diff --git a/.codacy.yml b/.codacy.yml
index a184e7151f..094f6deb22 100644
--- a/.codacy.yml
+++ b/.codacy.yml
@@ -14,7 +14,7 @@
 # IS NUL-terminated, and no core calls that overload at all -- every one of them uses
 # the two-iterator form.
 #
-# src/modules/{Bots,AhWorker} are deliberately absent: they are in-tree, they
+# src/modules/{Bots,AuctionHouseBot,AhService} are deliberately absent: they are in-tree, they
 # are ours, and they are analysed.
 exclude_paths:
   - "dep/**"
diff --git a/.github/workflows/core_windows_build.yml b/.github/workflows/core_windows_build.yml
index 222fc45f66..65657c74b3 100644
--- a/.github/workflows/core_windows_build.yml
+++ b/.github/workflows/core_windows_build.yml
@@ -14,8 +14,8 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  OPENSSL_VERSION: 3.6.4
-  OPENSSL_SHA512: 4FF8244287A027B1A138F4E1B56F425DD0988A6247830F1D7A47C179DCDB29A6A485490630647A7638569EC09D5B75FF4DC2B10ACFA41AFC4C68D7C21B44EC7F
+  OPENSSL_VERSION: 3.6.5
+  OPENSSL_SHA512: A7526344337A14EA270A1A7BDE590C4950CF08DCE631E9D485CCCDFCB14F737F42AFC73403656226B605A013D8E191BF831CEE34EEE6CDB810FFA4E0AEC53764
 
 jobs:
   build:
diff --git a/CLAUDE.md b/CLAUDE.md
index 3e796c801e..4ae83a2c0a 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -12,7 +12,8 @@ this repo. Humans: also read [`doc/CodingStandard.md`](doc/CodingStandard.md).
   `Rel##_##_###_*.sql` migrations that chain via `db_version`.
 - Clone/update **recursively**: `dep`, `src/realmd`, `src/modules/{SD3,Eluna}`, `src/tools/Extractor_projects`
   and `win` are submodules. Never shallow-update a submodule to a non-tip pinned SHA.
-- Less-obvious locations: out-of-process services in `src/ipc/` + `src/ah-service/`; scripting in
+- Less-obvious locations: auction modules in `src/modules/AuctionHouseBot/` and `src/modules/AhService/`
+  (registered through `src/game/Object/AuctionHouseModule.h`); scripting in
   `src/modules/` (Eluna = Lua, SD3 = C++, Bots = playerbots).
 
 ## Build & test
@@ -34,7 +35,7 @@ make -j"$(nproc)" && make install -j"$(nproc)"
 
 Windows: use the EasyBuild helper in `win/`. **A PR MUST keep CI green:** the Linux build compiles with
 **both** GCC and Clang, Windows builds on AppVeyor, and Codacy/CodeFactor gate quality. If you touch
-`src/ipc/` or `src/ah-service/`, keep `ah-service --selftest` passing (it must print `intent codec selftest OK`
+`src/modules/AhService/`, keep `ah-service --selftest` passing (it must print `intent codec selftest OK`
 and `ipc selftest OK`).
 
 ## Code style
@@ -56,9 +57,11 @@ Source of truth: [`doc/CodingStandard.md`](doc/CodingStandard.md). Non-default r
 
 ## Architecture note
 
-The **in-process AuctionHouseBot is the default**; the out-of-process AH service is additive and default-off
-(`AH.Service.Enabled`). `mangosd` is the **sole authority** over game state — worker/service "intents" are
-re-validated server-side before they are applied.
+Auction house extras are **modules**: the core knows only `AuctionHouseModule` and never names one. Each
+module is a CMake option (`BUILD_AHBOT`, default on; `BUILD_AH_SERVICE`, default off), brings its own
+`.conf` whose first key is `Enable`, and registers itself from a static object. The playerbots' ike3 AhBot
+(`src/modules/Bots/ahbot/`) is not built; `src/modules/Bots/AhBotPrices.cpp` answers its price queries. `mangosd.conf` stays module-agnostic. `mangosd` is the **sole authority** over game state —
+worker/service "intents" are re-validated server-side before they are applied.
 
 ## Review focus (for `@claude`)
 
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 1ea7e48c27..4e4360baa6 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -73,7 +73,8 @@ option(PCH                  "Enable precompiled headers"                    ON)
 option(WITH_IO_URING        "Use the io_uring network backend (Linux, needs liburing)" OFF)
 option(DEBUG                "Enable debug build (only on non IDEs)"         OFF)
 option(WITHOUT_GIT          "Disable Git revision detection"                OFF)
-option(BUILD_AH_SERVICE     "Build the out-of-process auction-house service" ON)
+option(BUILD_AHBOT          "Build the auction house bot module"            ON)
+option(BUILD_AH_SERVICE     "Build the out-of-process auction house service module" OFF)
 option(WITH_TESTS           "Build the unit tests"                          OFF)
 option(WITH_NET_TESTS       "Build the socket tests (slow; never in CI)"    OFF)
 #==================================================================================
@@ -99,6 +100,8 @@ message(
     SCRIPT_LIB_SD3          Compile with support for ScriptDev3 scripts
    Modules:
     PLAYERBOTS              Enable Player Bots
+    BUILD_AHBOT             Build the auction house bot module
+    BUILD_AH_SERVICE        Build the out-of-process auction house service module
 
   To set an option simply type -D<OPTION>=<VALUE> after 'cmake <srcs>'.
   Also, you can specify the generator with -G. See 'cmake --help' for more details
diff --git a/cmake/MangosParams.cmake b/cmake/MangosParams.cmake
index 8eb3566b12..af6a418cdd 100644
--- a/cmake/MangosParams.cmake
+++ b/cmake/MangosParams.cmake
@@ -1,5 +1,5 @@
 set(MANGOS_EXP "CLASSIC")
 set(MANGOS_PKG "Mangos Zero")
-set(MANGOS_WORLD_VER 2026082000)
+set(MANGOS_WORLD_VER 2026100200)
 set(MANGOS_REALM_VER 2026060300)
-set(MANGOS_AHBOT_VER 2026071400)
+set(MANGOS_AHBOT_VER 2026100200)
diff --git a/extra/doc/AuctionHouseBot.md b/extra/doc/AuctionHouseBot.md
index dd926b8d25..635aa51e08 100644
--- a/extra/doc/AuctionHouseBot.md
+++ b/extra/doc/AuctionHouseBot.md
@@ -6,6 +6,10 @@ on various configuration settings.
 
 Configuration
 -------------
+The bot is a module: it is built with `-DBUILD_AHBOT=1` (the default) and loaded
+when the first key of `ahbot.conf`, `Enable`, is 1. With `Enable = 0` the server
+runs without it, `.ahbot` commands included.
+
 Edit `ahbot.conf` to match your requirements. You can fine tune the amount of
 items, the pricing, the range of item quality, and many other settings.
 
@@ -21,330 +25,9 @@ The following rules apply when using the auction house bot:
 * the bot will not buy its own items, and will not receive mail from the AH or
   receive returned mails.
 
-The AH bot runs as a reserved *system* character named "AuctionHouse" (low-GUID
-0xFFFFFFFE) -- there is NO real character to create or maintain, and it
-regenerates automatically after a database wipe. The name is reserved from
-players and cannot be mailed. Do not create a real character named
-"AuctionHouse". To use a real character instead, set
-AuctionHouseBot.CharacterName to that character's name in ahbot.conf.
-
-Out-of-Process Run Mode (ah-service)
--------------------------------------
-The auction house bot can be run in one of two modes:
-
-**In-process (default):** The bot runs inside mangosd itself. This is the
-classic mode and requires no extra configuration. It is enabled as long as
-`AH.Service.Enabled = 0` in `mangosd.conf`.
-
-**Out-of-process service:** The bot runs as a separate `ah-service` child
-process. Set `AH.Service.Enabled = 1` in `mangosd.conf` to activate this
-mode. When the service is active, the in-process bot stands down automatically
-(dual-bot guard prevents double-posting). If the service crashes or loses its
-connection, the in-process bot resumes automatically until the service
-reconnects.
-
-Architecture
-~~~~~~~~~~~~
-The child process reads a market snapshot and item pool from the database, then
-emits *intents* (auction creation/cancellation proposals) to mangosd over a
-local TCP channel. mangosd re-validates every intent against live state before
-applying it and deduplicates by UUID (executor uuid-dedup), so the child never
-touches gold, items, or auctions directly. The channel uses a simple IPC
-framing protocol (proto v1); no DB credentials cross the wire.
-
-The ah-service console window is hidden by default on Windows. The `ah console
-show` and `ah console hide` commands, issued from the mangosd server console,
-toggle visibility at runtime.
-
-Security (trust model and least-privilege DB account)
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-The child process is **untrusted**. mangosd re-validates every intent against
-live state precisely because it does not trust the child; the child only ever
-*advises*. That trust boundary only holds for the IPC channel, however.
-
-The child's DB connections are described as "read-only", but that only means
-the child *issues* nothing but `SELECT` statements -- it is a property of the
-child's code, **not** an enforced credential restriction. The connection
-string in `WorldDatabaseInfo` / `CharacterDatabaseInfo` is an ordinary MySQL
-user/password. If you copy mangosd's full read/write credentials into it, a
-compromised or malfunctioning child could `INSERT`/`UPDATE`/`DELETE` auctions,
-characters, or gold **directly in the database**, completely bypassing the
-mangosd executor authority that the whole intent-re-validation design exists to
-provide.
-
-To make the adversarial model actually hold, provision a **dedicated
-least-privilege MySQL account** for the child with `SELECT`-only grants, and use
-it in `WorldDatabaseInfo` / `CharacterDatabaseInfo` instead of mangosd's
-credentials. With a SELECT-only account, a compromised child *cannot* write the
-DB at all: the only path left to it is the IPC channel, where mangosd validates
-everything. Without it, this least-privilege grant is the only thing standing
-between a compromised child and a direct-DB-write bypass of the executor.
-
-Example grants (run as a MySQL admin; adjust db names, host, and password to
-match your deployment). The child only needs to read the world tables the item
-pool and snapshot consult and the character `auction` / `characters` tables:
-
-```sql
-CREATE USER 'ahbot_ro'@'localhost' IDENTIFIED BY 'change-me';
-
--- Minimal: only the tables the child reads.
-GRANT SELECT ON `mangos0`.`item_template` TO 'ahbot_ro'@'localhost';
-GRANT SELECT ON `mangos0`.`npc_vendor`    TO 'ahbot_ro'@'localhost';
--- (plus any loot tables the seller filter consults, e.g.
---  creature_loot_template, etc.)
-GRANT SELECT ON `character0`.`auction`    TO 'ahbot_ro'@'localhost';
-GRANT SELECT ON `character0`.`characters` TO 'ahbot_ro'@'localhost';
-
--- Or, more simply, SELECT-only on the whole schemas:
-GRANT SELECT ON `mangos0`.*    TO 'ahbot_ro'@'localhost';
-GRANT SELECT ON `character0`.* TO 'ahbot_ro'@'localhost';
-
-FLUSH PRIVILEGES;
-```
-
-Then set, in `ah-service.conf`:
-
-```
-WorldDatabaseInfo     = "127.0.0.1;3306;ahbot_ro;change-me;mangos0"
-CharacterDatabaseInfo = "127.0.0.1;3306;ahbot_ro;change-me;character0"
-```
-
-mangosd.conf keys (service mode)
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-These keys are only active when `AH.Service.Enabled = 1`:
-
-* ``AH.Service.Enabled``       - Set to 1 to launch ah-service as a child
-  process instead of running the bot in-process. Default: 0.
-* ``AH.Service.Path``          - Path to the ah-service executable.
-* ``AH.Service.Port``          - TCP port for the IPC channel (default: 5760).
-* ``AH.Service.Secret``        - Shared secret used to authenticate the child
-  during the IPC handshake.
-* ``AH.Service.Config``        - Path to ah-service.conf passed to the child on
-  startup.
-* ``AH.Service.IntentTtlSec``  - How long (seconds) the executor retains UUID
-  records for deduplication. Default: 900.
-
-Player-auction custody escrow
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-Player auction custody is an in-process escrow ledger for player auction gold
-and items. It is independent of the out-of-process bot switch above:
-``AH.Service.Custody`` can remain off while ``AH.Service.Enabled`` is on, and
-can be enabled for player seams even when the bot still runs in-process.
-
-The relevant ``mangosd.conf`` keys are:
-
-* ``AH.Service.Custody`` - Default: 0. When 0, player auctions use today's
-  direct legacy path. When 1, only auctions that already carry custody ledger
-  rows use the custody path.
-* ``AH.Service.CustodyCrashAt`` - Default: empty. Test-only crash injection for
-  disposable realms. Values are ``pre-commit`` and ``pre-deferred``; never set
-  this on a live realm.
-
-The custody gate is per-auction. ``CustodyLedger::HasRows(auction_id)`` marks
-an auction as custody-managed, so existing pre-gate auctions and bot-created
-auctions with no custody rows continue through the legacy path. This lets a
-realm drain old auctions while the feature remains default-off and reversible.
-
-If reconciliation reports custody drift, use the server console command
-``ah repair``. It is console-only and scoped to custody-ledger drift; it does
-not repair legacy auction tears. The default form is dry-run. ``ah repair
-apply`` terminalizes supported orphan custody rows without disbursing gold or
-re-mailing items, which avoids minting value from a row whose live auction is
-gone. ``ah repair force-forfeit <idem_key>`` is the explicit escape hatch after
-manual verification; it terminalizes the named drift row without disbursement
-or item mail.
-
-Before enabling custody on a real realm, validate it first on a database clone
-and confirm ``ah repair`` reports zero drift after normal list, bid, buyout,
-cancel, and expire flows. Keep the setting default-off until the realm's live
-auction behavior has been observed cleanly.
-
-ah-service.conf keys
-~~~~~~~~~~~~~~~~~~~~~
-The child process uses its own configuration file (``ah-service.conf``):
-
-* ``WorldDatabaseInfo``             - Connection string for the world database.
-  Use a SELECT-only DB account here (see Security above), not mangosd's
-  credentials.
-* ``WorldDatabaseConnections``      - Number of world DB connections (the child
-  only issues SELECTs on them).
-* ``CharacterDatabaseInfo``         - Connection string for the character
-  database. Use a SELECT-only DB account here (see Security above).
-* ``CharacterDatabaseConnections``  - Number of character DB connections (the
-  child only issues SELECTs on them).
-
-Both databases must reside on the same MySQL server instance; the market
-snapshot uses a cross-database JOIN between the world and character schemas.
-The child's DB connections are **read-only by usage**: it only ever issues
-`SELECT` queries. That is a code-discipline guarantee, not an enforced
-credential restriction (see Security below).
-
-* ``AhBot.ConfigPath``              - Path to ``ahbot.conf`` (pricing, amounts,
-  quality ranges, and other tuning settings).
-* ``Console.ShowOnStartup``         - Set to 1 to show the ah-service console
-  window on startup (Windows only). Default: 0 (hidden).
-
-Out-of-process service - deployment & operational notes
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-**1. Use a dedicated bot character.**
-Point ``AuctionHouseBot.CharacterName`` at a character on a **separate account
-that you never log into**. The bot owns every auction it creates. If you log
-in as that character you inherit all of them in your Auctions tab, and the
-1.12 client's owner-items list is unpaginated -- hundreds of owned auctions
-in one house will crash the client (issue #132). Rule: never log into the bot
-character while the service (or the in-process bot) is active. Normal players
-are unaffected; the public browse list is paged.
-
-**2. Stock-target sizing.**
-The default ``AuctionHouseBot.Items.Amount.*`` targets (White 2000 / Green 2500
-/ Blue 1500 / Purple 1000, roughly 7 000 total, ~2 300 per faction house)
-populate a large auction house. Tune these down for low-population or
-development realms. The bot boost-fills toward the target then maintains it,
-so a first-run burst can be large if the house starts empty.
-
-**3. Performance and DB durability.**
-The mangosd executor applies each auction synchronously on the world thread
-(one character-DB transaction per auction -- the same mechanism the in-process
-bot uses). A large initial fill under the default MariaDB durability setting
-(``innodb_flush_log_at_trx_commit = 1``, one fsync per commit) can cause brief
-world-tick hitches during the burst. For development or test deployments,
-``innodb_flush_log_at_trx_commit = 2`` (commit to OS page cache) smooths this;
-a larger ``innodb_buffer_pool_size`` or SSD data directory also helps. In
-production, keep stock amounts moderate to avoid a large fill on first start.
-
-**4. Read-only DB account (child-side trust boundary).**
-The child process issues only ``SELECT`` statements. Provision it a dedicated
-least-privilege MySQL account with ``SELECT``-only grants (see the Security
-section above) rather than copying mangosd's full read/write credentials.
-With a ``SELECT``-only account a compromised or malfunctioning child cannot
-write the database at all -- the only path remaining is the IPC channel, where
-mangosd re-validates everything.
-
-GM commands under the service
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-The `ahbot` GM command set is extended when the service is running:
-
-* ``ahbot status``   - Displays live auction counts and executor statistics
-  (intents applied, rejected, and deduplicated).
-* ``ahbot reload``   - Live-reloads the child's tuning configuration (prices,
-  ratios, amounts, timers, and enable/disable toggles). Note: pool-affecting
-  filters (item level, quality, class, bind type, and include/exclude lists)
-  take effect only after a full service restart.
-* ``ahbot rebuild``  - Rebuilds the item pool, as in in-process mode.
-
-Custody repair command
-~~~~~~~~~~~~~~~~~~~~~~
-The ``ah repair`` command is available from the mangosd console for the player
-auction custody ledger. It reports custody drift by default, mutates only with
-``ah repair apply`` or ``ah repair force-forfeit <idem_key>``, and never mints
-gold or sends replacement item mail from an orphan row.
-
-### Worker AH browse path
-
-When the ah-service worker is connected and healthy, mangosd forwards AH browse
-/ owner-list / bidder-list requests to it over IPC (IPC_BROWSE_QUERY) and
-assembles the client reply from IPC_BROWSE_RESULT on a later world tick. The
-worker reproduces the full CanUseItem usable filter and full entry data
-(enchant/suffix/charges decoded from item_instance). On ENABLE_ELUNA builds the
-OnCanUseItem Lua hook is deferred to mangosd's world thread (the worker returns
-the un-paginated usable set; mangosd runs the hook + paginates). Player
-mutations (sell/bid/buyout/cancel) remain fully in-process.
-
-**Coordinator model (worker-mandatory reads).** Once an ah-service worker is the
-configured AH authority, mangosd holds no AH read state of its own. If the worker
-is down, times out, errors, or is overloaded (queue-full / oversize), mangosd
-returns **"AH temporarily unavailable"** — a center-screen notification flash plus
-a red system chat line, and an empty list on any in-flight browse so the client
-does not hang — and serves **nothing** in-process. While the worker is down the
-auction **window will not open** at all: the open path (auctioneer click, gossip
-option, `.auction` GM commands) is gated, so the player just gets the message. (A
-window already open when the worker dies stays open — 1.12 has no close-window
-opcode — and its next browse returns the unavailable reply.) A worker fault
-therefore degrades only the AH, never the realm. (If **no** worker is configured
-at all, the legacy single-process in-process AH is used as before.)
-Set `CharacterDatabaseConnections >= 2` in ah-service.conf so the browse thread's
-SELECTs do not serialize behind the bot snapshot.
-
-**Over-cap deferred-Eluna (decision #2).** On an `ENABLE_ELUNA` realm with an
-active `OnCanUseItem` veto, a single "usable"-filtered search that yields more
-than ~1000 matches cannot be veto-checked exactly out-of-process, so the worker
-**declines** it and mangosd returns "AH temporarily unavailable" rather than a
-short or mis-counted page. This is rare (needs both >1000 surviving matches and a
-bound Lua hook) and follows the coordinator's "correct-or-unavailable" contract —
-**expected, not a regression** — so do not treat it as a service failure.
-
-**Known limitation — Eluna `Player:SendAuctionMenu`.** The window-open gate lives
-in `WorldSession::SendAuctionHello`. A Lua script that calls
-`Player:SendAuctionMenu` builds `MSG_AUCTION_HELLO` directly and so bypasses that
-gate: while the worker is down the window opens, but its first browse returns the
-unavailable reply (an empty window). This affects only realms whose scripts call
-that API, and the fix would mean patching the third-party Eluna module, so it is
-left as a documented limitation.
-
-### Worker write-authority path
-
-`AH.Service.WriteAuthority` (in `mangosd.conf`, default `0`) hands the
-out-of-process worker authority over the auction book. When set, the worker is
-the **single writer** of the `auction` table: it inserts listings, applies
-player bids/buyouts/cancels, and runs the expiry/win tick, while mangosd forwards
-player mutations to it over the reliable IPC lane and applies the returned facts
-against the in-process custody escrow ledger.
-
-**Boot-latched flag.** The value is read once at startup (`LoadConfigSettings`
-only reads it when `!reload`), so `.reload config` can never toggle it mid-run --
-the process must be restarted to change it. This makes the "single book writer"
-invariant a per-boot property that no runtime reload can violate.
-
-**Hard requirement: `AH.Service.Custody = 1`.** The write path rides the custody
-escrow ledger (deposit/bid reservations, item escrow, seller payout netting).
-Enabling `WriteAuthority` with `Custody = 0` is unsupported.
-
-**Worker DB grant delta.** On top of the SELECT-only reader grants in *Security*
-above, a write-authority worker's DB account needs INSERT/UPDATE/DELETE on
-exactly two Character-DB tables. Journal retention also reads resolution
-idempotency markers from `custody_ledger`; it needs no custody write access:
-
-```sql
-GRANT INSERT, UPDATE, DELETE ON `character0`.`auction`           TO 'ahworker'@'localhost';
-GRANT INSERT, UPDATE, DELETE ON `character0`.`ah_worker_journal` TO 'ahworker'@'localhost';
-GRANT SELECT                 ON `character0`.`custody_ledger`    TO 'ahworker'@'localhost';
-```
-
-**Residual mangosd-side writers that stand down (spec section 5.7).** With
-`WriteAuthority = 1` these in-process auction writers no-op so there is exactly
-one book writer:
-
-* `AuctionHouseMgr::LoadAuctions` boot repair (item-template mismatch UPDATE,
-  missing-item / invalid-house row DELETE + return-mail) -- the worker's
-  `LoadFromDb` gates and reports instead.
-* `ObjectMgr::SetHighestGuids` auction-orphan `DELETE`.
-* `World::Update` `WUPDATE_AUCTIONS` in-process expiry sweep (`sAuctionMgr.Update`)
-  -- the worker runs the expiry/win tick; the returned-mail delivery still runs
-  in-process in both modes.
-* The in-process `AuctionHouseBot` startup (`sAuctionBot.Initialize`) -- the
-  worker's bot brain drives listings; the in-process buyer/seller stay null.
-
-Eluna AH hooks (`OnAdd` / `OnRemove`) still fire under write-authority: they are
-raised at the finalize position from the worker's facts on a synthesized
-transient `AuctionEntry`, so existing Lua AH scripts keep working.
-
-> **OPERATOR WARNING 1 -- do not `.reload config` Custody off while
-> WriteAuthority is on.** `WriteAuthority` is boot-latched but `Custody` is
-> reloadable. Reloading with `AH.Service.Custody = 0` while the worker still
-> holds write-authority bypasses the runtime custody invariant the write path
-> depends on and can corrupt in-flight escrow. If you must disable custody,
-> restart with `WriteAuthority = 0` as well.
-
-> **OPERATOR WARNING 2 -- apply the `ah_worker_journal` migration BEFORE enabling
-> WriteAuthority.** The worker records its committed mutations in
-> `ah_worker_journal`; the mangosd-side reconcile-on-reconnect reads it to decide
-> finalize-forward vs release. A missing table silently degrades reconcile to
-> "release", which can double-credit a mutation that actually committed. Verify
-> the migration is present first.
+The bot's auctions belong to the character named by
+AuctionHouseBot.CharacterName in ahbot.conf; left empty, they have no owner.
 
-Before enabling write-authority on a real realm, validate it first on a database
-clone with `AH.Service.WriteAuthority = 1` and `AH.Service.Custody = 1`. Exercise
-listing, bidding, outbidding, same-bidder buyout, seller cancel with an auction
-cut, expiry/win, worker reconnect, and mangosd restart. Then run `ah repair` and
-confirm it reports zero custody drift.
+The out-of-process auction house service is a separate module; see
+`src/modules/AhService/README.md`. The playerbots' own auction bot
+(`src/modules/Bots/ahbot/`) is not built.
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index e0e51ff85b..918d795e36 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -28,9 +28,6 @@ add_subdirectory(shared)
 
 add_subdirectory(proto)
 
-# IPC substrate (always built; ah-service and mangosd both link it)
-add_subdirectory(ipc)
-
 add_subdirectory(genrev)
 
 # Needs to link against mangos_world.lib
@@ -44,14 +41,8 @@ if(BUILD_MANGOSD)
     add_subdirectory(mangosd)
 endif()
 
-# The modules tree contains BOTH the game-linked scripts (SD3/Eluna, which
-# self-gate on SCRIPT_LIB_* AND require the `game` target) and the standalone
-# AhWorker (which links only ah_ipc + shared). Add it when EITHER mangosd or the
-# worker is being built; the SD3/Eluna add_subdirectory calls themselves stay
-# guarded so they never reference `game` when BUILD_MANGOSD is OFF.
-if(BUILD_MANGOSD OR BUILD_AH_SERVICE)
-    add_subdirectory(modules)
-endif()
+# Each module decides for itself whether it is built.
+add_subdirectory(modules)
 
 # Build the mangos realm authentication server
 if(BUILD_REALMD)
diff --git a/src/game/AuctionHouseBot/AhBotSystemOwner.h b/src/game/AuctionHouseBot/AhBotSystemOwner.h
deleted file mode 100644
index 40ca3701ce..0000000000
--- a/src/game/AuctionHouseBot/AhBotSystemOwner.h
+++ /dev/null
@@ -1,36 +0,0 @@
-#ifndef MANGOS_AHBOT_SYSTEM_OWNER_H
-#define MANGOS_AHBOT_SYSTEM_OWNER_H
-
-#include "Platform/Define.h"
-#include "ObjectGuid.h"  // ObjectGuid, HIGHGUID_PLAYER
-
-// Forged "system" owner for the out-of-process AH bot: a reserved player
-// low-GUID under this fixed name with NO characters row. See
-// Memory/Future_Work/AH_SubProcess/2026-06-29-ah-bot-forged-system-owner-design.md
-#define AHBOT_SYSTEM_OWNER_NAME "AuctionHouse"
-
-// Top of the uint32 player-GUID range, reserved as the AH bot's forged owner.
-// The player-GUID allocator's overflow guard (ObjectGuid.cpp: m_nextGuid >=
-// GetMaxCounter - 1 == 0xFFFFFFFE) trips AT this value, shuts the server down,
-// and returns the top-of-range GUID (GetMaxCounter, NOT this reserved one), so a
-// real character can never be branded with it. Reaching the boundary at all
-// would take ~4.29 billion player GUIDs, so it is effectively unreachable.
-static uint32 const AHBOT_SYSTEM_OWNER_GUID = 0xFFFFFFFE;
-
-/// True if @p guid is the AH bot's forged system owner.
-inline bool IsAhBotSystemOwnerGuid(ObjectGuid guid)
-{
-    return guid.IsPlayer() && guid.GetCounter() == AHBOT_SYSTEM_OWNER_GUID;
-}
-
-/// Defensive: if @p candidate is the reserved system GUID, step past it.
-inline uint32 SkipAhBotSystemOwnerGuid(uint32 candidate)
-{
-    if (candidate == AHBOT_SYSTEM_OWNER_GUID)
-    {
-        return candidate + 1;
-    }
-    return candidate;
-}
-
-#endif // MANGOS_AHBOT_SYSTEM_OWNER_H
diff --git a/src/game/CMakeLists.txt b/src/game/CMakeLists.txt
index 6843553215..b86b14d1d9 100644
--- a/src/game/CMakeLists.txt
+++ b/src/game/CMakeLists.txt
@@ -18,10 +18,6 @@
 # You should have received a copy of the GNU General Public License
 # along with this program. If not, see <https://www.gnu.org/licenses/>.
 
-#AH Bot group
-file(GLOB SRC_GRP_AHBOT AuctionHouseBot/*.cpp AuctionHouseBot/*.h)
-source_group("AhBot" FILES ${SRC_GRP_AHBOT})
-
 #Battlegrounds group
 file(GLOB SRC_GRP_BATTLEGROUND BattleGround/*.cpp BattleGround/*.h)
 source_group("BattleGround" FILES ${SRC_GRP_BATTLEGROUND})
@@ -103,12 +99,11 @@ if(PLAYERBOTS)
 #Base files
 file(GLOB Playerbot_Source ${CMAKE_SOURCE_DIR}/src/modules/Bots/playerbot/*.cpp ${CMAKE_SOURCE_DIR}/src/modules/Bots/playerbot/*.h)
 source_group("Player Bot" FILES ${Playerbot_Source})
-file(GLOB AHbot_Source ${CMAKE_SOURCE_DIR}/src/modules/Bots/ahbot/*.cpp ${CMAKE_SOURCE_DIR}/src/modules/Bots/ahbot/*.h)
-source_group("AH Bot" FILES ${AHbot_Source})
 
+# The ahbot/ AhBot is not built; the playerbots get its prices from here.
 set(SRC_GRP_BOTS
     ${Playerbot_Source}
-    ${AHbot_Source}
+    ${CMAKE_SOURCE_DIR}/src/modules/Bots/AhBotPrices.cpp
 )
 #Strategy files
 file(GLOB Playerbot_Strategy ${CMAKE_SOURCE_DIR}/src/modules/Bots/playerbot/strategy/*.cpp ${CMAKE_SOURCE_DIR}/src/modules/Bots/playerbot/strategy/*.h)
@@ -186,10 +181,7 @@ configure_file(${CMAKE_SOURCE_DIR}/src/modules/Bots/playerbot/aiplayerbot.conf.d
 
 endif()
 
-configure_file(AuctionHouseBot/ahbot.conf.dist.in ${CMAKE_CURRENT_BINARY_DIR}/AuctionHouseBot/ahbot.conf.dist)
-
 add_library(game STATIC
-    ${SRC_GRP_AHBOT}
     ${SRC_GRP_BATTLEGROUND}
     ${SRC_GRP_CHAT_COMMANDS}
     ${SRC_GRP_MAP_THREAD}
@@ -217,7 +209,6 @@ endif()
 target_include_directories(game
     PUBLIC
         ${CMAKE_CURRENT_SOURCE_DIR}
-        AuctionHouseBot
         BattleGround
         ChatCommands
         Maps
@@ -261,7 +252,6 @@ target_link_libraries(game
         geometry
         proto
         shared
-        ah_ipc
         RecastNavigation::Detour
         ZLIB::ZLIB
         $<$<BOOL:${SCRIPT_LIB_SD3}>:mangosscript>
@@ -275,11 +265,6 @@ if(PCH)
     add_cxx_pch(game pchdef.h pchdef.cpp)
 endif()
 
-install(
-    FILES ${CMAKE_CURRENT_BINARY_DIR}/AuctionHouseBot/ahbot.conf.dist
-    DESTINATION ${CONF_INSTALL_DIR}
-)
-
 if(SCRIPT_LIB_ELUNA)
 install(
     DIRECTORY ${CMAKE_SOURCE_DIR}/src/modules/Eluna/extensions
diff --git a/src/game/ChatCommands/AHBotCommands.cpp b/src/game/ChatCommands/AHBotCommands.cpp
deleted file mode 100644
index 1c0135d074..0000000000
--- a/src/game/ChatCommands/AHBotCommands.cpp
+++ /dev/null
@@ -1,344 +0,0 @@
-/**
- * SPDX-License-Identifier: GPL-3.0-or-later
- *
- * MaNGOS is a full featured server for World of Warcraft, supporting
- * the following clients: 1.12.x, 2.4.3, 3.3.5a, 4.3.4a and 5.4.8
- *
- * Copyright (C) 2005-2026 MaNGOS <https://www.getmangos.eu>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program. If not, see <https://www.gnu.org/licenses/>.
- *
- * World of Warcraft, and all World of Warcraft or Warcraft art, images,
- * and lore are copyrighted by Blizzard Entertainment, Inc.
- */
-
-/**
- * @file AHBotCommands.cpp
- * @brief Implementation of auction house bot management chat commands.
- *
- * This file contains chat command handlers for configuring and managing the
- * automated auction house bot system, including:
- * - Bot rebuild and reload operations
- * - Status information display
- * - Item amount configuration by quality
- * - Item distribution ratio settings
- */
-
-#include "Chat.h"
-#include "AuctionHouseBot/AuctionHouseBot.h"
-#include "AuctionHouseBot/AuctionIntentExecutor.h"
-#include "World.h"
-#include "WorkerSupervisor.h"
-#include "IpcMessage.h"
-#include "IpcOpcodes.h"
-#include "AuctionIntents.h"
-
-/**********************************************************************
- Useful constants definition
- **********************************************************************/
-
-static uint32 ahbotQualityIds[MAX_AUCTION_QUALITY] =
-{
-    LANG_AHBOT_QUALITY_GREY, LANG_AHBOT_QUALITY_WHITE,
-    LANG_AHBOT_QUALITY_GREEN, LANG_AHBOT_QUALITY_BLUE,
-    LANG_AHBOT_QUALITY_PURPLE, LANG_AHBOT_QUALITY_ORANGE,
-    LANG_AHBOT_QUALITY_YELLOW
-};
-
-/**
- * @brief Rebuilds the auction house bot's inventory.
- *
- * @param args Command arguments: optional "all" flag to rebuild all auction houses.
- * @returns True if the rebuild was initiated successfully, false otherwise.
- */
-bool ChatHandler::HandleAHBotRebuildCommand(char* args)
-{
-    bool all = false;
-    if (*args)
-    {
-        if (!ExtractLiteralArg(&args, "all"))
-        {
-            return false;
-        }
-        all = true;
-    }
-
-    sAuctionBot.Rebuild(all);
-    return true;
-}
-
-/**
- * @brief Reloads the auction house bot configuration.
- *
- * When the out-of-process AH service is active the mangosd-side config
- * (@c sAuctionBotConfig) is refreshed AND a GMCMD_RELOAD signal is
- * forwarded to the child so it reloads its own ahbot.conf tuning. The
- * child replies with IPC_GMCMD_RESULT; that result is logged by
- * World::HandleAhInbound (fire-and-forget, no per-GM reply correlation
- * in Phase 1).
- *
- * @param args Command arguments (not used).
- * @returns True if the reload was initiated, false on mangosd-side failure.
- */
-bool ChatHandler::HandleAHBotReloadCommand(char* /*args*/)
-{
-    WorkerSupervisor* sv = sWorld.GetAhSupervisor();
-    if (sv != NULL && sv->ServiceActive())
-    {
-        // Refresh the mangosd-side config (sAuctionBotConfig, bot GUID,
-        // etc.) and forward a reload signal to the child process.
-        sAuctionBot.ReloadAllConfig();
-
-        GmCmd gc;
-        gc.cmd = static_cast<uint8>(GMCMD_RELOAD);
-        IpcMessage m;
-        m.op = IPC_GMCMD;
-        gc.Encode(m.body);
-        sv->Channel().SendFrame(m);
-
-        SendSysMessage("AH bot config reloaded (mangosd); reload signal"
-                       " sent to AH service - result will be logged.");
-        return true;
-    }
-
-    // Service inactive: behave exactly as before.
-    if (sAuctionBot.ReloadAllConfig())
-    {
-        SendSysMessage(LANG_AHBOT_RELOAD_OK);
-        return true;
-    }
-    else
-    {
-        SendSysMessage(LANG_AHBOT_RELOAD_FAIL);
-        SetSentErrorMessage(true);
-        return false;
-    }
-}
-
-/**
- * @brief Displays the status of the auction house bot.
- *
- * @param args Command arguments: optional "all" flag for detailed status information.
- * @returns True if the status was displayed successfully, false otherwise.
- */
-bool ChatHandler::HandleAHBotStatusCommand(char* args)
-{
-    bool all = false;
-    if (*args)
-    {
-        if (!ExtractLiteralArg(&args, "all"))
-        {
-            return false;
-        }
-        all = true;
-    }
-
-    AuctionHouseBotStatusInfo statusInfo;
-    sAuctionBot.PrepareStatusInfos(statusInfo);
-
-    if (!m_session)
-    {
-        SendSysMessage(LANG_AHBOT_STATUS_BAR_CONSOLE);
-        SendSysMessage(LANG_AHBOT_STATUS_TITLE1_CONSOLE);
-        SendSysMessage(LANG_AHBOT_STATUS_MIDBAR_CONSOLE);
-    }
-    else
-    {
-        SendSysMessage(LANG_AHBOT_STATUS_TITLE1_CHAT);
-    }
-
-    uint32 fmtId = m_session ? LANG_AHBOT_STATUS_FORMAT_CHAT : LANG_AHBOT_STATUS_FORMAT_CONSOLE;
-
-    PSendSysMessage(fmtId, GetMangosString(LANG_AHBOT_STATUS_ITEM_COUNT),
-        statusInfo[AUCTION_HOUSE_ALLIANCE].ItemsCount,
-        statusInfo[AUCTION_HOUSE_HORDE].ItemsCount,
-        statusInfo[AUCTION_HOUSE_NEUTRAL].ItemsCount,
-        statusInfo[AUCTION_HOUSE_ALLIANCE].ItemsCount +
-        statusInfo[AUCTION_HOUSE_HORDE].ItemsCount +
-        statusInfo[AUCTION_HOUSE_NEUTRAL].ItemsCount);
-
-    if (all)
-    {
-        PSendSysMessage(fmtId, GetMangosString(LANG_AHBOT_STATUS_ITEM_RATIO),
-            sAuctionBotConfig.getConfig(CONFIG_UINT32_AHBOT_ALLIANCE_ITEM_AMOUNT_RATIO),
-            sAuctionBotConfig.getConfig(CONFIG_UINT32_AHBOT_HORDE_ITEM_AMOUNT_RATIO),
-            sAuctionBotConfig.getConfig(CONFIG_UINT32_AHBOT_NEUTRAL_ITEM_AMOUNT_RATIO),
-            sAuctionBotConfig.getConfig(CONFIG_UINT32_AHBOT_ALLIANCE_ITEM_AMOUNT_RATIO) +
-            sAuctionBotConfig.getConfig(CONFIG_UINT32_AHBOT_HORDE_ITEM_AMOUNT_RATIO) +
-            sAuctionBotConfig.getConfig(CONFIG_UINT32_AHBOT_NEUTRAL_ITEM_AMOUNT_RATIO));
-
-        if (!m_session)
-        {
-            SendSysMessage(LANG_AHBOT_STATUS_BAR_CONSOLE);
-            SendSysMessage(LANG_AHBOT_STATUS_TITLE2_CONSOLE);
-            SendSysMessage(LANG_AHBOT_STATUS_MIDBAR_CONSOLE);
-        }
-        else
-        {
-            SendSysMessage(LANG_AHBOT_STATUS_TITLE2_CHAT);
-        }
-
-        for (int i = 0; i < MAX_AUCTION_QUALITY; ++i)
-        {
-            PSendSysMessage(fmtId, GetMangosString(ahbotQualityIds[i]),
-                statusInfo[AUCTION_HOUSE_ALLIANCE].QualityInfo[i],
-                statusInfo[AUCTION_HOUSE_HORDE].QualityInfo[i],
-                statusInfo[AUCTION_HOUSE_NEUTRAL].QualityInfo[i],
-                sAuctionBotConfig.getConfigItemQualityAmount(AuctionQuality(i)));
-        }
-    }
-
-    if (!m_session)
-    {
-        SendSysMessage(LANG_AHBOT_STATUS_BAR_CONSOLE);
-    }
-
-    // --- AH subprocess service state + executor stats ---
-    WorkerSupervisor* sv = sWorld.GetAhSupervisor();
-    if (sv != NULL)
-    {
-        const char* svcState = sv->ServiceActive()
-            ? "active"
-            : "inactive (in-process bot running)";
-        PSendSysMessage("[AH service] state: %s", svcState);
-        PSendSysMessage("[AH service] executor: applied=%llu rejected=%llu"
-                        " duplicate=%llu malformed=%llu",
-                        sAuctionIntentExecutor.GetApplied(),
-                        sAuctionIntentExecutor.GetRejected(),
-                        sAuctionIntentExecutor.GetDuplicate(),
-                        sAuctionIntentExecutor.GetMalformed());
-    }
-
-    return true;
-}
-
-/**
- * @brief Sets the item amounts for all auction quality levels.
- *
- * @param args Command arguments: seven values for each quality level (grey, white, green, blue, purple, orange, yellow).
- * @returns True if the items amount was set successfully, false otherwise.
- */
-bool ChatHandler::HandleAHBotItemsAmountCommand(char* args)
-{
-    uint32 qVals[MAX_AUCTION_QUALITY];
-    for (int i = 0; i < MAX_AUCTION_QUALITY; ++i)
-    {
-        if (!ExtractUInt32(&args, qVals[i]))
-        {
-            return false;
-        }
-    }
-
-    sAuctionBot.SetItemsAmount(qVals);
-
-    for (int i = 0; i < MAX_AUCTION_QUALITY; ++i)
-    {
-        PSendSysMessage(LANG_AHBOT_ITEMS_AMOUNT, GetMangosString(ahbotQualityIds[i]), sAuctionBotConfig.getConfigItemQualityAmount(AuctionQuality(i)));
-    }
-
-    return true;
-}
-
-/**
- * @brief Template function to set item amount for a specific quality level.
- *
- * @tparam Q The auction quality level to configure.
- * @param args Command arguments: value for the specified quality level.
- * @returns True if the quality item amount was set successfully, false otherwise.
- */
-template<int Q>
-
-/**
- * @brief Handler for HandleAHBotItemsAmountQualityCommand command.
- *
- * @param args Command arguments.
- * @returns True if the command executed successfully, false otherwise.
- */
-bool ChatHandler::HandleAHBotItemsAmountQualityCommand(char* args)
-{
-    uint32 qVal;
-    if (!ExtractUInt32(&args, qVal))
-    {
-        return false;
-    }
-    sAuctionBot.SetItemsAmountForQuality(AuctionQuality(Q), qVal);
-    PSendSysMessage(LANG_AHBOT_ITEMS_AMOUNT, GetMangosString(ahbotQualityIds[Q]),
-        sAuctionBotConfig.getConfigItemQualityAmount(AuctionQuality(Q)));
-    return true;
-}
-
-template bool ChatHandler::HandleAHBotItemsAmountQualityCommand<AUCTION_QUALITY_GREY>(char*);
-template bool ChatHandler::HandleAHBotItemsAmountQualityCommand<AUCTION_QUALITY_WHITE>(char*);
-template bool ChatHandler::HandleAHBotItemsAmountQualityCommand<AUCTION_QUALITY_GREEN>(char*);
-template bool ChatHandler::HandleAHBotItemsAmountQualityCommand<AUCTION_QUALITY_BLUE>(char*);
-template bool ChatHandler::HandleAHBotItemsAmountQualityCommand<AUCTION_QUALITY_PURPLE>(char*);
-template bool ChatHandler::HandleAHBotItemsAmountQualityCommand<AUCTION_QUALITY_ORANGE>(char*);
-template bool ChatHandler::HandleAHBotItemsAmountQualityCommand<AUCTION_QUALITY_YELLOW>(char*);
-
-/**
- * @brief Sets the item distribution ratios for all auction houses.
- *
- * @param args Command arguments: three ratio values for alliance, horde, and neutral auction houses.
- * @returns True if the item ratios were set successfully, false otherwise.
- */
-bool ChatHandler::HandleAHBotItemsRatioCommand(char* args)
-{
-    uint32 rVal[MAX_AUCTION_HOUSE_TYPE];
-    for (int i = 0; i < MAX_AUCTION_HOUSE_TYPE; ++i)
-    {
-        if (!ExtractUInt32(&args, rVal[i]))
-        {
-            return false;
-        }
-    }
-
-    sAuctionBot.SetItemsRatio(rVal[0], rVal[1], rVal[2]);
-
-    for (int i = 0; i < MAX_AUCTION_HOUSE_TYPE; ++i)
-    {
-        PSendSysMessage(LANG_AHBOT_ITEMS_RATIO, AuctionBotConfig::GetHouseTypeName(AuctionHouseType(i)), sAuctionBotConfig.getConfigItemAmountRatio(AuctionHouseType(i)));
-    }
-    return true;
-}
-
-/**
- * @brief Template function to set item ratio for a specific auction house.
- *
- * @tparam H The auction house type to configure (alliance, horde, or neutral).
- * @param args Command arguments: ratio value for the specified auction house.
- * @returns True if the house item ratio was set successfully, false otherwise.
- */
-template<int H>
-
-/**
- * @brief Handler for HandleAHBotItemsRatioHouseCommand command.
- *
- * @param args Command arguments.
- * @returns True if the command executed successfully, false otherwise.
- */
-bool ChatHandler::HandleAHBotItemsRatioHouseCommand(char* args)
-{
-    uint32 rVal;
-    if (!ExtractUInt32(&args, rVal))
-    {
-        return false;
-    }
-    sAuctionBot.SetItemsRatioForHouse(AuctionHouseType(H), rVal);
-    PSendSysMessage(LANG_AHBOT_ITEMS_RATIO, AuctionBotConfig::GetHouseTypeName(AuctionHouseType(H)), sAuctionBotConfig.getConfigItemAmountRatio(AuctionHouseType(H)));
-    return true;
-}
-
-template bool ChatHandler::HandleAHBotItemsRatioHouseCommand<AUCTION_HOUSE_ALLIANCE>(char*);
-template bool ChatHandler::HandleAHBotItemsRatioHouseCommand<AUCTION_HOUSE_HORDE>(char*);
-template bool ChatHandler::HandleAHBotItemsRatioHouseCommand<AUCTION_HOUSE_NEUTRAL>(char*);
diff --git a/src/game/ChatCommands/AuctionHouseCommands.cpp b/src/game/ChatCommands/AuctionHouseCommands.cpp
index 39699275a7..b97c0fbe6b 100644
--- a/src/game/ChatCommands/AuctionHouseCommands.cpp
+++ b/src/game/ChatCommands/AuctionHouseCommands.cpp
@@ -37,7 +37,7 @@
 #include "Chat.h"
 #include "Language.h"
 #include "ObjectMgr.h"
-#include "World.h"
+#include "AuctionHouseModule.h"
 
 /**
  * @brief Opens the auction house interface for the player.
@@ -161,27 +161,9 @@ bool ChatHandler::HandleAuctionItemCommand(char* args)
         return false;
     }
 
-    // [SP-2] Under WriteAuthority the out-of-process AH worker is the SOLE
-    // writer of the shared `auction` book; mangosd must never insert an auction
-    // row directly (that would break the single-writer invariant and collide
-    // when the worker restarts). The worker only writes books in response to
-    // sells IT initiated (BotSellBegin -> materialize -> OnBotSellResult); there
-    // is no GM->worker listing-injection channel, so a manual `.auction item`
-    // cannot be safely materialized through the worker here. Refuse cleanly
-    // rather than mint an item the orphan sweep would later reap, or strand a
-    // half-written listing. (Default-off legacy path below is byte-identical.)
-    if (sWorld.IsAhWriteAuthority())
+    if (AuctionHouseModules::OwnsAuctionRows())
     {
-        if (sWorld.IsAhServiceConfigured())
-        {
-            SendSysMessage("The out-of-process AH worker owns the auction book;"
-                           " `.auction item` is unavailable in this mode. Bot"
-                           " listings are placed by the worker.");
-        }
-        else
-        {
-            SendSysMessage("Auction service unavailable.");
-        }
+        SendSysMessage("An auction module owns the auction table; `.auction item` is unavailable.");
         SetSentErrorMessage(true);
         return false;
     }
diff --git a/src/game/Object/AuctionHouseMgr.cpp b/src/game/Object/AuctionHouseMgr.cpp
index 3ad46e50de..d3ed830134 100644
--- a/src/game/Object/AuctionHouseMgr.cpp
+++ b/src/game/Object/AuctionHouseMgr.cpp
@@ -42,35 +42,15 @@
 #include "WorldPacket.h"
 #include "WorldSession.h"
 #include "Mail.h"
-#include "AuctionHouseBot/CustodyService.h"
-#include "AuctionHouseBot/CustodyLedger.h"
-#include "AuctionHouseBot/CustodyDeferred.h"
-#include "AuctionHouseBot/BrowsePending.h"
+#include "AuctionHouseModule.h"
 
 #include "Policies/Singleton.h"
 
-#include <string>
-#include <vector>
-
 /** \addtogroup auctionhouse
  * @{
  * \file
  */
 
-
-static void AuditCustodyReconcile(char const* phase)
-{
-    if (!sWorld.IsAhCustodyEnabled())
-    {
-        return;
-    }
-
-    CustodyReconcileReport report;
-    CustodyService::ReconcileScan(static_cast<uint64>(time(NULL)),
-                                  CUSTODY_SCAN_BOOT, report);
-    CustodyService::LogReconcileReport(phase, report);
-}
-
 /**
  * @brief Initializes the auction house manager.
  */
@@ -342,371 +322,11 @@ void AuctionHouseMgr::SendAuctionExpiredMail(AuctionEntry* auction)
     }
 }
 
-/**
- * @brief Custody co-commit variant of SendAuctionExpiredMail.
- *
- * Reproduces SendAuctionExpiredMail EXACTLY (owner-exists guard, expired subject,
- * item return to the seller by mail; destroy branch when the account is gone)
- * but co-commits the item return mail into the caller's already-open
- * CharacterDatabase transaction and flips the "item:<Id>" escrow row to
- * TERMINAL_OK. The online owner's SMSG_AUCTION_OWNER_NOTIFICATION (the "expired"
- * form, sold=false, bid/outbid/bidder all 0) is deferred into @p def BEFORE the
- * mail push so packet order stays notify-then-mail (legacy :307). RemoveAItem
- * (+ live item destroy on the no-owner branch) is deferred in legacy order (spec
- * S6 / C7). itemGuidLow is intentionally NOT zeroed on the custody path: success
- * deletes the AuctionEntry, and on rollback the original GUID must survive for
- * the next tick's re-resolution. Reads auction->owner/itemGuidLow, so the caller
- * MUST call this before mutating them (there is none in S6; expire deletes the
- * auction).
- *
- * @param auction The expired (no-bidder) auction entry.
- * @param def     Ordered deferred-effects queue for this co-commit.
- */
-void AuctionHouseMgr::SendAuctionExpiredMailInTransaction(AuctionEntry* auction, CustodyDeferred& def)
-{
-    // return an item in auction to its owner by mail
-    Item* pItem = GetAItem(auction->itemGuidLow);
-    if (!pItem)
-    {
-        sLog.outError("Auction item (GUID: %u) not found, and lost.", auction->itemGuidLow);
-        // The item is already absent from the live AH cache (legacy loses it too,
-        // sending nothing). Still terminalize the "item:<Id>" escrow row
-        // ledger-only: the caller (ExpireUnsoldCustody) deletes the auction
-        // UNCONDITIONALLY after this returns, so leaving the row CST_RESERVED
-        // would orphan a non-terminal custody row with no live auction (breaking
-        // the reconciliation invariant). Do NOT touch item_instance here -- legacy
-        // does not, and the DB row's state is unknown when the cache has drifted.
-        CustodyService::CommitGoldLedgerOnly("item:" + std::to_string(auction->Id));
-        return;
-    }
-
-    ObjectGuid owner_guid = ObjectGuid(HIGHGUID_PLAYER, auction->owner);
-    Player* owner = sObjectMgr.GetPlayer(owner_guid);
-
-    uint32 owner_accId = 0;
-    if (!owner)
-    {
-        owner_accId = sObjectMgr.GetPlayerAccountIdByGUID(owner_guid);
-    }
-
-    // Snapshot the item guid-low before any deferral; the deferred RemoveAItem
-    // closure must capture a stable value (the auction object itself is deleted
-    // by the trailing deferred closure on commit success).
-    uint32 const savedItemGuidLow = auction->itemGuidLow;
-
-    // owner exist
-    if (owner || owner_accId)
-    {
-        std::ostringstream subject;
-        subject << auction->itemTemplate << ":" << auction->itemRandomPropertyId << ":" << AUCTION_EXPIRED;
-
-        // Defer the online owner-expired notification, snapshotting every field
-        // BY VALUE (the auction is deleted in the same deferred run). Appended
-        // BEFORE the RemoveAItem and the mail push so packet order stays
-        // notify-then-mail (legacy :307). An unsold expiry carries bid==0,
-        // outbid==0, bidder==0 (the "expired" form, sold=false). Re-resolves the
-        // owner by GUID at run time, skipping the packet if offline -- the
-        // durable mail row is authoritative (spec I2).
-        if (owner)
-        {
-            uint32 ownerGuidLow = auction->owner;
-            uint32 houseId  = auction->GetHouseId();
-            uint32 aucId    = auction->Id;
-            uint32 itemTpl  = auction->itemTemplate;
-            int32  itemRand = auction->itemRandomPropertyId;
-            def.effects.push_back([ownerGuidLow, houseId, aucId, itemTpl, itemRand]()
-            {
-                Player* p = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, ownerGuidLow));
-                if (p)
-                {
-                    p->GetSession()->SendAuctionOwnerNotificationData(houseId, aucId, 0, 0, 0, itemTpl, itemRand, false);
-                }
-            });
-        }
-
-        // Defer RemoveAItem FIRST (legacy :310 ran before the mail;
-        // SendMailToInTransaction appends its own push AFTER this). Mirror S5
-        // cancel :979-982. Do NOT zero auction->itemGuidLow synchronously here:
-        // that in-memory write would survive a checked-commit rollback (the
-        // auction stays in the map with itemGuidLow==0, the next tick re-resolves
-        // to GetAItem(0)==NULL -> item lost, "item:" row orphaned). The auction is
-        // deleted by the trailing deferred closure on success, so the field never
-        // needs zeroing; on rollback it must stay valid for re-resolution. S4's
-        // SendAuctionWonMailInTransaction likewise never zeroes it.
-        def.effects.push_back([savedItemGuidLow]()
-        {
-            sAuctionMgr.RemoveAItem(savedItemGuidLow);
-        });
-
-        // Return the item via DeliverItem: flips "item:<Id>" -> TERMINAL_OK AND
-        // co-commits the return mail (queues the online owner's AddMItem
-        // disposal). An expiry return needs no item_instance.owner_guid UPDATE
-        // (the seller already owns the item). Mirror S5 cancel :984-987.
-        MailDraft itemReturn(subject.str(), "");
-        itemReturn.AddItem(pItem);
-        CustodyService::DeliverItem(def, "item:" + std::to_string(auction->Id), itemReturn,
-                                    MailReceiver(owner, owner_guid), MailSender(auction),
-                                    MAIL_CHECK_MASK_COPIED);
-    }
-    // owner not found (destroy)
-    else
-    {
-        // DELETE the item_instance row IN-TXN (appends to the caller's open txn).
-        CharacterDatabase.PExecute("DELETE FROM `item_instance` WHERE `guid`='%u'", savedItemGuidLow);
-
-        // Terminalize the escrow row: this branch sends no mail, so DeliverItem
-        // is NOT called and nothing else flips "item:". The §0 lesson -- without
-        // this the row stays CST_RESERVED after the auction row is deleted ->
-        // orphaned non-terminal row.
-        CustodyService::CommitGoldLedgerOnly("item:" + std::to_string(auction->Id));
-
-        // Defer RemoveAItem + the live `delete pItem` (X5: the destroy must run
-        // only after the checked commit succeeds, NOT inside the txn -- on
-        // rollback the row survives and so must the live Item*). Mirror
-        // SendAuctionWonMailInTransaction's destroy branch :534-548. As in the
-        // owner-exists branch, do NOT zero auction->itemGuidLow synchronously --
-        // it must survive a rollback for the next tick's re-resolution.
-        def.effects.push_back([savedItemGuidLow, pItem]()
-        {
-            sAuctionMgr.RemoveAItem(savedItemGuidLow);
-            delete pItem;
-        });
-    }
-}
-
-/**
- * @brief Custody co-commit variant of SendAuctionSuccessfulMail.
- *
- * Reproduces SendAuctionSuccessfulMail EXACTLY (owner-exists guard, subject/body,
- * profit = bid + deposit - cut) but co-commits the seller payout mail into the
- * caller's already-open CharacterDatabase transaction via SendMailToInTransaction.
- * If the owner is online, the SMSG_AUCTION_OWNER_NOTIFICATION (sold) is snapshotted
- * BY VALUE and appended to @p def BEFORE the mail's own push closure, preserving
- * the legacy notify-then-mail packet order. Reads auction->bid/bidder, so the
- * caller MUST call this before any bid/bidder mutation (spec B / S4).
- *
- * @param auction The auction being resolved.
- * @param def     Ordered deferred-effects queue for this co-commit.
- */
-void AuctionHouseMgr::SendAuctionSuccessfulMailInTransaction(AuctionEntry* auction, CustodyDeferred& def)
-{
-    ObjectGuid owner_guid = ObjectGuid(HIGHGUID_PLAYER, auction->owner);
-    Player* owner = sObjectMgr.GetPlayer(owner_guid);
-
-    uint32 owner_accId = 0;
-    if (!owner)
-    {
-        owner_accId = sObjectMgr.GetPlayerAccountIdByGUID(owner_guid);
-    }
-
-    // owner exist
-    if (owner || owner_accId)
-    {
-        std::ostringstream msgAuctionSuccessfulSubject;
-        msgAuctionSuccessfulSubject << auction->itemTemplate << ":" << auction->itemRandomPropertyId << ":" << AUCTION_SUCCESSFUL;
-
-        std::ostringstream auctionSuccessfulBody;
-        uint32 auctionCut = auction->GetAuctionCut();
-
-        auctionSuccessfulBody.width(16);
-        auctionSuccessfulBody << std::right << std::hex << auction->bidder;
-        auctionSuccessfulBody << std::dec << ":" << auction->bid << ":" << auction->buyout;
-        auctionSuccessfulBody << ":" << auction->deposit << ":" << auctionCut;
-
-        DEBUG_LOG("AuctionSuccessful body string : %s", auctionSuccessfulBody.str().c_str());
-
-        uint32 profit = auction->bid + auction->deposit - auctionCut;
-
-        // Defer the online owner-sold notification, snapshotting every field BY
-        // VALUE (the auction is deleted in the same deferred run). Appended BEFORE
-        // SendMailToInTransaction's own online push so packet order stays
-        // notify-then-mail (legacy :264). Captures the owner low GUID + scalars
-        // only and RE-RESOLVES the player by GUID at run time, skipping the packet
-        // if offline -- the durable mail row is authoritative (spec I2).
-        if (owner)
-        {
-            uint32 ownerGuidLow = auction->owner;
-            uint32 houseId  = auction->GetHouseId();
-            uint32 aucId    = auction->Id;
-            uint32 bidValue = auction->bid;
-            uint32 outbid   = auction->GetAuctionOutBid();
-            uint32 bidder   = auction->bidder;
-            uint32 itemTpl  = auction->itemTemplate;
-            int32  itemRand = auction->itemRandomPropertyId;
-            def.effects.push_back([ownerGuidLow, houseId, aucId, bidValue, outbid, bidder, itemTpl, itemRand]()
-            {
-                Player* p = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, ownerGuidLow));
-                if (p)
-                {
-                    p->GetSession()->SendAuctionOwnerNotificationData(houseId, aucId, bidValue, outbid, bidder, itemTpl, itemRand, true);
-                }
-            });
-        }
-
-        MailDraft(msgAuctionSuccessfulSubject.str(), auctionSuccessfulBody.str())
-            .SetMoney(profit)
-            .SendMailToInTransaction(MailReceiver(owner, owner_guid), MailSender(auction), def, MAIL_CHECK_MASK_COPIED);
-    }
-}
-
-/**
- * @brief Custody co-commit variant of SendAuctionWonMail.
- *
- * Reproduces SendAuctionWonMail EXACTLY (GM-log block, subject/body, owner UPDATE
- * vs destroy branches) but co-commits the winner item mail into the caller's
- * already-open CharacterDatabase transaction. On the receiver-exists branch the
- * item_instance owner UPDATE appends in-txn and the bidder notification +
- * RemoveAItem + itemGuidLow=0 are deferred in legacy order; on the no-receiver
- * branch the item_instance DELETE appends in-txn and RemoveAItem + itemGuidLow=0 +
- * the live `delete pItem` are deferred (X5: destroy outside the txn, run only on
- * commit success). Reads auction->bidder, so the caller MUST set it before calling
- * (spec C / S4).
- *
- * @param auction The auction being resolved.
- * @param def     Ordered deferred-effects queue for this co-commit.
- */
-void AuctionHouseMgr::SendAuctionWonMailInTransaction(AuctionEntry* auction, CustodyDeferred& def)
-{
-    Item* pItem = GetAItem(auction->itemGuidLow);
-    if (!pItem)
-    {
-        return;
-    }
-
-    ObjectGuid bidder_guid = ObjectGuid(HIGHGUID_PLAYER, auction->bidder);
-    Player* bidder = sObjectMgr.GetPlayer(bidder_guid);
-
-    uint32 bidder_accId = 0;
-
-    ObjectGuid ownerGuid = ObjectGuid(HIGHGUID_PLAYER, auction->owner);
-    // data for gm.log (kept identical to SendAuctionWonMail)
-    if (sWorld.getConfig(CONFIG_BOOL_GM_LOG_TRADE))
-    {
-        AccountTypes bidder_security;
-        std::string bidder_name;
-        if (bidder)
-        {
-            bidder_accId = bidder->GetSession()->GetAccountId();
-            bidder_security = bidder->GetSession()->GetSecurity();
-            bidder_name = bidder->GetName();
-        }
-        else
-        {
-            bidder_accId = sObjectMgr.GetPlayerAccountIdByGUID(bidder_guid);
-            bidder_security = bidder_accId ? sAccountMgr.GetSecurity(bidder_accId) : SEC_PLAYER;
-
-            if (bidder_security > SEC_PLAYER)               // not do redundant DB requests
-            {
-                if (!sObjectMgr.GetPlayerNameByGUID(bidder_guid, bidder_name))
-                {
-                    bidder_name = sObjectMgr.GetMangosStringForDBCLocale(LANG_UNKNOWN);
-                }
-            }
-        }
-
-        if (bidder_security > SEC_PLAYER)
-        {
-            std::string owner_name;
-            if (ownerGuid && !sObjectMgr.GetPlayerNameByGUID(ownerGuid, owner_name))
-            {
-                owner_name = sObjectMgr.GetMangosStringForDBCLocale(LANG_UNKNOWN);
-            }
-
-            uint32 owner_accid = sObjectMgr.GetPlayerAccountIdByGUID(ownerGuid);
-
-            sLog.outCommand(bidder_accId, "GM %s (Account: %u) won item in auction (Entry: %u Count: %u) and pay money: %u. Original owner %s (Account: %u)",
-                bidder_name.c_str(), bidder_accId, auction->itemTemplate, auction->itemCount, auction->bid, owner_name.c_str(), owner_accid);
-        }
-    }
-    else if (!bidder)
-    {
-        bidder_accId = sObjectMgr.GetPlayerAccountIdByGUID(bidder_guid);
-    }
-
-    // Snapshot the item guid-low before any deferral; the deferred RemoveAItem
-    // closure must capture a stable value (the auction object itself is deleted
-    // by the trailing deferred closure on commit success).
-    uint32 const savedItemGuidLow = auction->itemGuidLow;
-
-    // receiver exist
-    if (bidder || bidder_accId)
-    {
-        std::ostringstream msgAuctionWonSubject;
-        msgAuctionWonSubject << auction->itemTemplate << ":" << auction->itemRandomPropertyId << ":" << AUCTION_WON;
-
-        std::ostringstream msgAuctionWonBody;
-        msgAuctionWonBody.width(16);
-        msgAuctionWonBody << std::right << std::hex << auction->owner;
-        msgAuctionWonBody << std::dec << ":" << auction->bid << ":" << auction->buyout;
-        DEBUG_LOG("AuctionWon body string : %s", msgAuctionWonBody.str().c_str());
-
-        // set owner to bidder (to prevent delete item with sender char deleting)
-        // owner in `data` will set at mail receive and item extracting.
-        // Appends to the caller's OPEN transaction (no own Begin/Commit) (spec C).
-        CharacterDatabase.PExecute("UPDATE `item_instance` SET `owner_guid` = '%u' WHERE `guid`='%u'", auction->bidder, savedItemGuidLow);
-
-        // (1) Defer the online bidder-won notification, snapshotting every field BY
-        //     VALUE. Appended BEFORE the RemoveAItem and the mail push so packet
-        //     order = notify-then-mail (legacy :204). Re-resolves the bidder by
-        //     GUID at run time, skipping the packet if offline (spec I2).
-        if (bidder)
-        {
-            uint32 bidderGuidLow = auction->bidder;
-            uint32 houseId  = auction->GetHouseId();
-            uint32 aucId    = auction->Id;
-            uint32 bidValue = auction->bid;
-            uint32 outbid   = auction->GetAuctionOutBid();
-            uint32 itemTpl  = auction->itemTemplate;
-            int32  itemRand = auction->itemRandomPropertyId;
-            def.effects.push_back([bidderGuidLow, houseId, aucId, bidValue, outbid, itemTpl, itemRand]()
-            {
-                Player* p = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, bidderGuidLow));
-                if (p)
-                {
-                    p->GetSession()->SendAuctionBidderNotificationData(houseId, aucId, bidderGuidLow, bidValue, outbid, itemTpl, itemRand, true);
-                }
-            });
-        }
-
-        // (2) Defer RemoveAItem (legacy :207-208 ran before the mail;
-        //     SendMailToInTransaction appends its own push AFTER this).
-        def.effects.push_back([savedItemGuidLow]()
-        {
-            sAuctionMgr.RemoveAItem(savedItemGuidLow);
-        });
-
-        // (3) Co-commit the winner mail; its online push closure is appended AFTER
-        //     (1)+(2), matching legacy notify -> RemoveAItem -> mail order.
-        MailDraft(msgAuctionWonSubject.str(), msgAuctionWonBody.str())
-            .AddItem(pItem)
-            .SendMailToInTransaction(MailReceiver(bidder, bidder_guid), MailSender(auction), def, MAIL_CHECK_MASK_COPIED);
-    }
-    // receiver not exist (destroy)
-    else
-    {
-        // DELETE the item_instance row IN-TXN (appends to the caller's open txn).
-        CharacterDatabase.PExecute("DELETE FROM `item_instance` WHERE `guid`='%u'", savedItemGuidLow);
-
-        // Defer RemoveAItem + the live `delete pItem` (X5: the destroy must run
-        // only after the checked commit succeeds, NOT inside the txn -- on
-        // rollback the row survives and so must the live Item*).
-        def.effects.push_back([savedItemGuidLow, pItem]()
-        {
-            sAuctionMgr.RemoveAItem(savedItemGuidLow);
-            delete pItem;
-        });
-    }
-}
-
 /**
  * @brief Loads auction items from the database into memory.
  */
 void AuctionHouseMgr::LoadAuctionItems()
 {
-    // V6/D9: build the recipe cast->taught map NOW (before the empty-AH early
-    // return so it is always populated, even on a fresh/empty AH).
-    AhEnsureRecipeCastMap();
-
     // data needs to be at first place for Item::LoadFromDB 0  1        2
     QueryResult* result = CharacterDatabase.Query("SELECT `data`,`itemguid`,`item_template` FROM `auction` JOIN `item_instance` ON `itemguid` = `guid`");
 
@@ -769,7 +389,6 @@ void AuctionHouseMgr::LoadAuctions()
         bar.step();
         sLog.outString();
         sLog.outString(">> Loaded 0 auctions. DB table `auction` is empty.");
-        AuditCustodyReconcile("boot");
         return;
     }
 
@@ -783,7 +402,6 @@ void AuctionHouseMgr::LoadAuctions()
         bar.step();
         sLog.outString();
         sLog.outString(">> Loaded 0 auctions. DB table `auction` is empty.");
-        AuditCustodyReconcile("boot");
         return;
     }
 
@@ -800,6 +418,8 @@ void AuctionHouseMgr::LoadAuctions()
 
     BarGoLink bar(AuctionCount);
 
+    bool const repairRows = !AuctionHouseModules::OwnsAuctionRows();
+
     do
     {
         fields = result->Fetch();
@@ -828,11 +448,7 @@ void AuctionHouseMgr::LoadAuctions()
         Item* pItem = GetAItem(auction->itemGuidLow);
         if (!pItem)
         {
-            // [SP-2 spec 5.7] Under WriteAuthority the worker owns the auction
-            // book: its LoadFromDb gates + reports orphaned rows. mangosd must
-            // not also delete the row (double-writer). Skip the row in-memory
-            // either way; only the durable repair write is gated.
-            if (!sWorld.IsAhWriteAuthority())
+            if (repairRows)
             {
                 auction->DeleteFromDB();
             }
@@ -850,10 +466,7 @@ void AuctionHouseMgr::LoadAuctions()
             auction->itemCount    = pItem->GetCount();
             auction->itemRandomPropertyId = pItem->GetItemRandomPropertyId();
 
-            // [SP-2 spec 5.7] In-memory correction always applies (the local map
-            // must be self-consistent); the durable book repair is the worker's
-            // under WriteAuthority, so mangosd must not also rewrite the row.
-            if (!sWorld.IsAhWriteAuthority())
+            if (repairRows)
             {
                 // No SQL injection (no strings)
                 CharacterDatabase.PExecute("UPDATE `auction` SET `item_template` = %u, "
@@ -870,12 +483,7 @@ void AuctionHouseMgr::LoadAuctions()
             // need for send mail, use goblin auctionhouse
             auction->auctionHouseEntry = sAuctionHouseStore.LookupEntry(7);
 
-            // [SP-2 spec 5.7] Under WriteAuthority the worker owns auction-row
-            // lifecycle: it returns the item + deletes the invalid-house row via
-            // its own LoadFromDb repair. mangosd must not also mail the item back
-            // and delete the row (double-credit / double-writer). The row is
-            // dropped from the in-memory map either way (delete + continue).
-            if (!sWorld.IsAhWriteAuthority())
+            if (repairRows)
             {
                 // Attempt send item back to owner
                 std::ostringstream msgAuctionCanceledOwner;
@@ -907,7 +515,6 @@ void AuctionHouseMgr::LoadAuctions()
     delete result;
 
     sLog.outString(">> Loaded %u auctions", AuctionCount);
-    AuditCustodyReconcile("boot");
     sLog.outString();
 }
 
@@ -1061,109 +668,36 @@ void AuctionHouseObject::Update()
         AuctionEntryMap::iterator old = itr++;
         if (curTime > old->second->expireTime)
         {
-            // Runtime disable stops config-gated custody entry and maintenance,
-            // not settlement of value already represented by durable rows.
-            CustodyRouteState const route =
-                CustodyLedger::GetRouteState(old->second->Id);
-            if (!route.known)
+            AuctionExpiry expiry = AUCTION_EXPIRY_CORE;
+            AuctionHouseModules::Answer([&](AuctionHouseModule& module)
+            {
+                expiry = module.Expire(*this, *old->second);
+                return expiry != AUCTION_EXPIRY_CORE;
+            });
+            if (expiry == AUCTION_EXPIRY_STOP)
             {
-                sLog.outError("custody route unavailable; deferring auction expiry");
                 return;
             }
+            if (expiry == AUCTION_EXPIRY_DONE)
+            {
+                continue;
+            }
 
             ///- perform the transaction if there was bidder
             if (old->second->bid)
             {
-                // Seller and bid custody are independent. A worker/bot listing
-                // can carry only a player bid row; a player listing can still
-                // carry a legacy bid with no bid row.
-                // `old = itr++` already advanced the iterator, so the deferred
-                // RemoveAuction(Id) erase of `old`'s slot does NOT invalidate itr.
-                if (route.usesPlayerSellerCustody || route.hasLiveBidCustody)
-                {
-                    std::string liveBidKey;
-                    if (route.hasLiveBidCustody)
-                    {
-                        CustodyRow liveRow;
-                        if (old->second->bidder == 0 ||
-                            !CustodyLedger::GetSingleLiveBidRow(old->second->Id, liveRow) ||
-                            liveRow.ownerGuid != old->second->bidder ||
-                            liveRow.amount != old->second->bid)
-                        {
-                            sLog.outError("custody S4: live bid row validation failed for auction %u "
-                                          "(bidder %u, bid %u); failing closed",
-                                          old->second->Id, old->second->bidder,
-                                          old->second->bid);
-                            continue;
-                        }
-                        liveBidKey = liveRow.idemKey;
-                    }
-
-                    CustodyDeferred def;
-                    CharacterDatabase.BeginTransaction();
-                    old->second->AuctionBidWinningCustody(
-                        NULL, def, route.usesPlayerSellerCustody,
-                        route.hasLiveBidCustody, liveBidKey);
-                    CustodyService::MaybeCrash("pre-commit");
-                    if (CharacterDatabase.CommitTransactionChecked())
-                    {
-                        CustodyService::MaybeCrash("pre-deferred");
-                        def.run();
-                    }
-                    else
-                    {
-                        // S4 mutates NO live state before the checked commit (every
-                        // in-memory effect is deferred and does not run on rollback),
-                        // so there is nothing to restore: the auction/object survive
-                        // intact, the custody item stays in mAitems, and the next
-                        // tick re-resolves cleanly with a valid GetAItem pointer.
-                        sLog.outError("custody S4: win txn rolled back for auction %u", old->second->Id);
-                    }
-                }
-                else
-                {
-                    old->second->AuctionBidWinning();
-                }
+                old->second->AuctionBidWinning();
             }
             ///- cancel the auction if there was no bidder and clear the auction
-            else   // no bidder -> unsold expiry
+            else
             {
-                // Unsold expiry has no bid value to settle, so only player
-                // seller custody selects the custody transaction.
-                // `old = itr++` already advanced the iterator, so the deferred
-                // RemoveAuction(Id) erase of `old`'s slot does NOT invalidate itr
-                // (same reasoning as the win-branch comment at :887-889).
-                if (route.usesPlayerSellerCustody)
-                {
-                    CustodyDeferred def;
-                    CharacterDatabase.BeginTransaction();
-                    old->second->ExpireUnsoldCustody(def);
-                    CustodyService::MaybeCrash("pre-commit");
-                    if (CharacterDatabase.CommitTransactionChecked())
-                    {
-                        CustodyService::MaybeCrash("pre-deferred");
-                        def.run();
-                    }
-                    else
-                    {
-                        // S6 makes NO synchronous in-memory mutation (every
-                        // effect is deferred and does not run on rollback), so
-                        // there is nothing to restore: the auction + item
-                        // survive intact and the next tick re-resolves cleanly
-                        // with a valid GetAItem pointer.
-                        sLog.outError("custody S6: expire txn rolled back for auction %u", old->second->Id);
-                    }
-                }
-                else
-                {
-                    sAuctionMgr.SendAuctionExpiredMail(old->second);
+                sAuctionMgr.SendAuctionExpiredMail(old->second);
 
-                    old->second->DeleteFromDB();
-                    sAuctionMgr.RemoveAItem(old->second->itemGuidLow);
-                    delete old->second;
-                    AuctionsMap.erase(old);
-                    continue;
-                }
+                old->second->DeleteFromDB();
+                sAuctionMgr.RemoveAItem(old->second->itemGuidLow);
+                delete old->second;
+                AuctionsMap.erase(old);
+                continue;
             }
         }
     }
@@ -1316,85 +850,6 @@ void AuctionHouseObject::BuildListAuctionItems(WorldPacket& data, Player* player
     }
 }
 
-/**
- * @brief Dispatcher for the in-process browse fallback (C1/I1).
- *
- * Routes to one of the three existing BuildList* methods based on @p kind:
- *   0 (or default) = LIST public browse  -> BuildListAuctionItems
- *   1              = OWNER               -> BuildListOwnerItems
- *   2              = BIDDER              -> client-outbid prepend + BuildListBidderItems
- *
- * For BIDDER the @p clientOutbidIds entries from the stored request are
- * prepended in CLIENT ORDER ahead of the sweep, matching the live handler's
- * behaviour in HandleAuctionListBidderItems.  The three inner builders are
- * completely unchanged; this is a thin dispatcher only.
- *
- * @param kind           Browse kind: 0=LIST, 1=OWNER, 2=BIDDER.
- * @param data           Packet buffer to append auction entries to.
- * @param player         The resolving player (re-resolved by Task-11 fallback).
- * @param wname          Name search filter (LIST only).
- * @param listfrom       Starting offset (LIST only).
- * @param levelmin       Min required-level filter (LIST only).
- * @param levelmax       Max required-level filter (LIST only).
- * @param usable         Usability filter (LIST only).
- * @param invType        Inventory-type filter (LIST only).
- * @param itemClass      Item-class filter (LIST only).
- * @param itemSubClass   Item-subclass filter (LIST only).
- * @param quality        Minimum quality filter (LIST only).
- * @param clientOutbidIds Client-supplied outbid auction ids (BIDDER only).
- * @param count          Receives appended-entry count.
- * @param totalcount     Receives total matching count.
- */
-void AuctionHouseObject::BuildListForKind(uint8 kind, WorldPacket& data, Player* player,
-    const std::wstring& wname, uint32 listfrom, uint32 levelmin, uint32 levelmax,
-    uint32 usable, uint32 invType, uint32 itemClass, uint32 itemSubClass,
-    uint32 quality, const std::vector<uint32>& clientOutbidIds,
-    uint32& count, uint32& totalcount)
-{
-    switch (kind)
-    {
-        case 1: // BROWSE_OWNER
-            BuildListOwnerItems(data, player, count, totalcount);
-            break;
-        case 2: // BROWSE_BIDDER
-        {
-            // Client outbid ids prepended in CLIENT ORDER (matches the live handler).
-            for (size_t i = 0; i < clientOutbidIds.size(); ++i)
-            {
-                AuctionEntry* a = GetAuction(clientOutbidIds[i]);
-                if (a && a->BuildAuctionInfo(data))
-                {
-                    ++totalcount;
-                    ++count;
-                }
-            }
-            BuildListBidderItems(data, player, count, totalcount);
-            break;
-        }
-        case 0: // BROWSE_LIST
-        default:
-            BuildListAuctionItems(data, player, wname, listfrom, levelmin, levelmax,
-                usable, invType, itemClass, itemSubClass, quality, count, totalcount);
-            break;
-    }
-}
-
-/**
- * @brief Test seam for the client-outbid-prepend order contract.
- *
- * Records the ids from @p clientIds into @p outOrder in CLIENT ORDER, locking
- * the invariant that BuildListForKind(BIDDER=2) prepends them before the sweep.
- * Called only by the -t ahbrowsehelper smoke test.
- */
-void AhAppendClientOutbidsForTest(const std::vector<uint32>& clientIds,
-                                  std::vector<uint32>& outOrder)
-{
-    for (size_t i = 0; i < clientIds.size(); ++i)
-    {
-        outOrder.push_back(clientIds[i]);
-    }
-}
-
 /**
  * @brief Creates and stores a new auction from a player's item.
  *
@@ -1405,14 +860,9 @@ void AhAppendClientOutbidsForTest(const std::vector<uint32>& clientIds,
  * @param buyout The buyout price.
  * @param deposit The deposit amount.
  * @param pl The player creating the auction.
- * @param ownTransaction When true (default, all legacy callers) the four DB
- *        writes are wrapped in this method's own Begin/CommitTransaction.  When
- *        false the caller has already opened a transaction and the writes
- *        auto-append to it (custody co-commit seam, spec S1); the in-memory
- *        parts run identically in both cases.
  * @return Pointer to the created auction entry.
  */
-AuctionEntry* AuctionHouseObject::AddAuction(AuctionHouseEntry const* auctionHouseEntry, Item* newItem, uint32 etime, uint32 bid, uint32 buyout, uint32 deposit, Player* pl /*= NULL*/, bool ownTransaction /*= true*/)
+AuctionEntry* AuctionHouseObject::AddAuction(AuctionHouseEntry const* auctionHouseEntry, Item* newItem, uint32 etime, uint32 bid, uint32 buyout, uint32 deposit, Player* pl /*= NULL*/)
 {
     uint32 auction_time = uint32(etime * sWorld.getConfig(CONFIG_FLOAT_RATE_AUCTION_TIME));
 
@@ -1440,10 +890,7 @@ AuctionEntry* AuctionHouseObject::AddAuction(AuctionHouseEntry const* auctionHou
         pl->MoveItemFromInventory(newItem->GetBagSlot(), newItem->GetSlot(), true);
     }
 
-    if (ownTransaction)
-    {
-        CharacterDatabase.BeginTransaction();
-    }
+    CharacterDatabase.BeginTransaction();
 
     if (pl)
     {
@@ -1458,10 +905,7 @@ AuctionEntry* AuctionHouseObject::AddAuction(AuctionHouseEntry const* auctionHou
         pl->SaveInventoryAndGoldToDB();
     }
 
-    if (ownTransaction)
-    {
-        CharacterDatabase.CommitTransaction();
-    }
+    CharacterDatabase.CommitTransaction();
 
     return AH;
 }
@@ -1612,239 +1056,24 @@ void AuctionEntry::AuctionBidWinning(Player* newbidder)
     delete this;
 }
 
-/**
- * @brief Custody co-commit mirror of AuctionBidWinning (orchestrator, spec S4).
- *
- * Appends every DB write to the caller's ALREADY-OPEN CharacterDatabase
- * transaction and defers every in-memory effect into @p def; the caller
- * checked-commits then runs @p def. The deferred-effect order matches the legacy
- * resolution: owner-notify -> seller-mail -> bidder-notify -> winner-mail
- * (rendered by the two co-commit mail cores), then -- pushed LAST -- the AH map
- * RemoveAuction + `delete this`, so the in-memory auction survives until the very
- * end of def.run() (earlier closures that read auction fields snapshot by value).
- *
- * The seller payout and winner item delivery always retain legacy behavior.
- * Seller item/deposit rows and the bidder row are terminalized independently,
- * according to the route facts validated by the caller.
- *
- * Gold note: do NOT re-save newbidder's gold here. On a buyout it was already
- * saved by ReserveGold/TopUpBid in UpdateBidCustody; on the expiry path newbidder
- * is NULL.
- *
- * @param newbidder The online winner (buyout) or NULL (expiry).
- * @param def       Ordered deferred-effects queue for this co-commit.
- */
-void AuctionEntry::AuctionBidWinningCustody(Player* newbidder, CustodyDeferred& def,
-                                           bool usesPlayerSellerCustody,
-                                           bool hasLiveBidCustody,
-                                           std::string const& knownBidKey)
-{
-    // (void) newbidder: its gold is already persisted by the bid seam (buyout) or
-    // it is NULL (expiry); the auction UPDATE/DELETE persists the rest.
-    (void)newbidder;
-
-    // 1) Seller payout = bid + deposit - cut (single legacy mail; owner-notify
-    //    deferred BEFORE the mail push by the co-commit core).
-    sAuctionMgr.SendAuctionSuccessfulMailInTransaction(this, def);
-
-    // 2) Net player-seller custody only. The seller mail above already carries
-    //    the deposit return and proceeds, so these are ledger-only transitions.
-    if (usesPlayerSellerCustody)
-    {
-        CustodyService::RollbackGoldLedgerOnly("dep:" + std::to_string(Id));
-    }
-
-    // The caller either validated this existing key before BeginTransaction or
-    // created it in this same transaction while processing a buyout.
-    if (hasLiveBidCustody)
-    {
-        CustodyService::CommitGoldLedgerOnly(knownBidKey);
-    }
-
-    // 3) Item to winner (receiver-exists owner UPDATE) or destroy (bidder == 0 ->
-    //    account lookup fails -> destroy branch). Bidder-notify + RemoveAItem +
-    //    (destroy: delete pItem) are deferred by the co-commit core.
-    sAuctionMgr.SendAuctionWonMailInTransaction(this, def);
-
-    if (usesPlayerSellerCustody)
-    {
-        CustodyService::CommitGoldLedgerOnly("item:" + std::to_string(Id));
-    }
-
-    // 4) Delete the auction row IN-TXN (appends to the caller's open transaction).
-    this->DeleteFromDB();
-
-    // 5) Defer the AH-map erase + object delete LAST, so `this` stays valid for
-    //    every earlier deferred closure throughout def.run(). Snapshot the map
-    //    pointer + Id by value (the closure must not read `this` after delete).
-    AuctionHouseObject* houseMap = sAuctionMgr.GetAuctionsMap(this->auctionHouseEntry);
-    uint32 const aucId = this->Id;
-    AuctionEntry* self = this;
-    def.effects.push_back([houseMap, aucId, self]()
-    {
-        houseMap->RemoveAuction(aucId);
-        delete self;
-    });
-}
-
-/**
- * @brief Custody co-commit mirror of the unsold-expiry path (spec S6).
- *
- * The no-bidder expiry branch of AuctionHouseObject::Update() routes here when
- * the auction carries live custody rows. Returns the item to the seller by mail
- * (or destroys it if the account is gone), forfeits the deposit to the house,
- * deletes the auction row, and defers every in-memory effect (owner-expired
- * notification, mail push, RemoveAItem, RemoveAuction, delete this) into @p def.
- * Every DB write appends to the caller's ALREADY-OPEN CharacterDatabase
- * transaction; the caller checked-commits it then runs @p def (spec Sec 6 S6).
- * S6 makes NO synchronous in-memory mutation (every effect is deferred), so on
- * rollback there is nothing to restore -- the auction + item survive intact and
- * the next tick re-resolves cleanly.
- */
-void AuctionEntry::ExpireUnsoldCustody(CustodyDeferred& def)
-{
-    // 1) Return the item to the seller (or destroy if the account is gone) +
-    //    flip the "item:<Id>" escrow row, all co-committed; the online owner's
-    //    expired notification + RemoveAItem are deferred by the co-commit core.
-    sAuctionMgr.SendAuctionExpiredMailInTransaction(this, def);
-
-    // 2) Deposit FORFEIT to the house on an unsold expiry (legacy keeps it):
-    //    flip "dep:<Id>" -> TERMINAL_OK ledger-only (house sink, no money, no
-    //    mail). Mirror S5 cancel's deposit forfeit.
-    CustodyService::CommitGoldLedgerOnly("dep:" + std::to_string(Id));
-
-    // 3) Delete the auction row IN-TXN (appends to the caller's open transaction).
-    this->DeleteFromDB();
-
-    // 4) Defer the AH-map erase + object delete LAST, so `this` stays valid for
-    //    every earlier deferred closure throughout def.run(). Snapshot the map
-    //    pointer + Id by value (the closure must not read `this` after delete).
-    //    Mirror AuctionBidWinningCustody :1373-1380.
-    AuctionHouseObject* houseMap = sAuctionMgr.GetAuctionsMap(this->auctionHouseEntry);
-    uint32 const aucId = this->Id;
-    AuctionEntry* self = this;
-    def.effects.push_back([houseMap, aucId, self]()
-    {
-        houseMap->RemoveAuction(aucId);
-        delete self;
-    });
-}
-
-void AuctionEntry::PrepareCancelCustody(Player* seller, CustodyDeferred& def,
-                                        bool usesPlayerSellerCustody,
-                                        bool hasLiveBidCustody,
-                                        std::string const& liveBidKey,
-                                        uint32 auctionCut)
-{
-    if (bid)
-    {
-        seller->ModifyMoney(-int32(auctionCut));
-    }
-
-    if (bidder != 0)
-    {
-        if (hasLiveBidCustody)
-        {
-            CustodyService::RollbackGoldLedgerOnly(liveBidKey);
-        }
-        WorldSession::SendAuctionCancelledToBidderMailInTransaction(this, def);
-    }
-
-    if (usesPlayerSellerCustody)
-    {
-        CustodyService::CommitGoldLedgerOnly("dep:" + std::to_string(Id));
-    }
-
-    Item* item = sAuctionMgr.GetAItem(itemGuidLow);
-    MANGOS_ASSERT(item);
-    uint32 const savedItemGuidLow = itemGuidLow;
-    def.effects.push_back([savedItemGuidLow]()
-    {
-        sAuctionMgr.RemoveAItem(savedItemGuidLow);
-    });
-
-    std::ostringstream subject;
-    subject << itemTemplate << ":" << itemRandomPropertyId << ":" << AUCTION_CANCELED;
-    MailDraft itemReturn(subject.str(), "");
-    itemReturn.AddItem(item);
-    if (usesPlayerSellerCustody)
-    {
-        CustodyService::DeliverItem(def, "item:" + std::to_string(Id), itemReturn,
-                                    MailReceiver(seller), MailSender(this),
-                                    MAIL_CHECK_MASK_COPIED);
-    }
-    else
-    {
-        itemReturn.SendMailToInTransaction(MailReceiver(seller), MailSender(this),
-                                           def, MAIL_CHECK_MASK_COPIED);
-    }
-
-    seller->SaveInventoryAndGoldToDB();
-    DeleteFromDB();
-}
-
 /**
  * @brief Updates the current bid and handles buyout completion if reached.
  *
  * @param newbid The new bid amount.
  * @param newbidder The player placing the bid.
- * @param applied Optional success output; false on a custody/commit failure.
  * @return true if the auction remains active after the update; otherwise, false.
  */
-bool AuctionEntry::UpdateBid(uint32 newbid, Player* newbidder /*=NULL*/,
-                             bool* applied /*=NULL*/)
+bool AuctionEntry::UpdateBid(uint32 newbid, Player* newbidder /*=NULL*/)
 {
-    if (applied)
-    {
-        *applied = false;
-    }
     if (!newbidder)
     {
-        // Both service intents and the in-process buyer enter here. Preserve
-        // player custody when a generated bid displaces its current owner.
-        CustodyRouteState const route = CustodyLedger::GetRouteState(Id);
-        if (!route.known)
+        bool stillActive = false;
+        if (AuctionHouseModules::Answer([&](AuctionHouseModule& module) { return module.SettleGeneratedBid(*this, newbid, stillActive); }))
         {
-            return false;
-        }
-        if (route.usesPlayerSellerCustody || route.hasLiveBidCustody)
-        {
-            std::string liveBidKey;
-            if (route.hasLiveBidCustody)
-            {
-                CustodyRow row;
-                if (bidder == 0u || !CustodyLedger::GetSingleLiveBidRow(Id, row) ||
-                    row.ownerGuid != bidder || row.amount != bid)
-                {
-                    sLog.outError("custody bot bid validation failed for auction %u",
-                                  Id);
-                    return false;
-                }
-                liveBidKey = row.idemKey;
-            }
-            uint32 const oldBid = bid;
-            uint32 const oldBidder = bidder;
-            CustodyDeferred def;
-            if (!CharacterDatabase.BeginTransaction())
-            {
-                return false;
-            }
-            bool const active = UpdateBidCustody(newbid, NULL, def,
-                route.usesPlayerSellerCustody, route.hasLiveBidCustody, liveBidKey);
-            if (!CustodyService::CommitCheckedOrForcedFail("bot-bid"))
-            {
-                bid = oldBid;
-                bidder = oldBidder;
-                return false;
-            }
-            if (applied)
-            {
-                *applied = true;
-            }
-            def.run(); // A successful buyout deletes this auction last.
-            return active;
+            return stillActive;
         }
     }
+
     Player* auction_owner = owner ? sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, owner)) : NULL;
 
     // bid can't be greater buyout
@@ -1883,136 +1112,13 @@ bool AuctionEntry::UpdateBid(uint32 newbid, Player* newbidder /*=NULL*/,
             newbidder->SaveInventoryAndGoldToDB();
         }
         CharacterDatabase.CommitTransaction();
-        if (applied)
-        {
-            *applied = true;
-        }
         return true;
     }
     else                                                    // buyout
     {
-        if (applied)
-        {
-            *applied = true;
-        }
         AuctionBidWinning(newbidder);
         return false;
     }
 }
 
-/**
- * @brief Custody co-commit mirror of UpdateBid.
- *
- * Reproduces UpdateBid's gold movement EXACTLY but through the custody
- * primitives, appending every DB write to the caller's already-open
- * CharacterDatabase transaction (the caller opens and checked-commits it).
- * Live effects (outbid notify + refund mail push) are queued into @p def and
- * run only after the checked commit succeeds.
- *
- * A buyout (newbid >= buyout) is absorbed here (Task 10): the bid is capped at
- * buyout, reserved/refunded as a normal bid, then the win is resolved on the same
- * open transaction via AuctionBidWinningCustody, which defers the auction delete
- * + cache mutations into @p def. Returns false on a buyout (auction no longer
- * active), true on a normal bid.
- *
- * @param newbid     The new bid amount (capped at buyout here, as in UpdateBid).
- * @param newbidder  The bidding player, or NULL for a generated bot bid.
- * @param def        Ordered deferred-effects queue for this co-commit.
- * @param liveBidKey idem_key of the existing live bid row (validated by the
- *                   handler), empty when the auction has no live bidder.
- * @return true if the auction remains active (normal bid); false on buyout.
- */
-bool AuctionEntry::UpdateBidCustody(uint32 newbid, Player* newbidder, CustodyDeferred& def,
-                                   bool usesPlayerSellerCustody,
-                                   bool hadLiveBidCustody,
-                                   std::string const& liveBidKey)
-{
-    // Cap the bid at buyout FIRST, mirroring UpdateBid (:1055-1058). A buyout bid
-    // (newbid >= buyout) now runs through custody (Task 10): it reserves/refunds
-    // exactly like a normal bid and then resolves the win in this same open txn.
-    if (buyout && newbid > buyout)
-    {
-        newbid = buyout;
-    }
-    bool const isBuyout = (buyout != 0 && newbid >= buyout);
-
-    // The idem_key of the bid row that becomes the winner's bid on a buyout. On a
-    // same-bidder buyout it is the existing (topped-up) live bid row; otherwise it
-    // is the freshly reserved row. Passed to AuctionBidWinningCustody so it can
-    // commit-net the row WITHOUT a synchronous SELECT (the row is uncommitted in
-    // this same open txn). Empty when bidder ends up 0 (no row to commit).
-    std::string winningBidKey;
-
-    if (newbidder && newbidder->GetGUIDLow() == bidder)
-    {
-        if (hadLiveBidCustody)
-        {
-            CustodyService::TopUpBid(liveBidKey, newbid, newbid - bid, newbidder);
-            winningBidKey = liveBidKey;
-        }
-        else
-        {
-            // Seller custody can meet a legacy standing bid. Preserve the
-            // legacy delta debit, then establish custody at the full new amount.
-            newbidder->ModifyMoney(-int32(newbid - bid));
-            newbidder->SaveInventoryAndGoldToDB();
-            winningBidKey = "bid:" + std::to_string(Id) + ":" +
-                            std::to_string(CustodyLedger::NextBidSeq(Id));
-            CustodyService::ReserveGoldAlreadyDebited(
-                newbidder->GetGUIDLow(), newbid, winningBidKey, Id, ROLE_BID);
-        }
-    }
-    else
-    {
-        // Refund/displace a REAL prior bidder first (reads the OLD bid), then
-        // reserve the new bidder's full amount. A bot-displaced bid
-        // (bid>0, bidder==0) carries no custody row: no rollback, no outbid mail
-        // (matches UpdateBid's `if (bidder)` skipping the refund -- spec R2).
-        if (bidder != 0)
-        {
-            if (hadLiveBidCustody)
-            {
-                CustodyService::RollbackGoldLedgerOnly(liveBidKey);
-            }
-            WorldSession::SendAuctionOutbiddedMailInTransaction(this, def);
-        }
-
-        // Reserve the new bidder's full bid (debits -newbid + SaveInventory).
-        // Mirrors UpdateBid's `if (newbidder) ModifyMoney(-newbid)`.
-        // NextBidSeq returns MAX(id) of existing bid rows: monotonic, never
-        // decreases after TTL pruning, so the suffix is always strictly greater
-        // than every existing row's suffix -- UNIQUE constraint cannot fire.
-        if (newbidder)
-        {
-            std::string newBidKey = "bid:" + std::to_string(Id) + ":" +
-                                    std::to_string(CustodyLedger::NextBidSeq(Id));
-            CustodyService::ReserveGold(def, newbidder->GetGUIDLow(),
-                                        newbidder, newbid, newBidKey, Id, ROLE_BID);
-            winningBidKey = newBidKey;
-        }
-    }
-
-    bidder = newbidder ? newbidder->GetGUIDLow() : 0;
-    bid = newbid;
-
-    if (!isBuyout)                                          // normal bid
-    {
-        // The new bidder's gold was already persisted by ReserveGold/TopUpBid
-        // (SaveInventoryAndGoldToDB), so do NOT save again. The auction UPDATE
-        // appends to the caller's open transaction.
-        CharacterDatabase.PExecute("UPDATE `auction` SET `buyguid` = '%u', `lastbid` = '%u' WHERE `id` = '%u'", bidder, bid, Id);
-        return true;
-    }
-
-    // Buyout: resolve the win on this same open transaction. The winner's gold is
-    // already persisted (ReserveGold/TopUpBid above), so AuctionBidWinningCustody
-    // does NOT re-save it. Pass winningBidKey so the bid-row commit-net does not
-    // SELECT for the uncommitted row. Generated buyers have no gold reservation.
-    // The auction is deleted in a deferred closure run only after the caller's
-    // checked commit succeeds.
-    AuctionBidWinningCustody(newbidder, def, usesPlayerSellerCustody,
-                             !winningBidKey.empty(), winningBidKey);
-    return false;
-}
-
 /** @} */
diff --git a/src/game/Object/AuctionHouseMgr.h b/src/game/Object/AuctionHouseMgr.h
index 24c21cf8f7..e107b286ac 100644
--- a/src/game/Object/AuctionHouseMgr.h
+++ b/src/game/Object/AuctionHouseMgr.h
@@ -60,7 +60,6 @@ class Item;
 class Player;
 class Unit;
 class WorldPacket;
-struct CustodyDeferred;
 
 #define MIN_AUCTION_TIME (2*HOUR)
 
@@ -113,62 +112,7 @@ struct AuctionEntry
     void DeleteFromDB() const;
     void SaveToDB() const;
     void AuctionBidWinning(Player* bidder = NULL);
-    /// Custody co-commit mirror of AuctionBidWinning: pays the seller, delivers
-    /// the item to the winner, nets the deposit/bid ledger rows, deletes the
-    /// auction row, and defers every in-memory effect (notifications, mail pushes,
-    /// AH cache mutations, RemoveAuction, delete this) into @p def. Every DB write
-    /// appends to the caller's ALREADY-OPEN CharacterDatabase transaction; the
-    /// caller checked-commits it then runs @p def (spec Sec 6 S4). @p newbidder is
-    /// the online winner (buyout path) or NULL (expiry path).
-    ///
-    /// Seller custody and bid custody are independent: only seller custody
-    /// terminalizes item/deposit rows, and only bid custody terminalizes
-    /// @p knownBidKey. The caller validates any existing live bid row before
-    /// opening the transaction.
-    void AuctionBidWinningCustody(Player* newbidder, CustodyDeferred& def,
-                                  bool usesPlayerSellerCustody,
-                                  bool hasLiveBidCustody,
-                                  std::string const& knownBidKey = "");
-    /// Custody co-commit mirror of the unsold-expiry path (spec S6): returns the
-    /// item to the seller by mail (or destroys it if the account is gone),
-    /// forfeits the deposit to the house, deletes the auction row, and defers
-    /// every in-memory effect (owner-expired notification, mail push, RemoveAItem,
-    /// RemoveAuction, delete this) into @p def. Every DB write appends to the
-    /// caller's ALREADY-OPEN CharacterDatabase transaction; the caller
-    /// checked-commits it then runs @p def. S6 makes NO synchronous in-memory
-    /// mutation, so on rollback there is nothing to restore.
-    void ExpireUnsoldCustody(CustodyDeferred& def);
-    /// Append the cancel value transaction to the caller's open transaction.
-    /// The handler retains affordability checks, checked commit/rollback,
-    /// command results, cache removal, Eluna notification, and object deletion.
-    void PrepareCancelCustody(Player* seller, CustodyDeferred& def,
-                              bool usesPlayerSellerCustody,
-                              bool hasLiveBidCustody,
-                              std::string const& liveBidKey,
-                              uint32 auctionCut);
-    /// True if still active. Optional applied distinguishes failure from buyout.
-    bool UpdateBid(uint32 newbid, Player* newbidder = NULL, bool* applied = NULL);
-    /// Custody co-commit mirror of UpdateBid: moves the bidder's gold via the
-    /// custody primitives and appends every DB write to the caller's already-open
-    /// CharacterDatabase transaction (the caller opens/commits it). Live effects
-    /// (outbid notify/refund mail push) are queued into @p def. The outbid refund
-    /// mail is sent via the static SendAuctionOutbiddedMailInTransaction, which
-    /// resolves the old bidder's session itself, so no acting session is needed.
-    ///
-    /// @p hadLiveBidCustody says whether @p liveBidKey identifies the validated
-    /// existing bid row. Seller custody can route here without such a row; in
-    /// that case prior-bid refunds retain legacy behavior and the replacement
-    /// bid starts custody from its full current amount.
-    ///
-    /// A buyout (newbid >= buyout) is absorbed here (Task 10): the bid is capped at
-    /// buyout, reserved/refunded as a normal bid, then the win resolves on the same
-    /// open transaction via AuctionBidWinningCustody (auction delete + cache
-    /// mutations deferred into @p def). Returns true if the auction remains active
-    /// (normal bid), false on a buyout (auction resolved + scheduled for delete).
-    bool UpdateBidCustody(uint32 newbid, Player* newbidder, CustodyDeferred& def,
-                          bool usesPlayerSellerCustody,
-                          bool hadLiveBidCustody,
-                          std::string const& liveBidKey);
+    bool UpdateBid(uint32 newbid, Player* newbidder = NULL);// true if normal bid, false if buyout, bidder==NULL for generated bid
 };
 
 // this class is used as auctionhouse instance
@@ -221,18 +165,7 @@ class AuctionHouseObject
             uint32 inventoryType, uint32 itemClass, uint32 itemSubClass, uint32 quality,
             uint32& count, uint32& totalcount);
 
-        /// Dispatcher for in-process browse fallback (C1/I1). Switches on @p kind:
-        ///   0 = LIST (public browse), 1 = OWNER, 2 = BIDDER.
-        /// For BIDDER the @p clientOutbidIds entries are prepended in CLIENT ORDER
-        /// (matching HandleAuctionListBidderItems) before the sweep.
-        /// All other parameters mirror the corresponding BuildList* signatures.
-        void BuildListForKind(uint8 kind, WorldPacket& data, Player* player,
-            const std::wstring& wname, uint32 listfrom, uint32 levelmin, uint32 levelmax,
-            uint32 usable, uint32 invType, uint32 itemClass, uint32 itemSubClass,
-            uint32 quality, const std::vector<uint32>& clientOutbidIds,
-            uint32& count, uint32& totalcount);
-
-        AuctionEntry* AddAuction(AuctionHouseEntry const* auctionHouseEntry, Item* newItem, uint32 etime, uint32 bid, uint32 buyout = 0, uint32 deposit = 0, Player* pl = NULL, bool ownTransaction = true);
+        AuctionEntry* AddAuction(AuctionHouseEntry const* auctionHouseEntry, Item* newItem, uint32 etime, uint32 bid, uint32 buyout = 0, uint32 deposit = 0, Player* pl = NULL);
         AuctionEntry* AddAuctionByGuid(AuctionHouseEntry const* auctionHouseEntry, Item* newItem, uint32 etime, uint32 bid, uint32 buyout, uint32 lowguid);
     private:
         AuctionEntryMap AuctionsMap;
@@ -277,33 +210,6 @@ class AuctionHouseMgr
         void SendAuctionWonMail(AuctionEntry* auction);
         void SendAuctionSuccessfulMail(AuctionEntry* auction);
         void SendAuctionExpiredMail(AuctionEntry* auction);
-
-        /// Custody co-commit variant of SendAuctionExpiredMail: same owner-exists
-        /// guard + expired subject, but the item return mail co-commits into the
-        /// caller's open transaction (no own Begin/Commit), the "item:<Id>" escrow
-        /// row flips to TERMINAL_OK (DeliverItem on the return branch;
-        /// CommitGoldLedgerOnly on the destroy branch), and the online owner's
-        /// SMSG_AUCTION_OWNER_NOTIFICATION (expired form) + RemoveAItem (+ live
-        /// item destroy on the no-owner branch) are deferred into @p def in legacy
-        /// order (notify-then-mail, spec S6 / C7). itemGuidLow is intentionally NOT
-        /// zeroed (success deletes the AuctionEntry; rollback needs the GUID).
-        void SendAuctionExpiredMailInTransaction(AuctionEntry* auction, CustodyDeferred& def);
-
-        /// Custody co-commit variant of SendAuctionSuccessfulMail: same owner-exists
-        /// guard + profit math, but the seller payout mail co-commits into the
-        /// caller's open transaction (no own Begin/Commit) and the online owner-sold
-        /// notification is deferred into @p def BEFORE the mail push so packet order
-        /// stays notify-then-mail (legacy). Reads auction->bid/bidder, so the caller
-        /// MUST call this before mutating them (spec S4 / B).
-        void SendAuctionSuccessfulMailInTransaction(AuctionEntry* auction, CustodyDeferred& def);
-
-        /// Custody co-commit variant of SendAuctionWonMail: keeps the GM-log block;
-        /// the item_instance owner UPDATE (receiver-exists) or DELETE (destroy)
-        /// appends to the caller's open transaction, the winner mail co-commits via
-        /// SendMailToInTransaction, and the bidder notification + RemoveAItem +
-        /// itemGuidLow=0 (+ live item destroy on the no-receiver branch) are deferred
-        /// into @p def in legacy order (spec S4 / C).
-        void SendAuctionWonMailInTransaction(AuctionEntry* auction, CustodyDeferred& def);
         static uint32 GetAuctionDeposit(AuctionHouseEntry const* entry, uint32 time, Item* pItem);
 
         static uint32 GetAuctionHouseTeam(AuctionHouseEntry const* house);
@@ -327,13 +233,6 @@ class AuctionHouseMgr
 
 /// Convenience define to access the singleton object for the Auction House Manager
 #define sAuctionMgr MaNGOS::Singleton<AuctionHouseMgr>::Instance()
-
-/// Test seam for the client-outbid-prepend order contract (used by -t ahbrowsehelper).
-/// Records the ids from @p clientIds into @p outOrder in CLIENT ORDER, locking
-/// the invariant that BuildListForKind(BIDDER) prepends them before the sweep.
-void AhAppendClientOutbidsForTest(const std::vector<uint32>& clientIds,
-                                  std::vector<uint32>& outOrder);
-
 /** @} */
 
 #endif
diff --git a/src/game/Object/AuctionHouseModule.cpp b/src/game/Object/AuctionHouseModule.cpp
new file mode 100644
index 0000000000..452ea319f0
--- /dev/null
+++ b/src/game/Object/AuctionHouseModule.cpp
@@ -0,0 +1,164 @@
+/**
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * MaNGOS is a full featured server for World of Warcraft, supporting
+ * the following clients: 1.12.x, 2.4.3, 3.3.5a, 4.3.4a and 5.4.8
+ *
+ * Copyright (C) 2005-2026 MaNGOS <https://www.getmangos.eu>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * World of Warcraft, and all World of Warcraft or Warcraft art, images,
+ * and lore are copyrighted by Blizzard Entertainment, Inc.
+ */
+
+#include "AuctionHouseModule.h"
+#include "Log.h"
+
+#include <algorithm>
+
+namespace
+{
+    std::vector<AuctionHouseModules::Factory>& Factories()
+    {
+        static std::vector<AuctionHouseModules::Factory> factories;
+        return factories;
+    }
+
+    std::vector<std::unique_ptr<AuctionHouseModule>>& Modules()
+    {
+        static std::vector<std::unique_ptr<AuctionHouseModule>> modules;
+        return modules;
+    }
+
+    std::string& ConfigPath()
+    {
+        static std::string path;
+        return path;
+    }
+}
+
+void AuctionHouseModules::Provide(Factory factory)
+{
+    Factories().push_back(factory);
+}
+
+void AuctionHouseModules::LoadConfig(bool reload)
+{
+    if (reload)
+    {
+        for (std::unique_ptr<AuctionHouseModule>& module : Modules())
+        {
+            module->LoadConfig(true);
+        }
+        return;
+    }
+
+    Modules().clear();
+    for (Factory factory : Factories())
+    {
+        if (AuctionHouseModule* module = factory())
+        {
+            module->LoadConfig(false);
+            sLog.outString("Auction module %s enabled", module->Name());
+            Modules().emplace_back(module);
+        }
+    }
+}
+
+void AuctionHouseModules::Start()
+{
+    for (std::unique_ptr<AuctionHouseModule>& module : Modules())
+    {
+        module->Start();
+    }
+}
+
+void AuctionHouseModules::Update(uint32 diff)
+{
+    for (std::unique_ptr<AuctionHouseModule>& module : Modules())
+    {
+        module->Update(diff);
+    }
+}
+
+void AuctionHouseModules::Stop()
+{
+    for (auto itr = Modules().rbegin(); itr != Modules().rend(); ++itr)
+    {
+        (*itr)->Stop();
+    }
+}
+
+std::vector<ChatCommand*> AuctionHouseModules::Commands()
+{
+    std::vector<ChatCommand*> tables;
+    for (std::unique_ptr<AuctionHouseModule>& module : Modules())
+    {
+        if (ChatCommand* table = module->Commands())
+        {
+            tables.push_back(table);
+        }
+    }
+    return tables;
+}
+
+uint32 AuctionHouseModules::HighestAuctionId()
+{
+    uint32 highest = 0;
+    for (std::unique_ptr<AuctionHouseModule>& module : Modules())
+    {
+        highest = std::max(highest, module->HighestAuctionId());
+    }
+    return highest;
+}
+
+bool AuctionHouseModules::OwnsAuctionRows()
+{
+    for (std::unique_ptr<AuctionHouseModule>& module : Modules())
+    {
+        if (module->OwnsAuctionRows())
+        {
+            return true;
+        }
+    }
+    return false;
+}
+
+bool AuctionHouseModules::TakesOverListings()
+{
+    for (std::unique_ptr<AuctionHouseModule>& module : Modules())
+    {
+        if (module->TakesOverListings())
+        {
+            return true;
+        }
+    }
+    return false;
+}
+
+std::vector<std::unique_ptr<AuctionHouseModule>> const& AuctionHouseModules::All()
+{
+    return Modules();
+}
+
+void AuctionHouseModules::SetConfigFile(std::string const& path)
+{
+    ConfigPath() = path;
+}
+
+std::string const& AuctionHouseModules::ConfigFile()
+{
+    return ConfigPath();
+}
diff --git a/src/game/Object/AuctionHouseModule.h b/src/game/Object/AuctionHouseModule.h
new file mode 100644
index 0000000000..f684718c0c
--- /dev/null
+++ b/src/game/Object/AuctionHouseModule.h
@@ -0,0 +1,175 @@
+/**
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * MaNGOS is a full featured server for World of Warcraft, supporting
+ * the following clients: 1.12.x, 2.4.3, 3.3.5a, 4.3.4a and 5.4.8
+ *
+ * Copyright (C) 2005-2026 MaNGOS <https://www.getmangos.eu>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * World of Warcraft, and all World of Warcraft or Warcraft art, images,
+ * and lore are copyrighted by Blizzard Entertainment, Inc.
+ */
+
+#ifndef MANGOS_H_AUCTION_HOUSE_MODULE
+#define MANGOS_H_AUCTION_HOUSE_MODULE
+
+#include "Platform/Define.h"
+#include "DBCStructure.h"
+
+#include <memory>
+#include <string>
+#include <vector>
+
+class AuctionHouseObject;
+class ChatCommand;
+class Item;
+class WorldSession;
+struct AuctionEntry;
+
+/// A player's request to put an item up for auction, after the core checks.
+struct AuctionSale
+{
+    AuctionHouseEntry const* houseEntry;
+    AuctionHouseObject* house;
+    Item* item;
+    uint32 etime;                                           ///< seconds
+    uint32 bid;
+    uint32 buyout;
+    uint32 deposit;
+};
+
+enum AuctionListKind
+{
+    AUCTION_LIST_ITEMS  = 0,
+    AUCTION_LIST_OWNER  = 1,
+    AUCTION_LIST_BIDDER = 2
+};
+
+/// One of the three auction list requests, as the client sent it.
+struct AuctionListRequest
+{
+    AuctionListKind kind;
+    AuctionHouseEntry const* houseEntry;
+    AuctionHouseObject* house;
+    uint32 listfrom;
+    std::string searchedName;                               ///< raw UTF-8, AUCTION_LIST_ITEMS only
+    uint8 levelmin;
+    uint8 levelmax;
+    uint8 usable;
+    uint32 inventoryType;
+    uint32 itemClass;
+    uint32 itemSubClass;
+    uint32 quality;
+    std::vector<uint32> outbidIds;                          ///< client order, AUCTION_LIST_BIDDER only
+};
+
+enum AuctionExpiry
+{
+    AUCTION_EXPIRY_CORE,                                    ///< the core settles it
+    AUCTION_EXPIRY_DONE,                                    ///< the module settled or skipped it
+    AUCTION_EXPIRY_STOP                                     ///< leave the rest of this house for the next tick
+};
+
+/**
+ * @brief Something that lives beside the auction house: a bot that trades on
+ * it, or a service that takes part of it over.
+ *
+ * Every hook does nothing by default. A request hook returns true when the
+ * module answered the request itself; the core then does nothing more.
+ */
+class AuctionHouseModule
+{
+    public:
+
+        virtual ~AuctionHouseModule() {}
+
+        virtual char const* Name() const = 0;
+
+        virtual void LoadConfig(bool /*reload*/) {}
+        /// After the auctions are loaded, before the world loop starts.
+        virtual void Start() {}
+        virtual void Update(uint32 /*diff*/) {}
+        /// After the world loop has stopped.
+        virtual void Stop() {}
+        /// Top-level commands, terminated like every command table.
+        virtual ChatCommand* Commands() { return NULL; }
+
+        virtual uint32 HighestAuctionId() const { return 0; }
+        /// Another process writes the `auction` table; the core and the bots must not.
+        virtual bool OwnsAuctionRows() const { return false; }
+        /// Listings are driven elsewhere for now; the bots stand down.
+        virtual bool TakesOverListings() const { return false; }
+
+        virtual bool BlocksHello(WorldSession& /*session*/) { return false; }
+        virtual bool ForwardSell(WorldSession& /*session*/, AuctionSale const& /*sale*/) { return false; }
+        /// The deposit is already taken; @p listed stays NULL when the sale failed and was answered.
+        virtual bool SettleSell(WorldSession& /*session*/, AuctionSale const& /*sale*/, AuctionEntry*& /*listed*/) { return false; }
+        virtual bool ForwardBid(WorldSession& /*session*/, uint32 /*auctionId*/, uint32 /*price*/) { return false; }
+        virtual bool SettleBid(WorldSession& /*session*/, AuctionHouseObject& /*house*/, AuctionEntry& /*auction*/, uint32 /*price*/, uint32 /*newOutbid*/) { return false; }
+        virtual bool ForwardCancel(WorldSession& /*session*/, uint32 /*auctionId*/) { return false; }
+        virtual bool SettleCancel(WorldSession& /*session*/, AuctionHouseObject& /*house*/, AuctionEntry& /*auction*/) { return false; }
+        virtual bool ForwardList(WorldSession& /*session*/, AuctionListRequest const& /*request*/) { return false; }
+
+        virtual AuctionExpiry Expire(AuctionHouseObject& /*house*/, AuctionEntry& /*auction*/) { return AUCTION_EXPIRY_CORE; }
+        /// A bid with no player behind it; @p stillActive is UpdateBid's result.
+        virtual bool SettleGeneratedBid(AuctionEntry& /*auction*/, uint32 /*price*/, bool& /*stillActive*/) { return false; }
+};
+
+/**
+ * @brief The auction modules linked into this server.
+ *
+ * A module provides a factory from a static object in its own sources; the
+ * factory reads the module's configuration and returns NULL when it is off.
+ */
+class AuctionHouseModules
+{
+    public:
+
+        typedef AuctionHouseModule* (*Factory)();
+
+        static void Provide(Factory factory);
+
+        static void LoadConfig(bool reload);
+        static void Start();
+        static void Update(uint32 diff);
+        static void Stop();
+
+        static std::vector<ChatCommand*> Commands();
+        static uint32 HighestAuctionId();
+        static bool OwnsAuctionRows();
+        static bool TakesOverListings();
+        static std::vector<std::unique_ptr<AuctionHouseModule>> const& All();
+
+        /// Asks the modules in turn until one answers.
+        template<typename Hook>
+        static bool Answer(Hook hook)
+        {
+            for (std::unique_ptr<AuctionHouseModule> const& module : All())
+            {
+                if (hook(*module))
+                {
+                    return true;
+                }
+            }
+            return false;
+        }
+
+        static void SetConfigFile(std::string const& path);
+        /// The bots' configuration file (ahbot.conf), as given to mangosd.
+        static std::string const& ConfigFile();
+};
+
+#endif
diff --git a/src/game/Object/ObjectGuid.cpp b/src/game/Object/ObjectGuid.cpp
index d721e3ae40..32e220af26 100644
--- a/src/game/Object/ObjectGuid.cpp
+++ b/src/game/Object/ObjectGuid.cpp
@@ -96,14 +96,6 @@ uint32 ObjectGuidGenerator<high>::Generate()
     {
         sLog.outError("%s guid overflow!! Can't continue, shutting down server. ", ObjectGuid::GetTypeName(high));
         World::StopNow(ERROR_EXIT_CODE);
-        // World::StopNow() only sets a deferred stop flag, so this call still
-        // returns. Do NOT hand out m_nextGuid here: at the overflow boundary it
-        // equals GetMaxCounter-1, which for players is the reserved AH bot
-        // system-owner GUID (0xFFFFFFFE) -- returning it could brand a real
-        // character with the forged owner's GUID before the shutdown takes
-        // effect. Return the top-of-range value instead (never the reserved one);
-        // the server is stopping regardless.
-        return ObjectGuid::GetMaxCounter(high);
     }
     return m_nextGuid++;
 }
diff --git a/src/game/Object/ObjectMgr.cpp b/src/game/Object/ObjectMgr.cpp
index 04131cf54d..1d2c967801 100644
--- a/src/game/Object/ObjectMgr.cpp
+++ b/src/game/Object/ObjectMgr.cpp
@@ -33,7 +33,6 @@
 #include <map>
 #include <set>
 #include "ObjectMgr.h"
-#include "AuctionHouseBot/AhBotSystemOwner.h"
 #include "LivingWorldAnchorPolicy.h"
 #include "MotionGenerators/MotionMaster.h"  // WAYPOINT_MOTION_TYPE
 #include "Database/DatabaseEnv.h"
@@ -46,6 +45,7 @@
 #include "ScriptMgr.h"
 #include "SpellMgr.h"
 #include "World.h"
+#include "AuctionHouseModule.h"
 #include "Group.h"
 #include "Transports.h"
 #include "ProgressBar.h"
@@ -565,23 +565,6 @@ void ObjectMgr::LoadCreatureSpells()
 // name must be checked to correctness (if received) before call this function
 ObjectGuid ObjectMgr::GetPlayerGuidByName(std::string name) const
 {
-    // AH bot forged system owner: resolve the reserved name to the sentinel
-    // GUID WITHOUT a characters row or a DB round-trip (case-insensitive, to
-    // match the DB collation used below).
-    {
-        std::wstring wname;
-        std::wstring wsys;
-        if (Utf8toWStr(name, wname) && Utf8toWStr(AHBOT_SYSTEM_OWNER_NAME, wsys))
-        {
-            wstrToLower(wname);
-            wstrToLower(wsys);
-            if (wname == wsys)
-            {
-                return ObjectGuid(HIGHGUID_PLAYER, AHBOT_SYSTEM_OWNER_GUID);
-            }
-        }
-    }
-
     ObjectGuid guid;
 
     CharacterDatabase.escape_string(name);
@@ -1782,10 +1765,7 @@ void ObjectMgr::SetHighestGuids()
     QueryResult* result = CharacterDatabase.Query("SELECT MAX(`guid`) FROM `characters`");
     if (result)
     {
-        // Defensive: never let the allocator's next value land on the reserved
-        // AH-bot system GUID. (The overflow guard already makes 0xFFFFFFFE
-        // unreachable; this is belt-and-suspenders.)
-        m_CharGuids.Set(SkipAhBotSystemOwnerGuid((*result)[0].GetUInt32() + 1));
+        m_CharGuids.Set((*result)[0].GetUInt32() + 1);
         delete result;
     }
 
@@ -1807,11 +1787,7 @@ void ObjectMgr::SetHighestGuids()
     CharacterDatabase.BeginTransaction();
     CharacterDatabase.PExecute("DELETE FROM `character_inventory` WHERE `item` >= '%u'", m_ItemGuids.GetNextAfterMaxUsed());
     CharacterDatabase.PExecute("DELETE FROM `mail_items` WHERE `item_guid` >= '%u'", m_ItemGuids.GetNextAfterMaxUsed());
-    // [SP-2 spec 5.7] Under WriteAuthority the worker owns the `auction` book;
-    // the orphan-row DELETE is its responsibility (its own LoadFromDb repair).
-    // mangosd must not also delete auction rows (double-writer). The two item
-    // tables above stay mangosd's.
-    if (!sWorld.IsAhWriteAuthority())
+    if (!AuctionHouseModules::OwnsAuctionRows())
     {
         CharacterDatabase.PExecute("DELETE FROM `auction` WHERE `itemguid` >= '%u'", m_ItemGuids.GetNextAfterMaxUsed());
     }
@@ -1824,30 +1800,11 @@ void ObjectMgr::SetHighestGuids()
         delete result;
     }
 
-    // Seed the auction-id generator from the higher of the two live high-water
-    // marks: MAX(id) in the auction table, and MAX(auction_id) in the
-    // custody_ledger table.  Custody rows can outlive their auction row (the
-    // TTL sweep prunes them asynchronously), so a freshly reused auction id
-    // would collide the "item:<id>"/"dep:<id>" idempotency keys of any
-    // not-yet-pruned terminal custody rows for the old auction.
+    result = CharacterDatabase.Query("SELECT MAX(`id`) FROM `auction`");
+    if (result)
     {
-        uint32 auctionMax = 0;
-        result = CharacterDatabase.Query("SELECT MAX(`id`) FROM `auction`");
-        if (result)
-        {
-            auctionMax = (*result)[0].GetUInt32();
-            delete result;
-        }
-
-        uint32 custodyMax = 0;
-        result = CharacterDatabase.Query("SELECT MAX(`auction_id`) FROM `custody_ledger`");
-        if (result)
-        {
-            custodyMax = (*result)[0].GetUInt32();
-            delete result;
-        }
-
-        m_AuctionIds.Set(std::max(auctionMax, custodyMax) + 1);
+        m_AuctionIds.Set(std::max((*result)[0].GetUInt32(), AuctionHouseModules::HighestAuctionId()) + 1);
+        delete result;
     }
 
     result = CharacterDatabase.Query("SELECT MAX(`id`) FROM `mail`");
diff --git a/src/game/Object/ObjectMgrAreaTrigger.cpp b/src/game/Object/ObjectMgrAreaTrigger.cpp
index 40ff8cae0d..1f09732bcb 100644
--- a/src/game/Object/ObjectMgrAreaTrigger.cpp
+++ b/src/game/Object/ObjectMgrAreaTrigger.cpp
@@ -32,7 +32,6 @@
 #include "DBCStores.h"
 #include "Log.h"
 #include "ProgressBar.h"
-#include "AuctionHouseBot/AhBotSystemOwner.h"
 #include "LivingWorldAnchorPolicy.h"
 #include "MotionGenerators/MotionMaster.h"
 #include "SQLStorages.h"
diff --git a/src/game/Object/ObjectMgrCreatures.cpp b/src/game/Object/ObjectMgrCreatures.cpp
index 123afd48d9..e29289b8a1 100644
--- a/src/game/Object/ObjectMgrCreatures.cpp
+++ b/src/game/Object/ObjectMgrCreatures.cpp
@@ -61,7 +61,6 @@
 #include "GridNotifiersImpl.h"
 #include "CellImpl.h"
 #include "DisableMgr.h"
-#include "AuctionHouseBot/AhBotSystemOwner.h"
 #include "Formulas.h"
 #include "ItemEnchantmentMgr.h"
 #include <limits>
diff --git a/src/game/Object/ObjectMgrGameObjectInfo.cpp b/src/game/Object/ObjectMgrGameObjectInfo.cpp
index 855e2a4104..65bebde631 100644
--- a/src/game/Object/ObjectMgrGameObjectInfo.cpp
+++ b/src/game/Object/ObjectMgrGameObjectInfo.cpp
@@ -32,7 +32,6 @@
 #include "ProgressBar.h"
 #include "SQLStorages.h"
 #include "DBCStores.h"
-#include "AuctionHouseBot/AhBotSystemOwner.h"
 #include "LivingWorldAnchorPolicy.h"
 #include "MotionGenerators/MotionMaster.h"
 #include "MapManager.h"
diff --git a/src/game/Object/ObjectMgrGameObjects.cpp b/src/game/Object/ObjectMgrGameObjects.cpp
index 9a5e510b3f..2f2d9492c7 100644
--- a/src/game/Object/ObjectMgrGameObjects.cpp
+++ b/src/game/Object/ObjectMgrGameObjects.cpp
@@ -35,7 +35,6 @@
 #include "MapManager.h"
 #include "GridDefines.h"
 #include "DisableMgr.h"
-#include "AuctionHouseBot/AhBotSystemOwner.h"
 #include "LivingWorldAnchorPolicy.h"
 #include "MotionGenerators/MotionMaster.h"
 #include "ObjectGuid.h"
diff --git a/src/game/Object/ObjectMgrGameTele.cpp b/src/game/Object/ObjectMgrGameTele.cpp
index 682e40fde3..1b91b9d26d 100644
--- a/src/game/Object/ObjectMgrGameTele.cpp
+++ b/src/game/Object/ObjectMgrGameTele.cpp
@@ -33,7 +33,6 @@
 #include "MapManager.h"
 #include "ProgressBar.h"
 #include "Util.h"
-#include "AuctionHouseBot/AhBotSystemOwner.h"
 #include "LivingWorldAnchorPolicy.h"
 #include "MotionGenerators/MotionMaster.h"
 #include "SQLStorages.h"
diff --git a/src/game/Object/ObjectMgrGossipMenu.cpp b/src/game/Object/ObjectMgrGossipMenu.cpp
index a9e4a72893..49d0d52f1b 100644
--- a/src/game/Object/ObjectMgrGossipMenu.cpp
+++ b/src/game/Object/ObjectMgrGossipMenu.cpp
@@ -35,7 +35,6 @@
 #include "SQLStorages.h"
 #include "ScriptMgr.h"
 #include "GossipDef.h"
-#include "AuctionHouseBot/AhBotSystemOwner.h"
 #include "LivingWorldAnchorPolicy.h"
 #include "MotionGenerators/MotionMaster.h"
 #include "MapManager.h"
diff --git a/src/game/Object/ObjectMgrGraveyard.cpp b/src/game/Object/ObjectMgrGraveyard.cpp
index 7f7a87b7c2..949167cff4 100644
--- a/src/game/Object/ObjectMgrGraveyard.cpp
+++ b/src/game/Object/ObjectMgrGraveyard.cpp
@@ -31,7 +31,6 @@
 #include "DBCStores.h"
 #include "Log.h"
 #include "ProgressBar.h"
-#include "AuctionHouseBot/AhBotSystemOwner.h"
 #include "LivingWorldAnchorPolicy.h"
 #include "MotionGenerators/MotionMaster.h"
 #include "SQLStorages.h"
diff --git a/src/game/Object/ObjectMgrInstanceData.cpp b/src/game/Object/ObjectMgrInstanceData.cpp
index 114ee16652..4415c14f2e 100644
--- a/src/game/Object/ObjectMgrInstanceData.cpp
+++ b/src/game/Object/ObjectMgrInstanceData.cpp
@@ -32,7 +32,6 @@
 #include "SQLStorages.h"
 #include "DBCStores.h"
 #include "Group.h"
-#include "AuctionHouseBot/AhBotSystemOwner.h"
 #include "LivingWorldAnchorPolicy.h"
 #include "MotionGenerators/MotionMaster.h"
 #include "Policies/Singleton.h"
diff --git a/src/game/Object/ObjectMgrItems.cpp b/src/game/Object/ObjectMgrItems.cpp
index aeb4476178..43738bab66 100644
--- a/src/game/Object/ObjectMgrItems.cpp
+++ b/src/game/Object/ObjectMgrItems.cpp
@@ -60,7 +60,6 @@
 #include "GridNotifiersImpl.h"
 #include "CellImpl.h"
 #include "DisableMgr.h"
-#include "AuctionHouseBot/AhBotSystemOwner.h"
 #include "Formulas.h"
 #include "ItemEnchantmentMgr.h"
 #include <limits>
diff --git a/src/game/Object/ObjectMgrLocaleStrings.cpp b/src/game/Object/ObjectMgrLocaleStrings.cpp
index fb6132aeac..13e29f0bda 100644
--- a/src/game/Object/ObjectMgrLocaleStrings.cpp
+++ b/src/game/Object/ObjectMgrLocaleStrings.cpp
@@ -29,7 +29,6 @@
 #include "ObjectMgr.h"
 #include "Database/DatabaseEnv.h"
 #include "Policies/Singleton.h"
-#include "AuctionHouseBot/AhBotSystemOwner.h"
 #include "LivingWorldAnchorPolicy.h"
 #include "MotionGenerators/MotionMaster.h"
 #include "SQLStorages.h"
diff --git a/src/game/Object/ObjectMgrLocales.cpp b/src/game/Object/ObjectMgrLocales.cpp
index fcecd2ef83..9889a2af5d 100644
--- a/src/game/Object/ObjectMgrLocales.cpp
+++ b/src/game/Object/ObjectMgrLocales.cpp
@@ -35,7 +35,6 @@
 #include "SQLStorages.h"
 #include "DBCStores.h"
 #include "GossipDef.h"
-#include "AuctionHouseBot/AhBotSystemOwner.h"
 #include "LivingWorldAnchorPolicy.h"
 #include "MotionGenerators/MotionMaster.h"
 #include "Policies/Singleton.h"
diff --git a/src/game/Object/ObjectMgrNameCheck.cpp b/src/game/Object/ObjectMgrNameCheck.cpp
index 3c048ed8a8..dfd310541a 100644
--- a/src/game/Object/ObjectMgrNameCheck.cpp
+++ b/src/game/Object/ObjectMgrNameCheck.cpp
@@ -32,7 +32,6 @@
 #include "ProgressBar.h"
 #include "Util.h"
 #include "World.h"
-#include "AuctionHouseBot/AhBotSystemOwner.h"
 #include "LivingWorldAnchorPolicy.h"
 #include "MotionGenerators/MotionMaster.h"
 #include "Policies/Singleton.h"
@@ -74,19 +73,6 @@ void ObjectMgr::LoadReservedPlayersNames()
     {
         BarGoLink bar(1);
         bar.step();
-        // AH bot forged system owner: always reserve its name. In-memory only and
-        // run on every load/reload, so a wiped or never-seeded `reserved_name`
-        // table cannot free the name for players (enforcement is via IsReservedName,
-        // which reads m_ReservedNames).
-        std::wstring wsys;
-        if (Utf8toWStr(AHBOT_SYSTEM_OWNER_NAME, wsys))
-        {
-            wstrToLower(wsys);
-            if (m_ReservedNames.insert(wsys).second)
-            {
-                ++count;
-            }
-        }
         sLog.outString(">> Loaded %u reserved player names", count);
         sLog.outString();
         return;
@@ -117,20 +103,6 @@ void ObjectMgr::LoadReservedPlayersNames()
 
     delete result;
 
-    // AH bot forged system owner: always reserve its name. In-memory only and
-    // run on every load/reload, so a wiped or never-seeded `reserved_name`
-    // table cannot free the name for players (enforcement is via IsReservedName,
-    // which reads m_ReservedNames).
-    std::wstring wsys;
-    if (Utf8toWStr(AHBOT_SYSTEM_OWNER_NAME, wsys))
-    {
-        wstrToLower(wsys);
-        if (m_ReservedNames.insert(wsys).second)
-        {
-            ++count;
-        }
-    }
-
     sLog.outString(">> Loaded %u reserved player names", count);
     sLog.outString();
 }
diff --git a/src/game/Object/ObjectMgrPlayerInfo.cpp b/src/game/Object/ObjectMgrPlayerInfo.cpp
index cbaedc51ab..1f43e30eac 100644
--- a/src/game/Object/ObjectMgrPlayerInfo.cpp
+++ b/src/game/Object/ObjectMgrPlayerInfo.cpp
@@ -34,7 +34,6 @@
 #include "MapManager.h"
 #include "ProgressBar.h"
 #include "World.h"
-#include "AuctionHouseBot/AhBotSystemOwner.h"
 #include "LivingWorldAnchorPolicy.h"
 #include "MotionGenerators/MotionMaster.h"
 #include "ObjectGuid.h"
diff --git a/src/game/Object/ObjectMgrQuestRelations.cpp b/src/game/Object/ObjectMgrQuestRelations.cpp
index bad4609905..f2b621f637 100644
--- a/src/game/Object/ObjectMgrQuestRelations.cpp
+++ b/src/game/Object/ObjectMgrQuestRelations.cpp
@@ -30,7 +30,6 @@
 #include "Log.h"
 #include "ProgressBar.h"
 #include "SQLStorages.h"
-#include "AuctionHouseBot/AhBotSystemOwner.h"
 #include "LivingWorldAnchorPolicy.h"
 #include "MotionGenerators/MotionMaster.h"
 #include "Policies/Singleton.h"
diff --git a/src/game/Object/ObjectMgrQuests.cpp b/src/game/Object/ObjectMgrQuests.cpp
index 2c8108f285..4342116537 100644
--- a/src/game/Object/ObjectMgrQuests.cpp
+++ b/src/game/Object/ObjectMgrQuests.cpp
@@ -61,7 +61,6 @@
 #include "GridNotifiersImpl.h"
 #include "CellImpl.h"
 #include "DisableMgr.h"
-#include "AuctionHouseBot/AhBotSystemOwner.h"
 #include "Formulas.h"
 #include "ItemEnchantmentMgr.h"
 #include <limits>
diff --git a/src/game/Object/ObjectMgrReputation.cpp b/src/game/Object/ObjectMgrReputation.cpp
index 25d87f3ea6..465c7a26cf 100644
--- a/src/game/Object/ObjectMgrReputation.cpp
+++ b/src/game/Object/ObjectMgrReputation.cpp
@@ -31,7 +31,6 @@
 #include "DBCStores.h"
 #include "Log.h"
 #include "ProgressBar.h"
-#include "AuctionHouseBot/AhBotSystemOwner.h"
 #include "LivingWorldAnchorPolicy.h"
 #include "MotionGenerators/MotionMaster.h"
 #include "SQLStorages.h"
diff --git a/src/game/Object/ObjectMgrSpellData.cpp b/src/game/Object/ObjectMgrSpellData.cpp
index da44e15262..ec4d1d68a9 100644
--- a/src/game/Object/ObjectMgrSpellData.cpp
+++ b/src/game/Object/ObjectMgrSpellData.cpp
@@ -32,7 +32,6 @@
 #include "SQLStorages.h"
 #include "DBCStores.h"
 #include "SpellMgr.h"
-#include "AuctionHouseBot/AhBotSystemOwner.h"
 #include "LivingWorldAnchorPolicy.h"
 #include "MotionGenerators/MotionMaster.h"
 #include "Policies/Singleton.h"
diff --git a/src/game/Object/ObjectMgrTaxi.cpp b/src/game/Object/ObjectMgrTaxi.cpp
index 31301544b2..480378d700 100644
--- a/src/game/Object/ObjectMgrTaxi.cpp
+++ b/src/game/Object/ObjectMgrTaxi.cpp
@@ -30,7 +30,6 @@
 #include "Policies/Singleton.h"
 #include "DBCStores.h"
 #include "Log.h"
-#include "AuctionHouseBot/AhBotSystemOwner.h"
 #include "LivingWorldAnchorPolicy.h"
 #include "MotionGenerators/MotionMaster.h"
 #include "SQLStorages.h"
diff --git a/src/game/Object/ObjectMgrText.cpp b/src/game/Object/ObjectMgrText.cpp
index e1a9f3bf8f..31930bddd4 100644
--- a/src/game/Object/ObjectMgrText.cpp
+++ b/src/game/Object/ObjectMgrText.cpp
@@ -35,7 +35,6 @@
 #include "DBCStores.h"
 #include "GossipDef.h"
 #include "Language.h"
-#include "AuctionHouseBot/AhBotSystemOwner.h"
 #include "LivingWorldAnchorPolicy.h"
 #include "MotionGenerators/MotionMaster.h"
 #include "Policies/Singleton.h"
diff --git a/src/game/Object/ObjectMgrTrainerVendor.cpp b/src/game/Object/ObjectMgrTrainerVendor.cpp
index 4ae6c8f842..04dccfb786 100644
--- a/src/game/Object/ObjectMgrTrainerVendor.cpp
+++ b/src/game/Object/ObjectMgrTrainerVendor.cpp
@@ -34,7 +34,6 @@
 #include "DBCStores.h"
 #include "SQLStorages.h"
 #include "SpellMgr.h"
-#include "AuctionHouseBot/AhBotSystemOwner.h"
 #include "LivingWorldAnchorPolicy.h"
 #include "MotionGenerators/MotionMaster.h"
 #include "MapManager.h"
diff --git a/src/game/Object/Player.cpp b/src/game/Object/Player.cpp
index a7fd7c8ff2..c9ea41b535 100644
--- a/src/game/Object/Player.cpp
+++ b/src/game/Object/Player.cpp
@@ -4291,22 +4291,6 @@ bool Player::HasItemWithIdEquipped(uint32 item, uint32 count, uint8 except_slot)
     return false;
 }
 
-/// Runs ONLY the Eluna OnCanUseItem veto (D5). Returns EQUIP_ERR_OK when Eluna
-/// is compiled out or there is no veto. Used by the deferred-Eluna browse pass,
-/// which has already had every non-Eluna sub-filter enforced worker-side.
-InventoryResult Player::CanUseItemEluna(uint32 itemEntry) const
-{
-#ifdef ENABLE_ELUNA
-    if (Eluna* e = GetEluna())
-    {
-        return e->OnCanUseItem(this, itemEntry);
-    }
-#else
-    (void)itemEntry;
-#endif
-    return EQUIP_ERR_OK;
-}
-
 
 
 
diff --git a/src/game/Object/Player.h b/src/game/Object/Player.h
index 011eb69feb..c6bf6ce265 100644
--- a/src/game/Object/Player.h
+++ b/src/game/Object/Player.h
@@ -72,7 +72,6 @@
 #include "ItemPrototype.h"
 #include "Unit.h"
 #include "Item.h"
-#include "AhUsabilityRef.h"
 
 #include "Database/DatabaseEnv.h"
 #include "QuestDef.h"
@@ -1559,12 +1558,6 @@ class Player : public Unit
         InventoryResult CanUseItem(ItemPrototype const* pItem, bool direct_action = true) const;
         InventoryResult CanUseAmmo(uint32 item) const;
 
-        /// Runs ONLY the Eluna OnCanUseItem veto (D5). Returns EQUIP_ERR_OK when
-        /// Eluna is compiled out or there is no veto. Used by the deferred-Eluna
-        /// browse pass, which has already had every non-Eluna sub-filter enforced
-        /// worker-side.
-        InventoryResult CanUseItemEluna(uint32 itemEntry) const;
-
         // Store a new item
         Item* StoreNewItem(ItemPosCountVec const& pos, uint32 item, bool update, int32 randomPropertyId = 0);
 
@@ -4005,16 +3998,6 @@ class Player : public Unit
 
     private:
         uint32 m_created_date = 0;
-
-        /// Context struct threaded through AhUsabilityRef::Evaluate thunks so
-        /// the static callbacks can reach the Player instance without a capture.
-        struct AhEvalCtx { const Player* self; };
-
-        /// Static thunks for AhUsabilityRef::Evaluate (D1). Cast ctx to AhEvalCtx*.
-        static uint16 ThunkSkillRank(void* c, uint32 s);
-        static bool   ThunkHasSpell (void* c, uint32 s);
-        static uint8  ThunkRepRank  (void* c, uint32 f);
-
         // internal common parts for CanStore/StoreItem functions
         InventoryResult _CanStoreItem_InSpecificSlot(uint8 bag, uint8 slot, ItemPosCountVec& dest, ItemPrototype const* pProto, uint32& count, bool swap, Item* pSrcItem) const;
 
diff --git a/src/game/Object/PlayerItemValidation.cpp b/src/game/Object/PlayerItemValidation.cpp
index 77f00ec960..7008ff94f2 100644
--- a/src/game/Object/PlayerItemValidation.cpp
+++ b/src/game/Object/PlayerItemValidation.cpp
@@ -1708,39 +1708,6 @@ InventoryResult Player::CanUseItem(Item* pItem, bool direct_action) const
     return EQUIP_ERR_ITEM_NOT_FOUND;
 }
 
-// D1: map the header-free AhUseResult back to the EXACT InventoryResult. The
-// switch is exhaustive so every per-branch code is preserved (CanUseAmmo /
-// SpellHandler forward these to the client); the static_assert pins AHUSE_OK.
-static InventoryResult MapAhUseResult(AhUseResult r)
-{
-    static_assert(int(AHUSE_OK) == int(EQUIP_ERR_OK),
-                  "AHUSE_OK must equal EQUIP_ERR_OK");
-    switch (r)
-    {
-        case AHUSE_OK:                    return EQUIP_ERR_OK;
-        case AHUSE_NEVER_USE:             return EQUIP_ERR_YOU_CAN_NEVER_USE_THAT_ITEM;
-        case AHUSE_NO_PROFICIENCY:        return EQUIP_ERR_NO_REQUIRED_PROFICIENCY;
-        case AHUSE_CANT_EQUIP_SKILL:      return EQUIP_ERR_CANT_EQUIP_SKILL;
-        case AHUSE_CANT_EQUIP_RANK:       return EQUIP_ERR_CANT_EQUIP_RANK;
-        case AHUSE_CANT_EQUIP_LEVEL:      return EQUIP_ERR_CANT_EQUIP_LEVEL_I;
-        case AHUSE_CANT_EQUIP_REPUTATION: return EQUIP_ERR_CANT_EQUIP_REPUTATION;
-    }
-    return EQUIP_ERR_YOU_CAN_NEVER_USE_THAT_ITEM;   // unreachable
-}
-
-uint16 Player::ThunkSkillRank(void* c, uint32 s)
-{
-    return reinterpret_cast<AhEvalCtx*>(c)->self->GetSkillValue(s);
-}
-bool Player::ThunkHasSpell(void* c, uint32 s)
-{
-    return reinterpret_cast<AhEvalCtx*>(c)->self->HasSpell(s);
-}
-uint8 Player::ThunkRepRank(void* c, uint32 f)
-{
-    return uint8(reinterpret_cast<AhEvalCtx*>(c)->self->GetReputationRank(f));
-}
-
 /**
  * @brief Checks whether an item prototype is usable by the player.
  *
@@ -1754,41 +1721,118 @@ InventoryResult Player::CanUseItem(ItemPrototype const* pProto, bool direct_acti
 
     if (pProto)
     {
-        // NOTE: the prototype overload historically did NOT check reputation or
-        // proficiency (those are in the Item* overload). Pass 0 for
-        // rep/proficiency so Evaluate skips them here; the Item* overload passes
-        // the real values. The null-pProto case returns EQUIP_ERR_ITEM_NOT_FOUND
-        // below, outside Evaluate (the AhUseResult enum has no such value).
-        AhRefItem it;
-        it.itemClass            = pProto->Class;
-        it.allowableClass       = pProto->AllowableClass;
-        it.allowableRace        = pProto->AllowableRace;
-        it.requiredLevel        = pProto->RequiredLevel;
-        it.itemId               = pProto->ItemId;
-        it.requiredSkill        = pProto->RequiredSkill;
-        it.requiredSkillRank    = pProto->RequiredSkillRank;
-        it.requiredSpell        = pProto->RequiredSpell;
-        it.requiredHonorRank    = pProto->RequiredHonorRank;
-        it.requiredRepFaction   = 0u;
-        it.requiredRepRank      = 0u;
-        it.itemProficiencySkill = 0u;
-
-        // D1: Evaluate returns the per-branch AhUseResult; MapAhUseResult maps
-        // it 1:1 to the EXACT InventoryResult (no collapse) so callers that
-        // forward specific codes keep their client error messages.
-        // D2: direct_action gates the honor branch.
-        AhEvalCtx evalCtx = { this };
-        const AhUseResult ur = AhUsabilityRef::Evaluate(
-            getClassMask(), getRaceMask(), getLevel(),
-            uint32(GetHonorHighestRankInfo().rank), direct_action,
-            sWorld.getConfig(CONFIG_UINT32_MIN_TRAIN_MOUNT_LEVEL),
-            sWorld.getConfig(CONFIG_UINT32_MIN_TRAIN_EPIC_MOUNT_LEVEL),
-            it,
-            &Player::ThunkSkillRank, &Player::ThunkHasSpell, &Player::ThunkRepRank,
-            &evalCtx);
-        if (ur != AHUSE_OK)
-        {
-            return MapAhUseResult(ur);
+        if ((pProto->AllowableClass & getClassMask()) == 0 || (pProto->AllowableRace & getRaceMask()) == 0)
+        {
+            return EQUIP_ERR_YOU_CAN_NEVER_USE_THAT_ITEM;
+        }
+
+        if (pProto->RequiredSkill != 0)
+        {
+            if (GetSkillValue(pProto->RequiredSkill) == 0)
+            {
+                return EQUIP_ERR_NO_REQUIRED_PROFICIENCY;
+            }
+            else if (GetSkillValue(pProto->RequiredSkill) < pProto->RequiredSkillRank)
+            {
+                return EQUIP_ERR_CANT_EQUIP_SKILL;
+            }
+        }
+
+        if (pProto->RequiredSpell != 0 && !HasSpell(pProto->RequiredSpell))
+        {
+            return EQUIP_ERR_NO_REQUIRED_PROFICIENCY;
+        }
+
+        if (direct_action && GetHonorHighestRankInfo().rank < (uint8)pProto->RequiredHonorRank)
+        {
+            return EQUIP_ERR_CANT_EQUIP_RANK;
+        }
+
+        // override mount level requirements with the settings from the configuration file
+        uint32 requiredLevel = pProto->RequiredLevel;
+        switch (pProto->ItemId)
+        {
+            case 1132: //regular mounts
+            case 2411:
+            case 2414:
+            case 5655:
+            case 5656:
+            case 5665:
+            case 5668:
+            case 5864:
+            case 5872:
+            case 5873:
+            case 8563:
+            case 8588:
+            case 8591:
+            case 8592:
+            case 8595:
+            case 8629:
+            case 8631:
+            case 8632:
+            case 12325:
+            case 12326:
+            case 12327:
+            case 13321:
+            case 13322:
+            case 13331:
+            case 13332:
+            case 13333:
+            case 15277:
+            case 15290:
+            case 18241:
+            case 18242:
+            case 18243:
+            case 18244:
+            case 18245:
+            case 18246:
+            case 18247:
+            case 18248:
+                requiredLevel = AccountTypes(sWorld.getConfig(CONFIG_UINT32_MIN_TRAIN_MOUNT_LEVEL));
+                break;
+            case 12302: // epic mounts
+            case 12303:
+            case 12330:
+            case 12351:
+            case 12353:
+            case 12354:
+            case 13086:
+            case 13326:
+            case 13327:
+            case 13328:
+            case 13329:
+            case 13334:
+            case 13335:
+            case 18766:
+            case 18767:
+            case 18768:
+            case 18772:
+            case 18773:
+            case 18774:
+            case 18776:
+            case 18777:
+            case 18778:
+            case 18785:
+            case 18786:
+            case 18787:
+            case 18788:
+            case 18789:
+            case 18790:
+            case 18791:
+            case 18793:
+            case 18794:
+            case 18795:
+            case 18796:
+            case 18797:
+            case 18798:
+            case 18902:
+                requiredLevel = AccountTypes(sWorld.getConfig(CONFIG_UINT32_MIN_TRAIN_EPIC_MOUNT_LEVEL));
+                break;
+        }
+
+        if (getLevel() < requiredLevel)
+        {
+            return EQUIP_ERR_CANT_EQUIP_LEVEL_I;
         }
 
 #ifdef ENABLE_ELUNA
diff --git a/src/game/Server/WorldSession.h b/src/game/Server/WorldSession.h
index 2305791ada..cdc40d56ea 100644
--- a/src/game/Server/WorldSession.h
+++ b/src/game/Server/WorldSession.h
@@ -34,6 +34,7 @@
 #include "Platform/Define.h"
 #include "Common/Locales.h"
 #include <ctime>
+#include <functional>
 #include <string>
 #include <vector>
 #include <list>
@@ -52,7 +53,6 @@
 struct ItemPrototype;
 struct AuctionEntry;
 struct AuctionHouseEntry;
-struct CustodyDeferred;
 struct TradeStatusInfo;
 
 class ObjectGuid;
@@ -442,39 +442,11 @@ class WorldSession
         // auction
         void SendAuctionHello(Unit* unit);
         void SendAuctionCommandResult(AuctionEntry* auc, AuctionAction Action, AuctionError ErrorCode, InventoryResult invError = EQUIP_ERR_OK, uint32 newOutbid = 0);
-        /// By-value variant of SendAuctionCommandResult: builds
-        /// SMSG_AUCTION_COMMAND_RESULT from raw values so a deferred custody
-        /// closure can snapshot the auction Id (the buyout path deletes the
-        /// AuctionEntry before the deferred queue runs -- spec I5).
-        void SendAuctionCommandResultData(uint32 aucId, AuctionAction Action, AuctionError ErrorCode, InventoryResult invError, uint32 newOutbid);
         void SendAuctionBidderNotification(AuctionEntry* auction, bool won);
-        /// By-value variant of SendAuctionBidderNotification: builds
-        /// SMSG_AUCTION_BIDDER_NOTIFICATION from raw values snapshotted before a
-        /// custody co-commit (spec I5).
-        void SendAuctionBidderNotificationData(uint32 houseId, uint32 id, uint32 bidder, uint32 bid, uint32 outbid, uint32 itemTemplate, int32 itemRand, bool won);
         void SendAuctionOwnerNotification(AuctionEntry* auction, bool sold);
-        /// By-value variant of SendAuctionOwnerNotification: builds
-        /// SMSG_AUCTION_OWNER_NOTIFICATION from raw values snapshotted before a
-        /// custody co-commit, so a deferred closure can fire it after the
-        /// AuctionEntry is gone (spec I5).
-        void SendAuctionOwnerNotificationData(uint32 houseId, uint32 id, uint32 bid, uint32 outbid, uint32 bidderGuidLow, uint32 itemTemplate, int32 itemRand, bool sold);
         void SendAuctionRemovedNotification(AuctionEntry* auction);
-        /// By-value variant of SendAuctionRemovedNotification: builds
-        /// SMSG_AUCTION_REMOVED_NOTIFICATION from raw values snapshotted before a
-        /// custody co-commit, so a deferred closure can fire it after the
-        /// AuctionEntry is gone (spec I5 / S5).
-        void SendAuctionRemovedNotificationData(uint32 id, uint32 itemTemplate, int32 itemRand);
         static void SendAuctionOutbiddedMail(AuctionEntry* auction);
-        /// Custody co-commit variant of SendAuctionOutbiddedMail: defers the
-        /// online bidder notification (snapshotted by value) then co-commits the
-        /// refund mail into the caller's open transaction (spec B / S2).
-        static void SendAuctionOutbiddedMailInTransaction(AuctionEntry* auction, CustodyDeferred& def);
-        void SendAuctionCancelledToBidderMail(AuctionEntry* auction);
-        /// Custody co-commit variant of SendAuctionCancelledToBidderMail: defers
-        /// the distinct SMSG_AUCTION_REMOVED_NOTIFICATION (snapshotted by value)
-        /// then co-commits the refund mail (money = auction->bid) into the
-        /// caller's open transaction (spec B / S5).
-        static void SendAuctionCancelledToBidderMailInTransaction(AuctionEntry* auction, CustodyDeferred& def);
+        void SendAuctionCancelledToBidderMail(AuctionEntry* auction, std::vector<std::function<void()>>& afterCommit);
         AuctionHouseEntry const* GetCheckedAuctionHouseForAuctioneer(ObjectGuid guid);
 
         // Item Enchantment
diff --git a/src/game/WorldHandlers/AuctionHouseHandler.cpp b/src/game/WorldHandlers/AuctionHouseHandler.cpp
index b68414e557..3c13fad4af 100644
--- a/src/game/WorldHandlers/AuctionHouseHandler.cpp
+++ b/src/game/WorldHandlers/AuctionHouseHandler.cpp
@@ -49,27 +49,13 @@
 #include "ObjectGuid.h"
 #include "Player.h"
 #include "AuctionHouseMgr.h"
-#include "AuctionHouseBot/CustodyService.h"
-#include "AuctionHouseBot/CustodyLedger.h"
-#include "AuctionHouseBot/BrowsePending.h"
-#include "AuctionHouseBot/MutationPending.h"
+#include "AuctionHouseModule.h"
 #include "Mail.h"
 #include "Util.h"
 #include "Chat.h"
-#include "ReputationMgr.h"
-#include "SQLStorages.h"
-#include "DBCStores.h"
-#include "SpellMgr.h"
-#include "BrowseMessages.h"
-#include "IpcMessage.h"
-#include "IpcOpcodes.h"
-#include "PlayerMutations.h"
-#include "WorkerSupervisor.h"
+#include <functional>
 #include <string>
 #include <vector>
-#include <map>
-#include <list>
-#include <ctime>
 #ifdef ENABLE_ELUNA
 #include "LuaEngine.h"
 #endif /* ENABLE_ELUNA */
@@ -82,86 +68,6 @@
 // please DO NOT use iterator++, because it is slower than ++iterator!!!
 // post-incrementation is always slower than pre-incrementation !
 
-// SP-1 coordinator: the player-facing "AH temporarily unavailable" signal -- a
-// transient center-screen flash (SMSG_NOTIFICATION) PLUS a persistent red system
-// chat line. Used wherever a worker is the AH authority but cannot serve: the
-// window-open gate (SendAuctionHello) and the three browse read paths
-// (AhSendBrowseUnavailable, also from the World.cpp reply branch + TTL sweep).
-static void AhSendUnavailableMessage(WorldSession* session)
-{
-    session->SendNotification("The Auction House is temporarily unavailable.");
-    ChatHandler(session).SendSysMessage("|cffff0000The Auction House is temporarily unavailable.|r");
-}
-
-// SP-2 Task 10: bid-forward classifier. See MutationPending.h for the full
-// contract. Kept as a free function so `mangosd -t ahforwardreserve` can
-// exercise the real classification logic against seeded ledger rows without a
-// live Player or worker.
-uint16 AhClassifyBidForward(uint32 auctionId, uint32 bidderGuidLow, uint32 price,
-                            uint32& reserveAmount)
-{
-    reserveAmount = price;
-
-    CustodyRow liveRow;
-    if (!CustodyLedger::GetSingleLiveBidRow(auctionId, liveRow) ||
-        liveRow.ownerGuid != bidderGuidLow)
-    {
-        // Not provably this player's live bid (no row, ambiguous rows, or
-        // another player's row): reserve the full submitted price as maxPrice
-        // and let the worker adjudicate against the book (spec I6 / 4.1).
-        return uint16(IPC_PLAYER_BUYOUT);
-    }
-
-    if (price <= liveRow.amount)
-    {
-        // Raising to at-or-below the player's own live bid: legacy rejects
-        // inline (`price <= auction->bid` -> AUCTION_ERR_HIGHER_BID).
-        return 0u;
-    }
-
-    // Same-bidder top-up (spec I9): only the delta is reserved; the finalize
-    // applies the top-up. Route it as IPC_PLAYER_BUYOUT instead of BID because
-    // mangosd does not own the book's buyout price under WriteAuthority. The
-    // worker treats a below-buyout 0x42 as a normal bid at maxPrice and an
-    // at/over-buyout 0x42 as the win, so the same delta reserve covers both
-    // raise and current-high-bidder-buyout without an out-of-band book read.
-    reserveAmount = price - liveRow.amount;
-    return uint16(IPC_PLAYER_BUYOUT);
-}
-
-bool AhBuildCancelPrepareForward(MutationPendingMap& pending, uint32 playerGuidLow,
-                                 uint32 auctionId, uint64 uuid, uint32 sentSec,
-                                 IpcMessage& out)
-{
-    if (!pending.CanRegister(playerGuidLow))
-    {
-        return false;
-    }
-
-    PendingMutation pm;
-    pm.uuid           = uuid;
-    pm.playerGuidLow  = playerGuidLow;
-    pm.op             = uint16(IPC_PLAYER_CANCEL);
-    pm.auctionId      = auctionId;
-    pm.state          = uint8(PMUT_AWAIT_RESULT);
-    pm.sentSec        = sentSec;
-    pm.reservedAmount = 0u;
-    pm.reserveKey.clear();
-    pm.itemKey.clear();
-    pm.depKey.clear();
-    pending.Register(pm);
-
-    PlayerCancelPrepare prep;
-    prep.uuid       = uuid;
-    prep.auctionId  = auctionId;
-    prep.sellerGuid = playerGuidLow;
-
-    out = IpcMessage();
-    out.op = IPC_PLAYER_CANCEL;
-    prep.Encode(out.body);
-    return true;
-}
-
 // void called when player click on auctioneer npc
 void WorldSession::HandleAuctionHelloOpcode(WorldPacket& recv_data)
 {
@@ -187,18 +93,8 @@ void WorldSession::HandleAuctionHelloOpcode(WorldPacket& recv_data)
 // this void causes that auction window is opened
 void WorldSession::SendAuctionHello(Unit* unit)
 {
-    // SP-1 coordinator: if the worker is the CONFIGURED AH authority but not
-    // currently active (never started, or down), do NOT open the auction window
-    // at all -- the AH is unavailable; tell the player (center flash + chat) and
-    // return. The authority test is IsAhServiceConfigured(), NOT the supervisor
-    // pointer, so a configured-but-failed-start (sv == NULL) is still caught here
-    // rather than silently opening the window. When the worker is not configured,
-    // open normally (legacy single-process). This is the single chokepoint for
-    // every open path (auctioneer click, gossip option, .auction GM commands).
-    WorkerSupervisor* sv = sWorld.GetAhSupervisor();
-    if (sWorld.IsAhServiceConfigured() && !(sv && sv->ServiceActive()))
+    if (AuctionHouseModules::Answer([this](AuctionHouseModule& module) { return module.BlocksHello(*this); }))
     {
-        AhSendUnavailableMessage(this);
         return;
     }
 
@@ -213,39 +109,9 @@ void WorldSession::SendAuctionHello(Unit* unit)
 
 // call this method when player bids, creates, or deletes auction
 void WorldSession::SendAuctionCommandResult(AuctionEntry* auc, AuctionAction Action, AuctionError ErrorCode, InventoryResult invError, uint32 newOutbid /*= 0*/)
-{
-    // The AUCTION_ERR_HIGHER_BID branch dereferences auc (bidder/bid); it is
-    // only ever sent inline on a guard-reject (never deferred), so it stays
-    // here. All other branches are value-only and delegate to the by-value
-    // variant below. The bid-OK increment is resolved here while auc is live.
-    if (ErrorCode == AUCTION_ERR_HIGHER_BID)
-    {
-        WorldPacket data(SMSG_AUCTION_COMMAND_RESULT, 16);
-        data << uint32(auc ? auc->Id : 0);
-        data << uint32(Action);
-        data << uint32(ErrorCode);
-        data << ObjectGuid(HIGHGUID_PLAYER, auc->bidder);   // new bidder guid
-        data << uint32(auc->bid);                           // new bid
-        data << uint32(auc->GetAuctionOutBid());            // new AuctionOutBid?
-        SendPacket(&data);
-        return;
-    }
-
-    uint32 outbid = newOutbid;
-    if (ErrorCode == AUCTION_OK && Action == AUCTION_BID_PLACED && !outbid)
-    {
-        outbid = auc->GetAuctionOutBid();                   // resolve while auc is live
-    }
-
-    SendAuctionCommandResultData(auc ? auc->Id : 0, Action, ErrorCode, invError, outbid);
-}
-
-// by-value variant: builds SMSG_AUCTION_COMMAND_RESULT from raw values so a
-// deferred custody closure can fire it after the AuctionEntry is gone (spec I5)
-void WorldSession::SendAuctionCommandResultData(uint32 aucId, AuctionAction Action, AuctionError ErrorCode, InventoryResult invError, uint32 newOutbid)
 {
     WorldPacket data(SMSG_AUCTION_COMMAND_RESULT, 16);
-    data << uint32(aucId);
+    data << uint32(auc ? auc->Id : 0);
     data << uint32(Action);
     data << uint32(ErrorCode);
 
@@ -254,12 +120,17 @@ void WorldSession::SendAuctionCommandResultData(uint32 aucId, AuctionAction Acti
         case AUCTION_OK:
             if (Action == AUCTION_BID_PLACED)
             {
-                data << uint32(newOutbid);                  // outbid increment (pre-resolved)
+                data << uint32(newOutbid ? newOutbid : auc->GetAuctionOutBid());     // outbid increment
             }
             break;
         case AUCTION_ERR_INVENTORY:
             data << uint32(invError);
             break;
+        case AUCTION_ERR_HIGHER_BID:
+            data << ObjectGuid(HIGHGUID_PLAYER, auc->bidder); // new bidder guid
+            data << uint32(auc->bid);                       // new bid
+            data << uint32(auc->GetAuctionOutBid());        // new AuctionOutBid?
+            break;
         default:
             break;
     }
@@ -269,25 +140,17 @@ void WorldSession::SendAuctionCommandResultData(uint32 aucId, AuctionAction Acti
 
 // this function sends notification, if bidder is online
 void WorldSession::SendAuctionBidderNotification(AuctionEntry* auction, bool won)
-{
-    SendAuctionBidderNotificationData(auction->GetHouseId(), auction->Id, auction->bidder,
-                                      auction->bid, auction->GetAuctionOutBid(),
-                                      auction->itemTemplate, auction->itemRandomPropertyId, won);
-}
-
-// by-value variant of SendAuctionBidderNotification (spec I5)
-void WorldSession::SendAuctionBidderNotificationData(uint32 houseId, uint32 id, uint32 bidder, uint32 bid, uint32 outbid, uint32 itemTemplate, int32 itemRand, bool won)
 {
     WorldPacket data(SMSG_AUCTION_BIDDER_NOTIFICATION, (8 * 4));
-    data << uint32(houseId);
-    data << uint32(id);
-    data << ObjectGuid(HIGHGUID_PLAYER, bidder);
+    data << uint32(auction->GetHouseId());
+    data << uint32(auction->Id);
+    data << ObjectGuid(HIGHGUID_PLAYER, auction->bidder);
 
     // if 0, client shows ERR_AUCTION_WON_S, else ERR_AUCTION_OUTBID_S
-    data << uint32(won ? 0 : bid);
-    data << uint32(outbid);                                 // AuctionOutBid?
-    data << uint32(itemTemplate);
-    data << int32(itemRand);
+    data << uint32(won ? 0 : auction->bid);
+    data << uint32(auction->GetAuctionOutBid());            // AuctionOutBid?
+    data << uint32(auction->itemTemplate);
+    data << int32(auction->itemRandomPropertyId);
 
     SendPacket(&data);
 }
@@ -295,56 +158,38 @@ void WorldSession::SendAuctionBidderNotificationData(uint32 houseId, uint32 id,
 // this void causes on client to display: "Your auction sold"
 void WorldSession::SendAuctionOwnerNotification(AuctionEntry* auction, bool sold)
 {
-    SendAuctionOwnerNotificationData(auction->GetHouseId(), auction->Id, auction->bid,
-                                     auction->GetAuctionOutBid(), auction->bidder,
-                                     auction->itemTemplate, auction->itemRandomPropertyId, sold);
-}
-
-// by-value variant of SendAuctionOwnerNotification (spec I5)
-void WorldSession::SendAuctionOwnerNotificationData(uint32 houseId, uint32 id, uint32 bid, uint32 outbid, uint32 bidderGuidLow, uint32 itemTemplate, int32 itemRand, bool sold)
-{
-    // SMSG_AUCTION_OWNER_NOTIFICATION carries no houseId field (unlike the bidder
-    // notification); it is accepted for signature symmetry with the other by-value
-    // builders and to snapshot it alongside the other scalars.
-    (void)houseId;
-
     WorldPacket data(SMSG_AUCTION_OWNER_NOTIFICATION, (7 * 4));
-    data << uint32(id);
-    data << uint32(bid);                                    // if 0, client shows ERR_AUCTION_EXPIRED_S, else ERR_AUCTION_SOLD_S (works only when guid==0)
-    data << uint32(outbid);                                 // AuctionOutBid?
+    data << uint32(auction->Id);
+    data << uint32(auction->bid);                           // if 0, client shows ERR_AUCTION_EXPIRED_S, else ERR_AUCTION_SOLD_S (works only when guid==0)
+    data << uint32(auction->GetAuctionOutBid());            // AuctionOutBid?
 
     ObjectGuid bidder_guid = ObjectGuid();
     if (!sold)                                              // not sold yet
     {
-        bidder_guid = ObjectGuid(HIGHGUID_PLAYER, bidderGuidLow);
+        bidder_guid = ObjectGuid(HIGHGUID_PLAYER, auction->bidder);
     }
 
     // bidder==0 and moneyDeliveryTime==0 for expired auctions, and client shows error messages as described above
     // if bidder!=0 client updates auctions with new bid, outbid and bidderGuid
     data << bidder_guid;                                    // bidder guid
-    data << uint32(itemTemplate);                           // item entry
-    data << int32(itemRand);
+    data << uint32(auction->itemTemplate);                  // item entry
+    data << uint32(auction->itemRandomPropertyId);
 
     SendPacket(&data);
 }
 
 // shows ERR_AUCTION_REMOVED_S
 void WorldSession::SendAuctionRemovedNotification(AuctionEntry* auction)
-{
-    SendAuctionRemovedNotificationData(auction->Id, auction->itemTemplate, auction->itemRandomPropertyId);
-}
-
-// by-value variant of SendAuctionRemovedNotification (spec I5)
-void WorldSession::SendAuctionRemovedNotificationData(uint32 id, uint32 itemTemplate, int32 itemRand)
 {
     WorldPacket data(SMSG_AUCTION_REMOVED_NOTIFICATION, (3 * 4));
-    data << uint32(id);
-    data << uint32(itemTemplate);
-    data << uint32(itemRand);
+    data << uint32(auction->Id);
+    data << uint32(auction->itemTemplate);
+    data << uint32(auction->itemRandomPropertyId);
 
     SendPacket(&data);
 }
 
+
 // this function sends mail to old bidder
 void WorldSession::SendAuctionOutbiddedMail(AuctionEntry* auction)
 {
@@ -374,101 +219,9 @@ void WorldSession::SendAuctionOutbiddedMail(AuctionEntry* auction)
     }
 }
 
-// Custody co-commit variant of SendAuctionOutbiddedMail. Same old-bidder guard;
-// it (a) defers the online bidder notification snapshotted BY VALUE so it fires
-// in legacy order (notify before mail), then (b) co-commits the refund mail into
-// the caller's open transaction (its own online push is appended AFTER the notify
-// by SendMailToInTransaction). Reads the OLD auction->bid, so the caller MUST
-// call this before mutating bid (spec B / S2).
-void WorldSession::SendAuctionOutbiddedMailInTransaction(AuctionEntry* auction, CustodyDeferred& def)
-{
-    ObjectGuid oldBidder_guid = ObjectGuid(HIGHGUID_PLAYER, auction->bidder);
-    Player* oldBidder = sObjectMgr.GetPlayer(oldBidder_guid);
-
-    uint32 oldBidder_accId = 0;
-    if (!oldBidder)
-    {
-        oldBidder_accId = sObjectMgr.GetPlayerAccountIdByGUID(oldBidder_guid);
-    }
-
-    // old bidder exist
-    if (oldBidder || oldBidder_accId)
-    {
-        std::ostringstream msgAuctionOutbiddedSubject;
-        msgAuctionOutbiddedSubject << auction->itemTemplate << ":" << auction->itemRandomPropertyId << ":" << AUCTION_OUTBIDDED;
-
-        // Defer the online bidder notification, snapshotting every field BY
-        // VALUE (the buyout path may delete the AuctionEntry before run()).
-        // Appended BEFORE the refund mail so packet order = notify-then-mail.
-        // The closure captures the old bidder's low GUID + packet scalars only
-        // (no live WorldSession*/Player*/AuctionEntry*) and RE-RESOLVES the player
-        // by GUID at run time, skipping the live packet if offline -- the durable
-        // mail row is authoritative (spec I2).
-        if (oldBidder)
-        {
-            uint32 oldBidderGuidLow = auction->bidder;
-            uint32 houseId  = auction->GetHouseId();
-            uint32 aucId    = auction->Id;
-            uint32 bidder   = auction->bidder;
-            uint32 bidValue = auction->bid;
-            uint32 outbid   = auction->GetAuctionOutBid();
-            uint32 itemTpl  = auction->itemTemplate;
-            int32  itemRand = auction->itemRandomPropertyId;
-            def.effects.push_back([oldBidderGuidLow, houseId, aucId, bidder, bidValue, outbid, itemTpl, itemRand]()
-            {
-                Player* p = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, oldBidderGuidLow));
-                if (p)
-                {
-                    p->GetSession()->SendAuctionBidderNotificationData(houseId, aucId, bidder, bidValue, outbid, itemTpl, itemRand, false);
-                }
-            });
-        }
-
-        MailDraft(msgAuctionOutbiddedSubject.str(),"")
-            .SetMoney(auction->bid)
-            .SendMailToInTransaction(MailReceiver(oldBidder, oldBidder_guid), MailSender(auction), def, MAIL_CHECK_MASK_COPIED);
-    }
-}
-
-// this function sends mail, when auction is cancelled to old bidder
-void WorldSession::SendAuctionCancelledToBidderMail(AuctionEntry* auction)
-{
-    ObjectGuid bidder_guid = ObjectGuid(HIGHGUID_PLAYER, auction->bidder);
-    Player* bidder = sObjectMgr.GetPlayer(bidder_guid);
-
-    uint32 bidder_accId = 0;
-    if (!bidder)
-    {
-        bidder_accId = sObjectMgr.GetPlayerAccountIdByGUID(bidder_guid);
-    }
-
-    // bidder exist
-    if (bidder || bidder_accId)
-    {
-        std::ostringstream msgAuctionCancelledSubject;
-        msgAuctionCancelledSubject << auction->itemTemplate << ":" << auction->itemRandomPropertyId << ":" << AUCTION_CANCELLED_TO_BIDDER;
-
-        if (bidder)
-        {
-            bidder->GetSession()->SendAuctionRemovedNotification(auction);
-        }
-
-        MailDraft(msgAuctionCancelledSubject.str(),"")
-            .SetMoney(auction->bid)
-            .SendMailTo(MailReceiver(bidder, bidder_guid), auction, MAIL_CHECK_MASK_COPIED);
-    }
-}
-
-// Custody co-commit variant of SendAuctionCancelledToBidderMail. Same old-bidder
-// guard; it (a) defers the online bidder's DISTINCT SMSG_AUCTION_REMOVED_NOTIFICATION
-// snapshotted BY VALUE so it fires in legacy order (notify before mail), then
-// (b) co-commits the refund mail (money = auction->bid) into the caller's open
-// transaction (its own online push is appended AFTER the notify by
-// SendMailToInTransaction). Reads auction->bid, so the caller MUST call this
-// before any bid mutation (there is none in S5; cancel deletes the auction).
-// Note: unlike the outbid path this emits SendAuctionRemovedNotification (a third,
-// distinct opcode), NOT SendAuctionBidderNotification (spec B / S5).
-void WorldSession::SendAuctionCancelledToBidderMailInTransaction(AuctionEntry* auction, CustodyDeferred& def)
+// this function sends mail, when auction is cancelled to old bidder, inside the
+// caller's open transaction; what the bidder sees waits in afterCommit
+void WorldSession::SendAuctionCancelledToBidderMail(AuctionEntry* auction, std::vector<std::function<void()>>& afterCommit)
 {
     ObjectGuid bidder_guid = ObjectGuid(HIGHGUID_PLAYER, auction->bidder);
     Player* bidder = sObjectMgr.GetPlayer(bidder_guid);
@@ -485,32 +238,17 @@ void WorldSession::SendAuctionCancelledToBidderMailInTransaction(AuctionEntry* a
         std::ostringstream msgAuctionCancelledSubject;
         msgAuctionCancelledSubject << auction->itemTemplate << ":" << auction->itemRandomPropertyId << ":" << AUCTION_CANCELLED_TO_BIDDER;
 
-        // Defer the online bidder's removed-notification, snapshotting every field
-        // BY VALUE (the cancel deletes the AuctionEntry before run()). Appended
-        // BEFORE the refund mail so packet order = notify-then-mail (legacy :334).
-        // The closure captures the bidder's low GUID + packet scalars only (no live
-        // WorldSession*/Player*/AuctionEntry*) and RE-RESOLVES the player by GUID at
-        // run time, skipping the live packet if offline -- the durable mail row is
-        // authoritative (spec I2).
         if (bidder)
         {
-            uint32 bidderGuidLow = auction->bidder;
-            uint32 aucId    = auction->Id;
-            uint32 itemTpl  = auction->itemTemplate;
-            int32  itemRand = auction->itemRandomPropertyId;
-            def.effects.push_back([bidderGuidLow, aucId, itemTpl, itemRand]()
+            afterCommit.push_back([bidder, auction]()
             {
-                Player* p = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, bidderGuidLow));
-                if (p)
-                {
-                    p->GetSession()->SendAuctionRemovedNotificationData(aucId, itemTpl, itemRand);
-                }
+                bidder->GetSession()->SendAuctionRemovedNotification(auction);
             });
         }
 
         MailDraft(msgAuctionCancelledSubject.str(),"")
             .SetMoney(auction->bid)
-            .SendMailToInTransaction(MailReceiver(bidder, bidder_guid), MailSender(auction), def, MAIL_CHECK_MASK_COPIED);
+            .SendMailToInTransaction(MailReceiver(bidder, bidder_guid), MailSender(auction), afterCommit, MAIL_CHECK_MASK_COPIED);
     }
 }
 
@@ -651,127 +389,9 @@ void WorldSession::HandleAuctionSellItem(WorldPacket& recv_data)
             GetPlayerName(), GetAccountId(), it->GetProto()->Name1, it->GetEntry(), it->GetCount());
     }
 
-    // ----- SP-2 write-authority forward path: reserve -> forward (spec 4.1) -----
-    // Placed BEFORE the 50-owned-auctions loop: that guard walks the local
-    // AuctionsMap, which is dead under WriteAuthority -- the worker owns the
-    // book and enforces the 50-cap itself (spec I6). Eluna OnAdd fires at
-    // finalize time from the worker facts (spec 5.8, Task 11), not here.
-    if (sWorld.IsAhWriteAuthority())
+    AuctionSale const sale = { auctionHouseEntry, auctionHouse, it, etime, bid, buyout, deposit };
+    if (AuctionHouseModules::Answer([&](AuctionHouseModule& module) { return module.ForwardSell(*this, sale); }))
     {
-        // No in-process fallback of any kind (spec 5.5). Worker configured but
-        // down => the existing unavailable path (center flash + red chat line)
-        // plus an ERR_DATABASE command result so the client UI unlocks
-        // (the same result class as the M2 in-doubt tombstone).
-        WorkerSupervisor* sv = sWorld.GetAhSupervisor();
-        if (!sv || !sv->ServiceActive())
-        {
-            AhSendUnavailableMessage(this);
-            SendAuctionCommandResult(NULL, AUCTION_STARTED, AUCTION_ERR_DATABASE);
-            return;
-        }
-
-        // Cap check BEFORE any reserve (spec 5.5).
-        if (!sWorld.GetMutationPending().CanRegister(pl->GetGUIDLow()))
-        {
-            SendAuctionCommandResult(NULL, AUCTION_STARTED, AUCTION_ERR_DATABASE);
-            return;
-        }
-
-        // mangosd is the sole auction-ID allocator (spec decision 8): minted
-        // here and carried in the intent, so every custody idem key exists at
-        // reserve time.
-        uint32 const auctionId     = sObjectMgr.GenerateAuctionID();
-        uint64 const uuid          = AhMintMutationUuid();
-        std::string const aucIdStr = std::to_string(auctionId);
-        uint32 const itemGuidLow   = itemGuid.GetCounter();
-
-        // In-memory escrow exactly as the custody AddAuction path does (deposit
-        // debit at the legacy :605 position, then mAitems + out of the bags);
-        // the durable writes co-commit below. mAitems stays in mangosd (I7).
-        pl->ModifyMoney(-int32(deposit));
-        sAuctionMgr.AddAItem(it);
-        pl->MoveItemFromInventory(it->GetBagSlot(), it->GetSlot(), true);
-
-        // ONE checked txn (spec decision 9): item ownership move + escrow row +
-        // deposit reserve row. NO `auction` row -- the worker is the sole book
-        // writer and inserts it at commit (spec 4.1 step 3).
-        CharacterDatabase.BeginTransaction();
-        it->DeleteFromInventoryDB();
-        it->SaveToDB();
-        pl->SaveInventoryAndGoldToDB();
-        CustodyService::EscrowItem(pl->GetGUIDLow(), itemGuidLow,
-            "item:" + aucIdStr, auctionId);
-        CustodyService::ReserveGoldAlreadyDebited(pl->GetGUIDLow(), deposit,
-            "dep:" + aucIdStr, auctionId, ROLE_DEPOSIT);
-        if (!CharacterDatabase.CommitTransactionChecked())
-        {
-            // Durable rollback -> restore live state (mirrors the custody S1
-            // rollback below, minus the phantom AuctionEntry: none exists here).
-            sAuctionMgr.RemoveAItem(itemGuidLow);
-            ItemPosCountVec dest;
-            if (pl->CanStoreItem(NULL_BAG, NULL_SLOT, dest, it, false) == EQUIP_ERR_OK)
-            {
-                pl->MoveItemToInventory(dest, it, true, true);
-            }
-            else
-            {
-                sLog.outError("SP-2 sell: seller %u could not re-store item %u on reserve rollback of "
-                              "auction %u; item remains durably the seller's on disk (reloads on relog)",
-                              pl->GetGUIDLow(), itemGuidLow, auctionId);
-            }
-            pl->ModifyMoney(int32(deposit));
-            SendAuctionCommandResult(NULL, AUCTION_STARTED, AUCTION_ERR_DATABASE);
-            sLog.outError("SP-2 sell: reserve txn rolled back for auction %u; live state restored", auctionId);
-            return;
-        }
-
-        // [SP-2 Task 15] crash seam: the escrow+deposit reserve is durably
-        // committed but the intent has NOT been forwarded. Reconcile (Task 12)
-        // must release the reserved-but-un-forwarded row. Inert on a live realm.
-        CustodyService::MaybeCrash("post-reserve-pre-forward");
-
-        // Register BEFORE the send so a fast reply can never race an
-        // unregistered uuid.
-        PendingMutation pm;
-        pm.uuid           = uuid;
-        pm.playerGuidLow  = pl->GetGUIDLow();
-        pm.op             = uint16(IPC_PLAYER_SELL);
-        pm.auctionId      = auctionId;
-        pm.state          = uint8(PMUT_AWAIT_RESULT);
-        pm.sentSec        = uint32(time(NULL));
-        pm.reservedAmount = 0u;                 // deposit rides depKey, no bid reserve
-        pm.reserveKey.clear();
-        pm.itemKey        = "item:" + aucIdStr;
-        pm.depKey         = "dep:" + aucIdStr;
-        sWorld.GetMutationPending().Register(pm);
-
-        PlayerSellIntent psi;
-        psi.uuid             = uuid;
-        psi.auctionId        = auctionId;
-        psi.sellerGuid       = pl->GetGUIDLow();
-        psi.house            = uint8(auctionHouseEntry->houseId);
-        psi.itemGuid         = itemGuidLow;
-        psi.itemTemplate     = it->GetEntry();
-        psi.itemCount        = it->GetCount();
-        psi.randomPropertyId = it->GetItemRandomPropertyId();
-        psi.startbid         = bid;
-        psi.buyout           = buyout;
-        psi.deposit          = deposit;         // mangosd-computed, worker persists verbatim (spec 4.1)
-        psi.expireTime       = uint32(time(NULL) + uint32(etime * sWorld.getConfig(CONFIG_FLOAT_RATE_AUCTION_TIME)));
-
-        IpcMessage m;
-        m.op = IPC_PLAYER_SELL;
-        psi.Encode(m.body);
-        if (!sv->Channel().SendFrame(m))
-        {
-            // The reserve is durable and is NEVER unilaterally rolled back
-            // (decision 10): tombstone as in-doubt; reconcile-on-reconnect
-            // resolves it against the worker journal (spec 8).
-            sWorld.GetMutationPending().Tombstone(uuid);
-            SendAuctionCommandResult(NULL, AUCTION_STARTED, AUCTION_ERR_DATABASE);
-            sLog.outError("SP-2 sell: forward send failed for auction %u uuid " UI64FMTD "; reservation in doubt",
-                          auctionId, uuid);
-        }
         return;
     }
 
@@ -803,87 +423,15 @@ void WorldSession::HandleAuctionSellItem(WorldPacket& recv_data)
 
     pl->ModifyMoney(-int32(deposit));
 
-    AuctionEntry* AH;
-    if (sWorld.IsAhCustodyEnabled())
+    AuctionEntry* AH = NULL;
+    if (!AuctionHouseModules::Answer([&](AuctionHouseModule& module) { return module.SettleSell(*this, sale, AH); }))
     {
-        CharacterDatabase.BeginTransaction();
-        AH = auctionHouse->AddAuction(auctionHouseEntry, it, etime, bid, buyout, deposit, pl, false);
-        std::string aucId = std::to_string(AH->Id);
-        CustodyService::EscrowItem(AH->owner, AH->itemGuidLow, "item:" + aucId, AH->Id);
-        CustodyService::ReserveGoldAlreadyDebited(AH->owner, deposit, "dep:" + aucId, AH->Id, ROLE_DEPOSIT);
-        CustodyService::MaybeCrash("pre-commit");
-        if (!CharacterDatabase.CommitTransactionChecked())
-        {
-            // FIX X6: durable rollback -> UNDO the in-memory mutations
-            // AddAuction(ownTransaction=false) applied before the (now reverted)
-            // DB writes. The checked commit failed, so CharacterDatabase rolled
-            // back to the pre-seam DB state (gold intact, character_inventory link
-            // intact, item_instance row intact, no custody_ledger rows). Live
-            // memory, however, still holds: the debited deposit, the item moved out
-            // of the seller's bag + into the AH cache, and a PHANTOM AuctionEntry in
-            // the in-memory map (biddable, with no DB row). Restore live state to
-            // exactly match the rolled-back DB, then report the DB error.
-            uint32 const phantomId = AH->Id;
-            uint32 const itemGuidLow = AH->itemGuidLow;
-
-            // (1) Drop the phantom auction from the in-memory map and free it.
-            //     RemoveAuction only erases the map slot (legacy cancel deletes the
-            //     entry itself), so delete AH after.
-            auctionHouse->RemoveAuction(phantomId);
-
-            // (2) Drop the item from the AH item cache (mAitems). The Item* is NOT
-            //     freed by RemoveAItem -- it is the same live object AddAuction moved
-            //     out of the bag, so it survives for return-to-inventory below.
-            sAuctionMgr.RemoveAItem(itemGuidLow);
-
-            // (3) Return the item to the seller's inventory -- the canonical inverse
-            //     of MoveItemFromInventory (see HandleMailTakeItem / TradeHandler
-            //     item-return): resolve a destination with CanStoreItem, then
-            //     MoveItemToInventory with in_characterInventoryDB=true (sets the
-            //     live item ITEM_CHANGED). The item was never deleted and ownership
-            //     was not cleared on removal, so this re-attaches the same object.
-            //     No re-persist to DB is needed: the failed commit rolled the txn
-            //     back, so the durable character_inventory link + item_instance row
-            //     are STILL the seller's on disk (the success path's
-            //     SaveInventoryAndGoldToDB DELETE of the inventory link never
-            //     committed). This step only re-syncs in-memory state.
-            ItemPosCountVec dest;
-            if (pl->CanStoreItem(NULL_BAG, NULL_SLOT, dest, it, false) == EQUIP_ERR_OK)
-            {
-                pl->MoveItemToInventory(dest, it, true, true);
-            }
-            else
-            {
-                // Should be unreachable: we are returning the item to the very
-                // inventory it left in this same synchronous handler (no other
-                // packet ran in between to consume the slot). Even so, there is NO
-                // durable item loss -- the rolled-back DB still holds the item as
-                // the seller's, so it reloads into the bag on next login. Log loudly
-                // rather than risk a duplicate by force-storing. (TradeHandler's
-                // item-return fallback takes the same log-only stance.)
-                sLog.outError("custody S1: seller %u could not re-store item %u on rollback of "
-                              "auction %u; item remains durably the seller's on disk (reloads on relog)",
-                              pl->GetGUIDLow(), itemGuidLow, phantomId);
-            }
-
-            // (4) Refund the in-memory deposit debit applied at :493. The DB gold
-            //     already rolled back; this re-syncs memory (no re-save, mirroring
-            //     the S2 bid-rollback refund).
-            pl->ModifyMoney(int32(deposit));
-
-            // (5) Free the phantom entry and report the failure to the client in
-            //     place of the AUCTION_OK that the success path would have sent.
-            delete AH;
-            SendAuctionCommandResult(NULL, AUCTION_STARTED, AUCTION_ERR_DATABASE);
-            sLog.outError("custody S1: create txn rolled back for auction %u; live state restored", phantomId);
-            return;
-        }
-
-        CustodyService::MaybeCrash("pre-deferred");
+        AH = auctionHouse->AddAuction(auctionHouseEntry, it, etime, bid, buyout, deposit, pl);
     }
-    else
+
+    if (!AH)
     {
-        AH = auctionHouse->AddAuction(auctionHouseEntry, it, etime, bid, buyout, deposit, pl);
+        return;
     }
 
     DETAIL_LOG("selling %s to auctioneer %s with initial bid %u with buyout %u and with time %u (in sec) in auctionhouse %u",
@@ -931,120 +479,8 @@ void WorldSession::HandleAuctionPlaceBid(WorldPacket& recv_data)
         GetPlayer()->RemoveSpellsCausingAura(SPELL_AURA_FEIGN_DEATH);
     }
 
-    // ----- SP-2 write-authority forward path: reserve -> forward (spec 4.1) -----
-    // Placed BEFORE the local-map GetAuction: mangosd's AuctionsMap is dead
-    // under WriteAuthority (spec 5.7). Existence/state/min-increment/bid-own/
-    // same-account guards move to the worker (spec I6); mangosd validates only
-    // what it owns -- session, gold, and its own ledger (spec 4.1 step 1).
-    if (sWorld.IsAhWriteAuthority())
+    if (AuctionHouseModules::Answer([&](AuctionHouseModule& module) { return module.ForwardBid(*this, auctionId, price); }))
     {
-        Player* pl = GetPlayer();
-
-        WorkerSupervisor* sv = sWorld.GetAhSupervisor();
-        if (!sv || !sv->ServiceActive())
-        {
-            AhSendUnavailableMessage(this);
-            SendAuctionCommandResult(NULL, AUCTION_BID_PLACED, AUCTION_ERR_DATABASE);
-            return;
-        }
-
-        // Cap check BEFORE any reserve (spec 5.5).
-        if (!sWorld.GetMutationPending().CanRegister(pl->GetGUIDLow()))
-        {
-            SendAuctionCommandResult(NULL, AUCTION_BID_PLACED, AUCTION_ERR_DATABASE);
-            return;
-        }
-
-        // Full-price affordability guard at legacy parity (silent return, no
-        // result) -- legacy gates the FULL price even for a same-bidder raise,
-        // so a raise legacy accepts is never rejected here (spec I9).
-        if (price > pl->GetMoney())
-        {
-            return;
-        }
-
-        // Classify against mangosd's OWN ledger: same-bidder top-up ->
-        // IPC_PLAYER_BUYOUT with a delta reserve; everything else ->
-        // IPC_PLAYER_BUYOUT with the full price reserved as maxPrice (worker:
-        // effectiveBid = min(maxPrice, buyout), spec 4.1); 0 -> inline legacy
-        // ERR_HIGHER_BID.
-        uint32 reserveAmount = 0u;
-        uint16 const fwdOp = AhClassifyBidForward(auctionId, pl->GetGUIDLow(), price, reserveAmount);
-        if (fwdOp == 0u)
-        {
-            SendAuctionCommandResultData(auctionId, AUCTION_BID_PLACED, AUCTION_ERR_HIGHER_BID, EQUIP_ERR_OK, 0);
-            return;
-        }
-
-        uint64 const uuid = AhMintMutationUuid();
-        std::string const reserveKey = "bid:" + std::to_string(auctionId) + ":" +
-                                       std::to_string(CustodyLedger::NextBidSeq(auctionId));
-
-        // Durable reserve in ONE checked txn (spec decision 9). ReserveGold
-        // debits the wallet + saves gold inline (legacy debit timing) and
-        // appends the CST_RESERVED row to this open transaction.
-        CustodyDeferred def;
-        CharacterDatabase.BeginTransaction();
-        CustodyService::ReserveGold(def, pl->GetGUIDLow(), pl, reserveAmount, reserveKey, auctionId, ROLE_BID);
-        if (!CharacterDatabase.CommitTransactionChecked())
-        {
-            // DB rolled back -> restore ReserveGold's in-memory debit.
-            pl->ModifyMoney(int32(reserveAmount));
-            SendAuctionCommandResultData(auctionId, AUCTION_BID_PLACED, AUCTION_ERR_DATABASE, EQUIP_ERR_OK, 0);
-            sLog.outError("SP-2 bid: reserve txn rolled back for auction %u", auctionId);
-            return;
-        }
-
-        // [SP-2 Task 15] crash seam: the bid reserve is durably committed but the
-        // intent has NOT been forwarded. Reconcile (Task 12) must release the
-        // reserved-but-un-forwarded row. Inert on a live realm.
-        CustodyService::MaybeCrash("post-reserve-pre-forward");
-
-        // Register BEFORE the send (reply can never race an unknown uuid).
-        PendingMutation pm;
-        pm.uuid           = uuid;
-        pm.playerGuidLow  = pl->GetGUIDLow();
-        pm.op             = fwdOp;
-        pm.auctionId      = auctionId;
-        pm.state          = uint8(PMUT_AWAIT_RESULT);
-        pm.sentSec        = uint32(time(NULL));
-        pm.reservedAmount = reserveAmount;
-        pm.reserveKey     = reserveKey;
-        pm.itemKey.clear();
-        pm.depKey.clear();
-        sWorld.GetMutationPending().Register(pm);
-
-        IpcMessage m;
-        if (fwdOp == uint16(IPC_PLAYER_BID))
-        {
-            PlayerBidIntent pbi;
-            pbi.uuid       = uuid;
-            pbi.auctionId  = auctionId;
-            pbi.bidderGuid = pl->GetGUIDLow();
-            pbi.bidAmount  = price;    // full new price; the finalize tops up by the delta
-            m.op = IPC_PLAYER_BID;
-            pbi.Encode(m.body);
-        }
-        else
-        {
-            PlayerBuyoutIntent pbo;
-            pbo.uuid       = uuid;
-            pbo.auctionId  = auctionId;
-            pbo.bidderGuid = pl->GetGUIDLow();
-            pbo.maxPrice   = price;    // worker: effectiveBid = min(maxPrice, buyout) (spec 4.1)
-            m.op = IPC_PLAYER_BUYOUT;
-            pbo.Encode(m.body);
-        }
-
-        if (!sv->Channel().SendFrame(m))
-        {
-            // Never roll a durable reserve back unilaterally (decision 10):
-            // tombstone as in-doubt; reconcile resolves it via the journal.
-            sWorld.GetMutationPending().Tombstone(uuid);
-            SendAuctionCommandResultData(auctionId, AUCTION_BID_PLACED, AUCTION_ERR_DATABASE, EQUIP_ERR_OK, 0);
-            sLog.outError("SP-2 bid: forward send failed for auction %u uuid " UI64FMTD "; reservation in doubt",
-                          auctionId, uuid);
-        }
         return;
     }
 
@@ -1105,115 +541,14 @@ void WorldSession::HandleAuctionPlaceBid(WorldPacket& recv_data)
         newOutbid = 1;
     }
 
-    // A reload may disable config-gated custody entry and maintenance, but
-    // durable rows already in flight remain authoritative until terminal.
-    CustodyRouteState const route = CustodyLedger::GetRouteState(auction->Id);
-
-    if (!route.known)
+    if (AuctionHouseModules::Answer([&](AuctionHouseModule& module) { return module.SettleBid(*this, *auctionHouse, *auction, price, newOutbid); }))
     {
-        SendAuctionCommandResultData(auction->Id, AUCTION_BID_PLACED,
-                                     AUCTION_ERR_DATABASE, EQUIP_ERR_OK, 0);
         return;
     }
-    // A player-seller row or a player-bid row selects the combined transaction.
-    // Marker-only bot listings remain entirely on the legacy path.
-    if (route.usesPlayerSellerCustody || route.hasLiveBidCustody)
-    {
-        // Custody co-commit path. The success-path SendAuctionCommandResult is
-        // deferred and appended FIRST (its legacy position :507 precedes
-        // UpdateBid), snapshotting auction->Id + newOutbid BY VALUE since the
-        // buyout route deletes the AuctionEntry in the same deferred run (I5).
-        uint32 const capId = auction->Id;
-
-        // A route that claims live bid custody must have exactly one row matching
-        // the current auction state. Seller custody may legitimately coexist with
-        // a legacy standing bid and therefore does not imply this validation.
-        std::string liveBidKey;
-        if (route.hasLiveBidCustody)
-        {
-            CustodyRow liveRow;
-            if (auction->bidder == 0 ||
-                !CustodyLedger::GetSingleLiveBidRow(capId, liveRow) ||
-                liveRow.ownerGuid != auction->bidder ||
-                liveRow.amount != auction->bid)
-            {
-                // No single matching live bid row -> abort before any mutation.
-                sLog.outError("custody S2: live bid row validation failed for auction %u "
-                              "(bidder %u, bid %u); failing closed", capId, auction->bidder, auction->bid);
-                SendAuctionCommandResultData(capId, AUCTION_BID_PLACED, AUCTION_ERR_DATABASE, EQUIP_ERR_OK, 0);
-                return;
-            }
-            liveBidKey = liveRow.idemKey;
-        }
 
-        // FIX C1: snapshot the in-memory state mutated by UpdateBidCustody so a
-        // checked-commit rollback can restore it. effectiveBid mirrors
-        // UpdateBidCustody's buyout cap (newbid = buyout when price > buyout) so the
-        // X6 refund matches the actual debit on a buyout. Only the NEW bidder's
-        // wallet is debited in memory; the old bidder's refund is mail-based and
-        // rolls back with the txn, so no old-bidder restore is needed.
-        uint32 const oldBid = auction->bid;
-        uint32 const oldBidder = auction->bidder;
-        uint32 const effectiveBid = (auction->buyout && price > auction->buyout) ? auction->buyout : price;
-        uint32 const bidderDebit = (oldBidder == pl->GetGUIDLow()) ? (effectiveBid - oldBid) : effectiveBid;
-
-        // Capture bidder by low GUID so the deferred closure holds only uint32
-        // scalars; re-resolving at run-time avoids a dangling WorldSession* if
-        // the player logs out between commit and def.run().
-        uint32 const bidderGuidLow = pl->GetGUIDLow();
-
-        CustodyDeferred def;
-        def.effects.push_back([bidderGuidLow, capId, newOutbid]()
-        {
-            Player* p = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, bidderGuidLow));
-            if (p)
-            {
-                p->GetSession()->SendAuctionCommandResultData(capId, AUCTION_BID_PLACED, AUCTION_OK, EQUIP_ERR_OK, newOutbid);
-            }
-        });
-
-        CharacterDatabase.BeginTransaction();
-        // UpdateBidCustody mutates only deferred/DB state and returns whether the
-        // auction stays active: true = normal bid, false = BUYOUT (the win was
-        // resolved on this same open txn; the auction delete + cache mutations are
-        // deferred into def and run only on commit success). Both are success
-        // paths -> proceed to the checked commit. On the buyout path the auction is
-        // NOT deleted until def.run(), so the X6 restore below is still safe to
-        // reference auction on a commit FAILURE (def.run() did not execute).
-        bool const stillActive = auction->UpdateBidCustody(
-            price, pl, def, route.usesPlayerSellerCustody,
-            route.hasLiveBidCustody, liveBidKey);
-        (void)stillActive;
-
-        CustodyService::MaybeCrash("pre-commit");
-        if (CharacterDatabase.CommitTransactionChecked())
-        {
-            CustodyService::MaybeCrash("pre-deferred");
-            def.run();          // ordered live effects (command-result, notify/mail pushes, buyout win + delete)
-        }
-        else
-        {
-            // FIX C1/X6: durable rollback -> UNDO the in-memory mutations
-            // UpdateBidCustody applied, refund the in-memory debit, and report the
-            // DB error. The auction was NOT deleted (def.run() did not execute), so
-            // restoring its bid/bidder is safe for both the normal-bid and buyout
-            // paths. Otherwise the DB reverts but live memory keeps the bid/gold
-            // and the next bid reads corrupted state. No items are freed here: the
-            // deferred effects did not run, so every custody item survives in
-            // mAitems and the buyout auction re-resolves on the next tick.
-            auction->bid = oldBid;
-            auction->bidder = oldBidder;
-            pl->ModifyMoney(int32(bidderDebit));    // refund the debit we applied in memory
-            SendAuctionCommandResultData(capId, AUCTION_BID_PLACED, AUCTION_ERR_DATABASE, EQUIP_ERR_OK, 0);
-            sLog.outError("custody S2: bid txn rolled back for auction %u; live state restored", capId);
-        }
-    }
-    else
-    {
-        SendAuctionCommandResult(auction, AUCTION_BID_PLACED, AUCTION_OK, EQUIP_ERR_OK, newOutbid);
+    SendAuctionCommandResult(auction, AUCTION_BID_PLACED, AUCTION_OK, EQUIP_ERR_OK, newOutbid);
 
-        auction->UpdateBid(price, pl);
-    }
+    auction->UpdateBid(price, pl);
 }
 
 // this void is called when auction_owner cancels his auction
@@ -1242,41 +577,8 @@ void WorldSession::HandleAuctionRemoveItem(WorldPacket& recv_data)
         GetPlayer()->RemoveSpellsCausingAura(SPELL_AURA_FEIGN_DEATH);
     }
 
-    // ----- SP-2 write-authority cancel path: prepare -> worker -> phase 2 -----
-    // Placed BEFORE the local-map GetAuction: under WriteAuthority the worker
-    // owns the book, so mangosd's legacy AuctionsMap lookup is empty/stale.
-    // Ownership/existence checks move to the worker; mangosd owns only the
-    // pending slot, later cut reserve, and value finalize.
-    if (sWorld.IsAhWriteAuthority())
+    if (AuctionHouseModules::Answer([&](AuctionHouseModule& module) { return module.ForwardCancel(*this, auctionId); }))
     {
-        Player* pl = GetPlayer();
-
-        WorkerSupervisor* sv = sWorld.GetAhSupervisor();
-        if (!sv || !sv->ServiceActive())
-        {
-            AhSendUnavailableMessage(this);
-            SendAuctionCommandResultData(auctionId, AUCTION_REMOVED, AUCTION_ERR_DATABASE, EQUIP_ERR_OK, 0);
-            return;
-        }
-
-        uint64 const uuid = AhMintMutationUuid();
-        IpcMessage m;
-        if (!AhBuildCancelPrepareForward(sWorld.GetMutationPending(), pl->GetGUIDLow(),
-                                         auctionId, uuid, uint32(time(NULL)), m))
-        {
-            SendAuctionCommandResultData(auctionId, AUCTION_REMOVED, AUCTION_ERR_DATABASE, EQUIP_ERR_OK, 0);
-            return;
-        }
-
-        if (!sv->Channel().SendFrame(m))
-        {
-            // No unilateral rollback: the frame may have reached the worker.
-            // Reconcile-on-reconnect resolves by the shared worker journal.
-            sWorld.GetMutationPending().Tombstone(uuid);
-            SendAuctionCommandResultData(auctionId, AUCTION_REMOVED, AUCTION_ERR_DATABASE, EQUIP_ERR_OK, 0);
-            sLog.outError("SP-2 cancel: forward send failed for auction %u uuid " UI64FMTD
-                          "; cancellation in doubt", auctionId, uuid);
-        }
         return;
     }
 
@@ -1298,351 +600,98 @@ void WorldSession::HandleAuctionRemoveItem(WorldPacket& recv_data)
         return;
     }
 
-    // A reload may disable config-gated custody entry and maintenance, but
-    // durable rows already in flight remain authoritative until terminal.
-    CustodyRouteState const route = CustodyLedger::GetRouteState(auction->Id);
-
-    if (!route.known)
+    if (AuctionHouseModules::Answer([&](AuctionHouseModule& module) { return module.SettleCancel(*this, *auctionHouse, *auction); }))
     {
-        SendAuctionCommandResultData(auction->Id, AUCTION_REMOVED,
-                                     AUCTION_ERR_DATABASE, EQUIP_ERR_OK, 0);
         return;
     }
-    if (route.usesPlayerSellerCustody || route.hasLiveBidCustody)
+
+    uint32 cutDebited = 0;
+    std::vector<std::function<void()>> afterCommit;
+
+    // Opened BEFORE the mails: both mails, the item rows, the auction DELETE
+    // and the seller's gold co-commit as one unit. Sending a mail first would
+    // make the returned item durable independently of the auction DELETE -- a
+    // failed DELETE then leaves the auction in the DB with its item already
+    // mailed, duplicating it on the next load. The mails write into this
+    // transaction; what the players see of them waits in afterCommit.
+    CharacterDatabase.BeginTransaction();
+
+    if (auction->bid)                                   // If we have a bid, we have to send him the money he paid
     {
-        // -------------------------------------------------------------------
-        // Custody co-commit path (per-auction drain, X3). One checked txn:
-        // cut debit + bidder refund (ledger + mail) + deposit FORFEIT (ledger
-        // only) + item return to the seller, all co-committed; every live
-        // effect deferred and run only on commit success (spec B/C, S5).
-        // -------------------------------------------------------------------
-
-        // (1) GUARD FIRST -- before any mutation or txn. Matches legacy :835-838
-        //     (silent return, no command-result, no txn) so a too-poor seller
-        //     cancelling a bid auction is byte-identical to today.
-        uint32 const auctionCut = auction->bid ? auction->GetAuctionCut() : 0;
-        if (auction->bid && pl->GetMoney() < auctionCut)
+        uint32 auctionCut = auction->GetAuctionCut();
+        if (pl->GetMoney() < auctionCut)                // player doesn't have enough money, maybe message needed
         {
+            CharacterDatabase.RollbackTransaction();
             return;
         }
 
-        uint32 const capId = auction->Id;
-
-        // A bid-custody route must match exactly one current live bid row.
-        // Seller custody alone may legitimately contain a legacy standing bid.
-        std::string liveBidKey;
-        if (route.hasLiveBidCustody)
+        if (auction->bidder)                            // if auction have real existed bidder send mail
         {
-            CustodyRow liveRow;
-            if (auction->bidder == 0 ||
-                !CustodyLedger::GetSingleLiveBidRow(capId, liveRow) ||
-                liveRow.ownerGuid != auction->bidder ||
-                liveRow.amount != auction->bid)
-            {
-                sLog.outError("custody S5: live bid row validation failed for auction %u "
-                              "(bidder %u, bid %u); failing closed", capId, auction->bidder, auction->bid);
-                SendAuctionCommandResultData(capId, AUCTION_REMOVED, AUCTION_ERR_DATABASE, EQUIP_ERR_OK, 0);
-                return;
-            }
-            liveBidKey = liveRow.idemKey;
+            SendAuctionCancelledToBidderMail(auction, afterCommit);
         }
 
-        uint32 const cutDebited = auction->bid ? auctionCut : 0;
-
-        // Capture the seller's low GUID so the deferred command-result closure
-        // holds only uint32 scalars; re-resolving at run-time avoids a dangling
-        // WorldSession* if the seller logs out between commit and def.run().
-        uint32 const sellerGuidLow = pl->GetGUIDLow();
-
-        CustodyDeferred def;
-        CharacterDatabase.BeginTransaction();
-        auction->PrepareCancelCustody(
-            pl, def, route.usesPlayerSellerCustody,
-            route.hasLiveBidCustody, liveBidKey, auctionCut);
-
-        // (c) Command-result to the SELLER, deferred LAST (legacy :857 fires it
-        //     after the item mail). Scalar-only closure: re-resolve the seller by
-        //     GUID, snapshot capId by value (the auction is deleted in this same
-        //     deferred run).
-        def.effects.push_back([sellerGuidLow, capId]()
-        {
-            Player* p = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, sellerGuidLow));
-            if (p)
-            {
-                p->GetSession()->SendAuctionCommandResultData(capId, AUCTION_REMOVED, AUCTION_OK, EQUIP_ERR_OK, 0);
-            }
-        });
-
-        // Defer the AH-map erase + Eluna OnRemove hook + object delete LAST, in
-        // the exact legacy order of the non-custody branch (RemoveAuction
-        // out-of-map -> OnRemove -> delete), so OnRemove fires ONLY on a
-        // successful checked commit AND sees the same map-state legacy does (the
-        // auction already removed from the map, the object not yet deleted).
-        // `self`/auctionHouse stay valid until the delete at the end of this
-        // closure.
-        AuctionEntry* self = auction;
-        def.effects.push_back([auctionHouse, capId, self]()
-        {
-            auctionHouse->RemoveAuction(capId);
-#ifdef ENABLE_ELUNA
-            if (Eluna* e = sWorld.GetEluna())
-            {
-                e->OnRemove(auctionHouse, self);
-            }
-#endif /* ENABLE_ELUNA */
-            delete self;
-        });
-
-        CustodyService::MaybeCrash("pre-commit");
-        if (CharacterDatabase.CommitTransactionChecked())
-        {
-            CustodyService::MaybeCrash("pre-deferred");
-            def.run();          // ordered live effects (refund notify/mail, item return, command-result, OnRemove, delete)
-        }
-        else
-        {
-            // X6: durable rollback -> UNDO the only in-memory mutation (the cut
-            // debit). The item + auction survive in memory (no deferred effect
-            // ran), so there is nothing else to restore; the auction re-lists on
-            // the next observer and the seller can retry the cancel. No item
-            // discard -- items survive rollback in mAitems (the corrected
-            // lifecycle).
-            pl->ModifyMoney(int32(cutDebited));
-            SendAuctionCommandResultData(capId, AUCTION_REMOVED, AUCTION_ERR_DATABASE, EQUIP_ERR_OK, 0);
-            sLog.outError("custody S5: cancel txn rolled back for auction %u; cut restored", capId);
-        }
+        pl->ModifyMoney(-int32(auctionCut));
+        cutDebited = auctionCut;
     }
-    else
-    {
-        uint32 cutDebited = 0;
-
-        // Opened BEFORE the mails: Database::Execute queues onto the calling
-        // thread's open transaction, so both mails, the item rows, the auction
-        // DELETE and the seller's gold co-commit as one unit. Sending a mail
-        // first would make the returned item durable independently of the
-        // auction DELETE -- a failed DELETE then leaves the auction in the DB
-        // with its item already mailed, duplicating it on the next load.
-        CharacterDatabase.BeginTransaction();
-
-        if (auction->bid)                                   // If we have a bid, we have to send him the money he paid
-        {
-            uint32 auctionCut = auction->GetAuctionCut();
-            if (pl->GetMoney() < auctionCut)                // player doesn't have enough money, maybe message needed
-            {
-                CharacterDatabase.RollbackTransaction();
-                return;
-            }
-
-            if (auction->bidder)                            // if auction have real existed bidder send mail
-            {
-                SendAuctionCancelledToBidderMail(auction);
-            }
+    // Return the item by mail
+    std::ostringstream msgAuctionCanceledOwner;
+    msgAuctionCanceledOwner << auction->itemTemplate << ":" << auction->itemRandomPropertyId << ":" << AUCTION_CANCELED;
 
-            pl->ModifyMoney(-int32(auctionCut));
-            cutDebited = auctionCut;
-        }
-        // Return the item by mail
-        std::ostringstream msgAuctionCanceledOwner;
-        msgAuctionCanceledOwner << auction->itemTemplate << ":" << auction->itemRandomPropertyId << ":" << AUCTION_CANCELED;
+    // item will deleted or added to received mail list
+    MailDraft(msgAuctionCanceledOwner.str(),"")
+        .AddItem(pItem)
+        .SendMailToInTransaction(pl, MailSender(auction), afterCommit, MAIL_CHECK_MASK_COPIED);
 
-        // item will deleted or added to received mail list
-        MailDraft(msgAuctionCanceledOwner.str(),"")
-            .AddItem(pItem)
-            .SendMailTo(pl, auction, MAIL_CHECK_MASK_COPIED);
+    auction->DeleteFromDB();
+    pl->SaveInventoryAndGoldToDB();
 
-        auction->DeleteFromDB();
-        pl->SaveInventoryAndGoldToDB();
+    if (!CharacterDatabase.CommitTransactionChecked())
+    {
+        // Nothing durable landed. Undo the only in-memory mutation; the
+        // auction and its item stay live (the item survives in mAitems) so
+        // the seller can retry.
+        pl->ModifyMoney(int32(cutDebited));
+        SendAuctionCommandResult(auction, AUCTION_REMOVED, AUCTION_ERR_DATABASE);
+        sLog.outError("AH: cancel txn rolled back for auction %u; cut restored", auction->Id);
+        return;
+    }
 
-        if (!CharacterDatabase.CommitTransactionChecked())
-        {
-            // Nothing durable landed. Undo the only in-memory mutation; the
-            // auction and its item stay live (the item survives in mAitems) so
-            // the seller can retry.
-            pl->ModifyMoney(int32(cutDebited));
-            SendAuctionCommandResult(auction, AUCTION_REMOVED, AUCTION_ERR_DATABASE);
-            sLog.outError("AH: cancel txn rolled back for auction %u; cut restored", auction->Id);
-            return;
-        }
+    for (std::function<void()> const& effect : afterCommit)
+    {
+        effect();
+    }
 
-        // inform player, that auction is removed
-        SendAuctionCommandResult(auction, AUCTION_REMOVED, AUCTION_OK);
-        sAuctionMgr.RemoveAItem(auction->itemGuidLow);
-        auctionHouse->RemoveAuction(auction->Id);
+    // inform player, that auction is removed
+    SendAuctionCommandResult(auction, AUCTION_REMOVED, AUCTION_OK);
+    sAuctionMgr.RemoveAItem(auction->itemGuidLow);
+    auctionHouse->RemoveAuction(auction->Id);
 
-        // Used by Eluna
+    // Used by Eluna
 #ifdef ENABLE_ELUNA
-        if (Eluna* e = sWorld.GetEluna())
-        {
-            e->OnRemove(auctionHouse, auction);
-        }
-#endif /* ENABLE_ELUNA */
-        delete auction;
+    if (Eluna* e = sWorld.GetEluna())
+    {
+        e->OnRemove(auctionHouse, auction);
     }
+#endif /* ENABLE_ELUNA */
+    delete auction;
 }
 
-// ===========================================================================
-// SP-1 async browse proxy: profile/recipe/house builders + in-process fallback
-// ===========================================================================
-
-// Map an AuctionHouseEntry to the BrowseQuery house code (0/1/2). The houseId
-// ranges mirror the live faction split (1..3 = Alliance, 4..6 = Horde, else
-// Neutral).
-static uint8 AhHouseToType(AuctionHouseEntry const* e)
+// called when player lists his bids
+void WorldSession::HandleAuctionListBidderItems(WorldPacket& recv_data)
 {
-    uint32 id = e->houseId;
-    if (id >= 1u && id <= 3u)
+    DEBUG_LOG("WORLD: HandleAuctionListBidderItems");
+
+    ObjectGuid auctioneerGuid;                              // NPC guid
+    uint32 listfrom;                                        // page of auctions
+    uint32 outbiddedCount;                                  // count of outbidded auctions
+
+    recv_data >> auctioneerGuid;
+    recv_data >> listfrom;                                  // not used in fact (this list not have page control in client)
+    recv_data >> outbiddedCount;
+    if (recv_data.size() != (16 + outbiddedCount * 4))
     {
-        return 0u;   // ALLIANCE
-    }
-    if (id >= 4u && id <= 6u)
-    {
-        return 1u;   // HORDE
-    }
-    return 2u;       // NEUTRAL
-}
-
-// Snapshot the browsing player's usability inputs into the wire profile.
-static void AhBuildBrowseQueryProfile(Player* player, PlayerProfile& out)
-{
-    out.classId   = player->getClass();
-    out.raceId    = player->getRace();
-    out.level     = uint8(player->getLevel());
-    out.honorRank = player->GetHonorHighestRankInfo().rank;   // direct_action=true uses highest
-    // Known spells (open-c: full set; vanilla spellbooks are small).
-    PlayerSpellMap const& spells = player->GetSpellMap();
-    for (PlayerSpellMap::const_iterator it = spells.begin(); it != spells.end(); ++it)
-    {
-        if (it->second.state != PLAYERSPELL_REMOVED && !it->second.disabled)
-        {
-            out.knownSpells.push_back(it->first);
-        }
-    }
-    // Skills (D6): emit (skillId, GetSkillValue) for every known skill line by
-    // walking the PLAYER_SKILL_INFO update fields (3 uint32 per slot; the skill
-    // id is the low 16 bits of word 0). The worker gates BOTH RequiredSkill AND
-    // item proficiency against these.
-    for (uint32 i = 0; i < PLAYER_MAX_SKILLS; ++i)
-    {
-        uint32 w0 = player->GetUInt32Value(PLAYER_SKILL_INFO_1_1 + i * 3);
-        uint16 skillId = uint16(w0 & 0x0000FFFFu);
-        if (skillId == 0u)
-        {
-            continue;
-        }
-        SkillRank sr;
-        sr.skillId = skillId;
-        sr.rank    = player->GetSkillValue(skillId);
-        out.skills.push_back(sr);
-    }
-    // Reputations: emit (factionId, rank) for each faction the player has state.
-    FactionStateList const& reps = player->GetReputationMgr().GetStateList();
-    for (FactionStateList::const_iterator it = reps.begin(); it != reps.end(); ++it)
-    {
-        FactionEntry const* fe = sFactionStore.LookupEntry(it->second.ID);
-        if (!fe)
-        {
-            continue;
-        }
-        RepStanding rs;
-        rs.factionId = uint16(it->second.ID);
-        rs.rank = uint8(player->GetReputationMgr().GetRank(fe));
-        out.reps.push_back(rs);
-    }
-}
-
-// C2b/D9: sRecipeCastToTaught maps each recipe item's CAST spell (spellid_1) to
-// the spell it TEACHES (EffectTriggerSpell[0]). Built ONCE at world load.
-typedef std::map<uint32, uint32> RecipeCastMap;
-static RecipeCastMap sRecipeCastToTaught;
-static bool          sRecipeCastBuilt = false;
-
-// Build the recipe cast->taught map. Declared in AuctionHouseBot/BrowsePending.h
-// (V6). Call from the TOP of AuctionHouseMgr::LoadAuctionItems, BEFORE its
-// empty-AH early return (V6), at world load (single-threaded). Idempotent.
-void AhEnsureRecipeCastMap()
-{
-    if (sRecipeCastBuilt)
-    {
-        return;
-    }
-    sRecipeCastBuilt = true;
-    sRecipeCastToTaught.clear();
-    // Scan recipe-class item_template once; resolve spellid_1 -> trigger spell.
-    for (uint32 entry = 0; entry < sItemStorage.GetMaxEntry(); ++entry)
-    {
-        ItemPrototype const* proto = sItemStorage.LookupEntry<ItemPrototype>(entry);
-        if (!proto || proto->Class != ITEM_CLASS_RECIPE)
-        {
-            continue;
-        }
-        uint32 castSpell = proto->Spells[0].SpellId;
-        if (castSpell == 0u)
-        {
-            continue;
-        }
-        SpellEntry const* se = sSpellStore.LookupEntry(castSpell);
-        if (!se)
-        {
-            continue;
-        }
-        uint32 taught = se->EffectTriggerSpell[EFFECT_INDEX_0];
-        if (taught == 0u)
-        {
-            continue;   // no taught spell -> can't ever be "known"; skip
-        }
-        sRecipeCastToTaught[castSpell] = taught;
-    }
-}
-
-// The set of recipe CAST spell ids (spellid_1) whose TAUGHT spell the player
-// already knows. The worker matches each recipe item's spellid_1 against it.
-static void AhBuildKnownRecipeCastSpells(Player* player, std::vector<uint32>& out)
-{
-    for (RecipeCastMap::const_iterator it = sRecipeCastToTaught.begin();
-         it != sRecipeCastToTaught.end(); ++it)
-    {
-        if (player->HasSpell(it->second))
-        {
-            out.push_back(it->first);   // the player knows what this recipe teaches
-        }
-    }
-}
-
-// Coordinator model: the worker is the AH read authority. When it cannot serve
-// (down, a transient register/encode/send failure, queue-full, oversize, or a
-// reply timeout) mangosd serves NOTHING in-process. It sends an empty list so
-// the client does not hang, plus the unavailable message (center flash + red
-// chat line via AhSendUnavailableMessage). Non-static: the world thread calls it
-// from the IPC_BROWSE_RESULT reply branch and the TTL sweep. (kind is a
-// BrowseKind; only the opcode depends on it.)
-void AhSendBrowseUnavailable(WorldSession* session, uint8 kind)
-{
-    uint16 opcode = (kind == uint8(BROWSE_OWNER)) ? SMSG_AUCTION_OWNER_LIST_RESULT
-                  : (kind == uint8(BROWSE_BIDDER)) ? SMSG_AUCTION_BIDDER_LIST_RESULT
-                  : SMSG_AUCTION_LIST_RESULT;
-    WorldPacket data(opcode, 4 + 4);
-    data << uint32(0);   // count
-    data << uint32(0);   // totalcount
-    session->SendPacket(&data);
-    AhSendUnavailableMessage(session);
-}
-
-// called when player lists his bids
-void WorldSession::HandleAuctionListBidderItems(WorldPacket& recv_data)
-{
-    DEBUG_LOG("WORLD: HandleAuctionListBidderItems");
-
-    ObjectGuid auctioneerGuid;                              // NPC guid
-    uint32 listfrom;                                        // page of auctions
-    uint32 outbiddedCount;                                  // count of outbidded auctions
-
-    recv_data >> auctioneerGuid;
-    recv_data >> listfrom;                                  // not used in fact (this list not have page control in client)
-    recv_data >> outbiddedCount;
-    if (recv_data.size() != (16 + outbiddedCount * 4))
-    {
-        sLog.outError("Client sent bad opcode!!! with count: %u and size : %u (must be: %u)", outbiddedCount, (uint32)recv_data.size(), (16 + outbiddedCount * 4));
-        outbiddedCount = 0;
+        sLog.outError("Client sent bad opcode!!! with count: %u and size : %u (must be: %u)", outbiddedCount, (uint32)recv_data.size(), (16 + outbiddedCount * 4));
+        outbiddedCount = 0;
     }
 
     AuctionHouseEntry const* auctionHouseEntry = GetCheckedAuctionHouseForAuctioneer(auctioneerGuid);
@@ -1662,8 +711,6 @@ void WorldSession::HandleAuctionListBidderItems(WorldPacket& recv_data)
 
     Player* pl = GetPlayer();
 
-    // Read the client-supplied outbid ids in CLIENT ORDER (same loop as the
-    // legacy in-process path, after the size validation above).
     std::vector<uint32> clientOutbidIds;
     while (outbiddedCount > 0)
     {
@@ -1673,89 +720,17 @@ void WorldSession::HandleAuctionListBidderItems(WorldPacket& recv_data)
         clientOutbidIds.push_back(outbiddedAuctionId);
     }
 
-    // ----- SP-1 async proxy: hand the browse to the worker when active -----
-    WorkerSupervisor* sv = sWorld.GetAhSupervisor();
-    if (sv && sv->ServiceActive())
-    {
-        PendingBrowse pb;
-        pb.accountId      = GetAccountId();
-        pb.playerGuidLow  = pl->GetGUIDLow();
-        pb.kind           = uint8(BROWSE_BIDDER);
-        pb.house          = AhHouseToType(auctionHouseEntry);
-        pb.allHouses      = sWorld.getConfig(CONFIG_BOOL_ALLOW_TWO_SIDE_INTERACTION_AUCTION) ? 1u : 0u;
-        pb.itemClass      = 0xFFFFFFFFu;
-        pb.itemSubClass   = 0xFFFFFFFFu;
-        pb.inventoryType  = 0xFFFFFFFFu;
-        pb.quality        = 0xFFFFFFFFu;
-        pb.levelmin       = 0u;
-        pb.levelmax       = 0u;
-        pb.usable         = 0u;
-        pb.deferEluna     = 0u;
-        pb.listfrom       = listfrom;
-        pb.wname.clear();
-        pb.seq            = sWorld.GetBrowsePending().NextSeqFor(pb.playerGuidLow, pb.kind);
-
-        BrowseQuery q;
-        q.queryId          = 0;
-        q.kind             = pb.kind;
-        q.house            = pb.house;
-        q.allHouses        = pb.allHouses;
-        q.itemClass        = pb.itemClass;
-        q.itemSubClass     = pb.itemSubClass;
-        q.inventoryType    = pb.inventoryType;
-        q.quality          = pb.quality;
-        q.levelmin         = pb.levelmin;
-        q.levelmax         = pb.levelmax;
-        q.usable           = pb.usable;
-        q.deferEluna       = pb.deferEluna;
-        q.listfrom         = pb.listfrom;
-        {
-            int dbIdx = GetSessionDbLocaleIndex();
-            LocaleConstant lc = (dbIdx < 0) ? LOCALE_enUS
-                                            : sObjectMgr.GetLocaleForIndex(dbIdx);
-            q.localeIndex = int8(lc);
-        }
-        q.requesterGuidLow = pb.playerGuidLow;
-        q.minMountLevel    = sWorld.getConfig(CONFIG_UINT32_MIN_TRAIN_MOUNT_LEVEL);
-        q.minEpicMountLevel= sWorld.getConfig(CONFIG_UINT32_MIN_TRAIN_EPIC_MOUNT_LEVEL);
-        q.searchedName.clear();
-        q.outbidIds        = clientOutbidIds;   // client order, mirrored on the wire
-        AhBuildBrowseQueryProfile(pl, q.profile);
-        AhBuildKnownRecipeCastSpells(pl, q.knownRecipeCastSpells);
-
-        uint32 nowSec = uint32(time(NULL));
-        q.queryId = sWorld.GetBrowsePending().Register(pb, nowSec);
-        if (q.queryId == 0u)
-        {
-            AhSendBrowseUnavailable(this, pb.kind);
-            return;
-        }
-
-        IpcMessage qm; qm.op = IPC_BROWSE_QUERY; q.Encode(qm.body);
-        if (qm.body.size() > BrowseQuery::MAX_WIRE)
-        {
-            PendingBrowse tmp; (void)sWorld.GetBrowsePending().Take(q.queryId, tmp);
-            AhSendBrowseUnavailable(this, pb.kind);
-            return;
-        }
-        if (!sv->Channel().SendFrame(qm))
-        {
-            PendingBrowse tmp; (void)sWorld.GetBrowsePending().Take(q.queryId, tmp);
-            AhSendBrowseUnavailable(this, pb.kind);
-        }
-        return;
-    }
-
-    // Worker configured but DOWN (or failed to start) -> coordinator: no
-    // in-process serving. Key off IsAhServiceConfigured(), not the pointer, so a
-    // failed Start() (sv == NULL) still returns "unavailable" here.
-    if (sWorld.IsAhServiceConfigured())
+    AuctionListRequest request = AuctionListRequest();
+    request.kind = AUCTION_LIST_BIDDER;
+    request.houseEntry = auctionHouseEntry;
+    request.house = auctionHouse;
+    request.listfrom = listfrom;
+    request.outbidIds = clientOutbidIds;
+    if (AuctionHouseModules::Answer([&](AuctionHouseModule& module) { return module.ForwardList(*this, request); }))
     {
-        AhSendBrowseUnavailable(this, uint8(BROWSE_BIDDER));
         return;
     }
 
-    // --- no worker configured (legacy single-process): in-process path ---
     WorldPacket data(SMSG_AUCTION_BIDDER_LIST_RESULT, (4 + 4 + 4));
     data << uint32(0);                                      // add 0 as count
     uint32 count = 0;
@@ -1802,88 +777,16 @@ void WorldSession::HandleAuctionListOwnerItems(WorldPacket& recv_data)
         GetPlayer()->RemoveSpellsCausingAura(SPELL_AURA_FEIGN_DEATH);
     }
 
-    // ----- SP-1 async proxy: hand the browse to the worker when active -----
-    WorkerSupervisor* sv = sWorld.GetAhSupervisor();
-    if (sv && sv->ServiceActive())
-    {
-        PendingBrowse pb;
-        pb.accountId     = GetAccountId();
-        pb.playerGuidLow = GetPlayer()->GetGUIDLow();
-        pb.kind          = uint8(BROWSE_OWNER);
-        pb.house         = AhHouseToType(auctionHouseEntry);
-        pb.allHouses     = sWorld.getConfig(CONFIG_BOOL_ALLOW_TWO_SIDE_INTERACTION_AUCTION) ? 1u : 0u;
-        pb.itemClass     = 0xFFFFFFFFu;
-        pb.itemSubClass  = 0xFFFFFFFFu;
-        pb.inventoryType = 0xFFFFFFFFu;
-        pb.quality       = 0xFFFFFFFFu;
-        pb.levelmin      = 0u;
-        pb.levelmax      = 0u;
-        pb.usable        = 0u;
-        pb.deferEluna    = 0u;
-        pb.listfrom      = listfrom;
-        pb.wname.clear();
-        pb.seq           = sWorld.GetBrowsePending().NextSeqFor(pb.playerGuidLow, pb.kind);
-
-        BrowseQuery q;
-        q.queryId          = 0;
-        q.kind             = pb.kind;
-        q.house            = pb.house;
-        q.allHouses        = pb.allHouses;
-        q.itemClass        = pb.itemClass;
-        q.itemSubClass     = pb.itemSubClass;
-        q.inventoryType    = pb.inventoryType;
-        q.quality          = pb.quality;
-        q.levelmin         = pb.levelmin;
-        q.levelmax         = pb.levelmax;
-        q.usable           = pb.usable;
-        q.deferEluna       = pb.deferEluna;
-        q.listfrom         = pb.listfrom;
-        {
-            int dbIdx = GetSessionDbLocaleIndex();
-            LocaleConstant lc = (dbIdx < 0) ? LOCALE_enUS
-                                            : sObjectMgr.GetLocaleForIndex(dbIdx);
-            q.localeIndex = int8(lc);
-        }
-        q.requesterGuidLow = pb.playerGuidLow;
-        q.minMountLevel    = sWorld.getConfig(CONFIG_UINT32_MIN_TRAIN_MOUNT_LEVEL);
-        q.minEpicMountLevel= sWorld.getConfig(CONFIG_UINT32_MIN_TRAIN_EPIC_MOUNT_LEVEL);
-        q.searchedName.clear();
-        AhBuildBrowseQueryProfile(GetPlayer(), q.profile);
-        AhBuildKnownRecipeCastSpells(GetPlayer(), q.knownRecipeCastSpells);
-
-        uint32 nowSec = uint32(time(NULL));
-        q.queryId = sWorld.GetBrowsePending().Register(pb, nowSec);
-        if (q.queryId == 0u)
-        {
-            AhSendBrowseUnavailable(this, pb.kind);
-            return;
-        }
-
-        IpcMessage qm; qm.op = IPC_BROWSE_QUERY; q.Encode(qm.body);
-        if (qm.body.size() > BrowseQuery::MAX_WIRE)
-        {
-            PendingBrowse tmp; (void)sWorld.GetBrowsePending().Take(q.queryId, tmp);
-            AhSendBrowseUnavailable(this, pb.kind);
-            return;
-        }
-        if (!sv->Channel().SendFrame(qm))
-        {
-            PendingBrowse tmp; (void)sWorld.GetBrowsePending().Take(q.queryId, tmp);
-            AhSendBrowseUnavailable(this, pb.kind);
-        }
-        return;
-    }
-
-    // Worker configured but DOWN (or failed to start) -> coordinator: no
-    // in-process serving. Key off IsAhServiceConfigured(), not the pointer, so a
-    // failed Start() (sv == NULL) still returns "unavailable" here.
-    if (sWorld.IsAhServiceConfigured())
+    AuctionListRequest request = AuctionListRequest();
+    request.kind = AUCTION_LIST_OWNER;
+    request.houseEntry = auctionHouseEntry;
+    request.house = auctionHouse;
+    request.listfrom = listfrom;
+    if (AuctionHouseModules::Answer([&](AuctionHouseModule& module) { return module.ForwardList(*this, request); }))
     {
-        AhSendBrowseUnavailable(this, uint8(BROWSE_OWNER));
         return;
     }
 
-    // --- no worker configured (legacy single-process): in-process path ---
     WorldPacket data(SMSG_AUCTION_OWNER_LIST_RESULT, (4 + 4));
     data << (uint32) 0;                                     // amount place holder
 
@@ -1932,113 +835,24 @@ void WorldSession::HandleAuctionListItems(WorldPacket& recv_data)
     // DEBUG_LOG("Auctionhouse search %s list from: %u, searchedname: %s, levelmin: %u, levelmax: %u, auctionSlotID: %u, auctionMainCategory: %u, auctionSubCategory: %u, quality: %u, usable: %u",
     //  auctioneerGuid.GetString().c_str(), listfrom, searchedname.c_str(), levelmin, levelmax, auctionSlotID, auctionMainCategory, auctionSubCategory, quality, usable);
 
-    // ----- SP-1 async proxy: hand the browse to the worker when active -----
-    WorkerSupervisor* sv = sWorld.GetAhSupervisor();
-    if (sv && sv->ServiceActive())
-    {
-        std::wstring wsearchedname;
-        if (!Utf8toWStr(searchedname, wsearchedname))
-        {
-            // F5: malformed UTF-8 in the search name. The worker is the authority
-            // and this request never leaves -- send the terminal "unavailable"
-            // response (mirroring the sibling early-rejects below) so the client's
-            // browse panel does not hang waiting for a reply that never comes.
-            AhSendBrowseUnavailable(this, uint8(BROWSE_LIST));
-            return;
-        }
-        wstrToLower(wsearchedname);
-        std::string nameLower;
-        WStrToUtf8(wsearchedname, nameLower);
-
-        PendingBrowse pb;
-        pb.accountId     = GetAccountId();
-        pb.playerGuidLow = GetPlayer()->GetGUIDLow();
-        pb.kind          = uint8(BROWSE_LIST);
-        pb.house         = AhHouseToType(auctionHouseEntry);
-        pb.allHouses     = sWorld.getConfig(CONFIG_BOOL_ALLOW_TWO_SIDE_INTERACTION_AUCTION) ? 1u : 0u;
-        pb.itemClass     = auctionMainCategory;
-        pb.itemSubClass  = auctionSubCategory;
-        pb.inventoryType = auctionSlotID;
-        pb.quality       = quality;
-        pb.levelmin      = levelmin;
-        pb.levelmax      = levelmax;
-        pb.usable        = usable;
-        pb.deferEluna    = 0u;
-#ifdef ENABLE_ELUNA
-        if (usable != 0u)
-        {
-            pb.deferEluna = 1u;   // defer OnCanUseItem to the reply handler
-        }
-#endif
-        pb.listfrom      = listfrom;
-        pb.wname         = wsearchedname;
-        pb.seq           = sWorld.GetBrowsePending().NextSeqFor(pb.playerGuidLow, pb.kind);
-
-        BrowseQuery q;
-        q.queryId          = 0;
-        q.kind             = pb.kind;
-        q.house            = pb.house;
-        q.allHouses        = pb.allHouses;
-        q.itemClass        = pb.itemClass;
-        q.itemSubClass     = pb.itemSubClass;
-        q.inventoryType    = pb.inventoryType;
-        q.quality          = pb.quality;
-        q.levelmin         = pb.levelmin;
-        q.levelmax         = pb.levelmax;
-        q.usable           = pb.usable;
-        q.deferEluna       = pb.deferEluna;
-        q.listfrom         = pb.listfrom;
-        // V3: send the LocaleConstant (NOT the internal session index).
-        {
-            int dbIdx = GetSessionDbLocaleIndex();   // -1 for enUS / default
-            LocaleConstant lc = (dbIdx < 0) ? LOCALE_enUS
-                                            : sObjectMgr.GetLocaleForIndex(dbIdx);
-            q.localeIndex = int8(lc);                // LOCALE_enUS(0) => no overlay
-        }
-        q.requesterGuidLow = pb.playerGuidLow;
-        q.minMountLevel    = sWorld.getConfig(CONFIG_UINT32_MIN_TRAIN_MOUNT_LEVEL);
-        q.minEpicMountLevel= sWorld.getConfig(CONFIG_UINT32_MIN_TRAIN_EPIC_MOUNT_LEVEL);
-        q.searchedName     = nameLower;
-        AhBuildBrowseQueryProfile(GetPlayer(), q.profile);
-        AhBuildKnownRecipeCastSpells(GetPlayer(), q.knownRecipeCastSpells);
-
-        uint32 nowSec = uint32(time(NULL));
-        q.queryId = sWorld.GetBrowsePending().Register(pb, nowSec);
-        if (q.queryId == 0u)
-        {
-            // D3: pending-map at MAX_PENDING (browse flood). Serve in-process now.
-            AhSendBrowseUnavailable(this, pb.kind);
-            return;
-        }
-
-        IpcMessage qm; qm.op = IPC_BROWSE_QUERY; q.Encode(qm.body);
-        // open-c: oversize profile fallback. If encoding exceeds the cap, drop to
-        // in-process immediately (rare; a huge spellbook/rep set).
-        if (qm.body.size() > BrowseQuery::MAX_WIRE)
-        {
-            PendingBrowse tmp; (void)sWorld.GetBrowsePending().Take(q.queryId, tmp);
-            AhSendBrowseUnavailable(this, pb.kind);
-            return;
-        }
-        // C1: if the send itself fails, fall back in-process now and drop pending.
-        if (!sv->Channel().SendFrame(qm))
-        {
-            PendingBrowse tmp; (void)sWorld.GetBrowsePending().Take(q.queryId, tmp);
-            AhSendBrowseUnavailable(this, pb.kind);
-        }
-        return;   // async (or fell back synchronously above)
-    }
-
-    // Worker configured but DOWN (or failed to start) -> coordinator: no
-    // in-process serving. Key off IsAhServiceConfigured(), not the pointer, so a
-    // failed Start() (sv == NULL) still returns "unavailable" here.
-    if (sWorld.IsAhServiceConfigured())
+    AuctionListRequest request = AuctionListRequest();
+    request.kind = AUCTION_LIST_ITEMS;
+    request.houseEntry = auctionHouseEntry;
+    request.house = auctionHouse;
+    request.listfrom = listfrom;
+    request.searchedName = searchedname;
+    request.levelmin = levelmin;
+    request.levelmax = levelmax;
+    request.usable = usable;
+    request.inventoryType = auctionSlotID;
+    request.itemClass = auctionMainCategory;
+    request.itemSubClass = auctionSubCategory;
+    request.quality = quality;
+    if (AuctionHouseModules::Answer([&](AuctionHouseModule& module) { return module.ForwardList(*this, request); }))
     {
-        AhSendBrowseUnavailable(this, uint8(BROWSE_LIST));
         return;
     }
 
-    // --- no worker configured (legacy single-process): in-process path ---
     WorldPacket data(SMSG_AUCTION_LIST_RESULT, (4 + 4));
     uint32 count = 0;
     uint32 totalcount = 0;
@@ -2069,1881 +883,4 @@ void WorldSession::HandleAuctionListItems(WorldPacket& recv_data)
     SendPacket(&data);
 }
 
-// ===========================================================================
-// SP-2 write-authority: player-mutation finalize + cancel phase-2 driver.
-// The worker is the book authority; mangosd applies VALUE ONLY, from the
-// wire facts, cross-checked fail-closed against its own custody ledger
-// (spec section 3). No AuctionEntry / AuctionsMap access on any path here.
-// ===========================================================================
-
-// [SP-2] outbid increment from a bid value (mirrors AuctionEntry::GetAuctionOutBid,
-// AuctionHouseMgr.cpp GetAuctionOutBid).
-static uint32 AhOutbidFor(uint32 bid)
-{
-    uint32 outbid = (bid / 100) * 5;
-    if (!outbid)
-    {
-        outbid = 1;
-    }
-    return outbid;
-}
-
-// [SP-2] auction-house cut from wire facts (mirrors AuctionEntry::GetAuctionCut,
-// keyed by houseId -- no AuctionEntry exists on the finalize path). NULL house
-// entry -> 0 (also the -t harness case, where DBC data is not loaded).
-static uint32 AhCutFor(uint8 houseId, uint32 bid)
-{
-    AuctionHouseEntry const* he = sAuctionHouseStore.LookupEntry(uint32(houseId));
-    if (!he)
-    {
-        return 0;
-    }
-    return uint32(he->cutPercent * bid * sWorld.getConfig(CONFIG_FLOAT_RATE_AUCTION_CUT) / 100.0f);
-}
-
-// [SP-2] PlayerMutationResult.op (low byte of the IpcOpcode) -> AuctionAction.
-static AuctionAction AhActionForOp(uint8 op)
-{
-    switch (op)
-    {
-        case uint8(IPC_PLAYER_SELL & 0xFFu):
-            return AUCTION_STARTED;
-        case uint8(IPC_PLAYER_CANCEL & 0xFFu):
-        case uint8(IPC_PLAYER_CANCEL_CONFIRM & 0xFFu):
-            return AUCTION_REMOVED;
-        default:
-            return AUCTION_BID_PLACED;   // IPC_PLAYER_BID / IPC_PLAYER_BUYOUT
-    }
-}
-
-// [SP-2] GUID-re-resolve SMSG emitter (the SP-1 reply-branch pattern): never
-// hold a WorldSession* across ticks; re-resolve by low GUID at send time and
-// skip silently when offline (the durable mail rows are authoritative).
-static void AhSendCommandResultTo(uint32 playerGuidLow, uint32 aucId,
-                                  AuctionAction action, AuctionError err,
-                                  uint32 newOutbid)
-{
-    Player* p = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, playerGuidLow));
-    if (p && p->GetSession())
-    {
-        p->GetSession()->SendAuctionCommandResultData(aucId, action, err, EQUIP_ERR_OK, newOutbid);
-    }
-}
-
-// [SP-2] AUCTION_ERR_HIGHER_BID carries the current bidder/bid (the inline
-// branch of SendAuctionCommandResult); rebuilt from wire facts.
-static void AhSendHigherBidResultTo(uint32 playerGuidLow, uint8 op, MutationFacts const& f)
-{
-    Player* p = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, playerGuidLow));
-    if (!p || !p->GetSession())
-    {
-        return;
-    }
-    WorldPacket data(SMSG_AUCTION_COMMAND_RESULT, 16);
-    data << uint32(f.auctionId);
-    data << uint32(AhActionForOp(op));
-    data << uint32(AUCTION_ERR_HIGHER_BID);
-    data << ObjectGuid(HIGHGUID_PLAYER, f.curBidderGuid);
-    data << uint32(f.curBid);
-    data << uint32(AhOutbidFor(f.curBid));
-    p->GetSession()->SendPacket(&data);
-}
-
-// [SP-2] "<itemTemplate>:<rand>:<response>" mail subject (the legacy pattern
-// used by every AH mail).
-static std::string AhMailSubject(uint32 itemTemplate, int32 itemRand, uint32 response)
-{
-    std::ostringstream s;
-    s << itemTemplate << ":" << itemRand << ":" << response;
-    return s.str();
-}
-
-// Worker-authority terminal paths still use the live escrow cache until SP-6B's
-// durable item-take lands. Missing or mismatched cache state must therefore
-// hold custody for retry; it can never authorize a ledger-only item transition.
-// The output row is a value snapshot and the output item remains cache-owned.
-static bool AhGetCachedReservedItem(std::string const& key, uint32 auctionId,
-                                    uint32 ownerGuid, uint32 expectedItemGuid,
-                                    CustodyRow& row, Item*& item,
-                                    uint8 expectedRole = ROLE_ITEM)
-{
-    item = NULL;
-    if (key.empty() || !CustodyLedger::Get(key, row) ||
-        row.kind != CUSTODY_ITEM || row.role != expectedRole ||
-        row.state != CST_RESERVED || row.ownerGuid != ownerGuid ||
-        row.beneficiaryGuid != 0u || row.amount != 0u ||
-        row.auctionId != auctionId ||
-        (expectedItemGuid != 0u && row.itemGuid != expectedItemGuid))
-    {
-        sLog.outError("[AHMut] item custody mismatch for key %s (auction %u); "
-                      "holding for retry",
-                      key.c_str(), auctionId);
-        return false;
-    }
-
-    item = sAuctionMgr.GetAItem(row.itemGuid);
-    if (!item || item->GetOwnerGuid().GetCounter() != ownerGuid)
-    {
-        sLog.outError("[AHMut] auction %u escrow item %u missing/mismatched in cache; "
-                      "holding custody for retry",
-                      auctionId, row.itemGuid);
-        return false;
-    }
-    return true;
-}
-
-static bool AhPreflightTerminalItem(MutationFacts const& facts,
-                                    bool requireDeposit)
-{
-    // Bot materializations carry a botlist: marker, not player seller escrow.
-    // Read the marker count in one query so an error cannot look like absence.
-    std::unique_ptr<QueryResult> markers(CharacterDatabase.PQuery(
-        "SELECT COUNT(*), COALESCE(MAX(`idem_key`),'') FROM `custody_ledger` "
-        "WHERE `auction_id`=%u AND `idem_key` LIKE 'botlist:%%'",
-        facts.auctionId));
-    if (!markers)
-    {
-        return false;
-    }
-    uint64 const markerCount = markers->Fetch()[0].GetUInt64();
-    CustodyRow itemRow;
-    Item* item = NULL;
-    if (markerCount != 0u)
-    {
-        if (markerCount != 1u ||
-            !AhGetCachedReservedItem(markers->Fetch()[1].GetCppString(),
-                facts.auctionId, facts.sellerGuid, facts.itemGuid,
-                itemRow, item, ROLE_RESOLUTION))
-        {
-            return false;
-        }
-    }
-    else
-    {
-        if (requireDeposit)
-        {
-            CustodyRow deposit;
-            if (!CustodyLedger::Get("dep:" + std::to_string(facts.auctionId), deposit) ||
-                deposit.kind != CUSTODY_GOLD || deposit.role != ROLE_DEPOSIT ||
-                deposit.state != CST_RESERVED || deposit.ownerGuid != facts.sellerGuid ||
-                deposit.amount != facts.deposit || deposit.auctionId != facts.auctionId)
-            {
-                return false;
-            }
-        }
-        if (!AhGetCachedReservedItem("item:" + std::to_string(facts.auctionId),
-                facts.auctionId, facts.sellerGuid, facts.itemGuid, itemRow, item))
-        {
-            return false;
-        }
-    }
-    return item->GetEntry() == facts.itemTemplate;
-}
-
-// [SP-2] the prior/current bidder's live bid row: EXACTLY ONE live bid row for
-// the auction that is not `excludeKey` and matches the reported owner+amount.
-// Any other shape returns false -> fail closed (spec section 3 matrix).
-static bool AhFindPriorBidRow(uint32 auctionId, uint32 bidderGuid, uint32 amount,
-                              std::string const& excludeKey, CustodyRow& out)
-{
-    return CustodyLedger::GetSingleLiveBidRow(auctionId, out, excludeKey) &&
-        out.ownerGuid == bidderGuid && out.amount == amount;
-}
-
-// [SP-2] in-txn wallet re-credit WITHOUT a ledger-row flip (the buyout
-// remainder: the row shrinks via SetAmount and then commits). Mirrors
-// ReleaseGoldToWallet's wallet leg. The caller MUST undo the online in-memory
-// credit if its checked commit fails (forward-only redrive, X6 idiom).
-static void AhCreditWalletInTxn(uint32 guidLow, uint32 amount)
-{
-    if (amount == 0)
-    {
-        return;
-    }
-    Player* p = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, guidLow));
-    if (p)
-    {
-        p->ModifyMoney(int32(amount));
-        p->SaveInventoryAndGoldToDB();
-    }
-    else
-    {
-        CharacterDatabase.PExecute("UPDATE `characters` SET `money` = `money` + '%u' "
-            "WHERE `guid` = '%u'", amount, guidLow);
-    }
-}
-
-// ---------------------------------------------------------------------------
-// Redrive queue (spec 4.1 step 4, "failed finalize"): forward-only re-attempts
-// of finalizes whose checked commit returned false. NEVER rolls a committed
-// book fact back. In-memory only (a mangosd crash re-enters via reconcile).
-// ---------------------------------------------------------------------------
-struct AhRedriveEntry
-{
-    PlayerMutationResult res;
-    PendingMutation pm;
-    uint32 nextRetrySec;
-    uint32 attempts;
-};
-static std::list<AhRedriveEntry> s_ahRedrive;
-
-// In-doubt sweep TTL (spec 4.1 step 5). A player mutation un-answered by the
-// worker for this long is tombstoned and the player gets the legacy DB error;
-// the reservation stays non-terminal (decision 10) and a late reply still
-// applies via Take. Generous vs the worker round-trip; default-off in prod.
-static uint32 const AH_MUTATION_INDOUBT_TTL_SEC = 30u;
-
-// forward declarations (bodies below)
-static bool AhFinalizeOkDispatch(PlayerMutationResult const& res, PendingMutation const& pm);
-static void AhHandleCancelPrepared(PlayerMutationResult const& res);
-
-// [SP-2] replay of SendAuctionSuccessfulMailInTransaction from wire facts:
-// owner-exists guard, sold-notify deferred BEFORE the mail push, profit =
-// effectiveBid + deposit - cut, COPIED mask.
-static void AhSellerPayoutFromFacts(MutationFacts const& f, CustodyDeferred& def)
-{
-    ObjectGuid ownerGuid = ObjectGuid(HIGHGUID_PLAYER, f.sellerGuid);
-    Player* owner = sObjectMgr.GetPlayer(ownerGuid);
-    uint32 ownerAccId = 0;
-    if (!owner)
-    {
-        ownerAccId = sObjectMgr.GetPlayerAccountIdByGUID(ownerGuid);
-    }
-    if (!owner && !ownerAccId)
-    {
-        return;
-    }
-
-    uint32 const cut = AhCutFor(f.houseId, f.effectiveBid);
-    uint32 const profit = f.effectiveBid + f.deposit - cut;
-
-    std::ostringstream body;
-    body.width(16);
-    body << std::right << std::hex << f.curBidderGuid;
-    body << std::dec << ":" << f.effectiveBid << ":" << f.buyout;
-    body << ":" << f.deposit << ":" << cut;
-
-    if (owner)
-    {
-        uint32 const ownerGuidLow = f.sellerGuid;
-        uint32 const houseId  = f.houseId;
-        uint32 const aucId    = f.auctionId;
-        uint32 const bidValue = f.effectiveBid;
-        uint32 const outbid   = AhOutbidFor(f.effectiveBid);
-        uint32 const bidder   = f.curBidderGuid;
-        uint32 const itemTpl  = f.itemTemplate;
-        int32  const itemRand = f.randomPropertyId;
-        def.effects.push_back([ownerGuidLow, houseId, aucId, bidValue, outbid, bidder, itemTpl, itemRand]()
-        {
-            Player* p = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, ownerGuidLow));
-            if (p)
-            {
-            p->GetSession()->SendAuctionOwnerNotificationData(houseId, aucId,
-                bidValue, outbid, bidder, itemTpl, itemRand, true);
-            }
-        });
-    }
-
-    MailDraft(AhMailSubject(f.itemTemplate, f.randomPropertyId, AUCTION_SUCCESSFUL), body.str())
-        .SetMoney(profit)
-        .SendMailToInTransaction(MailReceiver(owner, ownerGuid),
-                                 MailSender(MAIL_AUCTION, uint32(f.houseId), MAIL_STATIONERY_AUCTION),
-                                 def, MAIL_CHECK_MASK_COPIED);
-}
-
-// [SP-2] replay of SendAuctionWonMailInTransaction from wire facts, minus the
-// GM-log block (server-side-only trace). A bot winner (curBidderGuid==0)
-// resolves to "no receiver" and follows the legacy destroy branch (spec
-// section 3). Callers preflight the live escrow item before opening their
-// transaction; the defensive miss below performs no value transition.
-static void AhItemToWinnerFromFacts(MutationFacts const& f, CustodyDeferred& def)
-{
-    Item* pItem = sAuctionMgr.GetAItem(f.itemGuid);
-    if (!pItem)
-    {
-        sLog.outError("[AHMut] auction %u won-item %u missing from escrow cache; no item mail",
-                      f.auctionId, f.itemGuid);
-        return;
-    }
-
-    ObjectGuid bidderGuid = ObjectGuid(HIGHGUID_PLAYER, f.curBidderGuid);
-    Player* bidder = sObjectMgr.GetPlayer(bidderGuid);
-    uint32 bidderAccId = 0;
-    if (!bidder)
-    {
-        bidderAccId = sObjectMgr.GetPlayerAccountIdByGUID(bidderGuid);
-    }
-
-    uint32 const savedItemGuidLow = f.itemGuid;
-
-    if (bidder || bidderAccId)
-    {
-        std::ostringstream body;
-        body.width(16);
-        body << std::right << std::hex << f.sellerGuid;
-        body << std::dec << ":" << f.effectiveBid << ":" << f.buyout;
-
-        CharacterDatabase.PExecute("UPDATE `item_instance` SET `owner_guid` = '%u' WHERE `guid`='%u'",
-                                   f.curBidderGuid, savedItemGuidLow);
-
-        if (bidder)
-        {
-            uint32 const bidderGuidLow = f.curBidderGuid;
-            uint32 const houseId  = f.houseId;
-            uint32 const aucId    = f.auctionId;
-            uint32 const bidValue = f.effectiveBid;
-            uint32 const outbid   = AhOutbidFor(f.effectiveBid);
-            uint32 const itemTpl  = f.itemTemplate;
-            int32  const itemRand = f.randomPropertyId;
-            def.effects.push_back([bidderGuidLow, houseId, aucId, bidValue, outbid, itemTpl, itemRand]()
-            {
-                Player* p = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, bidderGuidLow));
-                if (p)
-                {
-                    p->GetSession()->SendAuctionBidderNotificationData(houseId,
-                        aucId, bidderGuidLow, bidValue, outbid, itemTpl,
-                        itemRand, true);
-                }
-            });
-        }
-
-        def.effects.push_back([savedItemGuidLow]()
-        {
-            sAuctionMgr.RemoveAItem(savedItemGuidLow);
-        });
-
-        MailDraft(AhMailSubject(f.itemTemplate, f.randomPropertyId, AUCTION_WON), body.str())
-            .AddItem(pItem)
-            .SendMailToInTransaction(MailReceiver(bidder, bidderGuid),
-                                     MailSender(MAIL_AUCTION, uint32(f.houseId), MAIL_STATIONERY_AUCTION),
-                                     def, MAIL_CHECK_MASK_COPIED);
-    }
-    else
-    {
-        CharacterDatabase.PExecute("DELETE FROM `item_instance` WHERE `guid`='%u'", savedItemGuidLow);
-        def.effects.push_back([savedItemGuidLow, pItem]()
-        {
-            sAuctionMgr.RemoveAItem(savedItemGuidLow);
-            delete pItem;
-        });
-    }
-}
-
-// [SP-2] replay of the S2 outbid displacement (UpdateBidCustody +
-// SendAuctionOutbiddedMailInTransaction): terminalize the prior live bid row
-// ledger-only, outbid-notify deferred BEFORE the refund-mail push, refund
-// money = the prior bid, COPIED mask.
-static void AhRefundPriorBidderFromFacts(MutationFacts const& f, std::string const& priorKey, CustodyDeferred& def)
-{
-    CustodyService::RollbackGoldLedgerOnly(priorKey);
-
-    ObjectGuid priorGuid = ObjectGuid(HIGHGUID_PLAYER, f.priorBidderGuid);
-    Player* prior = sObjectMgr.GetPlayer(priorGuid);
-    uint32 priorAccId = 0;
-    if (!prior)
-    {
-        priorAccId = sObjectMgr.GetPlayerAccountIdByGUID(priorGuid);
-    }
-    if (!prior && !priorAccId)
-    {
-        return;   // legacy sends nothing when the old bidder is gone
-    }
-
-    if (prior)
-    {
-        uint32 const priorGuidLow = f.priorBidderGuid;
-        uint32 const houseId  = f.houseId;
-        uint32 const aucId    = f.auctionId;
-        uint32 const bidValue = f.priorBidAmount;
-        uint32 const outbid   = AhOutbidFor(f.priorBidAmount);
-        uint32 const itemTpl  = f.itemTemplate;
-        int32  const itemRand = f.randomPropertyId;
-        def.effects.push_back([priorGuidLow, houseId, aucId, bidValue, outbid, itemTpl, itemRand]()
-        {
-            Player* p = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, priorGuidLow));
-            if (p)
-            {
-                p->GetSession()->SendAuctionBidderNotificationData(houseId,
-                    aucId, priorGuidLow, bidValue, outbid, itemTpl, itemRand,
-                    false);
-            }
-        });
-    }
-
-    MailDraft(AhMailSubject(f.itemTemplate, f.randomPropertyId, AUCTION_OUTBIDDED), "")
-        .SetMoney(f.priorBidAmount)
-        .SendMailToInTransaction(MailReceiver(prior, priorGuid),
-                                 MailSender(MAIL_AUCTION, uint32(f.houseId), MAIL_STATIONERY_AUCTION),
-                                 def, MAIL_CHECK_MASK_COPIED);
-}
-
-// [SP-2] replay of the S5 bidder-refund leg
-// (SendAuctionCancelledToBidderMailInTransaction): removed-notify deferred
-// BEFORE the refund-mail push, money = the standing bid.
-static void AhRefundCancelledBidderFromFacts(MutationFacts const& f, std::string const& bidKey, CustodyDeferred& def)
-{
-    CustodyService::RollbackGoldLedgerOnly(bidKey);
-
-    ObjectGuid bidderGuid = ObjectGuid(HIGHGUID_PLAYER, f.curBidderGuid);
-    Player* bidder = sObjectMgr.GetPlayer(bidderGuid);
-    uint32 accId = 0;
-    if (!bidder)
-    {
-        accId = sObjectMgr.GetPlayerAccountIdByGUID(bidderGuid);
-    }
-    if (!bidder && !accId)
-    {
-        return;
-    }
-
-    if (bidder)
-    {
-        uint32 const bidderGuidLow = f.curBidderGuid;
-        uint32 const aucId    = f.auctionId;
-        uint32 const itemTpl  = f.itemTemplate;
-        int32  const itemRand = f.randomPropertyId;
-        def.effects.push_back([bidderGuidLow, aucId, itemTpl, itemRand]()
-        {
-            Player* p = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, bidderGuidLow));
-            if (p)
-            {
-                p->GetSession()->SendAuctionRemovedNotificationData(aucId, itemTpl, itemRand);
-            }
-        });
-    }
-
-    MailDraft(AhMailSubject(f.itemTemplate, f.randomPropertyId, AUCTION_CANCELLED_TO_BIDDER), "")
-        .SetMoney(f.curBid)
-        .SendMailToInTransaction(MailReceiver(bidder, bidderGuid),
-                                 MailSender(MAIL_AUCTION, uint32(f.houseId), MAIL_STATIONERY_AUCTION),
-                                 def, MAIL_CHECK_MASK_COPIED);
-}
-
-// [SP-2] item return to the seller (cancel / expiry / repair), replaying
-// SendAuctionExpiredMailInTransaction / the S5 return: expired owner-notify
-// (EXPIRED response only), RemoveAItem deferred FIRST, DeliverItem flips
-// "item:<id>" -> TERMINAL_OK and co-commits the mail; destroy branch when the
-// account is gone. Callers preflight the cache before opening the transaction.
-static void AhReturnItemToSellerFromFacts(MutationFacts const& f, uint32 mailResponse, CustodyDeferred& def)
-{
-    std::string const itemKey = "item:" + std::to_string(f.auctionId);
-    Item* pItem = sAuctionMgr.GetAItem(f.itemGuid);
-    if (!pItem)
-    {
-        sLog.outError("[AHMut] auction %u return-item %u missing from escrow "
-                      "cache; holding custody",
-                      f.auctionId, f.itemGuid);
-        return;
-    }
-
-    ObjectGuid ownerGuid = ObjectGuid(HIGHGUID_PLAYER, f.sellerGuid);
-    Player* owner = sObjectMgr.GetPlayer(ownerGuid);
-    uint32 accId = 0;
-    if (!owner)
-    {
-        accId = sObjectMgr.GetPlayerAccountIdByGUID(ownerGuid);
-    }
-
-    uint32 const savedItemGuidLow = f.itemGuid;
-
-    if (owner || accId)
-    {
-        if (owner && mailResponse == uint32(AUCTION_EXPIRED))
-        {
-            uint32 const ownerGuidLow = f.sellerGuid;
-            uint32 const houseId  = f.houseId;
-            uint32 const aucId    = f.auctionId;
-            uint32 const itemTpl  = f.itemTemplate;
-            int32  const itemRand = f.randomPropertyId;
-            def.effects.push_back([ownerGuidLow, houseId, aucId, itemTpl, itemRand]()
-            {
-                Player* p = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, ownerGuidLow));
-                if (p)
-                {
-                    p->GetSession()->SendAuctionOwnerNotificationData(houseId,
-                        aucId, 0, 0, 0, itemTpl, itemRand, false);
-                }
-            });
-        }
-
-        def.effects.push_back([savedItemGuidLow]()
-        {
-            sAuctionMgr.RemoveAItem(savedItemGuidLow);
-        });
-
-        MailDraft itemReturn(AhMailSubject(f.itemTemplate, f.randomPropertyId, mailResponse), "");
-        itemReturn.AddItem(pItem);
-        CustodyService::DeliverItem(def, itemKey, itemReturn,
-                                    MailReceiver(owner, ownerGuid),
-                                    MailSender(MAIL_AUCTION, uint32(f.houseId), MAIL_STATIONERY_AUCTION),
-                                    MAIL_CHECK_MASK_COPIED);
-    }
-    else
-    {
-        CharacterDatabase.PExecute("DELETE FROM `item_instance` WHERE `guid`='%u'", savedItemGuidLow);
-        CustodyService::CommitGoldLedgerOnly(itemKey);
-        def.effects.push_back([savedItemGuidLow, pItem]()
-        {
-            sAuctionMgr.RemoveAItem(savedItemGuidLow);
-            delete pItem;
-        });
-    }
-}
-
-#ifdef ENABLE_ELUNA
-// [SP-2 spec 5.8] Under WriteAuthority the worker owns the book, so the legacy
-// in-map AuctionEntry that fed the Eluna AH hooks no longer lives in mangosd.
-// Synthesize a transient (stack-only, never map-inserted) AuctionEntry from the
-// wire facts and fire the SAME OnAdd/OnRemove the legacy custody path invokes,
-// so Lua AH scripts still observe listing/finalize events. The hooks self-guard
-// on owner-online + escrow-item-present (GetAItem), so fire them while the
-// escrow item is still cached -- i.e. BEFORE the finalize's deferred RemoveAItem
-// runs. startbid is not carried in MutationFacts (0 here); every other field is
-// exact.
-static void AhElunaFillEntry(AuctionEntry& e, MutationFacts const& f)
-{
-    e.Id                   = f.auctionId;
-    e.itemGuidLow          = f.itemGuid;
-    e.itemTemplate         = f.itemTemplate;
-    e.itemCount            = f.itemCount;
-    e.itemRandomPropertyId = f.randomPropertyId;
-    e.owner                = f.sellerGuid;
-    e.startbid             = 0;
-    e.bid                  = f.curBid;
-    e.buyout               = f.buyout;
-    e.expireTime           = 0;
-    e.bidder               = f.curBidderGuid;
-    e.deposit              = f.deposit;
-    e.auctionHouseEntry    = sAuctionHouseStore.LookupEntry(uint32(f.houseId));
-}
-
-static void AhElunaOnAddFromFacts(MutationFacts const& f)
-{
-    Eluna* e = sWorld.GetEluna();
-    if (!e)
-    {
-        return;
-    }
-    AuctionEntry tmp;
-    AhElunaFillEntry(tmp, f);
-    if (!tmp.auctionHouseEntry)
-    {
-        return;
-    }
-    e->OnAdd(sAuctionMgr.GetAuctionsMap(tmp.auctionHouseEntry), &tmp);
-}
-
-static void AhElunaOnRemoveFromFacts(MutationFacts const& f)
-{
-    Eluna* e = sWorld.GetEluna();
-    if (!e)
-    {
-        return;
-    }
-    AuctionEntry tmp;
-    AhElunaFillEntry(tmp, f);
-    if (!tmp.auctionHouseEntry)
-    {
-        return;
-    }
-    e->OnRemove(sAuctionMgr.GetAuctionsMap(tmp.auctionHouseEntry), &tmp);
-}
-#endif /* ENABLE_ELUNA */
-
-// [SP-2] MUT_OK sell (spec 4.1 step 4): NO value moves -- the deposit stays
-// reserved and the item stays escrowed until resolution. Cross-check + the
-// legacy AUCTION_STARTED/AUCTION_OK result only.
-static bool AhFinalizeSellOk(PlayerMutationResult const& res, PendingMutation const& pm)
-{
-    MutationFacts const& f = res.facts;
-    CustodyRow depRow;
-    CustodyRow itemRow;
-    if (!CustodyLedger::Get(pm.depKey, depRow) || depRow.state != CST_RESERVED ||
-        depRow.ownerGuid != pm.playerGuidLow || depRow.amount != f.deposit ||
-        !CustodyLedger::Get(pm.itemKey, itemRow) || itemRow.state != CST_RESERVED ||
-        itemRow.itemGuid != f.itemGuid ||
-        f.sellerGuid != pm.playerGuidLow || f.auctionId != pm.auctionId)
-    {
-        sLog.outError("[AHMut] PROTOCOL FAULT: sell facts mismatch ledger for uuid " UI64FMTD
-                      " (auction %u); finalize refused", res.uuid, f.auctionId);
-        return true;   // faults are terminal, never redriven
-    }
-    AhSendCommandResultTo(pm.playerGuidLow, f.auctionId, AUCTION_STARTED, AUCTION_OK, 0);
-#ifdef ENABLE_ELUNA
-    // [SP-2 spec 5.8] listing committed to the worker's book -> Eluna OnAdd.
-    AhElunaOnAddFromFacts(f);
-#endif
-    return true;
-}
-
-// [SP-2] MUT_OK bid/buyout (spec 4.1 step 4 + I4 value math): section 4.4
-// order = command-result FIRST, then outbid-notify, then mails.
-//
-// [SP-2 reconciliation] op=0x42 (from an IPC_PLAYER_BUYOUT intent) is a buyout
-// WIN only when the worker actually removed the row at the buyout price; a
-// below-buyout price is committed by the worker as a NORMAL bid and the row
-// stays LIVE (HEAD 16e22c4e). Distinguish by facts: WIN <=> buyout != 0 &&
-// effectiveBid == buyout. A BID sub-case falls through the standing-bid path
-// (release = reservedAmount - effectiveBid == 0; no seller payout, no item
-// delivery, just the displaced prior-bidder refund).
-static bool AhFinalizeBidOk(PlayerMutationResult const& res, PendingMutation const& pm)
-{
-    MutationFacts const& f = res.facts;
-    bool const isBuyoutWin = (res.op == uint8(IPC_PLAYER_BUYOUT & 0xFFu)
-                              && f.buyout != 0 && f.effectiveBid == f.buyout);
-    bool const sameBidderRaise = (f.priorBidderGuid != 0 && f.priorBidderGuid == pm.playerGuidLow);
-
-    // ---- fail-closed cross-check vs our OWN ledger (spec section 3) ----
-    CustodyRow ownRow;
-    if (!CustodyLedger::Get(pm.reserveKey, ownRow) || ownRow.state != CST_RESERVED ||
-        ownRow.ownerGuid != pm.playerGuidLow || ownRow.auctionId != f.auctionId ||
-        ownRow.amount != pm.reservedAmount ||
-        f.curBidderGuid != pm.playerGuidLow || f.effectiveBid != f.curBid)
-    {
-        sLog.outError("[AHMut] PROTOCOL FAULT: bid facts mismatch ledger for uuid " UI64FMTD
-                      " (auction %u); finalize refused", res.uuid, f.auctionId);
-        return true;
-    }
-    if (sameBidderRaise && f.effectiveBid < f.priorBidAmount)
-    {
-        sLog.outError("[AHMut] PROTOCOL FAULT: raise below prior bid for uuid " UI64FMTD, res.uuid);
-        return true;
-    }
-    uint32 const needed = sameBidderRaise ? (f.effectiveBid - f.priorBidAmount) : f.effectiveBid;
-    if (needed > pm.reservedAmount)
-    {
-        sLog.outError("[AHMut] PROTOCOL FAULT: needed %u exceeds reserved %u for uuid " UI64FMTD,
-                      needed, pm.reservedAmount, res.uuid);
-        return true;
-    }
-    uint32 const remainder = pm.reservedAmount - needed;
-
-    if (isBuyoutWin && !AhPreflightTerminalItem(f, true))
-    {
-        sLog.outError("[AHMut] buyout terminal custody unavailable for "
-                      "auction %u; queued for retry", f.auctionId);
-        return false;
-    }
-
-    CustodyRow liveRow;
-    std::string priorKey;
-    if (f.priorBidderGuid != 0)
-    {
-        if (!AhFindPriorBidRow(f.auctionId, f.priorBidderGuid, f.priorBidAmount, pm.reserveKey, liveRow))
-        {
-            sLog.outError("[AHMut] PROTOCOL FAULT: prior live bid row mismatch for auction %u (uuid " UI64FMTD ")",
-                          f.auctionId, res.uuid);
-            return true;
-        }
-        priorKey = liveRow.idemKey;
-    }
-
-    CustodyDeferred def;
-
-    // 4.4: command-result FIRST (the S2 seam pushes it before UpdateBid).
-    {
-        uint32 const bidderGuidLow = pm.playerGuidLow;
-        uint32 const aucId = f.auctionId;
-        uint32 const newOutbid = AhOutbidFor(f.effectiveBid);
-        def.effects.push_back([bidderGuidLow, aucId, newOutbid]()
-        {
-            AhSendCommandResultTo(bidderGuidLow, aucId, AUCTION_BID_PLACED, AUCTION_OK, newOutbid);
-        });
-    }
-
-    CharacterDatabase.BeginTransaction();
-
-    if (sameBidderRaise)
-    {
-        // Merge the delta row into the live bid row. The delta gold was
-        // debited at reserve time -> NULL bidder = ledger-only, no 2nd debit.
-        CustodyService::TopUpBid(priorKey, f.effectiveBid, 0, NULL);
-        if (remainder > 0)
-        {
-            CustodyLedger::SetAmount(pm.reserveKey, needed);
-        }
-        CustodyService::CommitGoldLedgerOnly(pm.reserveKey);
-    }
-    else
-    {
-        if (f.priorBidderGuid != 0)
-        {
-            AhRefundPriorBidderFromFacts(f, priorKey, def);
-        }
-        if (remainder > 0)
-        {
-            CustodyLedger::SetAmount(pm.reserveKey, needed);
-        }
-        // Our (possibly shrunk) reserved row IS the live bid row: stays RESERVED.
-    }
-
-    AhCreditWalletInTxn(pm.playerGuidLow, remainder);   // I4: buyout remainder (0 on a bid)
-
-    if (isBuyoutWin)
-    {
-        // S4 replay MINUS the auction-row delete + AuctionsMap ops: the worker
-        // owns the book under WriteAuthority.
-        AhSellerPayoutFromFacts(f, def);
-        CustodyService::RollbackGoldLedgerOnly("dep:" + std::to_string(f.auctionId));
-        CustodyService::CommitGoldLedgerOnly(sameBidderRaise ? priorKey : pm.reserveKey);
-        AhItemToWinnerFromFacts(f, def);
-        CustodyService::CommitGoldLedgerOnly("item:" + std::to_string(f.auctionId));
-    }
-
-    // [SP-2 Task 15] finalize-fail crash seam: CommitCheckedOrForcedFail forces
-    // this checked commit to roll back and report false ONCE when
-    // AH.Service.CustodyFailCommitAt == "finalize-fail", exercising the
-    // redrive-without-rollback path below. Inert (a plain checked commit) on a
-    // live realm.
-    if (!CustodyService::CommitCheckedOrForcedFail("finalize-fail"))
-    {
-        if (remainder > 0)
-        {
-            Player* p = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, pm.playerGuidLow));
-            if (p)
-            {
-                p->ModifyMoney(-int32(remainder));   // X6: undo the in-memory credit
-            }
-        }
-        return false;   // -> redrive, never rollback (I10)
-    }
-#ifdef ENABLE_ELUNA
-    if (isBuyoutWin)
-    {
-        // [SP-2 spec 5.8] buyout win removed the listing -> Eluna OnRemove
-        // (fired while the escrow item is still cached, before def.run()).
-        AhElunaOnRemoveFromFacts(f);
-    }
-#endif
-    def.run();
-    return true;
-}
-
-// [SP-2] MUT_OK cancel (after CONFIRM; spec 4.2 step 3): S5 replay minus the
-// auction delete/map ops; 4.4 order = notifications and mails first,
-// command-result LAST.
-static bool AhFinalizeCancelOk(PlayerMutationResult const& res, PendingMutation const& pm)
-{
-    MutationFacts const& f = res.facts;
-
-    if (!AhPreflightTerminalItem(f, true))
-    {
-        sLog.outError("[AHMut] cancel terminal custody unavailable for auction "
-                      "%u; queued for retry",
-                      f.auctionId);
-        return false;
-    }
-
-    uint32 const cut = f.curBid ? AhCutFor(f.houseId, f.curBid) : 0;
-    if (cut)
-    {
-        CustodyRow cutRow;
-        if (pm.reserveKey.empty() || !CustodyLedger::Get(pm.reserveKey, cutRow) ||
-            cutRow.state != CST_RESERVED || cutRow.ownerGuid != pm.playerGuidLow ||
-            cutRow.amount != cut || cutRow.auctionId != f.auctionId)
-        {
-            sLog.outError("[AHMut] PROTOCOL FAULT: cancel cut reservation mismatch for uuid " UI64FMTD
-                          " (auction %u)", res.uuid, f.auctionId);
-            return true;
-        }
-    }
-    std::string bidKey;
-    if (f.curBid && f.curBidderGuid != 0)
-    {
-        CustodyRow liveRow;
-        if (!AhFindPriorBidRow(f.auctionId, f.curBidderGuid, f.curBid, pm.reserveKey, liveRow))
-        {
-            sLog.outError("[AHMut] PROTOCOL FAULT: cancel live bid row mismatch for auction %u (uuid " UI64FMTD ")",
-                          f.auctionId, res.uuid);
-            return true;
-        }
-        bidKey = liveRow.idemKey;
-    }
-
-    CustodyDeferred def;
-    CharacterDatabase.BeginTransaction();
-
-    if (!bidKey.empty())
-    {
-        AhRefundCancelledBidderFromFacts(f, bidKey, def);
-    }
-    CustodyService::CommitGoldLedgerOnly("dep:" + std::to_string(f.auctionId));   // forfeit (S5)
-    AhReturnItemToSellerFromFacts(f, uint32(AUCTION_CANCELED), def);
-    if (cut)
-    {
-        CustodyService::CommitGoldLedgerOnly(pm.reserveKey);                      // cut -> house sink
-    }
-    {
-        uint32 const sellerGuidLow = pm.playerGuidLow;
-        uint32 const aucId = f.auctionId;
-        def.effects.push_back([sellerGuidLow, aucId]()
-        {
-            AhSendCommandResultTo(sellerGuidLow, aucId, AUCTION_REMOVED, AUCTION_OK, 0);
-        });
-    }
-
-    if (!CharacterDatabase.CommitTransactionChecked())
-    {
-        return false;
-    }
-#ifdef ENABLE_ELUNA
-    // [SP-2 spec 5.8] cancel removed the listing -> Eluna OnRemove (fired while
-    // the escrow item is still cached, before def.run()).
-    AhElunaOnRemoveFromFacts(f);
-#endif
-    def.run();
-    return true;
-}
-
-static bool AhFinalizeOkDispatch(PlayerMutationResult const& res, PendingMutation const& pm)
-{
-    switch (res.op)
-    {
-        case uint8(IPC_PLAYER_SELL & 0xFFu):
-            return AhFinalizeSellOk(res, pm);
-        case uint8(IPC_PLAYER_BID & 0xFFu):
-        case uint8(IPC_PLAYER_BUYOUT & 0xFFu):
-            return AhFinalizeBidOk(res, pm);
-        case uint8(IPC_PLAYER_CANCEL & 0xFFu):
-        case uint8(IPC_PLAYER_CANCEL_CONFIRM & 0xFFu):
-            return AhFinalizeCancelOk(res, pm);
-        default:
-            sLog.outError("[AHMut] PROTOCOL FAULT: MUT_OK with unknown op 0x%02X (uuid " UI64FMTD ")",
-                          uint32(res.op), res.uuid);
-            return true;
-    }
-}
-
-// [SP-2] MUT_REJECTED (spec 4.1 step 4): silent wallet re-credit of the
-// reservation (I1: NO mail for the gold) + the legacy error result. For a
-// rejected SELL the escrowed item also leaves custody: returned by MAIL.
-static bool AhFinalizeRejected(PlayerMutationResult const& res, PendingMutation const& pm)
-{
-    MutationFacts const& f = res.facts;
-    Player* online = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, pm.playerGuidLow));
-    uint32 onlineCredit = 0;
-
-    CustodyRow sellDepRow;
-    CustodyRow sellItemRow;
-    Item* sellItem = NULL;
-    if (res.op == uint8(IPC_PLAYER_SELL & 0xFFu))
-    {
-        if (pm.depKey.empty() || !CustodyLedger::Get(pm.depKey, sellDepRow) ||
-            sellDepRow.kind != CUSTODY_GOLD ||
-            sellDepRow.role != ROLE_DEPOSIT ||
-            sellDepRow.state != CST_RESERVED ||
-            sellDepRow.ownerGuid != pm.playerGuidLow ||
-            sellDepRow.auctionId != pm.auctionId ||
-            !AhGetCachedReservedItem(pm.itemKey, pm.auctionId, pm.playerGuidLow,
-                                     0u, sellItemRow, sellItem))
-        {
-            sLog.outError("[AHMut] rejected sell %u custody unavailable; "
-                          "holding for retry",
-                          pm.auctionId);
-            return false;
-        }
-    }
-
-    CustodyDeferred def;
-    CharacterDatabase.BeginTransaction();
-
-    if (res.op == uint8(IPC_PLAYER_SELL & 0xFFu))
-    {
-        CustodyService::ReleaseGoldToWallet(def, pm.playerGuidLow, online,
-                                            sellDepRow.amount, pm.depKey);
-        if (online)
-        {
-            onlineCredit += sellDepRow.amount;
-        }
-
-        CustodyLedger::SetState(pm.itemKey, CST_TERMINAL_BACK,
-                                static_cast<uint64>(time(NULL)));
-        uint32 const savedItemGuidLow = sellItemRow.itemGuid;
-        def.effects.push_back([savedItemGuidLow]()
-        {
-            sAuctionMgr.RemoveAItem(savedItemGuidLow);
-        });
-        MailDraft ret(AhMailSubject(sellItem->GetEntry(),
-                                    sellItem->GetItemRandomPropertyId(),
-                                    AUCTION_CANCELED), "");
-        ret.AddItem(sellItem);
-        ret.SendMailToInTransaction(
-            MailReceiver(online,
-                         ObjectGuid(HIGHGUID_PLAYER, pm.playerGuidLow)),
-            MailSender(MAIL_AUCTION, uint32(f.houseId),
-                       MAIL_STATIONERY_AUCTION),
-            def, MAIL_CHECK_MASK_COPIED);
-    }
-    else if (!pm.reserveKey.empty() && pm.reservedAmount > 0)
-    {
-        // bid / buyout (and, defensively, a post-CONFIRM cancel reject).
-        CustodyService::ReleaseGoldToWallet(
-            def, pm.playerGuidLow, online, pm.reservedAmount, pm.reserveKey);
-        if (online)
-        {
-            onlineCredit += pm.reservedAmount;
-        }
-    }
-
-    // Legacy error result, deferred so it fires only when the release landed.
-    {
-        uint8 const op = res.op;
-        uint8 const reason = res.reason;
-        uint32 const guidLow = pm.playerGuidLow;
-        uint32 const aucId = pm.auctionId;
-        MutationFacts const facts = f;
-        def.effects.push_back([op, reason, guidLow, aucId, facts]()
-        {
-            if (reason == uint8(AUCTION_ERR_HIGHER_BID))
-            {
-                AhSendHigherBidResultTo(guidLow, op, facts);
-            }
-            else if (reason != 0)
-            {
-                AhSendCommandResultTo(guidLow, aucId, AhActionForOp(op), AuctionError(reason), 0);
-            }
-            // reason == 0 -> silent (spec: legacy emits nothing).
-        });
-    }
-
-    if (!CharacterDatabase.CommitTransactionChecked())
-    {
-        if (onlineCredit > 0 && online)
-        {
-            online->ModifyMoney(-int32(onlineCredit));   // X6: undo the in-memory credit
-        }
-        return false;
-    }
-    def.run();
-    return true;
-}
-
-// [SP-2] MUT_REJECTED_STALE (spec 4.2 step 4): the cancel CONFIRM raced the
-// worker's unlock. Release the cut reservation (if one was made) and resolve
-// the tombstone. No SMSG: the auction is untouched (divergence 12.5).
-static bool AhFinalizeStale(PlayerMutationResult const& res, PendingMutation const& pm)
-{
-    if (pm.reserveKey.empty() || pm.reservedAmount == 0)
-    {
-        DETAIL_LOG("[AHMut] REJECTED_STALE for uuid " UI64FMTD " with no reservation", res.uuid);
-        return true;
-    }
-    Player* online = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, pm.playerGuidLow));
-    CustodyDeferred def;
-    CharacterDatabase.BeginTransaction();
-    CustodyService::ReleaseGoldToWallet(def, pm.playerGuidLow, online, pm.reservedAmount, pm.reserveKey);
-    if (!CharacterDatabase.CommitTransactionChecked())
-    {
-        if (online)
-        {
-            online->ModifyMoney(-int32(pm.reservedAmount));
-        }
-        return false;
-    }
-    def.run();
-    return true;
-}
-
-void AhNotifyMutationInDoubt(PendingMutation const& pm)
-{
-    // M2: the timed-out mutation reports the legacy DB error; the reservation
-    // stays non-terminal (decision 10 -- no unilateral rollback) and a late
-    // reply still applies through the tombstone.
-    AhSendCommandResultTo(pm.playerGuidLow, pm.auctionId,
-                          AhActionForOp(uint8(pm.op & 0xFFu)), AUCTION_ERR_DATABASE, 0);
-}
-
-void AhHandlePlayerMutationResult(PlayerMutationResult const& res)
-{
-    if (res.status == uint8(MUT_PREPARED))
-    {
-        AhHandleCancelPrepared(res);
-        return;
-    }
-
-    MutationPendingMap& pend = sWorld.GetMutationPending();
-    PendingMutation pm;
-    if (!pend.Take(res.uuid, pm))
-    {
-        // Late reply on a terminal/unknown row: loud protocol fault, never a
-        // silent drop or a double apply (decision 10).
-        sLog.outError("[AHMut] PROTOCOL FAULT: result status %u for unknown or already-consumed uuid " UI64FMTD,
-                      uint32(res.status), res.uuid);
-        return;
-    }
-
-    bool ok = true;
-    switch (res.status)
-    {
-        case uint8(MUT_OK):
-            ok = AhFinalizeOkDispatch(res, pm);
-            break;
-        case uint8(MUT_REJECTED):
-            ok = AhFinalizeRejected(res, pm);
-            break;
-        case uint8(MUT_REJECTED_STALE):
-            ok = AhFinalizeStale(res, pm);
-            break;
-        default:
-            sLog.outError("[AHMut] PROTOCOL FAULT: unknown status %u for uuid " UI64FMTD,
-                          uint32(res.status), res.uuid);
-            break;
-    }
-
-    if (!ok)
-    {
-        AhRedriveEntry e;
-        e.res = res;
-        e.pm = pm;
-        e.attempts = 1;
-        e.nextRetrySec = uint32(time(NULL)) + 5;
-        s_ahRedrive.push_back(e);
-        sLog.outError("[AHMut] finalize deferred for uuid " UI64FMTD
-                      "; queued for redrive",
-                      res.uuid);
-    }
-}
-
-// [SP-2] MUT_PREPARED -- the cancel phase-2 driver (spec 4.2 step 2 + [v3]).
-static void AhHandleCancelPrepared(PlayerMutationResult const& res)
-{
-    MutationPendingMap& pend = sWorld.GetMutationPending();
-    WorkerSupervisor* sv = sWorld.GetAhSupervisor();
-
-    PendingMutation pm;
-    if (!pend.Peek(res.uuid, pm))
-    {
-        sLog.outError("[AHMut] PROTOCOL FAULT: PREPARED for unknown uuid " UI64FMTD, res.uuid);
-        return;
-    }
-    if (pm.op != uint16(IPC_PLAYER_CANCEL))
-    {
-        sLog.outError("[AHMut] PROTOCOL FAULT: PREPARED for non-cancel op 0x%04X (uuid " UI64FMTD ")",
-                      uint32(pm.op), res.uuid);
-        return;
-    }
-
-    // A PREPARE reply landing after the tombstone -> mangosd answers ABORT
-    // (spec 4.2 [v3]); the slot resolves.
-    if (pm.state == uint8(PMUT_TOMBSTONE))
-    {
-        if (sv && sv->ServiceActive())
-        {
-            PlayerCancelDecide d;
-            d.uuid = res.uuid;
-            d.auctionId = pm.auctionId;
-            IpcMessage m;
-            m.op = IPC_PLAYER_CANCEL_ABORT;
-            d.Encode(m.body);
-            sv->Channel().SendFrame(m);
-        }
-        PendingMutation consumed;
-        pend.Take(res.uuid, consumed);
-        return;
-    }
-
-    // [FIX D] Duplicate-PREPARED guard: only a slot still in AWAIT_RESULT is
-    // awaiting its first PREPARE reply. A slot already advanced past it (CONFIRM
-    // sent -> AWAIT_CONFIRM) that receives a second PREPARE frame must be ignored:
-    // re-running the affordability gate would re-reserve the cut on an already-
-    // confirmed slot. (TOMBSTONE is handled above.)
-    if (pm.state != uint8(PMUT_AWAIT_RESULT))
-    {
-        sLog.outError("[AHMut] duplicate PREPARED for uuid " UI64FMTD " in state %u"
-                      " (not AWAIT_RESULT); ignoring", res.uuid, uint32(pm.state));
-        return;
-    }
-
-    MutationFacts const& f = res.facts;
-    uint32 const cut = f.curBid ? AhCutFor(f.houseId, f.curBid) : 0;
-    Player* pl = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, pm.playerGuidLow));
-
-    // Affordability gate (legacy silent return). A standing bid (curBid != 0)
-    // means a cut is owed on cancel: an OFFLINE seller cannot be debited -> ABORT
-    // (the auction is untouched; the seller can retry -- byte-parity: legacy
-    // emits nothing here). Gated on curBid, not the computed cut, so the offline
-    // -> ABORT decision is independent of whether DBC cut data is loaded (the -t
-    // harness has none; AhCutFor would return 0 and mask the gate).
-    bool abort = false;
-    if (f.curBid != 0)
-    {
-        if (!pl)
-        {
-            abort = true;
-        }
-        else if (pl->GetMoney() < cut)
-        {
-            abort = true;
-        }
-    }
-
-    if (!abort && cut)
-    {
-        // Durable cut reserve = its own checked commit (decision 9). The key
-        // is uuid-salted so a retry after a stale/aborted cancel of the same
-        // auction can never collide on uk_idem.
-        std::string const cutKey = "cut:" + std::to_string(pm.auctionId) + ":" + std::to_string(res.uuid);
-        CustodyDeferred def;
-        CharacterDatabase.BeginTransaction();
-        CustodyService::ReserveGold(def, pm.playerGuidLow, pl, cut, cutKey, pm.auctionId, ROLE_PROCEEDS);
-        if (!CharacterDatabase.CommitTransactionChecked())
-        {
-            if (pl)
-            {
-                pl->ModifyMoney(int32(cut));   // X6: undo the in-memory debit
-            }
-            sLog.outError("[AHMut] cancel cut reserve commit FAILED for uuid " UI64FMTD "; aborting cancel", res.uuid);
-            abort = true;
-        }
-        else
-        {
-            def.run();
-            pend.SetReserve(res.uuid, cut, cutKey);
-        }
-    }
-
-    PlayerCancelDecide d;
-    d.uuid = res.uuid;
-    d.auctionId = pm.auctionId;
-    IpcMessage m;
-    m.op = abort ? IPC_PLAYER_CANCEL_ABORT : IPC_PLAYER_CANCEL_CONFIRM;
-    d.Encode(m.body);
-    if (sv && sv->ServiceActive())
-    {
-        sv->Channel().SendFrame(m);
-    }
-
-    if (abort)
-    {
-        PendingMutation consumed;
-        pend.Take(res.uuid, consumed);       // legacy silent-return parity: no SMSG
-    }
-    else
-    {
-        pend.RearmConfirm(res.uuid, uint32(time(NULL)));
-    }
-}
-
-void AhProcessRedriveQueue(uint32 nowSec)
-{
-    // (1) Forward-only re-attempt of finalizes whose checked commit failed.
-    for (std::list<AhRedriveEntry>::iterator it = s_ahRedrive.begin(); it != s_ahRedrive.end();)
-    {
-        if (nowSec < it->nextRetrySec)
-        {
-            ++it;
-            continue;
-        }
-        bool ok = true;
-        switch (it->res.status)
-        {
-            case uint8(MUT_OK):
-                ok = AhFinalizeOkDispatch(it->res, it->pm);
-                break;
-            case uint8(MUT_REJECTED):
-                ok = AhFinalizeRejected(it->res, it->pm);
-                break;
-            case uint8(MUT_REJECTED_STALE):
-                ok = AhFinalizeStale(it->res, it->pm);
-                break;
-            default:
-                break;
-        }
-        if (ok)
-        {
-            it = s_ahRedrive.erase(it);
-        }
-        else
-        {
-            ++it->attempts;
-            it->nextRetrySec = nowSec + 5;
-            if (it->attempts % 12 == 0)
-            {
-                sLog.outError("[AHMut] redrive STUCK: uuid " UI64FMTD " still failing after %u attempts",
-                              it->res.uuid, it->attempts);
-            }
-            ++it;
-        }
-    }
-
-    // (2) Age un-answered player mutations into in-doubt tombstones and emit the
-    // one-time legacy AUCTION_ERR_DATABASE result for each (spec 4.1 step 5).
-    // Cheap no-op when the pending map is empty (the default-off case).
-    std::vector<uint64> newlyInDoubt;
-    MutationPendingMap& pend = sWorld.GetMutationPending();
-    pend.SweepToTombstones(nowSec, AH_MUTATION_INDOUBT_TTL_SEC, newlyInDoubt);
-    for (size_t i = 0; i < newlyInDoubt.size(); ++i)
-    {
-        PendingMutation pm;
-        if (pend.Peek(newlyInDoubt[i], pm))
-        {
-            AhNotifyMutationInDoubt(pm);
-        }
-    }
-}
-
-// ===========================================================================
-// SP-2 Task 12: worker-initiated resolutions (IPC_RESOLVE_APPLY) + reconcile.
-// ===========================================================================
-
-// [SP-2] the single live (CST_RESERVED ROLE_PROCEEDS CUSTODY_GOLD) cut
-// reservation for an auction. The cancel-CONFIRM path salts the cut idem key
-// with the CANCEL uuid ("cut:<auc>:<uuid>"), but a RESOLVE_CANCELLED_UNLOCK
-// arrives with its OWN (worker-minted) uuid, so the cut cannot be found by a
-// deterministic point key -- it is located by auction + role instead.
-// Returns the row's real idemKey for the release.
-static bool AhFindLiveCutRow(uint32 auctionId, CustodyRow& out)
-{
-    std::vector<CustodyRow> rows;
-    CustodyLedger::LoadNonTerminal(rows);
-    for (size_t i = 0; i < rows.size(); ++i)
-    {
-        if (rows[i].auctionId == auctionId && rows[i].kind == CUSTODY_GOLD &&
-            rows[i].role == ROLE_PROCEEDS && rows[i].state == CST_RESERVED)
-        {
-            out = rows[i];
-            return true;
-        }
-    }
-    return false;
-}
-
-// [SP-2] Apply one worker-initiated resolution (spec 4.3). ALL per-kind value
-// effects + the resolve:<uuid> applied-record commit in ONE checked txn, so
-// DUPLICATE == APPLIED and a commit failure keeps the worker's row RESOLVING
-// (RES_FAILED, never a book rollback -- decision 10). Reuses Task 11's
-// from-facts value helpers verbatim. An unknown kind is an unrecoverable
-// protocol fault -> AH_RESOLVE_NO_ACK (the pump sends no ack; never retried).
-uint8 AhHandleResolveApply(ResolveApply const& ra)
-{
-    // Idempotency: DUPLICATE == APPLIED (spec 4.3-C1). Answer before mutating.
-    if (CustodyService::ResolutionApplied(ra.uuid))
-    {
-        return uint8(RES_DUPLICATE);
-    }
-
-    MutationFacts const& f = ra.facts;
-    bool const repairRefundOnly =
-        (ra.kind == uint8(RESOLVE_REPAIR_RETURN) &&
-         f.curBidderGuid == 0u && f.priorBidderGuid != 0u);
-    bool const needsItem =
-        (ra.kind == uint8(RESOLVE_WON) ||
-         ra.kind == uint8(RESOLVE_EXPIRED_NOBID) ||
-         (ra.kind == uint8(RESOLVE_REPAIR_RETURN) && !repairRefundOnly));
-    if (needsItem && !AhPreflightTerminalItem(f, true))
-    {
-        sLog.outError("[AHMut] resolve kind %u auction %u invalid terminal "
-                      "item or deposit custody; RES_FAILED", uint32(ra.kind), f.auctionId);
-        return uint8(RES_FAILED);
-    }
-
-    CustodyDeferred def;
-    // [F1] A RESOLVE_CANCELLED_UNLOCK release credits an ONLINE owner's wallet
-    // immediately (in-memory ModifyMoney, non-transactional); only the ledger
-    // flip is in the checked txn. Capture that credit so a commit failure can
-    // undo it (X6) before RES_FAILED -- mirrors the five sibling finalize sites.
-    Player* releasedCutOnline = NULL;
-    uint32  releasedCutAmount = 0u;
-    CharacterDatabase.BeginTransaction();
-
-    switch (ra.kind)
-    {
-        case RESOLVE_WON:
-        {
-            // Consume the winning bid row + the seller deposit, pay the seller
-            // (profit = effectiveBid + deposit - cut), deliver the item, and flip
-            // the escrow item row terminal. curBidderGuid == 0 => bot win (the
-            // destroy branch lives inside AhItemToWinnerFromFacts). The explicit
-            // item-row flip mirrors the landed buyout-win path in AhFinalizeBidOk
-            // (AhItemToWinnerFromFacts does NOT touch "item:<id>" itself).
-            std::string const depKey  = "dep:" + std::to_string(f.auctionId);
-            std::string const itemKey = "item:" + std::to_string(f.auctionId);
-            CustodyRow bidRow;
-            bool const realWinner = (f.curBidderGuid != 0u);
-            bool const displacedPlayer =
-                (!realWinner && f.priorBidderGuid != 0u);
-            bool bidRowOk = false;
-            if (realWinner)
-            {
-                bidRowOk = AhFindPriorBidRow(f.auctionId, f.curBidderGuid,
-                                             f.curBid, "", bidRow);
-            }
-            else if (displacedPlayer)
-            {
-                bidRowOk = AhFindPriorBidRow(f.auctionId, f.priorBidderGuid,
-                                             f.priorBidAmount, "", bidRow);
-            }
-            else
-            {
-                std::unique_ptr<QueryResult> liveRows(CharacterDatabase.PQuery(
-                    "SELECT COUNT(*) FROM `custody_ledger` WHERE `auction_id`=%u "
-                    "AND `kind`=%u AND `role`=%u AND `state`=%u",
-                    f.auctionId, uint32(CUSTODY_GOLD), uint32(ROLE_BID), uint32(CST_RESERVED)));
-                bidRowOk = liveRows && liveRows->Fetch()[0].GetUInt64() == 0u;
-            }
-            if (!bidRowOk)
-            {
-                CharacterDatabase.RollbackTransaction();
-                sLog.outError("[AHMut] PROTOCOL FAULT: RESOLVE_WON bid custody"
-                              " mismatch for auction %u - RES_FAILED",
-                              f.auctionId);
-                return uint8(RES_FAILED);
-            }
-            if (realWinner)
-            {
-                CustodyService::CommitGoldLedgerOnly(bidRow.idemKey);
-            }
-            else if (displacedPlayer)
-            {
-                AhRefundPriorBidderFromFacts(f, bidRow.idemKey, def);
-            }
-            CustodyService::CommitGoldLedgerOnly(depKey);
-            AhSellerPayoutFromFacts(f, def);
-            AhItemToWinnerFromFacts(f, def);
-            CustodyService::CommitGoldLedgerOnly(itemKey);
-            break;
-        }
-        case RESOLVE_EXPIRED_NOBID:
-        {
-            // No-bid expiry: the deposit is FORFEIT (legacy: not returned) and
-            // the item goes back to the seller. AhReturnItemToSellerFromFacts
-            // flips "item:<id>" terminal internally (DeliverItem / ledger-only).
-            std::string const depKey = "dep:" + std::to_string(f.auctionId);
-            CustodyService::CommitGoldLedgerOnly(depKey);
-            AhReturnItemToSellerFromFacts(f, uint32(AUCTION_EXPIRED), def);
-            break;
-        }
-        case RESOLVE_CANCELLED_UNLOCK:
-        {
-            // Worker timed out a cancel PREPARE and unlocked the row: release any
-            // cut reservation we hold for this auction back to the seller. No
-            // item/bid movement -- the auction persists.
-            CustodyRow cutRow;
-            if (AhFindLiveCutRow(f.auctionId, cutRow))
-            {
-                // [F3] Release to the guid actually debited at reserve time (the
-                // reserved row's authoritative owner), NOT the worker-supplied
-                // seller facts -- used for both the release owner and the lookup.
-                Player* owner = sObjectMgr.GetPlayer(
-                    ObjectGuid(HIGHGUID_PLAYER, cutRow.ownerGuid));
-                CustodyService::ReleaseGoldToWallet(def, cutRow.ownerGuid, owner,
-                                                    cutRow.amount, cutRow.idemKey);
-                // [F1] An online owner was credited in-memory now; remember it so
-                // a checked-commit failure can undo the credit (offline owners are
-                // an in-txn UPDATE that rolls back on failure -- nothing to undo).
-                if (owner)
-                {
-                    releasedCutOnline = owner;
-                    releasedCutAmount = cutRow.amount;
-                }
-            }
-            break;
-        }
-        case RESOLVE_REPAIR_RETURN:
-        {
-            if (f.curBidderGuid == 0u && f.priorBidderGuid != 0u)
-            {
-                // A bot displaced a real player bidder: refund the prior bidder;
-                // the listing persists (non-terminal). The prior bid key is the
-                // single live bid row for this auction.
-                CustodyRow priorRow;
-                if (CustodyLedger::GetSingleLiveBidRow(f.auctionId, priorRow))
-                {
-                    AhRefundPriorBidderFromFacts(f, priorRow.idemKey, def);
-                }
-            }
-            else
-            {
-                // Item repair / no displaced player: deposit forfeit + item back.
-                std::string const depKey = "dep:" + std::to_string(f.auctionId);
-                CustodyService::CommitGoldLedgerOnly(depKey);
-                AhReturnItemToSellerFromFacts(f, uint32(AUCTION_EXPIRED), def);
-            }
-            break;
-        }
-        default:
-        {
-            CharacterDatabase.RollbackTransaction();
-            sLog.outError("[AHMut] AhHandleResolveApply unknown kind %u (auction %u)"
-                          " - protocol fault, no ack", uint32(ra.kind), f.auctionId);
-            return AH_RESOLVE_NO_ACK;
-        }
-    }
-
-    // The applied-record commits atomically with the value effects.
-    CustodyService::WriteResolutionApplied(f.auctionId, ra.uuid);
-
-    // [SP-2 Task 15] crash seam: the applied-record is queued but NOT yet
-    // committed. On restart the worker re-sends RESOLVE_APPLY and the
-    // ResolutionApplied guard above must answer DUPLICATE == APPLIED. Inert on a
-    // live realm.
-    CustodyService::MaybeCrash("resolving-pre-apply");
-
-    if (!CharacterDatabase.CommitTransactionChecked())
-    {
-        // Keep the worker's row RESOLVING: it re-sends on its cadence and we
-        // DUPLICATE-answer once it finally applies (spec 4.3; never roll the
-        // worker book back on a mangosd-side failure).
-        // [F1] Undo the online owner's in-memory cut credit (the ledger flip +
-        // any offline UPDATE already rolled back with the txn). Mirrors the X6
-        // sibling undo: ModifyMoney only, since the DB write was transactional.
-        if (releasedCutOnline && releasedCutAmount > 0u)
-        {
-            releasedCutOnline->ModifyMoney(-int32(releasedCutAmount));   // X6: undo the in-memory credit
-        }
-        sLog.outError("[AHMut] resolve kind %u (auction %u) commit failed - RES_FAILED",
-                      uint32(ra.kind), f.auctionId);
-        return uint8(RES_FAILED);
-    }
-#ifdef ENABLE_ELUNA
-    // [SP-2 spec 5.8] fire Eluna OnRemove for worker-initiated resolutions that
-    // terminally remove the listing from the book: won, no-bid expiry, and the
-    // repair item-return branch. Cancel-unlock and the repair bidder-refund
-    // sub-case keep the listing live, so they do not fire. Fired while the
-    // escrow item is still cached, before def.run().
-    if (ra.kind == RESOLVE_WON || ra.kind == RESOLVE_EXPIRED_NOBID ||
-        (ra.kind == RESOLVE_REPAIR_RETURN &&
-         !(f.curBidderGuid == 0u && f.priorBidderGuid != 0u)))
-    {
-        AhElunaOnRemoveFromFacts(f);
-    }
-#endif
-    def.run();
-    return uint8(RES_APPLIED);
-}
-
-// ---------------------------------------------------------------------------
-// Reconcile-on-reconnect (spec 8). The worker journal (ah_worker_journal) is a
-// Character-DB table shared with the worker; mangosd has no ServiceDatabase, so
-// it reads the table directly with its own connection. Journal states mirror
-// AhJournal::JournalState: COMMITTED=1, RESOLVING=2, APPLIED=3,
-// CANCEL_PREPARED=4, INTENT_PENDING=5.
-// ---------------------------------------------------------------------------
-
-static int AhHexNibble(char c)
-{
-    if (c >= '0' && c <= '9')
-    {
-        return c - '0';
-    }
-    if (c >= 'a' && c <= 'f')
-    {
-        return c - 'a' + 10;
-    }
-    if (c >= 'A' && c <= 'F')
-    {
-        return c - 'A' + 10;
-    }
-    return -1;
-}
-
-// One peeked ah_worker_journal row and its decoded worker result envelope.
-struct AhJournalPeek
-{
-    uint32 auctionId;
-    uint8 state;
-    uint8 kind;
-    PlayerMutationResult result;
-    bool payloadOk;
-};
-
-// [FIX C.2] Tri-state result of a journal peek. mangos `PQuery` returns NULL for
-// BOTH "no rows" and "query could not be executed" (table missing / transient DB
-// error), so a bare bool conflates a genuine row-absent (release the reservation)
-// with a query failure (must NOT release -- the worker may have committed).
-enum AhJournalRead
-{
-    AHJRN_FOUND        = 0,  ///< row present; @p out is populated
-    AHJRN_ABSENT       = 1,  ///< row genuinely absent (table present) -> release
-    AHJRN_QUERY_FAILED = 2   ///< table missing / DB error -> in-doubt, do NOT release
-};
-
-// Read one journal row by uuid directly from the shared Character DB. The
-// aggregate always returns one row after a successful query, so COUNT cleanly
-// distinguishes ABSENT from a NULL query result (DB error/table missing). The
-// worker stores a complete PlayerMutationResult as NUL-safe ASCII hex.
-static AhJournalRead AhReadWorkerJournal(uint64 uuid, AhJournalPeek& out)
-{
-    QueryResult* q = CharacterDatabase.PQuery(
-        "SELECT COUNT(*), COALESCE(MAX(`auction_id`),0), "
-        "COALESCE(MAX(`state`),0), COALESCE(MAX(`kind`),0), "
-        "COALESCE(MAX(`facts`),'') FROM `ah_worker_journal` "
-        "WHERE `uuid`=%llu",
-        static_cast<unsigned long long>(uuid));
-    if (q == NULL)
-    {
-        return AHJRN_QUERY_FAILED;
-    }
-    Field* fld = q->Fetch();
-    if (fld[0].GetUInt32() == 0u)
-    {
-        delete q;
-        return AHJRN_ABSENT;
-    }
-    out.auctionId = fld[1].GetUInt32();
-    out.state = static_cast<uint8>(fld[2].GetUInt32());
-    out.kind = static_cast<uint8>(fld[3].GetUInt32());
-    std::string const hex = fld[4].GetCppString();
-    delete q;
-
-    out.payloadOk = false;
-    if ((hex.size() % 2u) == 0u && !hex.empty())
-    {
-        std::string bin;
-        bin.reserve(hex.size() / 2u);
-        bool ok = true;
-        for (size_t i = 0; i + 1u < hex.size(); i += 2u)
-        {
-            int const hi = AhHexNibble(hex[i]);
-            int const lo = AhHexNibble(hex[i + 1u]);
-            if (hi < 0 || lo < 0)
-            {
-                ok = false;
-                break;
-            }
-            bin.push_back(static_cast<char>((hi << 4) | lo));
-        }
-        if (ok && bin.size() == PlayerMutationResult::WIRE_SIZE)
-        {
-            ByteBuffer bb;
-            bb.append(reinterpret_cast<uint8 const*>(bin.data()), bin.size());
-            PlayerMutationResult stored;
-            if (stored.Decode(bb) && bb.rpos() == bb.size() &&
-                stored.uuid == uuid && stored.op == out.kind &&
-                stored.facts.auctionId == out.auctionId)
-            {
-                out.result = stored;
-                out.payloadOk = true;
-            }
-        }
-    }
-    return AHJRN_FOUND;
-}
-
-// [SP-2] Release whatever reservations a pending player mutation still holds
-// back to the wallet (forward-only; the absent-journal case, spec 8). Mirrors
-// AhFinalizeRejected's release core, but keyed off the pending (no worker
-// facts). Accumulates the online in-memory credit into @p onlineCredit so the
-// caller can undo it if its checked commit fails (X6).
-static bool AhReleasePendingReservations(PendingMutation const& pm,
-                                         CustodyDeferred& def, uint32& onlineCredit)
-{
-    Player* online = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, pm.playerGuidLow));
-
-    if (!pm.depKey.empty())
-    {
-        CustodyRow depRow;
-        if (CustodyLedger::Get(pm.depKey, depRow) && depRow.state == CST_RESERVED)
-        {
-            CustodyService::ReleaseGoldToWallet(def, pm.playerGuidLow, online, depRow.amount, pm.depKey);
-            if (online)
-            {
-                onlineCredit += depRow.amount;
-            }
-        }
-    }
-    if (!pm.reserveKey.empty())
-    {
-        CustodyRow rsvRow;
-        if (CustodyLedger::Get(pm.reserveKey, rsvRow) && rsvRow.state == CST_RESERVED)
-        {
-            CustodyService::ReleaseGoldToWallet(def, pm.playerGuidLow, online, rsvRow.amount, pm.reserveKey);
-            if (online)
-            {
-                onlineCredit += rsvRow.amount;
-            }
-        }
-    }
-    if (!pm.itemKey.empty())
-    {
-        CustodyRow itemRow;
-        if (CustodyLedger::Get(pm.itemKey, itemRow) && itemRow.state == CST_RESERVED)
-        {
-            Item* pItem = sAuctionMgr.GetAItem(itemRow.itemGuid);
-            if (!pItem)
-            {
-                sLog.outError(
-                    "[AHMut] reconcile release: escrow item %u missing "
-                    "for uuid " UI64FMTD "; holding reservation",
-                    itemRow.itemGuid, pm.uuid);
-                return false;
-            }
-
-            CustodyLedger::SetState(pm.itemKey, CST_TERMINAL_BACK,
-                                    static_cast<uint64>(time(NULL)));
-            uint32 const savedItemGuidLow = itemRow.itemGuid;
-            def.effects.push_back([savedItemGuidLow]()
-            {
-                sAuctionMgr.RemoveAItem(savedItemGuidLow);
-            });
-            MailDraft ret(AhMailSubject(pItem->GetEntry(),
-                                        pItem->GetItemRandomPropertyId(),
-                                        AUCTION_CANCELED), "");
-            ret.AddItem(pItem);
-            ret.SendMailToInTransaction(
-                MailReceiver(online,
-                             ObjectGuid(HIGHGUID_PLAYER, pm.playerGuidLow)),
-                MailSender(MAIL_AUCTION, 0u, MAIL_STATIONERY_AUCTION),
-                def, MAIL_CHECK_MASK_COPIED);
-        }
-    }
-    return true;
-}
-
-// [SP-2] Absent-journal (or anomalous-state) disposition: release the pending's
-// reservations, write the applied-record, and consume the slot. One checked txn.
-static bool AhReconcileReleaseAndConsume(PendingMutation const& pm)
-{
-    CustodyDeferred def;
-    uint32 onlineCredit = 0u;
-    CharacterDatabase.BeginTransaction();
-    if (!AhReleasePendingReservations(pm, def, onlineCredit))
-    {
-        CharacterDatabase.RollbackTransaction();
-        if (onlineCredit > 0u)
-        {
-            Player* p = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, pm.playerGuidLow));
-            if (p)
-            {
-                p->ModifyMoney(-int32(onlineCredit));
-            }
-        }
-        return false;
-    }
-    CustodyService::WriteResolutionApplied(pm.auctionId, pm.uuid);
-    if (CustodyService::CommitCheckedOrForcedFail("reconcile-release"))
-    {
-        def.run();
-        PendingMutation consumed;
-        sWorld.GetMutationPending().Take(pm.uuid, consumed);
-        return true;
-    }
-
-    if (onlineCredit > 0u)
-    {
-        Player* p = sObjectMgr.GetPlayer(
-            ObjectGuid(HIGHGUID_PLAYER, pm.playerGuidLow));
-        if (p)
-        {
-            // X6: undo the in-memory credit.
-            p->ModifyMoney(-int32(onlineCredit));
-        }
-    }
-    sLog.outError("[AHMut] reconcile release commit FAILED for uuid " UI64FMTD,
-                  pm.uuid);
-    return false;
-}
-
-enum AhReconnectDisposition
-{
-    AH_RECONNECT_COMPLETE,
-    AH_RECONNECT_RETRY,
-    AH_RECONNECT_HELD
-};
-
-static uint32 const AH_RECONNECT_RETRY_SEC = 5u;
-static std::map<uint64, uint32> s_ahReconnectRetries;
-
-// [SP-2] COMMITTED/APPLIED journal disposition: the worker committed the book
-// but the IPC_PLAYER_RESULT frame was lost. Re-drive the value finalize from
-// the journal facts. AhHandlePlayerMutationResult is fail-closed against the
-// custody ledger (a reserve row already flipped terminal by an earlier finalize
-// makes the cross-check refuse), so a partially/fully-applied finalize re-driven
-// here can never double-move value or double-mail; it also consumes the pending.
-static AhReconnectDisposition AhResolveForwardFromJournal(
-    PendingMutation const& pm, AhJournalPeek const& jp)
-{
-    // Cancel confirmation only updates the journal state: its stored envelope
-    // still describes PREPARED. APPLIED is ambiguous (it also records ABORT).
-    bool const committedCancel = jp.payloadOk && jp.state == 1u &&
-        pm.op == IPC_PLAYER_CANCEL && jp.result.status == uint8(MUT_PREPARED);
-    if (!jp.payloadOk || jp.auctionId != pm.auctionId ||
-        jp.result.op != uint8(pm.op & 0xFFu) ||
-        (jp.result.status != uint8(MUT_OK) && !committedCancel))
-    {
-        sLog.outError("[AHMut] reconcile uuid " UI64FMTD ": committed journal "
-                      "payload invalid; holding reservation in-doubt",
-                      pm.uuid);
-        sWorld.GetMutationPending().Tombstone(pm.uuid);
-        return AH_RECONNECT_HELD;
-    }
-    PlayerMutationResult result = jp.result;
-    if (committedCancel)
-    {
-        result.op = uint8(IPC_PLAYER_CANCEL_CONFIRM & 0xFFu);
-        result.status = uint8(MUT_OK);
-    }
-    // Takes the pending and applies the fail-closed finalize.
-    AhHandlePlayerMutationResult(result);
-    return AH_RECONNECT_COMPLETE;
-}
-
-// [SP-2] CANCEL_PREPARED journal disposition (spec 8): a cancel PREPARE lock we
-// hold with no CONFIRM -> release any cut reservation + tell the worker to ABORT
-// (unlock the book row), then consume the slot. Mirrors AhFinalizeStale + the
-// AhHandleCancelPrepared abort frame.
-static bool AhAbortAndRelease(PendingMutation const& pm)
-{
-    if (!pm.reserveKey.empty())
-    {
-        CustodyRow cutRow;
-        if (CustodyLedger::Get(pm.reserveKey, cutRow) && cutRow.state == CST_RESERVED)
-        {
-            Player* online = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, pm.playerGuidLow));
-            CustodyDeferred def;
-            CharacterDatabase.BeginTransaction();
-            CustodyService::ReleaseGoldToWallet(def, pm.playerGuidLow, online, cutRow.amount, pm.reserveKey);
-            if (CustodyService::CommitCheckedOrForcedFail(
-                    "reconcile-abort-release"))
-            {
-                def.run();
-            }
-            else
-            {
-                if (online)
-                {
-                    online->ModifyMoney(-int32(cutRow.amount));   // X6: undo in-memory credit
-                }
-                sLog.outError("[AHMut] reconcile cut release commit FAILED for uuid " UI64FMTD, pm.uuid);
-                return false;
-            }
-        }
-    }
-
-    WorkerSupervisor* const sv = sWorld.GetAhSupervisor();
-    if (sv != NULL && sv->ServiceActive())
-    {
-        PlayerCancelDecide d;
-        d.uuid      = pm.uuid;
-        d.auctionId = pm.auctionId;
-        IpcMessage m;
-        m.op = IPC_PLAYER_CANCEL_ABORT;
-        d.Encode(m.body);
-        sv->Channel().SendFrame(m);
-    }
-
-    PendingMutation consumed;
-    sWorld.GetMutationPending().Take(pm.uuid, consumed);
-    return true;
-}
-
-static AhReconnectDisposition AhReconcilePending(
-    PendingMutation const& pm)
-{
-    MutationPendingMap& pend = sWorld.GetMutationPending();
-    AhJournalPeek jp;
-    AhJournalRead const rd = AhReadWorkerJournal(pm.uuid, jp);
-
-    if (rd == AHJRN_QUERY_FAILED)
-    {
-        sLog.outError("[AHMut] reconcile uuid " UI64FMTD ": journal peek "
-                      "FAILED (table missing / DB error); holding reservation "
-                      "in-doubt",
-                      pm.uuid);
-        pend.Tombstone(pm.uuid);
-        return AH_RECONNECT_RETRY;
-    }
-
-    if (rd == AHJRN_FOUND)
-    {
-        // COMMITTED(1) / APPLIED(3): the worker committed the book.
-        if (jp.state == 1u || jp.state == 3u)
-        {
-            return AhResolveForwardFromJournal(pm, jp);
-        }
-
-        // CANCEL_PREPARED(4): abort the lock after releasing any cut.
-        if (jp.state == 4u)
-        {
-            if (!jp.payloadOk || jp.auctionId != pm.auctionId ||
-                jp.result.op != uint8(pm.op & 0xFFu) ||
-                jp.result.status != uint8(MUT_PREPARED))
-            {
-                sLog.outError(
-                    "[AHMut] reconcile uuid " UI64FMTD ": cancel-prepared "
-                    "journal payload invalid; holding in-doubt",
-                    pm.uuid);
-                pend.Tombstone(pm.uuid);
-                return AH_RECONNECT_HELD;
-            }
-            return AhAbortAndRelease(pm) ? AH_RECONNECT_COMPLETE
-                                         : AH_RECONNECT_RETRY;
-        }
-
-        // Any other present state for a mangosd pending is anomalous. The
-        // mangosd and worker UUID spaces are disjoint, so release safely.
-        sLog.outError("[AHMut] reconcile uuid " UI64FMTD ": unexpected journal "
-                      "state %u; releasing reservation",
-                      pm.uuid, uint32(jp.state));
-    }
-
-    // A genuinely absent row means the worker never committed this mutation.
-    return AhReconcileReleaseAndConsume(pm) ? AH_RECONNECT_COMPLETE
-                                             : AH_RECONNECT_RETRY;
-}
-
-// [SP-2] Walk every in-flight pending against the shared worker journal on the
-// service-just-became-active edge (spec 8). Failed local/query dispositions are
-// queued for the steady-state retry tick; malformed durable payloads remain
-// held for operator repair.
-void AhReconcileOnReconnect()
-{
-    MutationPendingMap& pend = sWorld.GetMutationPending();
-    std::vector<PendingMutation> inflight;
-    pend.SnapshotInflight(inflight);
-    if (inflight.empty())
-    {
-        return;
-    }
-    sLog.outString("[AHMut] reconcile-on-reconnect: %u in-flight pending mutation(s)",
-                   uint32(inflight.size()));
-
-    for (size_t i = 0; i < inflight.size(); ++i)
-    {
-        PendingMutation const& pm = inflight[i];
-        AhReconnectDisposition const disposition = AhReconcilePending(pm);
-        if (disposition == AH_RECONNECT_RETRY)
-        {
-            s_ahReconnectRetries[pm.uuid] =
-                uint32(time(NULL)) + AH_RECONNECT_RETRY_SEC;
-        }
-        else
-        {
-            s_ahReconnectRetries.erase(pm.uuid);
-        }
-    }
-}
-
-void AhProcessReconnectRetryQueue(uint32 nowSec)
-{
-    MutationPendingMap& pend = sWorld.GetMutationPending();
-    std::map<uint64, uint32>::iterator itr = s_ahReconnectRetries.begin();
-    while (itr != s_ahReconnectRetries.end())
-    {
-        if (itr->second > nowSec)
-        {
-            ++itr;
-            continue;
-        }
-
-        std::map<uint64, uint32>::iterator current = itr++;
-        PendingMutation pm;
-        if (!pend.Peek(current->first, pm))
-        {
-            s_ahReconnectRetries.erase(current);
-            continue;
-        }
-
-        AhReconnectDisposition const disposition = AhReconcilePending(pm);
-        if (disposition == AH_RECONNECT_RETRY)
-        {
-            current->second = nowSec + AH_RECONNECT_RETRY_SEC;
-        }
-        else
-        {
-            s_ahReconnectRetries.erase(current);
-        }
-    }
-}
-
 /** @} */
diff --git a/src/game/WorldHandlers/Chat.cpp b/src/game/WorldHandlers/Chat.cpp
index 8be2c82e53..f48a061f26 100644
--- a/src/game/WorldHandlers/Chat.cpp
+++ b/src/game/WorldHandlers/Chat.cpp
@@ -44,6 +44,8 @@
 
 #include "Common/Locales.h"
 #include "Utilities/Errors.h"
+#include <algorithm>
+#include <cstring>
 #include <sstream>
 #include <string>
 #include <map>
@@ -64,7 +66,7 @@
 #include "SpellMgr.h"
 #include "PoolManager.h"
 #include "GameEventMgr.h"
-#include "AuctionHouseBot/AuctionHouseBot.h"
+#include "AuctionHouseModule.h"
 #include "CommandMgr.h"
 #include "ObjectLookup.h"
 
@@ -124,58 +126,6 @@ ChatCommand* ChatHandler::getCommandTable()
         { NULL,             0,                  false, NULL,                                           "", NULL }
     };
 
-    static ChatCommand ahbotItemsAmountCommandTable[] =
-    {
-        { "grey",           SEC_ADMINISTRATOR,  true,  &ChatHandler::HandleAHBotItemsAmountQualityCommand<AUCTION_QUALITY_GREY>,  "", NULL },
-        { "white",          SEC_ADMINISTRATOR,  true,  &ChatHandler::HandleAHBotItemsAmountQualityCommand<AUCTION_QUALITY_WHITE>, "", NULL },
-        { "green",          SEC_ADMINISTRATOR,  true,  &ChatHandler::HandleAHBotItemsAmountQualityCommand<AUCTION_QUALITY_GREEN>, "", NULL },
-        { "blue",           SEC_ADMINISTRATOR,  true,  &ChatHandler::HandleAHBotItemsAmountQualityCommand<AUCTION_QUALITY_BLUE>,  "", NULL },
-        { "purple",         SEC_ADMINISTRATOR,  true,  &ChatHandler::HandleAHBotItemsAmountQualityCommand<AUCTION_QUALITY_PURPLE>, "", NULL },
-        { "orange",         SEC_ADMINISTRATOR,  true,  &ChatHandler::HandleAHBotItemsAmountQualityCommand<AUCTION_QUALITY_ORANGE>, "", NULL },
-        { "yellow",         SEC_ADMINISTRATOR,  true,  &ChatHandler::HandleAHBotItemsAmountQualityCommand<AUCTION_QUALITY_YELLOW>, "", NULL },
-        { "",               SEC_ADMINISTRATOR,  true,  &ChatHandler::HandleAHBotItemsAmountCommand,      "", NULL },
-        { NULL,             0,                  true,  NULL,                                             "", NULL }
-    };
-
-    static ChatCommand ahbotItemsRatioCommandTable[] =
-    {
-        { "alliance",       SEC_ADMINISTRATOR,  true,  &ChatHandler::HandleAHBotItemsRatioHouseCommand<AUCTION_HOUSE_ALLIANCE>,  "", NULL },
-        { "horde",          SEC_ADMINISTRATOR,  true,  &ChatHandler::HandleAHBotItemsRatioHouseCommand<AUCTION_HOUSE_HORDE>,     "", NULL },
-        { "neutral",        SEC_ADMINISTRATOR,  true,  &ChatHandler::HandleAHBotItemsRatioHouseCommand<AUCTION_HOUSE_NEUTRAL>,   "", NULL },
-        { "",               SEC_ADMINISTRATOR,  true,  &ChatHandler::HandleAHBotItemsRatioCommand,      "", NULL },
-        { NULL,             0,                  true,  NULL,                                             "", NULL }
-    };
-
-    static ChatCommand ahbotItemsCommandTable[] =
-    {
-        { "amount",         SEC_ADMINISTRATOR,  true,  NULL,                                           "", ahbotItemsAmountCommandTable},
-        { "ratio",          SEC_ADMINISTRATOR,  true,  NULL,                                           "", ahbotItemsRatioCommandTable},
-        { NULL,             0,                  true,  NULL,                                           "", NULL }
-    };
-
-    static ChatCommand ahbotCommandTable[] =
-    {
-        { "items",          SEC_ADMINISTRATOR,  true,  NULL,                                           "", ahbotItemsCommandTable},
-        { "rebuild",        SEC_ADMINISTRATOR,  true,  &ChatHandler::HandleAHBotRebuildCommand,        "", NULL },
-        { "reload",         SEC_ADMINISTRATOR,  true,  &ChatHandler::HandleAHBotReloadCommand,         "", NULL },
-        { "status",         SEC_ADMINISTRATOR,  true,  &ChatHandler::HandleAHBotStatusCommand,         "", NULL },
-        { NULL,             0,                  true,  NULL,                                           "", NULL }
-    };
-
-    static ChatCommand ahConsoleCommandTable[] =
-    {
-        { "show",           SEC_ADMINISTRATOR,  true,  &ChatHandler::HandleAhServiceConsoleShowCommand, "", NULL },
-        { "hide",           SEC_ADMINISTRATOR,  true,  &ChatHandler::HandleAhServiceConsoleHideCommand, "", NULL },
-        { NULL,             0,                  true,  NULL,                                            "", NULL }
-    };
-
-    static ChatCommand ahCommandTable[] =
-    {
-        { "console",        SEC_ADMINISTRATOR,  true,  NULL,                                            "", ahConsoleCommandTable },
-        { "repair",         SEC_ADMINISTRATOR,  true,  &ChatHandler::HandleAhRepairCommand,             "", NULL },
-        { NULL,             0,                  true,  NULL,                                            "", NULL }
-    };
-
     static ChatCommand auctionCommandTable[] =
     {
         { "alliance",       SEC_ADMINISTRATOR,  false, &ChatHandler::HandleAuctionAllianceCommand,     "", NULL },
@@ -777,9 +727,7 @@ ChatCommand* ChatHandler::getCommandTable()
     static ChatCommand commandTable[] =
     {
         { "account",        SEC_PLAYER,         true,  NULL,                                           "", accountCommandTable  },
-        { "ah",             SEC_ADMINISTRATOR,  true,  NULL,                                           "", ahCommandTable       },
         { "auction",        SEC_ADMINISTRATOR,  false, NULL,                                           "", auctionCommandTable  },
-        { "ahbot",          SEC_ADMINISTRATOR,  true,  NULL,                                           "", ahbotCommandTable    },
         { "cast",           SEC_ADMINISTRATOR,  true,  NULL,                                           "", castCommandTable     },
         { "character",      SEC_GAMEMASTER,     true,  NULL,                                           "", characterCommandTable},
         { "debug",          SEC_MODERATOR,      true,  NULL,                                           "", debugCommandTable    },
@@ -873,18 +821,43 @@ ChatCommand* ChatHandler::getCommandTable()
 #ifdef ENABLE_PLAYERBOTS
         { "bot",            SEC_PLAYER,         false, &ChatHandler::HandlePlayerbotCommand,           "", NULL },
         { "rndbot",         SEC_CONSOLE,        true,  &ChatHandler::HandlePlayerbotConsoleCommand,    "", NULL },
-        { "ahbot",          SEC_GAMEMASTER,     true,  &ChatHandler::HandleAhBotCommand,               "", NULL },
 #endif
 
         { NULL,             0,                  false, NULL,                                           "", NULL }
     };
 
+    // the hardcoded commands followed by those the auction modules bring, sorted
+    // by name so a command that abbreviates another ("ah", "ahbot") comes first
+    static std::vector<ChatCommand> rootTable;
+    if (rootTable.empty())
+    {
+        for (uint32 i = 0; commandTable[i].Name != NULL; ++i)
+        {
+            rootTable.push_back(commandTable[i]);
+        }
+
+        std::vector<ChatCommand> moduleCommands;
+        for (ChatCommand* table : AuctionHouseModules::Commands())
+        {
+            for (uint32 i = 0; table[i].Name != NULL; ++i)
+            {
+                moduleCommands.push_back(table[i]);
+            }
+        }
+        std::sort(moduleCommands.begin(), moduleCommands.end(), [](ChatCommand const& a, ChatCommand const& b)
+        {
+            return strcmp(a.Name, b.Name) < 0;
+        });
+        rootTable.insert(rootTable.end(), moduleCommands.begin(), moduleCommands.end());
+        rootTable.push_back(ChatCommand(NULL, 0, false, NULL, "", NULL));
+    }
+
     if (load_command_table)
     {
         load_command_table = false;
 
         // check hardcoded part integrity
-        CheckIntegrity(commandTable, NULL);
+        CheckIntegrity(rootTable.data(), NULL);
 
         QueryResult* result = WorldDatabase.Query("SELECT `id`, `command_text`,`security`,`help_text` FROM `command`");
         if (result)
@@ -894,14 +867,19 @@ ChatCommand* ChatHandler::getCommandTable()
                 Field* fields = result->Fetch();
                 uint32 id = fields[0].GetUInt32();
                 std::string name = fields[1].GetCppString();
-                SetDataForCommandInTable(commandTable, id, name.c_str(), fields[2].GetUInt16(), fields[3].GetCppString());
+                SetDataForCommandInTable(rootTable.data(), id, name.c_str(), fields[2].GetUInt16(), fields[3].GetCppString());
             }
             while (result->NextRow());
             delete result;
         }
     }
 
-    return commandTable;
+    return rootTable.data();
+}
+
+bool ChatCommand::Execute(ChatHandler& handler, char* args) const
+{
+    return Callback ? Callback(handler, args) : (handler.*Handler)(args);
 }
 
 ChatHandler::ChatHandler(WorldSession* session) : m_session(session) {}
@@ -1118,7 +1096,7 @@ void ChatHandler::CheckIntegrity(ChatCommand* table, ChatCommand* parentCommand)
 
         if (command->ChildCommands)
         {
-            if (command->Handler)
+            if (command->HasHandler())
             {
                 if (parentCommand)
                 {
@@ -1139,7 +1117,7 @@ void ChatHandler::CheckIntegrity(ChatCommand* table, ChatCommand* parentCommand)
 
             CheckIntegrity(command->ChildCommands, command);
         }
-        else if (!command->Handler)
+        else if (!command->HasHandler())
         {
             if (parentCommand)
             {
@@ -1291,7 +1269,7 @@ ChatCommandSearchResult ChatHandler::FindCommand(ChatCommand* table, char const*
         }
 
         // must be have handler is explicitly selected
-        if (!table[i].Handler)
+        if (!table[i].HasHandler())
         {
             continue;
         }
@@ -1351,7 +1329,7 @@ void ChatHandler::ExecuteCommand(const char* text)
         case CHAT_COMMAND_OK:
         {
             SetSentErrorMessage(false);
-            if ((this->*(command->Handler))((char*)text))   // text content destroyed at call
+            if (command->Execute(*this, (char*)text))   // text content destroyed at call
             {
                 if (command->SecurityLevel > SEC_PLAYER)
                 {
diff --git a/src/game/WorldHandlers/Chat.h b/src/game/WorldHandlers/Chat.h
index b62e194064..1e7165b493 100644
--- a/src/game/WorldHandlers/Chat.h
+++ b/src/game/WorldHandlers/Chat.h
@@ -61,6 +61,8 @@ class Map;
 class ChatCommand
 {
     public:
+        typedef bool (*Function)(ChatHandler& handler, char* args);
+
         uint32             Id;
         const char* Name;
         uint32             SecurityLevel;                   // function pointer required correct align (use uint32)
@@ -68,6 +70,7 @@ class ChatCommand
         bool (ChatHandler::* Handler)(char* args);
         std::string        Help;
         ChatCommand* ChildCommands;
+        Function           Callback;                        // handler of a command a module brings
 
         ChatCommand(
             const char* pName,
@@ -76,7 +79,7 @@ class ChatCommand
             bool (ChatHandler::* pHandler)(char* args),
             std::string pHelp,
             ChatCommand* pChildCommands)
-                : Id(-1)
+                : Id(-1), Callback(NULL)
         {
             Name = pName;
             SecurityLevel = pSecurityLevel;
@@ -85,6 +88,20 @@ class ChatCommand
             Help = pHelp;
             ChildCommands = pChildCommands;
         }
+
+        ChatCommand(
+            const char* pName,
+            Function pCallback,
+            uint32 pSecurityLevel,
+            bool pAllowConsole,
+            ChatCommand* pChildCommands = NULL)
+                : Id(-1), Name(pName), SecurityLevel(pSecurityLevel), AllowConsole(pAllowConsole),
+                  Handler(NULL), ChildCommands(pChildCommands), Callback(pCallback)
+        {
+        }
+
+        bool HasHandler() const { return Handler || Callback; }
+        bool Execute(ChatHandler& handler, char* args) const;
 };
 
 enum ChatCommandSearchResult
@@ -250,20 +267,6 @@ class ChatHandler
         bool HandleAccountSetGmLevelCommand(char* args);
         bool HandleAccountSetPasswordCommand(char* args);
 
-        bool HandleAHBotItemsAmountCommand(char* args);
-        template <int Q>
-            bool HandleAHBotItemsAmountQualityCommand(char* args);
-        bool HandleAHBotItemsRatioCommand(char* args);
-        template <int H>
-            bool HandleAHBotItemsRatioHouseCommand(char* args);
-        bool HandleAHBotRebuildCommand(char* args);
-        bool HandleAHBotReloadCommand(char* args);
-        bool HandleAHBotStatusCommand(char* args);
-
-        bool HandleAhServiceConsoleShowCommand(char* args);
-        bool HandleAhServiceConsoleHideCommand(char* args);
-        bool HandleAhRepairCommand(char* args);
-
         bool HandleAuctionAllianceCommand(char* args);
         bool HandleAuctionGoblinCommand(char* args);
         bool HandleAuctionHordeCommand(char* args);
@@ -721,7 +724,6 @@ class ChatHandler
 #ifdef ENABLE_PLAYERBOTS
         bool HandlePlayerbotCommand(char* args);
         bool HandlePlayerbotConsoleCommand(char* args);
-        bool HandleAhBotCommand(char* args);
 #endif
 
         //! LivingWorld grid occupancy diagnostic (read-only, GM-only, in-game only)
@@ -740,6 +742,7 @@ class ChatHandler
         void  SkipWhiteSpaces(char** args);
         bool  ExtractInt32(char** args, int32& val);
         bool  ExtractOptInt32(char** args, int32& val, int32 defVal);
+    public:
         bool  ExtractUInt32Base(char** args, uint32& val, uint32 base);
         bool  ExtractUInt32(char** args, uint32& val) { return ExtractUInt32Base(args, val, 10); }
         bool  ExtractOptUInt32(char** args, uint32& val, uint32 defVal);
@@ -759,6 +762,7 @@ class ChatHandler
         char* ExtractKeyFromLink(char** text, char const* linkType, char** something1 = NULL);
         char* ExtractKeyFromLink(char** text, char const* const* linkTypes, int* found_idx = NULL, char** something1 = NULL);
         bool  ExtractUint32KeyFromLink(char** text, char const* linkType, uint32& value);
+    protected:
 
         uint32 ExtractAccountId(char** args, std::string* accountName = NULL, Player** targetIfNullArg = NULL);
         uint32 ExtractSpellIdFromLink(char** text);
@@ -827,7 +831,10 @@ class ChatHandler
 
         void DumpPetsOn(Map* on, char const* label);
 
+    public:
         void SetSentErrorMessage(bool val) { sentErrorMessage = val;};
+        /// NULL for a console command
+        WorldSession* GetSession() const { return m_session; }
     private:
         WorldSession* m_session;                            // != NULL for chat command call and NULL for CLI command
 
diff --git a/src/game/WorldHandlers/ChatArgExtract.cpp b/src/game/WorldHandlers/ChatArgExtract.cpp
index 1f9637f3b0..aab96d28f4 100644
--- a/src/game/WorldHandlers/ChatArgExtract.cpp
+++ b/src/game/WorldHandlers/ChatArgExtract.cpp
@@ -66,7 +66,6 @@
 #include "SpellMgr.h"
 #include "PoolManager.h"
 #include "GameEventMgr.h"
-#include "AuctionHouseBot/AuctionHouseBot.h"
 #include "CommandMgr.h"
 #ifdef ENABLE_ELUNA
 #include "LuaEngine.h"
diff --git a/src/game/WorldHandlers/ChatHelp.cpp b/src/game/WorldHandlers/ChatHelp.cpp
index 75e7828cb8..78175731ef 100644
--- a/src/game/WorldHandlers/ChatHelp.cpp
+++ b/src/game/WorldHandlers/ChatHelp.cpp
@@ -63,7 +63,6 @@
 #include "SpellMgr.h"
 #include "PoolManager.h"
 #include "GameEventMgr.h"
-#include "AuctionHouseBot/AuctionHouseBot.h"
 #ifdef ENABLE_ELUNA
 #include "LuaEngine.h"
 #endif /* ENABLE_ELUNA */
diff --git a/src/game/WorldHandlers/ChatMessage.cpp b/src/game/WorldHandlers/ChatMessage.cpp
index c2771cf711..fee231b2c8 100644
--- a/src/game/WorldHandlers/ChatMessage.cpp
+++ b/src/game/WorldHandlers/ChatMessage.cpp
@@ -64,7 +64,6 @@
 #include "SpellMgr.h"
 #include "PoolManager.h"
 #include "GameEventMgr.h"
-#include "AuctionHouseBot/AuctionHouseBot.h"
 #include "CommandMgr.h"
 #ifdef ENABLE_ELUNA
 #include "LuaEngine.h"
diff --git a/src/game/WorldHandlers/ChatMessageValidation.cpp b/src/game/WorldHandlers/ChatMessageValidation.cpp
index 18bb4beef4..def2a2c0d2 100644
--- a/src/game/WorldHandlers/ChatMessageValidation.cpp
+++ b/src/game/WorldHandlers/ChatMessageValidation.cpp
@@ -65,7 +65,6 @@
 #include "AccountMgr.h"
 #include "PoolManager.h"
 #include "GameEventMgr.h"
-#include "AuctionHouseBot/AuctionHouseBot.h"
 #include "CommandMgr.h"
 #ifdef ENABLE_ELUNA
 #include "LuaEngine.h"
diff --git a/src/game/WorldHandlers/Mail.cpp b/src/game/WorldHandlers/Mail.cpp
index fbf160aee0..6cff3e0c7a 100644
--- a/src/game/WorldHandlers/Mail.cpp
+++ b/src/game/WorldHandlers/Mail.cpp
@@ -63,7 +63,32 @@
 #include "BattleGround/BattleGroundMgr.h"
 #include "Item.h"
 #include "AuctionHouseMgr.h"
-#include "AuctionHouseBot/CustodyDeferred.h"
+
+#include <functional>
+#include <utility>
+
+namespace
+{
+    /// What an online receiver is shown once the caller's transaction commits.
+    struct DeferredMailPush
+    {
+        uint32 mailId;
+        uint32 receiverGuid;
+        uint32 senderId;
+        uint8 messageType;
+        uint8 stationery;
+        uint32 mailTemplateId;
+        std::string subject;
+        std::string body;
+        uint32 money;
+        uint32 cod;
+        uint32 checked;
+        uint64 deliverTime;
+        uint64 expireTime;
+        std::vector<std::pair<uint32, uint32>> items;
+        std::vector<Item*> liveItems;
+    };
+}
 
 /**
  * Creates a new MailSender object.
@@ -431,27 +456,27 @@ void MailDraft::writeMailRows(uint32 mailId, MailReceiver const& receiver, MailS
 }
 
 /**
- * Custody co-commit variant of SendMailTo.
+ * Variant of SendMailTo that writes into the caller's open transaction.
  *
  * Mirrors SendMailTo's metadata/expiry computation and row writes EXACTLY, but
  * does NOT open or close a transaction: its INSERTs append to the caller's
  * already-open CharacterDatabase transaction so the mail co-commits atomically
  * with the caller's other writes. Every side effect that mutates live world
- * state or destroys a live Item* is queued into @p deferred instead of run
+ * state or destroys a live Item* is queued into @p afterCommit instead of run
  * inline, so it only happens after the caller's checked commit succeeds.
  *
- * Item lifetime invariant (spec I5): the deferred effects run in the SAME call
+ * Item lifetime: the deferred effects run in the SAME call
  * stack right after the checked commit (no yield/tick in between), so the
  * captured Player and Item pointers are still valid when the closure executes.
  *
  * @param receiver             The MailReceiver to which this mail is sent.
  * @param sender               The MailSender from which this mail is originated.
- * @param deferred             Ordered queue for the deferred online push / item destruction.
+ * @param afterCommit          Ordered queue for the deferred online push / item destruction.
  * @param checked              The mask used to specify the mail.
  * @param deliver_delay        The delay after which the mail is delivered in seconds.
  */
 void MailDraft::SendMailToInTransaction(MailReceiver const& receiver, MailSender const& sender,
-                                        CustodyDeferred& deferred, MailCheckMask checked,
+                                        std::vector<std::function<void()>>& afterCommit, MailCheckMask checked,
                                         uint32 deliver_delay)
 {
     Player* pReceiver = receiver.GetPlayer();               // can be NULL
@@ -467,8 +492,7 @@ void MailDraft::SendMailToInTransaction(MailReceiver const& receiver, MailSender
         // Delete the item_instance rows in the caller's transaction, but DEFER
         // the live Item* destruction into a SUCCESS-ONLY effect (do not delete
         // inside the open transaction). On rollback the closure never runs, the
-        // item_instance DELETE is reverted, and the live Item* survives in the
-        // AH cache (mAitems) for the next-tick re-resolution.
+        // item_instance DELETE is reverted, and the live Item* stays with its holder.
         std::vector<Item*> invalidItems;
         for (MailItemMap::iterator mailItemIter = m_items.begin(); mailItemIter != m_items.end(); ++mailItemIter)
         {
@@ -480,7 +504,7 @@ void MailDraft::SendMailToInTransaction(MailReceiver const& receiver, MailSender
 
         if (!invalidItems.empty())
         {
-            deferred.effects.push_back([invalidItems]()
+            afterCommit.push_back([invalidItems]()
             {
                 for (size_t i = 0; i < invalidItems.size(); ++i)
                 {
@@ -564,8 +588,8 @@ void MailDraft::SendMailToInTransaction(MailReceiver const& receiver, MailSender
             push.items.push_back(std::make_pair(item->GetGUIDLow(), item->GetEntry()));
             // The live Item* is disposed by the success push closure (AddMItem,
             // transferring ownership to the receiving Player). On rollback the
-            // closure never runs and the item survives in the AH cache (mAitems)
-            // for the next-tick re-resolution -- it is NOT freed on rollback.
+            // closure never runs and the item stays with its holder -- it is NOT
+            // freed on rollback.
             push.liveItems.push_back(item);
         }
 
@@ -574,8 +598,8 @@ void MailDraft::SendMailToInTransaction(MailReceiver const& receiver, MailSender
         m_items.clear();
 
         // Replays SendMailTo's online push (Mail.cpp online branch) identically.
-        // Re-resolves the receiver by GUID at run time (scalar-only closure, I2 invariant).
-        deferred.effects.push_back([push]()
+        // Re-resolves the receiver by GUID at run time.
+        afterCommit.push_back([push]()
         {
             // Re-resolve the receiver by GUID — no raw Player* captured.
             Player* p = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, push.receiverGuid));
@@ -634,8 +658,7 @@ void MailDraft::SendMailToInTransaction(MailReceiver const& receiver, MailSender
         // SUCCESS-ONLY effect instead of deleting inside the open transaction.
         // On success the item lives on only as the DB item_instance + mail_items
         // rows, so the live object is deleted. On rollback the closure never
-        // runs, the rows are reverted, and the live Item* survives in the AH
-        // cache (mAitems) for the next-tick re-resolution.
+        // runs, the rows are reverted, and the live Item* stays with its holder.
         std::vector<Item*> offlineItems;
         for (MailItemMap::iterator mailItemIter = m_items.begin(); mailItemIter != m_items.end(); ++mailItemIter)
         {
@@ -643,7 +666,7 @@ void MailDraft::SendMailToInTransaction(MailReceiver const& receiver, MailSender
         }
         m_items.clear();
 
-        deferred.effects.push_back([offlineItems]()
+        afterCommit.push_back([offlineItems]()
         {
             for (size_t i = 0; i < offlineItems.size(); ++i)
             {
diff --git a/src/game/WorldHandlers/Mail.h b/src/game/WorldHandlers/Mail.h
index 87f7f479e6..3b75ea2e86 100644
--- a/src/game/WorldHandlers/Mail.h
+++ b/src/game/WorldHandlers/Mail.h
@@ -46,10 +46,11 @@
 #include <string>
 #include <vector>
 #include "ObjectGuid.h"
+#include <functional>
 #include <map>
 
 struct AuctionEntry;
-struct CustodyDeferred;
+
 class Item;
 class Object;
 class Player;
@@ -270,15 +271,14 @@ class MailDraft
         void SendReturnToSender(uint32 sender_acc, ObjectGuid sender_guid, ObjectGuid receiver_guid);
         void SendMailTo(MailReceiver const& receiver, MailSender const& sender, MailCheckMask checked = MAIL_CHECK_MASK_NONE, uint32 deliver_delay = 0);
 
-        /// Custody co-commit: appends the mail INSERTs to the caller's OPEN
-        /// CharacterDatabase transaction (no own Begin/Commit) and DEFERS the
-        /// online receiver's in-memory push + any live-Item* destruction into
-        /// @p deferred, to be run AFTER the caller's checked commit succeeds.
-        /// The receiver's existence MUST be preflighted by the caller. The
-        /// deferred closure runs in the same call stack right after the checked
-        /// commit (no yield), so captured Player/Item pointers stay valid. Sec 5.1.
+        /// Appends the mail INSERTs to the caller's OPEN CharacterDatabase
+        /// transaction (no own Begin/Commit) and DEFERS the online receiver's
+        /// in-memory push + any live-Item* destruction into @p afterCommit, to be
+        /// run AFTER the caller's checked commit succeeds. The caller runs
+        /// @p afterCommit in the same call stack right after the commit, so
+        /// captured Player/Item pointers stay valid.
         void SendMailToInTransaction(MailReceiver const& receiver, MailSender const& sender,
-                                     CustodyDeferred& deferred,
+                                     std::vector<std::function<void()>>& afterCommit,
                                      MailCheckMask checked = MAIL_CHECK_MASK_NONE,
                                      uint32 deliver_delay = 0);
     private:
diff --git a/src/game/WorldHandlers/MailHandler.cpp b/src/game/WorldHandlers/MailHandler.cpp
index a1a36699c2..d9bc61e2fd 100644
--- a/src/game/WorldHandlers/MailHandler.cpp
+++ b/src/game/WorldHandlers/MailHandler.cpp
@@ -54,7 +54,6 @@
 #include "WorldSession.h"
 #include "Opcodes.h"
 #include "Chat.h"
-#include "AuctionHouseBot/AhBotSystemOwner.h"
 
 /**
  * @brief Verifies that the player can legally access the requested mailbox.
@@ -160,16 +159,6 @@ void WorldSession::HandleSendMail(WorldPacket& recv_data)
         return;
     }
 
-    // AH bot forged system owner: players cannot mail it. Its own auction
-    // proceeds/returns use the internal MailDraft::SendMailTo path, which does
-    // not go through this handler, so the bot still receives them. Looks like an
-    // unknown recipient to the sender (kills COD scams / accidental gifts).
-    if (IsAhBotSystemOwnerGuid(rc))
-    {
-        pl->SendMailResult(0, MAIL_SEND, MAIL_ERR_RECIPIENT_NOT_FOUND);
-        return;
-    }
-
     DETAIL_LOG("%s is sending mail to %s with subject %s and body %s includes %u items, %u copper and %u COD copper with unk1 = %u, unk2 = %u",
         pl->GetGuidStr().c_str(), rc.GetString().c_str(), subject.c_str(), body.c_str(), itemGuid ? 1 : 0, money, COD, unk1, unk2);
 
diff --git a/src/game/WorldHandlers/World.cpp b/src/game/WorldHandlers/World.cpp
index db169933c2..7f50286318 100644
--- a/src/game/WorldHandlers/World.cpp
+++ b/src/game/WorldHandlers/World.cpp
@@ -60,9 +60,6 @@
 #include "Player.h"
 #include "AccountMgr.h"
 #include "AuctionHouseMgr.h"
-#include "AuctionHouseBot/AuctionIntentExecutor.h"
-#include "AuctionHouseBot/CustodyLedger.h"
-#include "AuctionHouseBot/CustodyService.h"
 #include "ObjectMgr.h"
 #include "CreatureEventAIMgr.h"
 #include "GuildMgr.h"
@@ -90,7 +87,7 @@
 #include "WaypointManager.h"
 #include "GMTicketMgr.h"
 #include "Util.h"
-#include "AuctionHouseBot/AuctionHouseBot.h"
+#include "AuctionHouseModule.h"
 #include "CharacterDatabaseCleaner.h"
 #include "CreatureLinkingMgr.h"
 #include "Weather.h"
@@ -117,15 +114,6 @@
 #include "RandomPlayerbotMgr.h"
 #endif
 
-// AH subprocess supervisor (Task 5+)
-#include "WorkerSupervisor.h"
-#include "IpcMessage.h"
-#include "IpcOpcodes.h"
-#include "AuctionIntents.h"
-#include "BrowseMessages.h"
-#include "AuctionHouseBot/BrowsePending.h"
-#include "AuctionHouseBot/MutationPending.h"
-#include "PlayerMutations.h"
 
 #include <cstdarg>
 #include <iostream>
@@ -134,13 +122,6 @@
 #include "PlayerRegistry.h"
 #include "CorpseManager.h"
 
-
-
-// SP-1 coordinator: the "AH unavailable" responder, defined in
-// AuctionHouseHandler.cpp next to the three async-proxy handlers. The world
-// thread calls it from the IPC_BROWSE_RESULT reply branch and the TTL sweep.
-void AhSendBrowseUnavailable(WorldSession* session, uint8 kind);
-
 volatile bool World::m_stopEvent = false;
 uint8 World::m_ExitCode = SHUTDOWN_EXIT_CODE;
 
@@ -245,12 +226,6 @@ World::World()
     {
         m_configBoolValues[i] = false;
     }
-
-    // PF3-A: single-threaded construction; relaxed is sufficient here. The
-    // release/acquire pairing happens later between SetAhSupervisor() and the
-    // world tick loop.
-    m_ahSupervisor.store(NULL, std::memory_order_relaxed);
-    m_ahServiceConfigured.store(false, std::memory_order_relaxed);
 }
 
 /// World destructor
@@ -765,7 +740,6 @@ void World::SetInitialWorldSettings()
 
     ///- Load dynamic data tables from the database
     sLog.outString("Loading Auctions...");
-    CustodyLedger::InitializeRouting();
     sAuctionMgr.LoadAuctionItems();
     sAuctionMgr.LoadAuctions();
     sLog.outString(">>> Auctions loaded");
@@ -865,9 +839,6 @@ void World::SetInitialWorldSettings()
     m_timers[WUPDATE_CORPSES].SetInterval(20 * MINUTE * IN_MILLISECONDS);
     m_timers[WUPDATE_DELETECHARS].SetInterval(DAY * IN_MILLISECONDS); // check for chars to delete every day
 
-    // for AhBot
-    m_timers[WUPDATE_AHBOT].SetInterval(20 * IN_MILLISECONDS); // every 20 sec
-
     // for AutoBroadcast
     sLog.outString("Starting AutoBroadcast System");
     if (m_broadcastEnable)
@@ -942,32 +913,9 @@ void World::SetInitialWorldSettings()
     // Delete all characters which have been deleted X days before
     Player::DeleteOldCharacters();
 
-    // [SP-2 spec 5.7] Under WriteAuthority the out-of-process worker's bot brain
-    // drives all listings; the in-process AuctionHouseBot must not also write
-    // the book. Skipping Initialize() leaves its buyer/seller agents null, so
-    // its Update() (gated on !serviceActive in WUPDATE_AHBOT) and
-    // PurgeMailedItemsTick() both no-op (no agents / no configured bot GUID).
-    if (!IsAhWriteAuthority())
-    {
-        sLog.outString("Initialize AuctionHouseBot...");
-        sAuctionBot.Initialize();
-        sLog.outString();
-    }
-    else
-    {
-        // SP-2: the in-process bot AGENTS must not run under WriteAuthority (the
-        // worker's bot brain drives listings), but the bot owner GUID must still
-        // be resolved -- the worker's supervisor refuses to spawn on a 0 GUID,
-        // and the forged system owner is resolved as a side effect of loading
-        // the config. So load the config (which calls SetAHBotId -> the
-        // AHBOT_SYSTEM_OWNER name intercept, needing no real character) WITHOUT
-        // calling InitializeAgents().
-        sLog.outString("AuctionHouseBot: in-process agents disabled"
-                       " (AH.Service.WriteAuthority = 1; worker drives listings);"
-                       " resolving bot owner GUID for the worker supervisor");
-        sAuctionBotConfig.Initialize();
-        sLog.outString();
-    }
+    sLog.outString("Starting auction modules...");
+    AuctionHouseModules::Start();
+    sLog.outString();
 
 #ifdef ENABLE_ELUNA
     ///- Run eluna scripts.
@@ -1214,245 +1162,14 @@ void World::Update(uint32 diff)
         }
 
         ///- Handle expired auctions
-        // [SP-2 spec 5.7] Under WriteAuthority the worker runs the expiry/win
-        // tick and owns every auction-row write; mangosd's in-process expiry
-        // sweep must not also finalize/delete rows (double-writer). The
-        // returned-mail delivery above stays mangosd's and runs in both modes.
-        if (!IsAhWriteAuthority())
+        if (!AuctionHouseModules::OwnsAuctionRows())
         {
             sAuctionMgr.Update();
         }
     }
 
-    /// <li> Handle AHBot operations
-    if (m_timers[WUPDATE_AHBOT].Passed())
-    {
-        // PF3-A: acquire-load the published supervisor pointer once. The
-        // matching release store in SetAhSupervisor() guarantees the
-        // supervisor's construction + Start() is fully visible before any
-        // non-NULL pointer can be observed here.
-        WorkerSupervisor* const ahSupervisor = GetAhSupervisor();
-        const bool serviceActive =
-            (ahSupervisor != NULL && ahSupervisor->ServiceActive());
-
-        /// Transition logging: announce each time the in-process bot stands
-        /// down for / resumes from the out-of-process service.
-        static bool s_prevServiceActive = false;
-        if (serviceActive != s_prevServiceActive)
-        {
-            if (serviceActive)
-            {
-                sLog.outString("[AHSupervisor] AH service active -"
-                               " in-process AuctionHouseBot standing down");
-                // SP-2 (spec 8): on the just-became-active edge, reconcile every
-                // in-flight player-mutation reservation against the shared worker
-                // journal (committed => finalize-forward, absent => release,
-                // cancel-prepared => abort + release). No-op when nothing is
-                // in-flight (the default-off / steady-state case).
-                AhReconcileOnReconnect();
-            }
-            else
-            {
-                sLog.outString("[AHSupervisor] AH service inactive -"
-                               " in-process AuctionHouseBot resuming");
-            }
-            s_prevServiceActive = serviceActive;
-        }
-
-        if (!serviceActive)
-        {
-            sAuctionBot.Update();
-        }
-
-        // Mail cleanup must run in BOTH modes. In service mode the in-process
-        // bot's Update() is gated out, so PurgeMailedItems() (the hourly
-        // cleanup of the bot's returned/unsold/outbid mail) would otherwise
-        // never run and the char-DB mail tables would grow without bound.
-        // It is self-throttled to once/hour internally, so calling it on every
-        // WUPDATE_AHBOT tick in either mode is cheap and idempotent.
-        sAuctionBot.PurgeMailedItemsTick();
-
-        // Custody drift audit + terminal-row TTL prune. Orphan materialization
-        // recovery has a separate adaptive timer so outage backlogs drain in
-        // bounded batches without repeating the full reconciliation scan.
-        static uint64 s_nextCustodyReconcileTime = 0;
-        static uint64 s_nextOrphanSweepTime = 0;
-        uint64 const now = static_cast<uint64>(GetGameTime());
-        uint64 const custodyTerminalRetention = 30 * DAY;
-        uint32 const orphanSweepBatchSize = 100u;
-        CustodyMaintenancePlan const plan =
-            CustodyService::GetMaintenancePlan(IsAhCustodyEnabled(),
-                                               IsAhWriteAuthority());
-        if (!s_nextCustodyReconcileTime)
-        {
-            s_nextCustodyReconcileTime = now + HOUR;
-        }
-        else if (now >= s_nextCustodyReconcileTime)
-        {
-            if (plan.reconcile)
-            {
-                CustodyReconcileReport report;
-                CustodyService::ReconcileScan(now, CUSTODY_SCAN_RUNTIME,
-                                              report);
-                CustodyService::LogReconcileReport("hourly", report);
-            }
-
-            if (plan.prune && now > custodyTerminalRetention)
-            {
-                CustodyLedger::DeleteTerminalOlderThan(now - custodyTerminalRetention);
-            }
-
-            s_nextCustodyReconcileTime = now + HOUR;
-        }
-
-        if (!s_nextOrphanSweepTime)
-        {
-            s_nextOrphanSweepTime = now + MINUTE;
-        }
-        else if (now >= s_nextOrphanSweepTime)
-        {
-            // Only WriteAuthority materializes bot listings through this path.
-            // A full batch (or failed commit) retries in one minute; a drained
-            // queue returns to a cheap hourly check.
-            if (plan.sweepBotMaterializations)
-            {
-                OrphanMaterializationSweepReport const sweep =
-                    sAuctionIntentExecutor.SweepOrphanMaterializations(
-                        uint32(now), orphanSweepBatchSize);
-                bool const retrySoon = sweep.morePending || !sweep.committed;
-                s_nextOrphanSweepTime = now + (retrySoon ? MINUTE : HOUR);
-            }
-            else
-            {
-                s_nextOrphanSweepTime = now + HOUR;
-            }
-        }
-
-        m_timers[WUPDATE_AHBOT].Reset();
-    }
-
-    /// <li> Tick the AH subprocess supervisor and drain inbound frames
-    // PF3-A: acquire-load the published supervisor pointer once for this whole
-    // block (see SetAhSupervisor()). Reusing one local keeps every dereference
-    // below consistent and avoids repeated atomic loads.
-    WorkerSupervisor* const ahSupervisor = GetAhSupervisor();
-    if (ahSupervisor != NULL)
-    {
-        // Tick() uses wall-clock deltas internally; do NOT gate behind
-        // WUPDATE_AHBOT. Tick() drives heartbeat/restart/protocol and MUST run
-        // every tick regardless of service health (it is what transitions the
-        // service from inactive back to active).
-        ahSupervisor->Tick(GetGameTime());
-
-        // Overflow visibility: warn (rate-limited) when the inbound queue
-        // has dropped frames since we last checked.
-        static size_t s_lastDroppedSeen = 0;
-        static time_t s_lastOverflowWarn = 0;
-        static time_t s_lastNearFullWarn = 0;
-        const size_t  dropped = ahSupervisor->InboundDropped();
-        if (dropped > s_lastDroppedSeen)
-        {
-            const time_t now = time(NULL);
-            // Warn at most once every 60 seconds to avoid log spam.
-            // Baseline only advances on emission so suppressed bursts are
-            // counted correctly in the next warning.
-            if (now - s_lastOverflowWarn >= 60)
-            {
-                sLog.outError("[AHSupervisor] inbound queue overflow:"
-                              " %u frame(s) dropped (total %u)",
-                              static_cast<unsigned>(dropped - s_lastDroppedSeen),
-                              static_cast<unsigned>(dropped));
-                s_lastOverflowWarn = now;
-                s_lastDroppedSeen  = dropped;
-            }
-        }
-
-        // The apply loop (DrainInbound + HandleAhInbound) and the near-full
-        // back-pressure check are gated on service health. When the service is
-        // inactive (crash / heartbeat-timeout / stand-down) the in-process
-        // AuctionHouseBot resumes (see the WUPDATE_AHBOT block above); applying
-        // the dead child's last staged batch at the same time would over-post
-        // against the resumed in-process bot. WorkerSupervisor clears its
-        // staged frames on child exit, so a reconnecting child never replays
-        // the dead child's stale batch; this gate is the second guard.
-        if (ahSupervisor->ServiceActive())
-        {
-            // Drain up to 256 application frames per tick.
-            std::vector<IpcMessage> msgs;
-            ahSupervisor->DrainInbound(msgs, 256);
-
-            // Near-full back-pressure: queue >= 80% capacity means we are close
-            // to dropping frames even though none have been lost yet. Warn AND
-            // tell the child to throttle via IPC_QUEUE_FULL so it pauses one
-            // bot cycle. Both are rate-limited to once per 60s to avoid spam.
-            const size_t qSize = ahSupervisor->Channel().InboundSize();
-            if (qSize >= IPC_INBOUND_QUEUE_CAP * 4 / 5)
-            {
-                const time_t now = time(NULL);
-                if (now - s_lastNearFullWarn >= 60)
-                {
-                    sLog.outError("[AHSupervisor] inbound queue near full:"
-                                  " %u / %u frames - sending IPC_QUEUE_FULL",
-                                  static_cast<unsigned>(qSize),
-                                  static_cast<unsigned>(IPC_INBOUND_QUEUE_CAP));
-
-                    // Back-pressure producer: the child backs off one bot
-                    // cycle on IPC_QUEUE_FULL (ah-service Main.cpp). Empty
-                    // body; the child reads no payload for this opcode.
-                    IpcMessage qf;
-                    qf.op = IPC_QUEUE_FULL;
-                    ahSupervisor->Channel().SendFrame(qf);
-
-                    s_lastNearFullWarn = now;
-                }
-            }
-
-            for (size_t i = 0; i < msgs.size(); ++i)
-            {
-                HandleAhInbound(msgs[i]);
-            }
-
-            // SP-2: retry failed value-finalizes and age un-answered player
-            // mutations into in-doubt tombstones (forward-only; never rolls
-            // back). Cheap no-op when both queues are empty.
-            uint32 const mutationNowSec = uint32(time(NULL));
-            AhProcessRedriveQueue(mutationNowSec);
-            AhProcessReconnectRetryQueue(mutationNowSec);
-        }
-
-        // Expire processed-uuid dedup entries. UNCONDITIONAL: the dedup cache
-        // must keep aging out regardless of service health, else stale uuids
-        // leak when the service stays inactive. Rate-limit to once per second
-        // (game-time); purging every tick would be wasteful.
-        static time_t s_lastIntentPurge = 0;
-        const time_t nowSec = GetGameTime();
-        if (nowSec != s_lastIntentPurge)
-        {
-            sAuctionIntentExecutor.PurgeExpiredUuids(uint32(nowSec));
-            s_lastIntentPurge = nowSec;
-
-            // SP-1 (M5): sweep timed-out browse requests on the SAME nowSec clock
-            // used to register them. The worker never replied (crash/lost frame);
-            // coordinator model -> tell each player the AH is unavailable iff it
-            // is still the current search and the player is present (I4).
-            std::vector<PendingBrowse> timedOut;
-            m_browsePending.Sweep(uint32(nowSec), 10u, timedOut);
-            for (size_t i = 0; i < timedOut.size(); ++i)
-            {
-                if (!m_browsePending.IsCurrent(timedOut[i].playerGuidLow,
-                                               timedOut[i].kind, timedOut[i].seq))
-                {
-                    continue;
-                }
-                Player* p = sPlayerRegistry.Find(
-                    ObjectGuid(HIGHGUID_PLAYER, timedOut[i].playerGuidLow));
-                if (p && p->IsInWorld() && p->GetSession())
-                {
-                    AhSendBrowseUnavailable(p->GetSession(), timedOut[i].kind);
-                }
-            }
-        }
-    }
+    /// <li> Handle the auction modules
+    AuctionHouseModules::Update(diff);
 
 #ifdef ENABLE_PLAYERBOTS
     sRandomPlayerbotMgr.UpdateAI(diff);
@@ -1547,241 +1264,6 @@ void World::Update(uint32 diff)
     sTerrainMgr.Update(diff);
 }
 
-// ---------------------------------------------------------------------------
-// World::HandleAhInbound -- M1 stub; routes consumer frames in M2
-// ---------------------------------------------------------------------------
-
-/**
- * @brief Dispatch one inbound frame from the ah-service child process.
- *
- * M1: logs what arrived so the smoke test can confirm the drain pipeline
- * is live. M2 will add IPC_AH_* intent routing here; keep the switch
- * extensible.
- */
-void World::HandleAhInbound(const IpcMessage& msg)
-{
-    switch (msg.op)
-    {
-        case IPC_ECHO_REPLY:
-        {
-            DETAIL_LOG("[AHSupervisor] IPC_ECHO_REPLY received"
-                       " (body=%u bytes)", static_cast<unsigned>(msg.body.size()));
-            break;
-        }
-        case IPC_HEARTBEAT_ACK:
-        {
-            // Should have been consumed by WorkerSupervisor::Tick(); log if
-            // it somehow leaks through.
-            DETAIL_LOG("[AHSupervisor] HandleAhInbound: unexpected"
-                       " IPC_HEARTBEAT_ACK");
-            break;
-        }
-        case IPC_INTENT_SELL:
-        case IPC_INTENT_BID:
-        case IPC_INTENT_BUYOUT:
-        {
-            // Authority side: re-validate against live state and apply
-            // idempotently. The executor populates `result` with an
-            // IPC_INTENT_RESULT frame to return to the child (or leaves it
-            // empty -- op 0 -- for a malformed body, which we must not send).
-            IpcMessage result;
-            sAuctionIntentExecutor.Apply(msg, result);
-            // PF3-A: acquire-load the published supervisor pointer (see
-            // SetAhSupervisor()) before dereferencing it.
-            WorkerSupervisor* const ahSupervisor = GetAhSupervisor();
-            if (ahSupervisor != NULL && result.op != IpcOpcode(0))
-            {
-                ahSupervisor->Channel().SendFrame(result);
-            }
-            break;
-        }
-        case IPC_INTENT_RESULT:
-        {
-            // mangosd -> child direction; should never be received here.
-            sLog.outError("[AHSupervisor] HandleAhInbound: unexpected"
-                          " IPC_INTENT_RESULT (ignored)");
-            break;
-        }
-        case IPC_GMCMD_RESULT:
-        {
-            ByteBuffer body(msg.body);
-            GmCmdResult res;
-            if (res.Decode(body))
-            {
-                sLog.outString("[AHService] GM command %u result: %s",
-                               static_cast<unsigned>(res.cmd),
-                               res.ok ? "OK" : "FAIL");
-            }
-            else
-            {
-                sLog.outError("[AHSupervisor] HandleAhInbound:"
-                              " IPC_GMCMD_RESULT decode failed");
-            }
-            break;
-        }
-        case IPC_GMCMD:
-        {
-            // mangosd -> child direction; should never be received inbound.
-            sLog.outError("[AHSupervisor] HandleAhInbound: unexpected"
-                          " IPC_GMCMD inbound (ignored)");
-            break;
-        }
-        case IPC_BROWSE_RESULT:
-        {
-            ByteBuffer body(msg.body);
-            BrowseResult res;
-            if (!res.Decode(body))
-            {
-                sLog.outError("[AHSupervisor] IPC_BROWSE_RESULT decode failed");
-                break;
-            }
-            PendingBrowse pb;
-            if (!m_browsePending.Take(res.queryId, pb))
-            {
-                DETAIL_LOG("[AHSupervisor] IPC_BROWSE_RESULT unknown queryId %llu",
-                           (unsigned long long)res.queryId);
-                break;
-            }
-            // I4: ignore a reply for a search the player has since superseded.
-            if (!m_browsePending.IsCurrent(pb.playerGuidLow, pb.kind, pb.seq))
-            {
-                break;
-            }
-            Player* player = sPlayerRegistry.Find(
-                ObjectGuid(HIGHGUID_PLAYER, pb.playerGuidLow));
-            if (!player || !player->IsInWorld())
-            {
-                break;   // logged out / different char (I4) -> drop cleanly
-            }
-            WorldSession* session = player->GetSession();
-            if (!session)
-            {
-                break;
-            }
-
-            // tooMany: the worker declined (queue saturated / oversize failsafe /
-            // over-cap deferred-Eluna). Coordinator model: no in-process fallback
-            // -> the player gets "AH unavailable".
-            if (res.tooMany)
-            {
-                AhSendBrowseUnavailable(session, pb.kind);
-                break;
-            }
-
-            std::vector<BrowseEntry> finalEntries;
-            uint32 totalcount = res.totalcount;
-
-            if (res.elunaPending && pb.kind != uint8(BROWSE_BIDDER))
-            {
-                // Deferred-Eluna pass (D5/V2): run ONLY the OnCanUseItem veto per
-                // entry via the thin Player::CanUseItemEluna accessor. The worker
-                // already enforced every non-Eluna sub-filter on the same profile.
-                // Run the hook over EVERY entry -- NO per-tick budget that keeps
-                // unchecked entries (V2: that broke parity by counting/showing
-                // Lua-vetoed items).
-                std::vector<BrowseEntry> survivors;
-                survivors.reserve(res.entries.size());
-                for (size_t i = 0; i < res.entries.size(); ++i)
-                {
-                    if (player->CanUseItemEluna(res.entries[i].itemEntry) != EQUIP_ERR_OK)
-                    {
-                        continue;   // Lua veto -> drop (exact parity)
-                    }
-                    survivors.push_back(res.entries[i]);
-                }
-                // The worker shipped the FULL surviving set un-paginated (the >cap
-                // deferred-Eluna case is declined with tooMany, above). Run the Lua
-                // veto over all survivors, then paginate here for exact in-process
-                // parity.
-                totalcount = uint32(survivors.size());
-                uint32 from = pb.listfrom;
-                for (uint32 i = from; i < survivors.size() && finalEntries.size() < 50u; ++i)
-                {
-                    finalEntries.push_back(survivors[i]);
-                }
-            }
-            else
-            {
-                finalEntries = res.entries;   // worker already paginated
-            }
-
-            uint16 opcode = SMSG_AUCTION_LIST_RESULT;
-            if (pb.kind == uint8(BROWSE_OWNER))
-            {
-                opcode = SMSG_AUCTION_OWNER_LIST_RESULT;
-            }
-            else if (pb.kind == uint8(BROWSE_BIDDER))
-            {
-                opcode = SMSG_AUCTION_BIDDER_LIST_RESULT;
-            }
-
-            WorldPacket data(opcode, 4 + 4 + finalEntries.size() * 60);
-            ByteBuffer assembled;
-            AhAssembleBrowseListBody(finalEntries, totalcount, assembled);
-            data.append(assembled.contents(), assembled.size());
-            session->SendPacket(&data);
-            break;
-        }
-        case IPC_PLAYER_RESULT:
-        {
-            // SP-2 write-authority: worker mutation outcome + book facts.
-            // AhHandlePlayerMutationResult applies value only, fail-closed
-            // against the custody ledger. (IPC_RESOLVE_APPLY gets its own case
-            // in Task 12.)
-            ByteBuffer body(msg.body);
-            PlayerMutationResult res;
-            if (!res.Decode(body))
-            {
-                sLog.outError("[AHSupervisor] IPC_PLAYER_RESULT decode failed");
-                break;
-            }
-            AhHandlePlayerMutationResult(res);
-            break;
-        }
-        case IPC_RESOLVE_APPLY:
-        {
-            // SP-2 write-authority: worker-initiated resolution (WON / EXPIRED /
-            // CANCELLED_UNLOCK / REPAIR_RETURN). AhHandleResolveApply applies the
-            // per-kind value effects inside ONE checked txn with the
-            // resolve:<uuid> applied-record (DUPLICATE == APPLIED). An
-            // AH_RESOLVE_NO_ACK return is an unrecoverable protocol fault:
-            // already alarmed, NO ack is sent (the worker never retries it).
-            ByteBuffer body(msg.body);
-            ResolveApply ra;
-            if (!ra.Decode(body))
-            {
-                sLog.outError("[AHSupervisor] IPC_RESOLVE_APPLY decode failed");
-                break;
-            }
-            uint8 const st = AhHandleResolveApply(ra);
-            if (st == AH_RESOLVE_NO_ACK)
-            {
-                break;
-            }
-            WorkerSupervisor* const sv = GetAhSupervisor();
-            if (sv != NULL)
-            {
-                ResolveAck ack;
-                ack.uuid   = ra.uuid;
-                ack.status = st;
-                IpcMessage reply;
-                reply.op = IPC_RESOLVE_ACK;
-                ack.Encode(reply.body);
-                sv->Channel().SendFrame(reply);
-            }
-            break;
-        }
-        default:
-        {
-            DETAIL_LOG("[AHSupervisor] HandleAhInbound: opcode 0x%04X"
-                       " (body=%u bytes) -- unhandled",
-                       static_cast<unsigned>(msg.op),
-                       static_cast<unsigned>(msg.body.size()));
-            break;
-        }
-    }
-}
-
 namespace MaNGOS
 {
     class WorldWorldTextBuilder
diff --git a/src/game/WorldHandlers/World.h b/src/game/WorldHandlers/World.h
index 264b154baa..e7392f7a97 100644
--- a/src/game/WorldHandlers/World.h
+++ b/src/game/WorldHandlers/World.h
@@ -44,8 +44,6 @@
 #include "Timer.h"
 #include "Policies/Singleton.h"
 #include "SharedDefines.h"
-#include "AuctionHouseBot/BrowsePending.h"
-#include "AuctionHouseBot/MutationPending.h"
 #include <set>
 #include <list>
 #include <vector>
@@ -63,8 +61,6 @@ class WorldSession;
 class Player;
 class SqlResultQueue;
 class QueryResult;
-class WorkerSupervisor;
-class IpcMessage;
 
 // ServerMessages.dbc
 enum ServerMessageType
@@ -98,7 +94,6 @@ enum WorldTimers
     WUPDATE_CORPSES,
     WUPDATE_EVENTS,
     WUPDATE_DELETECHARS,
-    WUPDATE_AHBOT,
     WUPDATE_COUNT
 };
 
@@ -393,11 +388,6 @@ enum eConfigBoolValues
     // Recommended Or New Flag
     CONFIG_BOOL_REALM_RECOMMENDED_OR_NEW_ENABLED,
     CONFIG_BOOL_REALM_RECOMMENDED_OR_NEW,
-
-    // AH Service custody escrow ledger
-    CONFIG_BOOL_AH_CUSTODY,
-    // AH Service worker write-authority (SP-2, boot-latched)
-    CONFIG_BOOL_AH_WRITE_AUTHORITY,
     CONFIG_BOOL_WARDEN_REQUIRE_EXACT_PROFILE,
     CONFIG_BOOL_VALUE_COUNT
 };
@@ -622,17 +612,6 @@ class World
             return getConfig(CONFIG_UINT32_GAME_TYPE) == REALM_TYPE_FFA_PVP;
         }
 
-        /// Is the AH custody escrow ledger enabled?
-        bool IsAhCustodyEnabled() const { return getConfig(CONFIG_BOOL_AH_CUSTODY); }
-
-        /// Is the AH worker the auction write-authority? BOOT-LATCHED (SP-2,
-        /// spec decision 7): LoadConfigSettings reads the key only when
-        /// !reload, so `.reload config` can never change it mid-run.
-        bool IsAhWriteAuthority() const
-        {
-            return getConfig(CONFIG_BOOL_AH_WRITE_AUTHORITY);
-        }
-
         void KickAll();
         void KickAllLess(AccountTypes sec);
         BanReturn BanAccount(BanMode mode, std::string nameOrIP, uint32 duration_secs, std::string reason, const std::string &author);
@@ -690,56 +669,6 @@ class World
         Eluna* GetEluna() const { return eluna; }
         Eluna* eluna;
 #endif /* ENABLE_ELUNA */
-
-        // AH subprocess supervisor (Task 5+).
-        // Set by mangosd.cpp after WorkerSupervisor::Start() succeeds.
-        // Returns NULL if AH.Service.Enabled=0 OR startup failed -- a NULL
-        // supervisor does NOT distinguish "not configured" from "configured but
-        // failed to start". Use IsAhServiceConfigured() for that distinction.
-        //
-        // PF3-A: published with a RELEASE store and read with ACQUIRE loads.
-        // SetAhSupervisor() runs AFTER worldThread->open(0) has already started
-        // the world tick loop, so the world thread reads this pointer
-        // concurrently. The release/acquire pairing guarantees the
-        // WorkerSupervisor's construction + Start() member stores
-        // happen-before any non-NULL observation, so the world thread can never
-        // dereference a half-constructed supervisor on a weakly-ordered CPU.
-        void SetAhSupervisor(WorkerSupervisor* sv)
-        {
-            m_ahSupervisor.store(sv, std::memory_order_release);
-        }
-        WorkerSupervisor* GetAhSupervisor() const
-        {
-            return m_ahSupervisor.load(std::memory_order_acquire);
-        }
-
-        // SP-1 coordinator authority: TRUE iff the AH worker is the CONFIGURED
-        // read authority (AH.Service.Enabled=1), independent of whether the
-        // supervisor object is currently live. A failed WorkerSupervisor::Start()
-        // nulls m_ahSupervisor but MUST leave this flag set, so the read handlers
-        // send "AH unavailable" instead of silently reverting to in-process reads.
-        void SetAhServiceConfigured(bool v)
-        {
-            m_ahServiceConfigured.store(v, std::memory_order_release);
-        }
-        bool IsAhServiceConfigured() const
-        {
-            return m_ahServiceConfigured.load(std::memory_order_acquire);
-        }
-
-        // SP-1: outstanding async browse requests awaiting a worker reply.
-        // Owned by the world thread; the handlers Register, the reply branch
-        // Takes, and the once-per-second sweep collects timed-out entries.
-        BrowsePendingMap& GetBrowsePending() { return m_browsePending; }
-
-        /// SP-2: outstanding player mutations awaiting a worker reply
-        /// (apply-all consume-once; world-thread owned). The forward branches
-        /// Register (Task 10); the finalize pump Takes/Sweeps (Task 11).
-        MutationPendingMap& GetMutationPending()
-        {
-            return m_mutationPending;
-        }
-
     protected:
         void _UpdateGameTime();
         // callback for UpdateRealmCharacters
@@ -855,32 +784,6 @@ class World
 
         // List of Maps that should be force-loaded on startup
         std::set<uint32> m_configForceLoadMapIds;
-
-        // AH subprocess supervisor pointer (NULL when service is disabled).
-        // PF3-A: atomic so the publishing release store in SetAhSupervisor()
-        // synchronises-with the acquire loads in the world tick loop.
-        std::atomic<WorkerSupervisor*> m_ahSupervisor;
-
-        // SP-1 coordinator authority flag (see SetAhServiceConfigured). Persists
-        // for the process lifetime once AH.Service.Enabled=1, even if the
-        // supervisor object is torn down after a failed Start().
-        std::atomic<bool> m_ahServiceConfigured;
-
-        // SP-1: pending-map for async browse proxying (world-thread owned).
-        BrowsePendingMap m_browsePending;
-
-        /// SP-2: pending-map for async player mutations (world-thread owned).
-        MutationPendingMap m_mutationPending;
-
-        /**
-         * @brief Dispatch one inbound frame from the AH subprocess.
-         *
-         * M1 stub: logs the opcode. M2 will route IPC_AH_* intents to
-         * the AH executor. Keep this switch extensible.
-         *
-         * @param msg The inbound frame from the ah-service child.
-         */
-        void HandleAhInbound(const IpcMessage& msg);
 };
 
 extern uint32 realmID;
diff --git a/src/game/WorldHandlers/WorldConfig.cpp b/src/game/WorldHandlers/WorldConfig.cpp
index 91c8777864..eb484e1cf2 100644
--- a/src/game/WorldHandlers/WorldConfig.cpp
+++ b/src/game/WorldHandlers/WorldConfig.cpp
@@ -86,7 +86,7 @@
 #include "WaypointManager.h"
 #include "GMTicketMgr.h"
 #include "Util.h"
-#include "AuctionHouseBot/AuctionHouseBot.h"
+#include "AuctionHouseModule.h"
 #include "CharacterDatabaseCleaner.h"
 #include "CreatureLinkingMgr.h"
 #include "Weather.h"
@@ -99,16 +99,7 @@
 #include "UpdateTime.h"
 #include "GameTime.h"
 #include "SystemConfig.h"
-#include "AuctionHouseBot/AuctionIntentExecutor.h"
-#include "AuctionHouseBot/CustodyLedger.h"
-#include "AuctionHouseBot/CustodyService.h"
 #include "ScheduledExit.h"
-#include "WorkerSupervisor.h"
-#include "IpcMessage.h"
-#include "IpcOpcodes.h"
-#include "AuctionIntents.h"
-#include "BrowseMessages.h"
-#include "AuctionHouseBot/BrowsePending.h"
 #include <iostream>
 #include <sstream>
 #include "Corpse.h"
@@ -640,56 +631,6 @@ void World::LoadConfigSettings(bool reload)
     setConfig(CONFIG_BOOL_REALM_RECOMMENDED_OR_NEW_ENABLED, "Realm.RecommendedOrNew.Enabled", false);
     setConfig(CONFIG_BOOL_REALM_RECOMMENDED_OR_NEW, "Realm.RecommendedOrNew", false);
 
-    // AH Service custody escrow ledger
-    setConfig(CONFIG_BOOL_AH_CUSTODY, "AH.Service.Custody", false);
-
-    // AH Service worker write-authority (SP-2). BOOT-LATCHED (spec decision 7):
-    // configNoReload returns true only when !reload; on `.reload config` it
-    // logs and keeps the boot value, so the flag is immutable for the run.
-    if (configNoReload(reload, CONFIG_BOOL_AH_WRITE_AUTHORITY, "AH.Service.WriteAuthority", false))
-    {
-        setConfig(CONFIG_BOOL_AH_WRITE_AUTHORITY, "AH.Service.WriteAuthority", false);
-
-        // Startup invariant (spec I2): WriteAuthority hard-requires the custody
-        // ledger -- every WriteAuthority mutation is reservation-anchored.
-        if (getConfig(CONFIG_BOOL_AH_WRITE_AUTHORITY) && !getConfig(CONFIG_BOOL_AH_CUSTODY))
-        {
-            sLog.outError("AH.Service.WriteAuthority = 1 requires AH.Service.Custody = 1; forcing WriteAuthority OFF.");
-            setConfig(CONFIG_BOOL_AH_WRITE_AUTHORITY, false);
-        }
-
-        // [FIX C.1] Boot preflight: WriteAuthority hard-requires the
-        // `ah_worker_journal` migration. reconcile-on-reconnect reads that table
-        // to decide finalize-forward vs release; a missing table makes the read
-        // return "row absent" for a mutation the worker actually committed, so a
-        // committed bid gets refunded while the worker still shows the bidder ->
-        // double-credit. Refuse to run write-authority without the journal table.
-        if (getConfig(CONFIG_BOOL_AH_WRITE_AUTHORITY))
-        {
-            QueryResult* jrnCheck = CharacterDatabase.Query("SHOW TABLES LIKE 'ah_worker_journal'");
-            if (!jrnCheck)
-            {
-                sLog.outError("AH.Service.WriteAuthority = 1 but the "
-                    "`ah_worker_journal` table is missing; apply the SP-2 "
-                    "migration first. Forcing WriteAuthority OFF.");
-                setConfig(CONFIG_BOOL_AH_WRITE_AUTHORITY, false);
-            }
-            else
-            {
-                delete jrnCheck;
-            }
-        }
-
-        // Advisory only: with no worker configured, every AH mutation will
-        // report unavailable (spec 5.5: no in-process fallback).
-        if (getConfig(CONFIG_BOOL_AH_WRITE_AUTHORITY) && !sConfig.GetBoolDefault("AH.Service.Enabled", false))
-        {
-            sLog.outError("AH.Service.WriteAuthority = 1 but "
-                "AH.Service.Enabled = 0: no worker will start; all AH "
-                "mutations will be unavailable.");
-        }
-    }
-
     m_relocation_ai_notify_delay = sConfig.GetIntDefault("Visibility.AIRelocationNotifyDelay", 1000u);
     m_relocation_lower_limit_sq  = pow(sConfig.GetFloatDefault("Visibility.RelocationLowerLimit", 10), 2);
 
@@ -819,6 +760,8 @@ void World::LoadConfigSettings(bool reload)
         }
     }
 #endif /* ENABLE_ELUNA */
+
+    AuctionHouseModules::LoadConfig(reload);
     sLog.outString();
 }
 
diff --git a/src/game/WorldHandlers/WorldSessionMgr.cpp b/src/game/WorldHandlers/WorldSessionMgr.cpp
index de8bd55ce5..4f6e0647ef 100644
--- a/src/game/WorldHandlers/WorldSessionMgr.cpp
+++ b/src/game/WorldHandlers/WorldSessionMgr.cpp
@@ -82,7 +82,6 @@
 #include "WaypointManager.h"
 #include "GMTicketMgr.h"
 #include "Util.h"
-#include "AuctionHouseBot/AuctionHouseBot.h"
 #include "CharacterDatabaseCleaner.h"
 #include "CreatureLinkingMgr.h"
 #include "Weather.h"
@@ -94,16 +93,7 @@
 #include "UpdateTime.h"
 #include "GameTime.h"
 #include "SystemConfig.h"
-#include "AuctionHouseBot/AuctionIntentExecutor.h"
-#include "AuctionHouseBot/CustodyLedger.h"
-#include "AuctionHouseBot/CustodyService.h"
 #include "ScheduledExit.h"
-#include "WorkerSupervisor.h"
-#include "IpcMessage.h"
-#include "IpcOpcodes.h"
-#include "AuctionIntents.h"
-#include "BrowseMessages.h"
-#include "AuctionHouseBot/BrowsePending.h"
 #include <iostream>
 #ifdef ENABLE_ELUNA
 #include "LuaEngine.h"
diff --git a/src/mangosd/AhService.h b/src/mangosd/AhService.h
deleted file mode 100644
index 427a97bbf1..0000000000
--- a/src/mangosd/AhService.h
+++ /dev/null
@@ -1,111 +0,0 @@
-/**
- * SPDX-License-Identifier: GPL-3.0-or-later
- *
- * MaNGOS is a full featured server for World of Warcraft, supporting
- * the following clients: 1.12.x, 2.4.3, 3.3.5a, 4.3.4a and 5.4.8
- *
- * Copyright (C) 2005-2026 MaNGOS <https://www.getmangos.eu>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program. If not, see <https://www.gnu.org/licenses/>.
- *
- * World of Warcraft, and all World of Warcraft or Warcraft art, images,
- * and lore are copyrighted by Blizzard Entertainment, Inc.
- */
-
-#ifndef MANGOS_H_AHSERVICE
-#define MANGOS_H_AHSERVICE
-
-// mangos_zero only. The out-of-process auction house is this core's alone and is
-// deliberately not carried to mangos_one/two/three. It lives in its own header so
-// that Master.cpp stays identical to the other cores apart from one registration,
-// mirroring how RaService lives in RASession.h.
-
-#include "Service.h"
-#include "AuctionHouseBot.h"
-#include "Config/Config.h"
-#include "Log.h"
-#include "World.h"
-#include "WorkerSupervisor.h"
-
-
-/**
- * @brief The auction-house worker subprocess (optional, default-off).
- *
- * Not a thread: the supervisor owns a child process and its IPC link. It gets the
- * same lifecycle as everything else so its Shutdown() is ordered by the same rule —
- * joined after the world loop has stopped, so no tick can race it.
- */
-class AhServiceService : public IService
-{
-    public:
-
-        AhServiceService() : m_supervisor(nullptr) {}
-
-        const char* Name() const override { return "AH service"; }
-
-        void Start() override
-        {
-            // SP-1 coordinator authority: the worker is the configured AH read
-            // authority from here on. Set BEFORE Start() so that even if Start()
-            // fails (missing exe / port taken / bad bot GUID) and the supervisor is
-            // torn down below, the read handlers still send "AH unavailable" rather
-            // than silently reverting to in-process reads.
-            sWorld.SetAhServiceConfigured(true);
-
-            m_supervisor = new WorkerSupervisor(
-                "ah-service",
-                sConfig.GetStringDefault("AH.Service.Path", "service-workers/ah-service/ah-service"),
-                uint16(sConfig.GetIntDefault("AH.Service.Port", 5760)),
-                sConfig.GetStringDefault("AH.Service.Secret", "changeme"),
-                sAuctionBotConfig.GetAHBotId(),
-                sConfig.GetStringDefault("AH.Service.Config", "ah-service.conf"));
-
-            // SP-2: arm the write-authority bit for the IPC handshake BEFORE Start() --
-            // IPC_HELLO_ACK carries {runId, writeAuthority} to the worker (spec
-            // decision 7: the worker never reads it from its own conf). Applied on
-            // every child respawn.
-            m_supervisor->SetWriteAuthority(sWorld.IsAhWriteAuthority());
-
-            if (!m_supervisor->Start())
-            {
-                sLog.outError("AH service failed to start; falling back to in-process bot");
-                delete m_supervisor;
-                m_supervisor = nullptr;
-            }
-
-            // Published before the world loop starts, so the first tick already sees it.
-            sWorld.SetAhSupervisor(m_supervisor);
-        }
-
-        void Join() override
-        {
-            if (!m_supervisor)
-            {
-                return;
-            }
-
-            // Unpublish before destroying: the world loop has stopped, but nothing else
-            // should be able to observe a dangling supervisor.
-            sWorld.SetAhSupervisor(nullptr);
-            m_supervisor->Shutdown();
-            delete m_supervisor;
-            m_supervisor = nullptr;
-        }
-
-    private:
-
-        WorkerSupervisor* m_supervisor;
-};
-
-#endif
diff --git a/src/mangosd/CMakeLists.txt b/src/mangosd/CMakeLists.txt
index 8c06850bf4..ce8681136f 100644
--- a/src/mangosd/CMakeLists.txt
+++ b/src/mangosd/CMakeLists.txt
@@ -37,7 +37,6 @@ set(SRC_GRP_MAIN
   RASession.cpp
   RASession.h
   Service.h
-  AhService.h
   mangosd.cpp
 )
 source_group("Main" FILES ${SRC_GRP_MAIN})
@@ -81,7 +80,6 @@ target_link_libraries(mangosd
     PRIVATE
         game
         proto
-        ah_ipc
         $<$<BOOL:${SOAP}>:gsoap>
         Threads::Threads
         mangos_openssl
diff --git a/src/mangosd/MangosdTest.cpp b/src/mangosd/MangosdTest.cpp
index b50bbd3e6b..6515cea301 100644
--- a/src/mangosd/MangosdTest.cpp
+++ b/src/mangosd/MangosdTest.cpp
@@ -1,6539 +1,20 @@
-#include "Utilities/Errors.h"
-#include <vector>
 #include "MangosdTest.h"
-#include "Config/Config.h"
-#include "Log.h"
-#include "Database/DatabaseEnv.h"
-#include "Chat.h"
-#include "Mail.h"
-#include "ObjectMgr.h"
-#include "ObjectGuid.h"
-#include "AuctionHouseMgr.h"
-#include "AuctionHouseBot/AhBotSystemOwner.h"
-#include "AuctionHouseBot/AuctionIntentExecutor.h"
-#include "AuctionHouseBot/CustodyDeferred.h"
-#include "AuctionHouseBot/CustodyLedger.h"
-#include "AuctionHouseBot/CustodyReconciler.h"
-#include "AuctionHouseBot/CustodyService.h"
-#include "AuctionIntents.h"
-#include "WorkerSupervisor.h"
-#include "Object/AhUsabilityRef.h"
-#include "AuctionHouseBot/BrowsePending.h"
-#include "AuctionHouseBot/MutationPending.h"
-#include "IpcOpcodes.h"
-#include "Item.h"
-#include "BrowseMessages.h"
-#include "World.h"
-#include "WorldSession.h"
-#include "PlayerMutations.h"
-#include <cstdio>
-#include <cstdlib>
-#include <ctime>
-#include <memory>
-#include <string>
-
-#ifdef _WIN32
-#include <io.h>
-#else
-#include <unistd.h>
-#endif
-
-bool AhBuildCancelPrepareForward(MutationPendingMap& pending, uint32 playerGuidLow,
-                                 uint32 auctionId, uint64 uuid, uint32 sentSec,
-                                 IpcMessage& out);
-bool AhRepairFindingMutationAllowed(CustodyFinding const& finding);
-
-struct TestCliCapture
-{
-    std::vector<std::string> chunks;
-};
-
-static void TestCliPrint(void* arg, char const* text)
-{
-    if (arg && text)
-    {
-        static_cast<TestCliCapture*>(arg)->chunks.push_back(text);
-    }
-}
-
-static uint32 CountCliChunks(TestCliCapture const& capture,
-                             std::string const& needle)
-{
-    uint32 count = 0;
-    for (size_t i = 0; i < capture.chunks.size(); ++i)
-    {
-        if (capture.chunks[i].find(needle) != std::string::npos)
-        {
-            ++count;
-        }
-    }
-    return count;
-}
-
-static std::string TestHexEncode(ByteBuffer const& bb)
-{
-    static char const hex[] = "0123456789ABCDEF";
-    std::string out;
-    out.reserve(bb.size() * 2u);
-    uint8 const* data = bb.contents();
-    for (size_t i = 0; i < bb.size(); ++i)
-    {
-        out.push_back(hex[(data[i] >> 4) & 0x0Fu]);
-        out.push_back(hex[data[i] & 0x0Fu]);
-    }
-    return out;
-}
-
-static CustodyRow TestCustodyRow(uint32 id, std::string const& key,
-                                 uint8 kind, uint8 role, uint32 ownerGuid,
-                                 uint32 amount, uint32 itemGuid,
-                                 uint32 auctionId, uint64 createdTime = 0)
-{
-    CustodyRow row = {};
-    row.id = id;
-    row.idemKey = key;
-    row.kind = kind;
-    row.role = role;
-    row.state = CST_RESERVED;
-    row.ownerGuid = ownerGuid;
-    row.amount = amount;
-    row.itemGuid = itemGuid;
-    row.auctionId = auctionId;
-    row.createdTime = createdTime;
-    return row;
-}
-
-static CustodySnapshotGroup TestCustodyGroup(
-    uint32 auctionId, uint32 itemGuid, uint32 ownerGuid,
-    uint32 bidderGuid, uint32 bid, uint32 deposit,
-    std::vector<CustodyRow> const& rows)
-{
-    CustodySnapshotGroup group = {};
-    group.auctionId = auctionId;
-    group.auction.exists = true;
-    group.auction.auctionId = auctionId;
-    group.auction.itemGuid = itemGuid;
-    group.auction.ownerGuid = ownerGuid;
-    group.auction.bidderGuid = bidderGuid;
-    group.auction.bid = bid;
-    group.auction.deposit = deposit;
-    group.rows = rows;
-    return group;
-}
-
-static uint32 CountCustodyFindings(CustodyReconcileReport const& report,
-                                   CustodyFindingReason reason,
-                                   CustodyRepairOwnership ownership,
-                                   CustodyFindingState state)
-{
-    uint32 count = 0;
-    for (size_t i = 0; i < report.findings.size(); ++i)
-    {
-        CustodyFinding const& finding = report.findings[i];
-        if (finding.reason == reason &&
-            finding.repairOwnership == ownership &&
-            finding.state == state)
-        {
-            ++count;
-        }
-    }
-    return count;
-}
-
-static bool RunPureCustodyReconcilerTests()
-{
-    bool pass = true;
-    uint32 const botOwner = AHBOT_SYSTEM_OWNER_GUID;
-
-    auto marker = [botOwner](uint32 auctionId, uint32 itemGuid,
-                             uint64 createdTime = 0) -> CustodyRow
-    {
-        return TestCustodyRow(auctionId, "botlist:test:" + std::to_string(auctionId),
-            CUSTODY_ITEM, ROLE_RESOLUTION, botOwner, 0, itemGuid,
-            auctionId, createdTime);
-    };
-    auto bidRow = [](uint32 id, uint32 auctionId, uint32 bidder,
-                     uint32 amount, uint64 createdTime = 0) -> CustodyRow
-    {
-        return TestCustodyRow(id, "bid:" + std::to_string(auctionId) +
-            ":" + std::to_string(id), CUSTODY_GOLD, ROLE_BID,
-            bidder, amount, 0, auctionId, createdTime);
-    };
-
-    // Marker-owned listings do not invent player seller custody.
-    {
-        CustodyReconciler reconciler;
-        CustodyReconcileReport report;
-        std::vector<CustodySnapshotGroup> groups;
-        groups.push_back(TestCustodyGroup(980001, 880001, botOwner, 0, 0, 0,
-            std::vector<CustodyRow>(1, marker(980001, 880001))));
-        reconciler.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
-        if (!report.findings.empty() || report.rowVisits != 1)
-        {
-            printf("custody FAIL: valid DB-only bot marker produced drift\n");
-            pass = false;
-        }
-    }
-
-    // Marker plus matching player bid stays clean.
-    {
-        CustodyReconciler reconciler;
-        CustodyReconcileReport report;
-        std::vector<CustodyRow> rows;
-        rows.push_back(marker(980002, 880002));
-        rows.push_back(bidRow(2, 980002, 2202, 202));
-        std::vector<CustodySnapshotGroup> groups(1,
-            TestCustodyGroup(980002, 880002, botOwner, 2202, 202, 0, rows));
-        reconciler.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
-        if (!report.findings.empty())
-        {
-            printf("custody FAIL: matching bot-listing bid produced drift\n");
-            pass = false;
-        }
-    }
-
-    // A fresh row defers the whole group before and after auction facts change.
-    {
-        CustodyReconciler reconciler;
-        CustodyReconcileReport report;
-        std::vector<CustodyRow> rows;
-        rows.push_back(marker(980003, 880003, 900));
-        rows.push_back(bidRow(3, 980003, 2203, 203, 950));
-        std::vector<CustodySnapshotGroup> groups(1,
-            TestCustodyGroup(980003, 880003, botOwner, 0, 0, 0, rows));
-        reconciler.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
-        if (!report.findings.empty() || report.pendingBidCount != 0)
-        {
-            printf("custody FAIL: fresh bid was not deferred before auction update\n");
-            pass = false;
-        }
-        groups[0].auction.bidderGuid = 2203;
-        groups[0].auction.bid = 203;
-        reconciler.Scan(groups, 1005, CUSTODY_SCAN_RUNTIME, report);
-        if (!report.findings.empty() || report.pendingBidCount != 0)
-        {
-            printf("custody FAIL: fresh bid was not deferred after auction update\n");
-            pass = false;
-        }
-    }
-
-    // Complete and partial player seller custody.
-    {
-        std::vector<CustodyRow> rows;
-        rows.push_back(TestCustodyRow(1, "item:980004", CUSTODY_ITEM,
-            ROLE_ITEM, 1204, 0, 880004, 980004));
-        rows.push_back(TestCustodyRow(2, "dep:980004", CUSTODY_GOLD,
-            ROLE_DEPOSIT, 1204, 44, 0, 980004));
-        CustodyReconciler reconciler;
-        CustodyReconcileReport report;
-        std::vector<CustodySnapshotGroup> groups(1,
-            TestCustodyGroup(980004, 880004, 1204, 0, 0, 44, rows));
-        reconciler.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
-        if (!report.findings.empty())
-        {
-            printf("custody FAIL: complete player seller custody produced drift\n");
-            pass = false;
-        }
-
-        groups[0].rows.pop_back();
-        reconciler.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
-        if (CountCustodyFindings(report, CUSTODY_FINDING_MISSING,
-                CUSTODY_REPAIR_GENERIC, CUSTODY_FINDING_CONFIRMED) != 1)
-        {
-            printf("custody FAIL: partial seller custody did not report one missing row\n");
-            pass = false;
-        }
-    }
-
-    // Resolution-only legacy provenance and a valid bid-only overlay stay clean.
-    {
-        CustodyReconciler reconciler;
-        CustodyReconcileReport report;
-        std::vector<CustodySnapshotGroup> groups;
-        groups.push_back(TestCustodyGroup(980005, 880005, 1205, 0, 0, 55,
-            std::vector<CustodyRow>(1, TestCustodyRow(1, "resolve:test:980005",
-                CUSTODY_GOLD, ROLE_RESOLUTION, 0, 0, 0, 980005))));
-        groups.push_back(TestCustodyGroup(980006, 880006, 1206, 2206, 206, 66,
-            std::vector<CustodyRow>(1, bidRow(1, 980006, 2206, 206))));
-        reconciler.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
-        if (!report.findings.empty())
-        {
-            printf("custody FAIL: valid legacy provenance or bid overlay produced drift\n");
-            pass = false;
-        }
-    }
-
-    // A future canonical bot item remains marker-owned.
-    {
-        CustodyReconciler reconciler;
-        CustodyReconcileReport report;
-        std::vector<CustodyRow> rows;
-        rows.push_back(marker(980007, 880007));
-        rows.push_back(TestCustodyRow(2, "item:980007", CUSTODY_ITEM,
-            ROLE_ITEM, botOwner, 0, 880007, 980007));
-        std::vector<CustodySnapshotGroup> groups(1,
-            TestCustodyGroup(980007, 880007, botOwner, 0, 0, 0, rows));
-        reconciler.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
-        if (!report.findings.empty())
-        {
-            printf("custody FAIL: canonical bot item overrode marker provenance\n");
-            pass = false;
-        }
-    }
-
-    // Invalid and duplicate markers are confirmed manual-only findings.
-    {
-        CustodyReconciler reconciler;
-        CustodyReconcileReport report;
-        CustodyRow invalid = marker(980008, 880008);
-        invalid.role = ROLE_ITEM;
-        std::vector<CustodySnapshotGroup> groups(1,
-            TestCustodyGroup(980008, 880008, botOwner, 0, 0, 0,
-                std::vector<CustodyRow>(1, invalid)));
-        reconciler.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
-        if (CountCustodyFindings(report, CUSTODY_FINDING_INVALID_MARKER,
-                CUSTODY_REPAIR_MANUAL_ONLY, CUSTODY_FINDING_CONFIRMED) != 1)
-        {
-            printf("custody FAIL: invalid marker ownership/reason mismatch\n");
-            pass = false;
-        }
-
-        std::vector<CustodyRow> duplicateRows;
-        duplicateRows.push_back(marker(980009, 880009));
-        CustodyRow second = marker(980009, 880009);
-        second.id += 1;
-        second.idemKey += ":duplicate";
-        duplicateRows.push_back(second);
-        groups[0] = TestCustodyGroup(980009, 880009, botOwner, 0, 0, 0,
-            duplicateRows);
-        reconciler.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
-        if (CountCustodyFindings(report, CUSTODY_FINDING_DUPLICATE_MARKER,
-                CUSTODY_REPAIR_MANUAL_ONLY, CUSTODY_FINDING_CONFIRMED) != 1)
-        {
-            printf("custody FAIL: duplicate markers did not produce one finding\n");
-            pass = false;
-        }
-    }
-
-    // Orphan marker cleanup belongs to the bot sweep; player rows remain generic.
-    {
-        CustodyReconciler reconciler;
-        CustodyReconcileReport report;
-        CustodySnapshotGroup orphan = {};
-        orphan.auctionId = 980010;
-        orphan.rows.push_back(marker(980010, 880010));
-        orphan.rows.push_back(bidRow(2, 980010, 2210, 210));
-        std::vector<CustodySnapshotGroup> groups(1, orphan);
-        reconciler.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
-        if (report.sweepOwnedCount != 1 || report.confirmedDriftCount != 1 ||
-            CountCustodyFindings(report, CUSTODY_FINDING_SWEEP_OWNED_MARKER,
-                CUSTODY_REPAIR_BOT_SWEEP, CUSTODY_FINDING_CONFIRMED) != 1 ||
-            CountCustodyFindings(report, CUSTODY_FINDING_ORPHAN_PLAYER,
-                CUSTODY_REPAIR_GENERIC, CUSTODY_FINDING_CONFIRMED) != 1)
-        {
-            printf("custody FAIL: orphan marker/player ownership split is wrong\n");
-            pass = false;
-        }
-    }
-
-    // Missing, duplicate, mismatched, and unexpected bids begin pending.
-    {
-        CustodyReconciler reconciler;
-        CustodyReconcileReport report;
-        std::vector<CustodySnapshotGroup> groups;
-        groups.push_back(TestCustodyGroup(980011, 880011, botOwner, 2211, 211, 0,
-            std::vector<CustodyRow>(1, marker(980011, 880011))));
-        std::vector<CustodyRow> duplicate;
-        duplicate.push_back(bidRow(1, 980012, 2212, 212));
-        duplicate.push_back(bidRow(2, 980012, 2212, 212));
-        groups.push_back(TestCustodyGroup(980012, 880012, 1212, 2212, 212, 0,
-            duplicate));
-        std::vector<CustodyRow> mismatched;
-        mismatched.push_back(marker(980013, 880013));
-        mismatched.push_back(bidRow(2, 980013, 9999, 213));
-        groups.push_back(TestCustodyGroup(980013, 880013, botOwner, 2213, 213, 0,
-            mismatched));
-        std::vector<CustodyRow> unexpected;
-        unexpected.push_back(marker(980014, 880014));
-        unexpected.push_back(bidRow(2, 980014, 2214, 214));
-        groups.push_back(TestCustodyGroup(980014, 880014, botOwner, 0, 0, 0,
-            unexpected));
-        reconciler.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
-        if (report.pendingBidCount != 5 || report.confirmedDriftCount != 0 ||
-            CountCustodyFindings(report, CUSTODY_FINDING_MISSING,
-                CUSTODY_REPAIR_MANUAL_ONLY, CUSTODY_FINDING_PENDING) != 1 ||
-            CountCustodyFindings(report, CUSTODY_FINDING_DUPLICATE,
-                CUSTODY_REPAIR_MANUAL_ONLY, CUSTODY_FINDING_PENDING) != 2 ||
-            CountCustodyFindings(report, CUSTODY_FINDING_MISMATCHED,
-                CUSTODY_REPAIR_MANUAL_ONLY, CUSTODY_FINDING_PENDING) != 1 ||
-            CountCustodyFindings(report, CUSTODY_FINDING_UNEXPECTED,
-                CUSTODY_REPAIR_MANUAL_ONLY, CUSTODY_FINDING_PENDING) != 1)
-        {
-            printf("custody FAIL: bid mismatch reason or pending counts are wrong\n");
-            pass = false;
-        }
-    }
-
-    // Stable bid mismatch confirmation uses exact 1000/1059/1060 boundaries.
-    {
-        CustodyReconciler reconciler;
-        CustodyReconcileReport report;
-        std::vector<CustodySnapshotGroup> groups(1,
-            TestCustodyGroup(980015, 880015, botOwner, 2215, 215, 0,
-                std::vector<CustodyRow>(1, marker(980015, 880015))));
-        reconciler.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
-        if (report.pendingBidCount != 1 || report.confirmedDriftCount != 0)
-        {
-            printf("custody FAIL: first bid mismatch was not pending\n");
-            pass = false;
-        }
-        reconciler.Scan(groups, 1059, CUSTODY_SCAN_RUNTIME, report);
-        if (report.pendingBidCount != 1 || report.confirmedDriftCount != 0)
-        {
-            printf("custody FAIL: 59-second bid mismatch did not remain pending\n");
-            pass = false;
-        }
-        reconciler.Scan(groups, 1060, CUSTODY_SCAN_RUNTIME, report);
-        if (report.pendingBidCount != 0 || report.confirmedDriftCount != 1)
-        {
-            printf("custody FAIL: 60-second bid mismatch was not confirmed\n");
-            pass = false;
-        }
-
-        groups[0].rows.push_back(bidRow(2, 980015, 2215, 215));
-        reconciler.Scan(groups, 1061, CUSTODY_SCAN_RUNTIME, report);
-        if (!report.findings.empty())
-        {
-            printf("custody FAIL: matching bid did not clear pending cache\n");
-            pass = false;
-        }
-    }
-
-    // Changed, fresh, removed, and boot observations cannot confirm old state.
-    {
-        CustodyReconcileReport report;
-        std::vector<CustodySnapshotGroup> groups(1,
-            TestCustodyGroup(980016, 880016, botOwner, 2216, 216, 0,
-                std::vector<CustodyRow>(1, marker(980016, 880016))));
-
-        CustodyReconciler changed;
-        changed.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
-        groups[0].auction.bid = 217;
-        changed.Scan(groups, 1060, CUSTODY_SCAN_RUNTIME, report);
-        if (report.pendingBidCount != 1 || report.confirmedDriftCount != 0)
-        {
-            printf("custody FAIL: changed fingerprint confirmed stale mismatch\n");
-            pass = false;
-        }
-
-        std::vector<CustodyRow> wrongShapeRows;
-        wrongShapeRows.push_back(marker(980017, 880017));
-        wrongShapeRows.push_back(bidRow(2, 980017, 2217, 217));
-        wrongShapeRows[1].itemGuid = 1;
-        std::vector<CustodySnapshotGroup> wrongShapeGroups(1,
-            TestCustodyGroup(980017, 880017, botOwner, 2217, 217, 0,
-                wrongShapeRows));
-        CustodyReconciler rowChanged;
-        rowChanged.Scan(wrongShapeGroups, 1000, CUSTODY_SCAN_RUNTIME, report);
-        wrongShapeGroups[0].rows[1].itemGuid = 2;
-        rowChanged.Scan(wrongShapeGroups, 1060, CUSTODY_SCAN_RUNTIME, report);
-        if (report.pendingBidCount != 1 || report.confirmedDriftCount != 0)
-        {
-            printf("custody FAIL: changed bid-row shape inherited mismatch age\n");
-            pass = false;
-        }
-
-        CustodyReconciler fresh;
-        fresh.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
-        groups[0].rows.push_back(bidRow(2, 980016, 9999, 217, 1100));
-        fresh.Scan(groups, 1060, CUSTODY_SCAN_RUNTIME, report);
-        if (!report.findings.empty())
-        {
-            printf("custody FAIL: fresh group did not clear mismatch observation\n");
-            pass = false;
-        }
-        groups[0].rows.pop_back();
-        fresh.Scan(groups, 1200, CUSTODY_SCAN_RUNTIME, report);
-        if (report.pendingBidCount != 1 || report.confirmedDriftCount != 0)
-        {
-            printf("custody FAIL: fresh-group clear retained old mismatch age\n");
-            pass = false;
-        }
-
-        CustodyReconciler removed;
-        removed.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
-        removed.Scan(std::vector<CustodySnapshotGroup>(), 1060,
-            CUSTODY_SCAN_RUNTIME, report);
-        removed.Scan(groups, 1120, CUSTODY_SCAN_RUNTIME, report);
-        if (report.pendingBidCount != 1 || report.confirmedDriftCount != 0)
-        {
-            printf("custody FAIL: removed group retained old mismatch age\n");
-            pass = false;
-        }
-
-        CustodyReconciler boot;
-        boot.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
-        boot.Scan(groups, 1060, CUSTODY_SCAN_BOOT, report);
-        if (report.pendingBidCount != 1 || report.confirmedDriftCount != 0)
-        {
-            printf("custody FAIL: boot scan confirmed prior mismatch\n");
-            pass = false;
-        }
-
-        CustodyReconciler future;
-        groups[0].rows.push_back(bidRow(3, 980016, 9999, 217, 2000));
-        future.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
-        if (!report.findings.empty())
-        {
-            printf("custody FAIL: future timestamp was treated as mature\n");
-            pass = false;
-        }
-    }
-
-    // A large clean population visits each input row exactly once.
-    {
-        std::vector<CustodySnapshotGroup> groups;
-        groups.reserve(50000);
-        for (uint32 i = 0; i < 50000; ++i)
-        {
-            uint32 const auctionId = 1000000 + i;
-            groups.push_back(TestCustodyGroup(auctionId, 2000000 + i,
-                3000000 + i, 0, 0, 0,
-                std::vector<CustodyRow>(1, TestCustodyRow(i + 1,
-                    "resolve:linear:" + std::to_string(i), CUSTODY_GOLD,
-                    ROLE_RESOLUTION, 0, 0, 0, auctionId))));
-        }
-        CustodyReconciler reconciler;
-        CustodyReconcileReport report;
-        reconciler.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
-        if (report.rowVisits != 50000 || !report.findings.empty())
-        {
-            printf("custody FAIL: linear scan visits=" UI64FMTD " findings=%u\n",
-                report.rowVisits, uint32(report.findings.size()));
-            pass = false;
-        }
-    }
-
-    // Automatic custody maintenance gates reconciliation/pruning and the bot
-    // materialization sweep independently.
-    {
-        CustodyMaintenancePlan const disabled =
-            CustodyService::GetMaintenancePlan(false, false);
-        CustodyMaintenancePlan const custodyOnly =
-            CustodyService::GetMaintenancePlan(true, false);
-        CustodyMaintenancePlan const writeOnly =
-            CustodyService::GetMaintenancePlan(false, true);
-        CustodyMaintenancePlan const enabled =
-            CustodyService::GetMaintenancePlan(true, true);
-
-        if (disabled.reconcile || disabled.prune ||
-            disabled.sweepBotMaterializations ||
-            !custodyOnly.reconcile || !custodyOnly.prune ||
-            custodyOnly.sweepBotMaterializations ||
-            writeOnly.reconcile || writeOnly.prune ||
-            !writeOnly.sweepBotMaterializations ||
-            !enabled.reconcile || !enabled.prune ||
-            !enabled.sweepBotMaterializations)
-        {
-            printf("custody FAIL: maintenance gate truth table mismatch\n");
-            pass = false;
-        }
-    }
-
-    // Expected bot-sweep ownership and transient bid observations are
-    // diagnostics, not errors. Confirmed player/manual drift remains an error.
-    {
-        CustodyFinding confirmed = {};
-        confirmed.repairOwnership = CUSTODY_REPAIR_GENERIC;
-        confirmed.state = CUSTODY_FINDING_CONFIRMED;
-
-        CustodyFinding manual = confirmed;
-        manual.repairOwnership = CUSTODY_REPAIR_MANUAL_ONLY;
-
-        CustodyFinding pending = confirmed;
-        pending.state = CUSTODY_FINDING_PENDING;
-
-        CustodyFinding sweepOwned = confirmed;
-        sweepOwned.repairOwnership = CUSTODY_REPAIR_BOT_SWEEP;
-
-        if (!CustodyService::ReconcileFindingIsError(confirmed) ||
-            !CustodyService::ReconcileFindingIsError(manual) ||
-            CustodyService::ReconcileFindingIsError(pending) ||
-            CustodyService::ReconcileFindingIsError(sweepOwned))
-        {
-            printf("custody FAIL: reconcile finding severity policy mismatch\n");
-            pass = false;
-        }
-    }
-
-    // Each automatic/manual operation owns one independent detail budget.
-    {
-        CustodyDetailBudget budget(100);
-        uint32 allowed = 0;
-        for (uint32 i = 0; i < 101; ++i)
-        {
-            if (budget.Take())
-            {
-                ++allowed;
-            }
-        }
-
-        CustodyDetailBudget second(100);
-        if (allowed != 100 || budget.Allowed() != 100 ||
-            budget.Suppressed() != 1 || !second.Take() ||
-            second.Allowed() != 1 || second.Suppressed() != 0)
-        {
-            printf("custody FAIL: detail budget did not cap at 100\n");
-            pass = false;
-        }
-    }
-
-    // Shuffled input yields deterministic sorted detail output without
-    // changing exact category totals when the first 100 details are selected.
-    {
-        std::vector<CustodySnapshotGroup> groups;
-        for (uint32 i = 0; i < 101; ++i)
-        {
-            uint32 const auctionId = 990100 - i;
-            CustodySnapshotGroup group = {};
-            group.auctionId = auctionId;
-            group.rows.push_back(TestCustodyRow(i + 1,
-                "test:budget:" + std::to_string(auctionId), CUSTODY_GOLD,
-                ROLE_BID, 4000000 + i, 100 + i, 0, auctionId));
-            groups.push_back(group);
-        }
-
-        CustodyReconciler reconciler;
-        CustodyReconcileReport report;
-        reconciler.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
-        CustodyDetailBudget budget(100);
-        uint32 firstAuctionId = 0;
-        uint32 lastAuctionId = 0;
-        for (size_t i = 0; i < report.findings.size(); ++i)
-        {
-            if (!budget.Take())
-            {
-                continue;
-            }
-            if (!firstAuctionId)
-            {
-                firstAuctionId = report.findings[i].row.auctionId;
-            }
-            lastAuctionId = report.findings[i].row.auctionId;
-        }
-
-        if (report.findings.size() != 101 ||
-            report.confirmedDriftCount != 101 ||
-            report.pendingBidCount != 0 || report.sweepOwnedCount != 0 ||
-            firstAuctionId != 990000 || lastAuctionId != 990099 ||
-            budget.Allowed() != 100 || budget.Suppressed() != 1)
-        {
-            printf("custody FAIL: bounded report order/totals mismatch\n");
-            pass = false;
-        }
-    }
-
-    return pass;
-}
-
-static Item* TestCreateCachedAuctionItem(uint32 itemId, uint32 ownerGuid)
-{
-    Item* item = Item::CreateItem(itemId, 1);
-    if (!item)
-    {
-        return NULL;
-    }
-
-    item->SetOwnerGuid(ObjectGuid(HIGHGUID_PLAYER, ownerGuid));
-    CharacterDatabase.BeginTransaction();
-    item->SaveToDB();
-    if (!CharacterDatabase.CommitTransactionChecked())
-    {
-        delete item;
-        return NULL;
-    }
-
-    sAuctionMgr.AddAItem(item);
-    return item;
-}
-
-static bool TestArmCustodyCommitFailure(char const* phase,
-                                        std::string& originalConfig,
-                                        std::string& testConfig)
-{
-    originalConfig = sConfig.GetFilename();
-    char configPath[] = "mangosd-custody-selftest-XXXXXX";
-#ifdef _WIN32
-    if (_mktemp_s(configPath, sizeof(configPath)) != 0)
-    {
-        return false;
-    }
-
-    FILE* config = NULL;
-    if (fopen_s(&config, configPath, "w") != 0)
-    {
-        return false;
-    }
-#else
-    int const configHandle = mkstemp(configPath);
-    if (configHandle == -1)
-    {
-        return false;
-    }
-
-    FILE* config = fdopen(configHandle, "w");
-    if (!config)
-    {
-        close(configHandle);
-        remove(configPath);
-        return false;
-    }
-#endif
-    fprintf(config,
-            "[MangosdConf]\n"
-            "AH.Service.CustodyFailCommitAt = \"%s\"\n",
-            phase);
-    fclose(config);
-    testConfig = configPath;
-    if (!sConfig.SetSource(testConfig.c_str()))
-    {
-        remove(testConfig.c_str());
-        return false;
-    }
-    return true;
-}
-
-static bool TestRestoreConfig(std::string const& originalConfig,
-                              std::string const& testConfig)
-{
-    bool const restored = sConfig.SetSource(originalConfig.c_str());
-    remove(testConfig.c_str());
-    return restored;
-}
-
-/// Self-test for Database::CommitTransactionChecked(): proves the runtime
-/// (async-enabled) path is synchronous, durable and returns the REAL result.
-/// Returns 0 on pass, non-zero on fail.
-static int RunCommitTest()
-{
-    bool pass = true;
-
-    // Force the runtime async path so the transaction is FIFO-queued through
-    // the delay thread and CommitTransactionChecked() blocks until durable.
-    CharacterDatabase.AllowAsyncTransactions();
-
-    // Clean slate (ignore result; row may or may not exist from a prior run).
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `custody_ledger` WHERE `idem_key` LIKE 'test:commit%'");
-
-    // (a) Success path: a valid INSERT must commit and be visible BEFORE return.
-    CharacterDatabase.BeginTransaction();
-    CharacterDatabase.PExecute(
-        "INSERT INTO `custody_ledger` "
-        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-        "VALUES ('test:commit:ok',1,1,0,0,0,0,0,0,0,0)");
-    bool ok = CharacterDatabase.CommitTransactionChecked();
-    if (!ok)
-    {
-        printf("commit FAIL: success-path CommitTransactionChecked returned false\n");
-        pass = false;
-    }
-
-    // Durability: a synchronous SELECT must see the row immediately after the
-    // (blocking) checked commit returned - i.e. it is durable, not deferred.
-    {
-        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
-            "SELECT 1 FROM `custody_ledger` WHERE `idem_key`='test:commit:ok'"));
-        if (!res)
-        {
-            printf("commit FAIL: committed row not visible after return (not durable)\n");
-            pass = false;
-        }
-    }
-
-    // (b) Rollback path: a second row with the SAME idem_key violates uk_idem,
-    // so the transaction must fail and CommitTransactionChecked() must return
-    // false. The duplicate must NOT land.
-    CharacterDatabase.BeginTransaction();
-    CharacterDatabase.PExecute(
-        "INSERT INTO `custody_ledger` "
-        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-        "VALUES ('test:commit:ok',2,2,0,0,0,0,0,0,0,0)");
-    bool ok2 = CharacterDatabase.CommitTransactionChecked();
-    if (ok2)
-    {
-        printf("commit FAIL: rollback-path CommitTransactionChecked returned true\n");
-        pass = false;
-    }
-
-    // The duplicate must not have landed: still exactly one row for the key.
-    {
-        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
-            "SELECT COUNT(*) FROM `custody_ledger` "
-            "WHERE `idem_key`='test:commit:ok'"));
-        if (!res || res->Fetch()[0].GetUInt64() != 1)
-        {
-            printf("commit FAIL: duplicate row landed after rollback\n");
-            pass = false;
-        }
-    }
-
-    // (c) Post-rollback TSS cleanliness: the false-returning rollback path above
-    // must still have detached the transaction from the TSS slot. If it left a
-    // residue, this third BeginTransaction() would trip MANGOS_ASSERT(!m_pTrans);
-    // in TransHelper::init(); a clean detach lets a fresh checked commit succeed
-    // and land its row.
-    CharacterDatabase.BeginTransaction();
-    CharacterDatabase.PExecute(
-        "INSERT INTO `custody_ledger` "
-        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-        "VALUES ('test:commit:after',1,1,0,0,0,0,0,0,0,0)");
-    bool ok3 = CharacterDatabase.CommitTransactionChecked();
-    if (!ok3)
-    {
-        printf("commit FAIL: post-rollback CommitTransactionChecked returned false (TSS not clean?)\n");
-        pass = false;
-    }
-    {
-        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
-            "SELECT 1 FROM `custody_ledger` WHERE `idem_key`='test:commit:after'"));
-        if (!res)
-        {
-            printf("commit FAIL: post-rollback committed row not visible (not durable)\n");
-            pass = false;
-        }
-    }
-
-    // Clean up (covers test:commit:ok and test:commit:after via the prefix).
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `custody_ledger` WHERE `idem_key` LIKE 'test:commit%'");
-
-    if (pass)
-    {
-        printf("commit OK\n");
-        return 0;
-    }
-
-    return 2;
-}
-
-/// Self-test for MailDraft::SendMailToInTransaction + CustodyDeferred: proves
-/// the co-commit variant appends the `mail` row to the CALLER's open
-/// transaction (no own Begin/Commit) and that running the deferred queue after
-/// a checked commit is safe. Uses existing offline character guid 1 (which has
-/// an account, so the offline path writes a row). Returns 0 on pass.
-static int RunMailTest()
-{
-    bool pass = true;
-
-    CharacterDatabase.AllowAsyncTransactions();
-
-    // Seed mail ids from MAX(mail.id)+1 so GenerateMailID() does not collide
-    // with existing rows (world data is NOT loaded under -t).
-    sObjectMgr.SetHighestGuids();
-
-    // The offline mail path requires the recipient to resolve to an account.
-    // Normal test clones may not have a character with guid 1, so seed one only
-    // when absent and clean up only our own fixture row afterwards.
-    bool seededReceiver = false;
-    {
-        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
-            "SELECT 1 FROM `characters` WHERE `guid`=1"));
-        if (!res)
-        {
-            CharacterDatabase.DirectExecute(
-                "INSERT INTO `characters` (`guid`,`account`,`name`,`money`) "
-                "VALUES (1, 1, 'AhMailTest1', 0)");
-            seededReceiver = true;
-        }
-    }
-
-    // Clean slate from any prior run.
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `mail` WHERE `receiver`=1 AND `money`=123 "
-        "AND `subject`='custodytest'");
-
-    // Append the mail to OUR open transaction, then checked-commit, then run
-    // the deferred queue (offline receiver => effects empty, items deferred).
-    CharacterDatabase.BeginTransaction();
-    MailDraft d("custodytest", "b");
-    d.SetMoney(123);
-    CustodyDeferred def;
-    d.SendMailToInTransaction(MailReceiver(ObjectGuid(HIGHGUID_PLAYER, uint32(1))),
-                              MailSender(MAIL_AUCTION, uint32(0)), def);
-    bool ok = CharacterDatabase.CommitTransactionChecked();
-    if (!ok)
-    {
-        printf("mail FAIL: CommitTransactionChecked returned false\n");
-        pass = false;
-    }
-    else
-    {
-        def.run();
-    }
-
-    // The mail row must have co-committed in our transaction.
-    {
-        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
-            "SELECT COUNT(*) FROM `mail` WHERE `receiver`=1 AND `money`=123 "
-            "AND `subject`='custodytest'"));
-        if (!res || res->Fetch()[0].GetUInt64() != 1)
-        {
-            printf("mail FAIL: co-committed mail row not found (expected 1)\n");
-            pass = false;
-        }
-    }
-
-    // Clean up.
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `mail` WHERE `receiver`=1 AND `money`=123 "
-        "AND `subject`='custodytest'");
-    if (seededReceiver)
-    {
-        CharacterDatabase.DirectExecute(
-            "DELETE FROM `characters` WHERE `guid`=1 AND `name`='AhMailTest1'");
-    }
-
-    if (pass)
-    {
-        printf("mail OK\n");
-        return 0;
-    }
-
-    return 2;
-}
-
-/// CRUD round-trip test for CustodyLedger: Insert, Get, GetRouteState, SetState,
-/// LoadNonTerminal, DeleteTerminalOlderThan.  Returns 0 on pass.
-static int RunCustodyTest()
-{
-    bool pass = true;
-
-    if (CustodyService::ShouldCrashAtPhase("", "") ||
-        CustodyService::ShouldCrashAtPhase("pre-commit", "") ||
-        CustodyService::ShouldCrashAtPhase("", "pre-commit") ||
-        CustodyService::ShouldCrashAtPhase("pre-commit", "pre-deferred") ||
-        !CustodyService::ShouldCrashAtPhase("pre-commit", "pre-commit"))
-    {
-        printf("custody FAIL: crash phase predicate mismatch\n");
-        pass = false;
-    }
-
-    CharacterDatabase.AllowAsyncTransactions();
-
-    // Clean slate from any prior aborted run.
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `custody_ledger` WHERE `idem_key` LIKE 'test:crud%'");
-
-    // ------------------------------------------------------------------ step 1
-    // Insert a RESERVED gold row and commit.
-    {
-        CustodyRow r;
-        r.id              = 0;
-        r.idemKey         = "test:crud:1";
-        r.kind            = CUSTODY_GOLD;
-        r.role            = ROLE_BID;
-        r.state           = CST_RESERVED;
-        r.ownerGuid       = 1;
-        r.beneficiaryGuid = 0;
-        r.amount          = 50;
-        r.itemGuid        = 0;
-        r.auctionId       = 999;
-        r.createdTime     = static_cast<uint64>(time(NULL));
-        r.resolvedTime    = 0;
-
-        CharacterDatabase.BeginTransaction();
-        CustodyLedger::Insert(r);
-        bool ok = CharacterDatabase.CommitTransactionChecked();
-        if (!ok)
-        {
-            printf("custody FAIL: step 1 Insert CommitTransactionChecked returned false\n");
-            pass = false;
-        }
-    }
-
-    // ------------------------------------------------------------------ step 2
-    // Get: row visible, state==CST_RESERVED, amount==50.
-    {
-        CustodyRow row;
-        bool found = CustodyLedger::Get("test:crud:1", row);
-        if (!found)
-        {
-            printf("custody FAIL: step 2 Get returned false (row not found)\n");
-            pass = false;
-        }
-        else
-        {
-            if (row.state != CST_RESERVED)
-            {
-                printf("custody FAIL: step 2 state expected %u got %u\n",
-                    uint32(CST_RESERVED), uint32(row.state));
-                pass = false;
-            }
-            if (row.amount != 50)
-            {
-                printf("custody FAIL: step 2 amount expected 50 got %u\n", row.amount);
-                pass = false;
-            }
-        }
-    }
-
-    // The seeded bid row selects only bid custody; an absent auction selects none.
-    CustodyRouteState const seededRoute = CustodyLedger::GetRouteState(999);
-    if (seededRoute.usesPlayerSellerCustody || !seededRoute.hasLiveBidCustody)
-    {
-        printf("custody FAIL: step 2 GetRouteState(999) mismatch\n");
-        pass = false;
-    }
-    CustodyRouteState const absentRoute = CustodyLedger::GetRouteState(424242);
-    if (absentRoute.usesPlayerSellerCustody || absentRoute.hasLiveBidCustody)
-    {
-        printf("custody FAIL: step 2 GetRouteState(424242) unexpectedly routed\n");
-        pass = false;
-    }
-
-    // ------------------------------------------------------------------ step 3
-    // SetState to CST_TERMINAL_OK and verify.
-    {
-        uint64 resolvedNow = static_cast<uint64>(time(NULL));
-        CharacterDatabase.BeginTransaction();
-        CustodyLedger::SetState("test:crud:1", CST_TERMINAL_OK, resolvedNow);
-        bool ok = CharacterDatabase.CommitTransactionChecked();
-        if (!ok)
-        {
-            printf("custody FAIL: step 3 SetState CommitTransactionChecked returned false\n");
-            pass = false;
-        }
-
-        CustodyRow row;
-        bool found = CustodyLedger::Get("test:crud:1", row);
-        if (!found)
-        {
-            printf("custody FAIL: step 3 Get returned false after SetState\n");
-            pass = false;
-        }
-        else if (row.state != CST_TERMINAL_OK)
-        {
-            printf("custody FAIL: step 3 state expected %u got %u\n",
-                uint32(CST_TERMINAL_OK), uint32(row.state));
-            pass = false;
-        }
-    }
-
-    // ------------------------------------------------------------------ step 4
-    // LoadNonTerminal must NOT contain "test:crud:1" (it is now terminal).
-    {
-        std::vector<CustodyRow> v;
-        CustodyLedger::LoadNonTerminal(v);
-        for (size_t i = 0; i < v.size(); ++i)
-        {
-            if (v[i].idemKey == "test:crud:1")
-            {
-                printf("custody FAIL: step 4 LoadNonTerminal contains terminal row\n");
-                pass = false;
-                break;
-            }
-        }
-    }
-
-    // ------------------------------------------------------------------ step 5
-    // DeleteTerminalOlderThan(now+10): row must be pruned.
-    {
-        uint64 cutoff = static_cast<uint64>(time(NULL)) + 10;
-        CharacterDatabase.BeginTransaction();
-        CustodyLedger::DeleteTerminalOlderThan(cutoff);
-        bool ok = CharacterDatabase.CommitTransactionChecked();
-        if (!ok)
-        {
-            printf("custody FAIL: step 5 DeleteTerminalOlderThan CommitTransactionChecked returned false\n");
-            pass = false;
-        }
-
-        CustodyRow row;
-        bool found = CustodyLedger::Get("test:crud:1", row);
-        if (found)
-        {
-            printf("custody FAIL: step 5 Get returned true after prune (row not deleted)\n");
-            pass = false;
-        }
-    }
-
-    // ------------------------------------------------------------------ step 6
-    // Cleanup CRUD rows.
-    CharacterDatabase.BeginTransaction();
-    CharacterDatabase.PExecute(
-        "DELETE FROM `custody_ledger` WHERE `idem_key` LIKE 'test:crud%%'");
-    CharacterDatabase.CommitTransactionChecked();
-
-    // =================================================== authoritative reads
-    // These rows exercise route provenance independently from local AH maps.
-    uint32 const routeBase = 973100;
-    uint32 const snapshotAuctionId = routeBase + 7;
-    uint32 const orphanAuctionId = routeBase + 8;
-    uint64 const routeNow = static_cast<uint64>(time(NULL));
-
-    CharacterDatabase.DirectPExecute(
-        "DELETE FROM `custody_ledger` WHERE `auction_id` BETWEEN %u AND %u",
-        routeBase + 1, orphanAuctionId);
-    CharacterDatabase.DirectPExecute(
-        "DELETE FROM `auction` WHERE `id`=%u", snapshotAuctionId);
-
-    CharacterDatabase.BeginTransaction();
-    CharacterDatabase.PExecute(
-        "INSERT INTO `custody_ledger` "
-        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) VALUES "
-        "('item:973101',1,3,0,1101,0,0,883101,973101," UI64FMTD ",0),"
-        "('dep:973101',0,0,0,1101,0,31,0,973101," UI64FMTD ",0),"
-        "('bid:973102:1',0,1,0,2102,0,102,0,973102," UI64FMTD ",0),"
-        "('resolve:test:973103',0,4,0,0,0,0,0,973103," UI64FMTD ",0),"
-        "('botlist:test:973104',1,3,0,4294967294,0,0,883104,973104," UI64FMTD ",0),"
-        "('botlist:test:973105',1,3,0,4294967294,0,0,883105,973105," UI64FMTD ",0),"
-        "('bid:973105:1',0,1,0,2105,0,105,0,973105," UI64FMTD ",0),"
-        "('botlist:test:973106',1,3,0,4294967294,0,0,883106,973106," UI64FMTD ",0),"
-        "('item:973106',1,3,0,4294967294,0,0,883106,973106," UI64FMTD ",0),"
-        "('test:snapshot:live',0,4,0,0,0,0,0,973107," UI64FMTD ",0),"
-        "('test:snapshot:orphan',0,1,0,2208,0,208,0,973108," UI64FMTD ",0)",
-        routeNow, routeNow, routeNow, routeNow, routeNow, routeNow,
-        routeNow, routeNow, routeNow, routeNow, routeNow);
-    CharacterDatabase.PExecute(
-        "INSERT INTO `auction` "
-        "(`id`,`houseid`,`itemguid`,`item_template`,`item_count`,"
-        "`item_randompropertyid`,`itemowner`,`buyoutprice`,`time`,`buyguid`,"
-        "`lastbid`,`startbid`,`deposit`) "
-        "VALUES (%u,7,883107,25,2,0,1234,500," UI64FMTD ",2345,3456,100,77)",
-        snapshotAuctionId, routeNow + HOUR);
-    if (!CharacterDatabase.CommitTransactionChecked())
-    {
-        printf("custody FAIL: authoritative-read seed commit returned false\n");
-        pass = false;
-    }
-
-    struct RouteExpectation
-    {
-        uint32 auctionId;
-        bool seller;
-        bool bid;
-        char const* label;
-    };
-    RouteExpectation const routeExpectations[] =
-    {
-        { routeBase + 1, true,  false, "player seller" },
-        { routeBase + 2, false, true,  "bid only" },
-        { routeBase + 3, false, false, "resolution only" },
-        { routeBase + 4, false, false, "bot marker only" },
-        { routeBase + 5, false, true,  "bot marker plus bid" },
-        { routeBase + 6, false, false, "bot marker plus canonical item" },
-    };
-    for (size_t i = 0; i < sizeof(routeExpectations) / sizeof(routeExpectations[0]); ++i)
-    {
-        RouteExpectation const& expected = routeExpectations[i];
-        CustodyRouteState const route = CustodyLedger::GetRouteState(expected.auctionId);
-        if (route.usesPlayerSellerCustody != expected.seller ||
-            route.hasLiveBidCustody != expected.bid)
-        {
-            printf("custody FAIL: route %s expected seller=%u bid=%u got seller=%u bid=%u\n",
-                expected.label, uint32(expected.seller), uint32(expected.bid),
-                uint32(route.usesPlayerSellerCustody), uint32(route.hasLiveBidCustody));
-            pass = false;
-        }
-    }
-
-    AuctionHouseObject* authoritativeMap =
-        sAuctionMgr.GetAuctionsMap(AUCTION_HOUSE_NEUTRAL);
-    authoritativeMap->RemoveAuction(snapshotAuctionId);
-    if (authoritativeMap->GetAuction(snapshotAuctionId))
-    {
-        printf("custody FAIL: snapshot fixture unexpectedly exists in local AH map\n");
-        pass = false;
-    }
-
-    std::vector<CustodySnapshotGroup> snapshot;
-    CustodyLedger::LoadReconcileSnapshot(snapshot);
-    bool sawSnapshotAuction = false;
-    bool sawSnapshotOrphan = false;
-    for (size_t i = 0; i < snapshot.size(); ++i)
-    {
-        CustodySnapshotGroup const& group = snapshot[i];
-        if (group.auctionId == snapshotAuctionId)
-        {
-            sawSnapshotAuction = true;
-            if (!group.auction.exists || group.auction.auctionId != snapshotAuctionId ||
-                group.auction.itemGuid != 883107 || group.auction.ownerGuid != 1234 ||
-                group.auction.bidderGuid != 2345 || group.auction.bid != 3456 ||
-                group.auction.deposit != 77 || group.rows.size() != 1)
-            {
-                printf("custody FAIL: joined live auction facts do not match DB fixture\n");
-                pass = false;
-            }
-        }
-        else if (group.auctionId == orphanAuctionId)
-        {
-            sawSnapshotOrphan = true;
-            if (group.auction.exists || group.rows.size() != 1 ||
-                group.rows[0].idemKey != "test:snapshot:orphan")
-            {
-                printf("custody FAIL: joined orphan facts do not match DB fixture\n");
-                pass = false;
-            }
-        }
-    }
-    if (!sawSnapshotAuction || !sawSnapshotOrphan)
-    {
-        printf("custody FAIL: authoritative snapshot omitted live=%u orphan=%u\n",
-            uint32(sawSnapshotAuction), uint32(sawSnapshotOrphan));
-        pass = false;
-    }
-
-    if (!CustodyLedger::AuctionExists(snapshotAuctionId))
-    {
-        printf("custody FAIL: AuctionExists did not see shared auction row\n");
-        pass = false;
-    }
-    CharacterDatabase.DirectPExecute(
-        "DELETE FROM `auction` WHERE `id`=%u", snapshotAuctionId);
-    if (CustodyLedger::AuctionExists(snapshotAuctionId))
-    {
-        printf("custody FAIL: AuctionExists retained deleted shared auction row\n");
-        pass = false;
-    }
-
-    CharacterDatabase.DirectPExecute(
-        "DELETE FROM `custody_ledger` WHERE `auction_id` BETWEEN %u AND %u",
-        routeBase + 1, orphanAuctionId);
-    CharacterDatabase.DirectPExecute(
-        "DELETE FROM `auction` WHERE `id`=%u", snapshotAuctionId);
-
-    if (!RunPureCustodyReconcilerTests())
-    {
-        pass = false;
-    }
-
-    // ================================================================ reconcile
-    // Task 13: ReconcileScan flags custody drift and DeleteTerminalOlderThan
-    // prunes only old terminal rows.
-    uint32 const liveAuctionId = 970002;
-    uint32 const missingItemAuctionId = 970003;
-    uint32 const duplicateBidAuctionId = 970006;
-    uint64 const now = static_cast<uint64>(time(NULL));
-    uint64 const oldTime = now > 7200 ? now - 7200 : 1;
-
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `custody_ledger` WHERE `idem_key` LIKE 'test:recon:%'");
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `custody_ledger` WHERE `idem_key` IN "
-        "('item:970002','dep:970002','item:970003','dep:970003',"
-        "'item:970006','dep:970006','bid:970006:1','bid:970006:2')");
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `auction` WHERE `id` IN (970002,970003,970006)");
-
-    CharacterDatabase.BeginTransaction();
-    CharacterDatabase.PExecute(
-        "INSERT INTO `auction` "
-        "(`id`,`houseid`,`itemguid`,`item_template`,`item_count`,"
-        "`item_randompropertyid`,`itemowner`,`buyoutprice`,`time`,`buyguid`,"
-        "`lastbid`,`startbid`,`deposit`) VALUES "
-        "(970002,7,880002,25,1,0,1001,0," UI64FMTD ",0,0,10,5),"
-        "(970003,7,880003,25,1,0,1002,0," UI64FMTD ",0,0,10,5),"
-        "(970006,7,880006,25,1,0,1006,0," UI64FMTD ",2006,77,10,5)",
-        now + HOUR, now + HOUR, now + HOUR);
-    CharacterDatabase.PExecute(
-        "INSERT INTO `custody_ledger` "
-        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-        "VALUES ('test:recon:orphan','%u','%u','%u','%u','0','0','0','970001','" UI64FMTD "','0')",
-        uint32(CUSTODY_GOLD), uint32(ROLE_DEPOSIT), uint32(CST_RESERVED), 1000, oldTime);
-    CharacterDatabase.PExecute(
-        "INSERT INTO `custody_ledger` "
-        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-        "VALUES ('item:970002','%u','%u','%u','%u','0','0','880002','970002','" UI64FMTD "','0')",
-        uint32(CUSTODY_ITEM), uint32(ROLE_ITEM), uint32(CST_RESERVED), 1001, oldTime);
-    CharacterDatabase.PExecute(
-        "INSERT INTO `custody_ledger` "
-        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-        "VALUES ('dep:970002','%u','%u','%u','%u','0','5','0','970002','" UI64FMTD "','0')",
-        uint32(CUSTODY_GOLD), uint32(ROLE_DEPOSIT), uint32(CST_RESERVED), 1001, oldTime);
-    CharacterDatabase.PExecute(
-        "INSERT INTO `custody_ledger` "
-        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-        "VALUES ('dep:970003','%u','%u','%u','%u','0','5','0','970003','" UI64FMTD "','0')",
-        uint32(CUSTODY_GOLD), uint32(ROLE_DEPOSIT), uint32(CST_RESERVED), 1002, oldTime);
-    CharacterDatabase.PExecute(
-        "INSERT INTO `custody_ledger` "
-        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-        "VALUES ('item:970006','%u','%u','%u','%u','0','0','880006','970006','" UI64FMTD "','0')",
-        uint32(CUSTODY_ITEM), uint32(ROLE_ITEM), uint32(CST_RESERVED), 1006, oldTime);
-    CharacterDatabase.PExecute(
-        "INSERT INTO `custody_ledger` "
-        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-        "VALUES ('dep:970006','%u','%u','%u','%u','0','5','0','970006','" UI64FMTD "','0')",
-        uint32(CUSTODY_GOLD), uint32(ROLE_DEPOSIT), uint32(CST_RESERVED), 1006, oldTime);
-    CharacterDatabase.PExecute(
-        "INSERT INTO `custody_ledger` "
-        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-        "VALUES ('bid:970006:1','%u','%u','%u','%u','0','77','0','970006','" UI64FMTD "','0')",
-        uint32(CUSTODY_GOLD), uint32(ROLE_BID), uint32(CST_RESERVED), 2006, oldTime);
-    CharacterDatabase.PExecute(
-        "INSERT INTO `custody_ledger` "
-        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-        "VALUES ('bid:970006:2','%u','%u','%u','%u','0','77','0','970006','" UI64FMTD "','0')",
-        uint32(CUSTODY_GOLD), uint32(ROLE_BID), uint32(CST_RESERVED), 2006, oldTime);
-    CharacterDatabase.PExecute(
-        "INSERT INTO `custody_ledger` "
-        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-        "VALUES ('test:recon:old-terminal','%u','%u','%u','%u','0','0','0','970004','" UI64FMTD "','" UI64FMTD "')",
-        uint32(CUSTODY_GOLD), uint32(ROLE_DEPOSIT), uint32(CST_TERMINAL_OK), 1004, oldTime, oldTime);
-    CharacterDatabase.PExecute(
-        "INSERT INTO `custody_ledger` "
-        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-        "VALUES ('test:recon:recent-terminal','%u','%u','%u','%u','0','0','0','970005','" UI64FMTD "','" UI64FMTD "')",
-        uint32(CUSTODY_GOLD), uint32(ROLE_DEPOSIT), uint32(CST_TERMINAL_BACK), 1005, now, now);
-    if (!CharacterDatabase.CommitTransactionChecked())
-    {
-        printf("custody FAIL: reconcile seed commit returned false\n");
-        pass = false;
-    }
-
-    {
-        CustodyReconcileReport report;
-        CustodyService::ReconcileScan(now, CUSTODY_SCAN_RUNTIME, report);
-        bool sawOrphan = false;
-        bool sawCleanLive = false;
-        bool sawMissingItem = false;
-        uint32 pendingDuplicateBids = 0;
-        for (size_t i = 0; i < report.findings.size(); ++i)
-        {
-            CustodyFinding const& finding = report.findings[i];
-            if (finding.row.idemKey == "test:recon:orphan" &&
-                finding.reason == CUSTODY_FINDING_ORPHAN_PLAYER &&
-                finding.repairOwnership == CUSTODY_REPAIR_GENERIC)
-            {
-                sawOrphan = true;
-            }
-            if (finding.row.auctionId == liveAuctionId)
-            {
-                sawCleanLive = true;
-            }
-            if (finding.row.idemKey == "item:970003" &&
-                finding.reason == CUSTODY_FINDING_MISSING)
-            {
-                sawMissingItem = true;
-            }
-            if (finding.row.auctionId == duplicateBidAuctionId &&
-                finding.reason == CUSTODY_FINDING_DUPLICATE &&
-                finding.state == CUSTODY_FINDING_PENDING)
-            {
-                ++pendingDuplicateBids;
-            }
-        }
-        if (!sawOrphan)
-        {
-            printf("custody FAIL: reconcile did not flag orphan non-terminal row\n");
-            pass = false;
-        }
-        if (sawCleanLive)
-        {
-            printf("custody FAIL: reconcile flagged complete live custody auction\n");
-            pass = false;
-        }
-        if (!sawMissingItem)
-        {
-            printf("custody FAIL: reconcile did not flag live auction missing item row\n");
-            pass = false;
-        }
-        if (pendingDuplicateBids != 2)
-        {
-            printf("custody FAIL: reconcile duplicate bid pending count expected 2 got %u\n",
-                pendingDuplicateBids);
-            pass = false;
-        }
-    }
-
-    {
-        CharacterDatabase.BeginTransaction();
-        CustodyLedger::DeleteTerminalOlderThan(now - 3600);
-        if (!CharacterDatabase.CommitTransactionChecked())
-        {
-            printf("custody FAIL: reconcile prune commit returned false\n");
-            pass = false;
-        }
-
-        CustodyRow row;
-        if (CustodyLedger::Get("test:recon:old-terminal", row))
-        {
-            printf("custody FAIL: old terminal row was not pruned\n");
-            pass = false;
-        }
-        if (!CustodyLedger::Get("test:recon:recent-terminal", row))
-        {
-            printf("custody FAIL: recent terminal row was pruned\n");
-            pass = false;
-        }
-    }
-
-    CharacterDatabase.BeginTransaction();
-    CharacterDatabase.PExecute(
-        "DELETE FROM `auction` WHERE `id` IN (970002,970003,970006)");
-    CharacterDatabase.PExecute(
-        "DELETE FROM `custody_ledger` WHERE `idem_key` LIKE 'test:recon:%%'");
-    CharacterDatabase.PExecute(
-        "DELETE FROM `custody_ledger` WHERE `idem_key` IN "
-        "('item:970002','dep:970002','item:970003','dep:970003',"
-        "'item:970006','dep:970006','bid:970006:1','bid:970006:2')");
-    CharacterDatabase.CommitTransactionChecked();
-
-    // ========================================================== repair command
-    // Task 14: ah repair terminalizes custody drift conservatively and never
-    // mints mail from orphan ledger rows.
-    uint32 const repairOwner = 1;
-    uint32 const repairAuctionId = 970010;
-    uint32 const repairItemGuid = 880010;
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `mail` WHERE `receiver`=1 AND `subject`='AH custody repair'");
-    uint64 beforeRepairMail = 0;
-    {
-        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
-            "SELECT COUNT(*) FROM `mail` WHERE `receiver`='%u'",
-            repairOwner));
-        if (res)
-        {
-            beforeRepairMail = res->Fetch()[0].GetUInt64();
-        }
-    }
-
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `custody_ledger` WHERE `idem_key` LIKE 'test:repair:%'");
-    CharacterDatabase.BeginTransaction();
-    CharacterDatabase.PExecute(
-        "INSERT INTO `custody_ledger` "
-        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-        "VALUES ('test:repair:gold','%u','%u','%u','%u','0','12345','0','%u','" UI64FMTD "','0')",
-        uint32(CUSTODY_GOLD), uint32(ROLE_BID), uint32(CST_RESERVED),
-        repairOwner, repairAuctionId, oldTime);
-    CharacterDatabase.PExecute(
-        "INSERT INTO `custody_ledger` "
-        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-        "VALUES ('test:repair:item','%u','%u','%u','%u','0','0','%u','%u','" UI64FMTD "','0')",
-        uint32(CUSTODY_ITEM), uint32(ROLE_ITEM), uint32(CST_RESERVED),
-        repairOwner, repairItemGuid, repairAuctionId + 1, oldTime);
-    if (!CharacterDatabase.CommitTransactionChecked())
-    {
-        printf("custody FAIL: repair seed commit returned false\n");
-        pass = false;
-    }
-
-    CliHandler cli(0, SEC_ADMINISTRATOR, NULL, &TestCliPrint);
-    if (!cli.ParseCommands("ah repair apply"))
-    {
-        printf("custody FAIL: ah repair apply returned false\n");
-        pass = false;
-    }
-
-    {
-        CustodyRow row;
-        if (!CustodyLedger::Get("test:repair:gold", row) ||
-            row.state == CST_RESERVED)
-        {
-            printf("custody FAIL: ah repair did not terminalize gold row\n");
-            pass = false;
-        }
-        if (!CustodyLedger::Get("test:repair:item", row) ||
-            row.state == CST_RESERVED)
-        {
-            printf("custody FAIL: ah repair did not terminalize item row\n");
-            pass = false;
-        }
-    }
-
-    {
-        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
-            "SELECT COUNT(*) FROM `mail` WHERE `receiver`='%u'",
-            repairOwner));
-        uint64 const afterRepairMail = res ? res->Fetch()[0].GetUInt64() : 0;
-        if (afterRepairMail != beforeRepairMail)
-        {
-            printf("custody FAIL: ah repair minted mail from orphan ledger row\n");
-            pass = false;
-        }
-    }
-
-    {
-        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
-            "SELECT COUNT(*) FROM `item_instance` WHERE `guid`='%u'",
-            repairItemGuid));
-        if (res && res->Fetch()[0].GetUInt64() != 0)
-        {
-            printf("custody FAIL: ah repair mutated sentinel item_instance row\n");
-            pass = false;
-        }
-    }
-
-    CharacterDatabase.BeginTransaction();
-    CharacterDatabase.PExecute(
-        "INSERT INTO `custody_ledger` "
-        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-        "VALUES ('test:repair:force','%u','%u','%u','%u','0','54321','0','%u','" UI64FMTD "','0')",
-        uint32(CUSTODY_GOLD), uint32(ROLE_BID), uint32(CST_RESERVED),
-        repairOwner, repairAuctionId + 2, oldTime);
-    if (!CharacterDatabase.CommitTransactionChecked())
-    {
-        printf("custody FAIL: repair force seed commit returned false\n");
-        pass = false;
-    }
-
-    if (!cli.ParseCommands("ah repair force-forfeit test:repair:force"))
-    {
-        printf("custody FAIL: ah repair force-forfeit returned false\n");
-        pass = false;
-    }
-
-    {
-        CustodyRow row;
-        if (!CustodyLedger::Get("test:repair:force", row) ||
-            row.state == CST_RESERVED)
-        {
-            printf("custody FAIL: force-forfeit did not terminalize gold row\n");
-            pass = false;
-        }
-    }
-
-    {
-        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
-            "SELECT COUNT(*) FROM `mail` WHERE `receiver`='%u'",
-            repairOwner));
-        uint64 const afterForceMail = res ? res->Fetch()[0].GetUInt64() : 0;
-        if (afterForceMail != beforeRepairMail)
-        {
-            printf("custody FAIL: force-forfeit minted mail from orphan ledger row\n");
-            pass = false;
-        }
-    }
-
-    CharacterDatabase.BeginTransaction();
-    CharacterDatabase.PExecute(
-        "DELETE FROM `custody_ledger` WHERE `idem_key` LIKE 'test:repair:%%'");
-    CharacterDatabase.CommitTransactionChecked();
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `mail` WHERE `receiver`=1 AND `subject`='AH custody repair'");
-
-    // The apply guard must consult the shared auction table at mutation time,
-    // not the local AH map or the auction facts captured by the scan.
-    {
-        uint32 const livenessAuctionId = 970080;
-        CharacterDatabase.DirectPExecute(
-            "DELETE FROM `auction` WHERE `id`=%u", livenessAuctionId);
-        CharacterDatabase.DirectPExecute(
-            "DELETE FROM `custody_ledger` WHERE `idem_key`='test:repair:liveness'");
-        CharacterDatabase.DirectPExecute(
-            "INSERT INTO `custody_ledger` "
-            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-            "VALUES ('test:repair:liveness',0,1,0,1,0,80,0,%u," UI64FMTD ",0)",
-            livenessAuctionId, oldTime);
-
-        CustodyReconcileReport report;
-        CustodyService::ReconcileScan(now, CUSTODY_SCAN_RUNTIME, report);
-        CustodyFinding scanned = {};
-        bool found = false;
-        for (size_t i = 0; i < report.findings.size(); ++i)
-        {
-            if (report.findings[i].row.idemKey == "test:repair:liveness")
-            {
-                scanned = report.findings[i];
-                found = true;
-                break;
-            }
-        }
-
-        CharacterDatabase.DirectPExecute(
-            "INSERT INTO `auction` "
-            "(`id`,`houseid`,`itemguid`,`item_template`,`item_count`,"
-            "`item_randompropertyid`,`itemowner`,`buyoutprice`,`time`,`buyguid`,"
-            "`lastbid`,`startbid`,`deposit`) "
-            "VALUES (%u,7,880080,25,1,0,1,0," UI64FMTD ",0,0,10,5)",
-            livenessAuctionId, now + HOUR);
-        bool const blockedAfterInsert = found &&
-            !AhRepairFindingMutationAllowed(scanned);
-        if (!CharacterDatabase.DirectExecute(
-                "RENAME TABLE `auction` TO `auction_test_unavailable`"))
-        {
-            printf("custody FAIL: could not inject auction query failure\n");
-            return 2;
-        }
-        bool const blockedOnQueryFailure = found &&
-            !AhRepairFindingMutationAllowed(scanned);
-        if (!CharacterDatabase.DirectExecute(
-                "RENAME TABLE `auction_test_unavailable` TO `auction`"))
-        {
-            printf("custody FAIL: could not restore auction table\n");
-            return 2;
-        }
-        CharacterDatabase.DirectPExecute(
-            "DELETE FROM `auction` WHERE `id`=%u", livenessAuctionId);
-        bool const allowedAfterDelete = found &&
-            AhRepairFindingMutationAllowed(scanned);
-        if (!found || !blockedAfterInsert || !blockedOnQueryFailure ||
-            !allowedAfterDelete)
-        {
-            printf("custody FAIL: repair liveness guard ignored post-scan DB state\n");
-            pass = false;
-        }
-
-        CharacterDatabase.DirectExecute(
-            "DELETE FROM `custody_ledger` WHERE `idem_key`='test:repair:liveness'");
-    }
-
-    // Generic apply must report but skip pending, manual-only, and bot-sweep
-    // findings. Force-forfeit must reject the reserved bot marker explicitly.
-    {
-        CharacterDatabase.DirectExecute(
-            "DELETE FROM `custody_ledger` WHERE `idem_key` LIKE 'botlist:test:repair:%'");
-        CharacterDatabase.DirectExecute(
-            "DELETE FROM `auction` WHERE `id` IN (970081,970082)");
-        CharacterDatabase.BeginTransaction();
-        CharacterDatabase.PExecute(
-            "INSERT INTO `auction` "
-            "(`id`,`houseid`,`itemguid`,`item_template`,`item_count`,"
-            "`item_randompropertyid`,`itemowner`,`buyoutprice`,`time`,`buyguid`,"
-            "`lastbid`,`startbid`,`deposit`) VALUES "
-            "(970081,7,880081,25,1,0,%u,0," UI64FMTD ",0,0,10,0),"
-            "(970082,7,880082,25,1,0,%u,0," UI64FMTD ",2082,82,10,0)",
-            AHBOT_SYSTEM_OWNER_GUID, now + HOUR,
-            AHBOT_SYSTEM_OWNER_GUID, now + HOUR);
-        CharacterDatabase.PExecute(
-            "INSERT INTO `custody_ledger` "
-            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) VALUES "
-            "('botlist:test:repair:manual',1,3,0,%u,0,0,880081,970081," UI64FMTD ",0),"
-            "('botlist:test:repair:pending',1,4,0,%u,0,0,880082,970082," UI64FMTD ",0),"
-            "('botlist:test:repair:sweep',1,4,0,%u,0,0,880083,970083," UI64FMTD ",0)",
-            AHBOT_SYSTEM_OWNER_GUID, oldTime,
-            AHBOT_SYSTEM_OWNER_GUID, oldTime,
-            AHBOT_SYSTEM_OWNER_GUID, oldTime);
-        if (!CharacterDatabase.CommitTransactionChecked())
-        {
-            printf("custody FAIL: repair ownership fixtures failed to commit\n");
-            pass = false;
-        }
-
-        TestCliCapture applyCapture;
-        CliHandler applyCli(0, SEC_ADMINISTRATOR, &applyCapture, &TestCliPrint);
-        if (!applyCli.ParseCommands("ah repair apply") ||
-            CountCliChunks(applyCapture,
-                "mode=apply confirmed=1 pending=1 sweep-owned=1 repaired=0 skipped=3 failed=0") != 1)
-        {
-            printf("custody FAIL: repair ownership summary mismatch\n");
-            pass = false;
-        }
-
-        char const* markerKeys[] = {
-            "botlist:test:repair:manual",
-            "botlist:test:repair:pending",
-            "botlist:test:repair:sweep",
-        };
-        for (size_t i = 0; i < sizeof(markerKeys) / sizeof(markerKeys[0]); ++i)
-        {
-            CustodyRow markerRow;
-            if (!CustodyLedger::Get(markerKeys[i], markerRow) ||
-                markerRow.state != CST_RESERVED)
-            {
-                printf("custody FAIL: generic apply mutated reserved bot marker %s\n",
-                    markerKeys[i]);
-                pass = false;
-            }
-        }
-
-        TestCliCapture forceCapture;
-        CliHandler forceCli(0, SEC_ADMINISTRATOR, &forceCapture, &TestCliPrint);
-        forceCli.ParseCommands(
-            "ah repair force-forfeit botlist:test:repair:sweep");
-        if (CountCliChunks(forceCapture, "reserved bot marker") != 1)
-        {
-            printf("custody FAIL: force-forfeit did not reject bot marker\n");
-            pass = false;
-        }
-
-        CharacterDatabase.DirectExecute(
-            "DELETE FROM `custody_ledger` WHERE `idem_key` LIKE 'botlist:test:repair:%'");
-        CharacterDatabase.DirectExecute(
-            "DELETE FROM `auction` WHERE `id` IN (970081,970082)");
-    }
-
-    // Failed journal replay is counted separately and leaves custody reserved.
-    {
-        uint32 const failedAuctionId = 970084;
-        CharacterDatabase.DirectPExecute(
-            "DELETE FROM `custody_ledger` WHERE `idem_key`='test:repair:failed'");
-        CharacterDatabase.DirectPExecute(
-            "DELETE FROM `ah_worker_journal` WHERE `auction_id`=%u",
-            failedAuctionId);
-        CharacterDatabase.BeginTransaction();
-        CharacterDatabase.PExecute(
-            "INSERT INTO `custody_ledger` "
-            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-            "VALUES ('test:repair:failed',0,1,0,1,0,84,0,%u," UI64FMTD ",0)",
-            failedAuctionId, oldTime);
-        CharacterDatabase.PExecute(
-            "INSERT INTO `ah_worker_journal` "
-            "(`uuid`,`auction_id`,`kind`,`state`,`facts`,`created_time`,`resolved_time`) "
-            "VALUES (970084,%u,%u,1,'00'," UI64FMTD "," UI64FMTD ")",
-            failedAuctionId, uint32(IPC_PLAYER_CANCEL & 0xFFu),
-            oldTime, oldTime);
-        if (!CharacterDatabase.CommitTransactionChecked())
-        {
-            printf("custody FAIL: failed-replay fixtures did not commit\n");
-            pass = false;
-        }
-
-        TestCliCapture failedCapture;
-        CliHandler failedCli(0, SEC_ADMINISTRATOR,
-                             &failedCapture, &TestCliPrint);
-        failedCli.ParseCommands("ah repair apply");
-        CustodyRow failedRow;
-        if (CountCliChunks(failedCapture,
-                "mode=apply confirmed=1 pending=0 sweep-owned=0 repaired=0 skipped=0 failed=1") != 1 ||
-            !CustodyLedger::Get("test:repair:failed", failedRow) ||
-            failedRow.state != CST_RESERVED)
-        {
-            printf("custody FAIL: failed repair summary/state mismatch\n");
-            pass = false;
-        }
-
-        CharacterDatabase.DirectPExecute(
-            "DELETE FROM `custody_ledger` WHERE `idem_key`='test:repair:failed'");
-        CharacterDatabase.DirectPExecute(
-            "DELETE FROM `ah_worker_journal` WHERE `auction_id`=%u",
-            failedAuctionId);
-    }
-
-    // One budget spans scan and action details. Exact totals remain uncapped.
-    {
-        CharacterDatabase.DirectExecute(
-            "DELETE FROM `custody_ledger` WHERE `idem_key` LIKE 'test:repair:budget:%'");
-        CharacterDatabase.BeginTransaction();
-        for (uint32 i = 0; i < 101; ++i)
-        {
-            CharacterDatabase.PExecute(
-                "INSERT INTO `custody_ledger` "
-                "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-                "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-                "VALUES ('test:repair:budget:%u',0,1,0,1,0,%u,0,%u," UI64FMTD ",0)",
-                i, 100 + i, 974000 + i, oldTime);
-        }
-        if (!CharacterDatabase.CommitTransactionChecked())
-        {
-            printf("custody FAIL: repair budget fixtures failed to commit\n");
-            pass = false;
-        }
-
-        TestCliCapture dryCapture;
-        CliHandler dryCli(0, SEC_ADMINISTRATOR, &dryCapture, &TestCliPrint);
-        if (!dryCli.ParseCommands("ah repair --dry-run") ||
-            CountCliChunks(dryCapture, "ah repair detail:") != 100 ||
-            CountCliChunks(dryCapture, "detail(s) suppressed") != 1 ||
-            CountCliChunks(dryCapture,
-                "mode=dry-run confirmed=101 pending=0 sweep-owned=0 repaired=0 skipped=0 failed=0") != 1)
-        {
-            printf("custody FAIL: dry-run detail cap or totals mismatch\n");
-            pass = false;
-        }
-
-        TestCliCapture boundedApplyCapture;
-        CliHandler boundedApplyCli(0, SEC_ADMINISTRATOR,
-                                   &boundedApplyCapture, &TestCliPrint);
-        if (!boundedApplyCli.ParseCommands("ah repair apply") ||
-            CountCliChunks(boundedApplyCapture, "ah repair detail:") +
-                CountCliChunks(boundedApplyCapture, "ah repair action:") != 100 ||
-            CountCliChunks(boundedApplyCapture, "detail(s) suppressed") != 1 ||
-            CountCliChunks(boundedApplyCapture,
-                "mode=apply confirmed=101 pending=0 sweep-owned=0 repaired=101 skipped=0 failed=0") != 1)
-        {
-            printf("custody FAIL: apply shared detail cap or totals mismatch\n");
-            pass = false;
-        }
-
-        std::unique_ptr<QueryResult> reserved(CharacterDatabase.Query(
-            "SELECT COUNT(*) FROM `custody_ledger` "
-            "WHERE `idem_key` LIKE 'test:repair:budget:%' AND `state`=0"));
-        if (!reserved || reserved->Fetch()[0].GetUInt32() != 0)
-        {
-            printf("custody FAIL: bounded apply did not repair all 101 rows\n");
-            pass = false;
-        }
-
-        CharacterDatabase.DirectExecute(
-            "DELETE FROM `custody_ledger` WHERE `idem_key` LIKE 'test:repair:budget:%'");
-    }
-
-    // ================================================================ primitive
-    // Primitive round-trip: offline owner (no ModifyMoney),
-    // ReserveGold -> RollbackGoldLedgerOnly -> assert no mail.
-
-    // Clean slate for the primitive sub-test.
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `custody_ledger` WHERE `idem_key` LIKE 'test:rg%%'");
-
-    // ------------------------------------------------------------------ prim 1
-    // ReserveGold with offline owner: inserts RESERVED row, no money debit.
-    {
-        CharacterDatabase.BeginTransaction();
-        CustodyDeferred def;
-        CustodyService::ReserveGold(def, 1, NULL, 50, "test:rg:1", 999,
-                                    uint8(ROLE_BID));
-        bool ok = CharacterDatabase.CommitTransactionChecked();
-        if (!ok)
-        {
-            printf("custody FAIL: prim 1 ReserveGold CommitTransactionChecked returned false\n");
-            pass = false;
-        }
-        def.run();
-    }
-
-    // ------------------------------------------------------------------ prim 2
-    // Row must be visible: state CST_RESERVED, amount 50.
-    {
-        CustodyRow row;
-        bool found = CustodyLedger::Get("test:rg:1", row);
-        if (!found)
-        {
-            printf("custody FAIL: prim 2 Get returned false (row not found)\n");
-            pass = false;
-        }
-        else
-        {
-            if (row.state != CST_RESERVED)
-            {
-                printf("custody FAIL: prim 2 state expected %u got %u\n",
-                    uint32(CST_RESERVED), uint32(row.state));
-                pass = false;
-            }
-            if (row.amount != 50)
-            {
-                printf("custody FAIL: prim 2 amount expected 50 got %u\n",
-                    row.amount);
-                pass = false;
-            }
-        }
-    }
-
-    // ------------------------------------------------------------------ prim 3
-    // RollbackGoldLedgerOnly: ledger-only, no mail; state must flip to BACK.
-    {
-        CharacterDatabase.BeginTransaction();
-        CustodyService::RollbackGoldLedgerOnly("test:rg:1");
-        bool ok = CharacterDatabase.CommitTransactionChecked();
-        if (!ok)
-        {
-            printf("custody FAIL: prim 3 RollbackGoldLedgerOnly CommitTransactionChecked returned false\n");
-            pass = false;
-        }
-
-        CustodyRow row;
-        bool found = CustodyLedger::Get("test:rg:1", row);
-        if (!found)
-        {
-            printf("custody FAIL: prim 3 Get returned false after RollbackGoldLedgerOnly\n");
-            pass = false;
-        }
-        else if (row.state != CST_TERMINAL_BACK)
-        {
-            printf("custody FAIL: prim 3 state expected %u got %u\n",
-                uint32(CST_TERMINAL_BACK), uint32(row.state));
-            pass = false;
-        }
-    }
-
-    // ------------------------------------------------------------------ prim 4
-    // The ledger-only rollback must NOT have sent any mail for receiver 1.
-    {
-        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
-            "SELECT COUNT(*) FROM `mail` WHERE `receiver`=1"
-            " AND `subject` LIKE 'test:rg%%'"));
-        uint64 cnt = res ? res->Fetch()[0].GetUInt64() : 0u;
-        if (cnt != 0)
-        {
-            printf("custody FAIL: prim 4 ledger-only rollback sent unexpected mail"
-                   " (count=%u)\n", uint32(cnt));
-            pass = false;
-        }
-    }
-
-    // ------------------------------------------------------------------ final cleanup
-    // Remove all test:% rows from both runs.
-    CharacterDatabase.BeginTransaction();
-    CharacterDatabase.PExecute(
-        "DELETE FROM `custody_ledger` WHERE `idem_key` LIKE 'test:%%'");
-    CharacterDatabase.CommitTransactionChecked();
-
-    if (pass)
-    {
-        printf("custody OK\n");
-        return 0;
-    }
-
-    return 2;
-}
-
-/// Self-test for the AH bot forged system owner: proves GetPlayerGuidByName
-/// returns the sentinel GUID for the reserved name without a DB row, that the
-/// match is case-insensitive, and that ordinary non-existent names still fall
-/// through to an empty guid. Returns 0 on pass, non-zero on fail.
-static int RunAhOwnerTest()
-{
-    // Task 1: GetPlayerGuidByName intercepts the forged system name -> sentinel,
-    // case-insensitively, with NO dependency on a characters row.
-    {
-        ObjectGuid g = sObjectMgr.GetPlayerGuidByName(AHBOT_SYSTEM_OWNER_NAME);
-        if (!g.IsPlayer() || g.GetCounter() != AHBOT_SYSTEM_OWNER_GUID)
-        {
-            printf("ahowner FAIL: GetPlayerGuidByName(\"AuctionHouse\") did not return the sentinel\n");
-            return 1;
-        }
-        ObjectGuid gl = sObjectMgr.GetPlayerGuidByName("auctionhouse");
-        if (gl.GetCounter() != AHBOT_SYSTEM_OWNER_GUID)
-        {
-            printf("ahowner FAIL: name match is not case-insensitive\n");
-            return 1;
-        }
-        // a clearly-nonexistent ordinary name must still fall through to 0.
-        ObjectGuid none = sObjectMgr.GetPlayerGuidByName("Zzqxnonexistentname");
-        if (none)
-        {
-            printf("ahowner FAIL: non-system name unexpectedly resolved\n");
-            return 1;
-        }
-    }
-
-    // Task 2: the player-GUID allocator never hands out the reserved sentinel.
-    if (SkipAhBotSystemOwnerGuid(AHBOT_SYSTEM_OWNER_GUID) != AHBOT_SYSTEM_OWNER_GUID + 1)
-    {
-        printf("ahowner FAIL: SkipAhBotSystemOwnerGuid did not step past the sentinel\n");
-        return 1;
-    }
-    if (SkipAhBotSystemOwnerGuid(42u) != 42u)
-    {
-        printf("ahowner FAIL: SkipAhBotSystemOwnerGuid altered a normal GUID\n");
-        return 1;
-    }
-
-    // Task 3: the forged system name is always reserved from players, even if
-    // the reserved_name table is empty (self-healing across wipes).
-    sObjectMgr.LoadReservedPlayersNames();
-    if (!sObjectMgr.IsReservedName(AHBOT_SYSTEM_OWNER_NAME))
-    {
-        printf("ahowner FAIL: \"AuctionHouse\" is not reserved after load\n");
-        return 1;
-    }
-
-    // Task 4: the system-owner guid predicate the mail-gate keys on.
-    if (!IsAhBotSystemOwnerGuid(ObjectGuid(HIGHGUID_PLAYER, AHBOT_SYSTEM_OWNER_GUID)))
-    {
-        printf("ahowner FAIL: IsAhBotSystemOwnerGuid false for the sentinel\n");
-        return 1;
-    }
-    if (IsAhBotSystemOwnerGuid(ObjectGuid(HIGHGUID_PLAYER, 7u)))
-    {
-        printf("ahowner FAIL: IsAhBotSystemOwnerGuid true for a normal guid\n");
-        return 1;
-    }
-
-    // Task 5: the supervisor refuses to spawn (no restart loop) when the bot
-    // GUID is unresolved (0).
-    {
-        WorkerSupervisor sup("ahowner-test", "nonexistent-exe", 0, "secret", 0 /*botGuid*/, "nonexistent.conf");
-        if (sup.Start())
-        {
-            printf("ahowner FAIL: WorkerSupervisor::Start succeeded with botGuid 0\n");
-            return 1;
-        }
-    }
-
-    printf("ahowner OK\n");
-    return 0;
-}
-
-namespace
-{
-    struct RefCtx
-    {
-        const uint16* skills;
-        const uint32* skillIds;
-        size_t nSkills;
-        const uint32* spells;
-        size_t nSpells;
-        const uint32* repFactions;
-        const uint8* repRanks;
-        size_t nReps;
-    };
-
-    uint16 RefSkill(void* c, uint32 id)
-    {
-        RefCtx* x = (RefCtx*)c;
-        for (size_t i = 0; i < x->nSkills; ++i)
-        {
-            if (x->skillIds[i] == id)
-            {
-                return x->skills[i];
-            }
-        }
-        return 0;
-    }
-    bool RefSpell(void* c, uint32 id)
-    {
-        RefCtx* x = (RefCtx*)c;
-        for (size_t i = 0; i < x->nSpells; ++i)
-        {
-            if (x->spells[i] == id)
-            {
-                return true;
-            }
-        }
-        return false;
-    }
-    uint8 RefRep(void* c, uint32 f)
-    {
-        RefCtx* x = (RefCtx*)c;
-        for (size_t i = 0; i < x->nReps; ++i)
-        {
-            if (x->repFactions[i] == f)
-            {
-                return x->repRanks[i];
-            }
-        }
-        return 0;
-    }
-}
-
-/// Self-test for AhUsabilityRef::Evaluate: drives the production reference
-/// evaluator over a battery of synthetic profiles. Returns 0 on pass.
-static int RunAhUsabilityRefTest()
-{
-    uint32 skillIds[1] = { 43u };
-    uint16 skills[1]   = { 200u };
-    uint32 spells[1]   = { 123u };
-    uint32 repF[1]     = { 609u };
-    uint8  repR[1]     = { 5u };
-    RefCtx ctx;
-    ctx.skills      = skills;
-    ctx.skillIds    = skillIds;
-    ctx.nSkills     = 1;
-    ctx.spells      = spells;
-    ctx.nSpells     = 1;
-    ctx.repFactions = repF;
-    ctx.repRanks    = repR;
-    ctx.nReps       = 1;
-
-    // warrior (class 1) / human (race 1); level 40; honor rank 2
-    const uint32 cm    = 1u << (1u - 1u);
-    const uint32 rm    = 1u << (1u - 1u);
-    const uint32 level = 40u;
-    const uint32 honor = 2u;
-    const uint32 MM    = 40u;
-    const uint32 EM    = 60u;
-
-    AhRefItem it;
-    it.itemClass            = 2u;
-    it.allowableClass       = 0xFFFFFFFFu;
-    it.allowableRace        = 0xFFFFFFFFu;
-    it.requiredLevel        = 30u;
-    it.itemId               = 12345u;
-    it.requiredSkill        = 43u;
-    it.requiredSkillRank    = 150u;
-    it.requiredSpell        = 0u;
-    it.requiredHonorRank    = 0u;
-    it.requiredRepFaction   = 0u;
-    it.requiredRepRank      = 0u;
-    it.itemProficiencySkill = 43u;
-
-    // baseline: everything satisfied
-    if (AhUsabilityRef::Evaluate(cm, rm, level, honor, true, MM, EM, it,
-                                 RefSkill, RefSpell, RefRep, &ctx) != AHUSE_OK)
-    {
-        printf("ahusabilityref FAIL: baseline\n");
-        return 1;
-    }
-
-    // class gate: wrong class mask
-    AhRefItem b = it;
-    b.allowableClass = 0x80u;
-    if (AhUsabilityRef::Evaluate(cm, rm, level, honor, true, MM, EM, b,
-                                 RefSkill, RefSpell, RefRep, &ctx) == AHUSE_OK)
-    {
-        printf("ahusabilityref FAIL: class gate\n");
-        return 1;
-    }
-
-    // honor gate fires when direct_action=true and rank is insufficient
-    b = it;
-    b.requiredHonorRank = 5u;
-    if (AhUsabilityRef::Evaluate(cm, rm, level, honor, true, MM, EM, b,
-                                 RefSkill, RefSpell, RefRep, &ctx) == AHUSE_OK)
-    {
-        printf("ahusabilityref FAIL: honor gate (direct_action)\n");
-        return 1;
-    }
-    // D2: honor gate must NOT fire when direct_action=false
-    if (AhUsabilityRef::Evaluate(cm, rm, level, honor, false, MM, EM, b,
-                                 RefSkill, RefSpell, RefRep, &ctx) != AHUSE_OK)
-    {
-        printf("ahusabilityref FAIL: honor must be skipped when !direct_action\n");
-        return 1;
-    }
-
-    // reputation gate: player rep rank 5, item requires 7
-    b = it;
-    b.requiredRepFaction = 609u;
-    b.requiredRepRank    = 7u;
-    if (AhUsabilityRef::Evaluate(cm, rm, level, honor, true, MM, EM, b,
-                                 RefSkill, RefSpell, RefRep, &ctx) == AHUSE_OK)
-    {
-        printf("ahusabilityref FAIL: reputation gate\n");
-        return 1;
-    }
-
-    // epic mount override: item 12302 bumps requiredLevel to EM(60); player is 40
-    b = it;
-    b.itemId         = 12302u;
-    b.requiredLevel  = 30u;
-    if (AhUsabilityRef::Evaluate(cm, rm, level, honor, true, MM, EM, b,
-                                 RefSkill, RefSpell, RefRep, &ctx) == AHUSE_OK)
-    {
-        printf("ahusabilityref FAIL: epic-mount override\n");
-        return 1;
-    }
-
-    printf("ahusabilityref OK\n");
-    return 0;
-}
-
-/// Smoke test for the in-process browse helper (dispatch shape + order contract).
-/// Does NOT require a live Player or world data: it exercises only the
-/// client-outbid-prepend order invariant via the AhAppendClientOutbidsForTest
-/// seam, proving that BuildListForKind will prepend outbid ids in CLIENT ORDER
-/// before calling BuildListBidderItems. Returns 0 on pass, non-zero on fail.
-static int RunAhBrowseHelperTest()
-{
-    // The bidder client-outbid-prepend is extracted as a free helper so it can
-    // be tested without a Player. It appends each client outbid auction id in
-    // CLIENT ORDER ahead of the sweep (matches HandleAuctionListBidderItems).
-    // Here we assert the ORDER-PRESERVING contract over a stub appender.
-    std::vector<uint32> clientIds;
-    clientIds.push_back(7u);
-    clientIds.push_back(3u);
-    clientIds.push_back(9u);
-    std::vector<uint32> appended;
-    AhAppendClientOutbidsForTest(clientIds, appended);
-    if (appended.size() != 3u || appended[0] != 7u || appended[1] != 3u || appended[2] != 9u)
-    {
-        printf("ahbrowsehelper FAIL: client outbid order not preserved\n");
-        return 1;
-    }
-    printf("ahbrowsehelper OK\n");
-    return 0;
-}
-
-/// Self-test for the SP-1 browse pending-map + SMSG assembly: exercises
-/// Register/Take/Sweep, per-(char,kind) sequencing, and AhAssembleBrowseListBody.
-/// No DB / world data needed. Returns 0 on pass, non-zero on fail.
-static int RunAhBrowsePendingTest()
-{
-    BrowsePendingMap pend;
-    PendingBrowse a; a.accountId=1001u; a.playerGuidLow=5001u; a.kind=uint8(BROWSE_LIST);
-    a.seq = pend.NextSeqFor(5001u, uint8(BROWSE_LIST));
-    uint64 id1 = pend.Register(a, 100u);
-    PendingBrowse b; b.accountId=1002u; b.playerGuidLow=5002u; b.kind=uint8(BROWSE_OWNER);
-    b.seq = pend.NextSeqFor(5002u, uint8(BROWSE_OWNER));
-    uint64 id2 = pend.Register(b, 100u);
-    if (id1 == id2 || pend.Size() != 2u)
-    {
-        printf("ahbrowsepending FAIL: register\n");
-        return 1;
-    }
-
-    PendingBrowse got;
-    if (!pend.Take(id1, got) || got.accountId!=1001u || got.playerGuidLow!=5001u ||
-        got.kind != uint8(BROWSE_LIST))
-    {
-        printf("ahbrowsepending FAIL: Take(id1)\n");
-        return 1;
-    }
-    if (pend.Take(id1, got))
-    {
-        printf("ahbrowsepending FAIL: Take twice\n");
-        return 1;
-    }
-
-    // Per-(char,kind) sequencing: a newer search bumps the seq; the older seq
-    // is no longer current (a stale timeout for it must be ignored).
-    uint32 newSeq = pend.NextSeqFor(5002u, uint8(BROWSE_OWNER));   // newer than b.seq
-    if (pend.IsCurrent(5002u, uint8(BROWSE_OWNER), b.seq))
-    {
-        printf("ahbrowsepending FAIL: stale seq still current\n");
-        return 1;
-    }
-    if (!pend.IsCurrent(5002u, uint8(BROWSE_OWNER), newSeq))
-    {
-        printf("ahbrowsepending FAIL: newest seq not current\n");
-        return 1;
-    }
-
-    // TTL sweep collects the timed-out entry (id2) for in-process fallback.
-    std::vector<PendingBrowse> timedOut;
-    pend.Sweep(100u + 10u + 1u, 10u, timedOut);
-    if (pend.Size() != 0u || timedOut.size() != 1u || timedOut[0].accountId != 1002u)
-    {
-        printf("ahbrowsepending FAIL: sweep\n");
-        return 1;
-    }
-
-    // Stale-seq guard on the sweep path: after a newer search is issued, the
-    // swept entry's seq (b.seq) is NOT current -- the fallback must be ignored.
-    // Bump the seq (simulates a newer search that arrived before the sweep ran).
-    uint32 postSweepSeq = pend.NextSeqFor(5002u, uint8(BROWSE_OWNER));
-    if (pend.IsCurrent(5002u, uint8(BROWSE_OWNER), b.seq))
-    {
-        printf("ahbrowsepending FAIL: swept stale seq still current\n");
-        return 1;
-    }
-    if (!pend.IsCurrent(5002u, uint8(BROWSE_OWNER), postSweepSeq))
-    {
-        printf("ahbrowsepending FAIL: postSweepSeq not current\n");
-        return 1;
-    }
-
-    // SMSG assembly preserves the worker's complete bidder order, including a
-    // duplicate auction id, and writes the worker-provided totalcount.
-    {
-        std::vector<BrowseEntry> entries;
-        const uint32 orderedIds[] = { 9u, 3u, 9u, 7u };
-        for (size_t i = 0; i < 4u; ++i)
-        {
-            BrowseEntry e;
-            e.id=orderedIds[i]; e.itemEntry=19019u; e.enchantId=0u;
-            e.randomPropId=0u; e.suffixFactor=0u; e.count=1u;
-            e.charges=0; e.ownerGuidLow=4u; e.startbid=100u;
-            e.outbid=0u; e.buyout=5000u; e.timeLeftMs=720000u;
-            e.bidderGuidLow=0u; e.curBid=100u;
-            entries.push_back(e);
-        }
-        ByteBuffer body;
-        AhAssembleBrowseListBody(entries, 4u, body);
-        uint32 c=0; body >> c;
-        if (c != 4u)
-        {
-            printf("ahbrowsepending FAIL: assembled count %u\n",
-                   unsigned(c));
-            return 1;
-        }
-        uint32 dummy32 = 0; uint64 dummy64 = 0;
-        for (size_t i = 0; i < 4u; ++i)
-        {
-            uint32 id = 0; body >> id;
-            if (id != orderedIds[i])
-            {
-                printf("ahbrowsepending FAIL: ordered id[%u]=%u\n",
-                       unsigned(i), unsigned(id));
-                return 1;
-            }
-            body >> dummy32 >> dummy32 >> dummy32;
-            body >> dummy32 >> dummy32 >> dummy32;
-            body >> dummy64;
-            body >> dummy32 >> dummy32 >> dummy32 >> dummy32;
-            body >> dummy64;
-            body >> dummy32;
-        }
-        uint32 totalcount = 0; body >> totalcount;
-        if (totalcount != 4u)
-        {
-            printf("ahbrowsepending FAIL: totalcount %u\n",
-                   unsigned(totalcount));
-            return 1;
-        }
-        (void)dummy32; (void)dummy64;
-    }
-
-    printf("ahbrowsepending OK\n");
-    return 0;
-}
-
-/// Self-test for the SP-2 MutationPendingMap (spec 5.5): apply-all consume-once,
-/// per-player + total caps checked BEFORE any reserve, cancel-phase rearm, and
-/// the TTL sweep that tombstones in-doubt entries (emitting each newly-in-doubt
-/// uuid exactly once for the AUCTION_ERR_DATABASE result). Pure in-memory; no
-/// DB rows, no worker. Returns 0 on pass, non-zero on fail.
-static int RunAhMutPendingTest()
-{
-    MutationPendingMap pend;
-
-    // Mint sanity: two uuids differ and carry a nonzero (boot-second) high word,
-    // keeping them disjoint from worker-minted (runId << 32) | seq uuids.
-    uint64 u1 = AhMintMutationUuid();
-    uint64 u2 = AhMintMutationUuid();
-    if (u1 == u2 || (u1 >> 32) == 0u)
-    {
-        printf("ahmutpending FAIL: uuid mint\n");
-        return 1;
-    }
-
-    // (a) cap-before-reserve: MAX_PER_PLAYER entries fill player 100's slot;
-    // the next CanRegister is refused BEFORE any reserve would happen, while
-    // another player is unaffected.
-    std::vector<uint64> uuids;
-    for (size_t i = 0; i < MutationPendingMap::MAX_PER_PLAYER; ++i)
-    {
-        if (!pend.CanRegister(100u))
-        {
-            printf("ahmutpending FAIL: CanRegister refused below cap\n");
-            return 1;
-        }
-
-        PendingMutation pm;
-        pm.uuid           = AhMintMutationUuid();
-        pm.playerGuidLow  = 100u;
-        pm.op             = uint16(IPC_PLAYER_BID);
-        pm.auctionId      = uint32(9000u + i);
-        pm.state          = uint8(PMUT_AWAIT_RESULT);
-        pm.sentSec        = 1000u;
-        pm.reservedAmount = 55u;
-        pm.reserveKey     = "bid:9000:1";
-        pm.itemKey.clear();
-        pm.depKey.clear();
-        pend.Register(pm);
-        uuids.push_back(pm.uuid);
-    }
-    if (pend.CanRegister(100u))
-    {
-        printf("ahmutpending FAIL: per-player cap not enforced\n");
-        return 1;
-    }
-    if (!pend.CanRegister(101u))
-    {
-        printf("ahmutpending FAIL: cap leaked to another player\n");
-        return 1;
-    }
-
-    // (b) consume-once: Take returns the entry once, then never again; the
-    // per-player slot is released.
-    PendingMutation got;
-    if (!pend.Take(uuids[0], got) || got.playerGuidLow != 100u ||
-        got.op != uint16(IPC_PLAYER_BID) || got.reservedAmount != 55u ||
-        got.reserveKey != "bid:9000:1")
-    {
-        printf("ahmutpending FAIL: Take(first)\n");
-        return 1;
-    }
-    if (pend.Take(uuids[0], got))
-    {
-        printf("ahmutpending FAIL: Take twice\n");
-        return 1;
-    }
-    if (!pend.CanRegister(100u))
-    {
-        printf("ahmutpending FAIL: slot not released after Take\n");
-        return 1;
-    }
-
-    // (c) rearm (cancel phase 2, spec 4.2): AWAIT_RESULT (== AWAIT_PREPARE for
-    // cancels) -> AWAIT_CONFIRM in the SAME cap slot, with a fresh TTL anchor.
-    pend.RearmConfirm(uuids[1], 2000u);
-    if (!pend.Peek(uuids[1], got) || got.state != uint8(PMUT_AWAIT_CONFIRM) ||
-        got.sentSec != 2000u)
-    {
-        printf("ahmutpending FAIL: RearmConfirm\n");
-        return 1;
-    }
-
-    // (d) explicit tombstone: the entry STAYS (in-doubt, reservation
-    // non-terminal); Tombstone on a missing uuid reports false.
-    if (!pend.Tombstone(uuids[2]))
-    {
-        printf("ahmutpending FAIL: Tombstone(existing)\n");
-        return 1;
-    }
-    if (pend.Tombstone(0xDEADBEEFull))
-    {
-        printf("ahmutpending FAIL: Tombstone(missing) returned true\n");
-        return 1;
-    }
-
-    // (e) sweep-to-tombstone: at now=2005 with ttl=10, entries stamped 1000 are
-    // overdue EXCEPT the rearmed one (sentSec 2000). Already-tombstoned entries
-    // are NOT re-emitted (their AUCTION_ERR_DATABASE was already sent).
-    // Registered survivors: uuids[1..7]; uuids[1] fresh, uuids[2] pre-tombstoned
-    // -> exactly uuids[3..7] (5) are newly in doubt.
-    std::vector<uint64> inDoubt;
-    pend.SweepToTombstones(2005u, 10u, inDoubt);
-    if (inDoubt.size() != 5u)
-    {
-        printf("ahmutpending FAIL: sweep emitted %u (want 5)\n", unsigned(inDoubt.size()));
-        return 1;
-    }
-    for (size_t i = 0; i < inDoubt.size(); ++i)
-    {
-        if (inDoubt[i] == uuids[1] || inDoubt[i] == uuids[2])
-        {
-            printf("ahmutpending FAIL: sweep emitted a fresh/tombstoned uuid\n");
-            return 1;
-        }
-    }
-    // A second sweep emits nothing new (everything overdue is tombstoned).
-    inDoubt.clear();
-    pend.SweepToTombstones(2005u, 10u, inDoubt);
-    if (!inDoubt.empty())
-    {
-        printf("ahmutpending FAIL: second sweep re-emitted\n");
-        return 1;
-    }
-    // Late reply against a tombstone still applies (apply-all): Take consumes it.
-    if (!pend.Take(uuids[2], got) || got.state != uint8(PMUT_TOMBSTONE))
-    {
-        printf("ahmutpending FAIL: Take(tombstone)\n");
-        return 1;
-    }
-
-    // (f) MAX_TOTAL: fill a fresh map to the global cap across many players
-    // (4 per player, under the per-player cap); a fresh player is then refused.
-    MutationPendingMap full;
-    for (size_t i = 0; i < MutationPendingMap::MAX_TOTAL; ++i)
-    {
-        PendingMutation pm;
-        pm.uuid           = 0x100000000ull + i;
-        pm.playerGuidLow  = uint32(1000u + (i / 4u));
-        pm.op             = uint16(IPC_PLAYER_SELL);
-        pm.auctionId      = uint32(i + 1u);
-        pm.state          = uint8(PMUT_AWAIT_RESULT);
-        pm.sentSec        = 1u;
-        pm.reservedAmount = 0u;
-        pm.reserveKey.clear();
-        pm.itemKey.clear();
-        pm.depKey.clear();
-        full.Register(pm);
-    }
-    if (full.CanRegister(999999u))
-    {
-        printf("ahmutpending FAIL: MAX_TOTAL not enforced\n");
-        return 1;
-    }
-
-    printf("ahmutpending OK\n");
-    return 0;
-}
-
-/// DB-level self-test for the SP-2 forward-path reserve shapes (Task 10), no
-/// live worker and no Player: owner guid 1 is offline so ReserveGold takes the
-/// ledger-only path. Covers (a) the sell reserve pair item:<id> + dep:<id> in
-/// ONE checked txn plus its pending registration, and (b) the bid classifier
-/// AhClassifyBidForward against real ledger rows: no row -> IPC_PLAYER_BUYOUT
-/// full reserve; own live row -> IPC_PLAYER_BUYOUT delta; price <= own live bid
-/// -> 0 (inline ERR_HIGHER_BID); another owner's row -> BUYOUT full;
-/// ambiguous (two live rows) -> BUYOUT full. Returns 0 on pass.
-static int RunAhForwardReserveTest()
-{
-    bool pass = true;
-
-    CharacterDatabase.AllowAsyncTransactions();
-
-    uint32 const sellId = 990001u;   // synthetic ids far above live data
-    uint32 const bidId  = 990002u;
-
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `custody_ledger` WHERE `auction_id` IN (990001, 990002)");
-
-    // ---- (a) sell shape: escrow + deposit reserve, one checked txn ----
-    MutationPendingMap pend;
-    if (!pend.CanRegister(1u))
-    {
-        printf("ahforwardreserve FAIL: CanRegister(empty)\n");
-        pass = false;
-    }
-
-    std::string const sellIdStr = std::to_string(sellId);
-    CharacterDatabase.BeginTransaction();
-    CustodyService::EscrowItem(1u, 424242u, "item:" + sellIdStr, sellId);
-    CustodyService::ReserveGoldAlreadyDebited(1u, 77u, "dep:" + sellIdStr, sellId, ROLE_DEPOSIT);
-    if (!CharacterDatabase.CommitTransactionChecked())
-    {
-        printf("ahforwardreserve FAIL: sell reserve txn\n");
-        pass = false;
-    }
-
-    CustodyRow row;
-    if (!CustodyLedger::Get("item:" + sellIdStr, row) ||
-        row.kind != CUSTODY_ITEM || row.state != CST_RESERVED ||
-        row.itemGuid != 424242u || row.auctionId != sellId)
-    {
-        printf("ahforwardreserve FAIL: item row shape\n");
-        pass = false;
-    }
-    if (!CustodyLedger::Get("dep:" + sellIdStr, row) ||
-        row.kind != CUSTODY_GOLD || row.role != ROLE_DEPOSIT ||
-        row.state != CST_RESERVED || row.amount != 77u)
-    {
-        printf("ahforwardreserve FAIL: dep row shape\n");
-        pass = false;
-    }
-
-    uint64 const sellUuid = AhMintMutationUuid();
-    PendingMutation pm;
-    pm.uuid           = sellUuid;
-    pm.playerGuidLow  = 1u;
-    pm.op             = uint16(IPC_PLAYER_SELL);
-    pm.auctionId      = sellId;
-    pm.state          = uint8(PMUT_AWAIT_RESULT);
-    pm.sentSec        = uint32(time(NULL));
-    pm.reservedAmount = 0u;
-    pm.reserveKey.clear();
-    pm.itemKey        = "item:" + sellIdStr;
-    pm.depKey         = "dep:" + sellIdStr;
-    pend.Register(pm);
-
-    PendingMutation got;
-    if (!pend.Take(sellUuid, got) || got.itemKey != "item:" + sellIdStr ||
-        got.depKey != "dep:" + sellIdStr || got.op != uint16(IPC_PLAYER_SELL))
-    {
-        printf("ahforwardreserve FAIL: sell pending registration\n");
-        pass = false;
-    }
-
-    // ---- (a2) cancel shape: no legacy AuctionsMap/AuctionEntry state needed ----
-    MutationPendingMap cancelPend;
-    uint64 const cancelUuid = UINT64_C(0xCA00000000000043);
-    IpcMessage cancelFrame;
-    if (!AhBuildCancelPrepareForward(cancelPend, 1u, sellId, cancelUuid, 1234u,
-                                     cancelFrame))
-    {
-        printf("ahforwardreserve FAIL: cancel forward helper refused empty map\n");
-        pass = false;
-    }
-    if (cancelFrame.op != IPC_PLAYER_CANCEL)
-    {
-        printf("ahforwardreserve FAIL: cancel forward opcode\n");
-        pass = false;
-    }
-    PlayerCancelPrepare cancelIntent;
-    if (!cancelIntent.Decode(cancelFrame.body) ||
-        cancelIntent.uuid != cancelUuid || cancelIntent.auctionId != sellId ||
-        cancelIntent.sellerGuid != 1u)
-    {
-        printf("ahforwardreserve FAIL: cancel forward body\n");
-        pass = false;
-    }
-    PendingMutation cancelPm;
-    if (!cancelPend.Take(cancelUuid, cancelPm) ||
-        cancelPm.playerGuidLow != 1u ||
-        cancelPm.op != uint16(IPC_PLAYER_CANCEL) ||
-        cancelPm.auctionId != sellId ||
-        cancelPm.state != uint8(PMUT_AWAIT_RESULT) ||
-        cancelPm.sentSec != 1234u ||
-        cancelPm.reservedAmount != 0u ||
-        !cancelPm.reserveKey.empty() ||
-        !cancelPm.itemKey.empty() ||
-        !cancelPm.depKey.empty())
-    {
-        printf("ahforwardreserve FAIL: cancel pending shape\n");
-        pass = false;
-    }
-
-    // ---- (b) bid classifier: no live row -> BUYOUT, full reserve ----
-    uint32 reserveAmount = 0u;
-    if (AhClassifyBidForward(bidId, 1u, 500u, reserveAmount) != uint16(IPC_PLAYER_BUYOUT) ||
-        reserveAmount != 500u)
-    {
-        printf("ahforwardreserve FAIL: classify(no row)\n");
-        pass = false;
-    }
-
-    // Seed guid 1's live bid of 500 with the handler's key scheme, one txn.
-    std::string const bidKey = "bid:" + std::to_string(bidId) + ":" +
-                               std::to_string(CustodyLedger::NextBidSeq(bidId));
-    {
-        CustodyDeferred def;
-        CharacterDatabase.BeginTransaction();
-        CustodyService::ReserveGold(def, 1u, NULL, 500u, bidKey, bidId, ROLE_BID);
-        if (!CharacterDatabase.CommitTransactionChecked())
-        {
-            printf("ahforwardreserve FAIL: bid reserve txn\n");
-            pass = false;
-        }
-    }
-    if (!CustodyLedger::GetSingleLiveBidRow(bidId, row) ||
-        row.idemKey != bidKey || row.ownerGuid != 1u || row.amount != 500u)
-    {
-        printf("ahforwardreserve FAIL: single live bid row\n");
-        pass = false;
-    }
-
-    // Holder raise/top-up 500 -> 600: route on IPC_PLAYER_BUYOUT with the
-    // delta reserve. The worker treats a below-buyout 0x42 as a normal bid,
-    // while an at/over-buyout 0x42 becomes the buyout win; both preserve the
-    // same ledger delta semantics and avoid at-buyout 0x41 protocol faults.
-    if (AhClassifyBidForward(bidId, 1u, 600u, reserveAmount) != uint16(IPC_PLAYER_BUYOUT) ||
-        reserveAmount != 100u)
-    {
-        printf("ahforwardreserve FAIL: classify(raise delta)\n");
-        pass = false;
-    }
-    // Holder "raise" to own bid: 0 -> inline legacy ERR_HIGHER_BID.
-    if (AhClassifyBidForward(bidId, 1u, 500u, reserveAmount) != 0u)
-    {
-        printf("ahforwardreserve FAIL: classify(price <= own bid)\n");
-        pass = false;
-    }
-    // Another player: BUYOUT, full reserve (worker adjudicates, spec I6).
-    if (AhClassifyBidForward(bidId, 2u, 600u, reserveAmount) != uint16(IPC_PLAYER_BUYOUT) ||
-        reserveAmount != 600u)
-    {
-        printf("ahforwardreserve FAIL: classify(other bidder)\n");
-        pass = false;
-    }
-
-    // A raise-in-flight adds a SECOND live ROLE_BID row (the delta reserve);
-    // exactly-one is then violated and the classifier falls back to BUYOUT
-    // full reserve -- a value-safe over-reserve (transient, spec 12).
-    std::string const deltaKey = "bid:" + std::to_string(bidId) + ":" +
-                                 std::to_string(CustodyLedger::NextBidSeq(bidId));
-    {
-        CustodyDeferred def;
-        CharacterDatabase.BeginTransaction();
-        CustodyService::ReserveGold(def, 1u, NULL, 100u, deltaKey, bidId, ROLE_BID);
-        if (!CharacterDatabase.CommitTransactionChecked())
-        {
-            printf("ahforwardreserve FAIL: delta reserve txn\n");
-            pass = false;
-        }
-    }
-    if (CustodyLedger::GetSingleLiveBidRow(bidId, row))
-    {
-        printf("ahforwardreserve FAIL: two live rows not rejected\n");
-        pass = false;
-    }
-    if (AhClassifyBidForward(bidId, 1u, 700u, reserveAmount) != uint16(IPC_PLAYER_BUYOUT) ||
-        reserveAmount != 700u)
-    {
-        printf("ahforwardreserve FAIL: classify(ambiguous rows)\n");
-        pass = false;
-    }
-
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `custody_ledger` WHERE `auction_id` IN (990001, 990002)");
-
-    if (pass)
-    {
-        printf("ahforwardreserve OK\n");
-        return 0;
-    }
-
-    return 2;
-}
-
-/// SP-2: ReleaseGoldToWallet (online + offline re-credit) and the
-/// applied-record idempotency helpers (WriteResolutionApplied / ResolutionApplied).
-static int RunAhReleaseTest()
-{
-    bool pass = true;
-
-    // Clean slate for this test's rows and a synthetic offline character.
-    // NOTE: the applied-record key is "resolve:<uuid in DECIMAL>" (see
-    // WriteResolutionApplied); UINT64_C(0x0000009900000001) below decimalises
-    // to 657129996289, so the cleanup pattern must match that, not the hex
-    // digits.
-    CharacterDatabase.DirectPExecute(
-        "DELETE FROM `custody_ledger` WHERE `idem_key` LIKE 'test:rel%%'"
-        " OR `idem_key` = 'resolve:657129996289'");
-
-    // ---- offline re-credit: seed a RESERVED row + a characters money row ----
-    uint32 const offlineGuid = 970101u;
-    CharacterDatabase.DirectPExecute(
-        "DELETE FROM `characters` WHERE `guid` = %u", offlineGuid);
-    CharacterDatabase.DirectPExecute(
-        "INSERT INTO `characters` (`guid`,`account`,`name`,`money`) "
-        "VALUES (%u, 1, 'RelTestOff', 500)", offlineGuid);
-    {
-        CharacterDatabase.BeginTransaction();
-        CustodyRow r;
-        r.id = 0; r.idemKey = "test:rel:offline"; r.kind = CUSTODY_GOLD;
-        r.role = ROLE_BID; r.state = CST_RESERVED; r.ownerGuid = offlineGuid;
-        r.beneficiaryGuid = 0; r.amount = 250; r.itemGuid = 0;
-        r.auctionId = 970101; r.createdTime = static_cast<uint64>(time(NULL));
-        r.resolvedTime = 0;
-        CustodyLedger::Insert(r);
-        CharacterDatabase.CommitTransactionChecked();
-    }
-    {
-        CustodyDeferred def;
-        CharacterDatabase.BeginTransaction();
-        CustodyService::ReleaseGoldToWallet(def, offlineGuid, NULL, 250,
-                                            "test:rel:offline");
-        bool ok = CharacterDatabase.CommitTransactionChecked();
-        def.run();
-        if (!ok)
-        {
-            printf("ahrelease FAIL: offline commit returned false\n");
-            pass = false;
-        }
-        QueryResult* q = CharacterDatabase.PQuery(
-            "SELECT `money` FROM `characters` WHERE `guid` = %u", offlineGuid);
-        if (!q || q->Fetch()[0].GetUInt32() != 750u)  // 500 + 250
-        {
-            printf("ahrelease FAIL: offline money not credited (expected 750)\n");
-            pass = false;
-        }
-        delete q;
-        CustodyRow row;
-        if (!CustodyLedger::Get("test:rel:offline", row) ||
-            row.state != CST_TERMINAL_BACK)
-        {
-            printf("ahrelease FAIL: offline row not CST_TERMINAL_BACK\n");
-            pass = false;
-        }
-    }
-
-    // ---- applied-record: write once, detect duplicate, missing => false ----
-    {
-        uint64 const uuid = UINT64_C(0x0000009900000001);
-        if (CustodyService::ResolutionApplied(uuid))
-        {
-            printf("ahrelease FAIL: applied-record present before write\n");
-            pass = false;
-        }
-        CharacterDatabase.BeginTransaction();
-        CustodyService::WriteResolutionApplied(970200u, uuid);
-        if (!CharacterDatabase.CommitTransactionChecked())
-        {
-            printf("ahrelease FAIL: applied-record commit returned false\n");
-            pass = false;
-        }
-        if (!CustodyService::ResolutionApplied(uuid))
-        {
-            printf("ahrelease FAIL: applied-record not detected after write\n");
-            pass = false;
-        }
-    }
-
-    // Cleanup (see decimal-key NOTE above).
-    CharacterDatabase.DirectPExecute(
-        "DELETE FROM `custody_ledger` WHERE `idem_key` LIKE 'test:rel%%'"
-        " OR `idem_key` = 'resolve:657129996289'");
-    CharacterDatabase.DirectPExecute(
-        "DELETE FROM `characters` WHERE `guid` = %u", offlineGuid);
-
-    if (pass)
-    {
-        printf("ahrelease OK\n");
-    }
-    return pass ? 0 : 1;
-}
-
-/// SP-2 self-test for AhHandlePlayerMutationResult: finalizes crafted worker
-/// results against SEEDED custody rows + a seeded MutationPending entry. No live
-/// worker, no world data. Recipients of AH mail / gold re-credits use guid 1,
-/// which the test SEEDS as an offline `characters` row with an account (the
-/// legacy AH mail path guards on GetPlayerAccountIdByGUID != 0, so a recipient
-/// with no `characters` row is correctly skipped -- see RunAhReleaseTest); guid
-/// 99999 stays an offline-nobody bidder. Covers the reconciliation that an
-/// op=0x42 (buyout intent) MUT_OK is a WIN only when effectiveBid==buyout, else
-/// a normal standing bid. Returns 0 on pass.
-static int RunAhMutResultTest()
-{
-    bool pass = true;
-    CharacterDatabase.AllowAsyncTransactions();
-
-    // Clean slate from any prior run (auction-id scoped -- covers both the
-    // test:mut* keys and the hardcoded dep:/item: keys the buyout finalize uses).
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `custody_ledger` WHERE `auction_id` IN "
-        "(990001,990002,990003,990004,990005,990006,990007)");
-    CharacterDatabase.DirectExecute(
-        "DELETE ii FROM `item_instance` ii "
-        "JOIN `mail_items` mi ON mi.`item_guid`=ii.`guid` "
-        "JOIN `mail` m ON m.`id`=mi.`mail_id` "
-        "WHERE m.`receiver` IN (1,2) AND m.`subject` LIKE '19019:%'");
-    CharacterDatabase.DirectExecute(
-        "DELETE mi FROM `mail_items` mi JOIN `mail` m ON m.`id`=mi.`mail_id` "
-        "WHERE m.`receiver` IN (1,2) AND m.`subject` LIKE '19019:%'");
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `mail` WHERE `receiver` IN (1,2) AND `subject` LIKE '19019:%'");
-
-    sObjectMgr.SetHighestGuids();       // mail and item ids collide otherwise
-    sObjectMgr.LoadItemPrototypes();
-    if (!ObjectMgr::GetItemPrototype(19019u))
-    {
-        printf("ahmutresult FAIL: item prototype 19019 missing\n");
-        return 2;
-    }
-
-    // Seed the offline recipient (guid 1) with an account + durable money so the
-    // account-guarded AH mail path delivers and the offline gold re-credit UPDATE
-    // has a row to hit. World data is NOT loaded under -t, so GetPlayer(1) is
-    // NULL and every value motion takes the offline (durable-DB) branch.
-    CharacterDatabase.DirectExecute("DELETE FROM `characters` WHERE `guid`=1");
-    CharacterDatabase.DirectExecute(
-        "INSERT INTO `characters` (`guid`,`account`,`name`,`money`) "
-        "VALUES (1, 1, 'AhMutTestRcv', 100000)");
-
-    // Helper lambda: read guid 1's durable money.
-    auto readMoney = []() -> uint64
-    {
-        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
-            "SELECT `money` FROM `characters` WHERE `guid`=1"));
-        return res ? res->Fetch()[0].GetUInt64() : 0;
-    };
-
-    // Helper lambda: read a custody row's state (255 = missing).
-    auto rowState = [](char const* key) -> uint32
-    {
-        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
-            "SELECT `state` FROM `custody_ledger` WHERE `idem_key`='%s'", key));
-        return res ? res->Fetch()[0].GetUInt32() : 255u;
-    };
-
-    // Helper lambda: count mails matching a money+subject to receiver 1.
-    auto mailCount = [](uint32 money, char const* subject) -> uint64
-    {
-        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
-            "SELECT COUNT(*) FROM `mail` WHERE `receiver`=1 AND `money`=%u AND `subject`='%s'",
-            money, subject));
-        return res ? res->Fetch()[0].GetUInt64() : 0;
-    };
-
-    MutationPendingMap& pend = sWorld.GetMutationPending();
-
-    // ---- Part A: MUT_OK bid displacing a real prior bidder ----
-    {
-        CharacterDatabase.BeginTransaction();
-        CharacterDatabase.PExecute(
-            "INSERT INTO `custody_ledger` "
-            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-            "VALUES ('test:mut:prior',0,1,0,1,0,777,0,990001,0,0),"
-            "       ('test:mut:own',0,1,0,99999,0,900,0,990001,0,0)");
-        if (!CharacterDatabase.CommitTransactionChecked())
-        {
-            printf("ahmutresult FAIL: seed commit (bid)\n");
-            return 2;
-        }
-
-        PendingMutation pm;
-        pm.uuid = 0xA1ull;
-        pm.playerGuidLow = 99999u;          // nonexistent char: offline, no account
-        pm.op = uint16(IPC_PLAYER_BID);
-        pm.auctionId = 990001u;
-        pm.state = uint8(PMUT_AWAIT_RESULT);
-        pm.sentSec = uint32(time(NULL));
-        pm.reservedAmount = 900u;
-        pm.reserveKey = "test:mut:own";
-        pm.itemKey.clear();
-        pm.depKey.clear();
-        pend.Register(pm);
-
-        PlayerMutationResult res;
-        res.uuid = 0xA1ull;
-        res.op = uint8(IPC_PLAYER_BID & 0xFFu);
-        res.status = uint8(MUT_OK);
-        res.reason = 0;
-        res.facts = MutationFacts();
-        res.facts.auctionId = 990001u;
-        res.facts.houseId = 7;
-        res.facts.itemTemplate = 19019u;
-        res.facts.randomPropertyId = 0;
-        res.facts.sellerGuid = 2u;
-        res.facts.effectiveBid = 900u;
-        res.facts.curBid = 900u;
-        res.facts.curBidderGuid = 99999u;
-        res.facts.priorBidderGuid = 1u;
-        res.facts.priorBidAmount = 777u;
-        AhHandlePlayerMutationResult(res);
-
-        if (rowState("test:mut:prior") != 2u)
-        {
-            printf("ahmutresult FAIL: prior bid row not TERMINAL_BACK\n");
-            pass = false;
-        }
-        if (rowState("test:mut:own") != 0u)
-        {
-            printf("ahmutresult FAIL: new live bid row must stay RESERVED\n");
-            pass = false;
-        }
-        if (mailCount(777u, "19019:0:0") != 1u)
-        {
-            printf("ahmutresult FAIL: outbid refund mail missing\n");
-            pass = false;
-        }
-        PendingMutation gone;
-        if (pend.Peek(0xA1ull, gone))
-        {
-            printf("ahmutresult FAIL: OK pending not consumed\n");
-            pass = false;
-        }
-    }
-
-    // ---- Part A2: MUT_OK sell -> no value motion, rows stay RESERVED ----
-    {
-        CharacterDatabase.BeginTransaction();
-        CharacterDatabase.PExecute(
-            "INSERT INTO `custody_ledger` "
-            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-            "VALUES ('test:mut:dep',0,0,0,1,0,25,0,990002,0,0),"
-            "       ('test:mut:item',1,3,0,1,0,0,424242,990002,0,0)");
-        if (!CharacterDatabase.CommitTransactionChecked())
-        {
-            printf("ahmutresult FAIL: seed commit (sell)\n");
-            return 2;
-        }
-
-        PendingMutation pm;
-        pm.uuid = 0xA5ull;
-        pm.playerGuidLow = 1u;
-        pm.op = uint16(IPC_PLAYER_SELL);
-        pm.auctionId = 990002u;
-        pm.state = uint8(PMUT_AWAIT_RESULT);
-        pm.sentSec = uint32(time(NULL));
-        pm.reservedAmount = 25u;
-        pm.reserveKey.clear();
-        pm.itemKey = "test:mut:item";
-        pm.depKey = "test:mut:dep";
-        pend.Register(pm);
-
-        PlayerMutationResult res;
-        res.uuid = 0xA5ull;
-        res.op = uint8(IPC_PLAYER_SELL & 0xFFu);
-        res.status = uint8(MUT_OK);
-        res.reason = 0;
-        res.facts = MutationFacts();
-        res.facts.auctionId = 990002u;
-        res.facts.houseId = 7;
-        res.facts.itemGuid = 424242u;
-        res.facts.itemTemplate = 19019u;
-        res.facts.sellerGuid = 1u;
-        res.facts.deposit = 25u;
-        AhHandlePlayerMutationResult(res);
-
-        if (rowState("test:mut:dep") != 0u || rowState("test:mut:item") != 0u)
-        {
-            printf("ahmutresult FAIL: sell OK must leave dep+item RESERVED\n");
-            pass = false;
-        }
-        PendingMutation gone;
-        if (pend.Peek(0xA5ull, gone))
-        {
-            printf("ahmutresult FAIL: sell pending not consumed\n");
-            pass = false;
-        }
-    }
-
-    // ---- Part A3: MUT_OK op=0x42 buyout WIN (effectiveBid == buyout) ----
-    // The worker removed the row at buyout: seller paid, item to winner,
-    // buyer reserve committed as proceeds, deposit returned, remainder released.
-    {
-        Item* winItem = TestCreateCachedAuctionItem(19019u, 1u);
-        if (!winItem)
-        {
-            printf("ahmutresult FAIL: create buyout-win escrow item\n");
-            return 2;
-        }
-        uint32 const winItemGuid = winItem->GetGUIDLow();
-
-        CharacterDatabase.BeginTransaction();
-        CharacterDatabase.PExecute(
-            "INSERT INTO `custody_ledger` "
-            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-            "VALUES ('test:mut:bowin',0,1,0,99999,0,1000,0,990003,0,0),"
-            "       ('dep:990003',0,0,0,1,0,50,0,990003,0,0),"
-            "       ('item:990003',1,3,0,1,0,0,%u,990003,0,0)", winItemGuid);
-        if (!CharacterDatabase.CommitTransactionChecked())
-        {
-            printf("ahmutresult FAIL: seed commit (buyout-win)\n");
-            return 2;
-        }
-
-        PendingMutation pm;
-        pm.uuid = 0xA8ull;
-        pm.playerGuidLow = 99999u;          // buyer offline-nobody
-        pm.op = uint16(IPC_PLAYER_BUYOUT);
-        pm.auctionId = 990003u;
-        pm.state = uint8(PMUT_AWAIT_RESULT);
-        pm.sentSec = uint32(time(NULL));
-        pm.reservedAmount = 1000u;          // maxPrice
-        pm.reserveKey = "test:mut:bowin";
-        pm.itemKey.clear();
-        pm.depKey.clear();
-        pend.Register(pm);
-
-        PlayerMutationResult res;
-        res.uuid = 0xA8ull;
-        res.op = uint8(IPC_PLAYER_BUYOUT & 0xFFu);
-        res.status = uint8(MUT_OK);
-        res.reason = 0;
-        res.facts = MutationFacts();
-        res.facts.auctionId = 990003u;
-        res.facts.houseId = 7;
-        res.facts.itemGuid = winItemGuid;
-        res.facts.itemTemplate = 19019u;
-        res.facts.randomPropertyId = 0;
-        res.facts.sellerGuid = 1u;          // seller has an account -> gets payout mail
-        res.facts.deposit = 50u;
-        res.facts.effectiveBid = 800u;
-        res.facts.curBid = 800u;
-        res.facts.curBidderGuid = 99999u;
-        res.facts.buyout = 800u;            // effectiveBid == buyout -> WIN
-        AhHandlePlayerMutationResult(res);
-
-        if (rowState("test:mut:bowin") != 1u)
-        {
-            printf("ahmutresult FAIL: buyout-win reserve not TERMINAL_OK (proceeds)\n");
-            pass = false;
-        }
-        if (rowState("dep:990003") != 2u)
-        {
-            printf("ahmutresult FAIL: buyout-win deposit not TERMINAL_BACK\n");
-            pass = false;
-        }
-        if (rowState("item:990003") != 1u)
-        {
-            printf("ahmutresult FAIL: buyout-win item not TERMINAL_OK\n");
-            pass = false;
-        }
-        if (mailCount(850u, "19019:0:2") != 1u)  // profit=800+50-cut(0 under -t)
-        {
-            printf("ahmutresult FAIL: buyout-win seller payout mail missing\n");
-            pass = false;
-        }
-        PendingMutation gone;
-        if (pend.Peek(0xA8ull, gone))
-        {
-            printf("ahmutresult FAIL: buyout-win pending not consumed\n");
-            pass = false;
-        }
-    }
-
-    // ---- Part A4: MUT_OK op=0x42 committed by worker as a NORMAL BID ----
-    // effectiveBid < buyout: the row stayed LIVE. The buyer reserve becomes the
-    // standing bid (stays RESERVED); ONLY the displaced prior bidder is refunded;
-    // no seller payout, no item delivery, no release.
-    {
-        CharacterDatabase.BeginTransaction();
-        CharacterDatabase.PExecute(
-            "INSERT INTO `custody_ledger` "
-            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-            "VALUES ('test:mut:bobid',0,1,0,99999,0,500,0,990004,0,0),"
-            "       ('test:mut:bobidprior',0,1,0,1,0,400,0,990004,0,0)");
-        if (!CharacterDatabase.CommitTransactionChecked())
-        {
-            printf("ahmutresult FAIL: seed commit (buyout-as-bid)\n");
-            return 2;
-        }
-
-        PendingMutation pm;
-        pm.uuid = 0xA9ull;
-        pm.playerGuidLow = 99999u;          // buyer offline-nobody
-        pm.op = uint16(IPC_PLAYER_BUYOUT);
-        pm.auctionId = 990004u;
-        pm.state = uint8(PMUT_AWAIT_RESULT);
-        pm.sentSec = uint32(time(NULL));
-        pm.reservedAmount = 500u;           // reserved == effectiveBid -> release 0
-        pm.reserveKey = "test:mut:bobid";
-        pm.itemKey.clear();
-        pm.depKey.clear();
-        pend.Register(pm);
-
-        PlayerMutationResult res;
-        res.uuid = 0xA9ull;
-        res.op = uint8(IPC_PLAYER_BUYOUT & 0xFFu);
-        res.status = uint8(MUT_OK);
-        res.reason = 0;
-        res.facts = MutationFacts();
-        res.facts.auctionId = 990004u;
-        res.facts.houseId = 7;
-        res.facts.itemTemplate = 19019u;
-        res.facts.randomPropertyId = 0;
-        res.facts.sellerGuid = 2u;
-        res.facts.effectiveBid = 500u;
-        res.facts.curBid = 500u;
-        res.facts.curBidderGuid = 99999u;
-        res.facts.priorBidderGuid = 1u;
-        res.facts.priorBidAmount = 400u;
-        res.facts.buyout = 1000u;           // effectiveBid < buyout -> NOT a win
-        AhHandlePlayerMutationResult(res);
-
-        if (rowState("test:mut:bobid") != 0u)
-        {
-            printf("ahmutresult FAIL: buyout-as-bid reserve must stay RESERVED\n");
-            pass = false;
-        }
-        if (rowState("test:mut:bobidprior") != 2u)
-        {
-            printf("ahmutresult FAIL: buyout-as-bid prior bidder not refunded\n");
-            pass = false;
-        }
-        if (mailCount(400u, "19019:0:0") != 1u)
-        {
-            printf("ahmutresult FAIL: buyout-as-bid outbid refund mail missing\n");
-            pass = false;
-        }
-        PendingMutation gone;
-        if (pend.Peek(0xA9ull, gone))
-        {
-            printf("ahmutresult FAIL: buyout-as-bid pending not consumed\n");
-            pass = false;
-        }
-    }
-
-    // ---- Part A5: MUT_OK cancel CONFIRM finalizes seller return + deposit ----
-    {
-        Item* cancelItem = TestCreateCachedAuctionItem(19019u, 1u);
-        if (!cancelItem)
-        {
-            printf("ahmutresult FAIL: create cancel escrow item\n");
-            return 2;
-        }
-        uint32 const cancelItemGuid = cancelItem->GetGUIDLow();
-
-        CharacterDatabase.BeginTransaction();
-        CharacterDatabase.PExecute(
-            "INSERT INTO `custody_ledger` "
-            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-            "VALUES ('dep:990005',0,0,0,1,0,32,0,990005,0,0),"
-            "       ('item:990005',1,3,0,1,0,0,%u,990005,0,0)", cancelItemGuid);
-        if (!CharacterDatabase.CommitTransactionChecked())
-        {
-            printf("ahmutresult FAIL: seed commit (cancel-confirm)\n");
-            return 2;
-        }
-
-        PendingMutation pm;
-        pm.uuid = 0xAAull;
-        pm.playerGuidLow = 1u;
-        pm.op = uint16(IPC_PLAYER_CANCEL);
-        pm.auctionId = 990005u;
-        pm.state = uint8(PMUT_AWAIT_CONFIRM);
-        pm.sentSec = uint32(time(NULL));
-        pm.reservedAmount = 0u;
-        pm.reserveKey.clear();
-        pm.itemKey.clear();
-        pm.depKey.clear();
-        pend.Register(pm);
-
-        PlayerMutationResult res;
-        res.uuid = 0xAAull;
-        res.op = uint8(IPC_PLAYER_CANCEL_CONFIRM & 0xFFu);
-        res.status = uint8(MUT_OK);
-        res.reason = 0;
-        res.facts = MutationFacts();
-        res.facts.auctionId = 990005u;
-        res.facts.houseId = 7;
-        res.facts.itemGuid = cancelItemGuid;
-        res.facts.itemTemplate = 19019u;
-        res.facts.randomPropertyId = 0;
-        res.facts.sellerGuid = 1u;
-        res.facts.deposit = 32u;
-        AhHandlePlayerMutationResult(res);
-
-        if (rowState("dep:990005") != 1u)
-        {
-            printf("ahmutresult FAIL: cancel-confirm deposit not TERMINAL_OK\n");
-            pass = false;
-        }
-        if (rowState("item:990005") != 1u)
-        {
-            printf("ahmutresult FAIL: cancel-confirm item not TERMINAL_OK\n");
-            pass = false;
-        }
-        PendingMutation gone;
-        if (pend.Peek(0xAAull, gone))
-        {
-            printf("ahmutresult FAIL: cancel-confirm pending not consumed\n");
-            pass = false;
-        }
-    }
-
-    // ---- Part B1: rejected sell returns the item and the durable deposit ----
-    {
-        Item* rejectedItem = TestCreateCachedAuctionItem(19019u, 1u);
-        if (!rejectedItem)
-        {
-            printf("ahmutresult FAIL: create rejected-sell escrow item\n");
-            return 2;
-        }
-        uint32 const rejectedItemGuid = rejectedItem->GetGUIDLow();
-
-        CharacterDatabase.BeginTransaction();
-        CharacterDatabase.PExecute(
-            "INSERT INTO `custody_ledger` "
-            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-            "VALUES ('dep:990006',0,0,0,1,0,73,0,990006,0,0),"
-            "       ('item:990006',1,3,0,1,0,0,%u,990006,0,0)",
-            rejectedItemGuid);
-        if (!CharacterDatabase.CommitTransactionChecked())
-        {
-            printf("ahmutresult FAIL: seed commit (rejected sell)\n");
-            return 2;
-        }
-
-        PendingMutation pm;
-        pm.uuid = 0xABull;
-        pm.playerGuidLow = 1u;
-        pm.op = uint16(IPC_PLAYER_SELL);
-        pm.auctionId = 990006u;
-        pm.state = uint8(PMUT_AWAIT_RESULT);
-        pm.sentSec = uint32(time(NULL));
-        // Production sell pending stores its deposit in depKey.
-        pm.reservedAmount = 0u;
-        pm.reserveKey.clear();
-        pm.itemKey = "item:990006";
-        pm.depKey = "dep:990006";
-        pend.Register(pm);
-
-        uint64 const before = readMoney();
-        PlayerMutationResult res;
-        res.uuid = pm.uuid;
-        res.op = uint8(IPC_PLAYER_SELL & 0xFFu);
-        res.status = uint8(MUT_REJECTED);
-        res.reason = uint8(AUCTION_ERR_DATABASE);
-        res.facts = MutationFacts();
-        res.facts.auctionId = pm.auctionId;
-        res.facts.houseId = 7u;
-        AhHandlePlayerMutationResult(res);
-
-        if (readMoney() != before + 73u)
-        {
-            printf("ahmutresult FAIL: rejected sell did not refund durable "
-                   "deposit amount\n");
-            pass = false;
-        }
-        if (rowState("dep:990006") != CST_TERMINAL_BACK ||
-            rowState("item:990006") != CST_TERMINAL_BACK)
-        {
-            printf("ahmutresult FAIL: rejected sell custody not "
-                   "TERMINAL_BACK\n");
-            pass = false;
-        }
-        std::unique_ptr<QueryResult> returned(CharacterDatabase.PQuery(
-            "SELECT 1 FROM `mail_items` WHERE `receiver`=1 AND `item_guid`=%u",
-            rejectedItemGuid));
-        if (!returned)
-        {
-            printf("ahmutresult FAIL: rejected sell item-return mail "
-                   "missing\n");
-            pass = false;
-        }
-    }
-
-    // ---- Part B2: missing sell escrow item holds both rows for retry ----
-    {
-        Item* missingItem = TestCreateCachedAuctionItem(19019u, 1u);
-        if (!missingItem)
-        {
-            printf("ahmutresult FAIL: create missing-item retry fixture\n");
-            return 2;
-        }
-        uint32 const missingItemGuid = missingItem->GetGUIDLow();
-        sAuctionMgr.RemoveAItem(missingItemGuid);
-
-        CharacterDatabase.BeginTransaction();
-        CharacterDatabase.PExecute(
-            "INSERT INTO `custody_ledger` "
-            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-            "VALUES ('dep:990007',0,0,0,1,0,74,0,990007,0,0),"
-            "       ('item:990007',1,3,0,1,0,0,%u,990007,0,0)",
-            missingItemGuid);
-        if (!CharacterDatabase.CommitTransactionChecked())
-        {
-            printf("ahmutresult FAIL: seed commit "
-                   "(missing rejected-sell item)\n");
-            return 2;
-        }
-
-        PendingMutation pm;
-        pm.uuid = 0xACull;
-        pm.playerGuidLow = 1u;
-        pm.op = uint16(IPC_PLAYER_SELL);
-        pm.auctionId = 990007u;
-        pm.state = uint8(PMUT_AWAIT_RESULT);
-        pm.sentSec = uint32(time(NULL));
-        pm.reservedAmount = 0u;
-        pm.reserveKey.clear();
-        pm.itemKey = "item:990007";
-        pm.depKey = "dep:990007";
-        pend.Register(pm);
-
-        uint64 const before = readMoney();
-        PlayerMutationResult res;
-        res.uuid = pm.uuid;
-        res.op = uint8(IPC_PLAYER_SELL & 0xFFu);
-        res.status = uint8(MUT_REJECTED);
-        res.reason = uint8(AUCTION_ERR_DATABASE);
-        res.facts = MutationFacts();
-        res.facts.auctionId = pm.auctionId;
-        res.facts.houseId = 7u;
-        AhHandlePlayerMutationResult(res);
-
-        if (readMoney() != before || rowState("dep:990007") != CST_RESERVED ||
-            rowState("item:990007") != CST_RESERVED)
-        {
-            printf("ahmutresult FAIL: missing rejected-sell item moved "
-                   "conserved value\n");
-            pass = false;
-        }
-
-        sAuctionMgr.AddAItem(missingItem);
-        AhProcessRedriveQueue(uint32(time(NULL)) + 6u);
-        std::unique_ptr<QueryResult> returned(CharacterDatabase.PQuery(
-            "SELECT 1 FROM `mail_items` WHERE `receiver`=1 "
-            "AND `item_guid`=%u",
-            missingItemGuid));
-        if (readMoney() != before + 74u ||
-            rowState("dep:990007") != CST_TERMINAL_BACK ||
-            rowState("item:990007") != CST_TERMINAL_BACK || !returned ||
-            sAuctionMgr.GetAItem(missingItemGuid))
-        {
-            printf("ahmutresult FAIL: missing-item redrive did not conserve "
-                   "and return value\n");
-            pass = false;
-        }
-    }
-
-    // ---- Part B3: MUT_REJECTED buyout -> ReleaseGoldToWallet (offline) ----
-    {
-        CharacterDatabase.BeginTransaction();
-        CharacterDatabase.PExecute(
-            "INSERT INTO `custody_ledger` "
-            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-            "VALUES ('test:mut:rej',0,1,0,1,0,555,0,990001,0,0)");
-        if (!CharacterDatabase.CommitTransactionChecked())
-        {
-            printf("ahmutresult FAIL: seed commit (rej)\n");
-            return 2;
-        }
-
-        PendingMutation pm;
-        pm.uuid = 0xA2ull;
-        pm.playerGuidLow = 1u;
-        pm.op = uint16(IPC_PLAYER_BUYOUT);
-        pm.auctionId = 990001u;
-        pm.state = uint8(PMUT_AWAIT_RESULT);
-        pm.sentSec = uint32(time(NULL));
-        pm.reservedAmount = 555u;
-        pm.reserveKey = "test:mut:rej";
-        pm.itemKey.clear();
-        pm.depKey.clear();
-        pend.Register(pm);
-
-        uint64 const before = readMoney();
-
-        PlayerMutationResult res;
-        res.uuid = 0xA2ull;
-        res.op = uint8(IPC_PLAYER_BUYOUT & 0xFFu);
-        res.status = uint8(MUT_REJECTED);
-        res.reason = uint8(AUCTION_ERR_BID_INCREMENT);
-        res.facts = MutationFacts();
-        res.facts.auctionId = 990001u;
-        AhHandlePlayerMutationResult(res);
-
-        if (rowState("test:mut:rej") != 2u)
-        {
-            printf("ahmutresult FAIL: rejected row not TERMINAL_BACK\n");
-            pass = false;
-        }
-        if (readMoney() != before + 555u)
-        {
-            printf("ahmutresult FAIL: rejected release not credited\n");
-            pass = false;
-        }
-        PendingMutation gone;
-        if (pend.Peek(0xA2ull, gone))
-        {
-            printf("ahmutresult FAIL: rejected pending not consumed\n");
-            pass = false;
-        }
-    }
-
-    // ---- Part C: MUT_REJECTED_STALE cancel -> release cut + resolve ----
-    {
-        CharacterDatabase.BeginTransaction();
-        CharacterDatabase.PExecute(
-            "INSERT INTO `custody_ledger` "
-            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-            "VALUES ('test:mut:cut',0,2,0,1,0,55,0,990001,0,0)");
-        if (!CharacterDatabase.CommitTransactionChecked())
-        {
-            printf("ahmutresult FAIL: seed commit (cut)\n");
-            return 2;
-        }
-
-        PendingMutation pm;
-        pm.uuid = 0xA3ull;
-        pm.playerGuidLow = 1u;
-        pm.op = uint16(IPC_PLAYER_CANCEL);
-        pm.auctionId = 990001u;
-        pm.state = uint8(PMUT_AWAIT_RESULT);
-        pm.sentSec = uint32(time(NULL));
-        pm.reservedAmount = 0u;
-        pm.reserveKey.clear();
-        pm.itemKey.clear();
-        pm.depKey.clear();
-        pend.Register(pm);
-        pend.RearmConfirm(0xA3ull, uint32(time(NULL)));
-        if (!pend.SetReserve(0xA3ull, 55u, "test:mut:cut"))
-        {
-            printf("ahmutresult FAIL: SetReserve\n");
-            pass = false;
-        }
-
-        uint64 const before = readMoney();
-
-        PlayerMutationResult res;
-        res.uuid = 0xA3ull;
-        res.op = uint8(IPC_PLAYER_CANCEL & 0xFFu);
-        res.status = uint8(MUT_REJECTED_STALE);
-        res.reason = 0;
-        res.facts = MutationFacts();
-        res.facts.auctionId = 990001u;
-        AhHandlePlayerMutationResult(res);
-
-        if (rowState("test:mut:cut") != 2u)
-        {
-            printf("ahmutresult FAIL: stale cut row not TERMINAL_BACK\n");
-            pass = false;
-        }
-        if (readMoney() != before + 55u)
-        {
-            printf("ahmutresult FAIL: stale cut not credited\n");
-            pass = false;
-        }
-        PendingMutation gone;
-        if (pend.Peek(0xA3ull, gone))
-        {
-            printf("ahmutresult FAIL: stale pending not consumed\n");
-            pass = false;
-        }
-    }
-
-    // ---- Part D: unknown uuid -> loud protocol fault, no crash ----
-    {
-        PlayerMutationResult res;
-        res.uuid = 0xDEADull;
-        res.op = uint8(IPC_PLAYER_BID & 0xFFu);
-        res.status = uint8(MUT_OK);
-        res.reason = 0;
-        res.facts = MutationFacts();
-        AhHandlePlayerMutationResult(res);   // must only log
-    }
-
-    // ---- Part E: MUT_PREPARED with offline seller -> ABORT path consumes ----
-    {
-        PendingMutation pm;
-        pm.uuid = 0xA6ull;
-        pm.playerGuidLow = 99999u;          // offline -> can't debit cut -> ABORT
-        pm.op = uint16(IPC_PLAYER_CANCEL);
-        pm.auctionId = 990001u;
-        pm.state = uint8(PMUT_AWAIT_RESULT);
-        pm.sentSec = uint32(time(NULL));
-        pm.reservedAmount = 0u;
-        pm.reserveKey.clear();
-        pm.itemKey.clear();
-        pm.depKey.clear();
-        pend.Register(pm);
-
-        PlayerMutationResult res;
-        res.uuid = 0xA6ull;
-        res.op = uint8(IPC_PLAYER_CANCEL & 0xFFu);
-        res.status = uint8(MUT_PREPARED);
-        res.reason = 0;
-        res.facts = MutationFacts();
-        res.facts.auctionId = 990001u;
-        res.facts.houseId = 7;
-        res.facts.curBid = 500u;            // nonzero bid -> cut is owed -> gate engages
-        res.facts.curBidderGuid = 1u;
-        AhHandlePlayerMutationResult(res);   // sv==NULL under -t: frame skipped
-
-        PendingMutation gone;
-        if (pend.Peek(0xA6ull, gone))
-        {
-            printf("ahmutresult FAIL: PREPARED abort did not consume pending\n");
-            pass = false;
-        }
-    }
-
-    // ---- Part F: sweep tombstones a stale entry ----
-    {
-        PendingMutation pm;
-        pm.uuid = 0xA7ull;
-        pm.playerGuidLow = 99999u;
-        pm.op = uint16(IPC_PLAYER_BID);
-        pm.auctionId = 990001u;
-        pm.state = uint8(PMUT_AWAIT_RESULT);
-        pm.sentSec = 100u;                   // ancient
-        pm.reservedAmount = 0u;
-        pend.Register(pm);
-        std::vector<uint64> inDoubt;
-        pend.SweepToTombstones(uint32(time(NULL)), 10u, inDoubt);
-        bool swept = false;
-        for (size_t i = 0; i < inDoubt.size(); ++i)
-        {
-            if (inDoubt[i] == 0xA7ull)
-            {
-                swept = true;
-            }
-        }
-        PendingMutation t;
-        if (!swept || !pend.Peek(0xA7ull, t) || t.state != uint8(PMUT_TOMBSTONE))
-        {
-            printf("ahmutresult FAIL: sweep did not tombstone\n");
-            pass = false;
-        }
-        AhNotifyMutationInDoubt(t);          // offline -> no packet; must not crash
-        PendingMutation consumed;
-        pend.Take(0xA7ull, consumed);        // clean the slot for re-runs
-    }
-
-    // Clean up.
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `custody_ledger` WHERE `auction_id` IN "
-        "(990001,990002,990003,990004,990005,990006,990007)");
-    CharacterDatabase.DirectExecute(
-        "DELETE ii FROM `item_instance` ii "
-        "JOIN `mail_items` mi ON mi.`item_guid`=ii.`guid` "
-        "JOIN `mail` m ON m.`id`=mi.`mail_id` "
-        "WHERE m.`receiver` IN (1,2) AND m.`subject` LIKE '19019:%'");
-    CharacterDatabase.DirectExecute(
-        "DELETE mi FROM `mail_items` mi JOIN `mail` m ON m.`id`=mi.`mail_id` "
-        "WHERE m.`receiver` IN (1,2) AND m.`subject` LIKE '19019:%'");
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `mail` WHERE `receiver` IN (1,2) AND `subject` LIKE '19019:%'");
-    CharacterDatabase.DirectExecute("DELETE FROM `characters` WHERE `guid`=1");
-
-    if (pass)
-    {
-        printf("ahmutresult OK\n");
-        return 0;
-    }
-    return 2;
-}
-
-/// SP-2 Task 12 self-test for AhHandleResolveApply: applies crafted
-/// worker-initiated resolutions (WON / EXPIRED_NOBID / CANCELLED_UNLOCK /
-/// REPAIR_RETURN) against SEEDED custody rows -- no live worker, no world data.
-/// Asserts each kind's ledger flips + value mails, the resolve:<uuid>
-/// applied-record, and that a SECOND apply returns RES_DUPLICATE without
-/// double-applying. Recipients use guid 1 or 2, seeded offline with accounts so
-/// the account-guarded AH mail paths deliver. Item prototypes are loaded only
-/// for terminal-path fixtures that intentionally provide a cached escrow
-/// object.
-/// Returns 0 on pass.
-static int RunAhResolveTest()
-{
-    bool pass = true;
-    CharacterDatabase.AllowAsyncTransactions();
-
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `custody_ledger` WHERE `auction_id` IN "
-        "(991001,991002,991003,991004,991005,991006)");
-    CharacterDatabase.DirectExecute(
-        "DELETE ii FROM `item_instance` ii "
-        "JOIN `mail_items` mi ON mi.`item_guid`=ii.`guid` "
-        "JOIN `mail` m ON m.`id`=mi.`mail_id` "
-        "WHERE m.`receiver` IN (1,2) AND m.`subject` LIKE '19019:%'");
-    CharacterDatabase.DirectExecute(
-        "DELETE mi FROM `mail_items` mi JOIN `mail` m ON m.`id`=mi.`mail_id` "
-        "WHERE m.`receiver` IN (1,2) AND m.`subject` LIKE '19019:%'");
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `mail` WHERE `receiver` IN (1,2) "
-        "AND `subject` LIKE '19019:%'");
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `characters` WHERE `guid` IN (1,2)");
-    CharacterDatabase.DirectExecute(
-        "INSERT INTO `characters` (`guid`,`account`,`name`,`money`) "
-        "VALUES (1, 1, 'AhResTestRcv', 100000),"
-        "       (2, 2, 'AhResSeller', 100000)");
-
-    sObjectMgr.SetHighestGuids();       // mail and item ids collide otherwise
-    sObjectMgr.LoadItemPrototypes();
-    if (!ObjectMgr::GetItemPrototype(19019u))
-    {
-        printf("ahresolve FAIL: item prototype 19019 missing\n");
-        return 2;
-    }
-
-    auto readMoney = []() -> uint64
-    {
-        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
-            "SELECT `money` FROM `characters` WHERE `guid`=1"));
-        return res ? res->Fetch()[0].GetUInt64() : 0;
-    };
-    auto rowState = [](char const* key) -> uint32
-    {
-        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
-            "SELECT `state` FROM `custody_ledger` WHERE `idem_key`='%s'", key));
-        return res ? res->Fetch()[0].GetUInt32() : 255u;
-    };
-    auto mailCount = [](uint32 money, char const* subject) -> uint64
-    {
-        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
-            "SELECT COUNT(*) FROM `mail` WHERE `receiver`=1 AND `money`=%u AND `subject`='%s'",
-            money, subject));
-        return res ? res->Fetch()[0].GetUInt64() : 0;
-    };
-
-    // Terminal player resolutions require the matching deposit before any leg.
-    uint8 const terminalKinds[] =
-        { RESOLVE_WON, RESOLVE_EXPIRED_NOBID, RESOLVE_REPAIR_RETURN };
-    for (uint32 mode = 0u; mode < 3u; ++mode)
-    {
-        for (uint32 mismatch = 0u; mismatch < 2u; ++mismatch)
-        {
-            uint32 const auctionId = 991010u + mode * 2u + mismatch;
-            std::string const depKey = "dep:" + std::to_string(auctionId);
-            std::string const itemKey = "item:" + std::to_string(auctionId);
-            std::string const bidKey = "bid:" + std::to_string(auctionId) + ":1";
-            Item* const item = TestCreateCachedAuctionItem(19019u, 2u);
-            if (!item)
-            {
-                return 2;
-            }
-            uint32 const itemGuid = item->GetGUIDLow();
-            CharacterDatabase.BeginTransaction();
-            CustodyLedger::Insert(TestCustodyRow(0, itemKey, CUSTODY_ITEM,
-                ROLE_ITEM, 2u, 0u, itemGuid, auctionId));
-            if (mode == 0u)
-            {
-                CustodyLedger::Insert(TestCustodyRow(0, bidKey, CUSTODY_GOLD,
-                    ROLE_BID, 1u, 200u, 0u, auctionId));
-            }
-            if (mismatch)
-            {
-                CustodyLedger::Insert(TestCustodyRow(0, depKey, CUSTODY_GOLD,
-                    ROLE_DEPOSIT, 2u, 31u, 0u, auctionId));
-            }
-            if (!CharacterDatabase.CommitTransactionChecked())
-            {
-                return 2;
-            }
-            ResolveApply ra = {};
-            ra.uuid = 9912000ull + auctionId;
-            ra.kind = terminalKinds[mode];
-            ra.facts.auctionId = auctionId;
-            ra.facts.houseId = 7u;
-            ra.facts.sellerGuid = 2u;
-            ra.facts.itemGuid = itemGuid;
-            ra.facts.itemTemplate = 19019u;
-            ra.facts.itemCount = 1u;
-            ra.facts.deposit = 32u;
-            if (mode == 0u)
-            {
-                ra.facts.curBidderGuid = 1u;
-                ra.facts.curBid = ra.facts.effectiveBid = 200u;
-            }
-            uint64 const wallet = readMoney();
-            uint8 const result = AhHandleResolveApply(ra);
-            std::unique_ptr<QueryResult> heldMail(CharacterDatabase.Query(
-                "SELECT COUNT(*) FROM `mail` WHERE `receiver` IN (1,2)"));
-            bool const held = result == uint8(RES_FAILED) &&
-                !CustodyService::ResolutionApplied(ra.uuid) &&
-                sAuctionMgr.GetAItem(itemGuid) == item &&
-                rowState(itemKey.c_str()) == CST_RESERVED &&
-                rowState(depKey.c_str()) == (mismatch ? CST_RESERVED : 255u) &&
-                (mode != 0u || rowState(bidKey.c_str()) == CST_RESERVED) &&
-                readMoney() == wallet && heldMail &&
-                heldMail->Fetch()[0].GetUInt64() == 0u;
-            if (!held)
-            {
-                printf("ahresolve FAIL: kind %u %s deposit moved value\n",
-                       uint32(ra.kind), mismatch ? "mismatched" : "missing");
-                pass = false;
-            }
-            else
-            {
-                CharacterDatabase.BeginTransaction();
-                if (mismatch)
-                {
-                    CustodyLedger::SetAmount(depKey, 32u);
-                }
-                else
-                {
-                    CustodyLedger::Insert(TestCustodyRow(0, depKey, CUSTODY_GOLD,
-                        ROLE_DEPOSIT, 2u, 32u, 0u, auctionId));
-                }
-                if (!CharacterDatabase.CommitTransactionChecked())
-                {
-                    return 2;
-                }
-                uint8 const retried = AhHandleResolveApply(ra);
-                uint8 const duplicate = AhHandleResolveApply(ra);
-                std::unique_ptr<QueryResult> mails(CharacterDatabase.Query(
-                    "SELECT COUNT(*),COALESCE(SUM(`money`),0) "
-                    "FROM `mail` WHERE `receiver` IN (1,2)"));
-                std::unique_ptr<QueryResult> delivery(CharacterDatabase.PQuery(
-                    "SELECT COUNT(*) FROM `mail_items` "
-                    "WHERE `item_guid`=%u AND `receiver`=%u",
-                    itemGuid, mode == 0u ? 1u : 2u));
-                if (retried != uint8(RES_APPLIED) ||
-                    duplicate != uint8(RES_DUPLICATE) ||
-                    !CustodyService::ResolutionApplied(ra.uuid) ||
-                    rowState(depKey.c_str()) != CST_TERMINAL_OK ||
-                    rowState(itemKey.c_str()) != CST_TERMINAL_OK ||
-                    (mode == 0u && rowState(bidKey.c_str()) != CST_TERMINAL_OK) ||
-                    !mails || mails->Fetch()[0].GetUInt64() != (mode == 0u ? 2u : 1u) ||
-                    mails->Fetch()[1].GetUInt64() != (mode == 0u ? 232u : 0u) ||
-                    !delivery || delivery->Fetch()[0].GetUInt64() != 1u)
-                {
-                    printf("ahresolve FAIL: restored deposit did not settle once\n");
-                    pass = false;
-                }
-            }
-            if (Item* leftover = sAuctionMgr.GetAItem(itemGuid))
-            {
-                sAuctionMgr.RemoveAItem(itemGuid);
-                delete leftover;
-            }
-            CharacterDatabase.DirectPExecute(
-                "DELETE FROM `custody_ledger` WHERE `auction_id`=%u", auctionId);
-            CharacterDatabase.DirectExecute(
-                "DELETE FROM `mail_items` WHERE `receiver` IN (1,2)");
-            CharacterDatabase.DirectExecute(
-                "DELETE FROM `mail` WHERE `receiver` IN (1,2)");
-            CharacterDatabase.DirectPExecute(
-                "DELETE FROM `item_instance` WHERE `guid`=%u", itemGuid);
-        }
-    }
-
-    // ---- RESOLVE_WON: missing item cache must hold every value leg ----
-    {
-        CharacterDatabase.BeginTransaction();
-        CharacterDatabase.PExecute(
-            "INSERT INTO `custody_ledger` "
-            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-            "VALUES ('bid:991001:1',0,1,0,99999,0,800,0,991001,0,0),"
-            "       ('dep:991001',0,0,0,1,0,50,0,991001,0,0),"
-            "       ('item:991001',1,3,0,1,0,0,424242,991001,0,0)");
-        if (!CharacterDatabase.CommitTransactionChecked())
-        {
-            printf("ahresolve FAIL: seed commit (won)\n");
-            return 2;
-        }
-
-        ResolveApply ra;
-        ra.uuid = 0xB1ull;
-        ra.kind = uint8(RESOLVE_WON);
-        ra.facts = MutationFacts();
-        ra.facts.auctionId = 991001u;
-        ra.facts.houseId = 7;
-        ra.facts.itemGuid = 424242u;
-        ra.facts.itemTemplate = 19019u;
-        ra.facts.randomPropertyId = 0;
-        ra.facts.sellerGuid = 1u;           // has an account -> gets payout mail
-        ra.facts.deposit = 50u;
-        ra.facts.effectiveBid = 800u;
-        ra.facts.curBid = 800u;
-        ra.facts.curBidderGuid = 99999u;    // offline-nobody winner
-        ra.facts.buyout = 800u;
-
-        if (AhHandleResolveApply(ra) != uint8(RES_FAILED))
-        {
-            printf("ahresolve FAIL: missing-item WON not RES_FAILED\n");
-            pass = false;
-        }
-        if (CustodyService::ResolutionApplied(0xB1ull))
-        {
-            printf("ahresolve FAIL: missing-item WON wrote applied-record\n");
-            pass = false;
-        }
-        if (rowState("bid:991001:1") != CST_RESERVED)
-        {
-            printf("ahresolve FAIL: missing-item WON consumed bid\n");
-            pass = false;
-        }
-        if (rowState("dep:991001") != CST_RESERVED)
-        {
-            printf("ahresolve FAIL: missing-item WON consumed deposit\n");
-            pass = false;
-        }
-        if (rowState("item:991001") != CST_RESERVED)
-        {
-            printf("ahresolve FAIL: missing-item WON terminalized item "
-                   "custody\n");
-            pass = false;
-        }
-        if (mailCount(850u, "19019:0:2") != 0u)
-        {
-            printf("ahresolve FAIL: missing-item WON paid seller\n");
-            pass = false;
-        }
-
-        if (AhHandleResolveApply(ra) != uint8(RES_FAILED))
-        {
-            printf("ahresolve FAIL: missing-item WON retry was not "
-                   "RES_FAILED\n");
-            pass = false;
-        }
-        if (mailCount(850u, "19019:0:2") != 0u)
-        {
-            printf("ahresolve FAIL: missing-item WON retry paid seller\n");
-            pass = false;
-        }
-    }
-
-    // ---- RESOLVE_WON fail-closed [F2]: a REAL winner (curBidderGuid != 0) with
-    // NO live bid row must pay/deliver NOTHING and return RES_FAILED (mirror
-    // AhFinalizeBidOk), so the winner's RESERVED bid can never leak and the
-    // resolution re-drives. Seed dep + item but NO bid row: pre-fix this path
-    // silently skipped the bid terminal yet STILL paid the seller + wrote the
-    // applied-record. (A legit BOT win has curBidderGuid == 0 and no bid row --
-    // that proceed case is exercised by the REPAIR/bot-win paths.)
-    {
-        Item* missingBidItem = TestCreateCachedAuctionItem(19019u, 1u);
-        if (!missingBidItem)
-        {
-            printf("ahresolve FAIL: create missing-bid escrow item\n");
-            return 2;
-        }
-        uint32 const missingBidItemGuid = missingBidItem->GetGUIDLow();
-
-        CharacterDatabase.BeginTransaction();
-        CharacterDatabase.PExecute(
-            "INSERT INTO `custody_ledger` "
-            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-            "VALUES ('dep:991005',0,0,0,1,0,30,0,991005,0,0),"
-            "       ('item:991005',1,3,0,1,0,0,%u,991005,0,0)",
-            missingBidItemGuid);
-        if (!CharacterDatabase.CommitTransactionChecked())
-        {
-            printf("ahresolve FAIL: seed commit (won fail-closed)\n");
-            return 2;
-        }
-
-        ResolveApply ra;
-        ra.uuid = 0xB5ull;
-        ra.kind = uint8(RESOLVE_WON);
-        ra.facts = MutationFacts();
-        ra.facts.auctionId = 991005u;
-        ra.facts.houseId = 7;
-        ra.facts.itemGuid = missingBidItemGuid;
-        ra.facts.itemTemplate = 19019u;
-        ra.facts.randomPropertyId = 0;
-        ra.facts.sellerGuid = 1u;           // would get a payout mail if wrongly paid
-        ra.facts.deposit = 30u;
-        ra.facts.effectiveBid = 700u;
-        ra.facts.curBid = 700u;
-        ra.facts.curBidderGuid = 99999u;    // REAL winner, but NO live bid row seeded
-        ra.facts.buyout = 700u;
-
-        if (AhHandleResolveApply(ra) != uint8(RES_FAILED))
-        {
-            printf("ahresolve FAIL: WON-fail-closed not RES_FAILED\n");
-            pass = false;
-        }
-        if (CustodyService::ResolutionApplied(0xB5ull))
-        {
-            printf("ahresolve FAIL: WON-fail-closed wrote applied-record\n");
-            pass = false;
-        }
-        if (mailCount(730u, "19019:0:2") != 0u)    // seller must NOT be paid (700+30-cut0)
-        {
-            printf("ahresolve FAIL: WON-fail-closed paid the seller\n");
-            pass = false;
-        }
-        if (rowState("dep:991005") != 0u)          // rolled back -> still RESERVED
-        {
-            printf("ahresolve FAIL: WON-fail-closed dep row not rolled back\n");
-            pass = false;
-        }
-        if (rowState("item:991005") != 0u)         // rolled back -> still RESERVED
-        {
-            printf("ahresolve FAIL: WON-fail-closed item row not rolled back\n");
-            pass = false;
-        }
-
-        if (Item* leftover = sAuctionMgr.GetAItem(missingBidItemGuid))
-        {
-            sAuctionMgr.RemoveAItem(missingBidItemGuid);
-            delete leftover;
-        }
-        CharacterDatabase.DirectPExecute(
-            "DELETE FROM `item_instance` WHERE `guid`=%u", missingBidItemGuid);
-    }
-
-    // ---- RESOLVE_EXPIRED_NOBID: deposit forfeit + item returned ----
-    {
-        Item* expiredItem = TestCreateCachedAuctionItem(19019u, 1u);
-        if (!expiredItem)
-        {
-            printf("ahresolve FAIL: create expired escrow item\n");
-            return 2;
-        }
-        uint32 const expiredItemGuid = expiredItem->GetGUIDLow();
-
-        CharacterDatabase.BeginTransaction();
-        CharacterDatabase.PExecute(
-            "INSERT INTO `custody_ledger` "
-            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-            "VALUES ('dep:991002',0,0,0,1,0,40,0,991002,0,0),"
-            "       ('item:991002',1,3,0,1,0,0,%u,991002,0,0)",
-            expiredItemGuid);
-        if (!CharacterDatabase.CommitTransactionChecked())
-        {
-            printf("ahresolve FAIL: seed commit (expired)\n");
-            return 2;
-        }
-
-        ResolveApply ra;
-        ra.uuid = 0xB2ull;
-        ra.kind = uint8(RESOLVE_EXPIRED_NOBID);
-        ra.facts = MutationFacts();
-        ra.facts.auctionId = 991002u;
-        ra.facts.houseId = 7;
-        ra.facts.itemGuid = expiredItemGuid;
-        ra.facts.itemTemplate = 19019u;
-        ra.facts.sellerGuid = 1u;
-        ra.facts.deposit = 40u;
-
-        if (AhHandleResolveApply(ra) != uint8(RES_APPLIED))
-        {
-            printf("ahresolve FAIL: EXPIRED not RES_APPLIED\n");
-            pass = false;
-        }
-        if (rowState("dep:991002") != 1u)          // forfeit -> TERMINAL_OK
-        {
-            printf("ahresolve FAIL: EXPIRED deposit not forfeit (TERMINAL_OK)\n");
-            pass = false;
-        }
-        if (rowState("item:991002") != 1u)         // returned -> TERMINAL_OK
-        {
-            printf("ahresolve FAIL: EXPIRED item not TERMINAL_OK\n");
-            pass = false;
-        }
-        if (!CustodyService::ResolutionApplied(0xB2ull))
-        {
-            printf("ahresolve FAIL: EXPIRED applied-record missing\n");
-            pass = false;
-        }
-        if (AhHandleResolveApply(ra) != uint8(RES_DUPLICATE))
-        {
-            printf("ahresolve FAIL: EXPIRED second apply not RES_DUPLICATE\n");
-            pass = false;
-        }
-    }
-
-    // ---- RESOLVE_WON bot buyout: refund the displaced real bidder ----
-    {
-        Item* botWinItem = TestCreateCachedAuctionItem(19019u, 2u);
-        if (!botWinItem)
-        {
-            printf("ahresolve FAIL: create bot-win escrow item\n");
-            return 2;
-        }
-        uint32 const botWinItemGuid = botWinItem->GetGUIDLow();
-
-        CharacterDatabase.BeginTransaction();
-        CharacterDatabase.PExecute(
-            "INSERT INTO `custody_ledger` "
-            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-            "VALUES ('bid:991006:1',0,1,0,1,0,401,0,991006,0,0),"
-            "       ('dep:991006',0,0,0,2,0,50,0,991006,0,0),"
-            "       ('item:991006',1,3,0,2,0,0,%u,991006,0,0)", botWinItemGuid);
-        if (!CharacterDatabase.CommitTransactionChecked())
-        {
-            printf("ahresolve FAIL: seed commit (bot buyout)\n");
-            return 2;
-        }
-
-        ResolveApply ra;
-        ra.uuid = 0xB6ull;
-        ra.kind = uint8(RESOLVE_WON);
-        ra.facts = MutationFacts();
-        ra.facts.auctionId = 991006u;
-        ra.facts.houseId = 7u;
-        ra.facts.itemGuid = botWinItemGuid;
-        ra.facts.itemTemplate = 19019u;
-        ra.facts.randomPropertyId = 0;
-        ra.facts.sellerGuid = 2u;
-        ra.facts.deposit = 50u;
-        ra.facts.effectiveBid = 800u;
-        ra.facts.curBid = 800u;
-        ra.facts.curBidderGuid = 0u;
-        ra.facts.priorBidderGuid = 1u;
-        ra.facts.priorBidAmount = 401u;
-        ra.facts.buyout = 800u;
-
-        if (AhHandleResolveApply(ra) != uint8(RES_APPLIED))
-        {
-            printf("ahresolve FAIL: bot buyout not RES_APPLIED\n");
-            pass = false;
-        }
-        if (rowState("bid:991006:1") != CST_TERMINAL_BACK)
-        {
-            printf("ahresolve FAIL: bot buyout consumed displaced player "
-                   "bid\n");
-            pass = false;
-        }
-        if (mailCount(401u, "19019:0:0") != 1u)
-        {
-            printf("ahresolve FAIL: bot buyout prior-bidder refund missing\n");
-            pass = false;
-        }
-        if (!CustodyService::ResolutionApplied(ra.uuid))
-        {
-            printf("ahresolve FAIL: bot buyout applied-record missing\n");
-            pass = false;
-        }
-        std::unique_ptr<QueryResult> durableItem(CharacterDatabase.PQuery(
-            "SELECT 1 FROM `item_instance` WHERE `guid`=%u", botWinItemGuid));
-        if (rowState("item:991006") != CST_TERMINAL_OK ||
-            sAuctionMgr.GetAItem(botWinItemGuid) || durableItem)
-        {
-            printf("ahresolve FAIL: bot buyout did not consume terminal "
-                   "item\n");
-            pass = false;
-        }
-        if (AhHandleResolveApply(ra) != uint8(RES_DUPLICATE) ||
-            mailCount(401u, "19019:0:0") != 1u)
-        {
-            printf("ahresolve FAIL: bot buyout duplicate double-refunded\n");
-            pass = false;
-        }
-
-        if (Item* leftover = sAuctionMgr.GetAItem(botWinItemGuid))
-        {
-            sAuctionMgr.RemoveAItem(botWinItemGuid);
-            delete leftover;
-        }
-        CharacterDatabase.DirectPExecute(
-            "DELETE FROM `mail_items` WHERE `item_guid`=%u", botWinItemGuid);
-        CharacterDatabase.DirectPExecute(
-            "DELETE FROM `item_instance` WHERE `guid`=%u", botWinItemGuid);
-    }
-
-    // ---- RESOLVE_CANCELLED_UNLOCK: cut released to seller, no item/bid move ----
-    // The cut key is uuid-salted in production ("cut:<auc>:<uuid>"), so this
-    // exercises the by-auction cut scan (AhFindLiveCutRow), not a point key.
-    {
-        CharacterDatabase.BeginTransaction();
-        CharacterDatabase.PExecute(
-            "INSERT INTO `custody_ledger` "
-            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-            "VALUES ('cut:991003:12345',0,2,0,1,0,55,0,991003,0,0)");
-        if (!CharacterDatabase.CommitTransactionChecked())
-        {
-            printf("ahresolve FAIL: seed commit (cancelled)\n");
-            return 2;
-        }
-
-        ResolveApply ra;
-        ra.uuid = 0xB3ull;
-        ra.kind = uint8(RESOLVE_CANCELLED_UNLOCK);
-        ra.facts = MutationFacts();
-        ra.facts.auctionId = 991003u;
-        ra.facts.sellerGuid = 1u;
-
-        uint64 const before = readMoney();
-        if (AhHandleResolveApply(ra) != uint8(RES_APPLIED))
-        {
-            printf("ahresolve FAIL: CANCELLED not RES_APPLIED\n");
-            pass = false;
-        }
-        if (rowState("cut:991003:12345") != 2u)    // released -> TERMINAL_BACK
-        {
-            printf("ahresolve FAIL: CANCELLED cut not TERMINAL_BACK\n");
-            pass = false;
-        }
-        if (readMoney() != before + 55u)
-        {
-            printf("ahresolve FAIL: CANCELLED cut not credited to seller\n");
-            pass = false;
-        }
-        if (!CustodyService::ResolutionApplied(0xB3ull))
-        {
-            printf("ahresolve FAIL: CANCELLED applied-record missing\n");
-            pass = false;
-        }
-
-        uint64 const afterFirst = readMoney();
-        if (AhHandleResolveApply(ra) != uint8(RES_DUPLICATE))
-        {
-            printf("ahresolve FAIL: CANCELLED second apply not RES_DUPLICATE\n");
-            pass = false;
-        }
-        if (readMoney() != afterFirst)
-        {
-            printf("ahresolve FAIL: CANCELLED duplicate double-credited\n");
-            pass = false;
-        }
-    }
-
-    // ---- RESOLVE_REPAIR_RETURN (bot displaced a player): prior-bidder refund ----
-    {
-        CharacterDatabase.BeginTransaction();
-        CharacterDatabase.PExecute(
-            "INSERT INTO `custody_ledger` "
-            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-            "VALUES ('bid:991004:1',0,1,0,1,0,400,0,991004,0,0)");
-        if (!CharacterDatabase.CommitTransactionChecked())
-        {
-            printf("ahresolve FAIL: seed commit (repair)\n");
-            return 2;
-        }
-
-        ResolveApply ra;
-        ra.uuid = 0xB4ull;
-        ra.kind = uint8(RESOLVE_REPAIR_RETURN);
-        ra.facts = MutationFacts();
-        ra.facts.auctionId = 991004u;
-        ra.facts.houseId = 7;
-        ra.facts.itemTemplate = 19019u;
-        ra.facts.randomPropertyId = 0;
-        ra.facts.sellerGuid = 2u;
-        ra.facts.curBidderGuid = 0u;        // a bot now holds the top bid
-        ra.facts.priorBidderGuid = 1u;      // displaced real player
-        ra.facts.priorBidAmount = 400u;
-
-        if (AhHandleResolveApply(ra) != uint8(RES_APPLIED))
-        {
-            printf("ahresolve FAIL: REPAIR not RES_APPLIED\n");
-            pass = false;
-        }
-        if (rowState("bid:991004:1") != 2u)        // prior bid -> TERMINAL_BACK
-        {
-            printf("ahresolve FAIL: REPAIR prior bid not TERMINAL_BACK\n");
-            pass = false;
-        }
-        if (mailCount(400u, "19019:0:0") != 1u)    // outbid refund to guid 1
-        {
-            printf("ahresolve FAIL: REPAIR prior-bidder refund mail missing\n");
-            pass = false;
-        }
-        if (!CustodyService::ResolutionApplied(0xB4ull))
-        {
-            printf("ahresolve FAIL: REPAIR applied-record missing\n");
-            pass = false;
-        }
-        if (AhHandleResolveApply(ra) != uint8(RES_DUPLICATE))
-        {
-            printf("ahresolve FAIL: REPAIR second apply not RES_DUPLICATE\n");
-            pass = false;
-        }
-        if (mailCount(400u, "19019:0:0") != 1u)
-        {
-            printf("ahresolve FAIL: REPAIR duplicate double-refunded\n");
-            pass = false;
-        }
-    }
-
-    // Clean up.
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `custody_ledger` WHERE `auction_id` IN "
-        "(991001,991002,991003,991004,991005,991006)");
-    CharacterDatabase.DirectExecute(
-        "DELETE ii FROM `item_instance` ii "
-        "JOIN `mail_items` mi ON mi.`item_guid`=ii.`guid` "
-        "JOIN `mail` m ON m.`id`=mi.`mail_id` "
-        "WHERE m.`receiver` IN (1,2) AND m.`subject` LIKE '19019:%'");
-    CharacterDatabase.DirectExecute(
-        "DELETE mi FROM `mail_items` mi JOIN `mail` m ON m.`id`=mi.`mail_id` "
-        "WHERE m.`receiver` IN (1,2) AND m.`subject` LIKE '19019:%'");
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `mail` WHERE `receiver` IN (1,2) "
-        "AND `subject` LIKE '19019:%'");
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `characters` WHERE `guid` IN (1,2)");
-
-    if (pass)
-    {
-        printf("ahresolve OK\n");
-        return 0;
-    }
-    return 2;
-}
-
-/// Route and conservation regressions for seller custody and bid custody as
-/// independent dimensions. Uses only disposable Character DB fixtures.
-static int RunAhCustodyRouteTest()
-{
-    bool pass = true;
-    CharacterDatabase.AllowAsyncTransactions();
-    sObjectMgr.LoadItemPrototypes();
-
-    uint32 itemId = 2589u;
-    if (!ObjectMgr::GetItemPrototype(itemId))
-    {
-        std::unique_ptr<QueryResult> result(WorldDatabase.Query(
-            "SELECT `entry` FROM `item_template` "
-            "WHERE `InventoryType`=0 AND `stackable`>1 ORDER BY `entry` LIMIT 1"));
-        if (result)
-        {
-            itemId = result->Fetch()[0].GetUInt32();
-        }
-    }
-    if (!ObjectMgr::GetItemPrototype(itemId))
-    {
-        printf("ahcustodyroute FAIL: no usable item prototype\n");
-        return 2;
-    }
-
-    uint32 const sellerGuid = 9501u;
-    uint32 const bidderGuid = 9502u;
-    uint32 const otherBidderGuid = 9503u;
-    uint64 const now = static_cast<uint64>(time(NULL));
-    uint64 const oldTime = now > 7200u ? now - 7200u : 1u;
-    std::vector<uint32> itemGuids;
-
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `mail_items` WHERE `receiver` IN (9501,9502,9503)");
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `mail` WHERE `receiver` IN (9501,9502,9503)");
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `custody_ledger` WHERE `auction_id` BETWEEN 995100 AND 995199");
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `auction` WHERE `id` BETWEEN 995100 AND 995199");
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `item_instance` WHERE `owner_guid` IN (9501,9502,9503)");
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `characters` WHERE `guid` IN (9501,9502,9503)");
-    CharacterDatabase.DirectExecute(
-        "INSERT INTO `characters` (`guid`,`account`,`name`,`money`) VALUES "
-        "(9501,9501,'AhRtSeller',1000),"
-        "(9502,9502,'AhRtBidder',1000),"
-        "(9503,9503,'AhRtOther',1000)");
-    sObjectMgr.SetHighestGuids();
-
-    AuctionHouseEntry house = {};
-    house.houseId = 7;
-    house.faction = 0;
-    house.depositPercent = 5;
-    house.cutPercent = 5;
-
-    auto seedRow = [oldTime](std::string const& key, uint8 kind, uint8 role,
-                             uint32 owner, uint32 amount, uint32 itemGuid,
-                             uint32 auctionId)
-    {
-        CharacterDatabase.DirectPExecute(
-            "INSERT INTO `custody_ledger` "
-            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-            "VALUES ('%s',%u,%u,0,%u,0,%u,%u,%u," UI64FMTD ",0)",
-            key.c_str(), uint32(kind), uint32(role), owner, amount,
-            itemGuid, auctionId, oldTime);
-    };
-
-    auto createAuction = [&](uint32 auctionId, uint32 owner, uint32 bidder,
-                             uint32 bid, uint32 buyout,
-                             uint32 deposit) -> AuctionEntry*
-    {
-        Item* item = Item::CreateItem(itemId, 1);
-        if (!item)
-        {
-            return NULL;
-        }
-        item->SetOwnerGuid(ObjectGuid(HIGHGUID_PLAYER, owner));
-        itemGuids.push_back(item->GetGUIDLow());
-
-        AuctionEntry* auction = new AuctionEntry();
-        auction->Id = auctionId;
-        auction->itemGuidLow = item->GetGUIDLow();
-        auction->itemTemplate = itemId;
-        auction->itemCount = 1;
-        auction->itemRandomPropertyId = 0;
-        auction->owner = owner;
-        auction->startbid = 10;
-        auction->bid = bid;
-        auction->buyout = buyout;
-        auction->expireTime = static_cast<time_t>(now + HOUR);
-        auction->bidder = bidder;
-        auction->deposit = deposit;
-        auction->auctionHouseEntry = &house;
-
-        CharacterDatabase.BeginTransaction();
-        item->SaveToDB();
-        auction->SaveToDB();
-        if (!CharacterDatabase.CommitTransactionChecked())
-        {
-            delete item;
-            delete auction;
-            return NULL;
-        }
-        sAuctionMgr.AddAItem(item);
-        return auction;
-    };
-
-    auto rowState = [](std::string const& key) -> uint32
-    {
-        CustodyRow row;
-        return CustodyLedger::Get(key, row) ? uint32(row.state) : 255u;
-    };
-    auto auctionExists = [](uint32 auctionId) -> bool
-    {
-        return CustodyLedger::AuctionExists(auctionId);
-    };
-    auto mailCount = [itemId](uint32 receiver, MailAuctionAnswers answer) -> uint32
-    {
-        std::unique_ptr<QueryResult> result(CharacterDatabase.PQuery(
-            "SELECT COUNT(*) FROM `mail` WHERE `receiver`=%u "
-            "AND `subject`='%u:0:%u'", receiver, itemId, uint32(answer)));
-        return result ? result->Fetch()[0].GetUInt32() : 0u;
-    };
-    auto mailMoney = [itemId](uint32 receiver, MailAuctionAnswers answer) -> uint64
-    {
-        std::unique_ptr<QueryResult> result(CharacterDatabase.PQuery(
-            "SELECT COALESCE(SUM(`money`),0) FROM `mail` WHERE `receiver`=%u "
-            "AND `subject`='%u:0:%u'", receiver, itemId, uint32(answer)));
-        return result ? result->Fetch()[0].GetUInt64() : 0u;
-    };
-    auto itemMailCount = [](uint32 receiver, uint32 itemGuid) -> uint32
-    {
-        std::unique_ptr<QueryResult> result(CharacterDatabase.PQuery(
-            "SELECT COUNT(*) FROM `mail_items` WHERE `receiver`=%u AND `item_guid`=%u",
-            receiver, itemGuid));
-        return result ? result->Fetch()[0].GetUInt32() : 0u;
-    };
-    auto characterMoney = [](uint32 guid) -> uint32
-    {
-        std::unique_ptr<QueryResult> result(CharacterDatabase.PQuery(
-            "SELECT `money` FROM `characters` WHERE `guid`=%u", guid));
-        return result ? result->Fetch()[0].GetUInt32() : 0u;
-    };
-    auto sellerRows = [](uint32 auctionId) -> uint32
-    {
-        std::unique_ptr<QueryResult> result(CharacterDatabase.PQuery(
-            "SELECT COUNT(*) FROM `custody_ledger` WHERE `auction_id`=%u "
-            "AND `state`=0 AND (`idem_key` IN ('item:%u','dep:%u') "
-            "OR `role` IN (%u,%u))",
-            auctionId, auctionId, auctionId,
-            uint32(ROLE_ITEM), uint32(ROLE_DEPOSIT)));
-        return result ? result->Fetch()[0].GetUInt32() : 0u;
-    };
-    auto clearFixtureMail = []()
-    {
-        CharacterDatabase.DirectExecute(
-            "DELETE FROM `mail_items` WHERE `receiver` IN (9501,9502,9503)");
-        CharacterDatabase.DirectExecute(
-            "DELETE FROM `mail` WHERE `receiver` IN (9501,9502,9503)");
-    };
-
-    // Exact runtime route matrix, including the seller-only unsold-expiry fact.
-    seedRow("item:995101", CUSTODY_ITEM, ROLE_ITEM,
-            sellerGuid, 0, 1, 995101);
-    seedRow("dep:995101", CUSTODY_GOLD, ROLE_DEPOSIT,
-            sellerGuid, 5, 0, 995101);
-    seedRow("bid:995102:1", CUSTODY_GOLD, ROLE_BID,
-            bidderGuid, 20, 0, 995102);
-    seedRow("resolve:test:995103", CUSTODY_GOLD, ROLE_RESOLUTION,
-            0, 0, 0, 995103);
-    seedRow("botlist:test:995104", CUSTODY_ITEM, ROLE_RESOLUTION,
-            AHBOT_SYSTEM_OWNER_GUID, 0, 4, 995104);
-    seedRow("botlist:test:995105", CUSTODY_ITEM, ROLE_RESOLUTION,
-            AHBOT_SYSTEM_OWNER_GUID, 0, 5, 995105);
-    seedRow("bid:995105:1", CUSTODY_GOLD, ROLE_BID,
-            bidderGuid, 50, 0, 995105);
-    seedRow("botlist:test:995106", CUSTODY_ITEM, ROLE_RESOLUTION,
-            AHBOT_SYSTEM_OWNER_GUID, 0, 6, 995106);
-    seedRow("item:995106", CUSTODY_ITEM, ROLE_ITEM,
-            AHBOT_SYSTEM_OWNER_GUID, 0, 6, 995106);
-
-    struct RouteExpectation
-    {
-        uint32 auctionId;
-        bool seller;
-        bool bid;
-    };
-    RouteExpectation const routeExpectations[] = {
-        { 995101, true,  false },
-        { 995102, false, true  },
-        { 995103, false, false },
-        { 995104, false, false },
-        { 995105, false, true  },
-        { 995106, false, false },
-    };
-    for (size_t i = 0; i < sizeof(routeExpectations) / sizeof(routeExpectations[0]); ++i)
-    {
-        CustodyRouteState const route =
-            CustodyLedger::GetRouteState(routeExpectations[i].auctionId);
-        if (route.usesPlayerSellerCustody != routeExpectations[i].seller ||
-            route.hasLiveBidCustody != routeExpectations[i].bid)
-        {
-            printf("ahcustodyroute FAIL: route matrix mismatch auction=%u\n",
-                   routeExpectations[i].auctionId);
-            pass = false;
-        }
-    }
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `custody_ledger` WHERE `auction_id` BETWEEN 995100 AND 995109");
-
-    // Marker-only first bid remains on the legacy path and creates no bid or
-    // seller custody while debiting/persisting exactly once.
-    {
-        uint32 const auctionId = 995110;
-        AuctionEntry* auction = createAuction(
-            auctionId, sellerGuid, 0, 0, 0, 20);
-        if (!auction)
-        {
-            printf("ahcustodyroute FAIL: legacy first-bid fixture creation\n");
-            pass = false;
-        }
-        else
-        {
-            seedRow("botlist:test:995110", CUSTODY_ITEM, ROLE_RESOLUTION,
-                    AHBOT_SYSTEM_OWNER_GUID, 0, auction->itemGuidLow, auctionId);
-            CustodyRouteState const route = CustodyLedger::GetRouteState(auctionId);
-            WorldSession session(9502, std::shared_ptr<proto::IClientLink>(),
-                                 std::shared_ptr<SessionMailbox>(), SEC_PLAYER,
-                                 0, LOCALE_enUS);
-            Player bidder(&session);
-            session.SetPlayer(&bidder);
-            bidder._Create(bidderGuid, HIGHGUID_PLAYER);
-            bidder.SetMoney(1000);
-            bool const active = auction->UpdateBid(100, &bidder);
-            CharacterDatabase.BeginTransaction();
-            CharacterDatabase.CommitTransactionChecked();
-
-            std::unique_ptr<QueryResult> persisted(CharacterDatabase.PQuery(
-                "SELECT `buyguid`,`lastbid` FROM `auction` WHERE `id`=%u",
-                auctionId));
-            std::unique_ptr<QueryResult> bidRows(CharacterDatabase.PQuery(
-                "SELECT COUNT(*) FROM `custody_ledger` WHERE `auction_id`=%u "
-                "AND `state`=0 AND `role`=%u",
-                auctionId, uint32(ROLE_BID)));
-            if (route.usesPlayerSellerCustody || route.hasLiveBidCustody ||
-                !active || bidder.GetMoney() != 900 ||
-                characterMoney(bidderGuid) != 900 || !persisted ||
-                persisted->Fetch()[0].GetUInt32() != bidderGuid ||
-                persisted->Fetch()[1].GetUInt32() != 100 || !bidRows ||
-                bidRows->Fetch()[0].GetUInt32() != 0 ||
-                rowState("botlist:test:995110") != CST_RESERVED)
-            {
-                printf("ahcustodyroute FAIL: marker-only first bid left legacy behavior\n");
-                pass = false;
-            }
-            session.SetPlayer(NULL);
-
-            Item* liveItem = sAuctionMgr.GetAItem(auction->itemGuidLow);
-            sAuctionMgr.RemoveAItem(auction->itemGuidLow);
-            delete liveItem;
-            delete auction;
-            CharacterDatabase.DirectPExecute(
-                "DELETE FROM `auction` WHERE `id`=%u", auctionId);
-            CharacterDatabase.DirectPExecute(
-                "DELETE FROM `custody_ledger` WHERE `auction_id`=%u", auctionId);
-        }
-    }
-
-    // Bid-winning expiry on a bot listing: seller and winner settlement remains
-    // legacy-equivalent, while only the player bid row is terminalized.
-    {
-        clearFixtureMail();
-        uint32 const auctionId = 995120;
-        AuctionEntry* auction = createAuction(
-            auctionId, sellerGuid, bidderGuid, 100, 0, 20);
-        if (!auction)
-        {
-            printf("ahcustodyroute FAIL: bid-only win fixture creation\n");
-            pass = false;
-        }
-        else
-        {
-            uint32 const itemGuid = auction->itemGuidLow;
-            std::string const markerKey = "botlist:test:995120";
-            std::string const bidKey = "bid:995120:1";
-            seedRow(markerKey, CUSTODY_ITEM, ROLE_RESOLUTION,
-                    AHBOT_SYSTEM_OWNER_GUID, 0, itemGuid, auctionId);
-            seedRow(bidKey, CUSTODY_GOLD, ROLE_BID,
-                    bidderGuid, 100, 0, auctionId);
-            CustodyRouteState const route = CustodyLedger::GetRouteState(auctionId);
-            CustodyDeferred def;
-            CharacterDatabase.BeginTransaction();
-            auction->AuctionBidWinningCustody(NULL, def,
-                                              route.usesPlayerSellerCustody,
-                                              route.hasLiveBidCustody, bidKey);
-            bool const committed = CharacterDatabase.CommitTransactionChecked();
-            if (committed)
-            {
-                def.run();
-            }
-            if (!committed || route.usesPlayerSellerCustody ||
-                !route.hasLiveBidCustody || auctionExists(auctionId) ||
-                rowState(bidKey) != CST_TERMINAL_OK ||
-                rowState(markerKey) != CST_RESERVED || sellerRows(auctionId) != 0 ||
-                mailCount(sellerGuid, AUCTION_SUCCESSFUL) != 1 ||
-                mailMoney(sellerGuid, AUCTION_SUCCESSFUL) == 0 ||
-                mailCount(bidderGuid, AUCTION_WON) != 1 ||
-                itemMailCount(bidderGuid, itemGuid) != 1)
-            {
-                printf("ahcustodyroute FAIL: bid-only winning expiry conservation\n");
-                pass = false;
-            }
-        }
-    }
-
-    // Same-bidder buyout preserves bot provenance, debits only the delta, and
-    // terminalizes the existing bid row without inventing seller rows.
-    {
-        clearFixtureMail();
-        uint32 const auctionId = 995121;
-        AuctionEntry* auction = createAuction(
-            auctionId, sellerGuid, bidderGuid, 40, 100, 20);
-        if (!auction)
-        {
-            printf("ahcustodyroute FAIL: buyout fixture creation\n");
-            pass = false;
-        }
-        else
-        {
-            uint32 const itemGuid = auction->itemGuidLow;
-            std::string const markerKey = "botlist:test:995121";
-            std::string const bidKey = "bid:995121:1";
-            seedRow(markerKey, CUSTODY_ITEM, ROLE_RESOLUTION,
-                    AHBOT_SYSTEM_OWNER_GUID, 0, itemGuid, auctionId);
-            seedRow(bidKey, CUSTODY_GOLD, ROLE_BID,
-                    bidderGuid, 40, 0, auctionId);
-
-            CharacterDatabase.DirectPExecute(
-                "UPDATE `characters` SET `money`=1000 WHERE `guid`=%u",
-                bidderGuid);
-            WorldSession session(9502, std::shared_ptr<proto::IClientLink>(),
-                                 std::shared_ptr<SessionMailbox>(), SEC_PLAYER,
-                                 0, LOCALE_enUS);
-            Player bidder(&session);
-            session.SetPlayer(&bidder);
-            bidder._Create(bidderGuid, HIGHGUID_PLAYER);
-            bidder.SetMoney(1000);
-
-            CustodyDeferred def;
-            CharacterDatabase.BeginTransaction();
-            bool const active = auction->UpdateBidCustody(
-                100, &bidder, def, false, true, bidKey);
-            bool const committed = CharacterDatabase.CommitTransactionChecked();
-            if (committed)
-            {
-                def.run();
-            }
-            if (!committed || active || bidder.GetMoney() != 940 ||
-                characterMoney(bidderGuid) != 940 || auctionExists(auctionId) ||
-                rowState(bidKey) != CST_TERMINAL_OK ||
-                rowState(markerKey) != CST_RESERVED || sellerRows(auctionId) != 0 ||
-                mailCount(sellerGuid, AUCTION_SUCCESSFUL) != 1 ||
-                itemMailCount(bidderGuid, itemGuid) != 1)
-            {
-                printf("ahcustodyroute FAIL: bid-only buyout conservation\n");
-                pass = false;
-            }
-            session.SetPlayer(NULL);
-        }
-    }
-
-    // Owner cancel on a bot listing refunds the bidder and returns the item,
-    // while only bid custody transitions and the bot marker remains reserved.
-    {
-        clearFixtureMail();
-        uint32 const auctionId = 995122;
-        AuctionEntry* auction = createAuction(
-            auctionId, sellerGuid, otherBidderGuid, 100, 0, 20);
-        if (!auction)
-        {
-            printf("ahcustodyroute FAIL: cancel fixture creation\n");
-            pass = false;
-        }
-        else
-        {
-            uint32 const itemGuid = auction->itemGuidLow;
-            std::string const markerKey = "botlist:test:995122";
-            std::string const bidKey = "bid:995122:1";
-            seedRow(markerKey, CUSTODY_ITEM, ROLE_RESOLUTION,
-                    AHBOT_SYSTEM_OWNER_GUID, 0, itemGuid, auctionId);
-            seedRow(bidKey, CUSTODY_GOLD, ROLE_BID,
-                    otherBidderGuid, 100, 0, auctionId);
-
-            CharacterDatabase.DirectPExecute(
-                "UPDATE `characters` SET `money`=1000 WHERE `guid`=%u",
-                sellerGuid);
-            WorldSession session(9501, std::shared_ptr<proto::IClientLink>(),
-                                 std::shared_ptr<SessionMailbox>(), SEC_PLAYER,
-                                 0, LOCALE_enUS);
-            Player seller(&session);
-            session.SetPlayer(&seller);
-            seller._Create(sellerGuid, HIGHGUID_PLAYER);
-            seller.SetMoney(1000);
-            uint32 const cut = auction->GetAuctionCut();
-
-            CustodyDeferred def;
-            CharacterDatabase.BeginTransaction();
-            auction->PrepareCancelCustody(&seller, def, false, true,
-                                          bidKey, cut);
-            bool const committed = CharacterDatabase.CommitTransactionChecked();
-            if (committed)
-            {
-                def.run();
-            }
-            if (!committed || auctionExists(auctionId) ||
-                seller.GetMoney() != 1000 - cut ||
-                characterMoney(sellerGuid) != 1000 - cut ||
-                rowState(bidKey) != CST_TERMINAL_BACK ||
-                rowState(markerKey) != CST_RESERVED || sellerRows(auctionId) != 0 ||
-                mailCount(otherBidderGuid, AUCTION_CANCELLED_TO_BIDDER) != 1 ||
-                mailMoney(otherBidderGuid, AUCTION_CANCELLED_TO_BIDDER) != 100 ||
-                mailCount(sellerGuid, AUCTION_CANCELED) != 1 ||
-                itemMailCount(sellerGuid, itemGuid) != 1)
-            {
-                printf("ahcustodyroute FAIL: bid-only cancel conservation\n");
-                pass = false;
-            }
-            session.SetPlayer(NULL);
-            delete auction;
-        }
-    }
-
-    // A same-bidder raise can meet player-seller custody layered over a legacy
-    // bid. Debit only the delta, then represent the full standing bid in one row.
-    {
-        clearFixtureMail();
-        uint32 const auctionId = 995124;
-        AuctionEntry* auction = createAuction(
-            auctionId, sellerGuid, bidderGuid, 40, 0, 20);
-        if (!auction)
-        {
-            printf("ahcustodyroute FAIL: legacy same-bid fixture creation\n");
-            pass = false;
-        }
-        else
-        {
-            std::string const itemKey = "item:995124";
-            std::string const depKey = "dep:995124";
-            seedRow(itemKey, CUSTODY_ITEM, ROLE_ITEM,
-                    sellerGuid, 0, auction->itemGuidLow, auctionId);
-            seedRow(depKey, CUSTODY_GOLD, ROLE_DEPOSIT,
-                    sellerGuid, 20, 0, auctionId);
-
-            CharacterDatabase.DirectPExecute(
-                "UPDATE `characters` SET `money`=1000 WHERE `guid`=%u",
-                bidderGuid);
-            WorldSession session(9502, std::shared_ptr<proto::IClientLink>(),
-                                 std::shared_ptr<SessionMailbox>(), SEC_PLAYER,
-                                 0, LOCALE_enUS);
-            Player bidder(&session);
-            session.SetPlayer(&bidder);
-            bidder._Create(bidderGuid, HIGHGUID_PLAYER);
-            bidder.SetMoney(1000);
-
-            CustodyRouteState const route = CustodyLedger::GetRouteState(auctionId);
-            CustodyDeferred def;
-            CharacterDatabase.BeginTransaction();
-            bool const active = auction->UpdateBidCustody(
-                60, &bidder, def, route.usesPlayerSellerCustody,
-                route.hasLiveBidCustody, "");
-            bool const committed = CharacterDatabase.CommitTransactionChecked();
-            if (committed)
-            {
-                def.run();
-            }
-
-            std::unique_ptr<QueryResult> bidRows(CharacterDatabase.PQuery(
-                "SELECT COUNT(*),COALESCE(MAX(`owner_guid`),0),"
-                "COALESCE(MAX(`amount`),0) FROM `custody_ledger` "
-                "WHERE `auction_id`=%u AND `state`=0 AND `role`=%u",
-                auctionId, uint32(ROLE_BID)));
-            Field* bidFields = bidRows ? bidRows->Fetch() : NULL;
-            if (!committed || !active || !route.usesPlayerSellerCustody ||
-                route.hasLiveBidCustody || bidder.GetMoney() != 980 ||
-                characterMoney(bidderGuid) != 980 || !auctionExists(auctionId) ||
-                auction->bidder != bidderGuid || auction->bid != 60 ||
-                !bidFields || bidFields[0].GetUInt32() != 1 ||
-                bidFields[1].GetUInt32() != bidderGuid ||
-                bidFields[2].GetUInt32() != 60 ||
-                rowState(itemKey) != CST_RESERVED ||
-                rowState(depKey) != CST_RESERVED)
-            {
-                printf("ahcustodyroute FAIL: legacy same-bid custody promotion\n");
-                pass = false;
-            }
-            session.SetPlayer(NULL);
-            delete auction;
-        }
-    }
-
-    // Replacing a legacy standing bid under player-seller custody preserves the
-    // old bidder's mail refund and starts custody only for the replacement bid.
-    {
-        clearFixtureMail();
-        uint32 const auctionId = 995125;
-        AuctionEntry* auction = createAuction(
-            auctionId, sellerGuid, otherBidderGuid, 40, 0, 20);
-        if (!auction)
-        {
-            printf("ahcustodyroute FAIL: legacy outbid fixture creation\n");
-            pass = false;
-        }
-        else
-        {
-            std::string const itemKey = "item:995125";
-            std::string const depKey = "dep:995125";
-            seedRow(itemKey, CUSTODY_ITEM, ROLE_ITEM,
-                    sellerGuid, 0, auction->itemGuidLow, auctionId);
-            seedRow(depKey, CUSTODY_GOLD, ROLE_DEPOSIT,
-                    sellerGuid, 20, 0, auctionId);
-
-            CharacterDatabase.DirectPExecute(
-                "UPDATE `characters` SET `money`=1000 WHERE `guid`=%u",
-                bidderGuid);
-            WorldSession session(9502, std::shared_ptr<proto::IClientLink>(),
-                                 std::shared_ptr<SessionMailbox>(), SEC_PLAYER,
-                                 0, LOCALE_enUS);
-            Player bidder(&session);
-            session.SetPlayer(&bidder);
-            bidder._Create(bidderGuid, HIGHGUID_PLAYER);
-            bidder.SetMoney(1000);
-
-            CustodyRouteState const route = CustodyLedger::GetRouteState(auctionId);
-            CustodyDeferred def;
-            CharacterDatabase.BeginTransaction();
-            bool const active = auction->UpdateBidCustody(
-                60, &bidder, def, route.usesPlayerSellerCustody,
-                route.hasLiveBidCustody, "");
-            bool const committed = CharacterDatabase.CommitTransactionChecked();
-            if (committed)
-            {
-                def.run();
-            }
-
-            std::unique_ptr<QueryResult> bidRows(CharacterDatabase.PQuery(
-                "SELECT COUNT(*),COALESCE(MAX(`owner_guid`),0),"
-                "COALESCE(MAX(`amount`),0) FROM `custody_ledger` "
-                "WHERE `auction_id`=%u AND `state`=0 AND `role`=%u",
-                auctionId, uint32(ROLE_BID)));
-            Field* bidFields = bidRows ? bidRows->Fetch() : NULL;
-            if (!committed || !active || !route.usesPlayerSellerCustody ||
-                route.hasLiveBidCustody || bidder.GetMoney() != 940 ||
-                characterMoney(bidderGuid) != 940 || !auctionExists(auctionId) ||
-                !bidFields || bidFields[0].GetUInt32() != 1 ||
-                bidFields[1].GetUInt32() != bidderGuid ||
-                bidFields[2].GetUInt32() != 60 ||
-                mailCount(otherBidderGuid, AUCTION_OUTBIDDED) != 1 ||
-                mailMoney(otherBidderGuid, AUCTION_OUTBIDDED) != 40 ||
-                rowState(itemKey) != CST_RESERVED ||
-                rowState(depKey) != CST_RESERVED)
-            {
-                printf("ahcustodyroute FAIL: legacy bidder replacement\n");
-                pass = false;
-            }
-            session.SetPlayer(NULL);
-            delete auction;
-        }
-    }
-
-    // Bid-only custody never selects the unsold custody path. Even malformed
-    // no-bid book facts retain the legacy item return and leave bid provenance.
-    {
-        clearFixtureMail();
-        uint32 const auctionId = 995126;
-        AuctionEntry* auction = createAuction(
-            auctionId, sellerGuid, 0, 0, 0, 20);
-        if (!auction)
-        {
-            printf("ahcustodyroute FAIL: bid-only unsold fixture creation\n");
-            pass = false;
-        }
-        else
-        {
-            uint32 const itemGuid = auction->itemGuidLow;
-            std::string const markerKey = "botlist:test:995126";
-            std::string const bidKey = "bid:995126:1";
-            seedRow(markerKey, CUSTODY_ITEM, ROLE_RESOLUTION,
-                    AHBOT_SYSTEM_OWNER_GUID, 0, itemGuid, auctionId);
-            seedRow(bidKey, CUSTODY_GOLD, ROLE_BID,
-                    bidderGuid, 50, 0, auctionId);
-            CustodyRouteState const route = CustodyLedger::GetRouteState(auctionId);
-            auction->expireTime = static_cast<time_t>(-1);
-            AuctionHouseObject* houseMap = sAuctionMgr.GetAuctionsMap(&house);
-            houseMap->AddAuction(auction);
-            houseMap->Update();
-            CharacterDatabase.BeginTransaction();
-            CharacterDatabase.CommitTransactionChecked();
-
-            bool const mapPresent = houseMap->GetAuction(auctionId) != NULL;
-            bool const dbPresent = auctionExists(auctionId);
-            uint32 const bidState = rowState(bidKey);
-            uint32 const markerState = rowState(markerKey);
-            uint32 const sellerRowCount = sellerRows(auctionId);
-            uint32 const expiredMailCount = mailCount(sellerGuid, AUCTION_EXPIRED);
-            uint32 const expiredItemCount = itemMailCount(sellerGuid, itemGuid);
-            if (route.usesPlayerSellerCustody || !route.hasLiveBidCustody ||
-                mapPresent || dbPresent || bidState != CST_RESERVED ||
-                markerState != CST_RESERVED || sellerRowCount != 0 ||
-                expiredMailCount != 1 || expiredItemCount != 1)
-            {
-                printf("ahcustodyroute FAIL: bid-only unsold routing "
-                       "route=%u/%u map=%u db=%u states=%u/%u seller=%u mail=%u/%u\n",
-                       uint32(route.usesPlayerSellerCustody),
-                       uint32(route.hasLiveBidCustody), uint32(mapPresent),
-                       uint32(dbPresent), bidState, markerState,
-                       sellerRowCount, expiredMailCount, expiredItemCount);
-                pass = false;
-            }
-        }
-    }
-
-    // Existing full player seller+bid custody still terminalizes all three
-    // value rows after a runtime custody disable. The flag stops maintenance
-    // and config-gated entry; it must not abandon durable rows already in flight.
-    {
-        clearFixtureMail();
-        uint32 const auctionId = 995123;
-        AuctionEntry* auction = createAuction(
-            auctionId, sellerGuid, bidderGuid, 100, 0, 20);
-        if (!auction)
-        {
-            printf("ahcustodyroute FAIL: full custody fixture creation\n");
-            pass = false;
-        }
-        else
-        {
-            uint32 const itemGuid = auction->itemGuidLow;
-            std::string const itemKey = "item:995123";
-            std::string const depKey = "dep:995123";
-            std::string const bidKey = "bid:995123:1";
-            seedRow(itemKey, CUSTODY_ITEM, ROLE_ITEM,
-                    sellerGuid, 0, itemGuid, auctionId);
-            seedRow(depKey, CUSTODY_GOLD, ROLE_DEPOSIT,
-                    sellerGuid, 20, 0, auctionId);
-            seedRow(bidKey, CUSTODY_GOLD, ROLE_BID,
-                    bidderGuid, 100, 0, auctionId);
-
-            auction->expireTime = static_cast<time_t>(-1);
-            AuctionHouseObject* houseMap = sAuctionMgr.GetAuctionsMap(&house);
-            houseMap->AddAuction(auction);
-            bool const custodyWasEnabled = sWorld.IsAhCustodyEnabled();
-            sWorld.setConfig(CONFIG_BOOL_AH_CUSTODY, false);
-            houseMap->Update();
-            sWorld.setConfig(CONFIG_BOOL_AH_CUSTODY, custodyWasEnabled);
-
-            if (auctionExists(auctionId) ||
-                rowState(itemKey) != CST_TERMINAL_OK ||
-                rowState(depKey) != CST_TERMINAL_BACK ||
-                rowState(bidKey) != CST_TERMINAL_OK ||
-                mailCount(sellerGuid, AUCTION_SUCCESSFUL) != 1 ||
-                mailCount(bidderGuid, AUCTION_WON) != 1 ||
-                itemMailCount(bidderGuid, itemGuid) != 1)
-            {
-                printf("ahcustodyroute FAIL: runtime-disable winning regression\n");
-                pass = false;
-            }
-        }
-    }
-
-    // Bot bids share the legacy UpdateBid entry point with the fallback buyer.
-    {
-        uint32 const auctionId = 995130u;
-        AuctionEntry* auction = createAuction(
-            auctionId, sellerGuid, bidderGuid, 100u, 0u, 20u);
-        if (!auction)
-        {
-            return 2;
-        }
-        seedRow("bid:995130:1", CUSTODY_GOLD, ROLE_BID,
-                bidderGuid, 100u, 0u, auctionId);
-        uint32 const refunds = mailCount(bidderGuid, AUCTION_OUTBIDDED);
-        uint64 const refundMoney = mailMoney(bidderGuid, AUCTION_OUTBIDDED);
-        auction->UpdateBid(120u);
-        CharacterDatabase.BeginTransaction();
-        CharacterDatabase.CommitTransactionChecked();
-        if (rowState("bid:995130:1") != CST_TERMINAL_BACK ||
-            auction->bidder != 0u || auction->bid != 120u ||
-            mailCount(bidderGuid, AUCTION_OUTBIDDED) != refunds + 1u ||
-            mailMoney(bidderGuid, AUCTION_OUTBIDDED) != refundMoney + 100u)
-        {
-            printf("ahcustodyroute FAIL: bot displacement stranded player bid\n");
-            pass = false;
-        }
-        AuctionHouseObject* map = sAuctionMgr.GetAuctionsMap(&house);
-        map->AddAuction(auction);
-        auction->expireTime = static_cast<time_t>(-1);
-        map->Update();
-        CharacterDatabase.BeginTransaction();
-        CharacterDatabase.CommitTransactionChecked();
-        if (auctionExists(auctionId))
-        {
-            printf("ahcustodyroute FAIL: bot-held auction could not expire\n");
-            pass = false;
-        }
-        if (AuctionEntry* leftover = map->GetAuction(auctionId))
-        {
-            map->RemoveAuction(auctionId);
-            delete leftover;
-        }
-    }
-
-    // A failed bot buyout must roll back refund, seller payout, book and escrow.
-    {
-        uint32 const auctionId = 995131u;
-        AuctionEntry* auction = createAuction(
-            auctionId, sellerGuid, bidderGuid, 100u, 200u, 20u);
-        if (!auction)
-        {
-            return 2;
-        }
-        uint32 const itemGuid = auction->itemGuidLow;
-        Item* const cached = sAuctionMgr.GetAItem(itemGuid);
-        seedRow("bid:995131:1", CUSTODY_GOLD, ROLE_BID,
-                bidderGuid, 100u, 0u, auctionId);
-        seedRow("item:995131", CUSTODY_ITEM, ROLE_ITEM,
-                sellerGuid, 0u, itemGuid, auctionId);
-        seedRow("dep:995131", CUSTODY_GOLD, ROLE_DEPOSIT,
-                sellerGuid, 20u, 0u, auctionId);
-        uint32 const refunds = mailCount(bidderGuid, AUCTION_OUTBIDDED);
-        uint64 const refundMoney = mailMoney(bidderGuid, AUCTION_OUTBIDDED);
-        uint32 const sales = mailCount(sellerGuid, AUCTION_SUCCESSFUL);
-        uint64 const salesMoney = mailMoney(sellerGuid, AUCTION_SUCCESSFUL);
-        uint32 const payout = 220u - uint32(house.cutPercent * 200u *
-            sWorld.getConfig(CONFIG_FLOAT_RATE_AUCTION_CUT) / 100.0f);
-        AuctionHouseObject* map = sAuctionMgr.GetAuctionsMap(&house);
-        map->AddAuction(auction);
-        std::string originalConfig;
-        std::string testConfig;
-        if (!TestArmCustodyCommitFailure("bot-bid", originalConfig, testConfig))
-        {
-            TestRestoreConfig(originalConfig, testConfig);
-            return 2;
-        }
-        auction->UpdateBid(200u);
-        bool const restored = TestRestoreConfig(originalConfig, testConfig);
-        CharacterDatabase.BeginTransaction();
-        CharacterDatabase.CommitTransactionChecked();
-        AuctionEntry* retry = map->GetAuction(auctionId);
-        if (!restored || !retry || !auctionExists(auctionId) ||
-            retry->bidder != bidderGuid || retry->bid != 100u ||
-            sAuctionMgr.GetAItem(itemGuid) != cached ||
-            rowState("bid:995131:1") != CST_RESERVED ||
-            rowState("item:995131") != CST_RESERVED ||
-            rowState("dep:995131") != CST_RESERVED ||
-            mailCount(bidderGuid, AUCTION_OUTBIDDED) != refunds ||
-            mailCount(sellerGuid, AUCTION_SUCCESSFUL) != sales)
-        {
-            printf("ahcustodyroute FAIL: failed bot buyout moved value\n");
-            pass = false;
-        }
-        if (retry)
-        {
-            retry->UpdateBid(200u);
-            CharacterDatabase.BeginTransaction();
-            CharacterDatabase.CommitTransactionChecked();
-            std::unique_ptr<QueryResult> itemRow(CharacterDatabase.PQuery(
-                "SELECT 1 FROM `item_instance` WHERE `guid`=%u", itemGuid));
-            if (auctionExists(auctionId) || map->GetAuction(auctionId) ||
-                sAuctionMgr.GetAItem(itemGuid) || itemRow ||
-                rowState("bid:995131:1") != CST_TERMINAL_BACK ||
-                rowState("item:995131") != CST_TERMINAL_OK ||
-                rowState("dep:995131") != CST_TERMINAL_BACK ||
-                mailCount(bidderGuid, AUCTION_OUTBIDDED) != refunds + 1u ||
-                mailMoney(bidderGuid, AUCTION_OUTBIDDED) != refundMoney + 100u ||
-                mailCount(sellerGuid, AUCTION_SUCCESSFUL) != sales + 1u ||
-                mailMoney(sellerGuid, AUCTION_SUCCESSFUL) != salesMoney + payout)
-            {
-                printf("ahcustodyroute FAIL: bot buyout retry did not settle once\n");
-                pass = false;
-            }
-        }
-        if (AuctionEntry* leftover = map->GetAuction(auctionId))
-        {
-            map->RemoveAuction(auctionId);
-            delete leftover;
-        }
-    }
-
-    for (size_t i = 0; i < itemGuids.size(); ++i)
-    {
-        Item* liveItem = sAuctionMgr.GetAItem(itemGuids[i]);
-        if (liveItem)
-        {
-            sAuctionMgr.RemoveAItem(itemGuids[i]);
-            delete liveItem;
-        }
-        CharacterDatabase.DirectPExecute(
-            "DELETE FROM `mail_items` WHERE `item_guid`=%u", itemGuids[i]);
-        CharacterDatabase.DirectPExecute(
-            "DELETE FROM `item_instance` WHERE `guid`=%u", itemGuids[i]);
-    }
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `mail` WHERE `receiver` IN (9501,9502,9503)");
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `custody_ledger` WHERE `auction_id` BETWEEN 995100 AND 995199");
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `auction` WHERE `id` BETWEEN 995100 AND 995199");
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `characters` WHERE `guid` IN (9501,9502,9503)");
-
-    if (pass)
-    {
-        printf("ahcustodyroute OK\n");
-        return 0;
-    }
-    return 2;
-}
-
-/// No-work routing must avoid SQL, while reservations survive config disable.
-static int RunAhRouteGateTest()
-{
-    CharacterDatabase.AllowAsyncTransactions();
-    std::unique_ptr<QueryResult> count(CharacterDatabase.Query(
-        "SELECT COUNT(*) FROM `custody_ledger` WHERE `state`=0"));
-    if (!count || count->Fetch()[0].GetUInt64() != 0u)
-    {
-        printf("ahroutegate FAIL: requires an empty disposable ledger\n");
-        return 2;
-    }
-    bool pass = true;
-    CustodyLedger::InitializeRouting();
-    if (!CharacterDatabase.DirectExecute(
-            "RENAME TABLE `custody_ledger` TO `custody_route_test_unavailable`"))
-    {
-        return 2;
-    }
-    // If routing attempts SQL despite known-empty startup, this becomes unknown.
-    CustodyRouteState const empty = CustodyLedger::GetRouteState(995190u);
-    bool const restored = CharacterDatabase.DirectExecute(
-        "RENAME TABLE `custody_route_test_unavailable` TO `custody_ledger`");
-    if (!restored)
-    {
-        printf("ahroutegate FAIL: could not restore ledger table\n");
-        return 2;
-    }
-    if (!empty.known || empty.usesPlayerSellerCustody || empty.hasLiveBidCustody)
-    {
-        printf("ahroutegate FAIL: known-empty route attempted SQL\n");
-        pass = false;
-    }
-    CharacterDatabase.BeginTransaction();
-    CustodyLedger::Insert(TestCustodyRow(0, "test:route-gate", CUSTODY_GOLD,
-        ROLE_BID, 9502u, 100u, 0u, 995190u));
-    if (!CharacterDatabase.CommitTransactionChecked())
-    {
-        return 2;
-    }
-    bool const wasEnabled = sWorld.IsAhCustodyEnabled();
-    sWorld.setConfig(CONFIG_BOOL_AH_CUSTODY, false);
-    CustodyRouteState const inserted = CustodyLedger::GetRouteState(995190u);
-    CustodyLedger::InitializeRouting();
-    CustodyRouteState const restarted = CustodyLedger::GetRouteState(995190u);
-    sWorld.setConfig(CONFIG_BOOL_AH_CUSTODY, wasEnabled);
-    if (!inserted.known || !inserted.hasLiveBidCustody ||
-        !restarted.known || !restarted.hasLiveBidCustody)
-    {
-        printf("ahroutegate FAIL: reservation lost after insertion/restart/disable\n");
-        pass = false;
-    }
-    if (!CharacterDatabase.DirectExecute(
-            "RENAME TABLE `custody_ledger` TO `custody_route_test_unavailable`"))
-    {
-        return 2;
-    }
-    CustodyLedger::InitializeRouting();
-    CustodyRouteState const failed = CustodyLedger::GetRouteState(995190u);
-    if (!CharacterDatabase.DirectExecute(
-            "RENAME TABLE `custody_route_test_unavailable` TO `custody_ledger`"))
-    {
-        return 2;
-    }
-    if (failed.known)
-    {
-        printf("ahroutegate FAIL: failed lookup treated as known legacy route\n");
-        pass = false;
-    }
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `custody_ledger` WHERE `idem_key`='test:route-gate'");
-    printf("ahroutegate %s\n", pass ? "OK" : "FAIL");
-    return pass ? 0 : 2;
-}
-
-/// Regression for a real SP-2 smoke failure: the worker committed a cancel and
-/// removed the auction, but mangosd missed the terminal result before restart.
-/// The pending map is then empty, so repair must replay from ah_worker_journal
-/// and mail the orphaned item_instance back to the seller, not merely
-/// terminalize the custody rows.
-static int RunAhRepairRecoveryTest()
-{
-    bool pass = true;
-    CharacterDatabase.AllowAsyncTransactions();
-
-    sObjectMgr.LoadItemPrototypes();
-
-    uint32 const ownerGuid = 1u;
-    uint32 const auctionId = 992001u;
-    uint64 const uuid = 0xABCD001ull;
-    uint64 const oldTime = static_cast<uint64>(time(NULL)) > 7200u
-        ? static_cast<uint64>(time(NULL)) - 7200u : 1u;
-
-    CharacterDatabase.DirectPExecute(
-        "DELETE FROM `custody_ledger` WHERE `auction_id`=%u", auctionId);
-    CharacterDatabase.DirectPExecute(
-        "DELETE FROM `ah_worker_journal` WHERE `auction_id`=%u OR `uuid`=%llu",
-        auctionId, static_cast<unsigned long long>(uuid));
-    CharacterDatabase.DirectPExecute(
-        "DELETE FROM `auction` WHERE `id`=%u", auctionId);
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `mail` WHERE `receiver`=1 AND `subject` LIKE '2589:%'");
-    CharacterDatabase.DirectExecute("DELETE FROM `characters` WHERE `guid`=1");
-    CharacterDatabase.DirectExecute(
-        "INSERT INTO `characters` (`guid`,`account`,`name`,`money`) "
-        "VALUES (1, 1, 'AhRepairRcv', 100000)");
-
-    sObjectMgr.SetHighestGuids();
-
-    uint32 itemId = 2589u;      // Linen Cloth
-    if (!ObjectMgr::GetItemPrototype(itemId))
-    {
-        std::unique_ptr<QueryResult> r(WorldDatabase.PQuery(
-            "SELECT `entry` FROM `item_template` "
-            "WHERE `InventoryType`=0 AND `stackable`>1 ORDER BY `entry` LIMIT 1"));
-        if (r)
-        {
-            itemId = r->Fetch()[0].GetUInt32();
-        }
-    }
-    if (!ObjectMgr::GetItemPrototype(itemId))
-    {
-        printf("ahrepair FAIL: no usable item prototype\n");
-        return 2;
-    }
-
-    Item* item = Item::CreateItem(itemId, 1);
-    if (!item)
-    {
-        printf("ahrepair FAIL: CreateItem returned NULL\n");
-        return 2;
-    }
-    item->SetOwnerGuid(ObjectGuid(HIGHGUID_PLAYER, ownerGuid));
-    uint32 const itemGuid = item->GetGUIDLow();
-
-    CharacterDatabase.BeginTransaction();
-    item->SaveToDB();
-    if (!CharacterDatabase.CommitTransactionChecked())
-    {
-        delete item;
-        printf("ahrepair FAIL: item seed commit failed\n");
-        return 2;
-    }
-    delete item;
-
-    PlayerMutationResult journalRes;
-    journalRes.uuid = uuid;
-    journalRes.op = uint8(IPC_PLAYER_CANCEL & 0xFFu);
-    journalRes.status = uint8(MUT_PREPARED);
-    journalRes.reason = 0;
-    journalRes.facts = MutationFacts();
-    journalRes.facts.auctionId = auctionId;
-    journalRes.facts.houseId = 7;
-    journalRes.facts.itemGuid = itemGuid;
-    journalRes.facts.itemTemplate = itemId;
-    journalRes.facts.randomPropertyId = 0;
-    journalRes.facts.sellerGuid = ownerGuid;
-    journalRes.facts.deposit = 32u;
-
-    ByteBuffer bb;
-    journalRes.Encode(bb);
-    std::string const factsHex = TestHexEncode(bb);
-
-    CharacterDatabase.BeginTransaction();
-    CharacterDatabase.PExecute(
-        "INSERT INTO `custody_ledger` "
-        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-        "VALUES ('dep:%u',0,0,0,%u,0,32,0,%u," UI64FMTD ",0),"
-        "       ('item:%u',1,3,0,%u,0,0,%u,%u," UI64FMTD ",0)",
-        auctionId, ownerGuid, auctionId, oldTime,
-        auctionId, ownerGuid, itemGuid, auctionId, oldTime);
-    CharacterDatabase.PExecute(
-        "INSERT INTO `ah_worker_journal` "
-        "(`uuid`,`auction_id`,`kind`,`state`,`facts`,`created_time`,`resolved_time`) "
-        "VALUES (%llu,%u,%u,1,'%s'," UI64FMTD "," UI64FMTD ")",
-        static_cast<unsigned long long>(uuid), auctionId,
-        uint32(IPC_PLAYER_CANCEL & 0xFFu), factsHex.c_str(), oldTime, oldTime);
-    if (!CharacterDatabase.CommitTransactionChecked())
-    {
-        printf("ahrepair FAIL: recovery seed commit failed\n");
-        pass = false;
-    }
-
-    TestCliCapture repairCapture;
-    CliHandler repairCli(0, SEC_ADMINISTRATOR, &repairCapture, &TestCliPrint);
-    if (!repairCli.ParseCommands("ah repair apply"))
-    {
-        printf("ahrepair FAIL: committed cancel command was not parsed\n");
-        pass = false;
-    }
-    if (CountCliChunks(repairCapture,
-            "mode=apply confirmed=2 pending=0 sweep-owned=0 repaired=2 skipped=0 failed=0") != 1u)
-    {
-        printf("ahrepair FAIL: committed cancel command summary mismatch\n");
-        pass = false;
-    }
-    if (CountCliChunks(repairCapture, "replayed committed cancel") != 1u)
-    {
-        printf("ahrepair FAIL: repeated auction rows replayed journal more than once\n");
-        pass = false;
-    }
-
-    auto rowState = [](char const* key) -> uint32
-    {
-        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
-            "SELECT `state` FROM `custody_ledger` WHERE `idem_key`='%s'", key));
-        return res ? res->Fetch()[0].GetUInt32() : 255u;
-    };
-
-    std::string const depKey = "dep:" + std::to_string(auctionId);
-    std::string const itemKey = "item:" + std::to_string(auctionId);
-    if (rowState(depKey.c_str()) != CST_TERMINAL_OK)
-    {
-        printf("ahrepair FAIL: deposit not TERMINAL_OK\n");
-        pass = false;
-    }
-    if (rowState(itemKey.c_str()) != CST_TERMINAL_OK)
-    {
-        printf("ahrepair FAIL: item custody not TERMINAL_OK\n");
-        pass = false;
-    }
-
-    {
-        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
-            "SELECT COUNT(*) FROM `mail_items` WHERE `receiver`=%u AND `item_guid`=%u",
-            ownerGuid, itemGuid));
-        if (!res || res->Fetch()[0].GetUInt64() != 1u)
-        {
-            printf("ahrepair FAIL: returned item mail missing\n");
-            pass = false;
-        }
-    }
-
-    {
-        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
-            "SELECT `checked` FROM `mail` m "
-            "JOIN `mail_items` mi ON mi.`mail_id`=m.`id` "
-            "WHERE mi.`receiver`=%u AND mi.`item_guid`=%u",
-            ownerGuid, itemGuid));
-        if (!res || !(res->Fetch()[0].GetUInt32() & MAIL_CHECK_MASK_COPIED))
-        {
-            printf("ahrepair FAIL: returned item mail missing copied mask\n");
-            pass = false;
-        }
-    }
-
-    {
-        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
-            "SELECT COUNT(*) FROM `character_inventory` WHERE `item`=%u", itemGuid));
-        if (res && res->Fetch()[0].GetUInt64() != 0u)
-        {
-            printf("ahrepair FAIL: item should not be placed directly in inventory\n");
-            pass = false;
-        }
-    }
-
-    // Generic apply and force-forfeit both preserve reserved bot provenance
-    // markers and their materialized item instances.
-    Item* protectedItem = Item::CreateItem(itemId, 1);
-    if (!protectedItem)
-    {
-        printf("ahrepair FAIL: protected marker item creation failed\n");
-        pass = false;
-    }
-    else
-    {
-        protectedItem->SetOwnerGuid(ObjectGuid(HIGHGUID_PLAYER,
-                                               AHBOT_SYSTEM_OWNER_GUID));
-        uint32 const protectedItemGuid = protectedItem->GetGUIDLow();
-        CharacterDatabase.BeginTransaction();
-        protectedItem->SaveToDB();
-        CharacterDatabase.PExecute(
-            "INSERT INTO `custody_ledger` "
-            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-            "VALUES ('botlist:test:repair:protected',1,4,0,%u,0,0,%u,992002,"
-            UI64FMTD ",0)",
-            AHBOT_SYSTEM_OWNER_GUID, protectedItemGuid, oldTime);
-        bool const markerSeeded = CharacterDatabase.CommitTransactionChecked();
-        delete protectedItem;
-
-        TestCliCapture markerApplyCapture;
-        CliHandler markerApplyCli(0, SEC_ADMINISTRATOR,
-                                  &markerApplyCapture, &TestCliPrint);
-        markerApplyCli.ParseCommands("ah repair apply");
-        TestCliCapture markerForceCapture;
-        CliHandler markerForceCli(0, SEC_ADMINISTRATOR,
-                                  &markerForceCapture, &TestCliPrint);
-        markerForceCli.ParseCommands(
-            "ah repair force-forfeit botlist:test:repair:protected");
-
-        CustodyRow protectedMarker;
-        std::unique_ptr<QueryResult> protectedItemRow(CharacterDatabase.PQuery(
-            "SELECT 1 FROM `item_instance` WHERE `guid`=%u", protectedItemGuid));
-        if (!markerSeeded ||
-            !CustodyLedger::Get("botlist:test:repair:protected", protectedMarker) ||
-            protectedMarker.state != CST_RESERVED || !protectedItemRow ||
-            CountCliChunks(markerApplyCapture,
-                "mode=apply confirmed=0 pending=0 sweep-owned=1 repaired=0 skipped=1 failed=0") != 1u ||
-            CountCliChunks(markerForceCapture, "reserved bot marker") != 1u)
-        {
-            printf("ahrepair FAIL: apply or force-forfeit mutated bot marker/item\n");
-            pass = false;
-        }
-
-        CharacterDatabase.DirectPExecute(
-            "DELETE FROM `custody_ledger` WHERE `idem_key`='botlist:test:repair:protected'");
-        CharacterDatabase.DirectPExecute(
-            "DELETE FROM `item_instance` WHERE `guid`=%u", protectedItemGuid);
-    }
-
-    CharacterDatabase.DirectPExecute(
-        "DELETE FROM `mail_items` WHERE `item_guid`=%u", itemGuid);
-    CharacterDatabase.DirectPExecute(
-        "DELETE FROM `item_instance` WHERE `guid`=%u", itemGuid);
-    CharacterDatabase.DirectPExecute(
-        "DELETE FROM `mail` WHERE `receiver`=%u AND `subject` LIKE '%u:%%'",
-        ownerGuid, itemId);
-    CharacterDatabase.DirectPExecute(
-        "DELETE FROM `custody_ledger` WHERE `auction_id`=%u", auctionId);
-    CharacterDatabase.DirectPExecute(
-        "DELETE FROM `ah_worker_journal` WHERE `auction_id`=%u OR `uuid`=%llu",
-        auctionId, static_cast<unsigned long long>(uuid));
-    CharacterDatabase.DirectExecute("DELETE FROM `characters` WHERE `guid`=1");
-
-    if (pass)
-    {
-        printf("ahrepair OK\n");
-        return 0;
-    }
-    return 2;
-}
-
-/// Reconcile-on-reconnect conservation regressions. A failed local release
-/// commit must retain the pending mutation, and committed worker facts that
-/// cannot be decoded must hold the reservation in-doubt rather than release it.
-static int RunAhReconcileTest()
-{
-    bool pass = true;
-    CharacterDatabase.AllowAsyncTransactions();
-
-    uint32 const commitAuction = 993101u;
-    uint32 const malformedAuction = 993102u;
-    uint32 const validAuction = 993104u;
-    uint64 const commitUuid = 0xC101ull;
-    uint64 const malformedUuid = 0xC102ull;
-    uint64 const validUuid = 0xC104ull;
-
-    CharacterDatabase.DirectPExecute(
-        "DELETE FROM `custody_ledger` "
-        "WHERE `auction_id` IN (993101,993102,993104) "
-        "OR `idem_key` IN ('resolve:%llu','resolve:%llu','resolve:%llu')",
-        static_cast<unsigned long long>(commitUuid),
-        static_cast<unsigned long long>(malformedUuid),
-        static_cast<unsigned long long>(validUuid));
-    CharacterDatabase.DirectPExecute(
-        "DELETE FROM `ah_worker_journal` "
-        "WHERE `auction_id` IN (993101,993102,993104) "
-        "OR `uuid` IN (%llu,%llu,%llu)",
-        static_cast<unsigned long long>(commitUuid),
-        static_cast<unsigned long long>(malformedUuid),
-        static_cast<unsigned long long>(validUuid));
-    CharacterDatabase.DirectExecute("DELETE FROM `characters` WHERE `guid`=1");
-    CharacterDatabase.DirectExecute(
-        "INSERT INTO `characters` (`guid`,`account`,`name`,`money`) "
-        "VALUES (1,1,'AhReconTest',100000)");
-
-    auto readMoney = []() -> uint64
-    {
-        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
-            "SELECT `money` FROM `characters` WHERE `guid`=1"));
-        return res ? res->Fetch()[0].GetUInt64() : 0u;
-    };
-    auto rowState = [](char const* key) -> uint32
-    {
-        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
-            "SELECT `state` FROM `custody_ledger` WHERE `idem_key`='%s'", key));
-        return res ? res->Fetch()[0].GetUInt32() : 255u;
-    };
-    auto rowAmount = [](char const* key) -> uint32
-    {
-        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
-            "SELECT `amount` FROM `custody_ledger` WHERE `idem_key`='%s'",
-            key));
-        return res ? res->Fetch()[0].GetUInt32() : 0u;
-    };
-
-    MutationPendingMap& pend = sWorld.GetMutationPending();
 
-    // ---- Part 1: checked release failure retains pending + reservation ----
-    {
-        CharacterDatabase.BeginTransaction();
-        CharacterDatabase.PExecute(
-            "INSERT INTO `custody_ledger` "
-            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-            "VALUES ('test:reconcile:commit',0,1,0,1,0,333,0,%u,0,0)",
-            commitAuction);
-        if (!CharacterDatabase.CommitTransactionChecked())
-        {
-            printf("ahreconcile FAIL: commit-failure seed\n");
-            return 2;
-        }
-
-        PendingMutation pm;
-        pm.uuid = commitUuid;
-        pm.playerGuidLow = 1u;
-        pm.op = uint16(IPC_PLAYER_BID);
-        pm.auctionId = commitAuction;
-        pm.state = uint8(PMUT_AWAIT_RESULT);
-        pm.sentSec = uint32(time(NULL));
-        pm.reservedAmount = 333u;
-        pm.reserveKey = "test:reconcile:commit";
-        pm.itemKey.clear();
-        pm.depKey.clear();
-        pend.Register(pm);
-
-        uint64 const before = readMoney();
-        std::string originalConfig;
-        std::string testConfig;
-        if (!TestArmCustodyCommitFailure(
-                "reconcile-release", originalConfig, testConfig))
-        {
-            TestRestoreConfig(originalConfig, testConfig);
-            printf("ahreconcile FAIL: could not arm checked-commit failure\n");
-            return 2;
-        }
-        AhReconcileOnReconnect();
-        if (!TestRestoreConfig(originalConfig, testConfig))
-        {
-            printf("ahreconcile FAIL: could not restore configuration\n");
-            return 2;
-        }
-
-        PendingMutation held;
-        if (!pend.Peek(commitUuid, held) || pend.Size() != 1u)
-        {
-            printf("ahreconcile FAIL: failed release consumed pending "
-                   "mutation\n");
-            pass = false;
-        }
-        if (rowState("test:reconcile:commit") != CST_RESERVED ||
-            readMoney() != before ||
-            CustodyService::ResolutionApplied(commitUuid))
-        {
-            printf("ahreconcile FAIL: failed release moved conserved gold\n");
-            pass = false;
-        }
-
-        AhProcessReconnectRetryQueue(uint32(time(NULL)) + 6u);
-        if (pend.Peek(commitUuid, held) ||
-            rowState("test:reconcile:commit") != CST_TERMINAL_BACK ||
-            readMoney() != before + 333u ||
-            !CustodyService::ResolutionApplied(commitUuid))
-        {
-            printf("ahreconcile FAIL: retained release did not apply once "
-                   "on retry\n");
-            pass = false;
-        }
-    }
-
-    // ---- Part 2: exact worker journal envelope replays forward ----
-    {
-        PlayerMutationResult journalRes;
-        journalRes.uuid = validUuid;
-        journalRes.op = uint8(IPC_PLAYER_BID & 0xFFu);
-        journalRes.status = uint8(MUT_OK);
-        journalRes.reason = 0u;
-        journalRes.facts = MutationFacts();
-        journalRes.facts.auctionId = validAuction;
-        journalRes.facts.houseId = 7u;
-        journalRes.facts.itemCount = 1u;
-        journalRes.facts.sellerGuid = 2u;
-        journalRes.facts.effectiveBid = 500u;
-        journalRes.facts.priorBidderGuid = 1u;
-        journalRes.facts.priorBidAmount = 300u;
-        journalRes.facts.curBidderGuid = 1u;
-        journalRes.facts.curBid = 500u;
-
-        ByteBuffer bb;
-        journalRes.Encode(bb);
-        std::string const factsHex = TestHexEncode(bb);
-
-        CharacterDatabase.BeginTransaction();
-        CharacterDatabase.PExecute(
-            "INSERT INTO `custody_ledger` "
-            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,"
-            "`beneficiary_guid`,`amount`,`item_guid`,`auction_id`,"
-            "`created_time`,`resolved_time`) VALUES "
-            "('test:reconcile:valid-prior',0,1,0,1,0,300,0,%u,0,0),"
-            "('test:reconcile:valid-delta',0,1,0,1,0,200,0,%u,0,0)",
-            validAuction, validAuction);
-        CharacterDatabase.PExecute(
-            "INSERT INTO `ah_worker_journal` "
-            "(`uuid`,`auction_id`,`kind`,`state`,`facts`,"
-            "`created_time`,`resolved_time`) "
-            "VALUES (%llu,%u,%u,1,'%s',0,0)",
-            static_cast<unsigned long long>(validUuid), validAuction,
-            uint32(IPC_PLAYER_BID & 0xFFu), factsHex.c_str());
-        if (!CharacterDatabase.CommitTransactionChecked())
-        {
-            printf("ahreconcile FAIL: valid worker-envelope seed\n");
-            return 2;
-        }
-
-        PendingMutation pm;
-        pm.uuid = validUuid;
-        pm.playerGuidLow = 1u;
-        pm.op = uint16(IPC_PLAYER_BID);
-        pm.auctionId = validAuction;
-        pm.state = uint8(PMUT_AWAIT_RESULT);
-        pm.sentSec = uint32(time(NULL));
-        pm.reservedAmount = 200u;
-        pm.reserveKey = "test:reconcile:valid-delta";
-        pm.itemKey.clear();
-        pm.depKey.clear();
-        pend.Register(pm);
-
-        AhReconcileOnReconnect();
-
-        PendingMutation held;
-        if (pend.Peek(validUuid, held) ||
-            rowState("test:reconcile:valid-prior") != CST_RESERVED ||
-            rowAmount("test:reconcile:valid-prior") != 500u ||
-            rowState("test:reconcile:valid-delta") != CST_TERMINAL_OK)
-        {
-            printf("ahreconcile FAIL: valid worker envelope did not replay\n");
-            pass = false;
-        }
-    }
-
-    // ---- Part 3: malformed committed facts hold/tombstone, never release ----
-    {
-        CharacterDatabase.DirectExecute(
-            "DELETE FROM `custody_ledger` WHERE `auction_id`=993101");
-        CharacterDatabase.DirectExecute(
-            "UPDATE `characters` SET `money`=100000 WHERE `guid`=1");
-
-        PlayerMutationResult malformedRes;
-        malformedRes.uuid = malformedUuid + 1u;
-        malformedRes.op = uint8(IPC_PLAYER_BID & 0xFFu);
-        malformedRes.status = uint8(MUT_OK);
-        malformedRes.reason = 0u;
-        malformedRes.facts = MutationFacts();
-        malformedRes.facts.auctionId = malformedAuction;
-        malformedRes.facts.curBidderGuid = 1u;
-        malformedRes.facts.effectiveBid = 444u;
-        malformedRes.facts.curBid = 444u;
-        ByteBuffer bb;
-        malformedRes.Encode(bb);
-        std::string const malformedHex = TestHexEncode(bb);
-
-        CharacterDatabase.BeginTransaction();
-        CharacterDatabase.PExecute(
-            "INSERT INTO `custody_ledger` "
-            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-            "VALUES ('test:reconcile:malformed',0,1,0,1,0,444,0,%u,0,0)",
-            malformedAuction);
-        CharacterDatabase.PExecute(
-            "INSERT INTO `ah_worker_journal` "
-            "(`uuid`,`auction_id`,`kind`,`state`,`facts`,"
-            "`created_time`,`resolved_time`) "
-            "VALUES (%llu,%u,%u,1,'%s',0,0)",
-            static_cast<unsigned long long>(malformedUuid), malformedAuction,
-            uint32(IPC_PLAYER_BID & 0xFFu), malformedHex.c_str());
-        if (!CharacterDatabase.CommitTransactionChecked())
-        {
-            printf("ahreconcile FAIL: malformed-facts seed\n");
-            return 2;
-        }
-
-        PendingMutation pm;
-        pm.uuid = malformedUuid;
-        pm.playerGuidLow = 1u;
-        pm.op = uint16(IPC_PLAYER_BID);
-        pm.auctionId = malformedAuction;
-        pm.state = uint8(PMUT_AWAIT_RESULT);
-        pm.sentSec = uint32(time(NULL));
-        pm.reservedAmount = 444u;
-        pm.reserveKey = "test:reconcile:malformed";
-        pm.itemKey.clear();
-        pm.depKey.clear();
-        pend.Register(pm);
-
-        uint64 const before = readMoney();
-        AhReconcileOnReconnect();
-
-        PendingMutation held;
-        if (!pend.Peek(malformedUuid, held) ||
-            held.state != uint8(PMUT_TOMBSTONE))
-        {
-            printf("ahreconcile FAIL: malformed committed facts not held "
-                   "in-doubt\n");
-            pass = false;
-        }
-        if (rowState("test:reconcile:malformed") != CST_RESERVED ||
-            readMoney() != before)
-        {
-            printf("ahreconcile FAIL: malformed committed facts released "
-                   "gold\n");
-            pass = false;
-        }
-        pend.Take(malformedUuid, held);
-    }
-
-    // ---- Part 4: COMMITTED cancels retain their PREPARED journal envelope ----
-    {
-        uint32 const auctionId = 993105u;
-        uint64 const uuid = 0xC105ull;
-        sObjectMgr.SetHighestGuids();
-        sObjectMgr.LoadItemPrototypes();
-        Item* const item = TestCreateCachedAuctionItem(19019u, 1u);
-        if (!item)
-        {
-            printf("ahreconcile FAIL: create committed-cancel item\n");
-            return 2;
-        }
-        uint32 const itemGuid = item->GetGUIDLow();
-        PlayerMutationResult prepared = {};
-        prepared.uuid = uuid;
-        prepared.op = uint8(IPC_PLAYER_CANCEL & 0xFFu);
-        prepared.status = uint8(MUT_PREPARED);
-        prepared.facts.auctionId = auctionId;
-        prepared.facts.houseId = 7u;
-        prepared.facts.sellerGuid = 1u;
-        prepared.facts.itemGuid = itemGuid;
-        prepared.facts.itemTemplate = 19019u;
-        prepared.facts.itemCount = 1u;
-        prepared.facts.deposit = 32u;
-        ByteBuffer bytes;
-        prepared.Encode(bytes);
-        std::string const hex = TestHexEncode(bytes);
-        CharacterDatabase.BeginTransaction();
-        CustodyLedger::Insert(TestCustodyRow(0, "dep:993105", CUSTODY_GOLD,
-            ROLE_DEPOSIT, 1u, 32u, 0, auctionId));
-        CustodyLedger::Insert(TestCustodyRow(0, "item:993105", CUSTODY_ITEM,
-            ROLE_ITEM, 1u, 0, itemGuid, auctionId));
-        CharacterDatabase.PExecute(
-            "INSERT INTO `ah_worker_journal` "
-            "(`uuid`,`auction_id`,`kind`,`state`,`facts`,"
-            "`created_time`,`resolved_time`) VALUES (%llu,%u,%u,3,'%s',0,0)",
-            static_cast<unsigned long long>(uuid), auctionId,
-            uint32(prepared.op), hex.c_str());
-        if (!CharacterDatabase.CommitTransactionChecked())
-        {
-            printf("ahreconcile FAIL: seed committed-cancel journal\n");
-            return 2;
-        }
-        PendingMutation pm = {};
-        pm.uuid = uuid;
-        pm.playerGuidLow = 1u;
-        pm.op = IPC_PLAYER_CANCEL;
-        pm.auctionId = auctionId;
-        pm.state = PMUT_AWAIT_CONFIRM;
-        pm.itemKey = "item:993105";
-        pm.depKey = "dep:993105";
-        pend.Register(pm);
-        auto itemMails = [&]() -> uint64
-        {
-            std::unique_ptr<QueryResult> rows(CharacterDatabase.PQuery(
-                "SELECT COUNT(*) FROM `mail_items` "
-                "WHERE `item_guid`=%u AND `receiver`=1", itemGuid));
-            return rows ? rows->Fetch()[0].GetUInt64() : 0u;
-        };
-        uint64 const before = readMoney();
-        AhReconcileOnReconnect();
-        PendingMutation held;
-        // APPLIED + PREPARED can mean an abort; it is not proof of cancellation.
-        if (!pend.Peek(uuid, held) || itemMails() != 0u ||
-            rowState("dep:993105") != CST_RESERVED ||
-            rowState("item:993105") != CST_RESERVED || readMoney() != before)
-        {
-            printf("ahreconcile FAIL: ambiguous applied cancel moved value\n");
-            pass = false;
-        }
-        CharacterDatabase.DirectPExecute(
-            "UPDATE `ah_worker_journal` SET `state`=1 WHERE `uuid`=%llu",
-            static_cast<unsigned long long>(uuid));
-        AhReconcileOnReconnect();
-        AhReconcileOnReconnect();
-        if (pend.Peek(uuid, held) || itemMails() != 1u ||
-            rowState("dep:993105") != CST_TERMINAL_OK ||
-            rowState("item:993105") != CST_TERMINAL_OK ||
-            sAuctionMgr.GetAItem(itemGuid) || readMoney() != before)
-        {
-            printf("ahreconcile FAIL: committed prepared cancel did not "
-                   "complete exactly once\n");
-            pass = false;
-        }
-        pend.Take(uuid, held);
-        if (Item* leftover = sAuctionMgr.GetAItem(itemGuid))
-        {
-            sAuctionMgr.RemoveAItem(itemGuid);
-            delete leftover;
-        }
-        CharacterDatabase.DirectPExecute(
-            "DELETE FROM `mail` WHERE `id` IN "
-            "(SELECT `mail_id` FROM `mail_items` WHERE `item_guid`=%u)", itemGuid);
-        CharacterDatabase.DirectPExecute(
-            "DELETE FROM `mail_items` WHERE `item_guid`=%u", itemGuid);
-        CharacterDatabase.DirectPExecute(
-            "DELETE FROM `item_instance` WHERE `guid`=%u", itemGuid);
-        CharacterDatabase.DirectExecute(
-            "DELETE FROM `custody_ledger` WHERE `auction_id`=993105");
-        CharacterDatabase.DirectPExecute(
-            "DELETE FROM `ah_worker_journal` WHERE `uuid`=%llu",
-            static_cast<unsigned long long>(uuid));
-    }
-
-    CharacterDatabase.DirectPExecute(
-        "DELETE FROM `custody_ledger` "
-        "WHERE `auction_id` IN (993101,993102,993104) "
-        "OR `idem_key` IN ('resolve:%llu','resolve:%llu','resolve:%llu')",
-        static_cast<unsigned long long>(commitUuid),
-        static_cast<unsigned long long>(malformedUuid),
-        static_cast<unsigned long long>(validUuid));
-    CharacterDatabase.DirectPExecute(
-        "DELETE FROM `ah_worker_journal` "
-        "WHERE `auction_id` IN (993101,993102,993104) "
-        "OR `uuid` IN (%llu,%llu,%llu)",
-        static_cast<unsigned long long>(commitUuid),
-        static_cast<unsigned long long>(malformedUuid),
-        static_cast<unsigned long long>(validUuid));
-    CharacterDatabase.DirectExecute("DELETE FROM `characters` WHERE `guid`=1");
-
-    if (pass)
-    {
-        printf("ahreconcile OK\n");
-        return 0;
-    }
-    return 2;
-}
-
-/// Cancel-abort reconnect regression in its own process so the one-shot commit
-/// failpoint is independent of RunAhReconcileTest's release failpoint.
-static int RunAhReconcileAbortTest()
-{
-    bool pass = true;
-    CharacterDatabase.AllowAsyncTransactions();
-
-    uint32 const auctionId = 993103u;
-    uint64 const uuid = 0xC103ull;
-    std::string const cutKey = "test:reconcile:abort";
-
-    CharacterDatabase.DirectPExecute(
-        "DELETE FROM `custody_ledger` WHERE `auction_id`=%u "
-        "OR `idem_key`='resolve:%llu'",
-        auctionId, static_cast<unsigned long long>(uuid));
-    CharacterDatabase.DirectPExecute(
-        "DELETE FROM `ah_worker_journal` WHERE `auction_id`=%u OR `uuid`=%llu",
-        auctionId, static_cast<unsigned long long>(uuid));
-    CharacterDatabase.DirectExecute("DELETE FROM `characters` WHERE `guid`=1");
-    CharacterDatabase.DirectExecute(
-        "INSERT INTO `characters` (`guid`,`account`,`name`,`money`) "
-        "VALUES (1,1,'AhAbortTest',100000)");
-
-    PlayerMutationResult prepared;
-    prepared.uuid = uuid;
-    prepared.op = uint8(IPC_PLAYER_CANCEL & 0xFFu);
-    prepared.status = uint8(MUT_PREPARED);
-    prepared.reason = 0u;
-    prepared.facts = MutationFacts();
-    prepared.facts.auctionId = auctionId;
-    prepared.facts.houseId = 7u;
-    prepared.facts.sellerGuid = 1u;
-    prepared.facts.curBid = 1000u;
-
-    ByteBuffer bb;
-    prepared.Encode(bb);
-    std::string const factsHex = TestHexEncode(bb);
-
-    CharacterDatabase.BeginTransaction();
-    CharacterDatabase.PExecute(
-        "INSERT INTO `custody_ledger` "
-        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-        "VALUES ('%s',0,2,0,1,0,55,0,%u,0,0)", cutKey.c_str(), auctionId);
-    CharacterDatabase.PExecute(
-        "INSERT INTO `ah_worker_journal` "
-        "(`uuid`,`auction_id`,`kind`,`state`,`facts`,"
-        "`created_time`,`resolved_time`) "
-        "VALUES (%llu,%u,%u,4,'%s',0,0)",
-        static_cast<unsigned long long>(uuid), auctionId,
-        uint32(IPC_PLAYER_CANCEL & 0xFFu), factsHex.c_str());
-    if (!CharacterDatabase.CommitTransactionChecked())
-    {
-        printf("ahreconcileabort FAIL: seed commit\n");
-        return 2;
-    }
-
-    PendingMutation pm;
-    pm.uuid = uuid;
-    pm.playerGuidLow = 1u;
-    pm.op = uint16(IPC_PLAYER_CANCEL);
-    pm.auctionId = auctionId;
-    pm.state = uint8(PMUT_AWAIT_CONFIRM);
-    pm.sentSec = uint32(time(NULL));
-    pm.reservedAmount = 55u;
-    pm.reserveKey = cutKey;
-    pm.itemKey.clear();
-    pm.depKey.clear();
-    MutationPendingMap& pend = sWorld.GetMutationPending();
-    pend.Register(pm);
-
-    auto readMoney = []() -> uint64
-    {
-        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
-            "SELECT `money` FROM `characters` WHERE `guid`=1"));
-        return res ? res->Fetch()[0].GetUInt64() : 0u;
-    };
-    auto rowState = [&cutKey]() -> uint32
-    {
-        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
-            "SELECT `state` FROM `custody_ledger` WHERE `idem_key`='%s'",
-            cutKey.c_str()));
-        return res ? res->Fetch()[0].GetUInt32() : 255u;
-    };
-
-    uint64 const before = readMoney();
-    std::string originalConfig;
-    std::string testConfig;
-    if (!TestArmCustodyCommitFailure(
-            "reconcile-abort-release", originalConfig, testConfig))
-    {
-        TestRestoreConfig(originalConfig, testConfig);
-        printf("ahreconcileabort FAIL: could not arm commit failure\n");
-        return 2;
-    }
-    AhReconcileOnReconnect();
-    if (!TestRestoreConfig(originalConfig, testConfig))
-    {
-        printf("ahreconcileabort FAIL: could not restore configuration\n");
-        return 2;
-    }
-
-    PendingMutation held;
-    if (!pend.Peek(uuid, held) || pend.Size() != 1u ||
-        rowState() != CST_RESERVED || readMoney() != before)
-    {
-        printf("ahreconcileabort FAIL: failed cut release consumed "
-               "disposition\n");
-        pass = false;
-    }
-
-    AhProcessReconnectRetryQueue(uint32(time(NULL)) + 6u);
-    if (pend.Peek(uuid, held) || pend.Size() != 0u ||
-        rowState() != CST_TERMINAL_BACK || readMoney() != before + 55u)
-    {
-        printf("ahreconcileabort FAIL: retained cut release did not apply "
-               "once on retry\n");
-        pass = false;
-    }
-
-    pend.Take(uuid, held);
-    CharacterDatabase.DirectPExecute(
-        "DELETE FROM `custody_ledger` WHERE `auction_id`=%u "
-        "OR `idem_key`='resolve:%llu'",
-        auctionId, static_cast<unsigned long long>(uuid));
-    CharacterDatabase.DirectPExecute(
-        "DELETE FROM `ah_worker_journal` WHERE `auction_id`=%u OR `uuid`=%llu",
-        auctionId, static_cast<unsigned long long>(uuid));
-    CharacterDatabase.DirectExecute("DELETE FROM `characters` WHERE `guid`=1");
-
-    if (pass)
-    {
-        printf("ahreconcileabort OK\n");
-        return 0;
-    }
-    return 2;
-}
+#include <cstdio>
+#include <map>
 
-/// Marker-owned worker resolutions and player buyouts retain missing or
-/// mismatched item custody, then complete exactly once after it is restored.
-static int RunAhBotTerminalTest()
+namespace
 {
-    bool pass = true;
-    uint32 const buyer = 990117u;
-    uint32 const bot = AHBOT_SYSTEM_OWNER_GUID;
-    CharacterDatabase.AllowAsyncTransactions();
-    sObjectMgr.SetHighestGuids();
-    sObjectMgr.LoadItemPrototypes();
-    if (!CharacterDatabase.DirectPExecute(
-        "REPLACE INTO `characters` (`guid`,`account`,`name`,`money`) "
-        "VALUES (%u,1,'AhBotTerm',100000)", buyer))
-    {
-        printf("ahbotterminal FAIL: seed receiver\n");
-        return 2;
-    }
-
-    // Bot expiry, bid-won expiry, and player buyout all use marker custody,
-    // not a player's item:/dep: pair. A failed preflight must remain retryable.
-    for (uint32 mode = 0; mode < 3u; ++mode)
+    std::map<std::string, MangosdTest>& Tests()
     {
-        uint32 const auctionId = 991117u + mode;
-        uint64 const uuid = 0xBB117ull + mode;
-        std::string const markerKey = "botlist:test:terminal:" + std::to_string(mode);
-        std::string const bidKey = "bid:" + std::to_string(auctionId) + ":test";
-        CharacterDatabase.DirectPExecute(
-            "DELETE FROM `custody_ledger` WHERE `auction_id`=%u", auctionId);
-        Item* const item = TestCreateCachedAuctionItem(19019u, bot);
-        if (!item)
-        {
-            printf("ahbotterminal FAIL: create escrow item\n");
-            return 2;
-        }
-        uint32 const itemGuid = item->GetGUIDLow();
-        CharacterDatabase.BeginTransaction();
-        CustodyLedger::Insert(TestCustodyRow(0, markerKey, CUSTODY_ITEM,
-            ROLE_RESOLUTION, bot, 0, itemGuid, auctionId));
-        if (mode != 0u)
-        {
-            CustodyLedger::Insert(TestCustodyRow(0, bidKey, CUSTODY_GOLD,
-                ROLE_BID, buyer, 800u, 0, auctionId));
-        }
-        if (!CharacterDatabase.CommitTransactionChecked())
-        {
-            printf("ahbotterminal FAIL: seed custody\n");
-            return 2;
-        }
-
-        MutationFacts facts = {};
-        facts.auctionId = auctionId;
-        facts.houseId = 7;
-        facts.sellerGuid = bot;
-        facts.itemGuid = itemGuid;
-        facts.itemTemplate = 19019u;
-        facts.itemCount = 1;
-        facts.buyout = 800u;
-        if (mode != 0u)
-        {
-            facts.curBidderGuid = buyer;
-            facts.curBid = facts.effectiveBid = 800u;
-        }
-        PlayerMutationResult result = {};
-        result.uuid = uuid;
-        result.op = uint8(IPC_PLAYER_BUYOUT & 0xFFu);
-        result.status = uint8(MUT_OK);
-        result.facts = facts;
-        ResolveApply resolve = {};
-        resolve.uuid = uuid;
-        resolve.kind = mode == 0u ? uint8(RESOLVE_EXPIRED_NOBID) : uint8(RESOLVE_WON);
-        resolve.facts = facts;
-        PendingMutation pending = {};
-        if (mode == 2u)
-        {
-            pending.uuid = uuid;
-            pending.op = IPC_PLAYER_BUYOUT;
-            pending.playerGuidLow = buyer;
-            pending.auctionId = auctionId;
-            pending.state = PMUT_AWAIT_RESULT;
-            pending.sentSec = uint32(time(NULL));
-            pending.reserveKey = bidKey;
-            pending.reservedAmount = 800u;
-            sWorld.GetMutationPending().Register(pending);
-        }
-        auto apply = [&](uint32 attempt)
-        {
-            if (mode != 2u)
-            {
-                AhHandleResolveApply(resolve);
-            }
-            else if (attempt == 0u)
-            {
-                AhHandlePlayerMutationResult(result);
-            }
-            else
-            {
-                AhProcessRedriveQueue(uint32(time(NULL)) + attempt * 10u);
-            }
-        };
-        auto mailCount = [&]() -> uint64
-        {
-            std::unique_ptr<QueryResult> rows(CharacterDatabase.PQuery(
-                "SELECT COUNT(*) FROM `mail_items` WHERE `item_guid`=%u "
-                "AND `receiver`=%u", itemGuid, buyer));
-            return rows ? rows->Fetch()[0].GetUInt64() : 0u;
-        };
-
-        sAuctionMgr.RemoveAItem(itemGuid);
-        apply(0u);
-        if (mode != 0u)
-        {
-            OrphanMaterializationSweepReport const sweep =
-                sAuctionIntentExecutor.SweepOrphanMaterializations(301u, 100u);
-            CustodyRow heldMarker;
-            std::unique_ptr<QueryResult> heldItem(CharacterDatabase.PQuery(
-                "SELECT 1 FROM `item_instance` WHERE `guid`=%u", itemGuid));
-            if (!sweep.committed || sweep.selected != 0u || !heldItem ||
-                !CustodyLedger::Get(markerKey, heldMarker) ||
-                heldMarker.state != CST_RESERVED)
-            {
-                printf("ahbotterminal FAIL: mode %u sweep destroyed held sale escrow\n", mode);
-                pass = false;
-            }
-        }
-        sAuctionMgr.AddAItem(item);
-        CharacterDatabase.DirectPExecute(
-            "UPDATE `custody_ledger` SET `item_guid`=%u WHERE `idem_key`='%s'",
-            itemGuid + 1u, markerKey.c_str());
-        apply(1u);
-        CustodyRow row;
-        if (mailCount() != 0u || CustodyService::ResolutionApplied(uuid) ||
-            (mode != 0u && (!CustodyLedger::Get(bidKey, row) || row.state != CST_RESERVED)))
-        {
-            printf("ahbotterminal FAIL: mode %u missing/mismatched custody moved value\n", mode);
-            pass = false;
-        }
-        CharacterDatabase.DirectPExecute(
-            "UPDATE `custody_ledger` SET `item_guid`=%u WHERE `idem_key`='%s'",
-            itemGuid, markerKey.c_str());
-        apply(2u);
-        apply(3u);
-        std::unique_ptr<QueryResult> persisted(CharacterDatabase.PQuery(
-            "SELECT `owner_guid` FROM `item_instance` WHERE `guid`=%u", itemGuid));
-        if (sAuctionMgr.GetAItem(itemGuid) ||
-            !CustodyLedger::Get(markerKey, row) || row.state != CST_RESERVED ||
-            (mode == 0u && persisted) ||
-            (mode != 0u && (!persisted || persisted->Fetch()[0].GetUInt32() != buyer ||
-                mailCount() != 1u || !CustodyLedger::Get(bidKey, row) || row.state != CST_TERMINAL_OK)) ||
-            (mode != 2u && !CustodyService::ResolutionApplied(uuid)))
-        {
-            printf("ahbotterminal FAIL: mode %u did not finish exactly once after retry\n", mode);
-            pass = false;
-        }
-        if (mode != 0u)
-        {
-            OrphanMaterializationSweepReport const sweep =
-                sAuctionIntentExecutor.SweepOrphanMaterializations(301u, 100u);
-            std::unique_ptr<QueryResult> deliveredItem(CharacterDatabase.PQuery(
-                "SELECT `owner_guid` FROM `item_instance` WHERE `guid`=%u", itemGuid));
-            if (!sweep.committed || sweep.swept != 1u ||
-                CustodyLedger::Get(markerKey, row) || !deliveredItem ||
-                deliveredItem->Fetch()[0].GetUInt32() != buyer || mailCount() != 1u)
-            {
-                printf("ahbotterminal FAIL: mode %u terminal sweep changed delivered item\n", mode);
-                pass = false;
-            }
-        }
-        if (Item* leftover = sAuctionMgr.GetAItem(itemGuid))
-        {
-            sAuctionMgr.RemoveAItem(itemGuid);
-            delete leftover;
-        }
-        CharacterDatabase.DirectPExecute("DELETE FROM `item_instance` WHERE `guid`=%u", itemGuid);
-        CharacterDatabase.DirectPExecute("DELETE FROM `mail_items` WHERE `item_guid`=%u", itemGuid);
-        CharacterDatabase.DirectPExecute("DELETE FROM `custody_ledger` WHERE `auction_id`=%u", auctionId);
+        static std::map<std::string, MangosdTest> tests;
+        return tests;
     }
-    CharacterDatabase.DirectPExecute("DELETE FROM `mail` WHERE `receiver`=%u", buyer);
-    CharacterDatabase.DirectPExecute("DELETE FROM `characters` WHERE `guid`=%u", buyer);
-    printf("ahbotterminal %s\n", pass ? "OK" : "FAIL");
-    return pass ? 0 : 1;
 }
 
-/// SP-2 Task 13 self-test for the bot-sell materialization leg. Drives
-/// AuctionIntentExecutor::TestMaterializeSell directly -- the live path reaches
-/// it through Apply() -> ApplySell(), but that re-validation chain needs a fully
-/// loaded world (item store, AH DBC, bot config) unavailable under -t, so the
-/// seam exercises the durable leg in isolation. Asserts the durable contract:
-///   * status INTENT_OK with nonzero itemGuid + auctionId,
-///   * an item_instance row is minted with owner_guid == the bot lister,
-///   * a botlist:<uuid> custody row (kind ITEM, role RESOLUTION, RESERVED)
-///     records BOTH ids,
-///   * NO `auction` row is inserted (the worker owns the book),
-///   * a redelivered uuid replays the SAME ids and mints no second item.
-/// Then exercises SweepOrphanMaterializations: a stranded bot-owned mint (no
-/// auction row) is reaped, while an item that reached the book and was delivered
-/// to a buyer (owner changed) is preserved. Returns 0 on pass.
-static int RunAhMaterializeTest()
+void RegisterMangosdTest(char const* name, MangosdTest test)
 {
-    bool pass = true;
-    CharacterDatabase.AllowAsyncTransactions();
-
-    // -t does not load the world; Item::CreateItem needs item prototypes.
-    sObjectMgr.LoadItemPrototypes();
-
-    const uint32 botGuid   = 990113u;   // synthetic bot lister low-guid
-    const uint32 buyerGuid = 990199u;   // synthetic "delivered to" owner
-    const uint64 uuid      = 0xD13ull;  // Task 13 test intent uuid
-    std::string const key  = "botlist:" + std::to_string(uuid);
-
-    // Synthetic sweep fixtures (huge guids so they never collide with real data
-    // and are not reused as freshly-minted ids after SetHighestGuids).
-    const uint32 orphanItem = 99911301u;   // still bot-owned -> reaped
-    const uint32 soldItem   = 99911302u;   // delivered (owner changed) -> kept
-    const uint32 orphanAuc  = 99900001u;
-    const uint32 soldAuc    = 99900002u;
-
-    // Clean slate BEFORE SetHighestGuids so leftover synthetic rows do not
-    // inflate the auction-id / item-guid generators.
-    CharacterDatabase.DirectPExecute(
-        "DELETE FROM `custody_ledger` WHERE `idem_key` IN "
-        "('%s','botlist:test:orphan','botlist:test:sold')", key.c_str());
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `custody_ledger` "
-        "WHERE `idem_key` LIKE 'botlist:test:batch:%'");
-    CharacterDatabase.DirectPExecute(
-        "DELETE FROM `item_instance` WHERE `owner_guid` IN (%u,%u)",
-        botGuid, buyerGuid);
-    CharacterDatabase.DirectPExecute(
-        "DELETE FROM `item_instance` WHERE `guid` IN (%u,%u)",
-        orphanItem, soldItem);
-
-    sObjectMgr.SetHighestGuids();   // GenerateItemLowGuid / GenerateAuctionID
-
-    // A valid, simple stackable non-equip item to mint. Fall back to a DB probe
-    // so the test does not hardcode a build-specific id.
-    uint32 itemId = 2589u;          // Linen Cloth (universal 1.12 item)
-    if (!ObjectMgr::GetItemPrototype(itemId))
-    {
-        std::unique_ptr<QueryResult> r(WorldDatabase.PQuery(
-            "SELECT `entry` FROM `item_template` "
-            "WHERE `InventoryType`=0 AND `stackable`>1 ORDER BY `entry` LIMIT 1"));
-        if (r)
-        {
-            itemId = r->Fetch()[0].GetUInt32();
-        }
-    }
-    if (!ObjectMgr::GetItemPrototype(itemId))
-    {
-        printf("ahmaterialize FAIL: no usable item prototype"
-               " (item_template empty?)\n");
-        return 2;
-    }
-
-    SellIntent si;
-    si.uuid = uuid;
-    si.botGuid = botGuid;
-    si.house = 2;               // not re-validated by the durable leg
-    si.itemId = itemId;
-    si.stack = 1;
-    si.bid = 100u;
-    si.buyout = 1000u;
-    si.durationHrs = 24u;
-
-    // ---- Part 1: first materialization mints + records + replies ids ----
-    IpcMessage out;
-    sAuctionIntentExecutor.TestMaterializeSell(si, out, uint32(time(NULL)));
-
-    IntentResult res;
-    if (out.op != IPC_INTENT_RESULT || !res.Decode(out.body))
-    {
-        printf("ahmaterialize FAIL: no IPC_INTENT_RESULT reply\n");
-        return 2;
-    }
-    if (res.status != INTENT_OK)
-    {
-        printf("ahmaterialize FAIL: status %u != INTENT_OK\n", res.status);
-        pass = false;
-    }
-    if (res.itemGuid == 0u)
-    {
-        printf("ahmaterialize FAIL: itemGuid is zero\n");
-        pass = false;
-    }
-    if (res.auctionId == 0u)
-    {
-        printf("ahmaterialize FAIL: auctionId is zero\n");
-        pass = false;
-    }
-
-    uint32 const itemGuid  = res.itemGuid;
-    uint32 const auctionId = res.auctionId;
-
-    // item_instance row minted with owner == bot lister.
-    {
-        std::unique_ptr<QueryResult> q(CharacterDatabase.PQuery(
-            "SELECT `owner_guid` FROM `item_instance` WHERE `guid`=%u", itemGuid));
-        if (!q)
-        {
-            printf("ahmaterialize FAIL: item_instance row missing\n");
-            pass = false;
-        }
-        else if (q->Fetch()[0].GetUInt32() != botGuid)
-        {
-            printf("ahmaterialize FAIL: item owner_guid != bot\n");
-            pass = false;
-        }
-    }
-
-    // Durable botlist row records both ids in the expected shape.
-    {
-        CustodyRow row;
-        if (!CustodyLedger::Get(key, row))
-        {
-            printf("ahmaterialize FAIL: botlist row missing\n");
-            pass = false;
-        }
-        else
-        {
-            if (row.itemGuid != itemGuid)
-            {
-                printf("ahmaterialize FAIL: botlist item_guid mismatch\n");
-                pass = false;
-            }
-            if (row.auctionId != auctionId)
-            {
-                printf("ahmaterialize FAIL: botlist auction_id mismatch\n");
-                pass = false;
-            }
-            if (row.kind != CUSTODY_ITEM)
-            {
-                printf("ahmaterialize FAIL: botlist kind != CUSTODY_ITEM\n");
-                pass = false;
-            }
-            if (row.role != ROLE_RESOLUTION)
-            {
-                printf("ahmaterialize FAIL: botlist role != ROLE_RESOLUTION\n");
-                pass = false;
-            }
-            if (row.state != CST_RESERVED)
-            {
-                printf("ahmaterialize FAIL: botlist state != CST_RESERVED\n");
-                pass = false;
-            }
-        }
-    }
-
-    // No `auction` row -- the worker is the sole book writer.
-    {
-        std::unique_ptr<QueryResult> q(CharacterDatabase.PQuery(
-            "SELECT 1 FROM `auction` WHERE `id`=%u", auctionId));
-        if (q)
-        {
-            printf("ahmaterialize FAIL: unexpected auction row inserted\n");
-            pass = false;
-        }
-    }
-
-    // ---- Part 2: redelivered uuid replays the SAME ids, no second mint ----
-    {
-        IpcMessage out2;
-        sAuctionIntentExecutor.TestMaterializeSell(si, out2, uint32(time(NULL)));
-        IntentResult res2;
-        if (out2.op != IPC_INTENT_RESULT || !res2.Decode(out2.body))
-        {
-            printf("ahmaterialize FAIL: replay produced no reply\n");
-            pass = false;
-        }
-        else
-        {
-            if (res2.status != INTENT_OK)
-            {
-                printf("ahmaterialize FAIL: replay status != INTENT_OK\n");
-                pass = false;
-            }
-            if (res2.itemGuid != itemGuid)
-            {
-                printf("ahmaterialize FAIL: replay itemGuid changed\n");
-                pass = false;
-            }
-            if (res2.auctionId != auctionId)
-            {
-                printf("ahmaterialize FAIL: replay auctionId changed\n");
-                pass = false;
-            }
-        }
-        std::unique_ptr<QueryResult> q(CharacterDatabase.PQuery(
-            "SELECT COUNT(*) FROM `item_instance` WHERE `owner_guid`=%u", botGuid));
-        if (q && q->Fetch()[0].GetUInt64() != 1u)
-        {
-            printf("ahmaterialize FAIL: replay minted a second item\n");
-            pass = false;
-        }
-    }
-
-    // ---- Part 3: failed sweep commit preserves DB and cache ownership ----
-    {
-        CharacterDatabase.DirectPExecute(
-            "UPDATE `custody_ledger` SET `created_time`=0 "
-            "WHERE `idem_key`='%s'",
-            key.c_str());
-        Item* const cachedBefore = sAuctionMgr.GetAItem(itemGuid);
-        if (!cachedBefore)
-        {
-            printf("ahmaterialize FAIL: materialized item missing from "
-                   "cache before sweep\n");
-            return 2;
-        }
-        CustodyRow custodyBefore;
-        if (!CustodyLedger::Get(key, custodyBefore))
-        {
-            printf("ahmaterialize FAIL: materialization custody missing "
-                   "before sweep\n");
-            return 2;
-        }
-        std::unique_ptr<QueryResult> candidates(CharacterDatabase.Query(
-            "SELECT COUNT(*) FROM `custody_ledger` "
-            "WHERE `idem_key` LIKE 'botlist:%' AND `created_time` < 1 "
-            "AND `auction_id` NOT IN (SELECT `id` FROM `auction`)"));
-        if (!candidates || candidates->Fetch()[0].GetUInt64() != 1u)
-        {
-            printf("ahmaterialize FAIL: orphan-sweep failure fixture is "
-                   "not isolated\n");
-            return 2;
-        }
-
-        std::string originalConfig;
-        std::string testConfig;
-        if (!TestArmCustodyCommitFailure(
-                "orphan-sweep", originalConfig, testConfig))
-        {
-            TestRestoreConfig(originalConfig, testConfig);
-            printf("ahmaterialize FAIL: could not arm orphan-sweep failure\n");
-            return 2;
-        }
-        sAuctionIntentExecutor.SweepOrphanMaterializations(301u, 100u);
-        if (!TestRestoreConfig(originalConfig, testConfig))
-        {
-            printf("ahmaterialize FAIL: could not restore configuration\n");
-            return 2;
-        }
-
-        std::unique_ptr<QueryResult> itemRow(CharacterDatabase.PQuery(
-            "SELECT `owner_guid` FROM `item_instance` WHERE `guid`=%u",
-            itemGuid));
-        CustodyRow custodyRow;
-        if (!itemRow || !CustodyLedger::Get(key, custodyRow) ||
-            itemRow->Fetch()[0].GetUInt32() != botGuid ||
-            custodyRow.state != custodyBefore.state ||
-            custodyRow.ownerGuid != custodyBefore.ownerGuid ||
-            custodyRow.itemGuid != custodyBefore.itemGuid ||
-            custodyRow.auctionId != custodyBefore.auctionId ||
-            sAuctionMgr.GetAItem(itemGuid) != cachedBefore ||
-            cachedBefore->GetOwnerGuid().GetCounter() != botGuid)
-        {
-            printf("ahmaterialize FAIL: failed sweep commit changed "
-                   "durable/cache ownership\n");
-            pass = false;
-        }
-
-        sAuctionIntentExecutor.SweepOrphanMaterializations(301u, 100u);
-        std::unique_ptr<QueryResult> retriedItem(CharacterDatabase.PQuery(
-            "SELECT 1 FROM `item_instance` WHERE `guid`=%u", itemGuid));
-        if (CustodyLedger::Get(key, custodyRow) || retriedItem ||
-            sAuctionMgr.GetAItem(itemGuid))
-        {
-            printf("ahmaterialize FAIL: retained sweep did not apply on "
-                   "retry\n");
-            pass = false;
-        }
-    }
-
-    // ---- Part 4: successful sweep reaps strays but spares delivered
-    // items ----
-    {
-        // Seed synthetic item_instance + botlist rows AFTER SetHighestGuids so
-        // they never influence the generators. Both are "old" (past the 300s
-        // grace) and have no `auction` row. The orphan item is still bot-owned;
-        // the "sold" item's owner is the buyer (its listing reached the book and
-        // later resolved) -- it must survive the sweep.
-        CharacterDatabase.DirectPExecute(
-            "INSERT INTO `item_instance` (`guid`,`owner_guid`,`data`,`text`) "
-            "VALUES (%u,%u,'0',''),(%u,%u,'0','')",
-            orphanItem, botGuid, soldItem, buyerGuid);
-        CharacterDatabase.BeginTransaction();
-        CharacterDatabase.PExecute(
-            "INSERT INTO `custody_ledger` "
-            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
-            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
-            "VALUES ('botlist:test:orphan',1,4,0,%u,0,0,%u,%u,100,0),"
-            "       ('botlist:test:sold',1,4,0,%u,0,0,%u,%u,100,0)",
-            botGuid, orphanItem, orphanAuc, botGuid, soldItem, soldAuc);
-        if (!CharacterDatabase.CommitTransactionChecked())
-        {
-            printf("ahmaterialize FAIL: sweep seed commit\n");
-            return 2;
-        }
-
-        sAuctionIntentExecutor.SweepOrphanMaterializations(
-            uint32(time(NULL)), 100u);
-
-        std::unique_ptr<QueryResult> qo(CharacterDatabase.PQuery(
-            "SELECT 1 FROM `item_instance` WHERE `guid`=%u", orphanItem));
-        if (qo)
-        {
-            printf("ahmaterialize FAIL: orphan item not swept\n");
-            pass = false;
-        }
-
-        std::unique_ptr<QueryResult> qs(CharacterDatabase.PQuery(
-            "SELECT 1 FROM `item_instance` WHERE `guid`=%u", soldItem));
-        if (!qs)
-        {
-            printf("ahmaterialize FAIL: delivered item wrongly destroyed\n");
-            pass = false;
-        }
-
-        CustodyRow tmp;
-        if (CustodyLedger::Get("botlist:test:orphan", tmp))
-        {
-            printf("ahmaterialize FAIL: orphan botlist row not deleted\n");
-            pass = false;
-        }
-        if (CustodyLedger::Get("botlist:test:sold", tmp))
-        {
-            printf("ahmaterialize FAIL: sold botlist row not deleted\n");
-            pass = false;
-        }
-    }
-
-    // ---- Part 5: an outage backlog drains across bounded invocations ----
-    {
-        CharacterDatabase.BeginTransaction();
-        for (uint32 i = 1u; i <= 101u; ++i)
-        {
-            CharacterDatabase.PExecute(
-                "INSERT INTO `custody_ledger` "
-                "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,"
-                "`beneficiary_guid`,`amount`,`item_guid`,`auction_id`,"
-                "`created_time`,`resolved_time`) "
-                "VALUES ('botlist:test:batch:%u',1,4,0,%u,0,0,%u,%u,100,0)",
-                i, botGuid, 99911310u + i, 99900010u + i);
-        }
-        if (!CharacterDatabase.CommitTransactionChecked())
-        {
-            printf("ahmaterialize FAIL: bounded sweep seed commit\n");
-            return 2;
-        }
-
-        auto countBatchRows = []() -> uint64
-        {
-            std::unique_ptr<QueryResult> rows(CharacterDatabase.PQuery(
-                "SELECT COUNT(*) FROM `custody_ledger` "
-                "WHERE `idem_key` LIKE 'botlist:test:batch:%%'"));
-            return rows ? rows->Fetch()[0].GetUInt64() : 0u;
-        };
-
-        OrphanMaterializationSweepReport const first =
-            sAuctionIntentExecutor.SweepOrphanMaterializations(
-                uint32(time(NULL)), 100u);
-        if (!first.committed || first.selected != 100u || first.swept != 100u ||
-            !first.morePending || countBatchRows() != 1u)
-        {
-            printf("ahmaterialize FAIL: first bounded sweep batch\n");
-            pass = false;
-        }
-
-        OrphanMaterializationSweepReport const second =
-            sAuctionIntentExecutor.SweepOrphanMaterializations(
-                uint32(time(NULL)), 100u);
-        if (!second.committed || second.selected != 1u || second.swept != 1u ||
-            second.morePending || countBatchRows() != 0u)
-        {
-            printf("ahmaterialize FAIL: second bounded sweep batch\n");
-            pass = false;
-        }
-    }
-
-    // ---- Part 6: an old bot marker must not evict a buyer's relisted item ----
-    {
-        Item* const relisted = TestCreateCachedAuctionItem(itemId, buyerGuid);
-        if (!relisted)
-        {
-            printf("ahmaterialize FAIL: relisted item fixture\n");
-            return 2;
-        }
-        uint32 const relistedGuid = relisted->GetGUIDLow();
-        CharacterDatabase.BeginTransaction();
-        CustodyLedger::Insert(TestCustodyRow(0, "botlist:test:relisted",
-            CUSTODY_ITEM, ROLE_RESOLUTION, botGuid, 0, relistedGuid, 99900003u));
-        CharacterDatabase.PExecute(
-            "INSERT INTO `auction` (`id`,`itemguid`,`itemowner`) "
-            "VALUES (99900004,%u,%u)", relistedGuid, buyerGuid);
-        if (!CharacterDatabase.CommitTransactionChecked())
-        {
-            printf("ahmaterialize FAIL: relisted marker seed commit\n");
-            return 2;
-        }
-        OrphanMaterializationSweepReport const sweep =
-            sAuctionIntentExecutor.SweepOrphanMaterializations(301u, 100u);
-        CustodyRow marker;
-        std::unique_ptr<QueryResult> persisted(CharacterDatabase.PQuery(
-            "SELECT `owner_guid` FROM `item_instance` WHERE `guid`=%u", relistedGuid));
-        if (!sweep.committed || sweep.swept != 1u ||
-            CustodyLedger::Get("botlist:test:relisted", marker) ||
-            sAuctionMgr.GetAItem(relistedGuid) != relisted || !persisted ||
-            persisted->Fetch()[0].GetUInt32() != buyerGuid)
-        {
-            printf("ahmaterialize FAIL: old marker sweep destroyed buyer's relisted escrow\n");
-            pass = false;
-        }
-        if (Item* leftover = sAuctionMgr.GetAItem(relistedGuid))
-        {
-            sAuctionMgr.RemoveAItem(relistedGuid);
-            delete leftover;
-        }
-        CharacterDatabase.DirectExecute("DELETE FROM `auction` WHERE `id`=99900004");
-        CharacterDatabase.DirectExecute(
-            "DELETE FROM `custody_ledger` WHERE `idem_key`='botlist:test:relisted'");
-        CharacterDatabase.DirectPExecute(
-            "DELETE FROM `item_instance` WHERE `guid`=%u", relistedGuid);
-    }
-
-    // ---- Part 7: empty and failed candidate queries have distinct outcomes ----
-    {
-        if (!CharacterDatabase.DirectExecute(
-                "RENAME TABLE `custody_ledger` TO `custody_ledger_test_unavailable`"))
-        {
-            printf("ahmaterialize FAIL: could not inject candidate query failure\n");
-            return 2;
-        }
-        OrphanMaterializationSweepReport const failed =
-            sAuctionIntentExecutor.SweepOrphanMaterializations(301u, 100u);
-        if (!CharacterDatabase.DirectExecute(
-                "RENAME TABLE `custody_ledger_test_unavailable` TO `custody_ledger`"))
-        {
-            printf("ahmaterialize FAIL: could not restore custody table\n");
-            return 2;
-        }
-        OrphanMaterializationSweepReport const empty =
-            sAuctionIntentExecutor.SweepOrphanMaterializations(301u, 100u);
-        if (failed.committed || failed.selected || failed.swept ||
-            !empty.committed || empty.selected || empty.swept || empty.morePending)
-        {
-            printf("ahmaterialize FAIL: failed query reported as drained\n");
-            pass = false;
-        }
-    }
-
-    // Clean up the minted item and synthetic fixtures.
-    CharacterDatabase.DirectPExecute(
-        "DELETE FROM `custody_ledger` WHERE `idem_key` IN "
-        "('%s','botlist:test:orphan','botlist:test:sold')", key.c_str());
-    CharacterDatabase.DirectExecute(
-        "DELETE FROM `custody_ledger` "
-        "WHERE `idem_key` LIKE 'botlist:test:batch:%'");
-    CharacterDatabase.DirectPExecute(
-        "DELETE FROM `item_instance` WHERE `owner_guid` IN (%u,%u)",
-        botGuid, buyerGuid);
-    CharacterDatabase.DirectPExecute(
-        "DELETE FROM `item_instance` WHERE `guid` IN (%u,%u)",
-        orphanItem, soldItem);
-
-    if (pass)
-    {
-        printf("ahmaterialize OK\n");
-        return 0;
-    }
-    return 1;
+    Tests()[name] = test;
 }
 
 int RunMangosdTest(std::string const& name)
@@ -6544,100 +25,12 @@ int RunMangosdTest(std::string const& name)
         return 0;
     }
 
-    if (name == "commit")
-    {
-        return RunCommitTest();
-    }
-
-    if (name == "mail")
-    {
-        return RunMailTest();
-    }
-
-    if (name == "custody")
-    {
-        return RunCustodyTest();
-    }
-
-    if (name == "ahowner")
-    {
-        return RunAhOwnerTest();
-    }
-
-    if (name == "ahusabilityref")
-    {
-        return RunAhUsabilityRefTest();
-    }
-
-    if (name == "ahbrowsehelper")
-    {
-        return RunAhBrowseHelperTest();
-    }
-
-    if (name == "ahbrowsepending")
-    {
-        return RunAhBrowsePendingTest();
-    }
-
-    if (name == "ahmutpending")
-    {
-        return RunAhMutPendingTest();
-    }
-
-    if (name == "ahforwardreserve")
-    {
-        return RunAhForwardReserveTest();
-    }
-
-    if (name == "ahrelease")
-    {
-        return RunAhReleaseTest();
-    }
-
-    if (name == "ahmutresult")
-    {
-        return RunAhMutResultTest();
-    }
-
-    if (name == "ahresolve")
-    {
-        return RunAhResolveTest();
-    }
-
-    if (name == "ahrepair")
-    {
-        return RunAhRepairRecoveryTest();
-    }
-
-    if (name == "ahcustodyroute")
-    {
-        return RunAhCustodyRouteTest();
-    }
-    if (name == "ahroutegate")
-    {
-        return RunAhRouteGateTest();
-    }
-
-    if (name == "ahreconcile")
-    {
-        return RunAhReconcileTest();
-    }
-
-    if (name == "ahreconcileabort")
-    {
-        return RunAhReconcileAbortTest();
-    }
-
-    if (name == "ahmaterialize")
+    std::map<std::string, MangosdTest>::const_iterator itr = Tests().find(name);
+    if (itr == Tests().end())
     {
-        return RunAhMaterializeTest();
-    }
-
-    if (name == "ahbotterminal")
-    {
-        return RunAhBotTerminalTest();
+        printf("%s FAIL: unknown test\n", name.c_str());
+        return 2;
     }
 
-    printf("%s FAIL: unknown test\n", name.c_str());
-    return 2;
+    return itr->second();
 }
diff --git a/src/mangosd/MangosdTest.h b/src/mangosd/MangosdTest.h
index 911ca0a0e1..0389bb76fc 100644
--- a/src/mangosd/MangosdTest.h
+++ b/src/mangosd/MangosdTest.h
@@ -8,4 +8,9 @@
 /// DB init but BEFORE world load. Returns 0 on pass, non-zero on fail.
 int RunMangosdTest(std::string const& name);
 
+typedef int (*MangosdTest)();
+
+/// Makes a test runnable by name; modules call it from a static object.
+void RegisterMangosdTest(char const* name, MangosdTest test);
+
 #endif
diff --git a/src/mangosd/Master.cpp b/src/mangosd/Master.cpp
index bb1051341b..e853b3c8fd 100644
--- a/src/mangosd/Master.cpp
+++ b/src/mangosd/Master.cpp
@@ -25,11 +25,11 @@
 
 #include <memory>
 #include "Master.h"
+#include "AuctionHouseModule.h"
 
 #include "AntiFreezeService.h"
 #include "CliService.h"
 #include "RASession.h"
-#include "AhService.h"
 
 #include "Config/Config.h"
 #include "Console/ConsoleUI.h"
@@ -234,12 +234,6 @@ void Master::StartServices()
     }
 #endif
 
-    // The out-of-process auction house. mangos_zero only, default-off.
-    if (sConfig.GetBoolDefault("AH.Service.Enabled", false))
-    {
-        m_services.push_back(std::unique_ptr<IService>(new AhServiceService()));
-    }
-
     // Watchdog. Disabled unless MaxCoreStuckTime is set.
     m_services.push_back(std::unique_ptr<IService>(new AntiFreezeService(
         1000 * uint32(sConfig.GetIntDefault("MaxCoreStuckTime", 0)))));
@@ -380,6 +374,9 @@ void Master::ShutdownWorld()
 
     sLog.outString("[shutdown] unloading maps");
     sMapMgr.UnloadAll();
+
+    sLog.outString("[shutdown] stopping the auction modules");
+    AuctionHouseModules::Stop();
 }
 
 int Master::Run(std::string const& testMode, bool allowDestructiveTests)
@@ -398,6 +395,8 @@ int Master::Run(std::string const& testMode, bool allowDestructiveTests)
 
     if (!testMode.empty())
     {
+        // The tests see the modules a running world would.
+        AuctionHouseModules::LoadConfig(false);
         int const rc = RunMangosdTest(testMode);
         sLog.outString("mangosd test '%s' exit %d", testMode.c_str(), rc);
         sLog.Flush();
diff --git a/src/mangosd/mangosd.conf.dist.in b/src/mangosd/mangosd.conf.dist.in
index f3aba5df45..b0854e91d9 100644
--- a/src/mangosd/mangosd.conf.dist.in
+++ b/src/mangosd/mangosd.conf.dist.in
@@ -1862,88 +1862,6 @@ SOAP.Enabled   = 0
 SOAP.IP        = 127.0.0.1
 SOAP.Port      = 7878
 
-###############################################################################
-#    AH.Service.Enabled
-#        Run the auction house bot as a separate supervised child process.
-#        When enabled, mangosd spawns the ah-service executable, maintains a
-#        loopback IPC channel, and restarts the child on unexpected exit.
-#        Default: 0 (disabled; in-process AH bot is used instead)
-#
-#    AH.Service.Path
-#        Path to the ah-service executable, relative to the mangosd working
-#        directory (or absolute).
-#        Default: service-workers/ah-service/ah-service
-#
-#    AH.Service.Port
-#        Loopback TCP port for the mangosd ↔ ah-service IPC channel.
-#        Default: 5760
-#
-#    AH.Service.Secret
-#        Shared secret for IPC handshake authentication.
-#        Change this to a random string in production configurations.
-#        mangosd passes this to the child OUT-OF-BAND via the
-#        AH_SERVICE_SECRET environment variable (NOT on the child command
-#        line), so it is not exposed in the process list.
-#        Default: changeme
-#
-#    AH.Service.Config
-#        Path to the ah-service configuration file, passed as --config to the
-#        child process so it can locate its own settings.
-#        Default: ah-service.conf
-#
-#    AH.Service.IntentTtlSec
-#        How long (in seconds) the executor retains UUID records for
-#        deduplication of intents submitted by the child process.
-#        Increase if the child can re-emit the same intent after a reconnect
-#        within a window longer than the default.
-#        Default: 900
-#
-#    AH.Service.Custody
-#        Route player auction gold/items through the in-process custody escrow
-#        ledger.  Default 0 = today's direct path.
-#        Default: 0
-#
-#    AH.Service.CustodyCrashAt
-#        TEST ONLY.  Inject _exit(3) at a custody seam transition:
-#        empty = off, pre-commit, pre-deferred, and the SP-2 write-path seams
-#        post-reserve-pre-forward, resolving-pre-apply.
-#        NEVER set on a live realm.
-#        Default: "" (off)
-#
-#    AH.Service.CustodyFailCommitAt
-#        TEST ONLY.  Force an AH custody checked-commit to roll back and report
-#        failure ONCE (one-shot per process) to exercise its retention/redrive
-#        path: empty = off, finalize-fail, reconcile-release,
-#        reconcile-abort-release, orphan-sweep.
-#        NEVER set on a live realm.
-#        Default: "" (off)
-#
-#    AH.Service.WriteAuthority
-#        [SP-2] Grant the out-of-process AH worker WRITE-AUTHORITY over the
-#        auction book: the worker inserts/updates/deletes `auction` rows and
-#        runs the expiry/win tick, while every residual mangosd-side auction
-#        writer (boot repair, orphan cleanup, the in-process expiry sweep, and
-#        the in-process AH bot) stands down so there is a single book writer.
-#        BOOT-LATCHED: read once at startup, ignored by `.reload config`.
-#        HARD REQUIREMENT: AH.Service.Custody = 1 (the write path rides the
-#        custody escrow ledger). Enabling this with Custody = 0 is unsupported.
-#        The worker's DB account additionally needs INSERT/UPDATE/DELETE on the
-#        `auction` and `ah_worker_journal` tables (see extra/doc/AuctionHouseBot.md);
-#        the ah_worker_journal migration MUST be applied first.
-#        Default: 0 (disabled; mangosd owns the book, as today)
-###############################################################################
-
-AH.Service.Enabled        = 0
-AH.Service.Path           = service-workers/ah-service/ah-service
-AH.Service.Port           = 5760
-AH.Service.Secret         = changeme
-AH.Service.Config         = ah-service.conf
-AH.Service.IntentTtlSec   = 900
-AH.Service.Custody        = 0
-AH.Service.CustodyCrashAt = ""
-AH.Service.CustodyFailCommitAt = ""
-AH.Service.WriteAuthority = 0
-
 ################################################################################
 #    CharDelete.Method
 #        Character deletion behavior
diff --git a/src/mangosd/mangosd.cpp b/src/mangosd/mangosd.cpp
index d33d7a7459..e96d94d50d 100644
--- a/src/mangosd/mangosd.cpp
+++ b/src/mangosd/mangosd.cpp
@@ -63,7 +63,7 @@
 #include "Console/ConsoleUI.h"
 #include "Log.h"
 #include "SystemConfig.h"
-#include "AuctionHouseBot.h"
+#include "AuctionHouseModule.h"
 #include "Master.h"
 #include "World.h"
 #include "Util.h"
@@ -227,7 +227,7 @@ int main(int argc, char** argv)
         }
         else if ((arg == "-a" || arg == "--ahbot") && hasValue)
         {
-            sAuctionBotConfig.SetConfigFileName(argv[++i]);
+            AuctionHouseModules::SetConfigFile(argv[++i]);
         }
         else if (arg == "-t" && hasValue)
         {
diff --git a/src/modules/AhService/CMakeLists.txt b/src/modules/AhService/CMakeLists.txt
new file mode 100644
index 0000000000..08250edba8
--- /dev/null
+++ b/src/modules/AhService/CMakeLists.txt
@@ -0,0 +1,50 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# MaNGOS is a full featured server for World of Warcraft, supporting
+# the following clients: 1.12.x, 2.4.3, 3.3.5a, 4.3.4a and 5.4.8
+#
+# Copyright (C) 2005-2026 MaNGOS <https://www.getmangos.eu>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+add_subdirectory(ipc)
+add_subdirectory(worker)
+
+if(BUILD_MANGOSD)
+    if(NOT BUILD_AHBOT)
+        message(FATAL_ERROR "BUILD_AH_SERVICE needs BUILD_AHBOT: the worker lists as the auction house bot's character.")
+    endif()
+
+    file(GLOB ahservice_world_SRC world/*.cpp world/*.h)
+    file(GLOB ahservice_tests_SRC tests/*.cpp)
+
+    add_library(ahservice_module OBJECT
+        ${ahservice_world_SRC}
+        ${ahservice_tests_SRC}
+        worker/difftest/AhUsabilityRef.cpp
+        worker/difftest/AhUsabilityRef.h
+    )
+
+    target_include_directories(ahservice_module
+        PUBLIC
+            ${CMAKE_CURRENT_SOURCE_DIR}/world
+        PRIVATE
+            ${CMAKE_CURRENT_SOURCE_DIR}/worker/difftest
+            ${CMAKE_SOURCE_DIR}/src/mangosd
+            $<$<BOOL:${SCRIPT_LIB_ELUNA}>:${CMAKE_SOURCE_DIR}/src/shared/Compat/eluna>
+    )
+    target_link_libraries(ahservice_module PUBLIC game ah_ipc ahbot_module)
+
+    target_link_libraries(mangosd PRIVATE ahservice_module)
+endif()
diff --git a/src/modules/AhService/KNOWN_DEFECTS.md b/src/modules/AhService/KNOWN_DEFECTS.md
new file mode 100644
index 0000000000..ee31bba06c
--- /dev/null
+++ b/src/modules/AhService/KNOWN_DEFECTS.md
@@ -0,0 +1,469 @@
+# AH service module: known defects
+
+Open defects in `src/modules/AhService/` (world side, IPC, worker), from the
+static review of the auction module split (2026-10-03). Numbers are the
+review's. #7 and #8 are listed here as far as they concern standing the
+in-process bot down for the worker; the part of #7 that is the bot's alone is
+in `src/modules/AuctionHouseBot/KNOWN_DEFECTS.md`. Line numbers are as of the
+review and may drift.
+
+All of them predate the module split: the service code was moved unchanged, and
+where a defect runs through the core seam the core behaves as it did before
+(`AuctionHouseObject::Update` returned on an unknown custody route and skipped a
+mismatched row; `UpdateBid` dropped a generated bid on a custody failure). None
+of it is in a server built without `BUILD_AH_SERVICE` or run with `Enable = 0`.
+
+Two of the review's flags mean different things:
+
+- `OwnsAuctionRows()` is `IsWriteAuthority()`, latched for the whole run.
+- `TakesOverListings()` is `IsWorkerActive()`, which drops as soon as the child
+  is unhealthy.
+
+Several defects below are the gap between them.
+
+## Value and items
+
+### 1. Worker-initiated wins pay `effectiveBid` that mangosd never escrowed
+
+- Severity: bug (most severe)
+- Where: `world/AhServiceHandlers.cpp:1396` and `:2430` (`AhHandleResolveApply`, `RESOLVE_WON`)
+
+The seller is paid `f.effectiveBid + f.deposit - cut` from the worker's facts.
+Nothing requires `effectiveBid == curBid`, `effectiveBid <=` the reserved bid
+row, or the intrinsic-value ceiling the advisory executor applies
+(`ComputeBotValueCeiling`). The player-mutation finalize (`AhFinalizeBidOk`)
+does require them; this path does not.
+
+- Bot win (`curBidderGuid == 0`, no live bid row): `effectiveBid` is free. A
+  child past the handshake sends `RESOLVE_WON` with any amount; mangosd mails it
+  to the real seller and destroys the item.
+- Real bidder: the bid row must match `curBid`, so the bidder paid that much;
+  the mail still carries `effectiveBid`, and the difference is minted.
+
+The child is documented as untrusted, `IPC_RESOLVE_APPLY` is on the reliable
+lane, and the default secret is `changeme` (`WorkerSupervisor::Start` warns and
+still binds `127.0.0.1`), so any local process that completes the handshake can
+send the frame.
+
+Fix direction: pay `min(effectiveBid, reserved bid or deposit-backed buyout)`
+from the ledger row, apply the executor's ceiling before a bot-win mail, reject
+the resolve when `effectiveBid` disagrees with the row.
+
+### 13. A rolled-back custody transaction forgets unrelated item changes
+
+- Severity: bug
+- Where: `world/CustodyService.cpp:59`, `src/game/Object/PlayerSave.cpp:625`,
+  `src/game/Object/ItemPersistence.cpp:258`, `world/AhServiceHandlers.cpp:595`
+
+`ReserveGold` debits the player and calls `SaveInventoryAndGoldToDB` inside the
+open character transaction. That saves the whole item-update queue: each queued
+item becomes `ITEM_UNCHANGED` and the queue is cleared. If the checked commit
+fails, the SQL rolls back but only the gold is restored (`AhForwardBid` line
+599, the in-map custody bid at line 734). A just-looted `ITEM_NEW` item or an
+`ITEM_CHANGED` stack is no longer dirty, the next save skips it, and after relog
+it is gone. Needs a non-empty queue at reserve time.
+
+Fix direction: save only the gold in these transactions, or snapshot and
+restore each item's state and queue position when the commit fails.
+
+### 14. A missing prior-bid row is consumed as a finished success
+
+- Severity: bug
+- Where: `world/AhServiceHandlers.cpp:1815` and `:1937`, `world/CustodyLedger.cpp:271`
+
+`AhHandlePlayerMutationResult` takes the pending slot before finalize.
+`AhFinalizeBidOk` requires a live `ROLE_BID` row when `priorBidderGuid != 0`;
+`GetSingleLiveBidRow` returns false on a query error and on any count but one,
+and the function then logs and returns true ("done"). Nothing is redriven, the
+worker already committed and will not resend, the previous bidder is not mailed,
+and the new reserve stays `RESERVED`. The cancel live-row check at line 1937
+does the same. Listings that predate custody hit it every time
+(`AhForwardBid` reserves without looking at a live bid row; the worker copies
+`buyguid` from the auction row).
+
+Fix direction: return false when the row is missing or the query failed; for a
+real legacy bid, mail `priorBidAmount` from the auction row, then commit.
+
+### 15. Process death drops in-flight player mutations, and boot does not replay them
+
+- Severity: bug
+- Where: `world/AhServiceHandlers.cpp:2973`, `world/AhServiceModule.cpp:70`,
+  `world/CustodyReconciler.cpp:336`
+
+`MutationPendingMap` and the redrive list are in memory.
+`AhReconcileOnReconnect` returns at once when the map is empty; `Start` only
+calls `InitializeRouting`. A crash after `MaybeCrash("post-reserve-pre-forward")`
+leaves a committed debit and `RESERVED` row with no pending slot; after restart
+nothing reconciles it, and the hourly scan only reports `ORPHAN_PLAYER`. A crash
+after the worker committed a player buyout and before `AhFinalizeBidOk` loses
+the refund and the item delivery the same way (`PrimeResolvingFromJournal`
+replays `JRN_RESOLVING` only).
+
+Fix direction: on startup walk reserved player rows against the journal:
+finalize when committed, release and mail when absent, hold when the journal
+query fails.
+
+### 16. `RESOLVE_REPAIR_RETURN` acks a displaced bidder who was not refunded
+
+- Severity: bug
+- Where: `world/AhServiceHandlers.cpp:2529`
+
+A bot bid that displaced a real bidder (`curBidderGuid == 0`,
+`priorBidderGuid != 0`) refunds only when `GetSingleLiveBidRow` succeeds; on a
+query error, zero rows or two rows it still writes `resolve:<uuid>` and returns
+`RES_APPLIED`. The worker will not resend and the displaced player's copper
+stays `RESERVED`. `RESOLVE_WON` treats the same miss as `RES_FAILED` (line 2463).
+
+Fix direction: `RES_FAILED` when a prior bidder was declared and the row is
+missing or ambiguous; write the applied-record only after the refund.
+
+## Expiry and settlement
+
+### 2. A failed custody probe latches "rows may exist" and freezes expiry
+
+- Severity: bug
+- Where: `world/CustodyLedger.cpp:115`, `world/AhServiceBook.cpp:791`,
+  `src/game/Object/AuctionHouseMgr.cpp:677`
+
+`Start` always calls `CustodyLedger::InitializeRouting`, custody on or off.
+
+```cpp
+s_mayHaveReservedRows = !result || result->Fetch()[0].GetUInt32() != 0u;
+```
+
+`Query()` returns null when the statement fails and when `custody_ledger` does
+not exist, so the latch turns true; every later `GetRouteState` gets null again
+and reports `known=false`. `AhExpireAuction` answers `AUCTION_EXPIRY_STOP`, the
+core leaves the house, and the next tick stops on the same row: player auctions
+in that house never expire. Fires with `Enable = 1` and custody off whenever
+the SP-2 table was not migrated or the probe fails once at boot. (Before the
+split this hit every server, since the service was in the core.)
+
+Fix direction: a failed probe must not latch; with custody off a failed probe
+reports a known empty route; `STOP` should mean "retry this auction", not
+"abandon the house".
+
+### 3. Write authority with no running worker disables expiry and the fallback bot
+
+- Severity: bug
+- Where: `world/AhServiceModule.cpp:162`, `src/game/WorldHandlers/World.cpp:1165`,
+  `src/modules/AuctionHouseBot/AuctionHouseBotModule.cpp:54`
+
+`OwnsAuctionRows()` stays true while the child is dead, so `World::Update`
+skips `sAuctionMgr.Update()` for the run. `WorkerSupervisor::Start` returns
+false when `AuctionHouseBot.CharacterName` does not resolve and does not retry;
+the module deletes the supervisor. The bot's `Start` already skipped
+`Initialize()`, so buyer and seller stay null, and `AhBlocksHello` keeps the
+auction window shut. Listings, bids and deposits never settle.
+
+Fix direction: `OwnsAuctionRows()` true only while a write-authority child is
+up, or a failed `Start` clears write authority for the run and lets the core
+expire and the bot post.
+
+### 4. Generated bids are swallowed when the route probe fails
+
+- Severity: bug
+- Where: `world/AhServiceBook.cpp:878`, `src/game/Object/AuctionHouseMgr.cpp:1069`
+
+`AhSettleGeneratedBid` returns true ("handled") with nothing applied when the
+route is unknown (#2), the live row does not match, `BeginTransaction` fails, or
+the checked commit fails. `UpdateBid` then skips the core bid; the in-process
+buyer ignores the result, so the bid or buyout vanishes. The executor's
+`AhPlaceGeneratedBid` reports `REASON_TRANSACTION` without `Remember`, which at
+least lets the child retry.
+
+Fix direction: return false unless this call applied the bid; keep the
+fail-closed return only where the core path would double-spend a live custody
+row.
+
+### 5. A mismatched custody row quarantines an expired auction forever
+
+- Severity: bug
+- Where: `world/AhServiceBook.cpp:813`, `src/game/Object/AuctionHouseMgr.cpp:681`
+
+A live bid row that does not match `auction.bidder` / `auction.bid` makes
+`AhExpireAuction` log and return `AUCTION_EXPIRY_DONE`. The auction stays in the
+map, past its expiry, and takes the same branch every tick; the item and the
+bidder's gold never move and nothing queues `ah repair`. (`DONE` after a failed
+commit is different: the next tick can succeed.)
+
+Fix direction: report `DONE` only when the auction left the map; otherwise skip
+the id and keep going, and queue a repair.
+
+### 7. `.ahbot reload` builds agents that post into a book the core is not expiring
+
+- Severity: bug
+- Where: `src/modules/AuctionHouseBot/AuctionHouseBot.cpp:2696` (`ReloadAllConfig`
+  -> `InitializeAgents`), `src/modules/AuctionHouseBot/AuctionHouseBotModule.cpp:73`
+
+Under write authority the bot's `Start` skips `Initialize()`, so its agents stay
+null. `.ahbot reload` builds them anyway, and the bot tick asks only
+`TakesOverListings()`. When the worker turns unhealthy the rebuilt seller
+inserts `auction` rows that the core does not expire (`OwnsAuctionRows()` is
+still true) and the worker's book does not know.
+
+Fix direction: refuse to create agents, and refuse to post, while
+`OwnsAuctionRows()` is true.
+
+### 8. The bot stands down on a 20-second sample, so one cycle double-posts
+
+- Severity: bug
+- Where: `src/modules/AuctionHouseBot/AuctionHouseBotModule.cpp:39` and `:73`
+
+The bot reads `TakesOverListings()` only every 20 s (the same cadence as the
+old `WUPDATE_AHBOT` timer), while worker sell intents are applied on every world
+tick. A worker that turns healthy just after a bot tick still gets one full
+`sAuctionBot.Update()` up to 20 s later, against the table the worker writes;
+the reverse edge leaves up to 20 s with no bot at all.
+
+Fix direction: sample `TakesOverListings()` on every world tick and skip
+`sAuctionBot.Update()` in that tick while the worker is active.
+
+### 11. Reload can turn custody off while write authority stays on
+
+- Severity: bug
+- Where: `world/AhService.cpp:80`
+
+Startup forces write authority off unless custody is on and
+`ah_worker_journal` exists. The reload branch keeps write authority from the
+live settings but takes `custody` from the file, so `AH.Service.Custody = 0`
+on reload leaves write authority without custody; expiry stays skipped and the
+startup invariant is gone. `Enable` is read once at startup: reload does not
+rebuild the module list.
+
+Fix direction: repeat the startup check on reload, and refuse to clear custody
+while write authority is latched.
+
+### 17. Write-authority bot listings expire on a clock that can still be zero
+
+- Severity: bug
+- Where: `worker/MutationHandler.cpp:1470`, `worker/Main.cpp:4229` and `:4670`,
+  `ipc/IpcReliable.h:33`
+
+`m_gameTimeNow` starts at 0 and changes only on `IPC_GAMETIME`, which is not on
+the reliable lane; the bot cadence does not wait for it. `OnBotSellResult` stores
+`GameTime() + si.durationHrs * 3600`, and ignores `Rate.Auction.Time` (the
+advisory `AddAuctionByGuid` applies it to `time(NULL)`). A dropped first
+gametime frame stores an expiry a few hours after the epoch, and the next tick
+with a real clock resolves it at once. Under write authority this is the only
+expiry clock.
+
+Fix direction: gametime on the reliable lane, no bot sells before the first
+frame, and the absolute expiry `AddAuctionByGuid` would store.
+
+### 20. An `INTENT_OK` whose auction id is already in the book strands the new item
+
+- Severity: latent
+- Where: `worker/MutationHandler.cpp:1436`, `world/AuctionIntentExecutor.cpp:674`
+
+`MaterializeSell` writes `item_instance` and a `botlist:<uuid>` row, not
+`auction`. If `m_book.Find(auctionId)` already hits, `OnBotSellResult` erases
+the pending sell without `RetireIntentPending`; the journal stays
+`INTENT_PENDING`. The orphan sweep skips ids that are live auctions, and a
+restart replays and drops the same intent again.
+
+Fix direction: treat the collision as a failed commit and keep the pending sell,
+or retire it so the sweep sees the item.
+
+## Bot brain (worker)
+
+### 18. The ported seller's price range overflows `uint32`
+
+- Severity: latent
+- Where: `worker/BotBrain.cpp:691` (`SetPricesOfItem`)
+
+The worker's copy of the in-process seller's pricing. `PriceRatio` is `uint32`,
+so `buyp * stackcnt * ratio` is computed in 32 bits and wraps for an expensive
+stack (a price near zero); `temp_buyp + randrange` can also pass 2^32 and be
+converted to `uint32`, which is undefined. Under write authority that price is
+persisted into `auction`. Fixed in the in-process bot; this copy is not.
+
+Fix direction: as in `AuctionHouseBot.cpp`: 64-bit math, saturate to `uint32`
+before `urand`.
+
+### 19. In-flight bot sells are invisible to the seller, and a stale snapshot keeps selling
+
+- Severity: latent
+- Where: `worker/BotBrain.cpp:606`, `worker/MarketSnapshot.cpp:121` and `:230`
+
+`SetStat` counts bot rows in the last SQL snapshot; `BotSellBegin` does not
+insert `auction` until `OnBotSellResult` commits, and nothing subtracts
+`m_pendingSells`, so a pending materialization is counted missing and listed
+again. `Refresh` returns on a failed query without clearing the vectors, and
+`Healthy()` stays true for five more failures after one success, so the seller
+fills a house against a market it can no longer see.
+
+Fix direction: subtract pending sells in `SetStat`; `Healthy()` false on the
+first failed refresh, or no listing until a refresh replaces the vectors.
+
+## IPC and supervisor
+
+### 6. One pre-auth TCP connection stalls the IPC acceptor for good
+
+- Severity: bug
+- Where: `ipc/IpcThread.cpp:96`, `ipc/IpcServerHandler.cpp:65`, `ipc/IpcSocket.cpp:109`
+
+The accept loop runs `ReceiveLoop` on the acceptor thread, the backlog is 1,
+and there is no deadline for `IPC_HELLO`. A local process that connects to
+`127.0.0.1:<AH.Service.Port>` and sends nothing holds the only accepted socket;
+the real child is never accepted, every respawn fails, and `ServiceActive()`
+stays false. Under write authority #3 follows. No secret is needed.
+
+Fix direction: bound `WAIT_HELLO` and `WAIT_READY` to a few seconds, close and
+accept again; run the receive loop off the accept thread.
+
+### 9. Frames past the per-call budget are destroyed, not deferred
+
+- Severity: bug
+- Where: `ipc/WorkerSupervisor.cpp:608` and `:670`
+
+In `DrainInboundProtocol` the per-call caps (`WS_DRAIN_APP_PER_CALL` 256,
+`WS_DRAIN_BROWSE_PER_CALL` 128) only `break` the `switch`; the loop keeps
+popping and every later frame of an exhausted class is counted in
+`m_appDropped` and discarded. Browse results past 128 are lost and the player
+gets "AH unavailable" after the TTL. `IPC_INTENT_BID` / `IPC_INTENT_BUYOUT`
+share this lane, and `BotBrain` marks the auction checked when it emits
+(`BotBrain.cpp:1182`), so a dropped bid is not retried for minutes.
+
+Fix direction: on budget exhaustion stop popping or push the frame back; put
+bid and buyout on the reliable lane or clear `lastChecked` until `INTENT_OK`.
+
+### 10. Socket close races the world-thread send
+
+- Severity: bug (data race, undefined behavior)
+- Where: `ipc/IpcServerHandler.cpp:203` and `:361`, `ipc/IpcSocket.cpp:211` and `:256`
+
+`SendFrame` holds `m_sendMtx` across `SendAll`, which reads `m_fd`; `OnClose`
+(reactor thread) calls `m_sock.Close()` without it, writing `m_fd` and closing
+the descriptor. A concurrent `send` can hit a descriptor already reused by the
+next accept. Same pattern in `IpcClientHandler` on the worker side. (The comment
+in `WorkerSupervisor.h` about a benign `m_childExited` race describes a second
+world thread this process does not have.)
+
+Fix direction: `OnClose` takes `m_sendMtx` before `Close`; `SendAll` uses a
+descriptor copied under the lock; `shutdown` under the same lock.
+
+### 12. In-doubt sweep wraps when the clock steps backward
+
+- Severity: latent
+- Where: `world/MutationPending.cpp:129`
+
+`nowSec - sentSec <= ttlSec` is `uint32`; a backward clock step wraps it and
+tombstones every pending mutation at once. The player gets
+`AUCTION_ERR_DATABASE`; the reservation stays non-terminal, so no value is
+minted.
+
+Fix direction: signed difference, or ignore entries whose `sentSec` is in the future.
+
+### 21. A child that exits is respawned on the next world tick
+
+- Severity: bug
+- Where: `ipc/WorkerSupervisor.cpp:442`
+
+`m_nextRetryAt` moves forward only when `SpawnChild` itself fails; a child that
+starts and then exits resets the backoff and leaves `m_nextRetryAt` in the past.
+A worker that dies in `main` (bad config, empty pool) is re-spawned every tick.
+
+Fix direction: arm `m_nextRetryAt = now + m_backoffSec` when the child is marked
+dead; clear the backoff only after a healthy heartbeat.
+
+### 22. An unhealthy gap keeps staged bot intents and applies them later
+
+- Severity: bug
+- Where: `ipc/WorkerSupervisor.cpp:646`, `world/AhServiceWorld.cpp:429`
+
+A `healthy == 0` heartbeat clears `ServiceActive()` and lets the in-process bot
+resume, but `ClearStagedFrames` runs only on death and spawn. Frames keep
+moving into `m_pendingFrames`; the next healthy ack hands the backlog, including
+`IPC_INTENT_SELL`, to `AhHandleInbound` on top of what the in-process bot posted.
+
+Fix direction: drop staged bot intents on the transition to unhealthy; keep
+player-mutation results on the reliable lane.
+
+### 23. POSIX `waitpid` errors are treated as death, and the pid is then forgotten
+
+- Severity: latent
+- Where: `ipc/IpcProcess.cpp:176` and `:189`
+
+`Running()` is true only when `waitpid(WNOHANG)` returns 0, so `-1`/`EINTR`
+reads as "exited"; `Reap` clears `m_pid` without checking. A live child becomes
+unkillable, a second worker is spawned, the acceptor is still inside the old
+child's `ReceiveLoop`, and the orphan keeps its database sessions. Windows uses
+`WaitForSingleObject` and is not affected.
+
+Fix direction: only `r > 0` is death; `EINTR` is still running; never forget a
+pid that was not reaped.
+
+### 24. POSIX `fork` plus `setenv` can wedge the child before `exec`
+
+- Severity: latent (deadlock)
+- Where: `ipc/IpcProcess.cpp:149`
+
+After `fork` the child calls `setenv` and builds a `std::vector`, both taking
+the allocator lock another parent thread may have held at fork time; the child
+hangs before `execv`, is killed after 60 s, and #21 repeats that at once.
+Windows (`CreateProcessA`) is not affected.
+
+Fix direction: build `argv` / `envp` before `fork` and call only `execve` in the
+child, or use `posix_spawn`.
+
+### 25. `IpcServer::Start` reports success when the listen thread has already failed
+
+- Severity: bug
+- Where: `ipc/IpcChannel.cpp:82`, `ipc/IpcThread.cpp:69`
+
+`Start` returns true without waiting for `Listen`; a taken port only logs inside
+the thread. The supervisor spawns the child against a dead acceptor and the
+restart loop repeats until shutdown.
+
+Fix direction: publish the listen result, return false on bind/listen failure,
+do not spawn.
+
+### 26. A failed database connect logs the password
+
+- Severity: bug
+- Where: `worker/ServiceDatabase.cpp:99` and `:164`
+
+On `Initialize` failure the worker logs the whole
+`host;port;user;password;database` string.
+
+Fix direction: log host, port, user and database only.
+
+## Architectural notes
+
+- The README's trust model (the child never writes gold, items or auctions; a
+  SELECT-only account makes that true) holds only without write authority.
+  With `WriteAuthority = 1` the worker writes `auction` and mangosd pays value
+  from worker facts, which the SELECT grant and the intent ceiling do not cover.
+  #1 is the concrete hole.
+- The reliable lane (`IpcLink::reliableInbound`, `m_pendingReliableFrames`) is
+  unbounded so mutation frames are never dropped, and `IPC_INTENT_SELL` and
+  `IPC_RESOLVE_APPLY` ride it: a child past the handshake can grow mangosd's
+  memory without limit. An unknown opcode is buffered up to `IPC_MAX_FRAME`
+  (1 MiB) by `RejectOversizeForOp` (`IpcServerHandler.cpp:173`) and then
+  dropped without closing.
+- On POSIX the child is started with `execv` and the listen socket has no
+  `SOCK_CLOEXEC` (`IpcSocket.cpp:96`): the worker inherits mangosd's listen fd
+  and MySQL session fds, and closing the listener in the parent does not unbind
+  it while the child lives.
+- The fallback between service and bot is two booleans sampled at different
+  rates (#3, #7, #8, #22). One owner flag, updated when the child really turns
+  healthy or dies, should drive "core expires", "bot may post" and "hello is
+  open" together; restart needs a real backoff (#21) or the flag flaps.
+
+## Priority order (from the review)
+
+1. Bind `RESOLVE_WON` payout to the ledger and the value ceiling (#1); the same
+   for a repair that skips the refund (#16).
+2. Stop custody transactions from saving the item queue, and restore it if the
+   commit fails (#13).
+3. Do not consume a mutation whose prior-bid row is missing (#14); replay
+   reserved rows after a restart (#15).
+4. Stop a failed probe from freezing expiry (#2); do not leave
+   `OwnsAuctionRows()` set while the write-authority child is down (#3, #7).
+5. Handshake deadline on the acceptor (#6), close under the send lock (#10), no
+   spawn when listen failed (#25).
+6. Return "not handled" from the generated-bid and expiry hooks unless the
+   auction was settled (#4, #5).
+7. A real game-time expiry for write-authority listings (#17), and a backoff for
+   a crashing child (#21) so an unhealthy gap cannot replay staged sells (#22).
diff --git a/src/modules/AhService/README.md b/src/modules/AhService/README.md
new file mode 100644
index 0000000000..e7d5378618
--- /dev/null
+++ b/src/modules/AhService/README.md
@@ -0,0 +1,332 @@
+Auction house service module
+============================
+An auction module (see `src/game/Object/AuctionHouseModule.h`) that moves the
+auction house bot into a separate `ah-service` process and, optionally, keeps
+player auction value in a custody ledger.
+
+**Building:** `-DBUILD_AH_SERVICE=1` (default off). It needs the auction house
+bot module (`-DBUILD_AHBOT=1`): the worker lists as the bot's character.
+Without the option nothing of the service is compiled, mangosd included.
+
+**Enabling:** the module reads `ah-service.conf`; its first key, `Enable`,
+loads it. With `Enable = 0` mangosd runs as if the module were not built. All
+the keys below live in `ah-service.conf`; `mangosd.conf` knows nothing of them.
+
+**Out-of-process bot:** with `AH.Service.Worker = 1` mangosd spawns the
+`ah-service` child, giving it `ah-service.conf` as `--config`. While the
+service is active, the in-process bot stands down (dual-bot guard prevents
+double-posting). If the service crashes or loses its connection, the
+in-process bot resumes until the service reconnects.
+
+Architecture
+~~~~~~~~~~~~
+The child process reads a market snapshot and item pool from the database, then
+emits *intents* (auction creation/cancellation proposals) to mangosd over a
+local TCP channel. mangosd re-validates every intent against live state before
+applying it and deduplicates by UUID (executor uuid-dedup), so the child never
+touches gold, items, or auctions directly. The channel uses a simple IPC
+framing protocol (proto v1); no DB credentials cross the wire.
+
+The ah-service console window is hidden by default on Windows. The `ah console
+show` and `ah console hide` commands, issued from the mangosd server console,
+toggle visibility at runtime.
+
+Security (trust model and least-privilege DB account)
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+The child process is **untrusted**. mangosd re-validates every intent against
+live state precisely because it does not trust the child; the child only ever
+*advises*. That trust boundary only holds for the IPC channel, however.
+
+The child's DB connections are described as "read-only", but that only means
+the child *issues* nothing but `SELECT` statements -- it is a property of the
+child's code, **not** an enforced credential restriction. The connection
+string in `WorldDatabaseInfo` / `CharacterDatabaseInfo` is an ordinary MySQL
+user/password. If you copy mangosd's full read/write credentials into it, a
+compromised or malfunctioning child could `INSERT`/`UPDATE`/`DELETE` auctions,
+characters, or gold **directly in the database**, completely bypassing the
+mangosd executor authority that the whole intent-re-validation design exists to
+provide.
+
+To make the adversarial model actually hold, provision a **dedicated
+least-privilege MySQL account** for the child with `SELECT`-only grants, and use
+it in `WorldDatabaseInfo` / `CharacterDatabaseInfo` instead of mangosd's
+credentials. With a SELECT-only account, a compromised child *cannot* write the
+DB at all: the only path left to it is the IPC channel, where mangosd validates
+everything. Without it, this least-privilege grant is the only thing standing
+between a compromised child and a direct-DB-write bypass of the executor.
+
+Example grants (run as a MySQL admin; adjust db names, host, and password to
+match your deployment). The child only needs to read the world tables the item
+pool and snapshot consult and the character `auction` / `characters` tables:
+
+```sql
+CREATE USER 'ahbot_ro'@'localhost' IDENTIFIED BY 'change-me';
+
+-- Minimal: only the tables the child reads.
+GRANT SELECT ON `mangos0`.`item_template` TO 'ahbot_ro'@'localhost';
+GRANT SELECT ON `mangos0`.`npc_vendor`    TO 'ahbot_ro'@'localhost';
+-- (plus any loot tables the seller filter consults, e.g.
+--  creature_loot_template, etc.)
+GRANT SELECT ON `character0`.`auction`    TO 'ahbot_ro'@'localhost';
+GRANT SELECT ON `character0`.`characters` TO 'ahbot_ro'@'localhost';
+
+-- Or, more simply, SELECT-only on the whole schemas:
+GRANT SELECT ON `mangos0`.*    TO 'ahbot_ro'@'localhost';
+GRANT SELECT ON `character0`.* TO 'ahbot_ro'@'localhost';
+
+FLUSH PRIVILEGES;
+```
+
+Then set, in `ah-service.conf`:
+
+```
+WorldDatabaseInfo     = "127.0.0.1;3306;ahbot_ro;change-me;mangos0"
+CharacterDatabaseInfo = "127.0.0.1;3306;ahbot_ro;change-me;character0"
+```
+
+mangosd-side keys (ah-service.conf)
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+* ``Enable``                   - Loads the module. Default: 0.
+* ``AH.Service.Worker``        - Set to 1 to launch ah-service as a child
+  process instead of running the bot in-process. Default: 0.
+* ``AH.Service.Path``          - Path to the ah-service executable.
+* ``AH.Service.Port``          - TCP port for the IPC channel (default: 5760).
+* ``AH.Service.Secret``        - Shared secret used to authenticate the child
+  during the IPC handshake.
+* ``AH.Service.IntentTtlSec``  - How long (seconds) the executor retains UUID
+  records for deduplication. Default: 900.
+
+Player-auction custody escrow
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Player auction custody is an in-process escrow ledger for player auction gold
+and items. It is independent of the out-of-process bot switch above:
+``AH.Service.Custody`` can remain off while ``AH.Service.Worker`` is on, and
+can be enabled for player seams even when the bot still runs in-process.
+
+While the module is loaded, auctions that already carry custody rows settle
+through custody even after ``AH.Service.Custody`` is switched off. A server
+without the module (not built, or ``Enable = 0``) does not read the ledger at
+all: drain custody auctions before removing the module.
+
+The relevant ``ah-service.conf`` keys are:
+
+* ``AH.Service.Custody`` - Default: 0. When 0, player auctions use today's
+  direct legacy path. When 1, only auctions that already carry custody ledger
+  rows use the custody path.
+* ``AH.Service.CustodyCrashAt`` - Default: empty. Test-only crash injection for
+  disposable realms. Values are ``pre-commit`` and ``pre-deferred``; never set
+  this on a live realm.
+
+The custody gate is per-auction. ``CustodyLedger::HasRows(auction_id)`` marks
+an auction as custody-managed, so existing pre-gate auctions and bot-created
+auctions with no custody rows continue through the legacy path. This lets a
+realm drain old auctions while the feature remains default-off and reversible.
+
+If reconciliation reports custody drift, use the server console command
+``ah repair``. It is console-only and scoped to custody-ledger drift; it does
+not repair legacy auction tears. The default form is dry-run. ``ah repair
+apply`` terminalizes supported orphan custody rows without disbursing gold or
+re-mailing items, which avoids minting value from a row whose live auction is
+gone. ``ah repair force-forfeit <idem_key>`` is the explicit escape hatch after
+manual verification; it terminalizes the named drift row without disbursement
+or item mail.
+
+Before enabling custody on a real realm, validate it first on a database clone
+and confirm ``ah repair`` reports zero drift after normal list, bid, buyout,
+cancel, and expire flows. Keep the setting default-off until the realm's live
+auction behavior has been observed cleanly.
+
+Worker-side keys (ah-service.conf)
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+The child process reads the same file:
+
+* ``WorldDatabaseInfo``             - Connection string for the world database.
+  Use a SELECT-only DB account here (see Security above), not mangosd's
+  credentials.
+* ``WorldDatabaseConnections``      - Number of world DB connections (the child
+  only issues SELECTs on them).
+* ``CharacterDatabaseInfo``         - Connection string for the character
+  database. Use a SELECT-only DB account here (see Security above).
+* ``CharacterDatabaseConnections``  - Number of character DB connections (the
+  child only issues SELECTs on them).
+
+Both databases must reside on the same MySQL server instance; the market
+snapshot uses a cross-database JOIN between the world and character schemas.
+The child's DB connections are **read-only by usage**: it only ever issues
+`SELECT` queries. That is a code-discipline guarantee, not an enforced
+credential restriction (see Security below).
+
+* ``AhBot.ConfigPath``              - Path to ``ahbot.conf`` (pricing, amounts,
+  quality ranges, and other tuning settings).
+* ``Console.ShowOnStartup``         - Set to 1 to show the ah-service console
+  window on startup (Windows only). Default: 0 (hidden).
+
+Out-of-process service - deployment & operational notes
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+**1. Use a dedicated bot character.**
+Point ``AuctionHouseBot.CharacterName`` at a character on a **separate account
+that you never log into**. The bot owns every auction it creates. If you log
+in as that character you inherit all of them in your Auctions tab, and the
+1.12 client's owner-items list is unpaginated -- hundreds of owned auctions
+in one house will crash the client (issue #132). Rule: never log into the bot
+character while the service (or the in-process bot) is active. Normal players
+are unaffected; the public browse list is paged.
+
+**2. Stock-target sizing.**
+The default ``AuctionHouseBot.Items.Amount.*`` targets (White 2000 / Green 2500
+/ Blue 1500 / Purple 1000, roughly 7 000 total, ~2 300 per faction house)
+populate a large auction house. Tune these down for low-population or
+development realms. The bot boost-fills toward the target then maintains it,
+so a first-run burst can be large if the house starts empty.
+
+**3. Performance and DB durability.**
+The mangosd executor applies each auction synchronously on the world thread
+(one character-DB transaction per auction -- the same mechanism the in-process
+bot uses). A large initial fill under the default MariaDB durability setting
+(``innodb_flush_log_at_trx_commit = 1``, one fsync per commit) can cause brief
+world-tick hitches during the burst. For development or test deployments,
+``innodb_flush_log_at_trx_commit = 2`` (commit to OS page cache) smooths this;
+a larger ``innodb_buffer_pool_size`` or SSD data directory also helps. In
+production, keep stock amounts moderate to avoid a large fill on first start.
+
+**4. Read-only DB account (child-side trust boundary).**
+The child process issues only ``SELECT`` statements. Provision it a dedicated
+least-privilege MySQL account with ``SELECT``-only grants (see the Security
+section above) rather than copying mangosd's full read/write credentials.
+With a ``SELECT``-only account a compromised or malfunctioning child cannot
+write the database at all -- the only path remaining is the IPC channel, where
+mangosd re-validates everything.
+
+GM commands
+~~~~~~~~~~~
+The module brings the `ah` command set:
+
+* ``ah status``   - The worker's state, the custody and write-authority
+  switches, and executor statistics (intents applied, rejected, deduplicated).
+* ``ah reload``   - Reloads ah-service.conf and the bot settings, and asks the
+  worker to reload its tuning (prices, ratios, amounts, timers, and
+  enable/disable toggles). Pool-affecting filters (item level, quality, class,
+  bind type, and include/exclude lists) take effect only after a full service
+  restart. The worker, its address and the write authority hold for the run.
+* ``ah console show|hide`` - Shows or hides the worker's console (Windows).
+* ``ah repair``   - See below.
+
+`ahbot status` and `ahbot reload` stay with the auction house bot module and
+report only on the bot.
+
+Custody repair command
+~~~~~~~~~~~~~~~~~~~~~~
+The ``ah repair`` command is available from the mangosd console for the player
+auction custody ledger. It reports custody drift by default, mutates only with
+``ah repair apply`` or ``ah repair force-forfeit <idem_key>``, and never mints
+gold or sends replacement item mail from an orphan row.
+
+### Worker AH browse path
+
+When the ah-service worker is connected and healthy, mangosd forwards AH browse
+/ owner-list / bidder-list requests to it over IPC (IPC_BROWSE_QUERY) and
+assembles the client reply from IPC_BROWSE_RESULT on a later world tick. The
+worker reproduces the full CanUseItem usable filter and full entry data
+(enchant/suffix/charges decoded from item_instance). On ENABLE_ELUNA builds the
+OnCanUseItem Lua hook is deferred to mangosd's world thread (the worker returns
+the un-paginated usable set; mangosd runs the hook + paginates). Player
+mutations (sell/bid/buyout/cancel) remain fully in-process.
+
+**Coordinator model (worker-mandatory reads).** Once an ah-service worker is the
+configured AH authority, mangosd holds no AH read state of its own. If the worker
+is down, times out, errors, or is overloaded (queue-full / oversize), mangosd
+returns **"AH temporarily unavailable"** — a center-screen notification flash plus
+a red system chat line, and an empty list on any in-flight browse so the client
+does not hang — and serves **nothing** in-process. While the worker is down the
+auction **window will not open** at all: the open path (auctioneer click, gossip
+option, `.auction` GM commands) is gated, so the player just gets the message. (A
+window already open when the worker dies stays open — 1.12 has no close-window
+opcode — and its next browse returns the unavailable reply.) A worker fault
+therefore degrades only the AH, never the realm. (If **no** worker is configured
+at all, the legacy single-process in-process AH is used as before.)
+Set `CharacterDatabaseConnections >= 2` in ah-service.conf so the browse thread's
+SELECTs do not serialize behind the bot snapshot.
+
+**Over-cap deferred-Eluna (decision #2).** On an `ENABLE_ELUNA` realm with an
+active `OnCanUseItem` veto, a single "usable"-filtered search that yields more
+than ~1000 matches cannot be veto-checked exactly out-of-process, so the worker
+**declines** it and mangosd returns "AH temporarily unavailable" rather than a
+short or mis-counted page. This is rare (needs both >1000 surviving matches and a
+bound Lua hook) and follows the coordinator's "correct-or-unavailable" contract —
+**expected, not a regression** — so do not treat it as a service failure.
+
+**Known limitation — Eluna `Player:SendAuctionMenu`.** The window-open gate lives
+in `WorldSession::SendAuctionHello`. A Lua script that calls
+`Player:SendAuctionMenu` builds `MSG_AUCTION_HELLO` directly and so bypasses that
+gate: while the worker is down the window opens, but its first browse returns the
+unavailable reply (an empty window). This affects only realms whose scripts call
+that API, and the fix would mean patching the third-party Eluna module, so it is
+left as a documented limitation.
+
+### Worker write-authority path
+
+`AH.Service.WriteAuthority` (in `ah-service.conf`, default `0`) hands the
+out-of-process worker authority over the auction book. When set, the worker is
+the **single writer** of the `auction` table: it inserts listings, applies
+player bids/buyouts/cancels, and runs the expiry/win tick, while mangosd forwards
+player mutations to it over the reliable IPC lane and applies the returned facts
+against the in-process custody escrow ledger.
+
+**Boot-latched flag.** The value is read once at startup (`LoadConfigSettings`
+only reads it when `!reload`), so `.reload config` can never toggle it mid-run --
+the process must be restarted to change it. This makes the "single book writer"
+invariant a per-boot property that no runtime reload can violate.
+
+**Hard requirement: `AH.Service.Custody = 1`.** The write path rides the custody
+escrow ledger (deposit/bid reservations, item escrow, seller payout netting).
+Enabling `WriteAuthority` with `Custody = 0` is unsupported.
+
+**Worker DB grant delta.** On top of the SELECT-only reader grants in *Security*
+above, a write-authority worker's DB account needs INSERT/UPDATE/DELETE on
+exactly two Character-DB tables. Journal retention also reads resolution
+idempotency markers from `custody_ledger`; it needs no custody write access:
+
+```sql
+GRANT INSERT, UPDATE, DELETE ON `character0`.`auction`           TO 'ahworker'@'localhost';
+GRANT INSERT, UPDATE, DELETE ON `character0`.`ah_worker_journal` TO 'ahworker'@'localhost';
+GRANT SELECT                 ON `character0`.`custody_ledger`    TO 'ahworker'@'localhost';
+```
+
+**Residual mangosd-side writers that stand down (spec section 5.7).** With
+`WriteAuthority = 1` these in-process auction writers no-op so there is exactly
+one book writer:
+
+* `AuctionHouseMgr::LoadAuctions` boot repair (item-template mismatch UPDATE,
+  missing-item / invalid-house row DELETE + return-mail) -- the worker's
+  `LoadFromDb` gates and reports instead.
+* `ObjectMgr::SetHighestGuids` auction-orphan `DELETE`.
+* `World::Update` `WUPDATE_AUCTIONS` in-process expiry sweep (`sAuctionMgr.Update`)
+  -- the worker runs the expiry/win tick; the returned-mail delivery still runs
+  in-process in both modes.
+* The in-process `AuctionHouseBot` startup (`sAuctionBot.Initialize`) -- the
+  worker's bot brain drives listings; the in-process buyer/seller stay null.
+
+Eluna AH hooks (`OnAdd` / `OnRemove`) still fire under write-authority: they are
+raised at the finalize position from the worker's facts on a synthesized
+transient `AuctionEntry`, so existing Lua AH scripts keep working.
+
+> **OPERATOR WARNING 1 -- do not `.reload config` Custody off while
+> WriteAuthority is on.** `WriteAuthority` is boot-latched but `Custody` is
+> reloadable. Reloading with `AH.Service.Custody = 0` while the worker still
+> holds write-authority bypasses the runtime custody invariant the write path
+> depends on and can corrupt in-flight escrow. If you must disable custody,
+> restart with `WriteAuthority = 0` as well.
+
+> **OPERATOR WARNING 2 -- apply the `ah_worker_journal` migration BEFORE enabling
+> WriteAuthority.** The worker records its committed mutations in
+> `ah_worker_journal`; the mangosd-side reconcile-on-reconnect reads it to decide
+> finalize-forward vs release. A missing table silently degrades reconcile to
+> "release", which can double-credit a mutation that actually committed. Verify
+> the migration is present first.
+
+Before enabling write-authority on a real realm, validate it first on a database
+clone with `AH.Service.WriteAuthority = 1` and `AH.Service.Custody = 1`. Exercise
+listing, bidding, outbidding, same-bidder buyout, seller cancel with an auction
+cut, expiry/win, worker reconnect, and mangosd restart. Then run `ah repair` and
+confirm it reports zero custody drift.
diff --git a/src/ipc/AuctionIntents.h b/src/modules/AhService/ipc/AuctionIntents.h
similarity index 100%
rename from src/ipc/AuctionIntents.h
rename to src/modules/AhService/ipc/AuctionIntents.h
diff --git a/src/ipc/BoundedQueue.h b/src/modules/AhService/ipc/BoundedQueue.h
similarity index 100%
rename from src/ipc/BoundedQueue.h
rename to src/modules/AhService/ipc/BoundedQueue.h
diff --git a/src/ipc/BrowseMessages.h b/src/modules/AhService/ipc/BrowseMessages.h
similarity index 100%
rename from src/ipc/BrowseMessages.h
rename to src/modules/AhService/ipc/BrowseMessages.h
diff --git a/src/ipc/CMakeLists.txt b/src/modules/AhService/ipc/CMakeLists.txt
similarity index 100%
rename from src/ipc/CMakeLists.txt
rename to src/modules/AhService/ipc/CMakeLists.txt
diff --git a/src/ipc/IpcChannel.cpp b/src/modules/AhService/ipc/IpcChannel.cpp
similarity index 100%
rename from src/ipc/IpcChannel.cpp
rename to src/modules/AhService/ipc/IpcChannel.cpp
diff --git a/src/ipc/IpcChannel.h b/src/modules/AhService/ipc/IpcChannel.h
similarity index 100%
rename from src/ipc/IpcChannel.h
rename to src/modules/AhService/ipc/IpcChannel.h
diff --git a/src/ipc/IpcClientHandler.cpp b/src/modules/AhService/ipc/IpcClientHandler.cpp
similarity index 100%
rename from src/ipc/IpcClientHandler.cpp
rename to src/modules/AhService/ipc/IpcClientHandler.cpp
diff --git a/src/ipc/IpcClientHandler.h b/src/modules/AhService/ipc/IpcClientHandler.h
similarity index 100%
rename from src/ipc/IpcClientHandler.h
rename to src/modules/AhService/ipc/IpcClientHandler.h
diff --git a/src/ipc/IpcLink.h b/src/modules/AhService/ipc/IpcLink.h
similarity index 100%
rename from src/ipc/IpcLink.h
rename to src/modules/AhService/ipc/IpcLink.h
diff --git a/src/ipc/IpcMessage.cpp b/src/modules/AhService/ipc/IpcMessage.cpp
similarity index 100%
rename from src/ipc/IpcMessage.cpp
rename to src/modules/AhService/ipc/IpcMessage.cpp
diff --git a/src/ipc/IpcMessage.h b/src/modules/AhService/ipc/IpcMessage.h
similarity index 100%
rename from src/ipc/IpcMessage.h
rename to src/modules/AhService/ipc/IpcMessage.h
diff --git a/src/ipc/IpcOpcodes.h b/src/modules/AhService/ipc/IpcOpcodes.h
similarity index 100%
rename from src/ipc/IpcOpcodes.h
rename to src/modules/AhService/ipc/IpcOpcodes.h
diff --git a/src/ipc/IpcProcess.cpp b/src/modules/AhService/ipc/IpcProcess.cpp
similarity index 100%
rename from src/ipc/IpcProcess.cpp
rename to src/modules/AhService/ipc/IpcProcess.cpp
diff --git a/src/ipc/IpcProcess.h b/src/modules/AhService/ipc/IpcProcess.h
similarity index 100%
rename from src/ipc/IpcProcess.h
rename to src/modules/AhService/ipc/IpcProcess.h
diff --git a/src/ipc/IpcReliable.h b/src/modules/AhService/ipc/IpcReliable.h
similarity index 100%
rename from src/ipc/IpcReliable.h
rename to src/modules/AhService/ipc/IpcReliable.h
diff --git a/src/ipc/IpcServerHandler.cpp b/src/modules/AhService/ipc/IpcServerHandler.cpp
similarity index 100%
rename from src/ipc/IpcServerHandler.cpp
rename to src/modules/AhService/ipc/IpcServerHandler.cpp
diff --git a/src/ipc/IpcServerHandler.h b/src/modules/AhService/ipc/IpcServerHandler.h
similarity index 100%
rename from src/ipc/IpcServerHandler.h
rename to src/modules/AhService/ipc/IpcServerHandler.h
diff --git a/src/ipc/IpcSocket.cpp b/src/modules/AhService/ipc/IpcSocket.cpp
similarity index 100%
rename from src/ipc/IpcSocket.cpp
rename to src/modules/AhService/ipc/IpcSocket.cpp
diff --git a/src/ipc/IpcSocket.h b/src/modules/AhService/ipc/IpcSocket.h
similarity index 100%
rename from src/ipc/IpcSocket.h
rename to src/modules/AhService/ipc/IpcSocket.h
diff --git a/src/ipc/IpcThread.cpp b/src/modules/AhService/ipc/IpcThread.cpp
similarity index 100%
rename from src/ipc/IpcThread.cpp
rename to src/modules/AhService/ipc/IpcThread.cpp
diff --git a/src/ipc/IpcThread.h b/src/modules/AhService/ipc/IpcThread.h
similarity index 100%
rename from src/ipc/IpcThread.h
rename to src/modules/AhService/ipc/IpcThread.h
diff --git a/src/ipc/IpcVersion.cpp b/src/modules/AhService/ipc/IpcVersion.cpp
similarity index 100%
rename from src/ipc/IpcVersion.cpp
rename to src/modules/AhService/ipc/IpcVersion.cpp
diff --git a/src/ipc/IpcVersion.h b/src/modules/AhService/ipc/IpcVersion.h
similarity index 100%
rename from src/ipc/IpcVersion.h
rename to src/modules/AhService/ipc/IpcVersion.h
diff --git a/src/ipc/PlayerMutations.h b/src/modules/AhService/ipc/PlayerMutations.h
similarity index 100%
rename from src/ipc/PlayerMutations.h
rename to src/modules/AhService/ipc/PlayerMutations.h
diff --git a/src/ipc/WorkerSupervisor.cpp b/src/modules/AhService/ipc/WorkerSupervisor.cpp
similarity index 100%
rename from src/ipc/WorkerSupervisor.cpp
rename to src/modules/AhService/ipc/WorkerSupervisor.cpp
diff --git a/src/ipc/WorkerSupervisor.h b/src/modules/AhService/ipc/WorkerSupervisor.h
similarity index 100%
rename from src/ipc/WorkerSupervisor.h
rename to src/modules/AhService/ipc/WorkerSupervisor.h
diff --git a/src/modules/AhService/tests/AhServiceTests.cpp b/src/modules/AhService/tests/AhServiceTests.cpp
new file mode 100644
index 0000000000..7b1e30b39c
--- /dev/null
+++ b/src/modules/AhService/tests/AhServiceTests.cpp
@@ -0,0 +1,6449 @@
+#include "Utilities/Errors.h"
+#include <vector>
+#include "MangosdTest.h"
+#include "Config/Config.h"
+#include "Log.h"
+#include "Database/DatabaseEnv.h"
+#include "Chat.h"
+#include "Mail.h"
+#include "ObjectMgr.h"
+#include "ObjectGuid.h"
+#include "AuctionHouseMgr.h"
+#include "AhService.h"
+#include "AhServiceBook.h"
+#include "AhServiceHandlers.h"
+#include "AuctionIntentExecutor.h"
+#include "CustodyDeferred.h"
+#include "CustodyLedger.h"
+#include "CustodyReconciler.h"
+#include "CustodyService.h"
+#include "AuctionIntents.h"
+#include "WorkerSupervisor.h"
+#include "AhUsabilityRef.h"
+#include "BrowsePending.h"
+#include "MutationPending.h"
+#include "IpcOpcodes.h"
+#include "Item.h"
+#include "BrowseMessages.h"
+#include "World.h"
+#include "WorldSession.h"
+#include "PlayerMutations.h"
+#include <cstdio>
+#include <cstdlib>
+#include <ctime>
+#include <memory>
+#include <string>
+
+// The owner the custody fixtures give a bot listing.
+static uint32 const TEST_BOT_OWNER_GUID = 0xFFFFFFFE;
+
+bool AhBuildCancelPrepareForward(MutationPendingMap& pending, uint32 playerGuidLow,
+                                 uint32 auctionId, uint64 uuid, uint32 sentSec,
+                                 IpcMessage& out);
+bool AhRepairFindingMutationAllowed(CustodyFinding const& finding);
+
+struct TestCliCapture
+{
+    std::vector<std::string> chunks;
+};
+
+static void TestCliPrint(void* arg, char const* text)
+{
+    if (arg && text)
+    {
+        static_cast<TestCliCapture*>(arg)->chunks.push_back(text);
+    }
+}
+
+static uint32 CountCliChunks(TestCliCapture const& capture,
+                             std::string const& needle)
+{
+    uint32 count = 0;
+    for (size_t i = 0; i < capture.chunks.size(); ++i)
+    {
+        if (capture.chunks[i].find(needle) != std::string::npos)
+        {
+            ++count;
+        }
+    }
+    return count;
+}
+
+static std::string TestHexEncode(ByteBuffer const& bb)
+{
+    static char const hex[] = "0123456789ABCDEF";
+    std::string out;
+    out.reserve(bb.size() * 2u);
+    uint8 const* data = bb.contents();
+    for (size_t i = 0; i < bb.size(); ++i)
+    {
+        out.push_back(hex[(data[i] >> 4) & 0x0Fu]);
+        out.push_back(hex[data[i] & 0x0Fu]);
+    }
+    return out;
+}
+
+static CustodyRow TestCustodyRow(uint32 id, std::string const& key,
+                                 uint8 kind, uint8 role, uint32 ownerGuid,
+                                 uint32 amount, uint32 itemGuid,
+                                 uint32 auctionId, uint64 createdTime = 0)
+{
+    CustodyRow row = {};
+    row.id = id;
+    row.idemKey = key;
+    row.kind = kind;
+    row.role = role;
+    row.state = CST_RESERVED;
+    row.ownerGuid = ownerGuid;
+    row.amount = amount;
+    row.itemGuid = itemGuid;
+    row.auctionId = auctionId;
+    row.createdTime = createdTime;
+    return row;
+}
+
+static CustodySnapshotGroup TestCustodyGroup(
+    uint32 auctionId, uint32 itemGuid, uint32 ownerGuid,
+    uint32 bidderGuid, uint32 bid, uint32 deposit,
+    std::vector<CustodyRow> const& rows)
+{
+    CustodySnapshotGroup group = {};
+    group.auctionId = auctionId;
+    group.auction.exists = true;
+    group.auction.auctionId = auctionId;
+    group.auction.itemGuid = itemGuid;
+    group.auction.ownerGuid = ownerGuid;
+    group.auction.bidderGuid = bidderGuid;
+    group.auction.bid = bid;
+    group.auction.deposit = deposit;
+    group.rows = rows;
+    return group;
+}
+
+static uint32 CountCustodyFindings(CustodyReconcileReport const& report,
+                                   CustodyFindingReason reason,
+                                   CustodyRepairOwnership ownership,
+                                   CustodyFindingState state)
+{
+    uint32 count = 0;
+    for (size_t i = 0; i < report.findings.size(); ++i)
+    {
+        CustodyFinding const& finding = report.findings[i];
+        if (finding.reason == reason &&
+            finding.repairOwnership == ownership &&
+            finding.state == state)
+        {
+            ++count;
+        }
+    }
+    return count;
+}
+
+static bool RunPureCustodyReconcilerTests()
+{
+    bool pass = true;
+    uint32 const botOwner = TEST_BOT_OWNER_GUID;
+
+    auto marker = [botOwner](uint32 auctionId, uint32 itemGuid,
+                             uint64 createdTime = 0) -> CustodyRow
+    {
+        return TestCustodyRow(auctionId, "botlist:test:" + std::to_string(auctionId),
+            CUSTODY_ITEM, ROLE_RESOLUTION, botOwner, 0, itemGuid,
+            auctionId, createdTime);
+    };
+    auto bidRow = [](uint32 id, uint32 auctionId, uint32 bidder,
+                     uint32 amount, uint64 createdTime = 0) -> CustodyRow
+    {
+        return TestCustodyRow(id, "bid:" + std::to_string(auctionId) +
+            ":" + std::to_string(id), CUSTODY_GOLD, ROLE_BID,
+            bidder, amount, 0, auctionId, createdTime);
+    };
+
+    // Marker-owned listings do not invent player seller custody.
+    {
+        CustodyReconciler reconciler;
+        CustodyReconcileReport report;
+        std::vector<CustodySnapshotGroup> groups;
+        groups.push_back(TestCustodyGroup(980001, 880001, botOwner, 0, 0, 0,
+            std::vector<CustodyRow>(1, marker(980001, 880001))));
+        reconciler.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
+        if (!report.findings.empty() || report.rowVisits != 1)
+        {
+            printf("custody FAIL: valid DB-only bot marker produced drift\n");
+            pass = false;
+        }
+    }
+
+    // Marker plus matching player bid stays clean.
+    {
+        CustodyReconciler reconciler;
+        CustodyReconcileReport report;
+        std::vector<CustodyRow> rows;
+        rows.push_back(marker(980002, 880002));
+        rows.push_back(bidRow(2, 980002, 2202, 202));
+        std::vector<CustodySnapshotGroup> groups(1,
+            TestCustodyGroup(980002, 880002, botOwner, 2202, 202, 0, rows));
+        reconciler.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
+        if (!report.findings.empty())
+        {
+            printf("custody FAIL: matching bot-listing bid produced drift\n");
+            pass = false;
+        }
+    }
+
+    // A fresh row defers the whole group before and after auction facts change.
+    {
+        CustodyReconciler reconciler;
+        CustodyReconcileReport report;
+        std::vector<CustodyRow> rows;
+        rows.push_back(marker(980003, 880003, 900));
+        rows.push_back(bidRow(3, 980003, 2203, 203, 950));
+        std::vector<CustodySnapshotGroup> groups(1,
+            TestCustodyGroup(980003, 880003, botOwner, 0, 0, 0, rows));
+        reconciler.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
+        if (!report.findings.empty() || report.pendingBidCount != 0)
+        {
+            printf("custody FAIL: fresh bid was not deferred before auction update\n");
+            pass = false;
+        }
+        groups[0].auction.bidderGuid = 2203;
+        groups[0].auction.bid = 203;
+        reconciler.Scan(groups, 1005, CUSTODY_SCAN_RUNTIME, report);
+        if (!report.findings.empty() || report.pendingBidCount != 0)
+        {
+            printf("custody FAIL: fresh bid was not deferred after auction update\n");
+            pass = false;
+        }
+    }
+
+    // Complete and partial player seller custody.
+    {
+        std::vector<CustodyRow> rows;
+        rows.push_back(TestCustodyRow(1, "item:980004", CUSTODY_ITEM,
+            ROLE_ITEM, 1204, 0, 880004, 980004));
+        rows.push_back(TestCustodyRow(2, "dep:980004", CUSTODY_GOLD,
+            ROLE_DEPOSIT, 1204, 44, 0, 980004));
+        CustodyReconciler reconciler;
+        CustodyReconcileReport report;
+        std::vector<CustodySnapshotGroup> groups(1,
+            TestCustodyGroup(980004, 880004, 1204, 0, 0, 44, rows));
+        reconciler.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
+        if (!report.findings.empty())
+        {
+            printf("custody FAIL: complete player seller custody produced drift\n");
+            pass = false;
+        }
+
+        groups[0].rows.pop_back();
+        reconciler.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
+        if (CountCustodyFindings(report, CUSTODY_FINDING_MISSING,
+                CUSTODY_REPAIR_GENERIC, CUSTODY_FINDING_CONFIRMED) != 1)
+        {
+            printf("custody FAIL: partial seller custody did not report one missing row\n");
+            pass = false;
+        }
+    }
+
+    // Resolution-only legacy provenance and a valid bid-only overlay stay clean.
+    {
+        CustodyReconciler reconciler;
+        CustodyReconcileReport report;
+        std::vector<CustodySnapshotGroup> groups;
+        groups.push_back(TestCustodyGroup(980005, 880005, 1205, 0, 0, 55,
+            std::vector<CustodyRow>(1, TestCustodyRow(1, "resolve:test:980005",
+                CUSTODY_GOLD, ROLE_RESOLUTION, 0, 0, 0, 980005))));
+        groups.push_back(TestCustodyGroup(980006, 880006, 1206, 2206, 206, 66,
+            std::vector<CustodyRow>(1, bidRow(1, 980006, 2206, 206))));
+        reconciler.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
+        if (!report.findings.empty())
+        {
+            printf("custody FAIL: valid legacy provenance or bid overlay produced drift\n");
+            pass = false;
+        }
+    }
+
+    // A future canonical bot item remains marker-owned.
+    {
+        CustodyReconciler reconciler;
+        CustodyReconcileReport report;
+        std::vector<CustodyRow> rows;
+        rows.push_back(marker(980007, 880007));
+        rows.push_back(TestCustodyRow(2, "item:980007", CUSTODY_ITEM,
+            ROLE_ITEM, botOwner, 0, 880007, 980007));
+        std::vector<CustodySnapshotGroup> groups(1,
+            TestCustodyGroup(980007, 880007, botOwner, 0, 0, 0, rows));
+        reconciler.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
+        if (!report.findings.empty())
+        {
+            printf("custody FAIL: canonical bot item overrode marker provenance\n");
+            pass = false;
+        }
+    }
+
+    // Invalid and duplicate markers are confirmed manual-only findings.
+    {
+        CustodyReconciler reconciler;
+        CustodyReconcileReport report;
+        CustodyRow invalid = marker(980008, 880008);
+        invalid.role = ROLE_ITEM;
+        std::vector<CustodySnapshotGroup> groups(1,
+            TestCustodyGroup(980008, 880008, botOwner, 0, 0, 0,
+                std::vector<CustodyRow>(1, invalid)));
+        reconciler.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
+        if (CountCustodyFindings(report, CUSTODY_FINDING_INVALID_MARKER,
+                CUSTODY_REPAIR_MANUAL_ONLY, CUSTODY_FINDING_CONFIRMED) != 1)
+        {
+            printf("custody FAIL: invalid marker ownership/reason mismatch\n");
+            pass = false;
+        }
+
+        std::vector<CustodyRow> duplicateRows;
+        duplicateRows.push_back(marker(980009, 880009));
+        CustodyRow second = marker(980009, 880009);
+        second.id += 1;
+        second.idemKey += ":duplicate";
+        duplicateRows.push_back(second);
+        groups[0] = TestCustodyGroup(980009, 880009, botOwner, 0, 0, 0,
+            duplicateRows);
+        reconciler.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
+        if (CountCustodyFindings(report, CUSTODY_FINDING_DUPLICATE_MARKER,
+                CUSTODY_REPAIR_MANUAL_ONLY, CUSTODY_FINDING_CONFIRMED) != 1)
+        {
+            printf("custody FAIL: duplicate markers did not produce one finding\n");
+            pass = false;
+        }
+    }
+
+    // Orphan marker cleanup belongs to the bot sweep; player rows remain generic.
+    {
+        CustodyReconciler reconciler;
+        CustodyReconcileReport report;
+        CustodySnapshotGroup orphan = {};
+        orphan.auctionId = 980010;
+        orphan.rows.push_back(marker(980010, 880010));
+        orphan.rows.push_back(bidRow(2, 980010, 2210, 210));
+        std::vector<CustodySnapshotGroup> groups(1, orphan);
+        reconciler.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
+        if (report.sweepOwnedCount != 1 || report.confirmedDriftCount != 1 ||
+            CountCustodyFindings(report, CUSTODY_FINDING_SWEEP_OWNED_MARKER,
+                CUSTODY_REPAIR_BOT_SWEEP, CUSTODY_FINDING_CONFIRMED) != 1 ||
+            CountCustodyFindings(report, CUSTODY_FINDING_ORPHAN_PLAYER,
+                CUSTODY_REPAIR_GENERIC, CUSTODY_FINDING_CONFIRMED) != 1)
+        {
+            printf("custody FAIL: orphan marker/player ownership split is wrong\n");
+            pass = false;
+        }
+    }
+
+    // Missing, duplicate, mismatched, and unexpected bids begin pending.
+    {
+        CustodyReconciler reconciler;
+        CustodyReconcileReport report;
+        std::vector<CustodySnapshotGroup> groups;
+        groups.push_back(TestCustodyGroup(980011, 880011, botOwner, 2211, 211, 0,
+            std::vector<CustodyRow>(1, marker(980011, 880011))));
+        std::vector<CustodyRow> duplicate;
+        duplicate.push_back(bidRow(1, 980012, 2212, 212));
+        duplicate.push_back(bidRow(2, 980012, 2212, 212));
+        groups.push_back(TestCustodyGroup(980012, 880012, 1212, 2212, 212, 0,
+            duplicate));
+        std::vector<CustodyRow> mismatched;
+        mismatched.push_back(marker(980013, 880013));
+        mismatched.push_back(bidRow(2, 980013, 9999, 213));
+        groups.push_back(TestCustodyGroup(980013, 880013, botOwner, 2213, 213, 0,
+            mismatched));
+        std::vector<CustodyRow> unexpected;
+        unexpected.push_back(marker(980014, 880014));
+        unexpected.push_back(bidRow(2, 980014, 2214, 214));
+        groups.push_back(TestCustodyGroup(980014, 880014, botOwner, 0, 0, 0,
+            unexpected));
+        reconciler.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
+        if (report.pendingBidCount != 5 || report.confirmedDriftCount != 0 ||
+            CountCustodyFindings(report, CUSTODY_FINDING_MISSING,
+                CUSTODY_REPAIR_MANUAL_ONLY, CUSTODY_FINDING_PENDING) != 1 ||
+            CountCustodyFindings(report, CUSTODY_FINDING_DUPLICATE,
+                CUSTODY_REPAIR_MANUAL_ONLY, CUSTODY_FINDING_PENDING) != 2 ||
+            CountCustodyFindings(report, CUSTODY_FINDING_MISMATCHED,
+                CUSTODY_REPAIR_MANUAL_ONLY, CUSTODY_FINDING_PENDING) != 1 ||
+            CountCustodyFindings(report, CUSTODY_FINDING_UNEXPECTED,
+                CUSTODY_REPAIR_MANUAL_ONLY, CUSTODY_FINDING_PENDING) != 1)
+        {
+            printf("custody FAIL: bid mismatch reason or pending counts are wrong\n");
+            pass = false;
+        }
+    }
+
+    // Stable bid mismatch confirmation uses exact 1000/1059/1060 boundaries.
+    {
+        CustodyReconciler reconciler;
+        CustodyReconcileReport report;
+        std::vector<CustodySnapshotGroup> groups(1,
+            TestCustodyGroup(980015, 880015, botOwner, 2215, 215, 0,
+                std::vector<CustodyRow>(1, marker(980015, 880015))));
+        reconciler.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
+        if (report.pendingBidCount != 1 || report.confirmedDriftCount != 0)
+        {
+            printf("custody FAIL: first bid mismatch was not pending\n");
+            pass = false;
+        }
+        reconciler.Scan(groups, 1059, CUSTODY_SCAN_RUNTIME, report);
+        if (report.pendingBidCount != 1 || report.confirmedDriftCount != 0)
+        {
+            printf("custody FAIL: 59-second bid mismatch did not remain pending\n");
+            pass = false;
+        }
+        reconciler.Scan(groups, 1060, CUSTODY_SCAN_RUNTIME, report);
+        if (report.pendingBidCount != 0 || report.confirmedDriftCount != 1)
+        {
+            printf("custody FAIL: 60-second bid mismatch was not confirmed\n");
+            pass = false;
+        }
+
+        groups[0].rows.push_back(bidRow(2, 980015, 2215, 215));
+        reconciler.Scan(groups, 1061, CUSTODY_SCAN_RUNTIME, report);
+        if (!report.findings.empty())
+        {
+            printf("custody FAIL: matching bid did not clear pending cache\n");
+            pass = false;
+        }
+    }
+
+    // Changed, fresh, removed, and boot observations cannot confirm old state.
+    {
+        CustodyReconcileReport report;
+        std::vector<CustodySnapshotGroup> groups(1,
+            TestCustodyGroup(980016, 880016, botOwner, 2216, 216, 0,
+                std::vector<CustodyRow>(1, marker(980016, 880016))));
+
+        CustodyReconciler changed;
+        changed.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
+        groups[0].auction.bid = 217;
+        changed.Scan(groups, 1060, CUSTODY_SCAN_RUNTIME, report);
+        if (report.pendingBidCount != 1 || report.confirmedDriftCount != 0)
+        {
+            printf("custody FAIL: changed fingerprint confirmed stale mismatch\n");
+            pass = false;
+        }
+
+        std::vector<CustodyRow> wrongShapeRows;
+        wrongShapeRows.push_back(marker(980017, 880017));
+        wrongShapeRows.push_back(bidRow(2, 980017, 2217, 217));
+        wrongShapeRows[1].itemGuid = 1;
+        std::vector<CustodySnapshotGroup> wrongShapeGroups(1,
+            TestCustodyGroup(980017, 880017, botOwner, 2217, 217, 0,
+                wrongShapeRows));
+        CustodyReconciler rowChanged;
+        rowChanged.Scan(wrongShapeGroups, 1000, CUSTODY_SCAN_RUNTIME, report);
+        wrongShapeGroups[0].rows[1].itemGuid = 2;
+        rowChanged.Scan(wrongShapeGroups, 1060, CUSTODY_SCAN_RUNTIME, report);
+        if (report.pendingBidCount != 1 || report.confirmedDriftCount != 0)
+        {
+            printf("custody FAIL: changed bid-row shape inherited mismatch age\n");
+            pass = false;
+        }
+
+        CustodyReconciler fresh;
+        fresh.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
+        groups[0].rows.push_back(bidRow(2, 980016, 9999, 217, 1100));
+        fresh.Scan(groups, 1060, CUSTODY_SCAN_RUNTIME, report);
+        if (!report.findings.empty())
+        {
+            printf("custody FAIL: fresh group did not clear mismatch observation\n");
+            pass = false;
+        }
+        groups[0].rows.pop_back();
+        fresh.Scan(groups, 1200, CUSTODY_SCAN_RUNTIME, report);
+        if (report.pendingBidCount != 1 || report.confirmedDriftCount != 0)
+        {
+            printf("custody FAIL: fresh-group clear retained old mismatch age\n");
+            pass = false;
+        }
+
+        CustodyReconciler removed;
+        removed.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
+        removed.Scan(std::vector<CustodySnapshotGroup>(), 1060,
+            CUSTODY_SCAN_RUNTIME, report);
+        removed.Scan(groups, 1120, CUSTODY_SCAN_RUNTIME, report);
+        if (report.pendingBidCount != 1 || report.confirmedDriftCount != 0)
+        {
+            printf("custody FAIL: removed group retained old mismatch age\n");
+            pass = false;
+        }
+
+        CustodyReconciler boot;
+        boot.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
+        boot.Scan(groups, 1060, CUSTODY_SCAN_BOOT, report);
+        if (report.pendingBidCount != 1 || report.confirmedDriftCount != 0)
+        {
+            printf("custody FAIL: boot scan confirmed prior mismatch\n");
+            pass = false;
+        }
+
+        CustodyReconciler future;
+        groups[0].rows.push_back(bidRow(3, 980016, 9999, 217, 2000));
+        future.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
+        if (!report.findings.empty())
+        {
+            printf("custody FAIL: future timestamp was treated as mature\n");
+            pass = false;
+        }
+    }
+
+    // A large clean population visits each input row exactly once.
+    {
+        std::vector<CustodySnapshotGroup> groups;
+        groups.reserve(50000);
+        for (uint32 i = 0; i < 50000; ++i)
+        {
+            uint32 const auctionId = 1000000 + i;
+            groups.push_back(TestCustodyGroup(auctionId, 2000000 + i,
+                3000000 + i, 0, 0, 0,
+                std::vector<CustodyRow>(1, TestCustodyRow(i + 1,
+                    "resolve:linear:" + std::to_string(i), CUSTODY_GOLD,
+                    ROLE_RESOLUTION, 0, 0, 0, auctionId))));
+        }
+        CustodyReconciler reconciler;
+        CustodyReconcileReport report;
+        reconciler.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
+        if (report.rowVisits != 50000 || !report.findings.empty())
+        {
+            printf("custody FAIL: linear scan visits=" UI64FMTD " findings=%u\n",
+                report.rowVisits, uint32(report.findings.size()));
+            pass = false;
+        }
+    }
+
+    // Automatic custody maintenance gates reconciliation/pruning and the bot
+    // materialization sweep independently.
+    {
+        CustodyMaintenancePlan const disabled =
+            CustodyService::GetMaintenancePlan(false, false);
+        CustodyMaintenancePlan const custodyOnly =
+            CustodyService::GetMaintenancePlan(true, false);
+        CustodyMaintenancePlan const writeOnly =
+            CustodyService::GetMaintenancePlan(false, true);
+        CustodyMaintenancePlan const enabled =
+            CustodyService::GetMaintenancePlan(true, true);
+
+        if (disabled.reconcile || disabled.prune ||
+            disabled.sweepBotMaterializations ||
+            !custodyOnly.reconcile || !custodyOnly.prune ||
+            custodyOnly.sweepBotMaterializations ||
+            writeOnly.reconcile || writeOnly.prune ||
+            !writeOnly.sweepBotMaterializations ||
+            !enabled.reconcile || !enabled.prune ||
+            !enabled.sweepBotMaterializations)
+        {
+            printf("custody FAIL: maintenance gate truth table mismatch\n");
+            pass = false;
+        }
+    }
+
+    // Expected bot-sweep ownership and transient bid observations are
+    // diagnostics, not errors. Confirmed player/manual drift remains an error.
+    {
+        CustodyFinding confirmed = {};
+        confirmed.repairOwnership = CUSTODY_REPAIR_GENERIC;
+        confirmed.state = CUSTODY_FINDING_CONFIRMED;
+
+        CustodyFinding manual = confirmed;
+        manual.repairOwnership = CUSTODY_REPAIR_MANUAL_ONLY;
+
+        CustodyFinding pending = confirmed;
+        pending.state = CUSTODY_FINDING_PENDING;
+
+        CustodyFinding sweepOwned = confirmed;
+        sweepOwned.repairOwnership = CUSTODY_REPAIR_BOT_SWEEP;
+
+        if (!CustodyService::ReconcileFindingIsError(confirmed) ||
+            !CustodyService::ReconcileFindingIsError(manual) ||
+            CustodyService::ReconcileFindingIsError(pending) ||
+            CustodyService::ReconcileFindingIsError(sweepOwned))
+        {
+            printf("custody FAIL: reconcile finding severity policy mismatch\n");
+            pass = false;
+        }
+    }
+
+    // Each automatic/manual operation owns one independent detail budget.
+    {
+        CustodyDetailBudget budget(100);
+        uint32 allowed = 0;
+        for (uint32 i = 0; i < 101; ++i)
+        {
+            if (budget.Take())
+            {
+                ++allowed;
+            }
+        }
+
+        CustodyDetailBudget second(100);
+        if (allowed != 100 || budget.Allowed() != 100 ||
+            budget.Suppressed() != 1 || !second.Take() ||
+            second.Allowed() != 1 || second.Suppressed() != 0)
+        {
+            printf("custody FAIL: detail budget did not cap at 100\n");
+            pass = false;
+        }
+    }
+
+    // Shuffled input yields deterministic sorted detail output without
+    // changing exact category totals when the first 100 details are selected.
+    {
+        std::vector<CustodySnapshotGroup> groups;
+        for (uint32 i = 0; i < 101; ++i)
+        {
+            uint32 const auctionId = 990100 - i;
+            CustodySnapshotGroup group = {};
+            group.auctionId = auctionId;
+            group.rows.push_back(TestCustodyRow(i + 1,
+                "test:budget:" + std::to_string(auctionId), CUSTODY_GOLD,
+                ROLE_BID, 4000000 + i, 100 + i, 0, auctionId));
+            groups.push_back(group);
+        }
+
+        CustodyReconciler reconciler;
+        CustodyReconcileReport report;
+        reconciler.Scan(groups, 1000, CUSTODY_SCAN_RUNTIME, report);
+        CustodyDetailBudget budget(100);
+        uint32 firstAuctionId = 0;
+        uint32 lastAuctionId = 0;
+        for (size_t i = 0; i < report.findings.size(); ++i)
+        {
+            if (!budget.Take())
+            {
+                continue;
+            }
+            if (!firstAuctionId)
+            {
+                firstAuctionId = report.findings[i].row.auctionId;
+            }
+            lastAuctionId = report.findings[i].row.auctionId;
+        }
+
+        if (report.findings.size() != 101 ||
+            report.confirmedDriftCount != 101 ||
+            report.pendingBidCount != 0 || report.sweepOwnedCount != 0 ||
+            firstAuctionId != 990000 || lastAuctionId != 990099 ||
+            budget.Allowed() != 100 || budget.Suppressed() != 1)
+        {
+            printf("custody FAIL: bounded report order/totals mismatch\n");
+            pass = false;
+        }
+    }
+
+    return pass;
+}
+
+static Item* TestCreateCachedAuctionItem(uint32 itemId, uint32 ownerGuid)
+{
+    Item* item = Item::CreateItem(itemId, 1);
+    if (!item)
+    {
+        return NULL;
+    }
+
+    item->SetOwnerGuid(ObjectGuid(HIGHGUID_PLAYER, ownerGuid));
+    CharacterDatabase.BeginTransaction();
+    item->SaveToDB();
+    if (!CharacterDatabase.CommitTransactionChecked())
+    {
+        delete item;
+        return NULL;
+    }
+
+    sAuctionMgr.AddAItem(item);
+    return item;
+}
+
+static bool TestArmCustodyCommitFailure(char const* phase,
+                                        std::string& originalConfig,
+                                        std::string& testConfig)
+{
+    originalConfig = sAhService.Settings().custodyFailCommitAt;
+    testConfig = phase;
+    sAhService.SetCustodyFailCommitAt(testConfig);
+    return true;
+}
+
+static bool TestRestoreConfig(std::string const& originalConfig,
+                              std::string const& /*testConfig*/)
+{
+    sAhService.SetCustodyFailCommitAt(originalConfig);
+    return true;
+}
+
+/// Self-test for Database::CommitTransactionChecked(): proves the runtime
+/// (async-enabled) path is synchronous, durable and returns the REAL result.
+/// Returns 0 on pass, non-zero on fail.
+static int RunCommitTest()
+{
+    bool pass = true;
+
+    // Force the runtime async path so the transaction is FIFO-queued through
+    // the delay thread and CommitTransactionChecked() blocks until durable.
+    CharacterDatabase.AllowAsyncTransactions();
+
+    // Clean slate (ignore result; row may or may not exist from a prior run).
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `custody_ledger` WHERE `idem_key` LIKE 'test:commit%'");
+
+    // (a) Success path: a valid INSERT must commit and be visible BEFORE return.
+    CharacterDatabase.BeginTransaction();
+    CharacterDatabase.PExecute(
+        "INSERT INTO `custody_ledger` "
+        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+        "VALUES ('test:commit:ok',1,1,0,0,0,0,0,0,0,0)");
+    bool ok = CharacterDatabase.CommitTransactionChecked();
+    if (!ok)
+    {
+        printf("commit FAIL: success-path CommitTransactionChecked returned false\n");
+        pass = false;
+    }
+
+    // Durability: a synchronous SELECT must see the row immediately after the
+    // (blocking) checked commit returned - i.e. it is durable, not deferred.
+    {
+        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
+            "SELECT 1 FROM `custody_ledger` WHERE `idem_key`='test:commit:ok'"));
+        if (!res)
+        {
+            printf("commit FAIL: committed row not visible after return (not durable)\n");
+            pass = false;
+        }
+    }
+
+    // (b) Rollback path: a second row with the SAME idem_key violates uk_idem,
+    // so the transaction must fail and CommitTransactionChecked() must return
+    // false. The duplicate must NOT land.
+    CharacterDatabase.BeginTransaction();
+    CharacterDatabase.PExecute(
+        "INSERT INTO `custody_ledger` "
+        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+        "VALUES ('test:commit:ok',2,2,0,0,0,0,0,0,0,0)");
+    bool ok2 = CharacterDatabase.CommitTransactionChecked();
+    if (ok2)
+    {
+        printf("commit FAIL: rollback-path CommitTransactionChecked returned true\n");
+        pass = false;
+    }
+
+    // The duplicate must not have landed: still exactly one row for the key.
+    {
+        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
+            "SELECT COUNT(*) FROM `custody_ledger` "
+            "WHERE `idem_key`='test:commit:ok'"));
+        if (!res || res->Fetch()[0].GetUInt64() != 1)
+        {
+            printf("commit FAIL: duplicate row landed after rollback\n");
+            pass = false;
+        }
+    }
+
+    // (c) Post-rollback TSS cleanliness: the false-returning rollback path above
+    // must still have detached the transaction from the TSS slot. If it left a
+    // residue, this third BeginTransaction() would trip MANGOS_ASSERT(!m_pTrans);
+    // in TransHelper::init(); a clean detach lets a fresh checked commit succeed
+    // and land its row.
+    CharacterDatabase.BeginTransaction();
+    CharacterDatabase.PExecute(
+        "INSERT INTO `custody_ledger` "
+        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+        "VALUES ('test:commit:after',1,1,0,0,0,0,0,0,0,0)");
+    bool ok3 = CharacterDatabase.CommitTransactionChecked();
+    if (!ok3)
+    {
+        printf("commit FAIL: post-rollback CommitTransactionChecked returned false (TSS not clean?)\n");
+        pass = false;
+    }
+    {
+        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
+            "SELECT 1 FROM `custody_ledger` WHERE `idem_key`='test:commit:after'"));
+        if (!res)
+        {
+            printf("commit FAIL: post-rollback committed row not visible (not durable)\n");
+            pass = false;
+        }
+    }
+
+    // Clean up (covers test:commit:ok and test:commit:after via the prefix).
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `custody_ledger` WHERE `idem_key` LIKE 'test:commit%'");
+
+    if (pass)
+    {
+        printf("commit OK\n");
+        return 0;
+    }
+
+    return 2;
+}
+
+/// Self-test for MailDraft::SendMailToInTransaction + CustodyDeferred: proves
+/// the co-commit variant appends the `mail` row to the CALLER's open
+/// transaction (no own Begin/Commit) and that running the deferred queue after
+/// a checked commit is safe. Uses existing offline character guid 1 (which has
+/// an account, so the offline path writes a row). Returns 0 on pass.
+static int RunMailTest()
+{
+    bool pass = true;
+
+    CharacterDatabase.AllowAsyncTransactions();
+
+    // Seed mail ids from MAX(mail.id)+1 so GenerateMailID() does not collide
+    // with existing rows (world data is NOT loaded under -t).
+    sObjectMgr.SetHighestGuids();
+
+    // The offline mail path requires the recipient to resolve to an account.
+    // Normal test clones may not have a character with guid 1, so seed one only
+    // when absent and clean up only our own fixture row afterwards.
+    bool seededReceiver = false;
+    {
+        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
+            "SELECT 1 FROM `characters` WHERE `guid`=1"));
+        if (!res)
+        {
+            CharacterDatabase.DirectExecute(
+                "INSERT INTO `characters` (`guid`,`account`,`name`,`money`) "
+                "VALUES (1, 1, 'AhMailTest1', 0)");
+            seededReceiver = true;
+        }
+    }
+
+    // Clean slate from any prior run.
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `mail` WHERE `receiver`=1 AND `money`=123 "
+        "AND `subject`='custodytest'");
+
+    // Append the mail to OUR open transaction, then checked-commit, then run
+    // the deferred queue (offline receiver => effects empty, items deferred).
+    CharacterDatabase.BeginTransaction();
+    MailDraft d("custodytest", "b");
+    d.SetMoney(123);
+    CustodyDeferred def;
+    d.SendMailToInTransaction(MailReceiver(ObjectGuid(HIGHGUID_PLAYER, uint32(1))),
+                              MailSender(MAIL_AUCTION, uint32(0)), def.effects);
+    bool ok = CharacterDatabase.CommitTransactionChecked();
+    if (!ok)
+    {
+        printf("mail FAIL: CommitTransactionChecked returned false\n");
+        pass = false;
+    }
+    else
+    {
+        def.run();
+    }
+
+    // The mail row must have co-committed in our transaction.
+    {
+        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
+            "SELECT COUNT(*) FROM `mail` WHERE `receiver`=1 AND `money`=123 "
+            "AND `subject`='custodytest'"));
+        if (!res || res->Fetch()[0].GetUInt64() != 1)
+        {
+            printf("mail FAIL: co-committed mail row not found (expected 1)\n");
+            pass = false;
+        }
+    }
+
+    // Clean up.
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `mail` WHERE `receiver`=1 AND `money`=123 "
+        "AND `subject`='custodytest'");
+    if (seededReceiver)
+    {
+        CharacterDatabase.DirectExecute(
+            "DELETE FROM `characters` WHERE `guid`=1 AND `name`='AhMailTest1'");
+    }
+
+    if (pass)
+    {
+        printf("mail OK\n");
+        return 0;
+    }
+
+    return 2;
+}
+
+/// CRUD round-trip test for CustodyLedger: Insert, Get, GetRouteState, SetState,
+/// LoadNonTerminal, DeleteTerminalOlderThan.  Returns 0 on pass.
+static int RunCustodyTest()
+{
+    bool pass = true;
+
+    if (CustodyService::ShouldCrashAtPhase("", "") ||
+        CustodyService::ShouldCrashAtPhase("pre-commit", "") ||
+        CustodyService::ShouldCrashAtPhase("", "pre-commit") ||
+        CustodyService::ShouldCrashAtPhase("pre-commit", "pre-deferred") ||
+        !CustodyService::ShouldCrashAtPhase("pre-commit", "pre-commit"))
+    {
+        printf("custody FAIL: crash phase predicate mismatch\n");
+        pass = false;
+    }
+
+    CharacterDatabase.AllowAsyncTransactions();
+
+    // Clean slate from any prior aborted run.
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `custody_ledger` WHERE `idem_key` LIKE 'test:crud%'");
+
+    // ------------------------------------------------------------------ step 1
+    // Insert a RESERVED gold row and commit.
+    {
+        CustodyRow r;
+        r.id              = 0;
+        r.idemKey         = "test:crud:1";
+        r.kind            = CUSTODY_GOLD;
+        r.role            = ROLE_BID;
+        r.state           = CST_RESERVED;
+        r.ownerGuid       = 1;
+        r.beneficiaryGuid = 0;
+        r.amount          = 50;
+        r.itemGuid        = 0;
+        r.auctionId       = 999;
+        r.createdTime     = static_cast<uint64>(time(NULL));
+        r.resolvedTime    = 0;
+
+        CharacterDatabase.BeginTransaction();
+        CustodyLedger::Insert(r);
+        bool ok = CharacterDatabase.CommitTransactionChecked();
+        if (!ok)
+        {
+            printf("custody FAIL: step 1 Insert CommitTransactionChecked returned false\n");
+            pass = false;
+        }
+    }
+
+    // ------------------------------------------------------------------ step 2
+    // Get: row visible, state==CST_RESERVED, amount==50.
+    {
+        CustodyRow row;
+        bool found = CustodyLedger::Get("test:crud:1", row);
+        if (!found)
+        {
+            printf("custody FAIL: step 2 Get returned false (row not found)\n");
+            pass = false;
+        }
+        else
+        {
+            if (row.state != CST_RESERVED)
+            {
+                printf("custody FAIL: step 2 state expected %u got %u\n",
+                    uint32(CST_RESERVED), uint32(row.state));
+                pass = false;
+            }
+            if (row.amount != 50)
+            {
+                printf("custody FAIL: step 2 amount expected 50 got %u\n", row.amount);
+                pass = false;
+            }
+        }
+    }
+
+    // The seeded bid row selects only bid custody; an absent auction selects none.
+    CustodyRouteState const seededRoute = CustodyLedger::GetRouteState(999);
+    if (seededRoute.usesPlayerSellerCustody || !seededRoute.hasLiveBidCustody)
+    {
+        printf("custody FAIL: step 2 GetRouteState(999) mismatch\n");
+        pass = false;
+    }
+    CustodyRouteState const absentRoute = CustodyLedger::GetRouteState(424242);
+    if (absentRoute.usesPlayerSellerCustody || absentRoute.hasLiveBidCustody)
+    {
+        printf("custody FAIL: step 2 GetRouteState(424242) unexpectedly routed\n");
+        pass = false;
+    }
+
+    // ------------------------------------------------------------------ step 3
+    // SetState to CST_TERMINAL_OK and verify.
+    {
+        uint64 resolvedNow = static_cast<uint64>(time(NULL));
+        CharacterDatabase.BeginTransaction();
+        CustodyLedger::SetState("test:crud:1", CST_TERMINAL_OK, resolvedNow);
+        bool ok = CharacterDatabase.CommitTransactionChecked();
+        if (!ok)
+        {
+            printf("custody FAIL: step 3 SetState CommitTransactionChecked returned false\n");
+            pass = false;
+        }
+
+        CustodyRow row;
+        bool found = CustodyLedger::Get("test:crud:1", row);
+        if (!found)
+        {
+            printf("custody FAIL: step 3 Get returned false after SetState\n");
+            pass = false;
+        }
+        else if (row.state != CST_TERMINAL_OK)
+        {
+            printf("custody FAIL: step 3 state expected %u got %u\n",
+                uint32(CST_TERMINAL_OK), uint32(row.state));
+            pass = false;
+        }
+    }
+
+    // ------------------------------------------------------------------ step 4
+    // LoadNonTerminal must NOT contain "test:crud:1" (it is now terminal).
+    {
+        std::vector<CustodyRow> v;
+        CustodyLedger::LoadNonTerminal(v);
+        for (size_t i = 0; i < v.size(); ++i)
+        {
+            if (v[i].idemKey == "test:crud:1")
+            {
+                printf("custody FAIL: step 4 LoadNonTerminal contains terminal row\n");
+                pass = false;
+                break;
+            }
+        }
+    }
+
+    // ------------------------------------------------------------------ step 5
+    // DeleteTerminalOlderThan(now+10): row must be pruned.
+    {
+        uint64 cutoff = static_cast<uint64>(time(NULL)) + 10;
+        CharacterDatabase.BeginTransaction();
+        CustodyLedger::DeleteTerminalOlderThan(cutoff);
+        bool ok = CharacterDatabase.CommitTransactionChecked();
+        if (!ok)
+        {
+            printf("custody FAIL: step 5 DeleteTerminalOlderThan CommitTransactionChecked returned false\n");
+            pass = false;
+        }
+
+        CustodyRow row;
+        bool found = CustodyLedger::Get("test:crud:1", row);
+        if (found)
+        {
+            printf("custody FAIL: step 5 Get returned true after prune (row not deleted)\n");
+            pass = false;
+        }
+    }
+
+    // ------------------------------------------------------------------ step 6
+    // Cleanup CRUD rows.
+    CharacterDatabase.BeginTransaction();
+    CharacterDatabase.PExecute(
+        "DELETE FROM `custody_ledger` WHERE `idem_key` LIKE 'test:crud%%'");
+    CharacterDatabase.CommitTransactionChecked();
+
+    // =================================================== authoritative reads
+    // These rows exercise route provenance independently from local AH maps.
+    uint32 const routeBase = 973100;
+    uint32 const snapshotAuctionId = routeBase + 7;
+    uint32 const orphanAuctionId = routeBase + 8;
+    uint64 const routeNow = static_cast<uint64>(time(NULL));
+
+    CharacterDatabase.DirectPExecute(
+        "DELETE FROM `custody_ledger` WHERE `auction_id` BETWEEN %u AND %u",
+        routeBase + 1, orphanAuctionId);
+    CharacterDatabase.DirectPExecute(
+        "DELETE FROM `auction` WHERE `id`=%u", snapshotAuctionId);
+
+    CharacterDatabase.BeginTransaction();
+    CharacterDatabase.PExecute(
+        "INSERT INTO `custody_ledger` "
+        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) VALUES "
+        "('item:973101',1,3,0,1101,0,0,883101,973101," UI64FMTD ",0),"
+        "('dep:973101',0,0,0,1101,0,31,0,973101," UI64FMTD ",0),"
+        "('bid:973102:1',0,1,0,2102,0,102,0,973102," UI64FMTD ",0),"
+        "('resolve:test:973103',0,4,0,0,0,0,0,973103," UI64FMTD ",0),"
+        "('botlist:test:973104',1,3,0,4294967294,0,0,883104,973104," UI64FMTD ",0),"
+        "('botlist:test:973105',1,3,0,4294967294,0,0,883105,973105," UI64FMTD ",0),"
+        "('bid:973105:1',0,1,0,2105,0,105,0,973105," UI64FMTD ",0),"
+        "('botlist:test:973106',1,3,0,4294967294,0,0,883106,973106," UI64FMTD ",0),"
+        "('item:973106',1,3,0,4294967294,0,0,883106,973106," UI64FMTD ",0),"
+        "('test:snapshot:live',0,4,0,0,0,0,0,973107," UI64FMTD ",0),"
+        "('test:snapshot:orphan',0,1,0,2208,0,208,0,973108," UI64FMTD ",0)",
+        routeNow, routeNow, routeNow, routeNow, routeNow, routeNow,
+        routeNow, routeNow, routeNow, routeNow, routeNow);
+    CharacterDatabase.PExecute(
+        "INSERT INTO `auction` "
+        "(`id`,`houseid`,`itemguid`,`item_template`,`item_count`,"
+        "`item_randompropertyid`,`itemowner`,`buyoutprice`,`time`,`buyguid`,"
+        "`lastbid`,`startbid`,`deposit`) "
+        "VALUES (%u,7,883107,25,2,0,1234,500," UI64FMTD ",2345,3456,100,77)",
+        snapshotAuctionId, routeNow + HOUR);
+    if (!CharacterDatabase.CommitTransactionChecked())
+    {
+        printf("custody FAIL: authoritative-read seed commit returned false\n");
+        pass = false;
+    }
+
+    struct RouteExpectation
+    {
+        uint32 auctionId;
+        bool seller;
+        bool bid;
+        char const* label;
+    };
+    RouteExpectation const routeExpectations[] =
+    {
+        { routeBase + 1, true,  false, "player seller" },
+        { routeBase + 2, false, true,  "bid only" },
+        { routeBase + 3, false, false, "resolution only" },
+        { routeBase + 4, false, false, "bot marker only" },
+        { routeBase + 5, false, true,  "bot marker plus bid" },
+        { routeBase + 6, false, false, "bot marker plus canonical item" },
+    };
+    for (size_t i = 0; i < sizeof(routeExpectations) / sizeof(routeExpectations[0]); ++i)
+    {
+        RouteExpectation const& expected = routeExpectations[i];
+        CustodyRouteState const route = CustodyLedger::GetRouteState(expected.auctionId);
+        if (route.usesPlayerSellerCustody != expected.seller ||
+            route.hasLiveBidCustody != expected.bid)
+        {
+            printf("custody FAIL: route %s expected seller=%u bid=%u got seller=%u bid=%u\n",
+                expected.label, uint32(expected.seller), uint32(expected.bid),
+                uint32(route.usesPlayerSellerCustody), uint32(route.hasLiveBidCustody));
+            pass = false;
+        }
+    }
+
+    AuctionHouseObject* authoritativeMap =
+        sAuctionMgr.GetAuctionsMap(AUCTION_HOUSE_NEUTRAL);
+    authoritativeMap->RemoveAuction(snapshotAuctionId);
+    if (authoritativeMap->GetAuction(snapshotAuctionId))
+    {
+        printf("custody FAIL: snapshot fixture unexpectedly exists in local AH map\n");
+        pass = false;
+    }
+
+    std::vector<CustodySnapshotGroup> snapshot;
+    CustodyLedger::LoadReconcileSnapshot(snapshot);
+    bool sawSnapshotAuction = false;
+    bool sawSnapshotOrphan = false;
+    for (size_t i = 0; i < snapshot.size(); ++i)
+    {
+        CustodySnapshotGroup const& group = snapshot[i];
+        if (group.auctionId == snapshotAuctionId)
+        {
+            sawSnapshotAuction = true;
+            if (!group.auction.exists || group.auction.auctionId != snapshotAuctionId ||
+                group.auction.itemGuid != 883107 || group.auction.ownerGuid != 1234 ||
+                group.auction.bidderGuid != 2345 || group.auction.bid != 3456 ||
+                group.auction.deposit != 77 || group.rows.size() != 1)
+            {
+                printf("custody FAIL: joined live auction facts do not match DB fixture\n");
+                pass = false;
+            }
+        }
+        else if (group.auctionId == orphanAuctionId)
+        {
+            sawSnapshotOrphan = true;
+            if (group.auction.exists || group.rows.size() != 1 ||
+                group.rows[0].idemKey != "test:snapshot:orphan")
+            {
+                printf("custody FAIL: joined orphan facts do not match DB fixture\n");
+                pass = false;
+            }
+        }
+    }
+    if (!sawSnapshotAuction || !sawSnapshotOrphan)
+    {
+        printf("custody FAIL: authoritative snapshot omitted live=%u orphan=%u\n",
+            uint32(sawSnapshotAuction), uint32(sawSnapshotOrphan));
+        pass = false;
+    }
+
+    if (!CustodyLedger::AuctionExists(snapshotAuctionId))
+    {
+        printf("custody FAIL: AuctionExists did not see shared auction row\n");
+        pass = false;
+    }
+    CharacterDatabase.DirectPExecute(
+        "DELETE FROM `auction` WHERE `id`=%u", snapshotAuctionId);
+    if (CustodyLedger::AuctionExists(snapshotAuctionId))
+    {
+        printf("custody FAIL: AuctionExists retained deleted shared auction row\n");
+        pass = false;
+    }
+
+    CharacterDatabase.DirectPExecute(
+        "DELETE FROM `custody_ledger` WHERE `auction_id` BETWEEN %u AND %u",
+        routeBase + 1, orphanAuctionId);
+    CharacterDatabase.DirectPExecute(
+        "DELETE FROM `auction` WHERE `id`=%u", snapshotAuctionId);
+
+    if (!RunPureCustodyReconcilerTests())
+    {
+        pass = false;
+    }
+
+    // ================================================================ reconcile
+    // Task 13: ReconcileScan flags custody drift and DeleteTerminalOlderThan
+    // prunes only old terminal rows.
+    uint32 const liveAuctionId = 970002;
+    uint32 const missingItemAuctionId = 970003;
+    uint32 const duplicateBidAuctionId = 970006;
+    uint64 const now = static_cast<uint64>(time(NULL));
+    uint64 const oldTime = now > 7200 ? now - 7200 : 1;
+
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `custody_ledger` WHERE `idem_key` LIKE 'test:recon:%'");
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `custody_ledger` WHERE `idem_key` IN "
+        "('item:970002','dep:970002','item:970003','dep:970003',"
+        "'item:970006','dep:970006','bid:970006:1','bid:970006:2')");
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `auction` WHERE `id` IN (970002,970003,970006)");
+
+    CharacterDatabase.BeginTransaction();
+    CharacterDatabase.PExecute(
+        "INSERT INTO `auction` "
+        "(`id`,`houseid`,`itemguid`,`item_template`,`item_count`,"
+        "`item_randompropertyid`,`itemowner`,`buyoutprice`,`time`,`buyguid`,"
+        "`lastbid`,`startbid`,`deposit`) VALUES "
+        "(970002,7,880002,25,1,0,1001,0," UI64FMTD ",0,0,10,5),"
+        "(970003,7,880003,25,1,0,1002,0," UI64FMTD ",0,0,10,5),"
+        "(970006,7,880006,25,1,0,1006,0," UI64FMTD ",2006,77,10,5)",
+        now + HOUR, now + HOUR, now + HOUR);
+    CharacterDatabase.PExecute(
+        "INSERT INTO `custody_ledger` "
+        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+        "VALUES ('test:recon:orphan','%u','%u','%u','%u','0','0','0','970001','" UI64FMTD "','0')",
+        uint32(CUSTODY_GOLD), uint32(ROLE_DEPOSIT), uint32(CST_RESERVED), 1000, oldTime);
+    CharacterDatabase.PExecute(
+        "INSERT INTO `custody_ledger` "
+        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+        "VALUES ('item:970002','%u','%u','%u','%u','0','0','880002','970002','" UI64FMTD "','0')",
+        uint32(CUSTODY_ITEM), uint32(ROLE_ITEM), uint32(CST_RESERVED), 1001, oldTime);
+    CharacterDatabase.PExecute(
+        "INSERT INTO `custody_ledger` "
+        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+        "VALUES ('dep:970002','%u','%u','%u','%u','0','5','0','970002','" UI64FMTD "','0')",
+        uint32(CUSTODY_GOLD), uint32(ROLE_DEPOSIT), uint32(CST_RESERVED), 1001, oldTime);
+    CharacterDatabase.PExecute(
+        "INSERT INTO `custody_ledger` "
+        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+        "VALUES ('dep:970003','%u','%u','%u','%u','0','5','0','970003','" UI64FMTD "','0')",
+        uint32(CUSTODY_GOLD), uint32(ROLE_DEPOSIT), uint32(CST_RESERVED), 1002, oldTime);
+    CharacterDatabase.PExecute(
+        "INSERT INTO `custody_ledger` "
+        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+        "VALUES ('item:970006','%u','%u','%u','%u','0','0','880006','970006','" UI64FMTD "','0')",
+        uint32(CUSTODY_ITEM), uint32(ROLE_ITEM), uint32(CST_RESERVED), 1006, oldTime);
+    CharacterDatabase.PExecute(
+        "INSERT INTO `custody_ledger` "
+        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+        "VALUES ('dep:970006','%u','%u','%u','%u','0','5','0','970006','" UI64FMTD "','0')",
+        uint32(CUSTODY_GOLD), uint32(ROLE_DEPOSIT), uint32(CST_RESERVED), 1006, oldTime);
+    CharacterDatabase.PExecute(
+        "INSERT INTO `custody_ledger` "
+        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+        "VALUES ('bid:970006:1','%u','%u','%u','%u','0','77','0','970006','" UI64FMTD "','0')",
+        uint32(CUSTODY_GOLD), uint32(ROLE_BID), uint32(CST_RESERVED), 2006, oldTime);
+    CharacterDatabase.PExecute(
+        "INSERT INTO `custody_ledger` "
+        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+        "VALUES ('bid:970006:2','%u','%u','%u','%u','0','77','0','970006','" UI64FMTD "','0')",
+        uint32(CUSTODY_GOLD), uint32(ROLE_BID), uint32(CST_RESERVED), 2006, oldTime);
+    CharacterDatabase.PExecute(
+        "INSERT INTO `custody_ledger` "
+        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+        "VALUES ('test:recon:old-terminal','%u','%u','%u','%u','0','0','0','970004','" UI64FMTD "','" UI64FMTD "')",
+        uint32(CUSTODY_GOLD), uint32(ROLE_DEPOSIT), uint32(CST_TERMINAL_OK), 1004, oldTime, oldTime);
+    CharacterDatabase.PExecute(
+        "INSERT INTO `custody_ledger` "
+        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+        "VALUES ('test:recon:recent-terminal','%u','%u','%u','%u','0','0','0','970005','" UI64FMTD "','" UI64FMTD "')",
+        uint32(CUSTODY_GOLD), uint32(ROLE_DEPOSIT), uint32(CST_TERMINAL_BACK), 1005, now, now);
+    if (!CharacterDatabase.CommitTransactionChecked())
+    {
+        printf("custody FAIL: reconcile seed commit returned false\n");
+        pass = false;
+    }
+
+    {
+        CustodyReconcileReport report;
+        CustodyService::ReconcileScan(now, CUSTODY_SCAN_RUNTIME, report);
+        bool sawOrphan = false;
+        bool sawCleanLive = false;
+        bool sawMissingItem = false;
+        uint32 pendingDuplicateBids = 0;
+        for (size_t i = 0; i < report.findings.size(); ++i)
+        {
+            CustodyFinding const& finding = report.findings[i];
+            if (finding.row.idemKey == "test:recon:orphan" &&
+                finding.reason == CUSTODY_FINDING_ORPHAN_PLAYER &&
+                finding.repairOwnership == CUSTODY_REPAIR_GENERIC)
+            {
+                sawOrphan = true;
+            }
+            if (finding.row.auctionId == liveAuctionId)
+            {
+                sawCleanLive = true;
+            }
+            if (finding.row.idemKey == "item:970003" &&
+                finding.reason == CUSTODY_FINDING_MISSING)
+            {
+                sawMissingItem = true;
+            }
+            if (finding.row.auctionId == duplicateBidAuctionId &&
+                finding.reason == CUSTODY_FINDING_DUPLICATE &&
+                finding.state == CUSTODY_FINDING_PENDING)
+            {
+                ++pendingDuplicateBids;
+            }
+        }
+        if (!sawOrphan)
+        {
+            printf("custody FAIL: reconcile did not flag orphan non-terminal row\n");
+            pass = false;
+        }
+        if (sawCleanLive)
+        {
+            printf("custody FAIL: reconcile flagged complete live custody auction\n");
+            pass = false;
+        }
+        if (!sawMissingItem)
+        {
+            printf("custody FAIL: reconcile did not flag live auction missing item row\n");
+            pass = false;
+        }
+        if (pendingDuplicateBids != 2)
+        {
+            printf("custody FAIL: reconcile duplicate bid pending count expected 2 got %u\n",
+                pendingDuplicateBids);
+            pass = false;
+        }
+    }
+
+    {
+        CharacterDatabase.BeginTransaction();
+        CustodyLedger::DeleteTerminalOlderThan(now - 3600);
+        if (!CharacterDatabase.CommitTransactionChecked())
+        {
+            printf("custody FAIL: reconcile prune commit returned false\n");
+            pass = false;
+        }
+
+        CustodyRow row;
+        if (CustodyLedger::Get("test:recon:old-terminal", row))
+        {
+            printf("custody FAIL: old terminal row was not pruned\n");
+            pass = false;
+        }
+        if (!CustodyLedger::Get("test:recon:recent-terminal", row))
+        {
+            printf("custody FAIL: recent terminal row was pruned\n");
+            pass = false;
+        }
+    }
+
+    CharacterDatabase.BeginTransaction();
+    CharacterDatabase.PExecute(
+        "DELETE FROM `auction` WHERE `id` IN (970002,970003,970006)");
+    CharacterDatabase.PExecute(
+        "DELETE FROM `custody_ledger` WHERE `idem_key` LIKE 'test:recon:%%'");
+    CharacterDatabase.PExecute(
+        "DELETE FROM `custody_ledger` WHERE `idem_key` IN "
+        "('item:970002','dep:970002','item:970003','dep:970003',"
+        "'item:970006','dep:970006','bid:970006:1','bid:970006:2')");
+    CharacterDatabase.CommitTransactionChecked();
+
+    // ========================================================== repair command
+    // Task 14: ah repair terminalizes custody drift conservatively and never
+    // mints mail from orphan ledger rows.
+    uint32 const repairOwner = 1;
+    uint32 const repairAuctionId = 970010;
+    uint32 const repairItemGuid = 880010;
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `mail` WHERE `receiver`=1 AND `subject`='AH custody repair'");
+    uint64 beforeRepairMail = 0;
+    {
+        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
+            "SELECT COUNT(*) FROM `mail` WHERE `receiver`='%u'",
+            repairOwner));
+        if (res)
+        {
+            beforeRepairMail = res->Fetch()[0].GetUInt64();
+        }
+    }
+
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `custody_ledger` WHERE `idem_key` LIKE 'test:repair:%'");
+    CharacterDatabase.BeginTransaction();
+    CharacterDatabase.PExecute(
+        "INSERT INTO `custody_ledger` "
+        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+        "VALUES ('test:repair:gold','%u','%u','%u','%u','0','12345','0','%u','" UI64FMTD "','0')",
+        uint32(CUSTODY_GOLD), uint32(ROLE_BID), uint32(CST_RESERVED),
+        repairOwner, repairAuctionId, oldTime);
+    CharacterDatabase.PExecute(
+        "INSERT INTO `custody_ledger` "
+        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+        "VALUES ('test:repair:item','%u','%u','%u','%u','0','0','%u','%u','" UI64FMTD "','0')",
+        uint32(CUSTODY_ITEM), uint32(ROLE_ITEM), uint32(CST_RESERVED),
+        repairOwner, repairItemGuid, repairAuctionId + 1, oldTime);
+    if (!CharacterDatabase.CommitTransactionChecked())
+    {
+        printf("custody FAIL: repair seed commit returned false\n");
+        pass = false;
+    }
+
+    CliHandler cli(0, SEC_ADMINISTRATOR, NULL, &TestCliPrint);
+    if (!cli.ParseCommands("ah repair apply"))
+    {
+        printf("custody FAIL: ah repair apply returned false\n");
+        pass = false;
+    }
+
+    {
+        CustodyRow row;
+        if (!CustodyLedger::Get("test:repair:gold", row) ||
+            row.state == CST_RESERVED)
+        {
+            printf("custody FAIL: ah repair did not terminalize gold row\n");
+            pass = false;
+        }
+        if (!CustodyLedger::Get("test:repair:item", row) ||
+            row.state == CST_RESERVED)
+        {
+            printf("custody FAIL: ah repair did not terminalize item row\n");
+            pass = false;
+        }
+    }
+
+    {
+        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
+            "SELECT COUNT(*) FROM `mail` WHERE `receiver`='%u'",
+            repairOwner));
+        uint64 const afterRepairMail = res ? res->Fetch()[0].GetUInt64() : 0;
+        if (afterRepairMail != beforeRepairMail)
+        {
+            printf("custody FAIL: ah repair minted mail from orphan ledger row\n");
+            pass = false;
+        }
+    }
+
+    {
+        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
+            "SELECT COUNT(*) FROM `item_instance` WHERE `guid`='%u'",
+            repairItemGuid));
+        if (res && res->Fetch()[0].GetUInt64() != 0)
+        {
+            printf("custody FAIL: ah repair mutated sentinel item_instance row\n");
+            pass = false;
+        }
+    }
+
+    CharacterDatabase.BeginTransaction();
+    CharacterDatabase.PExecute(
+        "INSERT INTO `custody_ledger` "
+        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+        "VALUES ('test:repair:force','%u','%u','%u','%u','0','54321','0','%u','" UI64FMTD "','0')",
+        uint32(CUSTODY_GOLD), uint32(ROLE_BID), uint32(CST_RESERVED),
+        repairOwner, repairAuctionId + 2, oldTime);
+    if (!CharacterDatabase.CommitTransactionChecked())
+    {
+        printf("custody FAIL: repair force seed commit returned false\n");
+        pass = false;
+    }
+
+    if (!cli.ParseCommands("ah repair force-forfeit test:repair:force"))
+    {
+        printf("custody FAIL: ah repair force-forfeit returned false\n");
+        pass = false;
+    }
+
+    {
+        CustodyRow row;
+        if (!CustodyLedger::Get("test:repair:force", row) ||
+            row.state == CST_RESERVED)
+        {
+            printf("custody FAIL: force-forfeit did not terminalize gold row\n");
+            pass = false;
+        }
+    }
+
+    {
+        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
+            "SELECT COUNT(*) FROM `mail` WHERE `receiver`='%u'",
+            repairOwner));
+        uint64 const afterForceMail = res ? res->Fetch()[0].GetUInt64() : 0;
+        if (afterForceMail != beforeRepairMail)
+        {
+            printf("custody FAIL: force-forfeit minted mail from orphan ledger row\n");
+            pass = false;
+        }
+    }
+
+    CharacterDatabase.BeginTransaction();
+    CharacterDatabase.PExecute(
+        "DELETE FROM `custody_ledger` WHERE `idem_key` LIKE 'test:repair:%%'");
+    CharacterDatabase.CommitTransactionChecked();
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `mail` WHERE `receiver`=1 AND `subject`='AH custody repair'");
+
+    // The apply guard must consult the shared auction table at mutation time,
+    // not the local AH map or the auction facts captured by the scan.
+    {
+        uint32 const livenessAuctionId = 970080;
+        CharacterDatabase.DirectPExecute(
+            "DELETE FROM `auction` WHERE `id`=%u", livenessAuctionId);
+        CharacterDatabase.DirectPExecute(
+            "DELETE FROM `custody_ledger` WHERE `idem_key`='test:repair:liveness'");
+        CharacterDatabase.DirectPExecute(
+            "INSERT INTO `custody_ledger` "
+            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+            "VALUES ('test:repair:liveness',0,1,0,1,0,80,0,%u," UI64FMTD ",0)",
+            livenessAuctionId, oldTime);
+
+        CustodyReconcileReport report;
+        CustodyService::ReconcileScan(now, CUSTODY_SCAN_RUNTIME, report);
+        CustodyFinding scanned = {};
+        bool found = false;
+        for (size_t i = 0; i < report.findings.size(); ++i)
+        {
+            if (report.findings[i].row.idemKey == "test:repair:liveness")
+            {
+                scanned = report.findings[i];
+                found = true;
+                break;
+            }
+        }
+
+        CharacterDatabase.DirectPExecute(
+            "INSERT INTO `auction` "
+            "(`id`,`houseid`,`itemguid`,`item_template`,`item_count`,"
+            "`item_randompropertyid`,`itemowner`,`buyoutprice`,`time`,`buyguid`,"
+            "`lastbid`,`startbid`,`deposit`) "
+            "VALUES (%u,7,880080,25,1,0,1,0," UI64FMTD ",0,0,10,5)",
+            livenessAuctionId, now + HOUR);
+        bool const blockedAfterInsert = found &&
+            !AhRepairFindingMutationAllowed(scanned);
+        if (!CharacterDatabase.DirectExecute(
+                "RENAME TABLE `auction` TO `auction_test_unavailable`"))
+        {
+            printf("custody FAIL: could not inject auction query failure\n");
+            return 2;
+        }
+        bool const blockedOnQueryFailure = found &&
+            !AhRepairFindingMutationAllowed(scanned);
+        if (!CharacterDatabase.DirectExecute(
+                "RENAME TABLE `auction_test_unavailable` TO `auction`"))
+        {
+            printf("custody FAIL: could not restore auction table\n");
+            return 2;
+        }
+        CharacterDatabase.DirectPExecute(
+            "DELETE FROM `auction` WHERE `id`=%u", livenessAuctionId);
+        bool const allowedAfterDelete = found &&
+            AhRepairFindingMutationAllowed(scanned);
+        if (!found || !blockedAfterInsert || !blockedOnQueryFailure ||
+            !allowedAfterDelete)
+        {
+            printf("custody FAIL: repair liveness guard ignored post-scan DB state\n");
+            pass = false;
+        }
+
+        CharacterDatabase.DirectExecute(
+            "DELETE FROM `custody_ledger` WHERE `idem_key`='test:repair:liveness'");
+    }
+
+    // Generic apply must report but skip pending, manual-only, and bot-sweep
+    // findings. Force-forfeit must reject the reserved bot marker explicitly.
+    {
+        CharacterDatabase.DirectExecute(
+            "DELETE FROM `custody_ledger` WHERE `idem_key` LIKE 'botlist:test:repair:%'");
+        CharacterDatabase.DirectExecute(
+            "DELETE FROM `auction` WHERE `id` IN (970081,970082)");
+        CharacterDatabase.BeginTransaction();
+        CharacterDatabase.PExecute(
+            "INSERT INTO `auction` "
+            "(`id`,`houseid`,`itemguid`,`item_template`,`item_count`,"
+            "`item_randompropertyid`,`itemowner`,`buyoutprice`,`time`,`buyguid`,"
+            "`lastbid`,`startbid`,`deposit`) VALUES "
+            "(970081,7,880081,25,1,0,%u,0," UI64FMTD ",0,0,10,0),"
+            "(970082,7,880082,25,1,0,%u,0," UI64FMTD ",2082,82,10,0)",
+            TEST_BOT_OWNER_GUID, now + HOUR,
+            TEST_BOT_OWNER_GUID, now + HOUR);
+        CharacterDatabase.PExecute(
+            "INSERT INTO `custody_ledger` "
+            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) VALUES "
+            "('botlist:test:repair:manual',1,3,0,%u,0,0,880081,970081," UI64FMTD ",0),"
+            "('botlist:test:repair:pending',1,4,0,%u,0,0,880082,970082," UI64FMTD ",0),"
+            "('botlist:test:repair:sweep',1,4,0,%u,0,0,880083,970083," UI64FMTD ",0)",
+            TEST_BOT_OWNER_GUID, oldTime,
+            TEST_BOT_OWNER_GUID, oldTime,
+            TEST_BOT_OWNER_GUID, oldTime);
+        if (!CharacterDatabase.CommitTransactionChecked())
+        {
+            printf("custody FAIL: repair ownership fixtures failed to commit\n");
+            pass = false;
+        }
+
+        TestCliCapture applyCapture;
+        CliHandler applyCli(0, SEC_ADMINISTRATOR, &applyCapture, &TestCliPrint);
+        if (!applyCli.ParseCommands("ah repair apply") ||
+            CountCliChunks(applyCapture,
+                "mode=apply confirmed=1 pending=1 sweep-owned=1 repaired=0 skipped=3 failed=0") != 1)
+        {
+            printf("custody FAIL: repair ownership summary mismatch\n");
+            pass = false;
+        }
+
+        char const* markerKeys[] = {
+            "botlist:test:repair:manual",
+            "botlist:test:repair:pending",
+            "botlist:test:repair:sweep",
+        };
+        for (size_t i = 0; i < sizeof(markerKeys) / sizeof(markerKeys[0]); ++i)
+        {
+            CustodyRow markerRow;
+            if (!CustodyLedger::Get(markerKeys[i], markerRow) ||
+                markerRow.state != CST_RESERVED)
+            {
+                printf("custody FAIL: generic apply mutated reserved bot marker %s\n",
+                    markerKeys[i]);
+                pass = false;
+            }
+        }
+
+        TestCliCapture forceCapture;
+        CliHandler forceCli(0, SEC_ADMINISTRATOR, &forceCapture, &TestCliPrint);
+        forceCli.ParseCommands(
+            "ah repair force-forfeit botlist:test:repair:sweep");
+        if (CountCliChunks(forceCapture, "reserved bot marker") != 1)
+        {
+            printf("custody FAIL: force-forfeit did not reject bot marker\n");
+            pass = false;
+        }
+
+        CharacterDatabase.DirectExecute(
+            "DELETE FROM `custody_ledger` WHERE `idem_key` LIKE 'botlist:test:repair:%'");
+        CharacterDatabase.DirectExecute(
+            "DELETE FROM `auction` WHERE `id` IN (970081,970082)");
+    }
+
+    // Failed journal replay is counted separately and leaves custody reserved.
+    {
+        uint32 const failedAuctionId = 970084;
+        CharacterDatabase.DirectPExecute(
+            "DELETE FROM `custody_ledger` WHERE `idem_key`='test:repair:failed'");
+        CharacterDatabase.DirectPExecute(
+            "DELETE FROM `ah_worker_journal` WHERE `auction_id`=%u",
+            failedAuctionId);
+        CharacterDatabase.BeginTransaction();
+        CharacterDatabase.PExecute(
+            "INSERT INTO `custody_ledger` "
+            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+            "VALUES ('test:repair:failed',0,1,0,1,0,84,0,%u," UI64FMTD ",0)",
+            failedAuctionId, oldTime);
+        CharacterDatabase.PExecute(
+            "INSERT INTO `ah_worker_journal` "
+            "(`uuid`,`auction_id`,`kind`,`state`,`facts`,`created_time`,`resolved_time`) "
+            "VALUES (970084,%u,%u,1,'00'," UI64FMTD "," UI64FMTD ")",
+            failedAuctionId, uint32(IPC_PLAYER_CANCEL & 0xFFu),
+            oldTime, oldTime);
+        if (!CharacterDatabase.CommitTransactionChecked())
+        {
+            printf("custody FAIL: failed-replay fixtures did not commit\n");
+            pass = false;
+        }
+
+        TestCliCapture failedCapture;
+        CliHandler failedCli(0, SEC_ADMINISTRATOR,
+                             &failedCapture, &TestCliPrint);
+        failedCli.ParseCommands("ah repair apply");
+        CustodyRow failedRow;
+        if (CountCliChunks(failedCapture,
+                "mode=apply confirmed=1 pending=0 sweep-owned=0 repaired=0 skipped=0 failed=1") != 1 ||
+            !CustodyLedger::Get("test:repair:failed", failedRow) ||
+            failedRow.state != CST_RESERVED)
+        {
+            printf("custody FAIL: failed repair summary/state mismatch\n");
+            pass = false;
+        }
+
+        CharacterDatabase.DirectPExecute(
+            "DELETE FROM `custody_ledger` WHERE `idem_key`='test:repair:failed'");
+        CharacterDatabase.DirectPExecute(
+            "DELETE FROM `ah_worker_journal` WHERE `auction_id`=%u",
+            failedAuctionId);
+    }
+
+    // One budget spans scan and action details. Exact totals remain uncapped.
+    {
+        CharacterDatabase.DirectExecute(
+            "DELETE FROM `custody_ledger` WHERE `idem_key` LIKE 'test:repair:budget:%'");
+        CharacterDatabase.BeginTransaction();
+        for (uint32 i = 0; i < 101; ++i)
+        {
+            CharacterDatabase.PExecute(
+                "INSERT INTO `custody_ledger` "
+                "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+                "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+                "VALUES ('test:repair:budget:%u',0,1,0,1,0,%u,0,%u," UI64FMTD ",0)",
+                i, 100 + i, 974000 + i, oldTime);
+        }
+        if (!CharacterDatabase.CommitTransactionChecked())
+        {
+            printf("custody FAIL: repair budget fixtures failed to commit\n");
+            pass = false;
+        }
+
+        TestCliCapture dryCapture;
+        CliHandler dryCli(0, SEC_ADMINISTRATOR, &dryCapture, &TestCliPrint);
+        if (!dryCli.ParseCommands("ah repair --dry-run") ||
+            CountCliChunks(dryCapture, "ah repair detail:") != 100 ||
+            CountCliChunks(dryCapture, "detail(s) suppressed") != 1 ||
+            CountCliChunks(dryCapture,
+                "mode=dry-run confirmed=101 pending=0 sweep-owned=0 repaired=0 skipped=0 failed=0") != 1)
+        {
+            printf("custody FAIL: dry-run detail cap or totals mismatch\n");
+            pass = false;
+        }
+
+        TestCliCapture boundedApplyCapture;
+        CliHandler boundedApplyCli(0, SEC_ADMINISTRATOR,
+                                   &boundedApplyCapture, &TestCliPrint);
+        if (!boundedApplyCli.ParseCommands("ah repair apply") ||
+            CountCliChunks(boundedApplyCapture, "ah repair detail:") +
+                CountCliChunks(boundedApplyCapture, "ah repair action:") != 100 ||
+            CountCliChunks(boundedApplyCapture, "detail(s) suppressed") != 1 ||
+            CountCliChunks(boundedApplyCapture,
+                "mode=apply confirmed=101 pending=0 sweep-owned=0 repaired=101 skipped=0 failed=0") != 1)
+        {
+            printf("custody FAIL: apply shared detail cap or totals mismatch\n");
+            pass = false;
+        }
+
+        std::unique_ptr<QueryResult> reserved(CharacterDatabase.Query(
+            "SELECT COUNT(*) FROM `custody_ledger` "
+            "WHERE `idem_key` LIKE 'test:repair:budget:%' AND `state`=0"));
+        if (!reserved || reserved->Fetch()[0].GetUInt32() != 0)
+        {
+            printf("custody FAIL: bounded apply did not repair all 101 rows\n");
+            pass = false;
+        }
+
+        CharacterDatabase.DirectExecute(
+            "DELETE FROM `custody_ledger` WHERE `idem_key` LIKE 'test:repair:budget:%'");
+    }
+
+    // ================================================================ primitive
+    // Primitive round-trip: offline owner (no ModifyMoney),
+    // ReserveGold -> RollbackGoldLedgerOnly -> assert no mail.
+
+    // Clean slate for the primitive sub-test.
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `custody_ledger` WHERE `idem_key` LIKE 'test:rg%%'");
+
+    // ------------------------------------------------------------------ prim 1
+    // ReserveGold with offline owner: inserts RESERVED row, no money debit.
+    {
+        CharacterDatabase.BeginTransaction();
+        CustodyDeferred def;
+        CustodyService::ReserveGold(def, 1, NULL, 50, "test:rg:1", 999,
+                                    uint8(ROLE_BID));
+        bool ok = CharacterDatabase.CommitTransactionChecked();
+        if (!ok)
+        {
+            printf("custody FAIL: prim 1 ReserveGold CommitTransactionChecked returned false\n");
+            pass = false;
+        }
+        def.run();
+    }
+
+    // ------------------------------------------------------------------ prim 2
+    // Row must be visible: state CST_RESERVED, amount 50.
+    {
+        CustodyRow row;
+        bool found = CustodyLedger::Get("test:rg:1", row);
+        if (!found)
+        {
+            printf("custody FAIL: prim 2 Get returned false (row not found)\n");
+            pass = false;
+        }
+        else
+        {
+            if (row.state != CST_RESERVED)
+            {
+                printf("custody FAIL: prim 2 state expected %u got %u\n",
+                    uint32(CST_RESERVED), uint32(row.state));
+                pass = false;
+            }
+            if (row.amount != 50)
+            {
+                printf("custody FAIL: prim 2 amount expected 50 got %u\n",
+                    row.amount);
+                pass = false;
+            }
+        }
+    }
+
+    // ------------------------------------------------------------------ prim 3
+    // RollbackGoldLedgerOnly: ledger-only, no mail; state must flip to BACK.
+    {
+        CharacterDatabase.BeginTransaction();
+        CustodyService::RollbackGoldLedgerOnly("test:rg:1");
+        bool ok = CharacterDatabase.CommitTransactionChecked();
+        if (!ok)
+        {
+            printf("custody FAIL: prim 3 RollbackGoldLedgerOnly CommitTransactionChecked returned false\n");
+            pass = false;
+        }
+
+        CustodyRow row;
+        bool found = CustodyLedger::Get("test:rg:1", row);
+        if (!found)
+        {
+            printf("custody FAIL: prim 3 Get returned false after RollbackGoldLedgerOnly\n");
+            pass = false;
+        }
+        else if (row.state != CST_TERMINAL_BACK)
+        {
+            printf("custody FAIL: prim 3 state expected %u got %u\n",
+                uint32(CST_TERMINAL_BACK), uint32(row.state));
+            pass = false;
+        }
+    }
+
+    // ------------------------------------------------------------------ prim 4
+    // The ledger-only rollback must NOT have sent any mail for receiver 1.
+    {
+        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
+            "SELECT COUNT(*) FROM `mail` WHERE `receiver`=1"
+            " AND `subject` LIKE 'test:rg%%'"));
+        uint64 cnt = res ? res->Fetch()[0].GetUInt64() : 0u;
+        if (cnt != 0)
+        {
+            printf("custody FAIL: prim 4 ledger-only rollback sent unexpected mail"
+                   " (count=%u)\n", uint32(cnt));
+            pass = false;
+        }
+    }
+
+    // ------------------------------------------------------------------ final cleanup
+    // Remove all test:% rows from both runs.
+    CharacterDatabase.BeginTransaction();
+    CharacterDatabase.PExecute(
+        "DELETE FROM `custody_ledger` WHERE `idem_key` LIKE 'test:%%'");
+    CharacterDatabase.CommitTransactionChecked();
+
+    if (pass)
+    {
+        printf("custody OK\n");
+        return 0;
+    }
+
+    return 2;
+}
+
+namespace
+{
+    struct RefCtx
+    {
+        const uint16* skills;
+        const uint32* skillIds;
+        size_t nSkills;
+        const uint32* spells;
+        size_t nSpells;
+        const uint32* repFactions;
+        const uint8* repRanks;
+        size_t nReps;
+    };
+
+    uint16 RefSkill(void* c, uint32 id)
+    {
+        RefCtx* x = (RefCtx*)c;
+        for (size_t i = 0; i < x->nSkills; ++i)
+        {
+            if (x->skillIds[i] == id)
+            {
+                return x->skills[i];
+            }
+        }
+        return 0;
+    }
+    bool RefSpell(void* c, uint32 id)
+    {
+        RefCtx* x = (RefCtx*)c;
+        for (size_t i = 0; i < x->nSpells; ++i)
+        {
+            if (x->spells[i] == id)
+            {
+                return true;
+            }
+        }
+        return false;
+    }
+    uint8 RefRep(void* c, uint32 f)
+    {
+        RefCtx* x = (RefCtx*)c;
+        for (size_t i = 0; i < x->nReps; ++i)
+        {
+            if (x->repFactions[i] == f)
+            {
+                return x->repRanks[i];
+            }
+        }
+        return 0;
+    }
+}
+
+/// Self-test for AhUsabilityRef::Evaluate: drives the production reference
+/// evaluator over a battery of synthetic profiles. Returns 0 on pass.
+static int RunAhUsabilityRefTest()
+{
+    uint32 skillIds[1] = { 43u };
+    uint16 skills[1]   = { 200u };
+    uint32 spells[1]   = { 123u };
+    uint32 repF[1]     = { 609u };
+    uint8  repR[1]     = { 5u };
+    RefCtx ctx;
+    ctx.skills      = skills;
+    ctx.skillIds    = skillIds;
+    ctx.nSkills     = 1;
+    ctx.spells      = spells;
+    ctx.nSpells     = 1;
+    ctx.repFactions = repF;
+    ctx.repRanks    = repR;
+    ctx.nReps       = 1;
+
+    // warrior (class 1) / human (race 1); level 40; honor rank 2
+    const uint32 cm    = 1u << (1u - 1u);
+    const uint32 rm    = 1u << (1u - 1u);
+    const uint32 level = 40u;
+    const uint32 honor = 2u;
+    const uint32 MM    = 40u;
+    const uint32 EM    = 60u;
+
+    AhRefItem it;
+    it.itemClass            = 2u;
+    it.allowableClass       = 0xFFFFFFFFu;
+    it.allowableRace        = 0xFFFFFFFFu;
+    it.requiredLevel        = 30u;
+    it.itemId               = 12345u;
+    it.requiredSkill        = 43u;
+    it.requiredSkillRank    = 150u;
+    it.requiredSpell        = 0u;
+    it.requiredHonorRank    = 0u;
+    it.requiredRepFaction   = 0u;
+    it.requiredRepRank      = 0u;
+    it.itemProficiencySkill = 43u;
+
+    // baseline: everything satisfied
+    if (AhUsabilityRef::Evaluate(cm, rm, level, honor, true, MM, EM, it,
+                                 RefSkill, RefSpell, RefRep, &ctx) != AHUSE_OK)
+    {
+        printf("ahusabilityref FAIL: baseline\n");
+        return 1;
+    }
+
+    // class gate: wrong class mask
+    AhRefItem b = it;
+    b.allowableClass = 0x80u;
+    if (AhUsabilityRef::Evaluate(cm, rm, level, honor, true, MM, EM, b,
+                                 RefSkill, RefSpell, RefRep, &ctx) == AHUSE_OK)
+    {
+        printf("ahusabilityref FAIL: class gate\n");
+        return 1;
+    }
+
+    // honor gate fires when direct_action=true and rank is insufficient
+    b = it;
+    b.requiredHonorRank = 5u;
+    if (AhUsabilityRef::Evaluate(cm, rm, level, honor, true, MM, EM, b,
+                                 RefSkill, RefSpell, RefRep, &ctx) == AHUSE_OK)
+    {
+        printf("ahusabilityref FAIL: honor gate (direct_action)\n");
+        return 1;
+    }
+    // D2: honor gate must NOT fire when direct_action=false
+    if (AhUsabilityRef::Evaluate(cm, rm, level, honor, false, MM, EM, b,
+                                 RefSkill, RefSpell, RefRep, &ctx) != AHUSE_OK)
+    {
+        printf("ahusabilityref FAIL: honor must be skipped when !direct_action\n");
+        return 1;
+    }
+
+    // reputation gate: player rep rank 5, item requires 7
+    b = it;
+    b.requiredRepFaction = 609u;
+    b.requiredRepRank    = 7u;
+    if (AhUsabilityRef::Evaluate(cm, rm, level, honor, true, MM, EM, b,
+                                 RefSkill, RefSpell, RefRep, &ctx) == AHUSE_OK)
+    {
+        printf("ahusabilityref FAIL: reputation gate\n");
+        return 1;
+    }
+
+    // epic mount override: item 12302 bumps requiredLevel to EM(60); player is 40
+    b = it;
+    b.itemId         = 12302u;
+    b.requiredLevel  = 30u;
+    if (AhUsabilityRef::Evaluate(cm, rm, level, honor, true, MM, EM, b,
+                                 RefSkill, RefSpell, RefRep, &ctx) == AHUSE_OK)
+    {
+        printf("ahusabilityref FAIL: epic-mount override\n");
+        return 1;
+    }
+
+    printf("ahusabilityref OK\n");
+    return 0;
+}
+
+/// Smoke test for the in-process browse helper (dispatch shape + order contract).
+/// Does NOT require a live Player or world data: it exercises only the
+/// client-outbid-prepend order invariant via the AhAppendClientOutbidsForTest
+/// seam, proving that BuildListForKind will prepend outbid ids in CLIENT ORDER
+/// before calling BuildListBidderItems. Returns 0 on pass, non-zero on fail.
+static int RunAhBrowseHelperTest()
+{
+    // The bidder client-outbid-prepend is extracted as a free helper so it can
+    // be tested without a Player. It appends each client outbid auction id in
+    // CLIENT ORDER ahead of the sweep (matches HandleAuctionListBidderItems).
+    // Here we assert the ORDER-PRESERVING contract over a stub appender.
+    std::vector<uint32> clientIds;
+    clientIds.push_back(7u);
+    clientIds.push_back(3u);
+    clientIds.push_back(9u);
+    std::vector<uint32> appended;
+    AhAppendClientOutbidsForTest(clientIds, appended);
+    if (appended.size() != 3u || appended[0] != 7u || appended[1] != 3u || appended[2] != 9u)
+    {
+        printf("ahbrowsehelper FAIL: client outbid order not preserved\n");
+        return 1;
+    }
+    printf("ahbrowsehelper OK\n");
+    return 0;
+}
+
+/// Self-test for the SP-1 browse pending-map + SMSG assembly: exercises
+/// Register/Take/Sweep, per-(char,kind) sequencing, and AhAssembleBrowseListBody.
+/// No DB / world data needed. Returns 0 on pass, non-zero on fail.
+static int RunAhBrowsePendingTest()
+{
+    BrowsePendingMap pend;
+    PendingBrowse a; a.accountId=1001u; a.playerGuidLow=5001u; a.kind=uint8(BROWSE_LIST);
+    a.seq = pend.NextSeqFor(5001u, uint8(BROWSE_LIST));
+    uint64 id1 = pend.Register(a, 100u);
+    PendingBrowse b; b.accountId=1002u; b.playerGuidLow=5002u; b.kind=uint8(BROWSE_OWNER);
+    b.seq = pend.NextSeqFor(5002u, uint8(BROWSE_OWNER));
+    uint64 id2 = pend.Register(b, 100u);
+    if (id1 == id2 || pend.Size() != 2u)
+    {
+        printf("ahbrowsepending FAIL: register\n");
+        return 1;
+    }
+
+    PendingBrowse got;
+    if (!pend.Take(id1, got) || got.accountId!=1001u || got.playerGuidLow!=5001u ||
+        got.kind != uint8(BROWSE_LIST))
+    {
+        printf("ahbrowsepending FAIL: Take(id1)\n");
+        return 1;
+    }
+    if (pend.Take(id1, got))
+    {
+        printf("ahbrowsepending FAIL: Take twice\n");
+        return 1;
+    }
+
+    // Per-(char,kind) sequencing: a newer search bumps the seq; the older seq
+    // is no longer current (a stale timeout for it must be ignored).
+    uint32 newSeq = pend.NextSeqFor(5002u, uint8(BROWSE_OWNER));   // newer than b.seq
+    if (pend.IsCurrent(5002u, uint8(BROWSE_OWNER), b.seq))
+    {
+        printf("ahbrowsepending FAIL: stale seq still current\n");
+        return 1;
+    }
+    if (!pend.IsCurrent(5002u, uint8(BROWSE_OWNER), newSeq))
+    {
+        printf("ahbrowsepending FAIL: newest seq not current\n");
+        return 1;
+    }
+
+    // TTL sweep collects the timed-out entry (id2) for in-process fallback.
+    std::vector<PendingBrowse> timedOut;
+    pend.Sweep(100u + 10u + 1u, 10u, timedOut);
+    if (pend.Size() != 0u || timedOut.size() != 1u || timedOut[0].accountId != 1002u)
+    {
+        printf("ahbrowsepending FAIL: sweep\n");
+        return 1;
+    }
+
+    // Stale-seq guard on the sweep path: after a newer search is issued, the
+    // swept entry's seq (b.seq) is NOT current -- the fallback must be ignored.
+    // Bump the seq (simulates a newer search that arrived before the sweep ran).
+    uint32 postSweepSeq = pend.NextSeqFor(5002u, uint8(BROWSE_OWNER));
+    if (pend.IsCurrent(5002u, uint8(BROWSE_OWNER), b.seq))
+    {
+        printf("ahbrowsepending FAIL: swept stale seq still current\n");
+        return 1;
+    }
+    if (!pend.IsCurrent(5002u, uint8(BROWSE_OWNER), postSweepSeq))
+    {
+        printf("ahbrowsepending FAIL: postSweepSeq not current\n");
+        return 1;
+    }
+
+    // SMSG assembly preserves the worker's complete bidder order, including a
+    // duplicate auction id, and writes the worker-provided totalcount.
+    {
+        std::vector<BrowseEntry> entries;
+        const uint32 orderedIds[] = { 9u, 3u, 9u, 7u };
+        for (size_t i = 0; i < 4u; ++i)
+        {
+            BrowseEntry e;
+            e.id=orderedIds[i]; e.itemEntry=19019u; e.enchantId=0u;
+            e.randomPropId=0u; e.suffixFactor=0u; e.count=1u;
+            e.charges=0; e.ownerGuidLow=4u; e.startbid=100u;
+            e.outbid=0u; e.buyout=5000u; e.timeLeftMs=720000u;
+            e.bidderGuidLow=0u; e.curBid=100u;
+            entries.push_back(e);
+        }
+        ByteBuffer body;
+        AhAssembleBrowseListBody(entries, 4u, body);
+        uint32 c=0; body >> c;
+        if (c != 4u)
+        {
+            printf("ahbrowsepending FAIL: assembled count %u\n",
+                   unsigned(c));
+            return 1;
+        }
+        uint32 dummy32 = 0; uint64 dummy64 = 0;
+        for (size_t i = 0; i < 4u; ++i)
+        {
+            uint32 id = 0; body >> id;
+            if (id != orderedIds[i])
+            {
+                printf("ahbrowsepending FAIL: ordered id[%u]=%u\n",
+                       unsigned(i), unsigned(id));
+                return 1;
+            }
+            body >> dummy32 >> dummy32 >> dummy32;
+            body >> dummy32 >> dummy32 >> dummy32;
+            body >> dummy64;
+            body >> dummy32 >> dummy32 >> dummy32 >> dummy32;
+            body >> dummy64;
+            body >> dummy32;
+        }
+        uint32 totalcount = 0; body >> totalcount;
+        if (totalcount != 4u)
+        {
+            printf("ahbrowsepending FAIL: totalcount %u\n",
+                   unsigned(totalcount));
+            return 1;
+        }
+        (void)dummy32; (void)dummy64;
+    }
+
+    printf("ahbrowsepending OK\n");
+    return 0;
+}
+
+/// Self-test for the SP-2 MutationPendingMap (spec 5.5): apply-all consume-once,
+/// per-player + total caps checked BEFORE any reserve, cancel-phase rearm, and
+/// the TTL sweep that tombstones in-doubt entries (emitting each newly-in-doubt
+/// uuid exactly once for the AUCTION_ERR_DATABASE result). Pure in-memory; no
+/// DB rows, no worker. Returns 0 on pass, non-zero on fail.
+static int RunAhMutPendingTest()
+{
+    MutationPendingMap pend;
+
+    // Mint sanity: two uuids differ and carry a nonzero (boot-second) high word,
+    // keeping them disjoint from worker-minted (runId << 32) | seq uuids.
+    uint64 u1 = AhMintMutationUuid();
+    uint64 u2 = AhMintMutationUuid();
+    if (u1 == u2 || (u1 >> 32) == 0u)
+    {
+        printf("ahmutpending FAIL: uuid mint\n");
+        return 1;
+    }
+
+    // (a) cap-before-reserve: MAX_PER_PLAYER entries fill player 100's slot;
+    // the next CanRegister is refused BEFORE any reserve would happen, while
+    // another player is unaffected.
+    std::vector<uint64> uuids;
+    for (size_t i = 0; i < MutationPendingMap::MAX_PER_PLAYER; ++i)
+    {
+        if (!pend.CanRegister(100u))
+        {
+            printf("ahmutpending FAIL: CanRegister refused below cap\n");
+            return 1;
+        }
+
+        PendingMutation pm;
+        pm.uuid           = AhMintMutationUuid();
+        pm.playerGuidLow  = 100u;
+        pm.op             = uint16(IPC_PLAYER_BID);
+        pm.auctionId      = uint32(9000u + i);
+        pm.state          = uint8(PMUT_AWAIT_RESULT);
+        pm.sentSec        = 1000u;
+        pm.reservedAmount = 55u;
+        pm.reserveKey     = "bid:9000:1";
+        pm.itemKey.clear();
+        pm.depKey.clear();
+        pend.Register(pm);
+        uuids.push_back(pm.uuid);
+    }
+    if (pend.CanRegister(100u))
+    {
+        printf("ahmutpending FAIL: per-player cap not enforced\n");
+        return 1;
+    }
+    if (!pend.CanRegister(101u))
+    {
+        printf("ahmutpending FAIL: cap leaked to another player\n");
+        return 1;
+    }
+
+    // (b) consume-once: Take returns the entry once, then never again; the
+    // per-player slot is released.
+    PendingMutation got;
+    if (!pend.Take(uuids[0], got) || got.playerGuidLow != 100u ||
+        got.op != uint16(IPC_PLAYER_BID) || got.reservedAmount != 55u ||
+        got.reserveKey != "bid:9000:1")
+    {
+        printf("ahmutpending FAIL: Take(first)\n");
+        return 1;
+    }
+    if (pend.Take(uuids[0], got))
+    {
+        printf("ahmutpending FAIL: Take twice\n");
+        return 1;
+    }
+    if (!pend.CanRegister(100u))
+    {
+        printf("ahmutpending FAIL: slot not released after Take\n");
+        return 1;
+    }
+
+    // (c) rearm (cancel phase 2, spec 4.2): AWAIT_RESULT (== AWAIT_PREPARE for
+    // cancels) -> AWAIT_CONFIRM in the SAME cap slot, with a fresh TTL anchor.
+    pend.RearmConfirm(uuids[1], 2000u);
+    if (!pend.Peek(uuids[1], got) || got.state != uint8(PMUT_AWAIT_CONFIRM) ||
+        got.sentSec != 2000u)
+    {
+        printf("ahmutpending FAIL: RearmConfirm\n");
+        return 1;
+    }
+
+    // (d) explicit tombstone: the entry STAYS (in-doubt, reservation
+    // non-terminal); Tombstone on a missing uuid reports false.
+    if (!pend.Tombstone(uuids[2]))
+    {
+        printf("ahmutpending FAIL: Tombstone(existing)\n");
+        return 1;
+    }
+    if (pend.Tombstone(0xDEADBEEFull))
+    {
+        printf("ahmutpending FAIL: Tombstone(missing) returned true\n");
+        return 1;
+    }
+
+    // (e) sweep-to-tombstone: at now=2005 with ttl=10, entries stamped 1000 are
+    // overdue EXCEPT the rearmed one (sentSec 2000). Already-tombstoned entries
+    // are NOT re-emitted (their AUCTION_ERR_DATABASE was already sent).
+    // Registered survivors: uuids[1..7]; uuids[1] fresh, uuids[2] pre-tombstoned
+    // -> exactly uuids[3..7] (5) are newly in doubt.
+    std::vector<uint64> inDoubt;
+    pend.SweepToTombstones(2005u, 10u, inDoubt);
+    if (inDoubt.size() != 5u)
+    {
+        printf("ahmutpending FAIL: sweep emitted %u (want 5)\n", unsigned(inDoubt.size()));
+        return 1;
+    }
+    for (size_t i = 0; i < inDoubt.size(); ++i)
+    {
+        if (inDoubt[i] == uuids[1] || inDoubt[i] == uuids[2])
+        {
+            printf("ahmutpending FAIL: sweep emitted a fresh/tombstoned uuid\n");
+            return 1;
+        }
+    }
+    // A second sweep emits nothing new (everything overdue is tombstoned).
+    inDoubt.clear();
+    pend.SweepToTombstones(2005u, 10u, inDoubt);
+    if (!inDoubt.empty())
+    {
+        printf("ahmutpending FAIL: second sweep re-emitted\n");
+        return 1;
+    }
+    // Late reply against a tombstone still applies (apply-all): Take consumes it.
+    if (!pend.Take(uuids[2], got) || got.state != uint8(PMUT_TOMBSTONE))
+    {
+        printf("ahmutpending FAIL: Take(tombstone)\n");
+        return 1;
+    }
+
+    // (f) MAX_TOTAL: fill a fresh map to the global cap across many players
+    // (4 per player, under the per-player cap); a fresh player is then refused.
+    MutationPendingMap full;
+    for (size_t i = 0; i < MutationPendingMap::MAX_TOTAL; ++i)
+    {
+        PendingMutation pm;
+        pm.uuid           = 0x100000000ull + i;
+        pm.playerGuidLow  = uint32(1000u + (i / 4u));
+        pm.op             = uint16(IPC_PLAYER_SELL);
+        pm.auctionId      = uint32(i + 1u);
+        pm.state          = uint8(PMUT_AWAIT_RESULT);
+        pm.sentSec        = 1u;
+        pm.reservedAmount = 0u;
+        pm.reserveKey.clear();
+        pm.itemKey.clear();
+        pm.depKey.clear();
+        full.Register(pm);
+    }
+    if (full.CanRegister(999999u))
+    {
+        printf("ahmutpending FAIL: MAX_TOTAL not enforced\n");
+        return 1;
+    }
+
+    printf("ahmutpending OK\n");
+    return 0;
+}
+
+/// DB-level self-test for the SP-2 forward-path reserve shapes (Task 10), no
+/// live worker and no Player: owner guid 1 is offline so ReserveGold takes the
+/// ledger-only path. Covers (a) the sell reserve pair item:<id> + dep:<id> in
+/// ONE checked txn plus its pending registration, and (b) the bid classifier
+/// AhClassifyBidForward against real ledger rows: no row -> IPC_PLAYER_BUYOUT
+/// full reserve; own live row -> IPC_PLAYER_BUYOUT delta; price <= own live bid
+/// -> 0 (inline ERR_HIGHER_BID); another owner's row -> BUYOUT full;
+/// ambiguous (two live rows) -> BUYOUT full. Returns 0 on pass.
+static int RunAhForwardReserveTest()
+{
+    bool pass = true;
+
+    CharacterDatabase.AllowAsyncTransactions();
+
+    uint32 const sellId = 990001u;   // synthetic ids far above live data
+    uint32 const bidId  = 990002u;
+
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `custody_ledger` WHERE `auction_id` IN (990001, 990002)");
+
+    // ---- (a) sell shape: escrow + deposit reserve, one checked txn ----
+    MutationPendingMap pend;
+    if (!pend.CanRegister(1u))
+    {
+        printf("ahforwardreserve FAIL: CanRegister(empty)\n");
+        pass = false;
+    }
+
+    std::string const sellIdStr = std::to_string(sellId);
+    CharacterDatabase.BeginTransaction();
+    CustodyService::EscrowItem(1u, 424242u, "item:" + sellIdStr, sellId);
+    CustodyService::ReserveGoldAlreadyDebited(1u, 77u, "dep:" + sellIdStr, sellId, ROLE_DEPOSIT);
+    if (!CharacterDatabase.CommitTransactionChecked())
+    {
+        printf("ahforwardreserve FAIL: sell reserve txn\n");
+        pass = false;
+    }
+
+    CustodyRow row;
+    if (!CustodyLedger::Get("item:" + sellIdStr, row) ||
+        row.kind != CUSTODY_ITEM || row.state != CST_RESERVED ||
+        row.itemGuid != 424242u || row.auctionId != sellId)
+    {
+        printf("ahforwardreserve FAIL: item row shape\n");
+        pass = false;
+    }
+    if (!CustodyLedger::Get("dep:" + sellIdStr, row) ||
+        row.kind != CUSTODY_GOLD || row.role != ROLE_DEPOSIT ||
+        row.state != CST_RESERVED || row.amount != 77u)
+    {
+        printf("ahforwardreserve FAIL: dep row shape\n");
+        pass = false;
+    }
+
+    uint64 const sellUuid = AhMintMutationUuid();
+    PendingMutation pm;
+    pm.uuid           = sellUuid;
+    pm.playerGuidLow  = 1u;
+    pm.op             = uint16(IPC_PLAYER_SELL);
+    pm.auctionId      = sellId;
+    pm.state          = uint8(PMUT_AWAIT_RESULT);
+    pm.sentSec        = uint32(time(NULL));
+    pm.reservedAmount = 0u;
+    pm.reserveKey.clear();
+    pm.itemKey        = "item:" + sellIdStr;
+    pm.depKey         = "dep:" + sellIdStr;
+    pend.Register(pm);
+
+    PendingMutation got;
+    if (!pend.Take(sellUuid, got) || got.itemKey != "item:" + sellIdStr ||
+        got.depKey != "dep:" + sellIdStr || got.op != uint16(IPC_PLAYER_SELL))
+    {
+        printf("ahforwardreserve FAIL: sell pending registration\n");
+        pass = false;
+    }
+
+    // ---- (a2) cancel shape: no legacy AuctionsMap/AuctionEntry state needed ----
+    MutationPendingMap cancelPend;
+    uint64 const cancelUuid = UINT64_C(0xCA00000000000043);
+    IpcMessage cancelFrame;
+    if (!AhBuildCancelPrepareForward(cancelPend, 1u, sellId, cancelUuid, 1234u,
+                                     cancelFrame))
+    {
+        printf("ahforwardreserve FAIL: cancel forward helper refused empty map\n");
+        pass = false;
+    }
+    if (cancelFrame.op != IPC_PLAYER_CANCEL)
+    {
+        printf("ahforwardreserve FAIL: cancel forward opcode\n");
+        pass = false;
+    }
+    PlayerCancelPrepare cancelIntent;
+    if (!cancelIntent.Decode(cancelFrame.body) ||
+        cancelIntent.uuid != cancelUuid || cancelIntent.auctionId != sellId ||
+        cancelIntent.sellerGuid != 1u)
+    {
+        printf("ahforwardreserve FAIL: cancel forward body\n");
+        pass = false;
+    }
+    PendingMutation cancelPm;
+    if (!cancelPend.Take(cancelUuid, cancelPm) ||
+        cancelPm.playerGuidLow != 1u ||
+        cancelPm.op != uint16(IPC_PLAYER_CANCEL) ||
+        cancelPm.auctionId != sellId ||
+        cancelPm.state != uint8(PMUT_AWAIT_RESULT) ||
+        cancelPm.sentSec != 1234u ||
+        cancelPm.reservedAmount != 0u ||
+        !cancelPm.reserveKey.empty() ||
+        !cancelPm.itemKey.empty() ||
+        !cancelPm.depKey.empty())
+    {
+        printf("ahforwardreserve FAIL: cancel pending shape\n");
+        pass = false;
+    }
+
+    // ---- (b) bid classifier: no live row -> BUYOUT, full reserve ----
+    uint32 reserveAmount = 0u;
+    if (AhClassifyBidForward(bidId, 1u, 500u, reserveAmount) != uint16(IPC_PLAYER_BUYOUT) ||
+        reserveAmount != 500u)
+    {
+        printf("ahforwardreserve FAIL: classify(no row)\n");
+        pass = false;
+    }
+
+    // Seed guid 1's live bid of 500 with the handler's key scheme, one txn.
+    std::string const bidKey = "bid:" + std::to_string(bidId) + ":" +
+                               std::to_string(CustodyLedger::NextBidSeq(bidId));
+    {
+        CustodyDeferred def;
+        CharacterDatabase.BeginTransaction();
+        CustodyService::ReserveGold(def, 1u, NULL, 500u, bidKey, bidId, ROLE_BID);
+        if (!CharacterDatabase.CommitTransactionChecked())
+        {
+            printf("ahforwardreserve FAIL: bid reserve txn\n");
+            pass = false;
+        }
+    }
+    if (!CustodyLedger::GetSingleLiveBidRow(bidId, row) ||
+        row.idemKey != bidKey || row.ownerGuid != 1u || row.amount != 500u)
+    {
+        printf("ahforwardreserve FAIL: single live bid row\n");
+        pass = false;
+    }
+
+    // Holder raise/top-up 500 -> 600: route on IPC_PLAYER_BUYOUT with the
+    // delta reserve. The worker treats a below-buyout 0x42 as a normal bid,
+    // while an at/over-buyout 0x42 becomes the buyout win; both preserve the
+    // same ledger delta semantics and avoid at-buyout 0x41 protocol faults.
+    if (AhClassifyBidForward(bidId, 1u, 600u, reserveAmount) != uint16(IPC_PLAYER_BUYOUT) ||
+        reserveAmount != 100u)
+    {
+        printf("ahforwardreserve FAIL: classify(raise delta)\n");
+        pass = false;
+    }
+    // Holder "raise" to own bid: 0 -> inline legacy ERR_HIGHER_BID.
+    if (AhClassifyBidForward(bidId, 1u, 500u, reserveAmount) != 0u)
+    {
+        printf("ahforwardreserve FAIL: classify(price <= own bid)\n");
+        pass = false;
+    }
+    // Another player: BUYOUT, full reserve (worker adjudicates, spec I6).
+    if (AhClassifyBidForward(bidId, 2u, 600u, reserveAmount) != uint16(IPC_PLAYER_BUYOUT) ||
+        reserveAmount != 600u)
+    {
+        printf("ahforwardreserve FAIL: classify(other bidder)\n");
+        pass = false;
+    }
+
+    // A raise-in-flight adds a SECOND live ROLE_BID row (the delta reserve);
+    // exactly-one is then violated and the classifier falls back to BUYOUT
+    // full reserve -- a value-safe over-reserve (transient, spec 12).
+    std::string const deltaKey = "bid:" + std::to_string(bidId) + ":" +
+                                 std::to_string(CustodyLedger::NextBidSeq(bidId));
+    {
+        CustodyDeferred def;
+        CharacterDatabase.BeginTransaction();
+        CustodyService::ReserveGold(def, 1u, NULL, 100u, deltaKey, bidId, ROLE_BID);
+        if (!CharacterDatabase.CommitTransactionChecked())
+        {
+            printf("ahforwardreserve FAIL: delta reserve txn\n");
+            pass = false;
+        }
+    }
+    if (CustodyLedger::GetSingleLiveBidRow(bidId, row))
+    {
+        printf("ahforwardreserve FAIL: two live rows not rejected\n");
+        pass = false;
+    }
+    if (AhClassifyBidForward(bidId, 1u, 700u, reserveAmount) != uint16(IPC_PLAYER_BUYOUT) ||
+        reserveAmount != 700u)
+    {
+        printf("ahforwardreserve FAIL: classify(ambiguous rows)\n");
+        pass = false;
+    }
+
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `custody_ledger` WHERE `auction_id` IN (990001, 990002)");
+
+    if (pass)
+    {
+        printf("ahforwardreserve OK\n");
+        return 0;
+    }
+
+    return 2;
+}
+
+/// SP-2: ReleaseGoldToWallet (online + offline re-credit) and the
+/// applied-record idempotency helpers (WriteResolutionApplied / ResolutionApplied).
+static int RunAhReleaseTest()
+{
+    bool pass = true;
+
+    // Clean slate for this test's rows and a synthetic offline character.
+    // NOTE: the applied-record key is "resolve:<uuid in DECIMAL>" (see
+    // WriteResolutionApplied); UINT64_C(0x0000009900000001) below decimalises
+    // to 657129996289, so the cleanup pattern must match that, not the hex
+    // digits.
+    CharacterDatabase.DirectPExecute(
+        "DELETE FROM `custody_ledger` WHERE `idem_key` LIKE 'test:rel%%'"
+        " OR `idem_key` = 'resolve:657129996289'");
+
+    // ---- offline re-credit: seed a RESERVED row + a characters money row ----
+    uint32 const offlineGuid = 970101u;
+    CharacterDatabase.DirectPExecute(
+        "DELETE FROM `characters` WHERE `guid` = %u", offlineGuid);
+    CharacterDatabase.DirectPExecute(
+        "INSERT INTO `characters` (`guid`,`account`,`name`,`money`) "
+        "VALUES (%u, 1, 'RelTestOff', 500)", offlineGuid);
+    {
+        CharacterDatabase.BeginTransaction();
+        CustodyRow r;
+        r.id = 0; r.idemKey = "test:rel:offline"; r.kind = CUSTODY_GOLD;
+        r.role = ROLE_BID; r.state = CST_RESERVED; r.ownerGuid = offlineGuid;
+        r.beneficiaryGuid = 0; r.amount = 250; r.itemGuid = 0;
+        r.auctionId = 970101; r.createdTime = static_cast<uint64>(time(NULL));
+        r.resolvedTime = 0;
+        CustodyLedger::Insert(r);
+        CharacterDatabase.CommitTransactionChecked();
+    }
+    {
+        CustodyDeferred def;
+        CharacterDatabase.BeginTransaction();
+        CustodyService::ReleaseGoldToWallet(def, offlineGuid, NULL, 250,
+                                            "test:rel:offline");
+        bool ok = CharacterDatabase.CommitTransactionChecked();
+        def.run();
+        if (!ok)
+        {
+            printf("ahrelease FAIL: offline commit returned false\n");
+            pass = false;
+        }
+        QueryResult* q = CharacterDatabase.PQuery(
+            "SELECT `money` FROM `characters` WHERE `guid` = %u", offlineGuid);
+        if (!q || q->Fetch()[0].GetUInt32() != 750u)  // 500 + 250
+        {
+            printf("ahrelease FAIL: offline money not credited (expected 750)\n");
+            pass = false;
+        }
+        delete q;
+        CustodyRow row;
+        if (!CustodyLedger::Get("test:rel:offline", row) ||
+            row.state != CST_TERMINAL_BACK)
+        {
+            printf("ahrelease FAIL: offline row not CST_TERMINAL_BACK\n");
+            pass = false;
+        }
+    }
+
+    // ---- applied-record: write once, detect duplicate, missing => false ----
+    {
+        uint64 const uuid = UINT64_C(0x0000009900000001);
+        if (CustodyService::ResolutionApplied(uuid))
+        {
+            printf("ahrelease FAIL: applied-record present before write\n");
+            pass = false;
+        }
+        CharacterDatabase.BeginTransaction();
+        CustodyService::WriteResolutionApplied(970200u, uuid);
+        if (!CharacterDatabase.CommitTransactionChecked())
+        {
+            printf("ahrelease FAIL: applied-record commit returned false\n");
+            pass = false;
+        }
+        if (!CustodyService::ResolutionApplied(uuid))
+        {
+            printf("ahrelease FAIL: applied-record not detected after write\n");
+            pass = false;
+        }
+    }
+
+    // Cleanup (see decimal-key NOTE above).
+    CharacterDatabase.DirectPExecute(
+        "DELETE FROM `custody_ledger` WHERE `idem_key` LIKE 'test:rel%%'"
+        " OR `idem_key` = 'resolve:657129996289'");
+    CharacterDatabase.DirectPExecute(
+        "DELETE FROM `characters` WHERE `guid` = %u", offlineGuid);
+
+    if (pass)
+    {
+        printf("ahrelease OK\n");
+    }
+    return pass ? 0 : 1;
+}
+
+/// SP-2 self-test for AhHandlePlayerMutationResult: finalizes crafted worker
+/// results against SEEDED custody rows + a seeded MutationPending entry. No live
+/// worker, no world data. Recipients of AH mail / gold re-credits use guid 1,
+/// which the test SEEDS as an offline `characters` row with an account (the
+/// legacy AH mail path guards on GetPlayerAccountIdByGUID != 0, so a recipient
+/// with no `characters` row is correctly skipped -- see RunAhReleaseTest); guid
+/// 99999 stays an offline-nobody bidder. Covers the reconciliation that an
+/// op=0x42 (buyout intent) MUT_OK is a WIN only when effectiveBid==buyout, else
+/// a normal standing bid. Returns 0 on pass.
+static int RunAhMutResultTest()
+{
+    bool pass = true;
+    CharacterDatabase.AllowAsyncTransactions();
+
+    // Clean slate from any prior run (auction-id scoped -- covers both the
+    // test:mut* keys and the hardcoded dep:/item: keys the buyout finalize uses).
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `custody_ledger` WHERE `auction_id` IN "
+        "(990001,990002,990003,990004,990005,990006,990007)");
+    CharacterDatabase.DirectExecute(
+        "DELETE ii FROM `item_instance` ii "
+        "JOIN `mail_items` mi ON mi.`item_guid`=ii.`guid` "
+        "JOIN `mail` m ON m.`id`=mi.`mail_id` "
+        "WHERE m.`receiver` IN (1,2) AND m.`subject` LIKE '19019:%'");
+    CharacterDatabase.DirectExecute(
+        "DELETE mi FROM `mail_items` mi JOIN `mail` m ON m.`id`=mi.`mail_id` "
+        "WHERE m.`receiver` IN (1,2) AND m.`subject` LIKE '19019:%'");
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `mail` WHERE `receiver` IN (1,2) AND `subject` LIKE '19019:%'");
+
+    sObjectMgr.SetHighestGuids();       // mail and item ids collide otherwise
+    sObjectMgr.LoadItemPrototypes();
+    if (!ObjectMgr::GetItemPrototype(19019u))
+    {
+        printf("ahmutresult FAIL: item prototype 19019 missing\n");
+        return 2;
+    }
+
+    // Seed the offline recipient (guid 1) with an account + durable money so the
+    // account-guarded AH mail path delivers and the offline gold re-credit UPDATE
+    // has a row to hit. World data is NOT loaded under -t, so GetPlayer(1) is
+    // NULL and every value motion takes the offline (durable-DB) branch.
+    CharacterDatabase.DirectExecute("DELETE FROM `characters` WHERE `guid`=1");
+    CharacterDatabase.DirectExecute(
+        "INSERT INTO `characters` (`guid`,`account`,`name`,`money`) "
+        "VALUES (1, 1, 'AhMutTestRcv', 100000)");
+
+    // Helper lambda: read guid 1's durable money.
+    auto readMoney = []() -> uint64
+    {
+        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
+            "SELECT `money` FROM `characters` WHERE `guid`=1"));
+        return res ? res->Fetch()[0].GetUInt64() : 0;
+    };
+
+    // Helper lambda: read a custody row's state (255 = missing).
+    auto rowState = [](char const* key) -> uint32
+    {
+        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
+            "SELECT `state` FROM `custody_ledger` WHERE `idem_key`='%s'", key));
+        return res ? res->Fetch()[0].GetUInt32() : 255u;
+    };
+
+    // Helper lambda: count mails matching a money+subject to receiver 1.
+    auto mailCount = [](uint32 money, char const* subject) -> uint64
+    {
+        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
+            "SELECT COUNT(*) FROM `mail` WHERE `receiver`=1 AND `money`=%u AND `subject`='%s'",
+            money, subject));
+        return res ? res->Fetch()[0].GetUInt64() : 0;
+    };
+
+    MutationPendingMap& pend = sAhService.GetMutationPending();
+
+    // ---- Part A: MUT_OK bid displacing a real prior bidder ----
+    {
+        CharacterDatabase.BeginTransaction();
+        CharacterDatabase.PExecute(
+            "INSERT INTO `custody_ledger` "
+            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+            "VALUES ('test:mut:prior',0,1,0,1,0,777,0,990001,0,0),"
+            "       ('test:mut:own',0,1,0,99999,0,900,0,990001,0,0)");
+        if (!CharacterDatabase.CommitTransactionChecked())
+        {
+            printf("ahmutresult FAIL: seed commit (bid)\n");
+            return 2;
+        }
+
+        PendingMutation pm;
+        pm.uuid = 0xA1ull;
+        pm.playerGuidLow = 99999u;          // nonexistent char: offline, no account
+        pm.op = uint16(IPC_PLAYER_BID);
+        pm.auctionId = 990001u;
+        pm.state = uint8(PMUT_AWAIT_RESULT);
+        pm.sentSec = uint32(time(NULL));
+        pm.reservedAmount = 900u;
+        pm.reserveKey = "test:mut:own";
+        pm.itemKey.clear();
+        pm.depKey.clear();
+        pend.Register(pm);
+
+        PlayerMutationResult res;
+        res.uuid = 0xA1ull;
+        res.op = uint8(IPC_PLAYER_BID & 0xFFu);
+        res.status = uint8(MUT_OK);
+        res.reason = 0;
+        res.facts = MutationFacts();
+        res.facts.auctionId = 990001u;
+        res.facts.houseId = 7;
+        res.facts.itemTemplate = 19019u;
+        res.facts.randomPropertyId = 0;
+        res.facts.sellerGuid = 2u;
+        res.facts.effectiveBid = 900u;
+        res.facts.curBid = 900u;
+        res.facts.curBidderGuid = 99999u;
+        res.facts.priorBidderGuid = 1u;
+        res.facts.priorBidAmount = 777u;
+        AhHandlePlayerMutationResult(res);
+
+        if (rowState("test:mut:prior") != 2u)
+        {
+            printf("ahmutresult FAIL: prior bid row not TERMINAL_BACK\n");
+            pass = false;
+        }
+        if (rowState("test:mut:own") != 0u)
+        {
+            printf("ahmutresult FAIL: new live bid row must stay RESERVED\n");
+            pass = false;
+        }
+        if (mailCount(777u, "19019:0:0") != 1u)
+        {
+            printf("ahmutresult FAIL: outbid refund mail missing\n");
+            pass = false;
+        }
+        PendingMutation gone;
+        if (pend.Peek(0xA1ull, gone))
+        {
+            printf("ahmutresult FAIL: OK pending not consumed\n");
+            pass = false;
+        }
+    }
+
+    // ---- Part A2: MUT_OK sell -> no value motion, rows stay RESERVED ----
+    {
+        CharacterDatabase.BeginTransaction();
+        CharacterDatabase.PExecute(
+            "INSERT INTO `custody_ledger` "
+            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+            "VALUES ('test:mut:dep',0,0,0,1,0,25,0,990002,0,0),"
+            "       ('test:mut:item',1,3,0,1,0,0,424242,990002,0,0)");
+        if (!CharacterDatabase.CommitTransactionChecked())
+        {
+            printf("ahmutresult FAIL: seed commit (sell)\n");
+            return 2;
+        }
+
+        PendingMutation pm;
+        pm.uuid = 0xA5ull;
+        pm.playerGuidLow = 1u;
+        pm.op = uint16(IPC_PLAYER_SELL);
+        pm.auctionId = 990002u;
+        pm.state = uint8(PMUT_AWAIT_RESULT);
+        pm.sentSec = uint32(time(NULL));
+        pm.reservedAmount = 25u;
+        pm.reserveKey.clear();
+        pm.itemKey = "test:mut:item";
+        pm.depKey = "test:mut:dep";
+        pend.Register(pm);
+
+        PlayerMutationResult res;
+        res.uuid = 0xA5ull;
+        res.op = uint8(IPC_PLAYER_SELL & 0xFFu);
+        res.status = uint8(MUT_OK);
+        res.reason = 0;
+        res.facts = MutationFacts();
+        res.facts.auctionId = 990002u;
+        res.facts.houseId = 7;
+        res.facts.itemGuid = 424242u;
+        res.facts.itemTemplate = 19019u;
+        res.facts.sellerGuid = 1u;
+        res.facts.deposit = 25u;
+        AhHandlePlayerMutationResult(res);
+
+        if (rowState("test:mut:dep") != 0u || rowState("test:mut:item") != 0u)
+        {
+            printf("ahmutresult FAIL: sell OK must leave dep+item RESERVED\n");
+            pass = false;
+        }
+        PendingMutation gone;
+        if (pend.Peek(0xA5ull, gone))
+        {
+            printf("ahmutresult FAIL: sell pending not consumed\n");
+            pass = false;
+        }
+    }
+
+    // ---- Part A3: MUT_OK op=0x42 buyout WIN (effectiveBid == buyout) ----
+    // The worker removed the row at buyout: seller paid, item to winner,
+    // buyer reserve committed as proceeds, deposit returned, remainder released.
+    {
+        Item* winItem = TestCreateCachedAuctionItem(19019u, 1u);
+        if (!winItem)
+        {
+            printf("ahmutresult FAIL: create buyout-win escrow item\n");
+            return 2;
+        }
+        uint32 const winItemGuid = winItem->GetGUIDLow();
+
+        CharacterDatabase.BeginTransaction();
+        CharacterDatabase.PExecute(
+            "INSERT INTO `custody_ledger` "
+            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+            "VALUES ('test:mut:bowin',0,1,0,99999,0,1000,0,990003,0,0),"
+            "       ('dep:990003',0,0,0,1,0,50,0,990003,0,0),"
+            "       ('item:990003',1,3,0,1,0,0,%u,990003,0,0)", winItemGuid);
+        if (!CharacterDatabase.CommitTransactionChecked())
+        {
+            printf("ahmutresult FAIL: seed commit (buyout-win)\n");
+            return 2;
+        }
+
+        PendingMutation pm;
+        pm.uuid = 0xA8ull;
+        pm.playerGuidLow = 99999u;          // buyer offline-nobody
+        pm.op = uint16(IPC_PLAYER_BUYOUT);
+        pm.auctionId = 990003u;
+        pm.state = uint8(PMUT_AWAIT_RESULT);
+        pm.sentSec = uint32(time(NULL));
+        pm.reservedAmount = 1000u;          // maxPrice
+        pm.reserveKey = "test:mut:bowin";
+        pm.itemKey.clear();
+        pm.depKey.clear();
+        pend.Register(pm);
+
+        PlayerMutationResult res;
+        res.uuid = 0xA8ull;
+        res.op = uint8(IPC_PLAYER_BUYOUT & 0xFFu);
+        res.status = uint8(MUT_OK);
+        res.reason = 0;
+        res.facts = MutationFacts();
+        res.facts.auctionId = 990003u;
+        res.facts.houseId = 7;
+        res.facts.itemGuid = winItemGuid;
+        res.facts.itemTemplate = 19019u;
+        res.facts.randomPropertyId = 0;
+        res.facts.sellerGuid = 1u;          // seller has an account -> gets payout mail
+        res.facts.deposit = 50u;
+        res.facts.effectiveBid = 800u;
+        res.facts.curBid = 800u;
+        res.facts.curBidderGuid = 99999u;
+        res.facts.buyout = 800u;            // effectiveBid == buyout -> WIN
+        AhHandlePlayerMutationResult(res);
+
+        if (rowState("test:mut:bowin") != 1u)
+        {
+            printf("ahmutresult FAIL: buyout-win reserve not TERMINAL_OK (proceeds)\n");
+            pass = false;
+        }
+        if (rowState("dep:990003") != 2u)
+        {
+            printf("ahmutresult FAIL: buyout-win deposit not TERMINAL_BACK\n");
+            pass = false;
+        }
+        if (rowState("item:990003") != 1u)
+        {
+            printf("ahmutresult FAIL: buyout-win item not TERMINAL_OK\n");
+            pass = false;
+        }
+        if (mailCount(850u, "19019:0:2") != 1u)  // profit=800+50-cut(0 under -t)
+        {
+            printf("ahmutresult FAIL: buyout-win seller payout mail missing\n");
+            pass = false;
+        }
+        PendingMutation gone;
+        if (pend.Peek(0xA8ull, gone))
+        {
+            printf("ahmutresult FAIL: buyout-win pending not consumed\n");
+            pass = false;
+        }
+    }
+
+    // ---- Part A4: MUT_OK op=0x42 committed by worker as a NORMAL BID ----
+    // effectiveBid < buyout: the row stayed LIVE. The buyer reserve becomes the
+    // standing bid (stays RESERVED); ONLY the displaced prior bidder is refunded;
+    // no seller payout, no item delivery, no release.
+    {
+        CharacterDatabase.BeginTransaction();
+        CharacterDatabase.PExecute(
+            "INSERT INTO `custody_ledger` "
+            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+            "VALUES ('test:mut:bobid',0,1,0,99999,0,500,0,990004,0,0),"
+            "       ('test:mut:bobidprior',0,1,0,1,0,400,0,990004,0,0)");
+        if (!CharacterDatabase.CommitTransactionChecked())
+        {
+            printf("ahmutresult FAIL: seed commit (buyout-as-bid)\n");
+            return 2;
+        }
+
+        PendingMutation pm;
+        pm.uuid = 0xA9ull;
+        pm.playerGuidLow = 99999u;          // buyer offline-nobody
+        pm.op = uint16(IPC_PLAYER_BUYOUT);
+        pm.auctionId = 990004u;
+        pm.state = uint8(PMUT_AWAIT_RESULT);
+        pm.sentSec = uint32(time(NULL));
+        pm.reservedAmount = 500u;           // reserved == effectiveBid -> release 0
+        pm.reserveKey = "test:mut:bobid";
+        pm.itemKey.clear();
+        pm.depKey.clear();
+        pend.Register(pm);
+
+        PlayerMutationResult res;
+        res.uuid = 0xA9ull;
+        res.op = uint8(IPC_PLAYER_BUYOUT & 0xFFu);
+        res.status = uint8(MUT_OK);
+        res.reason = 0;
+        res.facts = MutationFacts();
+        res.facts.auctionId = 990004u;
+        res.facts.houseId = 7;
+        res.facts.itemTemplate = 19019u;
+        res.facts.randomPropertyId = 0;
+        res.facts.sellerGuid = 2u;
+        res.facts.effectiveBid = 500u;
+        res.facts.curBid = 500u;
+        res.facts.curBidderGuid = 99999u;
+        res.facts.priorBidderGuid = 1u;
+        res.facts.priorBidAmount = 400u;
+        res.facts.buyout = 1000u;           // effectiveBid < buyout -> NOT a win
+        AhHandlePlayerMutationResult(res);
+
+        if (rowState("test:mut:bobid") != 0u)
+        {
+            printf("ahmutresult FAIL: buyout-as-bid reserve must stay RESERVED\n");
+            pass = false;
+        }
+        if (rowState("test:mut:bobidprior") != 2u)
+        {
+            printf("ahmutresult FAIL: buyout-as-bid prior bidder not refunded\n");
+            pass = false;
+        }
+        if (mailCount(400u, "19019:0:0") != 1u)
+        {
+            printf("ahmutresult FAIL: buyout-as-bid outbid refund mail missing\n");
+            pass = false;
+        }
+        PendingMutation gone;
+        if (pend.Peek(0xA9ull, gone))
+        {
+            printf("ahmutresult FAIL: buyout-as-bid pending not consumed\n");
+            pass = false;
+        }
+    }
+
+    // ---- Part A5: MUT_OK cancel CONFIRM finalizes seller return + deposit ----
+    {
+        Item* cancelItem = TestCreateCachedAuctionItem(19019u, 1u);
+        if (!cancelItem)
+        {
+            printf("ahmutresult FAIL: create cancel escrow item\n");
+            return 2;
+        }
+        uint32 const cancelItemGuid = cancelItem->GetGUIDLow();
+
+        CharacterDatabase.BeginTransaction();
+        CharacterDatabase.PExecute(
+            "INSERT INTO `custody_ledger` "
+            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+            "VALUES ('dep:990005',0,0,0,1,0,32,0,990005,0,0),"
+            "       ('item:990005',1,3,0,1,0,0,%u,990005,0,0)", cancelItemGuid);
+        if (!CharacterDatabase.CommitTransactionChecked())
+        {
+            printf("ahmutresult FAIL: seed commit (cancel-confirm)\n");
+            return 2;
+        }
+
+        PendingMutation pm;
+        pm.uuid = 0xAAull;
+        pm.playerGuidLow = 1u;
+        pm.op = uint16(IPC_PLAYER_CANCEL);
+        pm.auctionId = 990005u;
+        pm.state = uint8(PMUT_AWAIT_CONFIRM);
+        pm.sentSec = uint32(time(NULL));
+        pm.reservedAmount = 0u;
+        pm.reserveKey.clear();
+        pm.itemKey.clear();
+        pm.depKey.clear();
+        pend.Register(pm);
+
+        PlayerMutationResult res;
+        res.uuid = 0xAAull;
+        res.op = uint8(IPC_PLAYER_CANCEL_CONFIRM & 0xFFu);
+        res.status = uint8(MUT_OK);
+        res.reason = 0;
+        res.facts = MutationFacts();
+        res.facts.auctionId = 990005u;
+        res.facts.houseId = 7;
+        res.facts.itemGuid = cancelItemGuid;
+        res.facts.itemTemplate = 19019u;
+        res.facts.randomPropertyId = 0;
+        res.facts.sellerGuid = 1u;
+        res.facts.deposit = 32u;
+        AhHandlePlayerMutationResult(res);
+
+        if (rowState("dep:990005") != 1u)
+        {
+            printf("ahmutresult FAIL: cancel-confirm deposit not TERMINAL_OK\n");
+            pass = false;
+        }
+        if (rowState("item:990005") != 1u)
+        {
+            printf("ahmutresult FAIL: cancel-confirm item not TERMINAL_OK\n");
+            pass = false;
+        }
+        PendingMutation gone;
+        if (pend.Peek(0xAAull, gone))
+        {
+            printf("ahmutresult FAIL: cancel-confirm pending not consumed\n");
+            pass = false;
+        }
+    }
+
+    // ---- Part B1: rejected sell returns the item and the durable deposit ----
+    {
+        Item* rejectedItem = TestCreateCachedAuctionItem(19019u, 1u);
+        if (!rejectedItem)
+        {
+            printf("ahmutresult FAIL: create rejected-sell escrow item\n");
+            return 2;
+        }
+        uint32 const rejectedItemGuid = rejectedItem->GetGUIDLow();
+
+        CharacterDatabase.BeginTransaction();
+        CharacterDatabase.PExecute(
+            "INSERT INTO `custody_ledger` "
+            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+            "VALUES ('dep:990006',0,0,0,1,0,73,0,990006,0,0),"
+            "       ('item:990006',1,3,0,1,0,0,%u,990006,0,0)",
+            rejectedItemGuid);
+        if (!CharacterDatabase.CommitTransactionChecked())
+        {
+            printf("ahmutresult FAIL: seed commit (rejected sell)\n");
+            return 2;
+        }
+
+        PendingMutation pm;
+        pm.uuid = 0xABull;
+        pm.playerGuidLow = 1u;
+        pm.op = uint16(IPC_PLAYER_SELL);
+        pm.auctionId = 990006u;
+        pm.state = uint8(PMUT_AWAIT_RESULT);
+        pm.sentSec = uint32(time(NULL));
+        // Production sell pending stores its deposit in depKey.
+        pm.reservedAmount = 0u;
+        pm.reserveKey.clear();
+        pm.itemKey = "item:990006";
+        pm.depKey = "dep:990006";
+        pend.Register(pm);
+
+        uint64 const before = readMoney();
+        PlayerMutationResult res;
+        res.uuid = pm.uuid;
+        res.op = uint8(IPC_PLAYER_SELL & 0xFFu);
+        res.status = uint8(MUT_REJECTED);
+        res.reason = uint8(AUCTION_ERR_DATABASE);
+        res.facts = MutationFacts();
+        res.facts.auctionId = pm.auctionId;
+        res.facts.houseId = 7u;
+        AhHandlePlayerMutationResult(res);
+
+        if (readMoney() != before + 73u)
+        {
+            printf("ahmutresult FAIL: rejected sell did not refund durable "
+                   "deposit amount\n");
+            pass = false;
+        }
+        if (rowState("dep:990006") != CST_TERMINAL_BACK ||
+            rowState("item:990006") != CST_TERMINAL_BACK)
+        {
+            printf("ahmutresult FAIL: rejected sell custody not "
+                   "TERMINAL_BACK\n");
+            pass = false;
+        }
+        std::unique_ptr<QueryResult> returned(CharacterDatabase.PQuery(
+            "SELECT 1 FROM `mail_items` WHERE `receiver`=1 AND `item_guid`=%u",
+            rejectedItemGuid));
+        if (!returned)
+        {
+            printf("ahmutresult FAIL: rejected sell item-return mail "
+                   "missing\n");
+            pass = false;
+        }
+    }
+
+    // ---- Part B2: missing sell escrow item holds both rows for retry ----
+    {
+        Item* missingItem = TestCreateCachedAuctionItem(19019u, 1u);
+        if (!missingItem)
+        {
+            printf("ahmutresult FAIL: create missing-item retry fixture\n");
+            return 2;
+        }
+        uint32 const missingItemGuid = missingItem->GetGUIDLow();
+        sAuctionMgr.RemoveAItem(missingItemGuid);
+
+        CharacterDatabase.BeginTransaction();
+        CharacterDatabase.PExecute(
+            "INSERT INTO `custody_ledger` "
+            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+            "VALUES ('dep:990007',0,0,0,1,0,74,0,990007,0,0),"
+            "       ('item:990007',1,3,0,1,0,0,%u,990007,0,0)",
+            missingItemGuid);
+        if (!CharacterDatabase.CommitTransactionChecked())
+        {
+            printf("ahmutresult FAIL: seed commit "
+                   "(missing rejected-sell item)\n");
+            return 2;
+        }
+
+        PendingMutation pm;
+        pm.uuid = 0xACull;
+        pm.playerGuidLow = 1u;
+        pm.op = uint16(IPC_PLAYER_SELL);
+        pm.auctionId = 990007u;
+        pm.state = uint8(PMUT_AWAIT_RESULT);
+        pm.sentSec = uint32(time(NULL));
+        pm.reservedAmount = 0u;
+        pm.reserveKey.clear();
+        pm.itemKey = "item:990007";
+        pm.depKey = "dep:990007";
+        pend.Register(pm);
+
+        uint64 const before = readMoney();
+        PlayerMutationResult res;
+        res.uuid = pm.uuid;
+        res.op = uint8(IPC_PLAYER_SELL & 0xFFu);
+        res.status = uint8(MUT_REJECTED);
+        res.reason = uint8(AUCTION_ERR_DATABASE);
+        res.facts = MutationFacts();
+        res.facts.auctionId = pm.auctionId;
+        res.facts.houseId = 7u;
+        AhHandlePlayerMutationResult(res);
+
+        if (readMoney() != before || rowState("dep:990007") != CST_RESERVED ||
+            rowState("item:990007") != CST_RESERVED)
+        {
+            printf("ahmutresult FAIL: missing rejected-sell item moved "
+                   "conserved value\n");
+            pass = false;
+        }
+
+        sAuctionMgr.AddAItem(missingItem);
+        AhProcessRedriveQueue(uint32(time(NULL)) + 6u);
+        std::unique_ptr<QueryResult> returned(CharacterDatabase.PQuery(
+            "SELECT 1 FROM `mail_items` WHERE `receiver`=1 "
+            "AND `item_guid`=%u",
+            missingItemGuid));
+        if (readMoney() != before + 74u ||
+            rowState("dep:990007") != CST_TERMINAL_BACK ||
+            rowState("item:990007") != CST_TERMINAL_BACK || !returned ||
+            sAuctionMgr.GetAItem(missingItemGuid))
+        {
+            printf("ahmutresult FAIL: missing-item redrive did not conserve "
+                   "and return value\n");
+            pass = false;
+        }
+    }
+
+    // ---- Part B3: MUT_REJECTED buyout -> ReleaseGoldToWallet (offline) ----
+    {
+        CharacterDatabase.BeginTransaction();
+        CharacterDatabase.PExecute(
+            "INSERT INTO `custody_ledger` "
+            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+            "VALUES ('test:mut:rej',0,1,0,1,0,555,0,990001,0,0)");
+        if (!CharacterDatabase.CommitTransactionChecked())
+        {
+            printf("ahmutresult FAIL: seed commit (rej)\n");
+            return 2;
+        }
+
+        PendingMutation pm;
+        pm.uuid = 0xA2ull;
+        pm.playerGuidLow = 1u;
+        pm.op = uint16(IPC_PLAYER_BUYOUT);
+        pm.auctionId = 990001u;
+        pm.state = uint8(PMUT_AWAIT_RESULT);
+        pm.sentSec = uint32(time(NULL));
+        pm.reservedAmount = 555u;
+        pm.reserveKey = "test:mut:rej";
+        pm.itemKey.clear();
+        pm.depKey.clear();
+        pend.Register(pm);
+
+        uint64 const before = readMoney();
+
+        PlayerMutationResult res;
+        res.uuid = 0xA2ull;
+        res.op = uint8(IPC_PLAYER_BUYOUT & 0xFFu);
+        res.status = uint8(MUT_REJECTED);
+        res.reason = uint8(AUCTION_ERR_BID_INCREMENT);
+        res.facts = MutationFacts();
+        res.facts.auctionId = 990001u;
+        AhHandlePlayerMutationResult(res);
+
+        if (rowState("test:mut:rej") != 2u)
+        {
+            printf("ahmutresult FAIL: rejected row not TERMINAL_BACK\n");
+            pass = false;
+        }
+        if (readMoney() != before + 555u)
+        {
+            printf("ahmutresult FAIL: rejected release not credited\n");
+            pass = false;
+        }
+        PendingMutation gone;
+        if (pend.Peek(0xA2ull, gone))
+        {
+            printf("ahmutresult FAIL: rejected pending not consumed\n");
+            pass = false;
+        }
+    }
+
+    // ---- Part C: MUT_REJECTED_STALE cancel -> release cut + resolve ----
+    {
+        CharacterDatabase.BeginTransaction();
+        CharacterDatabase.PExecute(
+            "INSERT INTO `custody_ledger` "
+            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+            "VALUES ('test:mut:cut',0,2,0,1,0,55,0,990001,0,0)");
+        if (!CharacterDatabase.CommitTransactionChecked())
+        {
+            printf("ahmutresult FAIL: seed commit (cut)\n");
+            return 2;
+        }
+
+        PendingMutation pm;
+        pm.uuid = 0xA3ull;
+        pm.playerGuidLow = 1u;
+        pm.op = uint16(IPC_PLAYER_CANCEL);
+        pm.auctionId = 990001u;
+        pm.state = uint8(PMUT_AWAIT_RESULT);
+        pm.sentSec = uint32(time(NULL));
+        pm.reservedAmount = 0u;
+        pm.reserveKey.clear();
+        pm.itemKey.clear();
+        pm.depKey.clear();
+        pend.Register(pm);
+        pend.RearmConfirm(0xA3ull, uint32(time(NULL)));
+        if (!pend.SetReserve(0xA3ull, 55u, "test:mut:cut"))
+        {
+            printf("ahmutresult FAIL: SetReserve\n");
+            pass = false;
+        }
+
+        uint64 const before = readMoney();
+
+        PlayerMutationResult res;
+        res.uuid = 0xA3ull;
+        res.op = uint8(IPC_PLAYER_CANCEL & 0xFFu);
+        res.status = uint8(MUT_REJECTED_STALE);
+        res.reason = 0;
+        res.facts = MutationFacts();
+        res.facts.auctionId = 990001u;
+        AhHandlePlayerMutationResult(res);
+
+        if (rowState("test:mut:cut") != 2u)
+        {
+            printf("ahmutresult FAIL: stale cut row not TERMINAL_BACK\n");
+            pass = false;
+        }
+        if (readMoney() != before + 55u)
+        {
+            printf("ahmutresult FAIL: stale cut not credited\n");
+            pass = false;
+        }
+        PendingMutation gone;
+        if (pend.Peek(0xA3ull, gone))
+        {
+            printf("ahmutresult FAIL: stale pending not consumed\n");
+            pass = false;
+        }
+    }
+
+    // ---- Part D: unknown uuid -> loud protocol fault, no crash ----
+    {
+        PlayerMutationResult res;
+        res.uuid = 0xDEADull;
+        res.op = uint8(IPC_PLAYER_BID & 0xFFu);
+        res.status = uint8(MUT_OK);
+        res.reason = 0;
+        res.facts = MutationFacts();
+        AhHandlePlayerMutationResult(res);   // must only log
+    }
+
+    // ---- Part E: MUT_PREPARED with offline seller -> ABORT path consumes ----
+    {
+        PendingMutation pm;
+        pm.uuid = 0xA6ull;
+        pm.playerGuidLow = 99999u;          // offline -> can't debit cut -> ABORT
+        pm.op = uint16(IPC_PLAYER_CANCEL);
+        pm.auctionId = 990001u;
+        pm.state = uint8(PMUT_AWAIT_RESULT);
+        pm.sentSec = uint32(time(NULL));
+        pm.reservedAmount = 0u;
+        pm.reserveKey.clear();
+        pm.itemKey.clear();
+        pm.depKey.clear();
+        pend.Register(pm);
+
+        PlayerMutationResult res;
+        res.uuid = 0xA6ull;
+        res.op = uint8(IPC_PLAYER_CANCEL & 0xFFu);
+        res.status = uint8(MUT_PREPARED);
+        res.reason = 0;
+        res.facts = MutationFacts();
+        res.facts.auctionId = 990001u;
+        res.facts.houseId = 7;
+        res.facts.curBid = 500u;            // nonzero bid -> cut is owed -> gate engages
+        res.facts.curBidderGuid = 1u;
+        AhHandlePlayerMutationResult(res);   // sv==NULL under -t: frame skipped
+
+        PendingMutation gone;
+        if (pend.Peek(0xA6ull, gone))
+        {
+            printf("ahmutresult FAIL: PREPARED abort did not consume pending\n");
+            pass = false;
+        }
+    }
+
+    // ---- Part F: sweep tombstones a stale entry ----
+    {
+        PendingMutation pm;
+        pm.uuid = 0xA7ull;
+        pm.playerGuidLow = 99999u;
+        pm.op = uint16(IPC_PLAYER_BID);
+        pm.auctionId = 990001u;
+        pm.state = uint8(PMUT_AWAIT_RESULT);
+        pm.sentSec = 100u;                   // ancient
+        pm.reservedAmount = 0u;
+        pend.Register(pm);
+        std::vector<uint64> inDoubt;
+        pend.SweepToTombstones(uint32(time(NULL)), 10u, inDoubt);
+        bool swept = false;
+        for (size_t i = 0; i < inDoubt.size(); ++i)
+        {
+            if (inDoubt[i] == 0xA7ull)
+            {
+                swept = true;
+            }
+        }
+        PendingMutation t;
+        if (!swept || !pend.Peek(0xA7ull, t) || t.state != uint8(PMUT_TOMBSTONE))
+        {
+            printf("ahmutresult FAIL: sweep did not tombstone\n");
+            pass = false;
+        }
+        AhNotifyMutationInDoubt(t);          // offline -> no packet; must not crash
+        PendingMutation consumed;
+        pend.Take(0xA7ull, consumed);        // clean the slot for re-runs
+    }
+
+    // Clean up.
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `custody_ledger` WHERE `auction_id` IN "
+        "(990001,990002,990003,990004,990005,990006,990007)");
+    CharacterDatabase.DirectExecute(
+        "DELETE ii FROM `item_instance` ii "
+        "JOIN `mail_items` mi ON mi.`item_guid`=ii.`guid` "
+        "JOIN `mail` m ON m.`id`=mi.`mail_id` "
+        "WHERE m.`receiver` IN (1,2) AND m.`subject` LIKE '19019:%'");
+    CharacterDatabase.DirectExecute(
+        "DELETE mi FROM `mail_items` mi JOIN `mail` m ON m.`id`=mi.`mail_id` "
+        "WHERE m.`receiver` IN (1,2) AND m.`subject` LIKE '19019:%'");
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `mail` WHERE `receiver` IN (1,2) AND `subject` LIKE '19019:%'");
+    CharacterDatabase.DirectExecute("DELETE FROM `characters` WHERE `guid`=1");
+
+    if (pass)
+    {
+        printf("ahmutresult OK\n");
+        return 0;
+    }
+    return 2;
+}
+
+/// SP-2 Task 12 self-test for AhHandleResolveApply: applies crafted
+/// worker-initiated resolutions (WON / EXPIRED_NOBID / CANCELLED_UNLOCK /
+/// REPAIR_RETURN) against SEEDED custody rows -- no live worker, no world data.
+/// Asserts each kind's ledger flips + value mails, the resolve:<uuid>
+/// applied-record, and that a SECOND apply returns RES_DUPLICATE without
+/// double-applying. Recipients use guid 1 or 2, seeded offline with accounts so
+/// the account-guarded AH mail paths deliver. Item prototypes are loaded only
+/// for terminal-path fixtures that intentionally provide a cached escrow
+/// object.
+/// Returns 0 on pass.
+static int RunAhResolveTest()
+{
+    bool pass = true;
+    CharacterDatabase.AllowAsyncTransactions();
+
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `custody_ledger` WHERE `auction_id` IN "
+        "(991001,991002,991003,991004,991005,991006)");
+    CharacterDatabase.DirectExecute(
+        "DELETE ii FROM `item_instance` ii "
+        "JOIN `mail_items` mi ON mi.`item_guid`=ii.`guid` "
+        "JOIN `mail` m ON m.`id`=mi.`mail_id` "
+        "WHERE m.`receiver` IN (1,2) AND m.`subject` LIKE '19019:%'");
+    CharacterDatabase.DirectExecute(
+        "DELETE mi FROM `mail_items` mi JOIN `mail` m ON m.`id`=mi.`mail_id` "
+        "WHERE m.`receiver` IN (1,2) AND m.`subject` LIKE '19019:%'");
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `mail` WHERE `receiver` IN (1,2) "
+        "AND `subject` LIKE '19019:%'");
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `characters` WHERE `guid` IN (1,2)");
+    CharacterDatabase.DirectExecute(
+        "INSERT INTO `characters` (`guid`,`account`,`name`,`money`) "
+        "VALUES (1, 1, 'AhResTestRcv', 100000),"
+        "       (2, 2, 'AhResSeller', 100000)");
+
+    sObjectMgr.SetHighestGuids();       // mail and item ids collide otherwise
+    sObjectMgr.LoadItemPrototypes();
+    if (!ObjectMgr::GetItemPrototype(19019u))
+    {
+        printf("ahresolve FAIL: item prototype 19019 missing\n");
+        return 2;
+    }
+
+    auto readMoney = []() -> uint64
+    {
+        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
+            "SELECT `money` FROM `characters` WHERE `guid`=1"));
+        return res ? res->Fetch()[0].GetUInt64() : 0;
+    };
+    auto rowState = [](char const* key) -> uint32
+    {
+        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
+            "SELECT `state` FROM `custody_ledger` WHERE `idem_key`='%s'", key));
+        return res ? res->Fetch()[0].GetUInt32() : 255u;
+    };
+    auto mailCount = [](uint32 money, char const* subject) -> uint64
+    {
+        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
+            "SELECT COUNT(*) FROM `mail` WHERE `receiver`=1 AND `money`=%u AND `subject`='%s'",
+            money, subject));
+        return res ? res->Fetch()[0].GetUInt64() : 0;
+    };
+
+    // Terminal player resolutions require the matching deposit before any leg.
+    uint8 const terminalKinds[] =
+        { RESOLVE_WON, RESOLVE_EXPIRED_NOBID, RESOLVE_REPAIR_RETURN };
+    for (uint32 mode = 0u; mode < 3u; ++mode)
+    {
+        for (uint32 mismatch = 0u; mismatch < 2u; ++mismatch)
+        {
+            uint32 const auctionId = 991010u + mode * 2u + mismatch;
+            std::string const depKey = "dep:" + std::to_string(auctionId);
+            std::string const itemKey = "item:" + std::to_string(auctionId);
+            std::string const bidKey = "bid:" + std::to_string(auctionId) + ":1";
+            Item* const item = TestCreateCachedAuctionItem(19019u, 2u);
+            if (!item)
+            {
+                return 2;
+            }
+            uint32 const itemGuid = item->GetGUIDLow();
+            CharacterDatabase.BeginTransaction();
+            CustodyLedger::Insert(TestCustodyRow(0, itemKey, CUSTODY_ITEM,
+                ROLE_ITEM, 2u, 0u, itemGuid, auctionId));
+            if (mode == 0u)
+            {
+                CustodyLedger::Insert(TestCustodyRow(0, bidKey, CUSTODY_GOLD,
+                    ROLE_BID, 1u, 200u, 0u, auctionId));
+            }
+            if (mismatch)
+            {
+                CustodyLedger::Insert(TestCustodyRow(0, depKey, CUSTODY_GOLD,
+                    ROLE_DEPOSIT, 2u, 31u, 0u, auctionId));
+            }
+            if (!CharacterDatabase.CommitTransactionChecked())
+            {
+                return 2;
+            }
+            ResolveApply ra = {};
+            ra.uuid = 9912000ull + auctionId;
+            ra.kind = terminalKinds[mode];
+            ra.facts.auctionId = auctionId;
+            ra.facts.houseId = 7u;
+            ra.facts.sellerGuid = 2u;
+            ra.facts.itemGuid = itemGuid;
+            ra.facts.itemTemplate = 19019u;
+            ra.facts.itemCount = 1u;
+            ra.facts.deposit = 32u;
+            if (mode == 0u)
+            {
+                ra.facts.curBidderGuid = 1u;
+                ra.facts.curBid = ra.facts.effectiveBid = 200u;
+            }
+            uint64 const wallet = readMoney();
+            uint8 const result = AhHandleResolveApply(ra);
+            std::unique_ptr<QueryResult> heldMail(CharacterDatabase.Query(
+                "SELECT COUNT(*) FROM `mail` WHERE `receiver` IN (1,2)"));
+            bool const held = result == uint8(RES_FAILED) &&
+                !CustodyService::ResolutionApplied(ra.uuid) &&
+                sAuctionMgr.GetAItem(itemGuid) == item &&
+                rowState(itemKey.c_str()) == CST_RESERVED &&
+                rowState(depKey.c_str()) == (mismatch ? CST_RESERVED : 255u) &&
+                (mode != 0u || rowState(bidKey.c_str()) == CST_RESERVED) &&
+                readMoney() == wallet && heldMail &&
+                heldMail->Fetch()[0].GetUInt64() == 0u;
+            if (!held)
+            {
+                printf("ahresolve FAIL: kind %u %s deposit moved value\n",
+                       uint32(ra.kind), mismatch ? "mismatched" : "missing");
+                pass = false;
+            }
+            else
+            {
+                CharacterDatabase.BeginTransaction();
+                if (mismatch)
+                {
+                    CustodyLedger::SetAmount(depKey, 32u);
+                }
+                else
+                {
+                    CustodyLedger::Insert(TestCustodyRow(0, depKey, CUSTODY_GOLD,
+                        ROLE_DEPOSIT, 2u, 32u, 0u, auctionId));
+                }
+                if (!CharacterDatabase.CommitTransactionChecked())
+                {
+                    return 2;
+                }
+                uint8 const retried = AhHandleResolveApply(ra);
+                uint8 const duplicate = AhHandleResolveApply(ra);
+                std::unique_ptr<QueryResult> mails(CharacterDatabase.Query(
+                    "SELECT COUNT(*),COALESCE(SUM(`money`),0) "
+                    "FROM `mail` WHERE `receiver` IN (1,2)"));
+                std::unique_ptr<QueryResult> delivery(CharacterDatabase.PQuery(
+                    "SELECT COUNT(*) FROM `mail_items` "
+                    "WHERE `item_guid`=%u AND `receiver`=%u",
+                    itemGuid, mode == 0u ? 1u : 2u));
+                if (retried != uint8(RES_APPLIED) ||
+                    duplicate != uint8(RES_DUPLICATE) ||
+                    !CustodyService::ResolutionApplied(ra.uuid) ||
+                    rowState(depKey.c_str()) != CST_TERMINAL_OK ||
+                    rowState(itemKey.c_str()) != CST_TERMINAL_OK ||
+                    (mode == 0u && rowState(bidKey.c_str()) != CST_TERMINAL_OK) ||
+                    !mails || mails->Fetch()[0].GetUInt64() != (mode == 0u ? 2u : 1u) ||
+                    mails->Fetch()[1].GetUInt64() != (mode == 0u ? 232u : 0u) ||
+                    !delivery || delivery->Fetch()[0].GetUInt64() != 1u)
+                {
+                    printf("ahresolve FAIL: restored deposit did not settle once\n");
+                    pass = false;
+                }
+            }
+            if (Item* leftover = sAuctionMgr.GetAItem(itemGuid))
+            {
+                sAuctionMgr.RemoveAItem(itemGuid);
+                delete leftover;
+            }
+            CharacterDatabase.DirectPExecute(
+                "DELETE FROM `custody_ledger` WHERE `auction_id`=%u", auctionId);
+            CharacterDatabase.DirectExecute(
+                "DELETE FROM `mail_items` WHERE `receiver` IN (1,2)");
+            CharacterDatabase.DirectExecute(
+                "DELETE FROM `mail` WHERE `receiver` IN (1,2)");
+            CharacterDatabase.DirectPExecute(
+                "DELETE FROM `item_instance` WHERE `guid`=%u", itemGuid);
+        }
+    }
+
+    // ---- RESOLVE_WON: missing item cache must hold every value leg ----
+    {
+        CharacterDatabase.BeginTransaction();
+        CharacterDatabase.PExecute(
+            "INSERT INTO `custody_ledger` "
+            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+            "VALUES ('bid:991001:1',0,1,0,99999,0,800,0,991001,0,0),"
+            "       ('dep:991001',0,0,0,1,0,50,0,991001,0,0),"
+            "       ('item:991001',1,3,0,1,0,0,424242,991001,0,0)");
+        if (!CharacterDatabase.CommitTransactionChecked())
+        {
+            printf("ahresolve FAIL: seed commit (won)\n");
+            return 2;
+        }
+
+        ResolveApply ra;
+        ra.uuid = 0xB1ull;
+        ra.kind = uint8(RESOLVE_WON);
+        ra.facts = MutationFacts();
+        ra.facts.auctionId = 991001u;
+        ra.facts.houseId = 7;
+        ra.facts.itemGuid = 424242u;
+        ra.facts.itemTemplate = 19019u;
+        ra.facts.randomPropertyId = 0;
+        ra.facts.sellerGuid = 1u;           // has an account -> gets payout mail
+        ra.facts.deposit = 50u;
+        ra.facts.effectiveBid = 800u;
+        ra.facts.curBid = 800u;
+        ra.facts.curBidderGuid = 99999u;    // offline-nobody winner
+        ra.facts.buyout = 800u;
+
+        if (AhHandleResolveApply(ra) != uint8(RES_FAILED))
+        {
+            printf("ahresolve FAIL: missing-item WON not RES_FAILED\n");
+            pass = false;
+        }
+        if (CustodyService::ResolutionApplied(0xB1ull))
+        {
+            printf("ahresolve FAIL: missing-item WON wrote applied-record\n");
+            pass = false;
+        }
+        if (rowState("bid:991001:1") != CST_RESERVED)
+        {
+            printf("ahresolve FAIL: missing-item WON consumed bid\n");
+            pass = false;
+        }
+        if (rowState("dep:991001") != CST_RESERVED)
+        {
+            printf("ahresolve FAIL: missing-item WON consumed deposit\n");
+            pass = false;
+        }
+        if (rowState("item:991001") != CST_RESERVED)
+        {
+            printf("ahresolve FAIL: missing-item WON terminalized item "
+                   "custody\n");
+            pass = false;
+        }
+        if (mailCount(850u, "19019:0:2") != 0u)
+        {
+            printf("ahresolve FAIL: missing-item WON paid seller\n");
+            pass = false;
+        }
+
+        if (AhHandleResolveApply(ra) != uint8(RES_FAILED))
+        {
+            printf("ahresolve FAIL: missing-item WON retry was not "
+                   "RES_FAILED\n");
+            pass = false;
+        }
+        if (mailCount(850u, "19019:0:2") != 0u)
+        {
+            printf("ahresolve FAIL: missing-item WON retry paid seller\n");
+            pass = false;
+        }
+    }
+
+    // ---- RESOLVE_WON fail-closed [F2]: a REAL winner (curBidderGuid != 0) with
+    // NO live bid row must pay/deliver NOTHING and return RES_FAILED (mirror
+    // AhFinalizeBidOk), so the winner's RESERVED bid can never leak and the
+    // resolution re-drives. Seed dep + item but NO bid row: pre-fix this path
+    // silently skipped the bid terminal yet STILL paid the seller + wrote the
+    // applied-record. (A legit BOT win has curBidderGuid == 0 and no bid row --
+    // that proceed case is exercised by the REPAIR/bot-win paths.)
+    {
+        Item* missingBidItem = TestCreateCachedAuctionItem(19019u, 1u);
+        if (!missingBidItem)
+        {
+            printf("ahresolve FAIL: create missing-bid escrow item\n");
+            return 2;
+        }
+        uint32 const missingBidItemGuid = missingBidItem->GetGUIDLow();
+
+        CharacterDatabase.BeginTransaction();
+        CharacterDatabase.PExecute(
+            "INSERT INTO `custody_ledger` "
+            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+            "VALUES ('dep:991005',0,0,0,1,0,30,0,991005,0,0),"
+            "       ('item:991005',1,3,0,1,0,0,%u,991005,0,0)",
+            missingBidItemGuid);
+        if (!CharacterDatabase.CommitTransactionChecked())
+        {
+            printf("ahresolve FAIL: seed commit (won fail-closed)\n");
+            return 2;
+        }
+
+        ResolveApply ra;
+        ra.uuid = 0xB5ull;
+        ra.kind = uint8(RESOLVE_WON);
+        ra.facts = MutationFacts();
+        ra.facts.auctionId = 991005u;
+        ra.facts.houseId = 7;
+        ra.facts.itemGuid = missingBidItemGuid;
+        ra.facts.itemTemplate = 19019u;
+        ra.facts.randomPropertyId = 0;
+        ra.facts.sellerGuid = 1u;           // would get a payout mail if wrongly paid
+        ra.facts.deposit = 30u;
+        ra.facts.effectiveBid = 700u;
+        ra.facts.curBid = 700u;
+        ra.facts.curBidderGuid = 99999u;    // REAL winner, but NO live bid row seeded
+        ra.facts.buyout = 700u;
+
+        if (AhHandleResolveApply(ra) != uint8(RES_FAILED))
+        {
+            printf("ahresolve FAIL: WON-fail-closed not RES_FAILED\n");
+            pass = false;
+        }
+        if (CustodyService::ResolutionApplied(0xB5ull))
+        {
+            printf("ahresolve FAIL: WON-fail-closed wrote applied-record\n");
+            pass = false;
+        }
+        if (mailCount(730u, "19019:0:2") != 0u)    // seller must NOT be paid (700+30-cut0)
+        {
+            printf("ahresolve FAIL: WON-fail-closed paid the seller\n");
+            pass = false;
+        }
+        if (rowState("dep:991005") != 0u)          // rolled back -> still RESERVED
+        {
+            printf("ahresolve FAIL: WON-fail-closed dep row not rolled back\n");
+            pass = false;
+        }
+        if (rowState("item:991005") != 0u)         // rolled back -> still RESERVED
+        {
+            printf("ahresolve FAIL: WON-fail-closed item row not rolled back\n");
+            pass = false;
+        }
+
+        if (Item* leftover = sAuctionMgr.GetAItem(missingBidItemGuid))
+        {
+            sAuctionMgr.RemoveAItem(missingBidItemGuid);
+            delete leftover;
+        }
+        CharacterDatabase.DirectPExecute(
+            "DELETE FROM `item_instance` WHERE `guid`=%u", missingBidItemGuid);
+    }
+
+    // ---- RESOLVE_EXPIRED_NOBID: deposit forfeit + item returned ----
+    {
+        Item* expiredItem = TestCreateCachedAuctionItem(19019u, 1u);
+        if (!expiredItem)
+        {
+            printf("ahresolve FAIL: create expired escrow item\n");
+            return 2;
+        }
+        uint32 const expiredItemGuid = expiredItem->GetGUIDLow();
+
+        CharacterDatabase.BeginTransaction();
+        CharacterDatabase.PExecute(
+            "INSERT INTO `custody_ledger` "
+            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+            "VALUES ('dep:991002',0,0,0,1,0,40,0,991002,0,0),"
+            "       ('item:991002',1,3,0,1,0,0,%u,991002,0,0)",
+            expiredItemGuid);
+        if (!CharacterDatabase.CommitTransactionChecked())
+        {
+            printf("ahresolve FAIL: seed commit (expired)\n");
+            return 2;
+        }
+
+        ResolveApply ra;
+        ra.uuid = 0xB2ull;
+        ra.kind = uint8(RESOLVE_EXPIRED_NOBID);
+        ra.facts = MutationFacts();
+        ra.facts.auctionId = 991002u;
+        ra.facts.houseId = 7;
+        ra.facts.itemGuid = expiredItemGuid;
+        ra.facts.itemTemplate = 19019u;
+        ra.facts.sellerGuid = 1u;
+        ra.facts.deposit = 40u;
+
+        if (AhHandleResolveApply(ra) != uint8(RES_APPLIED))
+        {
+            printf("ahresolve FAIL: EXPIRED not RES_APPLIED\n");
+            pass = false;
+        }
+        if (rowState("dep:991002") != 1u)          // forfeit -> TERMINAL_OK
+        {
+            printf("ahresolve FAIL: EXPIRED deposit not forfeit (TERMINAL_OK)\n");
+            pass = false;
+        }
+        if (rowState("item:991002") != 1u)         // returned -> TERMINAL_OK
+        {
+            printf("ahresolve FAIL: EXPIRED item not TERMINAL_OK\n");
+            pass = false;
+        }
+        if (!CustodyService::ResolutionApplied(0xB2ull))
+        {
+            printf("ahresolve FAIL: EXPIRED applied-record missing\n");
+            pass = false;
+        }
+        if (AhHandleResolveApply(ra) != uint8(RES_DUPLICATE))
+        {
+            printf("ahresolve FAIL: EXPIRED second apply not RES_DUPLICATE\n");
+            pass = false;
+        }
+    }
+
+    // ---- RESOLVE_WON bot buyout: refund the displaced real bidder ----
+    {
+        Item* botWinItem = TestCreateCachedAuctionItem(19019u, 2u);
+        if (!botWinItem)
+        {
+            printf("ahresolve FAIL: create bot-win escrow item\n");
+            return 2;
+        }
+        uint32 const botWinItemGuid = botWinItem->GetGUIDLow();
+
+        CharacterDatabase.BeginTransaction();
+        CharacterDatabase.PExecute(
+            "INSERT INTO `custody_ledger` "
+            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+            "VALUES ('bid:991006:1',0,1,0,1,0,401,0,991006,0,0),"
+            "       ('dep:991006',0,0,0,2,0,50,0,991006,0,0),"
+            "       ('item:991006',1,3,0,2,0,0,%u,991006,0,0)", botWinItemGuid);
+        if (!CharacterDatabase.CommitTransactionChecked())
+        {
+            printf("ahresolve FAIL: seed commit (bot buyout)\n");
+            return 2;
+        }
+
+        ResolveApply ra;
+        ra.uuid = 0xB6ull;
+        ra.kind = uint8(RESOLVE_WON);
+        ra.facts = MutationFacts();
+        ra.facts.auctionId = 991006u;
+        ra.facts.houseId = 7u;
+        ra.facts.itemGuid = botWinItemGuid;
+        ra.facts.itemTemplate = 19019u;
+        ra.facts.randomPropertyId = 0;
+        ra.facts.sellerGuid = 2u;
+        ra.facts.deposit = 50u;
+        ra.facts.effectiveBid = 800u;
+        ra.facts.curBid = 800u;
+        ra.facts.curBidderGuid = 0u;
+        ra.facts.priorBidderGuid = 1u;
+        ra.facts.priorBidAmount = 401u;
+        ra.facts.buyout = 800u;
+
+        if (AhHandleResolveApply(ra) != uint8(RES_APPLIED))
+        {
+            printf("ahresolve FAIL: bot buyout not RES_APPLIED\n");
+            pass = false;
+        }
+        if (rowState("bid:991006:1") != CST_TERMINAL_BACK)
+        {
+            printf("ahresolve FAIL: bot buyout consumed displaced player "
+                   "bid\n");
+            pass = false;
+        }
+        if (mailCount(401u, "19019:0:0") != 1u)
+        {
+            printf("ahresolve FAIL: bot buyout prior-bidder refund missing\n");
+            pass = false;
+        }
+        if (!CustodyService::ResolutionApplied(ra.uuid))
+        {
+            printf("ahresolve FAIL: bot buyout applied-record missing\n");
+            pass = false;
+        }
+        std::unique_ptr<QueryResult> durableItem(CharacterDatabase.PQuery(
+            "SELECT 1 FROM `item_instance` WHERE `guid`=%u", botWinItemGuid));
+        if (rowState("item:991006") != CST_TERMINAL_OK ||
+            sAuctionMgr.GetAItem(botWinItemGuid) || durableItem)
+        {
+            printf("ahresolve FAIL: bot buyout did not consume terminal "
+                   "item\n");
+            pass = false;
+        }
+        if (AhHandleResolveApply(ra) != uint8(RES_DUPLICATE) ||
+            mailCount(401u, "19019:0:0") != 1u)
+        {
+            printf("ahresolve FAIL: bot buyout duplicate double-refunded\n");
+            pass = false;
+        }
+
+        if (Item* leftover = sAuctionMgr.GetAItem(botWinItemGuid))
+        {
+            sAuctionMgr.RemoveAItem(botWinItemGuid);
+            delete leftover;
+        }
+        CharacterDatabase.DirectPExecute(
+            "DELETE FROM `mail_items` WHERE `item_guid`=%u", botWinItemGuid);
+        CharacterDatabase.DirectPExecute(
+            "DELETE FROM `item_instance` WHERE `guid`=%u", botWinItemGuid);
+    }
+
+    // ---- RESOLVE_CANCELLED_UNLOCK: cut released to seller, no item/bid move ----
+    // The cut key is uuid-salted in production ("cut:<auc>:<uuid>"), so this
+    // exercises the by-auction cut scan (AhFindLiveCutRow), not a point key.
+    {
+        CharacterDatabase.BeginTransaction();
+        CharacterDatabase.PExecute(
+            "INSERT INTO `custody_ledger` "
+            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+            "VALUES ('cut:991003:12345',0,2,0,1,0,55,0,991003,0,0)");
+        if (!CharacterDatabase.CommitTransactionChecked())
+        {
+            printf("ahresolve FAIL: seed commit (cancelled)\n");
+            return 2;
+        }
+
+        ResolveApply ra;
+        ra.uuid = 0xB3ull;
+        ra.kind = uint8(RESOLVE_CANCELLED_UNLOCK);
+        ra.facts = MutationFacts();
+        ra.facts.auctionId = 991003u;
+        ra.facts.sellerGuid = 1u;
+
+        uint64 const before = readMoney();
+        if (AhHandleResolveApply(ra) != uint8(RES_APPLIED))
+        {
+            printf("ahresolve FAIL: CANCELLED not RES_APPLIED\n");
+            pass = false;
+        }
+        if (rowState("cut:991003:12345") != 2u)    // released -> TERMINAL_BACK
+        {
+            printf("ahresolve FAIL: CANCELLED cut not TERMINAL_BACK\n");
+            pass = false;
+        }
+        if (readMoney() != before + 55u)
+        {
+            printf("ahresolve FAIL: CANCELLED cut not credited to seller\n");
+            pass = false;
+        }
+        if (!CustodyService::ResolutionApplied(0xB3ull))
+        {
+            printf("ahresolve FAIL: CANCELLED applied-record missing\n");
+            pass = false;
+        }
+
+        uint64 const afterFirst = readMoney();
+        if (AhHandleResolveApply(ra) != uint8(RES_DUPLICATE))
+        {
+            printf("ahresolve FAIL: CANCELLED second apply not RES_DUPLICATE\n");
+            pass = false;
+        }
+        if (readMoney() != afterFirst)
+        {
+            printf("ahresolve FAIL: CANCELLED duplicate double-credited\n");
+            pass = false;
+        }
+    }
+
+    // ---- RESOLVE_REPAIR_RETURN (bot displaced a player): prior-bidder refund ----
+    {
+        CharacterDatabase.BeginTransaction();
+        CharacterDatabase.PExecute(
+            "INSERT INTO `custody_ledger` "
+            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+            "VALUES ('bid:991004:1',0,1,0,1,0,400,0,991004,0,0)");
+        if (!CharacterDatabase.CommitTransactionChecked())
+        {
+            printf("ahresolve FAIL: seed commit (repair)\n");
+            return 2;
+        }
+
+        ResolveApply ra;
+        ra.uuid = 0xB4ull;
+        ra.kind = uint8(RESOLVE_REPAIR_RETURN);
+        ra.facts = MutationFacts();
+        ra.facts.auctionId = 991004u;
+        ra.facts.houseId = 7;
+        ra.facts.itemTemplate = 19019u;
+        ra.facts.randomPropertyId = 0;
+        ra.facts.sellerGuid = 2u;
+        ra.facts.curBidderGuid = 0u;        // a bot now holds the top bid
+        ra.facts.priorBidderGuid = 1u;      // displaced real player
+        ra.facts.priorBidAmount = 400u;
+
+        if (AhHandleResolveApply(ra) != uint8(RES_APPLIED))
+        {
+            printf("ahresolve FAIL: REPAIR not RES_APPLIED\n");
+            pass = false;
+        }
+        if (rowState("bid:991004:1") != 2u)        // prior bid -> TERMINAL_BACK
+        {
+            printf("ahresolve FAIL: REPAIR prior bid not TERMINAL_BACK\n");
+            pass = false;
+        }
+        if (mailCount(400u, "19019:0:0") != 1u)    // outbid refund to guid 1
+        {
+            printf("ahresolve FAIL: REPAIR prior-bidder refund mail missing\n");
+            pass = false;
+        }
+        if (!CustodyService::ResolutionApplied(0xB4ull))
+        {
+            printf("ahresolve FAIL: REPAIR applied-record missing\n");
+            pass = false;
+        }
+        if (AhHandleResolveApply(ra) != uint8(RES_DUPLICATE))
+        {
+            printf("ahresolve FAIL: REPAIR second apply not RES_DUPLICATE\n");
+            pass = false;
+        }
+        if (mailCount(400u, "19019:0:0") != 1u)
+        {
+            printf("ahresolve FAIL: REPAIR duplicate double-refunded\n");
+            pass = false;
+        }
+    }
+
+    // Clean up.
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `custody_ledger` WHERE `auction_id` IN "
+        "(991001,991002,991003,991004,991005,991006)");
+    CharacterDatabase.DirectExecute(
+        "DELETE ii FROM `item_instance` ii "
+        "JOIN `mail_items` mi ON mi.`item_guid`=ii.`guid` "
+        "JOIN `mail` m ON m.`id`=mi.`mail_id` "
+        "WHERE m.`receiver` IN (1,2) AND m.`subject` LIKE '19019:%'");
+    CharacterDatabase.DirectExecute(
+        "DELETE mi FROM `mail_items` mi JOIN `mail` m ON m.`id`=mi.`mail_id` "
+        "WHERE m.`receiver` IN (1,2) AND m.`subject` LIKE '19019:%'");
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `mail` WHERE `receiver` IN (1,2) "
+        "AND `subject` LIKE '19019:%'");
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `characters` WHERE `guid` IN (1,2)");
+
+    if (pass)
+    {
+        printf("ahresolve OK\n");
+        return 0;
+    }
+    return 2;
+}
+
+/// Route and conservation regressions for seller custody and bid custody as
+/// independent dimensions. Uses only disposable Character DB fixtures.
+static int RunAhCustodyRouteTest()
+{
+    bool pass = true;
+    CharacterDatabase.AllowAsyncTransactions();
+    sObjectMgr.LoadItemPrototypes();
+
+    uint32 itemId = 2589u;
+    if (!ObjectMgr::GetItemPrototype(itemId))
+    {
+        std::unique_ptr<QueryResult> result(WorldDatabase.Query(
+            "SELECT `entry` FROM `item_template` "
+            "WHERE `InventoryType`=0 AND `stackable`>1 ORDER BY `entry` LIMIT 1"));
+        if (result)
+        {
+            itemId = result->Fetch()[0].GetUInt32();
+        }
+    }
+    if (!ObjectMgr::GetItemPrototype(itemId))
+    {
+        printf("ahcustodyroute FAIL: no usable item prototype\n");
+        return 2;
+    }
+
+    uint32 const sellerGuid = 9501u;
+    uint32 const bidderGuid = 9502u;
+    uint32 const otherBidderGuid = 9503u;
+    uint64 const now = static_cast<uint64>(time(NULL));
+    uint64 const oldTime = now > 7200u ? now - 7200u : 1u;
+    std::vector<uint32> itemGuids;
+
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `mail_items` WHERE `receiver` IN (9501,9502,9503)");
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `mail` WHERE `receiver` IN (9501,9502,9503)");
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `custody_ledger` WHERE `auction_id` BETWEEN 995100 AND 995199");
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `auction` WHERE `id` BETWEEN 995100 AND 995199");
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `item_instance` WHERE `owner_guid` IN (9501,9502,9503)");
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `characters` WHERE `guid` IN (9501,9502,9503)");
+    CharacterDatabase.DirectExecute(
+        "INSERT INTO `characters` (`guid`,`account`,`name`,`money`) VALUES "
+        "(9501,9501,'AhRtSeller',1000),"
+        "(9502,9502,'AhRtBidder',1000),"
+        "(9503,9503,'AhRtOther',1000)");
+    sObjectMgr.SetHighestGuids();
+
+    AuctionHouseEntry house = {};
+    house.houseId = 7;
+    house.faction = 0;
+    house.depositPercent = 5;
+    house.cutPercent = 5;
+
+    auto seedRow = [oldTime](std::string const& key, uint8 kind, uint8 role,
+                             uint32 owner, uint32 amount, uint32 itemGuid,
+                             uint32 auctionId)
+    {
+        CharacterDatabase.DirectPExecute(
+            "INSERT INTO `custody_ledger` "
+            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+            "VALUES ('%s',%u,%u,0,%u,0,%u,%u,%u," UI64FMTD ",0)",
+            key.c_str(), uint32(kind), uint32(role), owner, amount,
+            itemGuid, auctionId, oldTime);
+    };
+
+    auto createAuction = [&](uint32 auctionId, uint32 owner, uint32 bidder,
+                             uint32 bid, uint32 buyout,
+                             uint32 deposit) -> AuctionEntry*
+    {
+        Item* item = Item::CreateItem(itemId, 1);
+        if (!item)
+        {
+            return NULL;
+        }
+        item->SetOwnerGuid(ObjectGuid(HIGHGUID_PLAYER, owner));
+        itemGuids.push_back(item->GetGUIDLow());
+
+        AuctionEntry* auction = new AuctionEntry();
+        auction->Id = auctionId;
+        auction->itemGuidLow = item->GetGUIDLow();
+        auction->itemTemplate = itemId;
+        auction->itemCount = 1;
+        auction->itemRandomPropertyId = 0;
+        auction->owner = owner;
+        auction->startbid = 10;
+        auction->bid = bid;
+        auction->buyout = buyout;
+        auction->expireTime = static_cast<time_t>(now + HOUR);
+        auction->bidder = bidder;
+        auction->deposit = deposit;
+        auction->auctionHouseEntry = &house;
+
+        CharacterDatabase.BeginTransaction();
+        item->SaveToDB();
+        auction->SaveToDB();
+        if (!CharacterDatabase.CommitTransactionChecked())
+        {
+            delete item;
+            delete auction;
+            return NULL;
+        }
+        sAuctionMgr.AddAItem(item);
+        return auction;
+    };
+
+    auto rowState = [](std::string const& key) -> uint32
+    {
+        CustodyRow row;
+        return CustodyLedger::Get(key, row) ? uint32(row.state) : 255u;
+    };
+    auto auctionExists = [](uint32 auctionId) -> bool
+    {
+        return CustodyLedger::AuctionExists(auctionId);
+    };
+    auto mailCount = [itemId](uint32 receiver, MailAuctionAnswers answer) -> uint32
+    {
+        std::unique_ptr<QueryResult> result(CharacterDatabase.PQuery(
+            "SELECT COUNT(*) FROM `mail` WHERE `receiver`=%u "
+            "AND `subject`='%u:0:%u'", receiver, itemId, uint32(answer)));
+        return result ? result->Fetch()[0].GetUInt32() : 0u;
+    };
+    auto mailMoney = [itemId](uint32 receiver, MailAuctionAnswers answer) -> uint64
+    {
+        std::unique_ptr<QueryResult> result(CharacterDatabase.PQuery(
+            "SELECT COALESCE(SUM(`money`),0) FROM `mail` WHERE `receiver`=%u "
+            "AND `subject`='%u:0:%u'", receiver, itemId, uint32(answer)));
+        return result ? result->Fetch()[0].GetUInt64() : 0u;
+    };
+    auto itemMailCount = [](uint32 receiver, uint32 itemGuid) -> uint32
+    {
+        std::unique_ptr<QueryResult> result(CharacterDatabase.PQuery(
+            "SELECT COUNT(*) FROM `mail_items` WHERE `receiver`=%u AND `item_guid`=%u",
+            receiver, itemGuid));
+        return result ? result->Fetch()[0].GetUInt32() : 0u;
+    };
+    auto characterMoney = [](uint32 guid) -> uint32
+    {
+        std::unique_ptr<QueryResult> result(CharacterDatabase.PQuery(
+            "SELECT `money` FROM `characters` WHERE `guid`=%u", guid));
+        return result ? result->Fetch()[0].GetUInt32() : 0u;
+    };
+    auto sellerRows = [](uint32 auctionId) -> uint32
+    {
+        std::unique_ptr<QueryResult> result(CharacterDatabase.PQuery(
+            "SELECT COUNT(*) FROM `custody_ledger` WHERE `auction_id`=%u "
+            "AND `state`=0 AND (`idem_key` IN ('item:%u','dep:%u') "
+            "OR `role` IN (%u,%u))",
+            auctionId, auctionId, auctionId,
+            uint32(ROLE_ITEM), uint32(ROLE_DEPOSIT)));
+        return result ? result->Fetch()[0].GetUInt32() : 0u;
+    };
+    auto clearFixtureMail = []()
+    {
+        CharacterDatabase.DirectExecute(
+            "DELETE FROM `mail_items` WHERE `receiver` IN (9501,9502,9503)");
+        CharacterDatabase.DirectExecute(
+            "DELETE FROM `mail` WHERE `receiver` IN (9501,9502,9503)");
+    };
+
+    // Exact runtime route matrix, including the seller-only unsold-expiry fact.
+    seedRow("item:995101", CUSTODY_ITEM, ROLE_ITEM,
+            sellerGuid, 0, 1, 995101);
+    seedRow("dep:995101", CUSTODY_GOLD, ROLE_DEPOSIT,
+            sellerGuid, 5, 0, 995101);
+    seedRow("bid:995102:1", CUSTODY_GOLD, ROLE_BID,
+            bidderGuid, 20, 0, 995102);
+    seedRow("resolve:test:995103", CUSTODY_GOLD, ROLE_RESOLUTION,
+            0, 0, 0, 995103);
+    seedRow("botlist:test:995104", CUSTODY_ITEM, ROLE_RESOLUTION,
+            TEST_BOT_OWNER_GUID, 0, 4, 995104);
+    seedRow("botlist:test:995105", CUSTODY_ITEM, ROLE_RESOLUTION,
+            TEST_BOT_OWNER_GUID, 0, 5, 995105);
+    seedRow("bid:995105:1", CUSTODY_GOLD, ROLE_BID,
+            bidderGuid, 50, 0, 995105);
+    seedRow("botlist:test:995106", CUSTODY_ITEM, ROLE_RESOLUTION,
+            TEST_BOT_OWNER_GUID, 0, 6, 995106);
+    seedRow("item:995106", CUSTODY_ITEM, ROLE_ITEM,
+            TEST_BOT_OWNER_GUID, 0, 6, 995106);
+
+    struct RouteExpectation
+    {
+        uint32 auctionId;
+        bool seller;
+        bool bid;
+    };
+    RouteExpectation const routeExpectations[] = {
+        { 995101, true,  false },
+        { 995102, false, true  },
+        { 995103, false, false },
+        { 995104, false, false },
+        { 995105, false, true  },
+        { 995106, false, false },
+    };
+    for (size_t i = 0; i < sizeof(routeExpectations) / sizeof(routeExpectations[0]); ++i)
+    {
+        CustodyRouteState const route =
+            CustodyLedger::GetRouteState(routeExpectations[i].auctionId);
+        if (route.usesPlayerSellerCustody != routeExpectations[i].seller ||
+            route.hasLiveBidCustody != routeExpectations[i].bid)
+        {
+            printf("ahcustodyroute FAIL: route matrix mismatch auction=%u\n",
+                   routeExpectations[i].auctionId);
+            pass = false;
+        }
+    }
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `custody_ledger` WHERE `auction_id` BETWEEN 995100 AND 995109");
+
+    // Marker-only first bid remains on the legacy path and creates no bid or
+    // seller custody while debiting/persisting exactly once.
+    {
+        uint32 const auctionId = 995110;
+        AuctionEntry* auction = createAuction(
+            auctionId, sellerGuid, 0, 0, 0, 20);
+        if (!auction)
+        {
+            printf("ahcustodyroute FAIL: legacy first-bid fixture creation\n");
+            pass = false;
+        }
+        else
+        {
+            seedRow("botlist:test:995110", CUSTODY_ITEM, ROLE_RESOLUTION,
+                    TEST_BOT_OWNER_GUID, 0, auction->itemGuidLow, auctionId);
+            CustodyRouteState const route = CustodyLedger::GetRouteState(auctionId);
+            WorldSession session(9502, std::shared_ptr<proto::IClientLink>(),
+                                 std::shared_ptr<SessionMailbox>(), SEC_PLAYER,
+                                 0, LOCALE_enUS);
+            Player bidder(&session);
+            session.SetPlayer(&bidder);
+            bidder._Create(bidderGuid, HIGHGUID_PLAYER);
+            bidder.SetMoney(1000);
+            bool const active = auction->UpdateBid(100, &bidder);
+            CharacterDatabase.BeginTransaction();
+            CharacterDatabase.CommitTransactionChecked();
+
+            std::unique_ptr<QueryResult> persisted(CharacterDatabase.PQuery(
+                "SELECT `buyguid`,`lastbid` FROM `auction` WHERE `id`=%u",
+                auctionId));
+            std::unique_ptr<QueryResult> bidRows(CharacterDatabase.PQuery(
+                "SELECT COUNT(*) FROM `custody_ledger` WHERE `auction_id`=%u "
+                "AND `state`=0 AND `role`=%u",
+                auctionId, uint32(ROLE_BID)));
+            if (route.usesPlayerSellerCustody || route.hasLiveBidCustody ||
+                !active || bidder.GetMoney() != 900 ||
+                characterMoney(bidderGuid) != 900 || !persisted ||
+                persisted->Fetch()[0].GetUInt32() != bidderGuid ||
+                persisted->Fetch()[1].GetUInt32() != 100 || !bidRows ||
+                bidRows->Fetch()[0].GetUInt32() != 0 ||
+                rowState("botlist:test:995110") != CST_RESERVED)
+            {
+                printf("ahcustodyroute FAIL: marker-only first bid left legacy behavior\n");
+                pass = false;
+            }
+            session.SetPlayer(NULL);
+
+            Item* liveItem = sAuctionMgr.GetAItem(auction->itemGuidLow);
+            sAuctionMgr.RemoveAItem(auction->itemGuidLow);
+            delete liveItem;
+            delete auction;
+            CharacterDatabase.DirectPExecute(
+                "DELETE FROM `auction` WHERE `id`=%u", auctionId);
+            CharacterDatabase.DirectPExecute(
+                "DELETE FROM `custody_ledger` WHERE `auction_id`=%u", auctionId);
+        }
+    }
+
+    // Bid-winning expiry on a bot listing: seller and winner settlement remains
+    // legacy-equivalent, while only the player bid row is terminalized.
+    {
+        clearFixtureMail();
+        uint32 const auctionId = 995120;
+        AuctionEntry* auction = createAuction(
+            auctionId, sellerGuid, bidderGuid, 100, 0, 20);
+        if (!auction)
+        {
+            printf("ahcustodyroute FAIL: bid-only win fixture creation\n");
+            pass = false;
+        }
+        else
+        {
+            uint32 const itemGuid = auction->itemGuidLow;
+            std::string const markerKey = "botlist:test:995120";
+            std::string const bidKey = "bid:995120:1";
+            seedRow(markerKey, CUSTODY_ITEM, ROLE_RESOLUTION,
+                    TEST_BOT_OWNER_GUID, 0, itemGuid, auctionId);
+            seedRow(bidKey, CUSTODY_GOLD, ROLE_BID,
+                    bidderGuid, 100, 0, auctionId);
+            CustodyRouteState const route = CustodyLedger::GetRouteState(auctionId);
+            CustodyDeferred def;
+            CharacterDatabase.BeginTransaction();
+            AhAuctionBidWinningCustody(*auction, NULL, def,
+                                       route.usesPlayerSellerCustody,
+                                       route.hasLiveBidCustody, bidKey);
+            bool const committed = CharacterDatabase.CommitTransactionChecked();
+            if (committed)
+            {
+                def.run();
+            }
+            if (!committed || route.usesPlayerSellerCustody ||
+                !route.hasLiveBidCustody || auctionExists(auctionId) ||
+                rowState(bidKey) != CST_TERMINAL_OK ||
+                rowState(markerKey) != CST_RESERVED || sellerRows(auctionId) != 0 ||
+                mailCount(sellerGuid, AUCTION_SUCCESSFUL) != 1 ||
+                mailMoney(sellerGuid, AUCTION_SUCCESSFUL) == 0 ||
+                mailCount(bidderGuid, AUCTION_WON) != 1 ||
+                itemMailCount(bidderGuid, itemGuid) != 1)
+            {
+                printf("ahcustodyroute FAIL: bid-only winning expiry conservation\n");
+                pass = false;
+            }
+        }
+    }
+
+    // Same-bidder buyout preserves bot provenance, debits only the delta, and
+    // terminalizes the existing bid row without inventing seller rows.
+    {
+        clearFixtureMail();
+        uint32 const auctionId = 995121;
+        AuctionEntry* auction = createAuction(
+            auctionId, sellerGuid, bidderGuid, 40, 100, 20);
+        if (!auction)
+        {
+            printf("ahcustodyroute FAIL: buyout fixture creation\n");
+            pass = false;
+        }
+        else
+        {
+            uint32 const itemGuid = auction->itemGuidLow;
+            std::string const markerKey = "botlist:test:995121";
+            std::string const bidKey = "bid:995121:1";
+            seedRow(markerKey, CUSTODY_ITEM, ROLE_RESOLUTION,
+                    TEST_BOT_OWNER_GUID, 0, itemGuid, auctionId);
+            seedRow(bidKey, CUSTODY_GOLD, ROLE_BID,
+                    bidderGuid, 40, 0, auctionId);
+
+            CharacterDatabase.DirectPExecute(
+                "UPDATE `characters` SET `money`=1000 WHERE `guid`=%u",
+                bidderGuid);
+            WorldSession session(9502, std::shared_ptr<proto::IClientLink>(),
+                                 std::shared_ptr<SessionMailbox>(), SEC_PLAYER,
+                                 0, LOCALE_enUS);
+            Player bidder(&session);
+            session.SetPlayer(&bidder);
+            bidder._Create(bidderGuid, HIGHGUID_PLAYER);
+            bidder.SetMoney(1000);
+
+            CustodyDeferred def;
+            CharacterDatabase.BeginTransaction();
+            bool const active = AhUpdateBidCustody(*auction,
+                100, &bidder, def, false, true, bidKey);
+            bool const committed = CharacterDatabase.CommitTransactionChecked();
+            if (committed)
+            {
+                def.run();
+            }
+            if (!committed || active || bidder.GetMoney() != 940 ||
+                characterMoney(bidderGuid) != 940 || auctionExists(auctionId) ||
+                rowState(bidKey) != CST_TERMINAL_OK ||
+                rowState(markerKey) != CST_RESERVED || sellerRows(auctionId) != 0 ||
+                mailCount(sellerGuid, AUCTION_SUCCESSFUL) != 1 ||
+                itemMailCount(bidderGuid, itemGuid) != 1)
+            {
+                printf("ahcustodyroute FAIL: bid-only buyout conservation\n");
+                pass = false;
+            }
+            session.SetPlayer(NULL);
+        }
+    }
+
+    // Owner cancel on a bot listing refunds the bidder and returns the item,
+    // while only bid custody transitions and the bot marker remains reserved.
+    {
+        clearFixtureMail();
+        uint32 const auctionId = 995122;
+        AuctionEntry* auction = createAuction(
+            auctionId, sellerGuid, otherBidderGuid, 100, 0, 20);
+        if (!auction)
+        {
+            printf("ahcustodyroute FAIL: cancel fixture creation\n");
+            pass = false;
+        }
+        else
+        {
+            uint32 const itemGuid = auction->itemGuidLow;
+            std::string const markerKey = "botlist:test:995122";
+            std::string const bidKey = "bid:995122:1";
+            seedRow(markerKey, CUSTODY_ITEM, ROLE_RESOLUTION,
+                    TEST_BOT_OWNER_GUID, 0, itemGuid, auctionId);
+            seedRow(bidKey, CUSTODY_GOLD, ROLE_BID,
+                    otherBidderGuid, 100, 0, auctionId);
+
+            CharacterDatabase.DirectPExecute(
+                "UPDATE `characters` SET `money`=1000 WHERE `guid`=%u",
+                sellerGuid);
+            WorldSession session(9501, std::shared_ptr<proto::IClientLink>(),
+                                 std::shared_ptr<SessionMailbox>(), SEC_PLAYER,
+                                 0, LOCALE_enUS);
+            Player seller(&session);
+            session.SetPlayer(&seller);
+            seller._Create(sellerGuid, HIGHGUID_PLAYER);
+            seller.SetMoney(1000);
+            uint32 const cut = auction->GetAuctionCut();
+
+            CustodyDeferred def;
+            CharacterDatabase.BeginTransaction();
+            AhPrepareCancelCustody(*auction, &seller, def, false, true,
+                                   bidKey, cut);
+            bool const committed = CharacterDatabase.CommitTransactionChecked();
+            if (committed)
+            {
+                def.run();
+            }
+            if (!committed || auctionExists(auctionId) ||
+                seller.GetMoney() != 1000 - cut ||
+                characterMoney(sellerGuid) != 1000 - cut ||
+                rowState(bidKey) != CST_TERMINAL_BACK ||
+                rowState(markerKey) != CST_RESERVED || sellerRows(auctionId) != 0 ||
+                mailCount(otherBidderGuid, AUCTION_CANCELLED_TO_BIDDER) != 1 ||
+                mailMoney(otherBidderGuid, AUCTION_CANCELLED_TO_BIDDER) != 100 ||
+                mailCount(sellerGuid, AUCTION_CANCELED) != 1 ||
+                itemMailCount(sellerGuid, itemGuid) != 1)
+            {
+                printf("ahcustodyroute FAIL: bid-only cancel conservation\n");
+                pass = false;
+            }
+            session.SetPlayer(NULL);
+            delete auction;
+        }
+    }
+
+    // A same-bidder raise can meet player-seller custody layered over a legacy
+    // bid. Debit only the delta, then represent the full standing bid in one row.
+    {
+        clearFixtureMail();
+        uint32 const auctionId = 995124;
+        AuctionEntry* auction = createAuction(
+            auctionId, sellerGuid, bidderGuid, 40, 0, 20);
+        if (!auction)
+        {
+            printf("ahcustodyroute FAIL: legacy same-bid fixture creation\n");
+            pass = false;
+        }
+        else
+        {
+            std::string const itemKey = "item:995124";
+            std::string const depKey = "dep:995124";
+            seedRow(itemKey, CUSTODY_ITEM, ROLE_ITEM,
+                    sellerGuid, 0, auction->itemGuidLow, auctionId);
+            seedRow(depKey, CUSTODY_GOLD, ROLE_DEPOSIT,
+                    sellerGuid, 20, 0, auctionId);
+
+            CharacterDatabase.DirectPExecute(
+                "UPDATE `characters` SET `money`=1000 WHERE `guid`=%u",
+                bidderGuid);
+            WorldSession session(9502, std::shared_ptr<proto::IClientLink>(),
+                                 std::shared_ptr<SessionMailbox>(), SEC_PLAYER,
+                                 0, LOCALE_enUS);
+            Player bidder(&session);
+            session.SetPlayer(&bidder);
+            bidder._Create(bidderGuid, HIGHGUID_PLAYER);
+            bidder.SetMoney(1000);
+
+            CustodyRouteState const route = CustodyLedger::GetRouteState(auctionId);
+            CustodyDeferred def;
+            CharacterDatabase.BeginTransaction();
+            bool const active = AhUpdateBidCustody(*auction,
+                60, &bidder, def, route.usesPlayerSellerCustody,
+                route.hasLiveBidCustody, "");
+            bool const committed = CharacterDatabase.CommitTransactionChecked();
+            if (committed)
+            {
+                def.run();
+            }
+
+            std::unique_ptr<QueryResult> bidRows(CharacterDatabase.PQuery(
+                "SELECT COUNT(*),COALESCE(MAX(`owner_guid`),0),"
+                "COALESCE(MAX(`amount`),0) FROM `custody_ledger` "
+                "WHERE `auction_id`=%u AND `state`=0 AND `role`=%u",
+                auctionId, uint32(ROLE_BID)));
+            Field* bidFields = bidRows ? bidRows->Fetch() : NULL;
+            if (!committed || !active || !route.usesPlayerSellerCustody ||
+                route.hasLiveBidCustody || bidder.GetMoney() != 980 ||
+                characterMoney(bidderGuid) != 980 || !auctionExists(auctionId) ||
+                auction->bidder != bidderGuid || auction->bid != 60 ||
+                !bidFields || bidFields[0].GetUInt32() != 1 ||
+                bidFields[1].GetUInt32() != bidderGuid ||
+                bidFields[2].GetUInt32() != 60 ||
+                rowState(itemKey) != CST_RESERVED ||
+                rowState(depKey) != CST_RESERVED)
+            {
+                printf("ahcustodyroute FAIL: legacy same-bid custody promotion\n");
+                pass = false;
+            }
+            session.SetPlayer(NULL);
+            delete auction;
+        }
+    }
+
+    // Replacing a legacy standing bid under player-seller custody preserves the
+    // old bidder's mail refund and starts custody only for the replacement bid.
+    {
+        clearFixtureMail();
+        uint32 const auctionId = 995125;
+        AuctionEntry* auction = createAuction(
+            auctionId, sellerGuid, otherBidderGuid, 40, 0, 20);
+        if (!auction)
+        {
+            printf("ahcustodyroute FAIL: legacy outbid fixture creation\n");
+            pass = false;
+        }
+        else
+        {
+            std::string const itemKey = "item:995125";
+            std::string const depKey = "dep:995125";
+            seedRow(itemKey, CUSTODY_ITEM, ROLE_ITEM,
+                    sellerGuid, 0, auction->itemGuidLow, auctionId);
+            seedRow(depKey, CUSTODY_GOLD, ROLE_DEPOSIT,
+                    sellerGuid, 20, 0, auctionId);
+
+            CharacterDatabase.DirectPExecute(
+                "UPDATE `characters` SET `money`=1000 WHERE `guid`=%u",
+                bidderGuid);
+            WorldSession session(9502, std::shared_ptr<proto::IClientLink>(),
+                                 std::shared_ptr<SessionMailbox>(), SEC_PLAYER,
+                                 0, LOCALE_enUS);
+            Player bidder(&session);
+            session.SetPlayer(&bidder);
+            bidder._Create(bidderGuid, HIGHGUID_PLAYER);
+            bidder.SetMoney(1000);
+
+            CustodyRouteState const route = CustodyLedger::GetRouteState(auctionId);
+            CustodyDeferred def;
+            CharacterDatabase.BeginTransaction();
+            bool const active = AhUpdateBidCustody(*auction,
+                60, &bidder, def, route.usesPlayerSellerCustody,
+                route.hasLiveBidCustody, "");
+            bool const committed = CharacterDatabase.CommitTransactionChecked();
+            if (committed)
+            {
+                def.run();
+            }
+
+            std::unique_ptr<QueryResult> bidRows(CharacterDatabase.PQuery(
+                "SELECT COUNT(*),COALESCE(MAX(`owner_guid`),0),"
+                "COALESCE(MAX(`amount`),0) FROM `custody_ledger` "
+                "WHERE `auction_id`=%u AND `state`=0 AND `role`=%u",
+                auctionId, uint32(ROLE_BID)));
+            Field* bidFields = bidRows ? bidRows->Fetch() : NULL;
+            if (!committed || !active || !route.usesPlayerSellerCustody ||
+                route.hasLiveBidCustody || bidder.GetMoney() != 940 ||
+                characterMoney(bidderGuid) != 940 || !auctionExists(auctionId) ||
+                !bidFields || bidFields[0].GetUInt32() != 1 ||
+                bidFields[1].GetUInt32() != bidderGuid ||
+                bidFields[2].GetUInt32() != 60 ||
+                mailCount(otherBidderGuid, AUCTION_OUTBIDDED) != 1 ||
+                mailMoney(otherBidderGuid, AUCTION_OUTBIDDED) != 40 ||
+                rowState(itemKey) != CST_RESERVED ||
+                rowState(depKey) != CST_RESERVED)
+            {
+                printf("ahcustodyroute FAIL: legacy bidder replacement\n");
+                pass = false;
+            }
+            session.SetPlayer(NULL);
+            delete auction;
+        }
+    }
+
+    // Bid-only custody never selects the unsold custody path. Even malformed
+    // no-bid book facts retain the legacy item return and leave bid provenance.
+    {
+        clearFixtureMail();
+        uint32 const auctionId = 995126;
+        AuctionEntry* auction = createAuction(
+            auctionId, sellerGuid, 0, 0, 0, 20);
+        if (!auction)
+        {
+            printf("ahcustodyroute FAIL: bid-only unsold fixture creation\n");
+            pass = false;
+        }
+        else
+        {
+            uint32 const itemGuid = auction->itemGuidLow;
+            std::string const markerKey = "botlist:test:995126";
+            std::string const bidKey = "bid:995126:1";
+            seedRow(markerKey, CUSTODY_ITEM, ROLE_RESOLUTION,
+                    TEST_BOT_OWNER_GUID, 0, itemGuid, auctionId);
+            seedRow(bidKey, CUSTODY_GOLD, ROLE_BID,
+                    bidderGuid, 50, 0, auctionId);
+            CustodyRouteState const route = CustodyLedger::GetRouteState(auctionId);
+            auction->expireTime = static_cast<time_t>(-1);
+            AuctionHouseObject* houseMap = sAuctionMgr.GetAuctionsMap(&house);
+            houseMap->AddAuction(auction);
+            houseMap->Update();
+            CharacterDatabase.BeginTransaction();
+            CharacterDatabase.CommitTransactionChecked();
+
+            bool const mapPresent = houseMap->GetAuction(auctionId) != NULL;
+            bool const dbPresent = auctionExists(auctionId);
+            uint32 const bidState = rowState(bidKey);
+            uint32 const markerState = rowState(markerKey);
+            uint32 const sellerRowCount = sellerRows(auctionId);
+            uint32 const expiredMailCount = mailCount(sellerGuid, AUCTION_EXPIRED);
+            uint32 const expiredItemCount = itemMailCount(sellerGuid, itemGuid);
+            if (route.usesPlayerSellerCustody || !route.hasLiveBidCustody ||
+                mapPresent || dbPresent || bidState != CST_RESERVED ||
+                markerState != CST_RESERVED || sellerRowCount != 0 ||
+                expiredMailCount != 1 || expiredItemCount != 1)
+            {
+                printf("ahcustodyroute FAIL: bid-only unsold routing "
+                       "route=%u/%u map=%u db=%u states=%u/%u seller=%u mail=%u/%u\n",
+                       uint32(route.usesPlayerSellerCustody),
+                       uint32(route.hasLiveBidCustody), uint32(mapPresent),
+                       uint32(dbPresent), bidState, markerState,
+                       sellerRowCount, expiredMailCount, expiredItemCount);
+                pass = false;
+            }
+        }
+    }
+
+    // Existing full player seller+bid custody still terminalizes all three
+    // value rows after a runtime custody disable. The flag stops maintenance
+    // and config-gated entry; it must not abandon durable rows already in flight.
+    {
+        clearFixtureMail();
+        uint32 const auctionId = 995123;
+        AuctionEntry* auction = createAuction(
+            auctionId, sellerGuid, bidderGuid, 100, 0, 20);
+        if (!auction)
+        {
+            printf("ahcustodyroute FAIL: full custody fixture creation\n");
+            pass = false;
+        }
+        else
+        {
+            uint32 const itemGuid = auction->itemGuidLow;
+            std::string const itemKey = "item:995123";
+            std::string const depKey = "dep:995123";
+            std::string const bidKey = "bid:995123:1";
+            seedRow(itemKey, CUSTODY_ITEM, ROLE_ITEM,
+                    sellerGuid, 0, itemGuid, auctionId);
+            seedRow(depKey, CUSTODY_GOLD, ROLE_DEPOSIT,
+                    sellerGuid, 20, 0, auctionId);
+            seedRow(bidKey, CUSTODY_GOLD, ROLE_BID,
+                    bidderGuid, 100, 0, auctionId);
+
+            auction->expireTime = static_cast<time_t>(-1);
+            AuctionHouseObject* houseMap = sAuctionMgr.GetAuctionsMap(&house);
+            houseMap->AddAuction(auction);
+            bool const custodyWasEnabled = sAhService.IsCustodyEnabled();
+            sAhService.SetCustody(false);
+            houseMap->Update();
+            sAhService.SetCustody(custodyWasEnabled);
+
+            if (auctionExists(auctionId) ||
+                rowState(itemKey) != CST_TERMINAL_OK ||
+                rowState(depKey) != CST_TERMINAL_BACK ||
+                rowState(bidKey) != CST_TERMINAL_OK ||
+                mailCount(sellerGuid, AUCTION_SUCCESSFUL) != 1 ||
+                mailCount(bidderGuid, AUCTION_WON) != 1 ||
+                itemMailCount(bidderGuid, itemGuid) != 1)
+            {
+                printf("ahcustodyroute FAIL: runtime-disable winning regression\n");
+                pass = false;
+            }
+        }
+    }
+
+    // Bot bids share the legacy UpdateBid entry point with the fallback buyer.
+    {
+        uint32 const auctionId = 995130u;
+        AuctionEntry* auction = createAuction(
+            auctionId, sellerGuid, bidderGuid, 100u, 0u, 20u);
+        if (!auction)
+        {
+            return 2;
+        }
+        seedRow("bid:995130:1", CUSTODY_GOLD, ROLE_BID,
+                bidderGuid, 100u, 0u, auctionId);
+        uint32 const refunds = mailCount(bidderGuid, AUCTION_OUTBIDDED);
+        uint64 const refundMoney = mailMoney(bidderGuid, AUCTION_OUTBIDDED);
+        auction->UpdateBid(120u);
+        CharacterDatabase.BeginTransaction();
+        CharacterDatabase.CommitTransactionChecked();
+        if (rowState("bid:995130:1") != CST_TERMINAL_BACK ||
+            auction->bidder != 0u || auction->bid != 120u ||
+            mailCount(bidderGuid, AUCTION_OUTBIDDED) != refunds + 1u ||
+            mailMoney(bidderGuid, AUCTION_OUTBIDDED) != refundMoney + 100u)
+        {
+            printf("ahcustodyroute FAIL: bot displacement stranded player bid\n");
+            pass = false;
+        }
+        AuctionHouseObject* map = sAuctionMgr.GetAuctionsMap(&house);
+        map->AddAuction(auction);
+        auction->expireTime = static_cast<time_t>(-1);
+        map->Update();
+        CharacterDatabase.BeginTransaction();
+        CharacterDatabase.CommitTransactionChecked();
+        if (auctionExists(auctionId))
+        {
+            printf("ahcustodyroute FAIL: bot-held auction could not expire\n");
+            pass = false;
+        }
+        if (AuctionEntry* leftover = map->GetAuction(auctionId))
+        {
+            map->RemoveAuction(auctionId);
+            delete leftover;
+        }
+    }
+
+    // A failed bot buyout must roll back refund, seller payout, book and escrow.
+    {
+        uint32 const auctionId = 995131u;
+        AuctionEntry* auction = createAuction(
+            auctionId, sellerGuid, bidderGuid, 100u, 200u, 20u);
+        if (!auction)
+        {
+            return 2;
+        }
+        uint32 const itemGuid = auction->itemGuidLow;
+        Item* const cached = sAuctionMgr.GetAItem(itemGuid);
+        seedRow("bid:995131:1", CUSTODY_GOLD, ROLE_BID,
+                bidderGuid, 100u, 0u, auctionId);
+        seedRow("item:995131", CUSTODY_ITEM, ROLE_ITEM,
+                sellerGuid, 0u, itemGuid, auctionId);
+        seedRow("dep:995131", CUSTODY_GOLD, ROLE_DEPOSIT,
+                sellerGuid, 20u, 0u, auctionId);
+        uint32 const refunds = mailCount(bidderGuid, AUCTION_OUTBIDDED);
+        uint64 const refundMoney = mailMoney(bidderGuid, AUCTION_OUTBIDDED);
+        uint32 const sales = mailCount(sellerGuid, AUCTION_SUCCESSFUL);
+        uint64 const salesMoney = mailMoney(sellerGuid, AUCTION_SUCCESSFUL);
+        uint32 const payout = 220u - uint32(house.cutPercent * 200u *
+            sWorld.getConfig(CONFIG_FLOAT_RATE_AUCTION_CUT) / 100.0f);
+        AuctionHouseObject* map = sAuctionMgr.GetAuctionsMap(&house);
+        map->AddAuction(auction);
+        std::string originalConfig;
+        std::string testConfig;
+        if (!TestArmCustodyCommitFailure("bot-bid", originalConfig, testConfig))
+        {
+            TestRestoreConfig(originalConfig, testConfig);
+            return 2;
+        }
+        auction->UpdateBid(200u);
+        bool const restored = TestRestoreConfig(originalConfig, testConfig);
+        CharacterDatabase.BeginTransaction();
+        CharacterDatabase.CommitTransactionChecked();
+        AuctionEntry* retry = map->GetAuction(auctionId);
+        if (!restored || !retry || !auctionExists(auctionId) ||
+            retry->bidder != bidderGuid || retry->bid != 100u ||
+            sAuctionMgr.GetAItem(itemGuid) != cached ||
+            rowState("bid:995131:1") != CST_RESERVED ||
+            rowState("item:995131") != CST_RESERVED ||
+            rowState("dep:995131") != CST_RESERVED ||
+            mailCount(bidderGuid, AUCTION_OUTBIDDED) != refunds ||
+            mailCount(sellerGuid, AUCTION_SUCCESSFUL) != sales)
+        {
+            printf("ahcustodyroute FAIL: failed bot buyout moved value\n");
+            pass = false;
+        }
+        if (retry)
+        {
+            retry->UpdateBid(200u);
+            CharacterDatabase.BeginTransaction();
+            CharacterDatabase.CommitTransactionChecked();
+            std::unique_ptr<QueryResult> itemRow(CharacterDatabase.PQuery(
+                "SELECT 1 FROM `item_instance` WHERE `guid`=%u", itemGuid));
+            if (auctionExists(auctionId) || map->GetAuction(auctionId) ||
+                sAuctionMgr.GetAItem(itemGuid) || itemRow ||
+                rowState("bid:995131:1") != CST_TERMINAL_BACK ||
+                rowState("item:995131") != CST_TERMINAL_OK ||
+                rowState("dep:995131") != CST_TERMINAL_BACK ||
+                mailCount(bidderGuid, AUCTION_OUTBIDDED) != refunds + 1u ||
+                mailMoney(bidderGuid, AUCTION_OUTBIDDED) != refundMoney + 100u ||
+                mailCount(sellerGuid, AUCTION_SUCCESSFUL) != sales + 1u ||
+                mailMoney(sellerGuid, AUCTION_SUCCESSFUL) != salesMoney + payout)
+            {
+                printf("ahcustodyroute FAIL: bot buyout retry did not settle once\n");
+                pass = false;
+            }
+        }
+        if (AuctionEntry* leftover = map->GetAuction(auctionId))
+        {
+            map->RemoveAuction(auctionId);
+            delete leftover;
+        }
+    }
+
+    for (size_t i = 0; i < itemGuids.size(); ++i)
+    {
+        Item* liveItem = sAuctionMgr.GetAItem(itemGuids[i]);
+        if (liveItem)
+        {
+            sAuctionMgr.RemoveAItem(itemGuids[i]);
+            delete liveItem;
+        }
+        CharacterDatabase.DirectPExecute(
+            "DELETE FROM `mail_items` WHERE `item_guid`=%u", itemGuids[i]);
+        CharacterDatabase.DirectPExecute(
+            "DELETE FROM `item_instance` WHERE `guid`=%u", itemGuids[i]);
+    }
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `mail` WHERE `receiver` IN (9501,9502,9503)");
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `custody_ledger` WHERE `auction_id` BETWEEN 995100 AND 995199");
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `auction` WHERE `id` BETWEEN 995100 AND 995199");
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `characters` WHERE `guid` IN (9501,9502,9503)");
+
+    if (pass)
+    {
+        printf("ahcustodyroute OK\n");
+        return 0;
+    }
+    return 2;
+}
+
+/// No-work routing must avoid SQL, while reservations survive config disable.
+static int RunAhRouteGateTest()
+{
+    CharacterDatabase.AllowAsyncTransactions();
+    std::unique_ptr<QueryResult> count(CharacterDatabase.Query(
+        "SELECT COUNT(*) FROM `custody_ledger` WHERE `state`=0"));
+    if (!count || count->Fetch()[0].GetUInt64() != 0u)
+    {
+        printf("ahroutegate FAIL: requires an empty disposable ledger\n");
+        return 2;
+    }
+    bool pass = true;
+    CustodyLedger::InitializeRouting();
+    if (!CharacterDatabase.DirectExecute(
+            "RENAME TABLE `custody_ledger` TO `custody_route_test_unavailable`"))
+    {
+        return 2;
+    }
+    // If routing attempts SQL despite known-empty startup, this becomes unknown.
+    CustodyRouteState const empty = CustodyLedger::GetRouteState(995190u);
+    bool const restored = CharacterDatabase.DirectExecute(
+        "RENAME TABLE `custody_route_test_unavailable` TO `custody_ledger`");
+    if (!restored)
+    {
+        printf("ahroutegate FAIL: could not restore ledger table\n");
+        return 2;
+    }
+    if (!empty.known || empty.usesPlayerSellerCustody || empty.hasLiveBidCustody)
+    {
+        printf("ahroutegate FAIL: known-empty route attempted SQL\n");
+        pass = false;
+    }
+    CharacterDatabase.BeginTransaction();
+    CustodyLedger::Insert(TestCustodyRow(0, "test:route-gate", CUSTODY_GOLD,
+        ROLE_BID, 9502u, 100u, 0u, 995190u));
+    if (!CharacterDatabase.CommitTransactionChecked())
+    {
+        return 2;
+    }
+    bool const wasEnabled = sAhService.IsCustodyEnabled();
+    sAhService.SetCustody(false);
+    CustodyRouteState const inserted = CustodyLedger::GetRouteState(995190u);
+    CustodyLedger::InitializeRouting();
+    CustodyRouteState const restarted = CustodyLedger::GetRouteState(995190u);
+    sAhService.SetCustody(wasEnabled);
+    if (!inserted.known || !inserted.hasLiveBidCustody ||
+        !restarted.known || !restarted.hasLiveBidCustody)
+    {
+        printf("ahroutegate FAIL: reservation lost after insertion/restart/disable\n");
+        pass = false;
+    }
+    if (!CharacterDatabase.DirectExecute(
+            "RENAME TABLE `custody_ledger` TO `custody_route_test_unavailable`"))
+    {
+        return 2;
+    }
+    CustodyLedger::InitializeRouting();
+    CustodyRouteState const failed = CustodyLedger::GetRouteState(995190u);
+    if (!CharacterDatabase.DirectExecute(
+            "RENAME TABLE `custody_route_test_unavailable` TO `custody_ledger`"))
+    {
+        return 2;
+    }
+    if (failed.known)
+    {
+        printf("ahroutegate FAIL: failed lookup treated as known legacy route\n");
+        pass = false;
+    }
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `custody_ledger` WHERE `idem_key`='test:route-gate'");
+    printf("ahroutegate %s\n", pass ? "OK" : "FAIL");
+    return pass ? 0 : 2;
+}
+
+/// Regression for a real SP-2 smoke failure: the worker committed a cancel and
+/// removed the auction, but mangosd missed the terminal result before restart.
+/// The pending map is then empty, so repair must replay from ah_worker_journal
+/// and mail the orphaned item_instance back to the seller, not merely
+/// terminalize the custody rows.
+static int RunAhRepairRecoveryTest()
+{
+    bool pass = true;
+    CharacterDatabase.AllowAsyncTransactions();
+
+    sObjectMgr.LoadItemPrototypes();
+
+    uint32 const ownerGuid = 1u;
+    uint32 const auctionId = 992001u;
+    uint64 const uuid = 0xABCD001ull;
+    uint64 const oldTime = static_cast<uint64>(time(NULL)) > 7200u
+        ? static_cast<uint64>(time(NULL)) - 7200u : 1u;
+
+    CharacterDatabase.DirectPExecute(
+        "DELETE FROM `custody_ledger` WHERE `auction_id`=%u", auctionId);
+    CharacterDatabase.DirectPExecute(
+        "DELETE FROM `ah_worker_journal` WHERE `auction_id`=%u OR `uuid`=%llu",
+        auctionId, static_cast<unsigned long long>(uuid));
+    CharacterDatabase.DirectPExecute(
+        "DELETE FROM `auction` WHERE `id`=%u", auctionId);
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `mail` WHERE `receiver`=1 AND `subject` LIKE '2589:%'");
+    CharacterDatabase.DirectExecute("DELETE FROM `characters` WHERE `guid`=1");
+    CharacterDatabase.DirectExecute(
+        "INSERT INTO `characters` (`guid`,`account`,`name`,`money`) "
+        "VALUES (1, 1, 'AhRepairRcv', 100000)");
+
+    sObjectMgr.SetHighestGuids();
+
+    uint32 itemId = 2589u;      // Linen Cloth
+    if (!ObjectMgr::GetItemPrototype(itemId))
+    {
+        std::unique_ptr<QueryResult> r(WorldDatabase.PQuery(
+            "SELECT `entry` FROM `item_template` "
+            "WHERE `InventoryType`=0 AND `stackable`>1 ORDER BY `entry` LIMIT 1"));
+        if (r)
+        {
+            itemId = r->Fetch()[0].GetUInt32();
+        }
+    }
+    if (!ObjectMgr::GetItemPrototype(itemId))
+    {
+        printf("ahrepair FAIL: no usable item prototype\n");
+        return 2;
+    }
+
+    Item* item = Item::CreateItem(itemId, 1);
+    if (!item)
+    {
+        printf("ahrepair FAIL: CreateItem returned NULL\n");
+        return 2;
+    }
+    item->SetOwnerGuid(ObjectGuid(HIGHGUID_PLAYER, ownerGuid));
+    uint32 const itemGuid = item->GetGUIDLow();
+
+    CharacterDatabase.BeginTransaction();
+    item->SaveToDB();
+    if (!CharacterDatabase.CommitTransactionChecked())
+    {
+        delete item;
+        printf("ahrepair FAIL: item seed commit failed\n");
+        return 2;
+    }
+    delete item;
+
+    PlayerMutationResult journalRes;
+    journalRes.uuid = uuid;
+    journalRes.op = uint8(IPC_PLAYER_CANCEL & 0xFFu);
+    journalRes.status = uint8(MUT_PREPARED);
+    journalRes.reason = 0;
+    journalRes.facts = MutationFacts();
+    journalRes.facts.auctionId = auctionId;
+    journalRes.facts.houseId = 7;
+    journalRes.facts.itemGuid = itemGuid;
+    journalRes.facts.itemTemplate = itemId;
+    journalRes.facts.randomPropertyId = 0;
+    journalRes.facts.sellerGuid = ownerGuid;
+    journalRes.facts.deposit = 32u;
+
+    ByteBuffer bb;
+    journalRes.Encode(bb);
+    std::string const factsHex = TestHexEncode(bb);
+
+    CharacterDatabase.BeginTransaction();
+    CharacterDatabase.PExecute(
+        "INSERT INTO `custody_ledger` "
+        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+        "VALUES ('dep:%u',0,0,0,%u,0,32,0,%u," UI64FMTD ",0),"
+        "       ('item:%u',1,3,0,%u,0,0,%u,%u," UI64FMTD ",0)",
+        auctionId, ownerGuid, auctionId, oldTime,
+        auctionId, ownerGuid, itemGuid, auctionId, oldTime);
+    CharacterDatabase.PExecute(
+        "INSERT INTO `ah_worker_journal` "
+        "(`uuid`,`auction_id`,`kind`,`state`,`facts`,`created_time`,`resolved_time`) "
+        "VALUES (%llu,%u,%u,1,'%s'," UI64FMTD "," UI64FMTD ")",
+        static_cast<unsigned long long>(uuid), auctionId,
+        uint32(IPC_PLAYER_CANCEL & 0xFFu), factsHex.c_str(), oldTime, oldTime);
+    if (!CharacterDatabase.CommitTransactionChecked())
+    {
+        printf("ahrepair FAIL: recovery seed commit failed\n");
+        pass = false;
+    }
+
+    TestCliCapture repairCapture;
+    CliHandler repairCli(0, SEC_ADMINISTRATOR, &repairCapture, &TestCliPrint);
+    if (!repairCli.ParseCommands("ah repair apply"))
+    {
+        printf("ahrepair FAIL: committed cancel command was not parsed\n");
+        pass = false;
+    }
+    if (CountCliChunks(repairCapture,
+            "mode=apply confirmed=2 pending=0 sweep-owned=0 repaired=2 skipped=0 failed=0") != 1u)
+    {
+        printf("ahrepair FAIL: committed cancel command summary mismatch\n");
+        pass = false;
+    }
+    if (CountCliChunks(repairCapture, "replayed committed cancel") != 1u)
+    {
+        printf("ahrepair FAIL: repeated auction rows replayed journal more than once\n");
+        pass = false;
+    }
+
+    auto rowState = [](char const* key) -> uint32
+    {
+        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
+            "SELECT `state` FROM `custody_ledger` WHERE `idem_key`='%s'", key));
+        return res ? res->Fetch()[0].GetUInt32() : 255u;
+    };
+
+    std::string const depKey = "dep:" + std::to_string(auctionId);
+    std::string const itemKey = "item:" + std::to_string(auctionId);
+    if (rowState(depKey.c_str()) != CST_TERMINAL_OK)
+    {
+        printf("ahrepair FAIL: deposit not TERMINAL_OK\n");
+        pass = false;
+    }
+    if (rowState(itemKey.c_str()) != CST_TERMINAL_OK)
+    {
+        printf("ahrepair FAIL: item custody not TERMINAL_OK\n");
+        pass = false;
+    }
+
+    {
+        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
+            "SELECT COUNT(*) FROM `mail_items` WHERE `receiver`=%u AND `item_guid`=%u",
+            ownerGuid, itemGuid));
+        if (!res || res->Fetch()[0].GetUInt64() != 1u)
+        {
+            printf("ahrepair FAIL: returned item mail missing\n");
+            pass = false;
+        }
+    }
+
+    {
+        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
+            "SELECT `checked` FROM `mail` m "
+            "JOIN `mail_items` mi ON mi.`mail_id`=m.`id` "
+            "WHERE mi.`receiver`=%u AND mi.`item_guid`=%u",
+            ownerGuid, itemGuid));
+        if (!res || !(res->Fetch()[0].GetUInt32() & MAIL_CHECK_MASK_COPIED))
+        {
+            printf("ahrepair FAIL: returned item mail missing copied mask\n");
+            pass = false;
+        }
+    }
+
+    {
+        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
+            "SELECT COUNT(*) FROM `character_inventory` WHERE `item`=%u", itemGuid));
+        if (res && res->Fetch()[0].GetUInt64() != 0u)
+        {
+            printf("ahrepair FAIL: item should not be placed directly in inventory\n");
+            pass = false;
+        }
+    }
+
+    // Generic apply and force-forfeit both preserve reserved bot provenance
+    // markers and their materialized item instances.
+    Item* protectedItem = Item::CreateItem(itemId, 1);
+    if (!protectedItem)
+    {
+        printf("ahrepair FAIL: protected marker item creation failed\n");
+        pass = false;
+    }
+    else
+    {
+        protectedItem->SetOwnerGuid(ObjectGuid(HIGHGUID_PLAYER,
+                                               TEST_BOT_OWNER_GUID));
+        uint32 const protectedItemGuid = protectedItem->GetGUIDLow();
+        CharacterDatabase.BeginTransaction();
+        protectedItem->SaveToDB();
+        CharacterDatabase.PExecute(
+            "INSERT INTO `custody_ledger` "
+            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+            "VALUES ('botlist:test:repair:protected',1,4,0,%u,0,0,%u,992002,"
+            UI64FMTD ",0)",
+            TEST_BOT_OWNER_GUID, protectedItemGuid, oldTime);
+        bool const markerSeeded = CharacterDatabase.CommitTransactionChecked();
+        delete protectedItem;
+
+        TestCliCapture markerApplyCapture;
+        CliHandler markerApplyCli(0, SEC_ADMINISTRATOR,
+                                  &markerApplyCapture, &TestCliPrint);
+        markerApplyCli.ParseCommands("ah repair apply");
+        TestCliCapture markerForceCapture;
+        CliHandler markerForceCli(0, SEC_ADMINISTRATOR,
+                                  &markerForceCapture, &TestCliPrint);
+        markerForceCli.ParseCommands(
+            "ah repair force-forfeit botlist:test:repair:protected");
+
+        CustodyRow protectedMarker;
+        std::unique_ptr<QueryResult> protectedItemRow(CharacterDatabase.PQuery(
+            "SELECT 1 FROM `item_instance` WHERE `guid`=%u", protectedItemGuid));
+        if (!markerSeeded ||
+            !CustodyLedger::Get("botlist:test:repair:protected", protectedMarker) ||
+            protectedMarker.state != CST_RESERVED || !protectedItemRow ||
+            CountCliChunks(markerApplyCapture,
+                "mode=apply confirmed=0 pending=0 sweep-owned=1 repaired=0 skipped=1 failed=0") != 1u ||
+            CountCliChunks(markerForceCapture, "reserved bot marker") != 1u)
+        {
+            printf("ahrepair FAIL: apply or force-forfeit mutated bot marker/item\n");
+            pass = false;
+        }
+
+        CharacterDatabase.DirectPExecute(
+            "DELETE FROM `custody_ledger` WHERE `idem_key`='botlist:test:repair:protected'");
+        CharacterDatabase.DirectPExecute(
+            "DELETE FROM `item_instance` WHERE `guid`=%u", protectedItemGuid);
+    }
+
+    CharacterDatabase.DirectPExecute(
+        "DELETE FROM `mail_items` WHERE `item_guid`=%u", itemGuid);
+    CharacterDatabase.DirectPExecute(
+        "DELETE FROM `item_instance` WHERE `guid`=%u", itemGuid);
+    CharacterDatabase.DirectPExecute(
+        "DELETE FROM `mail` WHERE `receiver`=%u AND `subject` LIKE '%u:%%'",
+        ownerGuid, itemId);
+    CharacterDatabase.DirectPExecute(
+        "DELETE FROM `custody_ledger` WHERE `auction_id`=%u", auctionId);
+    CharacterDatabase.DirectPExecute(
+        "DELETE FROM `ah_worker_journal` WHERE `auction_id`=%u OR `uuid`=%llu",
+        auctionId, static_cast<unsigned long long>(uuid));
+    CharacterDatabase.DirectExecute("DELETE FROM `characters` WHERE `guid`=1");
+
+    if (pass)
+    {
+        printf("ahrepair OK\n");
+        return 0;
+    }
+    return 2;
+}
+
+/// Reconcile-on-reconnect conservation regressions. A failed local release
+/// commit must retain the pending mutation, and committed worker facts that
+/// cannot be decoded must hold the reservation in-doubt rather than release it.
+static int RunAhReconcileTest()
+{
+    bool pass = true;
+    CharacterDatabase.AllowAsyncTransactions();
+
+    uint32 const commitAuction = 993101u;
+    uint32 const malformedAuction = 993102u;
+    uint32 const validAuction = 993104u;
+    uint64 const commitUuid = 0xC101ull;
+    uint64 const malformedUuid = 0xC102ull;
+    uint64 const validUuid = 0xC104ull;
+
+    CharacterDatabase.DirectPExecute(
+        "DELETE FROM `custody_ledger` "
+        "WHERE `auction_id` IN (993101,993102,993104) "
+        "OR `idem_key` IN ('resolve:%llu','resolve:%llu','resolve:%llu')",
+        static_cast<unsigned long long>(commitUuid),
+        static_cast<unsigned long long>(malformedUuid),
+        static_cast<unsigned long long>(validUuid));
+    CharacterDatabase.DirectPExecute(
+        "DELETE FROM `ah_worker_journal` "
+        "WHERE `auction_id` IN (993101,993102,993104) "
+        "OR `uuid` IN (%llu,%llu,%llu)",
+        static_cast<unsigned long long>(commitUuid),
+        static_cast<unsigned long long>(malformedUuid),
+        static_cast<unsigned long long>(validUuid));
+    CharacterDatabase.DirectExecute("DELETE FROM `characters` WHERE `guid`=1");
+    CharacterDatabase.DirectExecute(
+        "INSERT INTO `characters` (`guid`,`account`,`name`,`money`) "
+        "VALUES (1,1,'AhReconTest',100000)");
+
+    auto readMoney = []() -> uint64
+    {
+        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
+            "SELECT `money` FROM `characters` WHERE `guid`=1"));
+        return res ? res->Fetch()[0].GetUInt64() : 0u;
+    };
+    auto rowState = [](char const* key) -> uint32
+    {
+        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
+            "SELECT `state` FROM `custody_ledger` WHERE `idem_key`='%s'", key));
+        return res ? res->Fetch()[0].GetUInt32() : 255u;
+    };
+    auto rowAmount = [](char const* key) -> uint32
+    {
+        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
+            "SELECT `amount` FROM `custody_ledger` WHERE `idem_key`='%s'",
+            key));
+        return res ? res->Fetch()[0].GetUInt32() : 0u;
+    };
+
+    MutationPendingMap& pend = sAhService.GetMutationPending();
+
+    // ---- Part 1: checked release failure retains pending + reservation ----
+    {
+        CharacterDatabase.BeginTransaction();
+        CharacterDatabase.PExecute(
+            "INSERT INTO `custody_ledger` "
+            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+            "VALUES ('test:reconcile:commit',0,1,0,1,0,333,0,%u,0,0)",
+            commitAuction);
+        if (!CharacterDatabase.CommitTransactionChecked())
+        {
+            printf("ahreconcile FAIL: commit-failure seed\n");
+            return 2;
+        }
+
+        PendingMutation pm;
+        pm.uuid = commitUuid;
+        pm.playerGuidLow = 1u;
+        pm.op = uint16(IPC_PLAYER_BID);
+        pm.auctionId = commitAuction;
+        pm.state = uint8(PMUT_AWAIT_RESULT);
+        pm.sentSec = uint32(time(NULL));
+        pm.reservedAmount = 333u;
+        pm.reserveKey = "test:reconcile:commit";
+        pm.itemKey.clear();
+        pm.depKey.clear();
+        pend.Register(pm);
+
+        uint64 const before = readMoney();
+        std::string originalConfig;
+        std::string testConfig;
+        if (!TestArmCustodyCommitFailure(
+                "reconcile-release", originalConfig, testConfig))
+        {
+            TestRestoreConfig(originalConfig, testConfig);
+            printf("ahreconcile FAIL: could not arm checked-commit failure\n");
+            return 2;
+        }
+        AhReconcileOnReconnect();
+        if (!TestRestoreConfig(originalConfig, testConfig))
+        {
+            printf("ahreconcile FAIL: could not restore configuration\n");
+            return 2;
+        }
+
+        PendingMutation held;
+        if (!pend.Peek(commitUuid, held) || pend.Size() != 1u)
+        {
+            printf("ahreconcile FAIL: failed release consumed pending "
+                   "mutation\n");
+            pass = false;
+        }
+        if (rowState("test:reconcile:commit") != CST_RESERVED ||
+            readMoney() != before ||
+            CustodyService::ResolutionApplied(commitUuid))
+        {
+            printf("ahreconcile FAIL: failed release moved conserved gold\n");
+            pass = false;
+        }
+
+        AhProcessReconnectRetryQueue(uint32(time(NULL)) + 6u);
+        if (pend.Peek(commitUuid, held) ||
+            rowState("test:reconcile:commit") != CST_TERMINAL_BACK ||
+            readMoney() != before + 333u ||
+            !CustodyService::ResolutionApplied(commitUuid))
+        {
+            printf("ahreconcile FAIL: retained release did not apply once "
+                   "on retry\n");
+            pass = false;
+        }
+    }
+
+    // ---- Part 2: exact worker journal envelope replays forward ----
+    {
+        PlayerMutationResult journalRes;
+        journalRes.uuid = validUuid;
+        journalRes.op = uint8(IPC_PLAYER_BID & 0xFFu);
+        journalRes.status = uint8(MUT_OK);
+        journalRes.reason = 0u;
+        journalRes.facts = MutationFacts();
+        journalRes.facts.auctionId = validAuction;
+        journalRes.facts.houseId = 7u;
+        journalRes.facts.itemCount = 1u;
+        journalRes.facts.sellerGuid = 2u;
+        journalRes.facts.effectiveBid = 500u;
+        journalRes.facts.priorBidderGuid = 1u;
+        journalRes.facts.priorBidAmount = 300u;
+        journalRes.facts.curBidderGuid = 1u;
+        journalRes.facts.curBid = 500u;
+
+        ByteBuffer bb;
+        journalRes.Encode(bb);
+        std::string const factsHex = TestHexEncode(bb);
+
+        CharacterDatabase.BeginTransaction();
+        CharacterDatabase.PExecute(
+            "INSERT INTO `custody_ledger` "
+            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,"
+            "`beneficiary_guid`,`amount`,`item_guid`,`auction_id`,"
+            "`created_time`,`resolved_time`) VALUES "
+            "('test:reconcile:valid-prior',0,1,0,1,0,300,0,%u,0,0),"
+            "('test:reconcile:valid-delta',0,1,0,1,0,200,0,%u,0,0)",
+            validAuction, validAuction);
+        CharacterDatabase.PExecute(
+            "INSERT INTO `ah_worker_journal` "
+            "(`uuid`,`auction_id`,`kind`,`state`,`facts`,"
+            "`created_time`,`resolved_time`) "
+            "VALUES (%llu,%u,%u,1,'%s',0,0)",
+            static_cast<unsigned long long>(validUuid), validAuction,
+            uint32(IPC_PLAYER_BID & 0xFFu), factsHex.c_str());
+        if (!CharacterDatabase.CommitTransactionChecked())
+        {
+            printf("ahreconcile FAIL: valid worker-envelope seed\n");
+            return 2;
+        }
+
+        PendingMutation pm;
+        pm.uuid = validUuid;
+        pm.playerGuidLow = 1u;
+        pm.op = uint16(IPC_PLAYER_BID);
+        pm.auctionId = validAuction;
+        pm.state = uint8(PMUT_AWAIT_RESULT);
+        pm.sentSec = uint32(time(NULL));
+        pm.reservedAmount = 200u;
+        pm.reserveKey = "test:reconcile:valid-delta";
+        pm.itemKey.clear();
+        pm.depKey.clear();
+        pend.Register(pm);
+
+        AhReconcileOnReconnect();
+
+        PendingMutation held;
+        if (pend.Peek(validUuid, held) ||
+            rowState("test:reconcile:valid-prior") != CST_RESERVED ||
+            rowAmount("test:reconcile:valid-prior") != 500u ||
+            rowState("test:reconcile:valid-delta") != CST_TERMINAL_OK)
+        {
+            printf("ahreconcile FAIL: valid worker envelope did not replay\n");
+            pass = false;
+        }
+    }
+
+    // ---- Part 3: malformed committed facts hold/tombstone, never release ----
+    {
+        CharacterDatabase.DirectExecute(
+            "DELETE FROM `custody_ledger` WHERE `auction_id`=993101");
+        CharacterDatabase.DirectExecute(
+            "UPDATE `characters` SET `money`=100000 WHERE `guid`=1");
+
+        PlayerMutationResult malformedRes;
+        malformedRes.uuid = malformedUuid + 1u;
+        malformedRes.op = uint8(IPC_PLAYER_BID & 0xFFu);
+        malformedRes.status = uint8(MUT_OK);
+        malformedRes.reason = 0u;
+        malformedRes.facts = MutationFacts();
+        malformedRes.facts.auctionId = malformedAuction;
+        malformedRes.facts.curBidderGuid = 1u;
+        malformedRes.facts.effectiveBid = 444u;
+        malformedRes.facts.curBid = 444u;
+        ByteBuffer bb;
+        malformedRes.Encode(bb);
+        std::string const malformedHex = TestHexEncode(bb);
+
+        CharacterDatabase.BeginTransaction();
+        CharacterDatabase.PExecute(
+            "INSERT INTO `custody_ledger` "
+            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+            "VALUES ('test:reconcile:malformed',0,1,0,1,0,444,0,%u,0,0)",
+            malformedAuction);
+        CharacterDatabase.PExecute(
+            "INSERT INTO `ah_worker_journal` "
+            "(`uuid`,`auction_id`,`kind`,`state`,`facts`,"
+            "`created_time`,`resolved_time`) "
+            "VALUES (%llu,%u,%u,1,'%s',0,0)",
+            static_cast<unsigned long long>(malformedUuid), malformedAuction,
+            uint32(IPC_PLAYER_BID & 0xFFu), malformedHex.c_str());
+        if (!CharacterDatabase.CommitTransactionChecked())
+        {
+            printf("ahreconcile FAIL: malformed-facts seed\n");
+            return 2;
+        }
+
+        PendingMutation pm;
+        pm.uuid = malformedUuid;
+        pm.playerGuidLow = 1u;
+        pm.op = uint16(IPC_PLAYER_BID);
+        pm.auctionId = malformedAuction;
+        pm.state = uint8(PMUT_AWAIT_RESULT);
+        pm.sentSec = uint32(time(NULL));
+        pm.reservedAmount = 444u;
+        pm.reserveKey = "test:reconcile:malformed";
+        pm.itemKey.clear();
+        pm.depKey.clear();
+        pend.Register(pm);
+
+        uint64 const before = readMoney();
+        AhReconcileOnReconnect();
+
+        PendingMutation held;
+        if (!pend.Peek(malformedUuid, held) ||
+            held.state != uint8(PMUT_TOMBSTONE))
+        {
+            printf("ahreconcile FAIL: malformed committed facts not held "
+                   "in-doubt\n");
+            pass = false;
+        }
+        if (rowState("test:reconcile:malformed") != CST_RESERVED ||
+            readMoney() != before)
+        {
+            printf("ahreconcile FAIL: malformed committed facts released "
+                   "gold\n");
+            pass = false;
+        }
+        pend.Take(malformedUuid, held);
+    }
+
+    // ---- Part 4: COMMITTED cancels retain their PREPARED journal envelope ----
+    {
+        uint32 const auctionId = 993105u;
+        uint64 const uuid = 0xC105ull;
+        sObjectMgr.SetHighestGuids();
+        sObjectMgr.LoadItemPrototypes();
+        Item* const item = TestCreateCachedAuctionItem(19019u, 1u);
+        if (!item)
+        {
+            printf("ahreconcile FAIL: create committed-cancel item\n");
+            return 2;
+        }
+        uint32 const itemGuid = item->GetGUIDLow();
+        PlayerMutationResult prepared = {};
+        prepared.uuid = uuid;
+        prepared.op = uint8(IPC_PLAYER_CANCEL & 0xFFu);
+        prepared.status = uint8(MUT_PREPARED);
+        prepared.facts.auctionId = auctionId;
+        prepared.facts.houseId = 7u;
+        prepared.facts.sellerGuid = 1u;
+        prepared.facts.itemGuid = itemGuid;
+        prepared.facts.itemTemplate = 19019u;
+        prepared.facts.itemCount = 1u;
+        prepared.facts.deposit = 32u;
+        ByteBuffer bytes;
+        prepared.Encode(bytes);
+        std::string const hex = TestHexEncode(bytes);
+        CharacterDatabase.BeginTransaction();
+        CustodyLedger::Insert(TestCustodyRow(0, "dep:993105", CUSTODY_GOLD,
+            ROLE_DEPOSIT, 1u, 32u, 0, auctionId));
+        CustodyLedger::Insert(TestCustodyRow(0, "item:993105", CUSTODY_ITEM,
+            ROLE_ITEM, 1u, 0, itemGuid, auctionId));
+        CharacterDatabase.PExecute(
+            "INSERT INTO `ah_worker_journal` "
+            "(`uuid`,`auction_id`,`kind`,`state`,`facts`,"
+            "`created_time`,`resolved_time`) VALUES (%llu,%u,%u,3,'%s',0,0)",
+            static_cast<unsigned long long>(uuid), auctionId,
+            uint32(prepared.op), hex.c_str());
+        if (!CharacterDatabase.CommitTransactionChecked())
+        {
+            printf("ahreconcile FAIL: seed committed-cancel journal\n");
+            return 2;
+        }
+        PendingMutation pm = {};
+        pm.uuid = uuid;
+        pm.playerGuidLow = 1u;
+        pm.op = IPC_PLAYER_CANCEL;
+        pm.auctionId = auctionId;
+        pm.state = PMUT_AWAIT_CONFIRM;
+        pm.itemKey = "item:993105";
+        pm.depKey = "dep:993105";
+        pend.Register(pm);
+        auto itemMails = [&]() -> uint64
+        {
+            std::unique_ptr<QueryResult> rows(CharacterDatabase.PQuery(
+                "SELECT COUNT(*) FROM `mail_items` "
+                "WHERE `item_guid`=%u AND `receiver`=1", itemGuid));
+            return rows ? rows->Fetch()[0].GetUInt64() : 0u;
+        };
+        uint64 const before = readMoney();
+        AhReconcileOnReconnect();
+        PendingMutation held;
+        // APPLIED + PREPARED can mean an abort; it is not proof of cancellation.
+        if (!pend.Peek(uuid, held) || itemMails() != 0u ||
+            rowState("dep:993105") != CST_RESERVED ||
+            rowState("item:993105") != CST_RESERVED || readMoney() != before)
+        {
+            printf("ahreconcile FAIL: ambiguous applied cancel moved value\n");
+            pass = false;
+        }
+        CharacterDatabase.DirectPExecute(
+            "UPDATE `ah_worker_journal` SET `state`=1 WHERE `uuid`=%llu",
+            static_cast<unsigned long long>(uuid));
+        AhReconcileOnReconnect();
+        AhReconcileOnReconnect();
+        if (pend.Peek(uuid, held) || itemMails() != 1u ||
+            rowState("dep:993105") != CST_TERMINAL_OK ||
+            rowState("item:993105") != CST_TERMINAL_OK ||
+            sAuctionMgr.GetAItem(itemGuid) || readMoney() != before)
+        {
+            printf("ahreconcile FAIL: committed prepared cancel did not "
+                   "complete exactly once\n");
+            pass = false;
+        }
+        pend.Take(uuid, held);
+        if (Item* leftover = sAuctionMgr.GetAItem(itemGuid))
+        {
+            sAuctionMgr.RemoveAItem(itemGuid);
+            delete leftover;
+        }
+        CharacterDatabase.DirectPExecute(
+            "DELETE FROM `mail` WHERE `id` IN "
+            "(SELECT `mail_id` FROM `mail_items` WHERE `item_guid`=%u)", itemGuid);
+        CharacterDatabase.DirectPExecute(
+            "DELETE FROM `mail_items` WHERE `item_guid`=%u", itemGuid);
+        CharacterDatabase.DirectPExecute(
+            "DELETE FROM `item_instance` WHERE `guid`=%u", itemGuid);
+        CharacterDatabase.DirectExecute(
+            "DELETE FROM `custody_ledger` WHERE `auction_id`=993105");
+        CharacterDatabase.DirectPExecute(
+            "DELETE FROM `ah_worker_journal` WHERE `uuid`=%llu",
+            static_cast<unsigned long long>(uuid));
+    }
+
+    CharacterDatabase.DirectPExecute(
+        "DELETE FROM `custody_ledger` "
+        "WHERE `auction_id` IN (993101,993102,993104) "
+        "OR `idem_key` IN ('resolve:%llu','resolve:%llu','resolve:%llu')",
+        static_cast<unsigned long long>(commitUuid),
+        static_cast<unsigned long long>(malformedUuid),
+        static_cast<unsigned long long>(validUuid));
+    CharacterDatabase.DirectPExecute(
+        "DELETE FROM `ah_worker_journal` "
+        "WHERE `auction_id` IN (993101,993102,993104) "
+        "OR `uuid` IN (%llu,%llu,%llu)",
+        static_cast<unsigned long long>(commitUuid),
+        static_cast<unsigned long long>(malformedUuid),
+        static_cast<unsigned long long>(validUuid));
+    CharacterDatabase.DirectExecute("DELETE FROM `characters` WHERE `guid`=1");
+
+    if (pass)
+    {
+        printf("ahreconcile OK\n");
+        return 0;
+    }
+    return 2;
+}
+
+/// Cancel-abort reconnect regression in its own process so the one-shot commit
+/// failpoint is independent of RunAhReconcileTest's release failpoint.
+static int RunAhReconcileAbortTest()
+{
+    bool pass = true;
+    CharacterDatabase.AllowAsyncTransactions();
+
+    uint32 const auctionId = 993103u;
+    uint64 const uuid = 0xC103ull;
+    std::string const cutKey = "test:reconcile:abort";
+
+    CharacterDatabase.DirectPExecute(
+        "DELETE FROM `custody_ledger` WHERE `auction_id`=%u "
+        "OR `idem_key`='resolve:%llu'",
+        auctionId, static_cast<unsigned long long>(uuid));
+    CharacterDatabase.DirectPExecute(
+        "DELETE FROM `ah_worker_journal` WHERE `auction_id`=%u OR `uuid`=%llu",
+        auctionId, static_cast<unsigned long long>(uuid));
+    CharacterDatabase.DirectExecute("DELETE FROM `characters` WHERE `guid`=1");
+    CharacterDatabase.DirectExecute(
+        "INSERT INTO `characters` (`guid`,`account`,`name`,`money`) "
+        "VALUES (1,1,'AhAbortTest',100000)");
+
+    PlayerMutationResult prepared;
+    prepared.uuid = uuid;
+    prepared.op = uint8(IPC_PLAYER_CANCEL & 0xFFu);
+    prepared.status = uint8(MUT_PREPARED);
+    prepared.reason = 0u;
+    prepared.facts = MutationFacts();
+    prepared.facts.auctionId = auctionId;
+    prepared.facts.houseId = 7u;
+    prepared.facts.sellerGuid = 1u;
+    prepared.facts.curBid = 1000u;
+
+    ByteBuffer bb;
+    prepared.Encode(bb);
+    std::string const factsHex = TestHexEncode(bb);
+
+    CharacterDatabase.BeginTransaction();
+    CharacterDatabase.PExecute(
+        "INSERT INTO `custody_ledger` "
+        "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+        "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+        "VALUES ('%s',0,2,0,1,0,55,0,%u,0,0)", cutKey.c_str(), auctionId);
+    CharacterDatabase.PExecute(
+        "INSERT INTO `ah_worker_journal` "
+        "(`uuid`,`auction_id`,`kind`,`state`,`facts`,"
+        "`created_time`,`resolved_time`) "
+        "VALUES (%llu,%u,%u,4,'%s',0,0)",
+        static_cast<unsigned long long>(uuid), auctionId,
+        uint32(IPC_PLAYER_CANCEL & 0xFFu), factsHex.c_str());
+    if (!CharacterDatabase.CommitTransactionChecked())
+    {
+        printf("ahreconcileabort FAIL: seed commit\n");
+        return 2;
+    }
+
+    PendingMutation pm;
+    pm.uuid = uuid;
+    pm.playerGuidLow = 1u;
+    pm.op = uint16(IPC_PLAYER_CANCEL);
+    pm.auctionId = auctionId;
+    pm.state = uint8(PMUT_AWAIT_CONFIRM);
+    pm.sentSec = uint32(time(NULL));
+    pm.reservedAmount = 55u;
+    pm.reserveKey = cutKey;
+    pm.itemKey.clear();
+    pm.depKey.clear();
+    MutationPendingMap& pend = sAhService.GetMutationPending();
+    pend.Register(pm);
+
+    auto readMoney = []() -> uint64
+    {
+        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
+            "SELECT `money` FROM `characters` WHERE `guid`=1"));
+        return res ? res->Fetch()[0].GetUInt64() : 0u;
+    };
+    auto rowState = [&cutKey]() -> uint32
+    {
+        std::unique_ptr<QueryResult> res(CharacterDatabase.PQuery(
+            "SELECT `state` FROM `custody_ledger` WHERE `idem_key`='%s'",
+            cutKey.c_str()));
+        return res ? res->Fetch()[0].GetUInt32() : 255u;
+    };
+
+    uint64 const before = readMoney();
+    std::string originalConfig;
+    std::string testConfig;
+    if (!TestArmCustodyCommitFailure(
+            "reconcile-abort-release", originalConfig, testConfig))
+    {
+        TestRestoreConfig(originalConfig, testConfig);
+        printf("ahreconcileabort FAIL: could not arm commit failure\n");
+        return 2;
+    }
+    AhReconcileOnReconnect();
+    if (!TestRestoreConfig(originalConfig, testConfig))
+    {
+        printf("ahreconcileabort FAIL: could not restore configuration\n");
+        return 2;
+    }
+
+    PendingMutation held;
+    if (!pend.Peek(uuid, held) || pend.Size() != 1u ||
+        rowState() != CST_RESERVED || readMoney() != before)
+    {
+        printf("ahreconcileabort FAIL: failed cut release consumed "
+               "disposition\n");
+        pass = false;
+    }
+
+    AhProcessReconnectRetryQueue(uint32(time(NULL)) + 6u);
+    if (pend.Peek(uuid, held) || pend.Size() != 0u ||
+        rowState() != CST_TERMINAL_BACK || readMoney() != before + 55u)
+    {
+        printf("ahreconcileabort FAIL: retained cut release did not apply "
+               "once on retry\n");
+        pass = false;
+    }
+
+    pend.Take(uuid, held);
+    CharacterDatabase.DirectPExecute(
+        "DELETE FROM `custody_ledger` WHERE `auction_id`=%u "
+        "OR `idem_key`='resolve:%llu'",
+        auctionId, static_cast<unsigned long long>(uuid));
+    CharacterDatabase.DirectPExecute(
+        "DELETE FROM `ah_worker_journal` WHERE `auction_id`=%u OR `uuid`=%llu",
+        auctionId, static_cast<unsigned long long>(uuid));
+    CharacterDatabase.DirectExecute("DELETE FROM `characters` WHERE `guid`=1");
+
+    if (pass)
+    {
+        printf("ahreconcileabort OK\n");
+        return 0;
+    }
+    return 2;
+}
+
+/// Marker-owned worker resolutions and player buyouts retain missing or
+/// mismatched item custody, then complete exactly once after it is restored.
+static int RunAhBotTerminalTest()
+{
+    bool pass = true;
+    uint32 const buyer = 990117u;
+    uint32 const bot = TEST_BOT_OWNER_GUID;
+    CharacterDatabase.AllowAsyncTransactions();
+    sObjectMgr.SetHighestGuids();
+    sObjectMgr.LoadItemPrototypes();
+    if (!CharacterDatabase.DirectPExecute(
+        "REPLACE INTO `characters` (`guid`,`account`,`name`,`money`) "
+        "VALUES (%u,1,'AhBotTerm',100000)", buyer))
+    {
+        printf("ahbotterminal FAIL: seed receiver\n");
+        return 2;
+    }
+
+    // Bot expiry, bid-won expiry, and player buyout all use marker custody,
+    // not a player's item:/dep: pair. A failed preflight must remain retryable.
+    for (uint32 mode = 0; mode < 3u; ++mode)
+    {
+        uint32 const auctionId = 991117u + mode;
+        uint64 const uuid = 0xBB117ull + mode;
+        std::string const markerKey = "botlist:test:terminal:" + std::to_string(mode);
+        std::string const bidKey = "bid:" + std::to_string(auctionId) + ":test";
+        CharacterDatabase.DirectPExecute(
+            "DELETE FROM `custody_ledger` WHERE `auction_id`=%u", auctionId);
+        Item* const item = TestCreateCachedAuctionItem(19019u, bot);
+        if (!item)
+        {
+            printf("ahbotterminal FAIL: create escrow item\n");
+            return 2;
+        }
+        uint32 const itemGuid = item->GetGUIDLow();
+        CharacterDatabase.BeginTransaction();
+        CustodyLedger::Insert(TestCustodyRow(0, markerKey, CUSTODY_ITEM,
+            ROLE_RESOLUTION, bot, 0, itemGuid, auctionId));
+        if (mode != 0u)
+        {
+            CustodyLedger::Insert(TestCustodyRow(0, bidKey, CUSTODY_GOLD,
+                ROLE_BID, buyer, 800u, 0, auctionId));
+        }
+        if (!CharacterDatabase.CommitTransactionChecked())
+        {
+            printf("ahbotterminal FAIL: seed custody\n");
+            return 2;
+        }
+
+        MutationFacts facts = {};
+        facts.auctionId = auctionId;
+        facts.houseId = 7;
+        facts.sellerGuid = bot;
+        facts.itemGuid = itemGuid;
+        facts.itemTemplate = 19019u;
+        facts.itemCount = 1;
+        facts.buyout = 800u;
+        if (mode != 0u)
+        {
+            facts.curBidderGuid = buyer;
+            facts.curBid = facts.effectiveBid = 800u;
+        }
+        PlayerMutationResult result = {};
+        result.uuid = uuid;
+        result.op = uint8(IPC_PLAYER_BUYOUT & 0xFFu);
+        result.status = uint8(MUT_OK);
+        result.facts = facts;
+        ResolveApply resolve = {};
+        resolve.uuid = uuid;
+        resolve.kind = mode == 0u ? uint8(RESOLVE_EXPIRED_NOBID) : uint8(RESOLVE_WON);
+        resolve.facts = facts;
+        PendingMutation pending = {};
+        if (mode == 2u)
+        {
+            pending.uuid = uuid;
+            pending.op = IPC_PLAYER_BUYOUT;
+            pending.playerGuidLow = buyer;
+            pending.auctionId = auctionId;
+            pending.state = PMUT_AWAIT_RESULT;
+            pending.sentSec = uint32(time(NULL));
+            pending.reserveKey = bidKey;
+            pending.reservedAmount = 800u;
+            sAhService.GetMutationPending().Register(pending);
+        }
+        auto apply = [&](uint32 attempt)
+        {
+            if (mode != 2u)
+            {
+                AhHandleResolveApply(resolve);
+            }
+            else if (attempt == 0u)
+            {
+                AhHandlePlayerMutationResult(result);
+            }
+            else
+            {
+                AhProcessRedriveQueue(uint32(time(NULL)) + attempt * 10u);
+            }
+        };
+        auto mailCount = [&]() -> uint64
+        {
+            std::unique_ptr<QueryResult> rows(CharacterDatabase.PQuery(
+                "SELECT COUNT(*) FROM `mail_items` WHERE `item_guid`=%u "
+                "AND `receiver`=%u", itemGuid, buyer));
+            return rows ? rows->Fetch()[0].GetUInt64() : 0u;
+        };
+
+        sAuctionMgr.RemoveAItem(itemGuid);
+        apply(0u);
+        if (mode != 0u)
+        {
+            OrphanMaterializationSweepReport const sweep =
+                sAuctionIntentExecutor.SweepOrphanMaterializations(301u, 100u);
+            CustodyRow heldMarker;
+            std::unique_ptr<QueryResult> heldItem(CharacterDatabase.PQuery(
+                "SELECT 1 FROM `item_instance` WHERE `guid`=%u", itemGuid));
+            if (!sweep.committed || sweep.selected != 0u || !heldItem ||
+                !CustodyLedger::Get(markerKey, heldMarker) ||
+                heldMarker.state != CST_RESERVED)
+            {
+                printf("ahbotterminal FAIL: mode %u sweep destroyed held sale escrow\n", mode);
+                pass = false;
+            }
+        }
+        sAuctionMgr.AddAItem(item);
+        CharacterDatabase.DirectPExecute(
+            "UPDATE `custody_ledger` SET `item_guid`=%u WHERE `idem_key`='%s'",
+            itemGuid + 1u, markerKey.c_str());
+        apply(1u);
+        CustodyRow row;
+        if (mailCount() != 0u || CustodyService::ResolutionApplied(uuid) ||
+            (mode != 0u && (!CustodyLedger::Get(bidKey, row) || row.state != CST_RESERVED)))
+        {
+            printf("ahbotterminal FAIL: mode %u missing/mismatched custody moved value\n", mode);
+            pass = false;
+        }
+        CharacterDatabase.DirectPExecute(
+            "UPDATE `custody_ledger` SET `item_guid`=%u WHERE `idem_key`='%s'",
+            itemGuid, markerKey.c_str());
+        apply(2u);
+        apply(3u);
+        std::unique_ptr<QueryResult> persisted(CharacterDatabase.PQuery(
+            "SELECT `owner_guid` FROM `item_instance` WHERE `guid`=%u", itemGuid));
+        if (sAuctionMgr.GetAItem(itemGuid) ||
+            !CustodyLedger::Get(markerKey, row) || row.state != CST_RESERVED ||
+            (mode == 0u && persisted) ||
+            (mode != 0u && (!persisted || persisted->Fetch()[0].GetUInt32() != buyer ||
+                mailCount() != 1u || !CustodyLedger::Get(bidKey, row) || row.state != CST_TERMINAL_OK)) ||
+            (mode != 2u && !CustodyService::ResolutionApplied(uuid)))
+        {
+            printf("ahbotterminal FAIL: mode %u did not finish exactly once after retry\n", mode);
+            pass = false;
+        }
+        if (mode != 0u)
+        {
+            OrphanMaterializationSweepReport const sweep =
+                sAuctionIntentExecutor.SweepOrphanMaterializations(301u, 100u);
+            std::unique_ptr<QueryResult> deliveredItem(CharacterDatabase.PQuery(
+                "SELECT `owner_guid` FROM `item_instance` WHERE `guid`=%u", itemGuid));
+            if (!sweep.committed || sweep.swept != 1u ||
+                CustodyLedger::Get(markerKey, row) || !deliveredItem ||
+                deliveredItem->Fetch()[0].GetUInt32() != buyer || mailCount() != 1u)
+            {
+                printf("ahbotterminal FAIL: mode %u terminal sweep changed delivered item\n", mode);
+                pass = false;
+            }
+        }
+        if (Item* leftover = sAuctionMgr.GetAItem(itemGuid))
+        {
+            sAuctionMgr.RemoveAItem(itemGuid);
+            delete leftover;
+        }
+        CharacterDatabase.DirectPExecute("DELETE FROM `item_instance` WHERE `guid`=%u", itemGuid);
+        CharacterDatabase.DirectPExecute("DELETE FROM `mail_items` WHERE `item_guid`=%u", itemGuid);
+        CharacterDatabase.DirectPExecute("DELETE FROM `custody_ledger` WHERE `auction_id`=%u", auctionId);
+    }
+    CharacterDatabase.DirectPExecute("DELETE FROM `mail` WHERE `receiver`=%u", buyer);
+    CharacterDatabase.DirectPExecute("DELETE FROM `characters` WHERE `guid`=%u", buyer);
+    printf("ahbotterminal %s\n", pass ? "OK" : "FAIL");
+    return pass ? 0 : 1;
+}
+
+/// SP-2 Task 13 self-test for the bot-sell materialization leg. Drives
+/// AuctionIntentExecutor::TestMaterializeSell directly -- the live path reaches
+/// it through Apply() -> ApplySell(), but that re-validation chain needs a fully
+/// loaded world (item store, AH DBC, bot config) unavailable under -t, so the
+/// seam exercises the durable leg in isolation. Asserts the durable contract:
+///   * status INTENT_OK with nonzero itemGuid + auctionId,
+///   * an item_instance row is minted with owner_guid == the bot lister,
+///   * a botlist:<uuid> custody row (kind ITEM, role RESOLUTION, RESERVED)
+///     records BOTH ids,
+///   * NO `auction` row is inserted (the worker owns the book),
+///   * a redelivered uuid replays the SAME ids and mints no second item.
+/// Then exercises SweepOrphanMaterializations: a stranded bot-owned mint (no
+/// auction row) is reaped, while an item that reached the book and was delivered
+/// to a buyer (owner changed) is preserved. Returns 0 on pass.
+static int RunAhMaterializeTest()
+{
+    bool pass = true;
+    CharacterDatabase.AllowAsyncTransactions();
+
+    // -t does not load the world; Item::CreateItem needs item prototypes.
+    sObjectMgr.LoadItemPrototypes();
+
+    const uint32 botGuid   = 990113u;   // synthetic bot lister low-guid
+    const uint32 buyerGuid = 990199u;   // synthetic "delivered to" owner
+    const uint64 uuid      = 0xD13ull;  // Task 13 test intent uuid
+    std::string const key  = "botlist:" + std::to_string(uuid);
+
+    // Synthetic sweep fixtures (huge guids so they never collide with real data
+    // and are not reused as freshly-minted ids after SetHighestGuids).
+    const uint32 orphanItem = 99911301u;   // still bot-owned -> reaped
+    const uint32 soldItem   = 99911302u;   // delivered (owner changed) -> kept
+    const uint32 orphanAuc  = 99900001u;
+    const uint32 soldAuc    = 99900002u;
+
+    // Clean slate BEFORE SetHighestGuids so leftover synthetic rows do not
+    // inflate the auction-id / item-guid generators.
+    CharacterDatabase.DirectPExecute(
+        "DELETE FROM `custody_ledger` WHERE `idem_key` IN "
+        "('%s','botlist:test:orphan','botlist:test:sold')", key.c_str());
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `custody_ledger` "
+        "WHERE `idem_key` LIKE 'botlist:test:batch:%'");
+    CharacterDatabase.DirectPExecute(
+        "DELETE FROM `item_instance` WHERE `owner_guid` IN (%u,%u)",
+        botGuid, buyerGuid);
+    CharacterDatabase.DirectPExecute(
+        "DELETE FROM `item_instance` WHERE `guid` IN (%u,%u)",
+        orphanItem, soldItem);
+
+    sObjectMgr.SetHighestGuids();   // GenerateItemLowGuid / GenerateAuctionID
+
+    // A valid, simple stackable non-equip item to mint. Fall back to a DB probe
+    // so the test does not hardcode a build-specific id.
+    uint32 itemId = 2589u;          // Linen Cloth (universal 1.12 item)
+    if (!ObjectMgr::GetItemPrototype(itemId))
+    {
+        std::unique_ptr<QueryResult> r(WorldDatabase.PQuery(
+            "SELECT `entry` FROM `item_template` "
+            "WHERE `InventoryType`=0 AND `stackable`>1 ORDER BY `entry` LIMIT 1"));
+        if (r)
+        {
+            itemId = r->Fetch()[0].GetUInt32();
+        }
+    }
+    if (!ObjectMgr::GetItemPrototype(itemId))
+    {
+        printf("ahmaterialize FAIL: no usable item prototype"
+               " (item_template empty?)\n");
+        return 2;
+    }
+
+    SellIntent si;
+    si.uuid = uuid;
+    si.botGuid = botGuid;
+    si.house = 2;               // not re-validated by the durable leg
+    si.itemId = itemId;
+    si.stack = 1;
+    si.bid = 100u;
+    si.buyout = 1000u;
+    si.durationHrs = 24u;
+
+    // ---- Part 1: first materialization mints + records + replies ids ----
+    IpcMessage out;
+    sAuctionIntentExecutor.TestMaterializeSell(si, out, uint32(time(NULL)));
+
+    IntentResult res;
+    if (out.op != IPC_INTENT_RESULT || !res.Decode(out.body))
+    {
+        printf("ahmaterialize FAIL: no IPC_INTENT_RESULT reply\n");
+        return 2;
+    }
+    if (res.status != INTENT_OK)
+    {
+        printf("ahmaterialize FAIL: status %u != INTENT_OK\n", res.status);
+        pass = false;
+    }
+    if (res.itemGuid == 0u)
+    {
+        printf("ahmaterialize FAIL: itemGuid is zero\n");
+        pass = false;
+    }
+    if (res.auctionId == 0u)
+    {
+        printf("ahmaterialize FAIL: auctionId is zero\n");
+        pass = false;
+    }
+
+    uint32 const itemGuid  = res.itemGuid;
+    uint32 const auctionId = res.auctionId;
+
+    // item_instance row minted with owner == bot lister.
+    {
+        std::unique_ptr<QueryResult> q(CharacterDatabase.PQuery(
+            "SELECT `owner_guid` FROM `item_instance` WHERE `guid`=%u", itemGuid));
+        if (!q)
+        {
+            printf("ahmaterialize FAIL: item_instance row missing\n");
+            pass = false;
+        }
+        else if (q->Fetch()[0].GetUInt32() != botGuid)
+        {
+            printf("ahmaterialize FAIL: item owner_guid != bot\n");
+            pass = false;
+        }
+    }
+
+    // Durable botlist row records both ids in the expected shape.
+    {
+        CustodyRow row;
+        if (!CustodyLedger::Get(key, row))
+        {
+            printf("ahmaterialize FAIL: botlist row missing\n");
+            pass = false;
+        }
+        else
+        {
+            if (row.itemGuid != itemGuid)
+            {
+                printf("ahmaterialize FAIL: botlist item_guid mismatch\n");
+                pass = false;
+            }
+            if (row.auctionId != auctionId)
+            {
+                printf("ahmaterialize FAIL: botlist auction_id mismatch\n");
+                pass = false;
+            }
+            if (row.kind != CUSTODY_ITEM)
+            {
+                printf("ahmaterialize FAIL: botlist kind != CUSTODY_ITEM\n");
+                pass = false;
+            }
+            if (row.role != ROLE_RESOLUTION)
+            {
+                printf("ahmaterialize FAIL: botlist role != ROLE_RESOLUTION\n");
+                pass = false;
+            }
+            if (row.state != CST_RESERVED)
+            {
+                printf("ahmaterialize FAIL: botlist state != CST_RESERVED\n");
+                pass = false;
+            }
+        }
+    }
+
+    // No `auction` row -- the worker is the sole book writer.
+    {
+        std::unique_ptr<QueryResult> q(CharacterDatabase.PQuery(
+            "SELECT 1 FROM `auction` WHERE `id`=%u", auctionId));
+        if (q)
+        {
+            printf("ahmaterialize FAIL: unexpected auction row inserted\n");
+            pass = false;
+        }
+    }
+
+    // ---- Part 2: redelivered uuid replays the SAME ids, no second mint ----
+    {
+        IpcMessage out2;
+        sAuctionIntentExecutor.TestMaterializeSell(si, out2, uint32(time(NULL)));
+        IntentResult res2;
+        if (out2.op != IPC_INTENT_RESULT || !res2.Decode(out2.body))
+        {
+            printf("ahmaterialize FAIL: replay produced no reply\n");
+            pass = false;
+        }
+        else
+        {
+            if (res2.status != INTENT_OK)
+            {
+                printf("ahmaterialize FAIL: replay status != INTENT_OK\n");
+                pass = false;
+            }
+            if (res2.itemGuid != itemGuid)
+            {
+                printf("ahmaterialize FAIL: replay itemGuid changed\n");
+                pass = false;
+            }
+            if (res2.auctionId != auctionId)
+            {
+                printf("ahmaterialize FAIL: replay auctionId changed\n");
+                pass = false;
+            }
+        }
+        std::unique_ptr<QueryResult> q(CharacterDatabase.PQuery(
+            "SELECT COUNT(*) FROM `item_instance` WHERE `owner_guid`=%u", botGuid));
+        if (q && q->Fetch()[0].GetUInt64() != 1u)
+        {
+            printf("ahmaterialize FAIL: replay minted a second item\n");
+            pass = false;
+        }
+    }
+
+    // ---- Part 3: failed sweep commit preserves DB and cache ownership ----
+    {
+        CharacterDatabase.DirectPExecute(
+            "UPDATE `custody_ledger` SET `created_time`=0 "
+            "WHERE `idem_key`='%s'",
+            key.c_str());
+        Item* const cachedBefore = sAuctionMgr.GetAItem(itemGuid);
+        if (!cachedBefore)
+        {
+            printf("ahmaterialize FAIL: materialized item missing from "
+                   "cache before sweep\n");
+            return 2;
+        }
+        CustodyRow custodyBefore;
+        if (!CustodyLedger::Get(key, custodyBefore))
+        {
+            printf("ahmaterialize FAIL: materialization custody missing "
+                   "before sweep\n");
+            return 2;
+        }
+        std::unique_ptr<QueryResult> candidates(CharacterDatabase.Query(
+            "SELECT COUNT(*) FROM `custody_ledger` "
+            "WHERE `idem_key` LIKE 'botlist:%' AND `created_time` < 1 "
+            "AND `auction_id` NOT IN (SELECT `id` FROM `auction`)"));
+        if (!candidates || candidates->Fetch()[0].GetUInt64() != 1u)
+        {
+            printf("ahmaterialize FAIL: orphan-sweep failure fixture is "
+                   "not isolated\n");
+            return 2;
+        }
+
+        std::string originalConfig;
+        std::string testConfig;
+        if (!TestArmCustodyCommitFailure(
+                "orphan-sweep", originalConfig, testConfig))
+        {
+            TestRestoreConfig(originalConfig, testConfig);
+            printf("ahmaterialize FAIL: could not arm orphan-sweep failure\n");
+            return 2;
+        }
+        sAuctionIntentExecutor.SweepOrphanMaterializations(301u, 100u);
+        if (!TestRestoreConfig(originalConfig, testConfig))
+        {
+            printf("ahmaterialize FAIL: could not restore configuration\n");
+            return 2;
+        }
+
+        std::unique_ptr<QueryResult> itemRow(CharacterDatabase.PQuery(
+            "SELECT `owner_guid` FROM `item_instance` WHERE `guid`=%u",
+            itemGuid));
+        CustodyRow custodyRow;
+        if (!itemRow || !CustodyLedger::Get(key, custodyRow) ||
+            itemRow->Fetch()[0].GetUInt32() != botGuid ||
+            custodyRow.state != custodyBefore.state ||
+            custodyRow.ownerGuid != custodyBefore.ownerGuid ||
+            custodyRow.itemGuid != custodyBefore.itemGuid ||
+            custodyRow.auctionId != custodyBefore.auctionId ||
+            sAuctionMgr.GetAItem(itemGuid) != cachedBefore ||
+            cachedBefore->GetOwnerGuid().GetCounter() != botGuid)
+        {
+            printf("ahmaterialize FAIL: failed sweep commit changed "
+                   "durable/cache ownership\n");
+            pass = false;
+        }
+
+        sAuctionIntentExecutor.SweepOrphanMaterializations(301u, 100u);
+        std::unique_ptr<QueryResult> retriedItem(CharacterDatabase.PQuery(
+            "SELECT 1 FROM `item_instance` WHERE `guid`=%u", itemGuid));
+        if (CustodyLedger::Get(key, custodyRow) || retriedItem ||
+            sAuctionMgr.GetAItem(itemGuid))
+        {
+            printf("ahmaterialize FAIL: retained sweep did not apply on "
+                   "retry\n");
+            pass = false;
+        }
+    }
+
+    // ---- Part 4: successful sweep reaps strays but spares delivered
+    // items ----
+    {
+        // Seed synthetic item_instance + botlist rows AFTER SetHighestGuids so
+        // they never influence the generators. Both are "old" (past the 300s
+        // grace) and have no `auction` row. The orphan item is still bot-owned;
+        // the "sold" item's owner is the buyer (its listing reached the book and
+        // later resolved) -- it must survive the sweep.
+        CharacterDatabase.DirectPExecute(
+            "INSERT INTO `item_instance` (`guid`,`owner_guid`,`data`,`text`) "
+            "VALUES (%u,%u,'0',''),(%u,%u,'0','')",
+            orphanItem, botGuid, soldItem, buyerGuid);
+        CharacterDatabase.BeginTransaction();
+        CharacterDatabase.PExecute(
+            "INSERT INTO `custody_ledger` "
+            "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,`beneficiary_guid`,"
+            "`amount`,`item_guid`,`auction_id`,`created_time`,`resolved_time`) "
+            "VALUES ('botlist:test:orphan',1,4,0,%u,0,0,%u,%u,100,0),"
+            "       ('botlist:test:sold',1,4,0,%u,0,0,%u,%u,100,0)",
+            botGuid, orphanItem, orphanAuc, botGuid, soldItem, soldAuc);
+        if (!CharacterDatabase.CommitTransactionChecked())
+        {
+            printf("ahmaterialize FAIL: sweep seed commit\n");
+            return 2;
+        }
+
+        sAuctionIntentExecutor.SweepOrphanMaterializations(
+            uint32(time(NULL)), 100u);
+
+        std::unique_ptr<QueryResult> qo(CharacterDatabase.PQuery(
+            "SELECT 1 FROM `item_instance` WHERE `guid`=%u", orphanItem));
+        if (qo)
+        {
+            printf("ahmaterialize FAIL: orphan item not swept\n");
+            pass = false;
+        }
+
+        std::unique_ptr<QueryResult> qs(CharacterDatabase.PQuery(
+            "SELECT 1 FROM `item_instance` WHERE `guid`=%u", soldItem));
+        if (!qs)
+        {
+            printf("ahmaterialize FAIL: delivered item wrongly destroyed\n");
+            pass = false;
+        }
+
+        CustodyRow tmp;
+        if (CustodyLedger::Get("botlist:test:orphan", tmp))
+        {
+            printf("ahmaterialize FAIL: orphan botlist row not deleted\n");
+            pass = false;
+        }
+        if (CustodyLedger::Get("botlist:test:sold", tmp))
+        {
+            printf("ahmaterialize FAIL: sold botlist row not deleted\n");
+            pass = false;
+        }
+    }
+
+    // ---- Part 5: an outage backlog drains across bounded invocations ----
+    {
+        CharacterDatabase.BeginTransaction();
+        for (uint32 i = 1u; i <= 101u; ++i)
+        {
+            CharacterDatabase.PExecute(
+                "INSERT INTO `custody_ledger` "
+                "(`idem_key`,`kind`,`role`,`state`,`owner_guid`,"
+                "`beneficiary_guid`,`amount`,`item_guid`,`auction_id`,"
+                "`created_time`,`resolved_time`) "
+                "VALUES ('botlist:test:batch:%u',1,4,0,%u,0,0,%u,%u,100,0)",
+                i, botGuid, 99911310u + i, 99900010u + i);
+        }
+        if (!CharacterDatabase.CommitTransactionChecked())
+        {
+            printf("ahmaterialize FAIL: bounded sweep seed commit\n");
+            return 2;
+        }
+
+        auto countBatchRows = []() -> uint64
+        {
+            std::unique_ptr<QueryResult> rows(CharacterDatabase.PQuery(
+                "SELECT COUNT(*) FROM `custody_ledger` "
+                "WHERE `idem_key` LIKE 'botlist:test:batch:%%'"));
+            return rows ? rows->Fetch()[0].GetUInt64() : 0u;
+        };
+
+        OrphanMaterializationSweepReport const first =
+            sAuctionIntentExecutor.SweepOrphanMaterializations(
+                uint32(time(NULL)), 100u);
+        if (!first.committed || first.selected != 100u || first.swept != 100u ||
+            !first.morePending || countBatchRows() != 1u)
+        {
+            printf("ahmaterialize FAIL: first bounded sweep batch\n");
+            pass = false;
+        }
+
+        OrphanMaterializationSweepReport const second =
+            sAuctionIntentExecutor.SweepOrphanMaterializations(
+                uint32(time(NULL)), 100u);
+        if (!second.committed || second.selected != 1u || second.swept != 1u ||
+            second.morePending || countBatchRows() != 0u)
+        {
+            printf("ahmaterialize FAIL: second bounded sweep batch\n");
+            pass = false;
+        }
+    }
+
+    // ---- Part 6: an old bot marker must not evict a buyer's relisted item ----
+    {
+        Item* const relisted = TestCreateCachedAuctionItem(itemId, buyerGuid);
+        if (!relisted)
+        {
+            printf("ahmaterialize FAIL: relisted item fixture\n");
+            return 2;
+        }
+        uint32 const relistedGuid = relisted->GetGUIDLow();
+        CharacterDatabase.BeginTransaction();
+        CustodyLedger::Insert(TestCustodyRow(0, "botlist:test:relisted",
+            CUSTODY_ITEM, ROLE_RESOLUTION, botGuid, 0, relistedGuid, 99900003u));
+        CharacterDatabase.PExecute(
+            "INSERT INTO `auction` (`id`,`itemguid`,`itemowner`) "
+            "VALUES (99900004,%u,%u)", relistedGuid, buyerGuid);
+        if (!CharacterDatabase.CommitTransactionChecked())
+        {
+            printf("ahmaterialize FAIL: relisted marker seed commit\n");
+            return 2;
+        }
+        OrphanMaterializationSweepReport const sweep =
+            sAuctionIntentExecutor.SweepOrphanMaterializations(301u, 100u);
+        CustodyRow marker;
+        std::unique_ptr<QueryResult> persisted(CharacterDatabase.PQuery(
+            "SELECT `owner_guid` FROM `item_instance` WHERE `guid`=%u", relistedGuid));
+        if (!sweep.committed || sweep.swept != 1u ||
+            CustodyLedger::Get("botlist:test:relisted", marker) ||
+            sAuctionMgr.GetAItem(relistedGuid) != relisted || !persisted ||
+            persisted->Fetch()[0].GetUInt32() != buyerGuid)
+        {
+            printf("ahmaterialize FAIL: old marker sweep destroyed buyer's relisted escrow\n");
+            pass = false;
+        }
+        if (Item* leftover = sAuctionMgr.GetAItem(relistedGuid))
+        {
+            sAuctionMgr.RemoveAItem(relistedGuid);
+            delete leftover;
+        }
+        CharacterDatabase.DirectExecute("DELETE FROM `auction` WHERE `id`=99900004");
+        CharacterDatabase.DirectExecute(
+            "DELETE FROM `custody_ledger` WHERE `idem_key`='botlist:test:relisted'");
+        CharacterDatabase.DirectPExecute(
+            "DELETE FROM `item_instance` WHERE `guid`=%u", relistedGuid);
+    }
+
+    // ---- Part 7: empty and failed candidate queries have distinct outcomes ----
+    {
+        if (!CharacterDatabase.DirectExecute(
+                "RENAME TABLE `custody_ledger` TO `custody_ledger_test_unavailable`"))
+        {
+            printf("ahmaterialize FAIL: could not inject candidate query failure\n");
+            return 2;
+        }
+        OrphanMaterializationSweepReport const failed =
+            sAuctionIntentExecutor.SweepOrphanMaterializations(301u, 100u);
+        if (!CharacterDatabase.DirectExecute(
+                "RENAME TABLE `custody_ledger_test_unavailable` TO `custody_ledger`"))
+        {
+            printf("ahmaterialize FAIL: could not restore custody table\n");
+            return 2;
+        }
+        OrphanMaterializationSweepReport const empty =
+            sAuctionIntentExecutor.SweepOrphanMaterializations(301u, 100u);
+        if (failed.committed || failed.selected || failed.swept ||
+            !empty.committed || empty.selected || empty.swept || empty.morePending)
+        {
+            printf("ahmaterialize FAIL: failed query reported as drained\n");
+            pass = false;
+        }
+    }
+
+    // Clean up the minted item and synthetic fixtures.
+    CharacterDatabase.DirectPExecute(
+        "DELETE FROM `custody_ledger` WHERE `idem_key` IN "
+        "('%s','botlist:test:orphan','botlist:test:sold')", key.c_str());
+    CharacterDatabase.DirectExecute(
+        "DELETE FROM `custody_ledger` "
+        "WHERE `idem_key` LIKE 'botlist:test:batch:%'");
+    CharacterDatabase.DirectPExecute(
+        "DELETE FROM `item_instance` WHERE `owner_guid` IN (%u,%u)",
+        botGuid, buyerGuid);
+    CharacterDatabase.DirectPExecute(
+        "DELETE FROM `item_instance` WHERE `guid` IN (%u,%u)",
+        orphanItem, soldItem);
+
+    if (pass)
+    {
+        printf("ahmaterialize OK\n");
+        return 0;
+    }
+    return 1;
+}
+
+namespace
+{
+    struct Registrar
+    {
+        Registrar()
+        {
+            RegisterMangosdTest("commit", &RunCommitTest);
+            RegisterMangosdTest("mail", &RunMailTest);
+            RegisterMangosdTest("custody", &RunCustodyTest);
+            RegisterMangosdTest("ahusabilityref", &RunAhUsabilityRefTest);
+            RegisterMangosdTest("ahbrowsehelper", &RunAhBrowseHelperTest);
+            RegisterMangosdTest("ahbrowsepending", &RunAhBrowsePendingTest);
+            RegisterMangosdTest("ahmutpending", &RunAhMutPendingTest);
+            RegisterMangosdTest("ahforwardreserve", &RunAhForwardReserveTest);
+            RegisterMangosdTest("ahrelease", &RunAhReleaseTest);
+            RegisterMangosdTest("ahmutresult", &RunAhMutResultTest);
+            RegisterMangosdTest("ahresolve", &RunAhResolveTest);
+            RegisterMangosdTest("ahrepair", &RunAhRepairRecoveryTest);
+            RegisterMangosdTest("ahcustodyroute", &RunAhCustodyRouteTest);
+            RegisterMangosdTest("ahroutegate", &RunAhRouteGateTest);
+            RegisterMangosdTest("ahreconcile", &RunAhReconcileTest);
+            RegisterMangosdTest("ahreconcileabort", &RunAhReconcileAbortTest);
+            RegisterMangosdTest("ahmaterialize", &RunAhMaterializeTest);
+            RegisterMangosdTest("ahbotterminal", &RunAhBotTerminalTest);
+        }
+    } const registrar;
+}
diff --git a/src/modules/AhWorker/AhBotDefines.h b/src/modules/AhService/worker/AhBotDefines.h
similarity index 100%
rename from src/modules/AhWorker/AhBotDefines.h
rename to src/modules/AhService/worker/AhBotDefines.h
diff --git a/src/modules/AhWorker/AuctionBook.cpp b/src/modules/AhService/worker/AuctionBook.cpp
similarity index 100%
rename from src/modules/AhWorker/AuctionBook.cpp
rename to src/modules/AhService/worker/AuctionBook.cpp
diff --git a/src/modules/AhWorker/AuctionBook.h b/src/modules/AhService/worker/AuctionBook.h
similarity index 100%
rename from src/modules/AhWorker/AuctionBook.h
rename to src/modules/AhService/worker/AuctionBook.h
diff --git a/src/modules/AhWorker/BotBrain.cpp b/src/modules/AhService/worker/BotBrain.cpp
similarity index 100%
rename from src/modules/AhWorker/BotBrain.cpp
rename to src/modules/AhService/worker/BotBrain.cpp
diff --git a/src/modules/AhWorker/BotBrain.h b/src/modules/AhService/worker/BotBrain.h
similarity index 100%
rename from src/modules/AhWorker/BotBrain.h
rename to src/modules/AhService/worker/BotBrain.h
diff --git a/src/modules/AhWorker/BrowseHandler.cpp b/src/modules/AhService/worker/BrowseHandler.cpp
similarity index 100%
rename from src/modules/AhWorker/BrowseHandler.cpp
rename to src/modules/AhService/worker/BrowseHandler.cpp
diff --git a/src/modules/AhWorker/BrowseHandler.h b/src/modules/AhService/worker/BrowseHandler.h
similarity index 100%
rename from src/modules/AhWorker/BrowseHandler.h
rename to src/modules/AhService/worker/BrowseHandler.h
diff --git a/src/modules/AhWorker/CMakeLists.txt b/src/modules/AhService/worker/CMakeLists.txt
similarity index 90%
rename from src/modules/AhWorker/CMakeLists.txt
rename to src/modules/AhService/worker/CMakeLists.txt
index fa314178a7..ec9aa894e0 100644
--- a/src/modules/AhWorker/CMakeLists.txt
+++ b/src/modules/AhService/worker/CMakeLists.txt
@@ -31,13 +31,8 @@ install(TARGETS ah-service DESTINATION ${BIN_DIR}/service-workers/ah-service)
 configure_file(${CMAKE_CURRENT_SOURCE_DIR}/ah-service.conf.dist.in ${CMAKE_CURRENT_BINARY_DIR}/ah-service.conf.dist)
 install(FILES ${CMAKE_CURRENT_BINARY_DIR}/ah-service.conf.dist DESTINATION ${CONF_INSTALL_DIR})
 
-# The CanUseItem differential drift test needs BOTH ah_usability (this worker)
-# and the game-side AhUsabilityRef source, so it builds only when mangosd is in
-# the configure too. It is EXCLUDE_FROM_ALL (built on demand / in CI), never
-# part of the default build or the shipped binaries.
-if(BUILD_MANGOSD)
-    add_subdirectory(difftest)
-endif()
+# The usability differential test: EXCLUDE_FROM_ALL, built on demand / in CI.
+add_subdirectory(difftest)
 
 # ah-service runs as a STANDALONE process: spawned by mangosd in deployment, but
 # also run directly by the CI self-test (and by hand). It links `shared`, which
diff --git a/src/modules/AhWorker/Console.h b/src/modules/AhService/worker/Console.h
similarity index 100%
rename from src/modules/AhWorker/Console.h
rename to src/modules/AhService/worker/Console.h
diff --git a/src/modules/AhWorker/Console_posix.cpp b/src/modules/AhService/worker/Console_posix.cpp
similarity index 100%
rename from src/modules/AhWorker/Console_posix.cpp
rename to src/modules/AhService/worker/Console_posix.cpp
diff --git a/src/modules/AhWorker/Console_win.cpp b/src/modules/AhService/worker/Console_win.cpp
similarity index 100%
rename from src/modules/AhWorker/Console_win.cpp
rename to src/modules/AhService/worker/Console_win.cpp
diff --git a/src/modules/AhWorker/ItemInstanceFields.cpp b/src/modules/AhService/worker/ItemInstanceFields.cpp
similarity index 100%
rename from src/modules/AhWorker/ItemInstanceFields.cpp
rename to src/modules/AhService/worker/ItemInstanceFields.cpp
diff --git a/src/modules/AhWorker/ItemInstanceFields.h b/src/modules/AhService/worker/ItemInstanceFields.h
similarity index 100%
rename from src/modules/AhWorker/ItemInstanceFields.h
rename to src/modules/AhService/worker/ItemInstanceFields.h
diff --git a/src/modules/AhWorker/ItemPool.cpp b/src/modules/AhService/worker/ItemPool.cpp
similarity index 100%
rename from src/modules/AhWorker/ItemPool.cpp
rename to src/modules/AhService/worker/ItemPool.cpp
diff --git a/src/modules/AhWorker/ItemPool.h b/src/modules/AhService/worker/ItemPool.h
similarity index 100%
rename from src/modules/AhWorker/ItemPool.h
rename to src/modules/AhService/worker/ItemPool.h
diff --git a/src/modules/AhWorker/Journal.cpp b/src/modules/AhService/worker/Journal.cpp
similarity index 100%
rename from src/modules/AhWorker/Journal.cpp
rename to src/modules/AhService/worker/Journal.cpp
diff --git a/src/modules/AhWorker/Journal.h b/src/modules/AhService/worker/Journal.h
similarity index 100%
rename from src/modules/AhWorker/Journal.h
rename to src/modules/AhService/worker/Journal.h
diff --git a/src/modules/AhWorker/Main.cpp b/src/modules/AhService/worker/Main.cpp
similarity index 100%
rename from src/modules/AhWorker/Main.cpp
rename to src/modules/AhService/worker/Main.cpp
diff --git a/src/modules/AhWorker/MarketSnapshot.cpp b/src/modules/AhService/worker/MarketSnapshot.cpp
similarity index 100%
rename from src/modules/AhWorker/MarketSnapshot.cpp
rename to src/modules/AhService/worker/MarketSnapshot.cpp
diff --git a/src/modules/AhWorker/MarketSnapshot.h b/src/modules/AhService/worker/MarketSnapshot.h
similarity index 100%
rename from src/modules/AhWorker/MarketSnapshot.h
rename to src/modules/AhService/worker/MarketSnapshot.h
diff --git a/src/modules/AhWorker/MutationHandler.cpp b/src/modules/AhService/worker/MutationHandler.cpp
similarity index 100%
rename from src/modules/AhWorker/MutationHandler.cpp
rename to src/modules/AhService/worker/MutationHandler.cpp
diff --git a/src/modules/AhWorker/MutationHandler.h b/src/modules/AhService/worker/MutationHandler.h
similarity index 100%
rename from src/modules/AhWorker/MutationHandler.h
rename to src/modules/AhService/worker/MutationHandler.h
diff --git a/src/modules/AhWorker/ServiceConfig.cpp b/src/modules/AhService/worker/ServiceConfig.cpp
similarity index 100%
rename from src/modules/AhWorker/ServiceConfig.cpp
rename to src/modules/AhService/worker/ServiceConfig.cpp
diff --git a/src/modules/AhWorker/ServiceConfig.h b/src/modules/AhService/worker/ServiceConfig.h
similarity index 100%
rename from src/modules/AhWorker/ServiceConfig.h
rename to src/modules/AhService/worker/ServiceConfig.h
diff --git a/src/modules/AhWorker/ServiceDatabase.cpp b/src/modules/AhService/worker/ServiceDatabase.cpp
similarity index 100%
rename from src/modules/AhWorker/ServiceDatabase.cpp
rename to src/modules/AhService/worker/ServiceDatabase.cpp
diff --git a/src/modules/AhWorker/ServiceDatabase.h b/src/modules/AhService/worker/ServiceDatabase.h
similarity index 100%
rename from src/modules/AhWorker/ServiceDatabase.h
rename to src/modules/AhService/worker/ServiceDatabase.h
diff --git a/src/modules/AhWorker/Usability.cpp b/src/modules/AhService/worker/Usability.cpp
similarity index 100%
rename from src/modules/AhWorker/Usability.cpp
rename to src/modules/AhService/worker/Usability.cpp
diff --git a/src/modules/AhWorker/Usability.h b/src/modules/AhService/worker/Usability.h
similarity index 100%
rename from src/modules/AhWorker/Usability.h
rename to src/modules/AhService/worker/Usability.h
diff --git a/src/modules/AhWorker/ah-service.conf.dist.in b/src/modules/AhService/worker/ah-service.conf.dist.in
similarity index 61%
rename from src/modules/AhWorker/ah-service.conf.dist.in
rename to src/modules/AhService/worker/ah-service.conf.dist.in
index b224810b17..c8404998ac 100644
--- a/src/modules/AhWorker/ah-service.conf.dist.in
+++ b/src/modules/AhService/worker/ah-service.conf.dist.in
@@ -1,8 +1,90 @@
 [AhServiceConf]
+
+###############################################################################
+#    Enable
+#        Load the auction house service module in mangosd. 0 leaves the server
+#        without it: no worker, no custody, no .ah commands.
+#    Default: 0
+###############################################################################
+
+Enable = 0
+
 ConfVersion=@MANGOS_AHBOT_VER@
 Console.ShowOnStartup = 0
 LogLevel = 1
 
+###############################################################################
+# MANGOSD SIDE
+#
+#    AH.Service.Worker
+#        Run the auction house as a separate supervised child process.
+#        mangosd spawns the ah-service executable, maintains a loopback IPC
+#        channel, and restarts the child on unexpected exit. The child is
+#        given this file as --config.
+#        Default: 0 (the in-process AH bot is used instead)
+#
+#    AH.Service.Path
+#        Path to the ah-service executable, relative to the mangosd working
+#        directory (or absolute).
+#        Default: service-workers/ah-service/ah-service
+#
+#    AH.Service.Port
+#        Loopback TCP port for the mangosd <-> ah-service IPC channel.
+#        Default: 5760
+#
+#    AH.Service.Secret
+#        Shared secret for IPC handshake authentication.
+#        Change this to a random string in production configurations.
+#        mangosd passes this to the child OUT-OF-BAND via the
+#        AH_SERVICE_SECRET environment variable (NOT on the child command
+#        line), so it is not exposed in the process list.
+#        Default: changeme
+#
+#    AH.Service.IntentTtlSec
+#        How long (in seconds) the executor retains UUID records for
+#        deduplication of intents submitted by the child process.
+#        Default: 900
+#
+#    AH.Service.Custody
+#        Route player auction gold/items through the in-process custody escrow
+#        ledger.
+#        Default: 0
+#
+#    AH.Service.CustodyCrashAt
+#        TEST ONLY.  Inject _exit(3) at a custody seam transition:
+#        empty = off, pre-commit, pre-deferred, and the SP-2 write-path seams
+#        post-reserve-pre-forward, resolving-pre-apply.
+#        NEVER set on a live realm.
+#        Default: "" (off)
+#
+#    AH.Service.CustodyFailCommitAt
+#        TEST ONLY.  Force an AH custody checked-commit to roll back and report
+#        failure ONCE (one-shot per process): empty = off, finalize-fail,
+#        reconcile-release, reconcile-abort-release, orphan-sweep.
+#        NEVER set on a live realm.
+#        Default: "" (off)
+#
+#    AH.Service.WriteAuthority
+#        [SP-2] Grant the worker WRITE-AUTHORITY over the auction book: the
+#        worker inserts/updates/deletes `auction` rows and runs the expiry/win
+#        tick, while every other auction writer (boot repair, orphan cleanup,
+#        the in-process expiry sweep, and the AH bots) stands down.
+#        Read once at startup, ignored by `.ah reload`.
+#        HARD REQUIREMENT: AH.Service.Custody = 1, and the ah_worker_journal
+#        migration applied (see extra/doc/AuctionHouseBot.md).
+#        Default: 0 (mangosd owns the book)
+###############################################################################
+
+AH.Service.Worker              = 0
+AH.Service.Path                = service-workers/ah-service/ah-service
+AH.Service.Port                = 5760
+AH.Service.Secret              = changeme
+AH.Service.IntentTtlSec        = 900
+AH.Service.Custody             = 0
+AH.Service.CustodyCrashAt      = ""
+AH.Service.CustodyFailCommitAt = ""
+AH.Service.WriteAuthority      = 0
+
 ###############################################################################
 # AH-SERVICE INFRASTRUCTURE
 #
diff --git a/src/modules/AhWorker/difftest/AhUsabilityDiffTest.cpp b/src/modules/AhService/worker/difftest/AhUsabilityDiffTest.cpp
similarity index 99%
rename from src/modules/AhWorker/difftest/AhUsabilityDiffTest.cpp
rename to src/modules/AhService/worker/difftest/AhUsabilityDiffTest.cpp
index 2a2e8d2cb5..3bac60506f 100644
--- a/src/modules/AhWorker/difftest/AhUsabilityDiffTest.cpp
+++ b/src/modules/AhService/worker/difftest/AhUsabilityDiffTest.cpp
@@ -26,7 +26,7 @@
 // linked into production mangosd.
 //
 #include "Usability.h"              // worker port (ah_usability)
-#include "Object/AhUsabilityRef.h"  // reference (compiled in directly)
+#include "AhUsabilityRef.h"  // reference (compiled in directly)
 #include <cstdio>
 #include <vector>
 
diff --git a/src/game/Object/AhUsabilityRef.cpp b/src/modules/AhService/worker/difftest/AhUsabilityRef.cpp
similarity index 100%
rename from src/game/Object/AhUsabilityRef.cpp
rename to src/modules/AhService/worker/difftest/AhUsabilityRef.cpp
diff --git a/src/game/Object/AhUsabilityRef.h b/src/modules/AhService/worker/difftest/AhUsabilityRef.h
similarity index 100%
rename from src/game/Object/AhUsabilityRef.h
rename to src/modules/AhService/worker/difftest/AhUsabilityRef.h
diff --git a/src/modules/AhWorker/difftest/CMakeLists.txt b/src/modules/AhService/worker/difftest/CMakeLists.txt
similarity index 85%
rename from src/modules/AhWorker/difftest/CMakeLists.txt
rename to src/modules/AhService/worker/difftest/CMakeLists.txt
index e60dbd4e14..a972a001c5 100644
--- a/src/modules/AhWorker/difftest/CMakeLists.txt
+++ b/src/modules/AhService/worker/difftest/CMakeLists.txt
@@ -10,10 +10,7 @@
 # surfacing the boundary violation.
 add_executable(ah_usability_difftest EXCLUDE_FROM_ALL
     "${CMAKE_CURRENT_SOURCE_DIR}/AhUsabilityDiffTest.cpp"
-    "${CMAKE_SOURCE_DIR}/src/game/Object/AhUsabilityRef.cpp")
-
-target_include_directories(ah_usability_difftest PRIVATE
-    "${CMAKE_SOURCE_DIR}/src/game")   # for "Object/AhUsabilityRef.h"
+    "${CMAKE_CURRENT_SOURCE_DIR}/AhUsabilityRef.cpp")
 
 target_link_libraries(ah_usability_difftest PRIVATE ah_usability)
 # ah_usability pulls in ah_ipc (which provides Common.h / ByteBuffer.h /
diff --git a/src/modules/AhWorker/tools/custody_crash_test.md b/src/modules/AhService/worker/tools/custody_crash_test.md
similarity index 100%
rename from src/modules/AhWorker/tools/custody_crash_test.md
rename to src/modules/AhService/worker/tools/custody_crash_test.md
diff --git a/src/modules/AhWorker/tools/sp2_differential.md b/src/modules/AhService/worker/tools/sp2_differential.md
similarity index 100%
rename from src/modules/AhWorker/tools/sp2_differential.md
rename to src/modules/AhService/worker/tools/sp2_differential.md
diff --git a/src/modules/AhService/world/AhService.cpp b/src/modules/AhService/world/AhService.cpp
new file mode 100644
index 0000000000..2153496710
--- /dev/null
+++ b/src/modules/AhService/world/AhService.cpp
@@ -0,0 +1,122 @@
+/**
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * MaNGOS is a full featured server for World of Warcraft, supporting
+ * the following clients: 1.12.x, 2.4.3, 3.3.5a, 4.3.4a and 5.4.8
+ *
+ * Copyright (C) 2005-2026 MaNGOS <https://www.getmangos.eu>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * World of Warcraft, and all World of Warcraft or Warcraft art, images,
+ * and lore are copyrighted by Blizzard Entertainment, Inc.
+ */
+
+#include "AhService.h"
+#include "Database/DatabaseEnv.h"
+#include "Log.h"
+#include "SystemConfig.h"
+#include "WorkerSupervisor.h"
+
+namespace
+{
+    char const* const AHSERVICE_CONFIG_NAME = "ah-service.conf";
+}
+
+AhService& AhService::Instance()
+{
+    static AhService instance;
+    return instance;
+}
+
+bool AhService::IsWorkerActive() const
+{
+    return m_supervisor && m_supervisor->ServiceActive();
+}
+
+bool AhService::LoadConfig(bool reload)
+{
+    if (!reload)
+    {
+        m_configPath = std::string(SYSCONFDIR) + AHSERVICE_CONFIG_NAME;
+        if (!m_file.SetSource(m_configPath.c_str()))
+        {
+            m_configPath = AHSERVICE_CONFIG_NAME;
+            if (!m_file.SetSource(m_configPath.c_str()))
+            {
+                sLog.outString("AH service is disabled: unable to open %s", AHSERVICE_CONFIG_NAME);
+                return false;
+            }
+        }
+    }
+    else if (!m_file.Reload())
+    {
+        sLog.outError("AH service: unable to reload %s; keeping the previous settings", m_configPath.c_str());
+        return false;
+    }
+
+    AhServiceSettings settings;
+    settings.enable              = m_file.GetBoolDefault("Enable", false);
+    settings.worker              = m_file.GetBoolDefault("AH.Service.Worker", false);
+    settings.path                = m_file.GetStringDefault("AH.Service.Path", "service-workers/ah-service/ah-service");
+    settings.port                = uint16(m_file.GetIntDefault("AH.Service.Port", 5760));
+    settings.secret              = m_file.GetStringDefault("AH.Service.Secret", "changeme");
+    settings.intentTtlSec        = m_file.GetIntDefault("AH.Service.IntentTtlSec", 900);
+    settings.custody             = m_file.GetBoolDefault("AH.Service.Custody", false);
+    settings.custodyCrashAt      = m_file.GetStringDefault("AH.Service.CustodyCrashAt", "");
+    settings.custodyFailCommitAt = m_file.GetStringDefault("AH.Service.CustodyFailCommitAt", "");
+
+    if (reload)
+    {
+        // The worker, its address and the write authority hold for the whole run.
+        settings.enable         = m_settings.enable;
+        settings.worker         = m_settings.worker;
+        settings.path           = m_settings.path;
+        settings.port           = m_settings.port;
+        settings.secret         = m_settings.secret;
+        settings.writeAuthority = m_settings.writeAuthority;
+        m_settings = settings;
+        return true;
+    }
+
+    settings.writeAuthority = m_file.GetBoolDefault("AH.Service.WriteAuthority", false);
+    if (settings.writeAuthority && !settings.custody)
+    {
+        sLog.outError("AH.Service.WriteAuthority = 1 requires AH.Service.Custody = 1; forcing WriteAuthority OFF.");
+        settings.writeAuthority = false;
+    }
+
+    // Reconcile-on-reconnect reads the worker journal; without the table a
+    // committed bid would read as absent and be refunded twice.
+    if (settings.writeAuthority)
+    {
+        QueryResult* journal = CharacterDatabase.Query("SHOW TABLES LIKE 'ah_worker_journal'");
+        if (!journal)
+        {
+            sLog.outError("AH.Service.WriteAuthority = 1 but the `ah_worker_journal` table is missing; "
+                          "apply the SP-2 migration first. Forcing WriteAuthority OFF.");
+            settings.writeAuthority = false;
+        }
+        delete journal;
+    }
+
+    if (settings.writeAuthority && !settings.worker)
+    {
+        sLog.outError("AH.Service.WriteAuthority = 1 but AH.Service.Worker = 0: no worker will start; "
+                      "all AH mutations will be unavailable.");
+    }
+
+    m_settings = settings;
+    return true;
+}
diff --git a/src/modules/AhService/world/AhService.h b/src/modules/AhService/world/AhService.h
new file mode 100644
index 0000000000..1ad1c8426e
--- /dev/null
+++ b/src/modules/AhService/world/AhService.h
@@ -0,0 +1,99 @@
+/**
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * MaNGOS is a full featured server for World of Warcraft, supporting
+ * the following clients: 1.12.x, 2.4.3, 3.3.5a, 4.3.4a and 5.4.8
+ *
+ * Copyright (C) 2005-2026 MaNGOS <https://www.getmangos.eu>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * World of Warcraft, and all World of Warcraft or Warcraft art, images,
+ * and lore are copyrighted by Blizzard Entertainment, Inc.
+ */
+
+#ifndef MANGOS_H_AHSERVICE
+#define MANGOS_H_AHSERVICE
+
+#include "Platform/Define.h"
+#include "Config/Config.h"
+#include "BrowsePending.h"
+#include "MutationPending.h"
+
+#include <string>
+
+class WorkerSupervisor;
+
+/// The keys of ah-service.conf that mangosd reads; the worker reads the rest.
+struct AhServiceSettings
+{
+    bool enable = false;
+    bool worker = false;                                    ///< spawn and supervise the ah-service child
+    std::string path;
+    uint16 port = 5760;
+    std::string secret;
+    int32 intentTtlSec = 900;
+    bool custody = false;
+    bool writeAuthority = false;                            ///< read once at startup
+    std::string custodyCrashAt;                             ///< test only
+    std::string custodyFailCommitAt;                        ///< test only
+};
+
+/**
+ * @brief State of the auction house service inside mangosd.
+ *
+ * Owned by the world thread: created at configuration load, started before
+ * the world loop and stopped after it.
+ */
+class AhService
+{
+    public:
+
+        /// Loads ah-service.conf; false when it cannot be opened.
+        bool LoadConfig(bool reload);
+
+        AhServiceSettings const& Settings() const { return m_settings; }
+        std::string const& ConfigPath() const { return m_configPath; }
+
+        bool IsCustodyEnabled() const { return m_settings.custody; }
+        void SetCustody(bool on) { m_settings.custody = on; }
+        void SetCustodyFailCommitAt(std::string const& phase) { m_settings.custodyFailCommitAt = phase; }
+        bool IsWriteAuthority() const { return m_settings.writeAuthority; }
+        /// The worker is the configured authority, whether or not it is running.
+        bool IsWorkerConfigured() const { return m_settings.worker; }
+
+        void SetSupervisor(WorkerSupervisor* supervisor) { m_supervisor = supervisor; }
+        WorkerSupervisor* GetSupervisor() const { return m_supervisor; }
+        bool IsWorkerActive() const;
+
+        BrowsePendingMap& GetBrowsePending() { return m_browsePending; }
+        MutationPendingMap& GetMutationPending() { return m_mutationPending; }
+
+        static AhService& Instance();
+
+    private:
+
+        AhService() : m_supervisor(NULL) {}
+
+        Config m_file;
+        std::string m_configPath;
+        AhServiceSettings m_settings;
+        WorkerSupervisor* m_supervisor;
+        BrowsePendingMap m_browsePending;
+        MutationPendingMap m_mutationPending;
+};
+
+#define sAhService AhService::Instance()
+
+#endif
diff --git a/src/modules/AhService/world/AhServiceBook.cpp b/src/modules/AhService/world/AhServiceBook.cpp
new file mode 100644
index 0000000000..36bf50315f
--- /dev/null
+++ b/src/modules/AhService/world/AhServiceBook.cpp
@@ -0,0 +1,964 @@
+/**
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * MaNGOS is a full featured server for World of Warcraft, supporting
+ * the following clients: 1.12.x, 2.4.3, 3.3.5a, 4.3.4a and 5.4.8
+ *
+ * Copyright (C) 2005-2026 MaNGOS <https://www.getmangos.eu>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * World of Warcraft, and all World of Warcraft or Warcraft art, images,
+ * and lore are copyrighted by Blizzard Entertainment, Inc.
+ */
+
+/**
+ * @file AhServiceBook.cpp
+ * @brief The custody variants of the auction book's settlements.
+ */
+
+#include "AhServiceBook.h"
+#include "AhService.h"
+#include "AccountMgr.h"
+#include "AuctionHouseMgr.h"
+#include "CustodyLedger.h"
+#include "CustodyService.h"
+#include "Database/DatabaseEnv.h"
+#include "Item.h"
+#include "Language.h"
+#include "Log.h"
+#include "Mail.h"
+#include "ObjectGuid.h"
+#include "ObjectMgr.h"
+#include "Player.h"
+#include "World.h"
+#include "WorldPacket.h"
+#include "WorldSession.h"
+
+#include <sstream>
+#include <string>
+#include <vector>
+
+void AhAuditCustodyReconcile(char const* phase)
+{
+    if (!sAhService.IsCustodyEnabled())
+    {
+        return;
+    }
+
+    CustodyReconcileReport report;
+    CustodyService::ReconcileScan(static_cast<uint64>(time(NULL)),
+                                  CUSTODY_SCAN_BOOT, report);
+    CustodyService::LogReconcileReport(phase, report);
+}
+
+/**
+ * @brief Custody co-commit variant of SendAuctionExpiredMail.
+ *
+ * Reproduces SendAuctionExpiredMail EXACTLY (owner-exists guard, expired subject,
+ * item return to the seller by mail; destroy branch when the account is gone)
+ * but co-commits the item return mail into the caller's already-open
+ * CharacterDatabase transaction and flips the "item:<Id>" escrow row to
+ * TERMINAL_OK. The online owner's SMSG_AUCTION_OWNER_NOTIFICATION (the "expired"
+ * form, sold=false, bid/outbid/bidder all 0) is deferred into @p def BEFORE the
+ * mail push so packet order stays notify-then-mail (legacy :307). RemoveAItem
+ * (+ live item destroy on the no-owner branch) is deferred in legacy order (spec
+ * S6 / C7). itemGuidLow is intentionally NOT zeroed on the custody path: success
+ * deletes the AuctionEntry, and on rollback the original GUID must survive for
+ * the next tick's re-resolution. Reads auction->owner/itemGuidLow, so the caller
+ * MUST call this before mutating them (there is none in S6; expire deletes the
+ * auction).
+ *
+ * @param auction The expired (no-bidder) auction entry.
+ * @param def     Ordered deferred-effects queue for this co-commit.
+ */
+void AhSendAuctionExpiredMailInTransaction(AuctionEntry* auction, CustodyDeferred& def)
+{
+    // return an item in auction to its owner by mail
+    Item* pItem = sAuctionMgr.GetAItem(auction->itemGuidLow);
+    if (!pItem)
+    {
+        sLog.outError("Auction item (GUID: %u) not found, and lost.", auction->itemGuidLow);
+        // The item is already absent from the live AH cache (legacy loses it too,
+        // sending nothing). Still terminalize the "item:<Id>" escrow row
+        // ledger-only: the caller (ExpireUnsoldCustody) deletes the auction
+        // UNCONDITIONALLY after this returns, so leaving the row CST_RESERVED
+        // would orphan a non-terminal custody row with no live auction (breaking
+        // the reconciliation invariant). Do NOT touch item_instance here -- legacy
+        // does not, and the DB row's state is unknown when the cache has drifted.
+        CustodyService::CommitGoldLedgerOnly("item:" + std::to_string(auction->Id));
+        return;
+    }
+
+    ObjectGuid owner_guid = ObjectGuid(HIGHGUID_PLAYER, auction->owner);
+    Player* owner = sObjectMgr.GetPlayer(owner_guid);
+
+    uint32 owner_accId = 0;
+    if (!owner)
+    {
+        owner_accId = sObjectMgr.GetPlayerAccountIdByGUID(owner_guid);
+    }
+
+    // Snapshot the item guid-low before any deferral; the deferred RemoveAItem
+    // closure must capture a stable value (the auction object itself is deleted
+    // by the trailing deferred closure on commit success).
+    uint32 const savedItemGuidLow = auction->itemGuidLow;
+
+    // owner exist
+    if (owner || owner_accId)
+    {
+        std::ostringstream subject;
+        subject << auction->itemTemplate << ":" << auction->itemRandomPropertyId << ":" << AUCTION_EXPIRED;
+
+        // Defer the online owner-expired notification, snapshotting every field
+        // BY VALUE (the auction is deleted in the same deferred run). Appended
+        // BEFORE the RemoveAItem and the mail push so packet order stays
+        // notify-then-mail (legacy :307). An unsold expiry carries bid==0,
+        // outbid==0, bidder==0 (the "expired" form, sold=false). Re-resolves the
+        // owner by GUID at run time, skipping the packet if offline -- the
+        // durable mail row is authoritative (spec I2).
+        if (owner)
+        {
+            uint32 ownerGuidLow = auction->owner;
+            uint32 houseId  = auction->GetHouseId();
+            uint32 aucId    = auction->Id;
+            uint32 itemTpl  = auction->itemTemplate;
+            int32  itemRand = auction->itemRandomPropertyId;
+            def.effects.push_back([ownerGuidLow, houseId, aucId, itemTpl, itemRand]()
+            {
+                Player* p = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, ownerGuidLow));
+                if (p)
+                {
+                    AhSendAuctionOwnerNotificationData(p->GetSession(), houseId, aucId, 0, 0, 0, itemTpl, itemRand, false);
+                }
+            });
+        }
+
+        // Defer RemoveAItem FIRST (legacy :310 ran before the mail;
+        // SendMailToInTransaction appends its own push AFTER this). Mirror S5
+        // cancel :979-982. Do NOT zero auction->itemGuidLow synchronously here:
+        // that in-memory write would survive a checked-commit rollback (the
+        // auction stays in the map with itemGuidLow==0, the next tick re-resolves
+        // to GetAItem(0)==NULL -> item lost, "item:" row orphaned). The auction is
+        // deleted by the trailing deferred closure on success, so the field never
+        // needs zeroing; on rollback it must stay valid for re-resolution. S4's
+        // SendAuctionWonMailInTransaction likewise never zeroes it.
+        def.effects.push_back([savedItemGuidLow]()
+        {
+            sAuctionMgr.RemoveAItem(savedItemGuidLow);
+        });
+
+        // Return the item via DeliverItem: flips "item:<Id>" -> TERMINAL_OK AND
+        // co-commits the return mail (queues the online owner's AddMItem
+        // disposal). An expiry return needs no item_instance.owner_guid UPDATE
+        // (the seller already owns the item). Mirror S5 cancel :984-987.
+        MailDraft itemReturn(subject.str(), "");
+        itemReturn.AddItem(pItem);
+        CustodyService::DeliverItem(def, "item:" + std::to_string(auction->Id), itemReturn,
+                                    MailReceiver(owner, owner_guid), MailSender(auction),
+                                    MAIL_CHECK_MASK_COPIED);
+    }
+    // owner not found (destroy)
+    else
+    {
+        // DELETE the item_instance row IN-TXN (appends to the caller's open txn).
+        CharacterDatabase.PExecute("DELETE FROM `item_instance` WHERE `guid`='%u'", savedItemGuidLow);
+
+        // Terminalize the escrow row: this branch sends no mail, so DeliverItem
+        // is NOT called and nothing else flips "item:". The §0 lesson -- without
+        // this the row stays CST_RESERVED after the auction row is deleted ->
+        // orphaned non-terminal row.
+        CustodyService::CommitGoldLedgerOnly("item:" + std::to_string(auction->Id));
+
+        // Defer RemoveAItem + the live `delete pItem` (X5: the destroy must run
+        // only after the checked commit succeeds, NOT inside the txn -- on
+        // rollback the row survives and so must the live Item*). Mirror
+        // SendAuctionWonMailInTransaction's destroy branch :534-548. As in the
+        // owner-exists branch, do NOT zero auction->itemGuidLow synchronously --
+        // it must survive a rollback for the next tick's re-resolution.
+        def.effects.push_back([savedItemGuidLow, pItem]()
+        {
+            sAuctionMgr.RemoveAItem(savedItemGuidLow);
+            delete pItem;
+        });
+    }
+}
+
+/**
+ * @brief Custody co-commit variant of SendAuctionSuccessfulMail.
+ *
+ * Reproduces SendAuctionSuccessfulMail EXACTLY (owner-exists guard, subject/body,
+ * profit = bid + deposit - cut) but co-commits the seller payout mail into the
+ * caller's already-open CharacterDatabase transaction via SendMailToInTransaction.
+ * If the owner is online, the SMSG_AUCTION_OWNER_NOTIFICATION (sold) is snapshotted
+ * BY VALUE and appended to @p def BEFORE the mail's own push closure, preserving
+ * the legacy notify-then-mail packet order. Reads auction->bid/bidder, so the
+ * caller MUST call this before any bid/bidder mutation (spec B / S4).
+ *
+ * @param auction The auction being resolved.
+ * @param def     Ordered deferred-effects queue for this co-commit.
+ */
+void AhSendAuctionSuccessfulMailInTransaction(AuctionEntry* auction, CustodyDeferred& def)
+{
+    ObjectGuid owner_guid = ObjectGuid(HIGHGUID_PLAYER, auction->owner);
+    Player* owner = sObjectMgr.GetPlayer(owner_guid);
+
+    uint32 owner_accId = 0;
+    if (!owner)
+    {
+        owner_accId = sObjectMgr.GetPlayerAccountIdByGUID(owner_guid);
+    }
+
+    // owner exist
+    if (owner || owner_accId)
+    {
+        std::ostringstream msgAuctionSuccessfulSubject;
+        msgAuctionSuccessfulSubject << auction->itemTemplate << ":" << auction->itemRandomPropertyId << ":" << AUCTION_SUCCESSFUL;
+
+        std::ostringstream auctionSuccessfulBody;
+        uint32 auctionCut = auction->GetAuctionCut();
+
+        auctionSuccessfulBody.width(16);
+        auctionSuccessfulBody << std::right << std::hex << auction->bidder;
+        auctionSuccessfulBody << std::dec << ":" << auction->bid << ":" << auction->buyout;
+        auctionSuccessfulBody << ":" << auction->deposit << ":" << auctionCut;
+
+        DEBUG_LOG("AuctionSuccessful body string : %s", auctionSuccessfulBody.str().c_str());
+
+        uint32 profit = auction->bid + auction->deposit - auctionCut;
+
+        // Defer the online owner-sold notification, snapshotting every field BY
+        // VALUE (the auction is deleted in the same deferred run). Appended BEFORE
+        // SendMailToInTransaction's own online push so packet order stays
+        // notify-then-mail (legacy :264). Captures the owner low GUID + scalars
+        // only and RE-RESOLVES the player by GUID at run time, skipping the packet
+        // if offline -- the durable mail row is authoritative (spec I2).
+        if (owner)
+        {
+            uint32 ownerGuidLow = auction->owner;
+            uint32 houseId  = auction->GetHouseId();
+            uint32 aucId    = auction->Id;
+            uint32 bidValue = auction->bid;
+            uint32 outbid   = auction->GetAuctionOutBid();
+            uint32 bidder   = auction->bidder;
+            uint32 itemTpl  = auction->itemTemplate;
+            int32  itemRand = auction->itemRandomPropertyId;
+            def.effects.push_back([ownerGuidLow, houseId, aucId, bidValue, outbid, bidder, itemTpl, itemRand]()
+            {
+                Player* p = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, ownerGuidLow));
+                if (p)
+                {
+                    AhSendAuctionOwnerNotificationData(p->GetSession(), houseId, aucId, bidValue, outbid, bidder, itemTpl, itemRand, true);
+                }
+            });
+        }
+
+        MailDraft(msgAuctionSuccessfulSubject.str(), auctionSuccessfulBody.str())
+            .SetMoney(profit)
+            .SendMailToInTransaction(MailReceiver(owner, owner_guid), MailSender(auction), def.effects, MAIL_CHECK_MASK_COPIED);
+    }
+}
+
+/**
+ * @brief Custody co-commit variant of SendAuctionWonMail.
+ *
+ * Reproduces SendAuctionWonMail EXACTLY (GM-log block, subject/body, owner UPDATE
+ * vs destroy branches) but co-commits the winner item mail into the caller's
+ * already-open CharacterDatabase transaction. On the receiver-exists branch the
+ * item_instance owner UPDATE appends in-txn and the bidder notification +
+ * RemoveAItem + itemGuidLow=0 are deferred in legacy order; on the no-receiver
+ * branch the item_instance DELETE appends in-txn and RemoveAItem + itemGuidLow=0 +
+ * the live `delete pItem` are deferred (X5: destroy outside the txn, run only on
+ * commit success). Reads auction->bidder, so the caller MUST set it before calling
+ * (spec C / S4).
+ *
+ * @param auction The auction being resolved.
+ * @param def     Ordered deferred-effects queue for this co-commit.
+ */
+void AhSendAuctionWonMailInTransaction(AuctionEntry* auction, CustodyDeferred& def)
+{
+    Item* pItem = sAuctionMgr.GetAItem(auction->itemGuidLow);
+    if (!pItem)
+    {
+        return;
+    }
+
+    ObjectGuid bidder_guid = ObjectGuid(HIGHGUID_PLAYER, auction->bidder);
+    Player* bidder = sObjectMgr.GetPlayer(bidder_guid);
+
+    uint32 bidder_accId = 0;
+
+    ObjectGuid ownerGuid = ObjectGuid(HIGHGUID_PLAYER, auction->owner);
+    // data for gm.log (kept identical to SendAuctionWonMail)
+    if (sWorld.getConfig(CONFIG_BOOL_GM_LOG_TRADE))
+    {
+        AccountTypes bidder_security;
+        std::string bidder_name;
+        if (bidder)
+        {
+            bidder_accId = bidder->GetSession()->GetAccountId();
+            bidder_security = bidder->GetSession()->GetSecurity();
+            bidder_name = bidder->GetName();
+        }
+        else
+        {
+            bidder_accId = sObjectMgr.GetPlayerAccountIdByGUID(bidder_guid);
+            bidder_security = bidder_accId ? sAccountMgr.GetSecurity(bidder_accId) : SEC_PLAYER;
+
+            if (bidder_security > SEC_PLAYER)               // not do redundant DB requests
+            {
+                if (!sObjectMgr.GetPlayerNameByGUID(bidder_guid, bidder_name))
+                {
+                    bidder_name = sObjectMgr.GetMangosStringForDBCLocale(LANG_UNKNOWN);
+                }
+            }
+        }
+
+        if (bidder_security > SEC_PLAYER)
+        {
+            std::string owner_name;
+            if (ownerGuid && !sObjectMgr.GetPlayerNameByGUID(ownerGuid, owner_name))
+            {
+                owner_name = sObjectMgr.GetMangosStringForDBCLocale(LANG_UNKNOWN);
+            }
+
+            uint32 owner_accid = sObjectMgr.GetPlayerAccountIdByGUID(ownerGuid);
+
+            sLog.outCommand(bidder_accId, "GM %s (Account: %u) won item in auction (Entry: %u Count: %u) and pay money: %u. Original owner %s (Account: %u)",
+                bidder_name.c_str(), bidder_accId, auction->itemTemplate, auction->itemCount, auction->bid, owner_name.c_str(), owner_accid);
+        }
+    }
+    else if (!bidder)
+    {
+        bidder_accId = sObjectMgr.GetPlayerAccountIdByGUID(bidder_guid);
+    }
+
+    // Snapshot the item guid-low before any deferral; the deferred RemoveAItem
+    // closure must capture a stable value (the auction object itself is deleted
+    // by the trailing deferred closure on commit success).
+    uint32 const savedItemGuidLow = auction->itemGuidLow;
+
+    // receiver exist
+    if (bidder || bidder_accId)
+    {
+        std::ostringstream msgAuctionWonSubject;
+        msgAuctionWonSubject << auction->itemTemplate << ":" << auction->itemRandomPropertyId << ":" << AUCTION_WON;
+
+        std::ostringstream msgAuctionWonBody;
+        msgAuctionWonBody.width(16);
+        msgAuctionWonBody << std::right << std::hex << auction->owner;
+        msgAuctionWonBody << std::dec << ":" << auction->bid << ":" << auction->buyout;
+        DEBUG_LOG("AuctionWon body string : %s", msgAuctionWonBody.str().c_str());
+
+        // set owner to bidder (to prevent delete item with sender char deleting)
+        // owner in `data` will set at mail receive and item extracting.
+        // Appends to the caller's OPEN transaction (no own Begin/Commit) (spec C).
+        CharacterDatabase.PExecute("UPDATE `item_instance` SET `owner_guid` = '%u' WHERE `guid`='%u'", auction->bidder, savedItemGuidLow);
+
+        // (1) Defer the online bidder-won notification, snapshotting every field BY
+        //     VALUE. Appended BEFORE the RemoveAItem and the mail push so packet
+        //     order = notify-then-mail (legacy :204). Re-resolves the bidder by
+        //     GUID at run time, skipping the packet if offline (spec I2).
+        if (bidder)
+        {
+            uint32 bidderGuidLow = auction->bidder;
+            uint32 houseId  = auction->GetHouseId();
+            uint32 aucId    = auction->Id;
+            uint32 bidValue = auction->bid;
+            uint32 outbid   = auction->GetAuctionOutBid();
+            uint32 itemTpl  = auction->itemTemplate;
+            int32  itemRand = auction->itemRandomPropertyId;
+            def.effects.push_back([bidderGuidLow, houseId, aucId, bidValue, outbid, itemTpl, itemRand]()
+            {
+                Player* p = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, bidderGuidLow));
+                if (p)
+                {
+                    AhSendAuctionBidderNotificationData(p->GetSession(), houseId, aucId, bidderGuidLow, bidValue, outbid, itemTpl, itemRand, true);
+                }
+            });
+        }
+
+        // (2) Defer RemoveAItem (legacy :207-208 ran before the mail;
+        //     SendMailToInTransaction appends its own push AFTER this).
+        def.effects.push_back([savedItemGuidLow]()
+        {
+            sAuctionMgr.RemoveAItem(savedItemGuidLow);
+        });
+
+        // (3) Co-commit the winner mail; its online push closure is appended AFTER
+        //     (1)+(2), matching legacy notify -> RemoveAItem -> mail order.
+        MailDraft(msgAuctionWonSubject.str(), msgAuctionWonBody.str())
+            .AddItem(pItem)
+            .SendMailToInTransaction(MailReceiver(bidder, bidder_guid), MailSender(auction), def.effects, MAIL_CHECK_MASK_COPIED);
+    }
+    // receiver not exist (destroy)
+    else
+    {
+        // DELETE the item_instance row IN-TXN (appends to the caller's open txn).
+        CharacterDatabase.PExecute("DELETE FROM `item_instance` WHERE `guid`='%u'", savedItemGuidLow);
+
+        // Defer RemoveAItem + the live `delete pItem` (X5: the destroy must run
+        // only after the checked commit succeeds, NOT inside the txn -- on
+        // rollback the row survives and so must the live Item*).
+        def.effects.push_back([savedItemGuidLow, pItem]()
+        {
+            sAuctionMgr.RemoveAItem(savedItemGuidLow);
+            delete pItem;
+        });
+    }
+}
+
+/**
+ * @brief Dispatcher for the in-process browse fallback (C1/I1).
+ *
+ * Routes to one of the three existing BuildList* methods based on @p kind:
+ *   0 (or default) = LIST public browse  -> BuildListAuctionItems
+ *   1              = OWNER               -> BuildListOwnerItems
+ *   2              = BIDDER              -> client-outbid prepend + BuildListBidderItems
+ *
+ * For BIDDER the @p clientOutbidIds entries from the stored request are
+ * prepended in CLIENT ORDER ahead of the sweep, matching the live handler's
+ * behaviour in HandleAuctionListBidderItems.  The three inner builders are
+ * completely unchanged; this is a thin dispatcher only.
+ *
+ * @param kind           Browse kind: 0=LIST, 1=OWNER, 2=BIDDER.
+ * @param data           Packet buffer to append auction entries to.
+ * @param player         The resolving player (re-resolved by Task-11 fallback).
+ * @param wname          Name search filter (LIST only).
+ * @param listfrom       Starting offset (LIST only).
+ * @param levelmin       Min required-level filter (LIST only).
+ * @param levelmax       Max required-level filter (LIST only).
+ * @param usable         Usability filter (LIST only).
+ * @param invType        Inventory-type filter (LIST only).
+ * @param itemClass      Item-class filter (LIST only).
+ * @param itemSubClass   Item-subclass filter (LIST only).
+ * @param quality        Minimum quality filter (LIST only).
+ * @param clientOutbidIds Client-supplied outbid auction ids (BIDDER only).
+ * @param count          Receives appended-entry count.
+ * @param totalcount     Receives total matching count.
+ */
+void AhBuildListForKind(AuctionHouseObject& house, uint8 kind, WorldPacket& data, Player* player,
+    const std::wstring& wname, uint32 listfrom, uint32 levelmin, uint32 levelmax,
+    uint32 usable, uint32 invType, uint32 itemClass, uint32 itemSubClass,
+    uint32 quality, const std::vector<uint32>& clientOutbidIds,
+    uint32& count, uint32& totalcount)
+{
+    switch (kind)
+    {
+        case 1: // BROWSE_OWNER
+            house.BuildListOwnerItems(data, player, count, totalcount);
+            break;
+        case 2: // BROWSE_BIDDER
+        {
+            // Client outbid ids prepended in CLIENT ORDER (matches the live handler).
+            for (size_t i = 0; i < clientOutbidIds.size(); ++i)
+            {
+                AuctionEntry* a = house.GetAuction(clientOutbidIds[i]);
+                if (a && a->BuildAuctionInfo(data))
+                {
+                    ++totalcount;
+                    ++count;
+                }
+            }
+            house.BuildListBidderItems(data, player, count, totalcount);
+            break;
+        }
+        case 0: // BROWSE_LIST
+        default:
+            house.BuildListAuctionItems(data, player, wname, listfrom, levelmin, levelmax,
+                usable, invType, itemClass, itemSubClass, quality, count, totalcount);
+            break;
+    }
+}
+
+/**
+ * @brief Test seam for the client-outbid-prepend order contract.
+ *
+ * Records the ids from @p clientIds into @p outOrder in CLIENT ORDER, locking
+ * the invariant that BuildListForKind(BIDDER=2) prepends them before the sweep.
+ * Called only by the -t ahbrowsehelper smoke test.
+ */
+void AhAppendClientOutbidsForTest(const std::vector<uint32>& clientIds,
+                                  std::vector<uint32>& outOrder)
+{
+    for (size_t i = 0; i < clientIds.size(); ++i)
+    {
+        outOrder.push_back(clientIds[i]);
+    }
+}
+
+/**
+ * @brief Custody co-commit mirror of AuctionBidWinning (orchestrator, spec S4).
+ *
+ * Appends every DB write to the caller's ALREADY-OPEN CharacterDatabase
+ * transaction and defers every in-memory effect into @p def; the caller
+ * checked-commits then runs @p def. The deferred-effect order matches the legacy
+ * resolution: owner-notify -> seller-mail -> bidder-notify -> winner-mail
+ * (rendered by the two co-commit mail cores), then -- pushed LAST -- the AH map
+ * RemoveAuction + `delete this`, so the in-memory auction survives until the very
+ * end of def.run() (earlier closures that read auction fields snapshot by value).
+ *
+ * The seller payout and winner item delivery always retain legacy behavior.
+ * Seller item/deposit rows and the bidder row are terminalized independently,
+ * according to the route facts validated by the caller.
+ *
+ * Gold note: do NOT re-save newbidder's gold here. On a buyout it was already
+ * saved by ReserveGold/TopUpBid in UpdateBidCustody; on the expiry path newbidder
+ * is NULL.
+ *
+ * @param newbidder The online winner (buyout) or NULL (expiry).
+ * @param def       Ordered deferred-effects queue for this co-commit.
+ */
+void AhAuctionBidWinningCustody(AuctionEntry& a, Player* newbidder, CustodyDeferred& def,
+                                bool usesPlayerSellerCustody,
+                                bool hasLiveBidCustody,
+                                std::string const& knownBidKey)
+{
+    // (void) newbidder: its gold is already persisted by the bid seam (buyout) or
+    // it is NULL (expiry); the auction UPDATE/DELETE persists the rest.
+    (void)newbidder;
+
+    // 1) Seller payout = bid + deposit - cut (single legacy mail; owner-notify
+    //    deferred BEFORE the mail push by the co-commit core).
+    AhSendAuctionSuccessfulMailInTransaction(&a, def);
+
+    // 2) Net player-seller custody only. The seller mail above already carries
+    //    the deposit return and proceeds, so these are ledger-only transitions.
+    if (usesPlayerSellerCustody)
+    {
+        CustodyService::RollbackGoldLedgerOnly("dep:" + std::to_string(a.Id));
+    }
+
+    // The caller either validated this existing key before BeginTransaction or
+    // created it in this same transaction while processing a buyout.
+    if (hasLiveBidCustody)
+    {
+        CustodyService::CommitGoldLedgerOnly(knownBidKey);
+    }
+
+    // 3) Item to winner (receiver-exists owner UPDATE) or destroy (bidder == 0 ->
+    //    account lookup fails -> destroy branch). Bidder-notify + RemoveAItem +
+    //    (destroy: delete pItem) are deferred by the co-commit core.
+    AhSendAuctionWonMailInTransaction(&a, def);
+
+    if (usesPlayerSellerCustody)
+    {
+        CustodyService::CommitGoldLedgerOnly("item:" + std::to_string(a.Id));
+    }
+
+    // 4) Delete the auction row IN-TXN (appends to the caller's open transaction).
+    a.DeleteFromDB();
+
+    // 5) Defer the AH-map erase + object delete LAST, so `this` stays valid for
+    //    every earlier deferred closure throughout def.run(). Snapshot the map
+    //    pointer + Id by value (the closure must not read `this` after delete).
+    AuctionHouseObject* houseMap = sAuctionMgr.GetAuctionsMap(a.auctionHouseEntry);
+    uint32 const aucId = a.Id;
+    AuctionEntry* self = &a;
+    def.effects.push_back([houseMap, aucId, self]()
+    {
+        houseMap->RemoveAuction(aucId);
+        delete self;
+    });
+}
+
+/**
+ * @brief Custody co-commit mirror of the unsold-expiry path (spec S6).
+ *
+ * The no-bidder expiry branch of AuctionHouseObject::Update() routes here when
+ * the auction carries live custody rows. Returns the item to the seller by mail
+ * (or destroys it if the account is gone), forfeits the deposit to the house,
+ * deletes the auction row, and defers every in-memory effect (owner-expired
+ * notification, mail push, RemoveAItem, RemoveAuction, delete this) into @p def.
+ * Every DB write appends to the caller's ALREADY-OPEN CharacterDatabase
+ * transaction; the caller checked-commits it then runs @p def (spec Sec 6 S6).
+ * S6 makes NO synchronous in-memory mutation (every effect is deferred), so on
+ * rollback there is nothing to restore -- the auction + item survive intact and
+ * the next tick re-resolves cleanly.
+ */
+void AhExpireUnsoldCustody(AuctionEntry& a, CustodyDeferred& def)
+{
+    // 1) Return the item to the seller (or destroy if the account is gone) +
+    //    flip the "item:<Id>" escrow row, all co-committed; the online owner's
+    //    expired notification + RemoveAItem are deferred by the co-commit core.
+    AhSendAuctionExpiredMailInTransaction(&a, def);
+
+    // 2) Deposit FORFEIT to the house on an unsold expiry (legacy keeps it):
+    //    flip "dep:<Id>" -> TERMINAL_OK ledger-only (house sink, no money, no
+    //    mail). Mirror S5 cancel's deposit forfeit.
+    CustodyService::CommitGoldLedgerOnly("dep:" + std::to_string(a.Id));
+
+    // 3) Delete the auction row IN-TXN (appends to the caller's open transaction).
+    a.DeleteFromDB();
+
+    // 4) Defer the AH-map erase + object delete LAST, so `this` stays valid for
+    //    every earlier deferred closure throughout def.run(). Snapshot the map
+    //    pointer + Id by value (the closure must not read `this` after delete).
+    //    Mirror AuctionBidWinningCustody :1373-1380.
+    AuctionHouseObject* houseMap = sAuctionMgr.GetAuctionsMap(a.auctionHouseEntry);
+    uint32 const aucId = a.Id;
+    AuctionEntry* self = &a;
+    def.effects.push_back([houseMap, aucId, self]()
+    {
+        houseMap->RemoveAuction(aucId);
+        delete self;
+    });
+}
+
+void AhPrepareCancelCustody(AuctionEntry& a, Player* seller, CustodyDeferred& def,
+                            bool usesPlayerSellerCustody,
+                            bool hasLiveBidCustody,
+                            std::string const& liveBidKey,
+                            uint32 auctionCut)
+{
+    if (a.bid)
+    {
+        seller->ModifyMoney(-int32(auctionCut));
+    }
+
+    if (a.bidder != 0)
+    {
+        if (hasLiveBidCustody)
+        {
+            CustodyService::RollbackGoldLedgerOnly(liveBidKey);
+        }
+        AhSendAuctionCancelledToBidderMailInTransaction(&a, def);
+    }
+
+    if (usesPlayerSellerCustody)
+    {
+        CustodyService::CommitGoldLedgerOnly("dep:" + std::to_string(a.Id));
+    }
+
+    Item* item = sAuctionMgr.GetAItem(a.itemGuidLow);
+    MANGOS_ASSERT(item);
+    uint32 const savedItemGuidLow = a.itemGuidLow;
+    def.effects.push_back([savedItemGuidLow]()
+    {
+        sAuctionMgr.RemoveAItem(savedItemGuidLow);
+    });
+
+    std::ostringstream subject;
+    subject << a.itemTemplate << ":" << a.itemRandomPropertyId << ":" << AUCTION_CANCELED;
+    MailDraft itemReturn(subject.str(), "");
+    itemReturn.AddItem(item);
+    if (usesPlayerSellerCustody)
+    {
+        CustodyService::DeliverItem(def, "item:" + std::to_string(a.Id), itemReturn,
+                                    MailReceiver(seller), MailSender(&a),
+                                    MAIL_CHECK_MASK_COPIED);
+    }
+    else
+    {
+        itemReturn.SendMailToInTransaction(MailReceiver(seller), MailSender(&a),
+                                           def.effects, MAIL_CHECK_MASK_COPIED);
+    }
+
+    seller->SaveInventoryAndGoldToDB();
+    a.DeleteFromDB();
+}
+
+/**
+ * @brief Custody co-commit mirror of UpdateBid.
+ *
+ * Reproduces UpdateBid's gold movement EXACTLY but through the custody
+ * primitives, appending every DB write to the caller's already-open
+ * CharacterDatabase transaction (the caller opens and checked-commits it).
+ * Live effects (outbid notify + refund mail push) are queued into @p def and
+ * run only after the checked commit succeeds.
+ *
+ * A buyout (newbid >= buyout) is absorbed here (Task 10): the bid is capped at
+ * buyout, reserved/refunded as a normal bid, then the win is resolved on the same
+ * open transaction via AuctionBidWinningCustody, which defers the auction delete
+ * + cache mutations into @p def. Returns false on a buyout (auction no longer
+ * active), true on a normal bid.
+ *
+ * @param newbid     The new bid amount (capped at buyout here, as in UpdateBid).
+ * @param newbidder  The bidding player, or NULL for a generated bot bid.
+ * @param def        Ordered deferred-effects queue for this co-commit.
+ * @param liveBidKey idem_key of the existing live bid row (validated by the
+ *                   handler), empty when the auction has no live bidder.
+ * @return true if the auction remains active (normal bid); false on buyout.
+ */
+bool AhUpdateBidCustody(AuctionEntry& a, uint32 newbid, Player* newbidder, CustodyDeferred& def,
+                        bool usesPlayerSellerCustody,
+                        bool hadLiveBidCustody,
+                        std::string const& liveBidKey)
+{
+    // Cap the bid at buyout FIRST, mirroring UpdateBid (:1055-1058). A buyout bid
+    // (newbid >= buyout) now runs through custody (Task 10): it reserves/refunds
+    // exactly like a normal bid and then resolves the win in this same open txn.
+    if (a.buyout && newbid > a.buyout)
+    {
+        newbid = a.buyout;
+    }
+    bool const isBuyout = (a.buyout != 0 && newbid >= a.buyout);
+
+    // The idem_key of the bid row that becomes the winner's bid on a buyout. On a
+    // same-bidder buyout it is the existing (topped-up) live bid row; otherwise it
+    // is the freshly reserved row. Passed to AuctionBidWinningCustody so it can
+    // commit-net the row WITHOUT a synchronous SELECT (the row is uncommitted in
+    // this same open txn). Empty when bidder ends up 0 (no row to commit).
+    std::string winningBidKey;
+
+    if (newbidder && newbidder->GetGUIDLow() == a.bidder)
+    {
+        if (hadLiveBidCustody)
+        {
+            CustodyService::TopUpBid(liveBidKey, newbid, newbid - a.bid, newbidder);
+            winningBidKey = liveBidKey;
+        }
+        else
+        {
+            // Seller custody can meet a legacy standing bid. Preserve the
+            // legacy delta debit, then establish custody at the full new amount.
+            newbidder->ModifyMoney(-int32(newbid - a.bid));
+            newbidder->SaveInventoryAndGoldToDB();
+            winningBidKey = "bid:" + std::to_string(a.Id) + ":" +
+                            std::to_string(CustodyLedger::NextBidSeq(a.Id));
+            CustodyService::ReserveGoldAlreadyDebited(
+                newbidder->GetGUIDLow(), newbid, winningBidKey, a.Id, ROLE_BID);
+        }
+    }
+    else
+    {
+        // Refund/displace a REAL prior bidder first (reads the OLD bid), then
+        // reserve the new bidder's full amount. A bot-displaced bid
+        // (bid>0, bidder==0) carries no custody row: no rollback, no outbid mail
+        // (matches UpdateBid's `if (bidder)` skipping the refund -- spec R2).
+        if (a.bidder != 0)
+        {
+            if (hadLiveBidCustody)
+            {
+                CustodyService::RollbackGoldLedgerOnly(liveBidKey);
+            }
+            AhSendAuctionOutbiddedMailInTransaction(&a, def);
+        }
+
+        // Reserve the new bidder's full bid (debits -newbid + SaveInventory).
+        // Mirrors UpdateBid's `if (newbidder) ModifyMoney(-newbid)`.
+        // NextBidSeq returns MAX(id) of existing bid rows: monotonic, never
+        // decreases after TTL pruning, so the suffix is always strictly greater
+        // than every existing row's suffix -- UNIQUE constraint cannot fire.
+        if (newbidder)
+        {
+            std::string newBidKey = "bid:" + std::to_string(a.Id) + ":" +
+                                    std::to_string(CustodyLedger::NextBidSeq(a.Id));
+            CustodyService::ReserveGold(def, newbidder->GetGUIDLow(),
+                                        newbidder, newbid, newBidKey, a.Id, ROLE_BID);
+            winningBidKey = newBidKey;
+        }
+    }
+
+    a.bidder = newbidder ? newbidder->GetGUIDLow() : 0;
+    a.bid = newbid;
+
+    if (!isBuyout)                                          // normal a.bid
+    {
+        // The new bidder's gold was already persisted by ReserveGold/TopUpBid
+        // (SaveInventoryAndGoldToDB), so do NOT save again. The auction UPDATE
+        // appends to the caller's open transaction.
+        CharacterDatabase.PExecute("UPDATE `auction` SET `buyguid` = '%u', `lastbid` = '%u' WHERE `id` = '%u'", a.bidder, a.bid, a.Id);
+        return true;
+    }
+
+    // Buyout: resolve the win on this same open transaction. The winner's gold is
+    // already persisted (ReserveGold/TopUpBid above), so AuctionBidWinningCustody
+    // does NOT re-save it. Pass winningBidKey so the bid-row commit-net does not
+    // SELECT for the uncommitted row. Generated buyers have no gold reservation.
+    // The auction is deleted in a deferred closure run only after the caller's
+    // checked commit succeeds.
+    AhAuctionBidWinningCustody(a, newbidder, def, usesPlayerSellerCustody,
+                             !winningBidKey.empty(), winningBidKey);
+    return false;
+}
+
+AuctionExpiry AhExpireAuction(AuctionEntry& auction)
+{
+    // Runtime disable stops config-gated custody entry and maintenance, not
+    // settlement of value already represented by durable rows.
+    CustodyRouteState const route = CustodyLedger::GetRouteState(auction.Id);
+    if (!route.known)
+    {
+        sLog.outError("custody route unavailable; deferring auction expiry");
+        return AUCTION_EXPIRY_STOP;
+    }
+
+    ///- perform the transaction if there was bidder
+    if (auction.bid)
+    {
+        // Seller and bid custody are independent. A worker/bot listing can
+        // carry only a player bid row; a player listing can still carry a
+        // legacy bid with no bid row.
+        if (!route.usesPlayerSellerCustody && !route.hasLiveBidCustody)
+        {
+            return AUCTION_EXPIRY_CORE;
+        }
+
+        std::string liveBidKey;
+        if (route.hasLiveBidCustody)
+        {
+            CustodyRow liveRow;
+            if (auction.bidder == 0 ||
+                !CustodyLedger::GetSingleLiveBidRow(auction.Id, liveRow) ||
+                liveRow.ownerGuid != auction.bidder ||
+                liveRow.amount != auction.bid)
+            {
+                sLog.outError("custody S4: live bid row validation failed for auction %u "
+                              "(bidder %u, bid %u); failing closed",
+                              auction.Id, auction.bidder, auction.bid);
+                return AUCTION_EXPIRY_DONE;
+            }
+            liveBidKey = liveRow.idemKey;
+        }
+
+        uint32 const auctionId = auction.Id;
+        CustodyDeferred def;
+        CharacterDatabase.BeginTransaction();
+        AhAuctionBidWinningCustody(auction, NULL, def, route.usesPlayerSellerCustody,
+                                   route.hasLiveBidCustody, liveBidKey);
+        CustodyService::MaybeCrash("pre-commit");
+        if (CharacterDatabase.CommitTransactionChecked())
+        {
+            CustodyService::MaybeCrash("pre-deferred");
+            def.run();
+        }
+        else
+        {
+            // Nothing live changed before the commit: the auction and its custody
+            // item survive and the next tick settles them again.
+            sLog.outError("custody S4: win txn rolled back for auction %u", auctionId);
+        }
+        return AUCTION_EXPIRY_DONE;
+    }
+
+    // Unsold expiry has no bid value to settle, so only player seller custody
+    // selects the custody transaction.
+    if (!route.usesPlayerSellerCustody)
+    {
+        return AUCTION_EXPIRY_CORE;
+    }
+
+    uint32 const auctionId = auction.Id;
+    CustodyDeferred def;
+    CharacterDatabase.BeginTransaction();
+    AhExpireUnsoldCustody(auction, def);
+    CustodyService::MaybeCrash("pre-commit");
+    if (CharacterDatabase.CommitTransactionChecked())
+    {
+        CustodyService::MaybeCrash("pre-deferred");
+        def.run();
+    }
+    else
+    {
+        sLog.outError("custody S6: expire txn rolled back for auction %u", auctionId);
+    }
+    return AUCTION_EXPIRY_DONE;
+}
+
+bool AhSettleGeneratedBid(AuctionEntry& auction, uint32 newbid, bool& stillActive, bool& applied)
+{
+    applied = false;
+    stillActive = false;
+
+    // Both service intents and the in-process buyer enter here. Preserve player
+    // custody when a generated bid displaces its current owner.
+    CustodyRouteState const route = CustodyLedger::GetRouteState(auction.Id);
+    if (!route.known)
+    {
+        return true;
+    }
+    if (!route.usesPlayerSellerCustody && !route.hasLiveBidCustody)
+    {
+        return false;
+    }
+
+    std::string liveBidKey;
+    if (route.hasLiveBidCustody)
+    {
+        CustodyRow row;
+        if (auction.bidder == 0u || !CustodyLedger::GetSingleLiveBidRow(auction.Id, row) ||
+            row.ownerGuid != auction.bidder || row.amount != auction.bid)
+        {
+            sLog.outError("custody bot bid validation failed for auction %u", auction.Id);
+            return true;
+        }
+        liveBidKey = row.idemKey;
+    }
+
+    uint32 const oldBid = auction.bid;
+    uint32 const oldBidder = auction.bidder;
+    CustodyDeferred def;
+    if (!CharacterDatabase.BeginTransaction())
+    {
+        return true;
+    }
+    bool const active = AhUpdateBidCustody(auction, newbid, NULL, def,
+        route.usesPlayerSellerCustody, route.hasLiveBidCustody, liveBidKey);
+    if (!CustodyService::CommitCheckedOrForcedFail("bot-bid"))
+    {
+        auction.bid = oldBid;
+        auction.bidder = oldBidder;
+        return true;
+    }
+    applied = true;
+    stillActive = active;
+    def.run(); // A successful buyout deletes this auction last.
+    return true;
+}
+
+void AhPlaceGeneratedBid(AuctionEntry& auction, uint32 newbid, bool& applied)
+{
+    bool stillActive = false;
+    if (!AhSettleGeneratedBid(auction, newbid, stillActive, applied))
+    {
+        auction.UpdateBid(newbid);
+        applied = true;
+    }
+}
+
+AuctionEntry* AhAddAuctionInTransaction(AuctionHouseObject& house, AuctionHouseEntry const* auctionHouseEntry,
+                                        Item* newItem, uint32 etime, uint32 bid, uint32 buyout,
+                                        uint32 deposit, Player* pl)
+{
+    uint32 auction_time = uint32(etime * sWorld.getConfig(CONFIG_FLOAT_RATE_AUCTION_TIME));
+
+    AuctionEntry* AH = new AuctionEntry;
+    AH->Id = sObjectMgr.GenerateAuctionID();
+    AH->itemGuidLow = newItem->GetObjectGuid().GetCounter();
+    AH->itemTemplate = newItem->GetEntry();
+    AH->itemCount = newItem->GetCount();
+    AH->itemRandomPropertyId = newItem->GetItemRandomPropertyId();
+    AH->owner = pl->GetGUIDLow();
+    AH->startbid = bid;
+    AH->bidder = 0;
+    AH->bid = 0;
+    AH->buyout = buyout;
+    AH->expireTime = time(NULL) + auction_time;
+    AH->deposit = deposit;
+    AH->auctionHouseEntry = auctionHouseEntry;
+
+    house.AddAuction(AH);
+
+    sAuctionMgr.AddAItem(newItem);
+
+    pl->MoveItemFromInventory(newItem->GetBagSlot(), newItem->GetSlot(), true);
+
+    newItem->DeleteFromInventoryDB();
+    newItem->SaveToDB();
+    AH->SaveToDB();
+    pl->SaveInventoryAndGoldToDB();
+
+    return AH;
+}
diff --git a/src/modules/AhService/world/AhServiceBook.h b/src/modules/AhService/world/AhServiceBook.h
new file mode 100644
index 0000000000..19b5e56b27
--- /dev/null
+++ b/src/modules/AhService/world/AhServiceBook.h
@@ -0,0 +1,92 @@
+/**
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * MaNGOS is a full featured server for World of Warcraft, supporting
+ * the following clients: 1.12.x, 2.4.3, 3.3.5a, 4.3.4a and 5.4.8
+ *
+ * Copyright (C) 2005-2026 MaNGOS <https://www.getmangos.eu>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * World of Warcraft, and all World of Warcraft or Warcraft art, images,
+ * and lore are copyrighted by Blizzard Entertainment, Inc.
+ */
+
+#ifndef MANGOS_H_AHSERVICE_BOOK
+#define MANGOS_H_AHSERVICE_BOOK
+
+#include "AuctionHouseMgr.h"
+#include "AuctionHouseModule.h"
+#include "CustodyDeferred.h"
+#include "Item.h"
+
+#include <string>
+#include <vector>
+
+class Item;
+class Player;
+class WorldPacket;
+class WorldSession;
+
+// Packets built from values, for effects that run after the auction is gone.
+void AhSendAuctionCommandResultData(WorldSession* session, uint32 aucId, AuctionAction action, AuctionError errorCode, InventoryResult invError, uint32 newOutbid);
+void AhSendAuctionBidderNotificationData(WorldSession* session, uint32 houseId, uint32 id, uint32 bidder, uint32 bid, uint32 outbid, uint32 itemTemplate, int32 itemRand, bool won);
+void AhSendAuctionOwnerNotificationData(WorldSession* session, uint32 houseId, uint32 id, uint32 bid, uint32 outbid, uint32 bidderGuidLow, uint32 itemTemplate, int32 itemRand, bool sold);
+void AhSendAuctionRemovedNotificationData(WorldSession* session, uint32 id, uint32 itemTemplate, int32 itemRand);
+
+// The settlement mails, written into the caller's open transaction.
+void AhSendAuctionOutbiddedMailInTransaction(AuctionEntry* auction, CustodyDeferred& def);
+void AhSendAuctionCancelledToBidderMailInTransaction(AuctionEntry* auction, CustodyDeferred& def);
+void AhSendAuctionExpiredMailInTransaction(AuctionEntry* auction, CustodyDeferred& def);
+void AhSendAuctionSuccessfulMailInTransaction(AuctionEntry* auction, CustodyDeferred& def);
+void AhSendAuctionWonMailInTransaction(AuctionEntry* auction, CustodyDeferred& def);
+
+// The custody variants of the book's settlements.
+void AhAuctionBidWinningCustody(AuctionEntry& a, Player* newbidder, CustodyDeferred& def,
+                                bool usesPlayerSellerCustody,
+                                bool hasLiveBidCustody,
+                                std::string const& knownBidKey = "");
+void AhExpireUnsoldCustody(AuctionEntry& a, CustodyDeferred& def);
+void AhPrepareCancelCustody(AuctionEntry& a, Player* seller, CustodyDeferred& def,
+                            bool usesPlayerSellerCustody,
+                            bool hasLiveBidCustody,
+                            std::string const& liveBidKey,
+                            uint32 auctionCut);
+bool AhUpdateBidCustody(AuctionEntry& a, uint32 newbid, Player* newbidder, CustodyDeferred& def,
+                        bool usesPlayerSellerCustody,
+                        bool hadLiveBidCustody,
+                        std::string const& liveBidKey);
+
+AuctionExpiry AhExpireAuction(AuctionEntry& auction);
+/// True when custody settled or refused the bid; @p applied says which.
+bool AhSettleGeneratedBid(AuctionEntry& auction, uint32 newbid, bool& stillActive, bool& applied);
+/// A bot bid through custody when the auction has it, through the core otherwise.
+void AhPlaceGeneratedBid(AuctionEntry& auction, uint32 newbid, bool& applied);
+/// AuctionHouseObject::AddAuction, its writes appended to the caller's open transaction.
+AuctionEntry* AhAddAuctionInTransaction(AuctionHouseObject& house, AuctionHouseEntry const* auctionHouseEntry,
+                                        Item* newItem, uint32 etime, uint32 bid, uint32 buyout,
+                                        uint32 deposit, Player* pl);
+
+void AhBuildListForKind(AuctionHouseObject& house, uint8 kind, WorldPacket& data, Player* player,
+    const std::wstring& wname, uint32 listfrom, uint32 levelmin, uint32 levelmax,
+    uint32 usable, uint32 invType, uint32 itemClass, uint32 itemSubClass,
+    uint32 quality, const std::vector<uint32>& clientOutbidIds,
+    uint32& count, uint32& totalcount);
+/// Records @p clientIds in client order, as AhBuildListForKind prepends them.
+void AhAppendClientOutbidsForTest(const std::vector<uint32>& clientIds,
+                                  std::vector<uint32>& outOrder);
+
+void AhAuditCustodyReconcile(char const* phase);
+
+#endif
diff --git a/src/game/ChatCommands/AhServiceCommands.cpp b/src/modules/AhService/world/AhServiceCommands.cpp
similarity index 79%
rename from src/game/ChatCommands/AhServiceCommands.cpp
rename to src/modules/AhService/world/AhServiceCommands.cpp
index fe19c6f50f..81299508eb 100644
--- a/src/game/ChatCommands/AhServiceCommands.cpp
+++ b/src/modules/AhService/world/AhServiceCommands.cpp
@@ -37,11 +37,18 @@
  *   ah repair          -- dry-run custody-ledger drift repair
  *   ah repair apply    -- terminalize supported custody-ledger drift
  *   ah repair force-forfeit <key>
+ *   ah reload          -- reload ah-service.conf, and the worker's settings
+ *   ah status          -- worker state and intent executor counters
  */
 
 #include "AuctionHouseMgr.h"
-#include "AuctionHouseBot/CustodyLedger.h"
-#include "AuctionHouseBot/CustodyService.h"
+#include "AhService.h"
+#include "AhServiceCommands.h"
+#include "AuctionHouseBot.h"
+#include "AuctionIntentExecutor.h"
+#include "AuctionIntents.h"
+#include "CustodyLedger.h"
+#include "CustodyService.h"
 #include "Bag.h"
 #include "Chat.h"
 #include "Database/DatabaseEnv.h"
@@ -574,24 +581,24 @@ static void CountRepairAction(AhRepairActionResult const& result,
 /**
  * @brief "ah console show" -- request the child to show its console window.
  */
-bool ChatHandler::HandleAhServiceConsoleShowCommand(char* /*args*/)
+static bool HandleConsoleShow(ChatHandler& handler, char* /*args*/)
 {
     // Console-only: this toggles the CHILD's console window on the SERVER
-    // HOST, which an in-game GM cannot see and never needs. m_session is
+    // HOST, which an in-game GM cannot see and never needs. GetSession() is
     // non-NULL only for an in-game chat invocation; reject those.
-    if (m_session)
+    if (handler.GetSession())
     {
-        PSendSysMessage("This command is only available from the server"
+        handler.PSendSysMessage("This command is only available from the server"
                         " console.");
-        SetSentErrorMessage(true);
+        handler.SetSentErrorMessage(true);
         return false;
     }
 
-    WorkerSupervisor* sv = sWorld.GetAhSupervisor();
+    WorkerSupervisor* sv = sAhService.GetSupervisor();
     if (!IsAhServiceConnected(sv))
     {
-        SendSysMessage("AH service is not running.");
-        SetSentErrorMessage(true);
+        handler.SendSysMessage("AH service is not running.");
+        handler.SetSentErrorMessage(true);
         return false;
     }
 
@@ -600,34 +607,34 @@ bool ChatHandler::HandleAhServiceConsoleShowCommand(char* /*args*/)
     msg.body << static_cast<uint8>(1);
     if (!sv->Channel().SendFrame(msg))
     {
-        SendSysMessage("AH service is not responding (send failed).");
-        SetSentErrorMessage(true);
+        handler.SendSysMessage("AH service is not responding (send failed).");
+        handler.SetSentErrorMessage(true);
         return false;
     }
-    SendSysMessage("AH service console show requested.");
+    handler.SendSysMessage("AH service console show requested.");
     return true;
 }
 
 /**
  * @brief "ah console hide" -- request the child to hide its console window.
  */
-bool ChatHandler::HandleAhServiceConsoleHideCommand(char* /*args*/)
+static bool HandleConsoleHide(ChatHandler& handler, char* /*args*/)
 {
     // Console-only: see HandleAhServiceConsoleShowCommand. An in-game GM
     // cannot see the host's child console window and never needs this.
-    if (m_session)
+    if (handler.GetSession())
     {
-        PSendSysMessage("This command is only available from the server"
+        handler.PSendSysMessage("This command is only available from the server"
                         " console.");
-        SetSentErrorMessage(true);
+        handler.SetSentErrorMessage(true);
         return false;
     }
 
-    WorkerSupervisor* sv = sWorld.GetAhSupervisor();
+    WorkerSupervisor* sv = sAhService.GetSupervisor();
     if (!IsAhServiceConnected(sv))
     {
-        SendSysMessage("AH service is not running.");
-        SetSentErrorMessage(true);
+        handler.SendSysMessage("AH service is not running.");
+        handler.SetSentErrorMessage(true);
         return false;
     }
 
@@ -636,24 +643,24 @@ bool ChatHandler::HandleAhServiceConsoleHideCommand(char* /*args*/)
     msg.body << static_cast<uint8>(0);
     if (!sv->Channel().SendFrame(msg))
     {
-        SendSysMessage("AH service is not responding (send failed).");
-        SetSentErrorMessage(true);
+        handler.SendSysMessage("AH service is not responding (send failed).");
+        handler.SetSentErrorMessage(true);
         return false;
     }
-    SendSysMessage("AH service console hide requested.");
+    handler.SendSysMessage("AH service console hide requested.");
     return true;
 }
 
 /**
  * @brief "ah repair" -- dry-run or repair custody-ledger drift.
  */
-bool ChatHandler::HandleAhRepairCommand(char* args)
+static bool HandleRepair(ChatHandler& handler, char* args)
 {
-    if (m_session)
+    if (handler.GetSession())
     {
-        PSendSysMessage("This command is only available from the server"
+        handler.PSendSysMessage("This command is only available from the server"
                         " console.");
-        SetSentErrorMessage(true);
+        handler.SetSentErrorMessage(true);
         return false;
     }
 
@@ -663,8 +670,8 @@ bool ChatHandler::HandleAhRepairCommand(char* args)
     bool const forceForfeit = ExtractForceForfeitKey(mode, forceForfeitKey);
     if (!mode.empty() && mode != "--dry-run" && !apply && !forceForfeit)
     {
-        SendSysMessage("Syntax: ah repair [--dry-run|apply|force-forfeit <key>]");
-        SetSentErrorMessage(true);
+        handler.SendSysMessage("Syntax: ah repair [--dry-run|apply|force-forfeit <key>]");
+        handler.SetSentErrorMessage(true);
         return false;
     }
 
@@ -703,13 +710,13 @@ bool ChatHandler::HandleAhRepairCommand(char* args)
         }
 
         CountRepairAction(result, repaired, skipped, failed);
-        PrintRepairAction(*this, budget, result);
-        PrintRepairSuppression(*this, budget);
-        PrintRepairSummary(*this, "force-forfeit", report,
+        PrintRepairAction(handler, budget, result);
+        PrintRepairSuppression(handler, budget);
+        PrintRepairSummary(handler, "force-forfeit", report,
                            repaired, skipped, failed);
         if (!found || result.status != AH_REPAIR_REPAIRED)
         {
-            SetSentErrorMessage(true);
+            handler.SetSentErrorMessage(true);
             return false;
         }
         return true;
@@ -718,13 +725,13 @@ bool ChatHandler::HandleAhRepairCommand(char* args)
     char const* modeName = apply ? "apply" : "dry-run";
     for (size_t i = 0; i < report.findings.size(); ++i)
     {
-        PrintRepairFinding(*this, budget, modeName, report.findings[i]);
+        PrintRepairFinding(handler, budget, modeName, report.findings[i]);
     }
 
     if (!apply)
     {
-        PrintRepairSuppression(*this, budget);
-        PrintRepairSummary(*this, modeName, report, 0, 0, 0);
+        PrintRepairSuppression(handler, budget);
+        PrintRepairSummary(handler, modeName, report, 0, 0, 0);
         return true;
     }
 
@@ -745,7 +752,7 @@ bool ChatHandler::HandleAhRepairCommand(char* args)
                    << " state=" << CustodyFindingStateName(finding.state);
             result = RepairAction(AH_REPAIR_SKIPPED, 0, detail.str());
             CountRepairAction(result, repaired, skipped, failed);
-            PrintRepairAction(*this, budget, result);
+            PrintRepairAction(handler, budget, result);
             continue;
         }
 
@@ -763,10 +770,92 @@ bool ChatHandler::HandleAhRepairCommand(char* args)
         }
 
         CountRepairAction(result, repaired, skipped, failed);
-        PrintRepairAction(*this, budget, result);
+        PrintRepairAction(handler, budget, result);
     }
 
-    PrintRepairSuppression(*this, budget);
-    PrintRepairSummary(*this, modeName, report, repaired, skipped, failed);
+    PrintRepairSuppression(handler, budget);
+    PrintRepairSummary(handler, modeName, report, repaired, skipped, failed);
     return failed == 0;
 }
+
+/**
+ * @brief "ah reload" -- reload ah-service.conf and the bot settings, and ask
+ * the worker to reload its own; its answer is logged.
+ */
+static bool HandleReload(ChatHandler& handler, char* /*args*/)
+{
+    sAhService.LoadConfig(true);
+    sAuctionBotConfig.Initialize();
+
+    WorkerSupervisor* sv = sAhService.GetSupervisor();
+    if (sv == NULL || !sv->ServiceActive())
+    {
+        handler.SendSysMessage("AH service settings reloaded; the worker is not running.");
+        return true;
+    }
+
+    GmCmd gc;
+    gc.cmd = static_cast<uint8>(GMCMD_RELOAD);
+    IpcMessage m;
+    m.op = IPC_GMCMD;
+    gc.Encode(m.body);
+    sv->Channel().SendFrame(m);
+
+    handler.SendSysMessage("AH service settings reloaded; reload signal sent to the worker - result will be logged.");
+    return true;
+}
+
+/**
+ * @brief "ah status" -- the worker's state and the intent executor's counters.
+ */
+static bool HandleStatus(ChatHandler& handler, char* /*args*/)
+{
+    WorkerSupervisor* sv = sAhService.GetSupervisor();
+    if (sv == NULL)
+    {
+        handler.PSendSysMessage("[AH service] worker: %s",
+                                sAhService.IsWorkerConfigured() ? "configured, failed to start" : "not configured");
+    }
+    else
+    {
+        handler.PSendSysMessage("[AH service] worker: %s",
+                                sv->ServiceActive() ? "active" : "inactive (in-process bot running)");
+    }
+    handler.PSendSysMessage("[AH service] custody: %s, write authority: %s",
+                            sAhService.IsCustodyEnabled() ? "on" : "off",
+                            sAhService.IsWriteAuthority() ? "on" : "off");
+    handler.PSendSysMessage("[AH service] executor: applied=%llu rejected=%llu"
+                            " duplicate=%llu malformed=%llu",
+                            static_cast<unsigned long long>(sAuctionIntentExecutor.GetApplied()),
+                            static_cast<unsigned long long>(sAuctionIntentExecutor.GetRejected()),
+                            static_cast<unsigned long long>(sAuctionIntentExecutor.GetDuplicate()),
+                            static_cast<unsigned long long>(sAuctionIntentExecutor.GetMalformed()));
+    return true;
+}
+
+ChatCommand* AhServiceCommands()
+{
+    static ChatCommand consoleTable[] =
+    {
+        ChatCommand("show",    &HandleConsoleShow, SEC_ADMINISTRATOR, true),
+        ChatCommand("hide",    &HandleConsoleHide, SEC_ADMINISTRATOR, true),
+        ChatCommand(NULL,      0,                  true, NULL, "", NULL)
+    };
+
+    static ChatCommand ahTable[] =
+    {
+        ChatCommand("console", SEC_ADMINISTRATOR,  true, NULL, "", consoleTable),
+        ChatCommand("repair",  &HandleRepair,      SEC_ADMINISTRATOR, true),
+        ChatCommand("reload",  &HandleReload,      SEC_ADMINISTRATOR, true),
+        ChatCommand("status",  &HandleStatus,      SEC_ADMINISTRATOR, true),
+        ChatCommand(NULL,      0,                  true, NULL, "", NULL)
+    };
+
+    static ChatCommand rootTable[] =
+    {
+        ChatCommand("ah",      SEC_ADMINISTRATOR,  true, NULL, "", ahTable),
+        ChatCommand(NULL,      0,                  false, NULL, "", NULL)
+    };
+
+    return rootTable;
+}
diff --git a/src/modules/AhService/world/AhServiceCommands.h b/src/modules/AhService/world/AhServiceCommands.h
new file mode 100644
index 0000000000..dea5f10cac
--- /dev/null
+++ b/src/modules/AhService/world/AhServiceCommands.h
@@ -0,0 +1,34 @@
+/**
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * MaNGOS is a full featured server for World of Warcraft, supporting
+ * the following clients: 1.12.x, 2.4.3, 3.3.5a, 4.3.4a and 5.4.8
+ *
+ * Copyright (C) 2005-2026 MaNGOS <https://www.getmangos.eu>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * World of Warcraft, and all World of Warcraft or Warcraft art, images,
+ * and lore are copyrighted by Blizzard Entertainment, Inc.
+ */
+
+#ifndef MANGOS_H_AHSERVICE_COMMANDS
+#define MANGOS_H_AHSERVICE_COMMANDS
+
+class ChatCommand;
+
+/// The top-level .ah table.
+ChatCommand* AhServiceCommands();
+
+#endif
diff --git a/src/modules/AhService/world/AhServiceHandlers.cpp b/src/modules/AhService/world/AhServiceHandlers.cpp
new file mode 100644
index 0000000000..89443be2ce
--- /dev/null
+++ b/src/modules/AhService/world/AhServiceHandlers.cpp
@@ -0,0 +1,3026 @@
+/**
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * MaNGOS is a full featured server for World of Warcraft, supporting
+ * the following clients: 1.12.x, 2.4.3, 3.3.5a, 4.3.4a and 5.4.8
+ *
+ * Copyright (C) 2005-2026 MaNGOS <https://www.getmangos.eu>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * World of Warcraft, and all World of Warcraft or Warcraft art, images,
+ * and lore are copyrighted by Blizzard Entertainment, Inc.
+ */
+
+/**
+ * @file AhServiceHandlers.cpp
+ * @brief The auction house service's side of the auction opcodes and the
+ *        settlement of the mutations the worker decides.
+ */
+
+#include "AhServiceHandlers.h"
+#include "AhService.h"
+#include "AhServiceBook.h"
+#include "BrowseMessages.h"
+#include "BrowsePending.h"
+#include "CustodyLedger.h"
+#include "CustodyService.h"
+#include "IpcMessage.h"
+#include "IpcOpcodes.h"
+#include "MutationPending.h"
+#include "PlayerMutations.h"
+#include "WorkerSupervisor.h"
+
+#include "Common/Locales.h"
+#include "AuctionHouseMgr.h"
+#include "Chat.h"
+#include "DBCStores.h"
+#include "Log.h"
+#include "Mail.h"
+#include "ObjectGuid.h"
+#include "ObjectMgr.h"
+#include "Opcodes.h"
+#include "Player.h"
+#include "ReputationMgr.h"
+#include "SQLStorages.h"
+#include "SpellMgr.h"
+#include "Util.h"
+#include "World.h"
+#include "WorldPacket.h"
+#include "WorldSession.h"
+
+#include <ctime>
+#include <list>
+#include <map>
+#include <sstream>
+#include <string>
+#include <vector>
+#ifdef ENABLE_ELUNA
+#include "LuaEngine.h"
+#endif /* ENABLE_ELUNA */
+
+// SP-1 coordinator: the player-facing "AH temporarily unavailable" signal -- a
+// transient center-screen flash (SMSG_NOTIFICATION) PLUS a persistent red system
+// chat line. Used wherever a worker is the AH authority but cannot serve: the
+// window-open gate (SendAuctionHello) and the three browse read paths
+// (AhSendBrowseUnavailable, also from the World.cpp reply branch + TTL sweep).
+void AhSendUnavailableMessage(WorldSession* session)
+{
+    session->SendNotification("The Auction House is temporarily unavailable.");
+    ChatHandler(session).SendSysMessage("|cffff0000The Auction House is temporarily unavailable.|r");
+}
+
+// SP-2 Task 10: bid-forward classifier. See MutationPending.h for the full
+// contract. Kept as a free function so `mangosd -t ahforwardreserve` can
+// exercise the real classification logic against seeded ledger rows without a
+// live Player or worker.
+uint16 AhClassifyBidForward(uint32 auctionId, uint32 bidderGuidLow, uint32 price,
+                            uint32& reserveAmount)
+{
+    reserveAmount = price;
+
+    CustodyRow liveRow;
+    if (!CustodyLedger::GetSingleLiveBidRow(auctionId, liveRow) ||
+        liveRow.ownerGuid != bidderGuidLow)
+    {
+        // Not provably this player's live bid (no row, ambiguous rows, or
+        // another player's row): reserve the full submitted price as maxPrice
+        // and let the worker adjudicate against the book (spec I6 / 4.1).
+        return uint16(IPC_PLAYER_BUYOUT);
+    }
+
+    if (price <= liveRow.amount)
+    {
+        // Raising to at-or-below the player's own live bid: legacy rejects
+        // inline (`price <= auction->bid` -> AUCTION_ERR_HIGHER_BID).
+        return 0u;
+    }
+
+    // Same-bidder top-up (spec I9): only the delta is reserved; the finalize
+    // applies the top-up. Route it as IPC_PLAYER_BUYOUT instead of BID because
+    // mangosd does not own the book's buyout price under WriteAuthority. The
+    // worker treats a below-buyout 0x42 as a normal bid at maxPrice and an
+    // at/over-buyout 0x42 as the win, so the same delta reserve covers both
+    // raise and current-high-bidder-buyout without an out-of-band book read.
+    reserveAmount = price - liveRow.amount;
+    return uint16(IPC_PLAYER_BUYOUT);
+}
+
+bool AhBuildCancelPrepareForward(MutationPendingMap& pending, uint32 playerGuidLow,
+                                 uint32 auctionId, uint64 uuid, uint32 sentSec,
+                                 IpcMessage& out)
+{
+    if (!pending.CanRegister(playerGuidLow))
+    {
+        return false;
+    }
+
+    PendingMutation pm;
+    pm.uuid           = uuid;
+    pm.playerGuidLow  = playerGuidLow;
+    pm.op             = uint16(IPC_PLAYER_CANCEL);
+    pm.auctionId      = auctionId;
+    pm.state          = uint8(PMUT_AWAIT_RESULT);
+    pm.sentSec        = sentSec;
+    pm.reservedAmount = 0u;
+    pm.reserveKey.clear();
+    pm.itemKey.clear();
+    pm.depKey.clear();
+    pending.Register(pm);
+
+    PlayerCancelPrepare prep;
+    prep.uuid       = uuid;
+    prep.auctionId  = auctionId;
+    prep.sellerGuid = playerGuidLow;
+
+    out = IpcMessage();
+    out.op = IPC_PLAYER_CANCEL;
+    prep.Encode(out.body);
+    return true;
+}
+
+// by-value variant: builds SMSG_AUCTION_COMMAND_RESULT from raw values so a
+// deferred custody closure can fire it after the AuctionEntry is gone (spec I5)
+void AhSendAuctionCommandResultData(WorldSession* session, uint32 aucId, AuctionAction Action, AuctionError ErrorCode, InventoryResult invError, uint32 newOutbid)
+{
+    WorldPacket data(SMSG_AUCTION_COMMAND_RESULT, 16);
+    data << uint32(aucId);
+    data << uint32(Action);
+    data << uint32(ErrorCode);
+
+    switch (ErrorCode)
+    {
+        case AUCTION_OK:
+            if (Action == AUCTION_BID_PLACED)
+            {
+                data << uint32(newOutbid);                  // outbid increment (pre-resolved)
+            }
+            break;
+        case AUCTION_ERR_INVENTORY:
+            data << uint32(invError);
+            break;
+        default:
+            break;
+    }
+
+    session->SendPacket(&data);
+}
+
+// by-value variant of SendAuctionBidderNotification (spec I5)
+void AhSendAuctionBidderNotificationData(WorldSession* session, uint32 houseId, uint32 id, uint32 bidder, uint32 bid, uint32 outbid, uint32 itemTemplate, int32 itemRand, bool won)
+{
+    WorldPacket data(SMSG_AUCTION_BIDDER_NOTIFICATION, (8 * 4));
+    data << uint32(houseId);
+    data << uint32(id);
+    data << ObjectGuid(HIGHGUID_PLAYER, bidder);
+
+    // if 0, client shows ERR_AUCTION_WON_S, else ERR_AUCTION_OUTBID_S
+    data << uint32(won ? 0 : bid);
+    data << uint32(outbid);                                 // AuctionOutBid?
+    data << uint32(itemTemplate);
+    data << int32(itemRand);
+
+    session->SendPacket(&data);
+}
+
+// by-value variant of SendAuctionOwnerNotification (spec I5)
+void AhSendAuctionOwnerNotificationData(WorldSession* session, uint32 houseId, uint32 id, uint32 bid, uint32 outbid, uint32 bidderGuidLow, uint32 itemTemplate, int32 itemRand, bool sold)
+{
+    // SMSG_AUCTION_OWNER_NOTIFICATION carries no houseId field (unlike the bidder
+    // notification); it is accepted for signature symmetry with the other by-value
+    // builders and to snapshot it alongside the other scalars.
+    (void)houseId;
+
+    WorldPacket data(SMSG_AUCTION_OWNER_NOTIFICATION, (7 * 4));
+    data << uint32(id);
+    data << uint32(bid);                                    // if 0, client shows ERR_AUCTION_EXPIRED_S, else ERR_AUCTION_SOLD_S (works only when guid==0)
+    data << uint32(outbid);                                 // AuctionOutBid?
+
+    ObjectGuid bidder_guid = ObjectGuid();
+    if (!sold)                                              // not sold yet
+    {
+        bidder_guid = ObjectGuid(HIGHGUID_PLAYER, bidderGuidLow);
+    }
+
+    // bidder==0 and moneyDeliveryTime==0 for expired auctions, and client shows error messages as described above
+    // if bidder!=0 client updates auctions with new bid, outbid and bidderGuid
+    data << bidder_guid;                                    // bidder guid
+    data << uint32(itemTemplate);                           // item entry
+    data << int32(itemRand);
+
+    session->SendPacket(&data);
+}
+
+// by-value variant of SendAuctionRemovedNotification (spec I5)
+void AhSendAuctionRemovedNotificationData(WorldSession* session, uint32 id, uint32 itemTemplate, int32 itemRand)
+{
+    WorldPacket data(SMSG_AUCTION_REMOVED_NOTIFICATION, (3 * 4));
+    data << uint32(id);
+    data << uint32(itemTemplate);
+    data << uint32(itemRand);
+
+    session->SendPacket(&data);
+}
+
+// Custody co-commit variant of SendAuctionOutbiddedMail. Same old-bidder guard;
+// it (a) defers the online bidder notification snapshotted BY VALUE so it fires
+// in legacy order (notify before mail), then (b) co-commits the refund mail into
+// the caller's open transaction (its own online push is appended AFTER the notify
+// by SendMailToInTransaction). Reads the OLD auction->bid, so the caller MUST
+// call this before mutating bid (spec B / S2).
+void AhSendAuctionOutbiddedMailInTransaction(AuctionEntry* auction, CustodyDeferred& def)
+{
+    ObjectGuid oldBidder_guid = ObjectGuid(HIGHGUID_PLAYER, auction->bidder);
+    Player* oldBidder = sObjectMgr.GetPlayer(oldBidder_guid);
+
+    uint32 oldBidder_accId = 0;
+    if (!oldBidder)
+    {
+        oldBidder_accId = sObjectMgr.GetPlayerAccountIdByGUID(oldBidder_guid);
+    }
+
+    // old bidder exist
+    if (oldBidder || oldBidder_accId)
+    {
+        std::ostringstream msgAuctionOutbiddedSubject;
+        msgAuctionOutbiddedSubject << auction->itemTemplate << ":" << auction->itemRandomPropertyId << ":" << AUCTION_OUTBIDDED;
+
+        // Defer the online bidder notification, snapshotting every field BY
+        // VALUE (the buyout path may delete the AuctionEntry before run()).
+        // Appended BEFORE the refund mail so packet order = notify-then-mail.
+        // The closure captures the old bidder's low GUID + packet scalars only
+        // (no live WorldSession*/Player*/AuctionEntry*) and RE-RESOLVES the player
+        // by GUID at run time, skipping the live packet if offline -- the durable
+        // mail row is authoritative (spec I2).
+        if (oldBidder)
+        {
+            uint32 oldBidderGuidLow = auction->bidder;
+            uint32 houseId  = auction->GetHouseId();
+            uint32 aucId    = auction->Id;
+            uint32 bidder   = auction->bidder;
+            uint32 bidValue = auction->bid;
+            uint32 outbid   = auction->GetAuctionOutBid();
+            uint32 itemTpl  = auction->itemTemplate;
+            int32  itemRand = auction->itemRandomPropertyId;
+            def.effects.push_back([oldBidderGuidLow, houseId, aucId, bidder, bidValue, outbid, itemTpl, itemRand]()
+            {
+                Player* p = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, oldBidderGuidLow));
+                if (p)
+                {
+                    AhSendAuctionBidderNotificationData(p->GetSession(), houseId, aucId, bidder, bidValue, outbid, itemTpl, itemRand, false);
+                }
+            });
+        }
+
+        MailDraft(msgAuctionOutbiddedSubject.str(),"")
+            .SetMoney(auction->bid)
+            .SendMailToInTransaction(MailReceiver(oldBidder, oldBidder_guid), MailSender(auction), def.effects, MAIL_CHECK_MASK_COPIED);
+    }
+}
+
+// Custody co-commit variant of SendAuctionCancelledToBidderMail. Same old-bidder
+// guard; it (a) defers the online bidder's DISTINCT SMSG_AUCTION_REMOVED_NOTIFICATION
+// snapshotted BY VALUE so it fires in legacy order (notify before mail), then
+// (b) co-commits the refund mail (money = auction->bid) into the caller's open
+// transaction (its own online push is appended AFTER the notify by
+// SendMailToInTransaction). Reads auction->bid, so the caller MUST call this
+// before any bid mutation (there is none in S5; cancel deletes the auction).
+// Note: unlike the outbid path this emits SendAuctionRemovedNotification (a third,
+// distinct opcode), NOT SendAuctionBidderNotification (spec B / S5).
+void AhSendAuctionCancelledToBidderMailInTransaction(AuctionEntry* auction, CustodyDeferred& def)
+{
+    ObjectGuid bidder_guid = ObjectGuid(HIGHGUID_PLAYER, auction->bidder);
+    Player* bidder = sObjectMgr.GetPlayer(bidder_guid);
+
+    uint32 bidder_accId = 0;
+    if (!bidder)
+    {
+        bidder_accId = sObjectMgr.GetPlayerAccountIdByGUID(bidder_guid);
+    }
+
+    // bidder exist
+    if (bidder || bidder_accId)
+    {
+        std::ostringstream msgAuctionCancelledSubject;
+        msgAuctionCancelledSubject << auction->itemTemplate << ":" << auction->itemRandomPropertyId << ":" << AUCTION_CANCELLED_TO_BIDDER;
+
+        // Defer the online bidder's removed-notification, snapshotting every field
+        // BY VALUE (the cancel deletes the AuctionEntry before run()). Appended
+        // BEFORE the refund mail so packet order = notify-then-mail (legacy :334).
+        // The closure captures the bidder's low GUID + packet scalars only (no live
+        // WorldSession*/Player*/AuctionEntry*) and RE-RESOLVES the player by GUID at
+        // run time, skipping the live packet if offline -- the durable mail row is
+        // authoritative (spec I2).
+        if (bidder)
+        {
+            uint32 bidderGuidLow = auction->bidder;
+            uint32 aucId    = auction->Id;
+            uint32 itemTpl  = auction->itemTemplate;
+            int32  itemRand = auction->itemRandomPropertyId;
+            def.effects.push_back([bidderGuidLow, aucId, itemTpl, itemRand]()
+            {
+                Player* p = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, bidderGuidLow));
+                if (p)
+                {
+                    AhSendAuctionRemovedNotificationData(p->GetSession(), aucId, itemTpl, itemRand);
+                }
+            });
+        }
+
+        MailDraft(msgAuctionCancelledSubject.str(),"")
+            .SetMoney(auction->bid)
+            .SendMailToInTransaction(MailReceiver(bidder, bidder_guid), MailSender(auction), def.effects, MAIL_CHECK_MASK_COPIED);
+    }
+}
+
+
+// SP-1 coordinator: while the worker is the configured authority but down, the
+// auction window does not open at all.
+bool AhBlocksHello(WorldSession& session)
+{
+    if (sAhService.IsWorkerConfigured() && !sAhService.IsWorkerActive())
+    {
+        AhSendUnavailableMessage(&session);
+        return true;
+    }
+    return false;
+}
+
+// ----- SP-2 write-authority forward path: reserve -> forward (spec 4.1) -----
+// Runs BEFORE the 50-owned-auctions check: that guard walks the local
+// AuctionsMap, which is dead under WriteAuthority -- the worker owns the book
+// and enforces the 50-cap itself (spec I6). Eluna OnAdd fires at finalize time
+// from the worker facts (spec 5.8), not here.
+bool AhForwardSell(WorldSession& session, AuctionSale const& sale)
+{
+    if (!sAhService.IsWriteAuthority())
+    {
+        return false;
+    }
+
+    Player* pl = session.GetPlayer();
+    Item* it = sale.item;
+
+    // No in-process fallback of any kind (spec 5.5). Worker configured but
+    // down => the unavailable path plus an ERR_DATABASE command result so the
+    // client UI unlocks.
+    WorkerSupervisor* sv = sAhService.GetSupervisor();
+    if (!sv || !sv->ServiceActive())
+    {
+        AhSendUnavailableMessage(&session);
+        session.SendAuctionCommandResult(NULL, AUCTION_STARTED, AUCTION_ERR_DATABASE);
+        return true;
+    }
+
+    // Cap check BEFORE any reserve (spec 5.5).
+    if (!sAhService.GetMutationPending().CanRegister(pl->GetGUIDLow()))
+    {
+        session.SendAuctionCommandResult(NULL, AUCTION_STARTED, AUCTION_ERR_DATABASE);
+        return true;
+    }
+
+    // mangosd is the sole auction-ID allocator (spec decision 8): minted here
+    // and carried in the intent, so every custody idem key exists at reserve time.
+    uint32 const auctionId     = sObjectMgr.GenerateAuctionID();
+    uint64 const uuid          = AhMintMutationUuid();
+    std::string const aucIdStr = std::to_string(auctionId);
+    uint32 const itemGuidLow   = it->GetGUIDLow();
+
+    // In-memory escrow exactly as the custody path does (deposit debit, then
+    // mAitems + out of the bags); the durable writes co-commit below.
+    pl->ModifyMoney(-int32(sale.deposit));
+    sAuctionMgr.AddAItem(it);
+    pl->MoveItemFromInventory(it->GetBagSlot(), it->GetSlot(), true);
+
+    // ONE checked txn (spec decision 9): item ownership move + escrow row +
+    // deposit reserve row. NO `auction` row -- the worker is the sole book
+    // writer and inserts it at commit (spec 4.1 step 3).
+    CharacterDatabase.BeginTransaction();
+    it->DeleteFromInventoryDB();
+    it->SaveToDB();
+    pl->SaveInventoryAndGoldToDB();
+    CustodyService::EscrowItem(pl->GetGUIDLow(), itemGuidLow, "item:" + aucIdStr, auctionId);
+    CustodyService::ReserveGoldAlreadyDebited(pl->GetGUIDLow(), sale.deposit,
+        "dep:" + aucIdStr, auctionId, ROLE_DEPOSIT);
+    if (!CharacterDatabase.CommitTransactionChecked())
+    {
+        // Durable rollback -> restore live state.
+        sAuctionMgr.RemoveAItem(itemGuidLow);
+        ItemPosCountVec dest;
+        if (pl->CanStoreItem(NULL_BAG, NULL_SLOT, dest, it, false) == EQUIP_ERR_OK)
+        {
+            pl->MoveItemToInventory(dest, it, true, true);
+        }
+        else
+        {
+            sLog.outError("SP-2 sell: seller %u could not re-store item %u on reserve rollback of "
+                          "auction %u; item remains durably the seller's on disk (reloads on relog)",
+                          pl->GetGUIDLow(), itemGuidLow, auctionId);
+        }
+        pl->ModifyMoney(int32(sale.deposit));
+        session.SendAuctionCommandResult(NULL, AUCTION_STARTED, AUCTION_ERR_DATABASE);
+        sLog.outError("SP-2 sell: reserve txn rolled back for auction %u; live state restored", auctionId);
+        return true;
+    }
+
+    // Crash seam: the escrow+deposit reserve is durably committed but the
+    // intent has NOT been forwarded. Inert on a live realm.
+    CustodyService::MaybeCrash("post-reserve-pre-forward");
+
+    // Register BEFORE the send so a fast reply can never race an unregistered uuid.
+    PendingMutation pm;
+    pm.uuid           = uuid;
+    pm.playerGuidLow  = pl->GetGUIDLow();
+    pm.op             = uint16(IPC_PLAYER_SELL);
+    pm.auctionId      = auctionId;
+    pm.state          = uint8(PMUT_AWAIT_RESULT);
+    pm.sentSec        = uint32(time(NULL));
+    pm.reservedAmount = 0u;                 // deposit rides depKey, no bid reserve
+    pm.reserveKey.clear();
+    pm.itemKey        = "item:" + aucIdStr;
+    pm.depKey         = "dep:" + aucIdStr;
+    sAhService.GetMutationPending().Register(pm);
+
+    PlayerSellIntent psi;
+    psi.uuid             = uuid;
+    psi.auctionId        = auctionId;
+    psi.sellerGuid       = pl->GetGUIDLow();
+    psi.house            = uint8(sale.houseEntry->houseId);
+    psi.itemGuid         = itemGuidLow;
+    psi.itemTemplate     = it->GetEntry();
+    psi.itemCount        = it->GetCount();
+    psi.randomPropertyId = it->GetItemRandomPropertyId();
+    psi.startbid         = sale.bid;
+    psi.buyout           = sale.buyout;
+    psi.deposit          = sale.deposit;    // mangosd-computed, worker persists verbatim (spec 4.1)
+    psi.expireTime       = uint32(time(NULL) + uint32(sale.etime * sWorld.getConfig(CONFIG_FLOAT_RATE_AUCTION_TIME)));
+
+    IpcMessage m;
+    m.op = IPC_PLAYER_SELL;
+    psi.Encode(m.body);
+    if (!sv->Channel().SendFrame(m))
+    {
+        // The reserve is durable and is NEVER unilaterally rolled back
+        // (decision 10): tombstone as in-doubt; reconcile-on-reconnect resolves
+        // it against the worker journal (spec 8).
+        sAhService.GetMutationPending().Tombstone(uuid);
+        session.SendAuctionCommandResult(NULL, AUCTION_STARTED, AUCTION_ERR_DATABASE);
+        sLog.outError("SP-2 sell: forward send failed for auction %u uuid " UI64FMTD "; reservation in doubt",
+                      auctionId, uuid);
+    }
+    return true;
+}
+
+// Custody sell: the auction, the item escrow and the deposit co-commit. The
+// core has already taken the deposit from the seller's purse.
+bool AhSettleSell(WorldSession& session, AuctionSale const& sale, AuctionEntry*& listed)
+{
+    if (!sAhService.IsCustodyEnabled())
+    {
+        return false;
+    }
+
+    Player* pl = session.GetPlayer();
+    Item* it = sale.item;
+
+    CharacterDatabase.BeginTransaction();
+    AuctionEntry* AH = AhAddAuctionInTransaction(*sale.house, sale.houseEntry, it, sale.etime,
+                                                 sale.bid, sale.buyout, sale.deposit, pl);
+    std::string aucId = std::to_string(AH->Id);
+    CustodyService::EscrowItem(AH->owner, AH->itemGuidLow, "item:" + aucId, AH->Id);
+    CustodyService::ReserveGoldAlreadyDebited(AH->owner, sale.deposit, "dep:" + aucId, AH->Id, ROLE_DEPOSIT);
+    CustodyService::MaybeCrash("pre-commit");
+    if (!CharacterDatabase.CommitTransactionChecked())
+    {
+        // Durable rollback: undo the in-memory part of the listing (the map slot,
+        // the AH item cache, the item out of the bags, the deposit), so live
+        // state matches the rolled-back database.
+        uint32 const phantomId = AH->Id;
+        uint32 const itemGuidLow = AH->itemGuidLow;
+
+        sale.house->RemoveAuction(phantomId);
+        sAuctionMgr.RemoveAItem(itemGuidLow);
+
+        ItemPosCountVec dest;
+        if (pl->CanStoreItem(NULL_BAG, NULL_SLOT, dest, it, false) == EQUIP_ERR_OK)
+        {
+            pl->MoveItemToInventory(dest, it, true, true);
+        }
+        else
+        {
+            // No durable loss: the rolled-back DB still holds the item as the
+            // seller's, so it reloads into the bag on next login.
+            sLog.outError("custody S1: seller %u could not re-store item %u on rollback of "
+                          "auction %u; item remains durably the seller's on disk (reloads on relog)",
+                          pl->GetGUIDLow(), itemGuidLow, phantomId);
+        }
+
+        pl->ModifyMoney(int32(sale.deposit));
+
+        delete AH;
+        session.SendAuctionCommandResult(NULL, AUCTION_STARTED, AUCTION_ERR_DATABASE);
+        sLog.outError("custody S1: create txn rolled back for auction %u; live state restored", phantomId);
+        listed = NULL;
+        return true;
+    }
+
+    CustodyService::MaybeCrash("pre-deferred");
+    listed = AH;
+    return true;
+}
+
+// ----- SP-2 write-authority forward path for bids (spec 4.1) -----
+// mangosd's AuctionsMap is dead under WriteAuthority (spec 5.7). Existence,
+// state, min-increment, bid-own and same-account guards move to the worker
+// (spec I6); mangosd validates only what it owns -- session, gold, and its own
+// ledger (spec 4.1 step 1).
+bool AhForwardBid(WorldSession& session, uint32 auctionId, uint32 price)
+{
+    if (!sAhService.IsWriteAuthority())
+    {
+        return false;
+    }
+
+    Player* pl = session.GetPlayer();
+
+    WorkerSupervisor* sv = sAhService.GetSupervisor();
+    if (!sv || !sv->ServiceActive())
+    {
+        AhSendUnavailableMessage(&session);
+        session.SendAuctionCommandResult(NULL, AUCTION_BID_PLACED, AUCTION_ERR_DATABASE);
+        return true;
+    }
+
+    // Cap check BEFORE any reserve (spec 5.5).
+    if (!sAhService.GetMutationPending().CanRegister(pl->GetGUIDLow()))
+    {
+        session.SendAuctionCommandResult(NULL, AUCTION_BID_PLACED, AUCTION_ERR_DATABASE);
+        return true;
+    }
+
+    // Full-price affordability guard at core parity (silent return, no result).
+    if (price > pl->GetMoney())
+    {
+        return true;
+    }
+
+    // Classify against mangosd's OWN ledger: same-bidder top-up -> delta
+    // reserve; everything else -> the full price reserved as maxPrice; 0 ->
+    // inline ERR_HIGHER_BID.
+    uint32 reserveAmount = 0u;
+    uint16 const fwdOp = AhClassifyBidForward(auctionId, pl->GetGUIDLow(), price, reserveAmount);
+    if (fwdOp == 0u)
+    {
+        AhSendAuctionCommandResultData(&session, auctionId, AUCTION_BID_PLACED, AUCTION_ERR_HIGHER_BID, EQUIP_ERR_OK, 0);
+        return true;
+    }
+
+    uint64 const uuid = AhMintMutationUuid();
+    std::string const reserveKey = "bid:" + std::to_string(auctionId) + ":" +
+                                   std::to_string(CustodyLedger::NextBidSeq(auctionId));
+
+    // Durable reserve in ONE checked txn (spec decision 9).
+    CustodyDeferred def;
+    CharacterDatabase.BeginTransaction();
+    CustodyService::ReserveGold(def, pl->GetGUIDLow(), pl, reserveAmount, reserveKey, auctionId, ROLE_BID);
+    if (!CharacterDatabase.CommitTransactionChecked())
+    {
+        pl->ModifyMoney(int32(reserveAmount));
+        AhSendAuctionCommandResultData(&session, auctionId, AUCTION_BID_PLACED, AUCTION_ERR_DATABASE, EQUIP_ERR_OK, 0);
+        sLog.outError("SP-2 bid: reserve txn rolled back for auction %u", auctionId);
+        return true;
+    }
+
+    // Crash seam: the bid reserve is durably committed but not forwarded.
+    CustodyService::MaybeCrash("post-reserve-pre-forward");
+
+    // Register BEFORE the send (a reply can never race an unknown uuid).
+    PendingMutation pm;
+    pm.uuid           = uuid;
+    pm.playerGuidLow  = pl->GetGUIDLow();
+    pm.op             = fwdOp;
+    pm.auctionId      = auctionId;
+    pm.state          = uint8(PMUT_AWAIT_RESULT);
+    pm.sentSec        = uint32(time(NULL));
+    pm.reservedAmount = reserveAmount;
+    pm.reserveKey     = reserveKey;
+    pm.itemKey.clear();
+    pm.depKey.clear();
+    sAhService.GetMutationPending().Register(pm);
+
+    IpcMessage m;
+    if (fwdOp == uint16(IPC_PLAYER_BID))
+    {
+        PlayerBidIntent pbi;
+        pbi.uuid       = uuid;
+        pbi.auctionId  = auctionId;
+        pbi.bidderGuid = pl->GetGUIDLow();
+        pbi.bidAmount  = price;    // full new price; the finalize tops up by the delta
+        m.op = IPC_PLAYER_BID;
+        pbi.Encode(m.body);
+    }
+    else
+    {
+        PlayerBuyoutIntent pbo;
+        pbo.uuid       = uuid;
+        pbo.auctionId  = auctionId;
+        pbo.bidderGuid = pl->GetGUIDLow();
+        pbo.maxPrice   = price;    // worker: effectiveBid = min(maxPrice, buyout) (spec 4.1)
+        m.op = IPC_PLAYER_BUYOUT;
+        pbo.Encode(m.body);
+    }
+
+    if (!sv->Channel().SendFrame(m))
+    {
+        // Never roll a durable reserve back unilaterally (decision 10).
+        sAhService.GetMutationPending().Tombstone(uuid);
+        AhSendAuctionCommandResultData(&session, auctionId, AUCTION_BID_PLACED, AUCTION_ERR_DATABASE, EQUIP_ERR_OK, 0);
+        sLog.outError("SP-2 bid: forward send failed for auction %u uuid " UI64FMTD "; reservation in doubt",
+                      auctionId, uuid);
+    }
+    return true;
+}
+
+// Custody bid: durable rows already in flight remain authoritative until
+// terminal, so the route is consulted even when custody entry is switched off.
+bool AhSettleBid(WorldSession& session, AuctionEntry& auctionRef, uint32 price, uint32 newOutbid)
+{
+    AuctionEntry* auction = &auctionRef;
+    Player* pl = session.GetPlayer();
+
+    CustodyRouteState const route = CustodyLedger::GetRouteState(auction->Id);
+    if (!route.known)
+    {
+        AhSendAuctionCommandResultData(&session, auction->Id, AUCTION_BID_PLACED,
+                                       AUCTION_ERR_DATABASE, EQUIP_ERR_OK, 0);
+        return true;
+    }
+    // A player-seller row or a player-bid row selects the combined transaction.
+    // Marker-only bot listings remain entirely on the core path.
+    if (!route.usesPlayerSellerCustody && !route.hasLiveBidCustody)
+    {
+        return false;
+    }
+
+    uint32 const capId = auction->Id;
+
+    // A route that claims live bid custody must have exactly one row matching
+    // the current auction state.
+    std::string liveBidKey;
+    if (route.hasLiveBidCustody)
+    {
+        CustodyRow liveRow;
+        if (auction->bidder == 0 ||
+            !CustodyLedger::GetSingleLiveBidRow(capId, liveRow) ||
+            liveRow.ownerGuid != auction->bidder ||
+            liveRow.amount != auction->bid)
+        {
+            sLog.outError("custody S2: live bid row validation failed for auction %u "
+                          "(bidder %u, bid %u); failing closed", capId, auction->bidder, auction->bid);
+            AhSendAuctionCommandResultData(&session, capId, AUCTION_BID_PLACED, AUCTION_ERR_DATABASE, EQUIP_ERR_OK, 0);
+            return true;
+        }
+        liveBidKey = liveRow.idemKey;
+    }
+
+    // Snapshot what AhUpdateBidCustody changes in memory so a rolled-back
+    // commit can restore it. effectiveBid mirrors its buyout cap.
+    uint32 const oldBid = auction->bid;
+    uint32 const oldBidder = auction->bidder;
+    uint32 const effectiveBid = (auction->buyout && price > auction->buyout) ? auction->buyout : price;
+    uint32 const bidderDebit = (oldBidder == pl->GetGUIDLow()) ? (effectiveBid - oldBid) : effectiveBid;
+
+    uint32 const bidderGuidLow = pl->GetGUIDLow();
+
+    // The success command result comes first, as on the core path; it holds
+    // only values because a buyout deletes the auction in the same run.
+    CustodyDeferred def;
+    def.effects.push_back([bidderGuidLow, capId, newOutbid]()
+    {
+        Player* p = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, bidderGuidLow));
+        if (p)
+        {
+            AhSendAuctionCommandResultData(p->GetSession(), capId, AUCTION_BID_PLACED, AUCTION_OK, EQUIP_ERR_OK, newOutbid);
+        }
+    });
+
+    CharacterDatabase.BeginTransaction();
+    AhUpdateBidCustody(*auction, price, pl, def, route.usesPlayerSellerCustody,
+                       route.hasLiveBidCustody, liveBidKey);
+
+    CustodyService::MaybeCrash("pre-commit");
+    if (CharacterDatabase.CommitTransactionChecked())
+    {
+        CustodyService::MaybeCrash("pre-deferred");
+        def.run();          // ordered live effects (command-result, notify/mail pushes, buyout win + delete)
+    }
+    else
+    {
+        // The auction was not deleted (def did not run), so restoring its bid
+        // and bidder is safe for both the normal-bid and buyout paths.
+        auction->bid = oldBid;
+        auction->bidder = oldBidder;
+        pl->ModifyMoney(int32(bidderDebit));
+        AhSendAuctionCommandResultData(&session, capId, AUCTION_BID_PLACED, AUCTION_ERR_DATABASE, EQUIP_ERR_OK, 0);
+        sLog.outError("custody S2: bid txn rolled back for auction %u; live state restored", capId);
+    }
+    return true;
+}
+
+// ----- SP-2 write-authority cancel path: prepare -> worker -> phase 2 -----
+// The worker owns the book, so ownership/existence checks move to it; mangosd
+// owns only the pending slot, later cut reserve, and value finalize.
+bool AhForwardCancel(WorldSession& session, uint32 auctionId)
+{
+    if (!sAhService.IsWriteAuthority())
+    {
+        return false;
+    }
+
+    Player* pl = session.GetPlayer();
+
+    WorkerSupervisor* sv = sAhService.GetSupervisor();
+    if (!sv || !sv->ServiceActive())
+    {
+        AhSendUnavailableMessage(&session);
+        AhSendAuctionCommandResultData(&session, auctionId, AUCTION_REMOVED, AUCTION_ERR_DATABASE, EQUIP_ERR_OK, 0);
+        return true;
+    }
+
+    uint64 const uuid = AhMintMutationUuid();
+    IpcMessage m;
+    if (!AhBuildCancelPrepareForward(sAhService.GetMutationPending(), pl->GetGUIDLow(),
+                                     auctionId, uuid, uint32(time(NULL)), m))
+    {
+        AhSendAuctionCommandResultData(&session, auctionId, AUCTION_REMOVED, AUCTION_ERR_DATABASE, EQUIP_ERR_OK, 0);
+        return true;
+    }
+
+    if (!sv->Channel().SendFrame(m))
+    {
+        // No unilateral rollback: the frame may have reached the worker.
+        sAhService.GetMutationPending().Tombstone(uuid);
+        AhSendAuctionCommandResultData(&session, auctionId, AUCTION_REMOVED, AUCTION_ERR_DATABASE, EQUIP_ERR_OK, 0);
+        sLog.outError("SP-2 cancel: forward send failed for auction %u uuid " UI64FMTD
+                      "; cancellation in doubt", auctionId, uuid);
+    }
+    return true;
+}
+
+// Custody cancel (per-auction drain, X3). One checked txn: cut debit + bidder
+// refund (ledger + mail) + deposit forfeit (ledger only) + item return to the
+// seller; every live effect runs only on commit success (spec B/C, S5).
+bool AhSettleCancel(WorldSession& session, AuctionHouseObject& house, AuctionEntry& auctionRef)
+{
+    AuctionEntry* auction = &auctionRef;
+    AuctionHouseObject* auctionHouse = &house;
+    Player* pl = session.GetPlayer();
+
+    // Durable rows already in flight remain authoritative until terminal.
+    CustodyRouteState const route = CustodyLedger::GetRouteState(auction->Id);
+    if (!route.known)
+    {
+        AhSendAuctionCommandResultData(&session, auction->Id, AUCTION_REMOVED,
+                                       AUCTION_ERR_DATABASE, EQUIP_ERR_OK, 0);
+        return true;
+    }
+    if (!route.usesPlayerSellerCustody && !route.hasLiveBidCustody)
+    {
+        return false;
+    }
+
+    // Guard first, before any mutation or txn: a too-poor seller cancelling a
+    // bid auction gets the core path's silent return.
+    uint32 const auctionCut = auction->bid ? auction->GetAuctionCut() : 0;
+    if (auction->bid && pl->GetMoney() < auctionCut)
+    {
+        return true;
+    }
+
+    uint32 const capId = auction->Id;
+
+    // A bid-custody route must match exactly one current live bid row.
+    std::string liveBidKey;
+    if (route.hasLiveBidCustody)
+    {
+        CustodyRow liveRow;
+        if (auction->bidder == 0 ||
+            !CustodyLedger::GetSingleLiveBidRow(capId, liveRow) ||
+            liveRow.ownerGuid != auction->bidder ||
+            liveRow.amount != auction->bid)
+        {
+            sLog.outError("custody S5: live bid row validation failed for auction %u "
+                          "(bidder %u, bid %u); failing closed", capId, auction->bidder, auction->bid);
+            AhSendAuctionCommandResultData(&session, capId, AUCTION_REMOVED, AUCTION_ERR_DATABASE, EQUIP_ERR_OK, 0);
+            return true;
+        }
+        liveBidKey = liveRow.idemKey;
+    }
+
+    uint32 const cutDebited = auction->bid ? auctionCut : 0;
+    uint32 const sellerGuidLow = pl->GetGUIDLow();
+
+    CustodyDeferred def;
+    CharacterDatabase.BeginTransaction();
+    AhPrepareCancelCustody(*auction, pl, def, route.usesPlayerSellerCustody,
+                           route.hasLiveBidCustody, liveBidKey, auctionCut);
+
+    // The seller's command result runs after the item mail, as on the core path.
+    def.effects.push_back([sellerGuidLow, capId]()
+    {
+        Player* p = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, sellerGuidLow));
+        if (p)
+        {
+            AhSendAuctionCommandResultData(p->GetSession(), capId, AUCTION_REMOVED, AUCTION_OK, EQUIP_ERR_OK, 0);
+        }
+    });
+
+    // Map erase, Eluna OnRemove and delete last, in the core path's order, so
+    // OnRemove fires only on a committed cancel.
+    AuctionEntry* self = auction;
+    def.effects.push_back([auctionHouse, capId, self]()
+    {
+        auctionHouse->RemoveAuction(capId);
+#ifdef ENABLE_ELUNA
+        if (Eluna* e = sWorld.GetEluna())
+        {
+            e->OnRemove(auctionHouse, self);
+        }
+#endif /* ENABLE_ELUNA */
+        delete self;
+    });
+
+    CustodyService::MaybeCrash("pre-commit");
+    if (CharacterDatabase.CommitTransactionChecked())
+    {
+        CustodyService::MaybeCrash("pre-deferred");
+        def.run();
+    }
+    else
+    {
+        // Only the cut debit changed in memory; the item and auction survive.
+        pl->ModifyMoney(int32(cutDebited));
+        AhSendAuctionCommandResultData(&session, capId, AUCTION_REMOVED, AUCTION_ERR_DATABASE, EQUIP_ERR_OK, 0);
+        sLog.outError("custody S5: cancel txn rolled back for auction %u; cut restored", capId);
+    }
+    return true;
+}
+// ===========================================================================
+// SP-1 async browse proxy: profile/recipe/house builders + in-process fallback
+// ===========================================================================
+
+// Map an AuctionHouseEntry to the BrowseQuery house code (0/1/2). The houseId
+// ranges mirror the live faction split (1..3 = Alliance, 4..6 = Horde, else
+// Neutral).
+static uint8 AhHouseToType(AuctionHouseEntry const* e)
+{
+    uint32 id = e->houseId;
+    if (id >= 1u && id <= 3u)
+    {
+        return 0u;   // ALLIANCE
+    }
+    if (id >= 4u && id <= 6u)
+    {
+        return 1u;   // HORDE
+    }
+    return 2u;       // NEUTRAL
+}
+
+// Snapshot the browsing player's usability inputs into the wire profile.
+static void AhBuildBrowseQueryProfile(Player* player, PlayerProfile& out)
+{
+    out.classId   = player->getClass();
+    out.raceId    = player->getRace();
+    out.level     = uint8(player->getLevel());
+    out.honorRank = player->GetHonorHighestRankInfo().rank;   // direct_action=true uses highest
+    // Known spells (open-c: full set; vanilla spellbooks are small).
+    PlayerSpellMap const& spells = player->GetSpellMap();
+    for (PlayerSpellMap::const_iterator it = spells.begin(); it != spells.end(); ++it)
+    {
+        if (it->second.state != PLAYERSPELL_REMOVED && !it->second.disabled)
+        {
+            out.knownSpells.push_back(it->first);
+        }
+    }
+    // Skills (D6): emit (skillId, GetSkillValue) for every known skill line by
+    // walking the PLAYER_SKILL_INFO update fields (3 uint32 per slot; the skill
+    // id is the low 16 bits of word 0). The worker gates BOTH RequiredSkill AND
+    // item proficiency against these.
+    for (uint32 i = 0; i < PLAYER_MAX_SKILLS; ++i)
+    {
+        uint32 w0 = player->GetUInt32Value(PLAYER_SKILL_INFO_1_1 + i * 3);
+        uint16 skillId = uint16(w0 & 0x0000FFFFu);
+        if (skillId == 0u)
+        {
+            continue;
+        }
+        SkillRank sr;
+        sr.skillId = skillId;
+        sr.rank    = player->GetSkillValue(skillId);
+        out.skills.push_back(sr);
+    }
+    // Reputations: emit (factionId, rank) for each faction the player has state.
+    FactionStateList const& reps = player->GetReputationMgr().GetStateList();
+    for (FactionStateList::const_iterator it = reps.begin(); it != reps.end(); ++it)
+    {
+        FactionEntry const* fe = sFactionStore.LookupEntry(it->second.ID);
+        if (!fe)
+        {
+            continue;
+        }
+        RepStanding rs;
+        rs.factionId = uint16(it->second.ID);
+        rs.rank = uint8(player->GetReputationMgr().GetRank(fe));
+        out.reps.push_back(rs);
+    }
+}
+
+// C2b/D9: sRecipeCastToTaught maps each recipe item's CAST spell (spellid_1) to
+// the spell it TEACHES (EffectTriggerSpell[0]). Built ONCE at world load.
+typedef std::map<uint32, uint32> RecipeCastMap;
+static RecipeCastMap sRecipeCastToTaught;
+static bool          sRecipeCastBuilt = false;
+
+// Build the recipe cast->taught map. Declared in AuctionHouseBot/BrowsePending.h
+// (V6). Call from the TOP of AuctionHouseMgr::LoadAuctionItems, BEFORE its
+// empty-AH early return (V6), at world load (single-threaded). Idempotent.
+void AhEnsureRecipeCastMap()
+{
+    if (sRecipeCastBuilt)
+    {
+        return;
+    }
+    sRecipeCastBuilt = true;
+    sRecipeCastToTaught.clear();
+    // Scan recipe-class item_template once; resolve spellid_1 -> trigger spell.
+    for (uint32 entry = 0; entry < sItemStorage.GetMaxEntry(); ++entry)
+    {
+        ItemPrototype const* proto = sItemStorage.LookupEntry<ItemPrototype>(entry);
+        if (!proto || proto->Class != ITEM_CLASS_RECIPE)
+        {
+            continue;
+        }
+        uint32 castSpell = proto->Spells[0].SpellId;
+        if (castSpell == 0u)
+        {
+            continue;
+        }
+        SpellEntry const* se = sSpellStore.LookupEntry(castSpell);
+        if (!se)
+        {
+            continue;
+        }
+        uint32 taught = se->EffectTriggerSpell[EFFECT_INDEX_0];
+        if (taught == 0u)
+        {
+            continue;   // no taught spell -> can't ever be "known"; skip
+        }
+        sRecipeCastToTaught[castSpell] = taught;
+    }
+}
+
+// The set of recipe CAST spell ids (spellid_1) whose TAUGHT spell the player
+// already knows. The worker matches each recipe item's spellid_1 against it.
+static void AhBuildKnownRecipeCastSpells(Player* player, std::vector<uint32>& out)
+{
+    for (RecipeCastMap::const_iterator it = sRecipeCastToTaught.begin();
+         it != sRecipeCastToTaught.end(); ++it)
+    {
+        if (player->HasSpell(it->second))
+        {
+            out.push_back(it->first);   // the player knows what this recipe teaches
+        }
+    }
+}
+
+// Coordinator model: the worker is the AH read authority. When it cannot serve
+// (down, a transient register/encode/send failure, queue-full, oversize, or a
+// reply timeout) mangosd serves NOTHING in-process. It sends an empty list so
+// the client does not hang, plus the unavailable message (center flash + red
+// chat line via AhSendUnavailableMessage). Non-static: the world thread calls it
+// from the IPC_BROWSE_RESULT reply branch and the TTL sweep. (kind is a
+// BrowseKind; only the opcode depends on it.)
+void AhSendBrowseUnavailable(WorldSession* session, uint8 kind)
+{
+    uint16 opcode = (kind == uint8(BROWSE_OWNER)) ? SMSG_AUCTION_OWNER_LIST_RESULT
+                  : (kind == uint8(BROWSE_BIDDER)) ? SMSG_AUCTION_BIDDER_LIST_RESULT
+                  : SMSG_AUCTION_LIST_RESULT;
+    WorldPacket data(opcode, 4 + 4);
+    data << uint32(0);   // count
+    data << uint32(0);   // totalcount
+    session->SendPacket(&data);
+    AhSendUnavailableMessage(session);
+}
+
+
+// SP-1 async proxy: the worker answers the three auction lists while it runs.
+// Configured but down (or failed to start) -> coordinator: no in-process
+// serving, the player is told the AH is unavailable.
+bool AhForwardList(WorldSession& session, AuctionListRequest const& request)
+{
+    uint8 const kind = request.kind == AUCTION_LIST_OWNER ? uint8(BROWSE_OWNER)
+                     : request.kind == AUCTION_LIST_BIDDER ? uint8(BROWSE_BIDDER)
+                     : uint8(BROWSE_LIST);
+
+    WorkerSupervisor* sv = sAhService.GetSupervisor();
+    if (!sv || !sv->ServiceActive())
+    {
+        if (sAhService.IsWorkerConfigured())
+        {
+            AhSendBrowseUnavailable(&session, kind);
+            return true;
+        }
+        return false;
+    }
+
+    Player* pl = session.GetPlayer();
+
+    PendingBrowse pb;
+    pb.accountId      = session.GetAccountId();
+    pb.playerGuidLow  = pl->GetGUIDLow();
+    pb.kind           = kind;
+    pb.house          = AhHouseToType(request.houseEntry);
+    pb.allHouses      = sWorld.getConfig(CONFIG_BOOL_ALLOW_TWO_SIDE_INTERACTION_AUCTION) ? 1u : 0u;
+    pb.itemClass      = 0xFFFFFFFFu;
+    pb.itemSubClass   = 0xFFFFFFFFu;
+    pb.inventoryType  = 0xFFFFFFFFu;
+    pb.quality        = 0xFFFFFFFFu;
+    pb.levelmin       = 0u;
+    pb.levelmax       = 0u;
+    pb.usable         = 0u;
+    pb.deferEluna     = 0u;
+    pb.listfrom       = request.listfrom;
+    pb.wname.clear();
+
+    std::string nameLower;
+    if (request.kind == AUCTION_LIST_ITEMS)
+    {
+        std::wstring wsearchedname;
+        if (!Utf8toWStr(request.searchedName, wsearchedname))
+        {
+            // F5: malformed UTF-8 in the search name; the request never leaves,
+            // so answer it now or the client's browse panel hangs.
+            AhSendBrowseUnavailable(&session, kind);
+            return true;
+        }
+        wstrToLower(wsearchedname);
+        WStrToUtf8(wsearchedname, nameLower);
+
+        pb.itemClass     = request.itemClass;
+        pb.itemSubClass  = request.itemSubClass;
+        pb.inventoryType = request.inventoryType;
+        pb.quality       = request.quality;
+        pb.levelmin      = request.levelmin;
+        pb.levelmax      = request.levelmax;
+        pb.usable        = request.usable;
+#ifdef ENABLE_ELUNA
+        if (request.usable != 0u)
+        {
+            pb.deferEluna = 1u;   // defer OnCanUseItem to the reply handler
+        }
+#endif
+        pb.wname         = wsearchedname;
+    }
+    pb.seq = sAhService.GetBrowsePending().NextSeqFor(pb.playerGuidLow, pb.kind);
+
+    BrowseQuery q;
+    q.queryId          = 0;
+    q.kind             = pb.kind;
+    q.house            = pb.house;
+    q.allHouses        = pb.allHouses;
+    q.itemClass        = pb.itemClass;
+    q.itemSubClass     = pb.itemSubClass;
+    q.inventoryType    = pb.inventoryType;
+    q.quality          = pb.quality;
+    q.levelmin         = pb.levelmin;
+    q.levelmax         = pb.levelmax;
+    q.usable           = pb.usable;
+    q.deferEluna       = pb.deferEluna;
+    q.listfrom         = pb.listfrom;
+    // V3: send the LocaleConstant (NOT the internal session index).
+    {
+        int dbIdx = session.GetSessionDbLocaleIndex();   // -1 for enUS / default
+        LocaleConstant lc = (dbIdx < 0) ? LOCALE_enUS
+                                        : sObjectMgr.GetLocaleForIndex(dbIdx);
+        q.localeIndex = int8(lc);                        // LOCALE_enUS(0) => no overlay
+    }
+    q.requesterGuidLow = pb.playerGuidLow;
+    q.minMountLevel    = sWorld.getConfig(CONFIG_UINT32_MIN_TRAIN_MOUNT_LEVEL);
+    q.minEpicMountLevel= sWorld.getConfig(CONFIG_UINT32_MIN_TRAIN_EPIC_MOUNT_LEVEL);
+    q.searchedName     = nameLower;
+    q.outbidIds        = request.outbidIds;              // client order, mirrored on the wire
+    AhBuildBrowseQueryProfile(pl, q.profile);
+    AhBuildKnownRecipeCastSpells(pl, q.knownRecipeCastSpells);
+
+    uint32 nowSec = uint32(time(NULL));
+    q.queryId = sAhService.GetBrowsePending().Register(pb, nowSec);
+    if (q.queryId == 0u)
+    {
+        // D3: pending-map at MAX_PENDING (browse flood).
+        AhSendBrowseUnavailable(&session, pb.kind);
+        return true;
+    }
+
+    IpcMessage qm; qm.op = IPC_BROWSE_QUERY; q.Encode(qm.body);
+    // open-c: an oversize profile (a huge spellbook/rep set) cannot be sent.
+    if (qm.body.size() > BrowseQuery::MAX_WIRE)
+    {
+        PendingBrowse tmp; (void)sAhService.GetBrowsePending().Take(q.queryId, tmp);
+        AhSendBrowseUnavailable(&session, pb.kind);
+        return true;
+    }
+    if (!sv->Channel().SendFrame(qm))
+    {
+        PendingBrowse tmp; (void)sAhService.GetBrowsePending().Take(q.queryId, tmp);
+        AhSendBrowseUnavailable(&session, pb.kind);
+    }
+    return true;
+}
+
+// ===========================================================================
+// SP-2 write-authority: player-mutation finalize + cancel phase-2 driver.
+// The worker is the book authority; mangosd applies VALUE ONLY, from the
+// wire facts, cross-checked fail-closed against its own custody ledger
+// (spec section 3). No AuctionEntry / AuctionsMap access on any path here.
+// ===========================================================================
+
+// [SP-2] outbid increment from a bid value (mirrors AuctionEntry::GetAuctionOutBid,
+// AuctionHouseMgr.cpp GetAuctionOutBid).
+static uint32 AhOutbidFor(uint32 bid)
+{
+    uint32 outbid = (bid / 100) * 5;
+    if (!outbid)
+    {
+        outbid = 1;
+    }
+    return outbid;
+}
+
+// [SP-2] auction-house cut from wire facts (mirrors AuctionEntry::GetAuctionCut,
+// keyed by houseId -- no AuctionEntry exists on the finalize path). NULL house
+// entry -> 0 (also the -t harness case, where DBC data is not loaded).
+static uint32 AhCutFor(uint8 houseId, uint32 bid)
+{
+    AuctionHouseEntry const* he = sAuctionHouseStore.LookupEntry(uint32(houseId));
+    if (!he)
+    {
+        return 0;
+    }
+    return uint32(he->cutPercent * bid * sWorld.getConfig(CONFIG_FLOAT_RATE_AUCTION_CUT) / 100.0f);
+}
+
+// [SP-2] PlayerMutationResult.op (low byte of the IpcOpcode) -> AuctionAction.
+static AuctionAction AhActionForOp(uint8 op)
+{
+    switch (op)
+    {
+        case uint8(IPC_PLAYER_SELL & 0xFFu):
+            return AUCTION_STARTED;
+        case uint8(IPC_PLAYER_CANCEL & 0xFFu):
+        case uint8(IPC_PLAYER_CANCEL_CONFIRM & 0xFFu):
+            return AUCTION_REMOVED;
+        default:
+            return AUCTION_BID_PLACED;   // IPC_PLAYER_BID / IPC_PLAYER_BUYOUT
+    }
+}
+
+// [SP-2] GUID-re-resolve SMSG emitter (the SP-1 reply-branch pattern): never
+// hold a WorldSession* across ticks; re-resolve by low GUID at send time and
+// skip silently when offline (the durable mail rows are authoritative).
+static void AhSendCommandResultTo(uint32 playerGuidLow, uint32 aucId,
+                                  AuctionAction action, AuctionError err,
+                                  uint32 newOutbid)
+{
+    Player* p = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, playerGuidLow));
+    if (p && p->GetSession())
+    {
+        AhSendAuctionCommandResultData(p->GetSession(), aucId, action, err, EQUIP_ERR_OK, newOutbid);
+    }
+}
+
+// [SP-2] AUCTION_ERR_HIGHER_BID carries the current bidder/bid (the inline
+// branch of SendAuctionCommandResult); rebuilt from wire facts.
+static void AhSendHigherBidResultTo(uint32 playerGuidLow, uint8 op, MutationFacts const& f)
+{
+    Player* p = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, playerGuidLow));
+    if (!p || !p->GetSession())
+    {
+        return;
+    }
+    WorldPacket data(SMSG_AUCTION_COMMAND_RESULT, 16);
+    data << uint32(f.auctionId);
+    data << uint32(AhActionForOp(op));
+    data << uint32(AUCTION_ERR_HIGHER_BID);
+    data << ObjectGuid(HIGHGUID_PLAYER, f.curBidderGuid);
+    data << uint32(f.curBid);
+    data << uint32(AhOutbidFor(f.curBid));
+    p->GetSession()->SendPacket(&data);
+}
+
+// [SP-2] "<itemTemplate>:<rand>:<response>" mail subject (the legacy pattern
+// used by every AH mail).
+static std::string AhMailSubject(uint32 itemTemplate, int32 itemRand, uint32 response)
+{
+    std::ostringstream s;
+    s << itemTemplate << ":" << itemRand << ":" << response;
+    return s.str();
+}
+
+// Worker-authority terminal paths still use the live escrow cache until SP-6B's
+// durable item-take lands. Missing or mismatched cache state must therefore
+// hold custody for retry; it can never authorize a ledger-only item transition.
+// The output row is a value snapshot and the output item remains cache-owned.
+static bool AhGetCachedReservedItem(std::string const& key, uint32 auctionId,
+                                    uint32 ownerGuid, uint32 expectedItemGuid,
+                                    CustodyRow& row, Item*& item,
+                                    uint8 expectedRole = ROLE_ITEM)
+{
+    item = NULL;
+    if (key.empty() || !CustodyLedger::Get(key, row) ||
+        row.kind != CUSTODY_ITEM || row.role != expectedRole ||
+        row.state != CST_RESERVED || row.ownerGuid != ownerGuid ||
+        row.beneficiaryGuid != 0u || row.amount != 0u ||
+        row.auctionId != auctionId ||
+        (expectedItemGuid != 0u && row.itemGuid != expectedItemGuid))
+    {
+        sLog.outError("[AHMut] item custody mismatch for key %s (auction %u); "
+                      "holding for retry",
+                      key.c_str(), auctionId);
+        return false;
+    }
+
+    item = sAuctionMgr.GetAItem(row.itemGuid);
+    if (!item || item->GetOwnerGuid().GetCounter() != ownerGuid)
+    {
+        sLog.outError("[AHMut] auction %u escrow item %u missing/mismatched in cache; "
+                      "holding custody for retry",
+                      auctionId, row.itemGuid);
+        return false;
+    }
+    return true;
+}
+
+static bool AhPreflightTerminalItem(MutationFacts const& facts,
+                                    bool requireDeposit)
+{
+    // Bot materializations carry a botlist: marker, not player seller escrow.
+    // Read the marker count in one query so an error cannot look like absence.
+    std::unique_ptr<QueryResult> markers(CharacterDatabase.PQuery(
+        "SELECT COUNT(*), COALESCE(MAX(`idem_key`),'') FROM `custody_ledger` "
+        "WHERE `auction_id`=%u AND `idem_key` LIKE 'botlist:%%'",
+        facts.auctionId));
+    if (!markers)
+    {
+        return false;
+    }
+    uint64 const markerCount = markers->Fetch()[0].GetUInt64();
+    CustodyRow itemRow;
+    Item* item = NULL;
+    if (markerCount != 0u)
+    {
+        if (markerCount != 1u ||
+            !AhGetCachedReservedItem(markers->Fetch()[1].GetCppString(),
+                facts.auctionId, facts.sellerGuid, facts.itemGuid,
+                itemRow, item, ROLE_RESOLUTION))
+        {
+            return false;
+        }
+    }
+    else
+    {
+        if (requireDeposit)
+        {
+            CustodyRow deposit;
+            if (!CustodyLedger::Get("dep:" + std::to_string(facts.auctionId), deposit) ||
+                deposit.kind != CUSTODY_GOLD || deposit.role != ROLE_DEPOSIT ||
+                deposit.state != CST_RESERVED || deposit.ownerGuid != facts.sellerGuid ||
+                deposit.amount != facts.deposit || deposit.auctionId != facts.auctionId)
+            {
+                return false;
+            }
+        }
+        if (!AhGetCachedReservedItem("item:" + std::to_string(facts.auctionId),
+                facts.auctionId, facts.sellerGuid, facts.itemGuid, itemRow, item))
+        {
+            return false;
+        }
+    }
+    return item->GetEntry() == facts.itemTemplate;
+}
+
+// [SP-2] the prior/current bidder's live bid row: EXACTLY ONE live bid row for
+// the auction that is not `excludeKey` and matches the reported owner+amount.
+// Any other shape returns false -> fail closed (spec section 3 matrix).
+static bool AhFindPriorBidRow(uint32 auctionId, uint32 bidderGuid, uint32 amount,
+                              std::string const& excludeKey, CustodyRow& out)
+{
+    return CustodyLedger::GetSingleLiveBidRow(auctionId, out, excludeKey) &&
+        out.ownerGuid == bidderGuid && out.amount == amount;
+}
+
+// [SP-2] in-txn wallet re-credit WITHOUT a ledger-row flip (the buyout
+// remainder: the row shrinks via SetAmount and then commits). Mirrors
+// ReleaseGoldToWallet's wallet leg. The caller MUST undo the online in-memory
+// credit if its checked commit fails (forward-only redrive, X6 idiom).
+static void AhCreditWalletInTxn(uint32 guidLow, uint32 amount)
+{
+    if (amount == 0)
+    {
+        return;
+    }
+    Player* p = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, guidLow));
+    if (p)
+    {
+        p->ModifyMoney(int32(amount));
+        p->SaveInventoryAndGoldToDB();
+    }
+    else
+    {
+        CharacterDatabase.PExecute("UPDATE `characters` SET `money` = `money` + '%u' "
+            "WHERE `guid` = '%u'", amount, guidLow);
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Redrive queue (spec 4.1 step 4, "failed finalize"): forward-only re-attempts
+// of finalizes whose checked commit returned false. NEVER rolls a committed
+// book fact back. In-memory only (a mangosd crash re-enters via reconcile).
+// ---------------------------------------------------------------------------
+struct AhRedriveEntry
+{
+    PlayerMutationResult res;
+    PendingMutation pm;
+    uint32 nextRetrySec;
+    uint32 attempts;
+};
+static std::list<AhRedriveEntry> s_ahRedrive;
+
+// In-doubt sweep TTL (spec 4.1 step 5). A player mutation un-answered by the
+// worker for this long is tombstoned and the player gets the legacy DB error;
+// the reservation stays non-terminal (decision 10) and a late reply still
+// applies via Take. Generous vs the worker round-trip; default-off in prod.
+static uint32 const AH_MUTATION_INDOUBT_TTL_SEC = 30u;
+
+// forward declarations (bodies below)
+static bool AhFinalizeOkDispatch(PlayerMutationResult const& res, PendingMutation const& pm);
+static void AhHandleCancelPrepared(PlayerMutationResult const& res);
+
+// [SP-2] replay of SendAuctionSuccessfulMailInTransaction from wire facts:
+// owner-exists guard, sold-notify deferred BEFORE the mail push, profit =
+// effectiveBid + deposit - cut, COPIED mask.
+static void AhSellerPayoutFromFacts(MutationFacts const& f, CustodyDeferred& def)
+{
+    ObjectGuid ownerGuid = ObjectGuid(HIGHGUID_PLAYER, f.sellerGuid);
+    Player* owner = sObjectMgr.GetPlayer(ownerGuid);
+    uint32 ownerAccId = 0;
+    if (!owner)
+    {
+        ownerAccId = sObjectMgr.GetPlayerAccountIdByGUID(ownerGuid);
+    }
+    if (!owner && !ownerAccId)
+    {
+        return;
+    }
+
+    uint32 const cut = AhCutFor(f.houseId, f.effectiveBid);
+    uint32 const profit = f.effectiveBid + f.deposit - cut;
+
+    std::ostringstream body;
+    body.width(16);
+    body << std::right << std::hex << f.curBidderGuid;
+    body << std::dec << ":" << f.effectiveBid << ":" << f.buyout;
+    body << ":" << f.deposit << ":" << cut;
+
+    if (owner)
+    {
+        uint32 const ownerGuidLow = f.sellerGuid;
+        uint32 const houseId  = f.houseId;
+        uint32 const aucId    = f.auctionId;
+        uint32 const bidValue = f.effectiveBid;
+        uint32 const outbid   = AhOutbidFor(f.effectiveBid);
+        uint32 const bidder   = f.curBidderGuid;
+        uint32 const itemTpl  = f.itemTemplate;
+        int32  const itemRand = f.randomPropertyId;
+        def.effects.push_back([ownerGuidLow, houseId, aucId, bidValue, outbid, bidder, itemTpl, itemRand]()
+        {
+            Player* p = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, ownerGuidLow));
+            if (p)
+            {
+            AhSendAuctionOwnerNotificationData(p->GetSession(), houseId, aucId,
+                bidValue, outbid, bidder, itemTpl, itemRand, true);
+            }
+        });
+    }
+
+    MailDraft(AhMailSubject(f.itemTemplate, f.randomPropertyId, AUCTION_SUCCESSFUL), body.str())
+        .SetMoney(profit)
+        .SendMailToInTransaction(MailReceiver(owner, ownerGuid),
+                                 MailSender(MAIL_AUCTION, uint32(f.houseId), MAIL_STATIONERY_AUCTION),
+                                 def.effects, MAIL_CHECK_MASK_COPIED);
+}
+
+// [SP-2] replay of SendAuctionWonMailInTransaction from wire facts, minus the
+// GM-log block (server-side-only trace). A bot winner (curBidderGuid==0)
+// resolves to "no receiver" and follows the legacy destroy branch (spec
+// section 3). Callers preflight the live escrow item before opening their
+// transaction; the defensive miss below performs no value transition.
+static void AhItemToWinnerFromFacts(MutationFacts const& f, CustodyDeferred& def)
+{
+    Item* pItem = sAuctionMgr.GetAItem(f.itemGuid);
+    if (!pItem)
+    {
+        sLog.outError("[AHMut] auction %u won-item %u missing from escrow cache; no item mail",
+                      f.auctionId, f.itemGuid);
+        return;
+    }
+
+    ObjectGuid bidderGuid = ObjectGuid(HIGHGUID_PLAYER, f.curBidderGuid);
+    Player* bidder = sObjectMgr.GetPlayer(bidderGuid);
+    uint32 bidderAccId = 0;
+    if (!bidder)
+    {
+        bidderAccId = sObjectMgr.GetPlayerAccountIdByGUID(bidderGuid);
+    }
+
+    uint32 const savedItemGuidLow = f.itemGuid;
+
+    if (bidder || bidderAccId)
+    {
+        std::ostringstream body;
+        body.width(16);
+        body << std::right << std::hex << f.sellerGuid;
+        body << std::dec << ":" << f.effectiveBid << ":" << f.buyout;
+
+        CharacterDatabase.PExecute("UPDATE `item_instance` SET `owner_guid` = '%u' WHERE `guid`='%u'",
+                                   f.curBidderGuid, savedItemGuidLow);
+
+        if (bidder)
+        {
+            uint32 const bidderGuidLow = f.curBidderGuid;
+            uint32 const houseId  = f.houseId;
+            uint32 const aucId    = f.auctionId;
+            uint32 const bidValue = f.effectiveBid;
+            uint32 const outbid   = AhOutbidFor(f.effectiveBid);
+            uint32 const itemTpl  = f.itemTemplate;
+            int32  const itemRand = f.randomPropertyId;
+            def.effects.push_back([bidderGuidLow, houseId, aucId, bidValue, outbid, itemTpl, itemRand]()
+            {
+                Player* p = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, bidderGuidLow));
+                if (p)
+                {
+                    AhSendAuctionBidderNotificationData(p->GetSession(), houseId,
+                        aucId, bidderGuidLow, bidValue, outbid, itemTpl,
+                        itemRand, true);
+                }
+            });
+        }
+
+        def.effects.push_back([savedItemGuidLow]()
+        {
+            sAuctionMgr.RemoveAItem(savedItemGuidLow);
+        });
+
+        MailDraft(AhMailSubject(f.itemTemplate, f.randomPropertyId, AUCTION_WON), body.str())
+            .AddItem(pItem)
+            .SendMailToInTransaction(MailReceiver(bidder, bidderGuid),
+                                     MailSender(MAIL_AUCTION, uint32(f.houseId), MAIL_STATIONERY_AUCTION),
+                                     def.effects, MAIL_CHECK_MASK_COPIED);
+    }
+    else
+    {
+        CharacterDatabase.PExecute("DELETE FROM `item_instance` WHERE `guid`='%u'", savedItemGuidLow);
+        def.effects.push_back([savedItemGuidLow, pItem]()
+        {
+            sAuctionMgr.RemoveAItem(savedItemGuidLow);
+            delete pItem;
+        });
+    }
+}
+
+// [SP-2] replay of the S2 outbid displacement (UpdateBidCustody +
+// SendAuctionOutbiddedMailInTransaction): terminalize the prior live bid row
+// ledger-only, outbid-notify deferred BEFORE the refund-mail push, refund
+// money = the prior bid, COPIED mask.
+static void AhRefundPriorBidderFromFacts(MutationFacts const& f, std::string const& priorKey, CustodyDeferred& def)
+{
+    CustodyService::RollbackGoldLedgerOnly(priorKey);
+
+    ObjectGuid priorGuid = ObjectGuid(HIGHGUID_PLAYER, f.priorBidderGuid);
+    Player* prior = sObjectMgr.GetPlayer(priorGuid);
+    uint32 priorAccId = 0;
+    if (!prior)
+    {
+        priorAccId = sObjectMgr.GetPlayerAccountIdByGUID(priorGuid);
+    }
+    if (!prior && !priorAccId)
+    {
+        return;   // legacy sends nothing when the old bidder is gone
+    }
+
+    if (prior)
+    {
+        uint32 const priorGuidLow = f.priorBidderGuid;
+        uint32 const houseId  = f.houseId;
+        uint32 const aucId    = f.auctionId;
+        uint32 const bidValue = f.priorBidAmount;
+        uint32 const outbid   = AhOutbidFor(f.priorBidAmount);
+        uint32 const itemTpl  = f.itemTemplate;
+        int32  const itemRand = f.randomPropertyId;
+        def.effects.push_back([priorGuidLow, houseId, aucId, bidValue, outbid, itemTpl, itemRand]()
+        {
+            Player* p = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, priorGuidLow));
+            if (p)
+            {
+                AhSendAuctionBidderNotificationData(p->GetSession(), houseId,
+                    aucId, priorGuidLow, bidValue, outbid, itemTpl, itemRand,
+                    false);
+            }
+        });
+    }
+
+    MailDraft(AhMailSubject(f.itemTemplate, f.randomPropertyId, AUCTION_OUTBIDDED), "")
+        .SetMoney(f.priorBidAmount)
+        .SendMailToInTransaction(MailReceiver(prior, priorGuid),
+                                 MailSender(MAIL_AUCTION, uint32(f.houseId), MAIL_STATIONERY_AUCTION),
+                                 def.effects, MAIL_CHECK_MASK_COPIED);
+}
+
+// [SP-2] replay of the S5 bidder-refund leg
+// (SendAuctionCancelledToBidderMailInTransaction): removed-notify deferred
+// BEFORE the refund-mail push, money = the standing bid.
+static void AhRefundCancelledBidderFromFacts(MutationFacts const& f, std::string const& bidKey, CustodyDeferred& def)
+{
+    CustodyService::RollbackGoldLedgerOnly(bidKey);
+
+    ObjectGuid bidderGuid = ObjectGuid(HIGHGUID_PLAYER, f.curBidderGuid);
+    Player* bidder = sObjectMgr.GetPlayer(bidderGuid);
+    uint32 accId = 0;
+    if (!bidder)
+    {
+        accId = sObjectMgr.GetPlayerAccountIdByGUID(bidderGuid);
+    }
+    if (!bidder && !accId)
+    {
+        return;
+    }
+
+    if (bidder)
+    {
+        uint32 const bidderGuidLow = f.curBidderGuid;
+        uint32 const aucId    = f.auctionId;
+        uint32 const itemTpl  = f.itemTemplate;
+        int32  const itemRand = f.randomPropertyId;
+        def.effects.push_back([bidderGuidLow, aucId, itemTpl, itemRand]()
+        {
+            Player* p = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, bidderGuidLow));
+            if (p)
+            {
+                AhSendAuctionRemovedNotificationData(p->GetSession(), aucId, itemTpl, itemRand);
+            }
+        });
+    }
+
+    MailDraft(AhMailSubject(f.itemTemplate, f.randomPropertyId, AUCTION_CANCELLED_TO_BIDDER), "")
+        .SetMoney(f.curBid)
+        .SendMailToInTransaction(MailReceiver(bidder, bidderGuid),
+                                 MailSender(MAIL_AUCTION, uint32(f.houseId), MAIL_STATIONERY_AUCTION),
+                                 def.effects, MAIL_CHECK_MASK_COPIED);
+}
+
+// [SP-2] item return to the seller (cancel / expiry / repair), replaying
+// SendAuctionExpiredMailInTransaction / the S5 return: expired owner-notify
+// (EXPIRED response only), RemoveAItem deferred FIRST, DeliverItem flips
+// "item:<id>" -> TERMINAL_OK and co-commits the mail; destroy branch when the
+// account is gone. Callers preflight the cache before opening the transaction.
+static void AhReturnItemToSellerFromFacts(MutationFacts const& f, uint32 mailResponse, CustodyDeferred& def)
+{
+    std::string const itemKey = "item:" + std::to_string(f.auctionId);
+    Item* pItem = sAuctionMgr.GetAItem(f.itemGuid);
+    if (!pItem)
+    {
+        sLog.outError("[AHMut] auction %u return-item %u missing from escrow "
+                      "cache; holding custody",
+                      f.auctionId, f.itemGuid);
+        return;
+    }
+
+    ObjectGuid ownerGuid = ObjectGuid(HIGHGUID_PLAYER, f.sellerGuid);
+    Player* owner = sObjectMgr.GetPlayer(ownerGuid);
+    uint32 accId = 0;
+    if (!owner)
+    {
+        accId = sObjectMgr.GetPlayerAccountIdByGUID(ownerGuid);
+    }
+
+    uint32 const savedItemGuidLow = f.itemGuid;
+
+    if (owner || accId)
+    {
+        if (owner && mailResponse == uint32(AUCTION_EXPIRED))
+        {
+            uint32 const ownerGuidLow = f.sellerGuid;
+            uint32 const houseId  = f.houseId;
+            uint32 const aucId    = f.auctionId;
+            uint32 const itemTpl  = f.itemTemplate;
+            int32  const itemRand = f.randomPropertyId;
+            def.effects.push_back([ownerGuidLow, houseId, aucId, itemTpl, itemRand]()
+            {
+                Player* p = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, ownerGuidLow));
+                if (p)
+                {
+                    AhSendAuctionOwnerNotificationData(p->GetSession(), houseId,
+                        aucId, 0, 0, 0, itemTpl, itemRand, false);
+                }
+            });
+        }
+
+        def.effects.push_back([savedItemGuidLow]()
+        {
+            sAuctionMgr.RemoveAItem(savedItemGuidLow);
+        });
+
+        MailDraft itemReturn(AhMailSubject(f.itemTemplate, f.randomPropertyId, mailResponse), "");
+        itemReturn.AddItem(pItem);
+        CustodyService::DeliverItem(def, itemKey, itemReturn,
+                                    MailReceiver(owner, ownerGuid),
+                                    MailSender(MAIL_AUCTION, uint32(f.houseId), MAIL_STATIONERY_AUCTION),
+                                    MAIL_CHECK_MASK_COPIED);
+    }
+    else
+    {
+        CharacterDatabase.PExecute("DELETE FROM `item_instance` WHERE `guid`='%u'", savedItemGuidLow);
+        CustodyService::CommitGoldLedgerOnly(itemKey);
+        def.effects.push_back([savedItemGuidLow, pItem]()
+        {
+            sAuctionMgr.RemoveAItem(savedItemGuidLow);
+            delete pItem;
+        });
+    }
+}
+
+#ifdef ENABLE_ELUNA
+// [SP-2 spec 5.8] Under WriteAuthority the worker owns the book, so the legacy
+// in-map AuctionEntry that fed the Eluna AH hooks no longer lives in mangosd.
+// Synthesize a transient (stack-only, never map-inserted) AuctionEntry from the
+// wire facts and fire the SAME OnAdd/OnRemove the legacy custody path invokes,
+// so Lua AH scripts still observe listing/finalize events. The hooks self-guard
+// on owner-online + escrow-item-present (GetAItem), so fire them while the
+// escrow item is still cached -- i.e. BEFORE the finalize's deferred RemoveAItem
+// runs. startbid is not carried in MutationFacts (0 here); every other field is
+// exact.
+static void AhElunaFillEntry(AuctionEntry& e, MutationFacts const& f)
+{
+    e.Id                   = f.auctionId;
+    e.itemGuidLow          = f.itemGuid;
+    e.itemTemplate         = f.itemTemplate;
+    e.itemCount            = f.itemCount;
+    e.itemRandomPropertyId = f.randomPropertyId;
+    e.owner                = f.sellerGuid;
+    e.startbid             = 0;
+    e.bid                  = f.curBid;
+    e.buyout               = f.buyout;
+    e.expireTime           = 0;
+    e.bidder               = f.curBidderGuid;
+    e.deposit              = f.deposit;
+    e.auctionHouseEntry    = sAuctionHouseStore.LookupEntry(uint32(f.houseId));
+}
+
+static void AhElunaOnAddFromFacts(MutationFacts const& f)
+{
+    Eluna* e = sWorld.GetEluna();
+    if (!e)
+    {
+        return;
+    }
+    AuctionEntry tmp;
+    AhElunaFillEntry(tmp, f);
+    if (!tmp.auctionHouseEntry)
+    {
+        return;
+    }
+    e->OnAdd(sAuctionMgr.GetAuctionsMap(tmp.auctionHouseEntry), &tmp);
+}
+
+static void AhElunaOnRemoveFromFacts(MutationFacts const& f)
+{
+    Eluna* e = sWorld.GetEluna();
+    if (!e)
+    {
+        return;
+    }
+    AuctionEntry tmp;
+    AhElunaFillEntry(tmp, f);
+    if (!tmp.auctionHouseEntry)
+    {
+        return;
+    }
+    e->OnRemove(sAuctionMgr.GetAuctionsMap(tmp.auctionHouseEntry), &tmp);
+}
+#endif /* ENABLE_ELUNA */
+
+// [SP-2] MUT_OK sell (spec 4.1 step 4): NO value moves -- the deposit stays
+// reserved and the item stays escrowed until resolution. Cross-check + the
+// legacy AUCTION_STARTED/AUCTION_OK result only.
+static bool AhFinalizeSellOk(PlayerMutationResult const& res, PendingMutation const& pm)
+{
+    MutationFacts const& f = res.facts;
+    CustodyRow depRow;
+    CustodyRow itemRow;
+    if (!CustodyLedger::Get(pm.depKey, depRow) || depRow.state != CST_RESERVED ||
+        depRow.ownerGuid != pm.playerGuidLow || depRow.amount != f.deposit ||
+        !CustodyLedger::Get(pm.itemKey, itemRow) || itemRow.state != CST_RESERVED ||
+        itemRow.itemGuid != f.itemGuid ||
+        f.sellerGuid != pm.playerGuidLow || f.auctionId != pm.auctionId)
+    {
+        sLog.outError("[AHMut] PROTOCOL FAULT: sell facts mismatch ledger for uuid " UI64FMTD
+                      " (auction %u); finalize refused", res.uuid, f.auctionId);
+        return true;   // faults are terminal, never redriven
+    }
+    AhSendCommandResultTo(pm.playerGuidLow, f.auctionId, AUCTION_STARTED, AUCTION_OK, 0);
+#ifdef ENABLE_ELUNA
+    // [SP-2 spec 5.8] listing committed to the worker's book -> Eluna OnAdd.
+    AhElunaOnAddFromFacts(f);
+#endif
+    return true;
+}
+
+// [SP-2] MUT_OK bid/buyout (spec 4.1 step 4 + I4 value math): section 4.4
+// order = command-result FIRST, then outbid-notify, then mails.
+//
+// [SP-2 reconciliation] op=0x42 (from an IPC_PLAYER_BUYOUT intent) is a buyout
+// WIN only when the worker actually removed the row at the buyout price; a
+// below-buyout price is committed by the worker as a NORMAL bid and the row
+// stays LIVE (HEAD 16e22c4e). Distinguish by facts: WIN <=> buyout != 0 &&
+// effectiveBid == buyout. A BID sub-case falls through the standing-bid path
+// (release = reservedAmount - effectiveBid == 0; no seller payout, no item
+// delivery, just the displaced prior-bidder refund).
+static bool AhFinalizeBidOk(PlayerMutationResult const& res, PendingMutation const& pm)
+{
+    MutationFacts const& f = res.facts;
+    bool const isBuyoutWin = (res.op == uint8(IPC_PLAYER_BUYOUT & 0xFFu)
+                              && f.buyout != 0 && f.effectiveBid == f.buyout);
+    bool const sameBidderRaise = (f.priorBidderGuid != 0 && f.priorBidderGuid == pm.playerGuidLow);
+
+    // ---- fail-closed cross-check vs our OWN ledger (spec section 3) ----
+    CustodyRow ownRow;
+    if (!CustodyLedger::Get(pm.reserveKey, ownRow) || ownRow.state != CST_RESERVED ||
+        ownRow.ownerGuid != pm.playerGuidLow || ownRow.auctionId != f.auctionId ||
+        ownRow.amount != pm.reservedAmount ||
+        f.curBidderGuid != pm.playerGuidLow || f.effectiveBid != f.curBid)
+    {
+        sLog.outError("[AHMut] PROTOCOL FAULT: bid facts mismatch ledger for uuid " UI64FMTD
+                      " (auction %u); finalize refused", res.uuid, f.auctionId);
+        return true;
+    }
+    if (sameBidderRaise && f.effectiveBid < f.priorBidAmount)
+    {
+        sLog.outError("[AHMut] PROTOCOL FAULT: raise below prior bid for uuid " UI64FMTD, res.uuid);
+        return true;
+    }
+    uint32 const needed = sameBidderRaise ? (f.effectiveBid - f.priorBidAmount) : f.effectiveBid;
+    if (needed > pm.reservedAmount)
+    {
+        sLog.outError("[AHMut] PROTOCOL FAULT: needed %u exceeds reserved %u for uuid " UI64FMTD,
+                      needed, pm.reservedAmount, res.uuid);
+        return true;
+    }
+    uint32 const remainder = pm.reservedAmount - needed;
+
+    if (isBuyoutWin && !AhPreflightTerminalItem(f, true))
+    {
+        sLog.outError("[AHMut] buyout terminal custody unavailable for "
+                      "auction %u; queued for retry", f.auctionId);
+        return false;
+    }
+
+    CustodyRow liveRow;
+    std::string priorKey;
+    if (f.priorBidderGuid != 0)
+    {
+        if (!AhFindPriorBidRow(f.auctionId, f.priorBidderGuid, f.priorBidAmount, pm.reserveKey, liveRow))
+        {
+            sLog.outError("[AHMut] PROTOCOL FAULT: prior live bid row mismatch for auction %u (uuid " UI64FMTD ")",
+                          f.auctionId, res.uuid);
+            return true;
+        }
+        priorKey = liveRow.idemKey;
+    }
+
+    CustodyDeferred def;
+
+    // 4.4: command-result FIRST (the S2 seam pushes it before UpdateBid).
+    {
+        uint32 const bidderGuidLow = pm.playerGuidLow;
+        uint32 const aucId = f.auctionId;
+        uint32 const newOutbid = AhOutbidFor(f.effectiveBid);
+        def.effects.push_back([bidderGuidLow, aucId, newOutbid]()
+        {
+            AhSendCommandResultTo(bidderGuidLow, aucId, AUCTION_BID_PLACED, AUCTION_OK, newOutbid);
+        });
+    }
+
+    CharacterDatabase.BeginTransaction();
+
+    if (sameBidderRaise)
+    {
+        // Merge the delta row into the live bid row. The delta gold was
+        // debited at reserve time -> NULL bidder = ledger-only, no 2nd debit.
+        CustodyService::TopUpBid(priorKey, f.effectiveBid, 0, NULL);
+        if (remainder > 0)
+        {
+            CustodyLedger::SetAmount(pm.reserveKey, needed);
+        }
+        CustodyService::CommitGoldLedgerOnly(pm.reserveKey);
+    }
+    else
+    {
+        if (f.priorBidderGuid != 0)
+        {
+            AhRefundPriorBidderFromFacts(f, priorKey, def);
+        }
+        if (remainder > 0)
+        {
+            CustodyLedger::SetAmount(pm.reserveKey, needed);
+        }
+        // Our (possibly shrunk) reserved row IS the live bid row: stays RESERVED.
+    }
+
+    AhCreditWalletInTxn(pm.playerGuidLow, remainder);   // I4: buyout remainder (0 on a bid)
+
+    if (isBuyoutWin)
+    {
+        // S4 replay MINUS the auction-row delete + AuctionsMap ops: the worker
+        // owns the book under WriteAuthority.
+        AhSellerPayoutFromFacts(f, def);
+        CustodyService::RollbackGoldLedgerOnly("dep:" + std::to_string(f.auctionId));
+        CustodyService::CommitGoldLedgerOnly(sameBidderRaise ? priorKey : pm.reserveKey);
+        AhItemToWinnerFromFacts(f, def);
+        CustodyService::CommitGoldLedgerOnly("item:" + std::to_string(f.auctionId));
+    }
+
+    // [SP-2 Task 15] finalize-fail crash seam: CommitCheckedOrForcedFail forces
+    // this checked commit to roll back and report false ONCE when
+    // AH.Service.CustodyFailCommitAt == "finalize-fail", exercising the
+    // redrive-without-rollback path below. Inert (a plain checked commit) on a
+    // live realm.
+    if (!CustodyService::CommitCheckedOrForcedFail("finalize-fail"))
+    {
+        if (remainder > 0)
+        {
+            Player* p = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, pm.playerGuidLow));
+            if (p)
+            {
+                p->ModifyMoney(-int32(remainder));   // X6: undo the in-memory credit
+            }
+        }
+        return false;   // -> redrive, never rollback (I10)
+    }
+#ifdef ENABLE_ELUNA
+    if (isBuyoutWin)
+    {
+        // [SP-2 spec 5.8] buyout win removed the listing -> Eluna OnRemove
+        // (fired while the escrow item is still cached, before def.run()).
+        AhElunaOnRemoveFromFacts(f);
+    }
+#endif
+    def.run();
+    return true;
+}
+
+// [SP-2] MUT_OK cancel (after CONFIRM; spec 4.2 step 3): S5 replay minus the
+// auction delete/map ops; 4.4 order = notifications and mails first,
+// command-result LAST.
+static bool AhFinalizeCancelOk(PlayerMutationResult const& res, PendingMutation const& pm)
+{
+    MutationFacts const& f = res.facts;
+
+    if (!AhPreflightTerminalItem(f, true))
+    {
+        sLog.outError("[AHMut] cancel terminal custody unavailable for auction "
+                      "%u; queued for retry",
+                      f.auctionId);
+        return false;
+    }
+
+    uint32 const cut = f.curBid ? AhCutFor(f.houseId, f.curBid) : 0;
+    if (cut)
+    {
+        CustodyRow cutRow;
+        if (pm.reserveKey.empty() || !CustodyLedger::Get(pm.reserveKey, cutRow) ||
+            cutRow.state != CST_RESERVED || cutRow.ownerGuid != pm.playerGuidLow ||
+            cutRow.amount != cut || cutRow.auctionId != f.auctionId)
+        {
+            sLog.outError("[AHMut] PROTOCOL FAULT: cancel cut reservation mismatch for uuid " UI64FMTD
+                          " (auction %u)", res.uuid, f.auctionId);
+            return true;
+        }
+    }
+    std::string bidKey;
+    if (f.curBid && f.curBidderGuid != 0)
+    {
+        CustodyRow liveRow;
+        if (!AhFindPriorBidRow(f.auctionId, f.curBidderGuid, f.curBid, pm.reserveKey, liveRow))
+        {
+            sLog.outError("[AHMut] PROTOCOL FAULT: cancel live bid row mismatch for auction %u (uuid " UI64FMTD ")",
+                          f.auctionId, res.uuid);
+            return true;
+        }
+        bidKey = liveRow.idemKey;
+    }
+
+    CustodyDeferred def;
+    CharacterDatabase.BeginTransaction();
+
+    if (!bidKey.empty())
+    {
+        AhRefundCancelledBidderFromFacts(f, bidKey, def);
+    }
+    CustodyService::CommitGoldLedgerOnly("dep:" + std::to_string(f.auctionId));   // forfeit (S5)
+    AhReturnItemToSellerFromFacts(f, uint32(AUCTION_CANCELED), def);
+    if (cut)
+    {
+        CustodyService::CommitGoldLedgerOnly(pm.reserveKey);                      // cut -> house sink
+    }
+    {
+        uint32 const sellerGuidLow = pm.playerGuidLow;
+        uint32 const aucId = f.auctionId;
+        def.effects.push_back([sellerGuidLow, aucId]()
+        {
+            AhSendCommandResultTo(sellerGuidLow, aucId, AUCTION_REMOVED, AUCTION_OK, 0);
+        });
+    }
+
+    if (!CharacterDatabase.CommitTransactionChecked())
+    {
+        return false;
+    }
+#ifdef ENABLE_ELUNA
+    // [SP-2 spec 5.8] cancel removed the listing -> Eluna OnRemove (fired while
+    // the escrow item is still cached, before def.run()).
+    AhElunaOnRemoveFromFacts(f);
+#endif
+    def.run();
+    return true;
+}
+
+static bool AhFinalizeOkDispatch(PlayerMutationResult const& res, PendingMutation const& pm)
+{
+    switch (res.op)
+    {
+        case uint8(IPC_PLAYER_SELL & 0xFFu):
+            return AhFinalizeSellOk(res, pm);
+        case uint8(IPC_PLAYER_BID & 0xFFu):
+        case uint8(IPC_PLAYER_BUYOUT & 0xFFu):
+            return AhFinalizeBidOk(res, pm);
+        case uint8(IPC_PLAYER_CANCEL & 0xFFu):
+        case uint8(IPC_PLAYER_CANCEL_CONFIRM & 0xFFu):
+            return AhFinalizeCancelOk(res, pm);
+        default:
+            sLog.outError("[AHMut] PROTOCOL FAULT: MUT_OK with unknown op 0x%02X (uuid " UI64FMTD ")",
+                          uint32(res.op), res.uuid);
+            return true;
+    }
+}
+
+// [SP-2] MUT_REJECTED (spec 4.1 step 4): silent wallet re-credit of the
+// reservation (I1: NO mail for the gold) + the legacy error result. For a
+// rejected SELL the escrowed item also leaves custody: returned by MAIL.
+static bool AhFinalizeRejected(PlayerMutationResult const& res, PendingMutation const& pm)
+{
+    MutationFacts const& f = res.facts;
+    Player* online = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, pm.playerGuidLow));
+    uint32 onlineCredit = 0;
+
+    CustodyRow sellDepRow;
+    CustodyRow sellItemRow;
+    Item* sellItem = NULL;
+    if (res.op == uint8(IPC_PLAYER_SELL & 0xFFu))
+    {
+        if (pm.depKey.empty() || !CustodyLedger::Get(pm.depKey, sellDepRow) ||
+            sellDepRow.kind != CUSTODY_GOLD ||
+            sellDepRow.role != ROLE_DEPOSIT ||
+            sellDepRow.state != CST_RESERVED ||
+            sellDepRow.ownerGuid != pm.playerGuidLow ||
+            sellDepRow.auctionId != pm.auctionId ||
+            !AhGetCachedReservedItem(pm.itemKey, pm.auctionId, pm.playerGuidLow,
+                                     0u, sellItemRow, sellItem))
+        {
+            sLog.outError("[AHMut] rejected sell %u custody unavailable; "
+                          "holding for retry",
+                          pm.auctionId);
+            return false;
+        }
+    }
+
+    CustodyDeferred def;
+    CharacterDatabase.BeginTransaction();
+
+    if (res.op == uint8(IPC_PLAYER_SELL & 0xFFu))
+    {
+        CustodyService::ReleaseGoldToWallet(def, pm.playerGuidLow, online,
+                                            sellDepRow.amount, pm.depKey);
+        if (online)
+        {
+            onlineCredit += sellDepRow.amount;
+        }
+
+        CustodyLedger::SetState(pm.itemKey, CST_TERMINAL_BACK,
+                                static_cast<uint64>(time(NULL)));
+        uint32 const savedItemGuidLow = sellItemRow.itemGuid;
+        def.effects.push_back([savedItemGuidLow]()
+        {
+            sAuctionMgr.RemoveAItem(savedItemGuidLow);
+        });
+        MailDraft ret(AhMailSubject(sellItem->GetEntry(),
+                                    sellItem->GetItemRandomPropertyId(),
+                                    AUCTION_CANCELED), "");
+        ret.AddItem(sellItem);
+        ret.SendMailToInTransaction(
+            MailReceiver(online,
+                         ObjectGuid(HIGHGUID_PLAYER, pm.playerGuidLow)),
+            MailSender(MAIL_AUCTION, uint32(f.houseId),
+                       MAIL_STATIONERY_AUCTION),
+            def.effects, MAIL_CHECK_MASK_COPIED);
+    }
+    else if (!pm.reserveKey.empty() && pm.reservedAmount > 0)
+    {
+        // bid / buyout (and, defensively, a post-CONFIRM cancel reject).
+        CustodyService::ReleaseGoldToWallet(
+            def, pm.playerGuidLow, online, pm.reservedAmount, pm.reserveKey);
+        if (online)
+        {
+            onlineCredit += pm.reservedAmount;
+        }
+    }
+
+    // Legacy error result, deferred so it fires only when the release landed.
+    {
+        uint8 const op = res.op;
+        uint8 const reason = res.reason;
+        uint32 const guidLow = pm.playerGuidLow;
+        uint32 const aucId = pm.auctionId;
+        MutationFacts const facts = f;
+        def.effects.push_back([op, reason, guidLow, aucId, facts]()
+        {
+            if (reason == uint8(AUCTION_ERR_HIGHER_BID))
+            {
+                AhSendHigherBidResultTo(guidLow, op, facts);
+            }
+            else if (reason != 0)
+            {
+                AhSendCommandResultTo(guidLow, aucId, AhActionForOp(op), AuctionError(reason), 0);
+            }
+            // reason == 0 -> silent (spec: legacy emits nothing).
+        });
+    }
+
+    if (!CharacterDatabase.CommitTransactionChecked())
+    {
+        if (onlineCredit > 0 && online)
+        {
+            online->ModifyMoney(-int32(onlineCredit));   // X6: undo the in-memory credit
+        }
+        return false;
+    }
+    def.run();
+    return true;
+}
+
+// [SP-2] MUT_REJECTED_STALE (spec 4.2 step 4): the cancel CONFIRM raced the
+// worker's unlock. Release the cut reservation (if one was made) and resolve
+// the tombstone. No SMSG: the auction is untouched (divergence 12.5).
+static bool AhFinalizeStale(PlayerMutationResult const& res, PendingMutation const& pm)
+{
+    if (pm.reserveKey.empty() || pm.reservedAmount == 0)
+    {
+        DETAIL_LOG("[AHMut] REJECTED_STALE for uuid " UI64FMTD " with no reservation", res.uuid);
+        return true;
+    }
+    Player* online = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, pm.playerGuidLow));
+    CustodyDeferred def;
+    CharacterDatabase.BeginTransaction();
+    CustodyService::ReleaseGoldToWallet(def, pm.playerGuidLow, online, pm.reservedAmount, pm.reserveKey);
+    if (!CharacterDatabase.CommitTransactionChecked())
+    {
+        if (online)
+        {
+            online->ModifyMoney(-int32(pm.reservedAmount));
+        }
+        return false;
+    }
+    def.run();
+    return true;
+}
+
+void AhNotifyMutationInDoubt(PendingMutation const& pm)
+{
+    // M2: the timed-out mutation reports the legacy DB error; the reservation
+    // stays non-terminal (decision 10 -- no unilateral rollback) and a late
+    // reply still applies through the tombstone.
+    AhSendCommandResultTo(pm.playerGuidLow, pm.auctionId,
+                          AhActionForOp(uint8(pm.op & 0xFFu)), AUCTION_ERR_DATABASE, 0);
+}
+
+void AhHandlePlayerMutationResult(PlayerMutationResult const& res)
+{
+    if (res.status == uint8(MUT_PREPARED))
+    {
+        AhHandleCancelPrepared(res);
+        return;
+    }
+
+    MutationPendingMap& pend = sAhService.GetMutationPending();
+    PendingMutation pm;
+    if (!pend.Take(res.uuid, pm))
+    {
+        // Late reply on a terminal/unknown row: loud protocol fault, never a
+        // silent drop or a double apply (decision 10).
+        sLog.outError("[AHMut] PROTOCOL FAULT: result status %u for unknown or already-consumed uuid " UI64FMTD,
+                      uint32(res.status), res.uuid);
+        return;
+    }
+
+    bool ok = true;
+    switch (res.status)
+    {
+        case uint8(MUT_OK):
+            ok = AhFinalizeOkDispatch(res, pm);
+            break;
+        case uint8(MUT_REJECTED):
+            ok = AhFinalizeRejected(res, pm);
+            break;
+        case uint8(MUT_REJECTED_STALE):
+            ok = AhFinalizeStale(res, pm);
+            break;
+        default:
+            sLog.outError("[AHMut] PROTOCOL FAULT: unknown status %u for uuid " UI64FMTD,
+                          uint32(res.status), res.uuid);
+            break;
+    }
+
+    if (!ok)
+    {
+        AhRedriveEntry e;
+        e.res = res;
+        e.pm = pm;
+        e.attempts = 1;
+        e.nextRetrySec = uint32(time(NULL)) + 5;
+        s_ahRedrive.push_back(e);
+        sLog.outError("[AHMut] finalize deferred for uuid " UI64FMTD
+                      "; queued for redrive",
+                      res.uuid);
+    }
+}
+
+// [SP-2] MUT_PREPARED -- the cancel phase-2 driver (spec 4.2 step 2 + [v3]).
+static void AhHandleCancelPrepared(PlayerMutationResult const& res)
+{
+    MutationPendingMap& pend = sAhService.GetMutationPending();
+    WorkerSupervisor* sv = sAhService.GetSupervisor();
+
+    PendingMutation pm;
+    if (!pend.Peek(res.uuid, pm))
+    {
+        sLog.outError("[AHMut] PROTOCOL FAULT: PREPARED for unknown uuid " UI64FMTD, res.uuid);
+        return;
+    }
+    if (pm.op != uint16(IPC_PLAYER_CANCEL))
+    {
+        sLog.outError("[AHMut] PROTOCOL FAULT: PREPARED for non-cancel op 0x%04X (uuid " UI64FMTD ")",
+                      uint32(pm.op), res.uuid);
+        return;
+    }
+
+    // A PREPARE reply landing after the tombstone -> mangosd answers ABORT
+    // (spec 4.2 [v3]); the slot resolves.
+    if (pm.state == uint8(PMUT_TOMBSTONE))
+    {
+        if (sv && sv->ServiceActive())
+        {
+            PlayerCancelDecide d;
+            d.uuid = res.uuid;
+            d.auctionId = pm.auctionId;
+            IpcMessage m;
+            m.op = IPC_PLAYER_CANCEL_ABORT;
+            d.Encode(m.body);
+            sv->Channel().SendFrame(m);
+        }
+        PendingMutation consumed;
+        pend.Take(res.uuid, consumed);
+        return;
+    }
+
+    // [FIX D] Duplicate-PREPARED guard: only a slot still in AWAIT_RESULT is
+    // awaiting its first PREPARE reply. A slot already advanced past it (CONFIRM
+    // sent -> AWAIT_CONFIRM) that receives a second PREPARE frame must be ignored:
+    // re-running the affordability gate would re-reserve the cut on an already-
+    // confirmed slot. (TOMBSTONE is handled above.)
+    if (pm.state != uint8(PMUT_AWAIT_RESULT))
+    {
+        sLog.outError("[AHMut] duplicate PREPARED for uuid " UI64FMTD " in state %u"
+                      " (not AWAIT_RESULT); ignoring", res.uuid, uint32(pm.state));
+        return;
+    }
+
+    MutationFacts const& f = res.facts;
+    uint32 const cut = f.curBid ? AhCutFor(f.houseId, f.curBid) : 0;
+    Player* pl = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, pm.playerGuidLow));
+
+    // Affordability gate (legacy silent return). A standing bid (curBid != 0)
+    // means a cut is owed on cancel: an OFFLINE seller cannot be debited -> ABORT
+    // (the auction is untouched; the seller can retry -- byte-parity: legacy
+    // emits nothing here). Gated on curBid, not the computed cut, so the offline
+    // -> ABORT decision is independent of whether DBC cut data is loaded (the -t
+    // harness has none; AhCutFor would return 0 and mask the gate).
+    bool abort = false;
+    if (f.curBid != 0)
+    {
+        if (!pl)
+        {
+            abort = true;
+        }
+        else if (pl->GetMoney() < cut)
+        {
+            abort = true;
+        }
+    }
+
+    if (!abort && cut)
+    {
+        // Durable cut reserve = its own checked commit (decision 9). The key
+        // is uuid-salted so a retry after a stale/aborted cancel of the same
+        // auction can never collide on uk_idem.
+        std::string const cutKey = "cut:" + std::to_string(pm.auctionId) + ":" + std::to_string(res.uuid);
+        CustodyDeferred def;
+        CharacterDatabase.BeginTransaction();
+        CustodyService::ReserveGold(def, pm.playerGuidLow, pl, cut, cutKey, pm.auctionId, ROLE_PROCEEDS);
+        if (!CharacterDatabase.CommitTransactionChecked())
+        {
+            if (pl)
+            {
+                pl->ModifyMoney(int32(cut));   // X6: undo the in-memory debit
+            }
+            sLog.outError("[AHMut] cancel cut reserve commit FAILED for uuid " UI64FMTD "; aborting cancel", res.uuid);
+            abort = true;
+        }
+        else
+        {
+            def.run();
+            pend.SetReserve(res.uuid, cut, cutKey);
+        }
+    }
+
+    PlayerCancelDecide d;
+    d.uuid = res.uuid;
+    d.auctionId = pm.auctionId;
+    IpcMessage m;
+    m.op = abort ? IPC_PLAYER_CANCEL_ABORT : IPC_PLAYER_CANCEL_CONFIRM;
+    d.Encode(m.body);
+    if (sv && sv->ServiceActive())
+    {
+        sv->Channel().SendFrame(m);
+    }
+
+    if (abort)
+    {
+        PendingMutation consumed;
+        pend.Take(res.uuid, consumed);       // legacy silent-return parity: no SMSG
+    }
+    else
+    {
+        pend.RearmConfirm(res.uuid, uint32(time(NULL)));
+    }
+}
+
+void AhProcessRedriveQueue(uint32 nowSec)
+{
+    // (1) Forward-only re-attempt of finalizes whose checked commit failed.
+    for (std::list<AhRedriveEntry>::iterator it = s_ahRedrive.begin(); it != s_ahRedrive.end();)
+    {
+        if (nowSec < it->nextRetrySec)
+        {
+            ++it;
+            continue;
+        }
+        bool ok = true;
+        switch (it->res.status)
+        {
+            case uint8(MUT_OK):
+                ok = AhFinalizeOkDispatch(it->res, it->pm);
+                break;
+            case uint8(MUT_REJECTED):
+                ok = AhFinalizeRejected(it->res, it->pm);
+                break;
+            case uint8(MUT_REJECTED_STALE):
+                ok = AhFinalizeStale(it->res, it->pm);
+                break;
+            default:
+                break;
+        }
+        if (ok)
+        {
+            it = s_ahRedrive.erase(it);
+        }
+        else
+        {
+            ++it->attempts;
+            it->nextRetrySec = nowSec + 5;
+            if (it->attempts % 12 == 0)
+            {
+                sLog.outError("[AHMut] redrive STUCK: uuid " UI64FMTD " still failing after %u attempts",
+                              it->res.uuid, it->attempts);
+            }
+            ++it;
+        }
+    }
+
+    // (2) Age un-answered player mutations into in-doubt tombstones and emit the
+    // one-time legacy AUCTION_ERR_DATABASE result for each (spec 4.1 step 5).
+    // Cheap no-op when the pending map is empty (the default-off case).
+    std::vector<uint64> newlyInDoubt;
+    MutationPendingMap& pend = sAhService.GetMutationPending();
+    pend.SweepToTombstones(nowSec, AH_MUTATION_INDOUBT_TTL_SEC, newlyInDoubt);
+    for (size_t i = 0; i < newlyInDoubt.size(); ++i)
+    {
+        PendingMutation pm;
+        if (pend.Peek(newlyInDoubt[i], pm))
+        {
+            AhNotifyMutationInDoubt(pm);
+        }
+    }
+}
+
+// ===========================================================================
+// SP-2 Task 12: worker-initiated resolutions (IPC_RESOLVE_APPLY) + reconcile.
+// ===========================================================================
+
+// [SP-2] the single live (CST_RESERVED ROLE_PROCEEDS CUSTODY_GOLD) cut
+// reservation for an auction. The cancel-CONFIRM path salts the cut idem key
+// with the CANCEL uuid ("cut:<auc>:<uuid>"), but a RESOLVE_CANCELLED_UNLOCK
+// arrives with its OWN (worker-minted) uuid, so the cut cannot be found by a
+// deterministic point key -- it is located by auction + role instead.
+// Returns the row's real idemKey for the release.
+static bool AhFindLiveCutRow(uint32 auctionId, CustodyRow& out)
+{
+    std::vector<CustodyRow> rows;
+    CustodyLedger::LoadNonTerminal(rows);
+    for (size_t i = 0; i < rows.size(); ++i)
+    {
+        if (rows[i].auctionId == auctionId && rows[i].kind == CUSTODY_GOLD &&
+            rows[i].role == ROLE_PROCEEDS && rows[i].state == CST_RESERVED)
+        {
+            out = rows[i];
+            return true;
+        }
+    }
+    return false;
+}
+
+// [SP-2] Apply one worker-initiated resolution (spec 4.3). ALL per-kind value
+// effects + the resolve:<uuid> applied-record commit in ONE checked txn, so
+// DUPLICATE == APPLIED and a commit failure keeps the worker's row RESOLVING
+// (RES_FAILED, never a book rollback -- decision 10). Reuses Task 11's
+// from-facts value helpers verbatim. An unknown kind is an unrecoverable
+// protocol fault -> AH_RESOLVE_NO_ACK (the pump sends no ack; never retried).
+uint8 AhHandleResolveApply(ResolveApply const& ra)
+{
+    // Idempotency: DUPLICATE == APPLIED (spec 4.3-C1). Answer before mutating.
+    if (CustodyService::ResolutionApplied(ra.uuid))
+    {
+        return uint8(RES_DUPLICATE);
+    }
+
+    MutationFacts const& f = ra.facts;
+    bool const repairRefundOnly =
+        (ra.kind == uint8(RESOLVE_REPAIR_RETURN) &&
+         f.curBidderGuid == 0u && f.priorBidderGuid != 0u);
+    bool const needsItem =
+        (ra.kind == uint8(RESOLVE_WON) ||
+         ra.kind == uint8(RESOLVE_EXPIRED_NOBID) ||
+         (ra.kind == uint8(RESOLVE_REPAIR_RETURN) && !repairRefundOnly));
+    if (needsItem && !AhPreflightTerminalItem(f, true))
+    {
+        sLog.outError("[AHMut] resolve kind %u auction %u invalid terminal "
+                      "item or deposit custody; RES_FAILED", uint32(ra.kind), f.auctionId);
+        return uint8(RES_FAILED);
+    }
+
+    CustodyDeferred def;
+    // [F1] A RESOLVE_CANCELLED_UNLOCK release credits an ONLINE owner's wallet
+    // immediately (in-memory ModifyMoney, non-transactional); only the ledger
+    // flip is in the checked txn. Capture that credit so a commit failure can
+    // undo it (X6) before RES_FAILED -- mirrors the five sibling finalize sites.
+    Player* releasedCutOnline = NULL;
+    uint32  releasedCutAmount = 0u;
+    CharacterDatabase.BeginTransaction();
+
+    switch (ra.kind)
+    {
+        case RESOLVE_WON:
+        {
+            // Consume the winning bid row + the seller deposit, pay the seller
+            // (profit = effectiveBid + deposit - cut), deliver the item, and flip
+            // the escrow item row terminal. curBidderGuid == 0 => bot win (the
+            // destroy branch lives inside AhItemToWinnerFromFacts). The explicit
+            // item-row flip mirrors the landed buyout-win path in AhFinalizeBidOk
+            // (AhItemToWinnerFromFacts does NOT touch "item:<id>" itself).
+            std::string const depKey  = "dep:" + std::to_string(f.auctionId);
+            std::string const itemKey = "item:" + std::to_string(f.auctionId);
+            CustodyRow bidRow;
+            bool const realWinner = (f.curBidderGuid != 0u);
+            bool const displacedPlayer =
+                (!realWinner && f.priorBidderGuid != 0u);
+            bool bidRowOk = false;
+            if (realWinner)
+            {
+                bidRowOk = AhFindPriorBidRow(f.auctionId, f.curBidderGuid,
+                                             f.curBid, "", bidRow);
+            }
+            else if (displacedPlayer)
+            {
+                bidRowOk = AhFindPriorBidRow(f.auctionId, f.priorBidderGuid,
+                                             f.priorBidAmount, "", bidRow);
+            }
+            else
+            {
+                std::unique_ptr<QueryResult> liveRows(CharacterDatabase.PQuery(
+                    "SELECT COUNT(*) FROM `custody_ledger` WHERE `auction_id`=%u "
+                    "AND `kind`=%u AND `role`=%u AND `state`=%u",
+                    f.auctionId, uint32(CUSTODY_GOLD), uint32(ROLE_BID), uint32(CST_RESERVED)));
+                bidRowOk = liveRows && liveRows->Fetch()[0].GetUInt64() == 0u;
+            }
+            if (!bidRowOk)
+            {
+                CharacterDatabase.RollbackTransaction();
+                sLog.outError("[AHMut] PROTOCOL FAULT: RESOLVE_WON bid custody"
+                              " mismatch for auction %u - RES_FAILED",
+                              f.auctionId);
+                return uint8(RES_FAILED);
+            }
+            if (realWinner)
+            {
+                CustodyService::CommitGoldLedgerOnly(bidRow.idemKey);
+            }
+            else if (displacedPlayer)
+            {
+                AhRefundPriorBidderFromFacts(f, bidRow.idemKey, def);
+            }
+            CustodyService::CommitGoldLedgerOnly(depKey);
+            AhSellerPayoutFromFacts(f, def);
+            AhItemToWinnerFromFacts(f, def);
+            CustodyService::CommitGoldLedgerOnly(itemKey);
+            break;
+        }
+        case RESOLVE_EXPIRED_NOBID:
+        {
+            // No-bid expiry: the deposit is FORFEIT (legacy: not returned) and
+            // the item goes back to the seller. AhReturnItemToSellerFromFacts
+            // flips "item:<id>" terminal internally (DeliverItem / ledger-only).
+            std::string const depKey = "dep:" + std::to_string(f.auctionId);
+            CustodyService::CommitGoldLedgerOnly(depKey);
+            AhReturnItemToSellerFromFacts(f, uint32(AUCTION_EXPIRED), def);
+            break;
+        }
+        case RESOLVE_CANCELLED_UNLOCK:
+        {
+            // Worker timed out a cancel PREPARE and unlocked the row: release any
+            // cut reservation we hold for this auction back to the seller. No
+            // item/bid movement -- the auction persists.
+            CustodyRow cutRow;
+            if (AhFindLiveCutRow(f.auctionId, cutRow))
+            {
+                // [F3] Release to the guid actually debited at reserve time (the
+                // reserved row's authoritative owner), NOT the worker-supplied
+                // seller facts -- used for both the release owner and the lookup.
+                Player* owner = sObjectMgr.GetPlayer(
+                    ObjectGuid(HIGHGUID_PLAYER, cutRow.ownerGuid));
+                CustodyService::ReleaseGoldToWallet(def, cutRow.ownerGuid, owner,
+                                                    cutRow.amount, cutRow.idemKey);
+                // [F1] An online owner was credited in-memory now; remember it so
+                // a checked-commit failure can undo the credit (offline owners are
+                // an in-txn UPDATE that rolls back on failure -- nothing to undo).
+                if (owner)
+                {
+                    releasedCutOnline = owner;
+                    releasedCutAmount = cutRow.amount;
+                }
+            }
+            break;
+        }
+        case RESOLVE_REPAIR_RETURN:
+        {
+            if (f.curBidderGuid == 0u && f.priorBidderGuid != 0u)
+            {
+                // A bot displaced a real player bidder: refund the prior bidder;
+                // the listing persists (non-terminal). The prior bid key is the
+                // single live bid row for this auction.
+                CustodyRow priorRow;
+                if (CustodyLedger::GetSingleLiveBidRow(f.auctionId, priorRow))
+                {
+                    AhRefundPriorBidderFromFacts(f, priorRow.idemKey, def);
+                }
+            }
+            else
+            {
+                // Item repair / no displaced player: deposit forfeit + item back.
+                std::string const depKey = "dep:" + std::to_string(f.auctionId);
+                CustodyService::CommitGoldLedgerOnly(depKey);
+                AhReturnItemToSellerFromFacts(f, uint32(AUCTION_EXPIRED), def);
+            }
+            break;
+        }
+        default:
+        {
+            CharacterDatabase.RollbackTransaction();
+            sLog.outError("[AHMut] AhHandleResolveApply unknown kind %u (auction %u)"
+                          " - protocol fault, no ack", uint32(ra.kind), f.auctionId);
+            return AH_RESOLVE_NO_ACK;
+        }
+    }
+
+    // The applied-record commits atomically with the value effects.
+    CustodyService::WriteResolutionApplied(f.auctionId, ra.uuid);
+
+    // [SP-2 Task 15] crash seam: the applied-record is queued but NOT yet
+    // committed. On restart the worker re-sends RESOLVE_APPLY and the
+    // ResolutionApplied guard above must answer DUPLICATE == APPLIED. Inert on a
+    // live realm.
+    CustodyService::MaybeCrash("resolving-pre-apply");
+
+    if (!CharacterDatabase.CommitTransactionChecked())
+    {
+        // Keep the worker's row RESOLVING: it re-sends on its cadence and we
+        // DUPLICATE-answer once it finally applies (spec 4.3; never roll the
+        // worker book back on a mangosd-side failure).
+        // [F1] Undo the online owner's in-memory cut credit (the ledger flip +
+        // any offline UPDATE already rolled back with the txn). Mirrors the X6
+        // sibling undo: ModifyMoney only, since the DB write was transactional.
+        if (releasedCutOnline && releasedCutAmount > 0u)
+        {
+            releasedCutOnline->ModifyMoney(-int32(releasedCutAmount));   // X6: undo the in-memory credit
+        }
+        sLog.outError("[AHMut] resolve kind %u (auction %u) commit failed - RES_FAILED",
+                      uint32(ra.kind), f.auctionId);
+        return uint8(RES_FAILED);
+    }
+#ifdef ENABLE_ELUNA
+    // [SP-2 spec 5.8] fire Eluna OnRemove for worker-initiated resolutions that
+    // terminally remove the listing from the book: won, no-bid expiry, and the
+    // repair item-return branch. Cancel-unlock and the repair bidder-refund
+    // sub-case keep the listing live, so they do not fire. Fired while the
+    // escrow item is still cached, before def.run().
+    if (ra.kind == RESOLVE_WON || ra.kind == RESOLVE_EXPIRED_NOBID ||
+        (ra.kind == RESOLVE_REPAIR_RETURN &&
+         !(f.curBidderGuid == 0u && f.priorBidderGuid != 0u)))
+    {
+        AhElunaOnRemoveFromFacts(f);
+    }
+#endif
+    def.run();
+    return uint8(RES_APPLIED);
+}
+
+// ---------------------------------------------------------------------------
+// Reconcile-on-reconnect (spec 8). The worker journal (ah_worker_journal) is a
+// Character-DB table shared with the worker; mangosd has no ServiceDatabase, so
+// it reads the table directly with its own connection. Journal states mirror
+// AhJournal::JournalState: COMMITTED=1, RESOLVING=2, APPLIED=3,
+// CANCEL_PREPARED=4, INTENT_PENDING=5.
+// ---------------------------------------------------------------------------
+
+static int AhHexNibble(char c)
+{
+    if (c >= '0' && c <= '9')
+    {
+        return c - '0';
+    }
+    if (c >= 'a' && c <= 'f')
+    {
+        return c - 'a' + 10;
+    }
+    if (c >= 'A' && c <= 'F')
+    {
+        return c - 'A' + 10;
+    }
+    return -1;
+}
+
+// One peeked ah_worker_journal row and its decoded worker result envelope.
+struct AhJournalPeek
+{
+    uint32 auctionId;
+    uint8 state;
+    uint8 kind;
+    PlayerMutationResult result;
+    bool payloadOk;
+};
+
+// [FIX C.2] Tri-state result of a journal peek. mangos `PQuery` returns NULL for
+// BOTH "no rows" and "query could not be executed" (table missing / transient DB
+// error), so a bare bool conflates a genuine row-absent (release the reservation)
+// with a query failure (must NOT release -- the worker may have committed).
+enum AhJournalRead
+{
+    AHJRN_FOUND        = 0,  ///< row present; @p out is populated
+    AHJRN_ABSENT       = 1,  ///< row genuinely absent (table present) -> release
+    AHJRN_QUERY_FAILED = 2   ///< table missing / DB error -> in-doubt, do NOT release
+};
+
+// Read one journal row by uuid directly from the shared Character DB. The
+// aggregate always returns one row after a successful query, so COUNT cleanly
+// distinguishes ABSENT from a NULL query result (DB error/table missing). The
+// worker stores a complete PlayerMutationResult as NUL-safe ASCII hex.
+static AhJournalRead AhReadWorkerJournal(uint64 uuid, AhJournalPeek& out)
+{
+    QueryResult* q = CharacterDatabase.PQuery(
+        "SELECT COUNT(*), COALESCE(MAX(`auction_id`),0), "
+        "COALESCE(MAX(`state`),0), COALESCE(MAX(`kind`),0), "
+        "COALESCE(MAX(`facts`),'') FROM `ah_worker_journal` "
+        "WHERE `uuid`=%llu",
+        static_cast<unsigned long long>(uuid));
+    if (q == NULL)
+    {
+        return AHJRN_QUERY_FAILED;
+    }
+    Field* fld = q->Fetch();
+    if (fld[0].GetUInt32() == 0u)
+    {
+        delete q;
+        return AHJRN_ABSENT;
+    }
+    out.auctionId = fld[1].GetUInt32();
+    out.state = static_cast<uint8>(fld[2].GetUInt32());
+    out.kind = static_cast<uint8>(fld[3].GetUInt32());
+    std::string const hex = fld[4].GetCppString();
+    delete q;
+
+    out.payloadOk = false;
+    if ((hex.size() % 2u) == 0u && !hex.empty())
+    {
+        std::string bin;
+        bin.reserve(hex.size() / 2u);
+        bool ok = true;
+        for (size_t i = 0; i + 1u < hex.size(); i += 2u)
+        {
+            int const hi = AhHexNibble(hex[i]);
+            int const lo = AhHexNibble(hex[i + 1u]);
+            if (hi < 0 || lo < 0)
+            {
+                ok = false;
+                break;
+            }
+            bin.push_back(static_cast<char>((hi << 4) | lo));
+        }
+        if (ok && bin.size() == PlayerMutationResult::WIRE_SIZE)
+        {
+            ByteBuffer bb;
+            bb.append(reinterpret_cast<uint8 const*>(bin.data()), bin.size());
+            PlayerMutationResult stored;
+            if (stored.Decode(bb) && bb.rpos() == bb.size() &&
+                stored.uuid == uuid && stored.op == out.kind &&
+                stored.facts.auctionId == out.auctionId)
+            {
+                out.result = stored;
+                out.payloadOk = true;
+            }
+        }
+    }
+    return AHJRN_FOUND;
+}
+
+// [SP-2] Release whatever reservations a pending player mutation still holds
+// back to the wallet (forward-only; the absent-journal case, spec 8). Mirrors
+// AhFinalizeRejected's release core, but keyed off the pending (no worker
+// facts). Accumulates the online in-memory credit into @p onlineCredit so the
+// caller can undo it if its checked commit fails (X6).
+static bool AhReleasePendingReservations(PendingMutation const& pm,
+                                         CustodyDeferred& def, uint32& onlineCredit)
+{
+    Player* online = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, pm.playerGuidLow));
+
+    if (!pm.depKey.empty())
+    {
+        CustodyRow depRow;
+        if (CustodyLedger::Get(pm.depKey, depRow) && depRow.state == CST_RESERVED)
+        {
+            CustodyService::ReleaseGoldToWallet(def, pm.playerGuidLow, online, depRow.amount, pm.depKey);
+            if (online)
+            {
+                onlineCredit += depRow.amount;
+            }
+        }
+    }
+    if (!pm.reserveKey.empty())
+    {
+        CustodyRow rsvRow;
+        if (CustodyLedger::Get(pm.reserveKey, rsvRow) && rsvRow.state == CST_RESERVED)
+        {
+            CustodyService::ReleaseGoldToWallet(def, pm.playerGuidLow, online, rsvRow.amount, pm.reserveKey);
+            if (online)
+            {
+                onlineCredit += rsvRow.amount;
+            }
+        }
+    }
+    if (!pm.itemKey.empty())
+    {
+        CustodyRow itemRow;
+        if (CustodyLedger::Get(pm.itemKey, itemRow) && itemRow.state == CST_RESERVED)
+        {
+            Item* pItem = sAuctionMgr.GetAItem(itemRow.itemGuid);
+            if (!pItem)
+            {
+                sLog.outError(
+                    "[AHMut] reconcile release: escrow item %u missing "
+                    "for uuid " UI64FMTD "; holding reservation",
+                    itemRow.itemGuid, pm.uuid);
+                return false;
+            }
+
+            CustodyLedger::SetState(pm.itemKey, CST_TERMINAL_BACK,
+                                    static_cast<uint64>(time(NULL)));
+            uint32 const savedItemGuidLow = itemRow.itemGuid;
+            def.effects.push_back([savedItemGuidLow]()
+            {
+                sAuctionMgr.RemoveAItem(savedItemGuidLow);
+            });
+            MailDraft ret(AhMailSubject(pItem->GetEntry(),
+                                        pItem->GetItemRandomPropertyId(),
+                                        AUCTION_CANCELED), "");
+            ret.AddItem(pItem);
+            ret.SendMailToInTransaction(
+                MailReceiver(online,
+                             ObjectGuid(HIGHGUID_PLAYER, pm.playerGuidLow)),
+                MailSender(MAIL_AUCTION, 0u, MAIL_STATIONERY_AUCTION),
+                def.effects, MAIL_CHECK_MASK_COPIED);
+        }
+    }
+    return true;
+}
+
+// [SP-2] Absent-journal (or anomalous-state) disposition: release the pending's
+// reservations, write the applied-record, and consume the slot. One checked txn.
+static bool AhReconcileReleaseAndConsume(PendingMutation const& pm)
+{
+    CustodyDeferred def;
+    uint32 onlineCredit = 0u;
+    CharacterDatabase.BeginTransaction();
+    if (!AhReleasePendingReservations(pm, def, onlineCredit))
+    {
+        CharacterDatabase.RollbackTransaction();
+        if (onlineCredit > 0u)
+        {
+            Player* p = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, pm.playerGuidLow));
+            if (p)
+            {
+                p->ModifyMoney(-int32(onlineCredit));
+            }
+        }
+        return false;
+    }
+    CustodyService::WriteResolutionApplied(pm.auctionId, pm.uuid);
+    if (CustodyService::CommitCheckedOrForcedFail("reconcile-release"))
+    {
+        def.run();
+        PendingMutation consumed;
+        sAhService.GetMutationPending().Take(pm.uuid, consumed);
+        return true;
+    }
+
+    if (onlineCredit > 0u)
+    {
+        Player* p = sObjectMgr.GetPlayer(
+            ObjectGuid(HIGHGUID_PLAYER, pm.playerGuidLow));
+        if (p)
+        {
+            // X6: undo the in-memory credit.
+            p->ModifyMoney(-int32(onlineCredit));
+        }
+    }
+    sLog.outError("[AHMut] reconcile release commit FAILED for uuid " UI64FMTD,
+                  pm.uuid);
+    return false;
+}
+
+enum AhReconnectDisposition
+{
+    AH_RECONNECT_COMPLETE,
+    AH_RECONNECT_RETRY,
+    AH_RECONNECT_HELD
+};
+
+static uint32 const AH_RECONNECT_RETRY_SEC = 5u;
+static std::map<uint64, uint32> s_ahReconnectRetries;
+
+// [SP-2] COMMITTED/APPLIED journal disposition: the worker committed the book
+// but the IPC_PLAYER_RESULT frame was lost. Re-drive the value finalize from
+// the journal facts. AhHandlePlayerMutationResult is fail-closed against the
+// custody ledger (a reserve row already flipped terminal by an earlier finalize
+// makes the cross-check refuse), so a partially/fully-applied finalize re-driven
+// here can never double-move value or double-mail; it also consumes the pending.
+static AhReconnectDisposition AhResolveForwardFromJournal(
+    PendingMutation const& pm, AhJournalPeek const& jp)
+{
+    // Cancel confirmation only updates the journal state: its stored envelope
+    // still describes PREPARED. APPLIED is ambiguous (it also records ABORT).
+    bool const committedCancel = jp.payloadOk && jp.state == 1u &&
+        pm.op == IPC_PLAYER_CANCEL && jp.result.status == uint8(MUT_PREPARED);
+    if (!jp.payloadOk || jp.auctionId != pm.auctionId ||
+        jp.result.op != uint8(pm.op & 0xFFu) ||
+        (jp.result.status != uint8(MUT_OK) && !committedCancel))
+    {
+        sLog.outError("[AHMut] reconcile uuid " UI64FMTD ": committed journal "
+                      "payload invalid; holding reservation in-doubt",
+                      pm.uuid);
+        sAhService.GetMutationPending().Tombstone(pm.uuid);
+        return AH_RECONNECT_HELD;
+    }
+    PlayerMutationResult result = jp.result;
+    if (committedCancel)
+    {
+        result.op = uint8(IPC_PLAYER_CANCEL_CONFIRM & 0xFFu);
+        result.status = uint8(MUT_OK);
+    }
+    // Takes the pending and applies the fail-closed finalize.
+    AhHandlePlayerMutationResult(result);
+    return AH_RECONNECT_COMPLETE;
+}
+
+// [SP-2] CANCEL_PREPARED journal disposition (spec 8): a cancel PREPARE lock we
+// hold with no CONFIRM -> release any cut reservation + tell the worker to ABORT
+// (unlock the book row), then consume the slot. Mirrors AhFinalizeStale + the
+// AhHandleCancelPrepared abort frame.
+static bool AhAbortAndRelease(PendingMutation const& pm)
+{
+    if (!pm.reserveKey.empty())
+    {
+        CustodyRow cutRow;
+        if (CustodyLedger::Get(pm.reserveKey, cutRow) && cutRow.state == CST_RESERVED)
+        {
+            Player* online = sObjectMgr.GetPlayer(ObjectGuid(HIGHGUID_PLAYER, pm.playerGuidLow));
+            CustodyDeferred def;
+            CharacterDatabase.BeginTransaction();
+            CustodyService::ReleaseGoldToWallet(def, pm.playerGuidLow, online, cutRow.amount, pm.reserveKey);
+            if (CustodyService::CommitCheckedOrForcedFail(
+                    "reconcile-abort-release"))
+            {
+                def.run();
+            }
+            else
+            {
+                if (online)
+                {
+                    online->ModifyMoney(-int32(cutRow.amount));   // X6: undo in-memory credit
+                }
+                sLog.outError("[AHMut] reconcile cut release commit FAILED for uuid " UI64FMTD, pm.uuid);
+                return false;
+            }
+        }
+    }
+
+    WorkerSupervisor* const sv = sAhService.GetSupervisor();
+    if (sv != NULL && sv->ServiceActive())
+    {
+        PlayerCancelDecide d;
+        d.uuid      = pm.uuid;
+        d.auctionId = pm.auctionId;
+        IpcMessage m;
+        m.op = IPC_PLAYER_CANCEL_ABORT;
+        d.Encode(m.body);
+        sv->Channel().SendFrame(m);
+    }
+
+    PendingMutation consumed;
+    sAhService.GetMutationPending().Take(pm.uuid, consumed);
+    return true;
+}
+
+static AhReconnectDisposition AhReconcilePending(
+    PendingMutation const& pm)
+{
+    MutationPendingMap& pend = sAhService.GetMutationPending();
+    AhJournalPeek jp;
+    AhJournalRead const rd = AhReadWorkerJournal(pm.uuid, jp);
+
+    if (rd == AHJRN_QUERY_FAILED)
+    {
+        sLog.outError("[AHMut] reconcile uuid " UI64FMTD ": journal peek "
+                      "FAILED (table missing / DB error); holding reservation "
+                      "in-doubt",
+                      pm.uuid);
+        pend.Tombstone(pm.uuid);
+        return AH_RECONNECT_RETRY;
+    }
+
+    if (rd == AHJRN_FOUND)
+    {
+        // COMMITTED(1) / APPLIED(3): the worker committed the book.
+        if (jp.state == 1u || jp.state == 3u)
+        {
+            return AhResolveForwardFromJournal(pm, jp);
+        }
+
+        // CANCEL_PREPARED(4): abort the lock after releasing any cut.
+        if (jp.state == 4u)
+        {
+            if (!jp.payloadOk || jp.auctionId != pm.auctionId ||
+                jp.result.op != uint8(pm.op & 0xFFu) ||
+                jp.result.status != uint8(MUT_PREPARED))
+            {
+                sLog.outError(
+                    "[AHMut] reconcile uuid " UI64FMTD ": cancel-prepared "
+                    "journal payload invalid; holding in-doubt",
+                    pm.uuid);
+                pend.Tombstone(pm.uuid);
+                return AH_RECONNECT_HELD;
+            }
+            return AhAbortAndRelease(pm) ? AH_RECONNECT_COMPLETE
+                                         : AH_RECONNECT_RETRY;
+        }
+
+        // Any other present state for a mangosd pending is anomalous. The
+        // mangosd and worker UUID spaces are disjoint, so release safely.
+        sLog.outError("[AHMut] reconcile uuid " UI64FMTD ": unexpected journal "
+                      "state %u; releasing reservation",
+                      pm.uuid, uint32(jp.state));
+    }
+
+    // A genuinely absent row means the worker never committed this mutation.
+    return AhReconcileReleaseAndConsume(pm) ? AH_RECONNECT_COMPLETE
+                                             : AH_RECONNECT_RETRY;
+}
+
+// [SP-2] Walk every in-flight pending against the shared worker journal on the
+// service-just-became-active edge (spec 8). Failed local/query dispositions are
+// queued for the steady-state retry tick; malformed durable payloads remain
+// held for operator repair.
+void AhReconcileOnReconnect()
+{
+    MutationPendingMap& pend = sAhService.GetMutationPending();
+    std::vector<PendingMutation> inflight;
+    pend.SnapshotInflight(inflight);
+    if (inflight.empty())
+    {
+        return;
+    }
+    sLog.outString("[AHMut] reconcile-on-reconnect: %u in-flight pending mutation(s)",
+                   uint32(inflight.size()));
+
+    for (size_t i = 0; i < inflight.size(); ++i)
+    {
+        PendingMutation const& pm = inflight[i];
+        AhReconnectDisposition const disposition = AhReconcilePending(pm);
+        if (disposition == AH_RECONNECT_RETRY)
+        {
+            s_ahReconnectRetries[pm.uuid] =
+                uint32(time(NULL)) + AH_RECONNECT_RETRY_SEC;
+        }
+        else
+        {
+            s_ahReconnectRetries.erase(pm.uuid);
+        }
+    }
+}
+
+void AhProcessReconnectRetryQueue(uint32 nowSec)
+{
+    MutationPendingMap& pend = sAhService.GetMutationPending();
+    std::map<uint64, uint32>::iterator itr = s_ahReconnectRetries.begin();
+    while (itr != s_ahReconnectRetries.end())
+    {
+        if (itr->second > nowSec)
+        {
+            ++itr;
+            continue;
+        }
+
+        std::map<uint64, uint32>::iterator current = itr++;
+        PendingMutation pm;
+        if (!pend.Peek(current->first, pm))
+        {
+            s_ahReconnectRetries.erase(current);
+            continue;
+        }
+
+        AhReconnectDisposition const disposition = AhReconcilePending(pm);
+        if (disposition == AH_RECONNECT_RETRY)
+        {
+            current->second = nowSec + AH_RECONNECT_RETRY_SEC;
+        }
+        else
+        {
+            s_ahReconnectRetries.erase(current);
+        }
+    }
+}
diff --git a/src/modules/AhService/world/AhServiceHandlers.h b/src/modules/AhService/world/AhServiceHandlers.h
new file mode 100644
index 0000000000..5ca55e4b4a
--- /dev/null
+++ b/src/modules/AhService/world/AhServiceHandlers.h
@@ -0,0 +1,50 @@
+/**
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * MaNGOS is a full featured server for World of Warcraft, supporting
+ * the following clients: 1.12.x, 2.4.3, 3.3.5a, 4.3.4a and 5.4.8
+ *
+ * Copyright (C) 2005-2026 MaNGOS <https://www.getmangos.eu>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * World of Warcraft, and all World of Warcraft or Warcraft art, images,
+ * and lore are copyrighted by Blizzard Entertainment, Inc.
+ */
+
+#ifndef MANGOS_H_AHSERVICE_HANDLERS
+#define MANGOS_H_AHSERVICE_HANDLERS
+
+#include "AuctionHouseModule.h"
+
+class AuctionHouseObject;
+class WorldSession;
+struct AuctionEntry;
+
+/// The center flash and red chat line of an unavailable auction house.
+void AhSendUnavailableMessage(WorldSession* session);
+/// An empty list of @p kind (a BrowseKind) plus the unavailable message.
+void AhSendBrowseUnavailable(WorldSession* session, uint8 kind);
+
+// The AuctionHouseModule request hooks of the service.
+bool AhBlocksHello(WorldSession& session);
+bool AhForwardSell(WorldSession& session, AuctionSale const& sale);
+bool AhSettleSell(WorldSession& session, AuctionSale const& sale, AuctionEntry*& listed);
+bool AhForwardBid(WorldSession& session, uint32 auctionId, uint32 price);
+bool AhSettleBid(WorldSession& session, AuctionEntry& auction, uint32 price, uint32 newOutbid);
+bool AhForwardCancel(WorldSession& session, uint32 auctionId);
+bool AhSettleCancel(WorldSession& session, AuctionHouseObject& house, AuctionEntry& auction);
+bool AhForwardList(WorldSession& session, AuctionListRequest const& request);
+
+#endif
diff --git a/src/modules/AhService/world/AhServiceModule.cpp b/src/modules/AhService/world/AhServiceModule.cpp
new file mode 100644
index 0000000000..75dae8bcea
--- /dev/null
+++ b/src/modules/AhService/world/AhServiceModule.cpp
@@ -0,0 +1,188 @@
+/**
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * MaNGOS is a full featured server for World of Warcraft, supporting
+ * the following clients: 1.12.x, 2.4.3, 3.3.5a, 4.3.4a and 5.4.8
+ *
+ * Copyright (C) 2005-2026 MaNGOS <https://www.getmangos.eu>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * World of Warcraft, and all World of Warcraft or Warcraft art, images,
+ * and lore are copyrighted by Blizzard Entertainment, Inc.
+ */
+
+/**
+ * @file AhServiceModule.cpp
+ * @brief The out-of-process auction house service as an auction module.
+ */
+
+#include "AhService.h"
+#include "AhServiceBook.h"
+#include "AhServiceCommands.h"
+#include "AhServiceHandlers.h"
+#include "AhServiceWorld.h"
+#include "AuctionHouseBot.h"
+#include "AuctionHouseModule.h"
+#include "BrowsePending.h"
+#include "CustodyLedger.h"
+#include "Database/DatabaseEnv.h"
+#include "Log.h"
+#include "Timer.h"
+#include "WorkerSupervisor.h"
+
+namespace
+{
+    uint32 const MAINTENANCE_INTERVAL = 20 * IN_MILLISECONDS;
+
+    class AhServiceModule : public AuctionHouseModule
+    {
+        public:
+
+            AhServiceModule()
+            {
+                m_maintenanceTimer.SetInterval(MAINTENANCE_INTERVAL);
+            }
+
+            char const* Name() const override { return "AH service"; }
+
+            void LoadConfig(bool reload) override
+            {
+                if (reload)
+                {
+                    sAhService.LoadConfig(true);
+                }
+            }
+
+            void Start() override
+            {
+                CustodyLedger::InitializeRouting();
+                AhEnsureRecipeCastMap();
+                AhAuditCustodyReconcile("boot");
+
+                if (sAhService.IsWorkerConfigured())
+                {
+                    StartWorker();
+                }
+            }
+
+            void Update(uint32 diff) override
+            {
+                m_maintenanceTimer.Update(diff);
+                if (m_maintenanceTimer.Passed())
+                {
+                    m_maintenanceTimer.Reset();
+                    AhServiceMaintenance();
+                }
+                AhServiceTick();
+            }
+
+            void Stop() override
+            {
+                WorkerSupervisor* supervisor = sAhService.GetSupervisor();
+                if (!supervisor)
+                {
+                    return;
+                }
+
+                sAhService.SetSupervisor(NULL);
+                supervisor->Shutdown();
+                delete supervisor;
+            }
+
+            ChatCommand* Commands() override { return AhServiceCommands(); }
+
+            uint32 HighestAuctionId() const override
+            {
+                // Terminal custody rows outlive their auction until pruned; a
+                // reused id would collide their "item:<id>"/"dep:<id>" keys.
+                uint32 highest = 0;
+                if (QueryResult* result = CharacterDatabase.Query("SELECT MAX(`auction_id`) FROM `custody_ledger`"))
+                {
+                    highest = (*result)[0].GetUInt32();
+                    delete result;
+                }
+                return highest;
+            }
+
+            bool OwnsAuctionRows() const override { return sAhService.IsWriteAuthority(); }
+            bool TakesOverListings() const override { return sAhService.IsWorkerActive(); }
+
+            bool BlocksHello(WorldSession& session) override { return AhBlocksHello(session); }
+            bool ForwardSell(WorldSession& session, AuctionSale const& sale) override { return AhForwardSell(session, sale); }
+            bool SettleSell(WorldSession& session, AuctionSale const& sale, AuctionEntry*& listed) override { return AhSettleSell(session, sale, listed); }
+            bool ForwardBid(WorldSession& session, uint32 auctionId, uint32 price) override { return AhForwardBid(session, auctionId, price); }
+            bool SettleBid(WorldSession& session, AuctionHouseObject& /*house*/, AuctionEntry& auction, uint32 price, uint32 newOutbid) override
+            {
+                return AhSettleBid(session, auction, price, newOutbid);
+            }
+            bool ForwardCancel(WorldSession& session, uint32 auctionId) override { return AhForwardCancel(session, auctionId); }
+            bool SettleCancel(WorldSession& session, AuctionHouseObject& house, AuctionEntry& auction) override
+            {
+                return AhSettleCancel(session, house, auction);
+            }
+            bool ForwardList(WorldSession& session, AuctionListRequest const& request) override { return AhForwardList(session, request); }
+
+            AuctionExpiry Expire(AuctionHouseObject& /*house*/, AuctionEntry& auction) override { return AhExpireAuction(auction); }
+
+            bool SettleGeneratedBid(AuctionEntry& auction, uint32 price, bool& stillActive) override
+            {
+                bool applied = false;
+                return AhSettleGeneratedBid(auction, price, stillActive, applied);
+            }
+
+        private:
+
+            void StartWorker()
+            {
+                // The worker places its listings as the bot's character.
+                if (!sAuctionBotConfig.GetAHBotId())
+                {
+                    sAuctionBotConfig.Initialize();
+                }
+
+                AhServiceSettings const& settings = sAhService.Settings();
+                WorkerSupervisor* supervisor = new WorkerSupervisor("ah-service", settings.path, settings.port,
+                    settings.secret, sAuctionBotConfig.GetAHBotId(), sAhService.ConfigPath());
+
+                // IPC_HELLO_ACK carries the write authority to the worker on every respawn.
+                supervisor->SetWriteAuthority(sAhService.IsWriteAuthority());
+
+                if (!supervisor->Start())
+                {
+                    sLog.outError("AH service failed to start; the auction house reports itself unavailable");
+                    delete supervisor;
+                    return;
+                }
+
+                sAhService.SetSupervisor(supervisor);
+            }
+
+            IntervalTimer m_maintenanceTimer;
+    };
+
+    AuctionHouseModule* CreateAhServiceModule()
+    {
+        if (!sAhService.LoadConfig(false) || !sAhService.Settings().enable)
+        {
+            return NULL;
+        }
+        return new AhServiceModule;
+    }
+
+    struct Registrar
+    {
+        Registrar() { AuctionHouseModules::Provide(&CreateAhServiceModule); }
+    } const registrar;
+}
diff --git a/src/modules/AhService/world/AhServiceWorld.cpp b/src/modules/AhService/world/AhServiceWorld.cpp
new file mode 100644
index 0000000000..b3d9e4fc94
--- /dev/null
+++ b/src/modules/AhService/world/AhServiceWorld.cpp
@@ -0,0 +1,497 @@
+/**
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * MaNGOS is a full featured server for World of Warcraft, supporting
+ * the following clients: 1.12.x, 2.4.3, 3.3.5a, 4.3.4a and 5.4.8
+ *
+ * Copyright (C) 2005-2026 MaNGOS <https://www.getmangos.eu>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * World of Warcraft, and all World of Warcraft or Warcraft art, images,
+ * and lore are copyrighted by Blizzard Entertainment, Inc.
+ */
+
+/**
+ * @file AhServiceWorld.cpp
+ * @brief The service's share of the world tick: the supervisor, the frames
+ *        the worker sends, and the custody upkeep.
+ */
+
+#include "AhServiceWorld.h"
+#include "AhService.h"
+#include "AhServiceHandlers.h"
+#include "AuctionIntentExecutor.h"
+#include "AuctionIntents.h"
+#include "BrowseMessages.h"
+#include "BrowsePending.h"
+#include "CustodyLedger.h"
+#include "CustodyService.h"
+#include "IpcMessage.h"
+#include "IpcOpcodes.h"
+#include "MutationPending.h"
+#include "PlayerMutations.h"
+#include "WorkerSupervisor.h"
+
+#include "Log.h"
+#include "ObjectGuid.h"
+#include "Opcodes.h"
+#include "Player.h"
+#include "PlayerRegistry.h"
+#include "World.h"
+#include "WorldPacket.h"
+#include "WorldSession.h"
+
+#include <ctime>
+#include <vector>
+#ifdef ENABLE_ELUNA
+#include "LuaEngine.h"
+#endif /* ENABLE_ELUNA */
+
+// ---------------------------------------------------------------------------
+// AhHandleInbound -- M1 stub; routes consumer frames in M2
+// ---------------------------------------------------------------------------
+
+/**
+ * @brief Dispatch one inbound frame from the ah-service child process.
+ *
+ * M1: logs what arrived so the smoke test can confirm the drain pipeline
+ * is live. M2 will add IPC_AH_* intent routing here; keep the switch
+ * extensible.
+ */
+void AhHandleInbound(const IpcMessage& msg)
+{
+    switch (msg.op)
+    {
+        case IPC_ECHO_REPLY:
+        {
+            DETAIL_LOG("[AHSupervisor] IPC_ECHO_REPLY received"
+                       " (body=%u bytes)", static_cast<unsigned>(msg.body.size()));
+            break;
+        }
+        case IPC_HEARTBEAT_ACK:
+        {
+            // Should have been consumed by WorkerSupervisor::Tick(); log if
+            // it somehow leaks through.
+            DETAIL_LOG("[AHSupervisor] HandleAhInbound: unexpected"
+                       " IPC_HEARTBEAT_ACK");
+            break;
+        }
+        case IPC_INTENT_SELL:
+        case IPC_INTENT_BID:
+        case IPC_INTENT_BUYOUT:
+        {
+            // Authority side: re-validate against live state and apply
+            // idempotently. The executor populates `result` with an
+            // IPC_INTENT_RESULT frame to return to the child (or leaves it
+            // empty -- op 0 -- for a malformed body, which we must not send).
+            IpcMessage result;
+            sAuctionIntentExecutor.Apply(msg, result);
+            // PF3-A: acquire-load the published supervisor pointer (see
+            // SetAhSupervisor()) before dereferencing it.
+            WorkerSupervisor* const ahSupervisor = sAhService.GetSupervisor();
+            if (ahSupervisor != NULL && result.op != IpcOpcode(0))
+            {
+                ahSupervisor->Channel().SendFrame(result);
+            }
+            break;
+        }
+        case IPC_INTENT_RESULT:
+        {
+            // mangosd -> child direction; should never be received here.
+            sLog.outError("[AHSupervisor] HandleAhInbound: unexpected"
+                          " IPC_INTENT_RESULT (ignored)");
+            break;
+        }
+        case IPC_GMCMD_RESULT:
+        {
+            ByteBuffer body(msg.body);
+            GmCmdResult res;
+            if (res.Decode(body))
+            {
+                sLog.outString("[AHService] GM command %u result: %s",
+                               static_cast<unsigned>(res.cmd),
+                               res.ok ? "OK" : "FAIL");
+            }
+            else
+            {
+                sLog.outError("[AHSupervisor] HandleAhInbound:"
+                              " IPC_GMCMD_RESULT decode failed");
+            }
+            break;
+        }
+        case IPC_GMCMD:
+        {
+            // mangosd -> child direction; should never be received inbound.
+            sLog.outError("[AHSupervisor] HandleAhInbound: unexpected"
+                          " IPC_GMCMD inbound (ignored)");
+            break;
+        }
+        case IPC_BROWSE_RESULT:
+        {
+            ByteBuffer body(msg.body);
+            BrowseResult res;
+            if (!res.Decode(body))
+            {
+                sLog.outError("[AHSupervisor] IPC_BROWSE_RESULT decode failed");
+                break;
+            }
+            PendingBrowse pb;
+            if (!sAhService.GetBrowsePending().Take(res.queryId, pb))
+            {
+                DETAIL_LOG("[AHSupervisor] IPC_BROWSE_RESULT unknown queryId %llu",
+                           (unsigned long long)res.queryId);
+                break;
+            }
+            // I4: ignore a reply for a search the player has since superseded.
+            if (!sAhService.GetBrowsePending().IsCurrent(pb.playerGuidLow, pb.kind, pb.seq))
+            {
+                break;
+            }
+            Player* player = sPlayerRegistry.Find(
+                ObjectGuid(HIGHGUID_PLAYER, pb.playerGuidLow));
+            if (!player || !player->IsInWorld())
+            {
+                break;   // logged out / different char (I4) -> drop cleanly
+            }
+            WorldSession* session = player->GetSession();
+            if (!session)
+            {
+                break;
+            }
+
+            // tooMany: the worker declined (queue saturated / oversize failsafe /
+            // over-cap deferred-Eluna). Coordinator model: no in-process fallback
+            // -> the player gets "AH unavailable".
+            if (res.tooMany)
+            {
+                AhSendBrowseUnavailable(session, pb.kind);
+                break;
+            }
+
+            std::vector<BrowseEntry> finalEntries;
+            uint32 totalcount = res.totalcount;
+
+            if (res.elunaPending && pb.kind != uint8(BROWSE_BIDDER))
+            {
+                // Deferred-Eluna pass (D5/V2): run ONLY the OnCanUseItem veto per
+                // entry via the thin Player::CanUseItemEluna accessor. The worker
+                // already enforced every non-Eluna sub-filter on the same profile.
+                // Run the hook over EVERY entry -- NO per-tick budget that keeps
+                // unchecked entries (V2: that broke parity by counting/showing
+                // Lua-vetoed items).
+                std::vector<BrowseEntry> survivors;
+                survivors.reserve(res.entries.size());
+                for (size_t i = 0; i < res.entries.size(); ++i)
+                {
+                    if (AhScriptedItemUse(player, res.entries[i].itemEntry) != EQUIP_ERR_OK)
+                    {
+                        continue;   // Lua veto -> drop (exact parity)
+                    }
+                    survivors.push_back(res.entries[i]);
+                }
+                // The worker shipped the FULL surviving set un-paginated (the >cap
+                // deferred-Eluna case is declined with tooMany, above). Run the Lua
+                // veto over all survivors, then paginate here for exact in-process
+                // parity.
+                totalcount = uint32(survivors.size());
+                uint32 from = pb.listfrom;
+                for (uint32 i = from; i < survivors.size() && finalEntries.size() < 50u; ++i)
+                {
+                    finalEntries.push_back(survivors[i]);
+                }
+            }
+            else
+            {
+                finalEntries = res.entries;   // worker already paginated
+            }
+
+            uint16 opcode = SMSG_AUCTION_LIST_RESULT;
+            if (pb.kind == uint8(BROWSE_OWNER))
+            {
+                opcode = SMSG_AUCTION_OWNER_LIST_RESULT;
+            }
+            else if (pb.kind == uint8(BROWSE_BIDDER))
+            {
+                opcode = SMSG_AUCTION_BIDDER_LIST_RESULT;
+            }
+
+            WorldPacket data(opcode, 4 + 4 + finalEntries.size() * 60);
+            ByteBuffer assembled;
+            AhAssembleBrowseListBody(finalEntries, totalcount, assembled);
+            data.append(assembled.contents(), assembled.size());
+            session->SendPacket(&data);
+            break;
+        }
+        case IPC_PLAYER_RESULT:
+        {
+            // SP-2 write-authority: worker mutation outcome + book facts.
+            // AhHandlePlayerMutationResult applies value only, fail-closed
+            // against the custody ledger. (IPC_RESOLVE_APPLY gets its own case
+            // in Task 12.)
+            ByteBuffer body(msg.body);
+            PlayerMutationResult res;
+            if (!res.Decode(body))
+            {
+                sLog.outError("[AHSupervisor] IPC_PLAYER_RESULT decode failed");
+                break;
+            }
+            AhHandlePlayerMutationResult(res);
+            break;
+        }
+        case IPC_RESOLVE_APPLY:
+        {
+            // SP-2 write-authority: worker-initiated resolution (WON / EXPIRED /
+            // CANCELLED_UNLOCK / REPAIR_RETURN). AhHandleResolveApply applies the
+            // per-kind value effects inside ONE checked txn with the
+            // resolve:<uuid> applied-record (DUPLICATE == APPLIED). An
+            // AH_RESOLVE_NO_ACK return is an unrecoverable protocol fault:
+            // already alarmed, NO ack is sent (the worker never retries it).
+            ByteBuffer body(msg.body);
+            ResolveApply ra;
+            if (!ra.Decode(body))
+            {
+                sLog.outError("[AHSupervisor] IPC_RESOLVE_APPLY decode failed");
+                break;
+            }
+            uint8 const st = AhHandleResolveApply(ra);
+            if (st == AH_RESOLVE_NO_ACK)
+            {
+                break;
+            }
+            WorkerSupervisor* const sv = sAhService.GetSupervisor();
+            if (sv != NULL)
+            {
+                ResolveAck ack;
+                ack.uuid   = ra.uuid;
+                ack.status = st;
+                IpcMessage reply;
+                reply.op = IPC_RESOLVE_ACK;
+                ack.Encode(reply.body);
+                sv->Channel().SendFrame(reply);
+            }
+            break;
+        }
+        default:
+        {
+            DETAIL_LOG("[AHSupervisor] HandleAhInbound: opcode 0x%04X"
+                       " (body=%u bytes) -- unhandled",
+                       static_cast<unsigned>(msg.op),
+                       static_cast<unsigned>(msg.body.size()));
+            break;
+        }
+    }
+}
+
+
+InventoryResult AhScriptedItemUse(Player* player, uint32 itemEntry)
+{
+#ifdef ENABLE_ELUNA
+    if (Eluna* e = player->GetEluna())
+    {
+        return e->OnCanUseItem(player, itemEntry);
+    }
+#else
+    (void)player;
+    (void)itemEntry;
+#endif
+    return EQUIP_ERR_OK;
+}
+
+void AhServiceMaintenance()
+{
+    // Announce each change of the worker's health. On the edge to active,
+    // reconcile every in-flight player-mutation reservation against the shared
+    // worker journal (committed => finalize-forward, absent => release,
+    // cancel-prepared => abort + release).
+    static bool s_prevServiceActive = false;
+    bool const serviceActive = sAhService.IsWorkerActive();
+    if (serviceActive != s_prevServiceActive)
+    {
+        if (serviceActive)
+        {
+            sLog.outString("[AHSupervisor] AH service active");
+            AhReconcileOnReconnect();
+        }
+        else
+        {
+            sLog.outString("[AHSupervisor] AH service inactive");
+        }
+        s_prevServiceActive = serviceActive;
+    }
+
+    // Custody drift audit + terminal-row TTL prune. Orphan materialization
+    // recovery has a separate adaptive timer so outage backlogs drain in
+    // bounded batches without repeating the full reconciliation scan.
+    static uint64 s_nextCustodyReconcileTime = 0;
+    static uint64 s_nextOrphanSweepTime = 0;
+    uint64 const now = static_cast<uint64>(sWorld.GetGameTime());
+    uint64 const custodyTerminalRetention = 30 * DAY;
+    uint32 const orphanSweepBatchSize = 100u;
+    CustodyMaintenancePlan const plan =
+        CustodyService::GetMaintenancePlan(sAhService.IsCustodyEnabled(),
+                                           sAhService.IsWriteAuthority());
+    if (!s_nextCustodyReconcileTime)
+    {
+        s_nextCustodyReconcileTime = now + HOUR;
+    }
+    else if (now >= s_nextCustodyReconcileTime)
+    {
+        if (plan.reconcile)
+        {
+            CustodyReconcileReport report;
+            CustodyService::ReconcileScan(now, CUSTODY_SCAN_RUNTIME, report);
+            CustodyService::LogReconcileReport("hourly", report);
+        }
+
+        if (plan.prune && now > custodyTerminalRetention)
+        {
+            CustodyLedger::DeleteTerminalOlderThan(now - custodyTerminalRetention);
+        }
+
+        s_nextCustodyReconcileTime = now + HOUR;
+    }
+
+    if (!s_nextOrphanSweepTime)
+    {
+        s_nextOrphanSweepTime = now + MINUTE;
+    }
+    else if (now >= s_nextOrphanSweepTime)
+    {
+        // Only WriteAuthority materializes bot listings through this path. A
+        // full batch (or failed commit) retries in one minute; a drained queue
+        // returns to a cheap hourly check.
+        if (plan.sweepBotMaterializations)
+        {
+            OrphanMaterializationSweepReport const sweep =
+                sAuctionIntentExecutor.SweepOrphanMaterializations(
+                    uint32(now), orphanSweepBatchSize);
+            bool const retrySoon = sweep.morePending || !sweep.committed;
+            s_nextOrphanSweepTime = now + (retrySoon ? MINUTE : HOUR);
+        }
+        else
+        {
+            s_nextOrphanSweepTime = now + HOUR;
+        }
+    }
+}
+
+void AhServiceTick()
+{
+    WorkerSupervisor* const ahSupervisor = sAhService.GetSupervisor();
+    if (ahSupervisor == NULL)
+    {
+        return;
+    }
+
+    // Tick() uses wall-clock deltas internally and drives heartbeat, restart
+    // and protocol; it must run every tick regardless of service health (it is
+    // what transitions the service from inactive back to active).
+    ahSupervisor->Tick(sWorld.GetGameTime());
+
+    // Overflow visibility: warn (rate-limited) when the inbound queue has
+    // dropped frames since we last checked.
+    static size_t s_lastDroppedSeen = 0;
+    const size_t  dropped = ahSupervisor->InboundDropped();
+    if (dropped > s_lastDroppedSeen)
+    {
+        static time_t s_lastOverflowWarn = 0;
+        const time_t now = time(NULL);
+        // Baseline only advances on emission so suppressed bursts are counted
+        // correctly in the next warning.
+        if (now - s_lastOverflowWarn >= 60)
+        {
+            sLog.outError("[AHSupervisor] inbound queue overflow:"
+                          " %u frame(s) dropped (total %u)",
+                          static_cast<unsigned>(dropped - s_lastDroppedSeen),
+                          static_cast<unsigned>(dropped));
+            s_lastOverflowWarn = now;
+            s_lastDroppedSeen  = dropped;
+        }
+    }
+
+    // The apply loop and the near-full back-pressure check run only while the
+    // service is healthy: while it is not, the in-process bot trades, and
+    // applying the dead child's last staged batch at the same time would
+    // over-post against it.
+    if (ahSupervisor->ServiceActive())
+    {
+        std::vector<IpcMessage> msgs;
+        ahSupervisor->DrainInbound(msgs, 256);
+
+        // Near-full back-pressure: at 80% capacity warn AND tell the child to
+        // throttle via IPC_QUEUE_FULL so it pauses one bot cycle. Both are
+        // rate-limited to once per 60s.
+        const size_t qSize = ahSupervisor->Channel().InboundSize();
+        if (qSize >= IPC_INBOUND_QUEUE_CAP * 4 / 5)
+        {
+            static time_t s_lastNearFullWarn = 0;
+            const time_t now = time(NULL);
+            if (now - s_lastNearFullWarn >= 60)
+            {
+                sLog.outError("[AHSupervisor] inbound queue near full:"
+                              " %u / %u frames - sending IPC_QUEUE_FULL",
+                              static_cast<unsigned>(qSize),
+                              static_cast<unsigned>(IPC_INBOUND_QUEUE_CAP));
+
+                IpcMessage qf;
+                qf.op = IPC_QUEUE_FULL;
+                ahSupervisor->Channel().SendFrame(qf);
+
+                s_lastNearFullWarn = now;
+            }
+        }
+
+        for (size_t i = 0; i < msgs.size(); ++i)
+        {
+            AhHandleInbound(msgs[i]);
+        }
+
+        // Retry failed value-finalizes and age un-answered player mutations
+        // into in-doubt tombstones (forward-only; never rolls back).
+        uint32 const mutationNowSec = uint32(time(NULL));
+        AhProcessRedriveQueue(mutationNowSec);
+        AhProcessReconnectRetryQueue(mutationNowSec);
+    }
+
+    // Expire processed-uuid dedup entries regardless of service health, once
+    // per second of game time.
+    static time_t s_lastIntentPurge = 0;
+    const time_t nowSec = sWorld.GetGameTime();
+    if (nowSec != s_lastIntentPurge)
+    {
+        sAuctionIntentExecutor.PurgeExpiredUuids(uint32(nowSec));
+        s_lastIntentPurge = nowSec;
+
+        // Sweep timed-out browse requests on the same clock used to register
+        // them; tell each player the AH is unavailable iff it is still the
+        // current search and the player is present.
+        std::vector<PendingBrowse> timedOut;
+        sAhService.GetBrowsePending().Sweep(uint32(nowSec), 10u, timedOut);
+        for (size_t i = 0; i < timedOut.size(); ++i)
+        {
+            if (!sAhService.GetBrowsePending().IsCurrent(timedOut[i].playerGuidLow,
+                                                         timedOut[i].kind, timedOut[i].seq))
+            {
+                continue;
+            }
+            Player* p = sPlayerRegistry.Find(
+                ObjectGuid(HIGHGUID_PLAYER, timedOut[i].playerGuidLow));
+            if (p && p->IsInWorld() && p->GetSession())
+            {
+                AhSendBrowseUnavailable(p->GetSession(), timedOut[i].kind);
+            }
+        }
+    }
+}
diff --git a/src/modules/AhService/world/AhServiceWorld.h b/src/modules/AhService/world/AhServiceWorld.h
new file mode 100644
index 0000000000..47cc1a9598
--- /dev/null
+++ b/src/modules/AhService/world/AhServiceWorld.h
@@ -0,0 +1,43 @@
+/**
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * MaNGOS is a full featured server for World of Warcraft, supporting
+ * the following clients: 1.12.x, 2.4.3, 3.3.5a, 4.3.4a and 5.4.8
+ *
+ * Copyright (C) 2005-2026 MaNGOS <https://www.getmangos.eu>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * World of Warcraft, and all World of Warcraft or Warcraft art, images,
+ * and lore are copyrighted by Blizzard Entertainment, Inc.
+ */
+
+#ifndef MANGOS_H_AHSERVICE_WORLD
+#define MANGOS_H_AHSERVICE_WORLD
+
+#include "Item.h"
+
+class IpcMessage;
+class Player;
+
+/// Dispatches one frame from the worker.
+void AhHandleInbound(const IpcMessage& msg);
+/// Health transitions and custody upkeep, every 20 seconds.
+void AhServiceMaintenance();
+/// The supervisor and the frames it drained, every world tick.
+void AhServiceTick();
+/// Only the scripted OnCanUseItem veto; EQUIP_ERR_OK without one.
+InventoryResult AhScriptedItemUse(Player* player, uint32 itemEntry);
+
+#endif
diff --git a/src/game/AuctionHouseBot/AuctionIntentExecutor.cpp b/src/modules/AhService/world/AuctionIntentExecutor.cpp
similarity index 99%
rename from src/game/AuctionHouseBot/AuctionIntentExecutor.cpp
rename to src/modules/AhService/world/AuctionIntentExecutor.cpp
index d3af0d4f9d..b28d26c06b 100644
--- a/src/game/AuctionHouseBot/AuctionIntentExecutor.cpp
+++ b/src/modules/AhService/world/AuctionIntentExecutor.cpp
@@ -28,6 +28,8 @@
 #include "AuctionIntentExecutor.h"
 
 #include "AuctionIntents.h"
+#include "AhService.h"
+#include "AhServiceBook.h"
 #include "AuctionHouseMgr.h"
 #include "AuctionHouseBot.h"
 #include "CustodyLedger.h"
@@ -36,7 +38,6 @@
 #include "ItemPrototype.h"
 #include "Item.h"
 #include "DBCStores.h"
-#include "Config/Config.h"
 #include "Database/DatabaseEnv.h"
 #include "Log.h"
 #include "World.h"
@@ -212,7 +213,7 @@ void AuctionIntentExecutor::RefreshTtl()
     static const uint32 TTL_MIN = 60u;
     static const uint32 TTL_MAX = 86400u;
 
-    const int32 raw = sConfig.GetIntDefault("AH.Service.IntentTtlSec", 900);
+    const int32 raw = sAhService.Settings().intentTtlSec;
     uint32 ttl;
     if (raw < static_cast<int32>(TTL_MIN))
     {
@@ -369,7 +370,7 @@ void AuctionIntentExecutor::Apply(const IpcMessage& in, IpcMessage& resultOut)
             // value effect in-process, bidder=0) and no longer sends
             // IPC_INTENT_BID. A frame arriving here is stray/stale: log+ignore
             // (no reply) rather than mutate a live auction from a stale snapshot.
-            if (sWorld.IsAhWriteAuthority())
+            if (sAhService.IsWriteAuthority())
             {
                 sLog.outError("[AHExecutor] IPC_INTENT_BID under WriteAuthority"
                               " (worker owns bids) - ignored");
@@ -382,7 +383,7 @@ void AuctionIntentExecutor::Apply(const IpcMessage& in, IpcMessage& resultOut)
         {
             // [SP-2] Same as IPC_INTENT_BID: buyouts are worker-owned under
             // WriteAuthority. A stray frame is logged and ignored.
-            if (sWorld.IsAhWriteAuthority())
+            if (sAhService.IsWriteAuthority())
             {
                 sLog.outError("[AHExecutor] IPC_INTENT_BUYOUT under"
                               " WriteAuthority (worker owns buyouts) - ignored");
@@ -434,7 +435,7 @@ void AuctionIntentExecutor::ApplySell(const IpcMessage& in,
     // orphan sweep. So skip the in-memory dedup here under authority and let
     // MaterializeSell's durable replay own idempotency (it never double-mints:
     // Get("botlist:<uuid>") replays the recorded ids on a redelivery).
-    if (!sWorld.IsAhWriteAuthority() && IsDuplicate(s.uuid))
+    if (!sAhService.IsWriteAuthority() && IsDuplicate(s.uuid))
     {
         ++m_duplicate;
         Remember(s.uuid, now);
@@ -577,7 +578,7 @@ void AuctionIntentExecutor::ApplySell(const IpcMessage& in,
     // sole `auction`-table writer; mangosd's job is to mint+persist+escrow the
     // item, allocate the id and record the durable idempotency row, then reply
     // the ids for the worker to write the book. All validations above still ran.
-    if (sWorld.IsAhWriteAuthority())
+    if (sAhService.IsWriteAuthority())
     {
         MaterializeSell(s, resultOut, now);
         return;
@@ -1031,7 +1032,7 @@ void AuctionIntentExecutor::ApplyBid(const IpcMessage& in,
     // newbid reaches buyout, which we excluded above, so for a pure bid this
     // is the OK path regardless of return value.
     bool applied = false;
-    auction->UpdateBid(b.bidAmount, NULL, &applied);
+    AhPlaceGeneratedBid(*auction, b.bidAmount, applied);
     if (!applied)
     {
         ++m_rejected;
@@ -1151,7 +1152,7 @@ void AuctionIntentExecutor::ApplyBuyout(const IpcMessage& in,
     // the auction internally -- false is the SUCCESS path for buyout, so we
     // must NOT touch `auction` afterwards.
     bool applied = false;
-    auction->UpdateBid(auction->buyout, NULL, &applied);
+    AhPlaceGeneratedBid(*auction, auction->buyout, applied);
     if (!applied)
     {
         ++m_rejected;
diff --git a/src/game/AuctionHouseBot/AuctionIntentExecutor.h b/src/modules/AhService/world/AuctionIntentExecutor.h
similarity index 100%
rename from src/game/AuctionHouseBot/AuctionIntentExecutor.h
rename to src/modules/AhService/world/AuctionIntentExecutor.h
diff --git a/src/game/AuctionHouseBot/BrowsePending.cpp b/src/modules/AhService/world/BrowsePending.cpp
similarity index 100%
rename from src/game/AuctionHouseBot/BrowsePending.cpp
rename to src/modules/AhService/world/BrowsePending.cpp
diff --git a/src/game/AuctionHouseBot/BrowsePending.h b/src/modules/AhService/world/BrowsePending.h
similarity index 100%
rename from src/game/AuctionHouseBot/BrowsePending.h
rename to src/modules/AhService/world/BrowsePending.h
diff --git a/src/game/AuctionHouseBot/CustodyDeferred.h b/src/modules/AhService/world/CustodyDeferred.h
similarity index 67%
rename from src/game/AuctionHouseBot/CustodyDeferred.h
rename to src/modules/AhService/world/CustodyDeferred.h
index dfe4a52095..d10ad2783a 100644
--- a/src/game/AuctionHouseBot/CustodyDeferred.h
+++ b/src/modules/AhService/world/CustodyDeferred.h
@@ -59,40 +59,6 @@
 #include <vector>
 #include <string>
 #include <utility>
-
-/// The live Item* are only stored (never dereferenced) in this header, so a
-/// forward declaration is enough and Item.h need not be pulled in here.
-class Item;
-
-/**
- * Value-captured snapshot of everything needed to replay the online receiver's
- * in-memory mail push, built by VALUE so it never aliases a MailDraft (whose
- * copy/assign are trapped, see Mail.h) and stays valid across the deferral.
- */
-struct DeferredMailPush
-{
-    uint32 mailId;                                          ///< generated mail id
-    uint32 receiverGuid;                                    ///< receiver low guid
-    uint32 senderId;                                        ///< sender low guid / entry
-    uint8 messageType;                                      ///< MailMessageType
-    uint8 stationery;                                       ///< MailStationery
-    uint32 mailTemplateId;                                  ///< mail template id
-    std::string subject;                                    ///< mail subject (raw)
-    std::string body;                                       ///< mail body (raw)
-    uint32 money;                                           ///< attached money
-    uint32 cod;                                             ///< cash on delivery
-    uint32 checked;                                         ///< MailCheckMask
-    uint64 deliverTime;                                     ///< delivery time
-    uint64 expireTime;                                      ///< expiry time
-    /// (item guidLow, item entry) pairs to register on the in-memory Mail.
-    std::vector<std::pair<uint32, uint32>> items;
-    /// Live Item* objects (owned by the AH cache, mAitems) registered via
-    /// Player::AddMItem when the success push closure runs (same call stack, so
-    /// still valid). On rollback the closure never runs and these items survive
-    /// in mAitems for the next-tick re-resolution -- they are NOT freed here.
-    std::vector<Item*> liveItems;
-};
-
 /**
  * Ordered queue of deferred side effects for a custody co-commit. The owner
  * runs the queue exactly once, AFTER the caller's checked commit reports
diff --git a/src/game/AuctionHouseBot/CustodyLedger.cpp b/src/modules/AhService/world/CustodyLedger.cpp
similarity index 100%
rename from src/game/AuctionHouseBot/CustodyLedger.cpp
rename to src/modules/AhService/world/CustodyLedger.cpp
diff --git a/src/game/AuctionHouseBot/CustodyLedger.h b/src/modules/AhService/world/CustodyLedger.h
similarity index 100%
rename from src/game/AuctionHouseBot/CustodyLedger.h
rename to src/modules/AhService/world/CustodyLedger.h
diff --git a/src/game/AuctionHouseBot/CustodyReconciler.cpp b/src/modules/AhService/world/CustodyReconciler.cpp
similarity index 100%
rename from src/game/AuctionHouseBot/CustodyReconciler.cpp
rename to src/modules/AhService/world/CustodyReconciler.cpp
diff --git a/src/game/AuctionHouseBot/CustodyReconciler.h b/src/modules/AhService/world/CustodyReconciler.h
similarity index 100%
rename from src/game/AuctionHouseBot/CustodyReconciler.h
rename to src/modules/AhService/world/CustodyReconciler.h
diff --git a/src/game/AuctionHouseBot/CustodyService.cpp b/src/modules/AhService/world/CustodyService.cpp
similarity index 97%
rename from src/game/AuctionHouseBot/CustodyService.cpp
rename to src/modules/AhService/world/CustodyService.cpp
index 1124157b7e..b639c6324b 100644
--- a/src/game/AuctionHouseBot/CustodyService.cpp
+++ b/src/modules/AhService/world/CustodyService.cpp
@@ -25,8 +25,8 @@
 
 #include "CustodyService.h"
 
-#include "Config/Config.h"
 #include "CustodyLedger.h"
+#include "AhService.h"
 #include "Log.h"
 #include "Mail.h"
 #include "Player.h"
@@ -120,7 +120,7 @@ void CustodyService::RollbackGoldRefund(CustodyDeferred& d,
 {
     CustodyLedger::SetState(key, CST_TERMINAL_BACK,
                             static_cast<uint64>(time(NULL)));
-    refundMail.SendMailToInTransaction(to, from, d);
+    refundMail.SendMailToInTransaction(to, from, d.effects);
 }
 
 void CustodyService::ReleaseGoldToWallet(CustodyDeferred& d, uint32 ownerGuid,
@@ -213,7 +213,7 @@ void CustodyService::DeliverItem(CustodyDeferred& d, std::string const& key,
 {
     CustodyLedger::SetState(key, CST_TERMINAL_OK,
                             static_cast<uint64>(time(NULL)));
-    itemMail.SendMailToInTransaction(to, from, d,
+    itemMail.SendMailToInTransaction(to, from, d.effects,
                                      static_cast<MailCheckMask>(checked));
 }
 
@@ -225,7 +225,7 @@ void CustodyService::DeferEffect(CustodyDeferred& d,
 
 std::string CustodyService::CrashPhase()
 {
-    return sConfig.GetStringDefault("AH.Service.CustodyCrashAt", "");
+    return sAhService.Settings().custodyCrashAt;
 }
 
 bool CustodyService::ShouldCrashAtPhase(std::string const& configuredPhase,
@@ -252,7 +252,7 @@ bool CustodyService::CommitCheckedOrForcedFail(
     // the next reconciliation attempt can take the real checked commit.
     static bool s_forcedFailFired = false;
     if (!s_forcedFailFired && !phase.empty() &&
-        sConfig.GetStringDefault("AH.Service.CustodyFailCommitAt", "") == phase)
+        sAhService.Settings().custodyFailCommitAt == phase)
     {
         s_forcedFailFired = true;
         sLog.outError(
diff --git a/src/game/AuctionHouseBot/CustodyService.h b/src/modules/AhService/world/CustodyService.h
similarity index 100%
rename from src/game/AuctionHouseBot/CustodyService.h
rename to src/modules/AhService/world/CustodyService.h
diff --git a/src/game/AuctionHouseBot/MutationPending.cpp b/src/modules/AhService/world/MutationPending.cpp
similarity index 100%
rename from src/game/AuctionHouseBot/MutationPending.cpp
rename to src/modules/AhService/world/MutationPending.cpp
diff --git a/src/game/AuctionHouseBot/MutationPending.h b/src/modules/AhService/world/MutationPending.h
similarity index 100%
rename from src/game/AuctionHouseBot/MutationPending.h
rename to src/modules/AhService/world/MutationPending.h
diff --git a/src/game/AuctionHouseBot/AuctionHouseBot.cpp b/src/modules/AuctionHouseBot/AuctionHouseBot.cpp
similarity index 98%
rename from src/game/AuctionHouseBot/AuctionHouseBot.cpp
rename to src/modules/AuctionHouseBot/AuctionHouseBot.cpp
index c637b4e26a..ef823f007f 100755
--- a/src/game/AuctionHouseBot/AuctionHouseBot.cpp
+++ b/src/modules/AuctionHouseBot/AuctionHouseBot.cpp
@@ -23,12 +23,13 @@
  * and lore are copyrighted by Blizzard Entertainment, Inc.
  */
 
+#include <algorithm>
+#include <limits>
 #include <sstream>
 #include <string>
 #include <vector>
 #include <map>
 #include "AuctionHouseBot.h"
-#include "AhBotSystemOwner.h"
 #include "ProgressBar.h"
 #include "Log.h"
 #include "ObjectMgr.h"
@@ -607,6 +608,16 @@ AuctionBotConfig::AuctionBotConfig()
  * @brief Initialize the AuctionBotConfig by loading from configuration file
  * @return True if initialization successful, false otherwise
  */
+bool AuctionBotConfig::IsModuleEnabled()
+{
+    if (!m_AhBotCfg.SetSource(m_configFileName.c_str()) && !m_AhBotCfg.SetSource(AUCTIONHOUSEBOT_CONFIG_NAME))
+    {
+        sLog.outString("AHBOT is Disabled. Unable to open configuration file %s. ", m_configFileName.c_str());
+        return false;
+    }
+    return m_AhBotCfg.GetBoolDefault("Enable", true);
+}
+
 bool AuctionBotConfig::Initialize()
 {
     if (!m_AhBotCfg.SetSource(m_configFileName.c_str()))
@@ -664,16 +675,13 @@ bool AuctionBotConfig::Initialize()
 void AuctionBotConfig::SetAHBotId(const std::string& BotCharName)
 {
     m_BotId = 0;
-    // F7: an upgraded ahbot.conf may still carry an explicit empty
-    // AuctionHouseBot.CharacterName (the pre-forged-owner default). An empty
-    // string would bypass the forged system owner and leave the bot GUID
-    // unresolved (0), so treat it as the forged AHBOT_SYSTEM_OWNER_NAME -- the
-    // name-intercept then resolves it to the reserved system GUID.
-    const std::string name = BotCharName.empty() ? AHBOT_SYSTEM_OWNER_NAME : BotCharName;
-    m_BotId = sObjectMgr.GetPlayerGuidByName(name.c_str()).GetCounter();
-    if (!m_BotId)
+    if (!BotCharName.empty())
     {
-        sLog.outError("AHBot uses an invalid character name `%s`", name.c_str());
+        m_BotId = sObjectMgr.GetPlayerGuidByName(BotCharName.c_str()).GetCounter();
+        if (!m_BotId)
+        {
+            sLog.outError("AHBot uses an invalid character name `%s`", BotCharName.c_str());
+        }
     }
 }
 
@@ -761,7 +769,7 @@ void AuctionBotConfig::GetConfigFromFile()
 
     SetAHBotIncludes(m_AhBotCfg.GetStringDefault("AuctionHouseBot.forceIncludeItems", ""));
     SetAHBotExcludes(m_AhBotCfg.GetStringDefault("AuctionHouseBot.forceExcludeItems", ""));
-    SetAHBotId(m_AhBotCfg.GetStringDefault("AuctionHouseBot.CharacterName", AHBOT_SYSTEM_OWNER_NAME));
+    SetAHBotId(m_AhBotCfg.GetStringDefault("AuctionHouseBot.CharacterName", ""));
 
     setConfig(CONFIG_BOOL_AHBOT_BUYER_ALLIANCE_ENABLED       , "AuctionHouseBot.Buyer.Alliance.Enabled"      , false);
     setConfig(CONFIG_BOOL_AHBOT_BUYER_HORDE_ENABLED          , "AuctionHouseBot.Buyer.Horde.Enabled"         , false);
@@ -2319,27 +2327,25 @@ bool AuctionBotSeller::getRandomArray(AHB_Seller_Config& config, RandomArray& ra
  */
 void AuctionBotSeller::SetPricesOfItem(AHB_Seller_Config& config, uint32& buyp, uint32& bidp, uint32 stackcnt, ItemQualities itemQuality)
 {
-    // Calculate the buyout price based on the item quality and stack count
-    double temp_buyp = buyp * stackcnt *
-        (itemQuality < MAX_AUCTION_QUALITY ? config.GetPriceRatioPerQuality(AuctionQuality(itemQuality)) : 1);
+    // Prices are worked out in 64 bits and saturate at the largest uint32
+    auto saturate = [](uint64 value) { return uint32(std::min<uint64>(value, std::numeric_limits<uint32>::max())); };
 
-    // Calculate a random range for the buyout price
-    double randrange = temp_buyp * 0.4;
+    // Calculate the buyout price based on the item quality and stack count
+    uint64 const ratio = itemQuality < MAX_AUCTION_QUALITY ? config.GetPriceRatioPerQuality(AuctionQuality(itemQuality)) : 1;
+    uint64 const temp_buyp = uint64(buyp) * stackcnt * ratio;
 
-    uint32 buypMin = (uint32)temp_buyp - (uint32)randrange;
-    uint32 buypMax = ((uint32)temp_buyp + (uint32)randrange) < temp_buyp ? std::numeric_limits<uint32>::max() : temp_buyp + randrange;
+    // Calculate a random range (40%) for the buyout price
+    uint64 const randrange = temp_buyp * 2 / 5;
 
     // Set the buyout price
-    buyp = (urand(buypMin, buypMax) / 100) + 1;
+    buyp = (urand(saturate(temp_buyp - randrange), saturate(temp_buyp + randrange)) / 100) + 1;
 
     // Calculate a random range for the bid price
-    double urandrange = buyp * 40;
-    double temp_bidp = buyp * 50;
-    uint32 bidPmin = (uint32)temp_bidp - (uint32)urandrange;
-    uint32 bidPmax = ((uint32)temp_bidp + (uint32)urandrange) < temp_bidp ? std::numeric_limits<uint32>::max() : temp_bidp + urandrange;
+    uint64 const urandrange = uint64(buyp) * 40;
+    uint64 const temp_bidp = uint64(buyp) * 50;
 
     // Set the bid price
-    bidp = (urand(bidPmin, bidPmax) / 100) + 1;
+    bidp = (urand(saturate(temp_bidp - urandrange), saturate(temp_bidp + urandrange)) / 100) + 1;
 }
 
 /**
@@ -2813,19 +2819,10 @@ void AuctionHouseBot::Update()
             break;
         }
     }
-    // NOTE: PurgeMailedItems() is intentionally NOT called here. Update() is
-    // gated out when the out-of-process AH service is active, so driving the
-    // mail cleanup from here would skip it entirely on a service realm. It is
-    // now driven UNCONDITIONALLY from World::Update on the WUPDATE_AHBOT timer
-    // (via PurgeMailedItemsTick()), so it runs in both modes.
 }
 
 void AuctionHouseBot::PurgeMailedItemsTick()
 {
-    // Public, mode-agnostic entry point driven from World::Update on the
-    // WUPDATE_AHBOT timer. PurgeMailedItems() is internally throttled to once
-    // per hour and depends only on the configured bot GUID (not on any
-    // in-process bot cycle state), so it is safe to call in both bot modes.
     PurgeMailedItems();
 }
 
diff --git a/src/game/AuctionHouseBot/AuctionHouseBot.h b/src/modules/AuctionHouseBot/AuctionHouseBot.h
similarity index 97%
rename from src/game/AuctionHouseBot/AuctionHouseBot.h
rename to src/modules/AuctionHouseBot/AuctionHouseBot.h
index 83b954a4d3..e80fdbe3fc 100755
--- a/src/game/AuctionHouseBot/AuctionHouseBot.h
+++ b/src/modules/AuctionHouseBot/AuctionHouseBot.h
@@ -198,6 +198,12 @@ class AuctionBotConfig
          */
         bool Initialize();
 
+        /**
+         * @brief Reads the first key of the configuration file
+         * @return False when the file is missing or says Enable = 0
+         */
+        bool IsModuleEnabled();
+
         /**
          * @brief Get the AHBot includes string
          * @return Comma-separated list of included item IDs
@@ -461,13 +467,7 @@ class AuctionHouseBot
         void Update();
 
         /**
-         * @brief Drive the hourly mailed-item cleanup, mode-agnostic.
-         *
-         * Public wrapper around PurgeMailedItems() so World::Update can run
-         * the cleanup on the WUPDATE_AHBOT timer in BOTH bot modes (in-process
-         * and out-of-process service). In service mode Update() is gated out,
-         * so the cleanup must be driven from here or the bot's returned/unsold
-         * mail (mail / mail_items / item_instance) grows without bound.
+         * @brief Drive the hourly mailed-item cleanup, also while Update() stands down.
          *
          * Internally throttled to once per hour; cheap to call every tick.
          */
diff --git a/src/modules/AuctionHouseBot/AuctionHouseBotCommands.cpp b/src/modules/AuctionHouseBot/AuctionHouseBotCommands.cpp
new file mode 100644
index 0000000000..584d664e21
--- /dev/null
+++ b/src/modules/AuctionHouseBot/AuctionHouseBotCommands.cpp
@@ -0,0 +1,267 @@
+/**
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * MaNGOS is a full featured server for World of Warcraft, supporting
+ * the following clients: 1.12.x, 2.4.3, 3.3.5a, 4.3.4a and 5.4.8
+ *
+ * Copyright (C) 2005-2026 MaNGOS <https://www.getmangos.eu>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * World of Warcraft, and all World of Warcraft or Warcraft art, images,
+ * and lore are copyrighted by Blizzard Entertainment, Inc.
+ */
+
+/**
+ * @file AuctionHouseBotCommands.cpp
+ * @brief The .ahbot commands: rebuild, reload, status, item amounts and ratios.
+ */
+
+#include "AuctionHouseBotCommands.h"
+#include "AuctionHouseBot.h"
+#include "Chat.h"
+#include "Language.h"
+
+namespace
+{
+    uint32 const ahbotQualityIds[MAX_AUCTION_QUALITY] =
+    {
+        LANG_AHBOT_QUALITY_GREY, LANG_AHBOT_QUALITY_WHITE,
+        LANG_AHBOT_QUALITY_GREEN, LANG_AHBOT_QUALITY_BLUE,
+        LANG_AHBOT_QUALITY_PURPLE, LANG_AHBOT_QUALITY_ORANGE,
+        LANG_AHBOT_QUALITY_YELLOW
+    };
+
+    bool HandleRebuild(ChatHandler& handler, char* args)
+    {
+        bool all = false;
+        if (*args)
+        {
+            if (!handler.ExtractLiteralArg(&args, "all"))
+            {
+                return false;
+            }
+            all = true;
+        }
+
+        sAuctionBot.Rebuild(all);
+        return true;
+    }
+
+    bool HandleReload(ChatHandler& handler, char* /*args*/)
+    {
+        if (sAuctionBot.ReloadAllConfig())
+        {
+            handler.SendSysMessage(LANG_AHBOT_RELOAD_OK);
+            return true;
+        }
+
+        handler.SendSysMessage(LANG_AHBOT_RELOAD_FAIL);
+        handler.SetSentErrorMessage(true);
+        return false;
+    }
+
+    bool HandleStatus(ChatHandler& handler, char* args)
+    {
+        bool all = false;
+        if (*args)
+        {
+            if (!handler.ExtractLiteralArg(&args, "all"))
+            {
+                return false;
+            }
+            all = true;
+        }
+
+        AuctionHouseBotStatusInfo statusInfo;
+        sAuctionBot.PrepareStatusInfos(statusInfo);
+
+        bool const console = !handler.GetSession();
+        if (console)
+        {
+            handler.SendSysMessage(LANG_AHBOT_STATUS_BAR_CONSOLE);
+            handler.SendSysMessage(LANG_AHBOT_STATUS_TITLE1_CONSOLE);
+            handler.SendSysMessage(LANG_AHBOT_STATUS_MIDBAR_CONSOLE);
+        }
+        else
+        {
+            handler.SendSysMessage(LANG_AHBOT_STATUS_TITLE1_CHAT);
+        }
+
+        int32 const fmtId = console ? LANG_AHBOT_STATUS_FORMAT_CONSOLE : LANG_AHBOT_STATUS_FORMAT_CHAT;
+
+        handler.PSendSysMessage(fmtId, handler.GetMangosString(LANG_AHBOT_STATUS_ITEM_COUNT),
+            statusInfo[AUCTION_HOUSE_ALLIANCE].ItemsCount,
+            statusInfo[AUCTION_HOUSE_HORDE].ItemsCount,
+            statusInfo[AUCTION_HOUSE_NEUTRAL].ItemsCount,
+            statusInfo[AUCTION_HOUSE_ALLIANCE].ItemsCount +
+            statusInfo[AUCTION_HOUSE_HORDE].ItemsCount +
+            statusInfo[AUCTION_HOUSE_NEUTRAL].ItemsCount);
+
+        if (all)
+        {
+            handler.PSendSysMessage(fmtId, handler.GetMangosString(LANG_AHBOT_STATUS_ITEM_RATIO),
+                sAuctionBotConfig.getConfig(CONFIG_UINT32_AHBOT_ALLIANCE_ITEM_AMOUNT_RATIO),
+                sAuctionBotConfig.getConfig(CONFIG_UINT32_AHBOT_HORDE_ITEM_AMOUNT_RATIO),
+                sAuctionBotConfig.getConfig(CONFIG_UINT32_AHBOT_NEUTRAL_ITEM_AMOUNT_RATIO),
+                sAuctionBotConfig.getConfig(CONFIG_UINT32_AHBOT_ALLIANCE_ITEM_AMOUNT_RATIO) +
+                sAuctionBotConfig.getConfig(CONFIG_UINT32_AHBOT_HORDE_ITEM_AMOUNT_RATIO) +
+                sAuctionBotConfig.getConfig(CONFIG_UINT32_AHBOT_NEUTRAL_ITEM_AMOUNT_RATIO));
+
+            if (console)
+            {
+                handler.SendSysMessage(LANG_AHBOT_STATUS_BAR_CONSOLE);
+                handler.SendSysMessage(LANG_AHBOT_STATUS_TITLE2_CONSOLE);
+                handler.SendSysMessage(LANG_AHBOT_STATUS_MIDBAR_CONSOLE);
+            }
+            else
+            {
+                handler.SendSysMessage(LANG_AHBOT_STATUS_TITLE2_CHAT);
+            }
+
+            for (int i = 0; i < MAX_AUCTION_QUALITY; ++i)
+            {
+                handler.PSendSysMessage(fmtId, handler.GetMangosString(ahbotQualityIds[i]),
+                    statusInfo[AUCTION_HOUSE_ALLIANCE].QualityInfo[i],
+                    statusInfo[AUCTION_HOUSE_HORDE].QualityInfo[i],
+                    statusInfo[AUCTION_HOUSE_NEUTRAL].QualityInfo[i],
+                    sAuctionBotConfig.getConfigItemQualityAmount(AuctionQuality(i)));
+            }
+        }
+
+        if (console)
+        {
+            handler.SendSysMessage(LANG_AHBOT_STATUS_BAR_CONSOLE);
+        }
+
+        return true;
+    }
+
+    bool HandleItemsAmount(ChatHandler& handler, char* args)
+    {
+        uint32 qVals[MAX_AUCTION_QUALITY];
+        for (int i = 0; i < MAX_AUCTION_QUALITY; ++i)
+        {
+            if (!handler.ExtractUInt32(&args, qVals[i]))
+            {
+                return false;
+            }
+        }
+
+        sAuctionBot.SetItemsAmount(qVals);
+
+        for (int i = 0; i < MAX_AUCTION_QUALITY; ++i)
+        {
+            handler.PSendSysMessage(LANG_AHBOT_ITEMS_AMOUNT, handler.GetMangosString(ahbotQualityIds[i]), sAuctionBotConfig.getConfigItemQualityAmount(AuctionQuality(i)));
+        }
+
+        return true;
+    }
+
+    template<int Q>
+    bool HandleItemsAmountQuality(ChatHandler& handler, char* args)
+    {
+        uint32 qVal;
+        if (!handler.ExtractUInt32(&args, qVal))
+        {
+            return false;
+        }
+        sAuctionBot.SetItemsAmountForQuality(AuctionQuality(Q), qVal);
+        handler.PSendSysMessage(LANG_AHBOT_ITEMS_AMOUNT, handler.GetMangosString(ahbotQualityIds[Q]),
+            sAuctionBotConfig.getConfigItemQualityAmount(AuctionQuality(Q)));
+        return true;
+    }
+
+    bool HandleItemsRatio(ChatHandler& handler, char* args)
+    {
+        uint32 rVal[MAX_AUCTION_HOUSE_TYPE];
+        for (int i = 0; i < MAX_AUCTION_HOUSE_TYPE; ++i)
+        {
+            if (!handler.ExtractUInt32(&args, rVal[i]))
+            {
+                return false;
+            }
+        }
+
+        sAuctionBot.SetItemsRatio(rVal[0], rVal[1], rVal[2]);
+
+        for (int i = 0; i < MAX_AUCTION_HOUSE_TYPE; ++i)
+        {
+            handler.PSendSysMessage(LANG_AHBOT_ITEMS_RATIO, AuctionBotConfig::GetHouseTypeName(AuctionHouseType(i)), sAuctionBotConfig.getConfigItemAmountRatio(AuctionHouseType(i)));
+        }
+        return true;
+    }
+
+    template<int H>
+    bool HandleItemsRatioHouse(ChatHandler& handler, char* args)
+    {
+        uint32 rVal;
+        if (!handler.ExtractUInt32(&args, rVal))
+        {
+            return false;
+        }
+        sAuctionBot.SetItemsRatioForHouse(AuctionHouseType(H), rVal);
+        handler.PSendSysMessage(LANG_AHBOT_ITEMS_RATIO, AuctionBotConfig::GetHouseTypeName(AuctionHouseType(H)), sAuctionBotConfig.getConfigItemAmountRatio(AuctionHouseType(H)));
+        return true;
+    }
+}
+
+ChatCommand* AuctionHouseBotCommands()
+{
+    static ChatCommand itemsAmountTable[] =
+    {
+        ChatCommand("grey",     &HandleItemsAmountQuality<AUCTION_QUALITY_GREY>,   SEC_ADMINISTRATOR, true),
+        ChatCommand("white",    &HandleItemsAmountQuality<AUCTION_QUALITY_WHITE>,  SEC_ADMINISTRATOR, true),
+        ChatCommand("green",    &HandleItemsAmountQuality<AUCTION_QUALITY_GREEN>,  SEC_ADMINISTRATOR, true),
+        ChatCommand("blue",     &HandleItemsAmountQuality<AUCTION_QUALITY_BLUE>,   SEC_ADMINISTRATOR, true),
+        ChatCommand("purple",   &HandleItemsAmountQuality<AUCTION_QUALITY_PURPLE>, SEC_ADMINISTRATOR, true),
+        ChatCommand("orange",   &HandleItemsAmountQuality<AUCTION_QUALITY_ORANGE>, SEC_ADMINISTRATOR, true),
+        ChatCommand("yellow",   &HandleItemsAmountQuality<AUCTION_QUALITY_YELLOW>, SEC_ADMINISTRATOR, true),
+        ChatCommand("",         &HandleItemsAmount,                                SEC_ADMINISTRATOR, true),
+        ChatCommand(NULL,       0,                                                 true,  NULL, "", NULL)
+    };
+
+    static ChatCommand itemsRatioTable[] =
+    {
+        ChatCommand("alliance", &HandleItemsRatioHouse<AUCTION_HOUSE_ALLIANCE>,    SEC_ADMINISTRATOR, true),
+        ChatCommand("horde",    &HandleItemsRatioHouse<AUCTION_HOUSE_HORDE>,       SEC_ADMINISTRATOR, true),
+        ChatCommand("neutral",  &HandleItemsRatioHouse<AUCTION_HOUSE_NEUTRAL>,     SEC_ADMINISTRATOR, true),
+        ChatCommand("",         &HandleItemsRatio,                                 SEC_ADMINISTRATOR, true),
+        ChatCommand(NULL,       0,                                                 true,  NULL, "", NULL)
+    };
+
+    static ChatCommand itemsTable[] =
+    {
+        ChatCommand("amount",   SEC_ADMINISTRATOR, true, NULL, "", itemsAmountTable),
+        ChatCommand("ratio",    SEC_ADMINISTRATOR, true, NULL, "", itemsRatioTable),
+        ChatCommand(NULL,       0,                 true, NULL, "", NULL)
+    };
+
+    static ChatCommand ahbotTable[] =
+    {
+        ChatCommand("items",    SEC_ADMINISTRATOR, true, NULL, "", itemsTable),
+        ChatCommand("rebuild",  &HandleRebuild,    SEC_ADMINISTRATOR, true),
+        ChatCommand("reload",   &HandleReload,     SEC_ADMINISTRATOR, true),
+        ChatCommand("status",   &HandleStatus,     SEC_ADMINISTRATOR, true),
+        ChatCommand(NULL,       0,                 true, NULL, "", NULL)
+    };
+
+    static ChatCommand rootTable[] =
+    {
+        ChatCommand("ahbot",    SEC_ADMINISTRATOR, true, NULL, "", ahbotTable),
+        ChatCommand(NULL,       0,                 false, NULL, "", NULL)
+    };
+
+    return rootTable;
+}
diff --git a/src/modules/AuctionHouseBot/AuctionHouseBotCommands.h b/src/modules/AuctionHouseBot/AuctionHouseBotCommands.h
new file mode 100644
index 0000000000..0b25d17b5a
--- /dev/null
+++ b/src/modules/AuctionHouseBot/AuctionHouseBotCommands.h
@@ -0,0 +1,34 @@
+/**
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * MaNGOS is a full featured server for World of Warcraft, supporting
+ * the following clients: 1.12.x, 2.4.3, 3.3.5a, 4.3.4a and 5.4.8
+ *
+ * Copyright (C) 2005-2026 MaNGOS <https://www.getmangos.eu>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * World of Warcraft, and all World of Warcraft or Warcraft art, images,
+ * and lore are copyrighted by Blizzard Entertainment, Inc.
+ */
+
+#ifndef MANGOS_H_AUCTION_HOUSE_BOT_COMMANDS
+#define MANGOS_H_AUCTION_HOUSE_BOT_COMMANDS
+
+class ChatCommand;
+
+/// The top-level .ahbot table.
+ChatCommand* AuctionHouseBotCommands();
+
+#endif
diff --git a/src/modules/AuctionHouseBot/AuctionHouseBotModule.cpp b/src/modules/AuctionHouseBot/AuctionHouseBotModule.cpp
new file mode 100644
index 0000000000..53a8eb6e49
--- /dev/null
+++ b/src/modules/AuctionHouseBot/AuctionHouseBotModule.cpp
@@ -0,0 +1,109 @@
+/**
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * MaNGOS is a full featured server for World of Warcraft, supporting
+ * the following clients: 1.12.x, 2.4.3, 3.3.5a, 4.3.4a and 5.4.8
+ *
+ * Copyright (C) 2005-2026 MaNGOS <https://www.getmangos.eu>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * World of Warcraft, and all World of Warcraft or Warcraft art, images,
+ * and lore are copyrighted by Blizzard Entertainment, Inc.
+ */
+
+/**
+ * @file AuctionHouseBotModule.cpp
+ * @brief The in-process auction house bot as an auction module.
+ */
+
+#include "AuctionHouseBot.h"
+#include "AuctionHouseBotCommands.h"
+#include "AuctionHouseModule.h"
+#include "Log.h"
+#include "Timer.h"
+
+namespace
+{
+    uint32 const BOT_UPDATE_INTERVAL = 20 * IN_MILLISECONDS;
+
+    class AuctionHouseBotModule : public AuctionHouseModule
+    {
+        public:
+
+            AuctionHouseBotModule() : m_standingDown(false)
+            {
+                m_updateTimer.SetInterval(BOT_UPDATE_INTERVAL);
+            }
+
+            char const* Name() const override { return "AuctionHouseBot"; }
+
+            void Start() override
+            {
+                if (AuctionHouseModules::OwnsAuctionRows())
+                {
+                    sLog.outString("AuctionHouseBot: another auction module owns the auction table; the bot stays idle");
+                    return;
+                }
+
+                sLog.outString("Initialize AuctionHouseBot...");
+                sAuctionBot.Initialize();
+            }
+
+            void Update(uint32 diff) override
+            {
+                m_updateTimer.Update(diff);
+                if (!m_updateTimer.Passed())
+                {
+                    return;
+                }
+                m_updateTimer.Reset();
+
+                bool const standDown = AuctionHouseModules::TakesOverListings();
+                if (standDown != m_standingDown)
+                {
+                    sLog.outString(standDown ? "AuctionHouseBot: standing down, another module drives the listings"
+                                             : "AuctionHouseBot: resuming");
+                    m_standingDown = standDown;
+                }
+
+                if (!standDown)
+                {
+                    sAuctionBot.Update();
+                }
+                sAuctionBot.PurgeMailedItemsTick();
+            }
+
+            ChatCommand* Commands() override { return AuctionHouseBotCommands(); }
+
+        private:
+
+            IntervalTimer m_updateTimer;
+            bool m_standingDown;
+    };
+
+    AuctionHouseModule* CreateAuctionHouseBotModule()
+    {
+        if (!AuctionHouseModules::ConfigFile().empty())
+        {
+            sAuctionBotConfig.SetConfigFileName(AuctionHouseModules::ConfigFile().c_str());
+        }
+        return sAuctionBotConfig.IsModuleEnabled() ? new AuctionHouseBotModule : NULL;
+    }
+
+    struct Registrar
+    {
+        Registrar() { AuctionHouseModules::Provide(&CreateAuctionHouseBotModule); }
+    } const registrar;
+}
diff --git a/src/modules/AuctionHouseBot/CMakeLists.txt b/src/modules/AuctionHouseBot/CMakeLists.txt
new file mode 100644
index 0000000000..e85203173e
--- /dev/null
+++ b/src/modules/AuctionHouseBot/CMakeLists.txt
@@ -0,0 +1,38 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# MaNGOS is a full featured server for World of Warcraft, supporting
+# the following clients: 1.12.x, 2.4.3, 3.3.5a, 4.3.4a and 5.4.8
+#
+# Copyright (C) 2005-2026 MaNGOS <https://www.getmangos.eu>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+add_library(ahbot_module OBJECT
+    AuctionHouseBot.cpp
+    AuctionHouseBot.h
+    AuctionHouseBotCommands.cpp
+    AuctionHouseBotCommands.h
+    AuctionHouseBotModule.cpp
+)
+
+target_include_directories(ahbot_module PUBLIC ${CMAKE_CURRENT_SOURCE_DIR})
+target_link_libraries(ahbot_module PUBLIC game)
+
+target_link_libraries(mangosd PRIVATE ahbot_module)
+
+configure_file(ahbot.conf.dist.in ${CMAKE_CURRENT_BINARY_DIR}/ahbot.conf.dist)
+install(
+    FILES ${CMAKE_CURRENT_BINARY_DIR}/ahbot.conf.dist
+    DESTINATION ${CONF_INSTALL_DIR}
+)
diff --git a/src/modules/AuctionHouseBot/KNOWN_DEFECTS.md b/src/modules/AuctionHouseBot/KNOWN_DEFECTS.md
new file mode 100644
index 0000000000..335173efb8
--- /dev/null
+++ b/src/modules/AuctionHouseBot/KNOWN_DEFECTS.md
@@ -0,0 +1,29 @@
+# Auction house bot module: known defects
+
+Open defects in `src/modules/AuctionHouseBot/`, from the static review of the
+auction module split (2026-10-03). Numbers are the review's. Line numbers are
+as of the review and may drift. They predate the module split; the split moved
+the code without changing it.
+
+Fixed since the review: #18, the seller's out-of-range price conversion
+(`SetPricesOfItem` now works in 64 bits and saturates).
+
+The review's #8 and the first half of #7 exist only alongside the AH service
+module (they are about standing down for its worker) and are listed in
+`src/modules/AhService/KNOWN_DEFECTS.md`.
+
+## 7. `.ahbot reload` cannot turn the seller or the buyer off
+
+- Severity: bug
+- Where: `AuctionHouseBot.cpp:2599` and `:2610` (`InitializeAgents`, called by
+  `ReloadAllConfig`), `AuctionBotSeller::Update`, `AuctionBotBuyer::Update`
+
+`InitializeAgents` rebuilds an agent only when its flag is 1; when
+`AuctionHouseBot.Seller.Enabled` or `AuctionHouseBot.Buyer.Enabled` has become
+0, the existing agent is kept. Neither agent looks at that flag again:
+`AuctionBotSeller::Update` gates on the house's item ratio, and
+`AuctionBotBuyer::Update` on the per-house `Buyer.<House>.Enabled` flags. After
+setting `Seller.Enabled = 0` (or `Buyer.Enabled = 0`) and `.ahbot reload`, the
+bot keeps selling (or buying) until the server restarts.
+
+Fix direction: in `InitializeAgents`, delete and null an agent whose flag is 0.
diff --git a/src/game/AuctionHouseBot/ahbot.conf.dist.in b/src/modules/AuctionHouseBot/ahbot.conf.dist.in
similarity index 95%
rename from src/game/AuctionHouseBot/ahbot.conf.dist.in
rename to src/modules/AuctionHouseBot/ahbot.conf.dist.in
index b8686986c8..74b7071130 100644
--- a/src/game/AuctionHouseBot/ahbot.conf.dist.in
+++ b/src/modules/AuctionHouseBot/ahbot.conf.dist.in
@@ -3,6 +3,16 @@
 ################################################################################
 
 [AhbotConf]
+
+################################################################################
+#    Enable
+#        Load the auction house bot module. 0 leaves the server without it,
+#        including its .ahbot commands.
+#    Default 1 (Enabled; Seller and Buyer below still decide what it does)
+################################################################################
+
+Enable = 1
+
 ConfVersion=@MANGOS_AHBOT_VER@
 
 ################################################################################
@@ -151,7 +161,7 @@ ConfVersion=@MANGOS_AHBOT_VER@
 #
 ################################################################################
 
-AuctionHouseBot.CharacterName  = "AuctionHouse"
+AuctionHouseBot.CharacterName  = ""
 AuctionHouseBot.Seller.Enabled = 0
 AuctionHouseBot.DEBUG.Seller   = 0
 
diff --git a/src/modules/Bots/AhBotPrices.cpp b/src/modules/Bots/AhBotPrices.cpp
new file mode 100644
index 0000000000..e09be08009
--- /dev/null
+++ b/src/modules/Bots/AhBotPrices.cpp
@@ -0,0 +1,64 @@
+/**
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * MaNGOS is a full featured server for World of Warcraft, supporting
+ * the following clients: 1.12.x, 2.4.3, 3.3.5a, 4.3.4a and 5.4.8
+ *
+ * Copyright (C) 2005-2026 MaNGOS <https://www.getmangos.eu>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * World of Warcraft, and all World of Warcraft or Warcraft art, images,
+ * and lore are copyrighted by Blizzard Entertainment, Inc.
+ */
+
+/**
+ * @file AhBotPrices.cpp
+ * @brief The prices the playerbots ask of the ahbot/ AhBot, which is not built.
+ *
+ * The AhBot was never started, so it always answered as a disabled bot: no
+ * sell price, no buy price, a rarity multiplier of 1. These are those answers.
+ */
+
+#include "ahbot/AhBot.h"
+
+namespace ahbot
+{
+    ItemBag::ItemBag()
+    {
+    }
+
+    void AvailableItemsBag::Load()
+    {
+    }
+
+    AhBot::~AhBot()
+    {
+    }
+
+    int32 AhBot::GetSellPrice(ItemPrototype const* /*proto*/)
+    {
+        return 0;
+    }
+
+    int32 AhBot::GetBuyPrice(ItemPrototype const* /*proto*/)
+    {
+        return 0;
+    }
+
+    double AhBot::GetRarityPriceMultiplier(ItemPrototype const* /*proto*/)
+    {
+        return 1.0;
+    }
+}
diff --git a/src/modules/CMakeLists.txt b/src/modules/CMakeLists.txt
index 4561cadfc1..0f3178eddc 100644
--- a/src/modules/CMakeLists.txt
+++ b/src/modules/CMakeLists.txt
@@ -19,8 +19,6 @@
 # along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 # SD3 and Eluna link the `game` library, which only exists when BUILD_MANGOSD.
-# Guard on BOTH the script-lib option AND BUILD_MANGOSD so a worker-only
-# configure (BUILD_MANGOSD=OFF, BUILD_AH_SERVICE=ON) does not try to build them.
 if(BUILD_MANGOSD AND SCRIPT_LIB_SD3)
     add_subdirectory(SD3)
     mangos_submodule_compat(mangosscript
@@ -31,9 +29,11 @@ if(BUILD_MANGOSD AND SCRIPT_LIB_ELUNA)
     add_subdirectory(Eluna)
 endif()
 
-# The out-of-process auction-house worker. Self-contained: links only the IPC
-# wire contract (ah_ipc) + shared; never the mangosd game library. Gated by the
-# existing BUILD_AH_SERVICE option.
+# Auction modules link themselves into mangosd.
+if(BUILD_MANGOSD AND BUILD_AHBOT)
+    add_subdirectory(AuctionHouseBot)
+endif()
+
 if(BUILD_AH_SERVICE)
-    add_subdirectory(AhWorker)
+    add_subdirectory(AhService)
 endif()
\ No newline at end of file