feat(CT): CT2 — Runtime character-title ownership + wire

Campaign CT slice CT2: the client now learns the character's earned
titles and current display title from the server, owns that state in
Runtime, and can send a display-title change. No UI (CT3/CT4).

Wire (Core.Net):
- GameEvents.ParseCharacterTitleTable (0x0029 CharacterTitle): retail
  CharacterTitleTable::UnPack @0x005c6e90 skips a leading u32 into no
  field — its own Pack @0x005c6e40 always writes the literal 1 there,
  matching ACE's unconditional Writer.Write(1u) — then reads
  displayTitleId, then a count-prefixed PList<uint> of earned ids.
- GameEvents.ParseUpdateTitle (0x002B UpdateTitle): titleId +
  setAsDisplay, per CM_Social::DispatchUI_AddOrSetCharacterTitle
  @0x006a54c0 -> Handle_Social__AddOrSetCharacterTitle @0x00564260,
  which ALWAYS adds (SendNotice_AddCharacterTitle, unconditional) and
  additionally sets display only when setAsDisplay != 0
  (SendNotice_SetDisplayCharacterTitle, gated).
- SocialActions.BuildTitleSet / WorldSession.SendSetTitle: outbound
  TitleSet (0x002C), u32 titleId, matching ACE's GameActionSetTitle.
- GameEventWiring gains onCharacterTitleTable/onUpdateTitle delegate
  holes (Core.Net cannot reference AcDream.Runtime directly).

Runtime:
- New RuntimeCharacterTitleState (RuntimeCharacterState.Titles): earned
  title id set + display title id, TableReplaced/TitleAdded/
  DisplayTitleChanged events matching retail's unconditional-add /
  gated-display-set contract, clears at generation reset.
  RuntimeCharacterOwnershipSnapshot/CaptureOwnership/IsConverged and
  RuntimeCharacterSnapshot extended (trailing optional fields, no
  existing call site broken).
- IRuntimeCharacterCommands.SetTitle: generation-gated, sends
  TitleSet only — NO optimistic local mutation. Verified against
  retail's own CM_Social::Event_SetDisplayCharacterTitle @0x006a5720,
  which sends the wire message and touches no local field; the display
  title updates only from the server's own echo (the CA-campaign
  lesson: never re-add an optimistic write). Implemented on both hosts
  (DirectGameRuntimeCommandAdapter direct-send;
  CurrentGameRuntimeCommandAdapter via LiveCommandBus /
  LiveSessionCommandRouter's new SetTitleRuntimeCmd).
- LiveSessionEventRouter wires the two inbound events unconditionally
  (RuntimeCharacterState.Titles is a required child, not an optional
  sibling like Fellowship/Allegiance).

App (non-UI plumbing + resolver):
- CharacterTitleResolver (src/AcDream.App/UI/Layout/): ports
  CharacterTitleTable::GetCharacterTitleFromID @0x005c6ed0 — titleId ->
  EnumMapper(0x22000041) canonical key -> compute_str_hash ->
  StringTable(0x2300000E) localized text. Runtime stays id-only; CT3/
  CT4 consume this for display. DIDs hardcoded per the RetailKeyNames
  precedent (CT1 verified them end-to-end).

Register: no new row. Retail's send path is non-optimistic and so is
ours — no deviation to record for this slice.

Tests: wire conformance (byte-exact + truncation) in
CharacterTitleEventsTests.cs + SocialActionsTests.cs; Runtime owner
unit tests in RuntimeCharacterTitleStateTests.cs plus integration in
RuntimeCharacterStateTests.cs; a no-local-mutation command test in
DirectGameRuntimeCommandAdapterTests.cs; an InstalledDat pin
(CharacterTitleResolverLiveDatTests.cs, ids 0/1/2/3/5/13/14, run green
with ACDREAM_RUN_INSTALLED_DAT_TESTS=1). Full solution build green;
hermetic filtered suite green (15,380 passed / 0 failed).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/plans/2026-08-24-character-panel-parity-campaign.md

@@ -110,8 +110,9 @@ the composing function verbatim before writing a line of C#.
   0x10000539`); pages currently show retail-authored closed visuals.
 - Header labels partially bound (`StatHeaderLine` + `PkStatus` seams
   exist in `CharacterStatController.Bind` — content contract wrong).
-- `GameEventType.CharacterTitle/UpdateTitle` enum entries exist; no
+- `GameEventType.CharacterTitle/UpdateTitle` enum entries exist and now
-  parser, no state owner, no outbound builder.
+  (CT2, landed) have a parser, a `RuntimeCharacterTitleState` owner, and
+  an outbound `TitleSet` builder — see CT2's paragraph below.
 - The character window registers with `DatConstraintSource` — authored
   min/max plumbing exists in `RetailWindowFrame`; Y-resize for this
   window and the list-scrollbar contract do not.
@@ -145,13 +146,37 @@ rows), the value-column right margin, header element fonts/colors
 min/max constraints. Output: research doc + InstalledDat pins (the
 tooltip/scrollbar-pin pattern). No production changes.
 
-**CT2 — Runtime title ownership + wire.** Parse `0x0029`/`0x002B`;
+**CT2 — Runtime title ownership + wire. LANDED 2026-08-24.** Parsed
-locate the DAT title-string table `GetCharacterTitleFromID` reads and
+`0x0029 CharacterTitle` (retail's `CharacterTitleTable::UnPack
-port the lookup; `RuntimeCharacterState` owns the title set + display
+@0x005c6e90` — the leading ACE `1u`/retail-Pack-constant field is
-title (J4.3 owner; clears at generation reset); outbound `TitleSet`
+discarded, matching retail's own read) and `0x002B UpdateTitle`
-builder behind a typed Runtime command; ordered change events for UI
+(`CM_Social::DispatchUI_AddOrSetCharacterTitle @0x006a54c0`: title id +
-and headless bots (#368 contract: hosts observe the same owner).
+setAsDisplay). New sibling owner `RuntimeCharacterTitleState`
-Conformance tests against ACE's writer shapes.
+(`RuntimeCharacterState.Titles`) holds the earned-title set + display
+title id, clears at generation reset (`CaptureOwnership`/`IsConverged`
+extended with `TitleCount`/`DisplayTitleIsDefault`), and fires
+`TableReplaced`/`TitleAdded`/`DisplayTitleChanged` — matching retail's
+own unconditional-add / gated-display-set contract
+(`Handle_Social__AddOrSetCharacterTitle @0x00564260`). Outbound
+`TitleSet (0x002C)` ships behind `IRuntimeCharacterCommands.SetTitle`
+on both hosts (`DirectGameRuntimeCommandAdapter` direct-send,
+`CurrentGameRuntimeCommandAdapter` via the `LiveCommandBus`/
+`LiveSessionCommandRouter` queue) with **NO optimistic local
+mutation** — verified against retail's own
+`CM_Social::Event_SetDisplayCharacterTitle @0x006a5720`, which sends
+the wire message and touches no local field; the display title updates
+only from the server's own echo. No register row: this slice
+introduces no retail deviation. App-layer `CharacterTitleResolver`
+(`src/AcDream.App/UI/Layout/CharacterTitleResolver.cs`) ports
+`GetCharacterTitleFromID`'s EnumMapper(`0x22000041`) → hash →
+StringTable(`0x2300000E`) chain for CT3/CT4 to consume; Runtime stays
+id-only. Conformance tests against ACE's writer shapes
+(`tests/AcDream.Core.Net.Tests/Messages/CharacterTitleEventsTests.cs`),
+Runtime owner tests (`RuntimeCharacterTitleStateTests.cs` +
+`RuntimeCharacterStateTests.cs` integration), a no-local-mutation
+command test (`DirectGameRuntimeCommandAdapterTests.cs`), and an
+InstalledDat pin (`CharacterTitleResolverLiveDatTests.cs`, ids 0/1/2/3/
+5/13/14) all pass.
 
 **CT3 — Titles page UI.** Bind the authored page through the standard
 GUI classes (`UiTemplateListBox`/`UiScrollbar`/`UiButton` — zero

src/AcDream.App/Net/LiveSessionCommandRouter.cs

@@ -55,6 +55,10 @@ internal sealed record LiveSessionCommandBindings(
     // research §2.3-§2.7. No-ops when the batched module is clean, matching
     // retail's CPlayerModule::SaveToServer(force: 0).
     Action SaveCharacterOptions,
+    // Campaign CT slice CT2 (2026-08-24): TitleSet (0x002C) — sends only, no
+    // local mutation (RuntimeCharacterState.Titles updates from the
+    // server's own echo).
+    Action<uint> SendSetTitle,
     // Campaign FA slice FA2 (2026-08-12): fellowship + allegiance send
     // wrappers, the App-bus twin of DirectGameRuntimeCommandAdapter's
     // direct session.SendXxx calls.
@@ -95,6 +99,7 @@ internal readonly record struct SetSingleCharacterOptionRuntimeCmd(
     uint OptionId,
     bool Value);
 internal readonly record struct SaveCharacterOptionsRuntimeCmd;
+internal readonly record struct SetTitleRuntimeCmd(uint TitleId);
 internal readonly record struct AddFriendRuntimeCmd(string Name);
 internal readonly record struct RemoveFriendRuntimeCmd(uint CharacterId);
 
@@ -228,6 +233,8 @@ internal sealed class LiveSessionCommandRouter : ILiveSessionCommandRouting
                     command.Value)));
         commands.Register<SaveCharacterOptionsRuntimeCmd>(
             _ => SendIfActive(bindings.SaveCharacterOptions));
+        commands.Register<SetTitleRuntimeCmd>(
+            command => SendIfActive(() => bindings.SendSetTitle(command.TitleId)));
         commands.Register<AddFriendRuntimeCmd>(
             command => SendIfActive(() => bindings.AddFriend(command.Name)));
         commands.Register<OpenTradeNegotiationsRuntimeCmd>(

src/AcDream.App/Net/LiveSessionRuntimeFactory.cs

@@ -770,6 +770,8 @@ internal sealed class LiveSessionRuntimeFactory
         CharacterState: _domain.Character,
         SendSingleCharacterOption: SendSingleCharacterOption,
         SaveCharacterOptions: SaveCharacterOptionsIfDirty,
+        // Campaign CT slice CT2 (2026-08-24).
+        SendSetTitle: session.SendSetTitle,
         // Campaign FA slice FA2 (2026-08-12): fellowship + allegiance send
         // wrappers, matching the WorldSession.SendXxx methods FA2 added.
         SendFellowshipCreate: session.SendFellowshipCreate,

src/AcDream.App/Runtime/CurrentGameRuntimeCommandAdapter.cs

@@ -718,6 +718,31 @@ internal sealed class CurrentGameRuntimeCommandAdapter
             RuntimeCommandStatus.Accepted);
     }
 
+    public RuntimeCommandResult SetTitle(
+        RuntimeGenerationToken expectedGeneration,
+        uint titleId)
+    {
+        RuntimeCommandStatus gate = Validate(expectedGeneration, requireWorld: true);
+        if (gate != RuntimeCommandStatus.Accepted)
+            return Result(gate);
+        if (titleId == 0u)
+        {
+            return EmitResult(
+                RuntimeCommandDomain.Character,
+                operation: 6,
+                RuntimeCommandStatus.Rejected);
+        }
+        // CT2: NO optimistic local mutation — matches
+        // DirectGameRuntimeCommandAdapter.SetTitle; RuntimeCharacterState.
+        // Titles updates only from the server's own echo.
+        _commands.Publish(new SetTitleRuntimeCmd(titleId));
+        return EmitResult(
+            RuntimeCommandDomain.Character,
+            operation: 6,
+            RuntimeCommandStatus.Accepted,
+            titleId);
+    }
+
     public RuntimeCommandResult Execute(
         RuntimeGenerationToken expectedGeneration,
         in RuntimeFriendCommand command)

src/AcDream.App/UI/Layout/CharacterTitleResolver.cs

@@ -0,0 +1,85 @@
+using AcDream.Content;
+using DatReaderWriter.DBObjs;
+
+namespace AcDream.App.UI.Layout;
+
+/// <summary>
+/// Ports <c>CharacterTitleTable::GetCharacterTitleFromID @0x005c6ed0</c>'s
+/// title id -&gt; display string chain: <c>EnumMapper(0x22000041)</c>
+/// canonical key name -&gt; <c>compute_str_hash</c> -&gt;
+/// <c>StringTable(0x2300000E)</c> localized text.
+/// </summary>
+/// <remarks>
+/// <para>
+/// Retail's chain is a two-level <c>DBObj::GetDIDByEnum</c> indirection
+/// through a master map (DID <c>0x25000000</c>): category 1 (EMAPPER) for
+/// the EnumMapper, category 4 (STRINGTABLE) for the StringTable. Both
+/// resolved DIDs are hardcoded here rather than porting the indirection
+/// generically — the same precedent <see cref="RetailKeyNames"/> already
+/// set for this exact category-4 family (its <c>KeyNameTableId</c>/
+/// <c>MetaKeyNameTableId</c>/<c>DelimiterTableId</c>); factor out a shared
+/// helper only if a THIRD consumer of <c>GetDIDByEnum</c> appears. Both DIDs
+/// were verified end-to-end against ACE's <c>CharacterTitle.WarMage = 13</c>
+/// in Campaign CT slice CT1
+/// (docs/research/2026-08-24-campaign-ct-dat-ground-truth.md §5, pinned by
+/// <c>CharacterPanelLiveDatTests.TitleStringTable_ResolvesWarMageEndToEnd</c>).
+/// </para>
+/// <para>
+/// <see cref="AcDream.Runtime.Gameplay.RuntimeCharacterTitleState"/> stays
+/// id-only (the #368 headless-bot-observes-the-same-owner contract); this
+/// resolver is the App-layer seam CT3 (Titles page) and CT4 (header
+/// identity line) consume for display strings.
+/// </para>
+/// </remarks>
+public sealed class CharacterTitleResolver
+{
+    /// <summary>EnumMapper DID — title id -&gt; canonical key name (e.g.
+    /// "ID_CharacterTitle_War_Mage").</summary>
+    public const uint TitleEnumMapperId = 0x22000041u;
+
+    /// <summary>StringTable DID — canonical key hash -&gt; localized text.</summary>
+    public const uint TitleStringTableId = 0x2300000Eu;
+
+    private readonly IDatReaderWriter _dats;
+    private readonly DatStringResolver _strings;
+    private EnumMapper? _titleEnumMapper;
+    private bool _loadedMapper;
+
+    public CharacterTitleResolver(IDatReaderWriter dats)
+    {
+        _dats = dats ?? throw new ArgumentNullException(nameof(dats));
+        _strings = new DatStringResolver(dats);
+    }
+
+    /// <summary>
+    /// Resolves one title id to its localized display string. Returns null
+    /// for id 0 (retail's own early-return in
+    /// <c>GetCharacterTitleFromID</c>), an id absent from the EnumMapper, or
+    /// an unlocalized string — matching
+    /// <see cref="DatStringResolver.Resolve(uint, uint, int)"/>'s own
+    /// null-on-miss contract.
+    /// </summary>
+    public string? Resolve(uint titleId)
+    {
+        if (titleId == 0u)
+            return null;
+
+        if (!_loadedMapper)
+        {
+            _dats.Portal.TryGet<EnumMapper>(TitleEnumMapperId, out _titleEnumMapper);
+            _loadedMapper = true;
+        }
+
+        if (_titleEnumMapper is null
+            || !_titleEnumMapper.IdToStringMap.TryGetValue(titleId, out var rawNameValue))
+        {
+            return null;
+        }
+
+        string rawName = rawNameValue.ToString();
+        if (string.IsNullOrEmpty(rawName))
+            return null;
+
+        return _strings.Resolve(TitleStringTableId, DatStringResolver.ComputeHash(rawName));
+    }
+}

src/AcDream.Core.Net/GameEventWiring.cs

@@ -138,7 +138,15 @@ public static class GameEventWiring
         // in GameEventType since the wire catalog with nothing behind them,
         // so until this wiring the bytes arrived and were dropped.
         Action<IReadOnlyDictionary<uint, ContractTracker>>? onContractTable = null,
-        Action<ContractTrackerUpdate>? onContractUpdate = null)
+        Action<ContractTrackerUpdate>? onContractUpdate = null,
+        // Campaign CT slice CT2 (2026-08-24): the title-table (0x0029) and
+        // add/set-display (0x002B) delegate holes. RuntimeCharacterState.
+        // Titles is an AcDream.Runtime type — Core.Net cannot reference
+        // AcDream.Runtime directly, so these are delegate holes exactly like
+        // every other Runtime-owned sink above. Optional/nullable so every
+        // existing caller compiles unchanged.
+        Action<uint /*displayTitleId*/, IReadOnlyList<uint> /*titleIds*/>? onCharacterTitleTable = null,
+        Action<uint /*titleId*/, bool /*setAsDisplay*/>? onUpdateTitle = null)
     {
         ArgumentNullException.ThrowIfNull(dispatcher);
         ArgumentNullException.ThrowIfNull(items);
@@ -474,6 +482,24 @@ public static class GameEventWiring
             });
         }
 
+        // ── Character titles (Campaign CT slice CT2, 2026-08-24) ────────
+        if (onCharacterTitleTable is not null)
+        {
+            registrar.Register(GameEventType.CharacterTitle, e =>
+            {
+                var p = GameEvents.ParseCharacterTitleTable(e.Payload.Span);
+                if (p is not null) onCharacterTitleTable(p.Value.DisplayTitleId, p.Value.TitleIds);
+            });
+        }
+        if (onUpdateTitle is not null)
+        {
+            registrar.Register(GameEventType.UpdateTitle, e =>
+            {
+                var p = GameEvents.ParseUpdateTitle(e.Payload.Span);
+                if (p is not null) onUpdateTitle(p.Value.TitleId, p.Value.SetAsDisplay);
+            });
+        }
+
         if (onConfirmationRequest is not null)
         {
             registrar.Register(GameEventType.CharacterConfirmationRequest, e =>

src/AcDream.Core.Net/Messages/GameEvents.cs

@@ -869,6 +869,73 @@ public static class GameEvents
     public static FellowshipFellowStatsDone ParseFellowshipFellowStatsDone(ReadOnlySpan<byte> payload)
         => new(payload.Length >= 4 ? BinaryPrimitives.ReadUInt32LittleEndian(payload) : null);
 
+    // ── Character titles (Campaign CT slice CT2, 2026-08-24) ────────────────
+
+    /// <summary>
+    /// <c>0x0029 CharacterTitle</c> — retail <c>CharacterTitleTable::UnPack
+    /// @0x005c6e90</c> (named-retail pseudo-C offset 471514-471526). The
+    /// FIRST u32 is advanced past but never stored into any field — retail's
+    /// own <c>CharacterTitleTable::Pack @0x005c6e40</c> (offset 471494-471510)
+    /// always writes the literal constant <c>1</c> there
+    /// (<c>**(uint32_t**)arg2 = 1</c>), and ACE's
+    /// <c>GameEventCharacterTitle.cs</c> matches with an unconditional
+    /// <c>Writer.Write(1u)</c> — a version/format tag retail itself discards
+    /// on read, not meaningful gameplay data (CT2 task item 1). Then the
+    /// current display title id (<c>mDisplayTitle</c>), then the
+    /// count-prefixed <c>PList&lt;uint&gt;</c> of every earned title id
+    /// (<c>mTitleList</c>).
+    /// </summary>
+    public readonly record struct CharacterTitleTable(
+        uint DisplayTitleId,
+        IReadOnlyList<uint> TitleIds);
+
+    public static CharacterTitleTable? ParseCharacterTitleTable(ReadOnlySpan<byte> payload)
+    {
+        try
+        {
+            int pos = 0;
+            _ = FellowshipReadU32(payload, ref pos); // discarded pack-version tag — see doc comment above
+            uint displayTitleId = FellowshipReadU32(payload, ref pos);
+            uint count = FellowshipReadU32(payload, ref pos);
+            // PList<uint>::UnPack stores a 32-bit count bounded only by the
+            // remaining packet — same generous guard as
+            // SocialStateMessages.ParseFriendsUpdate.
+            if (count > 65_536) return null;
+            var titleIds = new uint[count];
+            for (int i = 0; i < titleIds.Length; i++)
+                titleIds[i] = FellowshipReadU32(payload, ref pos);
+            return new CharacterTitleTable(displayTitleId, titleIds);
+        }
+        catch (FormatException) { return null; }
+    }
+
+    /// <summary>
+    /// <c>0x002B UpdateTitle</c> — retail's dispatch entry
+    /// <c>CM_Social::DispatchUI_AddOrSetCharacterTitle @0x006a54c0</c> reads
+    /// exactly <c>titleId</c> then <c>setAsDisplay</c> and forwards to
+    /// <c>ClientUISystem::Handle_Social__AddOrSetCharacterTitle
+    /// @0x00564260</c>, which ALWAYS broadcasts
+    /// <c>SendNotice_AddCharacterTitle(titleId)</c> (a title just earned is
+    /// unconditionally added to the earned set) and, only when
+    /// <c>setAsDisplay != 0</c>, ALSO broadcasts
+    /// <c>SendNotice_SetDisplayCharacterTitle(titleId)</c>. ACE's
+    /// <c>GameEventUpdateTitle.cs</c>: <c>u32 title, u32
+    /// setAsDisplayTitle</c> — matches exactly.
+    /// </summary>
+    public readonly record struct UpdateTitle(uint TitleId, bool SetAsDisplay);
+
+    public static UpdateTitle? ParseUpdateTitle(ReadOnlySpan<byte> payload)
+    {
+        try
+        {
+            int pos = 0;
+            uint titleId = FellowshipReadU32(payload, ref pos);
+            bool setAsDisplay = FellowshipReadU32(payload, ref pos) != 0u;
+            return new UpdateTitle(titleId, setAsDisplay);
+        }
+        catch (FormatException) { return null; }
+    }
+
     private static FellowMember ReadFellow(ReadOnlySpan<byte> payload, ref int pos, uint guid)
     {
         uint cpCache = FellowshipReadU32(payload, ref pos);

src/AcDream.Core.Net/Messages/SocialActions.cs

@@ -52,6 +52,16 @@ public static class SocialActions
     public const uint FellowshipAssignNewLeaderOpcode = 0x0290u; // u32 newLeaderGuid
     public const uint FellowshipChangeOpennessOpcode  = 0x0291u; // u32 isOpen (0/1) — the REAL openness toggle
 
+    // Character titles (Campaign CT slice CT2, 2026-08-24). ACE
+    // GameActionType.TitleSet = 0x002C; GameActionSetTitle.cs reads exactly
+    // one u32 title id (session.Player.HandleActionSetTitle(title)). Retail
+    // sender CM_Social::Event_SetDisplayCharacterTitle @0x006a5720 (verified
+    // in the named pseudo-C): builds a 0x10-byte OrderHdr'd body whose
+    // payload is [u32 0x2c][u32 titleId] and sends via
+    // Proto_UI::SendToWeenie — no local state touched (see CT2's report: no
+    // optimistic mutation, matching this slice's CA-lesson design).
+    public const uint TitleSetOpcode = 0x002Cu; // u32 titleId
+
     // Character options
     // CH3 (2026-08-09): the full-blob SetCharacterOptions (0x01A1) builder
     // and the string-payload AddChannel/RemoveChannel (0x0145/0x0146)
@@ -230,6 +240,17 @@ public static class SocialActions
         return body;
     }
 
+    /// <summary>
+    /// Set the character's display title — <c>0x002C TitleSet</c>. Retail's
+    /// <c>Event_SetDisplayCharacterTitle</c> sends this and touches NO local
+    /// state; the display title updates only when the server echoes back
+    /// <c>UpdateTitle (0x002B)</c> with <c>setAsDisplay=true</c> (CT2: no
+    /// optimistic local mutation, matching retail exactly — the CA-campaign
+    /// lesson never re-add one).
+    /// </summary>
+    public static byte[] BuildTitleSet(uint seq, uint titleId)
+        => SingleGuid(seq, TitleSetOpcode, titleId);
+
     /// <summary>
     /// Toggle one character option and push it to the server.
     /// <c>GameActionSetSingleCharacterOption @ GameActionType 0x0005</c> —

src/AcDream.Core.Net/WorldSession.cs

@@ -2719,6 +2719,18 @@ public sealed class WorldSession : IDisposable
             spellbookFilters));
     }
 
+    /// <summary>
+    /// Send retail <c>TitleSet (0x002C)</c> — sets the character's display
+    /// title. Sends only; no local state changes here (Campaign CT slice
+    /// CT2: retail's own send path is non-optimistic — see
+    /// <see cref="SocialActions.BuildTitleSet"/>).
+    /// </summary>
+    public void SendSetTitle(uint titleId)
+    {
+        uint seq = NextGameActionSequence();
+        SendGameAction(SocialActions.BuildTitleSet(seq, titleId));
+    }
+
     public void SendAddFriend(string name)
     {
         uint seq = NextGameActionSequence();

src/AcDream.Runtime/GameRuntimeCommands.cs

@@ -268,6 +268,19 @@ public interface IRuntimeCharacterCommands
     /// production call sites — Apply, logout — pass <c>force = 0</c>).
     /// </summary>
     RuntimeCommandResult SaveOptions(RuntimeGenerationToken expectedGeneration);
+
+    /// <summary>
+    /// Retail <c>TitleSet (GameActionType 0x002C)</c> — sets the character's
+    /// display title (Campaign CT slice CT2, 2026-08-24;
+    /// <c>CM_Social::Event_SetDisplayCharacterTitle @0x006a5720</c>). Sends
+    /// only — no optimistic local mutation. The display title updates when
+    /// the server echoes <c>UpdateTitle (0x002B)</c> with
+    /// <c>setAsDisplay=true</c>, or the next <c>CharacterTitle (0x0029)</c>
+    /// table arrives, through <c>RuntimeCharacterState.Titles</c>.
+    /// </summary>
+    RuntimeCommandResult SetTitle(
+        RuntimeGenerationToken expectedGeneration,
+        uint titleId);
 }
 
 public enum RuntimeFriendCommandKind

src/AcDream.Runtime/GameRuntimeGameplayViews.cs

@@ -42,7 +42,11 @@ public readonly record struct RuntimeCharacterSnapshot(
     int ActiveEnchantmentCount,
     int DesiredComponentCount,
     int SkillCount,
-    uint SpellbookFilters);
+    uint SpellbookFilters,
+    // Campaign CT slice CT2 (2026-08-24): trailing/optional so every
+    // existing positional caller (GameRuntimeContractTests) compiles
+    // unchanged.
+    RuntimeCharacterTitleSnapshot Titles = default);
 
 public readonly record struct RuntimeVitalSnapshot(
     int Kind,

src/AcDream.Runtime/Gameplay/RuntimeCharacterState.cs

@@ -30,7 +30,18 @@ public readonly record struct RuntimeCharacterOwnershipSnapshot(
     /// still set — the ledger exists precisely to catch state a reset must
     /// clear but a value-only comparison would miss.
     /// </summary>
-    bool OptionsAreClean = true)
+    bool OptionsAreClean = true,
+    /// <summary>
+    /// Campaign CT slice CT2 (2026-08-24): the earned-title set's count —
+    /// zero when <see cref="RuntimeCharacterState.Titles"/> has never
+    /// received a table and after every reset.
+    /// </summary>
+    int TitleCount = 0,
+    /// <summary>
+    /// CT2: <c>Titles.DisplayTitleId == 0</c> — the client-constructor
+    /// default (no display title id known yet).
+    /// </summary>
+    bool DisplayTitleIsDefault = true)
 {
     public bool IsConverged =>
         IsDisposed
@@ -47,7 +58,9 @@ public readonly record struct RuntimeCharacterOwnershipSnapshot(
         && OptionsAreDefaults
         && MovementSkillsAreReset
         && AutonomyIsDefault
-        && OptionsAreClean;
+        && OptionsAreClean
+        && TitleCount == 0
+        && DisplayTitleIsDefault;
 }
 
 /// <summary>
@@ -104,6 +117,7 @@ public sealed class RuntimeCharacterState : IDisposable
         LocalPlayer = new LocalPlayerState(Spellbook);
         Options = new RuntimeCharacterOptionsState(timeProvider);
         MovementSkills = new RuntimeMovementSkillState();
+        Titles = new RuntimeCharacterTitleState();
         View = new CharacterView(this);
         Spellbook.StateChanged += OnSpellbookChanged;
         Spellbook.EnchantmentsChanged += OnEnchantmentsChangedForMovement;
@@ -117,6 +131,11 @@ public sealed class RuntimeCharacterState : IDisposable
     public LocalPlayerState LocalPlayer { get; }
     public RuntimeCharacterOptionsState Options { get; }
     public RuntimeMovementSkillState MovementSkills { get; }
+    /// <summary>Campaign CT slice CT2 (2026-08-24): earned titles + current
+    /// display title (retail's <c>CharacterTitleTable</c>). Id-only —
+    /// display-string resolution is an App-layer concern
+    /// (<c>CharacterTitleResolver</c>).</summary>
+    public RuntimeCharacterTitleState Titles { get; }
     public IRuntimeCharacterView View { get; }
     public bool IsDisposed => _disposed;
 
@@ -232,7 +251,9 @@ public sealed class RuntimeCharacterState : IDisposable
                 && _jumpSkillBase == -1
                 && _movementSkillAugmentations == default,
             AutonomyLevel == FullAutonomyLevel,
-            OptionsAreClean: !Options.IsDirty);
+            OptionsAreClean: !Options.IsDirty,
+            TitleCount: Titles.EarnedTitleIds.Count,
+            DisplayTitleIsDefault: Titles.DisplayTitleId == 0u);
     }
 
     /// <summary>
@@ -445,6 +466,7 @@ public sealed class RuntimeCharacterState : IDisposable
         _movementSkillAugmentations = default;
         Volatile.Write(ref _autonomyLevel, FullAutonomyLevel);
         Try(MovementSkills.ResetSession, ref failures);
+        Try(Titles.ResetSession, ref failures);
         if (failures is not null)
         {
             throw new AggregateException(
@@ -471,6 +493,7 @@ public sealed class RuntimeCharacterState : IDisposable
             _movementSkillAugmentations = default;
             Volatile.Write(ref _autonomyLevel, FullAutonomyLevel);
             Try(MovementSkills.ResetSession, ref failures);
+            Try(Titles.ResetSession, ref failures);
         }
         finally
         {
@@ -526,7 +549,8 @@ public sealed class RuntimeCharacterState : IDisposable
             owner.Spellbook.ActiveEnchantments.Count(),
             owner.Spellbook.DesiredComponents.Count,
             owner.LocalPlayer.Skills.Count,
-            owner.Spellbook.SpellbookFilters);
+            owner.Spellbook.SpellbookFilters,
+            owner.Titles.Snapshot);
 
         public bool TryGetVital(int kind, out RuntimeVitalSnapshot vital)
         {
@@ -1189,3 +1213,125 @@ public sealed class RuntimeMovementSkillState
         Interlocked.Increment(ref _revision);
     }
 }
+
+public readonly record struct RuntimeCharacterTitleSnapshot(
+    uint DisplayTitleId,
+    int TitleCount,
+    long Revision);
+
+/// <summary>
+/// Campaign CT slice CT2 (2026-08-24): retail's <c>CharacterTitleTable</c>
+/// (<c>mDisplayTitle</c> + <c>mTitleList</c>) ported into
+/// <see cref="RuntimeCharacterState"/>'s existing options/movement-skill
+/// sibling-owner shape. Two inbound wire events populate this: the full
+/// table (<c>0x0029 CharacterTitle</c>, <see cref="ReplaceTable"/>) and the
+/// incremental add/set-display notice (<c>0x002B UpdateTitle</c>,
+/// <see cref="ApplyUpdateTitle"/>). Runtime stays id-only — display-string
+/// resolution (EnumMapper -&gt; hash -&gt; StringTable,
+/// <c>CharacterTitleTable::GetCharacterTitleFromID @0x005c6ed0</c>) is an
+/// App-layer concern (<c>AcDream.App.UI.Layout.CharacterTitleResolver</c>),
+/// matching this class's presentation-independent contract and the #368
+/// headless-bot-observes-the-same-owner rule. Outbound
+/// <c>TitleSet (0x002C)</c> never mutates this state locally — retail's own
+/// <c>Event_SetDisplayCharacterTitle</c> send path touches no local field;
+/// the display title changes only when the server echoes back
+/// <c>UpdateTitle</c> (never re-add an optimistic write here — the CA
+/// campaign lesson).
+/// </summary>
+public sealed class RuntimeCharacterTitleState
+{
+    private readonly object _gate = new();
+    private readonly HashSet<uint> _earnedTitleIds = new();
+    private uint _displayTitleId;
+    private long _revision;
+
+    /// <summary>Fires after a full <c>0x0029 CharacterTitle</c> table replace.</summary>
+    public event Action? TableReplaced;
+
+    /// <summary>
+    /// Fires once per <c>0x002B UpdateTitle</c> arrival, UNCONDITIONALLY —
+    /// matches retail's own <c>SendNotice_AddCharacterTitle</c>, which
+    /// broadcasts regardless of whether the id was already in the earned
+    /// set. Carries the added title id.
+    /// </summary>
+    public event Action<uint>? TitleAdded;
+
+    /// <summary>
+    /// Fires whenever the display title id changes — from either a fresh
+    /// <c>0x0029</c> table (a differing seed) or an <c>0x002B</c> whose
+    /// <c>setAsDisplay</c> flag is set. Carries the NEW display title id.
+    /// </summary>
+    public event Action<uint>? DisplayTitleChanged;
+
+    public uint DisplayTitleId => Volatile.Read(ref _displayTitleId);
+    public long Revision => Interlocked.Read(ref _revision);
+
+    public IReadOnlyCollection<uint> EarnedTitleIds
+    {
+        get { lock (_gate) return _earnedTitleIds.ToArray(); }
+    }
+
+    public bool HasEarnedTitle(uint titleId)
+    {
+        lock (_gate) return _earnedTitleIds.Contains(titleId);
+    }
+
+    public RuntimeCharacterTitleSnapshot Snapshot
+    {
+        get
+        {
+            int count;
+            lock (_gate) count = _earnedTitleIds.Count;
+            return new RuntimeCharacterTitleSnapshot(DisplayTitleId, count, Revision);
+        }
+    }
+
+    /// <summary>
+    /// <c>0x0029 CharacterTitle</c> — a WHOLESALE authoritative replace
+    /// (retail's <c>CharacterTitleTable::UnPack</c> always rebuilds
+    /// <c>mTitleList</c> from scratch; there is no incremental-merge path
+    /// on this opcode).
+    /// </summary>
+    public void ReplaceTable(uint displayTitleId, IReadOnlyList<uint> titleIds)
+    {
+        ArgumentNullException.ThrowIfNull(titleIds);
+        lock (_gate)
+        {
+            _earnedTitleIds.Clear();
+            foreach (uint id in titleIds)
+                _earnedTitleIds.Add(id);
+        }
+        bool displayChanged = DisplayTitleId != displayTitleId;
+        Volatile.Write(ref _displayTitleId, displayTitleId);
+        Interlocked.Increment(ref _revision);
+        TableReplaced?.Invoke();
+        if (displayChanged)
+            DisplayTitleChanged?.Invoke(displayTitleId);
+    }
+
+    /// <summary>
+    /// <c>0x002B UpdateTitle</c> — retail's
+    /// <c>ClientUISystem::Handle_Social__AddOrSetCharacterTitle</c>: ALWAYS
+    /// add, and additionally set-display only when
+    /// <paramref name="setAsDisplay"/> is true.
+    /// </summary>
+    public void ApplyUpdateTitle(uint titleId, bool setAsDisplay)
+    {
+        lock (_gate) _earnedTitleIds.Add(titleId);
+        Interlocked.Increment(ref _revision);
+        TitleAdded?.Invoke(titleId);
+        if (setAsDisplay)
+        {
+            Volatile.Write(ref _displayTitleId, titleId);
+            Interlocked.Increment(ref _revision);
+            DisplayTitleChanged?.Invoke(titleId);
+        }
+    }
+
+    public void ResetSession()
+    {
+        lock (_gate) _earnedTitleIds.Clear();
+        Volatile.Write(ref _displayTitleId, 0u);
+        Interlocked.Increment(ref _revision);
+    }
+}

src/AcDream.Runtime/Session/DirectGameRuntimeCommandAdapter.cs

@@ -723,6 +723,33 @@ public sealed class DirectGameRuntimeCommandAdapter
             RuntimeCommandStatus.Accepted);
     }
 
+    public RuntimeCommandResult SetTitle(
+        RuntimeGenerationToken expectedGeneration,
+        uint titleId)
+    {
+        RuntimeCommandStatus gate =
+            Validate(expectedGeneration, out WorldSession? session);
+        if (gate != RuntimeCommandStatus.Accepted)
+            return Result(gate);
+        if (titleId == 0u)
+        {
+            return EmitResult(
+                RuntimeCommandDomain.Character,
+                operation: 6,
+                RuntimeCommandStatus.Rejected);
+        }
+        // CT2: NO optimistic local mutation — retail's own
+        // Event_SetDisplayCharacterTitle send path touches no local state;
+        // RuntimeCharacterState.Titles.DisplayTitleId updates only when the
+        // server echoes UpdateTitle (0x002B) with setAsDisplay=true.
+        session!.SendSetTitle(titleId);
+        return EmitResult(
+            RuntimeCommandDomain.Character,
+            operation: 6,
+            RuntimeCommandStatus.Accepted,
+            titleId);
+    }
+
     public RuntimeCommandResult Execute(
         RuntimeGenerationToken expectedGeneration,
         in RuntimeFriendCommand command)

src/AcDream.Runtime/Session/LiveSessionEventRouter.cs

@@ -345,7 +345,16 @@ public sealed class LiveSessionEventRouter : ILiveSessionEventRouting
                     : null,
                 onContractUpdate: social.Contracts is { } contractUpdate
                     ? contractUpdate.ApplyUpdate
-                    : null));
+                    : null,
+                // Campaign CT slice CT2 (2026-08-24): RuntimeCharacterState.
+                // Titles is a required child of the required `character.
+                // Character` owner (not an optional sibling like Fellowship/
+                // Allegiance/Trade/House above), so these are wired
+                // unconditionally.
+                onCharacterTitleTable: (displayTitleId, titleIds) =>
+                    character.Character.Titles.ReplaceTable(displayTitleId, titleIds),
+                onUpdateTitle: (titleId, setAsDisplay) =>
+                    character.Character.Titles.ApplyUpdateTitle(titleId, setAsDisplay)));
             ConstructionCheckpoint();
 
             // Campaign P Slice P1 (2026-07-30): burden recompute triggers —

tests/AcDream.App.Tests/Composition/InteractionUiRuntimeSourcesTests.cs

@@ -436,6 +436,11 @@ public sealed class InteractionUiRuntimeSourcesTests
             RuntimeGenerationToken expectedGeneration) =>
             Accepted(expectedGeneration);
 
+        public RuntimeCommandResult SetTitle(
+            RuntimeGenerationToken expectedGeneration,
+            uint titleId) =>
+            Accepted(expectedGeneration, titleId);
+
         private RuntimeCommandResult Accepted(
             RuntimeGenerationToken generation,
             uint objectId = 0u)

tests/AcDream.App.Tests/Net/LiveSessionCommandRouterTests.cs

@@ -728,7 +728,8 @@ public sealed class LiveSessionCommandRouterTests
         RuntimeCommunicationState? communication = null,
         RuntimeCharacterState? characterState = null,
         Action<uint, bool>? sendSingleCharacterOption = null,
-        Action? saveCharacterOptions = null) => new(
+        Action? saveCharacterOptions = null,
+        Action<uint>? sendSetTitle = null) => new(
         new LiveSessionCommandBindings(
             clientBindings ?? NewClientBindings(),
             chat ?? new ChatLog(),
@@ -767,6 +768,7 @@ public sealed class LiveSessionCommandRouterTests
             CharacterState: characterState ?? new RuntimeCharacterState(),
             SendSingleCharacterOption: sendSingleCharacterOption ?? ((_, _) => { }),
             SaveCharacterOptions: saveCharacterOptions ?? (() => { }),
+            SendSetTitle: sendSetTitle ?? (_ => { }),
             SendFellowshipCreate: (_, _) => { },
             SendFellowshipRecruit: _ => { },
             SendFellowshipDismiss: _ => { },

tests/AcDream.App.Tests/UI/Layout/CharacterTitleResolverLiveDatTests.cs

@@ -0,0 +1,68 @@
+using AcDream.App.UI.Layout;
+using AcDream.Content;
+using DatReaderWriter;
+
+namespace AcDream.App.Tests.UI.Layout;
+
+/// <summary>
+/// Campaign CT slice CT2 (2026-08-24) pin: <see cref="CharacterTitleResolver"/>
+/// against the installed DAT set, end to end (EnumMapper 0x22000041 -&gt;
+/// compute_str_hash -&gt; StringTable 0x2300000E). CT1's research doc
+/// (docs/research/2026-08-24-campaign-ct-dat-ground-truth.md §5) verified
+/// id 13 == "War Mage" against ACE's <c>CharacterTitle.WarMage</c>; this
+/// pin adds several more low-ordinal ids from the same enum
+/// (<c>CharacterTitle.cs</c>: Invalid=0, Adventurer=1, Archer=2,
+/// Blademaster=3, LifeMage=5, Wayfarer=14) so a DAT revision or resolver
+/// regression fails loudly instead of drifting unnoticed into CT3/CT4.
+/// Follows the durable-pin pattern of <see cref="ChatStringsLiveDatTests"/>.
+/// </summary>
+[Trait("Lane", "InstalledDat")]
+public sealed class CharacterTitleResolverLiveDatTests
+{
+    private static string DatDirectory =>
+        Path.Combine(
+            System.Environment.GetFolderPath(System.Environment.SpecialFolder.UserProfile),
+            "Documents", "Asheron's Call");
+
+    [InstalledDatFact]
+    public void Resolve_PinsSeveralTitleIdsToTheirRetailDisplayStrings()
+    {
+        using var dats = new DatCollection(DatDirectory, DatReaderWriter.Options.DatAccessType.Read);
+        var resolver = new CharacterTitleResolver(new DatCollectionAdapter(dats));
+
+        // Retail's own early-return: id 0 (Invalid) never resolves.
+        Assert.Null(resolver.Resolve(0u));
+
+        Assert.Equal("Adventurer", resolver.Resolve(1u));
+        Assert.Equal("Archer", resolver.Resolve(2u));
+        Assert.Equal("Blademaster", resolver.Resolve(3u));
+        Assert.Equal("Life Mage", resolver.Resolve(5u));
+        Assert.Equal("War Mage", resolver.Resolve(13u));
+        Assert.Equal("Wayfarer", resolver.Resolve(14u));
+    }
+
+    [InstalledDatFact]
+    public void Resolve_UnmappedId_ReturnsNull()
+    {
+        using var dats = new DatCollection(DatDirectory, DatReaderWriter.Options.DatAccessType.Read);
+        var resolver = new CharacterTitleResolver(new DatCollectionAdapter(dats));
+
+        Assert.Null(resolver.Resolve(0xFFFFFFFEu));
+    }
+
+    [InstalledDatFact]
+    public void Resolve_CachesTheEnumMapperAcrossCalls()
+    {
+        // Not a durable behavioral pin — just confirms the lazy-load path
+        // used by the assertions above resolves the SAME value on a second
+        // call (the cached-mapper branch), not only on the first (cold) one.
+        using var dats = new DatCollection(DatDirectory, DatReaderWriter.Options.DatAccessType.Read);
+        var resolver = new CharacterTitleResolver(new DatCollectionAdapter(dats));
+
+        string? first = resolver.Resolve(13u);
+        string? second = resolver.Resolve(13u);
+
+        Assert.Equal("War Mage", first);
+        Assert.Equal(first, second);
+    }
+}

tests/AcDream.Core.Net.Tests/Messages/CharacterTitleEventsTests.cs

@@ -0,0 +1,137 @@
+using System;
+using AcDream.Core.Net.Messages;
+using Xunit;
+
+namespace AcDream.Core.Net.Tests.Messages;
+
+/// <summary>
+/// Campaign CT slice CT2 (2026-08-24): golden-vector round-trip tests for
+/// the two character-title S→C parsers added to <see cref="GameEvents"/>.
+/// Fixtures are built with <see cref="AceWireWriter"/> (the ACE-mirror
+/// writer) so a pass proves agreement with ACE's own
+/// <c>GameEventCharacterTitle.cs</c> / <c>GameEventUpdateTitle.cs</c>
+/// writer shapes, not just with itself.
+/// </summary>
+public sealed class CharacterTitleEventsTests
+{
+    // ── 0x0029 CharacterTitle ────────────────────────────────────────────
+
+    [Fact]
+    public void ParseCharacterTitleTable_RoundTrips_DiscardsLeadingVersionTag()
+    {
+        byte[] wire = new AceWireWriter()
+            .Write(1u)          // ACE's literal pack-version tag — must be discarded
+            .Write(13u)         // displayTitleId
+            .Write(3u)          // count
+            .Write(1u)
+            .Write(5u)
+            .Write(13u)
+            .ToArray();
+
+        GameEvents.CharacterTitleTable? table = GameEvents.ParseCharacterTitleTable(wire);
+
+        Assert.NotNull(table);
+        Assert.Equal(13u, table!.Value.DisplayTitleId);
+        Assert.Equal(new uint[] { 1u, 5u, 13u }, table.Value.TitleIds);
+    }
+
+    [Fact]
+    public void ParseCharacterTitleTable_IgnoresNonOneLeadingTag()
+    {
+        // Retail's own UnPack never reads the leading dword into any field —
+        // it is advanced past unconditionally. A hostile/odd server value
+        // there must not change the parse outcome.
+        byte[] wire = new AceWireWriter()
+            .Write(0xDEADBEEFu)
+            .Write(7u)
+            .Write(0u) // empty title list
+            .ToArray();
+
+        GameEvents.CharacterTitleTable? table = GameEvents.ParseCharacterTitleTable(wire);
+
+        Assert.NotNull(table);
+        Assert.Equal(7u, table!.Value.DisplayTitleId);
+        Assert.Empty(table.Value.TitleIds);
+    }
+
+    [Fact]
+    public void ParseCharacterTitleTable_EmptyTitleList_RoundTrips()
+    {
+        byte[] wire = new AceWireWriter()
+            .Write(1u)
+            .Write(0u)  // displayTitleId — no display title yet
+            .Write(0u)  // count
+            .ToArray();
+
+        GameEvents.CharacterTitleTable? table = GameEvents.ParseCharacterTitleTable(wire);
+
+        Assert.NotNull(table);
+        Assert.Equal(0u, table!.Value.DisplayTitleId);
+        Assert.Empty(table.Value.TitleIds);
+    }
+
+    [Theory]
+    [InlineData(0)]  // empty payload
+    [InlineData(4)]  // only the leading tag
+    [InlineData(8)]  // leading tag + displayTitleId, missing count
+    public void ParseCharacterTitleTable_TruncatedHeader_ReturnsNull(int length)
+    {
+        byte[] wire = new byte[length];
+        Assert.Null(GameEvents.ParseCharacterTitleTable(wire));
+    }
+
+    [Fact]
+    public void ParseCharacterTitleTable_CountExceedsAvailableTitleIds_ReturnsNull()
+    {
+        byte[] wire = new AceWireWriter()
+            .Write(1u)
+            .Write(1u)
+            .Write(2u)  // count says 2 title ids follow
+            .Write(1u)  // only 1 is actually present
+            .ToArray();
+
+        Assert.Null(GameEvents.ParseCharacterTitleTable(wire));
+    }
+
+    // ── 0x002B UpdateTitle ───────────────────────────────────────────────
+
+    [Theory]
+    [InlineData(0u, false)]
+    [InlineData(13u, true)]
+    public void ParseUpdateTitle_RoundTrips(uint titleId, bool setAsDisplay)
+    {
+        byte[] wire = new AceWireWriter()
+            .Write(titleId)
+            .Write(setAsDisplay ? 1u : 0u)
+            .ToArray();
+
+        GameEvents.UpdateTitle? update = GameEvents.ParseUpdateTitle(wire);
+
+        Assert.NotNull(update);
+        Assert.Equal(titleId, update!.Value.TitleId);
+        Assert.Equal(setAsDisplay, update.Value.SetAsDisplay);
+    }
+
+    [Fact]
+    public void ParseUpdateTitle_NonZeroSetAsDisplay_IsTrue()
+    {
+        // ACE writes Convert.ToUInt32(bool) (always 0 or 1), but retail's own
+        // dispatch reads `!= 0`, not `== 1` — a non-1 truthy value must still
+        // resolve true.
+        byte[] wire = new AceWireWriter().Write(5u).Write(0xFFu).ToArray();
+
+        GameEvents.UpdateTitle? update = GameEvents.ParseUpdateTitle(wire);
+
+        Assert.NotNull(update);
+        Assert.True(update!.Value.SetAsDisplay);
+    }
+
+    [Theory]
+    [InlineData(0)]
+    [InlineData(4)] // only titleId, missing setAsDisplay
+    public void ParseUpdateTitle_Truncated_ReturnsNull(int length)
+    {
+        byte[] wire = new byte[length];
+        Assert.Null(GameEvents.ParseUpdateTitle(wire));
+    }
+}

tests/AcDream.Core.Net.Tests/Messages/SocialActionsTests.cs

@@ -378,4 +378,31 @@ public sealed class SocialActionsTests
         Assert.Contains((0x68000002u, 3u), parsed.Value.DesiredComps);
         Assert.Contains((0x68000003u, 7u), parsed.Value.DesiredComps);
     }
+
+    // ── Campaign CT slice CT2 (2026-08-24): TitleSet (0x002C) ────────────────
+
+    [Fact]
+    public void BuildTitleSet_GoldenByteVector()
+    {
+        byte[] body = SocialActions.BuildTitleSet(seq: 7, titleId: 13u);
+
+        byte[] expected =
+        [
+            0xB1, 0xF7, 0x00, 0x00, // envelope 0xF7B1
+            0x07, 0x00, 0x00, 0x00, // seq 7
+            0x2C, 0x00, 0x00, 0x00, // opcode 0x002C TitleSet
+            0x0D, 0x00, 0x00, 0x00, // titleId 13
+        ];
+        Assert.Equal(expected, body);
+    }
+
+    [Fact]
+    public void BuildTitleSet_HasOpcodeAndTitleId()
+    {
+        byte[] body = SocialActions.BuildTitleSet(seq: 1, titleId: 0xBEEFu);
+        Assert.Equal(SocialActions.TitleSetOpcode,
+            BinaryPrimitives.ReadUInt32LittleEndian(body.AsSpan(8)));
+        Assert.Equal(0xBEEFu,
+            BinaryPrimitives.ReadUInt32LittleEndian(body.AsSpan(12)));
+    }
 }

tests/AcDream.Headless.Tests/HeadlessCharacterOptionsSeederTests.cs

@@ -285,5 +285,11 @@ public sealed class HeadlessCharacterOptionsSeederTests
                 RuntimeCommandStatus.Accepted,
                 expectedGeneration);
         }
+
+        public RuntimeCommandResult SetTitle(
+            RuntimeGenerationToken expectedGeneration,
+            uint titleId) =>
+            throw new NotSupportedException(
+                "HeadlessCharacterOptionsSeeder never calls SetTitle.");
     }
 }

tests/AcDream.Runtime.Tests/Gameplay/RuntimeCharacterStateTests.cs

@@ -3,6 +3,7 @@ using AcDream.Core.Net.Messages;
 using AcDream.Core.Properties;
 using AcDream.Core.Spells;
 using AcDream.Core.Player;
+using AcDream.Runtime;
 using AcDream.Runtime.Gameplay;
 
 namespace AcDream.Runtime.Tests.Gameplay;
@@ -1051,6 +1052,61 @@ public sealed class RuntimeCharacterStateTests
         Assert.True(state.CaptureOwnership().AutonomyIsDefault);
     }
 
+    // ── Campaign CT slice CT2 (2026-08-24): Titles owner integration ─────
+
+    [Fact]
+    public void Titles_IsOwnedAsASiblingOfOptionsAndMovementSkills()
+    {
+        using var state = new RuntimeCharacterState();
+
+        state.Titles.ReplaceTable(13u, [1u, 5u, 13u]);
+
+        Assert.Equal(13u, state.Titles.DisplayTitleId);
+        Assert.Equal(3, state.Titles.EarnedTitleIds.Count);
+        Assert.Equal(3, state.CaptureOwnership().TitleCount);
+        Assert.False(state.CaptureOwnership().DisplayTitleIsDefault);
+    }
+
+    [Fact]
+    public void ResetSession_ClearsTitles()
+    {
+        using var state = new RuntimeCharacterState();
+        state.Titles.ReplaceTable(13u, [1u, 5u, 13u]);
+
+        state.ResetSession();
+
+        Assert.Equal(0u, state.Titles.DisplayTitleId);
+        Assert.Empty(state.Titles.EarnedTitleIds);
+        Assert.True(state.CaptureOwnership().TitleCount == 0);
+        Assert.True(state.CaptureOwnership().DisplayTitleIsDefault);
+        Assert.True(state.CaptureOwnership().IsConverged is false); // IsDisposed still false
+    }
+
+    [Fact]
+    public void Dispose_ClearsTitlesAndConverges()
+    {
+        var state = new RuntimeCharacterState();
+        state.Titles.ReplaceTable(13u, [1u, 5u, 13u]);
+
+        state.Dispose();
+
+        Assert.Equal(0u, state.Titles.DisplayTitleId);
+        Assert.Empty(state.Titles.EarnedTitleIds);
+        Assert.True(state.CaptureOwnership().IsConverged);
+    }
+
+    [Fact]
+    public void CharacterSnapshot_EmbedsTitlesSnapshot()
+    {
+        using var state = new RuntimeCharacterState();
+        state.Titles.ReplaceTable(13u, [1u, 5u, 13u]);
+
+        RuntimeCharacterSnapshot snapshot = state.View.Snapshot;
+
+        Assert.Equal(13u, snapshot.Titles.DisplayTitleId);
+        Assert.Equal(3, snapshot.Titles.TitleCount);
+    }
+
     private static ActiveEnchantmentRecord MakeVitae(uint spellId, float val) =>
         new(
             spellId, LayerId: 0u, Duration: -1f, CasterGuid: 0u,

tests/AcDream.Runtime.Tests/Gameplay/RuntimeCharacterTitleStateTests.cs

@@ -0,0 +1,193 @@
+using AcDream.Runtime.Gameplay;
+
+namespace AcDream.Runtime.Tests.Gameplay;
+
+/// <summary>
+/// Campaign CT slice CT2 (2026-08-24): unit tests for
+/// <see cref="RuntimeCharacterTitleState"/> — the retail
+/// <c>CharacterTitleTable</c> port. Covers the full table replace
+/// (<c>0x0029 CharacterTitle</c>), the incremental add/set-display notice
+/// (<c>0x002B UpdateTitle</c>), the retail-verified unconditional-add /
+/// gated-display-set contract, and generation-reset clearing.
+/// </summary>
+public sealed class RuntimeCharacterTitleStateTests
+{
+    [Fact]
+    public void InitialState_IsEmptyWithDefaultDisplayTitle()
+    {
+        var titles = new RuntimeCharacterTitleState();
+
+        Assert.Equal(0u, titles.DisplayTitleId);
+        Assert.Empty(titles.EarnedTitleIds);
+        Assert.False(titles.HasEarnedTitle(13u));
+    }
+
+    [Fact]
+    public void ReplaceTable_SetsEarnedIdsAndDisplayTitle_FiresTableReplaced()
+    {
+        var titles = new RuntimeCharacterTitleState();
+        int tableReplacedCount = 0;
+        titles.TableReplaced += () => tableReplacedCount++;
+
+        titles.ReplaceTable(13u, [1u, 5u, 13u]);
+
+        Assert.Equal(13u, titles.DisplayTitleId);
+        Assert.Equal(new HashSet<uint> { 1u, 5u, 13u }, titles.EarnedTitleIds.ToHashSet());
+        Assert.True(titles.HasEarnedTitle(5u));
+        Assert.False(titles.HasEarnedTitle(99u));
+        Assert.Equal(1, tableReplacedCount);
+    }
+
+    [Fact]
+    public void ReplaceTable_IsAWholesaleReplace_DropsIdsMissingFromTheNewTable()
+    {
+        var titles = new RuntimeCharacterTitleState();
+        titles.ReplaceTable(1u, [1u, 2u, 3u]);
+
+        titles.ReplaceTable(1u, [1u]);
+
+        Assert.Equal(new uint[] { 1u }, titles.EarnedTitleIds.ToArray());
+        Assert.False(titles.HasEarnedTitle(2u));
+        Assert.False(titles.HasEarnedTitle(3u));
+    }
+
+    [Fact]
+    public void ReplaceTable_DisplayTitleIdUnchanged_DoesNotFireDisplayTitleChanged()
+    {
+        var titles = new RuntimeCharacterTitleState();
+        titles.ReplaceTable(13u, [13u]);
+        var fired = new List<uint>();
+        titles.DisplayTitleChanged += id => fired.Add(id);
+
+        titles.ReplaceTable(13u, [13u, 14u]);
+
+        Assert.Empty(fired);
+        Assert.Equal(13u, titles.DisplayTitleId);
+    }
+
+    [Fact]
+    public void ReplaceTable_DisplayTitleIdChanges_FiresDisplayTitleChangedWithNewId()
+    {
+        var titles = new RuntimeCharacterTitleState();
+        titles.ReplaceTable(13u, [13u, 14u]);
+        var fired = new List<uint>();
+        titles.DisplayTitleChanged += id => fired.Add(id);
+
+        titles.ReplaceTable(14u, [13u, 14u]);
+
+        Assert.Equal([14u], fired);
+        Assert.Equal(14u, titles.DisplayTitleId);
+    }
+
+    // ── 0x002B UpdateTitle: unconditional add, gated display-set ─────────
+    // Retail's Handle_Social__AddOrSetCharacterTitle @0x00564260 ALWAYS
+    // calls SendNotice_AddCharacterTitle, and additionally calls
+    // SendNotice_SetDisplayCharacterTitle only when setAsDisplay != 0.
+
+    [Fact]
+    public void ApplyUpdateTitle_AlwaysAddsAndFiresTitleAdded_EvenWhenNotSetAsDisplay()
+    {
+        var titles = new RuntimeCharacterTitleState();
+        var added = new List<uint>();
+        titles.TitleAdded += id => added.Add(id);
+        var displayChanged = new List<uint>();
+        titles.DisplayTitleChanged += id => displayChanged.Add(id);
+
+        titles.ApplyUpdateTitle(7u, setAsDisplay: false);
+
+        Assert.True(titles.HasEarnedTitle(7u));
+        Assert.Equal([7u], added);
+        Assert.Empty(displayChanged);
+        Assert.Equal(0u, titles.DisplayTitleId);
+    }
+
+    [Fact]
+    public void ApplyUpdateTitle_SetAsDisplayTrue_AddsAndUpdatesDisplayTitle()
+    {
+        var titles = new RuntimeCharacterTitleState();
+        var added = new List<uint>();
+        titles.TitleAdded += id => added.Add(id);
+        var displayChanged = new List<uint>();
+        titles.DisplayTitleChanged += id => displayChanged.Add(id);
+
+        titles.ApplyUpdateTitle(13u, setAsDisplay: true);
+
+        Assert.True(titles.HasEarnedTitle(13u));
+        Assert.Equal([13u], added);
+        Assert.Equal([13u], displayChanged);
+        Assert.Equal(13u, titles.DisplayTitleId);
+    }
+
+    [Fact]
+    public void ApplyUpdateTitle_AlreadyEarnedId_StillFiresTitleAddedUnconditionally()
+    {
+        // Retail's own broadcast is unconditional — it does not check
+        // membership before firing the notice.
+        var titles = new RuntimeCharacterTitleState();
+        titles.ApplyUpdateTitle(7u, setAsDisplay: false);
+        var added = new List<uint>();
+        titles.TitleAdded += id => added.Add(id);
+
+        titles.ApplyUpdateTitle(7u, setAsDisplay: false);
+
+        Assert.Equal([7u], added);
+        Assert.Single(titles.EarnedTitleIds);
+    }
+
+    [Fact]
+    public void ApplyUpdateTitle_SetAsDisplayOnAnUnearnedId_AddsItAndSetsDisplay()
+    {
+        // Retail sends UpdateTitle for a title the player just earned — the
+        // id is not necessarily already in the earned set beforehand.
+        var titles = new RuntimeCharacterTitleState();
+
+        titles.ApplyUpdateTitle(99u, setAsDisplay: true);
+
+        Assert.True(titles.HasEarnedTitle(99u));
+        Assert.Equal(99u, titles.DisplayTitleId);
+    }
+
+    [Fact]
+    public void ResetSession_ClearsEarnedIdsAndDisplayTitle()
+    {
+        var titles = new RuntimeCharacterTitleState();
+        titles.ReplaceTable(13u, [1u, 5u, 13u]);
+
+        titles.ResetSession();
+
+        Assert.Equal(0u, titles.DisplayTitleId);
+        Assert.Empty(titles.EarnedTitleIds);
+    }
+
+    [Fact]
+    public void ResetSession_BumpsRevisionEvenWhenAlreadyEmpty()
+    {
+        var titles = new RuntimeCharacterTitleState();
+        long before = titles.Revision;
+
+        titles.ResetSession();
+
+        Assert.True(titles.Revision > before);
+    }
+
+    [Fact]
+    public void Snapshot_ReflectsDisplayTitleAndCount()
+    {
+        var titles = new RuntimeCharacterTitleState();
+        titles.ReplaceTable(13u, [1u, 5u, 13u]);
+
+        RuntimeCharacterTitleSnapshot snapshot = titles.Snapshot;
+
+        Assert.Equal(13u, snapshot.DisplayTitleId);
+        Assert.Equal(3, snapshot.TitleCount);
+        Assert.Equal(titles.Revision, snapshot.Revision);
+    }
+
+    [Fact]
+    public void ReplaceTable_NullTitleIds_Throws()
+    {
+        var titles = new RuntimeCharacterTitleState();
+        Assert.Throws<ArgumentNullException>(
+            () => titles.ReplaceTable(1u, null!));
+    }
+}

tests/AcDream.Runtime.Tests/Session/DirectGameRuntimeCommandAdapterTests.cs

@@ -1,3 +1,4 @@
+using System.Buffers.Binary;
 using System.Net;
 using AcDream.Core.Combat;
 using AcDream.Core.Items;
@@ -345,6 +346,69 @@ public sealed class DirectGameRuntimeCommandAdapterTests
         runtime.Dispose();
     }
 
+    // ── Campaign CT slice CT2 (2026-08-24): SetTitle (TitleSet 0x002C) ───
+
+    [Fact]
+    public void SetTitle_SendsTheWireActionWithoutAnyLocalMutation()
+    {
+        (GameRuntime runtime, DirectGameRuntimeCommandAdapter adapter, FixtureSessionOperations operations) =
+            CreateStartedHarness();
+        var gameActions = new List<byte[]>();
+        operations.Sessions[^1].GameActionCapture = body => gameActions.Add(body);
+
+        RuntimeCommandResult result = adapter.Character.SetTitle(
+            runtime.Generation,
+            titleId: 13u);
+
+        Assert.True(result.Accepted);
+        Assert.Single(gameActions);
+        byte[] sent = gameActions[0];
+        Assert.Equal(
+            SocialActions.TitleSetOpcode,
+            BinaryPrimitives.ReadUInt32LittleEndian(sent.AsSpan(8)));
+        Assert.Equal(13u, BinaryPrimitives.ReadUInt32LittleEndian(sent.AsSpan(12)));
+
+        // CA-lesson: NO optimistic local mutation. RuntimeCharacterState.
+        // Titles only updates from the server's own echo (0x002B/0x0029).
+        Assert.Equal(0u, runtime.CharacterOwner.Titles.DisplayTitleId);
+        Assert.Empty(runtime.CharacterOwner.Titles.EarnedTitleIds);
+        runtime.Dispose();
+    }
+
+    [Fact]
+    public void SetTitle_ZeroTitleId_RejectsWithoutSendingAnything()
+    {
+        (GameRuntime runtime, DirectGameRuntimeCommandAdapter adapter, FixtureSessionOperations operations) =
+            CreateStartedHarness();
+        var gameActions = new List<byte[]>();
+        operations.Sessions[^1].GameActionCapture = body => gameActions.Add(body);
+
+        RuntimeCommandResult result = adapter.Character.SetTitle(
+            runtime.Generation,
+            titleId: 0u);
+
+        Assert.Equal(RuntimeCommandStatus.Rejected, result.Status);
+        Assert.Empty(gameActions);
+        runtime.Dispose();
+    }
+
+    [Fact]
+    public void SetTitle_StaleGeneration_RejectsWithoutSendingAnything()
+    {
+        (GameRuntime runtime, DirectGameRuntimeCommandAdapter adapter, FixtureSessionOperations operations) =
+            CreateStartedHarness();
+        var gameActions = new List<byte[]>();
+        operations.Sessions[^1].GameActionCapture = body => gameActions.Add(body);
+        RuntimeGenerationToken stale = runtime.Generation;
+        _ = adapter.Session.Reconnect(runtime.Generation);
+
+        RuntimeCommandResult result = adapter.Character.SetTitle(stale, titleId: 13u);
+
+        Assert.Equal(RuntimeCommandStatus.StaleGeneration, result.Status);
+        Assert.Empty(gameActions);
+        runtime.Dispose();
+    }
+
     [Fact]
     public void SaveOptions_FlushesTheDirtyBlobThenNoOpsWhenClean()
     {