feat(headless): Campaign OP slice OP7 — declared characterOptions with seed-diff sends

Adds an optional, strict `characterOptions` block to the headless bot config
(D8): keys are exactly the lane-B tier-1 (22) + tier-2 (4) bot-declarable
CharacterOptionId enum-member spellings; an unknown/out-of-tier name fails
config load naming the offending key, before it can ever reach the wire.

HeadlessCharacterOptionsSeeder diffs declared-vs-actual once both of ACE's
real preconditions are known true — GameActionLoginComplete sent (the
FirstEnterWorldDone gate SetCharacterOptions 0x01A1 needs) and a real
PlayerDescription has seeded RuntimeCharacterOptionsState
(HasServerSeed) — learned from whichever of two hooks lands second. Every
differing id routes through OP1's shared IRuntimeCharacterCommands seam:
auto-save ids send SetSingleOption (0x0005) immediately; batched ids also
call SetSingleOption (which only dirties the module) followed by exactly
one SaveOptions flush after the whole declared set has been walked.
Idempotent on reconnect by construction — no dedupe latch, the diff simply
finds nothing once the server agrees.

RuntimeLiveEntitySessionController gains a passive onLoginCompleteSent
observation hook (additive only, never changes when/whether it sends) so
the headless host can learn ACE's gate opened from any of its own two
internal send sites; the third site (direct first-entry completion) is
already owned by HeadlessSessionHost itself. All wiring is synchronous
delegate calls on Runtime's one dedicated update thread — no new
async/Task continuation, honoring #368.

Tests: schema (valid parse, unknown/tier-3 name rejected naming the key,
non-bool rejected, empty/absent no-op), the diff engine against a fake
IRuntimeCharacterCommands (nothing-to-send, auto-save-only, batched-with-
flush, mixed ordering, reconnect idempotence), and two wiring integration
tests — one dispatching a real PlayerDescription game event end-to-end to
a captured wire action, one proving the send lands on the same dedicated
thread every Tick runs on. Full solution suite: 12,935 passed / 4 skipped
/ 0 failed (+17 over baseline 12,918/4/0).

No register row: the characterOptions bot-config surface is acdream-
native tooling over retail's own wire mechanisms (both already ported by
OP1), not a retail UI port with a divergence to record.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/research/2026-08-11-campaign-op-test-script.md

@@ -1,6 +1,6 @@
 # Campaign OP connected-gate test script
 
-**Status:** OP3 section only. Later slices (OP4-6, OP8) append their own
+**Status:** OP3 and OP7 sections. Later slices (OP4-6, OP8) append their own
 sections here as they land; the campaign's OP9 closeout gate is this
 document complete plus every slice code-complete.
 
@@ -112,3 +112,126 @@ for this slice, not a bug.
 - Configure Keyboard's actual screen — OP8.
 - Any observable camera change from "Use Mouse Turning Settings" — no
   acdream consumer exists yet (TS-74).
+
+---
+
+## OP7 — headless `characterOptions`
+
+Unlike OP3-OP6, this is not a graphical-client gate: no window is launched.
+The coordinator runs `acdream-headless run` against local ACE with a config
+declaring a small `characterOptions` block, and inspects the ACE-side
+persisted `CharacterOptions1`/`CharacterOptions2` (and, for the
+`ListenTo*Chat` ids, the actual Turbine room membership) before and after.
+Automated coverage (schema rejection, the diff-and-send engine, the wiring
+from a real `PlayerDescription` game event through to a captured wire
+action, and dedicated-update-thread affinity) already runs in
+`tests/AcDream.Headless.Tests/HeadlessConfigurationLoaderTests.cs`,
+`HeadlessCharacterOptionsSeederTests.cs`, and
+`HeadlessCharacterOptionsSeederWiringTests.cs` — this script is for the ONE
+thing those tests cannot prove: that a REAL ACE server actually accepts and
+persists the sends.
+
+### Recipe
+
+1. **Confirm the character's starting state.** Before running the bot,
+   note (or reset) the target character's `IgnoreAllegianceRequests`
+   (0x01, auto-save, `SetSingleCharacterOption 0x0005`) and
+   `ListenToTradeChat` (0x24, auto-save, also `0x0005` — additionally
+   joins/leaves the Turbine trade room) options — e.g. via an existing
+   graphical login, or by inspecting ACE's stored `CharacterOptions1`/
+   `CharacterOptions2` for the character row directly. Pick a THIRD,
+   batched (non-auto-save) id for the blob path — `SalvageMultiple`
+   (0x22, tier 2) is a safe choice: it has no observable server-side
+   effect beyond the stored bit, so a mismatch is purely a persistence
+   question, not a behavior one.
+2. **Author a headless config** with all three declared at values that
+   DIFFER from the character's current stored state, e.g.:
+   ```json
+   {
+     "version": 1,
+     "sessions": [{
+       "id": "op7-bot",
+       "endpoint": { "host": "127.0.0.1", "port": 9000 },
+       "account": "testaccount",
+       "character": { "name": "+Acdream" },
+       "policy": { "id": "idle" },
+       "credential": { "provider": "environment", "reference": "OP7_BOT_PASSWORD" },
+       "characterOptions": {
+         "IgnoreAllegianceRequests": true,
+         "ListenToTradeChat": true,
+         "SalvageMultiple": true
+       }
+     }]
+   }
+   ```
+   (Flip each `true` to `false` instead if the character already has that
+   bit set — the point is a genuine diff in both directions, not
+   specifically "everything ON".)
+3. **Run it**: `acdream-headless run --config op7-bot.json` with
+   `OP7_BOT_PASSWORD` set in the environment. Let it sit in-world a few
+   seconds, then stop it (Ctrl+C — the process scheduler's graceful-
+   shutdown path already sends a real logoff).
+
+### Expected wire sends on first connect
+
+- One `SetSingleCharacterOption (0x0005)` for `IgnoreAllegianceRequests`
+  (id `0x01`) — immediately, no batching.
+- One `SetSingleCharacterOption (0x0005)` for `ListenToTradeChat` (id
+  `0x24`) — immediately, and ACE's handler additionally joins the
+  Turbine trade-chat room server-side for this session (observable via
+  ACE's own Turbine-chat membership logging if available).
+- One `SetSingleCharacterOption (0x0005)` for `SalvageMultiple` (id
+  `0x22`) followed by exactly one `SetCharacterOptions (0x01A1)` blob
+  flush — `SalvageMultiple` is batched (dirties the module; OP7's
+  diff-and-send calls the explicit `SaveOptions` verb once, after every
+  declared id has been diffed, never interleaved).
+- **No other option bits change.** ACE's stored `CharacterOptions1`/
+  `CharacterOptions2` for every UNDECLARED id stay exactly what they
+  were before the run.
+- **No 0x01A1 blob before the client's own `GameActionLoginComplete`.**
+  If ACE logs a refusal ("SetCharacterOptions received before
+  FirstEnterWorldDone" or equivalent), that is a real OP7 defect — the
+  diff-and-send is contracted to run only after both LoginComplete has
+  been sent AND a real `PlayerDescription` has seeded local state
+  (`HeadlessCharacterOptionsSeeder`'s own two-precondition latch).
+
+### Expected silence on reconnect
+
+4. **Run the SAME config a second time** (a fresh process, or the
+   process's own reconnect path if it fires) without changing anything
+   on the ACE side in between. Expect **zero** `0x0005`/`0x01A1` sends
+   for the three declared ids — the fresh `PlayerDescription` now echoes
+   back exactly what the first run persisted, so the declared-vs-actual
+   diff finds nothing (idempotent by construction: a bot that already
+   has what it wants sends nothing, matching retail's own "re-set to the
+   current value produces nothing" rule — set-character-options-wire.md
+   §3.1/§3.5).
+5. **Flip one declared value** in the config (e.g. `SalvageMultiple` back
+   to `false`) and run again. Expect exactly ONE `0x0005` +
+   `0x01A1` pair for that id only — the other two, still matching,
+   produce nothing.
+
+### What to report
+
+- Any declared id that does NOT persist across a fresh reconnect (ACE
+  either rejected it silently, or the diff-and-send never actually ran).
+- Any UNDECLARED id whose stored value changed — a sign the blob echoed
+  something it shouldn't have (wire research §5.3's "echo real values,
+  never zero them" rule, or a stale/incorrect snapshot read).
+- Any 0x0005/0x01A1 send observed BEFORE the client's own LoginComplete
+  action on the wire (a WireMCP capture on loopback `127.0.0.1:9000`
+  settles this precisely if ACE's own log line is ambiguous).
+- Whether `ListenToTradeChat` actually joined the Turbine trade room
+  server-side (not just the stored bit) — the one declared id in the
+  sample config with a real behavioral consumer.
+
+### Explicitly NOT in scope for this gate
+
+- Every other tier-1/tier-2 option name — the three above exercise both
+  wire paths (auto-save `0x0005`-only and batched `0x0005`+`0x01A1`);
+  the remaining 23 names share the same two code paths and are already
+  covered by the id-ascending completeness assertions in
+  `CharacterOptionTableTests` (OP1) and the schema tests here (OP7).
+- Any presentation-only (tier-3) option — `HeadlessConfigurationLoader`
+  refuses to load a config that declares one; there is nothing to run.
+- The graphical Options panel's own Character tab — OP4.

src/AcDream.Headless/Configuration/HeadlessConfiguration.cs

@@ -48,6 +48,24 @@ internal sealed class HeadlessSessionDescriptor
 
     [JsonRequired]
     public HeadlessCredentialReference Credential { get; init; } = new();
+
+    /// <summary>
+    /// Campaign OP slice OP7 (2026-08-11), D8: optional declared character-
+    /// option overrides. Keys MUST be exact <c>CharacterOptionId</c> enum-
+    /// member spellings drawn from the lane-B tier-1+tier-2 bot-relevant
+    /// subset (docs/research/2026-08-10-character-options-map.md §5.2/§7.3)
+    /// — <see cref="HeadlessConfigurationLoader"/> rejects everything else
+    /// at load, before any name can reach the wire (ACE throws
+    /// <c>KeyNotFoundException</c> server-side on an unmodelled id — set-
+    /// character-options-wire.md §5.4.2). Dictionary VALUES bypass the
+    /// loader's camelCase property-naming policy entirely (only C# property
+    /// names go through that policy; JSON object keys inside a
+    /// <c>Dictionary&lt;string, TValue&gt;</c> are read verbatim), so the
+    /// exact PascalCase enum spelling is what the config file must contain.
+    /// <c>null</c> (the field entirely absent) and an empty object are both
+    /// legal no-ops.
+    /// </summary>
+    public Dictionary<string, bool>? CharacterOptions { get; init; }
 }
 
 internal sealed class HeadlessEndpointDescriptor

src/AcDream.Headless/Configuration/HeadlessConfigurationLoader.cs

@@ -1,5 +1,6 @@
 using System.Text.Json;
 using System.Text.Json.Serialization;
+using AcDream.Core.Net.Messages;
 
 namespace AcDream.Headless.Configuration;
 
@@ -7,6 +8,54 @@ internal static class HeadlessConfigurationLoader
 {
     private const int CurrentVersion = 1;
 
+    /// <summary>
+    /// Campaign OP slice OP7 (2026-08-11), D8: the ONLY <c>characterOptions</c>
+    /// key names a headless config may declare — the lane-B tier-1 (22, "server-
+    /// honoured AND plausibly bot-relevant") plus tier-2 (4, "client-side but a
+    /// bot still wants them") subset from
+    /// docs/research/2026-08-10-character-options-map.md §5.2, transcribed as
+    /// the matching <see cref="CharacterOptionTable"/>/<see cref="CharacterOptionId"/>
+    /// enum-member spellings (research doc §5.2's own prose labels differ from
+    /// the enum in a few spots — e.g. "IgnoreAllTradeRequests" is
+    /// <see cref="CharacterOptionId.IgnoreTradeRequests"/>,
+    /// "LetOtherPlayersGiveYouItems" is <see cref="CharacterOptionId.AllowGive"/>
+    /// — the enum spelling wins, per §7.3's "match CharacterOptionTable's enum-
+    /// member spellings" instruction). Every other real
+    /// <see cref="CharacterOptionId"/> member (the presentation-only tier-3 set,
+    /// §5.2) is deliberately excluded BY CONSTRUCTION — not merely undeclared.
+    /// </summary>
+    private static readonly HashSet<CharacterOptionId> AllowedCharacterOptions =
+    [
+        // Tier 1 (22).
+        CharacterOptionId.IgnoreAllegianceRequests,
+        CharacterOptionId.IgnoreFellowshipRequests,
+        CharacterOptionId.IgnoreTradeRequests,
+        CharacterOptionId.AllowGive,
+        CharacterOptionId.FellowshipShareXP,
+        CharacterOptionId.AcceptLootPermits,
+        CharacterOptionId.FellowshipShareLoot,
+        CharacterOptionId.FellowshipAutoAcceptRequests,
+        CharacterOptionId.DisplayAllegianceLogonNotifications,
+        CharacterOptionId.UseChargeAttack,
+        CharacterOptionId.UseCraftSuccessDialog,
+        CharacterOptionId.AutoRepeatAttack,
+        CharacterOptionId.LeadMissileTargets,
+        CharacterOptionId.UseFastMissiles,
+        CharacterOptionId.ConfirmVolatileRareUse,
+        CharacterOptionId.AppearOffline,
+        CharacterOptionId.ListenToAllegianceChat,
+        CharacterOptionId.ListenToGeneralChat,
+        CharacterOptionId.ListenToTradeChat,
+        CharacterOptionId.ListenToLFGChat,
+        CharacterOptionId.ListenToRoleplayChat,
+        CharacterOptionId.ListenToSocietyChat,
+        // Tier 2 (4).
+        CharacterOptionId.MainPackPreferred,
+        CharacterOptionId.ToggleRun,
+        CharacterOptionId.AutoTarget,
+        CharacterOptionId.SalvageMultiple,
+    ];
+
     private static readonly JsonSerializerOptions Options = new()
     {
         AllowTrailingCommas = false,
@@ -144,5 +193,36 @@ internal static class HeadlessConfigurationLoader
             throw new HeadlessConfigurationException(
                 $"Session '{session.Id}' requires a credential reference.");
         }
+
+        ValidateCharacterOptions(session);
+    }
+
+    /// <summary>
+    /// D8: an unknown name (misspelled, or a real
+    /// <see cref="CharacterOptionId"/> outside <see cref="AllowedCharacterOptions"/>,
+    /// e.g. a presentation-only tier-3 row) fails load with the offending
+    /// name in the message — never silently dropped, never sent. A non-bool
+    /// JSON value fails earlier, during <c>Dictionary&lt;string, bool&gt;</c>
+    /// deserialization itself (a <see cref="JsonException"/>, consistent with
+    /// every other type-shape violation this loader lets the deserializer
+    /// reject directly — <see cref="HeadlessConfigurationException"/> is
+    /// reserved for semantic validation of already-well-typed values).
+    /// </summary>
+    private static void ValidateCharacterOptions(HeadlessSessionDescriptor session)
+    {
+        if (session.CharacterOptions is not { } declared)
+            return;
+
+        foreach (string name in declared.Keys)
+        {
+            if (!Enum.TryParse(name, ignoreCase: false, out CharacterOptionId id)
+                || !AllowedCharacterOptions.Contains(id))
+            {
+                throw new HeadlessConfigurationException(
+                    $"Session '{session.Id}' characterOptions declares "
+                    + $"'{name}', which is not a bot-declarable character "
+                    + "option name.");
+            }
+        }
     }
 }

src/AcDream.Headless/Hosting/HeadlessCharacterOptionsSeeder.cs

@@ -0,0 +1,137 @@
+using AcDream.Core.Net.Messages;
+using AcDream.Runtime;
+using AcDream.Runtime.Gameplay;
+
+namespace AcDream.Headless.Hosting;
+
+/// <summary>
+/// Campaign OP slice OP7 (2026-08-11), D8: the declared-vs-actual character-
+/// option diff-and-send engine for a headless bot's optional
+/// <c>characterOptions</c> config block
+/// (docs/plans/2026-08-10-options-panel-campaign.md §4 OP7).
+///
+/// <para>
+/// Sends through the SAME shared Runtime seam the retail Options panel and
+/// every other option-changing entrance uses
+/// (<c>IRuntimeCharacterCommands.SetSingleOption</c> /
+/// <c>SaveOptions</c> — OP1) so this class owns no wire-format knowledge of
+/// its own: an auto-save id's <c>SetSingleOption</c> call sends
+/// <c>SetSingleCharacterOption (0x0005)</c> immediately (inside
+/// <see cref="RuntimeCharacterOptionsState.TrySetOption"/>); a batched id's
+/// call only dirties the module, so this class calls <c>SaveOptions</c>
+/// itself, exactly once, after every declared id has been diffed — never
+/// interleaved (docs/research/2026-08-10-set-character-options-wire.md §3.5's
+/// policy table).
+/// </para>
+///
+/// <para>
+/// <b>Why two note-methods.</b> Sending <c>SetCharacterOptions (0x01A1)</c>
+/// (via <c>SaveOptions</c>) before ACE's <c>FirstEnterWorldDone</c> gate
+/// opens is a silent no-op server-side (wire research §5.2) — that flag
+/// flips from the client's own <c>GameActionLoginComplete</c>, which a
+/// headless host can send from any of three independent production sites
+/// depending on content configuration and destination shape (content-less
+/// immediate admission, direct first-entry completion, or portal-space
+/// materialization completion — see <c>HeadlessSessionHost.CreateEventRoute</c>
+/// and <c>RuntimeLiveEntitySessionController</c>'s own two internal send
+/// sites). Diffing against live option state before a real
+/// <c>PlayerDescription</c> has seeded it would also diff against client-
+/// constructor defaults instead of server truth
+/// (<see cref="RuntimeCharacterOptionsState.HasServerSeed"/> — OP1's
+/// MUST-FIX M1 latch). Both preconditions can be learned in either order, so
+/// this class latches each sticky and re-attempts the diff from whichever
+/// hook lands second.
+/// </para>
+///
+/// <para>
+/// <b>No "already sent" dedupe.</b> character-options-map.md §5.3
+/// constraint 4 and set-character-options-wire.md §3.5's own "re-set an
+/// option to its current value produces nothing" rule make the diff
+/// naturally idempotent — a call that finds every declared id already
+/// matching live state (the ordinary reconnect case, or a redundant repeat
+/// signal from either hook within one session) sends nothing. A session
+/// constructs a fresh instance per connect/reconnect
+/// (<c>HeadlessSessionHost.CreateEventRoute</c>), so
+/// <see cref="_loginCompleteSent"/> never needs to un-latch mid-session.
+/// </para>
+/// </summary>
+internal sealed class HeadlessCharacterOptionsSeeder
+{
+    private readonly IReadOnlyList<KeyValuePair<CharacterOptionId, bool>> _declared;
+    private readonly GameRuntime _runtime;
+    private readonly IRuntimeCharacterCommands _commands;
+    private bool _loginCompleteSent;
+
+    internal HeadlessCharacterOptionsSeeder(
+        IReadOnlyDictionary<CharacterOptionId, bool> declared,
+        GameRuntime runtime,
+        IRuntimeCharacterCommands commands)
+    {
+        ArgumentNullException.ThrowIfNull(declared);
+        _runtime = runtime ?? throw new ArgumentNullException(nameof(runtime));
+        _commands = commands ?? throw new ArgumentNullException(nameof(commands));
+        // Deterministic id-ascending order: matches CharacterOptionTable's own
+        // ordering convention and keeps SetSingleOption call order
+        // reproducible — the contract requires "all option sets first, then
+        // the single flush", not any particular order among the sets
+        // themselves, but a stable order still makes captured-wire tests
+        // deterministic instead of relying on Dictionary's unspecified
+        // enumeration order.
+        _declared = [.. declared.OrderBy(static pair => (uint)pair.Key)];
+    }
+
+    internal bool HasDeclaredOptions => _declared.Count > 0;
+
+    /// <summary>
+    /// Wired to every production site that can send
+    /// <c>GameActionLoginComplete</c> for this session — see the type doc.
+    /// Idempotent to call more than once.
+    /// </summary>
+    internal void NoteLoginCompleteSent()
+    {
+        _loginCompleteSent = true;
+        TryDiffAndSend();
+    }
+
+    /// <summary>
+    /// Wired to <c>LiveCharacterSessionBindings.OnCharacterOptionsChanged</c>
+    /// — fires after <c>RuntimeCharacterOptionsState.Replace</c> has already
+    /// committed a fresh <c>PlayerDescription</c>'s option words, on both the
+    /// first connect and every reconnect's fresh seed.
+    /// </summary>
+    internal void NoteOptionsSeeded() => TryDiffAndSend();
+
+    private void TryDiffAndSend()
+    {
+        if (!_loginCompleteSent || _declared.Count == 0)
+            return;
+
+        RuntimeCharacterOptionsState options = _runtime.CharacterOwner.Options;
+        if (!options.HasServerSeed)
+            return;
+
+        RuntimeGenerationToken generation = _runtime.Generation;
+        bool needsFlush = false;
+        foreach ((CharacterOptionId id, bool desired) in _declared)
+        {
+            // Unreachable in production: HeadlessConfigurationLoader already
+            // rejects any declared name CharacterOptionTable cannot resolve.
+            // Guarded rather than assumed so a future table/schema drift
+            // fails closed (skips the id) instead of throwing mid-diff.
+            if (!CharacterOptionTable.TryGet(id, out CharacterOptionTableEntry entry))
+                continue;
+
+            uint word = entry.IsOptions1 ? options.Options1 : options.Options2;
+            bool current = (word & entry.Mask) != 0u;
+            if (current == desired)
+                continue;
+
+            _commands.SetSingleOption(generation, (uint)id, desired);
+            if (!entry.IsAutoSave)
+                needsFlush = true;
+        }
+
+        if (needsFlush)
+            _commands.SaveOptions(generation);
+    }
+}

src/AcDream.Headless/Hosting/HeadlessSessionHost.cs

@@ -112,6 +112,21 @@ internal sealed class HeadlessSessionHost : IDisposable
     private readonly HeadlessSessionDescriptor _descriptor;
     private readonly HeadlessCredentialSecret _credential;
     private readonly HeadlessDiagnosticWriter _diagnostics;
+    /// <summary>
+    /// Campaign OP slice OP7 (2026-08-11), D8: the parsed
+    /// <c>characterOptions</c> block — empty when the config omitted it.
+    /// Parsed once at construction; <see cref="HeadlessConfigurationLoader"/>
+    /// already rejected every unmodelled or out-of-tier name before this
+    /// host was ever built, so the parse here cannot fail.
+    /// </summary>
+    private readonly Dictionary<CharacterOptionId, bool> _declaredCharacterOptions;
+    /// <summary>
+    /// Reassigned on every reconnect exactly like <see cref="_worldProjection"/>
+    /// — a fresh instance per <see cref="CreateEventRoute"/> call gives the
+    /// seeder's own login-complete latch a clean per-session start without a
+    /// separate reset method.
+    /// </summary>
+    private HeadlessCharacterOptionsSeeder? _optionsSeeder;
     private readonly TimeSpan _reconnectQuiescence;
     private readonly TimeProvider _timeProvider;
     private readonly HeadlessGenerationResetHost _resetHost = new();
@@ -189,6 +204,7 @@ internal sealed class HeadlessSessionHost : IDisposable
             ?? throw new ArgumentNullException(nameof(credential));
         _diagnostics = diagnostics
             ?? throw new ArgumentNullException(nameof(diagnostics));
+        _declaredCharacterOptions = ParseDeclaredCharacterOptions(descriptor);
         _placementSinkOverride = placementSinkOverride;
         _timeProvider = timeProvider ?? TimeProvider.System;
         _reconnectQuiescence = reconnectQuiescence
@@ -309,6 +325,16 @@ internal sealed class HeadlessSessionHost : IDisposable
 
     internal GameRuntime Runtime { get; }
     internal DirectGameRuntimeCommandAdapter Commands { get; }
+    /// <summary>
+    /// OP7 test seam (mirrors <see cref="Commands"/>'s own visibility): the
+    /// current route's declared-<c>characterOptions</c> diff-and-send engine,
+    /// or <c>null</c> before the first <c>CreateEventRoute</c> call. Lets a
+    /// focused test drive one half of the seeder's two-precondition latch
+    /// directly (e.g. simulate "LoginComplete already sent") without
+    /// reconstructing the first-entry-drive/portal-completion machinery that
+    /// production code uses to reach the same state.
+    /// </summary>
+    internal HeadlessCharacterOptionsSeeder? OptionsSeeder => _optionsSeeder;
     internal string SessionId => _descriptor.Id;
     internal string ActiveCharacterName { get; private set; } =
         string.Empty;
@@ -604,6 +630,13 @@ internal sealed class HeadlessSessionHost : IDisposable
         // its ack-firing accessor must therefore read the CURRENT session
         // through this field, never one captured at first construction.
         _currentSession = session;
+        // OP7: a fresh seeder per route — see the field's own doc comment
+        // for why this (rather than a reset method) is the right per-
+        // reconnect lifetime.
+        _optionsSeeder = new HeadlessCharacterOptionsSeeder(
+            _declaredCharacterOptions,
+            Runtime,
+            Commands.Character);
         // R9 review note (2026-08-03): a content-less host (_contentLease is
         // null — a validated-legal headless configuration, see
         // RuntimeLiveEntitySessionController.OnSpawned's own R3 comment)
@@ -694,7 +727,10 @@ internal sealed class HeadlessSessionHost : IDisposable
                 message,
                 Runtime.Generation.Value),
             worldProjection,
-            _acceptedPositionDrive);
+            _acceptedPositionDrive,
+            // OP7: the first two of three production LoginComplete send
+            // sites — see RuntimeLiveEntitySessionController's own doc.
+            onLoginCompleteSent: () => _optionsSeeder?.NoteLoginCompleteSent());
         _entities = entities;
         var route = new LiveSessionEventRouter(
             session,
@@ -734,7 +770,13 @@ internal sealed class HeadlessSessionHost : IDisposable
                 // (HeadlessSessionWorldProjection.CreateController), same as
                 // the pre-P1 OnSkillsUpdated: null pattern — no live
                 // controller to reactively re-apply to mid-session here.
-                OnMovementStatsUpdated: null),
+                OnMovementStatsUpdated: null,
+                // OP7: fires after RuntimeCharacterOptionsState.Replace has
+                // already committed a fresh PlayerDescription's option words
+                // — the seeder's other precondition alongside
+                // NoteLoginCompleteSent (see its own type doc).
+                OnCharacterOptionsChanged: (_, _) =>
+                    _optionsSeeder?.NoteOptionsSeeded()),
             new LiveSocialSessionBindings(
                 Runtime.CommunicationOwner.Chat,
                 Runtime.CommunicationOwner.TurbineChat,
@@ -747,12 +789,42 @@ internal sealed class HeadlessSessionHost : IDisposable
             _placementSinkOverride
                 ?? new HeadlessRuntimePlacementProjectionSink(Runtime),
             _firstEntryDrive,
-            _ => session.SendGameAction(GameActionLoginComplete.Build()),
+            _ =>
+            {
+                session.SendGameAction(GameActionLoginComplete.Build());
+                // OP7: the THIRD production LoginComplete send site (direct,
+                // non-portal first-entry completion) — see
+                // HeadlessCharacterOptionsSeeder's type doc and
+                // RuntimeLiveEntitySessionController's onLoginCompleteSent
+                // doc for the other two.
+                _optionsSeeder?.NoteLoginCompleteSent();
+            },
             _acceptedPositionDrive);
         _eventRoute = eventRoute;
         return eventRoute;
     }
 
+    /// <summary>
+    /// OP7, D8: parses <see cref="HeadlessSessionDescriptor.CharacterOptions"/>
+    /// into the typed id space the seeder and <see cref="CharacterOptionTable"/>
+    /// share. <see cref="HeadlessConfigurationLoader"/> already validated
+    /// every key against the exact bot-declarable name set before this host
+    /// was constructed, so <c>Enum.Parse</c> here cannot fail.
+    /// </summary>
+    private static Dictionary<CharacterOptionId, bool> ParseDeclaredCharacterOptions(
+        HeadlessSessionDescriptor descriptor)
+    {
+        var declared = new Dictionary<CharacterOptionId, bool>();
+        if (descriptor.CharacterOptions is not { } options)
+            return declared;
+        foreach (KeyValuePair<string, bool> pair in options)
+        {
+            declared[Enum.Parse<CharacterOptionId>(pair.Key, ignoreCase: false)] =
+                pair.Value;
+        }
+        return declared;
+    }
+
     private static LiveSessionCharacterSelector MapCharacterSelector(
         HeadlessCharacterSelector selector) =>
         new(

src/AcDream.Runtime/Session/RuntimeLiveEntitySessionController.cs

@@ -74,6 +74,22 @@ public sealed class RuntimeLiveEntitySessionController
     /// <c>HeadlessSessionWorldProjection.BlipLocalPlayer</c>).
     /// </summary>
     private readonly RuntimeAcceptedPositionDriveController? _acceptedPositionDrive;
+    /// <summary>
+    /// Campaign OP slice OP7 (2026-08-11): passive observation hook — fires
+    /// AFTER either of this controller's own two internal
+    /// <c>GameActionLoginComplete</c> send sites (<see cref="OnSpawned"/>'s
+    /// content-less immediate-admission path; <see cref="TryAdvancePortalCompletion"/>'s
+    /// portal-space materialization completion). Never changes when or
+    /// whether LoginComplete is sent — purely additive, so a headless host
+    /// can learn "ACE's FirstEnterWorldDone gate is now open" (set-
+    /// character-options-wire.md §5.2) without duplicating this controller's
+    /// own dual-path completion logic. The THIRD production send site — direct
+    /// (non-portal) first-entry completion via
+    /// <c>RuntimeFirstEntryDriveController</c>'s <c>localPlayerCompleted</c>
+    /// callback — lives one level up in <c>HeadlessSessionHost</c>, which
+    /// wires the same observer there directly.
+    /// </summary>
+    private readonly Action? _onLoginCompleteSent;
     private bool _initialLoginCompleteSent;
     // A6 (architecture review): D5's ResolveAndCommitChildAttachment ran on
     // every accepted spawn and every ParentEvent, allocating three
@@ -88,13 +104,15 @@ public sealed class RuntimeLiveEntitySessionController
         WorldSession session,
         Action<string>? log = null,
         IRuntimeDirectWorldProjection? worldProjection = null,
-        RuntimeAcceptedPositionDriveController? acceptedPositionDrive = null)
+        RuntimeAcceptedPositionDriveController? acceptedPositionDrive = null,
+        Action? onLoginCompleteSent = null)
     {
         _runtime = runtime ?? throw new ArgumentNullException(nameof(runtime));
         _session = session ?? throw new ArgumentNullException(nameof(session));
         _log = log ?? (_ => { });
         _worldProjection = worldProjection;
         _acceptedPositionDrive = acceptedPositionDrive;
+        _onLoginCompleteSent = onLoginCompleteSent;
         _isChildGuidKnown = guid => Entities.Entities.TryGetSnapshot(guid, out _);
         _resolveParentInstance = guid =>
             Entities.Entities.TryGetSnapshot(guid, out WorldSession.EntitySpawn spawn)
@@ -180,6 +198,7 @@ public sealed class RuntimeLiveEntitySessionController
                 // truthful terminal admission edge.
                 _initialLoginCompleteSent = true;
                 _session.SendGameAction(GameActionLoginComplete.Build());
+                _onLoginCompleteSent?.Invoke();
             }
         }
     }
@@ -856,6 +875,7 @@ public sealed class RuntimeLiveEntitySessionController
             RuntimeWorldHostAcknowledgementStage.TerminalProjected);
 
         _session.SendGameAction(GameActionLoginComplete.Build());
+        _onLoginCompleteSent?.Invoke();
         transit.EndTeleport();
         _log(
             $"headless: portal complete generation={generation} "

tests/AcDream.Headless.Tests/HeadlessCharacterOptionsSeederTests.cs

@@ -0,0 +1,289 @@
+using AcDream.Core.Net.Messages;
+using AcDream.Headless.Hosting;
+using AcDream.Runtime;
+using AcDream.Runtime.Gameplay;
+
+namespace AcDream.Headless.Tests;
+
+/// <summary>
+/// Campaign OP slice OP7 (2026-08-11), D8: the declared-vs-actual diff engine
+/// (<see cref="HeadlessCharacterOptionsSeeder"/>) unit-tested against a fake
+/// <see cref="IRuntimeCharacterCommands"/> so these tests never need a live
+/// session, a wire, or a physics/collision fixture — only a bare
+/// <see cref="GameRuntime"/> for its <c>CharacterOwner.Options</c> state and
+/// <c>Generation</c> token. <see cref="RuntimeCharacterOptionsState.Replace"/>
+/// stands in for "a PlayerDescription just landed" exactly like
+/// <c>LiveSessionEventRouter</c>'s own <c>onCharacterOptions</c> wiring does.
+/// </summary>
+public sealed class HeadlessCharacterOptionsSeederTests
+{
+    // AutoRepeatAttack (0x00, Options1 0x00000002) is auto-save — sends
+    // SetSingleOption (0x0005) immediately, per CharacterOptionTable.
+    // IgnoreTradeRequests (0x03, Options1 0x00020000) is batched — dirties
+    // the module; only SaveOptions flushes it. Both are exercised by name
+    // throughout this file's tests.
+    private const uint AutoSaveMask = 0x00000002u;
+
+    [Fact]
+    public void DeclaredEqualsActualSendsNothing()
+    {
+        using GameRuntime runtime = NewRuntime();
+        runtime.CharacterOwner.Options.Replace(0u, 0u);
+        var commands = new FakeCharacterCommands(runtime.CharacterOwner.Options);
+        var seeder = new HeadlessCharacterOptionsSeeder(
+            new Dictionary<CharacterOptionId, bool>
+            {
+                [CharacterOptionId.AutoRepeatAttack] = false,
+            },
+            runtime,
+            commands);
+
+        seeder.NoteLoginCompleteSent();
+        seeder.NoteOptionsSeeded();
+
+        Assert.Empty(commands.CallOrder);
+    }
+
+    [Fact]
+    public void AutoSaveDifferenceSendsExactlyOneSetSingleOption()
+    {
+        using GameRuntime runtime = NewRuntime();
+        runtime.CharacterOwner.Options.Replace(0u, 0u);
+        var commands = new FakeCharacterCommands(runtime.CharacterOwner.Options);
+        var seeder = new HeadlessCharacterOptionsSeeder(
+            new Dictionary<CharacterOptionId, bool>
+            {
+                [CharacterOptionId.AutoRepeatAttack] = true,
+            },
+            runtime,
+            commands);
+
+        seeder.NoteLoginCompleteSent();
+        seeder.NoteOptionsSeeded();
+
+        var call = Assert.Single(commands.SingleOptionCalls);
+        Assert.Equal((uint)CharacterOptionId.AutoRepeatAttack, call.OptionId);
+        Assert.True(call.Value);
+        Assert.Equal(0, commands.SaveOptionsCallCount);
+        Assert.Equal(["set:0"], commands.CallOrder);
+    }
+
+    [Fact]
+    public void BatchedDifferenceSendsSetSingleOptionThenExactlyOneSaveOptionsAtTheEnd()
+    {
+        using GameRuntime runtime = NewRuntime();
+        runtime.CharacterOwner.Options.Replace(0u, 0u);
+        var commands = new FakeCharacterCommands(runtime.CharacterOwner.Options);
+        var seeder = new HeadlessCharacterOptionsSeeder(
+            new Dictionary<CharacterOptionId, bool>
+            {
+                [CharacterOptionId.IgnoreTradeRequests] = true,
+            },
+            runtime,
+            commands);
+
+        seeder.NoteLoginCompleteSent();
+        seeder.NoteOptionsSeeded();
+
+        var call = Assert.Single(commands.SingleOptionCalls);
+        Assert.Equal((uint)CharacterOptionId.IgnoreTradeRequests, call.OptionId);
+        Assert.True(call.Value);
+        Assert.Equal(1, commands.SaveOptionsCallCount);
+        Assert.Equal(["set:3", "save"], commands.CallOrder);
+    }
+
+    [Fact]
+    public void MixedDeclarationOrdersAllSetsBeforeTheSingleFlush()
+    {
+        using GameRuntime runtime = NewRuntime();
+        runtime.CharacterOwner.Options.Replace(0u, 0u);
+        var commands = new FakeCharacterCommands(runtime.CharacterOwner.Options);
+        var seeder = new HeadlessCharacterOptionsSeeder(
+            new Dictionary<CharacterOptionId, bool>
+            {
+                // Declared out of id order on purpose — the seeder sorts
+                // id-ascending internally, so the batched id (0x03) is
+                // expected AFTER the auto-save id (0x00) regardless of
+                // declaration order, with the flush always last.
+                [CharacterOptionId.IgnoreTradeRequests] = true,
+                [CharacterOptionId.AutoRepeatAttack] = true,
+            },
+            runtime,
+            commands);
+
+        seeder.NoteLoginCompleteSent();
+        seeder.NoteOptionsSeeded();
+
+        Assert.Equal(2, commands.SingleOptionCalls.Count);
+        Assert.Equal(1, commands.SaveOptionsCallCount);
+        Assert.Equal(["set:0", "set:3", "save"], commands.CallOrder);
+    }
+
+    [Fact]
+    public void NeitherPreconditionAloneSendsAnything()
+    {
+        using GameRuntime runtime = NewRuntime();
+        var commands = new FakeCharacterCommands(runtime.CharacterOwner.Options);
+        var seeder = new HeadlessCharacterOptionsSeeder(
+            new Dictionary<CharacterOptionId, bool>
+            {
+                [CharacterOptionId.AutoRepeatAttack] = true,
+            },
+            runtime,
+            commands);
+
+        // Login-complete alone: HasServerSeed is still false (no Replace
+        // ever ran), so the diff cannot trust live state yet.
+        seeder.NoteLoginCompleteSent();
+        Assert.Empty(commands.CallOrder);
+
+        // Now the seed lands — both preconditions are satisfied and the
+        // deferred diff runs from THIS call.
+        runtime.CharacterOwner.Options.Replace(0u, 0u);
+        seeder.NoteOptionsSeeded();
+
+        Assert.Single(commands.SingleOptionCalls);
+    }
+
+    [Fact]
+    public void OptionsSeededBeforeLoginCompleteDefersUntilLoginCompleteArrives()
+    {
+        using GameRuntime runtime = NewRuntime();
+        runtime.CharacterOwner.Options.Replace(0u, 0u);
+        var commands = new FakeCharacterCommands(runtime.CharacterOwner.Options);
+        var seeder = new HeadlessCharacterOptionsSeeder(
+            new Dictionary<CharacterOptionId, bool>
+            {
+                [CharacterOptionId.AutoRepeatAttack] = true,
+            },
+            runtime,
+            commands);
+
+        seeder.NoteOptionsSeeded();
+        Assert.Empty(commands.CallOrder);
+
+        seeder.NoteLoginCompleteSent();
+        Assert.Single(commands.SingleOptionCalls);
+    }
+
+    [Fact]
+    public void EmptyDeclarationNeverSendsRegardlessOfBothSignals()
+    {
+        using GameRuntime runtime = NewRuntime();
+        runtime.CharacterOwner.Options.Replace(0xFFFFFFFFu, 0xFFFFFFFFu);
+        var commands = new FakeCharacterCommands(runtime.CharacterOwner.Options);
+        var seeder = new HeadlessCharacterOptionsSeeder(
+            new Dictionary<CharacterOptionId, bool>(),
+            runtime,
+            commands);
+
+        Assert.False(seeder.HasDeclaredOptions);
+        seeder.NoteLoginCompleteSent();
+        seeder.NoteOptionsSeeded();
+
+        Assert.Empty(commands.CallOrder);
+    }
+
+    /// <summary>
+    /// D8 idempotence — the acceptance bar is "by construction", not a
+    /// special-cased dedupe: a fresh, second seeder instance (mirroring the
+    /// fresh instance <c>HeadlessSessionHost.CreateEventRoute</c> constructs
+    /// per reconnect) diffs against the SAME declared dictionary but against
+    /// live state that already reflects what the first seeder sent — the
+    /// second diff simply finds nothing to do.
+    /// </summary>
+    [Fact]
+    public void ReconnectWithSameDeclarationsAgainstServerThatNowAgreesSendsNothing()
+    {
+        using GameRuntime runtime = NewRuntime();
+        var declared = new Dictionary<CharacterOptionId, bool>
+        {
+            [CharacterOptionId.AutoRepeatAttack] = true,
+        };
+
+        // First connect: server has the option OFF; the bot's declared
+        // value differs, so it sends once.
+        runtime.CharacterOwner.Options.Replace(0u, 0u);
+        var firstCommands = new FakeCharacterCommands(runtime.CharacterOwner.Options);
+        var firstSeeder = new HeadlessCharacterOptionsSeeder(
+            declared, runtime, firstCommands);
+        firstSeeder.NoteLoginCompleteSent();
+        firstSeeder.NoteOptionsSeeded();
+        Assert.Single(firstCommands.SingleOptionCalls);
+
+        // Reconnect: a fresh seeder instance (per CreateEventRoute's own
+        // per-route construction), and the server's fresh PlayerDescription
+        // now echoes what the bot itself set last time.
+        runtime.CharacterOwner.Options.ResetSession();
+        runtime.CharacterOwner.Options.Replace(AutoSaveMask, 0u);
+        var secondCommands = new FakeCharacterCommands(runtime.CharacterOwner.Options);
+        var secondSeeder = new HeadlessCharacterOptionsSeeder(
+            declared, runtime, secondCommands);
+        secondSeeder.NoteLoginCompleteSent();
+        secondSeeder.NoteOptionsSeeded();
+
+        Assert.Empty(secondCommands.CallOrder);
+    }
+
+    private static GameRuntime NewRuntime()
+    {
+        var gameplay = new HeadlessGameplayOperations();
+        var runtime = new GameRuntime(new GameRuntimeDependencies(
+            gameplay,
+            gameplay,
+            gameplay,
+            gameplay));
+        gameplay.Bind(runtime, catalog: null, () => "account");
+        return runtime;
+    }
+
+    /// <summary>
+    /// Writes the bit into <paramref name="options"/> as part of
+    /// <see cref="SetSingleOption"/>, mirroring the REAL
+    /// <c>DirectGameRuntimeCommandAdapter.SetSingleOption</c> →
+    /// <c>RuntimeCharacterOptionsState.TrySetOption</c> contract: the local
+    /// copy updates synchronously, in the same call, before the method
+    /// returns. Without this, a fake that only records the call (never
+    /// mutating live state) would make a SECOND diff pass — e.g. a
+    /// legitimate redundant <c>NoteLoginCompleteSent</c>/<c>NoteOptionsSeeded</c>
+    /// pairing — re-find the same already-handled mismatch and re-send it,
+    /// which is a fidelity gap in the fake, not a real defect: production's
+    /// idempotence depends on exactly this synchronous local write.
+    /// </summary>
+    private sealed class FakeCharacterCommands(
+        RuntimeCharacterOptionsState options) : IRuntimeCharacterCommands
+    {
+        internal List<(uint OptionId, bool Value)> SingleOptionCalls { get; } = [];
+        internal int SaveOptionsCallCount { get; private set; }
+        internal List<string> CallOrder { get; } = [];
+
+        public RuntimeCommandResult Advance(
+            RuntimeGenerationToken expectedGeneration,
+            in RuntimeAdvancementCommand command) =>
+            throw new NotSupportedException(
+                "HeadlessCharacterOptionsSeeder never calls Advance.");
+
+        public RuntimeCommandResult SetSingleOption(
+            RuntimeGenerationToken expectedGeneration,
+            uint optionId,
+            bool value)
+        {
+            SingleOptionCalls.Add((optionId, value));
+            CallOrder.Add($"set:{optionId}");
+            options.SetOptionBit(optionId, value);
+            return new RuntimeCommandResult(
+                RuntimeCommandStatus.Accepted,
+                expectedGeneration);
+        }
+
+        public RuntimeCommandResult SaveOptions(
+            RuntimeGenerationToken expectedGeneration)
+        {
+            SaveOptionsCallCount++;
+            CallOrder.Add("save");
+            return new RuntimeCommandResult(
+                RuntimeCommandStatus.Accepted,
+                expectedGeneration);
+        }
+    }
+}

tests/AcDream.Headless.Tests/HeadlessCharacterOptionsSeederWiringTests.cs

@@ -0,0 +1,357 @@
+using System.Buffers.Binary;
+using System.Collections.Concurrent;
+using System.Diagnostics;
+using System.Net;
+using AcDream.Core.Net;
+using AcDream.Core.Net.Messages;
+using AcDream.Headless.Configuration;
+using AcDream.Headless.Credentials;
+using AcDream.Headless.Diagnostics;
+using AcDream.Headless.Hosting;
+using AcDream.Headless.Platform;
+using AcDream.Runtime;
+using AcDream.Runtime.Session;
+
+namespace AcDream.Headless.Tests;
+
+/// <summary>
+/// Campaign OP slice OP7 (2026-08-11), D8: end-to-end wiring proof that a
+/// declared <c>characterOptions</c> block reaches the real wire through
+/// <see cref="HeadlessSessionHost"/>'s actual production seams — not just
+/// the isolated diff engine (<see cref="HeadlessCharacterOptionsSeederTests"/>
+/// covers that with a fake command surface). A real
+/// <c>PlayerDescription</c> game event is dispatched through
+/// <c>WorldSession.GameEvents</c> exactly like a live server connection
+/// would deliver it (the same mechanism
+/// <c>LiveSessionEventRouterTests.PlayerDescription_ReplacesOptionsBeforeInvokingOnCharacterOptionsChanged</c>
+/// uses) — this proves the REAL
+/// <c>LiveCharacterSessionBindings.OnCharacterOptionsChanged</c> wiring
+/// added in <c>HeadlessSessionHost.CreateEventRoute</c>. The "LoginComplete
+/// already sent" half is driven through the <see cref="HeadlessSessionHost.OptionsSeeder"/>
+/// test seam directly — the three production sites that actually send
+/// <c>GameActionLoginComplete</c> (content-less immediate admission, direct
+/// first-entry completion, portal-space materialization completion) are
+/// each simple one-line delegate wiring already covered by their OWN
+/// existing tests (<c>RuntimeLiveEntitySessionControllerTests</c>); this
+/// class's job is to prove what happens once that signal lands, not to
+/// re-derive it.
+/// </summary>
+public sealed class HeadlessCharacterOptionsSeederWiringTests
+{
+    [Fact]
+    public void DeclaredOptionSendsOnceBothLoginCompleteAndTheRealPlayerDescriptionEventLand()
+    {
+        var operations = new FixtureSessionOperations();
+        using var credential = new HeadlessCredentialSecret(
+            "fixture",
+            "password");
+        using var host = new HeadlessSessionHost(
+            Descriptor(),
+            credential,
+            new HeadlessDiagnosticWriter(TextWriter.Null),
+            operations);
+
+        Assert.Equal(
+            RuntimeSessionStartStatus.Connected,
+            host.Start().Status);
+        Assert.NotNull(host.OptionsSeeder);
+
+        var sent = new List<byte[]>();
+        WorldSession session = operations.Sessions[^1];
+        session.GameActionCapture = body => sent.Add(body);
+
+        // LoginComplete lands first (a legitimate production ordering —
+        // see the type doc); no PlayerDescription has arrived yet, so
+        // HasServerSeed is still false and nothing can send.
+        host.OptionsSeeder!.NoteLoginCompleteSent();
+        Assert.Empty(sent);
+
+        // The real PlayerDescription game event, dispatched through the
+        // ACTUAL session event route production installed — proves
+        // OnCharacterOptionsChanged is really wired, not just callable.
+        // IgnoreAllegianceRequests (0x01, Options1 0x00000004) starts OFF
+        // on the server; the declared value is ON.
+        session.GameEvents.Dispatch(
+            GameEventEnvelope.TryParse(
+                WrapPlayerDescriptionEnvelope(options1: 0u, options2: 0u))!
+                .Value);
+
+        byte[] action = Assert.Single(sent);
+        Assert.Equal(
+            SocialActions.SetSingleCharacterOptionOpcode,
+            ActionOpcode(action));
+        Assert.Equal(
+            (uint)CharacterOptionId.IgnoreAllegianceRequests,
+            BinaryPrimitives.ReadUInt32LittleEndian(action.AsSpan(12, 4)));
+        Assert.Equal(1u, BinaryPrimitives.ReadUInt32LittleEndian(action.AsSpan(16, 4)));
+        Assert.True(
+            host.Runtime.CharacterOwner.Options.HasServerSeed);
+    }
+
+    [Fact]
+    public void ReconnectAgainstAServerThatNowAgreesSendsNothing()
+    {
+        var operations = new FixtureSessionOperations();
+        using var credential = new HeadlessCredentialSecret(
+            "fixture",
+            "password");
+        using var host = new HeadlessSessionHost(
+            Descriptor(),
+            credential,
+            new HeadlessDiagnosticWriter(TextWriter.Null),
+            operations);
+        Assert.Equal(
+            RuntimeSessionStartStatus.Connected,
+            host.Start().Status);
+        WorldSession firstSession = operations.Sessions[^1];
+        var firstSent = new List<byte[]>();
+        firstSession.GameActionCapture = body => firstSent.Add(body);
+        host.OptionsSeeder!.NoteLoginCompleteSent();
+        firstSession.GameEvents.Dispatch(
+            GameEventEnvelope.TryParse(
+                WrapPlayerDescriptionEnvelope(options1: 0u, options2: 0u))!
+                .Value);
+        Assert.Single(firstSent);
+
+        Assert.Equal(
+            RuntimeSessionStartStatus.Connected,
+            host.Reconnect().Status);
+        Assert.NotSame(firstSession, operations.Sessions[^1]);
+        WorldSession secondSession = operations.Sessions[^1];
+        var secondSent = new List<byte[]>();
+        secondSession.GameActionCapture = body => secondSent.Add(body);
+
+        host.OptionsSeeder!.NoteLoginCompleteSent();
+        // The fresh PlayerDescription now echoes what the bot itself set
+        // last connection — IgnoreAllegianceRequests's mask, ON.
+        secondSession.GameEvents.Dispatch(
+            GameEventEnvelope.TryParse(
+                WrapPlayerDescriptionEnvelope(
+                    options1: 0x00000004u,
+                    options2: 0u))!
+                .Value);
+
+        Assert.Empty(secondSent);
+    }
+
+    /// <summary>
+    /// #368: the diff-and-send must run on Runtime's one dedicated update
+    /// thread, exactly like every other gameplay-owner mutation — never a
+    /// new async continuation. Mirrors
+    /// <c>HeadlessProcessSchedulerTests.ProcessHostRunsStartAndEveryTickOnOneDedicatedUpdateThread</c>'s
+    /// own proof shape (occupy the calling thread across real ticks so a
+    /// thread-pool migration would be observable), but additionally drives
+    /// a real PlayerDescription dispatch and a login-complete signal FROM
+    /// INSIDE <c>ILiveSessionOperations.Tick</c> — the same call frame
+    /// <c>HeadlessSessionHost.Tick</c>'s own <c>Runtime.Session.Tick()</c>
+    /// reaches — so the captured send's thread id is measured at the exact
+    /// point production code would run it, not simulated from the test
+    /// thread.
+    /// </summary>
+    [Fact]
+    public async Task DiffAndSendRunsOnTheSameDedicatedUpdateThreadAsEveryTick()
+    {
+        var configuration = new HeadlessConfiguration
+        {
+            Version = 1,
+            Sessions = [Descriptor()],
+        };
+        var operations = new SeedTriggeringSessionOperations();
+        using var diagnostics = new StringWriter();
+        using var host = new HeadlessProcessHost(
+            configuration,
+            HeadlessPathSet.Resolve(new HeadlessPathOverrides()),
+            new System.IO.StringReader("fixture-password" + Environment.NewLine),
+            diagnostics,
+            operations);
+        operations.Host = host.Sessions[0];
+        using var cancellation = new CancellationTokenSource();
+
+        int callerThread = Environment.CurrentManagedThreadId;
+        Task<HeadlessExitCode> run = host.RunAsync(cancellation.Token);
+        var stopwatch = Stopwatch.StartNew();
+        while (operations.SentActions.IsEmpty
+            && stopwatch.Elapsed < TimeSpan.FromSeconds(10))
+        {
+            Thread.Sleep(1);
+        }
+        cancellation.Cancel();
+        HeadlessExitCode result = await run;
+
+        Assert.Equal(HeadlessExitCode.Success, result);
+        (byte[] Body, int ThreadId) sent = Assert.Single(operations.SentActions);
+        Assert.Equal(
+            SocialActions.SetSingleCharacterOptionOpcode,
+            ActionOpcode(sent.Body));
+        Assert.NotEqual(0, sent.ThreadId);
+        Assert.NotEqual(callerThread, sent.ThreadId);
+        Assert.Equal(operations.ConnectThreadId, sent.ThreadId);
+    }
+
+    private static uint ActionOpcode(byte[] body) =>
+        BinaryPrimitives.ReadUInt32LittleEndian(body.AsSpan(8, sizeof(uint)));
+
+    // Minimal PlayerDescription (0x0013) body carrying only the
+    // CharacterOptions1/2 trailer fields — copied from
+    // LiveSessionEventRouterTests.WrapPlayerDescriptionEnvelope (mirrors
+    // GameEventWiringTests.WireAll_PlayerDescription_PublishesCharacterOptions's
+    // fixture layout).
+    private static byte[] WrapPlayerDescriptionEnvelope(
+        uint options1,
+        uint options2)
+    {
+        var stream = new MemoryStream();
+        using (var writer = new BinaryWriter(
+            stream, System.Text.Encoding.UTF8, leaveOpen: true))
+        {
+            writer.Write(0u);       // property flags
+            writer.Write(0x52u);    // player weenie type
+            writer.Write(0u);       // vector flags
+            writer.Write(0u);       // has health
+            writer.Write(0x40u);    // option flags: CharacterOptions2
+            writer.Write(options1);
+            writer.Write(0u);       // legacy hotbar count
+            writer.Write(0u);       // spellbook filters
+            writer.Write(options2);
+            writer.Write(0u);       // inventory count
+            writer.Write(0u);       // equipped count
+        }
+
+        byte[] payload = stream.ToArray();
+        byte[] body = new byte[GameEventEnvelope.HeaderSize + payload.Length];
+        BinaryPrimitives.WriteUInt32LittleEndian(body,            GameEventEnvelope.Opcode);
+        BinaryPrimitives.WriteUInt32LittleEndian(body.AsSpan(4),  0u);
+        BinaryPrimitives.WriteUInt32LittleEndian(body.AsSpan(8),  0u);
+        BinaryPrimitives.WriteUInt32LittleEndian(
+            body.AsSpan(12), (uint)GameEventType.PlayerDescription);
+        Array.Copy(payload, 0, body, GameEventEnvelope.HeaderSize, payload.Length);
+        return body;
+    }
+
+    private static HeadlessSessionDescriptor Descriptor() => new()
+    {
+        Id = "bot",
+        Endpoint = new HeadlessEndpointDescriptor
+        {
+            Host = "127.0.0.1",
+            Port = 9000,
+        },
+        Account = "account",
+        Character = new HeadlessCharacterSelector
+        {
+            Name = "headless",
+        },
+        Policy = new HeadlessBotPolicyDescriptor
+        {
+            Id = "idle",
+        },
+        Credential = new HeadlessCredentialReference
+        {
+            Provider = HeadlessCredentialProviderKind.StandardInput,
+            Reference = "fixture-password",
+        },
+        CharacterOptions = new Dictionary<string, bool>
+        {
+            ["IgnoreAllegianceRequests"] = true,
+        },
+    };
+
+    private sealed class FixtureSessionOperations : ILiveSessionOperations
+    {
+        public List<WorldSession> Sessions { get; } = [];
+
+        public IPEndPoint ResolveEndpoint(string host, int port) =>
+            new(IPAddress.Loopback, port);
+
+        public WorldSession CreateSession(IPEndPoint endpoint)
+        {
+            var session = new WorldSession(endpoint);
+            Sessions.Add(session);
+            return session;
+        }
+
+        public void Connect(WorldSession session, string user, string password)
+        {
+        }
+
+        public CharacterList.Parsed GetCharacters(WorldSession session) =>
+            new(
+                0u,
+                [new CharacterList.Character(0x50000001u, "Headless", 0u)],
+                [],
+                11,
+                "account",
+                true,
+                true);
+
+        public void EnterWorld(WorldSession session, int activeCharacterIndex)
+        {
+        }
+
+        public void Tick(WorldSession session)
+        {
+        }
+
+        public void DisposeSession(WorldSession session) => session.Dispose();
+    }
+
+    /// <summary>
+    /// Thread-affinity fixture: on its first <see cref="Tick"/> call it
+    /// drives login-complete plus a real PlayerDescription dispatch from
+    /// INSIDE the call — the same frame production's
+    /// <c>Runtime.Session.Tick()</c> reaches <c>ILiveSessionOperations.Tick</c>
+    /// from. <see cref="Host"/> is wired AFTER construction (the
+    /// <see cref="HeadlessSessionHost"/> does not exist yet when this fixture
+    /// is passed into <see cref="HeadlessProcessHost"/>'s constructor).
+    /// </summary>
+    private sealed class SeedTriggeringSessionOperations : ILiveSessionOperations
+    {
+        private int _connectThreadId;
+        private int _dispatched;
+
+        internal HeadlessSessionHost? Host { get; set; }
+        internal int ConnectThreadId => Volatile.Read(ref _connectThreadId);
+        internal ConcurrentQueue<(byte[] Body, int ThreadId)> SentActions { get; } = new();
+
+        public IPEndPoint ResolveEndpoint(string host, int port) =>
+            new(IPAddress.Loopback, port);
+
+        public WorldSession CreateSession(IPEndPoint endpoint)
+        {
+            var session = new WorldSession(endpoint);
+            session.GameActionCapture = body => SentActions.Enqueue(
+                (body, Environment.CurrentManagedThreadId));
+            return session;
+        }
+
+        public void Connect(WorldSession session, string user, string password) =>
+            Volatile.Write(ref _connectThreadId, Environment.CurrentManagedThreadId);
+
+        public CharacterList.Parsed GetCharacters(WorldSession session) =>
+            new(
+                0u,
+                [new CharacterList.Character(0x50000001u, "Headless", 0u)],
+                [],
+                11,
+                "account",
+                true,
+                true);
+
+        public void EnterWorld(WorldSession session, int activeCharacterIndex)
+        {
+        }
+
+        public void Tick(WorldSession session)
+        {
+            if (Interlocked.Exchange(ref _dispatched, 1) != 0)
+                return;
+            Host?.OptionsSeeder?.NoteLoginCompleteSent();
+            session.GameEvents.Dispatch(
+                GameEventEnvelope.TryParse(
+                    WrapPlayerDescriptionEnvelope(options1: 0u, options2: 0u))!
+                    .Value);
+        }
+
+        public void DisposeSession(WorldSession session) => session.Dispose();
+    }
+}

tests/AcDream.Headless.Tests/HeadlessConfigurationLoaderTests.cs

@@ -0,0 +1,177 @@
+using System.Text.Json;
+using AcDream.Headless.Configuration;
+
+namespace AcDream.Headless.Tests;
+
+/// <summary>
+/// Campaign OP slice OP7 (2026-08-11), D8: schema tests for the optional
+/// per-session <c>characterOptions</c> block —
+/// docs/plans/2026-08-10-options-panel-campaign.md §4 OP7. Exercises
+/// <see cref="HeadlessConfigurationLoader.Load"/> directly (rather than
+/// through <c>HeadlessEntryPoint</c>'s CLI wrapper) so assertions can pin the
+/// exact exception type/message for the semantic "unknown name" rejection,
+/// matching the loader's own established split: type-shape violations
+/// (missing required field, wrong JSON value kind) fail during
+/// deserialization itself with a raw <see cref="JsonException"/>; semantic
+/// violations of an already-well-typed value fail with
+/// <see cref="HeadlessConfigurationException"/> (see
+/// <see cref="HeadlessConfigurationLoader"/>'s own doc comment on
+/// <c>ValidateCharacterOptions</c>).
+/// </summary>
+public sealed class HeadlessConfigurationLoaderTests
+{
+    [Fact]
+    public void ValidCharacterOptionsBlockParsesExactDeclaredNames()
+    {
+        using TemporaryConfiguration file = TemporaryConfiguration.Create(
+            ConfigurationWith(Session(
+                "bot",
+                "BOT_PASSWORD",
+                """
+                "characterOptions":{
+                    "IgnoreAllegianceRequests":true,
+                    "ListenToTradeChat":false,
+                    "AutoTarget":true
+                }
+                """)));
+
+        HeadlessConfiguration configuration =
+            HeadlessConfigurationLoader.Load(file.Path);
+
+        Dictionary<string, bool>? declared =
+            Assert.Single(configuration.Sessions)!.CharacterOptions;
+        Assert.NotNull(declared);
+        Assert.Equal(3, declared!.Count);
+        Assert.True(declared["IgnoreAllegianceRequests"]);
+        Assert.False(declared["ListenToTradeChat"]);
+        Assert.True(declared["AutoTarget"]);
+    }
+
+    [Fact]
+    public void UnknownOptionNameFailsLoadNamingTheOffendingKey()
+    {
+        using TemporaryConfiguration file = TemporaryConfiguration.Create(
+            ConfigurationWith(Session(
+                "bot",
+                "BOT_PASSWORD",
+                "\"characterOptions\":{\"NotARealOption\":true}")));
+
+        HeadlessConfigurationException exception = Assert.Throws<
+            HeadlessConfigurationException>(
+                () => HeadlessConfigurationLoader.Load(file.Path));
+
+        Assert.Contains(
+            "NotARealOption",
+            exception.Message,
+            StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void PresentationOnlyTierThreeOptionNameFailsLoad()
+    {
+        // ShowHelm is a REAL CharacterOptionId member (0x2F) but is
+        // deliberately outside the tier-1+2 bot-declarable subset (research
+        // doc §5.2 tier 3) — excluded by construction, not merely absent
+        // from an allow-list that forgot it.
+        using TemporaryConfiguration file = TemporaryConfiguration.Create(
+            ConfigurationWith(Session(
+                "bot",
+                "BOT_PASSWORD",
+                "\"characterOptions\":{\"ShowHelm\":true}")));
+
+        HeadlessConfigurationException exception = Assert.Throws<
+            HeadlessConfigurationException>(
+                () => HeadlessConfigurationLoader.Load(file.Path));
+
+        Assert.Contains(
+            "ShowHelm",
+            exception.Message,
+            StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void NonBoolValueFailsLoad()
+    {
+        using TemporaryConfiguration file = TemporaryConfiguration.Create(
+            ConfigurationWith(Session(
+                "bot",
+                "BOT_PASSWORD",
+                "\"characterOptions\":{\"IgnoreAllegianceRequests\":\"yes\"}")));
+
+        Assert.ThrowsAny<Exception>(
+            () => HeadlessConfigurationLoader.Load(file.Path));
+    }
+
+    [Fact]
+    public void AbsentCharacterOptionsBlockIsANoOp()
+    {
+        using TemporaryConfiguration file = TemporaryConfiguration.Create(
+            ConfigurationWith(Session("bot", "BOT_PASSWORD")));
+
+        HeadlessConfiguration configuration =
+            HeadlessConfigurationLoader.Load(file.Path);
+
+        Assert.Null(Assert.Single(configuration.Sessions)!.CharacterOptions);
+    }
+
+    [Fact]
+    public void EmptyCharacterOptionsBlockIsANoOp()
+    {
+        using TemporaryConfiguration file = TemporaryConfiguration.Create(
+            ConfigurationWith(Session(
+                "bot",
+                "BOT_PASSWORD",
+                "\"characterOptions\":{}")));
+
+        HeadlessConfiguration configuration =
+            HeadlessConfigurationLoader.Load(file.Path);
+
+        Dictionary<string, bool>? declared =
+            Assert.Single(configuration.Sessions)!.CharacterOptions;
+        Assert.NotNull(declared);
+        Assert.Empty(declared!);
+    }
+
+    private static string ConfigurationWith(params string[] sessions) =>
+        $$"""{"version":1,"sessions":[{{string.Join(",", sessions)}}]}""";
+
+    private static string Session(
+        string id,
+        string credentialReference,
+        string? extraTopLevelField = null)
+    {
+        string suffix = extraTopLevelField is null
+            ? string.Empty
+            : $",{extraTopLevelField}";
+        return $"{{\"id\":\"{id}\",\"endpoint\":{{\"host\":\"127.0.0.1\",\"port\":9000}},"
+            + "\"account\":\"account\",\"character\":{\"index\":0},"
+            + "\"policy\":{\"id\":\"idle\"},\"credential\":"
+            + $"{{\"provider\":\"environment\",\"reference\":\"{credentialReference}\"}}"
+            + suffix
+            + "}";
+    }
+
+    private sealed class TemporaryConfiguration : IDisposable
+    {
+        private TemporaryConfiguration(string path)
+        {
+            Path = path;
+        }
+
+        internal string Path { get; }
+
+        internal static TemporaryConfiguration Create(string json)
+        {
+            string path = System.IO.Path.Combine(
+                System.IO.Path.GetTempPath(),
+                $"acdream-headless-op7-{Guid.NewGuid():N}.json");
+            File.WriteAllText(path, json);
+            return new TemporaryConfiguration(path);
+        }
+
+        public void Dispose()
+        {
+            File.Delete(Path);
+        }
+    }
+}