feat(launcher): Campaign LA LA3 — AcDream.Launcher.Core profile store, composer, supervisor, status tailer

New AcDream.Launcher.Core (BCL-only, ProjectReference: AcDream.Platform
ONLY) plus tests/AcDream.Launcher.Core.Tests, both registered in
AcDream.slnx. This is the file-contract orchestrator core the Avalonia
launcher (LA4) will bind to — the game solution (Core/Runtime/App/
Headless) stays entirely out of this dependency graph, so the launcher
can never accidentally grow a game-protocol coupling.

- Profiles/: LauncherProfileStore owns launcher-profiles.json (spec §5
  schema: version 1, servers[]/accounts[]/characters[]), strict
  camelCase System.Text.Json (UnmappedMemberHandling.Disallow), typed
  CRUD (add/edit/remove server; add/edit/remove account; edit character
  settings), and MergeRoster (fold a reported roster into an account's
  characters[] while preserving user-owned launchMode/plugins/
  loginCommands, adding new rows with default guiSelect, and retaining
  rows absent from the roster — they may be pending-delete). 0600 on
  Linux via File.SetUnixFileMode after save.
- Launching/: SessionConfigComposer builds the pinned session-config
  contract (Headless K1 shape + plugins/loginCommands/
  loginCommandDelayMs/statusFile) from a profile character + install
  record — character selector omitted entirely for guiSelect, policy
  {id:"idle"} only for headless, credential always standardInput/
  session. Passwords never enter this document (proven by a dedicated
  test). LauncherProcessSupervisor spawns a host, feeds the password to
  stdin then closes it, and exposes Starting/Running/Exited lifecycle;
  Stop calls CloseMainWindow falling back to Kill after a timeout, both
  reachable through an injectable ILauncherChildProcess/factory seam so
  the state machine is unit-testable without real OS process timing.
- Status/: StatusEventParser decodes the v1 status.jsonl vocabulary
  (started/connected/characterList/enteredWorld/pluginLoaded/
  pluginFailed/disconnected/exited); an unrecognized "e" or a malformed
  line degrades to a typed Unknown event rather than throwing.
  StatusFileTailer incrementally reads new lines, tolerating a
  not-yet-existing file and a partial trailing line (only advances its
  read position past confirmed '\n' boundaries; a truncated tail is
  simply re-read next poll, never parsed early).
- Integrity/: streaming SHA-256 + hex verify for later pak/download
  checks (LA9/LA10).

Tests: 71 passed (profile CRUD + roster-merge matrix + strict-schema
rejection; composer golden-shape tests for gui/guiSelect/headless +
password-absence; supervisor tests against both an injected fake child
(state-machine determinism) and a real spawned `dotnet --version`
child (genuine cross-platform stdin/exit-code proof); tailer tests
incl. partial-line and not-yet-existing-file; SHA-256 tests). Verified
green on Windows (Release) and native WSL/Linux (Release) — the Linux
0600 test executes its real assertion body under WSL rather than
early-returning.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/AcDream.Launcher.Core/AcDream.Launcher.Core.csproj

@@ -0,0 +1,12 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <LangVersion>latest</LangVersion>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+  </PropertyGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\AcDream.Platform\AcDream.Platform.csproj" />
+  </ItemGroup>
+</Project>

src/AcDream.Launcher.Core/Integrity/FileIntegrity.cs

@@ -0,0 +1,61 @@
+using System.Security.Cryptography;
+
+namespace AcDream.Launcher.Core.Integrity;
+
+/// <summary>
+/// Streaming SHA-256 for pak/download verification, consumed by the
+/// install engine (LA9) and the updater (LA10). Kept minimal in this
+/// slice: hash a file and compare its hex digest.
+/// </summary>
+public static class FileIntegrity
+{
+    /// <summary>
+    /// Computes the lower-case hex SHA-256 digest of a file, streaming it
+    /// from disk rather than loading it fully into memory (relevant for
+    /// the ~30&#160;GB pak file LA9 verifies).
+    /// </summary>
+    public static string ComputeSha256Hex(string filePath)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(filePath);
+
+        using FileStream stream = new(
+            filePath,
+            FileMode.Open,
+            FileAccess.Read,
+            FileShare.Read);
+        byte[] hash = SHA256.HashData(stream);
+        return Convert.ToHexStringLower(hash);
+    }
+
+    public static async Task<string> ComputeSha256HexAsync(
+        string filePath,
+        CancellationToken cancellationToken = default)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(filePath);
+
+        await using FileStream stream = new(
+            filePath,
+            FileMode.Open,
+            FileAccess.Read,
+            FileShare.Read,
+            bufferSize: 4096,
+            useAsync: true);
+        byte[] hash = await SHA256.HashDataAsync(stream, cancellationToken)
+            .ConfigureAwait(false);
+        return Convert.ToHexStringLower(hash);
+    }
+
+    /// <summary>Case-insensitive hex comparison — callers may receive an
+    /// expected digest in either case from a manifest or a hand-typed
+    /// fixture.</summary>
+    public static bool Matches(string actualHex, string expectedHex)
+    {
+        ArgumentNullException.ThrowIfNull(actualHex);
+        ArgumentNullException.ThrowIfNull(expectedHex);
+        return string.Equals(actualHex, expectedHex, StringComparison.OrdinalIgnoreCase);
+    }
+
+    /// <summary>Computes and compares in one call.</summary>
+    public static bool Verify(string filePath, string expectedHex) =>
+        Matches(ComputeSha256Hex(filePath), expectedHex);
+}

src/AcDream.Launcher.Core/Launching/ILauncherChildProcess.cs

@@ -0,0 +1,120 @@
+using System.Diagnostics;
+
+namespace AcDream.Launcher.Core.Launching;
+
+/// <summary>
+/// Thin seam over <see cref="System.Diagnostics.Process"/> so
+/// <see cref="LauncherProcessSupervisor"/>'s lifecycle and Stop
+/// (CloseMainWindow, falling back to Kill after a timeout) state machine
+/// can be unit-tested against an in-memory fake without spawning a real
+/// OS process or depending on real window-message timing — both
+/// "injectable for tests" per Campaign LA spec §3.
+/// </summary>
+public interface ILauncherChildProcess : IDisposable
+{
+    bool HasExited { get; }
+
+    int ExitCode { get; }
+
+    /// <summary>The child's redirected stdin. The supervisor writes the
+    /// account password here (followed by a newline) and then closes it —
+    /// never anywhere else.</summary>
+    TextWriter StandardInput { get; }
+
+    /// <summary>Fires exactly once, when the child process terminates
+    /// (mirrors <see cref="Process.Exited"/> with
+    /// <c>EnableRaisingEvents</c> on).</summary>
+    event EventHandler? Exited;
+
+    void Start();
+
+    /// <summary>Mirrors <see cref="Process.CloseMainWindow"/> — requests
+    /// a graceful close via WM_CLOSE. Returns false for a console/no-
+    /// window process (never throws), matching the real API.</summary>
+    bool CloseMainWindow();
+
+    /// <summary>Mirrors <see cref="Process.Kill(bool)"/> with
+    /// <c>entireProcessTree: true</c>.</summary>
+    void Kill();
+
+    bool WaitForExit(TimeSpan timeout);
+}
+
+/// <summary>Creates <see cref="ILauncherChildProcess"/> instances from a
+/// <see cref="LauncherProcessSpec"/>.</summary>
+public interface ILauncherChildProcessFactory
+{
+    ILauncherChildProcess Create(LauncherProcessSpec spec);
+}
+
+/// <summary>Real-process implementation used in production.</summary>
+public sealed class SystemChildProcessFactory : ILauncherChildProcessFactory
+{
+    public ILauncherChildProcess Create(LauncherProcessSpec spec) =>
+        new SystemChildProcess(spec);
+}
+
+internal sealed class SystemChildProcess : ILauncherChildProcess
+{
+    private readonly Process _process;
+    private bool _raisingEnabled;
+
+    internal SystemChildProcess(LauncherProcessSpec spec)
+    {
+        ArgumentNullException.ThrowIfNull(spec);
+
+        var startInfo = new ProcessStartInfo
+        {
+            FileName = spec.ExecutablePath,
+            RedirectStandardInput = true,
+            UseShellExecute = false,
+        };
+
+        foreach (string argument in spec.Arguments)
+        {
+            startInfo.ArgumentList.Add(argument);
+        }
+
+        if (!string.IsNullOrEmpty(spec.WorkingDirectory))
+        {
+            startInfo.WorkingDirectory = spec.WorkingDirectory;
+        }
+
+        _process = new Process { StartInfo = startInfo };
+    }
+
+    public bool HasExited => _process.HasExited;
+
+    public int ExitCode => _process.ExitCode;
+
+    public TextWriter StandardInput => _process.StandardInput;
+
+    public event EventHandler? Exited;
+
+    public void Start()
+    {
+        _process.EnableRaisingEvents = true;
+        _process.Exited += OnExited;
+        _raisingEnabled = true;
+        _process.Start();
+    }
+
+    public bool CloseMainWindow() => _process.CloseMainWindow();
+
+    public void Kill() => _process.Kill(entireProcessTree: true);
+
+    public bool WaitForExit(TimeSpan timeout) => _process.WaitForExit(timeout);
+
+    public void Dispose()
+    {
+        if (_raisingEnabled)
+        {
+            _process.Exited -= OnExited;
+        }
+
+        _process.Dispose();
+    }
+
+    private void OnExited(object? sender, EventArgs e) =>
+        Exited?.Invoke(this, EventArgs.Empty);
+}

src/AcDream.Launcher.Core/Launching/LauncherInstallRecord.cs

@@ -0,0 +1,12 @@
+namespace AcDream.Launcher.Core.Launching;
+
+/// <summary>
+/// The DAT/pak locations a completed install (LA9) records and every
+/// session-config composition consumes for
+/// <see cref="SessionContentDescriptor"/>. SHA-256/version bookkeeping
+/// for the install record itself is LA9/LA10 scope; this slice only
+/// needs the two paths a session config requires.
+/// </summary>
+public sealed record LauncherInstallRecord(
+    string DatDirectory,
+    string PreparedAssetPath);

src/AcDream.Launcher.Core/Launching/LauncherProcessSpec.cs

@@ -0,0 +1,15 @@
+namespace AcDream.Launcher.Core.Launching;
+
+/// <summary>
+/// What to spawn: the host executable path + argument list (both
+/// injectable per Campaign LA spec §3, e.g. <c>AcDream.Headless --config
+/// &lt;path&gt;</c> or <c>AcDream.App --session-config &lt;path&gt;</c>).
+/// Deliberately carries no credential field — the password is a separate
+/// transient parameter to <see cref="LauncherProcessSupervisor.Start"/>
+/// that flows only to the child's stdin, never into this spec, an
+/// argument list, or a process environment.
+/// </summary>
+public sealed record LauncherProcessSpec(
+    string ExecutablePath,
+    IReadOnlyList<string> Arguments,
+    string? WorkingDirectory = null);

src/AcDream.Launcher.Core/Launching/LauncherProcessSupervisor.cs

@@ -0,0 +1,146 @@
+namespace AcDream.Launcher.Core.Launching;
+
+/// <summary>
+/// Spawns a host process (App/Headless), feeds the account password to
+/// its stdin then closes it, and supervises its lifetime (Campaign LA
+/// spec §3/§6). One supervisor instance owns exactly one child process
+/// for its lifetime — start a new supervisor per launched session.
+/// </summary>
+public sealed class LauncherProcessSupervisor : IDisposable
+{
+    private readonly ILauncherChildProcessFactory _factory;
+    private readonly object _gate = new();
+    private ILauncherChildProcess? _process;
+
+    public LauncherProcessSupervisor(ILauncherChildProcessFactory? factory = null)
+    {
+        _factory = factory ?? new SystemChildProcessFactory();
+    }
+
+    public LauncherSessionState State { get; private set; } = LauncherSessionState.Starting;
+
+    /// <summary>Set once <see cref="State"/> reaches
+    /// <see cref="LauncherSessionState.Exited"/>; null before then.
+    /// </summary>
+    public int? ExitCode { get; private set; }
+
+    /// <summary>Fires on every <see cref="LauncherSessionState"/>
+    /// transition, in order.</summary>
+    public event EventHandler<LauncherSessionState>? StateChanged;
+
+    /// <summary>
+    /// Spawns the child described by <paramref name="spec"/>, writes
+    /// <paramref name="password"/> (if any) followed by a newline to its
+    /// stdin, then closes stdin. The password is never written anywhere
+    /// else — not into <paramref name="spec"/>, not into an environment
+    /// variable, not logged.
+    /// </summary>
+    public void Start(LauncherProcessSpec spec, string? password)
+    {
+        ArgumentNullException.ThrowIfNull(spec);
+
+        ILauncherChildProcess process;
+        lock (_gate)
+        {
+            if (_process is not null)
+            {
+                throw new InvalidOperationException(
+                    "This supervisor already owns a process; start a new "
+                    + "supervisor per launched session.");
+            }
+
+            process = _factory.Create(spec);
+            process.Exited += OnProcessExited;
+            _process = process;
+        }
+
+        SetState(LauncherSessionState.Starting);
+
+        try
+        {
+            process.Start();
+
+            if (password is not null)
+            {
+                process.StandardInput.Write(password);
+                process.StandardInput.Write('\n');
+                process.StandardInput.Flush();
+            }
+
+            process.StandardInput.Close();
+        }
+        catch
+        {
+            lock (_gate)
+            {
+                process.Exited -= OnProcessExited;
+                _process = null;
+            }
+
+            throw;
+        }
+
+        SetState(LauncherSessionState.Running);
+    }
+
+    /// <summary>
+    /// Requests a graceful stop (CloseMainWindow), falling back to Kill
+    /// if the process has not exited within <paramref name="timeout"/>.
+    /// A no-op if <see cref="Start"/> was never called or the process has
+    /// already exited.
+    /// </summary>
+    public void Stop(TimeSpan timeout)
+    {
+        ILauncherChildProcess? process;
+        lock (_gate)
+        {
+            process = _process;
+        }
+
+        if (process is null || process.HasExited)
+        {
+            return;
+        }
+
+        process.CloseMainWindow();
+        if (!process.WaitForExit(timeout) && !process.HasExited)
+        {
+            process.Kill();
+        }
+    }
+
+    private void OnProcessExited(object? sender, EventArgs e)
+    {
+        ILauncherChildProcess? process;
+        lock (_gate)
+        {
+            process = _process;
+        }
+
+        ExitCode = process is { HasExited: true } ? process.ExitCode : null;
+        SetState(LauncherSessionState.Exited);
+    }
+
+    private void SetState(LauncherSessionState state)
+    {
+        lock (_gate)
+        {
+            State = state;
+        }
+
+        StateChanged?.Invoke(this, state);
+    }
+
+    public void Dispose()
+    {
+        lock (_gate)
+        {
+            if (_process is not null)
+            {
+                _process.Exited -= OnProcessExited;
+                _process.Dispose();
+                _process = null;
+            }
+        }
+    }
+}

src/AcDream.Launcher.Core/Launching/LauncherSessionState.cs

@@ -0,0 +1,21 @@
+namespace AcDream.Launcher.Core.Launching;
+
+/// <summary>Lifecycle of a launched host process, per Campaign LA spec §3
+/// ("supervise lifetime ... surface typed session state").</summary>
+public enum LauncherSessionState
+{
+    /// <summary>The child process has been created and the credential
+    /// handed off, but has not yet reached <see cref="Running"/>.</summary>
+    Starting,
+
+    /// <summary>The child process is spawned and its stdin has been
+    /// closed. Says nothing about game-level connection state — that
+    /// comes from the status stream (see
+    /// <c>AcDream.Launcher.Core.Status</c>).</summary>
+    Running,
+
+    /// <summary>The child process has exited. See
+    /// <see cref="LauncherProcessSupervisor.ExitCode"/> for the exit
+    /// code.</summary>
+    Exited,
+}

src/AcDream.Launcher.Core/Launching/SessionConfigComposer.cs

@@ -0,0 +1,167 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using AcDream.Launcher.Core.Profiles;
+using AcDream.Platform;
+
+namespace AcDream.Launcher.Core.Launching;
+
+/// <summary>The composed session-config document plus the two per-launch
+/// paths derived from the session id, per Campaign LA spec §6.</summary>
+public sealed record ComposedSessionConfig(
+    string SessionId,
+    string ConfigFilePath,
+    string StatusFilePath,
+    SessionConfigDocument Document);
+
+/// <summary>
+/// Builds the per-launch <see cref="SessionConfigDocument"/> from a
+/// profile character + install record (Campaign LA spec §6). Passwords
+/// NEVER appear in the composed document — the credential is always the
+/// <c>standardInput</c> provider; the launcher feeds the password to the
+/// child process's stdin separately (<see cref="LauncherProcessSupervisor"/>).
+/// </summary>
+public static class SessionConfigComposer
+{
+    internal static readonly JsonSerializerOptions SerializerOptions = new()
+    {
+        PropertyNamingPolicy = JsonNamingPolicy.CamelCase,
+        DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull,
+        WriteIndented = true,
+    };
+
+    /// <summary>
+    /// Builds the document and the paths it would be written to under
+    /// <c>&lt;CacheDirectory&gt;/launcher/sessions/&lt;sessionId&gt;/</c>,
+    /// without touching disk. <paramref name="sessionId"/> is caller-
+    /// supplied so composition stays a pure function of its inputs
+    /// (golden-file tests pass a fixed id).
+    /// </summary>
+    public static ComposedSessionConfig Compose(
+        ServerProfile server,
+        AccountProfile account,
+        CharacterProfile character,
+        LauncherInstallRecord install,
+        ApplicationPathSet paths,
+        string sessionId,
+        int? loginCommandDelayMs = null)
+    {
+        ArgumentNullException.ThrowIfNull(server);
+        ArgumentNullException.ThrowIfNull(account);
+        ArgumentNullException.ThrowIfNull(character);
+        ArgumentNullException.ThrowIfNull(install);
+        ArgumentNullException.ThrowIfNull(paths);
+        ArgumentException.ThrowIfNullOrWhiteSpace(sessionId);
+
+        string sessionDirectory = Path.Combine(
+            paths.CacheDirectory,
+            "launcher",
+            "sessions",
+            sessionId);
+        string configFilePath = Path.Combine(sessionDirectory, "session.json");
+        string statusFilePath = Path.Combine(sessionDirectory, "status.jsonl");
+
+        SessionCharacterSelector? selector = character.LaunchMode == LaunchMode.GuiSelect
+            ? null
+            : BuildSelector(character);
+
+        SessionPolicyDescriptor? policy = character.LaunchMode == LaunchMode.Headless
+            ? new SessionPolicyDescriptor()
+            : null;
+
+        var descriptor = new SessionDescriptor
+        {
+            Id = sessionId,
+            Endpoint = new SessionEndpointDescriptor
+            {
+                Host = server.Host,
+                Port = server.Port,
+            },
+            Account = account.Account,
+            Character = selector,
+            Policy = policy,
+            Credential = new SessionCredentialDescriptor(),
+            Plugins = character.Plugins.Count > 0 ? [.. character.Plugins] : null,
+            LoginCommands = character.LoginCommands.Count > 0
+                ? [.. character.LoginCommands]
+                : null,
+            LoginCommandDelayMs = loginCommandDelayMs,
+            StatusFile = statusFilePath,
+        };
+
+        var document = new SessionConfigDocument
+        {
+            Process = new SessionProcessSettings
+            {
+                Paths = new SessionPathOverrides(),
+                Content = new SessionContentDescriptor
+                {
+                    DatDirectory = install.DatDirectory,
+                    PreparedAssetPath = install.PreparedAssetPath,
+                },
+            },
+            Sessions = [descriptor],
+        };
+
+        return new ComposedSessionConfig(
+            sessionId,
+            configFilePath,
+            statusFilePath,
+            document);
+    }
+
+    /// <summary>Composes and writes <c>session.json</c> to
+    /// <see cref="ComposedSessionConfig.ConfigFilePath"/>, creating the
+    /// per-session directory. The status file itself is created by the
+    /// launched host, not the launcher.</summary>
+    public static ComposedSessionConfig ComposeAndWrite(
+        ServerProfile server,
+        AccountProfile account,
+        CharacterProfile character,
+        LauncherInstallRecord install,
+        ApplicationPathSet paths,
+        string sessionId,
+        int? loginCommandDelayMs = null)
+    {
+        ComposedSessionConfig composed = Compose(
+            server,
+            account,
+            character,
+            install,
+            paths,
+            sessionId,
+            loginCommandDelayMs);
+
+        string? directory = Path.GetDirectoryName(composed.ConfigFilePath);
+        if (!string.IsNullOrEmpty(directory))
+        {
+            Directory.CreateDirectory(directory);
+        }
+
+        using FileStream stream = File.Create(composed.ConfigFilePath);
+        JsonSerializer.Serialize(stream, composed.Document, SerializerOptions);
+
+        return composed;
+    }
+
+    /// <summary>Serializes the composed document exactly as
+    /// <see cref="ComposeAndWrite"/> would write it — used by golden-file
+    /// tests that assert on the JSON text without touching disk.</summary>
+    public static string Serialize(SessionConfigDocument document) =>
+        JsonSerializer.Serialize(document, SerializerOptions);
+
+    private static SessionCharacterSelector BuildSelector(CharacterProfile character)
+    {
+        if (CharacterIdFormat.TryParse(character.Id, out uint id))
+        {
+            return new SessionCharacterSelector { Id = id };
+        }
+
+        if (!string.IsNullOrWhiteSpace(character.Name))
+        {
+            return new SessionCharacterSelector { Name = character.Name };
+        }
+
+        throw new InvalidOperationException(
+            "Character has neither a usable id nor a name to select by.");
+    }
+}

src/AcDream.Launcher.Core/Launching/SessionConfigDocument.cs

@@ -0,0 +1,134 @@
+namespace AcDream.Launcher.Core.Launching;
+
+/// <summary>
+/// The per-launch session-config document written to
+/// <c>&lt;CacheDirectory&gt;/launcher/sessions/&lt;sessionId&gt;/session.json</c>
+/// and consumed by <c>AcDream.Headless --config</c> / (LA1)
+/// <c>AcDream.App --session-config</c>.
+///
+/// <para>
+/// PINNED CONTRACT (Campaign LA plan §LA3): this is the Slice K1
+/// <c>HeadlessConfiguration</c> version-1 shape extended with optional
+/// launcher fields (<c>plugins</c>, <c>loginCommands</c>,
+/// <c>loginCommandDelayMs</c>, <c>statusFile</c>). Launcher.Core defines
+/// its own DTOs rather than referencing <c>AcDream.Headless</c> — the
+/// project reference set for this assembly is <c>AcDream.Platform</c>
+/// ONLY (no game-solution dependency; see LA3 acceptance).
+/// Serialized camelCase via <see cref="SessionConfigComposer"/>, with
+/// null optional members omitted from the written JSON.
+/// </para>
+/// </summary>
+public sealed class SessionConfigDocument
+{
+    public int Version { get; init; } = 1;
+
+    public SessionProcessSettings Process { get; init; } = new();
+
+    public List<SessionDescriptor> Sessions { get; init; } = [];
+}
+
+public sealed class SessionProcessSettings
+{
+    public SessionPathOverrides Paths { get; init; } = new();
+
+    public SessionContentDescriptor Content { get; init; } = new();
+}
+
+/// <summary>All three members are optional overrides; a host resolves
+/// its own default <c>ApplicationPathSet</c> when a member is
+/// omitted.</summary>
+public sealed class SessionPathOverrides
+{
+    public string? ConfigDirectory { get; init; }
+
+    public string? DataDirectory { get; init; }
+
+    public string? CacheDirectory { get; init; }
+}
+
+// NOTE: these DTOs are write-only (Launcher.Core composes and serializes
+// them; it never deserializes a session-config document back). Members
+// that the pinned contract calls "always present" therefore use plain
+// non-nullable defaults rather than C#'s `required` modifier — a
+// `required` member cannot be given a `= new()` default on a containing
+// type without a [SetsRequiredMembers] constructor, and correctness here
+// is enforced by SessionConfigComposer's tests, not the compiler.
+
+public sealed class SessionContentDescriptor
+{
+    public string DatDirectory { get; init; } = string.Empty;
+
+    public string PreparedAssetPath { get; init; } = string.Empty;
+}
+
+public sealed class SessionDescriptor
+{
+    public string Id { get; init; } = string.Empty;
+
+    public SessionEndpointDescriptor Endpoint { get; init; } = new();
+
+    public string Account { get; init; } = string.Empty;
+
+    /// <summary>Exactly one of index/id/name when present. OMITTED
+    /// entirely for a <c>guiSelect</c> launch (retail character-select
+    /// screen instead of auto-enter).</summary>
+    public SessionCharacterSelector? Character { get; init; }
+
+    /// <summary>Present only for a <c>headless</c> launch (the <c>idle</c>
+    /// bot policy). Omitted for <c>gui</c>/<c>guiSelect</c>.</summary>
+    public SessionPolicyDescriptor? Policy { get; init; }
+
+    public SessionCredentialDescriptor Credential { get; init; } = new();
+
+    /// <summary>Omitted (never an empty array) when the character has no
+    /// configured plugin set.</summary>
+    public List<string>? Plugins { get; init; }
+
+    /// <summary>Omitted (never an empty array) when the character has no
+    /// configured login commands.</summary>
+    public List<string>? LoginCommands { get; init; }
+
+    /// <summary>Overrides the host's default 500&#160;ms inter-command
+    /// delay when set; omitted otherwise.</summary>
+    public int? LoginCommandDelayMs { get; init; }
+
+    public string StatusFile { get; init; } = string.Empty;
+}
+
+public sealed class SessionEndpointDescriptor
+{
+    public string Host { get; init; } = string.Empty;
+
+    public int Port { get; init; }
+}
+
+/// <summary>Exactly one of <see cref="Index"/>/<see cref="Id"/>/
+/// <see cref="Name"/> is set by <see cref="SessionConfigComposer"/>.
+/// </summary>
+public sealed class SessionCharacterSelector
+{
+    public int? Index { get; init; }
+
+    public uint? Id { get; init; }
+
+    public string? Name { get; init; }
+}
+
+/// <summary>Campaign LA composes exactly the <c>idle</c> bot policy (LA2)
+/// for headless launches — the launcher never asks for any other
+/// policy id.</summary>
+public sealed class SessionPolicyDescriptor
+{
+    public string Id { get; init; } = "idle";
+}
+
+/// <summary>Always the <c>standardInput</c> provider — the launcher pipes
+/// the account password to the child's stdin and never places it in the
+/// session-config document, process arguments, or environment (see
+/// <see cref="LauncherProcessSupervisor"/>).</summary>
+public sealed class SessionCredentialDescriptor
+{
+    public string Provider { get; init; } = "standardInput";
+
+    public string Reference { get; init; } = "session";
+}

src/AcDream.Launcher.Core/Profiles/AccountProfile.cs

@@ -0,0 +1,22 @@
+using System.Text.Json.Serialization;
+
+namespace AcDream.Launcher.Core.Profiles;
+
+/// <summary>
+/// One account under a server, per Campaign LA spec §5. The password is
+/// plaintext by explicit user decision
+/// (<c>claude-memory/project_launcher_direction.md</c>) — never written
+/// anywhere except this file, never logged, never placed in a session
+/// config or process argument/environment (see
+/// <see cref="AcDream.Launcher.Core.Launching.SessionConfigComposer"/>).
+/// </summary>
+public sealed class AccountProfile
+{
+    [JsonRequired]
+    public string Account { get; set; } = string.Empty;
+
+    [JsonRequired]
+    public string Password { get; set; } = string.Empty;
+
+    public List<CharacterProfile> Characters { get; set; } = [];
+}

src/AcDream.Launcher.Core/Profiles/CharacterIdFormat.cs

@@ -0,0 +1,32 @@
+using System.Globalization;
+
+namespace AcDream.Launcher.Core.Profiles;
+
+/// <summary>
+/// Converts between the wire <c>uint</c> character GUID and the
+/// launcher-profile hex-string representation (<c>"0x5000000A"</c>,
+/// matching the convention used throughout the project, e.g. the
+/// <c>+Acdream</c> test character's <c>0x5000000A</c> in CLAUDE.md).
+/// </summary>
+public static class CharacterIdFormat
+{
+    public static string ToHexString(uint id) =>
+        "0x" + id.ToString("X8", CultureInfo.InvariantCulture);
+
+    public static bool TryParse(string? text, out uint id)
+    {
+        id = 0;
+        if (string.IsNullOrWhiteSpace(text))
+            return false;
+
+        ReadOnlySpan<char> span = text.AsSpan().Trim();
+        if (span.StartsWith("0x", StringComparison.OrdinalIgnoreCase))
+            span = span[2..];
+
+        return uint.TryParse(
+            span,
+            NumberStyles.HexNumber,
+            CultureInfo.InvariantCulture,
+            out id);
+    }
+}

src/AcDream.Launcher.Core/Profiles/CharacterProfile.cs

@@ -0,0 +1,31 @@
+using System.Text.Json.Serialization;
+
+namespace AcDream.Launcher.Core.Profiles;
+
+/// <summary>
+/// One character row under an account, per Campaign LA spec §5. The
+/// <see cref="Id"/>/<see cref="Name"/> pair is the launcher-maintained
+/// cache (fed by status-stream <c>characterList</c> events and roster
+/// probes via <see cref="LauncherProfileStore.MergeRoster"/>);
+/// <see cref="LaunchMode"/>/<see cref="Plugins"/>/<see cref="LoginCommands"/>
+/// are user-owned settings that a roster merge must never clobber.
+/// </summary>
+public sealed class CharacterProfile
+{
+    [JsonRequired]
+    public string Name { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Hex-formatted character GUID (e.g. <c>"0x5000000A"</c>), matching
+    /// the convention used elsewhere in the project. Null only for a
+    /// hand-authored fixture/profile entry that has never been through a
+    /// roster merge.
+    /// </summary>
+    public string? Id { get; set; }
+
+    public LaunchMode LaunchMode { get; set; } = LaunchMode.GuiSelect;
+
+    public List<string> Plugins { get; set; } = [];
+
+    public List<string> LoginCommands { get; set; } = [];
+}

src/AcDream.Launcher.Core/Profiles/CharacterRosterEntry.cs

@@ -0,0 +1,19 @@
+namespace AcDream.Launcher.Core.Profiles;
+
+/// <summary>
+/// One roster row as reported by a host's <c>characterList</c> status
+/// event or an on-demand probe launch (Campaign LA spec §3/§6). Mirrors
+/// the wire shape of <c>AcDream.Core.Net.Messages.CharacterList.Character</c>
+/// (<c>uint Id, string Name, uint SecondsGreyedOut</c>) — Launcher.Core
+/// does not reference Core.Net, so this is an independent, intentionally
+/// identical shape fed by the status-stream parser
+/// (<see cref="AcDream.Launcher.Core.Status.CharacterListStatusEvent"/>).
+/// <see cref="SecondsGreyedOut"/> is carried for completeness but is
+/// NEVER persisted into <see cref="CharacterProfile"/> — ACE reports a
+/// constant 1 during the pending-delete grace window (a boolean, not a
+/// countdown), and the profile schema (§5) has no field for it.
+/// </summary>
+public readonly record struct CharacterRosterEntry(
+    uint Id,
+    string Name,
+    uint SecondsGreyedOut);

src/AcDream.Launcher.Core/Profiles/LaunchMode.cs

@@ -0,0 +1,35 @@
+namespace AcDream.Launcher.Core.Profiles;
+
+/// <summary>
+/// Per-character launch behaviour (Campaign LA spec §5). Stored on each
+/// <see cref="CharacterProfile"/> and read by
+/// <see cref="AcDream.Launcher.Core.Launching.SessionConfigComposer"/> to
+/// decide the shape of the composed session-config document.
+///
+/// <para>
+/// Serialized as camelCase text (<c>"gui"</c>/<c>"guiSelect"</c>/
+/// <c>"headless"</c>) via the explicit
+/// <c>new JsonStringEnumConverter(JsonNamingPolicy.CamelCase, ...)</c>
+/// registered in <see cref="LauncherProfileStore"/>'s serializer options
+/// — deliberately NOT a per-type <c>[JsonConverter]</c> attribute, which
+/// uses exact member-name casing (<c>"Gui"</c>) regardless of the
+/// ambient <c>PropertyNamingPolicy</c>.
+/// </para>
+/// </summary>
+public enum LaunchMode
+{
+    /// <summary>Launch the graphical client straight into the world as
+    /// this character.</summary>
+    Gui,
+
+    /// <summary>Launch the graphical client but stop at the retail
+    /// character-select screen — no character selector is sent. This is
+    /// the default for a character that has never had its launch mode set
+    /// explicitly.</summary>
+    GuiSelect,
+
+    /// <summary>Launch the no-window host running the <c>idle</c> bot
+    /// policy (enter world, run plugins/login commands, stay until
+    /// stopped).</summary>
+    Headless,
+}

src/AcDream.Launcher.Core/Profiles/LauncherProfileDocument.cs

@@ -0,0 +1,16 @@
+using System.Text.Json.Serialization;
+
+namespace AcDream.Launcher.Core.Profiles;
+
+/// <summary>
+/// Root document for <c>launcher-profiles.json</c> (Campaign LA spec §5)
+/// — the launcher's ONLY credential/profile store. Loaded and saved by
+/// <see cref="LauncherProfileStore"/>.
+/// </summary>
+public sealed class LauncherProfileDocument
+{
+    [JsonRequired]
+    public int Version { get; set; } = LauncherProfileStore.CurrentVersion;
+
+    public List<ServerProfile> Servers { get; set; } = [];
+}

src/AcDream.Launcher.Core/Profiles/LauncherProfileException.cs

@@ -0,0 +1,17 @@
+namespace AcDream.Launcher.Core.Profiles;
+
+/// <summary>Thrown for a malformed <c>launcher-profiles.json</c> document
+/// or an invalid CRUD operation against <see cref="LauncherProfileStore"/>
+/// (unknown target, duplicate name, etc.).</summary>
+public sealed class LauncherProfileException : Exception
+{
+    public LauncherProfileException(string message)
+        : base(message)
+    {
+    }
+
+    public LauncherProfileException(string message, Exception innerException)
+        : base(message, innerException)
+    {
+    }
+}

src/AcDream.Launcher.Core/Profiles/LauncherProfileStore.cs

@@ -0,0 +1,395 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using AcDream.Platform;
+
+namespace AcDream.Launcher.Core.Profiles;
+
+/// <summary>
+/// Load/save/CRUD owner for <c>launcher-profiles.json</c> (Campaign LA
+/// spec §5) — the launcher's ONLY credential/profile store, and the
+/// binding surface the Avalonia UI (slice LA4) mutates directly.
+///
+/// <para>
+/// A store instance holds the current in-memory <see cref="Document"/>
+/// after <see cref="Load"/>; every CRUD method mutates that document in
+/// place so callers can chain <c>store.AddServer(...); store.Save();</c>
+/// without re-threading a returned document through every call.
+/// </para>
+/// </summary>
+public sealed class LauncherProfileStore
+{
+    internal const int CurrentVersion = 1;
+
+    private static readonly JsonSerializerOptions SerializerOptions = new()
+    {
+        AllowTrailingCommas = false,
+        PropertyNamingPolicy = JsonNamingPolicy.CamelCase,
+        PropertyNameCaseInsensitive = false,
+        ReadCommentHandling = JsonCommentHandling.Disallow,
+        UnmappedMemberHandling = JsonUnmappedMemberHandling.Disallow,
+        WriteIndented = true,
+        Converters =
+        {
+            new JsonStringEnumConverter(
+                JsonNamingPolicy.CamelCase,
+                allowIntegerValues: false),
+        },
+    };
+
+    public LauncherProfileStore(string filePath)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(filePath);
+        FilePath = Path.GetFullPath(filePath);
+        Document = new LauncherProfileDocument();
+    }
+
+    /// <summary>Resolve the store at the canonical location under
+    /// <see cref="ApplicationPathSet.ConfigDirectory"/>
+    /// (<c>%APPDATA%\acdream\launcher-profiles.json</c> /
+    /// <c>~/.config/acdream/launcher-profiles.json</c>).</summary>
+    public static LauncherProfileStore ForApplicationPaths(ApplicationPathSet paths)
+    {
+        ArgumentNullException.ThrowIfNull(paths);
+        return new LauncherProfileStore(
+            Path.Combine(paths.ConfigDirectory, "launcher-profiles.json"));
+    }
+
+    public string FilePath { get; }
+
+    public LauncherProfileDocument Document { get; private set; }
+
+    /// <summary>
+    /// Loads <see cref="Document"/> from <see cref="FilePath"/>. A
+    /// missing file is not an error — it resolves to a fresh empty
+    /// document (version 1, no servers), matching a never-launched
+    /// installation. Returns true when a file was actually read.
+    /// </summary>
+    public bool Load()
+    {
+        if (!File.Exists(FilePath))
+        {
+            Document = new LauncherProfileDocument();
+            return false;
+        }
+
+        LauncherProfileDocument? document;
+        using (FileStream stream = File.OpenRead(FilePath))
+        {
+            try
+            {
+                document = JsonSerializer.Deserialize<LauncherProfileDocument>(
+                    stream,
+                    SerializerOptions);
+            }
+            catch (JsonException ex)
+            {
+                throw new LauncherProfileException(
+                    $"'{FilePath}' is not a valid launcher profile document.",
+                    ex);
+            }
+        }
+
+        if (document is null)
+        {
+            throw new LauncherProfileException($"'{FilePath}' is empty.");
+        }
+
+        if (document.Version != CurrentVersion)
+        {
+            throw new LauncherProfileException(
+                $"Unsupported launcher-profiles version {document.Version}; "
+                + $"expected {CurrentVersion}.");
+        }
+
+        Document = document;
+        return true;
+    }
+
+    /// <summary>
+    /// Persists <see cref="Document"/> to <see cref="FilePath"/> via a
+    /// write-then-atomic-rename so a crash mid-write never leaves a
+    /// truncated credentials file. On Linux, restricts the final file to
+    /// owner read/write (0600) per Campaign LA's plaintext-credential
+    /// decision (spec §5, decisions log).
+    /// </summary>
+    public void Save()
+    {
+        string? directory = Path.GetDirectoryName(FilePath);
+        if (!string.IsNullOrEmpty(directory))
+        {
+            Directory.CreateDirectory(directory);
+        }
+
+        string tempPath = FilePath + ".tmp";
+        using (FileStream stream = File.Create(tempPath))
+        {
+            JsonSerializer.Serialize(stream, Document, SerializerOptions);
+        }
+
+        File.Move(tempPath, FilePath, overwrite: true);
+
+        if (OperatingSystem.IsLinux())
+        {
+            File.SetUnixFileMode(
+                FilePath,
+                UnixFileMode.UserRead | UnixFileMode.UserWrite);
+        }
+    }
+
+    // --- Server CRUD -----------------------------------------------
+
+    public ServerProfile AddServer(string name, string host, int port)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(name);
+        ArgumentException.ThrowIfNullOrWhiteSpace(host);
+        RequireValidPort(port);
+
+        if (FindServer(name) is not null)
+        {
+            throw new LauncherProfileException(
+                $"A server named '{name}' already exists.");
+        }
+
+        var server = new ServerProfile { Name = name, Host = host, Port = port };
+        Document.Servers.Add(server);
+        return server;
+    }
+
+    public void EditServer(
+        string name,
+        string? newName = null,
+        string? newHost = null,
+        int? newPort = null)
+    {
+        ServerProfile server = FindServerOrThrow(name);
+
+        if (newName is not null)
+        {
+            ArgumentException.ThrowIfNullOrWhiteSpace(newName);
+            if (!string.Equals(newName, server.Name, StringComparison.Ordinal)
+                && FindServer(newName) is not null)
+            {
+                throw new LauncherProfileException(
+                    $"A server named '{newName}' already exists.");
+            }
+
+            server.Name = newName;
+        }
+
+        if (newHost is not null)
+        {
+            ArgumentException.ThrowIfNullOrWhiteSpace(newHost);
+            server.Host = newHost;
+        }
+
+        if (newPort is not null)
+        {
+            RequireValidPort(newPort.Value);
+            server.Port = newPort.Value;
+        }
+    }
+
+    public void RemoveServer(string name)
+    {
+        ServerProfile server = FindServerOrThrow(name);
+        Document.Servers.Remove(server);
+    }
+
+    // --- Account CRUD ------------------------------------------------
+
+    public AccountProfile AddAccount(string serverName, string account, string password)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(account);
+        ArgumentNullException.ThrowIfNull(password);
+        ServerProfile server = FindServerOrThrow(serverName);
+
+        if (FindAccount(server, account) is not null)
+        {
+            throw new LauncherProfileException(
+                $"Account '{account}' already exists on server '{serverName}'.");
+        }
+
+        var profile = new AccountProfile { Account = account, Password = password };
+        server.Accounts.Add(profile);
+        return profile;
+    }
+
+    public void EditAccount(
+        string serverName,
+        string account,
+        string? newAccount = null,
+        string? newPassword = null)
+    {
+        ServerProfile server = FindServerOrThrow(serverName);
+        AccountProfile profile = FindAccountOrThrow(server, account);
+
+        if (newAccount is not null)
+        {
+            ArgumentException.ThrowIfNullOrWhiteSpace(newAccount);
+            if (!string.Equals(newAccount, profile.Account, StringComparison.Ordinal)
+                && FindAccount(server, newAccount) is not null)
+            {
+                throw new LauncherProfileException(
+                    $"Account '{newAccount}' already exists on server '{serverName}'.");
+            }
+
+            profile.Account = newAccount;
+        }
+
+        if (newPassword is not null)
+        {
+            profile.Password = newPassword;
+        }
+    }
+
+    public void RemoveAccount(string serverName, string account)
+    {
+        ServerProfile server = FindServerOrThrow(serverName);
+        AccountProfile profile = FindAccountOrThrow(server, account);
+        server.Accounts.Remove(profile);
+    }
+
+    // --- Character settings (roster-driven add/remove; user-edited settings) ---
+
+    /// <summary>
+    /// Edits the user-owned settings of an existing character row. There
+    /// is no manual add/remove for characters — the roster (
+    /// <see cref="MergeRoster"/>) is the only source of new rows, per
+    /// spec §5/§6.
+    /// </summary>
+    public void EditCharacter(
+        string serverName,
+        string account,
+        string characterName,
+        LaunchMode? launchMode = null,
+        IReadOnlyList<string>? plugins = null,
+        IReadOnlyList<string>? loginCommands = null)
+    {
+        ServerProfile server = FindServerOrThrow(serverName);
+        AccountProfile profile = FindAccountOrThrow(server, account);
+        CharacterProfile character = FindCharacterOrThrow(profile, characterName);
+
+        if (launchMode is not null)
+        {
+            character.LaunchMode = launchMode.Value;
+        }
+
+        if (plugins is not null)
+        {
+            character.Plugins = [.. plugins];
+        }
+
+        if (loginCommands is not null)
+        {
+            character.LoginCommands = [.. loginCommands];
+        }
+    }
+
+    /// <summary>
+    /// Folds a reported character roster into an account's
+    /// <see cref="AccountProfile.Characters"/> (Campaign LA spec §3/§5/
+    /// §6): every roster entry either updates the name of an existing
+    /// row (matched by <see cref="CharacterProfile.Id"/>) while
+    /// PRESERVING that row's user settings (<see cref="LaunchMode"/>,
+    /// <see cref="CharacterProfile.Plugins"/>,
+    /// <see cref="CharacterProfile.LoginCommands"/>), or is inserted as a
+    /// new row with default settings (<see cref="LaunchMode.GuiSelect"/>,
+    /// no plugins, no login commands). Existing rows absent from the
+    /// roster are RETAINED unchanged — they may simply be pending-delete
+    /// (ACE keeps deleted characters queryable during the grace window)
+    /// or the roster snapshot may be partial; this store never deletes a
+    /// character row on the caller's behalf.
+    /// </summary>
+    public void MergeRoster(
+        string serverName,
+        string account,
+        IReadOnlyList<CharacterRosterEntry> roster)
+    {
+        ArgumentNullException.ThrowIfNull(roster);
+        ServerProfile server = FindServerOrThrow(serverName);
+        AccountProfile profile = FindAccountOrThrow(server, account);
+
+        foreach (CharacterRosterEntry entry in roster)
+        {
+            string idText = CharacterIdFormat.ToHexString(entry.Id);
+            CharacterProfile? existing = profile.Characters.Find(
+                character => string.Equals(
+                    character.Id,
+                    idText,
+                    StringComparison.OrdinalIgnoreCase));
+
+            // Defensive fallback for a hand-edited file where a character
+            // row was added with a name but no id yet.
+            existing ??= profile.Characters.Find(
+                character => character.Id is null
+                    && string.Equals(
+                        character.Name,
+                        entry.Name,
+                        StringComparison.Ordinal));
+
+            if (existing is not null)
+            {
+                existing.Id = idText;
+                existing.Name = entry.Name;
+                continue;
+            }
+
+            profile.Characters.Add(new CharacterProfile
+            {
+                Id = idText,
+                Name = entry.Name,
+                LaunchMode = LaunchMode.GuiSelect,
+                Plugins = [],
+                LoginCommands = [],
+            });
+        }
+    }
+
+    // --- Lookups -------------------------------------------------------
+
+    private ServerProfile? FindServer(string name) =>
+        Document.Servers.Find(
+            server => string.Equals(server.Name, name, StringComparison.Ordinal));
+
+    private ServerProfile FindServerOrThrow(string name)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(name);
+        return FindServer(name)
+            ?? throw new LauncherProfileException($"No server named '{name}'.");
+    }
+
+    private static AccountProfile? FindAccount(ServerProfile server, string account) =>
+        server.Accounts.Find(
+            candidate => string.Equals(candidate.Account, account, StringComparison.Ordinal));
+
+    private static AccountProfile FindAccountOrThrow(ServerProfile server, string account)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(account);
+        return FindAccount(server, account)
+            ?? throw new LauncherProfileException(
+                $"No account '{account}' on server '{server.Name}'.");
+    }
+
+    private static CharacterProfile FindCharacterOrThrow(
+        AccountProfile profile,
+        string characterName)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(characterName);
+        return profile.Characters.Find(
+                character => string.Equals(
+                    character.Name,
+                    characterName,
+                    StringComparison.Ordinal))
+            ?? throw new LauncherProfileException(
+                $"No character '{characterName}' on account '{profile.Account}'.");
+    }
+
+    private static void RequireValidPort(int port)
+    {
+        if (port is < 1 or > 65535)
+        {
+            throw new LauncherProfileException(
+                $"Port {port} is outside the valid 1-65535 range.");
+        }
+    }
+}

src/AcDream.Launcher.Core/Profiles/ServerProfile.cs

@@ -0,0 +1,19 @@
+using System.Text.Json.Serialization;
+
+namespace AcDream.Launcher.Core.Profiles;
+
+/// <summary>One server entry, per Campaign LA spec §5 (manual add — no
+/// published server-list import this campaign).</summary>
+public sealed class ServerProfile
+{
+    [JsonRequired]
+    public string Name { get; set; } = string.Empty;
+
+    [JsonRequired]
+    public string Host { get; set; } = string.Empty;
+
+    [JsonRequired]
+    public int Port { get; set; }
+
+    public List<AccountProfile> Accounts { get; set; } = [];
+}

src/AcDream.Launcher.Core/Status/StatusEvent.cs

@@ -0,0 +1,81 @@
+namespace AcDream.Launcher.Core.Status;
+
+/// <summary>
+/// One parsed line of a host's <c>status.jsonl</c> stream (Campaign LA
+/// spec §6). Every event carries the versioned envelope
+/// (<c>v</c>/<c>e</c>/<c>t</c>/<c>sessionId</c>) plus its own typed
+/// payload. See <see cref="StatusEventParser"/> for the wire shape and
+/// <see cref="AcDream.Launcher.Core.Status.StatusFileTailer"/> for the
+/// incremental reader that produces these.
+/// </summary>
+public abstract record StatusEvent
+{
+    public required int V { get; init; }
+
+    public required string E { get; init; }
+
+    public required DateTimeOffset T { get; init; }
+
+    public required string SessionId { get; init; }
+}
+
+public sealed record StartedStatusEvent : StatusEvent;
+
+public sealed record ConnectedStatusEvent : StatusEvent;
+
+public readonly record struct StatusCharacterEntry(
+    uint Id,
+    string Name,
+    int SecondsGreyedOut);
+
+public sealed record CharacterListStatusEvent : StatusEvent
+{
+    public required string AccountName { get; init; }
+
+    public required int SlotCount { get; init; }
+
+    public required IReadOnlyList<StatusCharacterEntry> Characters { get; init; }
+}
+
+public sealed record EnteredWorldStatusEvent : StatusEvent
+{
+    public required uint CharacterId { get; init; }
+
+    public required string CharacterName { get; init; }
+}
+
+public sealed record PluginLoadedStatusEvent : StatusEvent
+{
+    public required string Plugin { get; init; }
+}
+
+public sealed record PluginFailedStatusEvent : StatusEvent
+{
+    public required string Plugin { get; init; }
+
+    public required string Error { get; init; }
+}
+
+public sealed record DisconnectedStatusEvent : StatusEvent
+{
+    public required string Reason { get; init; }
+}
+
+public sealed record ExitedStatusEvent : StatusEvent
+{
+    public required int Code { get; init; }
+
+    public required string Reason { get; init; }
+}
+
+/// <summary>
+/// A well-formed status line whose <c>e</c> value (or overall envelope
+/// shape) this reader does not recognize. The tailer never throws on an
+/// unrecognized event — an older launcher reading a newer host's stream
+/// degrades to seeing <see cref="UnknownStatusEvent"/> rows instead of
+/// crashing.
+/// </summary>
+public sealed record UnknownStatusEvent : StatusEvent
+{
+    public required string RawJson { get; init; }
+}

src/AcDream.Launcher.Core/Status/StatusEventParser.cs

@@ -0,0 +1,247 @@
+using System.Text.Json;
+
+namespace AcDream.Launcher.Core.Status;
+
+/// <summary>
+/// Parses one <c>status.jsonl</c> line (Campaign LA spec §6) into a typed
+/// <see cref="StatusEvent"/>. Wire shape: every line is a flat JSON
+/// object carrying the envelope (<c>v</c>, <c>e</c>, <c>t</c>,
+/// <c>sessionId</c>) alongside that event's own fields — e.g.
+/// <c>{"v":1,"e":"characterList","t":"...","sessionId":"...",
+/// "accountName":"...","slotCount":6,"characters":[...]}</c>.
+///
+/// <para>
+/// Never throws: a line whose <c>e</c> is not one of the eight known
+/// values, or whose payload doesn't match that event's expected shape,
+/// or that isn't valid JSON at all, degrades to a typed
+/// <see cref="UnknownStatusEvent"/> rather than an exception — a
+/// launcher must keep tailing a session's status stream even against a
+/// host running a newer/older wire version.
+/// </para>
+/// </summary>
+public static class StatusEventParser
+{
+    public static StatusEvent Parse(string line)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(line);
+
+        try
+        {
+            using JsonDocument document = JsonDocument.Parse(line);
+            JsonElement root = document.RootElement;
+
+            int v = GetInt32OrDefault(root, "v");
+            string e = GetStringOrDefault(root, "e");
+            DateTimeOffset t = GetDateTimeOffsetOrDefault(root, "t");
+            string sessionId = GetStringOrDefault(root, "sessionId");
+
+            return e switch
+            {
+                "started" =>
+                    new StartedStatusEvent { V = v, E = e, T = t, SessionId = sessionId },
+                "connected" =>
+                    new ConnectedStatusEvent { V = v, E = e, T = t, SessionId = sessionId },
+                "characterList" =>
+                    ParseCharacterList(root, v, e, t, sessionId),
+                "enteredWorld" =>
+                    ParseEnteredWorld(root, v, e, t, sessionId),
+                "pluginLoaded" =>
+                    ParsePluginLoaded(root, v, e, t, sessionId),
+                "pluginFailed" =>
+                    ParsePluginFailed(root, v, e, t, sessionId),
+                "disconnected" =>
+                    ParseDisconnected(root, v, e, t, sessionId),
+                "exited" =>
+                    ParseExited(root, v, e, t, sessionId),
+                _ =>
+                    new UnknownStatusEvent
+                    {
+                        V = v,
+                        E = e,
+                        T = t,
+                        SessionId = sessionId,
+                        RawJson = line,
+                    },
+            };
+        }
+        catch (Exception)
+        {
+            // JsonException (malformed JSON), FormatException (a
+            // required-field miss inside a Parse* helper) — all degrade
+            // the same way: never throw out of the tailer.
+            return new UnknownStatusEvent
+            {
+                V = 0,
+                E = string.Empty,
+                T = default,
+                SessionId = string.Empty,
+                RawJson = line,
+            };
+        }
+    }
+
+    private static StatusEvent ParseCharacterList(
+        JsonElement root,
+        int v,
+        string e,
+        DateTimeOffset t,
+        string sessionId)
+    {
+        string accountName = RequireString(root, "accountName");
+        int slotCount = RequireInt32(root, "slotCount");
+        JsonElement charactersElement = RequireProperty(root, "characters");
+
+        var characters = new List<StatusCharacterEntry>();
+        foreach (JsonElement item in charactersElement.EnumerateArray())
+        {
+            uint id = RequireUInt32(item, "id");
+            string name = RequireString(item, "name");
+            int secondsGreyedOut = RequireInt32(item, "secondsGreyedOut");
+            characters.Add(new StatusCharacterEntry(id, name, secondsGreyedOut));
+        }
+
+        return new CharacterListStatusEvent
+        {
+            V = v,
+            E = e,
+            T = t,
+            SessionId = sessionId,
+            AccountName = accountName,
+            SlotCount = slotCount,
+            Characters = characters,
+        };
+    }
+
+    private static StatusEvent ParseEnteredWorld(
+        JsonElement root,
+        int v,
+        string e,
+        DateTimeOffset t,
+        string sessionId) =>
+        new EnteredWorldStatusEvent
+        {
+            V = v,
+            E = e,
+            T = t,
+            SessionId = sessionId,
+            CharacterId = RequireUInt32(root, "characterId"),
+            CharacterName = RequireString(root, "characterName"),
+        };
+
+    private static StatusEvent ParsePluginLoaded(
+        JsonElement root,
+        int v,
+        string e,
+        DateTimeOffset t,
+        string sessionId) =>
+        new PluginLoadedStatusEvent
+        {
+            V = v,
+            E = e,
+            T = t,
+            SessionId = sessionId,
+            Plugin = RequireString(root, "plugin"),
+        };
+
+    private static StatusEvent ParsePluginFailed(
+        JsonElement root,
+        int v,
+        string e,
+        DateTimeOffset t,
+        string sessionId) =>
+        new PluginFailedStatusEvent
+        {
+            V = v,
+            E = e,
+            T = t,
+            SessionId = sessionId,
+            Plugin = RequireString(root, "plugin"),
+            Error = RequireString(root, "error"),
+        };
+
+    private static StatusEvent ParseDisconnected(
+        JsonElement root,
+        int v,
+        string e,
+        DateTimeOffset t,
+        string sessionId) =>
+        new DisconnectedStatusEvent
+        {
+            V = v,
+            E = e,
+            T = t,
+            SessionId = sessionId,
+            Reason = RequireString(root, "reason"),
+        };
+
+    private static StatusEvent ParseExited(
+        JsonElement root,
+        int v,
+        string e,
+        DateTimeOffset t,
+        string sessionId) =>
+        new ExitedStatusEvent
+        {
+            V = v,
+            E = e,
+            T = t,
+            SessionId = sessionId,
+            Code = RequireInt32(root, "code"),
+            Reason = RequireString(root, "reason"),
+        };
+
+    private static int GetInt32OrDefault(JsonElement root, string name) =>
+        root.TryGetProperty(name, out JsonElement element)
+            && element.ValueKind == JsonValueKind.Number
+            && element.TryGetInt32(out int value)
+            ? value
+            : 0;
+
+    private static string GetStringOrDefault(JsonElement root, string name) =>
+        root.TryGetProperty(name, out JsonElement element)
+            && element.ValueKind == JsonValueKind.String
+            ? element.GetString() ?? string.Empty
+            : string.Empty;
+
+    private static DateTimeOffset GetDateTimeOffsetOrDefault(
+        JsonElement root,
+        string name) =>
+        root.TryGetProperty(name, out JsonElement element)
+            && element.ValueKind == JsonValueKind.String
+            && DateTimeOffset.TryParse(
+                element.GetString(),
+                System.Globalization.CultureInfo.InvariantCulture,
+                System.Globalization.DateTimeStyles.None,
+                out DateTimeOffset value)
+            ? value
+            : default;
+
+    private static JsonElement RequireProperty(JsonElement root, string name) =>
+        root.TryGetProperty(name, out JsonElement element)
+            ? element
+            : throw new FormatException($"status event is missing '{name}'.");
+
+    private static string RequireString(JsonElement root, string name)
+    {
+        JsonElement element = RequireProperty(root, name);
+        return element.ValueKind == JsonValueKind.String
+            ? element.GetString() ?? string.Empty
+            : throw new FormatException($"status event field '{name}' is not a string.");
+    }
+
+    private static int RequireInt32(JsonElement root, string name)
+    {
+        JsonElement element = RequireProperty(root, name);
+        return element.ValueKind == JsonValueKind.Number && element.TryGetInt32(out int value)
+            ? value
+            : throw new FormatException($"status event field '{name}' is not an integer.");
+    }
+
+    private static uint RequireUInt32(JsonElement root, string name)
+    {
+        JsonElement element = RequireProperty(root, name);
+        return element.ValueKind == JsonValueKind.Number && element.TryGetUInt32(out uint value)
+            ? value
+            : throw new FormatException($"status event field '{name}' is not an unsigned integer.");
+    }
+}

src/AcDream.Launcher.Core/Status/StatusFileTailer.cs

@@ -0,0 +1,118 @@
+using System.Text;
+
+namespace AcDream.Launcher.Core.Status;
+
+/// <summary>
+/// Incremental reader over a host's <c>status.jsonl</c> file (Campaign LA
+/// spec §3/§6). Each call to <see cref="ReadNewEvents"/> returns the
+/// events that arrived since the previous call, tolerating:
+/// <list type="bullet">
+/// <item>the file not existing yet (the launcher may start tailing
+/// before the host has written its first line — returns no events, not
+/// an error);</item>
+/// <item>a partial last line (the host may be mid-write when polled —
+/// the tailer only advances its read position past the last confirmed
+/// <c>'\n'</c>; a still-incomplete tail is re-read, combined with
+/// whatever gets appended, on the next poll — never parsed while
+/// truncated).</item>
+/// </list>
+/// One tailer instance owns one file's read position; construct a new
+/// one per session.
+/// </summary>
+public sealed class StatusFileTailer
+{
+    private readonly string _path;
+    private long _position;
+
+    public StatusFileTailer(string path)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(path);
+        _path = path;
+    }
+
+    /// <summary>
+    /// Reads and parses every complete line appended to the file since
+    /// the last call. Returns an empty list (never null, never throws)
+    /// when the file doesn't exist yet or nothing new/complete has
+    /// arrived since the last poll.
+    /// </summary>
+    public IReadOnlyList<StatusEvent> ReadNewEvents()
+    {
+        if (!File.Exists(_path))
+        {
+            return [];
+        }
+
+        using var stream = new FileStream(
+            _path,
+            FileMode.Open,
+            FileAccess.Read,
+            FileShare.ReadWrite | FileShare.Delete);
+
+        if (stream.Length < _position)
+        {
+            // The file was truncated/replaced under us (e.g. a fresh
+            // session reusing a stale path) — restart from the top
+            // rather than throwing or silently missing the new content.
+            _position = 0;
+        }
+
+        if (stream.Length == _position)
+        {
+            return [];
+        }
+
+        stream.Seek(_position, SeekOrigin.Begin);
+        int unreadByteCount = checked((int)(stream.Length - _position));
+        byte[] buffer = new byte[unreadByteCount];
+        int totalRead = 0;
+        while (totalRead < unreadByteCount)
+        {
+            int read = stream.Read(buffer, totalRead, unreadByteCount - totalRead);
+            if (read == 0)
+            {
+                break;
+            }
+
+            totalRead += read;
+        }
+
+        var events = new List<StatusEvent>();
+        int lineStart = 0;
+
+        // How far into `buffer` we've confirmed a complete line — this
+        // is where `_position` advances to. Bytes after this point (an
+        // in-progress line with no trailing '\n' yet) are simply left
+        // unread on disk; the next poll re-reads them from `_position`
+        // combined with whatever the writer appends in between. No
+        // separate in-memory carry-over buffer is needed.
+        int consumedThroughIndex = 0;
+
+        for (int i = 0; i < totalRead; i++)
+        {
+            if (buffer[i] != (byte)'\n')
+            {
+                continue;
+            }
+
+            int lineEnd = i;
+            if (lineEnd > lineStart && buffer[lineEnd - 1] == (byte)'\r')
+            {
+                lineEnd--;
+            }
+
+            if (lineEnd > lineStart)
+            {
+                string rawLine = Encoding.UTF8.GetString(buffer, lineStart, lineEnd - lineStart);
+                events.Add(StatusEventParser.Parse(rawLine));
+            }
+
+            lineStart = i + 1;
+            consumedThroughIndex = lineStart;
+        }
+
+        _position += consumedThroughIndex;
+
+        return events;
+    }
+}