feat(launcher): Campaign LA LA3 — AcDream.Launcher.Core profile store, composer, supervisor, status tailer

New AcDream.Launcher.Core (BCL-only, ProjectReference: AcDream.Platform
ONLY) plus tests/AcDream.Launcher.Core.Tests, both registered in
AcDream.slnx. This is the file-contract orchestrator core the Avalonia
launcher (LA4) will bind to — the game solution (Core/Runtime/App/
Headless) stays entirely out of this dependency graph, so the launcher
can never accidentally grow a game-protocol coupling.

- Profiles/: LauncherProfileStore owns launcher-profiles.json (spec §5
  schema: version 1, servers[]/accounts[]/characters[]), strict
  camelCase System.Text.Json (UnmappedMemberHandling.Disallow), typed
  CRUD (add/edit/remove server; add/edit/remove account; edit character
  settings), and MergeRoster (fold a reported roster into an account's
  characters[] while preserving user-owned launchMode/plugins/
  loginCommands, adding new rows with default guiSelect, and retaining
  rows absent from the roster — they may be pending-delete). 0600 on
  Linux via File.SetUnixFileMode after save.
- Launching/: SessionConfigComposer builds the pinned session-config
  contract (Headless K1 shape + plugins/loginCommands/
  loginCommandDelayMs/statusFile) from a profile character + install
  record — character selector omitted entirely for guiSelect, policy
  {id:"idle"} only for headless, credential always standardInput/
  session. Passwords never enter this document (proven by a dedicated
  test). LauncherProcessSupervisor spawns a host, feeds the password to
  stdin then closes it, and exposes Starting/Running/Exited lifecycle;
  Stop calls CloseMainWindow falling back to Kill after a timeout, both
  reachable through an injectable ILauncherChildProcess/factory seam so
  the state machine is unit-testable without real OS process timing.
- Status/: StatusEventParser decodes the v1 status.jsonl vocabulary
  (started/connected/characterList/enteredWorld/pluginLoaded/
  pluginFailed/disconnected/exited); an unrecognized "e" or a malformed
  line degrades to a typed Unknown event rather than throwing.
  StatusFileTailer incrementally reads new lines, tolerating a
  not-yet-existing file and a partial trailing line (only advances its
  read position past confirmed '\n' boundaries; a truncated tail is
  simply re-read next poll, never parsed early).
- Integrity/: streaming SHA-256 + hex verify for later pak/download
  checks (LA9/LA10).

Tests: 71 passed (profile CRUD + roster-merge matrix + strict-schema
rejection; composer golden-shape tests for gui/guiSelect/headless +
password-absence; supervisor tests against both an injected fake child
(state-machine determinism) and a real spawned `dotnet --version`
child (genuine cross-platform stdin/exit-code proof); tailer tests
incl. partial-line and not-yet-existing-file; SHA-256 tests). Verified
green on Windows (Release) and native WSL/Linux (Release) — the Linux
0600 test executes its real assertion body under WSL rather than
early-returning.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/AcDream.Launcher.Core.Tests/Profiles/CharacterIdFormatTests.cs

@@ -0,0 +1,43 @@
+using AcDream.Launcher.Core.Profiles;
+
+namespace AcDream.Launcher.Core.Tests.Profiles;
+
+public sealed class CharacterIdFormatTests
+{
+    [Fact]
+    public void ToHexStringFormatsEightDigitUppercaseWithPrefix()
+    {
+        Assert.Equal("0x5000000A", CharacterIdFormat.ToHexString(0x5000000Au));
+        Assert.Equal("0x00000001", CharacterIdFormat.ToHexString(1u));
+    }
+
+    [Theory]
+    [InlineData("0x5000000A", 0x5000000Au)]
+    [InlineData("0x5000000a", 0x5000000Au)]
+    [InlineData("5000000A", 0x5000000Au)]
+    public void TryParseAcceptsWithAndWithoutPrefixAndCase(string text, uint expected)
+    {
+        Assert.True(CharacterIdFormat.TryParse(text, out uint id));
+        Assert.Equal(expected, id);
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("   ")]
+    [InlineData("not-hex")]
+    public void TryParseRejectsNullEmptyOrNonHex(string? text)
+    {
+        Assert.False(CharacterIdFormat.TryParse(text, out uint id));
+        Assert.Equal(0u, id);
+    }
+
+    [Fact]
+    public void RoundTripsThroughToHexStringAndTryParse()
+    {
+        const uint original = 0x5000000Au;
+        string text = CharacterIdFormat.ToHexString(original);
+        Assert.True(CharacterIdFormat.TryParse(text, out uint parsed));
+        Assert.Equal(original, parsed);
+    }
+}

tests/AcDream.Launcher.Core.Tests/Profiles/LauncherProfileStoreTests.cs

@@ -0,0 +1,287 @@
+using AcDream.Launcher.Core.Profiles;
+
+namespace AcDream.Launcher.Core.Tests.Profiles;
+
+public sealed class LauncherProfileStoreTests : IDisposable
+{
+    private readonly string _root;
+    private readonly string _filePath;
+
+    public LauncherProfileStoreTests()
+    {
+        _root = Path.Combine(
+            Path.GetTempPath(),
+            "acdream-launcher-profile-tests",
+            Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(_root);
+        _filePath = Path.Combine(_root, "launcher-profiles.json");
+    }
+
+    public void Dispose()
+    {
+        if (Directory.Exists(_root))
+        {
+            Directory.Delete(_root, recursive: true);
+        }
+    }
+
+    [Fact]
+    public void LoadOnMissingFileYieldsEmptyDocumentWithoutTouchingDisk()
+    {
+        var store = new LauncherProfileStore(_filePath);
+
+        bool loaded = store.Load();
+
+        Assert.False(loaded);
+        Assert.False(File.Exists(_filePath));
+        Assert.Equal(1, store.Document.Version);
+        Assert.Empty(store.Document.Servers);
+    }
+
+    [Fact]
+    public void AddServerThenSaveThenReloadRoundTrips()
+    {
+        var store = new LauncherProfileStore(_filePath);
+        store.Load();
+
+        store.AddServer("Local ACE", "127.0.0.1", 9000);
+        store.Save();
+
+        Assert.True(File.Exists(_filePath));
+
+        var reloaded = new LauncherProfileStore(_filePath);
+        reloaded.Load();
+
+        ServerProfile server = Assert.Single(reloaded.Document.Servers);
+        Assert.Equal("Local ACE", server.Name);
+        Assert.Equal("127.0.0.1", server.Host);
+        Assert.Equal(9000, server.Port);
+        Assert.Empty(server.Accounts);
+    }
+
+    [Fact]
+    public void AddServerRejectsDuplicateName()
+    {
+        var store = new LauncherProfileStore(_filePath);
+        store.Load();
+        store.AddServer("Local ACE", "127.0.0.1", 9000);
+
+        var ex = Assert.Throws<LauncherProfileException>(
+            () => store.AddServer("Local ACE", "127.0.0.1", 9001));
+        Assert.Contains("Local ACE", ex.Message);
+    }
+
+    [Theory]
+    [InlineData(0)]
+    [InlineData(65536)]
+    [InlineData(-1)]
+    public void AddServerRejectsOutOfRangePort(int port)
+    {
+        var store = new LauncherProfileStore(_filePath);
+        store.Load();
+
+        Assert.Throws<LauncherProfileException>(
+            () => store.AddServer("Local ACE", "127.0.0.1", port));
+    }
+
+    [Fact]
+    public void EditServerRenamesAndUpdatesHostAndPort()
+    {
+        var store = new LauncherProfileStore(_filePath);
+        store.Load();
+        store.AddServer("Local ACE", "127.0.0.1", 9000);
+
+        store.EditServer("Local ACE", newName: "Home ACE", newHost: "10.0.0.5", newPort: 9001);
+
+        ServerProfile server = Assert.Single(store.Document.Servers);
+        Assert.Equal("Home ACE", server.Name);
+        Assert.Equal("10.0.0.5", server.Host);
+        Assert.Equal(9001, server.Port);
+    }
+
+    [Fact]
+    public void EditServerOnUnknownNameThrows()
+    {
+        var store = new LauncherProfileStore(_filePath);
+        store.Load();
+
+        Assert.Throws<LauncherProfileException>(
+            () => store.EditServer("Nope", newHost: "1.2.3.4"));
+    }
+
+    [Fact]
+    public void RemoveServerRemovesIt()
+    {
+        var store = new LauncherProfileStore(_filePath);
+        store.Load();
+        store.AddServer("Local ACE", "127.0.0.1", 9000);
+
+        store.RemoveServer("Local ACE");
+
+        Assert.Empty(store.Document.Servers);
+    }
+
+    [Fact]
+    public void AddEditRemoveAccountRoundTrip()
+    {
+        var store = new LauncherProfileStore(_filePath);
+        store.Load();
+        store.AddServer("Local ACE", "127.0.0.1", 9000);
+
+        store.AddAccount("Local ACE", "testaccount", "testpassword");
+        AccountProfile account = Assert.Single(
+            store.Document.Servers.Single().Accounts);
+        Assert.Equal("testaccount", account.Account);
+        Assert.Equal("testpassword", account.Password);
+
+        store.EditAccount(
+            "Local ACE",
+            "testaccount",
+            newAccount: "renamed",
+            newPassword: "newpass");
+        account = Assert.Single(store.Document.Servers.Single().Accounts);
+        Assert.Equal("renamed", account.Account);
+        Assert.Equal("newpass", account.Password);
+
+        store.RemoveAccount("Local ACE", "renamed");
+        Assert.Empty(store.Document.Servers.Single().Accounts);
+    }
+
+    [Fact]
+    public void AddAccountRejectsDuplicateAccountOnSameServer()
+    {
+        var store = new LauncherProfileStore(_filePath);
+        store.Load();
+        store.AddServer("Local ACE", "127.0.0.1", 9000);
+        store.AddAccount("Local ACE", "testaccount", "pw");
+
+        Assert.Throws<LauncherProfileException>(
+            () => store.AddAccount("Local ACE", "testaccount", "pw2"));
+    }
+
+    [Fact]
+    public void EditCharacterUpdatesLaunchModePluginsAndLoginCommandsOnly()
+    {
+        var store = new LauncherProfileStore(_filePath);
+        store.Load();
+        store.AddServer("Local ACE", "127.0.0.1", 9000);
+        store.AddAccount("Local ACE", "testaccount", "pw");
+        store.MergeRoster(
+            "Local ACE",
+            "testaccount",
+            [new CharacterRosterEntry(0x5000000A, "+Acdream", 0)]);
+
+        store.EditCharacter(
+            "Local ACE",
+            "testaccount",
+            "+Acdream",
+            launchMode: LaunchMode.Headless,
+            plugins: ["ExamplePlugin"],
+            loginCommands: ["/tell someone, hi"]);
+
+        CharacterProfile character = Assert.Single(
+            store.Document.Servers.Single().Accounts.Single().Characters);
+        Assert.Equal(LaunchMode.Headless, character.LaunchMode);
+        Assert.Equal(["ExamplePlugin"], character.Plugins);
+        Assert.Equal(["/tell someone, hi"], character.LoginCommands);
+        Assert.Equal("0x5000000A", character.Id);
+    }
+
+    [Fact]
+    public void FullProfileWithServersAccountsAndCharactersRoundTripsThroughDisk()
+    {
+        var store = new LauncherProfileStore(_filePath);
+        store.Load();
+        store.AddServer("Local ACE", "127.0.0.1", 9000);
+        store.AddAccount("Local ACE", "testaccount", "testpassword");
+        store.MergeRoster(
+            "Local ACE",
+            "testaccount",
+            [new CharacterRosterEntry(0x5000000A, "+Acdream", 0)]);
+        store.EditCharacter(
+            "Local ACE",
+            "testaccount",
+            "+Acdream",
+            launchMode: LaunchMode.Gui,
+            plugins: ["ExamplePlugin"],
+            loginCommands: ["/vt start"]);
+        store.Save();
+
+        // Direct proof of the on-disk enum casing — a round-trip alone
+        // could mask a PascalCase regression if the reader ever became
+        // case-insensitive on enum values.
+        string text = File.ReadAllText(_filePath);
+        Assert.Contains("\"launchMode\":\"gui\"", text.Replace(" ", string.Empty));
+
+        var reloaded = new LauncherProfileStore(_filePath);
+        reloaded.Load();
+
+        ServerProfile server = Assert.Single(reloaded.Document.Servers);
+        AccountProfile account = Assert.Single(server.Accounts);
+        CharacterProfile character = Assert.Single(account.Characters);
+        Assert.Equal("+Acdream", character.Name);
+        Assert.Equal("0x5000000A", character.Id);
+        Assert.Equal(LaunchMode.Gui, character.LaunchMode);
+        Assert.Equal(["ExamplePlugin"], character.Plugins);
+        Assert.Equal(["/vt start"], character.LoginCommands);
+    }
+
+    [Fact]
+    public void LoadRejectsUnsupportedVersion()
+    {
+        File.WriteAllText(_filePath, """{"version":2,"servers":[]}""");
+        var store = new LauncherProfileStore(_filePath);
+
+        Assert.Throws<LauncherProfileException>(() => store.Load());
+    }
+
+    [Fact]
+    public void LoadRejectsUnmappedMembersStrictly()
+    {
+        File.WriteAllText(
+            _filePath,
+            """{"version":1,"servers":[],"unexpectedField":true}""");
+        var store = new LauncherProfileStore(_filePath);
+
+        Assert.Throws<LauncherProfileException>(() => store.Load());
+    }
+
+    [Fact]
+    public void SaveWritesCamelCaseJson()
+    {
+        var store = new LauncherProfileStore(_filePath);
+        store.Load();
+        store.AddServer("Local ACE", "127.0.0.1", 9000);
+        store.Save();
+
+        string text = File.ReadAllText(_filePath);
+        Assert.Contains("\"version\"", text);
+        Assert.Contains("\"servers\"", text);
+        Assert.Contains("\"host\"", text);
+        Assert.DoesNotContain("\"Version\"", text);
+        Assert.DoesNotContain("\"Servers\"", text);
+    }
+
+    [Fact]
+    public void SaveSetsOwnerOnlyPermissionsOnLinux()
+    {
+        // Linux-conditional: 0600 is a Linux-only hygiene step (spec §5,
+        // decisions log item "Windows profile-file permissions"). A no-op
+        // pass on Windows/macOS, matching the repo's established
+        // OperatingSystem.IsLinux() early-return pattern (e.g.
+        // HeadlessCredentialResolverTests.LinuxRejectsGroupOrOtherCredentialPermissions).
+        if (!OperatingSystem.IsLinux())
+            return;
+
+        var store = new LauncherProfileStore(_filePath);
+        store.Load();
+        store.AddServer("Local ACE", "127.0.0.1", 9000);
+        store.AddAccount("Local ACE", "testaccount", "testpassword");
+        store.Save();
+
+        UnixFileMode mode = File.GetUnixFileMode(_filePath);
+        Assert.Equal(
+            UnixFileMode.UserRead | UnixFileMode.UserWrite,
+            mode);
+    }
+}

tests/AcDream.Launcher.Core.Tests/Profiles/RosterMergeTests.cs

@@ -0,0 +1,146 @@
+using AcDream.Launcher.Core.Profiles;
+
+namespace AcDream.Launcher.Core.Tests.Profiles;
+
+/// <summary>
+/// The roster-merge matrix (Campaign LA plan §LA3 acceptance): a new
+/// character, an existing character keeping its user settings, and a
+/// character absent from a later roster snapshot being retained
+/// (possibly pending-delete).
+/// </summary>
+public sealed class RosterMergeTests
+{
+    private static LauncherProfileStore NewStoreWithServerAndAccount()
+    {
+        var store = new LauncherProfileStore(
+            Path.Combine(Path.GetTempPath(), Guid.NewGuid().ToString("N") + ".json"));
+        store.Load();
+        store.AddServer("Local ACE", "127.0.0.1", 9000);
+        store.AddAccount("Local ACE", "testaccount", "testpassword");
+        return store;
+    }
+
+    [Fact]
+    public void FirstMergeAddsNewCharactersWithDefaultLaunchModeGuiSelect()
+    {
+        LauncherProfileStore store = NewStoreWithServerAndAccount();
+
+        store.MergeRoster(
+            "Local ACE",
+            "testaccount",
+            [
+                new CharacterRosterEntry(0x5000000A, "+Acdream", 0),
+                new CharacterRosterEntry(0x5000000B, "+Second", 0),
+            ]);
+
+        List<CharacterProfile> characters =
+            store.Document.Servers.Single().Accounts.Single().Characters;
+        Assert.Equal(2, characters.Count);
+
+        CharacterProfile first = characters.Single(c => c.Name == "+Acdream");
+        Assert.Equal("0x5000000A", first.Id);
+        Assert.Equal(LaunchMode.GuiSelect, first.LaunchMode);
+        Assert.Empty(first.Plugins);
+        Assert.Empty(first.LoginCommands);
+
+        CharacterProfile second = characters.Single(c => c.Name == "+Second");
+        Assert.Equal("0x5000000B", second.Id);
+        Assert.Equal(LaunchMode.GuiSelect, second.LaunchMode);
+    }
+
+    [Fact]
+    public void SecondMergePreservesUserSettingsOnAnExistingCharacter()
+    {
+        LauncherProfileStore store = NewStoreWithServerAndAccount();
+        store.MergeRoster(
+            "Local ACE",
+            "testaccount",
+            [new CharacterRosterEntry(0x5000000A, "+Acdream", 0)]);
+        store.EditCharacter(
+            "Local ACE",
+            "testaccount",
+            "+Acdream",
+            launchMode: LaunchMode.Headless,
+            plugins: ["ExamplePlugin"],
+            loginCommands: ["/vt start"]);
+
+        // A later probe reports the same character again (same id), with
+        // a renamed display — settings must survive untouched.
+        store.MergeRoster(
+            "Local ACE",
+            "testaccount",
+            [new CharacterRosterEntry(0x5000000A, "+Acdream", 0)]);
+
+        CharacterProfile character = Assert.Single(
+            store.Document.Servers.Single().Accounts.Single().Characters);
+        Assert.Equal(LaunchMode.Headless, character.LaunchMode);
+        Assert.Equal(["ExamplePlugin"], character.Plugins);
+        Assert.Equal(["/vt start"], character.LoginCommands);
+    }
+
+    [Fact]
+    public void MergeUpdatesNameWhenIdMatchesButDisplayNameChanged()
+    {
+        LauncherProfileStore store = NewStoreWithServerAndAccount();
+        store.MergeRoster(
+            "Local ACE",
+            "testaccount",
+            [new CharacterRosterEntry(0x5000000A, "+OldName", 0)]);
+
+        store.MergeRoster(
+            "Local ACE",
+            "testaccount",
+            [new CharacterRosterEntry(0x5000000A, "+NewName", 0)]);
+
+        CharacterProfile character = Assert.Single(
+            store.Document.Servers.Single().Accounts.Single().Characters);
+        Assert.Equal("+NewName", character.Name);
+        Assert.Equal("0x5000000A", character.Id);
+    }
+
+    [Fact]
+    public void CharacterAbsentFromALaterRosterSnapshotIsRetained()
+    {
+        LauncherProfileStore store = NewStoreWithServerAndAccount();
+        store.MergeRoster(
+            "Local ACE",
+            "testaccount",
+            [
+                new CharacterRosterEntry(0x5000000A, "+Acdream", 0),
+                new CharacterRosterEntry(0x5000000B, "+PendingDelete", 1),
+            ]);
+
+        // A later probe's roster only reports one of the two — e.g. the
+        // other was deleted and is now in ACE's grace window / a
+        // partial snapshot. The store never removes rows on the
+        // caller's behalf.
+        store.MergeRoster(
+            "Local ACE",
+            "testaccount",
+            [new CharacterRosterEntry(0x5000000A, "+Acdream", 0)]);
+
+        List<CharacterProfile> characters =
+            store.Document.Servers.Single().Accounts.Single().Characters;
+        Assert.Equal(2, characters.Count);
+        Assert.Contains(characters, c => c.Name == "+Acdream");
+        Assert.Contains(characters, c => c.Name == "+PendingDelete");
+    }
+
+    [Fact]
+    public void MergeThrowsForUnknownServerOrAccount()
+    {
+        LauncherProfileStore store = NewStoreWithServerAndAccount();
+
+        Assert.Throws<LauncherProfileException>(
+            () => store.MergeRoster(
+                "Nope",
+                "testaccount",
+                [new CharacterRosterEntry(1, "x", 0)]));
+
+        Assert.Throws<LauncherProfileException>(
+            () => store.MergeRoster(
+                "Local ACE",
+                "nope",
+                [new CharacterRosterEntry(1, "x", 0)]));
+    }
+}