merge: Campaign LA LA5 - plugin hosting review-closed

docs/architecture/acdream-architecture.md

@@ -120,7 +120,16 @@ handlers and controllers translate those intents to `WorldSession`; panels
 never inspect or construct wire messages.
 Plugins register retained gameplay markup through the BCL-only
 `AcDream.Plugin.Abstractions.IUiRegistry`; they do not import App or
-presentation assemblies. Core `SelectionState` is the sole selected-object owner for world,
+presentation assemblies. `IPluginHost.HasUi` is the explicit capability edge:
+the graphical host supplies its retained registry, while no-window hosts
+return `false` and the BCL-only `NoOpUiRegistry`, which retains no plugin
+binding. Both hosts use Core's session-scoped discovery/lifetime orchestrator
+and the same config allow-list semantics (absent loads all; explicit empty
+loads none). The headless adapter projects entity snapshots on demand from the
+canonical Runtime view, subscribes to Runtime's ordered events, and borrows the
+exact Runtime selection owner; it does not mirror gameplay state.
+
+Core `SelectionState` is the sole selected-object owner for world,
 radar, inventory, paperdoll, toolbar, use/examine consumers, and plugins;
 `IPluginHost.Selection` exposes that same state and retail-style old/new callback.
 Temporary pointer modes are separate App orchestration in `InteractionState` and
@@ -174,6 +183,9 @@ parallel window-lifecycle map.
 ```
 src/
   AcDream.Core/              Layer 2-4: no Vulkan, no Silk.NET, pure logic
+    Plugins/
+      PluginSession.cs        -> shared per-host allow-list, failure isolation,
+                                 status outcome, and collectible ALC lifetime
     Physics/
       PhysicsBody.cs          -> body state / integration foundation (done)
       CollisionPrimitives.cs  -> retail primitive helpers (partial, active)
@@ -304,6 +316,8 @@ src/
     Configuration/           -> strict versioned process/session config
     Credentials/             -> redacted env/stdin/owner-only-file providers
     Hosting/                 -> one GameRuntime/session/lease/policy lifetime
+    Plugins/                 -> no-window IPluginHost borrowing Runtime/Core;
+                                BCL no-op UI and per-session plugin lifetime
     Policies/                -> typed Runtime-view/command consumers
     -> references Runtime only; no presentation/backend package
     -> Slice K complete: portable single/multi-session production host,
@@ -314,6 +328,7 @@ src/
   AcDream.Plugin.Abstractions/  Layer 5: plugin interfaces
     IAcDreamPlugin.cs         -> done
     IPluginHost.cs            -> done
+    IUiRegistry.cs            -> capability-aware retained/no-op UI contract
     IGameState.cs             -> done
     IEvents.cs                -> done
     ISelectionService.cs      -> done
@@ -368,6 +383,7 @@ src/
       PlayerMovementController.cs  -> active movement driver
     Plugins/
       AppPluginHost.cs        -> done
+      GraphicalPluginSession.cs -> thin shared-session/root/status adapter
 ```
 
 The 4B2 production SetPosition routes and shared local-controller body remain

docs/plans/2026-08-14-launcher-campaign.md

@@ -155,7 +155,11 @@ Field rules:
   for gui/guiSelect/probe.
 - `credential`: always `{ "provider": "standardInput", "reference":
   "session" }` for launcher-composed configs.
-- `plugins`/`loginCommands`/`loginCommandDelayMs`/`statusFile`: optional,
+- `plugins`: absent/null means load all discovered plugins (preserving the
+  developer flow); explicit `[]` means load none. Launcher-composed
+  normal-empty and probe sessions emit `[]` so they cannot load arbitrary
+  machine-local plugins.
+- `loginCommands`/`loginCommandDelayMs`/`statusFile`: optional,
   omitted-when-unset (never null, never `[]` for empty). Absent
   `loginCommandDelayMs` means 500.
 
@@ -297,7 +301,9 @@ are backed by Core-owned types already; only `Ui` (`BufferedUiRegistry`) is
 genuinely App-only. Headless has zero plugin hosting today (confirmed).
 
 1. Session-config `Plugins` allow-list filters the discovery result on BOTH
-   hosts (absent list = load all, preserving today's dev behavior).
+   hosts (absent/null list = load all, preserving today's dev behavior;
+   explicit `[]` = load none). Launcher-composed normal-empty and probe
+   sessions emit `[]`.
 2. `HeadlessPluginHost : IPluginHost` in Headless over the same Core-owned
    `State`/`Events`/`Selection`; `Ui` is an explicit no-op behind a new
    capability flag on `IPluginHost` (e.g. `HasUi`) so plugins can detect

docs/superpowers/specs/2026-08-14-launcher-campaign-design.md

@@ -168,7 +168,9 @@ Hand-editability is a property of the format, not a required workflow.
 `HeadlessConfiguration` shape extended with:
 
 - `Plugins: string[]` — plugin names to load from the standard
-  `PluginsDirectory`; hosts load exactly this set.
+  `PluginsDirectory`; absent/null loads all discovered plugins, while an
+  explicit empty array loads none. Launcher-composed normal-empty and probe
+  sessions emit the empty array.
 - `LoginCommands: string[]` — ordered chat-typed strings.
 - Graphical host: `Character` selector may be ABSENT → character-select
   screen instead of auto-enter.