Merge campaign-cc2: CC2 CharacterCreate wire, review-closed

CC2 review PASS (checksum term set confirmed against the CG_Pack
accumulator; account-outside-body and GetPackSize=172 independently
proven), fix round e77ebf10 (F1 latch scope + pin test, AD-100, ACE
double-NameInUse note, creationFailed reason/name split, pointer fix,
retail-discriminator citations), narrow re-review CLOSED, residual
anchor fix 95e95bb6.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/plans/2026-08-14-launcher-campaign.md

@@ -170,6 +170,7 @@ line, writer opens `FileShare.Read`, tailer opens
 `enteredWorld{characterId,characterName}`, `pluginLoaded{plugin}`,
 `pluginFailed{plugin,error}`,
 `loginCommandFailed{commandIndex,command,error}`,
+`characterCreated{guid,name}`, `creationFailed{code,reason,name}`,
 `disconnected{reason}`,
 `exited{code,reason}` — every line carries `"v":1`, `"e"`, `"t"`
 (ISO-8601 UTC), `"sessionId"`. `secondsGreyedOut` is a uint on BOTH
@@ -177,6 +178,26 @@ sides. Unknown `e` values must parse to a typed Unknown event, never
 throw; a known `e` with a wrong payload shape should be distinguishable
 from an unknown `e` (LA3 review finding 12).
 
+**Campaign CC CC2 amendment (this section is the contract; the writer and
+tailer below implement it, in that order):** `characterCreated{guid,name}`
+fires on the Ok reply to a `CharacterCreate` (opcode `0xF656`) request —
+`guid`/`name` come straight off the shared `0xF643`
+`CharGenVerificationResponse` Ok identity payload
+(`AcDream.Core.Net.Messages.CharGenVerificationResponse`), deliberately
+named `guid`/`name` rather than `characterId`/`characterName` to mirror
+that payload's own field names and to read distinctly from
+`enteredWorld` — a freshly created character is logged straight in by
+retail without a fresh `characterList` (see that type's doc comment), so
+`characterCreated` can precede an `enteredWorld` for the same character
+rather than replacing it. `creationFailed{code,reason,name}` fires on any
+non-Ok reply: `code` is the raw wire `CharGenVerificationResponse.Code`
+value, `reason` is that code's enum member name (e.g. `"NameInUse"`) so a
+reader gets a stable readable reason without hard-coding the numeric
+mapping itself, and `name` is the ATTEMPTED character name so a launcher
+can render "the name Bob is taken". (CC2 review F4: the enum member
+originally rode the `name` key, colliding in meaning with
+`characterCreated.name`; renamed before any consumer shipped.)
+
 `loginCommandFailed.commandIndex` is the zero-based index in the configured
 `loginCommands` array. `command` is the exact configured line and `error` is
 the isolated parser/router/handler failure. The event is observational: the
@@ -214,7 +235,8 @@ Three pieces, one slice, because they share the session-config/status seam:
    config; absent → permanent no-op sink). Versioned event
    vocabulary (`"v":1`): `started`, `connected`, `characterList`,
    `enteredWorld`, `pluginLoaded`/`pluginFailed`,
-   `loginCommandFailed`, `disconnected`, `exited`.
+   `loginCommandFailed`, `characterCreated`/`creationFailed` (Campaign CC
+   CC2), `disconnected`, `exited`.
    Recon: today's `HeadlessDiagnosticWriter` is a single shared-stdout JSONL
    sink with four kinds (lifecycle/failure/event/resources) and NO per-session
    file — the status writer is a second, separate sink, not a rework of the