feat(launcher): LU9/LU10 — stop logs out for real, sessions read plainly, logout lands on character select

Five things from the user's gate.

STOP NOW ACTUALLY LOGS OUT. The UI gave the client five seconds and then
killed it. That is not enough for a graphical client to send its logout, wait
for the server to acknowledge, and tear down a mapped 28 GB world — so Stop
routinely ended in a kill, which sends the server nothing, which is exactly
what leaves the account held. Thirty seconds now, with the kill still there as
a genuine last resort, and the status says "Logging out…".

THE SERVER-SIDE HOLD IS MODELLED INSTEAD OF DISCOVERED. A session that ends
without the host running its own teardown may leave the account logged in
server-side for minutes. Launching again inside that window does not queue or
retry — it fails with a bare "CharacterList not received", which reads as a
broken launcher rather than a busy server. The orchestrator now records whether
each session ended gracefully (the host reported its own exit AND exited zero —
a killed or crashed child can satisfy neither) and refuses that account for
three minutes afterwards, saying how many seconds are left. A graceful exit
never starts a hold.

READABLE TERMINAL TEXT. "Exited: connection-error (code 5)" becomes "Could not
reach the server — the server may hold this account for a few minutes";
"Exited: process-exit (code 0)" becomes "Exited gracefully — logged out
cleanly". Live sessions still show the host's own status line, which is the
most informative thing available while one is running.

COLUMN HEADERS on the sessions list — ACCOUNT / CHARACTER / STATUS / DETAIL,
sharing the row template's widths so they stay aligned.

LOGOUT LANDS ON THE CHARACTER SCREEN (LU10). The toolbar X was already wired
correctly: IndicatorBarController's EndCharacterSessionButtonId 0x100000FA runs
retail's EndCharacterSession, and LiveSessionController's logout transaction
already ends by resetting the world generation and calling
CharacterSelectionState.Begin. What was missing is where that lands: the
retained UI built its character-selection and character-creation bindings only
when NO character selector was supplied, so a launcher-started session logged
out into a client with no screen to return to. The selector decides how a
session STARTS; it must not decide whether the select screen EXISTS. Both
binding sets are now unconditional.

The composition test that pinned the old gate is updated to pin the new
contract — the retained UI must not branch on the selector at all — rather than
being deleted.

App 5380 passed, Launcher.Core 336, Launcher 76, Headless 169. Not pushed; the
user is testing locally.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/AcDream.Launcher/MainWindow.axaml

@@ -227,14 +227,27 @@
       </Border>
 
       <Border Grid.Column="2" Grid.Row="2" Classes="card">
-        <Grid RowDefinitions="Auto,*">
+        <Grid RowDefinitions="Auto,Auto,*">
           <Grid ColumnDefinitions="*,Auto">
             <TextBlock Text="Sessions" Classes="section" />
             <Button Grid.Column="1"
                     Content="Clear finished"
                     Command="{Binding ClearFinishedSessionsCommand}" />
           </Grid>
-          <ScrollViewer Grid.Row="1" Margin="0,10,0,0">
+          <!-- LU9: column headers, using the same widths as the row template
+               below so they stay lined up. -->
+          <Grid Grid.Row="1"
+                ColumnDefinitions="2*,2*,130,3*,Auto"
+                Margin="4,10,4,4">
+            <TextBlock Text="ACCOUNT" Classes="muted" FontSize="11" FontWeight="SemiBold" />
+            <TextBlock Grid.Column="1" Text="CHARACTER"
+                       Classes="muted" FontSize="11" FontWeight="SemiBold" />
+            <TextBlock Grid.Column="2" Text="STATUS"
+                       Classes="muted" FontSize="11" FontWeight="SemiBold" />
+            <TextBlock Grid.Column="3" Text="DETAIL"
+                       Classes="muted" FontSize="11" FontWeight="SemiBold" />
+          </Grid>
+          <ScrollViewer Grid.Row="2" Margin="0,0,0,0">
             <ItemsControl ItemsSource="{Binding Sessions}">
               <ItemsControl.ItemTemplate>
                 <DataTemplate x:DataType="vm:LauncherSessionRowViewModel">

src/AcDream.Launcher/ViewModels/LauncherSessionRowViewModel.cs

@@ -28,7 +28,7 @@ public sealed class LauncherSessionRowViewModel
         Server = snapshot.ServerName;
         Character = DescribeCharacter(snapshot);
         State = DescribeState(snapshot);
-        Status = snapshot.Status;
+        Status = DescribeStatus(snapshot);
         Error = snapshot.Error;
         IsActive = snapshot.IsActive;
         StopCommand = new AsyncRelayCommand(
@@ -64,6 +64,52 @@ public sealed class LauncherSessionRowViewModel
 
     public void NotifyCommandState() => StopCommand.NotifyCanExecuteChanged();
 
+    /// <summary>
+    /// LU9. A finished session used to report the host's own machine tokens —
+    /// "Exited: process-exit (code 0)", "Exited: connection-error (code 5)" —
+    /// which say nothing to a player about the thing they actually care about:
+    /// whether the client logged out properly, and therefore whether they can
+    /// log straight back in.
+    ///
+    /// <para>While a session is alive the host's own status line is the most
+    /// informative thing available, so it is kept. Once it is over, the row
+    /// answers that question in a sentence.</para>
+    /// </summary>
+    private static string DescribeStatus(LauncherSessionSnapshot snapshot)
+    {
+        if (snapshot.IsActive)
+        {
+            return snapshot.Status;
+        }
+
+        if (snapshot.State == LauncherActivityState.Cancelled)
+        {
+            return "Cancelled before it started.";
+        }
+
+        if (snapshot.ExitedGracefully)
+        {
+            return snapshot.Kind == LauncherActivityKind.Probe
+                ? "Finished reading characters."
+                : "Exited gracefully — logged out cleanly.";
+        }
+
+        // Not graceful: the host never reported its own exit, or reported a
+        // failure. The server may still be holding the account, and saying so
+        // here is what stops the next login failure being a mystery.
+        string detail = snapshot.ExitReason switch
+        {
+            "connection-error" => "Could not reach the server",
+            "credential-error" => "The account or password was rejected",
+            "configuration-error" => "The session configuration was rejected",
+            "usage-error" => "The client rejected how it was started",
+            null or "" => "Crashed",
+            _ => "Stopped unexpectedly",
+        };
+
+        return $"{detail} — the server may hold this account for a few minutes.";
+    }
+
     private static string DescribeCharacter(LauncherSessionSnapshot snapshot)
     {
         if (snapshot.Kind == LauncherActivityKind.Probe)

src/AcDream.Launcher/ViewModels/LauncherWindowViewModel.cs

@@ -11,6 +11,16 @@ namespace AcDream.Launcher.ViewModels;
 public sealed class LauncherWindowViewModel : ObservableObject, IDisposable
 {
     private readonly ILauncherOrchestrator _orchestrator;
+    /// <summary>
+    /// LU9: how long Stop waits for the client to log out BEFORE killing it.
+    /// This used to be five seconds, which is not enough for a graphical
+    /// client to send its logout, wait for the server to acknowledge, and tear
+    /// down a mapped 28 GB world — so pressing Stop routinely ended in a kill,
+    /// the server kept holding the account, and the next login failed. The
+    /// kill is still there; it is now genuinely a last resort.
+    /// </summary>
+    private static readonly TimeSpan GracefulStopTimeout = TimeSpan.FromSeconds(30);
+
     private readonly IUiDispatcher _dispatcher;
     private readonly ILauncherInstaller _installer;
     private LauncherStateSnapshot? _snapshot;
@@ -787,12 +797,12 @@ public sealed class LauncherWindowViewModel : ObservableObject, IDisposable
         _operationCancellation = cancellation;
         IsBusy = true;
         LastError = null;
-        OperationStatus = "Stopping session…";
+        OperationStatus = "Logging out…";
         try
         {
             await _orchestrator.StopSessionAsync(
                     sessionId,
-                    TimeSpan.FromSeconds(5),
+                    GracefulStopTimeout,
                     cancellation.Token)
                 .ConfigureAwait(true);
             OperationStatus = "Stop requested.";