feat(launcher): LU9/LU10 — stop logs out for real, sessions read plainly, logout lands on character select

Five things from the user's gate.

STOP NOW ACTUALLY LOGS OUT. The UI gave the client five seconds and then
killed it. That is not enough for a graphical client to send its logout, wait
for the server to acknowledge, and tear down a mapped 28 GB world — so Stop
routinely ended in a kill, which sends the server nothing, which is exactly
what leaves the account held. Thirty seconds now, with the kill still there as
a genuine last resort, and the status says "Logging out…".

THE SERVER-SIDE HOLD IS MODELLED INSTEAD OF DISCOVERED. A session that ends
without the host running its own teardown may leave the account logged in
server-side for minutes. Launching again inside that window does not queue or
retry — it fails with a bare "CharacterList not received", which reads as a
broken launcher rather than a busy server. The orchestrator now records whether
each session ended gracefully (the host reported its own exit AND exited zero —
a killed or crashed child can satisfy neither) and refuses that account for
three minutes afterwards, saying how many seconds are left. A graceful exit
never starts a hold.

READABLE TERMINAL TEXT. "Exited: connection-error (code 5)" becomes "Could not
reach the server — the server may hold this account for a few minutes";
"Exited: process-exit (code 0)" becomes "Exited gracefully — logged out
cleanly". Live sessions still show the host's own status line, which is the
most informative thing available while one is running.

COLUMN HEADERS on the sessions list — ACCOUNT / CHARACTER / STATUS / DETAIL,
sharing the row template's widths so they stay aligned.

LOGOUT LANDS ON THE CHARACTER SCREEN (LU10). The toolbar X was already wired
correctly: IndicatorBarController's EndCharacterSessionButtonId 0x100000FA runs
retail's EndCharacterSession, and LiveSessionController's logout transaction
already ends by resetting the world generation and calling
CharacterSelectionState.Begin. What was missing is where that lands: the
retained UI built its character-selection and character-creation bindings only
when NO character selector was supplied, so a launcher-started session logged
out into a client with no screen to return to. The selector decides how a
session STARTS; it must not decide whether the select screen EXISTS. Both
binding sets are now unconditional.

The composition test that pinned the old gate is updated to pin the new
contract — the retained UI must not branch on the selector at all — rather than
being deleted.

App 5380 passed, Launcher.Core 336, Launcher 76, Headless 169. Not pushed; the
user is testing locally.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/AcDream.Launcher.Core/Orchestration/LauncherOrchestrator.cs

@@ -15,6 +15,11 @@ namespace AcDream.Launcher.Core.Orchestration;
 /// </summary>
 public sealed class LauncherOrchestrator : ILauncherOrchestrator
 {
+    /// <summary>How long the server may keep an account logged in after a
+    /// client dies without sending a logout. Observed against ACE at three
+    /// minutes and more; see GetReconnectHoldLocked.</summary>
+    private static readonly TimeSpan ServerSessionHold = TimeSpan.FromMinutes(3);
+
     private const string FirstRunRequired =
         "Client content is not configured. Complete the first-run setup before launching.";
 
@@ -142,14 +147,62 @@ public sealed class LauncherOrchestrator : ILauncherOrchestrator
             ThrowIfDisposed();
             _ = FindAccountLocked(serverName, accountName);
             ManagedActivity? active = FindActiveActivityLocked(serverName, accountName);
-            return active is null
-                ? LauncherCapability.Available
-                : LauncherCapability.Unavailable(
+            if (active is not null)
+            {
+                return LauncherCapability.Unavailable(
                     $"Stop the running {active.Kind.ToString().ToLowerInvariant()} "
                     + "for this account before starting another activity.");
+            }
+
+            return GetReconnectHoldLocked(serverName, accountName);
         }
     }
 
+    /// <summary>
+    /// LU9. A client that shuts itself down sends the server a logout and the
+    /// account frees in a few seconds. One that is killed or crashes sends
+    /// nothing, and the server keeps the account logged in until its own
+    /// timeout — observed at three minutes and more against ACE. Logging in
+    /// during that window does not queue or retry; it fails with a bare
+    /// "CharacterList not received", which reads as "the launcher is broken"
+    /// rather than "the server is still holding your last session".
+    ///
+    /// <para>So the launcher holds the account itself for that window and says
+    /// how long is left. This is the server's constraint made visible, not a
+    /// retry or a grace period hiding one: the moment the hold expires the
+    /// account is offered again, and a graceful exit never starts one.</para>
+    /// </summary>
+    private LauncherCapability GetReconnectHoldLocked(
+        string serverName,
+        string accountName)
+    {
+        DateTimeOffset now = DateTimeOffset.UtcNow;
+        ManagedActivity? ungraceful = _activities
+            .Where(activity =>
+                activity.IsTerminal
+                && !activity.ExitedGracefully
+                && activity.TerminalAt is not null
+                && string.Equals(activity.ServerName, serverName, StringComparison.Ordinal)
+                && string.Equals(activity.AccountName, accountName, StringComparison.Ordinal))
+            .OrderByDescending(activity => activity.TerminalAt)
+            .FirstOrDefault();
+        if (ungraceful?.TerminalAt is not { } terminalAt)
+        {
+            return LauncherCapability.Available;
+        }
+
+        TimeSpan remaining = ServerSessionHold - (now - terminalAt);
+        if (remaining <= TimeSpan.Zero)
+        {
+            return LauncherCapability.Available;
+        }
+
+        int seconds = (int)Math.Ceiling(remaining.TotalSeconds);
+        return LauncherCapability.Unavailable(
+            $"The last session for this account did not log out cleanly, so the "
+            + $"server may still be holding it. Try again in {seconds} s.");
+    }
+
     public LauncherCapability GetProbeCapability(string serverName, string accountName)
     {
         ArgumentException.ThrowIfNullOrWhiteSpace(serverName);
@@ -838,6 +891,8 @@ public sealed class LauncherOrchestrator : ILauncherOrchestrator
                 {
                     case ExitedStatusEvent exited:
                         activity.ExitCode ??= exited.Code;
+                        activity.HostReportedExit = true;
+                        activity.ExitReason ??= exited.Reason;
                         activity.HostTerminalStatus ??=
                             $"Exited: {exited.Reason} (code {exited.Code}).";
                         if (activity.State == LauncherActivityState.Exited)
@@ -904,6 +959,8 @@ public sealed class LauncherOrchestrator : ILauncherOrchestrator
                 case ExitedStatusEvent exited:
                     activity.State = LauncherActivityState.Exited;
                     activity.ExitCode = exited.Code;
+                    activity.HostReportedExit = true;
+                    activity.ExitReason = exited.Reason;
                     activity.HostTerminalStatus =
                         $"Exited: {exited.Reason} (code {exited.Code}).";
                     activity.Status = activity.HostTerminalStatus;
@@ -1289,7 +1346,26 @@ public sealed class LauncherOrchestrator : ILauncherOrchestrator
 
         public DateTimeOffset CreatedAt { get; }
 
-        public LauncherActivityState State { get; set; } = LauncherActivityState.Starting;
+        private LauncherActivityState _state = LauncherActivityState.Starting;
+
+        /// <summary>
+        /// LU9: stamps <see cref="TerminalAt"/> on the FIRST transition into a
+        /// terminal state. Every terminal path in this file assigns through
+        /// here, so the server-side hold cannot be started from one site and
+        /// forgotten at another.
+        /// </summary>
+        public LauncherActivityState State
+        {
+            get => _state;
+            set
+            {
+                _state = value;
+                if (IsTerminal)
+                {
+                    TerminalAt ??= DateTimeOffset.UtcNow;
+                }
+            }
+        }
 
         public string Status { get; set; }
 
@@ -1299,6 +1375,21 @@ public sealed class LauncherOrchestrator : ILauncherOrchestrator
 
         public string? HostTerminalStatus { get; set; }
 
+        /// <summary>LU9: the host's own terminal reason token, set only when
+        /// the host actually reported "exited" — so null means it never ran
+        /// its own teardown.</summary>
+        public string? ExitReason { get; set; }
+
+        /// <summary>LU9: the host reported its own terminal event, as opposed
+        /// to the launcher merely observing the process disappear.</summary>
+        public bool HostReportedExit { get; set; }
+
+        /// <summary>LU9: when this activity first became terminal, which is
+        /// when the server-side hold starts counting.</summary>
+        public DateTimeOffset? TerminalAt { get; set; }
+
+        public bool ExitedGracefully => HostReportedExit && ExitCode == 0;
+
         public ILauncherProcessSupervisor? Supervisor { get; set; }
 
         public EventHandler<LauncherSessionState>? SupervisorStateHandler { get; set; }
@@ -1332,7 +1423,13 @@ public sealed class LauncherOrchestrator : ILauncherOrchestrator
                 Status,
                 ExitCode,
                 Error,
-                CreatedAt);
+                CreatedAt,
+                ExitReason,
+                // Graceful means the HOST ran its own shutdown and exited
+                // clean, which is exactly the path that sends the server a
+                // logout. A killed or crashed child never reports "exited"
+                // and never exits zero, so it cannot be mistaken for one.
+                ExitedGracefully);
     }
 
     private sealed class StartRequest(

src/AcDream.Launcher.Core/Orchestration/LauncherStateSnapshot.cs

@@ -61,7 +61,17 @@ public sealed record LauncherSessionSnapshot(
     string Status,
     int? ExitCode,
     string? Error,
-    DateTimeOffset CreatedAt)
+    DateTimeOffset CreatedAt,
+    /// <summary>LU9: the host's own machine-readable terminal reason
+    /// ("process-exit", "connection-error", "probe", ...), or null when the
+    /// host never got to report one — which itself means it did not shut
+    /// itself down.</summary>
+    string? ExitReason = null,
+    /// <summary>LU9: the host ran its OWN teardown and exited zero, so it
+    /// sent the server a logout. When this is false after a terminal state,
+    /// the server may still be holding the session — see
+    /// <see cref="LauncherOrchestrator"/>'s reconnect hold.</summary>
+    bool ExitedGracefully = false)
 {
     public bool IsActive => State is not (
         LauncherActivityState.Exited