merge: Campaign LA LA3 - Launcher.Core review-closed

src/AcDream.Launcher.Core/AcDream.Launcher.Core.csproj

@@ -0,0 +1,21 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <LangVersion>latest</LangVersion>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+    <!-- Required by the LibraryImportAttribute source generator (F3's
+         Linux SIGINT P/Invoke in Launching/ILauncherChildProcess.cs):
+         the generated marshalling stub calls through an unmanaged
+         function pointer, which the compiler only allows in an unsafe
+         context. -->
+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
+  </PropertyGroup>
+  <ItemGroup>
+    <InternalsVisibleTo Include="AcDream.Launcher.Core.Tests" />
+  </ItemGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\AcDream.Platform\AcDream.Platform.csproj" />
+  </ItemGroup>
+</Project>

src/AcDream.Launcher.Core/Integrity/FileIntegrity.cs

@@ -0,0 +1,61 @@
+using System.Security.Cryptography;
+
+namespace AcDream.Launcher.Core.Integrity;
+
+/// <summary>
+/// Streaming SHA-256 for pak/download verification, consumed by the
+/// install engine (LA9) and the updater (LA10). Kept minimal in this
+/// slice: hash a file and compare its hex digest.
+/// </summary>
+public static class FileIntegrity
+{
+    /// <summary>
+    /// Computes the lower-case hex SHA-256 digest of a file, streaming it
+    /// from disk rather than loading it fully into memory (relevant for
+    /// the ~30&#160;GB pak file LA9 verifies).
+    /// </summary>
+    public static string ComputeSha256Hex(string filePath)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(filePath);
+
+        using FileStream stream = new(
+            filePath,
+            FileMode.Open,
+            FileAccess.Read,
+            FileShare.Read);
+        byte[] hash = SHA256.HashData(stream);
+        return Convert.ToHexStringLower(hash);
+    }
+
+    public static async Task<string> ComputeSha256HexAsync(
+        string filePath,
+        CancellationToken cancellationToken = default)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(filePath);
+
+        await using FileStream stream = new(
+            filePath,
+            FileMode.Open,
+            FileAccess.Read,
+            FileShare.Read,
+            bufferSize: 4096,
+            useAsync: true);
+        byte[] hash = await SHA256.HashDataAsync(stream, cancellationToken)
+            .ConfigureAwait(false);
+        return Convert.ToHexStringLower(hash);
+    }
+
+    /// <summary>Case-insensitive hex comparison — callers may receive an
+    /// expected digest in either case from a manifest or a hand-typed
+    /// fixture.</summary>
+    public static bool Matches(string actualHex, string expectedHex)
+    {
+        ArgumentNullException.ThrowIfNull(actualHex);
+        ArgumentNullException.ThrowIfNull(expectedHex);
+        return string.Equals(actualHex, expectedHex, StringComparison.OrdinalIgnoreCase);
+    }
+
+    /// <summary>Computes and compares in one call.</summary>
+    public static bool Verify(string filePath, string expectedHex) =>
+        Matches(ComputeSha256Hex(filePath), expectedHex);
+}

src/AcDream.Launcher.Core/Launching/ILauncherChildProcess.cs

@@ -0,0 +1,174 @@
+using System.Diagnostics;
+using System.Runtime.InteropServices;
+
+namespace AcDream.Launcher.Core.Launching;
+
+/// <summary>
+/// Thin seam over <see cref="System.Diagnostics.Process"/> so
+/// <see cref="LauncherProcessSupervisor"/>'s lifecycle and Stop
+/// (CloseMainWindow, falling back to Kill after a timeout) state machine
+/// can be unit-tested against an in-memory fake without spawning a real
+/// OS process or depending on real window-message timing — both
+/// "injectable for tests" per Campaign LA spec §3.
+/// </summary>
+public interface ILauncherChildProcess : IDisposable
+{
+    bool HasExited { get; }
+
+    int ExitCode { get; }
+
+    /// <summary>The child's redirected stdin. The supervisor writes the
+    /// account password here (followed by a newline) and then closes it —
+    /// never anywhere else.</summary>
+    TextWriter StandardInput { get; }
+
+    /// <summary>Fires exactly once, when the child process terminates
+    /// (mirrors <see cref="Process.Exited"/> with
+    /// <c>EnableRaisingEvents</c> on).</summary>
+    event EventHandler? Exited;
+
+    void Start();
+
+    /// <summary>
+    /// Attempts a graceful stop signal appropriate to the platform,
+    /// tried BEFORE <see cref="CloseMainWindow"/> (Campaign LA plan §LA3
+    /// review finding F3): a no-window console host (e.g.
+    /// <c>AcDream.Headless</c>) never has a main window for
+    /// <see cref="CloseMainWindow"/> to close, so without this step
+    /// <see cref="LauncherProcessSupervisor.Stop"/> always degraded
+    /// straight to a timeout + hard <see cref="Kill"/> — and a hard kill
+    /// leaves the ACE account session stuck for several minutes (a
+    /// documented project landmine; see CLAUDE.md
+    /// "Logout-before-reconnect"). On Linux this sends SIGINT (K4 proved
+    /// the headless host's SIGINT handler produces an ACE-confirmed
+    /// graceful logout). On Windows there is no reliable cross-console
+    /// mechanism for an arbitrary no-window child process today — see
+    /// <c>docs/ISSUES.md</c> for the tracked gap and fix direction; this
+    /// returns false there. Returns true only when the signal was
+    /// actually delivered; never throws.
+    /// </summary>
+    bool TryRequestGracefulStop();
+
+    /// <summary>Mirrors <see cref="Process.CloseMainWindow"/> — requests
+    /// a graceful close via WM_CLOSE. Returns false for a console/no-
+    /// window process (never throws), matching the real API.</summary>
+    bool CloseMainWindow();
+
+    /// <summary>Mirrors <see cref="Process.Kill(bool)"/> with
+    /// <c>entireProcessTree: true</c>.</summary>
+    void Kill();
+
+    bool WaitForExit(TimeSpan timeout);
+}
+
+/// <summary>Creates <see cref="ILauncherChildProcess"/> instances from a
+/// <see cref="LauncherProcessSpec"/>.</summary>
+public interface ILauncherChildProcessFactory
+{
+    ILauncherChildProcess Create(LauncherProcessSpec spec);
+}
+
+/// <summary>Real-process implementation used in production.</summary>
+public sealed class SystemChildProcessFactory : ILauncherChildProcessFactory
+{
+    public ILauncherChildProcess Create(LauncherProcessSpec spec) =>
+        new SystemChildProcess(spec);
+}
+
+internal sealed partial class SystemChildProcess : ILauncherChildProcess
+{
+    // SIGINT's numeric value (POSIX-stable across Linux distributions).
+    // K4/Slice K already proved the headless host's SIGINT handler
+    // produces an ACE-confirmed graceful logout.
+    private const int Sigint = 2;
+
+    [LibraryImport("libc", SetLastError = true)]
+    private static partial int kill(int pid, int sig);
+
+    private readonly Process _process;
+    private bool _raisingEnabled;
+
+    internal SystemChildProcess(LauncherProcessSpec spec)
+    {
+        ArgumentNullException.ThrowIfNull(spec);
+
+        var startInfo = new ProcessStartInfo
+        {
+            FileName = spec.ExecutablePath,
+            RedirectStandardInput = true,
+            UseShellExecute = false,
+        };
+
+        foreach (string argument in spec.Arguments)
+        {
+            startInfo.ArgumentList.Add(argument);
+        }
+
+        if (!string.IsNullOrEmpty(spec.WorkingDirectory))
+        {
+            startInfo.WorkingDirectory = spec.WorkingDirectory;
+        }
+
+        _process = new Process { StartInfo = startInfo };
+    }
+
+    public bool HasExited => _process.HasExited;
+
+    public int ExitCode => _process.ExitCode;
+
+    public TextWriter StandardInput => _process.StandardInput;
+
+    public event EventHandler? Exited;
+
+    public void Start()
+    {
+        _process.EnableRaisingEvents = true;
+        _process.Exited += OnExited;
+        _raisingEnabled = true;
+        _process.Start();
+    }
+
+    public bool TryRequestGracefulStop()
+    {
+        if (!OperatingSystem.IsLinux())
+        {
+            // No reliable cross-console mechanism exists for an
+            // arbitrary no-window Windows child process — tracked gap,
+            // see docs/ISSUES.md.
+            return false;
+        }
+
+        try
+        {
+            return kill(_process.Id, Sigint) == 0;
+        }
+        catch
+        {
+            // Matches CloseMainWindow's "never throws" contract — the
+            // process may not have started yet, may have already exited
+            // (ESRCH), or the platform may lack libc under an unusual
+            // Linux runtime; any of these degrade to "signal not sent"
+            // rather than an exception out of Stop().
+            return false;
+        }
+    }
+
+    public bool CloseMainWindow() => _process.CloseMainWindow();
+
+    public void Kill() => _process.Kill(entireProcessTree: true);
+
+    public bool WaitForExit(TimeSpan timeout) => _process.WaitForExit(timeout);
+
+    public void Dispose()
+    {
+        if (_raisingEnabled)
+        {
+            _process.Exited -= OnExited;
+        }
+
+        _process.Dispose();
+    }
+
+    private void OnExited(object? sender, EventArgs e) =>
+        Exited?.Invoke(this, EventArgs.Empty);
+}

src/AcDream.Launcher.Core/Launching/LauncherInstallRecord.cs

@@ -0,0 +1,12 @@
+namespace AcDream.Launcher.Core.Launching;
+
+/// <summary>
+/// The DAT/pak locations a completed install (LA9) records and every
+/// session-config composition consumes for
+/// <see cref="SessionContentDescriptor"/>. SHA-256/version bookkeeping
+/// for the install record itself is LA9/LA10 scope; this slice only
+/// needs the two paths a session config requires.
+/// </summary>
+public sealed record LauncherInstallRecord(
+    string DatDirectory,
+    string PreparedAssetPath);

src/AcDream.Launcher.Core/Launching/LauncherProcessSpec.cs

@@ -0,0 +1,15 @@
+namespace AcDream.Launcher.Core.Launching;
+
+/// <summary>
+/// What to spawn: the host executable path + argument list (both
+/// injectable per Campaign LA spec §3, e.g. <c>AcDream.Headless --config
+/// &lt;path&gt;</c> or <c>AcDream.App --session-config &lt;path&gt;</c>).
+/// Deliberately carries no credential field — the password is a separate
+/// transient parameter to <see cref="LauncherProcessSupervisor.Start"/>
+/// that flows only to the child's stdin, never into this spec, an
+/// argument list, or a process environment.
+/// </summary>
+public sealed record LauncherProcessSpec(
+    string ExecutablePath,
+    IReadOnlyList<string> Arguments,
+    string? WorkingDirectory = null);

src/AcDream.Launcher.Core/Launching/LauncherProcessSupervisor.cs

@@ -0,0 +1,286 @@
+using System.Runtime.ExceptionServices;
+
+namespace AcDream.Launcher.Core.Launching;
+
+/// <summary>
+/// Spawns a host process (App/Headless), feeds the account password to
+/// its stdin then closes it, and supervises its lifetime (Campaign LA
+/// spec §3/§6). One supervisor instance owns exactly one child process
+/// for its lifetime — start a new supervisor per launched session.
+/// </summary>
+public sealed class LauncherProcessSupervisor : IDisposable
+{
+    private readonly ILauncherChildProcessFactory _factory;
+    private readonly object _gate = new();
+    private readonly Queue<LauncherSessionState> _pendingStateChanges = [];
+    private ILauncherChildProcess? _process;
+    private LauncherSessionState _state = LauncherSessionState.Starting;
+    private int? _exitCode;
+    private bool _publishingStateChanges;
+
+    public LauncherProcessSupervisor(ILauncherChildProcessFactory? factory = null)
+    {
+        _factory = factory ?? new SystemChildProcessFactory();
+    }
+
+    public LauncherSessionState State
+    {
+        get
+        {
+            lock (_gate)
+            {
+                return _state;
+            }
+        }
+    }
+
+    /// <summary>Set once <see cref="State"/> reaches
+    /// <see cref="LauncherSessionState.Exited"/>; null before then.
+    /// </summary>
+    public int? ExitCode
+    {
+        get
+        {
+            lock (_gate)
+            {
+                return _exitCode;
+            }
+        }
+    }
+
+    /// <summary>Fires on every <see cref="LauncherSessionState"/>
+    /// transition, in order.</summary>
+    public event EventHandler<LauncherSessionState>? StateChanged;
+
+    /// <summary>
+    /// Spawns the child described by <paramref name="spec"/>, writes
+    /// <paramref name="password"/> (if any) followed by a newline to its
+    /// stdin, then closes stdin. The password is never written anywhere
+    /// else — not into <paramref name="spec"/>, not into an environment
+    /// variable, not logged.
+    /// </summary>
+    public void Start(LauncherProcessSpec spec, string? password)
+    {
+        ArgumentNullException.ThrowIfNull(spec);
+
+        ILauncherChildProcess process;
+        lock (_gate)
+        {
+            if (_process is not null)
+            {
+                throw new InvalidOperationException(
+                    "This supervisor already owns a process; start a new "
+                    + "supervisor per launched session.");
+            }
+
+            process = _factory.Create(spec);
+            process.Exited += OnProcessExited;
+            _process = process;
+        }
+
+        SetState(LauncherSessionState.Starting);
+
+        bool started = false;
+        try
+        {
+            process.Start();
+            started = true;
+
+            if (password is not null)
+            {
+                process.StandardInput.Write(password);
+                process.StandardInput.Write('\n');
+                process.StandardInput.Flush();
+            }
+
+            process.StandardInput.Close();
+        }
+        catch
+        {
+            lock (_gate)
+            {
+                process.Exited -= OnProcessExited;
+                _process = null;
+            }
+
+            // A failure after the child actually started (e.g. the stdin
+            // pipe breaks while feeding the password) must not leave a
+            // live, unsupervised, undisposable child running (Campaign LA
+            // plan §LA3 review finding F8) — kill the whole process tree
+            // and release the handle before propagating the original
+            // failure.
+            if (started)
+            {
+                try
+                {
+                    process.Kill();
+                }
+                catch
+                {
+                    // Best-effort — the ORIGINAL failure, rethrown below,
+                    // is what the caller needs to see; a failed cleanup
+                    // kill must not replace it.
+                }
+            }
+
+            process.Dispose();
+
+            throw;
+        }
+
+        SetState(LauncherSessionState.Running);
+    }
+
+    /// <summary>
+    /// Requests a graceful stop — first
+    /// <see cref="ILauncherChildProcess.TryRequestGracefulStop"/> (SIGINT
+    /// on Linux; a no-op on Windows today, see
+    /// <see cref="ILauncherChildProcess.TryRequestGracefulStop"/>'s docs),
+    /// then <see cref="ILauncherChildProcess.CloseMainWindow"/> — falling
+    /// back to <see cref="ILauncherChildProcess.Kill"/> if the process has
+    /// not exited within <paramref name="timeout"/>. A no-op if
+    /// <see cref="Start"/> was never called or the process has already
+    /// exited.
+    /// <para>
+    /// BLOCKS THE CALLING THREAD for up to <paramref name="timeout"/>
+    /// (via the real child's <c>WaitForExit</c>) — callers on a UI thread
+    /// must dispatch this off-thread rather than calling it directly (a
+    /// binding requirement for the LA4 Avalonia UI, which will call this
+    /// method from a "stop session" action).
+    /// </para>
+    /// </summary>
+    public void Stop(TimeSpan timeout)
+    {
+        ILauncherChildProcess? process;
+        lock (_gate)
+        {
+            process = _process;
+        }
+
+        if (process is null || process.HasExited)
+        {
+            return;
+        }
+
+        process.TryRequestGracefulStop();
+        process.CloseMainWindow();
+        if (!process.WaitForExit(timeout) && !process.HasExited)
+        {
+            process.Kill();
+        }
+    }
+
+    private void OnProcessExited(object? sender, EventArgs e)
+    {
+        int? exitCode;
+        lock (_gate)
+        {
+            exitCode = _process is { HasExited: true } process
+                ? process.ExitCode
+                : null;
+        }
+
+        SetState(LauncherSessionState.Exited, exitCode);
+    }
+
+    /// <summary>
+    /// Applies a state transition, or silently ignores it (Campaign LA
+    /// plan §LA3 review finding F9): once <see cref="State"/> reaches the
+    /// terminal <see cref="LauncherSessionState.Exited"/>, no later call
+    /// may move it anywhere else, and <see cref="StateChanged"/> only
+    /// fires for a transition that was actually applied. This matters
+    /// because <see cref="Start"/>'s trailing
+    /// <c>SetState(LauncherSessionState.Running)</c> can race a
+    /// synchronous <see cref="OnProcessExited"/> callback fired from
+    /// inside <see cref="Start"/> itself (a child that dies immediately)
+    /// — without this guard, "Running" would silently resurrect a
+    /// process that has already reported its exit.
+    /// </summary>
+    private void SetState(LauncherSessionState state, int? exitCode = null)
+    {
+        bool publish;
+        lock (_gate)
+        {
+            if (_state == LauncherSessionState.Exited)
+            {
+                return;
+            }
+
+            _state = state;
+            if (state == LauncherSessionState.Exited)
+            {
+                _exitCode = exitCode;
+            }
+
+            _pendingStateChanges.Enqueue(state);
+            publish = !_publishingStateChanges;
+            if (publish)
+            {
+                _publishingStateChanges = true;
+            }
+        }
+
+        if (publish)
+        {
+            PublishPendingStateChanges();
+        }
+    }
+
+    /// <summary>
+    /// Drains state notifications through one publisher. Transition storage
+    /// stays under <see cref="_gate"/>, but user callbacks run outside it so
+    /// they may re-enter the supervisor or wait for another thread reading
+    /// state without deadlocking. A concurrent/re-entrant transition queues
+    /// behind the notification already in flight, preserving storage order in
+    /// the externally observed event stream.
+    /// </summary>
+    private void PublishPendingStateChanges()
+    {
+        Exception? firstException = null;
+        while (true)
+        {
+            LauncherSessionState state;
+            lock (_gate)
+            {
+                if (_pendingStateChanges.Count == 0)
+                {
+                    _publishingStateChanges = false;
+                    break;
+                }
+
+                state = _pendingStateChanges.Dequeue();
+            }
+
+            try
+            {
+                StateChanged?.Invoke(this, state);
+            }
+            catch (Exception ex)
+            {
+                // Preserve the previous propagation behavior, but finish
+                // publishing any transition already committed concurrently
+                // (especially terminal Exited) before rethrowing the first
+                // observer failure to the initiating caller.
+                firstException ??= ex;
+            }
+        }
+
+        if (firstException is not null)
+        {
+            ExceptionDispatchInfo.Capture(firstException).Throw();
+        }
+    }
+
+    public void Dispose()
+    {
+        lock (_gate)
+        {
+            if (_process is not null)
+            {
+                _process.Exited -= OnProcessExited;
+                _process.Dispose();
+                _process = null;
+            }
+        }
+    }
+}

src/AcDream.Launcher.Core/Launching/LauncherSessionState.cs

@@ -0,0 +1,21 @@
+namespace AcDream.Launcher.Core.Launching;
+
+/// <summary>Lifecycle of a launched host process, per Campaign LA spec §3
+/// ("supervise lifetime ... surface typed session state").</summary>
+public enum LauncherSessionState
+{
+    /// <summary>The child process has been created and the credential
+    /// handed off, but has not yet reached <see cref="Running"/>.</summary>
+    Starting,
+
+    /// <summary>The child process is spawned and its stdin has been
+    /// closed. Says nothing about game-level connection state — that
+    /// comes from the status stream (see
+    /// <c>AcDream.Launcher.Core.Status</c>).</summary>
+    Running,
+
+    /// <summary>The child process has exited. See
+    /// <see cref="LauncherProcessSupervisor.ExitCode"/> for the exit
+    /// code.</summary>
+    Exited,
+}

src/AcDream.Launcher.Core/Launching/SessionConfigComposer.cs

@@ -0,0 +1,242 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using AcDream.Launcher.Core.Profiles;
+using AcDream.Platform;
+
+namespace AcDream.Launcher.Core.Launching;
+
+/// <summary>The composed session-config document plus the two per-launch
+/// paths derived from the session id, per Campaign LA spec §6.</summary>
+public sealed record ComposedSessionConfig(
+    string SessionId,
+    string ConfigFilePath,
+    string StatusFilePath,
+    SessionConfigDocument Document);
+
+/// <summary>
+/// Builds the per-launch <see cref="SessionConfigDocument"/> from a
+/// profile character + install record (Campaign LA spec §6). Passwords
+/// NEVER appear in the composed document — the credential is always the
+/// <c>standardInput</c> provider; the launcher feeds the password to the
+/// child process's stdin separately (<see cref="LauncherProcessSupervisor"/>).
+/// </summary>
+public static class SessionConfigComposer
+{
+    internal static readonly JsonSerializerOptions SerializerOptions = new()
+    {
+        PropertyNamingPolicy = JsonNamingPolicy.CamelCase,
+        DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull,
+        WriteIndented = true,
+    };
+
+    /// <summary>
+    /// Builds the document and the paths it would be written to under
+    /// <c>&lt;CacheDirectory&gt;/launcher/sessions/&lt;sessionId&gt;/</c>,
+    /// without touching disk. <paramref name="sessionId"/> is caller-
+    /// supplied so composition stays a pure function of its inputs
+    /// (golden-file tests pass a fixed id).
+    /// </summary>
+    public static ComposedSessionConfig Compose(
+        ServerProfile server,
+        AccountProfile account,
+        CharacterProfile character,
+        LauncherInstallRecord install,
+        ApplicationPathSet paths,
+        string sessionId,
+        int? loginCommandDelayMs = null)
+    {
+        ArgumentNullException.ThrowIfNull(server);
+        ArgumentNullException.ThrowIfNull(account);
+        ArgumentNullException.ThrowIfNull(character);
+        ArgumentNullException.ThrowIfNull(install);
+        ArgumentNullException.ThrowIfNull(paths);
+        ArgumentException.ThrowIfNullOrWhiteSpace(sessionId);
+
+        (string configFilePath, string statusFilePath) = BuildSessionPaths(paths, sessionId);
+
+        SessionCharacterSelector? selector = character.LaunchMode == LaunchMode.GuiSelect
+            ? null
+            : BuildSelector(character);
+
+        SessionPolicyDescriptor? policy = character.LaunchMode == LaunchMode.Headless
+            ? new SessionPolicyDescriptor()
+            : null;
+
+        var descriptor = new SessionDescriptor
+        {
+            Id = sessionId,
+            Endpoint = new SessionEndpointDescriptor
+            {
+                Host = server.Host,
+                Port = server.Port,
+            },
+            Account = account.Account,
+            Character = selector,
+            Policy = policy,
+            Credential = new SessionCredentialDescriptor(),
+            Plugins = character.Plugins.Count > 0 ? [.. character.Plugins] : null,
+            LoginCommands = character.LoginCommands.Count > 0
+                ? [.. character.LoginCommands]
+                : null,
+            LoginCommandDelayMs = loginCommandDelayMs,
+            StatusFile = statusFilePath,
+        };
+
+        var document = new SessionConfigDocument
+        {
+            Process = new SessionProcessSettings
+            {
+                Content = new SessionContentDescriptor
+                {
+                    DatDirectory = install.DatDirectory,
+                    PreparedAssetPath = install.PreparedAssetPath,
+                },
+            },
+            Sessions = [descriptor],
+        };
+
+        return new ComposedSessionConfig(
+            sessionId,
+            configFilePath,
+            statusFilePath,
+            document);
+    }
+
+    /// <summary>
+    /// Builds a probe session-config document (Campaign LA plan §LA2/
+    /// §LA3 review finding F2): the session carries <c>mode: "probe"</c>,
+    /// no <c>character</c> selector, and no <c>policy</c> — the host
+    /// reports the account's character roster over the status stream and
+    /// exits without entering the world. <c>plugins</c>/<c>loginCommands</c>
+    /// don't apply to a probe and are always omitted, exactly like an
+    /// empty configured set on a normal session.
+    /// </summary>
+    public static ComposedSessionConfig ComposeProbe(
+        ServerProfile server,
+        AccountProfile account,
+        LauncherInstallRecord install,
+        ApplicationPathSet paths,
+        string sessionId)
+    {
+        ArgumentNullException.ThrowIfNull(server);
+        ArgumentNullException.ThrowIfNull(account);
+        ArgumentNullException.ThrowIfNull(install);
+        ArgumentNullException.ThrowIfNull(paths);
+        ArgumentException.ThrowIfNullOrWhiteSpace(sessionId);
+
+        (string configFilePath, string statusFilePath) = BuildSessionPaths(paths, sessionId);
+
+        var descriptor = new SessionDescriptor
+        {
+            Id = sessionId,
+            Mode = "probe",
+            Endpoint = new SessionEndpointDescriptor
+            {
+                Host = server.Host,
+                Port = server.Port,
+            },
+            Account = account.Account,
+            Character = null,
+            Policy = null,
+            Credential = new SessionCredentialDescriptor(),
+            Plugins = null,
+            LoginCommands = null,
+            LoginCommandDelayMs = null,
+            StatusFile = statusFilePath,
+        };
+
+        var document = new SessionConfigDocument
+        {
+            Process = new SessionProcessSettings
+            {
+                Content = new SessionContentDescriptor
+                {
+                    DatDirectory = install.DatDirectory,
+                    PreparedAssetPath = install.PreparedAssetPath,
+                },
+            },
+            Sessions = [descriptor],
+        };
+
+        return new ComposedSessionConfig(
+            sessionId,
+            configFilePath,
+            statusFilePath,
+            document);
+    }
+
+    /// <summary>Composes and writes <c>session.json</c> to
+    /// <see cref="ComposedSessionConfig.ConfigFilePath"/>, creating the
+    /// per-session directory. The status file itself is created by the
+    /// launched host, not the launcher.</summary>
+    public static ComposedSessionConfig ComposeAndWrite(
+        ServerProfile server,
+        AccountProfile account,
+        CharacterProfile character,
+        LauncherInstallRecord install,
+        ApplicationPathSet paths,
+        string sessionId,
+        int? loginCommandDelayMs = null)
+    {
+        ComposedSessionConfig composed = Compose(
+            server,
+            account,
+            character,
+            install,
+            paths,
+            sessionId,
+            loginCommandDelayMs);
+
+        string? directory = Path.GetDirectoryName(composed.ConfigFilePath);
+        if (!string.IsNullOrEmpty(directory))
+        {
+            Directory.CreateDirectory(directory);
+        }
+
+        using FileStream stream = File.Create(composed.ConfigFilePath);
+        JsonSerializer.Serialize(stream, composed.Document, SerializerOptions);
+
+        return composed;
+    }
+
+    /// <summary>Serializes the composed document exactly as
+    /// <see cref="ComposeAndWrite"/> would write it — used by golden-file
+    /// tests that assert on the JSON text without touching disk.</summary>
+    public static string Serialize(SessionConfigDocument document) =>
+        JsonSerializer.Serialize(document, SerializerOptions);
+
+    private static (string ConfigFilePath, string StatusFilePath) BuildSessionPaths(
+        ApplicationPathSet paths,
+        string sessionId)
+    {
+        string sessionDirectory = Path.Combine(
+            paths.CacheDirectory,
+            "launcher",
+            "sessions",
+            sessionId);
+
+        return (
+            Path.Combine(sessionDirectory, "session.json"),
+            Path.Combine(sessionDirectory, "status.jsonl"));
+    }
+
+    private static SessionCharacterSelector BuildSelector(CharacterProfile character)
+    {
+        // A parsed id of 0 is not a usable selector — both host loaders
+        // (App/Headless) reject `id: 0` outright, so falling through to
+        // the name selector here is the only shape that reaches a real
+        // character (Campaign LA plan §LA3 review finding F10).
+        if (CharacterIdFormat.TryParse(character.Id, out uint id) && id != 0)
+        {
+            return new SessionCharacterSelector { Id = id };
+        }
+
+        if (!string.IsNullOrWhiteSpace(character.Name))
+        {
+            return new SessionCharacterSelector { Name = character.Name };
+        }
+
+        throw new InvalidOperationException(
+            "Character has neither a usable id nor a name to select by.");
+    }
+}

src/AcDream.Launcher.Core/Launching/SessionConfigDocument.cs

@@ -0,0 +1,152 @@
+namespace AcDream.Launcher.Core.Launching;
+
+/// <summary>
+/// The per-launch session-config document written to
+/// <c>&lt;CacheDirectory&gt;/launcher/sessions/&lt;sessionId&gt;/session.json</c>
+/// and consumed by <c>AcDream.Headless --config</c> / (LA1)
+/// <c>AcDream.App --session-config</c>.
+///
+/// <para>
+/// PINNED CONTRACT (Campaign LA plan §LA3): this is the Slice K1
+/// <c>HeadlessConfiguration</c> version-1 shape extended with optional
+/// launcher fields (<c>plugins</c>, <c>loginCommands</c>,
+/// <c>loginCommandDelayMs</c>, <c>statusFile</c>). Launcher.Core defines
+/// its own DTOs rather than referencing <c>AcDream.Headless</c> — the
+/// project reference set for this assembly is <c>AcDream.Platform</c>
+/// ONLY (no game-solution dependency; see LA3 acceptance).
+/// Serialized camelCase via <see cref="SessionConfigComposer"/>, with
+/// null optional members omitted from the written JSON.
+/// </para>
+/// </summary>
+public sealed class SessionConfigDocument
+{
+    public int Version { get; init; } = 1;
+
+    public SessionProcessSettings Process { get; init; } = new();
+
+    public List<SessionDescriptor> Sessions { get; init; } = [];
+}
+
+public sealed class SessionProcessSettings
+{
+    /// <summary>
+    /// PINNED CONTRACT (Campaign LA plan §LA3 review, finding F1): the
+    /// <c>paths</c> KEY is entirely OMITTED from the written JSON unless
+    /// a caller explicitly supplies overrides — never an empty object.
+    /// The App-side loader parses with strict
+    /// <c>UnmappedMemberHandling.Disallow</c> and has no <c>paths</c>
+    /// member of its own, so an emitted <c>"paths":{}</c> is a null-
+    /// omission artifact (the object's own members are all optional and
+    /// omit cleanly, but the containing property was never null itself)
+    /// that would fail every gui/guiSelect launch at config load.
+    /// </summary>
+    public SessionPathOverrides? Paths { get; init; }
+
+    public SessionContentDescriptor Content { get; init; } = new();
+}
+
+/// <summary>All three members are optional overrides; a host resolves
+/// its own default <c>ApplicationPathSet</c> when a member is
+/// omitted.</summary>
+public sealed class SessionPathOverrides
+{
+    public string? ConfigDirectory { get; init; }
+
+    public string? DataDirectory { get; init; }
+
+    public string? CacheDirectory { get; init; }
+}
+
+// NOTE: these DTOs are write-only (Launcher.Core composes and serializes
+// them; it never deserializes a session-config document back). Members
+// that the pinned contract calls "always present" therefore use plain
+// non-nullable defaults rather than C#'s `required` modifier — a
+// `required` member cannot be given a `= new()` default on a containing
+// type without a [SetsRequiredMembers] constructor, and correctness here
+// is enforced by SessionConfigComposer's tests, not the compiler.
+
+public sealed class SessionContentDescriptor
+{
+    public string DatDirectory { get; init; } = string.Empty;
+
+    public string PreparedAssetPath { get; init; } = string.Empty;
+}
+
+public sealed class SessionDescriptor
+{
+    public string Id { get; init; } = string.Empty;
+
+    /// <summary>Present only for a probe session (<c>"probe"</c>,
+    /// Campaign LA plan §LA2/§LA3) — the host reports the account's
+    /// character roster and exits without entering the world. OMITTED
+    /// entirely for a normal gui/guiSelect/headless play session.
+    /// </summary>
+    public string? Mode { get; init; }
+
+    public SessionEndpointDescriptor Endpoint { get; init; } = new();
+
+    public string Account { get; init; } = string.Empty;
+
+    /// <summary>Exactly one of index/id/name when present. OMITTED
+    /// entirely for a <c>guiSelect</c> launch (retail character-select
+    /// screen instead of auto-enter).</summary>
+    public SessionCharacterSelector? Character { get; init; }
+
+    /// <summary>Present only for a <c>headless</c> launch (the <c>idle</c>
+    /// bot policy). Omitted for <c>gui</c>/<c>guiSelect</c>.</summary>
+    public SessionPolicyDescriptor? Policy { get; init; }
+
+    public SessionCredentialDescriptor Credential { get; init; } = new();
+
+    /// <summary>Omitted (never an empty array) when the character has no
+    /// configured plugin set.</summary>
+    public List<string>? Plugins { get; init; }
+
+    /// <summary>Omitted (never an empty array) when the character has no
+    /// configured login commands.</summary>
+    public List<string>? LoginCommands { get; init; }
+
+    /// <summary>Overrides the host's default 500&#160;ms inter-command
+    /// delay when set; omitted otherwise.</summary>
+    public int? LoginCommandDelayMs { get; init; }
+
+    public string StatusFile { get; init; } = string.Empty;
+}
+
+public sealed class SessionEndpointDescriptor
+{
+    public string Host { get; init; } = string.Empty;
+
+    public int Port { get; init; }
+}
+
+/// <summary>Exactly one of <see cref="Index"/>/<see cref="Id"/>/
+/// <see cref="Name"/> is set by <see cref="SessionConfigComposer"/>.
+/// </summary>
+public sealed class SessionCharacterSelector
+{
+    public int? Index { get; init; }
+
+    public uint? Id { get; init; }
+
+    public string? Name { get; init; }
+}
+
+/// <summary>Campaign LA composes exactly the <c>idle</c> bot policy (LA2)
+/// for headless launches — the launcher never asks for any other
+/// policy id.</summary>
+public sealed class SessionPolicyDescriptor
+{
+    public string Id { get; init; } = "idle";
+}
+
+/// <summary>Always the <c>standardInput</c> provider — the launcher pipes
+/// the account password to the child's stdin and never places it in the
+/// session-config document, process arguments, or environment (see
+/// <see cref="LauncherProcessSupervisor"/>).</summary>
+public sealed class SessionCredentialDescriptor
+{
+    public string Provider { get; init; } = "standardInput";
+
+    public string Reference { get; init; } = "session";
+}

src/AcDream.Launcher.Core/Profiles/AccountProfile.cs

@@ -0,0 +1,22 @@
+using System.Text.Json.Serialization;
+
+namespace AcDream.Launcher.Core.Profiles;
+
+/// <summary>
+/// One account under a server, per Campaign LA spec §5. The password is
+/// plaintext by explicit user decision
+/// (<c>claude-memory/project_launcher_direction.md</c>) — never written
+/// anywhere except this file, never logged, never placed in a session
+/// config or process argument/environment (see
+/// <see cref="AcDream.Launcher.Core.Launching.SessionConfigComposer"/>).
+/// </summary>
+public sealed class AccountProfile
+{
+    [JsonRequired]
+    public string Account { get; set; } = string.Empty;
+
+    [JsonRequired]
+    public string Password { get; set; } = string.Empty;
+
+    public List<CharacterProfile> Characters { get; set; } = [];
+}

src/AcDream.Launcher.Core/Profiles/CharacterIdFormat.cs

@@ -0,0 +1,43 @@
+using System.Globalization;
+
+namespace AcDream.Launcher.Core.Profiles;
+
+/// <summary>
+/// Converts between the wire <c>uint</c> character GUID and the
+/// launcher-profile hex-string representation (<c>"0x5000000A"</c>,
+/// matching the convention used throughout the project, e.g. the
+/// <c>+Acdream</c> test character's <c>0x5000000A</c> in CLAUDE.md).
+/// </summary>
+public static class CharacterIdFormat
+{
+    public static string ToHexString(uint id) =>
+        "0x" + id.ToString("X8", CultureInfo.InvariantCulture);
+
+    /// <summary>
+    /// Parses <paramref name="text"/> as a hex character id — the
+    /// <c>0x</c> prefix (case-insensitive) is REQUIRED (Campaign LA plan
+    /// §LA3 review finding F10). Every all-digit id is ALSO a valid hex
+    /// number (e.g. <c>"12345678"</c>), so accepting a bare unprefixed
+    /// string as hex silently reinterprets a hand-typed decimal id and
+    /// selects the wrong character; requiring the prefix makes "this is
+    /// hex" an explicit, unambiguous signal instead of a guess.
+    /// </summary>
+    public static bool TryParse(string? text, out uint id)
+    {
+        id = 0;
+        if (string.IsNullOrWhiteSpace(text))
+            return false;
+
+        ReadOnlySpan<char> span = text.AsSpan().Trim();
+        if (!span.StartsWith("0x", StringComparison.OrdinalIgnoreCase))
+            return false;
+
+        span = span[2..];
+
+        return uint.TryParse(
+            span,
+            NumberStyles.HexNumber,
+            CultureInfo.InvariantCulture,
+            out id);
+    }
+}

src/AcDream.Launcher.Core/Profiles/CharacterProfile.cs

@@ -0,0 +1,31 @@
+using System.Text.Json.Serialization;
+
+namespace AcDream.Launcher.Core.Profiles;
+
+/// <summary>
+/// One character row under an account, per Campaign LA spec §5. The
+/// <see cref="Id"/>/<see cref="Name"/> pair is the launcher-maintained
+/// cache (fed by status-stream <c>characterList</c> events and roster
+/// probes via <see cref="LauncherProfileStore.MergeRoster"/>);
+/// <see cref="LaunchMode"/>/<see cref="Plugins"/>/<see cref="LoginCommands"/>
+/// are user-owned settings that a roster merge must never clobber.
+/// </summary>
+public sealed class CharacterProfile
+{
+    [JsonRequired]
+    public string Name { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Hex-formatted character GUID (e.g. <c>"0x5000000A"</c>), matching
+    /// the convention used elsewhere in the project. Null only for a
+    /// hand-authored fixture/profile entry that has never been through a
+    /// roster merge.
+    /// </summary>
+    public string? Id { get; set; }
+
+    public LaunchMode LaunchMode { get; set; } = LaunchMode.GuiSelect;
+
+    public List<string> Plugins { get; set; } = [];
+
+    public List<string> LoginCommands { get; set; } = [];
+}

src/AcDream.Launcher.Core/Profiles/CharacterRosterEntry.cs

@@ -0,0 +1,19 @@
+namespace AcDream.Launcher.Core.Profiles;
+
+/// <summary>
+/// One roster row as reported by a host's <c>characterList</c> status
+/// event or an on-demand probe launch (Campaign LA spec §3/§6). Mirrors
+/// the wire shape of <c>AcDream.Core.Net.Messages.CharacterList.Character</c>
+/// (<c>uint Id, string Name, uint SecondsGreyedOut</c>) — Launcher.Core
+/// does not reference Core.Net, so this is an independent, intentionally
+/// identical shape fed by the status-stream parser
+/// (<see cref="AcDream.Launcher.Core.Status.CharacterListStatusEvent"/>).
+/// <see cref="SecondsGreyedOut"/> is carried for completeness but is
+/// NEVER persisted into <see cref="CharacterProfile"/> — ACE reports a
+/// constant 1 during the pending-delete grace window (a boolean, not a
+/// countdown), and the profile schema (§5) has no field for it.
+/// </summary>
+public readonly record struct CharacterRosterEntry(
+    uint Id,
+    string Name,
+    uint SecondsGreyedOut);

src/AcDream.Launcher.Core/Profiles/LaunchMode.cs

@@ -0,0 +1,35 @@
+namespace AcDream.Launcher.Core.Profiles;
+
+/// <summary>
+/// Per-character launch behaviour (Campaign LA spec §5). Stored on each
+/// <see cref="CharacterProfile"/> and read by
+/// <see cref="AcDream.Launcher.Core.Launching.SessionConfigComposer"/> to
+/// decide the shape of the composed session-config document.
+///
+/// <para>
+/// Serialized as camelCase text (<c>"gui"</c>/<c>"guiSelect"</c>/
+/// <c>"headless"</c>) via the explicit
+/// <c>new JsonStringEnumConverter(JsonNamingPolicy.CamelCase, ...)</c>
+/// registered in <see cref="LauncherProfileStore"/>'s serializer options
+/// — deliberately NOT a per-type <c>[JsonConverter]</c> attribute, which
+/// uses exact member-name casing (<c>"Gui"</c>) regardless of the
+/// ambient <c>PropertyNamingPolicy</c>.
+/// </para>
+/// </summary>
+public enum LaunchMode
+{
+    /// <summary>Launch the graphical client straight into the world as
+    /// this character.</summary>
+    Gui,
+
+    /// <summary>Launch the graphical client but stop at the retail
+    /// character-select screen — no character selector is sent. This is
+    /// the default for a character that has never had its launch mode set
+    /// explicitly.</summary>
+    GuiSelect,
+
+    /// <summary>Launch the no-window host running the <c>idle</c> bot
+    /// policy (enter world, run plugins/login commands, stay until
+    /// stopped).</summary>
+    Headless,
+}

src/AcDream.Launcher.Core/Profiles/LauncherProfileDocument.cs

@@ -0,0 +1,16 @@
+using System.Text.Json.Serialization;
+
+namespace AcDream.Launcher.Core.Profiles;
+
+/// <summary>
+/// Root document for <c>launcher-profiles.json</c> (Campaign LA spec §5)
+/// — the launcher's ONLY credential/profile store. Loaded and saved by
+/// <see cref="LauncherProfileStore"/>.
+/// </summary>
+public sealed class LauncherProfileDocument
+{
+    [JsonRequired]
+    public int Version { get; set; } = LauncherProfileStore.CurrentVersion;
+
+    public List<ServerProfile> Servers { get; set; } = [];
+}

src/AcDream.Launcher.Core/Profiles/LauncherProfileException.cs

@@ -0,0 +1,17 @@
+namespace AcDream.Launcher.Core.Profiles;
+
+/// <summary>Thrown for a malformed <c>launcher-profiles.json</c> document
+/// or an invalid CRUD operation against <see cref="LauncherProfileStore"/>
+/// (unknown target, duplicate name, etc.).</summary>
+public sealed class LauncherProfileException : Exception
+{
+    public LauncherProfileException(string message)
+        : base(message)
+    {
+    }
+
+    public LauncherProfileException(string message, Exception innerException)
+        : base(message, innerException)
+    {
+    }
+}

src/AcDream.Launcher.Core/Profiles/LauncherProfileStore.cs

@@ -0,0 +1,481 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using AcDream.Platform;
+
+namespace AcDream.Launcher.Core.Profiles;
+
+/// <summary>
+/// Load/save/CRUD owner for <c>launcher-profiles.json</c> (Campaign LA
+/// spec §5) — the launcher's ONLY credential/profile store, and the
+/// binding surface the Avalonia UI (slice LA4) mutates directly.
+///
+/// <para>
+/// A store instance holds the current in-memory <see cref="Document"/>
+/// after <see cref="Load"/>; every CRUD method mutates that document in
+/// place so callers can chain <c>store.AddServer(...); store.Save();</c>
+/// without re-threading a returned document through every call.
+/// </para>
+/// </summary>
+public sealed class LauncherProfileStore
+{
+    internal const int CurrentVersion = 1;
+    internal const UnixFileMode OwnerOnlyFileMode =
+        UnixFileMode.UserRead | UnixFileMode.UserWrite;
+
+    private static readonly JsonSerializerOptions SerializerOptions = new()
+    {
+        AllowTrailingCommas = false,
+        PropertyNamingPolicy = JsonNamingPolicy.CamelCase,
+        PropertyNameCaseInsensitive = false,
+        ReadCommentHandling = JsonCommentHandling.Disallow,
+        UnmappedMemberHandling = JsonUnmappedMemberHandling.Disallow,
+        WriteIndented = true,
+        Converters =
+        {
+            new JsonStringEnumConverter(
+                JsonNamingPolicy.CamelCase,
+                allowIntegerValues: false),
+        },
+    };
+
+    public LauncherProfileStore(string filePath)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(filePath);
+        FilePath = Path.GetFullPath(filePath);
+        Document = new LauncherProfileDocument();
+    }
+
+    /// <summary>Resolve the store at the canonical location under
+    /// <see cref="ApplicationPathSet.ConfigDirectory"/>
+    /// (<c>%APPDATA%\acdream\launcher-profiles.json</c> /
+    /// <c>~/.config/acdream/launcher-profiles.json</c>).</summary>
+    public static LauncherProfileStore ForApplicationPaths(ApplicationPathSet paths)
+    {
+        ArgumentNullException.ThrowIfNull(paths);
+        return new LauncherProfileStore(
+            Path.Combine(paths.ConfigDirectory, "launcher-profiles.json"));
+    }
+
+    public string FilePath { get; }
+
+    public LauncherProfileDocument Document { get; private set; }
+
+    /// <summary>
+    /// Loads <see cref="Document"/> from <see cref="FilePath"/>. A
+    /// missing file is not an error — it resolves to a fresh empty
+    /// document (version 1, no servers), matching a never-launched
+    /// installation. Returns true when a file was actually read.
+    /// </summary>
+    public bool Load()
+    {
+        // Opportunistic cleanup of a stale ".tmp" left behind by a Save()
+        // that crashed between creating the temp file and the atomic
+        // rename (Campaign LA plan §LA3 review finding F4) — a stray
+        // temp file carries the same plaintext credentials as the real
+        // store and should not linger.
+        DeleteStaleTempFile(FilePath + ".tmp");
+
+        if (!File.Exists(FilePath))
+        {
+            Document = new LauncherProfileDocument();
+            return false;
+        }
+
+        LauncherProfileDocument? document;
+        using (FileStream stream = File.OpenRead(FilePath))
+        {
+            try
+            {
+                document = JsonSerializer.Deserialize<LauncherProfileDocument>(
+                    stream,
+                    SerializerOptions);
+            }
+            catch (JsonException ex)
+            {
+                throw new LauncherProfileException(
+                    $"'{FilePath}' is not a valid launcher profile document.",
+                    ex);
+            }
+        }
+
+        if (document is null)
+        {
+            throw new LauncherProfileException($"'{FilePath}' is empty.");
+        }
+
+        if (document.Version != CurrentVersion)
+        {
+            throw new LauncherProfileException(
+                $"Unsupported launcher-profiles version {document.Version}; "
+                + $"expected {CurrentVersion}.");
+        }
+
+        Document = document;
+        return true;
+    }
+
+    /// <summary>
+    /// Persists <see cref="Document"/> to <see cref="FilePath"/> via a
+    /// write-then-atomic-rename so a crash mid-write never leaves a
+    /// truncated credentials file. On Linux, the temp file is created
+    /// atomically with owner read/write (0600) as its requested creation
+    /// mode — before its path is observable and before any plaintext
+    /// credential is serialized into it. The final path retains that mode
+    /// through the rename (Campaign LA's plaintext-credential decision,
+    /// spec §5, decisions log).
+    /// A failure between temp-file creation and the rename deletes the
+    /// stale temp file rather than leaving it behind.
+    /// </summary>
+    public void Save()
+    {
+        string? directory = Path.GetDirectoryName(FilePath);
+        if (!string.IsNullOrEmpty(directory))
+        {
+            Directory.CreateDirectory(directory);
+        }
+
+        string tempPath = FilePath + ".tmp";
+        DeleteStaleTempFile(tempPath);
+        try
+        {
+            using (FileStream stream = CreateCredentialTempFile(tempPath))
+            {
+                if (OperatingSystem.IsLinux())
+                {
+                    // UnixCreateMode is subject to the process umask. It
+                    // guarantees the file is never created with group/other
+                    // access; normalize the owner bits while the still-empty
+                    // file is open so the persisted contract is exactly 0600.
+                    File.SetUnixFileMode(tempPath, OwnerOnlyFileMode);
+                }
+
+                JsonSerializer.Serialize(stream, Document, SerializerOptions);
+            }
+
+            File.Move(tempPath, FilePath, overwrite: true);
+        }
+        catch
+        {
+            DeleteStaleTempFile(tempPath);
+            throw;
+        }
+
+        if (OperatingSystem.IsLinux())
+        {
+            File.SetUnixFileMode(FilePath, OwnerOnlyFileMode);
+        }
+    }
+
+    /// <summary>
+    /// Builds the exact options used for the plaintext-credential temp
+    /// file. <see cref="FileMode.CreateNew"/> makes creation atomic and
+    /// refuses to follow an existing stale or raced path. On Linux,
+    /// <see cref="FileStreamOptions.UnixCreateMode"/> supplies 0600 to
+    /// the OS create operation itself, eliminating the observable
+    /// create-then-chmod window. Windows leaves UnixCreateMode unset and
+    /// therefore retains its normal user-profile ACL behavior.
+    /// </summary>
+    internal static FileStreamOptions CreateCredentialTempFileOptions()
+    {
+        var options = new FileStreamOptions
+        {
+            Mode = FileMode.CreateNew,
+            Access = FileAccess.Write,
+            Share = FileShare.None,
+        };
+
+        if (OperatingSystem.IsLinux())
+        {
+            options.UnixCreateMode = OwnerOnlyFileMode;
+        }
+
+        return options;
+    }
+
+    internal static FileStream CreateCredentialTempFile(string tempPath) =>
+        new(tempPath, CreateCredentialTempFileOptions());
+
+    private static void DeleteStaleTempFile(string tempPath)
+    {
+        try
+        {
+            if (File.Exists(tempPath))
+            {
+                File.Delete(tempPath);
+            }
+        }
+        catch
+        {
+            // Best-effort cleanup only — the caller's own exception (a
+            // failed Save()) or the fresh Load() already in progress is
+            // what matters; a cleanup failure must not mask either.
+        }
+    }
+
+    // --- Server CRUD -----------------------------------------------
+
+    public ServerProfile AddServer(string name, string host, int port)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(name);
+        ArgumentException.ThrowIfNullOrWhiteSpace(host);
+        RequireValidPort(port);
+
+        if (FindServer(name) is not null)
+        {
+            throw new LauncherProfileException(
+                $"A server named '{name}' already exists.");
+        }
+
+        var server = new ServerProfile { Name = name, Host = host, Port = port };
+        Document.Servers.Add(server);
+        return server;
+    }
+
+    public void EditServer(
+        string name,
+        string? newName = null,
+        string? newHost = null,
+        int? newPort = null)
+    {
+        ServerProfile server = FindServerOrThrow(name);
+
+        if (newName is not null)
+        {
+            ArgumentException.ThrowIfNullOrWhiteSpace(newName);
+            if (!string.Equals(newName, server.Name, StringComparison.Ordinal)
+                && FindServer(newName) is not null)
+            {
+                throw new LauncherProfileException(
+                    $"A server named '{newName}' already exists.");
+            }
+
+            server.Name = newName;
+        }
+
+        if (newHost is not null)
+        {
+            ArgumentException.ThrowIfNullOrWhiteSpace(newHost);
+            server.Host = newHost;
+        }
+
+        if (newPort is not null)
+        {
+            RequireValidPort(newPort.Value);
+            server.Port = newPort.Value;
+        }
+    }
+
+    public void RemoveServer(string name)
+    {
+        ServerProfile server = FindServerOrThrow(name);
+        Document.Servers.Remove(server);
+    }
+
+    // --- Account CRUD ------------------------------------------------
+
+    public AccountProfile AddAccount(string serverName, string account, string password)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(account);
+        ArgumentNullException.ThrowIfNull(password);
+        ServerProfile server = FindServerOrThrow(serverName);
+
+        if (FindAccount(server, account) is not null)
+        {
+            throw new LauncherProfileException(
+                $"Account '{account}' already exists on server '{serverName}'.");
+        }
+
+        var profile = new AccountProfile { Account = account, Password = password };
+        server.Accounts.Add(profile);
+        return profile;
+    }
+
+    public void EditAccount(
+        string serverName,
+        string account,
+        string? newAccount = null,
+        string? newPassword = null)
+    {
+        ServerProfile server = FindServerOrThrow(serverName);
+        AccountProfile profile = FindAccountOrThrow(server, account);
+
+        if (newAccount is not null)
+        {
+            ArgumentException.ThrowIfNullOrWhiteSpace(newAccount);
+            if (!string.Equals(newAccount, profile.Account, StringComparison.Ordinal)
+                && FindAccount(server, newAccount) is not null)
+            {
+                throw new LauncherProfileException(
+                    $"Account '{newAccount}' already exists on server '{serverName}'.");
+            }
+
+            profile.Account = newAccount;
+        }
+
+        if (newPassword is not null)
+        {
+            profile.Password = newPassword;
+        }
+    }
+
+    public void RemoveAccount(string serverName, string account)
+    {
+        ServerProfile server = FindServerOrThrow(serverName);
+        AccountProfile profile = FindAccountOrThrow(server, account);
+        server.Accounts.Remove(profile);
+    }
+
+    // --- Character settings (roster-driven add/remove; user-edited settings) ---
+
+    /// <summary>
+    /// Edits the user-owned settings of an existing character row. There
+    /// is no manual add/remove for characters — the roster (
+    /// <see cref="MergeRoster"/>) is the only source of new rows, per
+    /// spec §5/§6.
+    /// </summary>
+    public void EditCharacter(
+        string serverName,
+        string account,
+        string characterName,
+        LaunchMode? launchMode = null,
+        IReadOnlyList<string>? plugins = null,
+        IReadOnlyList<string>? loginCommands = null)
+    {
+        ServerProfile server = FindServerOrThrow(serverName);
+        AccountProfile profile = FindAccountOrThrow(server, account);
+        CharacterProfile character = FindCharacterOrThrow(profile, characterName);
+
+        if (launchMode is not null)
+        {
+            character.LaunchMode = launchMode.Value;
+        }
+
+        if (plugins is not null)
+        {
+            character.Plugins = [.. plugins];
+        }
+
+        if (loginCommands is not null)
+        {
+            character.LoginCommands = [.. loginCommands];
+        }
+    }
+
+    /// <summary>
+    /// Folds a reported character roster into an account's
+    /// <see cref="AccountProfile.Characters"/> (Campaign LA spec §3/§5/
+    /// §6): every roster entry either updates the name of an existing
+    /// row (matched by <see cref="CharacterProfile.Id"/>) while
+    /// PRESERVING that row's user settings (<see cref="LaunchMode"/>,
+    /// <see cref="CharacterProfile.Plugins"/>,
+    /// <see cref="CharacterProfile.LoginCommands"/>), or is inserted as a
+    /// new row with default settings (<see cref="LaunchMode.GuiSelect"/>,
+    /// no plugins, no login commands). Existing rows absent from the
+    /// roster are RETAINED unchanged — they may simply be pending-delete
+    /// (ACE keeps deleted characters queryable during the grace window)
+    /// or the roster snapshot may be partial; this store never deletes a
+    /// character row on the caller's behalf.
+    /// </summary>
+    public void MergeRoster(
+        string serverName,
+        string account,
+        IReadOnlyList<CharacterRosterEntry> roster)
+    {
+        ArgumentNullException.ThrowIfNull(roster);
+        ServerProfile server = FindServerOrThrow(serverName);
+        AccountProfile profile = FindAccountOrThrow(server, account);
+
+        foreach (CharacterRosterEntry entry in roster)
+        {
+            string idText = CharacterIdFormat.ToHexString(entry.Id);
+
+            // Normalize BOTH sides through TryParse/ToHexString rather
+            // than a raw string compare (Campaign LA plan §LA3 review
+            // finding F10): a stored id that round-trips to the same
+            // uint (different case, or — before this fix — no "0x"
+            // prefix) must match even though its text isn't byte-
+            // identical to the canonical form this method itself always
+            // writes.
+            CharacterProfile? existing = profile.Characters.Find(
+                character => CharacterIdFormat.TryParse(character.Id, out uint existingId)
+                    && existingId == entry.Id);
+
+            // Defensive fallback for a row whose id is missing OR
+            // unparseable (e.g. a hand-edited id with no "0x" prefix,
+            // which TryParse now rejects outright) — match by name
+            // instead so a later merge self-heals the id into the
+            // canonical form rather than creating a permanent duplicate
+            // row.
+            existing ??= profile.Characters.Find(
+                character => !CharacterIdFormat.TryParse(character.Id, out _)
+                    && string.Equals(
+                        character.Name,
+                        entry.Name,
+                        StringComparison.Ordinal));
+
+            if (existing is not null)
+            {
+                existing.Id = idText;
+                existing.Name = entry.Name;
+                continue;
+            }
+
+            profile.Characters.Add(new CharacterProfile
+            {
+                Id = idText,
+                Name = entry.Name,
+                LaunchMode = LaunchMode.GuiSelect,
+                Plugins = [],
+                LoginCommands = [],
+            });
+        }
+    }
+
+    // --- Lookups -------------------------------------------------------
+
+    private ServerProfile? FindServer(string name) =>
+        Document.Servers.Find(
+            server => string.Equals(server.Name, name, StringComparison.Ordinal));
+
+    private ServerProfile FindServerOrThrow(string name)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(name);
+        return FindServer(name)
+            ?? throw new LauncherProfileException($"No server named '{name}'.");
+    }
+
+    private static AccountProfile? FindAccount(ServerProfile server, string account) =>
+        server.Accounts.Find(
+            candidate => string.Equals(candidate.Account, account, StringComparison.Ordinal));
+
+    private static AccountProfile FindAccountOrThrow(ServerProfile server, string account)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(account);
+        return FindAccount(server, account)
+            ?? throw new LauncherProfileException(
+                $"No account '{account}' on server '{server.Name}'.");
+    }
+
+    private static CharacterProfile FindCharacterOrThrow(
+        AccountProfile profile,
+        string characterName)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(characterName);
+        return profile.Characters.Find(
+                character => string.Equals(
+                    character.Name,
+                    characterName,
+                    StringComparison.Ordinal))
+            ?? throw new LauncherProfileException(
+                $"No character '{characterName}' on account '{profile.Account}'.");
+    }
+
+    private static void RequireValidPort(int port)
+    {
+        if (port is < 1 or > 65535)
+        {
+            throw new LauncherProfileException(
+                $"Port {port} is outside the valid 1-65535 range.");
+        }
+    }
+}

src/AcDream.Launcher.Core/Profiles/ServerProfile.cs

@@ -0,0 +1,19 @@
+using System.Text.Json.Serialization;
+
+namespace AcDream.Launcher.Core.Profiles;
+
+/// <summary>One server entry, per Campaign LA spec §5 (manual add — no
+/// published server-list import this campaign).</summary>
+public sealed class ServerProfile
+{
+    [JsonRequired]
+    public string Name { get; set; } = string.Empty;
+
+    [JsonRequired]
+    public string Host { get; set; } = string.Empty;
+
+    [JsonRequired]
+    public int Port { get; set; }
+
+    public List<AccountProfile> Accounts { get; set; } = [];
+}

src/AcDream.Launcher.Core/Status/StatusEvent.cs

@@ -0,0 +1,96 @@
+namespace AcDream.Launcher.Core.Status;
+
+/// <summary>
+/// One parsed line of a host's <c>status.jsonl</c> stream (Campaign LA
+/// spec §6). Every event carries the versioned envelope
+/// (<c>v</c>/<c>e</c>/<c>t</c>/<c>sessionId</c>) plus its own typed
+/// payload. See <see cref="StatusEventParser"/> for the wire shape and
+/// <see cref="AcDream.Launcher.Core.Status.StatusFileTailer"/> for the
+/// incremental reader that produces these.
+/// </summary>
+public abstract record StatusEvent
+{
+    public required int V { get; init; }
+
+    public required string E { get; init; }
+
+    public required DateTimeOffset T { get; init; }
+
+    public required string SessionId { get; init; }
+}
+
+public sealed record StartedStatusEvent : StatusEvent;
+
+public sealed record ConnectedStatusEvent : StatusEvent;
+
+public readonly record struct StatusCharacterEntry(
+    uint Id,
+    string Name,
+    uint SecondsGreyedOut);
+
+public sealed record CharacterListStatusEvent : StatusEvent
+{
+    public required string AccountName { get; init; }
+
+    public required int SlotCount { get; init; }
+
+    public required IReadOnlyList<StatusCharacterEntry> Characters { get; init; }
+}
+
+public sealed record EnteredWorldStatusEvent : StatusEvent
+{
+    public required uint CharacterId { get; init; }
+
+    public required string CharacterName { get; init; }
+}
+
+public sealed record PluginLoadedStatusEvent : StatusEvent
+{
+    public required string Plugin { get; init; }
+}
+
+public sealed record PluginFailedStatusEvent : StatusEvent
+{
+    public required string Plugin { get; init; }
+
+    public required string Error { get; init; }
+}
+
+public sealed record DisconnectedStatusEvent : StatusEvent
+{
+    public required string Reason { get; init; }
+}
+
+public sealed record ExitedStatusEvent : StatusEvent
+{
+    public required int Code { get; init; }
+
+    public required string Reason { get; init; }
+}
+
+/// <summary>
+/// A JSON-object status line whose non-empty string <c>e</c> value this
+/// reader does not recognize. The tailer never throws on an unrecognized
+/// event — an older launcher reading a newer host's stream
+/// degrades to seeing <see cref="UnknownStatusEvent"/> rows instead of
+/// crashing.
+/// </summary>
+public sealed record UnknownStatusEvent : StatusEvent
+{
+    public required string RawJson { get; init; }
+}
+
+/// <summary>
+/// A complete JSON value that is not an object, an object without a
+/// usable event name, or a known event whose pinned v1 envelope/payload
+/// does not match its expected shape. Distinguished from
+/// <see cref="UnknownStatusEvent"/> (Campaign
+/// LA plan §LA3 review finding F12) so a launcher can tell "a newer/older
+/// host sent an event I've never heard of" apart from "a host I recognize
+/// sent me garbage for an event I do know" — the two cases call for
+/// different diagnostics. The tailer never throws for either case.
+/// </summary>
+public sealed record MalformedStatusEvent : StatusEvent
+{
+    public required string Error { get; init; }
+}

src/AcDream.Launcher.Core/Status/StatusEventParser.cs

@@ -0,0 +1,391 @@
+using System.Text.Json;
+
+namespace AcDream.Launcher.Core.Status;
+
+/// <summary>
+/// Parses one <c>status.jsonl</c> line (Campaign LA spec §6) into a typed
+/// <see cref="StatusEvent"/>. Wire shape: every line is a flat JSON
+/// object carrying the envelope (<c>v</c>, <c>e</c>, <c>t</c>,
+/// <c>sessionId</c>) alongside that event's own fields — e.g.
+/// <c>{"v":1,"e":"characterList","t":"...","sessionId":"...",
+/// "accountName":"...","slotCount":6,"characters":[...]}</c>.
+///
+/// <para>
+/// Never throws: a null/blank/malformed-JSON line, a complete JSON value
+/// with a non-object root, an unrecognized <c>e</c> value, or a recognized
+/// <c>e</c> whose envelope/payload does not match the pinned v1 shape all
+/// degrade to a typed event (<see cref="UnknownStatusEvent"/> or
+/// <see cref="MalformedStatusEvent"/>) rather than an exception. A launcher
+/// must keep tailing a session's status stream even against a host running a
+/// newer/older wire version or a host that writes a bad line.
+/// </para>
+/// </summary>
+public static class StatusEventParser
+{
+    public static StatusEvent Parse(string line)
+    {
+        if (string.IsNullOrWhiteSpace(line))
+        {
+            return UnknownEvent(line ?? string.Empty);
+        }
+
+        JsonDocument document;
+        try
+        {
+            document = JsonDocument.Parse(line);
+        }
+        catch (JsonException)
+        {
+            return UnknownEvent(line);
+        }
+
+        using (document)
+        {
+            JsonElement root = document.RootElement;
+            if (root.ValueKind != JsonValueKind.Object)
+            {
+                return MalformedEvent(
+                    v: 0,
+                    e: string.Empty,
+                    t: default,
+                    sessionId: string.Empty,
+                    "status event root is not a JSON object.");
+            }
+
+            if (!TryGetEventName(root, out string e, out string eventNameError))
+            {
+                return MalformedEvent(
+                    GetInt32OrDefault(root, "v"),
+                    e,
+                    GetDateTimeOffsetOrDefault(root, "t"),
+                    GetStringOrDefault(root, "sessionId"),
+                    eventNameError);
+            }
+
+            // A genuinely unknown event name is the forward-compatibility
+            // case. Retain its best-effort envelope and raw JSON without
+            // imposing this launcher's known-event envelope/payload schema.
+            if (!IsKnownEventName(e))
+            {
+                return new UnknownStatusEvent
+                {
+                    V = GetInt32OrDefault(root, "v"),
+                    E = e,
+                    T = GetDateTimeOffsetOrDefault(root, "t"),
+                    SessionId = GetStringOrDefault(root, "sessionId"),
+                    RawJson = line,
+                };
+            }
+
+            try
+            {
+                // The pinned v1 envelope applies to every known event,
+                // including payload-free started/connected rows. Defaulting
+                // malformed fields would turn corrupt or cross-version input
+                // into an apparently valid typed event.
+                int v = RequireVersionOne(root);
+                DateTimeOffset t = RequireUtcTimestamp(root, "t");
+                string sessionId = RequireNonEmptyString(root, "sessionId");
+
+                return e switch
+                {
+                    "started" =>
+                        new StartedStatusEvent { V = v, E = e, T = t, SessionId = sessionId },
+                    "connected" =>
+                        new ConnectedStatusEvent { V = v, E = e, T = t, SessionId = sessionId },
+                    "characterList" =>
+                        ParseCharacterList(root, v, e, t, sessionId),
+                    "enteredWorld" =>
+                        ParseEnteredWorld(root, v, e, t, sessionId),
+                    "pluginLoaded" =>
+                        ParsePluginLoaded(root, v, e, t, sessionId),
+                    "pluginFailed" =>
+                        ParsePluginFailed(root, v, e, t, sessionId),
+                    "disconnected" =>
+                        ParseDisconnected(root, v, e, t, sessionId),
+                    "exited" =>
+                        ParseExited(root, v, e, t, sessionId),
+                    _ => throw new InvalidOperationException("known event dispatch is incomplete."),
+                };
+            }
+            catch (Exception ex) when (ex is FormatException or InvalidOperationException)
+            {
+                return MalformedEvent(
+                    GetInt32OrDefault(root, "v"),
+                    e,
+                    GetDateTimeOffsetOrDefault(root, "t"),
+                    GetStringOrDefault(root, "sessionId"),
+                    ex.Message);
+            }
+        }
+    }
+
+    private static bool IsKnownEventName(string eventName) =>
+        eventName is
+            "started" or
+            "connected" or
+            "characterList" or
+            "enteredWorld" or
+            "pluginLoaded" or
+            "pluginFailed" or
+            "disconnected" or
+            "exited";
+
+    private static bool TryGetEventName(
+        JsonElement root,
+        out string eventName,
+        out string error)
+    {
+        if (!root.TryGetProperty("e", out JsonElement element))
+        {
+            eventName = string.Empty;
+            error = "status event is missing 'e'.";
+            return false;
+        }
+
+        if (element.ValueKind != JsonValueKind.String)
+        {
+            eventName = string.Empty;
+            error = "status event field 'e' is not a string.";
+            return false;
+        }
+
+        eventName = element.GetString() ?? string.Empty;
+        if (string.IsNullOrWhiteSpace(eventName))
+        {
+            error = "status event field 'e' is empty.";
+            return false;
+        }
+
+        error = string.Empty;
+        return true;
+    }
+
+    private static UnknownStatusEvent UnknownEvent(string rawLine) =>
+        new()
+        {
+            V = 0,
+            E = string.Empty,
+            T = default,
+            SessionId = string.Empty,
+            RawJson = rawLine,
+        };
+
+    private static MalformedStatusEvent MalformedEvent(
+        int v,
+        string e,
+        DateTimeOffset t,
+        string sessionId,
+        string error) =>
+        new()
+        {
+            V = v,
+            E = e,
+            T = t,
+            SessionId = sessionId,
+            Error = error,
+        };
+
+    private static StatusEvent ParseCharacterList(
+        JsonElement root,
+        int v,
+        string e,
+        DateTimeOffset t,
+        string sessionId)
+    {
+        string accountName = RequireString(root, "accountName");
+        int slotCount = RequireInt32(root, "slotCount");
+        JsonElement charactersElement = RequireProperty(root, "characters");
+
+        var characters = new List<StatusCharacterEntry>();
+        foreach (JsonElement item in charactersElement.EnumerateArray())
+        {
+            uint id = RequireUInt32(item, "id");
+            string name = RequireString(item, "name");
+            uint secondsGreyedOut = RequireUInt32(item, "secondsGreyedOut");
+            characters.Add(new StatusCharacterEntry(id, name, secondsGreyedOut));
+        }
+
+        return new CharacterListStatusEvent
+        {
+            V = v,
+            E = e,
+            T = t,
+            SessionId = sessionId,
+            AccountName = accountName,
+            SlotCount = slotCount,
+            Characters = characters,
+        };
+    }
+
+    private static StatusEvent ParseEnteredWorld(
+        JsonElement root,
+        int v,
+        string e,
+        DateTimeOffset t,
+        string sessionId) =>
+        new EnteredWorldStatusEvent
+        {
+            V = v,
+            E = e,
+            T = t,
+            SessionId = sessionId,
+            CharacterId = RequireUInt32(root, "characterId"),
+            CharacterName = RequireString(root, "characterName"),
+        };
+
+    private static StatusEvent ParsePluginLoaded(
+        JsonElement root,
+        int v,
+        string e,
+        DateTimeOffset t,
+        string sessionId) =>
+        new PluginLoadedStatusEvent
+        {
+            V = v,
+            E = e,
+            T = t,
+            SessionId = sessionId,
+            Plugin = RequireString(root, "plugin"),
+        };
+
+    private static StatusEvent ParsePluginFailed(
+        JsonElement root,
+        int v,
+        string e,
+        DateTimeOffset t,
+        string sessionId) =>
+        new PluginFailedStatusEvent
+        {
+            V = v,
+            E = e,
+            T = t,
+            SessionId = sessionId,
+            Plugin = RequireString(root, "plugin"),
+            Error = RequireString(root, "error"),
+        };
+
+    private static StatusEvent ParseDisconnected(
+        JsonElement root,
+        int v,
+        string e,
+        DateTimeOffset t,
+        string sessionId) =>
+        new DisconnectedStatusEvent
+        {
+            V = v,
+            E = e,
+            T = t,
+            SessionId = sessionId,
+            Reason = RequireString(root, "reason"),
+        };
+
+    private static StatusEvent ParseExited(
+        JsonElement root,
+        int v,
+        string e,
+        DateTimeOffset t,
+        string sessionId) =>
+        new ExitedStatusEvent
+        {
+            V = v,
+            E = e,
+            T = t,
+            SessionId = sessionId,
+            Code = RequireInt32(root, "code"),
+            Reason = RequireString(root, "reason"),
+        };
+
+    private static int GetInt32OrDefault(JsonElement root, string name) =>
+        root.TryGetProperty(name, out JsonElement element)
+            && element.ValueKind == JsonValueKind.Number
+            && element.TryGetInt32(out int value)
+            ? value
+            : 0;
+
+    private static string GetStringOrDefault(JsonElement root, string name) =>
+        root.TryGetProperty(name, out JsonElement element)
+            && element.ValueKind == JsonValueKind.String
+            ? element.GetString() ?? string.Empty
+            : string.Empty;
+
+    private static DateTimeOffset GetDateTimeOffsetOrDefault(
+        JsonElement root,
+        string name) =>
+        root.TryGetProperty(name, out JsonElement element)
+            && element.ValueKind == JsonValueKind.String
+            && element.TryGetDateTimeOffset(out DateTimeOffset value)
+            && value.Offset == TimeSpan.Zero
+            ? value
+            : default;
+
+    private static JsonElement RequireProperty(JsonElement root, string name) =>
+        root.TryGetProperty(name, out JsonElement element)
+            ? element
+            : throw new FormatException($"status event is missing '{name}'.");
+
+    private static string RequireString(JsonElement root, string name)
+    {
+        JsonElement element = RequireProperty(root, name);
+        return element.ValueKind == JsonValueKind.String
+            ? element.GetString() ?? string.Empty
+            : throw new FormatException($"status event field '{name}' is not a string.");
+    }
+
+    private static int RequireInt32(JsonElement root, string name)
+    {
+        JsonElement element = RequireProperty(root, name);
+        return element.ValueKind == JsonValueKind.Number && element.TryGetInt32(out int value)
+            ? value
+            : throw new FormatException($"status event field '{name}' is not an integer.");
+    }
+
+    private static int RequireVersionOne(JsonElement root)
+    {
+        int version = RequireInt32(root, "v");
+        return version == 1
+            ? version
+            : throw new FormatException(
+                $"status event version is {version}; expected 1.");
+    }
+
+    private static string RequireNonEmptyString(JsonElement root, string name)
+    {
+        string value = RequireString(root, name);
+        return !string.IsNullOrWhiteSpace(value)
+            ? value
+            : throw new FormatException($"status event field '{name}' is empty.");
+    }
+
+    private static DateTimeOffset RequireUtcTimestamp(JsonElement root, string name)
+    {
+        JsonElement element = RequireProperty(root, name);
+        if (element.ValueKind != JsonValueKind.String)
+        {
+            throw new FormatException(
+                $"status event field '{name}' is not an ISO-8601 UTC string.");
+        }
+
+        string text = element.GetString() ?? string.Empty;
+        bool hasExplicitUtcOffset = text.EndsWith('Z')
+            || text.EndsWith("+00:00", StringComparison.Ordinal);
+        if (!hasExplicitUtcOffset
+            || !element.TryGetDateTimeOffset(out DateTimeOffset value)
+            || value.Offset != TimeSpan.Zero)
+        {
+            throw new FormatException(
+                $"status event field '{name}' is not an ISO-8601 UTC timestamp.");
+        }
+
+        return value;
+    }
+
+    private static uint RequireUInt32(JsonElement root, string name)
+    {
+        JsonElement element = RequireProperty(root, name);
+        return element.ValueKind == JsonValueKind.Number && element.TryGetUInt32(out uint value)
+            ? value
+            : throw new FormatException(
+                $"status event field '{name}' is not an unsigned integer.");
+    }
+}

src/AcDream.Launcher.Core/Status/StatusFileTailer.cs

@@ -0,0 +1,139 @@
+using System.Text;
+
+namespace AcDream.Launcher.Core.Status;
+
+/// <summary>
+/// Incremental reader over a host's <c>status.jsonl</c> file (Campaign LA
+/// spec §3/§6). Each call to <see cref="ReadNewEvents"/> returns the
+/// events that arrived since the previous call, tolerating:
+/// <list type="bullet">
+/// <item>the file not existing yet (the launcher may start tailing
+/// before the host has written its first line — returns no events, not
+/// an error);</item>
+/// <item>a partial last line (the host may be mid-write when polled —
+/// the tailer only advances its read position past the last confirmed
+/// <c>'\n'</c>; a still-incomplete tail is re-read, combined with
+/// whatever gets appended, on the next poll — never parsed while
+/// truncated).</item>
+/// </list>
+/// One tailer instance owns one file's read position; construct a new
+/// one per session.
+/// </summary>
+public sealed class StatusFileTailer
+{
+    private readonly string _path;
+    private long _position;
+
+    public StatusFileTailer(string path)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(path);
+        _path = path;
+    }
+
+    /// <summary>
+    /// Reads and parses every complete line appended to the file since
+    /// the last call. Returns an empty list (never null, never throws)
+    /// when the file doesn't exist yet, has been deleted/rotated between
+    /// the existence check and the open (a TOCTOU window — Campaign LA
+    /// plan §LA3 review finding F7), or nothing new/complete has arrived
+    /// since the last poll.
+    /// </summary>
+    public IReadOnlyList<StatusEvent> ReadNewEvents()
+    {
+        try
+        {
+            return ReadNewEventsCore();
+        }
+        catch (Exception ex) when (
+            ex is FileNotFoundException or DirectoryNotFoundException or IOException)
+        {
+            // The host process deleted/rotated the file (or its
+            // directory) between File.Exists and the open below, or
+            // another transient I/O condition hit mid-read — degrade to
+            // "nothing new this poll" rather than throwing out of a
+            // method documented never to throw; the next poll picks up
+            // wherever the file (or its replacement) actually is.
+            return [];
+        }
+    }
+
+    private IReadOnlyList<StatusEvent> ReadNewEventsCore()
+    {
+        if (!File.Exists(_path))
+        {
+            return [];
+        }
+
+        using var stream = new FileStream(
+            _path,
+            FileMode.Open,
+            FileAccess.Read,
+            FileShare.ReadWrite | FileShare.Delete);
+
+        if (stream.Length < _position)
+        {
+            // The file was truncated/replaced under us (e.g. a fresh
+            // session reusing a stale path) — restart from the top
+            // rather than throwing or silently missing the new content.
+            _position = 0;
+        }
+
+        if (stream.Length == _position)
+        {
+            return [];
+        }
+
+        stream.Seek(_position, SeekOrigin.Begin);
+        int unreadByteCount = checked((int)(stream.Length - _position));
+        byte[] buffer = new byte[unreadByteCount];
+        int totalRead = 0;
+        while (totalRead < unreadByteCount)
+        {
+            int read = stream.Read(buffer, totalRead, unreadByteCount - totalRead);
+            if (read == 0)
+            {
+                break;
+            }
+
+            totalRead += read;
+        }
+
+        var events = new List<StatusEvent>();
+        int lineStart = 0;
+
+        // How far into `buffer` we've confirmed a complete line — this
+        // is where `_position` advances to. Bytes after this point (an
+        // in-progress line with no trailing '\n' yet) are simply left
+        // unread on disk; the next poll re-reads them from `_position`
+        // combined with whatever the writer appends in between. No
+        // separate in-memory carry-over buffer is needed.
+        int consumedThroughIndex = 0;
+
+        for (int i = 0; i < totalRead; i++)
+        {
+            if (buffer[i] != (byte)'\n')
+            {
+                continue;
+            }
+
+            int lineEnd = i;
+            if (lineEnd > lineStart && buffer[lineEnd - 1] == (byte)'\r')
+            {
+                lineEnd--;
+            }
+
+            if (lineEnd > lineStart)
+            {
+                string rawLine = Encoding.UTF8.GetString(buffer, lineStart, lineEnd - lineStart);
+                events.Add(StatusEventParser.Parse(rawLine));
+            }
+
+            lineStart = i + 1;
+            consumedThroughIndex = lineStart;
+        }
+
+        _position += consumedThroughIndex;
+
+        return events;
+    }
+}