fix(headless,runtime): OP7 review fixes + docs: OP3 re-review REOPEN (narrow)

TWO work products share this commit (a staged-index collision between the
coordinator's docs commit and the OP7 fixer's staged files — content
verified complete and coherent; only this message was wrong before the
amend):

1. OP7 review fixes (all nine findings from
   docs/research/2026-08-11-op7-review.md):
   - M1: HeadlessSessionDescriptor is a record; WithAccount uses 'with' non-destructive record copy,
     so a future property cannot be silently dropped; direct-CLI
     regression test proves CharacterOptions survives --user/--password.
   - M2 root fix: LiveSessionEventRouter skips BOTH Replace and the
     options notification on a trailer-truncated PlayerDescription — a
     truncated re-seed can no longer install zeroed words under an armed
     latch for OP7's automation to flush into 0x01A1.
   - SF1: schema keys validate as ordinal strings against the allowed
     names (numeric / comma-combined aliases rejected). SF2: both-true
     fellowship exclusion rejected at load, naming both keys. SF3: the
     onLoginCompleteSent observer moved after transit.EndTeleport().
     SF4: production-hook coverage for all three LoginComplete sites.
     SF5: test-script OP7 wire expectation corrected (batched ids ride
     only the 0x01A1).

2. docs/research/2026-08-11-op3-rereview.md — OP3 re-review verdict
   REOPEN (narrow): M1 byte-decode independently re-verified (6a 07 at
   all six sites); residuals R1 (gate script promises a timestamp prefix
   acdream doesn't render), R2 (null-controller player-mode still
   refuses), R3 (dormancy pin lacks stimulus) — coordinator fixes follow.

Full Release suite at this tree: 12,956 passed / 4 skipped / 0 failed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/research/2026-08-11-campaign-op-test-script.md

@@ -228,11 +228,15 @@ persists the sends.
   `0x24`) — immediately, and ACE's handler additionally joins the
   Turbine trade-chat room server-side for this session (observable via
   ACE's own Turbine-chat membership logging if available).
-- One `SetSingleCharacterOption (0x0005)` for `SalvageMultiple` (id
-  `0x22`) followed by exactly one `SetCharacterOptions (0x01A1)` blob
-  flush — `SalvageMultiple` is batched (dirties the module; OP7's
-  diff-and-send calls the explicit `SaveOptions` verb once, after every
-  declared id has been diffed, never interleaved).
+- **No** `SetSingleCharacterOption (0x0005)` for `SalvageMultiple` (id
+  `0x22`) — it is batched, not auto-save, so `TrySetOption` only marks
+  the module dirty and never sends `0x0005` for it. The single
+  `SetCharacterOptions (0x01A1)` blob flush is the ONLY wire evidence of
+  this id changing (OP7's diff-and-send calls the explicit `SaveOptions`
+  verb once, after every declared id has been diffed, never interleaved
+  — so this same `0x01A1` also carries whatever the loop already wrote
+  locally for `IgnoreAllegianceRequests`/`ListenToTradeChat`, even though
+  those two ALSO got their own immediate `0x0005`).
 - **No other option bits change.** ACE's stored `CharacterOptions1`/
   `CharacterOptions2` for every UNDECLARED id stay exactly what they
   were before the run.
@@ -255,9 +259,10 @@ persists the sends.
    current value produces nothing" rule — set-character-options-wire.md
    §3.1/§3.5).
 5. **Flip one declared value** in the config (e.g. `SalvageMultiple` back
-   to `false`) and run again. Expect exactly ONE `0x0005` +
-   `0x01A1` pair for that id only — the other two, still matching,
-   produce nothing.
+   to `false`) and run again. `SalvageMultiple` is batched, so expect
+   exactly ONE `0x01A1` blob flush and **no** `0x0005` for it — the other
+   two declared ids, still matching, produce nothing at all (not even the
+   blob).
 
 ### What to report