feat(session): the in-world logoff — LogOut animation, reverse wormhole, live return to character select

Retires AD-74 (Exit to Character Selection 'behaves as Exit Game') and
files AD-110 (the composed handoff edge) — register rows in this commit.

Retail derivation (named decomp):
- gmGamePlayUI::UseTime @0x004EA3A0: confirmed Yes drains into
  CPlayerSystem::LogOffCharacter(0) when grounded (transient_state &
  CONTACT); the grounded three-way branch now also covers the
  indicator-bar end-session control (it was Options-only).
- CPlayerSystem::LogOffCharacter @0x00563520: SaveToServer FIRST (the
  existing pre-logoff flush hook), then RequestLogOff @0x00562DD0:
  'Logging off...' chat (type 0), 0xF653 via Proto_UI::LogOffCharacter
  @0x00546A20, logOffRequestTime = now + 3.0 (+20.0 when
  IsPlayerKiller @0x0058C910 — PWD bits 0x20|0x2000000), and
  CommandInterpreter::HandleLogOff @0x006B3330 -> Disable.
- The log-off ANIMATION is server-driven: ACE broadcasts
  MotionCommand.LogOut (0x1000011E, Player.cs:596 SendMotionAsCommands)
  and it plays on the local player through the existing inbound
  unpack_movement funnel during the 3 s hold — retail plays nothing
  locally; Disable() is the whole client-side effect.
- gmSmartBoxUI::UseTime @0x004D6E64: hold elapsed ->
  BeginTeleportAnimation(TAS_WORLD_FADE_OUT) @0x004D6E83 (enter cue
  @0x004D638E, unconditional) -> TunnelFadeIn -> Tunnel. The tunnel
  plays the SAME forward 40 fps animation; nothing renders backwards,
  and NO exit cue ever fires on logout (the char-select swap preempts
  the TunnelContinue/FadeOut tail).
- Inbound 0xF653 echo (dispatch case 3 @0x0055C963) ->
  ExecuteLogOff @0x0055D780: world teardown with the LOGON CONNECTION
  KEPT (ExitWorldDisconnect @0x00541E00 removes every connection
  except logonRecID_ — one connection against ACE) and
  Proto_UI::SetEventCounter(0) @0x00541E79; the fresh CharacterList in
  the same batch re-shows character management (gmGamePlayUI::Update
  @0x004E9CD0 -> QueueUIMode(0x1000000a)). ACE mirrors it:
  SendFinalLogOffMessages (Session.cs:249) sends 0xF653 + CharacterList
  + ServerName >=6 s after the request and leaves the session
  AuthConnected — a second EnterWorld needs no re-handshake.

Implementation:
- RuntimeWorldTransitState: the canonical logout lifecycle
  (Requested/PresentationActive/Confirmed, retail 3 s/+20 s holds,
  cancel/reset/ownership convergence).
- WorldSession: RequestCharacterLogOff (non-blocking 0xF653),
  IsCharacterLogOffConfirmed, ReturnToCharacterSelect (InWorld ->
  InCharacterSelect + game-action sequence reset; transport untouched).
- LiveSessionController: BeginCharacterLogOff (flush-first request) and
  CompleteCharacterLogOff — the return-to-selection transaction
  (ReconnectCore minus the transport swap: retire the world
  generation's routes, host reset, state flip, fresh generation
  re-bind, roster re-applied from the pushed CharacterList; failures
  degrade to the full StopCore teardown).
- RuntimeLocalPlayerMovementState.DisableCommandInterpreter +
  DispatcherMovementInputSource gate: retail's Disable() — held keys
  produce no movement while the server LogOut motion plays; cleared by
  the generation reset.
- LocalPlayerTeleportController: the logout pump as the third arm of
  the one wormhole machine (request/hold/wormhole/confirmed handoff;
  teleport starts refused during logout; the handoff runs the session
  transaction whose world reset retires the tunnel as the fresh
  selection state re-shows the character screen).
- UI: both end-session surfaces share the retail three-way grounded
  gate and now run the REAL flow; Options' Exit Game keeps the app
  exit (window close -> the existing graceful-shutdown logoff).

Tests: +5 transit lifecycle, +4 session transaction, +7 logout pump.
Runtime 1756/0 (baseline 1747), App live-DAT 5523/3 (baseline 5512/3
+ 11 this round), Core.Net 1004/0, full solution green (0 failures).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/AcDream.App/Composition/InteractionRetainedUiComposition.cs

@@ -56,6 +56,11 @@ internal sealed record InteractionRetainedUiDependencies(
     HostQuiescenceGate HostQuiescence,
     RetainedUiInputCaptureSlot RetainedInputCapture,
     InputDispatcher? InputDispatcher,
+    /// <summary>Logout round (2026-08-17): the construction-order teleport
+    /// bridge — the retained UI is composed before the teleport controller,
+    /// so the end-character-session binding reaches the wormhole owner
+    /// through this deferred sink.</summary>
+    AcDream.App.Streaming.DeferredLocalPlayerTeleportNetworkSink TeleportSink,
     // Campaign OP slice OP8: the portable keybinds.json path
     // (ApplicationPathSet.KeyBindingsFile) — the Configure Keyboard screen's
     // Save button writes here, same file GameWindow's startup load reads.
@@ -751,7 +756,14 @@ internal sealed class RetailInteractionRetainedUiCompositionFactory
                     () => late.Session.LinkStatus,
                     d.ClientTime,
                     () => late.Session.CurrentSession?.RequestLinkStatusPing(),
-                    d.Window.Close),
+                    // Logout round (2026-08-17): the in-world logoff flow
+                    // (retail EndCharacterSession — animation + reverse
+                    // wormhole + return to character select), forwarded
+                    // through the construction-order teleport-sink bridge.
+                    EndCharacterSession: d.TeleportSink.RequestLogout,
+                    // Exit Game keeps the app-exit: window close runs the
+                    // graceful-shutdown logoff in WorldSession.Dispose.
+                    ExitGame: d.Window.Close),
                 Toolbar: new ToolbarRuntimeBindings(
                     d.Inventory.Objects,
                     d.Inventory.Shortcuts,

src/AcDream.App/Composition/SessionPlayerComposition.cs

@@ -1025,7 +1025,16 @@ internal sealed class SessionPlayerCompositionPhase
                 // armed pre-reveal tunnel projects the Runtime
                 // character-selection lifecycle to disarm on a rejected
                 // EnterWorld (see the controller's field doc).
-                new RuntimeLoginLifecycleSource(d.Runtime));
+                new RuntimeLoginLifecycleSource(d.Runtime),
+                // Logout round (2026-08-17): the logout arm's Runtime seams
+                // (wire begin, confirmation, return-to-selection
+                // transaction, PK hold fact, interpreter disable).
+                new RuntimeLocalPlayerLogoutOperations(
+                    d.Runtime,
+                    d.PlayerController,
+                    liveSessionSource,
+                    d.Inventory.Objects,
+                    d.PlayerIdentity));
 
         LocalPlayerTeleportController CreateLocalTeleportWithTunnel(
             PortalTunnelPresentation portalTunnel)