fix(chat): CH3 review fixes — phantom UN-9, allegiance-broadcast echo, /a legacy fallback

Applies the Opus review of Campaign CH slice CH3 (614a1e05):

- B1: UN-9 was a phantom divergence — ACE's CharacterOptions1.cs:47
  OR-sum is 0x50C4A54A (its own comment confirms 1355064650), identical
  to acdream's literal. The wrong 0x50C48D4A existed only in the research
  doc. Row deleted, register §5 reverted to 4 rows, research doc corrected
  with dated notes.
- S1/S4: AllegianceBroadcast (0x02000000) is a server-echoing channel —
  ACE's GameActionChatChannel handler includes the sender in its real-name
  Allegiance.Members broadcast (retail's DoAllegianceBroadcast has no
  AddTextToScroll), so the client must skip its local optimistic echo, not
  keep it. ChatChannelInfo.Legacy.IsSelfEchoChannel() now returns true for
  it; RouteLegacyChannel's comment corrected; Turbine.IsSelfEchoChannel()'s
  backwards comment rewritten truthfully.
- S3: retail's /a stays on the legacy AllegianceBroadcast bitflag until
  StartupTurbineChatSystem successfully starts Turbine chat — "never
  started" (TurbineChatState.Enabled == false) now falls back to legacy in
  both LiveSessionCommandRouter.RouteChat and
  DirectGameRuntimeCommandAdapter.TrySendChannel, while "enabled but no
  allegiance room" still correctly refuses locally.
- S5: added a LiveSessionEventRouter test proving the Options.Replace ->
  OnCharacterOptionsChanged seeding order, and RuntimeSettingsTargets /
  GameWindowLiveSessionOwnershipTests tests proving the concrete
  ICommandBus.Publish wiring and the single LiveSessionCommandSurface
  construction site.
- S6: AP-181 rewritten to name both of retail's omitted pre-send checks
  (IsMessageSafe silent-drop, then IsMessageSpam) and stop misattributing
  either to RouteLegacyChannel, which has no such gates.
- N1-N7: CharacterOptionId moved below SocialActions so its doc comment
  re-attaches; TurbineChatMembershipGate reuses TurbineChatDisplayNames
  instead of a duplicate table; the gate-to-refusal-text mapping is now
  shared via TurbineChatMembershipGate.ResolveRefusalText instead of
  duplicated in both hosts; ChatSettings.Default now matches ACE's real
  CharacterOptions2.Default (Roleplay/Society start off); a doc-comment
  clarifies only the five Hear toggles are server-backed; the register's
  §3 header recounted 129 -> 128.

Suite: 11,964 passed / 4 skipped / 0 failed (baseline 11,957/4/0 + 7 new
tests). Campaign ledger CH3 review column updated to APPROVE-WITH-FIXES.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/AcDream.App/Net/LiveSessionCommandRouter.cs

@@ -236,11 +236,19 @@ internal sealed class LiveSessionCommandRouter : ILiveSessionCommandRouting
     /// (0xF7DE), mapped to the lighter <see cref="ChatChannelKindLite"/>
     /// <see cref="TurbineChatMembershipGate"/> reads. Every OTHER channel
     /// kind (Fellowship/Vassals/Patron/Monarch/CoVassals/AllegianceBroadcast)
-    /// is legacy-only (0x0147) — the two pipelines never overlap, so this
-    /// dispatch is exhaustive rather than "try Turbine, fall back to
-    /// legacy." That fallback was the bug (CH3 research doc §5.3): with no
-    /// allegiance, <c>/a</c> silently downgraded to the legacy
-    /// AllegianceBroadcast bitflag instead of retail's local refusal.
+    /// is legacy-only (0x0147) — those pipelines never overlap Turbine.
+    /// <see cref="ChatChannelKind.Allegiance"/> is the one exception, and
+    /// <see cref="RouteChat"/> special-cases it BEFORE this table is
+    /// consulted: S3 (CH3 Opus review, 2026-08-09) corrected the original
+    /// CH3 filing (research doc §5.3) — retail's <c>/a</c> is bound to the
+    /// LEGACY <c>AllegianceBroadcast</c> bitflag by default and is only
+    /// rebound to <c>DoTurbineChat_Allegiance</c> once
+    /// <c>StartupTurbineChatSystem</c> successfully starts Turbine chat
+    /// (research doc §4.3). So "Turbine never started" (<c>TurbineChat.
+    /// Enabled == false</c>) still falls back to legacy, while "Turbine is
+    /// up but this character has no allegiance room" (<c>Enabled == true</c>,
+    /// <c>AllegianceRoom == 0</c>) correctly keeps retail's local
+    /// "Turbine chat is not available." refusal at the membership gate.
     /// </summary>
     private static readonly Dictionary<ChatChannelKind, ChatChannelKindLite> TurbineChannelKinds = new()
     {
@@ -285,6 +293,18 @@ internal sealed class LiveSessionCommandRouter : ILiveSessionCommandRouting
                 return;
         }
 
+        // S3 (CH3 Opus review, 2026-08-09): see the TurbineChannelKinds doc
+        // comment above — Turbine chat never having started (no 0x0295
+        // SetTurbineChatChannels received at all) still routes /a through
+        // the legacy AllegianceBroadcast bitflag, exactly like retail's
+        // default binding before StartupTurbineChatSystem runs.
+        if (command.Channel == ChatChannelKind.Allegiance
+            && !bindings.TurbineChat.Enabled)
+        {
+            RouteLegacyChannel(bindings, ChatChannelKind.AllegianceBroadcast, command.Text);
+            return;
+        }
+
         if (TurbineChannelKinds.TryGetValue(command.Channel, out ChatChannelKindLite liteKind))
         {
             RouteTurbineChat(bindings, liteKind, command.Text);
@@ -312,21 +332,18 @@ internal sealed class LiveSessionCommandRouter : ILiveSessionCommandRouting
             bindings.CharacterState.Options,
             bindings.CharacterState.IsOlthoiPlayer);
 
-        switch (gate.Status)
+        // N3 (CH3 Opus review): the gate-result-to-refusal-text mapping is
+        // now shared with DirectGameRuntimeCommandAdapter.TrySendChannel via
+        // TurbineChatMembershipGate.ResolveRefusalText — this used to be an
+        // independent copy of the same switch.
+        if (gate.Status != TurbineChatGateStatus.Allowed)
         {
-            case TurbineChatGateStatus.Unavailable:
-                bindings.Communication.AddText(
-                    ClientTextRefusals.TurbineChatUnavailable,
-                    RetailLogTextType.Default);
-                return;
-            case TurbineChatGateStatus.NotListening:
+            if (TurbineChatMembershipGate.ResolveRefusalText(gate) is
+                (string refusalText, RetailLogTextType refusalType))
             {
-                (string? refusal, RetailLogTextType type) =
-                    WeenieErrorMessages.Resolve(0x0551u, gate.DisplayName);
-                if (refusal is not null)
-                    bindings.Communication.AddText(refusal, type);
-                return;
+                bindings.Communication.AddText(refusalText, refusalType);
             }
+            return;
         }
 
         uint cookie = bindings.TurbineChat.NextContextId();
@@ -366,10 +383,14 @@ internal sealed class LiveSessionCommandRouter : ILiveSessionCommandRouting
 
         // Step 5: wire ChatChannelInfo.IsSelfEchoChannel() — ACE resends
         // Fellow/Vassals/Patron/Monarch/CoVassals to the sender with an
-        // empty sender name, so a local optimistic echo double-prints.
-        // AllegianceBroadcast includes the sender in its real-name broadcast
-        // with no such server echo, so it keeps the local echo (research
-        // doc §3.7/§5.4).
+        // empty sender name, so a local optimistic echo double-prints. S1
+        // (CH3 Opus review, 2026-08-09) corrected AllegianceBroadcast into
+        // this SAME group: ACE's GameActionChatChannel handler iterates
+        // player.Allegiance.Members and the sender is one of them, so they
+        // get their own line back with their real name too — a different
+        // mechanism (no separate ""-sender resend) but the same
+        // double-print risk, so it must ALSO skip the local echo (research
+        // doc §3.7/§5.4, corrected).
         bool serverEchoes = new ChatChannelInfo.Legacy(
             legacy.Value.ChannelId,
             legacy.Value.DisplayName).IsSelfEchoChannel();