fix(chat): CH3 review fixes — phantom UN-9, allegiance-broadcast echo, /a legacy fallback

Applies the Opus review of Campaign CH slice CH3 (614a1e05):

- B1: UN-9 was a phantom divergence — ACE's CharacterOptions1.cs:47
  OR-sum is 0x50C4A54A (its own comment confirms 1355064650), identical
  to acdream's literal. The wrong 0x50C48D4A existed only in the research
  doc. Row deleted, register §5 reverted to 4 rows, research doc corrected
  with dated notes.
- S1/S4: AllegianceBroadcast (0x02000000) is a server-echoing channel —
  ACE's GameActionChatChannel handler includes the sender in its real-name
  Allegiance.Members broadcast (retail's DoAllegianceBroadcast has no
  AddTextToScroll), so the client must skip its local optimistic echo, not
  keep it. ChatChannelInfo.Legacy.IsSelfEchoChannel() now returns true for
  it; RouteLegacyChannel's comment corrected; Turbine.IsSelfEchoChannel()'s
  backwards comment rewritten truthfully.
- S3: retail's /a stays on the legacy AllegianceBroadcast bitflag until
  StartupTurbineChatSystem successfully starts Turbine chat — "never
  started" (TurbineChatState.Enabled == false) now falls back to legacy in
  both LiveSessionCommandRouter.RouteChat and
  DirectGameRuntimeCommandAdapter.TrySendChannel, while "enabled but no
  allegiance room" still correctly refuses locally.
- S5: added a LiveSessionEventRouter test proving the Options.Replace ->
  OnCharacterOptionsChanged seeding order, and RuntimeSettingsTargets /
  GameWindowLiveSessionOwnershipTests tests proving the concrete
  ICommandBus.Publish wiring and the single LiveSessionCommandSurface
  construction site.
- S6: AP-181 rewritten to name both of retail's omitted pre-send checks
  (IsMessageSafe silent-drop, then IsMessageSpam) and stop misattributing
  either to RouteLegacyChannel, which has no such gates.
- N1-N7: CharacterOptionId moved below SocialActions so its doc comment
  re-attaches; TurbineChatMembershipGate reuses TurbineChatDisplayNames
  instead of a duplicate table; the gate-to-refusal-text mapping is now
  shared via TurbineChatMembershipGate.ResolveRefusalText instead of
  duplicated in both hosts; ChatSettings.Default now matches ACE's real
  CharacterOptions2.Default (Roleplay/Society start off); a doc-comment
  clarifies only the five Hear toggles are server-backed; the register's
  §3 header recounted 129 -> 128.

Suite: 11,964 passed / 4 skipped / 0 failed (baseline 11,957/4/0 + 7 new
tests). Campaign ledger CH3 review column updated to APPROVE-WITH-FIXES.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/plans/2026-04-11-roadmap.md

@@ -945,7 +945,7 @@ the way retail + holtburger expect.
 - **✓ SHIPPED — I.3 — `LiveCommandBus` + `WorldSession.Send{Talk,Tell,Channel}`.** Replaces `NullCommandBus.Instance` with a real handler-registry `ICommandBus`. New `SendChatCmd` record + `ChatChannelKind` enum + `ChannelResolver` legacy-id mapping (per holtburger). `WorldSession.SendTalk` / `SendTell` / `SendChannel` are 3-line wrappers around existing `ChatRequests.BuildTalk/Tell/ChatChannel`. Commit `8e6e5a0`.
 - **✓ SHIPPED — I.4 — `ChatPanel` input field + slash commands.** Enter-to-submit input field on `ChatPanel`; `ChatInputParser` recognises `/say` `/t` `/tell` `/r` `/g` `/f` `/a` `/m` `/p` `/v` `/cv` `/lfg` `/trade` `/role` `/society` `/olthoi`; `ChatVM.LastIncomingTellSender` tracks for `/r` reply. `ImGui.WantCaptureKeyboard` already suppresses WASD on input focus. Commit `f14296c`.
 - **✓ SHIPPED — I.5 — Holtburger inbound chat parity + Windows-1252.** `EmoteText (0x01E0)`, `SoulEmote (0x01E2)`, `ServerMessage (0xF7E0)`, `PlayerKilled (0x019E)` parsers + `WeenieError` routing through `GameEventWiring`. Global string codec switch from `Encoding.ASCII` to `Encoding.GetEncoding(1252)` so accented names round-trip per retail + holtburger. Commit `ff5ed9e`.
-- **✓ SHIPPED — I.6 — TurbineChat codec + `ChatChannelInfo`.** Full `0xF7DE` codec with three payload variants (`EventSendToRoom`, `RequestSendToRoomById`, `Response`), UTF-16LE strings with variable-length prefix, `SetTurbineChatChannels (0x0295)` parser, unified `ChatChannelInfo` (Legacy + Turbine variants), `TurbineChatState`. **ACE doesn't host a TurbineChat server — codec is ready when retail-emulating servers exist.** Commit `ca968fc`.
+- **✓ SHIPPED — I.6 — TurbineChat codec + `ChatChannelInfo`.** Full `0xF7DE` codec with three payload variants (`EventSendToRoom`, `RequestSendToRoomById`, `Response`), UTF-16LE strings with variable-length prefix, `SetTurbineChatChannels (0x0295)` parser, unified `ChatChannelInfo` (Legacy + Turbine variants), `TurbineChatState`. **Correction (Campaign CH slice CH3, 2026-08-09): the "ACE doesn't host a TurbineChat server" note above was FALSE — ACE has a complete, on-by-default TurbineChat implementation; see `docs/research/2026-08-09-chat-side-channels-vs-ace.md` §1.** Commit `ca968fc`.
 - **✓ SHIPPED — I.7 — `CombatChatTranslator`.** Retail-faithful combat-text formatters into `ChatLog` ("You hit drudge for 50 slashing damage (87%)"). Subscribes to visible damage/evasion/miss/kill events; `AttackDone` was removed from chat after named retail + ACE proved its nonzero final status is control-only. Commit `3d26c8e`, corrected 2026-07-11.
 - **✓ SHIPPED — I.8 — Docs alignment.** Roadmap (this file) + `docs/ISSUES.md` issues #14-#20 closed + `memory/project_chat_pipeline.md` crib + `MEMORY.md` index entry + `CLAUDE.md` UI strategy paragraph all updated to reflect Phase I shipped state. Commit `(this commit)`.
 

docs/plans/2026-08-09-chat-parity-campaign.md

@@ -108,7 +108,7 @@ implementer per slice against a pinned contract (per
 | R1–R4 research | `see docs/research/2026-08-09-chat-retail-*` | — | — | — |
 | CH1 colors | `172c6f9a` | 11,835 passed / 4 skipped / 0 failed | APPROVE-WITH-FIXES; fixed `34d8a3c0` | pending |
 | CH2 interface text | `77c8296e`, reworked `e0e78883` | 11,916 passed / 4 skipped / 0 failed | REJECT → reworked `e0e78883` → re-review APPROVE-WITH-FIXES → nits `233c30d1` | pending |
-| CH3 side channels | `614a1e05` | 11,957 passed / 4 skipped / 0 failed | not yet reviewed | pending (connected gate — see handoff below) |
+| CH3 side channels | `614a1e05` | 11,957 passed / 4 skipped / 0 failed | APPROVE-WITH-FIXES; fixed `(this commit)` | pending (connected gate — see handoff below) |
 | CH4 commands | — | — | — | — |
 | CH5 closeout | — | — | — | — |
 
@@ -175,6 +175,50 @@ notes above (no 6th Allegiance toggle, no `/allegiancebroadcast` verb) are
 scope-narrowing decisions made against the retail command registry and the
 existing `ChatSettings` shape, not skipped work.
 
+### CH3 Opus review fixes (2026-08-09)
+
+The review found the CH3 closeout above had three items that no longer
+match the fixed code — corrections, not a rewrite of the historical
+record:
+
+- **Item 5 is now WRONG for AllegianceBroadcast.** ACE's
+  `GameActionChatChannel` handler iterates `player.Allegiance.Members` —
+  the sender IS a member, so they get their own real-name line back
+  through the same broadcast, same as Fellow/Vassals/Patron/Monarch/
+  CoVassals (a different mechanism, same self-echo consequence).
+  `ChatChannelInfo.Legacy.IsSelfEchoChannel()` now returns `true` for
+  `0x02000000` too; `RouteLegacyChannel` skips the local echo for it.
+- **Item 7 is now WRONG.** `/a` is NOT unconditionally Turbine. Retail's
+  base binding keeps it on the legacy `AllegianceBroadcast` bitflag until
+  `StartupTurbineChatSystem` successfully starts Turbine chat and rebinds
+  it (research doc §4.3). `LiveSessionCommandRouter.RouteChat` and
+  `DirectGameRuntimeCommandAdapter.TrySendChannel` now special-case
+  `TurbineChatState.Enabled == false` to fall back to the legacy send;
+  `Enabled == true` with `AllegianceRoom == 0` still correctly refuses
+  locally ("Turbine chat is not available.").
+- **Item 9's UN-9 filing was a phantom.** ACE's own
+  `CharacterOptions1.cs:47` OR-sum is `0x50C4A54A` (confirmed by its own
+  inline comment, `// 1355064650`), identical to acdream's
+  `PlayerDescriptionParser.cs:217` — there was never a divergence. The
+  wrong literal `0x50C48D4A` existed only in
+  `docs/research/2026-08-09-chat-side-channels-vs-ace.md`. UN-9 is deleted
+  from the register; AP-181 is rewritten to name BOTH of retail's omitted
+  pre-send checks (`IsMessageSafe` silent-drop, THEN `IsMessageSpam`) and
+  no longer misattributes either to `RouteLegacyChannel`.
+
+Also fixed this review: `ChatSettings.Default` now matches ACE's real
+`CharacterOptions2.Default` (Roleplay/Society start OFF, not the
+previously-claimed "all on"); `TurbineChatMembershipGate` reuses
+`TurbineChatDisplayNames.Resolve` instead of a second name table; the
+gate-result-to-refusal-text mapping is shared via
+`TurbineChatMembershipGate.ResolveRefusalText` instead of being
+duplicated in both hosts; the `CharacterOptionId` enum in
+`SocialActions.cs` moved below the class so its doc comment re-attaches
+correctly; `docs/plans/2026-04-11-roadmap.md` line ~948 got the same
+TurbineChat-server retraction already applied at line ~429; and the
+register's §3 header count was corrected from a pre-existing off-by-one
+(129 claimed vs 128 actual `| AP-` rows).
+
 **What the connected gate must verify (not run this session — build+test
 only per the CH3 task's hard constraint):** General/Trade/LFG round-trip
 send+receive; Roleplay is now silent-but-correctly-refused until the user

docs/research/2026-08-09-chat-side-channels-vs-ace.md

@@ -300,7 +300,13 @@ and from allegiance changes.
 | `0x00080000` | HearSocietyChat | **NO** |
 
 `Default = 0x00948700`. `CharacterOptions1.Default` includes
-`HearAllegianceChat (0x40000000)`; `CharacterOptions1.Default = 0x50C48D4A`.
+`HearAllegianceChat (0x40000000)`; `CharacterOptions1.Default = 0x50C4A54A`
+(corrected 2026-08-09 at the CH3 Opus review — the original filing here
+had `0x50C48D4A`, a copy error with no basis in ACE's own source; ACE's
+`CharacterOptions1.cs:47` OR-sum is `0x50C4A54A`, confirmed by its own
+inline comment `// 1355064650`, and is identical to acdream's
+`PlayerDescriptionParser.cs:217`. This wrong literal is what filed the
+now-retracted UN-9 register row).
 `PlayerFactory.CharacterCreateSetDefaultCharacterOptions` sets exactly these
 two defaults on every new character.
 
@@ -620,7 +626,9 @@ unknown channel ids are dropped with no client-visible response.
 as `flags`, then reads `characterOptions1` past the end of the payload.
 Worse, `CharacterOptionDataFlag.CharacterOptions2 = 0x40` collides with
 `CharacterOptions1.AllowGive = 0x40`, which **is** set in
-`CharacterOptions1.Default (0x50C48D4A)` — so ACE would also try to read an
+`CharacterOptions1.Default (0x50C4A54A)` (corrected 2026-08-09 at the CH3
+Opus review; see the §3.5 correction note above — same copy error, same
+fix) — so ACE would also try to read an
 options2 value. Reachable only via `IGameRuntimeCommands.SetOptions1`, which has
 no production call site (grep: only tests). **Latent, but this is the exact
 message a Settings-sync feature would reach for.**

src/AcDream.App/Net/LiveSessionCommandRouter.cs

@@ -236,11 +236,19 @@ internal sealed class LiveSessionCommandRouter : ILiveSessionCommandRouting
     /// (0xF7DE), mapped to the lighter <see cref="ChatChannelKindLite"/>
     /// <see cref="TurbineChatMembershipGate"/> reads. Every OTHER channel
     /// kind (Fellowship/Vassals/Patron/Monarch/CoVassals/AllegianceBroadcast)
-    /// is legacy-only (0x0147) — the two pipelines never overlap, so this
+    /// is legacy-only (0x0147) — those pipelines never overlap Turbine.
-    /// dispatch is exhaustive rather than "try Turbine, fall back to
+    /// <see cref="ChatChannelKind.Allegiance"/> is the one exception, and
-    /// legacy." That fallback was the bug (CH3 research doc §5.3): with no
+    /// <see cref="RouteChat"/> special-cases it BEFORE this table is
-    /// allegiance, <c>/a</c> silently downgraded to the legacy
+    /// consulted: S3 (CH3 Opus review, 2026-08-09) corrected the original
-    /// AllegianceBroadcast bitflag instead of retail's local refusal.
+    /// CH3 filing (research doc §5.3) — retail's <c>/a</c> is bound to the
+    /// LEGACY <c>AllegianceBroadcast</c> bitflag by default and is only
+    /// rebound to <c>DoTurbineChat_Allegiance</c> once
+    /// <c>StartupTurbineChatSystem</c> successfully starts Turbine chat
+    /// (research doc §4.3). So "Turbine never started" (<c>TurbineChat.
+    /// Enabled == false</c>) still falls back to legacy, while "Turbine is
+    /// up but this character has no allegiance room" (<c>Enabled == true</c>,
+    /// <c>AllegianceRoom == 0</c>) correctly keeps retail's local
+    /// "Turbine chat is not available." refusal at the membership gate.
     /// </summary>
     private static readonly Dictionary<ChatChannelKind, ChatChannelKindLite> TurbineChannelKinds = new()
     {
@@ -285,6 +293,18 @@ internal sealed class LiveSessionCommandRouter : ILiveSessionCommandRouting
                 return;
         }
 
+        // S3 (CH3 Opus review, 2026-08-09): see the TurbineChannelKinds doc
+        // comment above — Turbine chat never having started (no 0x0295
+        // SetTurbineChatChannels received at all) still routes /a through
+        // the legacy AllegianceBroadcast bitflag, exactly like retail's
+        // default binding before StartupTurbineChatSystem runs.
+        if (command.Channel == ChatChannelKind.Allegiance
+            && !bindings.TurbineChat.Enabled)
+        {
+            RouteLegacyChannel(bindings, ChatChannelKind.AllegianceBroadcast, command.Text);
+            return;
+        }
+
         if (TurbineChannelKinds.TryGetValue(command.Channel, out ChatChannelKindLite liteKind))
         {
             RouteTurbineChat(bindings, liteKind, command.Text);
@@ -312,21 +332,18 @@ internal sealed class LiveSessionCommandRouter : ILiveSessionCommandRouting
             bindings.CharacterState.Options,
             bindings.CharacterState.IsOlthoiPlayer);
 
-        switch (gate.Status)
+        // N3 (CH3 Opus review): the gate-result-to-refusal-text mapping is
+        // now shared with DirectGameRuntimeCommandAdapter.TrySendChannel via
+        // TurbineChatMembershipGate.ResolveRefusalText — this used to be an
+        // independent copy of the same switch.
+        if (gate.Status != TurbineChatGateStatus.Allowed)
         {
-            case TurbineChatGateStatus.Unavailable:
+            if (TurbineChatMembershipGate.ResolveRefusalText(gate) is
-                bindings.Communication.AddText(
+                (string refusalText, RetailLogTextType refusalType))
-                    ClientTextRefusals.TurbineChatUnavailable,
-                    RetailLogTextType.Default);
-                return;
-            case TurbineChatGateStatus.NotListening:
             {
-                (string? refusal, RetailLogTextType type) =
+                bindings.Communication.AddText(refusalText, refusalType);
-                    WeenieErrorMessages.Resolve(0x0551u, gate.DisplayName);
-                if (refusal is not null)
-                    bindings.Communication.AddText(refusal, type);
-                return;
             }
+            return;
         }
 
         uint cookie = bindings.TurbineChat.NextContextId();
@@ -366,10 +383,14 @@ internal sealed class LiveSessionCommandRouter : ILiveSessionCommandRouting
 
         // Step 5: wire ChatChannelInfo.IsSelfEchoChannel() — ACE resends
         // Fellow/Vassals/Patron/Monarch/CoVassals to the sender with an
-        // empty sender name, so a local optimistic echo double-prints.
+        // empty sender name, so a local optimistic echo double-prints. S1
-        // AllegianceBroadcast includes the sender in its real-name broadcast
+        // (CH3 Opus review, 2026-08-09) corrected AllegianceBroadcast into
-        // with no such server echo, so it keeps the local echo (research
+        // this SAME group: ACE's GameActionChatChannel handler iterates
-        // doc §3.7/§5.4).
+        // player.Allegiance.Members and the sender is one of them, so they
+        // get their own line back with their real name too — a different
+        // mechanism (no separate ""-sender resend) but the same
+        // double-print risk, so it must ALSO skip the local echo (research
+        // doc §3.7/§5.4, corrected).
         bool serverEchoes = new ChatChannelInfo.Legacy(
             legacy.Value.ChannelId,
             legacy.Value.DisplayName).IsSelfEchoChannel();

src/AcDream.App/Net/LiveSessionRuntimeFactory.cs

@@ -313,8 +313,13 @@ internal sealed class LiveSessionRuntimeFactory
             OnMovementStatsUpdated: () => _movementStats.Apply("stats"),
             // Campaign CH slice CH3 (2026-08-09): reseed the Settings Chat
             // draft from server truth every time a PlayerDescription lands
-            // (research doc §5.2/§6.4 — the local ChatSettings.Default lied
+            // (research doc §5.2/§6.4). N4 (CH3 Opus review, 2026-08-09)
-            // relative to ACE's CharacterOptions2.Default).
+            // aligned ChatSettings.Default itself to ACE's real
+            // CharacterOptions2.Default, but this reseed stays load-bearing
+            // regardless — a per-character persisted settings.json can
+            // still diverge from server truth (e.g. an older save, or a
+            // character whose allegiance/society changed), and the server
+            // is always authoritative.
             OnCharacterOptionsChanged: (_, options2) =>
                 _interaction.Settings.SyncChatFromServerOptions(options2));
     }

src/AcDream.App/Settings/RuntimeSettingsController.cs

@@ -553,11 +553,15 @@ internal sealed class RuntimeSettingsController :
     /// <summary>
     /// CH3 (2026-08-09): reseed the persisted + draft Chat snapshot from the
     /// server's own <c>CharacterOptions2</c> bitfield (already parsed out of
-    /// PlayerDescription) — called whenever a fresh description lands. The
+    /// PlayerDescription) — called whenever a fresh description lands. N4
-    /// local <see cref="ChatSettings.Default"/> lies relative to ACE's
+    /// (CH3 Opus review, 2026-08-09) aligned <see cref="ChatSettings.Default"/>
-    /// default (Roleplay/Society start OFF server-side), so this is the only
+    /// to ACE's real default (Roleplay/Society start OFF server-side), but
-    /// way the checkbox ever reflects truth for a character that never
+    /// this sync remains the only way the checkbox reflects truth for a
-    /// explicitly saved a Chat preference.
+    /// character whose PERSISTED settings.json diverges from the server —
+    /// an older save, or a character whose allegiance/society membership
+    /// changed since the file was last written. The server is always
+    /// authoritative, regardless of what the local default or a stale save
+    /// says.
     /// </summary>
     public void SyncChatFromServerOptions(uint options2)
     {

src/AcDream.App/Settings/RuntimeSettingsTargets.cs

@@ -270,7 +270,14 @@ internal sealed class RuntimeSettingsTargets : IRuntimeSettingsTargets
     /// <see cref="LiveSessionCommandRouter"/> generation-gated route every
     /// other outbound Settings/chat command uses — a no-op when no route is
     /// currently attached (disconnected / reconnecting), exactly like every
-    /// other <c>ICommandBus.Publish</c> call site.
+    /// other <c>ICommandBus.Publish</c> call site. N6 (CH3 Opus review,
+    /// 2026-08-09): this silent drop is safe because
+    /// <c>RuntimeSettingsController.SaveChat</c> already wrote the toggle to
+    /// settings.json BEFORE calling here — the local preference is never
+    /// lost — and the next successful connect's PlayerDescription re-runs
+    /// <c>SyncChatFromServerOptions</c>, reconciling the draft/persisted
+    /// snapshot back to whatever the server actually has (which may or may
+    /// not match the dropped toggle, since the wire send never landed).
     /// </summary>
     public void SetSingleCharacterOption(uint optionId, bool value) =>
         _commands.Publish(new SetSingleCharacterOptionRuntimeCmd(optionId, value));

src/AcDream.Core.Net/Messages/SocialActions.cs

@@ -23,24 +23,6 @@ namespace AcDream.Core.Net.Messages;
 /// References: r08 §3 rows for each opcode.
 /// </para>
 /// </summary>
-/// <summary>
-/// ACE <c>CharacterOption</c> ids (a LINEAR enum, distinct from the
-/// <c>CharacterOptions1</c>/<c>CharacterOptions2</c> BITFIELDS) — the first
-/// <c>u32</c> of a <c>SetSingleCharacterOption (0x0005)</c> payload. Only
-/// the six <c>ListenTo*Chat</c> ids Campaign CH slice CH3 (2026-08-09) needs
-/// are modeled here; ACE <c>Source/ACE.Entity/Enum/CharacterOption.cs</c>
-/// has the complete list.
-/// </summary>
-public enum CharacterOptionId : uint
-{
-    ListenToAllegianceChat = 0x1B,
-    ListenToGeneralChat = 0x23,
-    ListenToTradeChat = 0x24,
-    ListenToLFGChat = 0x25,
-    ListenToRoleplayChat = 0x26,
-    ListenToSocietyChat = 0x2E,
-}
-
 public static class SocialActions
 {
     public const uint GameActionEnvelope = 0xF7B1u;
@@ -205,3 +187,21 @@ public static class SocialActions
         return result;
     }
 }
+
+/// <summary>
+/// ACE <c>CharacterOption</c> ids (a LINEAR enum, distinct from the
+/// <c>CharacterOptions1</c>/<c>CharacterOptions2</c> BITFIELDS) — the first
+/// <c>u32</c> of a <c>SetSingleCharacterOption (0x0005)</c> payload. Only
+/// the six <c>ListenTo*Chat</c> ids Campaign CH slice CH3 (2026-08-09) needs
+/// are modeled here; ACE <c>Source/ACE.Entity/Enum/CharacterOption.cs</c>
+/// has the complete list.
+/// </summary>
+public enum CharacterOptionId : uint
+{
+    ListenToAllegianceChat = 0x1B,
+    ListenToGeneralChat = 0x23,
+    ListenToTradeChat = 0x24,
+    ListenToLFGChat = 0x25,
+    ListenToRoleplayChat = 0x26,
+    ListenToSocietyChat = 0x2E,
+}

src/AcDream.Core/Chat/ChatChannelInfo.cs

@@ -33,9 +33,14 @@ public enum ChatChannelSource
 /// echoes the client's own outgoing messages back on this channel
 /// (so the client should suppress its optimistic local echo). Per
 /// holtburger's predicate at <c>chat.rs::is_self_echo_channel</c>
-/// (lines 492-507) this is true ONLY for the legacy fellowship/vassals/
+/// (lines 492-507) this is true for the legacy fellowship/vassals/
-/// patron/monarch/co-vassals channels — server resends those with
+/// patron/monarch/co-vassals channels — server resends those with an
-/// empty sender. Turbine and tells do not echo.
+/// empty sender. S1 (CH3 Opus review, 2026-08-09) added
+/// AllegianceBroadcast to this same group: ACE's GameActionChatChannel
+/// handler includes the sender as an ordinary member of its real-name
+/// broadcast — a different mechanism from the other five's empty-sender
+/// resend, but the same consequence for the client (suppress the local
+/// echo). Turbine and tells do not echo.
 /// </para>
 /// </summary>
 public abstract record ChatChannelInfo(string DisplayName, ChatChannelSource Source)
@@ -47,17 +52,22 @@ public abstract record ChatChannelInfo(string DisplayName, ChatChannelSource Sou
         public override bool IsSelfEchoChannel()
         {
             // Per holtburger: the legacy fellowship + allegiance-tree
-            // channels are the ones the server echoes back to the sender
+            // channels are the ones the server echoes back to the sender.
-            // with an empty sender field. Bitflag values from
+            // Bitflag values from
             // references/holtburger/.../messages/chat/types.rs::ChatChannel.
             //
-            // CH3 (2026-08-09, research doc §3.7/§5.4): AllegianceBroadcast
+            // S1 (CH3 Opus review, 2026-08-09) — corrects the original CH3
-            // (0x02000000) deliberately falls to the `false` default below —
+            // filing at research doc §3.7/§5.4: AllegianceBroadcast
-            // ACE's GameActionChatChannel handler includes the sender in the
+            // (0x02000000) belongs in the `true` group below, NOT the
-            // normal real-name member broadcast for that channel (no
+            // `false` default. ACE's GameActionChatChannel handler iterates
-            // separate "" -sender echo the way Fellow/Vassals/Patron/
+            // player.Allegiance.Members, and the sender IS a member, so
-            // Monarch/CoVassals get), so the client must keep its own local
+            // they receive their own line back with their REAL name — a
-            // optimistic echo or the sender never sees their own line.
+            // different mechanism from Fellow/Vassals/Patron/Monarch/
+            // CoVassals' separate ""-sender resend, but the same
+            // consequence: keeping a local optimistic echo double-prints.
+            // Retail agrees: ClientCommunicationSystem::DoAllegianceBroadcast
+            // @0x005761F0 calls Event_ChannelBroadcast(0x2000000, &text)
+            // with no AddTextToScroll of its own.
             return ChannelId switch
             {
                 0x00000800u => true,  // Fellow
@@ -65,6 +75,7 @@ public abstract record ChatChannelInfo(string DisplayName, ChatChannelSource Sou
                 0x00002000u => true,  // Patron
                 0x00004000u => true,  // Monarch
                 0x01000000u => true,  // CoVassals
+                0x02000000u => true,  // AllegianceBroadcast
                 _ => false,
             };
         }
@@ -86,9 +97,20 @@ public abstract record ChatChannelInfo(string DisplayName, ChatChannelSource Sou
     {
         public override bool IsSelfEchoChannel()
         {
-            // Turbine rooms do NOT echo the sender's own messages back.
+            // S4 (CH3 Opus review, 2026-08-09): the comment this replaced
-            // The client must emit its own optimistic local echo to give
+            // was wrong in both directions. ACE's TurbineChatHandler
-            // the player feedback that the message was sent.
+            // resends via GetAllOnline() WITH the sender included — there
+            // is no sender exclusion, so the sender's own outgoing line
+            // comes back through the SAME broadcast every other member
+            // gets. Retail's SendTurbineChat @0x0057db10 emits no local
+            // AddTextToScroll on success either way. Production correctly
+            // shows no local optimistic echo for Turbine channels, but NOT
+            // because of this return value — RouteTurbineChat
+            // (LiveSessionCommandRouter / DirectGameRuntimeCommandAdapter)
+            // never calls OnSelfSent for a Turbine send at all, so this
+            // method is currently unread for the Turbine variant (only
+            // Legacy.IsSelfEchoChannel() has a caller). Kept `false` here
+            // since no caller depends on the value either way.
             return false;
         }
     }

src/AcDream.Runtime/Gameplay/TurbineChatMembershipGate.cs

@@ -1,5 +1,6 @@
 using AcDream.Core.Chat;
 using AcDream.Core.Net.Messages;
+using AcDream.Runtime.Session;
 
 namespace AcDream.Runtime.Gameplay;
 
@@ -64,38 +65,36 @@ public static class TurbineChatMembershipGate
         ArgumentNullException.ThrowIfNull(turbineChat);
         ArgumentNullException.ThrowIfNull(options);
 
-        (uint room, uint chatType, string name) = kind switch
+        // N2 (CH3 Opus review): reuse TurbineChatDisplayNames.Resolve — the
+        // SAME assembly already has this room/chatType-to-display-name
+        // table (LiveSessionEventRouter's inbound path uses it) rather than
+        // maintaining a second copy of the same seven strings here.
+        (uint room, uint chatType) = kind switch
         {
             ChatChannelKindLite.Allegiance => (
                 turbineChat.AllegianceRoom,
-                (uint)TurbineChat.ChatType.Allegiance,
+                (uint)TurbineChat.ChatType.Allegiance),
-                "Allegiance"),
             ChatChannelKindLite.General => (
                 turbineChat.GeneralRoom,
-                (uint)TurbineChat.ChatType.General,
+                (uint)TurbineChat.ChatType.General),
-                "General"),
             ChatChannelKindLite.Trade => (
                 turbineChat.TradeRoom,
-                (uint)TurbineChat.ChatType.Trade,
+                (uint)TurbineChat.ChatType.Trade),
-                "Trade"),
             ChatChannelKindLite.Lfg => (
                 turbineChat.LfgRoom,
-                (uint)TurbineChat.ChatType.Lfg,
+                (uint)TurbineChat.ChatType.Lfg),
-                "LFG"),
             ChatChannelKindLite.Roleplay => (
                 turbineChat.RoleplayRoom,
-                (uint)TurbineChat.ChatType.Roleplay,
+                (uint)TurbineChat.ChatType.Roleplay),
-                "Roleplay"),
             ChatChannelKindLite.Society => (
                 turbineChat.SocietyRoom,
-                (uint)TurbineChat.ChatType.Society,
+                (uint)TurbineChat.ChatType.Society),
-                "Society"),
             ChatChannelKindLite.Olthoi => (
                 turbineChat.OlthoiRoom,
-                (uint)TurbineChat.ChatType.Olthoi,
+                (uint)TurbineChat.ChatType.Olthoi),
-                "Olthoi"),
+            _ => (0u, 0u),
-            _ => (0u, 0u, string.Empty),
         };
+        string name = TurbineChatDisplayNames.Resolve(room, chatType);
 
         if (!turbineChat.Enabled || room == 0u)
         {
@@ -140,4 +139,31 @@ public static class TurbineChatMembershipGate
             ? new TurbineChatGateResult(TurbineChatGateStatus.Allowed, room, chatType, name)
             : new TurbineChatGateResult(TurbineChatGateStatus.NotListening, room, chatType, name);
     }
+
+    /// <summary>
+    /// N3 (CH3 Opus review): the single shared mapping from an evaluated
+    /// <see cref="TurbineChatGateResult"/> to the retail-exact local
+    /// refusal text/type an <c>AddText</c> caller should raise instead of
+    /// sending — collapses the identical
+    /// <c>switch (gate.Status) { case Unavailable: ...; case NotListening:
+    /// ...; }</c> block that used to live independently in both
+    /// <c>LiveSessionCommandRouter.RouteTurbineChat</c> and
+    /// <c>DirectGameRuntimeCommandAdapter.TrySendChannel</c>. Returns
+    /// <c>null</c> when the gate allows the send to proceed to the wire.
+    /// </summary>
+    public static (string Text, RetailLogTextType Type)? ResolveRefusalText(
+        TurbineChatGateResult gate)
+    {
+        switch (gate.Status)
+        {
+            case TurbineChatGateStatus.Unavailable:
+                return (ClientTextRefusals.TurbineChatUnavailable, RetailLogTextType.Default);
+            case TurbineChatGateStatus.NotListening:
+                (string? text, RetailLogTextType type) =
+                    WeenieErrorMessages.Resolve(0x0551u, gate.DisplayName);
+                return text is not null ? (text, type) : null;
+            default:
+                return null;
+        }
+    }
 }

src/AcDream.Runtime/Session/DirectGameRuntimeCommandAdapter.cs

@@ -952,6 +952,22 @@ public sealed class DirectGameRuntimeCommandAdapter
         RuntimeChatChannel channel,
         string text)
     {
+        // S3 (CH3 Opus review): retail's @a stays bound to the legacy
+        // AllegianceBroadcast bitflag (0x02000000) until
+        // StartupTurbineChatSystem successfully starts Turbine chat (0x0295
+        // SetTurbineChatChannels received) and rebinds it to
+        // DoTurbineChat_Allegiance (research doc §4.3). "Turbine chat never
+        // started" is NOT the same case as "Turbine is up but this
+        // character has no allegiance room" (roomId == 0 with Enabled ==
+        // true), which keeps the "Turbine chat is not available." local
+        // refusal below at the membership gate's own Unavailable branch.
+        if (channel == RuntimeChatChannel.Allegiance
+            && !_runtime.CommunicationOwner.TurbineChat.Enabled)
+        {
+            session.SendChannel(0x02000000u, text);
+            return true;
+        }
+
         if (TryMapTurbine(channel, out ChatChannelKindLite turbineKind))
         {
             // CH3 (2026-08-09): the SAME membership gate the graphical host
@@ -964,21 +980,16 @@ public sealed class DirectGameRuntimeCommandAdapter
                 _runtime.CharacterOwner.Options,
                 _runtime.CharacterOwner.IsOlthoiPlayer);
 
-            switch (gate.Status)
+            // N3 (CH3 Opus review): shared refusal-text mapping — see
+            // TurbineChatMembershipGate.ResolveRefusalText.
+            if (gate.Status != TurbineChatGateStatus.Allowed)
             {
-                case TurbineChatGateStatus.Unavailable:
+                if (TurbineChatMembershipGate.ResolveRefusalText(gate) is
-                    _runtime.CommunicationOwner.AddText(
+                    (string refusalText, RetailLogTextType refusalType))
-                        ClientTextRefusals.TurbineChatUnavailable,
-                        RetailLogTextType.Default);
-                    return true;
-                case TurbineChatGateStatus.NotListening:
                 {
-                    (string? refusal, RetailLogTextType type) =
+                    _runtime.CommunicationOwner.AddText(refusalText, refusalType);
-                        WeenieErrorMessages.Resolve(0x0551u, gate.DisplayName);
-                    if (refusal is not null)
-                        _runtime.CommunicationOwner.AddText(refusal, type);
-                    return true;
                 }
+                return true;
             }
 
             session.SendTurbineChatTo(

src/AcDream.Runtime/Session/LiveSessionEventRouter.cs

@@ -62,9 +62,11 @@ public sealed record LiveCharacterSessionBindings(
     // (options1, options2) pair whenever a fresh PlayerDescription lands —
     // AFTER Character.Options.Replace has already committed them. Lets the
     // graphical host reseed its Settings "Hear * Chat" draft from server
-    // truth (research doc §5.2/§6.4: the local ChatSettings.Default lies
+    // truth (research doc §5.2/§6.4) so a per-character persisted
-    // relative to ACE's CharacterOptions2.Default). Optional/nullable so
+    // settings.json that diverges from the server (an older save, or a
-    // every existing caller compiles unchanged.
+    // changed allegiance/society) always converges back to what ACE
+    // actually has — the server, not any local default, is authoritative.
+    // Optional/nullable so every existing caller compiles unchanged.
     Action<uint, uint>? OnCharacterOptionsChanged = null);
 
 public sealed record LiveSocialSessionBindings(

src/AcDream.UI.Abstractions/Panels/Settings/ChatSettings.cs

@@ -21,6 +21,19 @@ namespace AcDream.UI.Abstractions.Panels.Settings;
 /// Settings UI does not expose one either — Allegiance chat membership rides
 /// allegiance membership, not a standalone preference.
 /// </para>
+///
+/// <para>
+/// N5 (CH3 Opus review, 2026-08-09): the server-backed sync/publish
+/// wiring above covers ONLY the five Hear*Chat fields.
+/// <see cref="AppearOffline"/>, <see cref="ShowTimestamps"/>, and
+/// <see cref="FilterProfanity"/> each correspond to a real retail
+/// <c>CharacterOptions2</c> bit (per the field comments below) but are
+/// deliberately NOT wired to <c>SyncChatFromServerOptions</c> or
+/// <c>SaveChat</c>'s <c>SetSingleCharacterOption</c> publish — they stay
+/// local-only display preferences. Do not extend the sync/publish pair to
+/// them without a corresponding design decision; today they are read and
+/// written from <c>settings.json</c> alone.
+/// </para>
 /// </summary>
 public sealed record ChatSettings(
     // CharacterOptions2 (32-bit) channel filters.
@@ -35,13 +48,23 @@ public sealed record ChatSettings(
     // Visual / UX (no retail bitfield).
     float FontSize)                      // chat panel font, 10..20 pt
 {
-    /// <summary>Sensible starting values matching the retail "all on" stance.</summary>
+    /// <summary>
+    /// N4 (CH3 Opus review): matches ACE's ACTUAL
+    /// <c>CharacterOptions2.Default (0x00948700)</c> stance for the five
+    /// server-backed Hear*Chat bits — General/Trade/LFG are on, but
+    /// Roleplay (<c>0x800</c>) and Society (<c>0x80000</c>) are OFF (research
+    /// doc §5.2). The prior "matching the retail 'all on' stance" comment
+    /// here was wrong: two of the five synced flags are off by default. The
+    /// server reseed at login (<c>SyncChatFromServerOptions</c>) remains
+    /// authoritative regardless of this constant — this is only the
+    /// pre-login / never-connected starting value.
+    /// </summary>
     public static ChatSettings Default { get; } = new(
         HearGeneralChat:    true,
         HearTradeChat:      true,
         HearLFGChat:        true,
-        HearRoleplayChat:   true,
+        HearRoleplayChat:   false,
-        HearSocietyChat:    true,
+        HearSocietyChat:    false,
         AppearOffline:      false,
         ShowTimestamps:     true,
         FilterProfanity:    true,

tests/AcDream.App.Tests/Net/GameWindowLiveSessionOwnershipTests.cs

@@ -100,6 +100,28 @@ public sealed class GameWindowLiveSessionOwnershipTests
                 StringComparison.Ordinal));
     }
 
+    [Fact]
+    public void ProductionSourceConstructsOnlyOneLiveSessionCommandSurface()
+    {
+        // CH3 review S5(b): LiveSessionCommandSurface has no dependencies of
+        // its own — CH3 deliberately hoisted its single construction site
+        // (SessionPlayerComposition.cs) so RuntimeSettingsTargets and the
+        // retained UI's chat/inventory panels share the SAME generation-
+        // gated command route. A second construction site anywhere under
+        // src/AcDream.App would silently split that route into two, each
+        // with its own activation/dispose lifecycle.
+        string root = FindRepositoryRoot();
+        string appRoot = Path.Combine(root, "src", "AcDream.App");
+
+        int total = Directory
+            .EnumerateFiles(appRoot, "*.cs", SearchOption.AllDirectories)
+            .Sum(path => CountOccurrences(
+                File.ReadAllText(path),
+                "new LiveSessionCommandSurface("));
+
+        Assert.Equal(1, total);
+    }
+
     [Theory]
     [InlineData("TryStartLiveSession")]
     [InlineData("ClearInboundEntityState")]

tests/AcDream.App.Tests/Net/LiveSessionCommandRouterTests.cs

@@ -174,19 +174,29 @@ public sealed class LiveSessionCommandRouterTests
     }
 
     [Fact]
-    public void AllegianceWithNoRoom_RefusesLocally_NeverDowngradesToLegacyChannel()
+    public void AllegianceTurbineEnabledButNoRoom_RefusesLocally_NeverDowngradesToLegacyChannel()
     {
-        // The CH3 headline /a bug (research doc §5.3): retail's @a is bound
+        // S3 (CH3 Opus review, 2026-08-09) corrected the original CH3
-        // unconditionally to Turbine — no allegiance must refuse locally,
+        // headline /a fix (research doc §5.3): retail's @a is bound to
-        // NOT silently fall through to the legacy AllegianceBroadcast
+        // Turbine only once StartupTurbineChatSystem succeeds — i.e. once
-        // bitflag.
+        // Turbine chat is ENABLED. With Turbine up but no allegiance room
+        // (this test), retail hits SendTurbineChat's own roomId<=0 branch
+        // and refuses locally — it must NOT fall through to the legacy
+        // AllegianceBroadcast bitflag. (Contrast the Enabled==false case
+        // below, which DOES fall back — Turbine was never started at all.)
         var communication = new RuntimeCommunicationState();
         var legacySent = new List<(uint Id, string Text)>();
         var turbineSent = new List<string>();
+        var turbine = new TurbineChatState();
+        turbine.OnChannelsReceived(
+            allegianceRoom: 0u, generalRoom: 0x70000001u, tradeRoom: 0u,
+            lfgRoom: 0u, roleplayRoom: 0u, olthoiRoom: 0u, societyRoom: 0u,
+            societyCelestialHandRoom: 0u, societyEldrytchWebRoom: 0u,
+            societyRadiantBloodRoom: 0u); // Enabled = true, AllegianceRoom stays 0
         var router = NewRouter(
             chat: communication.Chat,
             communication: communication,
-            turbine: new TurbineChatState(), // AllegianceRoom stays 0
+            turbine: turbine,
             sendChannel: (id, text) => legacySent.Add((id, text)),
             sendTurbine: (_, _, _, _, text, _) => turbineSent.Add(text));
         router.Activate();
@@ -201,10 +211,40 @@ public sealed class LiveSessionCommandRouterTests
     }
 
     [Fact]
-    public void AllegianceBroadcast_AbVerbChannel_RoutesLegacyWithSelfEcho()
+    public void AllegianceTurbineNeverStarted_FallsBackToLegacyAllegianceBroadcast()
+    {
+        // S3 (CH3 Opus review, 2026-08-09): retail's BASE binding keeps /a
+        // on the legacy AllegianceBroadcast (0x02000000) channel until
+        // Turbine chat successfully starts and StartupTurbineChatSystem
+        // rebinds it (research doc §4.3) — with NO 0x0295
+        // SetTurbineChatChannels ever received, retail does not print
+        // "Turbine chat is not available." (that refusal only exists once
+        // the Turbine-bound verb has actually been armed).
+        var chat = new ChatLog();
+        var legacySent = new List<(uint Id, string Text)>();
+        var turbineSent = new List<string>();
+        var router = NewRouter(
+            chat: chat,
+            turbine: new TurbineChatState(), // never received SetTurbineChatChannels
+            sendChannel: (id, text) => legacySent.Add((id, text)),
+            sendTurbine: (_, _, _, _, text, _) => turbineSent.Add(text));
+        router.Activate();
+
+        router.Publish(new SendChatCmd(ChatChannelKind.Allegiance, null, "guild hi"));
+
+        Assert.Equal([(0x02000000u, "guild hi")], legacySent);
+        Assert.Empty(turbineSent);
+        // S1: AllegianceBroadcast is now a server-echoing channel — no
+        // local optimistic echo.
+        Assert.Equal(0, chat.Count);
+    }
+
+    [Fact]
+    public void AllegianceBroadcast_AbVerbChannel_RoutesLegacyWithNoLocalEcho()
     {
         // /ab (retail DoAllegianceBroadcast) rides the legacy 0x0147 pipe —
-        // distinct from /a, which is always Turbine now.
+        // distinct from /a, which routes through Turbine whenever Turbine
+        // chat is enabled (see the two Allegiance tests above).
         var chat = new ChatLog();
         var legacySent = new List<(uint Id, string Text)>();
         var router = NewRouter(
@@ -216,13 +256,10 @@ public sealed class LiveSessionCommandRouterTests
             ChatChannelKind.AllegianceBroadcast, null, "to the whole allegiance"));
 
         Assert.Equal([(0x02000000u, "to the whole allegiance")], legacySent);
-        Assert.Collection(
+        // S1 (CH3 Opus review): ACE's GameActionChatChannel handler
-            chat.Snapshot(),
+        // includes the sender in its real-name Allegiance.Members
-            entry =>
+        // broadcast, so the client must NOT also echo locally.
-            {
+        Assert.Equal(0, chat.Count);
-                Assert.Equal(ChatKind.Channel, entry.Kind);
-                Assert.Equal("Allegiance", entry.ChannelName);
-            });
     }
 
     // ── Campaign CH slice CH3: per-channel self-echo matrix ──
@@ -252,8 +289,15 @@ public sealed class LiveSessionCommandRouterTests
     }
 
     [Fact]
-    public void AllegianceBroadcast_KeepsLocalOptimisticEcho()
+    public void AllegianceBroadcast_SkipsLocalOptimisticEcho()
     {
+        // S1 (CH3 Opus review, 2026-08-09): flips this test's original
+        // (wrong) premise. ACE's GameActionChatChannel handler iterates
+        // player.Allegiance.Members — the sender IS a member, so their own
+        // line comes back with their real name through the SAME broadcast
+        // every other member gets. Retail agrees:
+        // ClientCommunicationSystem::DoAllegianceBroadcast @0x005761F0 has
+        // no AddTextToScroll of its own. Keeping a local echo double-prints.
         var chat = new ChatLog();
         var router = NewRouter(
             chat: chat,
@@ -263,9 +307,7 @@ public sealed class LiveSessionCommandRouterTests
         router.Publish(new SendChatCmd(
             ChatChannelKind.AllegianceBroadcast, null, "hi"));
 
-        Assert.Equal(1, chat.Count); // real-name broadcast includes the
+        Assert.Equal(0, chat.Count);
-                                     // sender — no separate "" echo, so the
-                                     // client keeps its own.
     }
 
     [Fact]

tests/AcDream.App.Tests/Settings/RuntimeSettingsControllerTests.cs

@@ -1,4 +1,5 @@
 using AcDream.App.Diagnostics;
+using AcDream.App.Net;
 using AcDream.App.Rendering;
 using AcDream.App.Settings;
 using AcDream.Core.Net.Messages;
@@ -243,6 +244,33 @@ public sealed class RuntimeSettingsControllerTests
         }
     }
 
+    [Fact]
+    public void ConcreteRuntimeTargetPublishesSetSingleCharacterOptionOntoTheBus()
+    {
+        // CH3 review S5(b): SaveChatPublishesSetSingleCharacterOption... above
+        // only proves RuntimeSettingsController calls the IRuntimeSettingsTargets
+        // INTERFACE (via the FakeRuntimeTargets test double) — nothing exercised
+        // the CONCRETE RuntimeSettingsTargets.SetSingleCharacterOption, which is
+        // the code that actually reaches the wire via ICommandBus.Publish. A
+        // silent unwiring there (wrong record, wrong bus, dropped call) would
+        // pass every test that only goes through the fake.
+        var bus = new CaptureCommandBus();
+        var target = new RuntimeSettingsTargets(
+            new InspectingDisplayWindowTarget(static _ => { }),
+            new RecordingQualityApplicationTarget([]),
+            new RecordingUiLockTarget([]),
+            bus,
+            static _ => { });
+
+        target.SetSingleCharacterOption(
+            (uint)CharacterOptionId.ListenToRoleplayChat, value: false);
+
+        var cmd = Assert.IsType<SetSingleCharacterOptionRuntimeCmd>(
+            Assert.Single(bus.Published));
+        Assert.Equal((uint)CharacterOptionId.ListenToRoleplayChat, cmd.OptionId);
+        Assert.False(cmd.Value);
+    }
+
     [Fact]
     public void SettingsViewModelSavePreservesSectionAndTargetOrder()
     {
@@ -314,28 +342,30 @@ public sealed class RuntimeSettingsControllerTests
             dispatcher,
             static _ => { });
 
-        // ChatSettings.Default starts every Hear*Chat bit true — flip one
+        // N4 (CH3 Opus review): ChatSettings.Default now matches ACE's real
-        // off first so the second edit below can flip it back on.
+        // CharacterOptions2.Default — Roleplay/Society start FALSE (only
-        Assert.True(viewModel.ChatDraft.HearRoleplayChat);
+        // General/Trade/LFG start true). Flip Roleplay ON first so the
-        viewModel.SetChat(viewModel.ChatDraft with { HearRoleplayChat = false });
+        // second edit below can flip it back off.
+        Assert.False(viewModel.ChatDraft.HearRoleplayChat);
+        viewModel.SetChat(viewModel.ChatDraft with { HearRoleplayChat = true });
         viewModel.Save();
 
         Assert.Equal(
-            [((uint)CharacterOptionId.ListenToRoleplayChat, false)],
+            [((uint)CharacterOptionId.ListenToRoleplayChat, true)],
             targets.SingleOptionCalls);
 
         targets.SingleOptionCalls.Clear();
         viewModel.SetChat(viewModel.ChatDraft with
         {
-            HearRoleplayChat = true,
+            HearRoleplayChat = false,
-            HearSocietyChat = false,
+            HearSocietyChat = true,
         });
         viewModel.Save();
 
         Assert.Equal(
         [
-            ((uint)CharacterOptionId.ListenToRoleplayChat, true),
+            ((uint)CharacterOptionId.ListenToRoleplayChat, false),
-            ((uint)CharacterOptionId.ListenToSocietyChat, false),
+            ((uint)CharacterOptionId.ListenToSocietyChat, true),
         ],
             targets.SingleOptionCalls);
     }
@@ -363,9 +393,20 @@ public sealed class RuntimeSettingsControllerTests
     public void SyncChatFromServerOptionsReseedsPersistedAndDraft()
     {
         // Research doc §5.2: ACE's CharacterOptions2.Default omits
-        // HearRoleplayChat/HearSocietyChat even though acdream's local
+        // HearRoleplayChat/HearSocietyChat. N4 (CH3 Opus review) aligned
-        // ChatSettings.Default claims both are on.
+        // ChatSettings.Default to that same stance, so this test now seeds
-        var storage = new FakeStorage();
+        // storage with an explicitly stale PERSISTED value (both on — e.g.
+        // a save from before N4, or a user who had enabled them) to prove
+        // the server sync corrects local state to the server's truth,
+        // rather than merely observing the two already agree.
+        var storage = new FakeStorage
+        {
+            ChatValue = ChatSettings.Default with
+            {
+                HearRoleplayChat = true,
+                HearSocietyChat = true,
+            },
+        };
         var controller = new RuntimeSettingsController(
             storage,
             static preset => QualitySettings.From(preset),
@@ -417,17 +458,16 @@ public sealed class RuntimeSettingsControllerTests
             static _ => { });
         storage.ClearEvents();
 
-        // ChatSettings.Default already has all five Hear*Chat bits on —
+        // N4 (CH3 Opus review): ChatSettings.Default now matches ACE's real
-        // options2 with only those five bits set (any other bits are
+        // CharacterOptions2.Default exactly — General/Trade/LFG on,
-        // irrelevant, the sync only masks these) reproduces exactly that,
+        // Roleplay/Society off. Syncing with that SAME bit pattern (any
-        // so the sync must be a true no-op.
+        // other bits are irrelevant, the sync only masks these five) must
-        const uint allFiveHearBitsOn =
+        // be a true no-op.
+        const uint aceDefaultHearBits =
             (uint)PlayerDescriptionParser.CharacterOptions2.HearGeneralChat
             | (uint)PlayerDescriptionParser.CharacterOptions2.HearTradeChat
-            | (uint)PlayerDescriptionParser.CharacterOptions2.HearLFGChat
+            | (uint)PlayerDescriptionParser.CharacterOptions2.HearLFGChat;
-            | (uint)PlayerDescriptionParser.CharacterOptions2.HearRoleplayChat
+        controller.SyncChatFromServerOptions(aceDefaultHearBits);
-            | (uint)PlayerDescriptionParser.CharacterOptions2.HearSocietyChat;
-        controller.SyncChatFromServerOptions(allFiveHearBitsOn);
 
         Assert.Equal(0, storage.ChatSaves);
     }
@@ -1061,6 +1101,17 @@ public sealed class RuntimeSettingsControllerTests
         }
     }
 
+    // CH3 review S5(b): records every ICommandBus.Publish call so a test can
+    // assert what the CONCRETE RuntimeSettingsTargets actually put on the
+    // bus, rather than only what the IRuntimeSettingsTargets fake recorded.
+    private sealed class CaptureCommandBus : ICommandBus
+    {
+        public readonly List<object> Published = new();
+
+        public void Publish<T>(T command) where T : notnull =>
+            Published.Add(command!);
+    }
+
     private sealed class InspectingDisplayWindowTarget(
         Action<DisplaySettings> apply)
         : IRuntimeDisplayWindowTarget

tests/AcDream.Core.Tests/Chat/ChatChannelInfoTests.cs

@@ -32,13 +32,19 @@ public sealed class ChatChannelInfoTests
     }
 
     [Fact]
-    public void Legacy_AllegianceBroadcastBitflag_IsNOTSelfEcho()
+    public void Legacy_AllegianceBroadcastBitflag_IsSelfEcho()
     {
-        // 0x02000000 AllegianceBroadcast is the read-only motd channel —
+        // S1 (CH3 Opus review, 2026-08-09): flips this test's original
-        // server does not echo client messages back on it (per holtburger
+        // (wrong) premise. ACE's GameActionChatChannel handler iterates
-        // chat.rs:492-507 predicate, only Fellow+Vassals+Patron+Monarch+CoVassals).
+        // player.Allegiance.Members — the sender IS a member, so their own
+        // line comes back with their real name through the SAME broadcast
+        // every other member gets (a different mechanism from holtburger's
+        // documented empty-sender resend for Fellow/Vassals/Patron/Monarch/
+        // CoVassals, but the same self-echo consequence). Retail agrees:
+        // ClientCommunicationSystem::DoAllegianceBroadcast @0x005761F0 has
+        // no AddTextToScroll of its own.
         var c = new ChatChannelInfo.Legacy(0x02000000u, "AllegianceBroadcast");
-        Assert.False(c.IsSelfEchoChannel());
+        Assert.True(c.IsSelfEchoChannel());
     }
 
     [Fact]

tests/AcDream.Runtime.Tests/Gameplay/TurbineChatMembershipGateTests.cs

@@ -159,6 +159,54 @@ public sealed class TurbineChatMembershipGateTests
                 ChatChannelKindLite.Society, turbine, options, false).Status);
     }
 
+    // ── N3 (CH3 Opus review): shared refusal-text mapping ──
+
+    [Fact]
+    public void ResolveRefusalText_AllowedGate_ReturnsNull()
+    {
+        TurbineChatState turbine = ReceivedRooms();
+        var options = new RuntimeCharacterOptionsState();
+        TurbineChatGateResult gate = TurbineChatMembershipGate.Evaluate(
+            ChatChannelKindLite.General, turbine, options, isOlthoiPlayer: false);
+
+        Assert.Equal(TurbineChatGateStatus.Allowed, gate.Status);
+        Assert.Null(TurbineChatMembershipGate.ResolveRefusalText(gate));
+    }
+
+    [Fact]
+    public void ResolveRefusalText_UnavailableGate_ReturnsRetailUnavailableString()
+    {
+        var turbine = new TurbineChatState(); // never received SetTurbineChatChannels
+        var options = new RuntimeCharacterOptionsState();
+        TurbineChatGateResult gate = TurbineChatMembershipGate.Evaluate(
+            ChatChannelKindLite.General, turbine, options, isOlthoiPlayer: false);
+
+        (string Text, RetailLogTextType Type)? refusal =
+            TurbineChatMembershipGate.ResolveRefusalText(gate);
+
+        Assert.NotNull(refusal);
+        Assert.Equal(ClientTextRefusals.TurbineChatUnavailable, refusal!.Value.Text);
+    }
+
+    [Fact]
+    public void ResolveRefusalText_NotListeningGate_ReturnsWeenieErrorString()
+    {
+        TurbineChatState turbine = ReceivedRooms();
+        var options = new RuntimeCharacterOptionsState();
+        options.Replace(options.Options1, 0u); // every Hear*Chat bit off
+        TurbineChatGateResult gate = TurbineChatMembershipGate.Evaluate(
+            ChatChannelKindLite.General, turbine, options, isOlthoiPlayer: false);
+
+        (string Text, RetailLogTextType Type)? refusal =
+            TurbineChatMembershipGate.ResolveRefusalText(gate);
+
+        Assert.NotNull(refusal);
+        (string? expectedText, RetailLogTextType expectedType) =
+            WeenieErrorMessages.Resolve(0x0551u, gate.DisplayName);
+        Assert.Equal(expectedText, refusal!.Value.Text);
+        Assert.Equal(expectedType, refusal.Value.Type);
+    }
+
     private static TurbineChatState ReceivedRooms(
         uint allegianceRoom = 0x10u,
         uint generalRoom = 0x11u,

tests/AcDream.Runtime.Tests/Session/LiveSessionEventRouterTests.cs

@@ -1,9 +1,11 @@
+using System.Buffers.Binary;
 using System.Net;
 using System.Reflection;
 using AcDream.Core.Chat;
 using AcDream.Core.Combat;
 using AcDream.Core.Items;
 using AcDream.Core.Net;
+using AcDream.Core.Net.Messages;
 using AcDream.Core.Player;
 using AcDream.Core.Properties;
 using AcDream.Core.Social;
@@ -238,6 +240,56 @@ public sealed class LiveSessionEventRouterTests
         router.Dispose();
     }
 
+    [Fact]
+    public void PlayerDescription_ReplacesOptionsBeforeInvokingOnCharacterOptionsChanged()
+    {
+        // CH3 review S5(a): the §6.4 seeding chain
+        // (LiveSessionEventRouter.cs:208-212) is
+        // `character.Character.Options.Replace(...)` THEN
+        // `character.OnCharacterOptionsChanged?.Invoke(...)`. Nothing
+        // previously asserted this glue lambda itself — only
+        // GameEventWiring.WireAll's own onCharacterOptions?.Invoke — so a
+        // silent unwiring of either half would go unnoticed by the suite.
+        using var session = NewSession();
+        var character = new RuntimeCharacterState();
+        var observed = new List<(uint Options1, uint Options2, uint LiveOptions1AtCallback)>();
+
+        var router = new LiveSessionEventRouter(
+            session,
+            NoOpEntitySink(),
+            NoOpEnvironmentSink(),
+            NewInventoryBindings(),
+            new LiveCharacterSessionBindings(
+                new CombatState(),
+                character,
+                ResolveSkillFormulaBonus: null,
+                OnSkillsUpdated: null,
+                OnConfirmationRequest: null,
+                OnConfirmationDone: null,
+                ClientTime: () => 0d,
+                OnCharacterOptionsChanged: (options1, options2) =>
+                    observed.Add((options1, options2, character.Options.Options1))),
+            NewSocialBindings());
+        router.Attach();
+
+        session.GameEvents.Dispatch(
+            GameEventEnvelope.TryParse(
+                WrapPlayerDescriptionEnvelope(0x50C4A54Au, 0x00948700u))!.Value);
+
+        var (options1, options2, liveOptions1AtCallback) = Assert.Single(observed);
+        Assert.Equal(0x50C4A54Au, options1);
+        Assert.Equal(0x00948700u, options2);
+        // If Replace ran AFTER the callback (or not at all), a listener
+        // reading character.Options from inside the callback — exactly
+        // what a Settings-panel seed handler does — would observe the
+        // stale default instead of the just-received value.
+        Assert.Equal(0x50C4A54Au, liveOptions1AtCallback);
+        Assert.Equal(0x50C4A54Au, character.Options.Options1);
+        Assert.Equal(0x00948700u, character.Options.Options2);
+
+        router.Dispose();
+    }
+
     [Fact]
     public void NestedRouters_DisposeOlderFirstLeavesOnlyNewerRouter()
     {
@@ -382,7 +434,7 @@ public sealed class LiveSessionEventRouterTests
         const uint playerGuid = 0x50000001u;
         var objects = new ClientObjectTable();
         var character = new RuntimeCharacterState();
-        character.InstallSpellMetadata(SpellTable.LoadFromReader(new StringReader(
+        character.InstallSpellMetadata(SpellTable.LoadFromReader(new System.IO.StringReader(
             "Spell ID,Name,Flags [Hex]\n42,Strength Test,0x4\n")));
         int movementStatsUpdated = 0;
 
@@ -621,6 +673,38 @@ public sealed class LiveSessionEventRouterTests
         new FriendsState(),
         new SquelchState());
 
+    // Minimal PlayerDescription (0x0013) body carrying only the
+    // CharacterOptions1/2 trailer fields — mirrors
+    // GameEventWiringTests.WireAll_PlayerDescription_PublishesCharacterOptions's
+    // fixture layout.
+    private static byte[] WrapPlayerDescriptionEnvelope(uint options1, uint options2)
+    {
+        var stream = new MemoryStream();
+        using (var writer = new BinaryWriter(stream, System.Text.Encoding.UTF8, leaveOpen: true))
+        {
+            writer.Write(0u);       // property flags
+            writer.Write(0x52u);    // player weenie type
+            writer.Write(0u);       // vector flags
+            writer.Write(0u);       // has health
+            writer.Write(0x40u);    // option flags: CharacterOptions2
+            writer.Write(options1);
+            writer.Write(0u);       // legacy hotbar count
+            writer.Write(0u);       // spellbook filters
+            writer.Write(options2);
+            writer.Write(0u);       // inventory count
+            writer.Write(0u);       // equipped count
+        }
+
+        byte[] payload = stream.ToArray();
+        byte[] body = new byte[GameEventEnvelope.HeaderSize + payload.Length];
+        BinaryPrimitives.WriteUInt32LittleEndian(body,            GameEventEnvelope.Opcode);
+        BinaryPrimitives.WriteUInt32LittleEndian(body.AsSpan(4),  0u);
+        BinaryPrimitives.WriteUInt32LittleEndian(body.AsSpan(8),  0u);
+        BinaryPrimitives.WriteUInt32LittleEndian(body.AsSpan(12), (uint)GameEventType.PlayerDescription);
+        Array.Copy(payload, 0, body, GameEventEnvelope.HeaderSize, payload.Length);
+        return body;
+    }
+
     private static WorldSession NewSession() =>
         new(new IPEndPoint(IPAddress.Loopback, 9));
 

tests/AcDream.UI.Abstractions.Tests/Panels/Settings/ChatSettingsTests.cs

@@ -8,14 +8,18 @@ namespace AcDream.UI.Abstractions.Tests.Panels.Settings;
 public sealed class ChatSettingsTests
 {
     [Fact]
-    public void Default_values_are_all_channels_on_with_timestamps_and_filter()
+    public void Default_values_match_AceCharacterOptions2Default_stance()
     {
+        // N4 (CH3 Opus review): ACE's real CharacterOptions2.Default
+        // (0x00948700) turns General/Trade/LFG on but leaves Roleplay
+        // (0x800) and Society (0x80000) off — this is no longer an
+        // invented "all channels on" stance.
         var d = ChatSettings.Default;
         Assert.True(d.HearGeneralChat);
         Assert.True(d.HearTradeChat);
         Assert.True(d.HearLFGChat);
-        Assert.True(d.HearRoleplayChat);
+        Assert.False(d.HearRoleplayChat);
-        Assert.True(d.HearSocietyChat);
+        Assert.False(d.HearSocietyChat);
         Assert.False(d.AppearOffline);
         Assert.True(d.ShowTimestamps);
         Assert.True(d.FilterProfanity);