fix(ui,net): Campaign LA gate round 2 — char-select exit confirmation, authored row justify, world name

Finding 1 (Exit button dead): retail's gmCharacterManagementUI Exit
button (element 0x100003A4, offset 7 from the listbox base in
ListenToElementMessage@0x004ed5a0) opens MakeConfirmExitDialog
(0x004ed250), whose exact ID_CharacterManagement_ConfirmExit text
(table 0x23000002) and m_confirmExitDialogContext re-entry guard are
now ported. On confirm (matching RecvNotice_CloseDialog@0x004ed760
case 1's ConfirmationResult check) the client exits through the
EXISTING graceful window-close seam (CharacterSelectionRuntimeBindings
.RequestExit -> d.Window.Close, the same delegate
GameplayInputCommandController's Escape fallback already uses) so
disconnected/exited status events still fire via GameWindow.OnClosing
-> CompleteShutdown. Retail's real post-confirm destination is
QueueUIMode(0x10000009) -> gmEpilogueUI, an epilogue screen this round
does not port — recorded as AD-99. Credits (element 0x100003A3,
QueueUIMode(0x10000005) -> gmCreditsUI) stays visibly ghosted like
Create, same treatment, out of scope this round.

Finding 2 (row names center-aligned, retail is left): the character
row template (LayoutDesc 0x21000004, element 0x100003A5, live-DAT
confirmed HJustify=Left with three stateful Type-3 highlight-art
children and no Type-12 caption child) authors its OWN justify
directly, with no separate text child to lift a label from.
DatWidgetFactory.BuildButton's Left-justify branch required
!ReferenceEquals(labelInfo, info) — true only when a label was LIFTED
from a distinct child — so a button's own direct HJustify=Left was
silently dropped to UiButton's Center default. Widened the branch to
also honor the direct case, preserving the existing lifted-child
LabelOffsetX behavior and leaving genuinely-centered buttons
(CREATE/ENTER/DELETE/RESTORE) untouched.

Finding 3 (World box empty): parsed ACE's GameMessageServerName
(opcode 0xF7E1, ACE.Server/Network/GameMessages/Messages/
GameMessageServerName.cs; retail CM_Login::DispatchUI_WorldInfo
@0x006ad860 -> ClientUISystem::Handle_Login__WorldInfo@0x005641a0 ->
ECM_Login::SendNotice_WorldName@0x00692b10, notice 0x186a2, consumed
by gmCharacterManagementUI::UpdateWorldName@0x004ec120 /
RecvNotice_WorldName@0x004ec360 onto element 0x1000039B) as
src/AcDream.Core.Net/Messages/ServerName.cs, cross-checked against
holtburger's ServerNameData. WorldSession.ServerNameReceived fires
alongside CharacterListReceived (ACE sends both in one
SendConnectResponse batch); RuntimeCharacterSelectionState.
ApplyWorldName is the new J-owner field (ungated by lifecycle, since
either message can arrive first); CharacterManagementUiController
binds it onto the WorldTextElementId UiText. Per the LA1 status
vocabulary, the characterList STATUS event's worldName field is
intentionally NOT added this round (kept bounded to the client-side
fix) — a follow-up if the launcher UI wants it.

Also corrects AD-44, discovered stale while filing AD-99: its opening
claim ("acdream has no retained character-management screen") was
false as of this session — LA7/LA8 shipped the screen in earlier
commits without updating this row.

Tests: exit-confirm open/cancel/confirm/re-entry-guard flow;
DatWidgetFactory own-HJustify-Left/Center regression tests plus the
live-DAT pinned row-justify assertion; ServerName parse round-trip
(byte-exact vs ACE's AceWireWriter fixture, truncation/wrong-opcode
cases); WorldSession dispatch test (roster+world in one wire batch);
RuntimeCharacterSelectionState.ApplyWorldName tests (order-independent
of ApplyRoster, unchanged-value no-op, Reset clears); controller test
binding the World text element to the live snapshot. Extended the
shared RetailDialogFactoryTests.BuildDialogLayout test fixture with a
Confirmation-type branch (Accept/Reject buttons) since this is its
first RetailDialogType.Confirmation consumer.

Suites: full solution Release build green; AcDream.App.Tests 5100/6
skips, AcDream.Core.Net.Tests 965/0, AcDream.Runtime.Tests 1665/0, all
Release, 0 failures; live-DAT probes (ACDREAM_PROBE_LIVE_MOUNT=1)
green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/AcDream.Core.Net/Messages/ServerName.cs

@@ -0,0 +1,90 @@
+using System.Buffers.Binary;
+
+namespace AcDream.Core.Net.Messages;
+
+/// <summary>
+/// Inbound <c>ServerName</c> GameMessage (opcode <c>0xF7E1</c>). ACE sends
+/// this in the SAME batch as <see cref="CharacterList"/>, right after
+/// <c>AuthConnectResponse</c> completes — it is the world (server) name the
+/// retail character-select screen's "World" box shows.
+///
+/// <para>
+/// Retail wire path: <c>CM_Login::DispatchUI_WorldInfo@0x006ad860</c> checks
+/// the leading opcode against <c>0xf7e1</c>, unpacks the trailing
+/// <c>PStringBase&lt;char&gt;</c>, and calls
+/// <c>ClientUISystem::Handle_Login__WorldInfo@0x005641a0(currentConnections,
+/// maxConnections, worldName)</c>, which forwards only the name to
+/// <c>ECM_Login::SendNotice_WorldName@0x00692b10</c> (notice id
+/// <c>0x186a2</c>). <c>gmCharacterManagementUI</c> registers for that notice
+/// in its ctor (<c>0x004ec8f0</c>) and both
+/// <c>RecvNotice_WorldName@0x004ec360</c> and its own
+/// <c>UpdateWorldName@0x004ec120</c> resolve child element <c>0x1000039B</c>
+/// (<c>UIElement::GetChildRecursive(m_rootField, 0x1000039b)</c>, dynamic-cast
+/// to <c>UIElement_Text</c>) and call
+/// <c>UIElement_Text::SetText(Client::GetInstance()->GetWorldName())</c> —
+/// <c>Client::GetWorldName@0x00401ca0</c>/<c>SetWorldName@0x00402090</c> just
+/// hold the string the notice delivered. The two leading dwords
+/// (currentConnections/maxConnections) are read off the wire by the
+/// dispatcher but never consumed by the character-management screen itself.
+/// </para>
+///
+/// <para>
+/// ACE: <c>GameMessageOpcode.ServerName = 0xF7E1</c>
+/// (<c>ACE.Server/Network/GameMessages/GameMessageOpcode.cs</c>);
+/// <c>GameMessageServerName</c>
+/// (<c>ACE.Server/Network/GameMessages/Messages/GameMessageServerName.cs</c>)
+/// writes <c>i32 currentConnections, i32 maxConnections, String16L
+/// serverName</c>; sent from
+/// <c>AuthenticationHandler.SendConnectResponse</c>
+/// (<c>ACE.Server/Network/Handlers/AuthenticationHandler.cs:258</c>)
+/// alongside <c>GameMessageCharacterList</c> and
+/// <c>GameMessageDDDInterrogation</c>. holtburger's
+/// <c>ServerNameData</c>
+/// (<c>holtburger-protocol/src/messages/character/types.rs</c>) parses the
+/// same three fields and cross-checks the field order/types.
+/// </para>
+///
+/// <code>
+///   u32 opcode              (0xF7E1)
+///   i32 currentConnections
+///   i32 maxConnections
+///   String16L worldName
+/// </code>
+/// </summary>
+public static class ServerName
+{
+    public const uint Opcode = 0xF7E1u;
+
+    public readonly record struct Parsed(
+        int CurrentConnections,
+        int MaxConnections,
+        string WorldName);
+
+    /// <summary>
+    /// Parse a ServerName body. <paramref name="body"/> must start with the
+    /// 4-byte opcode (0xF7E1) — i.e. pass the full reassembled GameMessage
+    /// output from <see cref="AcDream.Core.Net.Packets.FragmentAssembler"/>.
+    /// </summary>
+    public static Parsed Parse(ReadOnlySpan<byte> body)
+    {
+        int pos = 0;
+
+        uint opcode = ReadU32(body, ref pos);
+        if (opcode != Opcode)
+            throw new FormatException($"expected ServerName opcode 0x{Opcode:X4}, got 0x{opcode:X8}");
+
+        int currentConnections = unchecked((int)ReadU32(body, ref pos));
+        int maxConnections = unchecked((int)ReadU32(body, ref pos));
+        string worldName = StringReader.ReadString16L(body, ref pos);
+
+        return new Parsed(currentConnections, maxConnections, worldName);
+    }
+
+    private static uint ReadU32(ReadOnlySpan<byte> source, ref int pos)
+    {
+        if (source.Length - pos < 4) throw new FormatException("truncated u32");
+        uint value = BinaryPrimitives.ReadUInt32LittleEndian(source.Slice(pos));
+        pos += 4;
+        return value;
+    }
+}

src/AcDream.Core.Net/WorldSession.cs

@@ -599,6 +599,12 @@ public sealed class WorldSession : IDisposable
     public event Action? CharacterDeleteAcknowledged;
     public event Action<CharacterRestore.Parsed>? CharacterRestoreReceived;
     public event Action<CharacterError.Parsed>? CharacterErrorReceived;
+    /// <summary>
+    /// Campaign LA gate round 2 finding 3: ACE sends this in the same batch
+    /// as <see cref="CharacterListReceived"/> (right after
+    /// AuthConnectResponse) — see <see cref="ServerName"/>.
+    /// </summary>
+    public event Action<ServerName.Parsed>? ServerNameReceived;
 
     /// <summary>
     /// Phase F.1: inbound 0xF7B0 GameEvent dispatcher. Each sub-opcode
@@ -691,6 +697,13 @@ public sealed class WorldSession : IDisposable
     }
 
     public CharacterList.Parsed? Characters { get; private set; }
+
+    /// <summary>
+    /// Campaign LA gate round 2 finding 3: last <see cref="ServerName"/>
+    /// (opcode 0xF7E1) received, mirroring <see cref="Characters"/>' shape —
+    /// ACE sends it in the same batch, right after AuthConnectResponse.
+    /// </summary>
+    public ServerName.Parsed? ServerInfo { get; private set; }
     private CharacterError.Parsed? _lastCharacterSelectionError;
 
     private readonly IWorldSessionTransport _net;
@@ -1789,6 +1802,22 @@ public sealed class WorldSession : IDisposable
                 Characters = parsed;
                 CharacterListReceived?.Invoke(parsed);
             }
+            else if (op == ServerName.Opcode)
+            {
+                ServerName.Parsed parsed;
+                try
+                {
+                    parsed = ServerName.Parse(body);
+                }
+                catch
+                {
+                    // Malformed management messages do not poison the
+                    // remaining ordered UIQueue fragments.
+                    continue;
+                }
+                ServerInfo = parsed;
+                ServerNameReceived?.Invoke(parsed);
+            }
             else if (op == CharacterDelete.Opcode
                 && CharacterDelete.IsAcknowledgement(body))
             {