ISSUE-041: make session teardown survive a failing SignOut, and start measuring connection silence

[meketreve]

Addresses part of ISSUE-041 — characters
staying online after the player has gone. The reasoning behind it is on that issue; this is what came
out of it.

It does not close the issue, and the parts it leaves open are named below rather than left for a
reader to discover.

The defect

There is one session teardown path and both a clean logout and a dropped connection reach it
identically: Session.Disconnect(safeLogout) calls ForceQuit, which ends in
_connection.Disconnect() — the same call a lost socket makes.

Session.OnDisconnected completed its transaction and only then raised Disconnected, on the next
line and outside it. SessionManager.Remove is a subscriber to that event. So an exception anywhere
inside SignOut() skipped the removal:

• the session stayed in _sessions, and its Player stayed in the zone tick for the life of the
  process
• the rolled-back inuse = 0 left the character shown as online
• TcpConnection runs the whole teardown under LogExceptions, so the only trace was one logged
  exception and nothing else

A second variant needed no rollback at all: Disconnected is a plain multicast invoke,
SessionManager.OnSessionDisconnected is subscribed to it before Remove is, and a multicast
delegate stops at the first subscriber that throws.

The fix

Raising Disconnected moves into a finally, so the session leaves _sessions whether or not
SignOut() succeeded. SessionManager.OnSessionDisconnected contains its own failure so it cannot
cancel the Remove subscribed after it.

The exception is still allowed to leave Session.OnDisconnected deliberately. What throws is a
separate and still unanswered question, and swallowing it would make that question harder to answer,
not easier.

The measurement, and why there is no timeout in here

An idle timeout is the other half of this issue, and it needs a threshold that cannot be chosen from
inside this repository. The client sends zero-length keepalive packets — they arrive as data, since
they still carry their four length bytes — but their interval is a client decision. A threshold set
below it disconnects players who are still connected, which is a worse failure than the one being
fixed.

So this ships the measurement rather than a guess. ConnectionActivity records when data last arrived
and the widest gap between two receives; TcpConnection touches it on every receive; both numbers are
logged when a connection closes:

connection closed. 1.2.3.4:5678 silent for 3.4s, longest gap 12.1s

Nothing disconnects on those numbers. Read them off a live server, then the threshold can be set
from data and the timeout enabled. Worth noting the timeout belongs on the relay connection rather than
on ZoneSession, whose existing InactiveTime only covers players who are currently in a zone.

One design detail the tests forced: a gap that is still open does not count towards the longest. A
connection whose peer vanished an hour ago would otherwise report a one-hour keepalive interval and
poison the very measurement this exists to collect.

Test coverage, stated plainly

ConnectionActivity has 11 unit tests, written before the type existed and observed failing against
its absence. They inject "now" rather than sleeping.

The teardown change is covered by inspection only. Session takes a raw Socket in its
constructor and builds its connection from it, and SessionManager.Add is private and reachable only
through a real TcpListener accept — neither can be exercised at the unit tier without adding a
production seam, and that seemed like a bigger request than a fix should smuggle in. If you would
rather have the seam (a Session constructor taking ITcpConnection, which touches Session.Factory
and the Autofac registration), say so and it can be a separate pull request with the tests that seam
makes possible.

What is still open

This stops the session leaking and stops a dead Player being ticked forever. It does not put the
character offline when the transaction rolls back: Character.IsOnline is the characters.inuse
column, so a rolled-back SignOut() leaves the player shown as online until they next sign in, at
which point SignIn clears it. Fixing that means a compensating write outside the failed transaction,
in a catch path, and that is a design decision that should not be made while the thing being
compensated for is still unnamed.

The question that unblocks the rest

Both open parts need the same thing — a look at a live log. [Relay] client disconnected. is written
by a subscriber to Disconnected, so before this change it could only appear when the event fired. In
a window where a ghost was reported, was there a logged exception with no matching
[Relay] client disconnected. line? That confirms the mechanism and names what throws.

Validation

Solution builds with 0 errors and no new warnings on the changed files. Tier 2 84/84 (73 before, 11
new), tier 3 10/10, neither skipped. tools/smoke-test.ps1 green: online in 78 s, 6425 members,
graceful shutdown in 28 s, exit 0.

The backlog entry is updated in the same branch: status IN_PROGRESS, each step marked with what
actually shipped, and the open half written up as its own section so it is not mistaken for done.