feat(ui) Campaign CA CA4 #431: server-authoritative raises — the optimistic layer is deleted

Retail sends a raise and WAITS: one request in flight, the raise
controls ghost, and displayed state changes only when the authoritative
quality-change record lands (gmStatManagementUI @ 0x004F03F0 family,
pinned in docs/research/2026-07-10-retail-panel-behavior-pseudocode.md
§5, whose own conclusion names ApplyLocalRaise as the thing to remove).
The optimistic layer predates the inbound parsers — it existed so the
panel showed anything at all — and with CA2 delivering server truth it
became strictly harmful: against ACE, a wrong TrainSkill cost fails
SILENTLY, so the optimistic promote-and-debit could show a trained
skill the server refused with nothing to ever correct it.

Deleted: CharacterSheetProvider.ApplyLocalRaise + both spend helpers,
and LocalPlayerState's six optimistic mutators (ApplyAttributeRaise,
ApplyVitalRaise, ApplySkillRaise, ApplySkillTraining, DebitIntProperty,
DebitInt64Property) with their tests. Added: the one-in-flight latch in
HandleRaiseRequest, CharacterSheet.AwaitingRaise ghosting all raise
controls, and gate release on every authoritative quality signal
(attribute/character/player-property events unconditionally; vital
events only release-and-refresh while a raise is in flight, so regen
ticks stay out of the sheet-rebuild path). Panel unmount resets the
gate — retail's awaiting flag lives on the panel instance.

AP-73 NARROWS rather than retires: retail's release on a rejection that
produces NO quality change is statically unverifiable, and ACE sends
chat-only (Raise*) or nothing (RaiseSkill/TrainSkill) on failure; until
the CA5 live check, a silently-rejected request leaves the controls
ghosted until panel reopen — recorded with its observable symptom.

Also verified for CA4: the train button sends the DAT-exact TrainedCost
(ACE's silent exact-match rule), and there is correctly NO panel
specialize send — retail/ACE specialize only via the SkillAlterationDevice
item-use + confirmation round-trip, whose client seams
(SendConfirmationResponse 0x0275, the 0x028B WeenieErrorWithString chat
routing) already exist. Provider tests now pin the retail contract:
send-without-mutation, one-in-flight, release-on-record, release-on-
unmount, and the regen-tick rebuild guard. Full hermetic suite 15,327
passed / 0 failed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/AcDream.App.Tests/UI/Layout/CharacterSheetProviderTests.cs

@@ -142,7 +142,7 @@ public sealed class CharacterSheetProviderTests
     }
 
     [Fact]
-    public void HandleRaiseRequest_Attribute_SendsAndDebitsThroughTableEvents()
+    public void HandleRaiseRequest_Attribute_SendsWithoutMutation_AndLatchesOneInFlight()
     {
         var h = new Harness();
         h.AddPlayerObject(unassignedXp: 1000L);
@@ -153,11 +153,21 @@ public sealed class CharacterSheetProviderTests
         h.Provider.HandleRaiseRequest(new CharacterStatController.RaiseRequest(
             CharacterStatController.RaiseTargetKind.Attribute, StatId: 1u, Cost: 20L, Amount: 1));
 
+        // CA4 (retired AP-73): retail sends and WAITS — no local mutation of
+        // ranks or XP; displayed state changes only when the authoritative
+        // record lands (gmStatManagementUI, pseudocode doc §5).
         Assert.Equal((1u, 20ul), h.SentAttribute);
         var strength = h.Player.GetAttribute(LocalPlayerState.AttributeKind.Strength);
-        Assert.Equal(2u, strength!.Value.Ranks);                       // optimistic rank apply
-        Assert.Equal(980L, h.Table.Get(PlayerGuid)!.Properties.GetInt64(2u)); // XP debited
-        Assert.True(tableUpdates >= 1);                                // via the eventful API
+        Assert.Equal(1u, strength!.Value.Ranks);                        // unchanged
+        Assert.Equal(1000L, h.Table.Get(PlayerGuid)!.Properties.GetInt64(2u)); // undebited
+        Assert.Equal(0, tableUpdates);
+        Assert.True(h.Provider.BuildSheet().AwaitingRaise);
+
+        // One request in flight: a second click sends nothing.
+        h.SentAttribute = null;
+        h.Provider.HandleRaiseRequest(new CharacterStatController.RaiseRequest(
+            CharacterStatController.RaiseTargetKind.Attribute, StatId: 1u, Cost: 20L, Amount: 1));
+        Assert.Null(h.SentAttribute);
     }
 
     [Fact]
@@ -177,7 +187,7 @@ public sealed class CharacterSheetProviderTests
     }
 
     [Fact]
-    public void HandleRaiseRequest_TrainSkill_DebitsRetailSkillCreditProperty()
+    public void HandleRaiseRequest_TrainSkill_SendsExactDatCostWithoutMutation()
     {
         var h = new Harness();
         var player = h.AddPlayerObject();
@@ -189,26 +199,58 @@ public sealed class CharacterSheetProviderTests
             CharacterStatController.RaiseTargetKind.TrainSkill, StatId: 6u, Cost: 4L, Amount: 1));
 
         Assert.Equal((6u, 4u), h.SentTrain);
-        Assert.Equal(2u, h.Player.GetSkill(6u)!.Value.Status);          // promoted to trained
-        Assert.Equal(0, player.Properties.GetInt(0x18u));               // credits debited
+        // CA4: no optimistic promotion or credit debit — against ACE a wrong
+        // TrainSkill cost fails SILENTLY, so an optimistic apply could show
+        // a trained skill the server refused, forever.
+        Assert.Equal(1u, h.Player.GetSkill(6u)!.Value.Status);          // still untrained
+        Assert.Equal(4, player.Properties.GetInt(0x18u));               // credits intact
+        Assert.True(h.Provider.BuildSheet().AwaitingRaise);
     }
 
     [Fact]
-    public void SpendUnassignedXp_FallsBackToLocalPlayer_WhenPlayerObjectAbsent()
+    public void AwaitingRaise_ReleasesOnTheAuthoritativeRecord_AndOnPanelUnmount()
     {
-        var h = new Harness();   // note: nothing added to the table
-        var props = new PropertyBundle();
-        props.Int64s[2u] = 500L;
-        h.Player.OnProperties(props);
+        // Retail releases the one-in-flight gate on ANY quality-change
+        // message (ListenToElementMessage @ 0x004EFBE0); the CA2 inbound
+        // records arriving at LocalPlayerState are our equivalent. The gate
+        // also dies with the panel binding, matching retail's per-instance
+        // awaiting flag.
+        var h = new Harness();
+        h.AddPlayerObject(unassignedXp: 1000L);
         h.Player.OnAttributeUpdate(atType: 1u, ranks: 1u, start: 10u, xp: 10u);
-        int changed = 0;
-        h.Player.CharacterChanged += () => changed++;
+        int rebuilds = 0;
+        using (h.Provider.SubscribeChanged(() => rebuilds++))
+        {
+            h.Provider.HandleRaiseRequest(new CharacterStatController.RaiseRequest(
+                CharacterStatController.RaiseTargetKind.Attribute, StatId: 1u, Cost: 20L, Amount: 1));
+            Assert.True(h.Provider.BuildSheet().AwaitingRaise);
 
-        h.Provider.HandleRaiseRequest(new CharacterStatController.RaiseRequest(
-            CharacterStatController.RaiseTargetKind.Attribute, StatId: 1u, Cost: 100L, Amount: 1));
+            // The authoritative attribute record releases + refreshes.
+            h.Player.OnAttributeUpdate(atType: 1u, ranks: 2u, start: 10u, xp: 30u);
+            Assert.False(h.Provider.BuildSheet().AwaitingRaise);
+            Assert.True(rebuilds >= 1);
 
-        Assert.Equal(400L, h.Player.Properties.GetInt64(2u));   // debited on the LPS side
-        Assert.True(changed >= 1);                              // and CharacterChanged fired
+            // A vital regen tick outside a raise must NOT rebuild the sheet.
+            int before = rebuilds;
+            h.Player.OnVitalCurrent(vitalId: 2u, current: 50u);
+            Assert.Equal(before, rebuilds);
+
+            // But the full vital record answering a RaiseVital releases.
+            h.Provider.HandleRaiseRequest(new CharacterStatController.RaiseRequest(
+                CharacterStatController.RaiseTargetKind.Vital, StatId: 1u, Cost: 20L, Amount: 1));
+            Assert.True(h.Provider.BuildSheet().AwaitingRaise);
+            h.Player.OnVitalUpdate(vitalId: 1u, ranks: 1u, start: 10u, xp: 20u, current: 15u);
+            Assert.False(h.Provider.BuildSheet().AwaitingRaise);
+        }
+
+        // Panel unmount resets a still-held gate (silent-rejection recovery).
+        using (h.Provider.SubscribeChanged(() => { }))
+        {
+            h.Provider.HandleRaiseRequest(new CharacterStatController.RaiseRequest(
+                CharacterStatController.RaiseTargetKind.Attribute, StatId: 1u, Cost: 20L, Amount: 1));
+            Assert.True(h.Provider.BuildSheet().AwaitingRaise);
+        }
+        Assert.False(h.Provider.BuildSheet().AwaitingRaise);
     }
 
     // ── Issue #267 — vitae/buff-aware skill + attribute values ───────────────