fix(vendor): Slice 6 review corrections — ownership-checked retire, live slider display, drag-proof shop rows, hardened buy reservation

All nine findings from the buy-arc review, at root:

F1 the materializer's retire pass re-checks ownership (guid->vendorId
map; remove only while the live object's ContainerId still equals the
recording vendor) — buying a player-sold UNIQUE no longer deletes the
item you just purchased; the discriminating reparent-then-refresh test
pins it. F2 the cost/name display subscribes to the live split state
and shares ONE quantity computation with Buy (retail re-renders per
slider tick: RecvNotice_StackSliderChanged 0x004C4500) — the sentence
and the charge can no longer disagree. F3 shop rows never mint drag
payloads (UiItemSlot.AllowDragSource gates both IsDragSource AND
GetDragPayload — the second gate was caught by this pass's own test).
F4 sendBuy reports whether anything was sent; a null-session buy
cancels the reservation instead of leaking BusyCount forever.
F5 the retire loop snapshots, isolates per-guid observer failures, and
clears its tracking in finally and Dispose — teardown convergence can
no longer wedge. F6 auto-select is retail's unconditional
first-filtered-item shape (pc:201180-201184; the survival-check was
our invention and the comment claiming otherwise is corrected).
F7 non-stack buys clamp to quantity 1 locally (BuySingleItem
pc:201669). F8 the Add button is hard-disabled until staging exists.
F9 AP-161/162/163 rewritten to the post-fix reality.

Clean-room complete solution: 11,378 passed / 4 skipped / 0 failed.
The #350 render-ledger overflow observed this session is under
separate investigation and is NOT addressed here.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

tests/AcDream.App.Tests/UI/ItemInteractionControllerTests.cs

@@ -28,6 +28,11 @@ public sealed class ItemInteractionControllerTests
         public readonly List<(uint Item, uint Amount)> SplitDrops = new();
         public readonly List<(uint Target, uint Item, uint Amount)> Gives = new();
         public readonly List<(uint VendorGuid, uint ItemGuid, int Amount, uint AlternateCurrencyId)> Buys = new();
+        // F4 (Slice 6 review): simulates the composition-root sendBuy
+        // delegate's "no live session / not in world" no-op case —
+        // TryBuy must see this as false and release the reservation
+        // rather than mark it dispatched for a request nothing sent.
+        public bool SendBuySucceeds = true;
         public readonly List<string> Toasts = new();
         public readonly List<string> SystemMessages = new();
         public readonly List<CombatMode> CombatModeRequests = new();
@@ -97,7 +102,12 @@ public sealed class ItemInteractionControllerTests
                 sendChangeCombatMode: CombatModeRequests.Add,
                 requestUse: requestUse,
                 sendBuy: (vendorGuid, itemGuid, amount, alternateCurrencyId) =>
-                    Buys.Add((vendorGuid, itemGuid, amount, alternateCurrencyId)));
+                {
+                    if (!SendBuySucceeds)
+                        return false;
+                    Buys.Add((vendorGuid, itemGuid, amount, alternateCurrencyId));
+                    return true;
+                });
         }
 
         public ItemInteractionController Controller { get; }
@@ -2267,4 +2277,35 @@ public sealed class ItemInteractionControllerTests
 
         Assert.Equal(0, h.Controller.BusyCount);
     }
+
+    [Fact]
+    public void TryBuy_NoSessionToSendOn_ReleasesTheReservation_AndASubsequentBuyWorks()
+    {
+        // F4 (Slice 6 review): the composition-root sendBuy delegate
+        // returns false when there is no live session (or it's not in
+        // world) -- BEFORE this fix, sendBuy was a plain Action, so TryBuy
+        // could not tell "sent" apart from a silent no-op and always
+        // called MarkDispatched(). Since nothing was actually sent, no
+        // UseDone would ever arrive to balance it, leaking BusyCount and
+        // permanently wedging every future Use/Buy behind "You can only
+        // move or use one item at a time."
+        var h = new Harness();
+        h.SendBuySucceeds = false;
+
+        bool result = h.Controller.TryBuy(0x40001000u, 0x50002000u, 1, 0u);
+
+        Assert.False(result);
+        Assert.Empty(h.Buys);
+        // The reservation was cancelled, not dispatched -- the gate is
+        // free again immediately, with no UseDone needed to release it.
+        Assert.Equal(0, h.Controller.BusyCount);
+
+        // A subsequent buy, once a session IS available, proceeds normally.
+        h.SendBuySucceeds = true;
+        bool second = h.Controller.TryBuy(0x40001000u, 0x50002001u, 1, 0u);
+
+        Assert.True(second);
+        Assert.Single(h.Buys);
+        Assert.Equal(1, h.Controller.BusyCount);
+    }
 }

tests/AcDream.App.Tests/UI/Layout/VendorUiControllerTests.cs

@@ -176,7 +176,10 @@ public sealed class VendorUiControllerTests
                 sendDrop: null,
                 sendExamine: Examines.Add,
                 sendBuy: (vendorGuid, itemGuid, amount, alternateCurrencyId) =>
-                    Buys.Add((vendorGuid, itemGuid, amount, alternateCurrencyId)));
+                {
+                    Buys.Add((vendorGuid, itemGuid, amount, alternateCurrencyId));
+                    return true;
+                });
 
             Controller = VendorUiController.Bind(
                 layout,
@@ -293,6 +296,15 @@ public sealed class VendorUiControllerTests
         });
 
         h.ItemList.GetItem(0)!.Clicked?.Invoke();
+        // F2 (Slice 6 review): the display now reads the LIVE split state
+        // instead of recomputing a static seed. Production seeds this via
+        // SelectedObjectController (mounted on the toolbar, subscribed to
+        // SelectionState.Changed BEFORE VendorUiController — RetailUiRuntime
+        // MountToolbar() runs before MountVendor()); this harness doesn't
+        // mount that controller, so the test seeds SplitQuantity directly to
+        // stand in for it, matching the SAME not-exempt full-stack seed
+        // SelectedObjectController.ApplySelection would have computed.
+        h.SplitQuantity.Reset(100u, initialValue: 100u);
 
         // No authored PluralName -> ACCWeenieObject::GetObjectName falls back
         // to the singular name UNCHANGED (not an invented "Arrows" + "s").
@@ -319,6 +331,10 @@ public sealed class VendorUiControllerTests
         });
 
         h.ItemList.GetItem(0)!.Clicked?.Invoke();
+        // F2: exempt seed is 1 regardless of the 50-unit authored stack —
+        // see the split-exempt comment on the sibling test above for why
+        // this harness seeds SplitQuantity explicitly.
+        h.SplitQuantity.Reset(50u, initialValue: 1u);
 
         Assert.Equal("Bread", GetText(h.ItemNameText));
         Assert.Equal(
@@ -338,10 +354,56 @@ public sealed class VendorUiControllerTests
         });
 
         h.ItemList.GetItem(0)!.Clicked?.Invoke();
+        // F2: Key is not split-exempt -> full authored stack (10).
+        h.SplitQuantity.Reset(10u, initialValue: 10u);
 
         Assert.Equal("10 Iron Keys", GetText(h.ItemNameText));
     }
 
+    [Fact]
+    public void SliderChange_AfterSelection_UpdatesNameAndPriceToLiveQuantity_MatchingWhatBuyWouldCharge()
+    {
+        // F2 (Slice 6 review): retail re-runs UpdateItemsUI on every slider
+        // change (gmVendorUI::RecvNotice_StackSliderChanged,
+        // pc:203262-203278) -- the OLD implementation froze the display's
+        // quantity at a static per-selection seed while BuySelectedItem
+        // separately read the LIVE split, so a slider drag after selecting
+        // never updated the sentence/price and could show a DIFFERENT price
+        // than what Buy would actually charge. Both now go through the SAME
+        // ResolveBuyQuantity, proven here by asserting the displayed price
+        // equals the amount the subsequent Buy press actually sends.
+        var h = new Harness();
+        h.State.Apply(VendorGuid, Profile(sellRate: 2.0f), new[]
+        {
+            // perUnit = 1000/100 = 10 (MissileWeapon, not split-exempt).
+            new VendorShopItem(
+                StackedItemGuid, -1, 3u, "Arrows", (uint)ItemType.MissileWeapon, 300u, 1000,
+                DescStackSize: 100),
+        });
+        // F6 auto-selects the sole item; the harness's un-mounted-toolbar
+        // split state starts at its class default (Value=1/Maximum=1) —
+        // singular display, matching a fresh, not-yet-slider-touched
+        // selection.
+        Assert.Equal("Arrows", GetText(h.ItemNameText));
+        Assert.Equal(
+            $"costs {20:N0} (you have {Harness.DefaultPlayerCoinValue:N0})",
+            GetText(h.ItemCostText));
+
+        // Player drags the slider to 40 AFTER selecting -- no re-click, no
+        // re-selection, purely a StackSplitQuantityState.Changed event.
+        h.SplitQuantity.Reset(100u, initialValue: 40u);
+
+        // SellPrice = ceil(2.0*10*40 - 0.1) = 800.
+        Assert.Equal("40 Arrows", GetText(h.ItemNameText));
+        Assert.Equal(
+            $"cost {800:N0} (you have {Harness.DefaultPlayerCoinValue:N0})",
+            GetText(h.ItemCostText));
+
+        h.BuyButton.OnClick!.Invoke();
+
+        Assert.Equal(40, h.Buys.Single().Amount);
+    }
+
     [Fact]
     public void SelectingItem_WithAlternateCurrency_ShowsFullRetailCostSentence()
     {
@@ -370,10 +432,34 @@ public sealed class VendorUiControllerTests
     }
 
     [Fact]
-    public void NoSelection_DisablesBuyAndAddButtons_SelectionEnablesThem()
+    public void NoSelection_DisablesBuyButton_SelectionEnablesIt()
     {
         var h = new Harness();
         Assert.False(h.BuyButton.Enabled);
+
+        h.State.Apply(VendorGuid, Profile(), new[]
+        {
+            new VendorShopItem(ArmorItemGuid, -1, 2u, "Chainmail", (uint)ItemType.Armor, 200u, 500),
+        });
+
+        // F4 auto-selects the sole item on open, so Buy is already enabled
+        // — SetState(1), pc:202784-202789.
+        Assert.True(h.BuyButton.Enabled);
+
+        // Closing clears the selection -> SetState(0xd), pc:202572-202577.
+        h.State.Close();
+        Assert.False(h.BuyButton.Enabled);
+    }
+
+    [Fact]
+    public void AddButton_IsPermanentlyDisabled_RegardlessOfSelection()
+    {
+        // F8 (Slice 6 review): "Add to List" has no wired OnClick at all
+        // (staging into the "Buying" tab is deferred, contract decision 6)
+        // — an enabled button that silently does nothing on click is a
+        // dead-affordance bug, worse than a disabled one. It must never
+        // enable, with or without a selection.
+        var h = new Harness();
         Assert.False(h.AddButton.Enabled);
 
         h.State.Apply(VendorGuid, Profile(), new[]
@@ -381,14 +467,10 @@ public sealed class VendorUiControllerTests
             new VendorShopItem(ArmorItemGuid, -1, 2u, "Chainmail", (uint)ItemType.Armor, 200u, 500),
         });
 
-        // F4 auto-selects the sole item on open, so the buttons are already
-        // enabled — SetState(1), pc:202784-202789.
-        Assert.True(h.BuyButton.Enabled);
-        Assert.True(h.AddButton.Enabled);
+        // F4/F6 auto-selects the sole item on open -- Add stays disabled.
+        Assert.False(h.AddButton.Enabled);
 
-        // Closing clears the selection -> SetState(0xd), pc:202572-202577.
         h.State.Close();
-        Assert.False(h.BuyButton.Enabled);
         Assert.False(h.AddButton.Enabled);
     }
 
@@ -473,6 +555,29 @@ public sealed class VendorUiControllerTests
         Assert.NotNull(h.ItemList.EmptySlotFactory);
     }
 
+    [Fact]
+    public void ShopRow_NeverMintsADragPayload()
+    {
+        // F3 (Slice 6 review): with shop items materialized into
+        // ClientObjectTable (Slice 6.1), a draggable vendor cell would pass
+        // every destination handler's existence guard -- a pack drop would
+        // send a real PutItemInContainer for vendor stock, the shortcut bar
+        // would persist a dangling guid, and PlaceIn3D would fire. Retail
+        // excludes vendor/salvage lists from ItemList_BeginDrag entirely; a
+        // populated shop row must never become a drag source at all.
+        var h = new Harness();
+        h.State.Apply(VendorGuid, Profile(), new[]
+        {
+            new VendorShopItem(ArmorItemGuid, -1, 2u, "Chainmail", (uint)ItemType.Armor, 200u, 500),
+        });
+
+        UiItemSlot cell = h.ItemList.GetItem(0)!;
+
+        Assert.NotEqual(0u, cell.ItemId); // occupied -- would otherwise be a drag source by default
+        Assert.False(cell.IsDragSource);
+        Assert.Null(cell.GetDragPayload());
+    }
+
     [Fact]
     public void Opened_WithDifferentVendor_ResetsToFirstPresentCategory_NotThePreviousVendors()
     {
@@ -529,6 +634,43 @@ public sealed class VendorUiControllerTests
         Assert.Equal("Food", h.TypeMenu.Items.Single(i => Equals(i.Payload, h.TypeMenu.Selected)).Label);
     }
 
+    [Fact]
+    public void Refreshed_SameVendor_ReselectsFirstItemUnconditionally_NotThePreviouslySelectedSurvivor()
+    {
+        // F6 (Slice 6 review): retail's VendorItemsUI::UpdateItemsList
+        // selects UNCONDITIONALLY on every rebuild call site this
+        // controller reaches (pc:201180-201184, confirmed via
+        // VendorItemsUI::OpenVendor's unconditional clamp +
+        // SetSelectedItem(...,1) at pc:201022, which every vendor
+        // open/refresh runs regardless of the sameVendor flag) -- there is
+        // NO survival test. A same-vendor refresh that re-lists the SAME
+        // two items in the SAME order must reset to the FIRST one even
+        // though the player's prior selection (the second item) is still
+        // present in the new snapshot -- this is the case that would have
+        // diverged under the OLD "preserve if it survives" logic.
+        const uint SecondArmorGuid = 0x60000110u;
+        var h = new Harness();
+        var items = new[]
+        {
+            new VendorShopItem(ArmorItemGuid, -1, 2u, "Chainmail", (uint)ItemType.Armor, 200u, 500),
+            new VendorShopItem(SecondArmorGuid, -1, 4u, "Buckler", (uint)ItemType.Armor, 900u, 40),
+        };
+        h.State.Apply(VendorGuid, Profile(), items);
+        Assert.Equal(ArmorItemGuid, h.ItemList.GetItem(0)!.ItemId); // auto-selected first
+
+        // Player explicitly picks the SECOND item.
+        h.ItemList.GetItem(1)!.Clicked?.Invoke();
+        Assert.True(h.ItemList.GetItem(1)!.Selected);
+
+        // SAME vendor, SAME two items, SAME order -> Refreshed transition.
+        h.State.Apply(VendorGuid, Profile(), items);
+
+        // Retail resets to the FIRST item, not the still-present second one.
+        Assert.True(h.ItemList.GetItem(0)!.Selected);
+        Assert.False(h.ItemList.GetItem(1)!.Selected);
+        Assert.Equal("Chainmail", GetText(h.ItemNameText));
+    }
+
     [Fact]
     public void CategoryMenu_OpensAndSelectsThroughRealHitPath_UsingAuthoredPopupGeometry()
     {
@@ -723,6 +865,36 @@ public sealed class VendorUiControllerTests
         Assert.Equal(25, h.Buys.Single().Amount);
     }
 
+    [Fact]
+    public void BuyButton_Press_NonStackedItem_IgnoresAStaleSliderFromAPreviouslySelectedStackableItem()
+    {
+        // F7 (Slice 6 review): retail's BuySingleItem (pc:201674-201681)
+        // gates on the SELECTED item's OWN stack size FIRST -- quantity 1
+        // whenever it is <=1, regardless of whatever
+        // GenItemHolder::splitSize still holds from a PREVIOUSLY selected,
+        // DIFFERENT, stackable item. Without this guard,
+        // ResolveBuyQuantity's GetObjectSplitSize(item.ItemGuid, selected,
+        // stackSize) call trivially returns the live Value for ANY selected
+        // item (item.ItemGuid always equals the selection guid at this call
+        // site) -- leaking a stale quantity into a non-stack purchase.
+        var h = new Harness();
+        h.State.Apply(VendorGuid, Profile(), new[]
+        {
+            new VendorShopItem(ArmorItemGuid, -1, 2u, "Chainmail", (uint)ItemType.Armor, 200u, 500),
+        });
+        // Simulate a stale slider left over from a PREVIOUSLY selected,
+        // different, stackable item -- this harness doesn't mount
+        // SelectedObjectController, which in production would already have
+        // reset the slider on selecting the (non-stack) armor; seeding it
+        // directly here proves the clamp doesn't depend on that reset
+        // having run.
+        h.SplitQuantity.Reset(50u, initialValue: 30u);
+
+        h.BuyButton.OnClick!.Invoke();
+
+        Assert.Equal(1, h.Buys.Single().Amount);
+    }
+
     [Fact]
     public void BuyButton_Press_AlternateCurrencyVendor_ForwardsTheVendorsTradeWcid()
     {

tests/AcDream.App.Tests/UI/UiItemSlotTests.cs

@@ -66,6 +66,33 @@ public class UiItemSlotTests
         Assert.Null(slot.GetDragPayload());
     }
 
+    // ── F3 (Slice 6 review): AllowDragSource ────────────────────────────────
+
+    [Fact]
+    public void AllowDragSource_DefaultsTrue_OccupiedSlotIsADragSource()
+    {
+        var s = new UiItemSlot();
+        s.SetItem(0x5001u, 0x99u);
+
+        Assert.True(s.IsDragSource);
+        Assert.NotNull(s.GetDragPayload());
+    }
+
+    [Fact]
+    public void AllowDragSource_False_OccupiedSlotIsNeverADragSource()
+    {
+        // A vendor row (or any future list retail excludes from
+        // ItemList_BeginDrag, e.g. salvage) sets this false. IsDragSource is
+        // the sole gate UiRoot reads at MouseDown to decide whether a
+        // press-and-move even becomes a drag CANDIDATE -- GetDragPayload()
+        // is never reached at all when this is false, so no destination
+        // drop handler needs to reject anything.
+        var s = new UiItemSlot { AllowDragSource = false };
+        s.SetItem(0x5001u, 0x99u);
+
+        Assert.False(s.IsDragSource);
+    }
+
     // ── Shortcut number tests ────────────────────────────────────────────────
     // Port of UIElement_UIItem::SetShortcutNum (acclient_2013_pseudo_c.txt:229465).
 

tests/AcDream.Runtime.Tests/Gameplay/VendorShopItemMaterializerTests.cs

@@ -119,8 +119,15 @@ public sealed class VendorShopItemMaterializerTests
     [Fact]
     public void Refreshed_ItemNoLongerListed_IsRemoved()
     {
-        // A unique item sold out (bought up / delisted) between one
-        // ApproachVendor and the next same-vendor refresh.
+        // An item drops out of the vendor's own list WITHOUT ever being
+        // re-containered elsewhere (e.g. admin-removed stock, a delisted
+        // line item) -- its live ContainerId is still the vendor's own
+        // guid, so the retire pass's F1 ownership re-check finds a match
+        // and removes it. This is deliberately NOT "I bought it" -- see
+        // Refreshed_ItemPurchased_ReparentedIntoBuyerPack_Survives for that
+        // case, where the SAME "missing from the new snapshot" trigger must
+        // NOT delete the item because a real purchase already moved it into
+        // the buyer's own pack before this refresh arrived.
         var vendor = new VendorState();
         var objects = new ClientObjectTable();
         using var materializer = new VendorShopItemMaterializer(vendor, objects);
@@ -133,6 +140,62 @@ public sealed class VendorShopItemMaterializerTests
         Assert.Equal(1, materializer.OwnedCount);
     }
 
+    [Fact]
+    public void Refreshed_ItemPurchased_ReparentedIntoBuyerPack_Survives()
+    {
+        // F1: buying a UNIQUE vendor item does not merely drop it from the
+        // next ApproachVendor snapshot -- ACE first re-containers the SAME
+        // guid into the BUYER's own pack via CreateObject
+        // (Player_Commerce.cs:86-108) and only THEN sends the full-replace
+        // refresh that no longer lists it. The retire pass must re-check
+        // live ownership (ContainerId) before deleting, or it strips the
+        // just-purchased item straight back out of the buyer's inventory.
+        var vendor = new VendorState();
+        var objects = new ClientObjectTable();
+        using var materializer = new VendorShopItemMaterializer(vendor, objects);
+        vendor.Apply(VendorGuid, default, new[] { Item(ItemA, "Unique Sword"), Item(ItemB) });
+        Assert.Equal(VendorGuid, objects.Get(ItemA)!.ContainerId);
+
+        const uint BuyerGuid = 0x50009000u;
+        // Simulate the purchase's CreateObject: ACE re-containers the SAME
+        // guid into the buyer's pack BEFORE the post-buy ApproachVendor
+        // refresh arrives.
+        objects.Ingest(new WeenieData(
+            Guid: ItemA,
+            Name: null,
+            Type: null,
+            WeenieClassId: 0,
+            IconId: 0,
+            IconOverlayId: 0,
+            IconUnderlayId: 0,
+            Effects: 0,
+            Value: null,
+            StackSize: null,
+            StackSizeMax: null,
+            Burden: null,
+            ContainerId: BuyerGuid,
+            WielderId: null,
+            ValidLocations: null,
+            CurrentWieldedLocation: null,
+            Priority: null,
+            ItemsCapacity: null,
+            ContainersCapacity: null,
+            Structure: null,
+            MaxStructure: null,
+            Workmanship: null));
+        Assert.Equal(BuyerGuid, objects.Get(ItemA)!.ContainerId);
+
+        // Post-buy ApproachVendor refresh: the purchased item is gone from
+        // the shop's own list.
+        vendor.Apply(VendorGuid, default, new[] { Item(ItemB) });
+
+        ClientObject? survivor = objects.Get(ItemA);
+        Assert.NotNull(survivor);
+        Assert.Equal(BuyerGuid, survivor!.ContainerId);
+        Assert.False(materializer.Owns(ItemA));
+        Assert.Equal(1, materializer.OwnedCount);
+    }
+
     [Fact]
     public void CollidingGuid_AlreadyOwnedBySomethingElse_IsNeverClobbered()
     {
@@ -188,4 +251,38 @@ public sealed class VendorShopItemMaterializerTests
         vendor.Close();
         Assert.NotNull(objects.Get(ItemA));
     }
+
+    [Fact]
+    public void Retire_ThrowingObjectRemovedObserver_StillRetiresRemainingGuidsAndConverges()
+    {
+        // F5: ClientObjectTable.Remove fires ObjectRemoved with NO
+        // per-listener isolation (unlike VendorState's own Changed
+        // dispatch). One throwing observer must not abort the retire loop
+        // partway through and strand _ownedGuids -- every owned guid still
+        // retires, and OwnedCount still converges to zero.
+        var vendor = new VendorState();
+        var objects = new ClientObjectTable();
+        using var materializer = new VendorShopItemMaterializer(vendor, objects);
+        vendor.Apply(VendorGuid, default, new[] { Item(ItemA), Item(ItemB) });
+        Assert.Equal(2, materializer.OwnedCount);
+
+        // A throwing ObjectRemoved observer fires on EVERY Remove() call
+        // (both ItemA's and ItemB's) -- multicast delegate invocation has
+        // no per-listener isolation, so each Remove() call itself throws.
+        objects.ObjectRemoved += _ => throw new InvalidOperationException("boom");
+
+        vendor.Close();
+
+        // Both guids are gone from the table -- the throwing first observer
+        // did not stop the second guid's Remove() call from happening.
+        Assert.Null(objects.Get(ItemA));
+        Assert.Null(objects.Get(ItemB));
+        Assert.Equal(0, materializer.OwnedCount);
+        Assert.False(materializer.Owns(ItemA));
+        Assert.False(materializer.Owns(ItemB));
+
+        // Dispose still converges cleanly afterward.
+        materializer.Dispose();
+        Assert.Equal(0, materializer.OwnedCount);
+    }
 }