fix(vendor): Slice 6 review corrections — ownership-checked retire, live slider display, drag-proof shop rows, hardened buy reservation

All nine findings from the buy-arc review, at root:

F1 the materializer's retire pass re-checks ownership (guid->vendorId
map; remove only while the live object's ContainerId still equals the
recording vendor) — buying a player-sold UNIQUE no longer deletes the
item you just purchased; the discriminating reparent-then-refresh test
pins it. F2 the cost/name display subscribes to the live split state
and shares ONE quantity computation with Buy (retail re-renders per
slider tick: RecvNotice_StackSliderChanged 0x004C4500) — the sentence
and the charge can no longer disagree. F3 shop rows never mint drag
payloads (UiItemSlot.AllowDragSource gates both IsDragSource AND
GetDragPayload — the second gate was caught by this pass's own test).
F4 sendBuy reports whether anything was sent; a null-session buy
cancels the reservation instead of leaking BusyCount forever.
F5 the retire loop snapshots, isolates per-guid observer failures, and
clears its tracking in finally and Dispose — teardown convergence can
no longer wedge. F6 auto-select is retail's unconditional
first-filtered-item shape (pc:201180-201184; the survival-check was
our invention and the comment claiming otherwise is corrected).
F7 non-stack buys clamp to quantity 1 locally (BuySingleItem
pc:201669). F8 the Add button is hard-disabled until staging exists.
F9 AP-161/162/163 rewritten to the post-fix reality.

Clean-room complete solution: 11,378 passed / 4 skipped / 0 failed.
The #350 render-ledger overflow observed this session is under
separate investigation and is NOT addressed here.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

tests/AcDream.Runtime.Tests/Gameplay/VendorShopItemMaterializerTests.cs

@@ -119,8 +119,15 @@ public sealed class VendorShopItemMaterializerTests
     [Fact]
     public void Refreshed_ItemNoLongerListed_IsRemoved()
     {
-        // A unique item sold out (bought up / delisted) between one
-        // ApproachVendor and the next same-vendor refresh.
+        // An item drops out of the vendor's own list WITHOUT ever being
+        // re-containered elsewhere (e.g. admin-removed stock, a delisted
+        // line item) -- its live ContainerId is still the vendor's own
+        // guid, so the retire pass's F1 ownership re-check finds a match
+        // and removes it. This is deliberately NOT "I bought it" -- see
+        // Refreshed_ItemPurchased_ReparentedIntoBuyerPack_Survives for that
+        // case, where the SAME "missing from the new snapshot" trigger must
+        // NOT delete the item because a real purchase already moved it into
+        // the buyer's own pack before this refresh arrived.
         var vendor = new VendorState();
         var objects = new ClientObjectTable();
         using var materializer = new VendorShopItemMaterializer(vendor, objects);
@@ -133,6 +140,62 @@ public sealed class VendorShopItemMaterializerTests
         Assert.Equal(1, materializer.OwnedCount);
     }
 
+    [Fact]
+    public void Refreshed_ItemPurchased_ReparentedIntoBuyerPack_Survives()
+    {
+        // F1: buying a UNIQUE vendor item does not merely drop it from the
+        // next ApproachVendor snapshot -- ACE first re-containers the SAME
+        // guid into the BUYER's own pack via CreateObject
+        // (Player_Commerce.cs:86-108) and only THEN sends the full-replace
+        // refresh that no longer lists it. The retire pass must re-check
+        // live ownership (ContainerId) before deleting, or it strips the
+        // just-purchased item straight back out of the buyer's inventory.
+        var vendor = new VendorState();
+        var objects = new ClientObjectTable();
+        using var materializer = new VendorShopItemMaterializer(vendor, objects);
+        vendor.Apply(VendorGuid, default, new[] { Item(ItemA, "Unique Sword"), Item(ItemB) });
+        Assert.Equal(VendorGuid, objects.Get(ItemA)!.ContainerId);
+
+        const uint BuyerGuid = 0x50009000u;
+        // Simulate the purchase's CreateObject: ACE re-containers the SAME
+        // guid into the buyer's pack BEFORE the post-buy ApproachVendor
+        // refresh arrives.
+        objects.Ingest(new WeenieData(
+            Guid: ItemA,
+            Name: null,
+            Type: null,
+            WeenieClassId: 0,
+            IconId: 0,
+            IconOverlayId: 0,
+            IconUnderlayId: 0,
+            Effects: 0,
+            Value: null,
+            StackSize: null,
+            StackSizeMax: null,
+            Burden: null,
+            ContainerId: BuyerGuid,
+            WielderId: null,
+            ValidLocations: null,
+            CurrentWieldedLocation: null,
+            Priority: null,
+            ItemsCapacity: null,
+            ContainersCapacity: null,
+            Structure: null,
+            MaxStructure: null,
+            Workmanship: null));
+        Assert.Equal(BuyerGuid, objects.Get(ItemA)!.ContainerId);
+
+        // Post-buy ApproachVendor refresh: the purchased item is gone from
+        // the shop's own list.
+        vendor.Apply(VendorGuid, default, new[] { Item(ItemB) });
+
+        ClientObject? survivor = objects.Get(ItemA);
+        Assert.NotNull(survivor);
+        Assert.Equal(BuyerGuid, survivor!.ContainerId);
+        Assert.False(materializer.Owns(ItemA));
+        Assert.Equal(1, materializer.OwnedCount);
+    }
+
     [Fact]
     public void CollidingGuid_AlreadyOwnedBySomethingElse_IsNeverClobbered()
     {
@@ -188,4 +251,38 @@ public sealed class VendorShopItemMaterializerTests
         vendor.Close();
         Assert.NotNull(objects.Get(ItemA));
     }
+
+    [Fact]
+    public void Retire_ThrowingObjectRemovedObserver_StillRetiresRemainingGuidsAndConverges()
+    {
+        // F5: ClientObjectTable.Remove fires ObjectRemoved with NO
+        // per-listener isolation (unlike VendorState's own Changed
+        // dispatch). One throwing observer must not abort the retire loop
+        // partway through and strand _ownedGuids -- every owned guid still
+        // retires, and OwnedCount still converges to zero.
+        var vendor = new VendorState();
+        var objects = new ClientObjectTable();
+        using var materializer = new VendorShopItemMaterializer(vendor, objects);
+        vendor.Apply(VendorGuid, default, new[] { Item(ItemA), Item(ItemB) });
+        Assert.Equal(2, materializer.OwnedCount);
+
+        // A throwing ObjectRemoved observer fires on EVERY Remove() call
+        // (both ItemA's and ItemB's) -- multicast delegate invocation has
+        // no per-listener isolation, so each Remove() call itself throws.
+        objects.ObjectRemoved += _ => throw new InvalidOperationException("boom");
+
+        vendor.Close();
+
+        // Both guids are gone from the table -- the throwing first observer
+        // did not stop the second guid's Remove() call from happening.
+        Assert.Null(objects.Get(ItemA));
+        Assert.Null(objects.Get(ItemB));
+        Assert.Equal(0, materializer.OwnedCount);
+        Assert.False(materializer.Owns(ItemA));
+        Assert.False(materializer.Owns(ItemB));
+
+        // Dispose still converges cleanly afterward.
+        materializer.Dispose();
+        Assert.Equal(0, materializer.OwnedCount);
+    }
 }