feat(vendor): Slice 6b/6c — move-to-use, buy staging, selling; the vendor arc is functionally complete

C1 an out-of-range Use now approaches first via the existing
client-predicted BeginApproach (Pickup's far-range shape mirrored;
retail's ItemHolder::UseObject @0x00588A80 has no range check and the
dispatch stays immediate). C2 Add-to-List stages into the Buying tab
via VendorStagingList (RemoveProfileFromList's two shapes,
pc:200497-200537), Buy All sends ONE batched 0x005F and flushes
staging on send exactly as retail does (SendShopEvent -> Flush,
pc:204075-204076 — not UseDone-gated), and X-close over a non-empty
staging list shows retail's confirm string recovered verbatim from the
binary data segment (0x007b5bd8) through the existing dialog factory.
C3 the Selling tab's list is the sole drop target (retail's single
IsAncestorOfMe gate, pc:204229-204246); VendorSellAcceptability ports
InqAcceptability with all rejection strings recovered verbatim from
the raw data segment; the sell side prices with BuyPrice (retail's
inverted naming: what the vendor PAYS) and 0x0060 carries no trailing
currency field, unlike Buy. C4 the status-bar reproduction test PASSES
against the production toolbar mount — retail's toolbar shows count +
name with the split bar and NO price parenthetical (that figure is the
vendor row's own cost text); no code change, the live gate referees.
C5 pack order verified correct, untouched.

Register: AP-161 narrowed to its two pre-existing cosmetic gaps;
AP-162 extended over Buy All; AP-164 (non-sellable bitfield
unmodeled), AP-165 (DescStackSize for _maxStackSize in the removal
test, bounded), AP-166 (purse text + pending-sell highlight cosmetic)
filed.

Clean-room complete solution: 11,482 passed / 4 skipped / 0 failed.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

src/AcDream.App/UI/ItemInteractionController.cs

@@ -67,6 +67,11 @@ public sealed class ItemInteractionController : IDisposable
     // in world) — the bool return is what lets TryBuy release the
     // reservation instead of leaking BusyCount forever.
     private readonly Func<uint, uint, int, uint, bool>? _sendBuy;
+    // Slice 6b/6c: vendorGuid, staged (amount, itemGuid) entries[, alternate
+    // currency] -> true when the wire send actually happened. Same
+    // dispatched-vs-silent-no-op shape as _sendBuy — see TryBuyAll/TrySell.
+    private readonly Func<uint, IReadOnlyList<(int Amount, uint ItemGuid)>, uint, bool>? _sendBuyAll;
+    private readonly Func<uint, IReadOnlyList<(int Amount, uint ItemGuid)>, bool>? _sendSell;
     private readonly RuntimeInteractionTransactionState _runtimeTransactions;
     private readonly InventoryTransactionState _transactions;
 
@@ -108,7 +113,9 @@ public sealed class ItemInteractionController : IDisposable
         CombatState? combatState = null,
         Action<CombatMode>? sendChangeCombatMode = null,
         Action<uint, ItemUseRequestReservation>? requestUse = null,
-        Func<uint, uint, int, uint, bool>? sendBuy = null)
+        Func<uint, uint, int, uint, bool>? sendBuy = null,
+        Func<uint, IReadOnlyList<(int Amount, uint ItemGuid)>, uint, bool>? sendBuyAll = null,
+        Func<uint, IReadOnlyList<(int Amount, uint ItemGuid)>, bool>? sendSell = null)
     {
         _objects = objects ?? throw new ArgumentNullException(nameof(objects));
         _playerGuid = playerGuid ?? throw new ArgumentNullException(nameof(playerGuid));
@@ -139,6 +146,8 @@ public sealed class ItemInteractionController : IDisposable
         _systemMessage = systemMessage;
         _requestUse = requestUse;
         _sendBuy = sendBuy;
+        _sendBuyAll = sendBuyAll;
+        _sendSell = sendSell;
         _interactionState = interactionState
             ?? throw new ArgumentNullException(nameof(interactionState));
         _runtimeTransactions = runtimeTransactions
@@ -289,6 +298,90 @@ public sealed class ItemInteractionController : IDisposable
         return true;
     }
 
+    /// <summary>
+    /// Slice 6b: retail's "Buy All" button (<c>gmVendorUI::HandleButtonClicks</c>
+    /// case <c>0x100000ca</c>, <c>pc:204011-204079</c>) — the ONE path that
+    /// sends a multi-item Buy in a single wire call. Rides the SAME
+    /// one-request-at-a-time use reservation <see cref="TryBuy"/> does.
+    /// Retail's client-side affordability/pack-capacity pre-checks
+    /// (<c>pc:204017/204032/204053/204067</c>) are deliberately NOT ported
+    /// here either, for the same reason <see cref="TryBuy"/>'s own doc
+    /// comment already gives for the single-item Buy: the server is
+    /// authoritative either way (register AP-162, extended to this batched
+    /// path rather than filing a second near-duplicate row).
+    /// </summary>
+    public bool TryBuyAll(
+        uint vendorGuid,
+        IReadOnlyList<(int Amount, uint ItemGuid)> items,
+        uint alternateCurrencyId)
+    {
+        if (vendorGuid == 0u || items is null || items.Count == 0 || _sendBuyAll is null)
+            return false;
+        if (!EnsureInventoryRequestReady())
+            return false;
+
+        ItemUseRequestReservation reservation = BeginUseRequestReservation();
+        bool dispatched;
+        try
+        {
+            dispatched = _sendBuyAll(vendorGuid, items, alternateCurrencyId);
+        }
+        catch
+        {
+            reservation.CancelBeforeDispatch();
+            throw;
+        }
+
+        if (!dispatched)
+        {
+            reservation.CancelBeforeDispatch();
+            return false;
+        }
+
+        reservation.MarkDispatched();
+        return true;
+    }
+
+    /// <summary>
+    /// Slice 6c: retail's Sell path — both "Sell Item"
+    /// (<c>gmVendorUI::HandleButtonClicks</c> case <c>0x100000d2</c>,
+    /// <c>pc:204101-204112</c>, a one-entry list) and "Sell All" (case
+    /// <c>0x100000d3</c>, <c>pc:204113-204129</c>, an n-entry list) reuse
+    /// this single method — retail's own <c>CM_Vendor::Event_Sell</c> has no
+    /// separate single-item opcode the way Buy does. Same reservation dance
+    /// as <see cref="TryBuy"/>/<see cref="TryBuyAll"/>.
+    /// </summary>
+    public bool TrySell(
+        uint vendorGuid,
+        IReadOnlyList<(int Amount, uint ItemGuid)> items)
+    {
+        if (vendorGuid == 0u || items is null || items.Count == 0 || _sendSell is null)
+            return false;
+        if (!EnsureInventoryRequestReady())
+            return false;
+
+        ItemUseRequestReservation reservation = BeginUseRequestReservation();
+        bool dispatched;
+        try
+        {
+            dispatched = _sendSell(vendorGuid, items);
+        }
+        catch
+        {
+            reservation.CancelBeforeDispatch();
+            throw;
+        }
+
+        if (!dispatched)
+        {
+            reservation.CancelBeforeDispatch();
+            return false;
+        }
+
+        reservation.MarkDispatched();
+        return true;
+    }
+
     /// <summary>
     /// Retail <c>UIElement_ItemList::AcceptDragObject</c>'s local
     /// <c>m_pendingItem</c> branch. This wording belongs only to the destination