fix(ui): morning gate — map town markers: green rollover highlight + the authored map-note tooltip skin/font

User finding 3 (retail screenshot): hovering a town on the Map tab turns
its marker GREEN and shows the name on a special-font tooltip — clearly
not our generic 0x10000395 popup skin, and we had no hover highlight at
all.

Re-derivation (live-DAT probe + raw ElementDesc dump + surface
byte-decode; MapNoteLiveDatTests pins all of it):

- m_pMap (0x100001EC)'s P0x47/P0x48 = 0x100001F0 @ 0x21000026 are the
  note CONSTRUCTION template (AddMapNote @0x004a1bb0's
  CreateChildElement args) — that part we had right.
- The TEMPLATE's own DirectState authors the note's tooltip popup
  locator P0x47=0x10000398/P0x48=0x21000041 — the FOURTH popup skin,
  whose incorporated text child 0x10000396 fonts 0x40000015 where the
  other three skins font 0x40000002 (the user's "special font") — plus
  P0x50=0.0 (zero per-element tooltip delay: town tooltips fire the
  instant the dwell arms; UiRoot already honors it), P0x4B TooltipOn,
  and P0x13 RolloverEnabled. Batch C's "the template authors no locator
  of its own" claim was WRONG, and BuildTownMarkers' hardcoded
  shared-skin override was clobbering the authored values — removed.
- The hover highlight: the template's Normal/Normal_rollover states are
  PassToChildren descriptors driving the swallowed highlight child
  0x100001F1 (base 0x100002B7@0x21000042 — a four-piece frame all
  drawing 0x06004CC9, byte-decoded PURE GREEN A=FF R=00 G=FF B=00) via
  per-state P0x3B (Invisible): hidden at rest, green on rollover.

Port:
- UiButton.CascadeStateToChildren — retail UIElement::SetState
  @0x00464E70's PassToChildren cascade, keyed off the REQUESTED state id
  (properties commit unconditionally; only the sprite draw is art-gated,
  the existing #382/AP-222 distinction).
- UiDatElement.TrySetRetailState honors per-state P0x3B for NAMED states
  (OnSetAttribute @0x00462d80 case 8: SetVisible(value==0)). The
  unnamed-DirectState case is explicitly excluded — honoring it would
  un-gate ISSUES #408 (1,083 authored-invisible elements) through
  BuildWidget's post-children state reapply; measured breaking the
  spell-favorite drag tests before the scoping (note added to #408).
- MapPageController.BuildTownMarkers rebuilds the button-swallowed
  highlight child per marker through the AD-108 IconBuilder seam
  (Bindings.TemplateInfoResolver, backed by
  RowTemplateResolver.ResolveInfo — same cache) and arms it with the
  initial Normal cascade.

Register TS-85's Batch C paragraph corrected; RetailTooltipPresenter's
F10 shared-skin remark updated (MapPageController no longer a consumer).
Tests: 3 installed-DAT pins (locator/delay/rollover; per-state P0x3B +
green frame; the four-skin font sweep), UiButton cascade + UiDatElement
P0x3B units, MapHousePanel marker no-clobber + hover-highlight fixture.
App suite 5487 passed / 3 skips (5490 total, +11 over baseline);
Runtime 1744/1744.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/AcDream.App/UI/Layout/UiDatElement.cs

@@ -107,6 +107,36 @@ public class UiDatElement : UiElement, IUiDatStateful
             ActiveState = stateName;
         }
 
+        // Per-state Invisible (dat property 0x3B): retail's SetState applies
+        // the committed state's properties through UIElement::OnSetAttribute,
+        // whose case 8 (@0x00462d80, property id 0x33 + 8 = 0x3B) is
+        // `SetVisible(value == 0)` — an authored per-STATE true hides the
+        // element for that state. First consumer (2026-08-17 morning gate
+        // finding 3): the map town-hotspot template's highlight child
+        // (0x100001F1 in 0x21000026, base 0x100002B7@0x21000042 — the green
+        // 0x06004CC9 frame) authors Normal={0x3B:true} /
+        // Normal_rollover={0x3B:false}, i.e. hidden at rest, shown on
+        // rollover.
+        //
+        // SCOPED TO NAMED STATES ONLY: a 0x3B authored in the unnamed
+        // DirectState is the CONSTRUCTION-time "authored invisible" class
+        // (1,083 elements client-wide — docs/ISSUES.md #408, its own
+        // separately-gated general-honor item; ElementReader.Invisible/GF-13
+        // captures it and only chargen's scoped walk acts on it, register
+        // AP-230). Honoring it here would un-gate #408 through the back
+        // door: LayoutImporter.BuildWidget's post-children state reapply
+        // calls TrySetRetailState(DirectStateId) on every built widget, so
+        // a DirectState honor would hide all 1,083 at import (measured
+        // same-round: 10 combat-layout elements incl. 0x10000454 went
+        // un-hit-testable, breaking the spell-favorite drag tests). The
+        // NAMED-state flip below is a live visibility state machine that
+        // cannot work at all without the honor — that is this port's line.
+        if (stateId != UiStateInfo.DirectStateId
+            && selectedState is not null
+            && selectedState.Properties.TryGetValue(0x3Bu, out var invisibleProp)
+            && invisibleProp.Kind == UiPropertyKind.Bool)
+            Visible = !invisibleProp.BoolValue;
+
         if (selectedState?.PassToChildren == true)
         {
             foreach (UiElement child in Children)