feat(vendor): Slice 6 buy arc — shop items are real objects, vendor selection is THE selection, and Buy works (0x005F)

Three ordered pieces in one landing (the shared controller/composition
files carry all three; the internal order was 6.1 -> 6.2 -> 6.3):

6.1 VendorShopItemMaterializer diff-merges the shop list into the live
ClientObjectTable on VendorState transitions (so client-local close and
session teardown retire the entries too) and never claims a guid it did
not add — ACE's UniqueItemsForSale can re-list a guid a player once
held (AP-163 files the collision-skip; no retail counterpart traced).
Right-click examine on shop items now routes through the ordinary
appraisal path — the 5.4 F7c blocker dissolves with the table entries.

6.2 SelectionChangeSource.Vendor: row clicks, auto-select, and examine
all flow through the canonical SelectionState; the status bar and the
existing byte-faithful StackSplitQuantityState slider light up
unmodified. VendorSplitPolicy is the single 0xDC41CB0 mask owner; the
slider VALUE seeds to 1 for exempt items while maxSplitSize keeps the
stack (the splitSize/maxSplitSize distinction, research §B.3).
Selection clears at retail's actual site — VendorItemsUI::RemoveFromShop
(pc:202848), not a CloseVendor-level clear that does not exist.

6.3 BuildBuy (0x005F): vendorGuid, count, (i32 amount, u32 guid) pairs,
and the trailing alternateCurrencyId the REAL client sends
(CM_Vendor::Event_Buy pc:689288) though ACE's reader ignores it.
TryBuy rides the EXISTING J5.2 one-request-at-a-time reservation and
completes on UseDone; the Buy button disables while a request is in
flight. The reconciliation round-trip (money property update, inventory
CreateObject, ApproachVendor refresh -> panel rebuild) is proven by a
synthetic-inbound test against existing machinery — no new owner.

Register: AP-161 narrowed (selection + examine residuals close;
staging/Sell remain; double-click-to-buy confirmed ABSENT from retail
with negative evidence cited — we match retail). AP-162 files the
conscious no-client-side-affordability-precheck deferral.

Clean-room complete solution: 11,368 passed / 4 skipped / 0 failed.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

src/AcDream.App/UI/ItemInteractionController.cs

@@ -61,6 +61,8 @@ public sealed class ItemInteractionController : IDisposable
     private readonly Action<string>? _systemMessage;
     private readonly AutoWieldController _autoWield;
     private readonly Action<uint, ItemUseRequestReservation>? _requestUse;
+    // Slice 6.3: vendorGuid, itemGuid, amount, alternateCurrencyId.
+    private readonly Action<uint, uint, int, uint>? _sendBuy;
     private readonly RuntimeInteractionTransactionState _runtimeTransactions;
     private readonly InventoryTransactionState _transactions;
 
@@ -101,7 +103,8 @@ public sealed class ItemInteractionController : IDisposable
         Action<uint>? requestExternalContainer = null,
         CombatState? combatState = null,
         Action<CombatMode>? sendChangeCombatMode = null,
-        Action<uint, ItemUseRequestReservation>? requestUse = null)
+        Action<uint, ItemUseRequestReservation>? requestUse = null,
+        Action<uint, uint, int, uint>? sendBuy = null)
     {
         _objects = objects ?? throw new ArgumentNullException(nameof(objects));
         _playerGuid = playerGuid ?? throw new ArgumentNullException(nameof(playerGuid));
@@ -131,6 +134,7 @@ public sealed class ItemInteractionController : IDisposable
         _dragOnPlayerOpensSecureTrade = dragOnPlayerOpensSecureTrade ?? (() => true);
         _systemMessage = systemMessage;
         _requestUse = requestUse;
+        _sendBuy = sendBuy;
         _interactionState = interactionState
             ?? throw new ArgumentNullException(nameof(interactionState));
         _runtimeTransactions = runtimeTransactions
@@ -222,6 +226,43 @@ public sealed class ItemInteractionController : IDisposable
         return false;
     }
 
+    /// <summary>
+    /// Slice 6.3: retail's Buy button — <c>gmVendorUI::BuySingleItem</c>
+    /// (<c>pc:201661</c>, <c>0x004C2820</c>). Immediate single-item purchase
+    /// of <paramref name="itemGuid"/> (a vendor shop item) at
+    /// <paramref name="amount"/> units, with the vendor's own trade currency
+    /// (0 = pyreal). Rides the EXISTING one-request-at-a-time reservation
+    /// ordinary Use takes (research doc §A.4: every
+    /// <c>HandleActionBuyItem</c> path ends in exactly one
+    /// <c>SendUseDoneEvent()</c>, the SAME completion signal
+    /// <c>RuntimeInteractionTransactionState.CompleteUse</c> already
+    /// resolves via the wired <c>UseDone (0x01C7)</c> handler) — no second
+    /// gate, and retail's client-side busy-count increment
+    /// (<c>ClientUISystem::IncrementBusyCount</c>, <c>pc:201765</c>) is
+    /// exactly what <see cref="EnsureInventoryRequestReady"/>'s
+    /// <c>BusyCount == 0</c> check already guards for every other request.
+    /// </summary>
+    public bool TryBuy(uint vendorGuid, uint itemGuid, int amount, uint alternateCurrencyId)
+    {
+        if (vendorGuid == 0u || itemGuid == 0u || amount <= 0 || _sendBuy is null)
+            return false;
+        if (!EnsureInventoryRequestReady())
+            return false;
+
+        ItemUseRequestReservation reservation = BeginUseRequestReservation();
+        try
+        {
+            _sendBuy(vendorGuid, itemGuid, amount, alternateCurrencyId);
+        }
+        catch
+        {
+            reservation.CancelBeforeDispatch();
+            throw;
+        }
+        reservation.MarkDispatched();
+        return true;
+    }
+
     /// <summary>
     /// Retail <c>UIElement_ItemList::AcceptDragObject</c>'s local
     /// <c>m_pendingItem</c> branch. This wording belongs only to the destination