fix(chat): CH2 rework — SpewBox tick-driven visibility + binary-derived error table

Reworks Campaign CH slice CH2 per the REJECT-review findings doc
(docs/research/2026-08-09-ch2-review-findings.md).

BLOCKER 1 — SpewBoxController never rendered a line and leaked its
pending queue. LinesProvider only ran through UiText.OnDraw, which
gates on Visible — and the box started invisible, so the provider (the
sole caller of SpewBoxState.Tick) never ran. Gave the controller an
explicit per-frame Tick(now) driven by UiRoot's global-message-3
broadcast (a zero-size GlobalTimeSink child, the same pattern
VendorUiController.DragOverGlobalTimeSink already uses), matching
retail's gmSpewBoxUI::Update. LinesProvider now only returns the
cache. Tests rewritten to drive root.Tick(...) instead of calling the
provider directly, plus new coverage for visibility-without-a-draw,
queue-drain-without-a-draw, and bounded-queue-across-many-ticks.

BLOCKER 2 — re-derived the HandleFailureEvent routing table from the
PDB-paired binary instead of the pseudo-C's ~33-char string previews.
tools/pdb-extract/sweep_weenie_strings.py sweeps every push imm32 in
VA 0x571990-0x575480, dereferences into .rdata/.data, and decodes the
full UTF-16LE literal. Added the 5 ids dispatched via else-if (missed
by case-label enumeration), resolved 0x4F8 (previously excluded),
fixed 18 wrong strings (16 the review flagged + 2 more — 0x4E9 and
0x518 — an automated diff between every swept literal and the landed
table found). Every changed row cross-checked against ACE's
WeenieError/WeenieErrorWithString enum doc comments; both oracles
agreed on every row, including a case where the review's own proposed
text for the new 0x4E8 row was itself wrong (it was 0x4E9's text) —
corrected via the else-if block's own instruction address plus the ACE
cross-check. Pinned table count: 344 (338 + 5 + 0x4F8).

SHOULD-FIX 1 — RuntimeCommunicationState.ResetSpewBox was dead code;
folded into the ChatIdentity generation-reset stage (same lifetime
boundary), with a reset assertion added to the existing populated-reset
test.

SHOULD-FIX 2 — AddText trimmed only the trailing end and invented an
empty-string early return; retail's AddTextToScroll trims both ends
(trim(&str, 1, 1, ws)) and has no empty guard. Both retired.

SHOULD-FIX 3 — ShowWeenieError bypassed the AddText chokepoint via
ChatLog.OnWeenieError (hardcoded LogTextType 0x00); routed through
Communication.AddText(Resolve(code, param)) instead, and
ChatLog.OnWeenieError is deleted — GameEventWiring's legacy no-router
fallback now resolves + calls OnSystemMessage directly.

SHOULD-FIX 4 — retail's HandleFailureEvent switch has no default case;
an unmapped id now resolves to a null Text (silence toward the
player) instead of the invented "WeenieError 0xNNNN" hex fallback,
with a diagnostics-only console log line for the id.

NITs — AP-TBD placeholders corrected to their real register rows
(AP-178, not the unrelated AP-177 lifetime row); filed AP-180 for the
windowId dual-destination gap and corrected three stale "lands with
CH2" comments; extended SpewBoxLayoutDumpDiagnostic from dats.Portal
to dats.Local and found the SpewBox element for real — LayoutDesc
0x21000011, element 0x10000048, size 450x72, MaxConcurrentItems
(ListBox property 0x10000028) = 4, not retail's code default of 1.
AP-178 narrowed accordingly; SpewBoxState.MaxConcurrentItems and
SpewBoxController's extent/anchor/OneLine are now authored rather than
placeholder (absolute screen position and colour remain open); fixed
the "19 ids... lists 18" miscount by retiring the stale paragraph in
the class doc rewrite; aligned the UseDone handler's silent-status
check with the other two WeenieError handlers.

Full Release suite: 11,914 passed / 4 skipped / 0 failed (build 0
errors).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/AcDream.Core/Chat/SpewBoxState.cs

@@ -35,21 +35,39 @@ public readonly record struct SpewBoxEntry(string Text, double ExpiresAtSeconds)
 /// Retail decouples enqueue (<c>RecvNotice_DisplayFinalStringInfo
 /// @0x004D60A0</c>, type-filtered to <c>0x1A</c> only) from display
 /// (<c>Update @0x004D5DF0</c>, driven once per UI tick by global message
-/// <c>3</c>) by exactly one frame. <see cref="Tick"/> reproduces that: it
-/// drains whatever is pending into the visible list (applying retail's
-/// dedupe-against-index-0 and <c>MaxConcurrentItems</c> overflow rules) and
-/// prunes expired entries, all in the caller's own per-frame cadence.
+/// <c>3</c>) — NOT by exactly one frame (fixed 2026-08-09, CH2 REJECT-review
+/// rework NIT 5: the earlier wording overstated this). A message that
+/// arrives just before the tick fires waits ~0 frames; one that arrives
+/// just after waits nearly a full frame — retail's own gap is 0-1 frames,
+/// bounded by tick cadence, not a fixed one-frame delay. <see cref="Tick"/>
+/// reproduces the SAME-CALL shape: it drains whatever is pending into the
+/// visible list (applying retail's dedupe-against-index-0 and
+/// <c>MaxConcurrentItems</c> overflow rules) and prunes expired entries in
+/// one call, so a caller invoking <see cref="Enqueue"/> then immediately
+/// <see cref="Tick"/> and <see cref="Snapshot"/> in the same frame sees the
+/// line SAME-frame — the decoupling only shows up when the caller's own
+/// tick cadence spans multiple frames, exactly like retail's.
 /// </para>
 /// </summary>
 public sealed class SpewBoxState
 {
     /// <summary>
-    /// Retail's own code default (<c>gmSpewBoxUI::PostInit @0x004D5AB0</c>)
-    /// when ListBox property <c>0x10000028</c> is absent or unreadable. The
-    /// shipped LayoutDesc's authored value was not resolved in this slice —
-    /// see the divergence register.
+    /// The shipped LayoutDesc's AUTHORED value — no longer a placeholder.
+    /// CH2 REJECT-review rework, NIT 3
+    /// (<c>docs/research/2026-08-09-ch2-review-findings.md</c>): the
+    /// original C.7 sweep only searched <c>dats.Portal</c>, which has no
+    /// <c>0x10000016</c> (gmSpewBoxUI) element anywhere; extending the same
+    /// sweep to <c>dats.Local</c> (<c>client_local_English.dat</c>) found
+    /// it — LayoutDesc <c>0x21000011</c>, element <c>0x10000048</c>, whose
+    /// sole child (ListBox <c>0x10000049</c>, matching
+    /// <c>gmSpewBoxUI::PostInit</c>'s <c>GetChildRecursive(0x10000049)</c>
+    /// call verbatim) carries ListBox property <c>0x10000028</c> = the
+    /// integer <c>4</c>. Retail's own code default
+    /// (<c>gmSpewBoxUI::PostInit @0x004D5AB0</c>), used only when this
+    /// property is absent or unreadable, was <c>1</c> — the shipped layout
+    /// overrides it with <c>4</c>.
     /// </summary>
-    public const int MaxConcurrentItems = 1;
+    public const int MaxConcurrentItems = 4;
 
     /// <summary>
     /// Retail's own client never raises the expiry element message