Build native Lua GMI around the web market workflow

Build the client GMI as a Lua-owned interface using existing native window/table/assets and secure market HTTP boundary, not a literal translation of the C# market presenter. Inspect current web market views as workflow reference. Prioritize discoverable item search, native item icons, buy/sell offers and listing collection/cancellation, clear prices and explicit loading/empty/error states. Preserve server trade rules, authentication and idempotency; do not expose credentials or unrestricted HTTP to Lua. Identify wider web parity gaps explicitly rather than claiming full parity. Implementation: feature/lua-gmi replaces the C# market presenter/layout with a provider-selectable Market Lua package and a native authenticated API adapter. Home separates buy/sell orders with collectible summaries; search supports category/QL/paging/Enter; offer forms show per-unit prices, total escrow/payout and whole-stack semantics; native activation gates mutations and retains retry keys. Native item-slot widgets render icons from the existing RDB image provider. A pixel regression first failed for BitmapView (bitmap bound but invisible) and passed after using the shared item-slot rendering path. First slice verified: final warning-gated client build passes with zero warnings/errors. 35 focused market/API/provider/shared-table/shared-window/Actions/capability tests pass; strengthened column-containment assertions also pass. Real-install icon decode/render tests paint visible pixels through the native GPU renderer. All six final capture views were inspected, covering orders/offers at 940/1200 window widths and installed search/offer icons. Lua 5.4 syntax and generator self-test pass; git diff --check is clean. Full run-client-lua-tests.sh passes (8 native tests in release and sanitizer builds plus existing Native AOT acceptance); that harness does not exercise the new market adapter under AOT. Docker rewrote shared restore metadata with container NuGet paths; a host restore resolved the subsequent no-restore build failure without source changes. The installed StyLua binary only supports Lua 5.1 and cannot parse 5.4 integer division; native 5.4 parser and execution tests validate the package. User authorized committing the first slice. Committed all 16 intended paths as 0320c1b87 (feature: Add Lua GMI trading workflow) on feature/lua-gmi; working tree is clean. No push or pull request was requested or performed. Broader work remains in progress for the substantive web-parity features below, not solely for live verification. Browser access to live /market/ is blocked by missing game-session headers; no live trades or authenticated visual-parity claim. User now authorizes completing player-facing web parity for advanced search/subcategories (profession, faction, level, handedness, damage type and modified stats), item details/requirements and market depth, repricing existing orders, and transaction history/trends. Work orders are explicitly excluded. Extend the authenticated JSON API and shared public contracts where needed, reusing existing IMarketClient operations and current character scoping. Keep internal bus DTOs, identities, credentials and GM-only pricing diagnostics out of client-facing responses. Preserve native mutation activation and authoritative server validation. The first slice had no server/API changes; the parity extension includes ClientWebEngine API changes, not new market rules. Parity implementation milestone: added authenticated public JSON routes and native/Lua presentation for all four requested areas, with work orders excluded. Advanced choices are supplied by the server; subtype/QL/faction/profession/level/handedness/damage/stat filters and global result sorts persist through paging. Native item research presents requirements/modifiers, price levels, all-QL offers with form-fill selection, and tabular recent-sale price history. Open-order repricing previews escrow effects and uses a protected native action; history/trends navigate back to normal item offers. Extracted credentials into a cohesive native transport type so tests can exercise the real API client without loading the whole game. Verified so far: 10 API/controller/security tests pass, including a real Kestrel/auth middleware/native HTTP client round trip and rejection of missing reprice prices. 241 market-engine tests pass on .NET 8, including a red-green history visibility/limit regression: reprices/refunds were omitted and hidden admin rows consumed the requested history limit. Shared immutable visibility rules now fix both paths; the web history view reuses the same safe formatter. Full Lua/native/sanitizer/AOT runner passes, now including the actual GMI adapter and source-generated HTTP JSON under Native AOT. 40 focused native market/API/shared UI tests pass; order-panel width collapse with one empty side was reproduced and fixed using explicit equal-column sizing. Partial static patch review raised two real cache bugs, reproduced by new tests and fixed: stale depth replies after changing offer QLs, and cached seven-day trend rankings relabelled by the independent thirty-day depth window. It also suggested clearing subcategory on reset; web _SearchForm intentionally preserves category/subcategory, so retained that parity, clarified the button to Reset advanced, and verified scoped reset behavior. Review was partial only because six generated binary Avalonia build-task artifacts could not be read; those test-generated, untracked artifacts were removed. No approval or runtime testing by the reviewer is claimed. Final verification passed: warning-gated client build has zero warnings/errors; all 40 focused native market/API/shared UI tests, all 10 API/controller/security/authenticated HTTP tests and all 241 market-engine tests pass (291 tests total). The full Lua runner passes release and sanitizer native tests, generator self-tests and the post-review Native AOT run including the actual GMI adapter. Lua 5.4 syntax and git diff --check are clean. Twenty final native Vulkan-rendered capture views were inspected through contact sheets, covering installed icons, advanced filters, requirements, depth/quality levels, recent sales, repricing, history/trends, and core/research layouts at 940×660 and 1200×800. Price history is presented as exact paged native tables rather than a Chart.js graph. Generated Avalonia telemetry artifacts were removed from the worktree after tests. Implementation acceptance is met for the four requested player-facing areas; work orders remain excluded. Live game-session/PFE validation and Windows/macOS execution remain unverified. User authorized committing the extension. Committed all 36 intended paths as 1b4732ada (feature: Add GMI research, repricing and advanced search) on feature/lua-gmi; working tree is clean. User authorized publication through /open-pr. Pushed feature/lua-gmi without rewriting history and opened ready PR #2962, feature: Add Lua GMI trading and market research, against develop: https://git.project-rk.com/prk/engines/pulls/2962. Confirmed exactly two session commits and 45 intended changed paths. Remote head matches 1b4732ada; worktree is clean and synchronized. Latest develop is six commits ahead of the branch base; a read-only merge preview and Gitea both report no conflicts. No deployment or live PFE validation was performed; existing 291-test/Lua/AOT/build evidence applies to the unchanged published head, not a merged revision. Documentation follow-up implemented, committed and pushed to PR #2962 as d4d5c4981 (docs: Link Lua requests to component callbacks): generator category pages now include a ToC, public Functions and built-in Component callbacks; callback-only components such as Missions receive their own category page. callbacks.md contains only callback parameter types. LuaExport.Response links asynchronous request functions to validated same-category LuaEntry callbacks. game.market.trends now explains boolean queue acceptance and links market_trends(days, entries); other market requests have matching response metadata or explicit multi-response prose. Explicit categories keep chat and combat callbacks under existing ui.* pages. Static review found generic callback wording incorrectly described every entrypoint as an async response and found game.market.research validating after Queue; both fixed, with a runtime regression proving missing selections/invalid sections return false without issuing API reads. Generator self-test, full Lua release/sanitizer/AOT runner, warning-gated client build, focused market regression and git diff check pass. Generated game-market.md, ui-chat.md, game-missions.md and callbacks.md were manually inspected. PR #2962 now points at d4d5c4981 and remains open/mergeable; working tree is clean and synchronized. Deployment requires updated ClientWebEngine routes and MarketEngine history visibility alongside the native client; the real HTTP integration test uses mock bus/auth providers, not production credentials or live financial mutations. Acceptance: existing Lua GMI trading flow remains functional; advanced filters persist across category changes and paging; selected search/inventory/orders expose item details and requirements, aggregated bids/asks and recent prices without private data; open orders can be repriced with correct escrow implications; character transaction history and market trends are available and accurately labelled. Work orders remain absent. Add player-safe bounded authenticated API routes/contracts and meaningful regression coverage, then validate client/server builds, Lua/native behavior, rendering and existing security boundaries. Keep unauthenticated/live-market and new-adapter AOT validation gaps explicit.