Radiator fan stuck on and on high in ignition and with engine running?

I'm not sure disconnecting the sensors would be a fix, it might just be setting codes for those sensors because of a lack of comms to that ACC module, just and effect and maybe not the cause. Because you also have codes for the Recir actuator as well, the B15C0 "Right Fresh air flap". They call these components all kinds of confusing names, but also theres a Blower Regulator code too.
When I suspect a bad module or an issue with a module, I first check powers and grounds by load testing them to make sure they can carry current, I have a few turn signal bulbs and some lower current bulbs set up on the 4mm meter connectors so I can use them with a back probe, and then to check the Can bus coming out of the module I would de-pin just the Can wires so the module it still plugged in, but isolated from the network, then scope just the two pins on the modules connector to see if any message packets are coming out, because if its not isolated you will read the others modules on that network.

To get really technical you could decode the Can messages, (you would need to use a Pico for this unless your scope can decode messages) then unplug the AAC module and then decode the network again to see if theres any module IDs missing, meaning the ACC is missing from the network when unplugged, this is a much more time consuming route,

But this is the Sun sensor location, I would have to locate the humidity sensor because its not just for humidity, its a multifunction sensor that reads a bunch of different things such as air quality and some others, I dont remember all of it, but it does a lot.
Im kind of surprised other modules are not setting codes for no comms with the AAC module, Im just going over the AAC diagrams again, it takes forever to find a single component on these diagrams, it looks like the Can bus wires run to the "Cockpit Voltage distributor connector" (so a Can Splice pack), you may be able to seperate the wires coming from the AAC module from there and check its output alone, thats what I would do considering you have communication codes.
Do you want me to post these AAC diagrams again. It does show the blower regulator, the sun sensor wiring, etc.

I've gone through and labelled some of the components on the AAC module diagrams (2-4 below) and you can find each on the list (diagram 1), it's just a matter of locating the letter and number listing, and diagram 5, 6 are for the Multifunction Sensor (humidity sensor). These cars are tough to work on, even for a 2003, it takes more time to do research in service info than anything else. You can try unplugging some sensors and see if the AAC unit starts working again, it does look like the sun sensor works off a 12v reference that comes directly from the AAC unit itself.

Yes, I understand your waveform, it should be pulling to 0volts (ground), that why I mentioned that wire might be shorted to a different wire somewhere, just looking at these diagrams again trying to identify the wire you are reading this signal on, they have the fan connector labelled as M/3x1, which I see here, unfortunately they have the fan connector cut off at the section where it goes to the next page of the diagrams, and since this is the original OEM wiring its showing a 2 wire connector (a Black wire and a Green wire), whereas the TSB shows a 4 wire connector,
I am going to try to paste these pages together so we can see exactly where the fan control module gets its inputs from, its looks like the "Right Front fuse and relay module"

The waveform is strange for sure, the really difficult part is that after this x1 fan connector the wires look to change colors going to the control module (the N65/2 Suction cooling fan control module). The Green wire goes to red (+) and the black (-) wire goes to blue.
So, your waveform is on the red wire, is that correct?

Service info states the fan will default to high with a loss of communications, I agree the issue is probably not the sensors, they are just setting codes because a module is not receiving data from them, so we're on the same page here.
I think some of these fuse boxes are mislabeled as well, but just so I'm looking at the correct wire, regardless of if its labelled incorrectly, your waveform is on the red fan wire. I know I've probably asked that already, but I'm looking at the power distribution diagrams now as well.

Okay, that helps, they have each system all on the same diagrams, I found the 4 wire cooling fan unit, so pin 2 should be the Red power wire from a fuse, but the control wire coming out on pin 4 runs back through the K40/7 Right Front fuse/relay module on (connector C1 pin 4) then out on (connector MR2 pin 2) to the ECU (N3/10) connector 4 pin 39. I will post the diagram of that with the ECU connector,
I was meaning that the wire might be shorted to a power wire, not ground, such as a short to a 5volt reference and that's why it's not pulling to ground. But let me get this diagram together for you. Obviously, the wire colors are not completely correct.

Okay, the 1st diagram is the cooling fan integrated unit with a 4 wire connector, so with the fan unplugged you should read 12volts on the red wire Pin 2 since it's supposed to come from a fuse, so I would verify there's a full 12volts there, you could use pin 1, the Brown wire as your ground when checking that, Pin 3 is also supposed to be 12volts,
The Fan module shows a power transistor (Power Mosfet) inside of it on the Power Distribution wiring diagram, but also shows another transistor on the other end where the wire runs into the ECU, so I would scope across the red and control wire with the fan unplugged, and see if you have a normal pwm signal, that way you can isolate the issue to either the fan module or ECU, even go right to the ECU and scope there to make sure there's no shorts to power inside that Right Fuse/Relay module. Breaking down the circuit like that can help figure out where the fault is faster, I'd be curious to see what readings you get on each wire with the fan module unplugged. It's kind of strange the route the circuit takes.

3.5volts sounds like a CAN High signal, does it drop to 2.5volts on the low side?

What do you get with the fan unplugged, do you get a 0v-12v pwm? A Can High signal would be 2.5 to 3.5v and Can Low would be 2.5v down to 1.5v, riding on a 2.5volt bias level, so that's probably not a can signal then. I'll see if I can find any operations info on the fan, but I still think the Bus codes are a factor.

So the fan is blasting away on high with only a 3.5-3.8 voltage signal? Does the blower motor work at all, or any of the climate controls?

Okay, a quick random search showed a B1350 code is a Can Bus Communication Fault on a Merc, the scan tool might not be interpreting the code numbers correctly, which is not uncommon, scan tool data is not always correct,
I would see what the waveform looks like for some of the Can bus networks in the vehicle, the easiest to check is the data link connector, pins 6 and 14 are the two can high and low pins, Pins 4 and 5 are grounds, unfortunately service info doesn't show a picture of the DLC in this vehicle, but pin 16 is always B+, so you can identify pins 6(high) and 14(low). And use 4(chassis ground) and 5(sensor ground) for ground connection.
If you see anything that's not square in the signal, such as a message packet that randomly comes by, that can be a single module sending out corrupt messages, or any lines that rise or fall with a sloped angle that can be a short between high and low, but just see what you find, you might just see a bad message every once and awhile, if you can set a trigger on your scope and adjust your time base, you might catch something, the messages are so fast though it can be difficult with smaller scopes. It's worth checking out though.

Hello, sorry for the delay, I had to go out on a mobile call yesterday, and yes to your question, its actually pretty common when there is an ECM (ME_SFI) communications issue for the fan to default to high, I have seen it before. The code numbers are not matching up with what the oem has listed in some areas, but thats not uncommon as well. Do you know the location of the ECM? This is where your scope is going to be very useful. I know some of the ECMs are located in the engine compartment under the windshield cowl section, so you can scope the Can bus right at the ECM or at the splice pack for the Can bus, I would go right to the ECM, because if it is actually located in the engine compartment, there might be an issue with its connector(s) being corroded due to water intrusion.