fix(vendor): evidence-based pass — max-first stack ceiling; the local player resolves never-animated MoveTo targets

Both chains pinned by the live [vendor-diag] run (vendor-diag.log)
after three code-reading rounds each failed:

The split bar: ACE serializes descStackSize=1 for EVERY browse row
(live wire, log 343-348) — the R1-era "ACE never populates desc"
claim is retracted with the line quoted. Retail's vendor sites read
pwd._maxStackSize directly (four sites, incl. UpdateItemsList
@0x004c1ea0 stamping min(remaining, _maxStackSize));
ResolveAuthoredStackSize flips to max-first for its vendor-only
consumers. Taper ceiling 1000, scarab 100, seed 1 for exempt.
Pricing still reads the desc (per-1 values on ACE).

Walk-to-use: the local player's getObjectA seam was bound to
TryGetPhysicsHost, which resolves only INSTALLED physics hosts — a
never-animated vendor has none, so TargetManager.SetTarget got null,
the MoveToObject armed with zero nodes, and UseTime never dispatched.
The log's natural=False completions were the user's own movement keys
(retail-correct input-edge cancels); attempt 4 worked because the
greeting animation had installed a host. RuntimePhysicsState gains
the retail CObjectMaint::GetObjectA seam (bound canonical resolver
with installed-host fallback); the graphical host binds the SAME
lazy-minimal-host resolver every remote already uses — whose own doc
comment names this exact never-animated hazard. The reservation
release was already correct (2b premise refuted with evidence); the
production-wiring invariants are now pinned by four new tests
including the pre-fix pathology as a permanent sabotage control.

AP-169 rewritten a second time, honestly. The [vendor-diag] probe
family (ACDREAM_DUMP_VENDOR) lands env-gated for future live triage.

Clean-room complete solution: 11,536 passed / 4 skipped / 0 failed.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

src/AcDream.App/Composition/SessionPlayerComposition.cs

@@ -509,6 +509,20 @@ internal sealed class SessionPlayerCompositionPhase
             d.PlayerIdentity,
             dormantLiveEntities,
             d.Options.DumpLiveSpawns ? d.Log : null);
+        // 2026-08-08 vendor-approach root cause: the local player's
+        // publication-chain host resolves moveto/sticky targets through
+        // RuntimePhysicsState.ResolveObjectTableHost. Bind the graphical
+        // host's canonical CObjectMaint::GetObjectA stand-in — the SAME
+        // lazy-minimal-host resolver every remote host's GetObjectA uses
+        // (LiveEntityMotionRuntimeController.ResolvePhysicsHost, reached
+        // through the deferred motion-bindings seam so this closure stays
+        // valid across session routes). Without it the local player's
+        // MoveToObject against a never-animated NPC/static object never
+        // received TargetManager.AddVoyeur's immediate initial snapshot and
+        // sat armed-but-inert forever (no nodes, no movement, no natural
+        // completion).
+        live.LiveEntities.Physics.BindObjectTableHostResolver(
+            guid => d.MotionBindings.ResolvePhysicsHost(guid));
         // C3c: the graphical first-entry drive controller — walks every
         // initial-Create residence through its Runtime conductor with the
         // production prepared-collision source, the live movement-skill