fix(vendor): evidence-based pass — max-first stack ceiling; the local player resolves never-animated MoveTo targets

Both chains pinned by the live [vendor-diag] run (vendor-diag.log)
after three code-reading rounds each failed:

The split bar: ACE serializes descStackSize=1 for EVERY browse row
(live wire, log 343-348) — the R1-era "ACE never populates desc"
claim is retracted with the line quoted. Retail's vendor sites read
pwd._maxStackSize directly (four sites, incl. UpdateItemsList
@0x004c1ea0 stamping min(remaining, _maxStackSize));
ResolveAuthoredStackSize flips to max-first for its vendor-only
consumers. Taper ceiling 1000, scarab 100, seed 1 for exempt.
Pricing still reads the desc (per-1 values on ACE).

Walk-to-use: the local player's getObjectA seam was bound to
TryGetPhysicsHost, which resolves only INSTALLED physics hosts — a
never-animated vendor has none, so TargetManager.SetTarget got null,
the MoveToObject armed with zero nodes, and UseTime never dispatched.
The log's natural=False completions were the user's own movement keys
(retail-correct input-edge cancels); attempt 4 worked because the
greeting animation had installed a host. RuntimePhysicsState gains
the retail CObjectMaint::GetObjectA seam (bound canonical resolver
with installed-host fallback); the graphical host binds the SAME
lazy-minimal-host resolver every remote already uses — whose own doc
comment names this exact never-animated hazard. The reservation
release was already correct (2b premise refuted with evidence); the
production-wiring invariants are now pinned by four new tests
including the pre-fix pathology as a permanent sabotage control.

AP-169 rewritten a second time, honestly. The [vendor-diag] probe
family (ACDREAM_DUMP_VENDOR) lands env-gated for future live triage.

Clean-room complete solution: 11,536 passed / 4 skipped / 0 failed.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

src/AcDream.App/UI/Layout/VendorUiController.cs

@@ -1401,15 +1401,18 @@ public sealed class VendorUiController : IRetainedPanelController, IItemListDrag
     /// this one — otherwise the CURRENT slider value via
     /// <c>ItemHolder::GetObjectSplitSize</c> (<c>0x00586F00</c>).
     /// <para>
-    /// R1 gate-finding fix (2026-08-08, register AP-169 correction): the
-    /// ceiling this gates on is <see cref="VendorSplitPolicy.ResolveAuthoredStackSize"/>
-    /// — <see cref="VendorShopItem.DescStackSize"/> when the wire carries
-    /// it, else <see cref="VendorShopItem.MaxStackSize"/> — the SAME
-    /// resolution <see cref="VendorShopItemMaterializer"/> uses to seed
-    /// <see cref="ClientObject.StackSize"/> (and therefore the toolbar
-    /// slider's own ceiling, <c>SelectedObjectController</c>). Using a
-    /// narrower source here than the visible slider would let the slider
-    /// show a ceiling of 1000 while every Buy still sent quantity 1.
+    /// R1 gate-finding fix, CORRECTED at the 2026-08-08 live-evidence
+    /// re-fix (register AP-169, second correction): the ceiling this gates
+    /// on is <see cref="VendorSplitPolicy.ResolveAuthoredStackSize"/> —
+    /// <see cref="VendorShopItem.MaxStackSize"/> FIRST (retail's own
+    /// vendor-owned quantity operand: the Buy cases at
+    /// <c>pc:203996</c>/<c>204086</c> gate on <c>pwd._maxStackSize &gt; 1</c>
+    /// literally), falling back to <see cref="VendorShopItem.DescStackSize"/>
+    /// — the SAME resolution <see cref="VendorShopItemMaterializer"/> uses
+    /// to seed <see cref="ClientObject.StackSize"/> (and therefore the
+    /// toolbar slider's own ceiling, <c>SelectedObjectController</c>).
+    /// Using a narrower source here than the visible slider would let the
+    /// slider show a ceiling of 1000 while every Buy still sent quantity 1.
     /// </para>
     /// </summary>
     private uint ResolveBuyQuantity(VendorShopItem item)