fix(vendor): evidence-based pass — max-first stack ceiling; the local player resolves never-animated MoveTo targets

Both chains pinned by the live [vendor-diag] run (vendor-diag.log)
after three code-reading rounds each failed:

The split bar: ACE serializes descStackSize=1 for EVERY browse row
(live wire, log 343-348) — the R1-era "ACE never populates desc"
claim is retracted with the line quoted. Retail's vendor sites read
pwd._maxStackSize directly (four sites, incl. UpdateItemsList
@0x004c1ea0 stamping min(remaining, _maxStackSize));
ResolveAuthoredStackSize flips to max-first for its vendor-only
consumers. Taper ceiling 1000, scarab 100, seed 1 for exempt.
Pricing still reads the desc (per-1 values on ACE).

Walk-to-use: the local player's getObjectA seam was bound to
TryGetPhysicsHost, which resolves only INSTALLED physics hosts — a
never-animated vendor has none, so TargetManager.SetTarget got null,
the MoveToObject armed with zero nodes, and UseTime never dispatched.
The log's natural=False completions were the user's own movement keys
(retail-correct input-edge cancels); attempt 4 worked because the
greeting animation had installed a host. RuntimePhysicsState gains
the retail CObjectMaint::GetObjectA seam (bound canonical resolver
with installed-host fallback); the graphical host binds the SAME
lazy-minimal-host resolver every remote already uses — whose own doc
comment names this exact never-animated hazard. The reservation
release was already correct (2b premise refuted with evidence); the
production-wiring invariants are now pinned by four new tests
including the pre-fix pathology as a permanent sabotage control.

AP-169 rewritten a second time, honestly. The [vendor-diag] probe
family (ACDREAM_DUMP_VENDOR) lands env-gated for future live triage.

Clean-room complete solution: 11,536 passed / 4 skipped / 0 failed.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

src/AcDream.Runtime/Gameplay/RuntimeInteractionTransactionState.cs

@@ -193,33 +193,43 @@ public sealed class RuntimeInteractionTransactionState : IDisposable
         ObjectDisposedException.ThrowIf(_disposed, this);
         ArgumentNullException.ThrowIfNull(transport);
         sequence = 0u;
+        RuntimeInteractionDispatchResult verdict;
 
         if (serverGuid == 0u)
         {
             reservation?.CancelBeforeDispatch();
-            return RuntimeInteractionDispatchResult.Rejected;
+            verdict = RuntimeInteractionDispatchResult.Rejected;
         }
-        if (!transport.IsInWorld)
+        else if (!transport.IsInWorld)
         {
             reservation?.CancelBeforeDispatch();
-            return RuntimeInteractionDispatchResult.NotInWorld;
+            verdict = RuntimeInteractionDispatchResult.NotInWorld;
         }
-        if (!ownedByPlayer && !useable)
+        else if (!ownedByPlayer && !useable)
         {
             reservation?.CancelBeforeDispatch();
-            return RuntimeInteractionDispatchResult.NotUseable;
+            verdict = RuntimeInteractionDispatchResult.NotUseable;
         }
-        if (!transport.TrySendUse(serverGuid, out sequence))
+        else if (!transport.TrySendUse(serverGuid, out sequence))
         {
             reservation?.CancelBeforeDispatch();
-            return RuntimeInteractionDispatchResult.Rejected;
+            verdict = RuntimeInteractionDispatchResult.Rejected;
+        }
+        else
+        {
+            reservation?.MarkDispatched();
+            _lastUseSourceId = serverGuid;
+            _lastUseTargetId = 0u;
+            IncrementRevision();
+            verdict = RuntimeInteractionDispatchResult.Dispatched;
         }
 
-        reservation?.MarkDispatched();
-        _lastUseSourceId = serverGuid;
-        _lastUseTargetId = 0u;
-        IncrementRevision();
-        return RuntimeInteractionDispatchResult.Dispatched;
+        if (VendorDiagnostics.DumpVendorEnabled)
+        {
+            Console.WriteLine(
+                $"[vendor-diag] TryDispatchUse guid=0x{serverGuid:X8} ownedByPlayer={ownedByPlayer} useable={useable} verdict={verdict} seq={sequence}");
+        }
+        return verdict;
     }
 
     public bool TryDispatchTargetedUse(
@@ -623,6 +633,11 @@ public sealed class RuntimeInteractionTransactionState : IDisposable
         if (_pendingUse is not { } current
             || current.ApproachToken != approachToken)
         {
+            if (VendorDiagnostics.DumpVendorEnabled)
+            {
+                Console.WriteLine(
+                    $"[vendor-diag] TryResolveUseApproachCompletion no-match approachToken=({approachToken.ControllerLifetime},{approachToken.ApproachGeneration}) natural={natural} hasPendingUse={_pendingUse is not null}");
+            }
             pending = default;
             return false;
         }
@@ -630,6 +645,11 @@ public sealed class RuntimeInteractionTransactionState : IDisposable
         _pendingUse = null;
         pending = current;
         IncrementRevision();
+        if (VendorDiagnostics.DumpVendorEnabled)
+        {
+            Console.WriteLine(
+                $"[vendor-diag] TryResolveUseApproachCompletion guid=0x{pending.ServerGuid:X8} natural={natural} accepted={natural}");
+        }
         return natural;
     }
 

src/AcDream.Runtime/Gameplay/RuntimeLocalPlayerPhysicsPublicationState.cs

@@ -296,9 +296,24 @@ internal sealed class RuntimeLocalPlayerPhysicsPublicationState : IDisposable
             minterpMaxSpeed: () => motion.GetAdjustedMaxSpeed(),
             curTime: () => controller.SimTimeSeconds,
             physicsTimerTime: () => controller.SimTimeSeconds,
-            getObjectA: id => _physics.TryGetPhysicsHost(id, out var host)
-                ? host
-                : null,
+            // 2026-08-08 vendor-approach root cause: this seam is retail's
+            // CObjectMaint::GetObjectA — it must resolve ANY in-world object
+            // so TargetManager.SetTarget's add_voyeur can deliver the
+            // immediate initial snapshot that a deferred MoveToObject/
+            // TurnToObject needs before it queues a single node (UseTime's
+            // object-move gate stays closed until that first
+            // HandleUpdateTarget). The previous binding went straight to
+            // _physics.TryGetPhysicsHost, which answers only entities whose
+            // host is ALREADY installed (remote-motion-bound movers) — a
+            // never-animated NPC/static target resolved to null, add_voyeur
+            // never ran, and the armed approach sat inert (no nodes, no
+            // movement, no completion) until user input or the 10 s
+            // staleness timeout cancelled it. ResolveObjectTableHost routes
+            // through the host-bound canonical resolver (the SAME
+            // lazy-minimal-host lookup every remote host's GetObjectA uses)
+            // and falls back to the exact installed-host lookup when no
+            // resolver is bound (no-window hosts).
+            getObjectA: _physics.ResolveObjectTableHost,
             // C3c: the [autowalk-target]/[autowalk-end] probes moved here
             // with controller construction (previously App-side in
             // PlayerModeController.BuildControllerAndCamera); they stay on

src/AcDream.Runtime/Gameplay/VendorShopItemMaterializer.cs

@@ -191,6 +191,7 @@ public sealed class VendorShopItemMaterializer : IDisposable
                 }
             }
 
+            int diagIndex = 0;
             foreach (VendorShopItem item in currentItems)
             {
                 bool ownedAlready = _ownedGuids.ContainsKey(item.ItemGuid);
@@ -206,7 +207,19 @@ public sealed class VendorShopItemMaterializer : IDisposable
                     continue;
                 }
 
-                _objects.Ingest(ToWeenieData(item, transition.VendorId));
+                WeenieData materialized = ToWeenieData(item, transition.VendorId);
+                if (VendorDiagnostics.DumpVendorEnabled && diagIndex < 5)
+                {
+                    Console.WriteLine(
+                        $"[vendor-diag] materialize[{diagIndex}] guid=0x{item.ItemGuid:X8} "
+                        + $"descStackSize={(item.DescStackSize is { } ds ? ds.ToString() : "null")} "
+                        + $"maxStackSize={(item.MaxStackSize is { } ms ? ms.ToString() : "null")} "
+                        + $"resolvedStackSize={(materialized.StackSize is { } rs ? rs.ToString() : "null")} "
+                        + $"resolvedStackSizeMax={(materialized.StackSizeMax is { } rm ? rm.ToString() : "null")}");
+                    diagIndex++;
+                }
+
+                _objects.Ingest(materialized);
                 nextOwned[item.ItemGuid] = transition.VendorId;
             }
         }
@@ -249,25 +262,30 @@ public sealed class VendorShopItemMaterializer : IDisposable
     /// appeared for ANY vendor stack.
     /// </para>
     /// <para>
-    /// <b>The G2 packed-supply-count fallback (retired 2026-08-08).</b> An
-    /// earlier fix fell back to <see cref="VendorShopItem.StackSize"/> (the
-    /// packed ItemProfile "how many for sale" dword) when
+    /// <b>The G2 packed-supply-count fallback (retired 2026-08-08) and the
+    /// R1 desc-first preference (retired the same day, live evidence).</b>
+    /// An earlier fix fell back to <see cref="VendorShopItem.StackSize"/>
+    /// (the packed ItemProfile "how many for sale" dword) when
     /// <c>DescStackSize</c> was absent. That did not survive live testing —
     /// a standard vendor listing (e.g. a Prismatic Taper) has UNLIMITED
     /// stock (<c>StackSize == -1</c>), so the fallback produced nothing
-    /// usable and the bar stayed hidden, matching the live report exactly
-    /// (bare "Prismatic Taper", no bar, no count). The live retail
-    /// screenshot showed "1000 Prismatic Tapers" with the bar visible and a
-    /// ceiling of 1000 — 1000 being the taper's authored MAX STACK SIZE, not
-    /// any bounded supply count. This now prefers <c>DescStackSize</c> when
-    /// present (retail-faithful first, forward-compatible with any server
-    /// that DOES populate it), falling back to
-    /// <see cref="VendorShopItem.MaxStackSize"/> — the item TYPE's authored
-    /// stack ceiling, which ACE DOES populate (an ordinary weenie property)
-    /// and which a real retail server evidently uses AS <c>_stackSize</c>
-    /// for an unlimited-supply "one full stack" browse listing. See
-    /// <see cref="VendorSplitPolicy.ResolveAuthoredStackSize"/> and the
-    /// register, AP-169.
+    /// usable and the bar stayed hidden. The R1 replacement preferred
+    /// <c>DescStackSize</c> on the theory that ACE never populates it for a
+    /// browse row; the 2026-08-08 vendor-diag live run refuted THAT too —
+    /// ACE serializes <c>descStackSize=1</c> for every browse row, so
+    /// desc-first resolved every vendor stack to 1 and the bar stayed
+    /// hidden again. The operand retail's own vendor UI reads is
+    /// <c>PublicWeenieDesc::_maxStackSize</c> directly
+    /// (<c>VendorItemsUI::UpdateItemsList</c> <c>0x004c1ea0</c>,
+    /// <c>pc:201085-201133</c>: each row displays
+    /// <c>min(remaining, _maxStackSize)</c>, plain <c>_maxStackSize</c> for
+    /// unlimited supply; <c>gmVendorUI::InqListSlotCount</c>
+    /// <c>pc:200052</c> and the Buy cases <c>pc:203996</c>/<c>204086</c>
+    /// gate on the same field), matching the live retail screenshot
+    /// ("1000 Prismatic Tapers", ceiling 1000 = the authored max stack
+    /// size). <see cref="VendorSplitPolicy.ResolveAuthoredStackSize"/> is
+    /// therefore max-first with <c>DescStackSize</c> as the fallback. See
+    /// the register, AP-169.
     /// </para>
     /// <para>
     /// Every other field <see cref="VendorShopItem"/> doesn't carry