fix(vendor): evidence-based pass — max-first stack ceiling; the local player resolves never-animated MoveTo targets

Both chains pinned by the live [vendor-diag] run (vendor-diag.log)
after three code-reading rounds each failed:

The split bar: ACE serializes descStackSize=1 for EVERY browse row
(live wire, log 343-348) — the R1-era "ACE never populates desc"
claim is retracted with the line quoted. Retail's vendor sites read
pwd._maxStackSize directly (four sites, incl. UpdateItemsList
@0x004c1ea0 stamping min(remaining, _maxStackSize));
ResolveAuthoredStackSize flips to max-first for its vendor-only
consumers. Taper ceiling 1000, scarab 100, seed 1 for exempt.
Pricing still reads the desc (per-1 values on ACE).

Walk-to-use: the local player's getObjectA seam was bound to
TryGetPhysicsHost, which resolves only INSTALLED physics hosts — a
never-animated vendor has none, so TargetManager.SetTarget got null,
the MoveToObject armed with zero nodes, and UseTime never dispatched.
The log's natural=False completions were the user's own movement keys
(retail-correct input-edge cancels); attempt 4 worked because the
greeting animation had installed a host. RuntimePhysicsState gains
the retail CObjectMaint::GetObjectA seam (bound canonical resolver
with installed-host fallback); the graphical host binds the SAME
lazy-minimal-host resolver every remote already uses — whose own doc
comment names this exact never-animated hazard. The reservation
release was already correct (2b premise refuted with evidence); the
production-wiring invariants are now pinned by four new tests
including the pre-fix pathology as a permanent sabotage control.

AP-169 rewritten a second time, honestly. The [vendor-diag] probe
family (ACDREAM_DUMP_VENDOR) lands env-gated for future live triage.

Clean-room complete solution: 11,536 passed / 4 skipped / 0 failed.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

tests/AcDream.App.Tests/UI/Layout/SelectedObjectControllerTests.cs

@@ -696,8 +696,12 @@ public class SelectedObjectControllerTests
     /// operand is the item's authored <see cref="VendorShopItem.MaxStackSize"/>
     /// (1000 for a Prismatic Taper), not any supply count. This fixture now
     /// matches that exact ACE-realistic shape: unlimited packed supply, no
-    /// <c>DescStackSize</c> (ACE never sets it — see the class doc above),
-    /// <c>MaxStackSize=1000</c> from the wire.
+    /// <c>DescStackSize</c>, <c>MaxStackSize=1000</c> from the wire.
+    /// (Second correction, 2026-08-08: the live vendor-diag wire showed ACE
+    /// actually serializes <c>descStackSize=1</c> for every browse row, so
+    /// the resolver is now max-FIRST — see
+    /// <see cref="LiveAceWireShape_DescOneMaxHundred_ShowsSplitSliderWithTheAuthoredCeiling"/>;
+    /// this desc-absent fixture resolves identically either way.)
     /// </para>
     /// </summary>
     [Fact]
@@ -744,23 +748,20 @@ public class SelectedObjectControllerTests
                 && vendorCandidate.ContainerId == vendor.VendorId
                 && VendorSplitPolicy.IsSplitExempt(vendorCandidate.Type));
 
-        // G2 root cause, R1-corrected: a REAL ACE vendor listing,
-        // byte-for-byte. ACE's Vendor.LoadInventoryItem (Vendor.cs:144-172)
-        // builds the browse-list WorldObject via
-        // WorldObjectFactory.CreateNewWorldObject and sets ONLY
-        // wo.VendorShopCreateListStackSize = stackSize ?? -1 (the "how many
-        // available" packed dword — our VendorShopItem.StackSize) — it
-        // NEVER calls wo.SetStackSize(...), so the per-item
-        // PublicWeenieDesc's own conditional StackSize field (our
-        // DescStackSize — retail's pwd._stackSize, what
-        // GameEventApproachVendor.cs:60's SerializeGameDataOnly walks) comes
-        // back null on the real wire. A STANDARD listing (unlimited stock,
+        // G2 root cause, R1-corrected, second-corrected 2026-08-08: a REAL
+        // ACE vendor listing. The R1 reading of Vendor.LoadInventoryItem
+        // concluded DescStackSize "comes back null on the real wire"; the
+        // live vendor-diag capture showed the real wire actually carries
+        // descStackSize=1 for every browse row — either way the field never
+        // names a usable ceiling. A STANDARD listing (unlimited stock,
         // packed StackSize=-1) is the common case the live re-test actually
         // hit — matching the retail screenshot's Prismatic Taper, not a
         // bounded-supply item like the original fixture's "100 arrows".
         // MaxStackSize=1000 IS reliably populated by ACE (an ordinary
-        // weenie property), which is the field the toolbar ceiling now
-        // resolves through — see VendorSplitPolicy.ResolveAuthoredStackSize.
+        // weenie property), and it is retail's own vendor-side operand
+        // (VendorItemsUI::UpdateItemsList 0x004c1ea0 stamps each row's
+        // displayed stack from pwd._maxStackSize), which the resolver now
+        // prefers — see VendorSplitPolicy.ResolveAuthoredStackSize.
         vendor.Apply(
             vendorGuid,
             new VendorShopProfile(0u, 0u, 0u, false, 1.0f, 1.5f, 0u, 0u, ""),
@@ -788,6 +789,95 @@ public class SelectedObjectControllerTests
         controller.Dispose();
     }
 
+    /// <summary>
+    /// 2026-08-08 live-evidence re-fix (register AP-169, second
+    /// correction): the EXACT live ACE wire shape the vendor-diag run
+    /// captured — every browse row carries <c>descStackSize=1</c> AND
+    /// <c>stackSizeMax</c> (e.g. a Lead Scarab: desc 1, max 100). The R1
+    /// desc-first resolver read the 1 and the split bar never appeared
+    /// (`ApplySelection ... sliderVisible=false
+    /// failingPredicate=stackSize&lt;=1u stackSize=1` in the live log).
+    /// Retail's vendor UI reads <c>pwd._maxStackSize</c> directly
+    /// (<c>VendorItemsUI::UpdateItemsList</c> <c>0x004c1ea0</c>), so the
+    /// selection must show the bar with ceiling 100, seeded at 1 (scarabs
+    /// are SpellComponents — split-exempt), and the retail "{count}
+    /// {plural name}" label. Same REAL-materializer wiring as the G2 test
+    /// above. Sabotage-verified: restoring the desc-first preference
+    /// resolves the operand to 1 and every assertion below fails.
+    /// </summary>
+    [Fact]
+    public void LiveAceWireShape_DescOneMaxHundred_ShowsSplitSliderWithTheAuthoredCeiling()
+    {
+        const uint vendorGuid = 0x70000012u;
+        const uint scarabGuid = 0x60009012u;
+
+        ImportedLayout layout = FixtureLoader.LoadToolbar();
+        var objects = new ClientObjectTable();
+        var vendor = new VendorState();
+        var selection = new SelectionState();
+        var splitQuantity = new StackSplitQuantityState();
+        using var materializer = new VendorShopItemMaterializer(vendor, objects);
+
+        SelectedObjectController controller = SelectedObjectController.Bind(
+            layout,
+            selection,
+            subscribeHealthChanged: _ => { },
+            unsubscribeHealthChanged: _ => { },
+            subscribeItemManaChanged: _ => { },
+            unsubscribeItemManaChanged: _ => { },
+            isHealthTarget: _ => false,
+            isOwnedByPlayer: _ => false,
+            name: guid => objects.Get(guid)?.GetAppropriateName(),
+            healthPercent: _ => 0f,
+            hasHealth: _ => false,
+            stackSize: guid => (uint)(objects.Get(guid)?.StackSize ?? 0),
+            sendQueryHealth: _ => { },
+            manaPercent: _ => 0f,
+            sendQueryItemMana: _ => { },
+            datFont: null,
+            splitQuantity: splitQuantity,
+            subscribeObjectUpdated: h => objects.ObjectUpdated += h,
+            unsubscribeObjectUpdated: h => objects.ObjectUpdated -= h,
+            isVendorSplitExempt: guid =>
+                vendor.VendorId != 0u
+                && objects.Get(guid) is { } vendorCandidate
+                && vendorCandidate.ContainerId == vendor.VendorId
+                && VendorSplitPolicy.IsSplitExempt(vendorCandidate.Type));
+
+        vendor.Apply(
+            vendorGuid,
+            new VendorShopProfile(0u, 0u, 0u, false, 1.0f, 1.5f, 0u, 0u, ""),
+            new[]
+            {
+                new VendorShopItem(
+                    scarabGuid, StackSize: -1, WeenieClassId: 5u, Name: "Lead Scarab",
+                    ItemType: (uint)ItemType.SpellComponents, IconId: 200u, Value: 10,
+                    DescStackSize: 1, MaxStackSize: 100, PluralName: "Lead Scarabs"),
+            });
+        Assert.Equal(100, objects.Get(scarabGuid)!.StackSize);
+
+        selection.Select(scarabGuid, SelectionChangeSource.Vendor);
+
+        var slider = Assert.IsType<UiScrollbar>(
+            layout.FindElement(SelectedObjectController.StackSizeSliderId));
+        Assert.True(slider.Visible);
+        Assert.Equal(100u, splitQuantity.Maximum);
+        // Split-exempt (SpellComponents intersects the 0xDC41CB0 mask):
+        // seeds at 1, ceiling stays the authored stack.
+        Assert.Equal(1u, splitQuantity.GetObjectSplitSize(
+            scarabGuid, scarabGuid, 100u));
+
+        // Retail's "{count} {plural}" toolbar label.
+        var nameElement = layout.FindElement(SelectedObjectController.NameId);
+        Assert.NotNull(nameElement);
+        UiText nameLabel = Assert.Single(nameElement!.Children.OfType<UiText>());
+        string renderedName = string.Concat(
+            nameLabel.LinesProvider().Select(static line => line.Text));
+        Assert.Equal("100 Lead Scarabs", renderedName);
+
+        controller.Dispose();
+    }
+
     [Fact]
     public void C4_VendorOwnedSplitExemptStackSelection_MatchesRetailsToolbarPresentation()
     {