feat(R4-V3): wire completion - mt 8/9 parsing + full params exposure + the mt-0 sticky trailer (closes M7, M13, M14-wire-note)

UpdateMotion now parses TurnToObject (mt 8: guid, standalone wire
heading, 3-dword UnPackNet) and TurnToHeading (mt 9: 3-dword UnPackNet)
into a new TurnToPathData sibling record (the two wire forms genuinely
diverge - 7-dword move UnPackNet with Origin head vs 3-dword turn
UnPackNet with guid+heading head; every consumer switches on
MovementType first, so no polymorphic shape was invented). mt 6/7
exposure widened additively so ALL UnPackNet fields reach
MovementParameters.FromWire. The mt=0 motionFlags sticky-guid trailer
(bit 0x1) is parsed for cursor honesty and carried unconsumed until R5
- scoped to mt=0 ONLY per both ACE's writer (MovementInvalid.Write) and
the decomp's case-0 read, tighter than the plan sketched; the
StandingLongJump bit (0x2) doc-noted as the R5 unpack_movement item.
MoveToRunRate doc-pointered as the V4/V5 MyRunRate write.

11 new golden-byte tests hand-assembled from ACE's writers
(MovementData/TurnToObject/TurnToParameters/TurnToHeading/
MoveToParameters/MovementInvalid) incl. flag-permutation round-trips
and the trailer cursor-honesty case; the existing 12 mt 6/7 fixtures
pass unchanged. Full suite: 3,972 passed.

Implemented by a dedicated agent against the V0-pinned spec (P6 order
confirmed exactly); scope + suite independently verified.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/AcDream.Core.Net/Messages/CreateObject.cs

@@ -217,6 +217,21 @@ public static class CreateObject
     ///   0x40=TurnSpeed.
     /// </para>
     /// </summary>
+    /// <param name="MoveToRunRate">
+    /// R4-V3 deliverable D — the trailing <c>f32 runRate</c> on MoveToObject
+    /// (6) / MoveToPosition (7) payloads. Retail's <c>unpack_movement</c>
+    /// writes this straight onto <c>CMotionInterp::my_run_rate</c>
+    /// (r4-moveto-decomp.md §2f: <c>this->motion_interpreter->my_run_rate =
+    /// read_float()</c>, both @300603 case 6 and @300660 case 7 — SAME
+    /// write for both types, immediately after <c>UnPackNet</c>). Today this
+    /// field only seeds <c>PlanMoveToStart</c>'s local heuristic (plan M13);
+    /// the interp's actual <see cref="AcDream.Core.Physics.MotionInterpreter.MyRunRate"/>
+    /// field is a SEPARATE consumer write the V4/V5 MoveToManager cutover
+    /// performs at the GameWindow mt 6-9 routing site (r4-port-plan.md §4,
+    /// step 2: <c>Motion.MyRunRate = MoveToRunRate</c>) — this record is
+    /// wire-primitive only; it does not write MotionInterpreter state
+    /// itself.
+    /// </param>
     public readonly record struct ServerMotionState(
         ushort Stance,
         ushort? ForwardCommand,
@@ -230,7 +245,24 @@ public static class CreateObject
         uint? MoveToParameters = null,
         float? MoveToSpeed = null,
         float? MoveToRunRate = null,
-        MoveToPathData? MoveToPath = null)
+        MoveToPathData? MoveToPath = null,
+        // R4-V3 (closes M7): movement types 8 (TurnToObject) and 9
+        // (TurnToHeading) — previously dropped end-to-end (UpdateMotion.cs
+        // only branched on `movementType is 6 or 7`). Carries the DECODED
+        // wire payload (guid + standalone wire_heading for type 8, plus the
+        // shared 3-dword UnPackNet triple for both types) per V0-pins.md P6.
+        TurnToPathData? TurnToPath = null,
+        // R4-V3 (closes M14-wire-note): the 0xF74C motionFlags sticky-guid
+        // trailer, mt=0 (Invalid) only — ACE MovementInvalid.Write gates the
+        // trailing guid on MotionFlags.StickToObject (0x1); the decomp's
+        // `unpack_movement` case 0 reads it right after
+        // InterpretedMotionState::UnPack (r4-moveto-decomp.md §2f
+        // @0052455d: `if (header & 0x100) sticky_object_guid = read_dword()`
+        // — bit 0x100 of the combined header word is motionFlags byte1&0x1).
+        // Carried unconsumed until R5's PositionManager::StickTo body binds
+        // it; parsing it here just keeps the buffer cursor honest past this
+        // field (deliverable C — no behavior).
+        uint? StickyObjectGuid = null)
     {
         /// <summary>
         /// ACE/retail movement types 6 and 7 are server-controlled
@@ -240,6 +272,13 @@ public static class CreateObject
         /// </summary>
         public bool IsServerControlledMoveTo => MovementType is 6 or 7;
 
+        /// <summary>
+        /// R4-V3: movement types 8 (TurnToObject) and 9 (TurnToHeading) —
+        /// the turn-only sibling of <see cref="IsServerControlledMoveTo"/>.
+        /// Neither carries an InterpretedMotionState.ForwardCommand either.
+        /// </summary>
+        public bool IsServerControlledTurnTo => MovementType is 8 or 9;
+
         public bool MoveToCanRun => !MoveToParameters.HasValue
             || (MoveToParameters.Value & 0x2u) != 0;
 
@@ -301,6 +340,50 @@ public static class CreateObject
         float WalkRunThreshold,
         float DesiredHeading);
 
+    /// <summary>
+    /// R4-V3 (closes M7) — path-control payload of a server-controlled
+    /// TurnTo packet (movementType 8 TurnToObject or 9 TurnToHeading).
+    /// Sibling of <see cref="MoveToPathData"/>: kept as a SEPARATE record
+    /// rather than widening <c>MoveToPathData</c> in place, because the two
+    /// wire forms genuinely diverge (7-dword <c>UnPackNet</c> with an
+    /// Origin+optional-guid head for move types vs. the 3-dword
+    /// <c>UnPackNet</c> with a guid+standalone-heading head for turn types —
+    /// V0-pins.md P6) and a single record would need every move-only field
+    /// nullable for turn payloads (and vice versa) for no reader benefit —
+    /// no code path ever needs "either a move or a turn path" polymorphically,
+    /// every consumer already switches on <see cref="ServerMotionState.MovementType"/>
+    /// first.
+    ///
+    /// <list type="bullet">
+    ///   <item>type 8 (TurnToObject) only: u32 <c>TargetGuid</c>, f32
+    ///     <c>WireHeading</c> — the STANDALONE heading field (ACE
+    ///     <c>TurnToObject.DesiredHeading</c>, distinct from
+    ///     <see cref="DesiredHeading"/> below despite ACE always populating
+    ///     both from the same source; V0-pins.md P6's fixture caveat: never
+    ///     distinguish the two fields by value in a test, only by
+    ///     OFFSET). Consumed ONLY in retail's unresolvable-object fallback
+    ///     (decomp §2f case 8: <c>if (GetObjectA(object_id) == 0) {
+    ///     params.desired_heading = wire_heading; goto TurnToHeading; }</c>)
+    ///     — the resolved-object path never reads it.</item>
+    ///   <item>TurnToParameters (0xc bytes, exact retail order —
+    ///     <c>MovementParameters::UnPackNet</c> 3-dword TurnTo form, decomp
+    ///     §2g): u32 <c>Bitfield</c>, f32 <c>Speed</c>, f32
+    ///     <c>DesiredHeading</c>. Present for BOTH type 8 and type 9 (type 9
+    ///     has no guid/WireHeading head — <see cref="TargetGuid"/> and
+    ///     <see cref="WireHeading"/> are null).</item>
+    /// </list>
+    ///
+    /// Feeds <see cref="AcDream.Core.Physics.Motion.MovementParameters.FromWireTurnTo"/>
+    /// at the (future) App-layer consumer — this record stays wire-primitive
+    /// (no domain-object construction in the Net-layer parser).
+    /// </summary>
+    public readonly record struct TurnToPathData(
+        uint? TargetGuid,
+        float? WireHeading,
+        uint Bitfield,
+        float Speed,
+        float DesiredHeading);
+
     /// <summary>
     /// One entry in the InterpretedMotionState's Commands list (MotionItem).
     /// The server packs 0..many of these per broadcast: emotes, attacks,