Separate radio defence and harden player and objective lifecycles

docs/architecture.md

@@ -6,7 +6,7 @@
 
 Core owns `ERR_GameMode`, mission rules, native spawn lifecycle integration, settings, the location registry, the vanilla faction catalog and authored scenario construction. `ERR_Phase` transitions are checked centrally. `ERR_LocationComponent` registers stable location IDs and replicates discovery. Mission phase, discovery and persistent settings mutations are server-owned.
 
-The mode exposes `OnPhaseChanged`, `OnGroup`, `OnTick`, `OnStop` and server-side `OnLocationDiscovered` events. `ERR_CommandService` is the response-coordinator interface. AI supplies its implementation through `CreateCommandService`. Core owns `ERR_DiscoveryService`, recovering physical documents and remembering consumed folder identities, and presents discovered objective markers. Intel subscribes to group and mission ticks only to distribute optional extra documents to enemies. Map supplies its shared field-map item through the scenario resource hook. Chat sends authenticated owner RPCs to mutate validated settings or read HQ status. Scenario placement and mission transitions are separate classes, but richer lifecycle and objective service interfaces remain migration work.
+The mode exposes `OnPhaseChanged`, `OnGroup`, `OnTick`, `OnStop` and server-side `OnLocationDiscovered` events. `ERR_CommandService` is the response-coordinator interface. AI supplies its implementation through `CreateCommandService`. Core owns `ERR_DiscoveryService`, recovering physical documents and remembering consumed folder identities, and presents discovered objective markers. Intel subscribes to group and mission ticks only to distribute optional extra documents to enemies. Map supplies its shared field-map item through the scenario resource hook. Chat sends authenticated owner RPCs to mutate validated settings or read HQ status. Scenario placement, radio defence, extraction and mission transitions are separate services; native player assignment uses an account-bound admission gate. Further contracts for support/logistics remain migration work.
 
 ## HQ information flow
 
@@ -26,13 +26,13 @@ Stop events cancel service timers, remove HQ waypoints and despawn owned AI grou
 
 `ERR_PlayerRoster` owns life records by backend identity; transient connection IDs are only lookup keys. Spawn, disconnect and rebind publish `OnChanged`. The native reconnect component retains the same physical character for voluntary as well as involuntary departures during its configured reservation interval. Reservation expiry does not restore a spent life. The defeat check includes reserved living characters. A server with no connected players pauses defeat and clears the radio defence timer.
 
-First-time arrivals may spawn during prison, search or defence. Late spawn positions are checked beside conscious, on-foot survivors, with the authored prison as fallback. New arrivals during extraction observe until the next round. Dead players cannot request another life. Unconscious characters remain survivors and retain their own camera; they do not hold the radio objective.
+First-time arrivals may spawn during prison, search or defence. Prison placement checks a bounded grid against physical obstacles and pending reservations; a full grid waits without spending the failure budget. Late spawn positions are checked beside conscious, on-foot survivors, with the same prison grid as fallback. Native preloads receive account/controller/request/data/actor-bound tickets. Final assignment rechecks current life, phase, connection and placement; stop, disconnect and closed-admission phases cancel owned pending actors and callbacks. See [player lifecycle](player-lifecycle.md). New arrivals during extraction observe until the next round. Dead players cannot request another life. Unconscious characters remain survivors and retain their own camera; they do not hold the radio objective.
 
 The server selects a living friendly survivor for each spectator and replicates only its replication ID and fallback position. A local camera follows that survivor; owner RPCs allow `/esc spectate next` and `/esc spectate previous`. Only the selected survivor and occupied vehicle are pinned for streaming to that spectator. Loss, target changes and mission stop release pins. Reconnect, remote streaming and multi-client camera behavior still require multiplayer tests.
 
 ## Base objective presentation
 
-`ERR_Objectives` subscribes to phase and tick events and publishes one native `SCR_Task` per active phase, completing the previous task or failing it on defeat. Core mission rules alone advance phases. Native task replication carries current instructions to joining players; task markers remain list-only because the discovery registry owns map disclosure. Radio descriptions update on five-second boundaries and show interruptions. These APIs compile against installed vanilla scripts; actual task UI presentation and remote-client delivery still require gameplay validation.
+`ERR_Objectives` subscribes to phase and tick events and publishes one native `SCR_Task` per active phase, completing the previous task or failing it on defeat. The independent radio service emits start/completion events; Core mission rules alone advance phases. Native task replication carries current instructions to joining players; task markers remain list-only because the discovery registry owns map disclosure. Radio descriptions update on five-second boundaries and show interruptions. These APIs compile against installed vanilla scripts; actual task UI presentation and remote-client delivery still require gameplay validation.
 
 ## Authored sites and finite scavenging
 
@@ -56,3 +56,11 @@ Preparation failure is retained in replicated state. Spawning remains disabled,
 The native end-data connection ID list is retained only as a framework adapter. Core publishes an account-derived personal result on each player's controller, keyed to the current mission replication ID and reset at round startup/audit. Binding/rebinding republishes the result. The successor victory content ignores stale end-data winner IDs and refreshes if personal-result replication arrives after the end screen opens. Local widget tests and real network reconnect acceptance are distinct.
 
 `ERR_TimeService` configures the native world clock once before the prison phase. Core administration saves start time and progression for the next round while showing the current applied values separately. The native manager advances and replicates time; there is no per-tick clock reset. See [mission time](mission-time.md) and [extraction](extraction.md).
+
+## Radio defence service and objective details
+
+`ERR_RadioDefenceService` owns tune authorization, eligible conscious defenders, continuous occupancy and one-time completion. GameMode consumes its events to advance phases and expose extraction; native tasks carry instructions to clients. The service requires current connected life records and the configured player faction, so unregistered actors, disconnected bodies and hostile characters cannot hold transmission. Empty-server sampling resets progress before mission work pauses. See [radio defence](radio-defence.md) for exact boundaries and test scope.
+
+`ERR_ObjectiveText` supplies hints and native task descriptions from the same mission state. Radio identification can update local guidance within the search phase, and extraction instructions use the configured replicated radius. `ERR_ObjectiveDetails` subscribes open successor task details directly to native display-data changes; it removes that subscription on task switch and widget detach. Detach also removes native global task-event callbacks, and pending overflow work is cancelled before assignee labels are deleted. Other task types retain their native behavior. See [objective widget lifecycle](objective-widget-lifecycle.md).
+
+Optional ground transport belongs to the existing site definition/service and its rollback path. It has bounded parking checks, actual native fuel and compartments, and no replacement/refill loop. See [ground transport](ground-transport.md).