Expand independent escape routes and finite site discovery

docs/architecture.md

@@ -6,7 +6,7 @@
 
 Core owns `ERR_GameMode`, mission rules, native spawn lifecycle integration, settings, the location registry, the vanilla faction catalog and authored scenario construction. `ERR_Phase` transitions are checked centrally. `ERR_LocationComponent` registers stable location IDs and replicates discovery. Mission phase, discovery and persistent settings mutations are server-owned.
 
-The mode exposes `OnPhaseChanged`, `OnGroup`, `OnTick` and `OnStop` events. `ERR_CommandService` is the response-coordinator interface. AI supplies its implementation through `CreateCommandService`. Core owns `ERR_DiscoveryService`, recovering physical documents and remembering consumed folder identities, and presents discovered objective markers. Intel subscribes to group and mission ticks only to distribute optional extra documents to enemies. Map supplies its shared field-map item through the scenario resource hook. Chat sends authenticated owner RPCs to mutate validated settings or read HQ status. Scenario placement and mission transitions are separate classes, but richer lifecycle and objective service interfaces remain migration work.
+The mode exposes `OnPhaseChanged`, `OnGroup`, `OnTick`, `OnStop` and server-side `OnLocationDiscovered` events. `ERR_CommandService` is the response-coordinator interface. AI supplies its implementation through `CreateCommandService`. Core owns `ERR_DiscoveryService`, recovering physical documents and remembering consumed folder identities, and presents discovered objective markers. Intel subscribes to group and mission ticks only to distribute optional extra documents to enemies. Map supplies its shared field-map item through the scenario resource hook. Chat sends authenticated owner RPCs to mutate validated settings or read HQ status. Scenario placement and mission transitions are separate classes, but richer lifecycle and objective service interfaces remain migration work.
 
 ## HQ information flow
 
@@ -38,7 +38,7 @@ The server selects a living friendly survivor for each spectator and replicates
 
 Core reads `ERR_ScenarioDefinition` from `Configs/ERR/EveronSites.conf`. `ERR_SiteService` owns the resulting locations, guards, containers and stock. The scenario component handles pending/ready/failed preparation separately from mission progression. Location IDs are supplied by configuration and replicated; templates carry no fixed scenario identity. Initial inventory items are created once, and retries move the same entities into the container. Readiness requires observed physical inventory contents. A completed service never refills stock or replaces destroyed sites.
 
-`ERR_DocumentComponent` binds each mandatory physical clue to a radio location. Core recovery applies it only to that destination; optional generic enemy intel retains its broader discovery behavior. Definition validation requires an accessible, guaranteed clue route and a starting map. Native tests mutate separate definition instances to verify invalid inputs are rejected. [Authoring details and current stock](site-authoring.md).
+`ERR_DocumentComponent` binds each mandatory physical clue to a radio location. Core recovery applies it only to that destination; optional generic enemy intel retains its broader discovery behavior. Definition validation requires a starting map and, for Everon, two separate guaranteed clue sources at least 100 metres apart. Each has enough documents to identify the radio independently. Optional supply/outpost locations use bounded five-second conscious-player visibility scans; progression sites remain document-controlled. Location names and discovery state replicate to the map, while actual knowledge transitions publish the server-side discovery event. Native tests mutate separate definition instances to verify invalid inputs are rejected. [Authoring details and current stock](site-authoring.md).
 
 ## Base configuration and administration