Integrate radio-delivered convoy cover and conservative squad ammunition reports

docs/convoy-migration.md

@@ -83,3 +83,76 @@ The same four external string-table errors keep the strict native qualifier
 failed. This single short road run establishes the initial physical controller;
 it does not prove full-route reliability, native combat/dismount/reboarding,
 logistics delivery/unloading, multiplayer or FPS improvements.
+
+
+## Delivered HQ mounted-cover follow-up
+
+This follow-up adds per-vehicle HOLD/RESUME travel commands to the existing finite
+convoy. It does not change the six-vehicle receipt, nineteen original crew,
+finite initial cargo or opt-in manual dispatch. The earlier native driving
+archive above predates these combat commands.
+
+[HQ planning](../addons/ai/Scripts/Game/ERR/ERR_HQ.c) uses two delivered inputs:
+a living, nonclosed original crew's own status position no older than 180 seconds,
+and a positive sighting less than 60 seconds old within 400 m of that reported
+position. Exactly 400 m and exactly 180 seconds are accepted; exactly 60 seconds
+is no longer a planner contact. The executor permits a HOLD report age up to
+60 seconds, but HQ rechecks its stricter current-contact rule at delivery.
+Neither the planner nor a silent crew substitutes a live vehicle or hidden enemy
+position for those reports. Body/distress beliefs do not become convoy fire targets.
+
+Each original crew uses its existing shared HQ downlink. A queued
+[combat command](../addons/ai/Scripts/Game/ERR/ERR_ConvoyCombat.c) contains the
+convoy source ID, original group, vehicle index, monotonically increasing command
+ID, originating sighting ID/time, issue time and an expiry at most 30 seconds
+later. Queuing does not stop travel. Only successful physical radio delivery can
+reach the executor; it rechecks current contact evidence, own-status freshness,
+canonical consumed receipt, matching physical Core record and exact original crew.
+Foreign, duplicate or expired commands cannot replace the current order. A newer
+nearby sighting still justifies an in-flight HOLD, so reports arriving faster than
+the downlink cannot starve cover delivery. A superseded RESUME is rejected.
+
+An accepted HOLD removes only that vehicle group's owned move waypoint and
+preserves its route index. A newer delivered sighting can refresh the held
+lineage without repeatedly clearing waypoints. A RESUME is considered only after
+60 seconds since the held sighting, with fresh own-position status and no current
+qualifying contact. It must match the held sighting ID/time. New contact arriving
+while the downlink travels invalidates an older RESUME; a failed HOLD refresh
+cannot accidentally authorize it. Missing radio or stale own status retains the
+current travel/hold state. There is no independent timeout that silently resumes
+a held vehicle. A successful RESUME creates one native move waypoint at the
+preserved route index. Failed native recreation consumes that command ID and
+releases the vehicle's order instead of retrying the same command.
+
+At admission, [ConvoyService](../addons/ai/Scripts/Game/ERR/ERR_ConvoyService.c)
+calls the native `utility.AddUsableVehicle(usage)` helper after vehicle-manager
+admission. This registers the native deletion/damage callbacks and mounted combat
+activity omitted by raw manager insertion alone. Native perception, weapon aiming
+and firing remain the engine's responsibility. HOLD supplies no target coordinates
+to a gunner and does not prove that the gunner fires or suppresses a player.
+This is mounted cover, not migrated infantry dismount/flank/reboard tactics.
+
+Player occupation of any convoy vehicle or crew still stops the whole task.
+Release clears owned orders and temporary forced detail while leaving vehicles,
+weapons, cargo, casualties and survivors physical. HOLD/RESUME introduces no new
+crew/vehicle spawn, ammunition grant, cargo refill or replacement receipt.
+The separate [small-arms status model](hq-ammunition.md) does not estimate mounted
+vehicle ammunition or provide convoy rearming.
+
+[Combat executor tests](../tests/test_convoy_combat.py) and
+[HQ radio/planner tests](../tests/test_hq_convoy_combat.py) execute the actual
+methods against boundary doubles. They cover freshness, lineage/replay, shared
+pending downlinks, changed evidence in transit, owned waypoint hold/resume,
+original crew/ledger identity, capture and failed recreation. These are policy
+regressions, not native mounted firing or multiplayer evidence.
+
+The [04:11:50 native driving recheck](evidence/native-2026-09-20-041150-convoy-cover-driving/report.json)
+compiles this follow-up and completes one round with 181 assertions and zero
+script/runtime failures. All six vehicles move at least 20 m, the lead exceeds
+100 m, and the original nineteen seat occupants, six records and finite truck
+cargo remain intact. This includes the native mounted-combat registration but
+**does not exercise a combat HOLD/RESUME or prove firing**. Those transitions
+still need a direct native scenario. Source and six external dependencies stayed
+unchanged, and hidden/muted process cleanup was confirmed. Four external
+localization errors keep strict native qualification failed. Full-route,
+dismount/flank/reboard, unloading, multiplayer and FPS work remain outstanding.