Fix faction ammunition resupply and settings recovery

Wait for both convoy cargo phases and use actual magazine stock. Resolve empty primary weapon ammunition from muzzle metadata and recover cleanly from failed initial settings saves.

Update native fixtures, scoped cleanup guards, packaging evidence and validation documentation. Make reviewed fixture tests checkout-relative. All repository checks pass against the isolated staged tree; native resupply completion and multiplayer qualification remain outstanding.

tools/headless_workbench.py

@@ -14,7 +14,7 @@ p.add_argument('--steam', type=Path, default=Path.home()/'.local/share/Steam')
 p.add_argument('--external-addons', type=Path, help='Installed RHS/WCS/BMP source root; expose only audited closure in a separate Chat profile')
 p.add_argument('--compat', type=Path, required=True, help='Disposable cloned Proton compatdata directory outside Steam')
 p.add_argument('--profile', type=Path, required=True, help='Separate disposable successor Workbench profile')
-p.add_argument('--smoke', choices=['optional-site-skip', 'infantry-combat', 'medical-combat', 'hunter-faction', 'unconscious-camera', 'town-garrisons', 'site-garrisons', 'radio-interaction', 'enemy-loadout', 'aggression', 'air-logistics', 'air-assault', 'air-recon', 'airfield-markers', 'opening-tools', 'mortar-station', 'generated-sites', 'hq-local-handoff', 'infantry-transfer', 'hq-body', 'convoy', 'supply-convoys', 'hq-memory', 'hq-awareness', 'aircraft-field', 'aircraft-route', 'native-end-active', 'native-end-preparing', 'aircraft-control', 'aircraft-cancel', 'aircraft-translate', 'map-ownership', 'mortar-refresh', 'mortar-salvo', 'mortar-courier', 'station-teardown', 'prison-breach', 'powered-flight', 'powered-translate', 'local-admission', 'mortar-expiry', 'mortar-transfer', 'mortar-fire', 'patrol-hq', 'victory', 'lost-helicopter', 'player-death', 'radio-network', 'hq-response', 'mortar-inventory', 'startup-failure', 'site-survey', 'cache-loss', 'extraction-capacity', 'early-helicopter-loss', 'extraction-startup-failure', 'extraction-boundary-failure', 'transport-loss', 'transport-survey', 'lifecycle', 'objective-ui', 'recovery', 'prisoner-kit', 'medical', 'casualty-load', 'casualty-direct', 'casualty-bench', 'casualty-remove', 'environment', 'environment-restart', 'patrols', 'radio-document-loss', 'radio-document-loss-partial', 'guard-cancel', 'casualty-service'], default='victory')
+p.add_argument('--smoke', choices=['escape-route', 'optional-site-skip', 'infantry-combat', 'medical-combat', 'hunter-faction', 'unconscious-camera', 'town-garrisons', 'site-garrisons', 'radio-interaction', 'enemy-loadout', 'aggression', 'air-logistics', 'air-assault', 'air-recon', 'airfield-markers', 'opening-tools', 'mortar-station', 'generated-sites', 'hq-local-handoff', 'infantry-transfer', 'hq-body', 'convoy', 'supply-convoys', 'hq-memory', 'hq-awareness', 'aircraft-field', 'aircraft-route', 'native-end-active', 'native-end-preparing', 'aircraft-control', 'aircraft-cancel', 'aircraft-translate', 'map-ownership', 'mortar-refresh', 'mortar-salvo', 'mortar-courier', 'station-teardown', 'prison-breach', 'powered-flight', 'powered-translate', 'local-admission', 'mortar-expiry', 'mortar-transfer', 'mortar-fire', 'patrol-hq', 'victory', 'lost-helicopter', 'player-death', 'radio-network', 'hq-response', 'mortar-inventory', 'startup-failure', 'site-survey', 'cache-loss', 'extraction-capacity', 'early-helicopter-loss', 'extraction-startup-failure', 'extraction-boundary-failure', 'transport-loss', 'transport-survey', 'lifecycle', 'objective-ui', 'recovery', 'prisoner-kit', 'medical', 'casualty-load', 'casualty-direct', 'casualty-bench', 'casualty-remove', 'environment', 'environment-restart', 'patrols', 'radio-document-loss', 'radio-document-loss-partial', 'guard-cancel', 'casualty-service'], default='victory')
 p.add_argument('--convoy-cover', action='store_true', help='After convoy driving, arrange the existing prisoner to verify native sighting/radio HOLD and RESUME')
 p.add_argument('--field-terrain-audit', action='store_true', help='After a fixed aircraft-field survey refusal, log one read-only 1681-node coarse terrain grid; never selects or qualifies a corridor')
 p.add_argument('--field-service-cancel', action='store_true', help='Explicit aircraft-field variant: Stop the original retained service during measured cruise; requires physical cancellation landing')

tools/private_prefix_cleanup.py

@@ -73,21 +73,42 @@ def prefix_kind(value):
     return 'other'
 
 
+def user_systemd_argv(argv):
+    if argv == SYSTEMD_ARGV:
+        return True
+    # User-systemd preserves its identity across reexec and appends its state
+    # descriptor. Accept only the observed single ASCII decimal FD argument.
+    if len(argv) != 3 or argv[:2] != SYSTEMD_ARGV:
+        return False
+    argument = argv[2]
+    if not argument.startswith(b'--deserialize='):
+        return False
+    descriptor = argument[len(b'--deserialize='):]
+    return (descriptor.isdigit() and len(descriptor) <= 10
+            and int(descriptor) <= 2147483647)
+
+
 def native_metadata_proves_unrelated(p):
     names = [p.comm.lower(), *(os.fsdecode(a).replace('\\', '/').rsplit('/', 1)[-1].lower() for a in p.argv)]
     if p.exe:
         names.append(Path(p.exe).name.lower())
     if any(n.endswith('.exe') or n.startswith(('wine', 'proton', 'gamescope', 'armareforger')) or n in {'reaper', 'pressure-vessel-wrap', 'pv-bwrap'} for n in names):
         return False
+    if (p.comm == 'systemd' or p.exe == '/usr/lib/systemd/systemd'
+            or (p.argv and p.argv[0] == SYSTEMD_ARGV[0])):
+        return (p.comm == 'systemd' and p.ppid == 1
+                and user_systemd_argv(p.argv)
+                and p.exe in {None, '/usr/lib/systemd/systemd'})
     if p.exe and p.exe.startswith('/'):
         return True
-    if p.comm == 'systemd' and p.argv == SYSTEMD_ARGV and p.ppid == 1:
-        return True
     if p.comm == '(sd-pam)' and p.argv == (b'(sd-pam)',):
         return True
     # Same narrow native foreground signature as headless_game's preflight.
     if p.comm == 'apache2' and p.argv == (b'apache2', b'-DFOREGROUND'):
         return True
+    # The user's GnuPG smart-card helper is native and may be nondumpable.
+    if p.comm == 'scdaemon' and p.argv == (b'scdaemon', b'--multi-server'):
+        return True
     # Nondumpable desktop services still expose argv and kernel comm. Match
     # both (Linux comm truncates at 15 bytes), after refusing runtime markers
     # in every argument above. This does not authorize any signal: it only
@@ -106,7 +127,7 @@ def prove_device(p, parent, uid, expected_exe, executable_id):
         raise CleanupRefused(f'PID {p.pid} is not the exact adopted device helper; left untouched')
     if (parent.pid != p.ppid or parent.uid != uid or parent.ppid != 1
             or parent.state in {'Z', 'X'} or parent.comm != 'systemd'
-            or parent.argv != SYSTEMD_ARGV
+            or not user_systemd_argv(parent.argv)
             or parent.exe not in {None, '/usr/lib/systemd/systemd'}):
         raise CleanupRefused(f'PID {p.pid} does not have the proven user-systemd parent; left untouched')
     # The observed user-systemd is nondumpable: an unreadable exe is accepted