Validate independent packed addons and complete physical mortar salvos

docs/architecture.md

@@ -6,7 +6,7 @@
 
 Core owns `ERR_GameMode`, mission rules, native spawn lifecycle integration, settings, the location registry, the vanilla faction catalog and authored scenario construction. `ERR_Phase` transitions are checked centrally. `ERR_LocationComponent` registers stable location IDs and replicates discovery. Mission phase, discovery and persistent settings mutations are server-owned.
 
-The mode exposes `OnPhaseChanged`, `OnGroup`, `OnTick`, `OnStop` and server-side `OnLocationDiscovered` events. `ERR_CommandService` is the response-coordinator interface. AI supplies its implementation through `CreateCommandService`. Core owns `ERR_DiscoveryService`, recovering physical documents and remembering consumed folder identities, and presents discovered objective markers. Intel subscribes to group and mission ticks only to distribute optional extra documents to enemies. Map supplies its shared field-map item through the scenario resource hook. Chat sends authenticated owner RPCs to mutate validated settings or read HQ status. Scenario placement, radio defence, extraction and mission transitions are separate services; native player assignment uses an account-bound admission gate. Further contracts for support/logistics remain migration work.
+The mode exposes `OnPhaseChanged`, `OnGroup`, `OnTick`, `OnStop` and server-side `OnLocationDiscovered` events. `ERR_CommandService` is the response-coordinator interface. AI supplies its implementation through `CreateCommandService`. Core owns `ERR_DiscoveryService`, recovering physical documents and remembering consumed folder identities, and presents discovered objective markers. Intel subscribes to group and mission ticks only to distribute optional extra documents to enemies. Map supplies its shared field-map item through the scenario resource hook. Chat sends authenticated owner RPCs to mutate validated settings or read HQ status. Scenario placement, radio defence, extraction and mission transitions are separate services; native player assignment uses an identity-bound admission gate, with a restricted standalone alternative described below. AI owns finite mortar support and the western-cache courier through the same HQ and physical-radio authority; broader convoy and aircraft support remain migration work.
 
 ## HQ information flow
 
@@ -14,7 +14,7 @@ Physical group members observe through vanilla AI perception. `ERR_HQObservation
 
 The coordinator is the sole source of strategic response orders. Individual units retain vanilla tactical combat. It does not spawn reinforcements when alerted. Initial physical forces are authored by the scenario. No distant-unit virtual simulation is implemented.
 
-The current coordinator is a reduced implementation. Full contact scheduling, supporting aircraft and physical logistics remain incomplete. A finite physical mortar controller now compiles; its initialization, ammunition depletion and permanent asset loss pass local tests. Actual firing has not been validated. Aircraft availability helpers must not be mistaken for an operational controller.
+The [092237 native fixture](evidence/native-2026-09-19-092237/report.json) verifies real guard perception, immutable report delivery through uplink/HQ/downlink, and movement by another original physical infantry group without adding forces. The [095513 courier fixture](evidence/native-2026-09-19-095513/report.json) verifies a finite physical delivery, HQ reservation release and restoration of the original patrol. These are arranged local integration tests: the perception fixture places and temporarily protects its real player, while the courier fixture physically sequesters the original 27 shells to trigger depletion. They do not establish manual encounter quality, multiplayer behavior or improved FPS. Operational supporting aircraft, broader logistics/convoy parity and distant virtual simulation remain incomplete; aircraft availability helpers and isolated flight experiments are not an operational controller.
 
 ## Bounded work and ownership
 
@@ -24,7 +24,7 @@ Stop events cancel service timers, remove HQ waypoints and despawn owned AI grou
 
 ## Round player lifecycle
 
-`ERR_PlayerRoster` owns life records by backend identity; transient connection IDs are only lookup keys. Spawn, disconnect and rebind publish `OnChanged`. The native reconnect component retains the same physical character for voluntary as well as involuntary departures during its configured reservation interval. Reservation expiry does not restore a spent life. The defeat check includes reserved living characters. A server with no connected players pauses defeat and clears the radio defence timer.
+`ERR_PlayerRoster` owns network life records by backend identity; the sole genuine standalone local controller can use the pinned round-local key described below. Transient connection IDs are only lookup keys. Spawn, disconnect and rebind publish `OnChanged`. The native reconnect component retains the same physical character for voluntary as well as involuntary departures during its configured reservation interval. Reservation expiry does not restore a spent life. The defeat check includes reserved living characters. A server with no connected players pauses defeat and clears the radio defence timer.
 
 First-time arrivals may spawn during prison, search or defence. Prison placement checks a bounded grid against physical obstacles and pending reservations; a full grid waits without spending the failure budget. Late spawn positions are checked beside conscious, on-foot survivors, with the same prison grid as fallback. Native preloads receive account/controller/request/data/actor-bound tickets. Final assignment rechecks current life, phase, connection and placement; stop, disconnect and closed-admission phases cancel owned pending actors and callbacks. See [player lifecycle](player-lifecycle.md). New arrivals during extraction observe until the next round. Dead players cannot request another life. Unconscious characters remain survivors and retain their own camera; they do not hold the radio objective.
 
@@ -70,3 +70,9 @@ Optional ground transport belongs to the existing site definition/service and it
 `ERR_LocalAdmission` supplies a round-local roster key only for the sole genuine local controller in native `RplMode.None`. It is selected through normal audited spawn admission, pinned to that controller/context and closed on invalidation. It is not an account identity and never replaces native identity handling in Listen, Dedicated or Client modes. [Design and evidence](local-singleplayer-admission.md).
 
 HQ owns each finite mortar battery, its readiness, delivered order and exact shell transactions. Initial expansion and inventory callbacks must resolve to the actual original crew and 27 distinct HE shells. Resupply moves one exact existing shell; acceptance alone is not readiness. Re-aim validation recomputes native ballistics against the immutable original command while retaining the original report's expiry. The per-battery report ledger prevents a cancelled/completed radio observation from becoming another order; only newly delivered observations can authorize new attempts. [Operations](finite-mortar-operations.md), [aim renewal](mortar-aim-renewal.md), [report deduplication](mortar-report-deduplication.md).
+
+An active order can accept a strictly newer same-target observation only after its own real HQ downlink. Each report keeps its original observation time and 60-second freshness bound; updates preserve the original order/activity, eight-round limit and 120-second deadline. If the barrel already has a command, the original native solver must prove equivalent geometry before adopting the update; an already committed shell retains its previous report until its actual projectile callback. The [111915 refresh attempt](evidence/native-2026-09-19-111915-refresh-completion-refusal/report.json) emitted eight real projectiles but failed the required natural-completion gate and remains failed evidence, not a qualified complete salvo or impact test. The subsequent event-latch correction captures vanilla completion/failure on the exact activity and order before deselection can overwrite its state, then consumes that event on the HQ tick. Cleanup detaches before its own `Complete` call and cannot manufacture a completion observation. The subsequent 112900 native rerun passes this handoff and the complete refreshed salvo; its evidence is described below. See [report refresh](mortar-report-refresh.md).
+
+`ERR_MortarLogistics` inserts twelve distinct depot shells once into the existing western clue cache and uses its original physical patrol as courier. A genuine low-ammunition status reaches HQ through the battery's RTO; HQ alone reserves the patrol and sends the delivery downlink. Transport authorization retains that status's original time with a 180-second bound, separately from firing-contact freshness. Native waypoints move the bearer and exact inventory transactions move surviving shells; there is no teleport, replenishment or replacement crew/vehicle. Cancellation releases owned orders while surviving stock remains physical, and unresolved live-item transfers cannot be retried. This is one finite walking route, not complete logistics parity. [Courier contract and native evidence](finite-mortar-courier.md).
+
+The subsequent [112900 native refresh regression](evidence/native-2026-09-19-112900-mortar-refresh/report.json) passes the exact activity-event handoff, all eight fresh physical shots, 19 remaining original shells and 25-second replay refusal with 55 assertions and zero captured errors. The earlier completion failure remains historical evidence.