EscapistsReintroduced/docs/infantry-resupply.md

Finite infantry ammunition resupply

The successor implements HQ-directed rendezvous between existing infantry patrols and the original ammunition trucks of all admitted finite convoys. Up to twenty immutable convoy slots are supported; each keeps its own original magazine identities and transfer state. Shared delivered-demand history and per-recipient cooldowns prevent another truck from replaying an already consumed report. HQ rotates donors and starts at most one new trip each five-second planning cadence. Multi-convoy integration and evidence. Convoy creation remains owned by the existing finite convoy system; resupply creates no vehicles, troops or replacement cargo. This remains a partial migration of the user-owned AI extension, not full logistics parity.

Reports and rendezvous

Local own-roster ammunition sampling runs about every 30 seconds when a radio and free uplink are available, with six initial phases five seconds apart. Complete small-arms stock at or below 30 magazine-plus-chamber rounds per living member can prompt an early status report, including known empty stock. This is a formation average; incomplete or unknown inventories do not establish a shortage. Any queued status imposes a 60-second urgent-call cooldown. Routine status retains its 180-second interval, while requested check-ins bypass the urgent cooldown. Contact traffic and physical negative-search rules keep their existing order after due status.

Complete low mounted stock can also request the same early status frame and cooldown, while remaining in a separate mounted payload. It never enters carried totals or satisfies the infantry demand predicate.

HQ acts only on successfully delivered status. Both formations need a fresh report, at most 120 seconds old, with living and fit members; their reported positions must be within 200 metres. The recipient must be an available patrol rather than a home guard. Existing reservations, hostile perception, convoy combat, capture and ownership changes can refuse or terminate the task. Local physical checks validate execution; they do not silently update HQ's reported positions or ammunition knowledge.

The truck receives a real radio downlink to stop. After it physically stops, its original crew is asked for a new status report. HQ waits for that report to arrive before sending the infantry a separate downlink to a rendezvous three metres from the reported position. Native move/defend waypoints then direct the existing infantry. Both use a 0.5 m completion radius: the previous 2 m move radius could accept arrival five metres from the reported truck center, beyond the transfer distance. The destination still comes from the delivered report, and no actor is snapped or teleported. Stock formation/defend behavior can choose other positions; these parameters do not prove that every member reaches a usable storage access point. The task expires after at most 120 seconds and cannot extend beyond 180 seconds from the demand observation. A consumed demand message is not reused; that formation has a three-minute planning cooldown.

Finite cargo and physical transfer

The service waits for the convoy's cargo startup to settle, including the supply convoy's separate faction-weapon and matching-ammunition phases. It captures actual identities of up to 96 magazine-component items already in the ammunition truck, independent of faction or AK74 prefab. A single 90-second deadline starts when this service first observes the ready convoy; repeated waiting cannot extend it. This allows the producer's weapon phase and a bounded magazine-callback grace without treating the earlier crew-admission deadline as cargo failure. The unchanged 128-item inventory bound and 96-magazine bound stop conservatively if exceeded; recipient weapon compatibility is still checked before each transfer. Failed insertion, looting or subsequent loss reduces usable stock. New items added later are not adopted, and missing stock is never recreated. The service uses the original registered truck, crew, ledger records and recipient roster.

A trip allows at most six magazine transfers, one per served soldier. The individual must still have complete local small-arms stock of at most 30 rounds, carry a compatible weapon, remain on foot and be within four metres of the stopped truck. The leaf checks actual native inventory capacity, managed storage and magazine-well compatibility. It submits one TryMoveItemToStorage for the exact existing magazine. Success requires both a completed native callback and physical proof: that identity is absent from donor inventory, present in recipient inventory and parented to the selected destination storage.

When available storage blocks an incoming magazine, the ground coordinator may now return one unused compatible empty magazine to the original truck first. The return is a separate, once-only native operation with its own callback and exact storage proof. No return occurs when incoming capacity already exists, and the original incoming stock is revalidated before the later delivery. Returned empties are not added to the one-time stock snapshot.

Each magazine identity is reserved before its first leaf check. If that check submits no native operation, temporary approach geometry, motion, access or capacity refusal releases the reservation and another member may try. There is at most one such preflight per member per existing slow tick, within the unchanged rendezvous deadline. Once native submission is attempted, the identity remains spent even after synchronous rejection; the native operation is never retried. Each phase has an eight-second deadline and the whole transaction has a sixteen-second ceiling. Either native submission consumes the selected incoming identity even if only the empty return was attempted; this conservative reservation prevents automatic replay. A deadline does not cancel an accepted native operation. Unresolved operations remain reserved after failure/Stop; a late completion does not turn a failed task into success. Cleanup removes only owned waypoints and releases reservations, retaining physical forces and remaining cargo. No magazine spawning, refilling, forced reload or actor teleportation is involved.

Evidence and limits

The current-source native HQ run compiles the integration and completes one scripted round with 59 assertions, zero script/runtime failures, unchanged source/external inputs and confirmed hidden/muted cleanup. Four installed RHS/WCS localization errors remain, so strict qualification stays failed. The initial compile failure is retained: splitting an overlong Enfusion condition corrected it. This fixture does not dispatch a supply convoy or prove a successful native inventory transfer.

The controlled native transfer now completes 43 assertions and one round without script/runtime failures. An existing original patrol actor is deliberately positioned beside the existing automatic convoy ammo truck; after native pose update, one original magazine transfers with unchanged round count and no new force entry. Exact native callback, source absence and destination storage ownership agree. Source/external fingerprints and private cleanup are confirmed; four external localization errors remain. This is direct transfer evidence, not a walking rendezvous.

Actual-method tests cover the coordinator's delivered-report rules, radio transitions and cleanup, the transfer's exact identity/ownership and callback requirements, and early-report scheduling with deterministic radio/legacy contact doubles. Captured native contact priority is outside that fairness harness. Native navigation, a full HQ-directed rendezvous, ordinary play and multiplayer still require direct evidence. Before submission, physical access qualification now requires an unobstructed native trace to a root-owned authored truck storage-action context. Missing anchors or blocked/uncertain geometry refuse the operation. This does not prove an AI walking route or door-opening animation. This slice does not implement demand-triggered supply dispatch, broad supply catalogs, launcher/vehicle rearming or complete original logistics behavior.

Provenance: the authorized user-owned escapists-ai files EAI_Resupply.c (SHA-256 dfa28d0741c5515c85a6e62bc6d1a104f5474ddc22a6e58931be1583133f3586) and EAI_HQStatus.c supplied behavioral references. The successor mortar transfer supplied its physical-proof pattern; installed vanilla storage and magazine-well APIs supplied native contracts. The original protected Escapists implementation and its helpers were not imported. Related background: HQ ammunition and finite convoys.

Approach corrections after the controlled transfer checkpoint

Actual coordinator and complete leaf methods now run together in regressions that reproduced the former premature item-spending/whole-trip-abort. Transient 3D range, stopped state, storage capacity or access refusal submits nothing, releases only that unsubmitted item's reservation and lets another original member approach. One preflight per member per existing slow tick and the original trip deadline bound the wait. A rejected or failed native submission remains spent; accepted uncertainty never retries. Inline native completion is still counted once. Waypoint tests cover the smaller positive radii, unchanged report-derived target and native move-before-hold ordering.

The local-handoff integration run compiles these changes with all five addons. It does not exercise autonomous resupply. The earlier direct-transfer evidence retains its own source snapshot; no full walking delivery or performance result is claimed.

Supply convoy cargo integration correction (30 September 2026)

Actual-method stock/planning regressions now exercise phased issue readiness, completion after the former crew deadline, the early-ready producer timeout boundary, a fixed expiry, NATO magazine identities, 96/97-item stock limits and exclusion of later replacement identities. Coordinator cleanup and native-operation quarantine policy regressions still pass. The cargo producer and inventory callbacks are doubled by these checks; this change has not yet been exercised in a native walking rendezvous. At this checkpoint, incompatible remaining cargo could still consume a planning attempt and wait until the bounded trip expired, although no incompatible magazine could pass the physical-transfer guard. The later compatible-stock admission correction below closes that planning gap.

The 30 September native rerun reached both real cargo phases and captured 56 original magazine identities. It failed recipient selection before any transfer; no eligible compatible original patrol could be reserved at that point. Source/external fingerprints remained unchanged and hidden/muted cleanup completed. Current native transfer, autonomous rendezvous and release qualification remain open.

The mounted courier integration now shares each original truck's frozen stock/spent identities and the fleet's delivered-report history. Infantry planning retains priority. An active or quarantined mounted operation blocks infantry reuse, and unresolved infantry operations block mounted dispatch. Ground-supply status counts both kinds of active trip and labels its moved counter explicitly as infantry-only. This source integration does not constitute native mounted-transfer qualification.

Finite mine top-ups (1 October 2026)

The 1 October checkpoint added the ability for the same original-truck coordinator to send one original PMN4 to an existing carrier with exactly one usable mine, after scanning ordinary infantry and mounted-ammunition demand. HQ admits this narrow case only from fresh delivered, complete mine status: MineMembers == Count and ReadyMines == 1. Both formations still need the existing fresh reported positions within 200 metres, original ownership and idle-force admission. Unknown, empty and multiple-mine counts do not establish this demand; no initial mine chance or grant policy is overridden.

The truck stop, new stopped-position report and infantry rendezvous each retain the existing radio and physical movement requirements. At the truck, selection requires an attributable original living on-foot member still carrying exactly one usable PMN4. Its startup mine grant must have finished with no pending insertion callback, including callbacks surviving a grant timeout. The selected actor remains fixed through unsubmitted capacity/access refusals. The leaf additionally pins its exact carried mine, incoming mine, original roster slot, driver, force records and inventory managers.

At that checkpoint, supply came only from the optional convoy batch's at-most-two frozen original identities. Those mines use the same spent ledger as the truck's infantry/mounted magazines, with the unchanged 96-spent ceiling and shared recipient replay/cooldown maps. The reservation commits before one native TryMoveItemToStorage. Success requires a successful callback, exact source absence and reciprocal destination storage custody. One confirmed mine ends the trip; no spawn, refill, rollback, retry of a submitted item or mine-placement reset occurs.

A refused or expired move with uncertain custody retains the exact truck and recipient claims in state 7, even after service Stop. Owned waypoints/downlink are cleared. A second truck cannot use a newer delivered report after cooldown to race the retained operation. Polling releases only matching claims after exact terminal custody/failure evidence or deletion of the incoming identity; damage/capture alone cannot resolve an unknown move. Late completion never changes a failed trip to success or refunds its stock. Admin supply totals distinguish magazines from mines and include unresolved claimed trips.

Independent review, mutations and preservation accompany 268 passing regression programs. Removing the startup callback guard or retained claims produces compiled assertion failures, including an attempted second-truck admission after cooldown. The hidden/muted normal native route uses a frozen combined-source copy after concurrent equipment edits invalidated the first run; it compiles the integration and completes 63 assertions and one round with zero script/runtime failures; thirteen installed-resource errors retain strict failure. This proves base-loop integration, not actual mine transfer or multiplayer. Native approach/insertion/movement remains unqualified. At that checkpoint, zero-stock recovery, per-actor full need manifests and repeated mine placement remained outside this partial migration. The later zero-stock increment is described below.

Designated engineer zero-stock replacement (2 October 2026)

A fresh, complete delivered mine report with ReadyMines == 0 can now authorize one finite PMN4 replacement. Before reserving a truck or consuming the report, HQ requires an attributable member of the original recipient roster whose startup mine lottery selected it and whose initial grant has settled. A failed lottery never creates this entitlement; later setting changes do not alter the recorded designation. An unfinished native insertion still blocks resupply, including after a timeout or a false native submission return. Existing one-to-two top-ups remain supported. No arbitrary zero-stock infantry group receives mines.

At the physical rendezvous, bounded inventory inspection distinguishes proven zero from unknown or malformed inventory. The selected original actor and its zero-or-one mode remain fixed through unsubmitted capacity/access retries. For zero replacement, the transfer independently rechecks the current mission/HQ designation and exact empty inventory on each tick; after submission it excludes only the exact incoming item from that count. For one-to-two top-ups, the leaf retains the exact pre-existing carried mine. Original roster, driver, custody, access and stopped-truck guards apply to both paths.

Each trip transfers at most one exact identity from its finite mine allowance through the shared spent ledger. The original convoy snapshot is now supplemented only by the proved camp deliveries described below. Existing report freshness, priority, cooldown, callback proof and uncertain-operation quarantine are unchanged. This replenishes carried stock only: supply delivery cannot reset consumed mine attempts, spawn replacement stock or refund submitted items. Since 3 October, finite reuse at a genuinely newer delivered post is governed separately by the HQ post ledger; delivery cannot reopen a consumed post or replenish its quota.

Six focused actual-method programs passed independently: startup designation and settings changes, original equipment membership, known-zero versus unknown inventory, pinned modes through retries, delivered-report admission, and existing callback/quarantine behavior. The old planning method compiled and failed the new designated-zero admission assertion. All 272 registered regression programs pass across a resumed run: the initial native_package stop exhausted the per-user /tmp quota; verified relocation of completed task snapshots recovered space, and that program plus the remaining suite passed with the existing canonical /tmp guards. The infrastructure failure is preserved. The hidden/muted frozen-source normal route compiles this increment and passes 63 assertions and one round, with zero script/runtime failures and thirteen retained installed-resource errors. Cleanup and unchanged inputs are confirmed. This proves compilation/base-loop integration, not actual zero-stock transfer. Review and preservation. Actual walking mine delivery, repeated placement and multiplayer remain unqualified; earlier native evidence retains its original source scope.

Authored camp imports (2 October 2026)

The historical one-time truck snapshot above now has one narrow extension: proved finite camp deliveries can append an original startup camp magazine after two separately acknowledged native moves. Existing stock/spent entries and the lifetime 96-identity limit remain intact; arbitrary later deposits and returned empty magazines remain excluded. Admission requires conservative known finite-magazine commitments beyond prior imports, not merely unused truck capacity. Autonomous physical loading remains unqualified.

Supported carried launcher supply (2 October 2026)

HQ now considers supported empty launchers after existing rifle and mounted supply requests and before mine top-ups. Demand requires a fresh, complete delivered launcher snapshot for the entire known living formation, a positive count of reloadable magazine-well muzzles, and zero reported launcher rounds/chambers. The new LauncherMuzzles field survives detached status copying and validation. It does not assume an expended rocket/grenade leaves an empty magazine entity behind.

Before reserving the original infantry group and ammunition truck, the coordinator requires a compatible, unspent identity in its existing finite stock. The bounded scan covers all 96 stock entries and 32 original members; rifle-only prefixes cannot hide compatible cargo. Native muzzle disposal flags and scripted CanBeReloaded restrictions both refuse one-shot weapons. Exact supported wells, carried-weapon ownership and reciprocal loaded-item slots are checked. Installed RPG7/GP25/M203 round prefabs are projectile entities with magazine components; their entity type alone does not exclude them. This adds no stock, replacement actors or virtual ammunition.

The existing radio hold, reported rendezvous, physical access, shared spent ledger and native inventory proof govern transfer. Launcher trips do not return empty projectile rounds. Unknown delayed operations retain the original claims; a terminal negative callback releases them only after exact unchanged original source slot/storage, managers and exclusive custody are proved. Submitted stock remains spent even after refusal: no retry or refund. A failed move therefore cannot silently duplicate cargo or permanently pin forces when its unchanged source custody is confirmed.

Eleven focused programs pass independently, with failing mutation controls for copied muzzle presence, stock-prefix reachability and terminal refusal settlement. All 283 registered programs pass. The final-source normal route compiles the implementation and completes 63 assertions with zero script failures; thirteen retained engine errors preserve strict failure. Actual launcher walking delivery, subsequent AI reloading/firing, remote inventory behavior and performance remain unqualified. Source, installed-API review and limits. The existing packaged handoff predates this feature.

Rifle transfer cancellation (2 October 2026)

Both rifle and launcher transfers now preserve terminal cancellation and revalidate current authority immediately after native submission. Previously an inline callback could stop a rifle transfer, move its exact magazine and acknowledge success; the leaf would overwrite failure and the coordinator would count delivery. The same gap admitted a donor capture or recipient ownership change at that boundary. The existing checks now apply to both modes.

Focused actual-method tests cover cancellation, capture, inactive mission, changed recipient group, late custody after cancellation, one submission and zero cancelled-delivery accounting. Submitted identity reservations and uncertainty handling are unchanged. Four related regression programs pass; independent baseline and ownership-mutation failures confirm the correction. Native inventory is doubled in these tests, so this does not establish a physical delivery or multiplayer behavior. Evidence.

Compatible-stock admission (3 October 2026)

Before committing a small-arms supply trip, HQ now checks that at least one unspent original magazine still in the truck contains usable ammunition and fits a weapon carried by an attributable, fit member of the original recipient roster. This reuses the bounded launcher preflight with small-arms compatibility rules; launcher and mine priorities remain unchanged. Delivered reports still establish demand and rendezvous positions.

Previously, any remaining magazine could consume the demand report, set the three-minute cooldown and stop the truck—even when only incompatible belts or launcher ammunition remained. Such a trip could never pass the later transfer check. Refusal now happens before those commitments, leaving the same report available to a compatible original truck or a later supported supply request.

The scan admits at most 96 original magazine identities and 32 original roster members. It creates and reserves nothing. This is a compatibility preflight, not a promise of later delivery: individual need, physical approach, capacity, ownership, ammunition loss and native transfer proof remain execution checks. The added ordinary-planning scan has bounded work; no measured frame-time improvement is claimed.

All 300 registered regression programs pass. Independent actual-method tests reproduce the old failure and confirm a later compatible original truck can accept the same delivered report. One hidden/muted normal Everon run compiles and completes 63 assertions and one round, with 0 script/runtime failures and 13 retained engine-error entries. Cleanup and unchanged source/external inputs are confirmed. Native walking supply, inventory delivery and multiplayer remain unqualified. Implementation, regression and native evidence.

Finite camp mine imports — 3 October 2026

The original bound convoy mine snapshot now has a finite extension: an original camp responder can carry one original inert camp PMN4 through two independently proved native inventory moves into that truck. A separate mine demand/import count prevents magazine expenditure or unknown stock from requesting mines. The original batch stays bound; zero original allowance cannot bootstrap supply. Each exact import appends once to the mine allowance, whose lifetime limit is 96 identities, while outgoing mine and magazine work retains the shared 96-spent ceiling. No stock is recreated and arbitrary deposits remain excluded.

This adds a source of physical cargo, not an engineer grant or a reset of consumed mine orders. Existing radio-delivered recipient demand, original designation/carrier entitlement, per-trip limits and cancellation quarantine stay in place. Full depot behavior and validation.

All 301 registered regression programs pass. One hidden/muted normal Everon run completes 64 assertions and one round, with 0 script/runtime failures and 13 retained engine-error entries. The added read-only stock witness confirms ten distinct original inert PMN4s stored in five camp caches. Cleanup and unchanged source/external inputs are confirmed. Autonomous camp-to-truck and truck-to-engineer delivery remain unqualified.

Ordinary ammunition claims survive unresolved cancellation — 3 October 2026

An interrupted ordinary rifle-magazine trip now retains its exact recipient and truck reservations while its existing transfer leaf reports an unresolved native operation. Previously only mine and launcher trips retained these claims, allowing a later truck to reserve the same group while an accepted empty-magazine return was still pending. Owned waypoints and the downlink are cleared immediately. The existing polling path releases only matching claims when the leaf settles; stopped services also continue this observation. No new submission, refund, replacement stock or late success is granted. The leaf's existing custody and callback rules are unchanged.

The recorded source regression checks cover delayed settlement, competing claims and cancellation. Native transfers, real convoy movement and multiplayer remain unverified for this change; an existing game prevented isolated engine checks. Exact source and regression checkpoint.