EscapistsReintroduced/docs/hq-ammunition.md

Delivered HQ ammunition and mine reports

The current addition reports physical small-arms ammunition through the existing formation status uplink and lets HQ withhold a new armed infantry task when a fresh, complete report proves the squad empty. The later infantry resupply follow-up adds early low-stock reports and a finite nearby truck rendezvous; broad resupply parity remains unfinished. A controlled native radio/inventory run is recorded below; multiplayer and resupply remain unqualified.

What the local sampler observes

StatusSampler enumerates the same immutable original roster used for casualty accounting. Each living, still-owned member contributes to an AmmoSnapshot; unconscious living members remain part of that roster. A surviving original owned radio caller is still required to send status. Unknown/deleted or transferred members do not become fabricated ammunition counts or replacement soldiers.

The sampler reads owned inventory and weapon components, muzzle magazine wells, loaded magazines, carried compatible magazines and chambered barrels. Exact magazine-well types contribute known counts. A differing type accepted by the native inherited-well search makes the corresponding total incomplete, so potentially compatible modded magazines cannot create a false empty report. Physical item identity deduplicates loaded/carried enumeration and weapons sharing a compatible well. Magazine rounds and chambered rounds remain separate fields. Rifles, sniper rifles, machine guns and handguns form the small-arms category; supported launcher magazines/chambers are separate. Grenades and smoke do not stand in for rifle ammunition. Vehicle-mounted weapons, cargo stock, mines and loose launcher projectiles are outside the rifle/launcher totals. Carried PMN4 capability has separate fields described below.

Work is bounded to 32 members, 128 inventory items and eight weapons per inspected actor, four muzzles per weapon and four barrels per muzzle. Missing components, unsupported relevant weapon geometry, invalid loaded magazine wells/counts or an exceeded bound mark the affected information incomplete. Loose items with no magazine well cannot reload a well-bearing rifle under vanilla compatibility rules; they leave small-arms completeness intact and launcher information unknown. Launcher completeness is tracked separately where the unsupported data concerns only a launcher. Incomplete inventory never means an empty rifle squad. A squad with no observed small-arms muzzle is also not treated as proven empty.

What reaches HQ

The snapshot travels with the routine status report, scheduled every 180 seconds; an HQ check-in request can make the next status due sooner. Local scans every 30 seconds can also request low-stock status, subject to a 60-second urgent-call cooldown; only complete known stock qualifies. Busy radios and physical route delivery still govern arrival. Local inspection, queuing and an interrupted uplink do not update HQ ammunition knowledge. Watch validates and copies the payload only on delivered status, keeping the status source, message ID and observation time. Later mutation of the sender's object cannot alter the delivered copy. An accepted status without ammunition payload clears a previous ammunition claim. The journal displays small-arms magazine rounds and chambered rounds when complete, otherwise unknown.

ArmedSearchBlocked returns true only for a nonclosed formation with a complete snapshot matching its current delivered living count, at least one member and one small-arms muzzle, zero magazine rounds, zero chambered rounds, and status age no greater than 180 seconds. A newer body report that changes the living count invalidates that match until suitable fresh status arrives. Missing, stale, incomplete or roster-mismatched information adds no veto: HQ does not interpret uncertainty as proof that ammunition exists or that it is exhausted.

Effect on orders

HQ checks the delivered empty-ammunition veto while selecting new pursuit/intercept/contain/search tasks, retasking a search, and selecting a missing-patrol investigator. It checks again before applying a newly delivered infantry order, so an empty status arriving during that downlink can prevent the new assignment. A rejected pending replacement does not cancel the previously active assignment. Already active orders are not interrupted merely because ammunition evidence changes. Delivered release-only commands still work for an empty squad.

Only small-arms emptiness drives this initial decision. Launcher totals do not authorize anti-air fire or block tasks; no vehicle-weapon or mine budget is inferred. The infantry supply coordinator consumes delivered low-stock reports and existing finite convoy cargo. It shares the HQ tick, creates no replacement units or ammunition, and does not implement the original broad truck/helicopter/depot supply network. Existing finite mortar/courier logistics retain their own reservations and inventory.

Validation boundary

Sampler tests execute actual inspection and snapshot methods with native-component doubles: loaded/carried deduplication, shared wells, chambers, separate launcher information, unsupported/invalid inputs, work bounds and ownership refusal. Watch tests cover immutable delivered snapshots, exact freshness limits, absent payload and roster changes. Dispatch tests check the new-task gate locations and execute the actual delivery admission while preserving active orders and release commands. They do not prove native inventory API behavior or real client replication.

The 04:08:57 native run completes 49 assertions and one round with zero script/runtime failures. Five original surviving members report 1,120 compatible magazine rounds, 33 magazines and five chambered rounds. A separate native read observes 160 rounds in five loaded magazines and a full original-roster rescan matches the queued totals. The actual radio route delivers a distinct Watch snapshot, unchanged twenty seconds later. No inventory was drained or replenished. The arrangement is the existing controlled body-visibility fixture; it does not prove native depletion, ordinary squad resupply or multiplayer. This run predates the final conservative derived-well refinement, which has actual-method coverage and is compiled in the subsequent convoy run. It retains four external localization errors, so strict native/release qualification still fails. Cleanup and unchanged source/dependency inputs are confirmed for this run.

Failed attempts remain visible: compiler-expression limit, incomplete-inventory diagnostic, and component classification diagnostic. The second attempt has an original cleanup-verification failure and is explicitly unsealed; a later independent check verified the private prefix idle. Its runner was not rewritten or promoted. Native diagnostics identified loose rocket/flare projectiles with no magazine well; the category correction follows the stock reload/search predicates instead of claiming those items refill a rifle.

Mounted convoy reporting (30 September 2026)

Convoy admission now gives each original crew sampler its exact original vehicle. The sampler pins the current mission and physical convoy ledger record and checks that identity, source, initial strength and ownership again before inspecting mounted weapons. Capture, foreign crew/faction, vehicle loss or ledger replacement permanently releases this mounted claim. At least one attributed surviving original crew member must occupy the root. Empty or uncertain occupancy produces an incomplete observation; the sampler never searches for another vehicle.

The separate ERR_HQMountedAmmoSnapshot carries only completeness, weapon/muzzle/ magazine counts, rounds, capacity, chambers and magazines at or below one quarter capacity. Traversal admits at most 128 structural nodes and 128 excluded cargo roots, with a hard 256-identity queue bound. Skipped crew and unknown storage count as structural work. Character and deposited-inventory subtrees remain excluded, including combined deposit/attachment storage flags. Weapon, muzzle and magazine identities are deduplicated. Missing magazines, projectile-only weapons, malformed quantities or exceeded bounds keep the snapshot incomplete rather than proving empty. Cargo rifles and their loaded magazines are not mounted weapons; inventory reserves are not counted.

Mounted data accompanies the ordinary pending status, retaining its observation time. Only successful radio delivery admits a validated detached copy to the HQ watch. A later incomplete or absent mounted payload replaces the previous claim. The status journal displays complete totals or unknown/incomplete. Mounted counts do not trigger urgent infantry reports, alter infantry task selection, request a resupply mission, refill stock or create forces. Mounted rearming remains unfinished.

Actual-method regressions cover hierarchy/quantity bounds, deposited cargo, deduplication, ownership/capture/loss, original ledger replacement, detached pending and delivered snapshots, replay/staleness and preservation of infantry reporting. The native convoy fixture only observes actual mounted sampling and detached copies; it does not repair production binding or qualify remote delivery, depletion or rearming. Native results for this increment are recorded in current status.

The initial native run compiled the feature but timed out before convoy dispatch: the old diagnostic waited for mortar readiness while HQ ticks were paused in prison. Both convoy variants now use the existing checked escape transition before waiting. The corrected run passes 33 assertions and road surveying, then rejects canonical dispatch before mounted inspection. It retains two fixture failure lines and thirteen installed-resource errors. Cleanup and source/external invariance pass in both runs. These results prove compilation, not native mounted counts or gameplay completion. The next direct check should use the current production supply fleet or diagnose the retained legacy allocator's refusal; do not weaken finite force budgets to obtain a passing diagnostic. The normal-route package still predates this source change.

The later production-fleet diagnostic keeps normal generated sites and observes existing convoys without forcing dispatch, reports or stock. Its scope is one ready original convoy under a fixed deadline; the configured three-convoy target is unchanged. The first production attempt failed before proof, with five mounted-binding refusals and only one deployed convoy. That log does not establish the exact failed eligibility predicate.

Independent actual-method regression then reproduced a structural traversal bug: seat enumeration descended into soldiers' carried inventory and deposited cargo, exhausting its 128-node budget after loading. Mounted eligibility now uses a separate bounded structural-seat scan, preserving exact occupancy and immutable crew/ledger checks. The generic convoy admission traversal is unchanged.

The structural follow-up compiles and passes 48 assertions: all six original vehicle roots retain their crews and ledger, snapshots are bounded/valid, and eight actual cargo weapons are excluded from the unarmed ammo truck. It fails the installed weapon-magazine assertion and never reaches the real-radio detached-copy proof. Validity alone does not establish completeness or armed counts. The precise missing-mounted- magazine cause remains undiagnosed. Both production attempts preserve their failures, thirteen installed-resource errors, unchanged source/external inputs and confirmed hidden/muted cleanup. Physical depletion, remote delivery, mounted rearming and fleet reliability remain unfinished; no passing native result is inferred from regression doubles.

Installed weapon slots and shared structural admission

The installed vanilla mounted weapon hierarchy exposes weapon and magazine InventoryStorageSlot parents owned by WeaponSlotComponent and BaseMuzzleComponent. Those parents are not ordinary deposit storage. The former storage-only guard could prune a genuinely installed weapon or magazine when GetStorage() returned null, UNSET or ANY.

Both mounted sampling and structural-seat traversal now share a narrow installed- slot check: the container owner must already be an accepted node of this original vehicle, and the slot must reference that exact current weapon, or the muzzle's current magazine must own that exact entity. Pending/unvisited nodes, foreign owners, carried weapons, stale slots and deposited cargo cannot establish that relationship. Unknown ordinary storage still fails closed. Original-crew and force-ledger identity, occupancy checks and all traversal limits remain intact. Actual-method regressions exercise both consumers together, including nested seats, cargo ancestry, incorrect current items and null/UNSET/ANY slot storage.

The first installed-slot attempt compiled the sampler correction but deployed no production convoy within the fixed 180-second observation window. It retains 32 passing assertions and two fixture failures; no sampling or radio delivery was reached. The subsequent shared seat correction is covered by regressions and the normal route integration, which completes 55 scripted checks with zero script/runtime failures. This route is compilation and base-gameplay evidence, not a mounted-magazine proof. Thirteen installed-resource errors remain in both runs. Native installed counts, actual mounted radio delivery, three-convoy reliability and physical rearming remain unqualified. The mounted observer now logs the existing production startup reason for future diagnosis without changing spawn budgets or the fixed deadline.

Native slot-wrapper deduplication (1 October 2026)

The initial alarm-hearing fixture incidentally logs original mounted UAZ status with 99/100 magazine rounds and one chambered round, while the unarmed ammo truck reports zero. Its two-weapon total exposed a separate identity issue: native WeaponSlotComponent inherits BaseWeaponComponent, and a manager can expose both the wrapper and its physical gun. Muzzles and magazines were deduplicated, but the wrapper inflated weapon count.

The sampler now resolves one exact current wrapper binding to the allowed physical weapon before deduplication. Parent container, current entity, inventory parent slot and physical component owner must all agree. Empty, stale, foreign, nested or mismatched slots mark the snapshot incomplete; traversal and 32-weapon caps remain unchanged. Actual-method regression fails on the old two-count behavior and passes with the correction, including 32 genuine weapons plus wrapper aliases.

The diagnostic follow-up compiles this source but stops at the alarm receiver's inactive LOD before any mounted qualification. The incidental first-run status lines are limited evidence of installed magazine discovery; they are not an independently checked detached snapshot, delivered Watch copy, corrected weapon total or BMP completeness proof. Physical rearming, native depletion and full fleet reliability remain unfinished.

Early mounted-ammunition check-ins (1 October 2026)

A complete validated original mounted snapshot with at least one magazine at or below a quarter of capacity can now request an early ordinary status frame. This uses the existing 30-second local scan and shared 60-second urgent-call cooldown. Carried and mounted totals stay separate: a full rifle inventory no longer hides a low vehicle magazine, and mounted stock does not create an infantry resupply demand. Unknown, captured/incomplete, unarmed, malformed or stale mounted samples cannot request urgency. A malformed carried payload also refuses an early frame that delivered Watch would reject. Routine/requested status behavior is unchanged.

Regression executes the actual policy and report scheduler: healthy carried stock plus 25/100 mounted rounds now queues status; queueing does not create delivered knowledge, later local mutation leaves the pending snapshot unchanged, interrupted transmission retains the same cooldown, and later ordinary delivery updates the harness receiver. The same final regression fails against the preceding source at the missing mounted check-in. Separate mounted validation, status, Watch and legacy contact/sweep scheduling tests pass. Captured native contact priority is a doubled boundary in that fairness harness, so neither native urgent reporting nor unrestricted-contact fairness is claimed. Physical rearming remains absent. Exact check and native evidence.

The read-only next-step audit identifies native CanSwapItemStorages/TrySwapItemStorages and the installed PKM magazine-slot inheritance. This supports investigating a physical two-item swap that returns the old box to the truck; it does not prove mounted slot access or native acceptance. Implementation must share the existing truck's stock/spent owner, validate an already-bound original mount, require an original worker's physical access, and confirm both exact final slot identities plus callback. Uncertain submissions remain reserved. No independent second stock consumer, free ammunition refill or unused transfer scaffold was added.

Shared finite reservations and bound-root queries (1 October 2026)

The existing infantry selector now reserves each exact original magazine through ERR_FiniteMagazineReservation, using the same coordinator-owned stock and spent arrays. A native submission commits the identity even when it fails synchronously, returns only the old empty magazine, or remains unresolved. Only an attempt with no native operation can release its claim. Closing a handle prevents later cleanup from releasing a new consumer's reservation. Destruction never refunds stock. The finite 96-identity cap and uncertain-operation quarantine are unchanged.

ValidateBoundVehicle(root) checks only a previously admitted original root, crew and ledger. It cannot create a binding, substitute a vehicle or update death, release or sample state. Ordinary mounted sampling consumes the query and still records permanent capture/loss through its observing path. Recovered captured vehicles and released crew therefore remain ineligible after recorded loss.

Actual-method regressions cover shared competing reservations, repeated release, empty-return uncertainty, all 96 identities, and 24 invalid root/crew/ledger conditions. Independent review found no reservation/lifetime regression. These are production-consumed prerequisites, not mounted rearming: physical worker access, native mounted swap eligibility, two-way slot confirmation and remote replication are still unproved. The current packaged handoff predates these changes.

Native production mounted reports (1 October 2026)

The current-source mounted fixture now completes 56 scripted assertions and one round. It observes one ordinary six-vehicle convoy, its original seated crews and force ledger, excludes eight physical cargo weapons from the ammo truck, captures a naturally queued status before transmission and verifies the detached matching counts in delivered HQ Watch. Original observation age, roster counts and radio payload are retained.

The three UAZ roots each report one weapon/muzzle/magazine, 99/100 magazine rounds and one chambered round. The ammo and unarmed truck roots report zero mounted weapons. BMP reporting remains explicitly incomplete: this run observes five weapon entries, three muzzles/magazines, 288/290 rounds and two chambers. Those partial counts are not full BMP ammunition qualification. One convoy deployed; 135/135 committed bodies prevented further original convoys. This does not prove three-convoy reliability or low-ammunition/physical rearming behavior.

There are zero script/runtime failures and thirteen retained installed-resource errors; strict native qualification remains failed. The runner confirms hidden, muted operation, cleanup and unchanged source/seven external inputs. Its addon source manifest is b12e845039f1ef02adc542e6d079a2c4cc634d50a13336135eca18b99f4aabaf. Later probe or source changes need their own evidence. Remote clients, actual mounted swaps and measured performance remain unqualified.

Read-only mounted slot eligibility diagnostic

The optional --mounted-swap-eligibility variant uses the exact production collector and one retained original convoy. It never moves inventory or actors, reserves stock, changes radio state or binds a new vehicle. The native run verifies the UAZ PKM loaded magazine in unlocked slot 0, its exact muzzle parent and its weapon-owned attachments storage. No eligible compatible incoming cargo candidate was found, so CanSwap was not called. This is not a native swap refusal and does not prove that a physical transfer is possible. The worker-access stage was not reached. Two explicit fixture failures and all thirteen installed errors are preserved in the result.

The run compiles the shared collector and budget optimization. Afterward, the terminal diagnostic wording was corrected and regression-tested so even successful eligibility cannot claim radio delivery; no successful terminal marker was emitted in the unavailable run. Mounted rearming still needs eligible original finite stock, a physical original worker, convoy order exclusion, one native submission, exact two-way ownership and late-callback handling. Existing development packages remain unchanged.

Initial mounted stock and read-only eligibility (1 October 2026)

The production initial-stock batch now derives finite extra types from exact originally installed magazines. Existing infantry weapon requests retain priority; unresolved original callbacks omit extras, and no runtime refill is added. Bounds and ownership rules.

The hidden/muted native run completes 34 assertions and one eligibility-only round with zero script/runtime failures. The production journal records two initial mounted-magazine requests after 48 primary requests. The read-only diagnostic finds a real 100-round PKM box in the original truck, with the same prefab as the original loaded magazine. CanSwapItemStorages returns true once, and both original slots remain unchanged. No original soldier is on foot at the required location; this proves neither physical access nor a transfer. The 13 known installed-resource errors retain the strict failed verdict. Cleanup and unchanged source/external inputs are confirmed. Native report.

All 250 registered regression programs pass, including actual seed/issuance methods, timeout and finite-headroom cases, and the stock callback barrier. The previous unavailable-candidate run remains archived. Physical worker approach, mounted access, two-item native completion, shared reservation/consumption and delivered demand remain unfinished. The packaged development candidate is unchanged.

Physical original-vehicle status position (1 October 2026)

A valid immutable mounted-root binding now supplies its current physical position at local status observation, rather than the native group's potentially stale spawn origin. The resulting position and timestamp remain detached while the ordinary radio route is in flight. Invalid or released roots retain original-group status with incomplete mounted ammunition and never reveal a replacement/captured root's live coordinates. Actual sampler regressions cover movement, detached values, invalid positions and all ownership refusal paths. Current native compilation and scope.

Mounted courier integration (1 October 2026)

The previously retained second-leg proposal is now integrated with a dedicated pickup transaction and ERR_MountedResupply, called by the production HQ planner. Each original convoy keeps one strong coordinator and shares the exact frozen stock/spent arrays and delivered-report replay/cooldown maps with infantry. Infantry planning retains priority; active or uncertain operations exclude the other consumer. HQ atomically reserves both original support formations without changing their permanent support roles. New holds require actual radio delivery.

One original non-driver dismounts, walks to an authored truck access point, picks up one compatible existing magazine, approaches its original mounted slot, exchanges the two exact items through native inventory, and returns to the same seat. The driver remains seated. Group retention survives a courier who is also the group leader. Transactions require callback and physical custody proof; submitted uncertainty retains its stock/claims instead of retrying or refilling. Only unsubmitted reservations can be released. Deadlines and matching-token cleanup bound normal failure and recovery; stopped services retain proof polling without authorizing new work. No force, magazine or replacement worker is spawned by this resupply path. Cargo capacity, stationary vehicles, slot locks and physical access remain mandatory.

The review records 256 passing regression programs and final focused checks. Native compilation exposed overly complex expressions; equivalent shorter guards now compile. Both compiler failures and an early native-fixture startup failure remain archived. The corrected opt-in --smoke mounted-ammo --mounted-courier --rounds 1 --timeout 780 fixture deliberately depletes one original installed magazine, then observes production decisions and physical operations; it never manufactures demand reports or dispatches a courier.

The first physical attempt delivers real low-ammunition status, dispatches and dismounts the original courier, reaches pickup, then fails before carried-item proof. Its initial generic journal message does not identify the precise inventory refusal. The follow-up times out during truck approach before pickup. Both journals record bounded return to the original seat and release of the matching holds. Each has 33 passed assertions, two fixture failures, no compiler/VM failure, and the thirteen installed-resource errors. Neither proves pickup, mounted exchange or ordinary gameplay reliability. Leaf refusal reasons are now included in the HQ journal when that stage is reached.

The unchanged final source also passes the normal generated escape route: 55 assertions, one round, no script/runtime failure. Strict qualification still fails on the thirteen installed-resource errors. All runs stayed hidden/muted, cleaned up, and preserved captured source/dependency inputs. Existing packaged handoffs are older and unchanged; manual play, multiplayer, performance, native courier approach/capacity and mounted swap qualification remain outstanding.

Terminal loss of submitted mounted stock (1 October 2026)

A submitted pickup can no longer keep its two convoy formations held indefinitely after its exact incoming entity is deleted. A submitted swap resolves this way only after both original exchange entities are deleted; either surviving item remains quarantined. Damage, capture, missing workers and uncertain inventory membership are not deletion proof. The committed stock remains spent, no transfer is credited and no item is replaced. Existing cleanup releases matching holds, allowing a fresh delivered request to use other original stock.

Actual-method regressions fail before the correction and pass after it, including late callbacks, no refund, surviving-item quarantine and coordinator reuse. The review records the full suite and a normal-route compile/integration run. This is not native physical deletion or mounted-rearming qualification. The packaged field-update candidate predates this source correction and remains unchanged.

Carried mine reports (1 October 2026)

Routine formation status now includes exact carried PMN4 capability. The same original owned roster contributes MineMembers, ReadyMines and MineComplete independently of rifle/launcher completeness. Inventory work is limited to 32 members and 128 entries per member; duplicate physical identities count once. A mine must be the supported PMN4 prefab, held in reciprocal owned inventory storage, with its required mine, damage and pressure-trigger components. Destroyed or activated/default-activated mines are not available stock. Unknown entries, missing components or uncertain custody make mine information incomplete instead of proving an empty squad.

The scalar snapshot keeps the existing observation time and travels through the existing status radio route. Pending/interrupted reports do not update Watch; stale or impossible counts are rejected. Delivered values are copied, so later inventory or sender changes cannot rewrite HQ history. The status journal shows a complete available-PMN4 count or unknown/incomplete. Mine scarcity alone adds no extra urgent radio call. Fresh complete routine reports now also feed the existing coordinator's narrow one-to-two mine top-up from finite original truck stock. Zero-stock replenishment and additional placement behavior remain unfinished.

Independent review and regressions cover actual sampler, snapshot, Watch and radio methods. All 264 regression programs pass. The normal native escape route compiles this source and completes 63 assertions with zero script/runtime failures; thirteen installed-resource errors retain strict failure. This route does not qualify physical mine counts, placement, replenishment or multiplayer. The preserved packaged field-update candidate predates this addition.

3 October: exact inert BMP controls

Mounted sampling now omits only the installed WCS Armament_Empty.et and vanilla VehiclePeriscope_DummyWeapon_Base.et when their native muzzle list is empty and exact reciprocal weapon-slot ownership is proved. Actual weapons, including a known placeholder resource exposing a real muzzle, still undergo ordinary ammunition accounting. Missing magazines and unsupported components remain incomplete. No BMP dispatch or budget policy changes.

Actual-method regression tests reproduce the old incomplete count and pass with this correction; all 302 registered programs pass on the recorded snapshot. Later concurrent settings, preferences and welcome-voice changes are outside that validation. The hidden mounted diagnostic compiled but admitted no convoy before its fixed deadline because of the existing finite body budget. It therefore provides no native BMP accounting or radio-delivery proof. Its two test failures and thirteen existing engine errors remain recorded. See accounting evidence. The depot-mines runtime package predates this change.

4 October: original BMP complete counts and delivered report

The exact WCS empty-armament control has no runtime inventory-item component. For this audited zero-muzzle resource only, the sampler now accepts an absent reverse inventory binding when its unique native structural attachment is proved within the same bounded hierarchy. It checks the exact physical owner, immediate allowed parent, at most eight local mount components, mount/slot/parent-container/attached-entity agreement and absence of conflicting inventory custody. Real guns, unknown controls and the existing periscope path retain their previous rules; the control still consumes the bounded collection slot before being omitted from armed counts.

The corrected hidden native fixture completes 60 assertions and one cycle: the original slot-4 BMP is complete with three weapons/muzzles/magazines, 288 magazine rounds, 290 capacity and two chambered rounds. Its exact queued status reaches a detached HQ Watch copy through actual radio delivery, preserving original crew/vehicle identity. One convoy is checked with unrelated opening hunter/town admissions isolated. This proves accounting and delivered state, not physical interception, full-fleet reliability or multiplayer. All 309 regression programs pass on the recorded final inputs. Thirteen known engine errors remain; strict clean qualification fails. The earlier diagnostic failure is retained. Implementation, controls and exact source evidence.