EscapistsReintroduced/docs/next-gameplay-increments.md

# Next concrete gameplay increments

**Current source increment (2 October 2026):** the two-road-survey budget rotates across delivered tracks so blocked early tracks cannot starve later candidates. Resumed verification retains **233 passing programs** against identical frozen input hashes and attempts **1 fresh suffix program**; the current resumed result exits **1** after **234 total recorded programs**. Complete passing verification remains unestablished. The initial deadline-test adapter failure, later `/tmp` quota failure and rejected alternate-directory attempt remain archived. Resumed temporary files use `/tmp`; no production/native source changed for this resumption. The final canonical `/tmp` retry stops in `test_native_package.py` with disk-quota errors (Errno 122); the remaining suffix is unverified. No full-suite pass is claimed. The bounded native run records **33 assertions**, **0 completions**, **2 script/runtime failures** and **15 retained engine errors**; runner result: `test-failed`. It does not establish the complete physical interception sequence; preserve the failed or incomplete result and its raw logs. The canonical convoy admission assertion failed before the interception stage; no physical interception was exercised and no admission policy was weakened. Cleanup confirmed: `True`. Strict engine errors are retained. A separate normal-route run of the same source records **63 assertions**, **1 completion**, **0 script/runtime failures** and **13 retained engine errors**; runner result: `smoke-completed` and cleanup confirmed: `True`. This ordinary route does not validate physical interception. The witness arranges two synthetic observations and cannot qualify natural detection, multiplayer or FPS. The existing menu-fix package is unchanged. [Source, regression, native and independent-review evidence](evidence/mounted-native-2026-10-02/review.json).

**Latest separate development handoff:** [2 October HQ travel memory](../.build/playtest-2026-10-02-hq-memory-menu-fix/README.md). It includes recovery-status hints, finite supported-launcher resupply, motorized interception source and the parallel automatic terrain takeover work. Fresh source checks pass 285 regression programs and 63 scripted normal-route assertions. Runtime/package qualification is stated in the handoff; physical interception/launcher delivery, human escape, multiplayer and comparative FPS remain open. Earlier dated evidence below retains its original scope.


Read-only audits on 30 September distinguish these missing ordinary features from code that already exists but still needs native/manual/multiplayer qualification. Most recent packaged checkpoint: [objective-map development build](../.build/playtest-2026-10-02-objective-map/README.md). It includes authored discovery/mine-warning map UI, controller ownership fixes and the earlier finite maintenance, engineer, convoy, HQ and intel changes. Physical mounted rearming is still not demonstrated; see current status for source-bound evidence. The generated-catalog route now completes its scripted check; ordinary input, multiplayer and strict packaging remain unqualified. Retain native concurrency guards and leave unrelated sessions untouched.

## 1. Normal clue-site ground transport

Implemented in source: `EveronSites.conf` now attempts one explicitly optional locked `SupplyUAZ` at the Southern cache. The required default remains unchanged. Optional creation is deferred behind required physical stock/guards/extraction, attempts once, and safely omits failed candidates under a fixed readiness deadline. Occupied or uncertain candidates are retained outside preparation cleanup ownership. Focused executable regressions and independent review cover these paths.

One normal-catalog native startup now accepts the parking candidate and confirms the owned UAZ starts locked; ordinary driving and remote interactions remain pending. The candidate uses offset `0 0 -12`, heading 180°, radius 4 and maximum terrain range 1. The first `normal-escape-route` launch was refused because another test runner held the private prefix. The subsequent [normal-route run](evidence/native-2026-09-30-normal-route/report.json) completes 55 scripted checks through extraction with zero script/runtime failures and thirteen installed-resource errors. That diagnostic uses the ordinary catalog and generated placement; previous `escape-route` evidence uses historical sites. Keep those scopes distinct. [Ground transport details](ground-transport.md).

## 2. Audible vehicle breach alarm

Implemented in source: successful authoritative `TryBreach` starts a once-only, replicated eight-second horn alarm. A monotonic unused/active/completed state and local completion latch prevent replay. Initial client mission readiness may wait only inside the original local deadline; a bound mission becoming inactive stops immediately. Dedicated servers keep state without audio. A single component-owned `AudioSystem.PlayEvent` handle follows the vehicle; expiry, destruction, mission end and deletion remove callbacks and terminate only that handle. Driver input and shared vehicle horn signals remain untouched.

The exact vanilla UAZ ACP `{7E64D37BE3E1F3FA}Sounds/Vehicles/Wheeled/UAZ469/Vehicles_UAZ469_Horn.acp` was verified once in the installed resource database. Playback uses `SOUND_VEHICLE_HORN_LP`, explicit `HornState=1` and the local horn point `0 1 1.2`. `AudioSystem.IsSoundPlayed` means **finished**, as demonstrated by three vanilla sound-manager/cinematic callers; the diagnostic now checks its inverse. The initial failed native assertion is preserved. The corrected [native fixture](evidence/native-2026-09-30-vehicle-alarm/report.json) completes 135 checks and observes the active handle, fixed stop and no replay, with zero script/runtime failures and thirteen installed-resource errors. Audible waveform, spatial offset and real remote/late-join delivery still need qualification. [Implementation details](vehicle-security.md).

Implemented in source: tagged native local horn events feed only eligible nearby
soldiers' native danger queues, then the existing per-group perception cache and
radio path. Alarm reports retain their original time and approximate area, carry
no target/motion/equipment claims, and may reserve only one mobile search group.
Home guards, interception and fire-support escalation are excluded. [Alarm evidence
and validation limits](vehicle-security.md#local-alarm-evidence-for-hq-30-september-2026).
Native event retention and actual radio delivery into HQ memory now pass the arranged active-scene test; ordinary breach input, audible presentation and remote clients remain unqualified.

## 3. Mounted ammunition reporting before rearming

The authorized owned `EAI_AmmoSupply.c` samples vehicle weapon/muzzle magazines and treats ammunition below one quarter of capacity as low. The successor intentionally samples carried weapons separately; mixing mounted rounds into infantry totals would change existing infantry-resupply decisions.

Implemented in source: a bounded sampler binds one immutable root to each already admitted convoy vehicle and its original crew/ledger identity. Revalidate capture, faction, attributed surviving crew and occupancy; a replaced or lost root must never rebind. Traverse at most 128 unique descendants, skip character subtrees, deduplicate weapon/muzzle/magazine identities and report overflow or unsupported magazine-less weapons as incomplete rather than empty. Keep all live references in the local sampler. Send a separate detached completeness/weapon/round/capacity/chamber snapshot through `PendingStatus`, normal radio delivery and `ERR_HQWatch.Ingest` with the existing observation time. Initially expose status only; mounted rearming remains a subsequent physical transaction, not a stock refill or force spawn.

Existing API examples are `ERR_HQAmmoSampler.c` and `ERR_AircraftAmmo.c`; do not reuse the latter's unbounded recursive helper unchanged. Existing original-roster and snapshot caps remain in force. Increments 1–3 are implemented in source; native evidence and ordinary/multiplayer qualification are scoped separately. [Mounted reporting details](hq-ammunition.md#mounted-convoy-reporting-30-september-2026). Physical mounted rearming remains unfinished; alarm-driven investigation is implemented in source; native hearing and memory delivery now have arranged evidence, while physical investigation arrival remains unqualified.


The production-fleet observer reaches six original roots and excludes eight cargo
weapons from the unarmed truck. Later incidental native UAZ status observes
99/100 magazine rounds plus one chambered round, but also exposed slot wrappers
being counted as a second weapon. Exact installed relationships and one-hop
wrapper deduplication are now regression-tested; the latest alarm diagnostic
compiles them. A dedicated detached-snapshot/radio proof, corrected native weapon
totals, BMP completeness and mounted rearming remain outstanding. Preserve all
[failed production evidence](hq-ammunition.md#mounted-convoy-reporting-30-september-2026).

The alarm fixture now keeps its exact observer near the existing scene and waits
for natural activation. Actual hearing and radio delivery exposed and then verified
a fix for a sanitized-report lifetime crash in HQ memory. [Native proof and remaining
limits](vehicle-security.md#native-alarm-delivery-and-memory-lifetime-correction).
Complete low mounted magazines now request early status through the existing
shared cooldown; finite-stock physical rearming still needs the audited swap,
access and shared-reservation integration described in [HQ ammunition](hq-ammunition.md#early-mounted-ammunition-check-ins-1-october-2026).
Convoy startup now reports its shared body budget, including the observed 134/135
refusal for a 25-body convoy. Configured fleet size is an allowance, not a
reliability guarantee; budgets, report timing and inventory remain unchanged.

The shared original-magazine reservation and pure already-bound root validation
are now consumed by infantry transfer and mounted sampling, respectively. The
next mounted step is the bounded read-only native swap-eligibility probe recorded
in [the implementation review](evidence/hq-contact-reservations-2026-10-01/review.json).
Physical worker access and the actual two-item transfer remain unfinished.

The current production mounted-report fixture now verifies actual detached radio
delivery and correct one-gun UAZ counts; BMP reporting remains incomplete. The
first read-only mounted eligibility variant verifies the exact original PKM slot,
muzzle and storage, but finds no eligible compatible cargo candidate and never
calls CanSwap. Retain that unavailable result; the next step is resolving eligible
finite incoming stock before any physical transfer implementation. [Evidence and
remaining scope](evidence/mounted-budget-2026-10-01/review.json).

The later initial-stock run resolves the missing incoming candidate: production adds two finite mounted-magazine requests after the primary batch, and native inventory contains a compatible PKM box. One read-only CanSwap query succeeds while both slots remain unchanged. There is no eligible original worker on foot, and no transfer occurs. The next implementation must coordinate an original worker's physical approach/access and a once-only native transaction using shared finite reservations, driven by delivered HQ demand. [Latest stock and eligibility evidence](hq-ammunition.md#initial-mounted-stock-and-read-only-eligibility-1-october-2026).

The retained second-leg proposal is now integrated into the shared production HQ/convoy service with a dedicated physical pickup leaf and original-crew coordinator. [Current behavior and failed native evidence](hq-ammunition.md#mounted-courier-integration-1-october-2026). The source integration is no longer the missing step: exact native pickup/exchange and reliable truck approach remain unproved. Preserve both failed physical attempts; the first reached pickup without recording its specific refusal, the second timed out before pickup. Do not weaken capacity, physical access, finite custody or radio guards to make the fixture pass. The normal generated escape loop still completes on this source. Further courier diagnostics must stay bounded and must not displace playable base-mission work, manual/multiplayer preparation or the paused-experiment restrictions.

## Latest source changes and next bounded AI feature (2 October 2026)

[Recovery warnings and supported launcher supply](evidence/recovery-launcher-2026-10-02/review.json) are now implemented and regression-tested; the latest packaged handoff above predates both. Physical launcher delivery/reloading still needs native qualification.

The next identified owned-AI gap is [motorized road interception from delivered travel history](evidence/recovery-launcher-2026-10-02/next-motorized-interception-proposal.json). Current remembered headings can place infantry ahead of travel, but convoy orders only hold/resume authored routes. A first implementation should assign at most one available original armed escort, deliver its order by radio, hold a suitable road and resume the preserved route. It must integrate with the existing convoy waypoint owner and exclude combat/logistics/depot reservations in both directions. This is a design proposal, not implemented behavior or a native driving result. Existing authorization covers later hidden/muted checks; no new permission gate is intended by the archived draft's wording.

## 2 October: source implementation complete, native interception pending

The motorized-interception proposal is implemented for one existing armed UAZ escort, with 285 passing regressions and a 63-assertion final-source normal escape check. The next bounded check is actual radio delivery, movement, hold and rejoin with unchanged original vehicles and crew in the authorized hidden/muted environment. It needs no new permission request. The old playtest package still predates recovery/launcher and motorized-interception changes. Human play, multiplayer, launcher delivery and comparative performance remain open.