NEXT PHYSICAL MINE RESUPPLY: READ-ONLY PLAN, NOT IMPLEMENTED

Recommended smallest coherent scope
----------------------------------
Top up exactly one already demonstrated mine carrier from one usable carried
PMN4 to two. Admit only an idle original infantry formation with fresh delivered
MineComplete=true, MineMembers==Count and ReadyMines==1, plus the existing fresh
truck position/distance<=200m conditions. At the physical rendezvous require one
attributable original living on-foot actor still has exactly one owned usable
PMN4; move at most ONE original frozen truck PMN4 to that actor. Do not schedule a
zero-mine formation, infer mine entitlement from global chance settings, or reset
mine-placement attempts. This deliberately covers the narrow one-to-two case;
zero-stock recovery and full per-actor need manifests remain later work.

Why this demand boundary
------------------------
Owned EAI_Mines.STOCK=2 and Inspect creates per-soldier shortages only after its
EAI_MinesIssued flag. Successor MineComplete/MineMembers/ReadyMines are formation
aggregates; they carry no issued/selected flag or immutable carrier slot. A fresh
zero alone can mean intentionally never issued, dead former carrier, lost mine,
or prior placement. Dispatching to every zero would override optional issue policy.
Exactly one currently carried supported mine proves a current carrier without
inventing historical role or issuing a free new capability to a zero-mine group.

Existing paths to reuse
-----------------------
ERR_HQ.PlanResupply()/PlanResupplyTask: keep shared5s round-robin cadence; infantry
ammunition retains first priority, mounted demand second, new mine top-up last.
Use only existing delivered Watch entries and existing idle-force reservation.

ERR_InfantryResupply.TryPlan/Tick/Waypoints/Finish/Stop/PollTransfers: reuse the
single original truck coordinator and trip token100000+slot*128+trip, original
roster validation, two radio downlinks, fresh stopped-truck status, bounded native
movement, mutual exclusion and cleanup. Add explicit mine trip kind + dedicated
mine transfer leaf; do not duplicate the whole rendezvous controller. Retain every
submitted unresolved leaf through Stop and include it in the same Busy/Unresolved
checks so infantry/mounted work cannot overlap it. Use existing consumed-report
and recipient-cooldown maps. Mine trip moves one item then finishes; no zero-ammo
assumptions from the rifle sampler in its physical branch. Status/log counts must
distinguish magazine delivery from mine delivery.

ERR_ConvoyMineStock.Complete/Count/At: after batch closes, capture up to2 exact
initial identities once into service-local mine originals. Never adopt replacement
entities or re-read arbitrary current cargo as new stock. At plan and execution,
revalidate exact original truck, native ownership, alive/disarmed PMN4 and unspent.
Closed may mean failed/empty; that grants no entitlement to retry initial spawn.

ERR_FiniteMagazineReservation: despite its name, Reserve/Commit/ReleaseUnsubmitted
operate on exact IEntity plus originals/spent arrays, not magazine components.
Pass the separate two-item mine originals array with the EXACT EXISTING service
m_Spent array. Do not pass magazine-only m_Stock (Reserve would reject every mine).
The existing shared96 spent cap remains conservative: if ammunition consumes all
96 attempts, skip mine transfer. Do not add a second spent ledger, raise caps or
refund accepted/ambiguous native operations. Commit immediately before native call.

New ERR_InfantryMineTransfer (needed actual production leaf)
----------------------------------------------------------
Same mode/current original donor+recipient/physical storage invariants as the
existing infantry magazine leaf, and shared ERR_InfantryAmmoAccess.Clear at the
original truck. Exact incoming PMN4 must be alive, inactive (including default),
originally frozen, reciprocally stored under the original truck, and not present
in the recipient. Recipient must be an immutable original member and physically
still own exactly one usable PMN4, with native FindStorageForItem/CanMove capacity.
Submit one TryMoveItemToStorage only; no compatible-rifle test, no empty-magazine
return, no GetItem (native excludes Move), no refill/spawn/delete/retry.
Require callback plus exact source absence/destination ownership/reciprocal slot
proof. Native false without definitive proof stays spent/quarantined; exact
incoming deletion may settle the one-item operation, not capture/damage alone.
Caller retains strong leaf/reservation while uncertain. Terminal cleanup releases
matching force/vehicle claims only, never transfers player-held items back.

Engineer lifecycle coupling deliberately NOT changed
---------------------------------------------------
ERR_HQ.MaintainEngineerMines requires delivered RoadIntercept and active assignment,
then permanently sets EngineerMineAttempted once per squad, including refusal.
ERR_HQ.ReserveLogistics rejects active Assignment/Waypoint, so an engineer cannot
leave an active road post under current generic rendezvous authorization. The
new top-up must wait until ordinary assignment teardown, not steal its actions.
ERR_EngineerMine.SelectActor/Begin consume an exact carried mine and preserve a
round-wide attempted-item tombstone; resupply must not clear that tombstone.
Rearming another road post after replenishment would require a separately designed
per-task attempt policy, prior-mine spacing and approach safety. It is not implied
by a successful item delivery and must not be bundled as a silent latch reset.

Exact planned file boundaries
-----------------------------
- ERR_InfantryResupply.c: one trip kind, frozen mine originals, same spent/maps,
  top-up admission, transfer/poll/Stop integration and clear delivery diagnostics.
- ERR_HQ.c: PlanResupplyTask lowest-priority fallback only.
- NEW ERR_InfantryMineTransfer.c: exact one-item native move transaction.
- Existing tests/test_infantry_resupply_planning.py,
  tests/test_infantry_resupply_coordinator.py, tests/test_hq_multiconvoy_supply.py,
  tests/test_mounted_supply_integration.py: mutual exclusion and shared lifecycle.
- New actual-method mine leaf test; registration handled separately by parent.
No changes required to EngineerMine, mine grants, Watch schema, radio scheduling,
initial cargo batches, original reference content, or force budgets for this scope.

Critical actual-method checks before any native qualification
-------------------------------------------------------------
Known1 vs unknown/zero/2+, stale/interrupted report, unchanged global issue policy;
physical carrier lost/changed count/captured/released; exact frozen mine and shared
spent exclusion; inline success+false return; callback without custody; timeout,
late success, deleted item vs merely captured; original truck/courier loss; no
placement reset; no simultaneous infantry/mounted/mine work; exactly one delivery;
normal magazine-only stock counts and priority unchanged. Native consumption and
ordinary AI approach remain separate bounded qualification, not implied by tests.
