Capture current mission, AI, map and administration development

Include the current addon, terrain integrations, tools, regression tests and recorded development evidence.

docs/mounted-interception.md

@@ -0,0 +1,31 @@
+# Motorized interception from delivered history
+
+The HQ can temporarily detach one or two original armed UAZ escorts, or one eligible original BMP, from a live convoy. It chooses a road ahead of a credible, radio-delivered ground track and sends the command through the ordinary physical radio graph. It never reads a player's current position to plan or update this order.
+
+Eligible UAZ formations occupy convoy slots 0, 3 and 5. The original slot-4 BMP becomes eligible as a singleton after six confirmed original-unit losses have been reconciled from delivered reports. Supply trucks remain on their existing duties. The selected original formation must have fresh, complete delivered mounted-ammunition and fitness status, unchanged crew and vehicle ownership, and no conflicting tactical or logistics reservation. Existing convoy combat and resupply planners have priority. New depot jobs run afterward and respect the claim.
+
+For the BMP, an immutable envelope measured from its exact vehicle and attachments must fit the road width, a single supporting segment and terrain/water/collision clearance. Unknown, changed or excessive geometry refuses the order. It remains a conservative destination check, not proof of a traversable route. The threshold and original custody are rechecked when the radio command arrives. BMP selection precedes the UAZ fallback and shares the same two-survey allowance.
+
+The destination lies 300–900 metres ahead of the remembered predicted position. Selection requires a road at least six metres wide, the existing vehicle-volume and terrain checks, a 200-metre settlement exclusion and separation from other HQ destinations. These checks do not establish native path reachability or guarantee that an escort will arrive before the players.
+
+There is one pending or active intercept job, with each assigned escort counted against both HQ force limits. A pair consumes two places before either radio command arrives. Pending radio delivery leaves the normal route and its deadline intact. A changed report revision, interrupted delivery or unavailable original crew rejects the command. Each attempted report revision remains spent; at most 256 attempts are retained per HQ lifetime. An independent monotonic allocator spends one token per escort from 400001–400256, outside existing infantry, mounted and depot logistics ranges. Refused claims also spend their allocated tokens; pair attempts consume two.
+
+When two original escorts are available from the same convoy, HQ first tries a pair on one road polyline. Both positions retain the actual road shape and segment height, are at least forty metres apart, and independently satisfy settlement, clearance and reservation checks. Short roads, tight bends or blocked positions can reject the pair. A singleton fallback is chosen before claims are made; pair and singleton selection share the existing total of two road surveys per HQ pass.
+
+Each crew receives its own real downlink. The first receipt only waits for the second; both vehicles continue their authored route until both commands arrive. Interrupted delivery, changed history, ownership loss or an unavailable partner cancels the whole pending job. There is no replacement partner or deadline extension. Before changing either route, the service allocates both detour waypoints and rechecks both original claims. Native waypoint installation is not transactional: callbacks may cancel a partly installed pair, and cleanup releases only the exact owned claims and waypoints.
+
+Delivery replaces only each escort's owned travel waypoint with a temporary detour. The original route index is not advanced by reaching that destination. Arrival removes the detour waypoint and holds until the fixed deadline, at most 120 seconds after the original observation. The order does not follow later live target movement. On expiry, the escort rejoins the surviving column; a returning escort cannot take an earlier route index back into the column's leadership. If it is the sole surviving member, it resumes its saved route index. Local combat may cancel the exact detour before taking control.
+
+The code retains original task, receipt, force record, route, group, vehicle, driver, roster and seat ownership. Cleanup removes only its owned detour and exact reservation. It creates no vehicles, crew, ammunition, replacement forces or roadblock props. HQ status and journal entries expose the queued/delivered order and the originating report.
+
+Validation results and limitations are recorded in the linked current-status checkpoint. Source regressions exercise admission, radio interruption, history changes, claim ownership, finite attempts, route preservation, column rejoining and cleanup. Native driving, physical holding and interception effectiveness still require a dedicated gameplay exercise; ordinary escape compilation does not prove them. Multiplayer and comparative FPS also remain unverified. The current sealed depot-mines playtest includes the earlier paired extension but predates BMP singleton interception. The BMP source change passes the 305-program suite; native compilation and driving remain deferred. See [the exact BMP checkpoint](evidence/bmp-interception-2026-10-03/README.md).
+
+## 2 October 2026 — bounded survey fairness and native witness
+
+HQ road surveying now rotates through delivered tracks while retaining the existing two-survey limit. Previously, the first two eligible tracks with blocked road candidates could consume every pass and permanently starve a later usable track. The actual-method regression fails before the change and passes afterward; independent review confirms the bounded cursor and unchanged radio, force-claim and expiry policy.
+
+Resumed verification retains **233 passing programs** against identical frozen input hashes and attempts **1 fresh suffix program**; the current resumed result exits **1** after **234 total recorded programs**. Complete passing verification remains unestablished. The initial deadline-test adapter failure, later `/tmp` quota failure and rejected alternate-directory attempt remain archived. Resumed temporary files use `/tmp`; no production/native source changed for this resumption. The final canonical `/tmp` retry stops in `test_native_package.py` with disk-quota errors (Errno 122); the remaining suffix is unverified. No full-suite pass is claimed. The bounded native run records **33 assertions**, **0 completions**, **2 script/runtime failures** and **15 retained engine errors**; runner result: `test-failed`. It does not establish the complete physical interception sequence; preserve the failed or incomplete result and its raw logs. The canonical convoy admission assertion failed before the interception stage; no physical interception was exercised and no admission policy was weakened. Cleanup confirmed: `True`. Strict engine errors are retained. A separate normal-route run of the same source records **63 assertions**, **1 completion**, **0 script/runtime failures** and **13 retained engine errors**; runner result: `smoke-completed` and cleanup confirmed: `True`. This ordinary route does not validate physical interception.
+
+The opt-in Workbench witness uses two synthetic observation positions in an original soldier’s local inbox. Radio hops, HQ memory/planning, the original escort and physical AI movement remain production paths. It is not natural detection, a human escape, multiplayer, interception effectiveness, FPS or release qualification. No vehicles, crew or stock are created by the new interception stage.
+
+The separate [HQ-memory/menu-fix development package](../.build/playtest-2026-10-02-hq-memory-menu-fix/README.md) is unchanged and predates this survey correction and opt-in witness. Concurrent terrain work and older evidence remain preserved. [Source, regression, native and independent-review evidence](evidence/mounted-native-2026-10-02/review.json).