Integrate delivered HQ memory, finite physical convoy and RHS WCS dependencies

docs/ai-migration-progress.md

@@ -0,0 +1,147 @@
+# AI migration progress — 20 September 2026
+
+The successor now has a persistent HQ belief model, bounded infantry pursuit,
+radio check-ins, missing-patrol investigations, local body discovery and a Core
+force ledger. These extend the existing playable mission and finite mortar/courier
+systems. They do **not** complete the living-island plan, all predecessor AI
+features, or multiplayer/release qualification.
+
+This checkpoint describes the source captured by the native tests at **01:47:53**
+and **01:52:20**, plus the focused regression corrections completed afterward.
+Later convoy or planner changes need their own evidence; the results below do not
+qualify edits made after those snapshots. Existing base-loop and packaged-playtest
+history remains in [current status](current-status.md).
+
+## Implemented in this checkpoint
+
+| Area | Actual behavior and boundary |
+| --- | --- |
+| Core force ledger | [Ledger](../addons/core/Scripts/Game/ERR/ERR_ForceLedger.c) and [simulation](../addons/core/Scripts/Game/ERR/ERR_ForceSimulation.c) retain up to 128 formation identities, initial strength, casualties, duty, home position and authored routes. Six existing site groups register before HQ consumes them; other ready physical enemy groups register through GameMode. Physical snapshots count unconscious members as living. Eliminated/retired identities cannot restore strength through re-registration. |
+| Dormant arithmetic | A pure route simulator advances nonphysical records on a staggered two-second schedule, with 1.4 m/s walking and 11 m/s convoy rules, authored elevation interpolation and bounded whole-lap skipping. It performs no terrain, navigation, player or entity queries. This supplies the arithmetic foundation; production presence arbitration and member materialization are still missing. |
+| Delivered belief | [Memory](../addons/ai/Scripts/Game/ERR/ERR_HQMemory.c) retains up to 64 delivered tracks independently of short-lived fire contacts. Sightings decay with a 600-second confidence half-life and widening uncertainty. Credible successive reports infer motion; extrapolation is capped at 30 seconds/300 metres. Body and distress reports begin weaker and do not infer a moving enemy. Target handles are identity keys, not live-position sources. |
+| Pursuit and objectives | [Pursuit rules](../addons/ai/Scripts/Game/ERR/ERR_HQPursuit.c), [doctrine](../addons/ai/Scripts/Game/ERR/ERR_HQDoctrine.c) and HQ assign existing eligible infantry to intercept, search or contain objectives. Age/confidence restrict precision, travel distance affects task lifetime, and stale/new report revisions control replacement orders. Actual downlink delivery precedes native waypoint changes. Home guards, busy/support units, two approach sectors and finite task lifetimes constrain commitments. Doctrine uses authored objectives and reported headings; it does not claim road-route or player-goal knowledge. |
+| Searched areas | [Coverage](../addons/ai/Scripts/Game/ERR/ERR_HQCoverage.c) records at most 128 visited 500 m cells for 900 seconds, using delivered completed sweeps. Replay/revision guards prevent repeated or outdated negative reports from reducing a newer belief. Fresh positive sightings reopen their cell. Reserved destinations prevent concurrent reuse. A coarse visited cell is not proof every building or hiding place was searched. |
+| Routine status | [Sampler](../addons/ai/Scripts/Game/ERR/ERR_HQStatusSampler.c) retains each formation's initial roster, up to 32 members. Only valid retained corpses with explicit destroyed damage state count as local confirmed deaths; missing references, transferred members and unconsciousness do not. A detached status needs a surviving original owned radio caller. [Watch](../addons/ai/Scripts/Game/ERR/ERR_HQWatch.c) changes HQ's roster only after uplink delivery. |
+| Missing patrols | Routine check-ins are scheduled every 180 seconds. After two missed check-ins, HQ attempts a request and allows 30 seconds for a reply, even if no route exists. One existing eligible patrol may investigate the missing unit's **last delivered** position. Source/status/request identities reject late completions; a fresh check-in resolves the case and cancellation travels through radio. Silence never proves a death or creates an exact enemy target. |
+| Body discovery | [Body observer](../addons/ai/Scripts/Game/ERR/ERR_HQBodyObserver.c) uses a bounded own-force registry, a rotating window of at most 16 corpses, a 15-second per-group scan cadence and a shared trace budget. Physical observers need range/facing and native visibility checks. Discovery becomes low-confidence casualty evidence only through radio, with cause unknown; it cannot authorize precise fire. |
+| Skill and rare anti-air equipment | [Equipment service](../addons/ai/Scripts/Game/ERR/ERR_EnemyEquipment.c) binds an Expert minimum only to eligible registered enemy actors and restores the captured skill on release. Finite startup Stinger selection defaults to one in 15; `/esc hq stinger show\|set N` supports disabling or changing future selections. Pending/late inventory callbacks do not cause replenishment after success, firing, dropping or looting. See the [equipment audit](ai-equipment-migration.md) for owned-source hashes and exact limitations. |
+
+The original owned `SquadLimit` behavior **raises**, rather than shrinks, the
+shared commitment ceiling: `baseline + floor(confirmed losses / 2)`, capped at
+eight; a zero baseline stays disabled. This corrects the contradictory wording
+in the existing [T10 brief](living-island/T10-ai-migration.md), which is preserved.
+Current production additionally limits hunters across all beliefs to three and
+allows only one separate missing-patrol investigation. Thus the eight-squad
+ceiling is not a promise to deploy eight hunters or spawn replacement troops.
+
+## Native evidence and its limits
+
+| Captured run | Observed result | What it establishes |
+| --- | --- | --- |
+| [HQ memory 01:47:53](evidence/native-2026-09-20-014753-hq-memory/report.json) | 56 total assertions, one completed scripted round, zero script/runtime failures; four engine errors retained. | Actual six-site ledger registration and detached elimination; immutable memory snapshots and bounded prediction; a synthetic report blocked by removing the transmitting radio; later real radio delivery reaching production intake once; delivered negative-sweep effects, replay protection and rejection of an old sweep revision. Actual command Stop clears history. The ten-minute advance is a value-clock fixture, not ten real minutes of gameplay. |
+| [HQ response 01:52:20](evidence/native-2026-09-20-015220-hq-response/report.json) | 35 total assertions, one completed scripted round, zero script/runtime failures; the same four engine errors retained. | An arranged sighting produces actual native perception, report, uplink, HQ receipt and downlink lineage. A distinct original infantry group physically moves toward its native Search waypoint with bounded unique orders, without adding or replacing a force. This is not the two-UAZ convoy described in T10. |
+
+Both runners recorded unchanged successor source and six unchanged external addon
+inputs, hidden Gamescope displays, silent/muted test audio, and confirmed owned
+cleanup. Their [memory runner](evidence/native-2026-09-20-014753-hq-memory/runner.json.txt)
+and [response runner](evidence/native-2026-09-20-015220-hq-response/runner.json.txt)
+retain these facts and exact launch manifests.
+
+**Neither run passes the strict native qualifier.** The four retained errors are
+GUID/name mismatches in external string tables: `rhs_localization.st`,
+`wcs_armament_localization.st`, `wcs_spacecore_localization.st` and
+`wcs_bmp1_localization.st`. Smoke completion and zero script failures do not erase
+resource errors or establish a clean build. These external localization errors
+are separate from the earlier packaging shutdown failures.
+
+The journals also show routine status messages reaching HQ and a physical FIM-92
+observed in a weapon slot. The memory run records another selected actor reaching
+its bounded equipment deadline. This is limited runtime observation, not proof
+that every selection succeeds, that skill restoration works in multiplayer, or
+that native AI launches the Stinger correctly.
+
+The fixtures do not prove the complete six-and-a-half-minute missed-check-in
+sequence, ordinary corpse discovery, long pursuit/containment play, twelve real
+clients, remote ownership, full ordinary escape, aircraft operations or FPS gains.
+The current status/body/equipment classes compile in the captured source; their
+additional lifecycle cases are covered by focused regressions rather than those
+native assertions.
+
+## Radio scheduling follow-up
+
+Due routine status and requested check-ins now claim the next free uplink before
+new visual reports. An occupied transmission is never replaced. A regression of
+the actual report methods reproduced the old starvation at five-second sighting
+intervals over a six-second route: no status arrived during ten simulated minutes.
+The revised ordering delivers periodic status while continuing visual reports.
+Search completion also samples the physical group's native visible contacts before
+accumulating its thirty-second dwell, including while another report occupies the
+radio. A quiet combat flag alone cannot produce an area-clear report. These new
+scheduling cases have method-level regression coverage; the earlier native memory
+and response archives predate this follow-up.
+
+## Repository checks
+
+Actual extracted Enforce method bodies are exercised by the force-ledger,
+HQ-memory, pursuit, doctrine, coverage, watch, status-sampler, body-observer,
+equipment and assignment-lifecycle tests. The ledger harness advances 128 records
+for a simulated hour; this is arithmetic regression coverage, not an engine FPS
+benchmark. Intel readiness tests verify late physical binding without duplicate
+HQ units or new Intel rolls.
+
+The repository check list completed in two parts: the successful prefix, the
+corrected packed-archive suite (26 tests), then all 58 remaining suites without
+failure. The archive correction constructs its synthetic historical five-addon
+payload from the frozen packed schema, rather than copying today's externally
+dependent AI project. An added regression confirms external dependencies still
+fail that frozen packed closure. Validation was not weakened.
+
+## Physical convoy follow-up
+
+The [finite convoy controller](convoy-migration.md) now integrates the six-vehicle
+owned convoy composition, nineteen explicit native seat occupants, finite physical
+truck cargo, shared Core admission budget, real-road preparation and canonical HQ
+admin dispatch. A new independently authored memberless group prevents vanilla's
+queued six-soldier allocation from bypassing that budget. Native seated-group
+waypoint completion drives route advancement. The02:50:35 native run completes181
+assertions with exact original identities and actual movement, while retaining the
+four external localization errors. It remains an opt-in first physical slice;
+combat tactics, unloading, automatic scheduling and full-route reliability are
+still pending. The earlier feature inventory counts remain explicitly baseline
+counts, not an assertion that this follow-up was present at that older commit.
+
+## Remaining work
+
+- **T2 presence and a real shared active-agent budget:** materialization,
+  dematerialization, observer exclusions, hysteresis, dwell time and exact loss
+  preservation. Route progress must be reconciled when a moved physical patrol
+  becomes dormant. Current arithmetic alone does not reduce active AI cost.
+- **Occupation and broader activity:** authored checkpoints, conditional guards,
+  smart actions, ambient signals and HQ deployment objectives from T3–T7/O1–O6.
+  Current objective scoring is not a completed occupation state machine.
+- **Ground and air capabilities:** the T10 hunter convoy, road routing/reactive
+  roadblocks, planner-selected reconnaissance flights and operational shared-pool
+  air transport were not present in these native snapshots. Independent aircraft
+  experiments and historical courier/mortar tests are not proof of those features.
+- **Complete loss reconciliation:** another patrol's delivered body discovery
+  currently confirms the body-observer candidate, but does not reconcile the
+  deceased formation's Watch casualty total. An all-dead patrol has no surviving
+  caller; do not manufacture its own status or mark it dead solely from silence.
+- **Further companion behavior:** full road supply convoys, broader ammunition
+  chains, HQ-deployed mortar sites, aircraft servicing/recovery, improvised-prison/crash starts and
+  optional warned mine-laying remain separate migrations or qualification work.
+- **Play and release validation:** adversarial radio interruptions, captures,
+  simultaneous investigations/retasking, long sessions and real multiplayer;
+  equivalent-workload FPS measurements; clean external resources/native packaging;
+  and refreshed packages bound to the final source. The earlier playtest PAKs do
+  not contain this checkpoint merely because their editable source folder exists.
+
+Core remains vanilla-only. The AI project now declares the user-authorized
+RHS/WCS/BMP dependencies recorded in [external policy](external-addons.json), with
+six installed addons in the audited closure; external asset bytes remain outside
+this repository. The earlier vanilla-only full-scenario package and release
+acceptance wording therefore describe an older scope. This document does not
+silently promote or rewrite the [pending acceptance cases](acceptance.json),
+[original responsibility inventory](original-feature-coverage.md), or the
+preexisting living-island design documents. No complete original-feature parity
+or release-completion percentage is claimed.