Fix convoy coordination, AI combat and spectator recovery

docs/aggression-ai.md

@@ -33,12 +33,14 @@ The mission currently has a **medical supply stash**, not a spawned hospital bui
 
 ## Skill, accuracy and perception
 
-Mission-owned hostile military AI use `EAISkill.CYLON` for maximum skill while the native aim-error node uses the `REGULAR` random-error distribution. This avoids CYLON's zero-error shooting. Recognition uses the native alerted factor (2.5) even in safe/suppressed states, preserving equipment factors and the engine's visibility/occlusion checks. This does not create through-wall vision or knowledge of unseen players.
+Mission-owned hostile military AI use `EAISkill.CYLON` for maximum skill while the native aim-error node uses the `REGULAR` random-error distribution with deviations from the mean reduced by 10%. This avoids CYLON's zero-error shooting. Recognition uses the native alerted factor (2.5) even in safe/suppressed states, preserving equipment factors and the engine's visibility/occlusion checks. This does not create through-wall vision or knowledge of unseen players.
 
 The authorized original AI code supplied the scoped skill/equipment and detection-hook approach. The separate aim-error reduction is new: no corresponding independent accuracy hook was found in the inspected original. Native `SCR_AIGetAimErrorOffset` and `SCR_AICombatComponent` implementations were used to separate these behaviours.
 
 Actual enemy-detection events activate local native combat and bring forward the next HQ report; report delivery still obeys radio routing. Primary-enemy units share HQ. Other hostile factions receive the same scoped skill/aim policy but do not leak intelligence to a mutually hostile faction. Specialist scouts and flight crews retain their authored equipment. Captured/ineligible actors are excluded from the profile, and normal teardown restores prior skill and native perception.
 
+See [local awareness and heard fighting](ai-local-awareness.md) for immediate visual snapshots, prioritized reports and uncertain gunfire investigation.
+
 ## Audit trail and adjustment
 
 The complete HQ journal is `$logs:rereintroduced-hq.log` (existing filename retained). Relevant events:

docs/ai-local-awareness.md

@@ -0,0 +1,73 @@
+# Local observations and HQ response
+
+Mission-owned primary-enemy squads now capture visual evidence in the native
+`SCR_AIGroupPerception.AddOrUpdateTarget` callback, before the next one-second HQ
+update. Capture still requires an enemy target seen within 0.5 seconds, a clear
+native trace and positive exposure. The source, last-seen position, observation
+time and visible equipment are copied immediately. Subsequent movement or gear
+changes do not alter that report.
+
+Each squad keeps at most 16 visual snapshots and one sound report, for at most
+30 seconds. Repeated visual capture is limited to once per second per retained
+target. Sending uses the existing observation watermark, so polling cannot resend
+the same observation. This is local squad knowledge; only successful physical
+radio delivery creates HQ memory. A missing radio route leaves the snapshot
+pending until it expires. An accepted transmission is not duplicated if it fails.
+
+Captured contacts can use the next free uplink, with at most one attempt per five
+seconds. They can precede routine status, but status overdue by 15 seconds gets
+the next free slot. Existing transmissions are allowed to finish. The saved
+report interval still controls the ordinary polling path; the new event path
+works even on an existing server profile with a ten-second report interval.
+A delivered report brings forward the next HQ planning pass.
+
+## Heard fighting
+
+The native `AddOrUpdateGunshot` callback supplies hostile-fire evidence. Native
+weapon danger reactions invoke it for audible shots or incoming fire; grenade
+danger can also notify this native group path. The mission does not scan player
+positions or invent a hearing radius. Capture is scoped to bound, server-owned,
+primary-enemy AI groups during the active post-prison mission. Unregistration
+and round teardown detach the hook and discard pending observations.
+
+A sound report carries a 150-metre grid area's centre, its observation time and
+the reporting squad. Shooter identity, player count, equipment and movement are
+not sent. Sound updates are coalesced to one per second and radio reports to one
+per 30 seconds per squad. Visual evidence takes precedence in the local inbox.
+
+Delivered sound has its own memory kind, keyed by reporting squad rather than an
+unseen shooter. Initial confidence is 0.4, halves every 60 seconds, and positional
+uncertainty starts at 150 metres and grows by 2 metres per second. Repeated sounds
+never infer target velocity. A visual sighting creates a separate stronger track.
+
+HQ can allocate one existing mobile search squad per sound task, within the
+current response radius, total assignment limit and hunt cooldown. This uses the
+ordinary radio downlink, search waypoint and negative-search report. Sound alone
+cannot authorize mortar/aircraft targeting, paratrooper targeting or a hunter
+UAZ precision interception. Permanent objective defenders, mortar crews and
+other reserved specialists remain excluded from mobile assignments. Native
+local combat and the existing defensive waypoints remain responsible for their
+immediate defensive movement.
+
+Maximum AI skill, alerted recognition and Regular aim error are unchanged. No
+additional soldiers or vehicles are spawned by this change.
+
+## Validation
+
+`test_hq_local_awareness.py` executes the production cache and contact scheduler
+with engine/radio adapters: frozen evidence, expiry, coalescing, capacity, duplicate
+rejection, route loss/retry, captured-contact priority and bounded status delay.
+The existing memory, radio fairness and local handoff tests cover the new sound
+kind and retained observation age. The dedicated `hq-awareness` native fixture exercises the
+cache, isolated native gunfire callback, sound confidence/targeting restrictions,
+and production cached-contact intake followed by physical radio delivery. Its
+injected observations do not prove natural hearing/visibility or combat tactics
+in a live multiplayer session.
+
+Validation on 2026-09-25: repository checks passed; the dedicated Workbench
+fixture compiled and completed its awareness, physical radio, memory and teardown
+assertions. The launcher encountered a terminating-process classification race
+while verifying cleanup; a subsequent private-prefix idle check passed. Logs and
+source manifests, including earlier failed fixture attempts, are retained under
+`.local/analysis/ai-awareness-2026-09-25/`. The fixture arranges an isolated local
+inbox so concurrent natural contacts cannot replace its injected payload.

docs/airborne-validation-2026-09-27.md

@@ -0,0 +1,40 @@
+# RHS airborne validation — 27 September 2026
+
+The tests use the installed RHS/WCS dependencies, US prisoners and RHS ION enemies in an isolated Workbench game. They do not publish the mod or change RKS 2.
+
+## Physical drop
+
+The first run used the existing controlled-order fixture. Eight original RHS passengers boarded the aircraft, all eight left in two-second intervals, all eight boarded their native parachute compartments, all eight finished their descents alive, and both original four-person groups received the carried HQ search order. The original aircrew remained aboard and post-drop cover became active. The run was deliberately stopped after these checks so the next tests could exercise automatic authorization; it did not qualify the reload cycle.
+
+The archived journal contains exactly eight `AIR DROP JUMP`, eight `PARACHUTE BOARDED`, eight `PARACHUTE FINISHED` and two `AIR TEAM LANDED` events.
+
+## Automatic HQ decision
+
+The upgraded fixture places only the test player in a visible runway-sector encounter and protects that player from damage for the duration of the test. Crew perception, sighting reports, physical radio delivery, HQ memory, airborne policy, corridor selection and passenger transfer remain production behavior. It no longer calls `Begin` with a fabricated drop order.
+
+The first automatic run correctly withheld a drop with `ground forces already committed in sufficient strength`. That is intended policy, not a boarding or parachute failure. This run was stopped after observing the refusal.
+
+For the complementary shortage scenario, the fixture reserves other ground squads using the existing `ReserveGroup` API while waiting for authorization. It does not fabricate sightings, change the airborne policy, bypass artillery safety, or issue a drop command. After authorization, it stops reserving squads so landed teams can receive normal HQ search orders. It also checks cover, return, servicing, another eight seated passengers and the separate airport cargo helicopter. The existing fixture advances the remaining cover timer after confirming cover, avoiding a five-minute idle wait; policy tests check the actual cover deadline independently.
+
+The shortage run exposed a real starvation issue: each artillery veto reset the 45-second confirmation timer. Its first clear window ran from mission time 189.3 to 224.5 seconds (35.2 seconds), too short for confirmation before another mortar order reset it again.
+
+`ERR_AirSupportPolicy.Consider` now validates and retains fresh contact/shortage history while artillery blocks the approach. It still refuses authorization while artillery is busy. Invalid/stale intelligence, a new target, sufficient ground support and the existing cooldown keep their previous checks. The order receiver still revalidates airspace using `Refusal` with its default airspace check enabled. A regression fails on the previous implementation and passes with the correction, including stale-target and cooldown cases.
+
+The corrected-timer run then exposed a second blocker: successive reports from multiple observers could be less than two seconds apart. `ERR_HQMemoryTrack.Evaluate` used only the last two samples, repeatedly discarding a valid stationary-target history as unknown movement. Its bounded history now selects the nearest older sample with the existing two-second minimum separation. It stops at travel-mode changes and never skips an implausible eligible pair to find a convenient older estimate. Existing speed, freshness and prediction bounds are retained. A regression reproduces the previous failure and covers stationary sightings, movement, mode changes, implausible jumps and insufficient history.
+
+The final corrected shortage run completed all seven native assertions:
+
+- HQ automatically authorized the drop from native sightings and delivered radio reports at 20:01:23.
+- All eight original passengers jumped at two-second intervals, boarded their parachutes, and completed descent without damage. Both original squads were released by 20:02:52 and received HQ search assignments for the carried target.
+- Post-drop cover became active with the original aircraft and aircrew retained.
+- The same helicopter returned to the airfield, serviced, boarded another eight passengers and departed at 20:06:46. The separate cargo helicopter was waiting at the airport.
+
+The runner recorded `smoke-completed`, confirmed cleanup and verified that source and external dependencies remained unchanged throughout the run. The journal contains eight jumps, eight parachute boardings, eight completed descents, two landed teams and two completed passenger loads.
+
+The generic native report still exits nonzero for existing dependency/resource errors: RHS/WCS localization GUIDs, prefab keywords and two inherited parachute material remaps referring to nonexistent source material names. The same errors were present in the initial controlled-drop run; there are no new engine errors or script/runtime failures in the final run. These warnings did not prevent boarding, descent or landing, but this headless test does not establish the canopy's visual appearance on multiplayer clients.
+
+## Scope
+
+The repository checks and production airborne-policy tests passed. They cover confidence, persistent sightings, ground-force availability, artillery veto, cooldown, cover and invalid inputs. Native results establish local Workbench behavior; dedicated multiplayer replication and client-side canopy rendering still require a server playthrough.
+
+Evidence: `.local/analysis/parachutes-2026-09-27/`.

docs/convoy-coordination.md

@@ -0,0 +1,50 @@
+# Convoy coordination review — 27 September 2026
+
+## Findings
+
+The latest RKS 2 logs available for this review were from 26 September. That session contains a native `Defend Waypoint not provided to the node!` exception in a supply-convoy escort. The existing local escort correction removes infantry Defend orders from mounted crews; it was not running in that logged game.
+
+The supply controller also had coordination problems independent of that exception:
+
+- Each vehicle independently drove to the same route/base destination at the same cruise speed. There was no spacing controller or leader wait for slower vehicles.
+- Being within 250 metres of a base immediately counted as arrival. A shared ten-minute deadline also marked every remaining vehicle arrived regardless of location.
+- Combat refreshed support and infantry waypoints every thirty seconds even when the contact had not moved, interrupting native manoeuvres.
+- Native move completion and a check against the vehicle origin need different tolerances. The first new-controller test reproduced lead vehicles stopping short of a physical completion check when both used the same radius.
+
+## Current behavior
+
+`ERR_SupplyConvoyColumn` owns ordinary travel. The initial lead vehicle follows the existing road route; each follower targets the preceding surviving vehicle rather than the distant base. Targets remain stable through small position changes. Followers regulate cruise speed, leave a spacing gap, and can catch up. The leader waits when a gap between neighbours exceeds 160 metres and resumes below 90 metres. After combat and at a new base leg, a stable travel order is formed from surviving vehicles’ physical distance to the next destination. This prevents restoring spawn order by sending trucks toward each other; canonical vehicle identities and combat roles remain unchanged. Released vehicles are skipped and leadership preserves route progress. A replacement leader still has to physically reach the endpoint, even if its predecessor had already completed that route.
+
+The leader uses a 15-metre native waypoint radius and a 35-metre physical arrival check. Followers finish in sequence within 75 metres of their predecessor after it arrives. The normal 45–90 second base pause starts only after this physical column arrival. Timeouts do not advance the trip.
+
+The troop truck waits until dismounted infantry are at least 25 metres away before withdrawing. Owned convoy vehicles slow to 8 km/h within 45 metres of their fit dismounted teams; column travel restores the cruising speed after regroup.
+
+Travel pauses during combat and boarding; the original tactical controller retains those orders. Supply transactions retain their own control. Intentionally waiting vehicles do not accrue stuck time. During commanded travel, a missing native usable-vehicle association can be restored for the healthy original seated crew. Stock `SCR_AIRemoveStuckVehicle` removes that association after failed movement; a retained crew needs it to accept driving orders again. Restoration is checked when travel starts and on bounded retries, with an explicit journal event. No five-metre progress triggers a native route retry every 45 seconds; three minutes without progress releases that vehicle from the column and logs its position. Physical vehicles, surviving crew and loot remain; no teleport or replacement spawn is used.
+
+Reboarding tracks occupied seats and the farthest remaining soldier’s distance. Thirty seconds without either kind of progress permits a retry for only that unfinished team, at most three times. The old waypoint is cancelled and its replacement waits until a subsequent tick, allowing native reservations to clear. Seated soldiers are not moved. A five-minute hard deadline retains the finite stranded-team policy; active approaches no longer lose their squad at an unconditional two-minute cutoff.
+
+Unchanged contacts no longer recreate tactical orders. A changed contact can refresh them after the existing thirty-second limit; dismount retries and emergency abandonment retain their separate policies.
+
+The HQ journal now records the selected lead vehicle, spacing waits/resumes, periodic neighbour-gap and supply state, route retries, stranded vehicles and departures.
+
+## Validation
+
+`tests/test_convoy_column.py` executes the production controller against doubles of native entities and waypoints. It covers spacing hysteresis, stable targets, physical arrival, supply-order ownership, route-preserving leader promotion, held-time exclusion, retries and loss. It also exercises the actual unchanged-contact order policy and rejects native-test success based on movement before departure.
+
+`tests/test_supply_convoys.py` verifies that expired travel deadlines and proximity to the old 250-metre base boundary no longer create arrival, and that supply/combat holds prevent departure.
+
+The native fixture starts three production convoys (18 vehicles, 75 soldiers), checks physical cargo and seating, observes all vehicles moving, injects one labelled contact, verifies both infantry teams dismount and reboard, waits for real arrival and the normal pause, and measures truck movement from a new position captured after the next leg starts. The contact is a test input, not proof of native enemy perception. The final fixture parks its observer away from the convoy route and gives that observer a convoy-friendly native perceived faction to prevent unrelated combat from contaminating the injected-contact sequence. The fixture explicitly resets the scenario at completion; it no longer tries to kill a protected prisoner as cleanup.
+
+Native iteration evidence is preserved under `.local/analysis/convoy-coordination-2026-09-27/`. The second run completed convoy movement, dismount, boarding, regroup and physical arrival, but failed obsolete player-death cleanup; its runner result remains `test-failed`. Its old next-leg assertion also counted earlier regroup displacement, so the final fixture requires a fresh post-departure movement sample.
+
+The third run exposed crossed vehicle ordering after combat and also stopped on a native `No suppression volume provided!` exception while unrelated units were reporting the observer near the airfield. Its failed result is preserved; the suppression exception is not claimed fixed by the convoy ordering change. The isolated repeat separates that engine/ambient-combat issue from the controlled convoy sequence.
+
+The fourth run had all 18 vehicles moving and both teams dismounted, but only 13 of 14 passengers had reboarded when the old two-minute deadline released a team. This is preserved as a failed native test and motivated the progress-aware boarding policy.
+
+The fifth run stopped in the test-only seat logger after an infantry actor lost its AI agent during dismounted movement. The diagnostic dereference is now guarded. Vehicles moving near dismounted infantry also motivated the clearance and low-speed protection; the log does not identify a definitive damage instigator.
+
+The sixth run reboarded all 14 passengers and formed a physical travel order, then reproduced a healthy seated troop-truck driver remaining stationary despite three waypoint retries. The three-minute watchdog correctly exposed/released it instead of inventing arrival. The subsequent change adds bounded usable-vehicle restoration and native driver/group-action diagnostics; the old failure itself does not prove which native action discarded or blocked driving.
+
+The seventh run completed the strengthened fixture: all 18 vehicles moved, both infantry teams dismounted, all 14 passengers reboarded, all three convoys departed for another base, and the original troop truck moved twenty metres measured strictly after its next-leg departure. There were no script errors, VM exceptions or stranded-vehicle releases in that run. Native boarding emitted temporary stuck/reset warnings before completing. The runner records `smoke-completed`, unchanged source/external-addon hashes, and confirmed cleanup. All repository checks passed. Generic qualification still exits nonzero for existing external localization/resource and inherited-prefab keyword errors; the raw report is preserved in `r7-completed/qualification.log`. The successful run did not exercise missing-registration restoration, so it does not establish that as the cause of the sixth run’s stall.
+
+Dedicated multiplayer and long-session navigation across all road layouts remain separate validation requirements. Native obstacle/pathfinding failures are recoverable only within the engine's capabilities; the controller now exposes and bounds stationary failures rather than reporting them as arrival.

docs/external-addons.json

@@ -140,6 +140,36 @@
       "guid": "962C400354E4BD6C",
       "addon": "629B2BA37EFFD577",
       "verification": "Installed WCS USSR AA character references this exact prefab; inspected launcher has infrared guidance and a loaded disposable muzzle, 2026-09-23."
+    },
+    "Prefabs/Characters/Factions/BLUFOR/RHS_USAF/RHS_USAF_MARSOC/RandomSoldiers/Character_RHS_USMC_MARSOC_Rifleman_Random.et": {
+      "guid": "844936B168DFAB8E",
+      "addon": "595F2BF2F44836FB",
+      "verification": "Exact path/type/GUID verified in installed owning resourceDatabase.rdb, 2026-09-26. Response roles and medic stock inspected in RHS character/group prefabs."
+    },
+    "Prefabs/Characters/Factions/BLUFOR/RHS_USAF/RHS_USAF_MARSOC/RandomSoldiers/Character_RHS_USMC_MARSOC_Medic_Random.et": {
+      "guid": "DBB8D1F13930220E",
+      "addon": "595F2BF2F44836FB",
+      "verification": "Exact path/type/GUID verified in installed owning resourceDatabase.rdb, 2026-09-26. Response roles and medic stock inspected in RHS character/group prefabs."
+    },
+    "Prefabs/Characters/Factions/OPFOR/RHS_AFRF/MSV/Flora/Character_RHS_RF_MSV_Flora_SL.et": {
+      "guid": "B3C496CCFA72D25E",
+      "addon": "595F2BF2F44836FB",
+      "verification": "Exact path/type/GUID verified in installed owning resourceDatabase.rdb, 2026-09-26. Response roles and medic stock inspected in RHS character/group prefabs."
+    },
+    "Prefabs/Characters/Factions/OPFOR/RHS_AFRF/MSV/Flora/Character_RHS_RF_MSV_Flora_Medic.et": {
+      "guid": "D9AF475A4E5DC52C",
+      "addon": "595F2BF2F44836FB",
+      "verification": "Exact path/type/GUID verified in installed owning resourceDatabase.rdb, 2026-09-26. Response roles and medic stock inspected in RHS character/group prefabs."
+    },
+    "Prefabs/Characters/Factions/INDFOR/RHS_ION_Coy/RandomSoldiers/Character_RHS_ION_Coy_Rifleman_Random.et": {
+      "guid": "140001FC383DF9A2",
+      "addon": "595F2BF2F44836FB",
+      "verification": "Exact path/type/GUID verified in installed owning resourceDatabase.rdb, 2026-09-26. Response roles and medic stock inspected in RHS character/group prefabs."
+    },
+    "Prefabs/Characters/Factions/INDFOR/RHS_ION_Coy/RandomSoldiers/Character_RHS_ION_Coy_Medic_Random.et": {
+      "guid": "0FA8ACE19A772327",
+      "addon": "595F2BF2F44836FB",
+      "verification": "Exact path/type/GUID verified in installed owning resourceDatabase.rdb, 2026-09-26. Response roles and medic stock inspected in RHS character/group prefabs."
     }
   }
 }

docs/field-sites.md

@@ -1,6 +1,6 @@
 # Random field hospitals and camps
 
-Everon now has **three field hospitals and five field camps**. This replaces the old medical stash and eastern outpost and adds six locations. Their positions and headings are chosen again at round start. The prison, radio, four mortars and existing supply/extraction objectives remain separate.
+Everon requests **three field hospitals and five field camps**. This replaces the old medical stash and eastern outpost and adds six locations. Their positions and headings are chosen again at round start. Optional sites with no safe placement are skipped for that round. The prison, radio, four mortars and existing supply/extraction objectives remain separate.
 
 Each field site has four permanent defenders and a separate two-person mobile team, drawn from the selected enemy faction's group roster. Both groups are created once, registered with the force ledger, and receive the existing AI skill, equipment, intel and reporting systems. HQ reserves the defenders against hunting, support, courier and logistics assignments. The mobile team is eligible for delivered HQ hunting orders and otherwise defends its home assembly area. Its standing home waypoint remains available after a temporary HQ assignment ends. Losing mobile soldiers does not turn the permanent guards into replacements. Guards still fight locally and can be killed; the existing objective-defence system permits one finite relief squad after a garrison is lost.
 
@@ -12,7 +12,7 @@ The original medical clue route remains marked after prison escape. The other fi
 
 Edit `addons/core/Configs/ERR/EveronSites.conf`. `GuardCount` selects the permanent roster size (1–8, or zero for the full faction group). `ResponseCount` selects a separate mobile roster (0–8). `GuardOffset` and `ResponseOffset` are rotated with the composition. Do not put a roaming `Patrol` on a permanent garrison; use its separate response team instead. The selected profile must provide usable infantry members.
 
-`RandomClear` supports hospitals, outposts and depots as well as the existing generated objectives. Each new field site is at least 600 metres from other committed locations; unresolved fallback seeds do not reserve ground. The survey checks water, terrain variation, physical obstacles, the composition footprint, and both squad assembly areas. Each site has a bounded 12,000-candidate/30-second search and a validated authored fallback. Invalid terrain is never accepted just to satisfy a requested count; preparation reports the site's ID if placement fails. Custom scenery still needs to fit the surveyed footprint (ten metres either side of its centre).
+`RandomClear` supports hospitals, outposts and depots as well as the existing generated objectives. Each new field site is at least 600 metres from other committed locations; unresolved fallback seeds do not reserve ground. The survey checks water, terrain variation, physical obstacles, the composition footprint, and both squad assembly areas. Each site has a bounded 12,000-candidate/30-second search and a validated authored fallback. Invalid terrain is never accepted just to satisfy a requested count. If both search and fallback fail, a dispensable site is removed before spawning and logged under `[site skipped]`; preparation continues. A site providing indispensable accessible radio intel cannot be skipped. Custom scenery still needs to fit the surveyed footprint (ten metres either side of its centre).
 
 Scenario bounds are 32 sites, 24 initial groups including mobile teams, 512 stock items and 128 scenery props. The default field sites total 32 fixed defenders and 16 mobile soldiers, in addition to other mission forces. These finite limits are not performance measurements.
 

docs/gameplay-review-2026-09-27.md

@@ -0,0 +1,23 @@
+# Corrections from the 26 September RKS 2 game
+
+The source review and downloaded evidence are in `.local/analysis/rks2-game-2026-09-26/analysis.md`. These changes do not publish the Workshop mod or restart RKS 2.
+
+- Helicopters defer crew allocation until native airframe simulation, fuel and accessible compartments have initialized. They allocate the original crew once, assign the selected faction and group before native boarding, and only then start passenger loading. This ordering matters for ION: the native convenience spawn function attempted to board a Soviet pilot before changing its faction. A failed allocation terminates that attempt with the seat name; it cannot create replacement crew on subsequent ticks. The same path serves search and ammunition helicopters.
+- Convoy road selection applies spacing exclusions before choosing its best candidate, so a nearby occupied deployment area cannot hide other valid formations. Failed bounded placement still retains existing convoys and reports the actual deployed/requested counts; it never forces an unsafe spawn or replaces a lost convoy.
+- Mounted convoy escorts move to cover and retain native vehicle combat. They no longer receive infantry Defend waypoints, eliminating that convoy path into the missing-Defend-waypoint exception during regroup.
+- Mission-owned hunter and mortar boarding tasks only receive completion callbacks while still present in their actor's native utility and while `m_AIInfo` exists. Teardown/dead-actor references cannot invoke the native null-pointer completion callback.
+- Hunters preserve their existing route for fresh reports within 75 m of the area actually delivered to them. A materially changed contact still causes an HQ radio order. Delivered road destinations within 50 m of the current waypoint also preserve navigation. Pending or failed radio packets never advance the delivered-area anchor. The original finite vehicle-radio fix remains required.
+- Stale native perception entries no longer suspend stuck-vehicle recovery. The same recent-contact predicate controls both combat priority and the movement watchdog. Actual fresh combat retains priority.
+- Mortar HQ selection predicts the reported impact area and checks settlement/friendly exclusions before issuing an order. Rejected native aim/fire attempts receive a 60-second cooldown. Exact ballistic and per-shot authorization remain in place, including the eight-round salvo and finite ammunition; these changes do not allow firing through friendly forces or settlements.
+- While prisoners are unconscious, medical diagnostics log blood, resilience, bleeding, observed improvement, treatment and natural recovery at most every ten seconds. Defeat additionally records the current per-prisoner snapshot at the decision. Medical damage/recovery rules are unchanged.
+
+Regression tests execute route retention, stale-contact retry, safe callback cleanup and mortar preflight/cooldown behavior. The complete repository check suite passed. Native compilation passed with the installed RHS/WCS dependencies.
+
+Native Workbench evidence is archived under `.local/analysis/gameplay-fixes-2026-09-27/`:
+
+- The vanilla-enemy fixture completed launch, native player sighting and radio delivery, return/landing, destruction delay, replacement and faction takeover before the final faction-before-boarding correction.
+- The RHS ION fixture first reproduced the pilot boarding failure. With the correction, all four original flight crew and eight passengers boarded; the helicopter took off and flew its search route. A second ammunition helicopter also seated its crew.
+- The final RHS ION fixture did **not** complete: at 18:24:51 it reported `pilot or airframe lost`. The engine also reported an extreme particle-parent velocity and coordinates during the helicopter explosion. That run did not identify the cause. A subsequent close-contact reproduction isolated repeated outward acceleration in `StandOff`; the correction and successful extended RHS flight/return regression are documented in [helicopter-standoff.md](helicopter-standoff.md). The earlier failed run is retained as evidence.
+- The runner could not certify cleanup while an exiting `enfMain` process had empty arguments. A subsequent independent `assert_prefix_idle` check passed; the disposable prefix is idle.
+
+Long-session UAZ navigation, convoy combat/placement and mortar eligibility still need a dedicated multiplayer playthrough. Unit/behavior tests and Workbench compilation do not certify those live behaviors. These edits remain local and have not been published or applied to RKS 2.

docs/generated-sites.md

@@ -1,13 +1,15 @@
 # Generated starts and radio camps
 
-Everon now chooses a new prison, radio camp and four mortar sites at preparation time. Other caches,
-outposts retain their authored positions. The extraction helicopter uses the validated
+Everon chooses a new prison, radio camp, four mortar sites and optional field
+hospitals/camps at preparation time. The supply cache retains its authored position.
+The extraction helicopter uses the validated
 Everon airfield pad (4800.953 / 11487.412), with no off-airfield fallback. The server
 resolves the prison first, then the radio, before creating any site entities.
 Joining clients receive the real replicated locations; intel keeps the same
 stable destination IDs.
 
-Site authors can use `RandomClear 1` on a prison, radio or mortar definition. `Heading`
+Site authors can use `RandomClear 1` on a prison, radio, mortar, hospital, outpost
+or depot definition. `Heading`
 sets the authored fallback heading; `RootHeight` offsets a composition above its
 surveyed ground (the radio/table composition uses 0.8 m). Runtime placement never
 rewrites the configuration file. Existing definitions default to authored sites.
@@ -17,11 +19,17 @@ terrain varying by more than 0.6 m, nearby roads (12 m), and unsafe guard footin
 Prisons avoid physical runway/control-tower anchors by 1,500 m. The radio stays
 at least 1 km from the prison and 300 m from other sites. The extraction pickup
 must remain inside the prison-relative escape boundary with 100 m clearance.
-Sampling yields after an 8 ms work budget, with a 30-second overall deadline and
+Sampling yields after an 8 ms work budget, with a 30-second deadline and
 12,000 candidate limit per site. The budget is checked between native terrain
 queries, so a single engine query can exceed it. Authored fallback positions
-must pass the same checks; otherwise preparation reports failure instead of
-spawning an incomplete camp or waiting forever.
+must pass the same checks. If both search and fallback fail, an optional outpost,
+hospital or depot is omitted for that round and preparation continues. The
+`[site skipped]` log identifies its label, ID and attempt count. Removal happens
+before spawning, map registration or AI intel assignment, leaving no empty site.
+Every following site gets a fresh search budget. Required prison/radio/extraction
+and mortar sites remain mandatory. An otherwise optional site also remains
+mandatory if removing it would invalidate the scenario, for example by losing
+the minimum accessible radio-intel sources. No unsafe placement is accepted.
 
 The existing prison composition, gate, backpack and guards move together.
 Player slots and escape-boundary tests use the same rotation. Admission still
@@ -63,6 +71,22 @@ definitions. Other Workbench smoke outcomes explicitly load
 fixtures, including the retired western cache and old extraction position.
 Ordinary Workbench play and dedicated servers use the live definitions.
 
+`--project core --smoke optional-site-skip` uses current randomized definitions,
+forces camp 5 to fail both random and authored terrain checks, and verifies that
+the camp has no runtime, required objectives/mortars remain and a player is
+admitted. The failure injection exists only in the opt-in Workbench fixture.
+
+On 2026-09-26, this fixture compiled and completed after camp 5 exhausted 12,000
+candidates and failed its fallback. The camp was omitted and player admission
+succeeded with prison, radio, extraction and all four mortars retained. The full
+repository check passed. The runner reported a terminating-process classification
+race at shutdown; independent follow-up confirmed the private prefix idle and
+the addon source manifest unchanged. External inputs were unchanged. Existing
+loaded asset errors remain; the completed scenario had no script/runtime failures. Evidence,
+including the earlier test-selector compile failure, is retained under
+`.local/analysis/optional-site-skip-2026-09-26/`. This validates local startup,
+not a published or dedicated-server update.
+
 On 2026-09-22, the full `python3 tools/check.py` suite passed. The final native
 `generated-sites` fixture passed 39 assertions at a randomized Everon start:
 prison at approximately (5100, 9137), heading 89 degrees; radio at (5991, 5659).

docs/helicopter-standoff.md

@@ -0,0 +1,16 @@
+# Helicopter close-contact speed correction — 27 September 2026
+
+`ERR_ReconFlightRules.StandOff` receives the persistent, smoothed flight velocity. Inside 180 metres of an observed player, it previously added the full outward correction on every simulation frame. Even a helicopter already moving away at the requested speed received another impulse. This made acceleration depend on frame rate and could send the native airframe physics into extreme velocities.
+
+The correction restores the original mission policy: calculate the existing radial speed, calculate the required minimum outward speed, and add only the positive difference. Tangential motion and already sufficient outward motion are preserved. The 180-metre radius and 25 m/s maximum outward correction target are unchanged. No health, damage, player takeover, replacement timing or airframe position is overridden by this fix.
+
+## Reproduction and validation
+
+- A regression executing the production function fails before the correction: 600 repeated evaluations keep accelerating an already safe outward velocity. The corrected function passes repeated-call and 30/60/120 Hz cases, alongside the existing orbit, return and loss-timer tests.
+- Ordinary native RHS ION flight telemetry stayed below 40 m/s, with angular velocity below 0.056 rad/s; that diagnostic was deliberately stopped after entering landing. It was not a completed qualification run.
+- The extended native Workbench fixture first requires real crew perception and radio delivery to HQ. It then relocates only the test player 100 metres ahead of the aircraft to exercise a sudden close sighting. Aircraft movement, perception, radio, crew and damage remain production behavior.
+- With the unfixed controller, that encounter failed at 19:19:46 with commanded speed **573.703 m/s** and measured speed **45,378.7 m/s**. This reproduced the flight instability without changing flight physics in the test.
+- With the correction, the **same native close-contact fixture completed** at 19:27:49: actual close sighting, 60 seconds of bounded flight with the original living pilot, return/landing with the same intact aircraft and crew, retained parked aircraft, intentional destruction/replacement delay, replacement and faction takeover. Intact-flight telemetry peaked at 41.094 m/s.
+- All repository checks passed. Native compilation and scripted flight assertions passed, and the runner confirmed cleanup and unchanged source/external inputs. The final generic native-error report returned nonzero for existing RHS/WCS localization and prefab keyword errors also present in the unfixed run; there were no new engine-error signatures. This is a successful flight regression, not a claim of an error-free dependency installation.
+
+Evidence is retained in `.local/analysis/helicopter-standoff-2026-09-27/`. The native fixture is Workbench-only; these results do not substitute for a dedicated multiplayer playthrough. Nothing has been published or restarted on RKS 2.

docs/infantry-combat-priority.md

@@ -0,0 +1,55 @@
+# Infantry contact and search orders
+
+HQ-controlled enemy infantry now suspend their current HQ mobile search when
+native group perception has a detected/identified target updated within 15
+seconds. This is evaluated on the existing one-second server tick, before radio
+downlink delivery. Local reactions do not wait for a report to reach HQ.
+At the transition, the group and its combat-capable agents are activated without
+changing their permanent simulation LOD; casualties are not awakened.
+
+The mission removes only its own search waypoint from the native queue, retaining
+the assignment and waypoint identity. Native waypoint deselection cancels that
+search activity's child investigation orders. The searching squad is set to fire
+at will, and pending infantry task orders are discarded. Status/check-in and
+vehicle transports remain independent. Individual native combat, visibility,
+cover, suppression, ammunition and aiming still determine whether soldiers fire.
+
+After qualifying contacts stop, a 15-second grace period prevents immediate
+retasking. The same search is reinserted once only if its assignment is still
+current, unexpired and eligible. Released/replaced/expired orders cannot return.
+Old, destroyed or disarmed target records no longer block HQ indefinitely.
+
+Defensive site and road-interception waypoints stay in place. Baseline home patrol
+routes and other owners' waypoints are not removed. Permanent objective guards,
+specialists, logistics reservations, vehicle crews and player-controlled groups
+retain their existing ownership/eligibility restrictions. No extra AI are spawned.
+
+Journal events under `INFANTRY COMBAT` identify the squad and spawn source, contact,
+search pause, search resumption or completion without a surviving search. This is
+an order-conflict safeguard, not proof that every reported hesitation was caused
+by HQ. Native attacks already have a higher default priority than investigation;
+visibility, suppression, weapon state and other native behavior need a live
+playtest if soldiers still fail to fire.
+
+`test_infantry_combat.py` executes the actual state machine with native waypoint
+adapters, including renewal, quiet delay, expiry, replacement, defensive orders,
+and ownership changes. The focused `infantry-combat` Workbench fixture exercises
+the actual mobile outpost responders' search and home-defence queue with an
+explicitly injected contact. It does not certify natural target acquisition or
+multiplayer shooting behavior.
+
+The older `patrol-hq` scenario's traversal stage runs before unlocking the prison;
+its stationary enemies are consistent with the intentional prison AI hold. Its
+old search helper also selected permanent objective defenders, which correctly
+reject mobile HQ assignments. The shared queue probe now selects the separate
+mobile responder roster. The focused scenario leaves the prison hold in place
+and tests queue ownership only; it does not claim physical patrol traversal.
+
+Validation on 25 September 2026: the full repository check passed. Targeted checks
+after the wake-up and fixture updates also passed. Native run 5 compiled and
+completed 15 assertions for the actual mobile squad's search pause/resume and
+home-defence queue. Source/external inputs were unchanged and cleanup confirmed.
+Loaded localization/world/controller asset errors still make the strict runner
+exit nonzero; no script/runtime failure was reported in that completed run.
+Logs, source manifests and earlier failed fixture setups are retained in
+`.local/analysis/infantry-combat-2026-09-25/`.

docs/mortar-rapid-fire.md

@@ -0,0 +1,21 @@
+# Rapid mortar barrage — 27 September 2026
+
+An authorized HQ fire mission retains eight HE rounds distributed over an 80-metre radius. Mission-owned AI mortar crews use a dedicated behavior tree with the two fixed 1.5-second firing-loop delays removed. The native loading animation, physical projectile event, ammunition transfer, per-round ballistic solve and spread still determine the real firing rate. The 0.75-second settling pause after leaving the aiming seat is retained.
+
+The tree is derived from the installed Arma Reforger 1.8.0.13 `AI/BehaviorTrees/Chimera/Soldier/StaticArtilleryBehavior.bt`. Only its resource identity and the two delay values differ. It is selected only for a mortar registered with the mission mortar service; unrelated artillery keeps its stock tree. Player firing actions are unchanged.
+
+The existing shooting-cycle gate waits for an actual projectile before advancing the native shot counter. Removing a fixed delay does not replace that event, create ammunition, skip the loading animation, or manufacture explosions. The final transfer still checks the delivered report, current ballistic aim, friendly exclusions, mission state and eight-round limit. Orders retain their finite ammunition, report freshness, cooldown and helicopter airspace coordination.
+
+The old salvo fixture now unlocks the prison through the normal mission API before waiting for crew readiness. Previously it stayed in the prison phase while HQ was paused. The fixture moves its player to the distant airfield after unlocking, keeping the participant away from the crew while testing the synthetic range target. It also stops automatic UAZ responders before unlocking: the first live rapid-fire trial correctly withheld fire when those vehicles pursued its synthetic report into the impact area. This arrangement is restricted to the opt-in Workbench fixture; production friendly-fire checks are unchanged.
+
+The unchanged single-report baseline fired once and then correctly expired its target report. The first unobstructed rapid-fire run fired seven actual rounds, then correctly withheld the eighth because the older refresh fixture stopped generating sightings halfway through a salvo. That fixture now continues observations until six rounds have fired, leaving two rounds for the final downlink to arrive; its existing 90-second update bound remains. Freshness and the production order deadline are not relaxed. The fixture also waits within its existing deadline when normal crew/status traffic occupies the radio: a zero queue result creates no observation and no longer fails the test immediately.
+
+A further run refused a radio update because the original native aim owner was no longer available, amid nearby combat involving the released test player. The test player is now placed away from the battery; the production rejection remains intact.
+
+The unobstructed eight-round run exposed a completion race after the fixed waits were removed: the native eighth-shot callback completed the activity, but the zero-delay repeater began a ninth aim before HQ observed the completion event. Its normal eight-round guard then marked the already-completed barrage rejected. The shooting-cycle node now returns RUNNING after superclass processing of the last confirmed shot, waiting for normal HQ cleanup. Repeated ticks cannot increment the native counter again. An executable regression covers eight physical events, pending supply, exactly one completion, no ninth aiming request and unchanged unrelated artillery behavior.
+
+Final native run passed all 57 assertions with eight distinct physical projectiles and eight matching commits. The original stock decreased from 27 to 19 shells; the native activity completed naturally and the 25-second replay watch observed no extra projectile or replenishment. Launch intervals measured from mission journal time were 5.1, 4.9, 4.9, 5.9, 6.0, 6.0, 6.1 seconds (5.557 seconds on average; 38.9 seconds from first to eighth launch). This is one isolated firing-range result, not a guaranteed cadence under combat or server load. Initial order delivery and barrel setup occur before the first shot.
+
+The runner recorded `smoke-completed`, source/dependency hashes unchanged, and cleanup confirmed. The generic report still returns nonzero for the same 13 installed dependency/prefab errors seen in the stock baseline; it reports no script/runtime failures or new engine errors. All repository checks passed, including the executable last-shot regression. Removing just the completion wait makes that regression fail.
+
+These results qualify local native Workbench launch behavior and ammunition accounting. Multiplayer replication, actual impact positions and damage are not measured by this fixture. Evidence: `.local/analysis/mortar-cadence-2026-09-27/`.

docs/recovery.md

@@ -1,40 +1,54 @@
-# Revivable players and all-unconscious mission failure
+# Player injuries and team failure
 
-Admitted player bodies receive server-owned casualty protection. Ordinary damage
-still causes wounds and bleeding. Damage to physical, overall-health and blood
-hitzones is limited above their configured destruction threshold; an otherwise
-lethal hit knocks the prisoner unconscious. Resilience can still reach zero, and
-healing damage is passed through unchanged. Further hits and bleeding cannot
-finish the casualty. AI retain their normal damage rules. Protection stays with
-the original body across reconnects and does not grant a new life or respawn.
+Admitted players keep the same living, treatable body. Otherwise lethal damage
+is capped just above hit-zone destruction and causes unconsciousness. Continued
+bleeding still drains blood down to the protected minimum; protection never adds
+health or blood. AI retain native lethal damage and recovery rules.
 
-The round fails after **30 uninterrupted seconds** with every remaining prisoner
-unconscious, no conscious reserved prisoner available to reconnect, and no
-ongoing treatment or observed blood/resilience recovery. Waking up, a treatment
-in progress, or increasing blood/resilience resets that timer. A passive recovery
-effect that is present but makes no progress does not prevent failure. An empty
-server does not start this timer. Mission status explains whether recovery is
-continuing or the team is in the failure grace period.
+Passive blood, wound and resilience recovery use one quarter of their native
+rates. Bleeding prevents passive blood and consciousness recovery. Bandaging
+stops the bleeding and lets blood improve gradually. With sufficient blood,
+resilience recovers slowly and the player can eventually wake without an injector.
+This is not an instant or periodic full heal. Saline restores blood through its
+finite native infusion; epinephrine improves resilience over 30 seconds without
+replacing blood or treating wounds. Medicine is not slowed by the passive-rate
+setting. Duplicate epinephrine dosing is refused while its effect is active.
 
-Treatment uses the existing medical system. Bandaging and saline remain relevant;
-ACE Medical epinephrine heals resilience and is not blocked by casualty protection.
-ACE's own treatment prerequisites still apply (including stopping bleeding and
-restoring sufficient health). Installing this mission does not itself install
-ACE Medical or add an unlimited epinephrine action.
+The round fails with **“Everybody died.”** after 30 uninterrupted seconds when
+all remaining prisoners are unconscious, no conscious reserved prisoner can
+reconnect to help, and nobody has treatment, observed recovery, or viable native
+passive recovery. A bandaged casualty with a blood/resilience regeneration effect
+also counts during the engine's initial regeneration delay. Full hit zones,
+zero-rate effects, insufficient blood for resilience, and bleeding do not falsely
+count as self-recovery. Waking, viable recovery, or treatment resets the timer.
+An empty server does not start it. Existing all-dead/missing-body and exhausted
+admission handling remains active.
 
-`/esc mission abandon` remains an administrator-only way to end a round explicitly.
-The all-dead/missing-body fallback and exhausted-admission handling also remain,
-for deleted bodies and administrative/native paths outside ordinary damage.
+The `recovery` fixture exercises the real team-failure timer and treatment on an
+admitted prisoner. `medical-combat` checks an actual hunter medic's inventory,
+bleeding, consumed bandages, slow blood recovery without saline, natural waking,
+finite saline/epinephrine and protected fatal blood loss. Fixtures inject initial
+injuries and enter at native item-effect completion; they do not certify manual
+interactions or remote multiplayer play. ACE medical overrides require separate
+compatibility testing. The 25 September lethal-death result is historical and
+has been superseded by the restored revivable-player policy.
 
-The isolated `recovery` Workbench fixture exercises damage exceeding full health
-on health, blood and head hitzones, continued survival while treatment is flagged
-active, restoration by native resilience healing, and the actual all-unconscious
-failure timer. This is separate from remote-client/manual treatment acceptance.
+## Local validation, 26 September 2026
 
-Validation on 2026-09-23: all repository checks passed after updating the existing
-ServerTick test adapters. The isolated `recovery` run at
-`/tmp/erri-revivable-native2/logs/logs_2026-09-23_20-02-04` completed 66 assertions
-with no script/runtime failures, unchanged source and verified cleanup. Existing
-RHS/WCS resource and inherited prefab-keyword errors remain in that engine log.
-The recovery effect was a native timed resilience-healing effect; an actual ACE
-injector action and remote multiplayer treatment were not exercised by this run.
+Repository checks passed. The updated `medical-combat` engine fixture completed
+32 assertions, including the actual SF UAZ medic's backpack and six injectors,
+native bleeding, bandaging, blood recovery without saline, natural waking after
+blood replacement, finite epinephrine, and a living unconscious body after fatal
+blood damage. No script compilation or medical assertion failed in the final run.
+The strict runner reported a transient process-cleanup classification failure;
+a subsequent independent check confirmed the private prefix idle and unchanged
+source hashes. Original reports and the unsuccessful diagnostic run are retained
+under `.local/analysis/revivable-medical-2026-09-26/`. Loaded external/base assets
+still emit their existing warnings; this does not certify remote multiplayer.
+
+The subsequent `recovery` engine run verified natural recovery and active
+medical treatment each keeping the full mission alive beyond 30 seconds,
+waking the same admitted prisoner, resetting the failure timer, and automatic
+team defeat after 30 seconds of unrecoverable unconsciousness. Source remained
+unchanged and cleanup was confirmed. The strict asset-error scan still reports
+existing inherited resource errors; all recovery assertions passed.

docs/response-medics-combat.md

@@ -0,0 +1,93 @@
+# Response-team medicine and combat priority
+
+RKS 2 session `1790341620-1` (25 September 2026), journal part 1, confirms the old
+casualty floor repeatedly prevented lethal injury. Events 23102–23118 also show
+UAZ 6 switching to a routine road patrol while its combat flag was active; events
+23162–23371 show subsequent travel with that flag still set. These establish an
+order conflict, not the exact reason for every individual failure to fire.
+The read-only SSH excerpt is retained in
+`.local/analysis/medical-combat-2026-09-25/rks2-journal-excerpt.log`.
+
+Hunter UAZs now fill accessible driver, turret and cargo seats (bounded at 12),
+with exactly one cargo medic. US uses Green Berets and USSR uses Spetsnaz native
+presets. Modded factions first use optional `ResponseSoldier` and `ResponseMedic`
+resources in `Configs/ERR/Content/Registry.conf`, then their enabled character
+catalog. The registry supplies RHS ION, AFRF and MARSOC profiles because installed
+RHS character catalogs can be empty despite the characters being available.
+Catalog fallback prefers SF/recon presets and a medic; the ordinary soldier
+fallback comes from the selected faction's group. No wrong-faction medic is
+substituted. Missing crew resources defer deployment for 30 seconds before any
+vehicle/body is created or allowance consumed. Genuine partial physical spawn
+failures still consume their allowance to prevent duplicate forces. Native medic presets retain their authored medical bag, saline, bandages,
+tourniquets and morphine. Admission waits for every original occupant to be
+seated. The crew's native combat mode is explicitly fire at will.
+
+Each physical soldier receives a finite startup allowance: two epinephrine and
+at least two morphine for SF/hunter troops; six of each for medics. Twenty-five
+percent of ordinary hostile soldiers receive one of each. Existing stock counts
+toward the allowance. Medic additions target the existing backpack when present, with overflow into free
+personal pouches only after the bag refuses insertion. Medics do not receive the
+optional mine/anti-air grants that could consume their treatment storage.
+Insertion failures and completion are logged; completed, pending or looted grants
+are never periodically replenished. This does not create AI healers for every
+ordinary squad; native medic roles are guaranteed specifically in hunter UAZs.
+
+A native detected/identified contact no older than 15 seconds suspends that
+hunter's travel waypoint and pending travel radio order. Driver recovery cancels
+its own high-priority boarding action while combat is active. Existing native
+combat behavior remains free to fight/dismount. After contacts stop qualifying,
+a further 15 quiet seconds permits HQ travel and driver recovery again. Lost,
+destroyed, disarmed and old remembered targets cannot hold the patrol forever.
+The existing permanent objective-defender exclusions remain unchanged.
+
+Full crews increase the number of physical AI per hunter vehicle. The existing
+three initial UAZs and maximum fifteen vehicle allowance remain unchanged.
+
+Historical validation on 25 September 2026 (the lethal-player medical policy
+has since been superseded; see [recovery.md](recovery.md)): the `medical-combat` Workbench run completed
+31 assertions, including the actual three-seat native UAZ crew and medic stock,
+bleeding/bandaging, timed saline, finite epinephrine and lethal blood loss.
+Source stayed unchanged during the run and private-prefix cleanup was confirmed.
+The strict runner still returned failure for loaded asset errors (localization
+references and inherited world/controller properties); there were no script or
+runtime failures. Repository medical/equipment/hunter checks passed. This is
+local scripted integration evidence, not manual or multiplayer combat acceptance.
+Logs, manifests and failed earlier attempts are retained under
+`.local/analysis/medical-combat-2026-09-25/`.
+
+## RKS 2 vehicle deployment failure, 26 September 2026
+
+The 14:08 UTC server log contained two rounds. In both, all three opening
+UAZ attempts failed with “selected faction has no usable soldier/medic profile”;
+the second round also lost the fourth allowance the same way. Enemy faction was
+RHS ION. The same journal contains delivered sightings and infantry search orders,
+so HQ was operating; no hunter crew reached deployment. The installed ION
+character catalog is empty, although RHS supplies stocked ION medic prefabs.
+The downloaded journal is retained in `.local/analysis/rks2-hunters-2026-09-26/`.
+
+Response profile overrides resolve this without changing faction identity.
+The `hunter-faction` Workbench fixture explicitly selects ION, unlocks the actual
+prison gate, checks the seated crew/medic stock, supplies a sighting at HQ's
+already-delivered intake boundary, and requires a radio-delivered hunter order
+and more than 30 metres of native vehicle movement. It does not certify a live
+multiplayer attack, visual detection, or combat accuracy percentages.
+
+The ION native regression exposed a second issue: the crew's modded loadouts
+refused the required personal manpack. Each hunter UAZ now receives exactly one
+physical R-107M in vehicle cargo before admission. Its original seated crew can
+use that manpack as their HQ link; looting, capture, vehicle destruction,
+dismounting or mission teardown removes the vehicle link. No medic backpack is
+replaced and no lost radio is replenished. Personal radios retain their existing
+rules. Radio-fitting and HQ routing both recognize the physical vehicle radio.
+
+Final native validation: all three ION crews admitted with their vehicle radio;
+the medic had at least four saline/bandages, six morphine and six epinephrine.
+All three UAZs received a contact order through the production radio route;
+the fixture confirmed native driving beyond 30 metres. Source hashes were
+unchanged during the run and cleanup was confirmed. All fixture assertions
+passed; the strict runner's asset scan still reports existing inherited asset
+errors. Earlier failed/stalled runs are preserved beside the successful run.
+
+The final complete repository check suite and the targeted vehicle-radio/aim
+policy regressions also passed after the radio changes. No server restart,
+Workshop publication or Git push was performed.

docs/spectator-guidance.md

@@ -1,9 +1,17 @@
-# Spectator reason and controls
+# Spectator controls and recovery
 
-The local observer hint now explains the replicated reason for spectating: the player has used their round's life, joined after extraction began, or could not be spawned. It tells a spectator with a selected survivor about the existing `/esc spectate next` and `/esc spectate previous` commands. Those commands already use the ordinary nonadministrator path; the change does not grant administration, change spawn/identity policy or alter camera control.
+While spectating, **Left / Right arrow** selects the previous/next eligible teammate. **Enter** (including numpad Enter) toggles between the orbit camera and a player view at the teammate's head, looking along their replicated head-aim direction. Orbit retains mouse-look and zoom. Player view follows posture and vehicle seating; it does not possess the teammate, reproduce their private HUD/ADS camera, or move the unconscious body. With no available/streamed target the camera falls back to the observer anchor. `/esc spectate next|previous` remains available without administrator permission.
 
-When the server has selected no survivor, the hint says that nobody is currently available to follow and that the view will follow a survivor when one becomes available. It omits ineffective cycling advice in that state. Availability is read from the replicated selected entity ID, not from whether that entity has finished streaming to this client, so streaming delay is not mistaken for an empty survivor set.
+The camera activates `ERR_ObserverContext`, inherited from vanilla's manual-camera context. Dedicated input actions bind the arrows and Enter; normal gameplay input remains inherited from `chimeraInputCommon.conf`. Held keys trigger once; opposing arrows cancel. Camera input is disabled while ordinary menus/dialogs are open. These controls replace raw `Debug.KeyState` polling; the old bit-15 mask is documented by the engine, so inspection alone does not establish it as the cause of the reported missed arrows.
 
-The existing 250 ms observer monitor refreshes the twelve-second hint on first display, a reason change or a change between having/no selected survivor. Stable state does not repeat hints, and switching between two available survivors does not produce another hint. Closing the camera clears the shown flag. If the native hint manager is temporarily absent, the monitor retries without consuming the first display. There are no new timers, input bindings, RPCs, permission checks or server mutations.
+The 250 ms local monitor records an unconscious controlled body independently of whichever camera is active. When that same body becomes conscious, it asks the native editor manager (Game Master/ArmaVision) to close and explicitly selects the controller's player camera. This also handles a separate manual camera taking over from the mission's observer camera. Asynchronous editor closure or unavailable player cameras are retried for up to ten seconds; refusal is logged rather than permanently forcing the camera. Once returned, conscious admins can open their cameras normally. Round end, body loss, or changed possession cancels the pending handoff. No remote player is possessed and no administrative privileges change.
 
-`tests/test_spectator_guidance.py` executes the actual message and refresh methods for every current reason, a fallback reason, both availability states and all prior/current refresh combinations. It also checks the existing monitoring/command boundaries: no extra timer, state recorded only after a hint exists, close/reopen reset, cycling handled before the admin transport and unchanged admin rejection. These are source-local policy and integration-contract checks. Native compilation, real hint rendering, actual chat input and remote target streaming still require their own tests.
+The spectator hint explains why the player is observing and how to switch targets/views. Availability uses the replicated selected entity ID, not local streaming completion. The hint refreshes on first display, a reason change, or having/no selected survivor; stable state does not repeatedly show it. Missing/refusing hint managers retain the retry.
+
+## Verification
+
+`test_unconscious_controls.py`, `test_spectator_recovery.py`, `test_spectator_guidance.py`, `test_hint_delivery.py`, and `test_participant_selection.py` exercise production input dispatch, held/opposing/menu keys, Enter toggling, camera/editor recovery retries and cancellation, guidance, and canonical server selection. Native APIs and remote clients are doubled in these tests.
+
+`ERR_UnconsciousCameraProbe` tests native incapacitation, unchanged possession, physical camera tracking, loaded input actions including inherited orbit input, toggling to/from head view, a different manual camera taking over before healing, return to the normal camera, and repeated knockout. It uses a physical stand-in for another player and programmatic input-handler calls; it does not prove physical keyboard delivery or dedicated multiplayer target streaming. Native run results are recorded separately under `.local/analysis/spectator-2026-09-27/`.
+
+On 27 September, the isolated native fixture completed 25 assertions without script errors or VM exceptions. It verified both camera views, the loaded controls, a separate manual camera takeover, restoration after healing, and repeated knockout. The runner subsequently hit a transient cleanup-classification failure; separate follow-up confirmed the private runtime idle and authored sources unchanged. Existing external resource errors remain. Raw results and failed diagnostic iterations are preserved in the evidence directory above. Physical keyboard delivery, remote client cycling, and native Game Master/ArmaVision menu closure remain manual multiplayer checks.

docs/supply-convoys.md

@@ -1,6 +1,6 @@
 # Supply convoys
 
-The production HQ now uses `ERR_SupplyConvoySystem`, `ERR_SupplyConvoyService` and `ERR_SupplyConvoyTactics`, adapting the owned original `EAI_SupplyConvoys.c` to the combined mod's native AI and force ledger.
+The production HQ now uses `ERR_SupplyConvoySystem`, `ERR_SupplyConvoyService`, `ERR_SupplyConvoyColumn` and `ERR_SupplyConvoyTactics`, adapting the owned original `EAI_SupplyConvoys.c` to the combined mod's native AI and force ledger.
 
 ## Configuration
 
@@ -20,15 +20,15 @@ The ammo truck receives eight random weapons from the convoy faction's native ar
 
 After prison escape and existing force admission, automatic deployment begins after a 30-second grace period. Every five seconds it tests up to eight road formations, for at most 120 startup passes. It uses friendly military outpost, depot and radio-site road approaches within 500 metres, deduplicated at 300 metres. Starting formations are separated by up to one kilometre and retain all existing road, terrain and obstruction checks.
 
-The initial road route feeds an ongoing circuit between different friendly bases. Arrival accepts surviving vehicles within 250 metres; a ten-minute travel deadline advances a stuck trip. Convoys pause 45–90 seconds before selecting their next destination. The original carried supplies between bases but did not unload or regenerate them; no artificial unloading is added here.
+The initial road route feeds an ongoing circuit between different friendly bases. One travel controller paces each column: the lead vehicle follows the route and each follower targets the preceding surviving vehicle. After combat or a new base leg, travel order follows physical approach to the destination while vehicle identities and combat roles remain unchanged. The leader waits when a neighbour gap exceeds 160 metres and resumes below 90 metres; followers regulate their speed and retain stable movement targets. Arrival requires the lead vehicle to physically reach the route endpoint and the followers to close up in order. A timeout never counts as arrival. Commanded vehicles with no five-metre progress retry native navigation after 45 seconds; after three minutes without progress they leave the column, preserving their physical crew and cargo. Combat, boarding, intentional spacing waits and supply stops do not consume that timer. Convoys pause 45–90 seconds after physical arrival before selecting their next destination. The original carried supplies between bases but did not unload or regenerate them; no artificial unloading is added here.
 
-Combat starts from fresh identified native group perception within 400 metres of a surviving convoy vehicle or a delivered HQ sighting. Mounted group origins are not used for this distance, because native groups can retain their original spawn position. Infantry dismounts, approaches the left and right flanks, then searches those sectors. Armed escorts provide cover while the ammo truck withdraws; the troop truck waits until the passengers have dismounted. Orders refresh at a bounded thirty-second interval. Still-mounted infantry receives at most six dismount retries, ten seconds apart, to recover from busy doors or a braking truck. Native boarding waypoints require all surviving members and use a 100-metre approach radius; actual compartment membership determines readiness. Crew retention suppresses both group and individual abandonment priorities only for the original mounted vehicle crew and releases on critical damage or drivetrain failure, allowing native emergency abandonment.
+Combat starts from fresh identified native group perception within 400 metres of a surviving convoy vehicle or a delivered HQ sighting. Mounted group origins are not used for this distance, because native groups can retain their original spawn position. Infantry dismounts, approaches the left and right flanks, then searches those sectors. Armed escorts provide cover while the ammo truck withdraws; the troop truck waits until the passengers have dismounted and cleared it by 25 metres. Convoy vehicles slow to 8 km/h within 45 metres of their fit dismounted teams and restore cruising speed for travel. Contact-driven tactical orders refresh no more often than every thirty seconds and only after the contact moves at least forty metres; unchanged sightings retain the existing manoeuvres. Combat and boarding suspend column travel, and surviving vehicles regroup before resuming. Still-mounted infantry receives at most six dismount retries, ten seconds apart, to recover from busy doors or a braking truck. Native boarding waypoints require all surviving members and use a 100-metre approach radius; actual compartment membership determines readiness. Crew retention suppresses both group and individual abandonment priorities only for the original mounted vehicle crew and releases on critical damage or drivetrain failure, allowing native emergency abandonment.
 
-After sixty seconds without a fresh contact, the teams reboard under escort cover. A new contact interrupts boarding. After a 120-second boarding deadline, stranded survivors are released and the remaining vehicles continue. A lost troop truck releases the infantry. Player capture stops convoy control permanently, preserving the actors and loot.
+After sixty seconds without a fresh contact, the teams reboard under escort cover. A new contact interrupts boarding. While soldiers approach or board, their native orders are preserved. A team with no approach or seat progress for thirty seconds can receive up to three boarding retries, with one tick between cancellation and reissue so native reservations can settle. A five-minute hard deadline releases genuinely stranded survivors and lets the remaining vehicles continue. A lost troop truck releases the infantry. Player capture stops convoy control permanently, preserving the actors and loot.
 
 ## Validation
 
-`tests/test_supply_convoys.py` executes production startup, base selection, arrival, circuit timing, contact freshness and perception boundaries, scoped crew-abandonment priorities, combat quiet time, boarding interruption, timeout and truck-loss policies. The receipt tests cover all eight groups and configured fleets through twenty convoys, including no replacement after losses. Existing dispatch, native seat allocation, cargo, HQ radio and force-ledger regressions remain in the main check suite.
+`tests/test_convoy_column.py` executes the production spacing, stable-target, physical-arrival, leader-promotion, supply-ownership and stuck-recovery controller against native-boundary doubles. `tests/test_supply_convoys.py` executes production startup, base selection, arrival, circuit timing, contact freshness and perception boundaries, scoped crew-abandonment priorities, combat quiet time, boarding interruption, timeout and truck-loss policies. The receipt tests cover all eight groups and configured fleets through twenty convoys, including no replacement after losses. Existing dispatch, native seat allocation, cargo, HQ radio and force-ledger regressions remain in the main check suite.
 
 `tools/headless_workbench.py --project chat --smoke supply-convoys --rounds 1 --timeout 900` exercises production automatic startup and physical AI in an isolated Workbench profile. Its final controlled contact explicitly tests native dismount/reboarding rather than claiming that an injected report proves perception. Remote-client replication and twenty-convoy performance require dedicated-server testing. Earlier one-convoy evidence in `convoy-migration.md` and `convoy-startup.md` remains historical evidence for those earlier sources.
 

docs/vanilla-resources.json

@@ -35,6 +35,8 @@
   "Configs/Map/MapPlain.conf": "A786DD4868598F15",
   "Configs/Navmesh/Navmesh_GM_Eden_Soldier.conf": "8BBC73472092902E",
   "Configs/Navmesh/Navmesh_GM_Eden_Vehicle.conf": "0228A79846FD8A97",
+  "Configs/System/ActionContext/ManualCameraContext.conf": "C538807EEE48BED8",
+  "Configs/System/chimeraInputCommon.conf": "795184CF9AD764DB",
   "Configs/System/chimeraMenus.conf": "C747AFB6B750CE9A",
   "Configs/Systems/MissionSystems.conf": "C50579A2EC48E8EF",
   "Prefabs/AI/Groups/Group_Base.et": "000CD338713F2B5A",
@@ -50,6 +52,8 @@
   "Prefabs/Characters/Factions/BLUFOR/US_Army/Character_US_HeliPilot.et": "42A502E3BB727CEB",
   "Prefabs/Characters/Factions/BLUFOR/US_Army/Character_US_Sniper.et": "0F6689B491641155",
   "Prefabs/Characters/Factions/BLUFOR/US_Army/Character_US_Unarmed.et": "2F912ED6E399FF47",
+  "Prefabs/Characters/Factions/BLUFOR/US_Army/GreenBerets/Character_US_SF.et": "36E28C628A2F83CB",
+  "Prefabs/Characters/Factions/BLUFOR/US_Army/GreenBerets/Character_US_SF_Medic.et": "9A234C5857D92187",
   "Prefabs/Characters/Factions/OPFOR/USSR_Army/Character_USSR_AR.et": "23ADBBC31B6A3DC6",
   "Prefabs/Characters/Factions/OPFOR/USSR_Army/Character_USSR_AT.et": "1C78331E156A3D65",
   "Prefabs/Characters/Factions/OPFOR/USSR_Army/Character_USSR_HeliPilot.et": "A62FA97C4EC64F14",
@@ -59,6 +63,8 @@
   "Prefabs/Characters/Factions/OPFOR/USSR_Army/Character_USSR_SL.et": "5436629450D8387A",
   "Prefabs/Characters/Factions/OPFOR/USSR_Army/Character_USSR_SR.et": "333DA6244C7DA34C",
   "Prefabs/Characters/Factions/OPFOR/USSR_Army/Character_USSR_Sharpshooter.et": "976AC400219898FA",
+  "Prefabs/Characters/Factions/OPFOR/USSR_Army/Spetsnaz/Character_USSR_SF.et": "2DB452B3EC386B92",
+  "Prefabs/Characters/Factions/OPFOR/USSR_Army/Spetsnaz/Character_USSR_SF_Medic.et": "8CA70597606992EC",
   "Prefabs/Characters/Footwear/CombatBoots_US_01.et": "DAAFD15478BDE1C3",
   "Prefabs/Characters/HeadGear/Hat_Patrol_US_01/Hat_Patrol_US_01.et": "F545C1BE7C99954A",
   "Prefabs/Characters/HeadGear/Helmet_PASGT_01/Helmet_PASGT_01_base.et": "8A2B2A544F3ED831",