Forecast all-down recovery and preserve self-rescue; record Workshop 0.0.133

docs/recovery.md

@@ -20,15 +20,32 @@ finite native infusion; epinephrine improves resilience over 30 seconds without
 replacing blood or treating wounds. Medicine is not slowed by the passive-rate
 setting. Duplicate epinephrine dosing is refused while its effect is active.
 
-The round fails with **“Everybody died.”** after 30 uninterrupted seconds when
-all remaining prisoners are unconscious, no conscious reserved prisoner can
-reconnect to help, and nobody has treatment, observed recovery, or viable native
-passive recovery. A bandaged casualty with a blood/resilience regeneration effect
-also counts during the engine's initial regeneration delay. Full hit zones,
-zero-rate effects, insufficient blood for resilience, and bleeding do not falsely
-count as self-recovery. Waking, viable recovery, or treatment resets the timer.
-An empty server does not start it. Existing all-dead/missing-body and exhausted
-admission handling remains active.
+When all prisoners are down, authority evaluates a five-minute recovery forecast
+once per second. Blood and resilience must both cross their native wake thresholds.
+The copied-value model includes pending regeneration delays, bleeding (including
+tourniquets), native hit-zone multipliers, and finite saline/epinephrine rates and
+remaining durations. Passive resilience recovery is not double-counted during
+epinephrine treatment; uncertain post-treatment recovery retains the fallback. Wound
+healing alone does not count. The estimator never applies treatment or advances
+real effect timers.
+
+If nobody can wake within 300 seconds, the existing 30-second defeat grace starts.
+Each fresh forecast can cancel it. A connected unconscious player with a usable
+injector also keeps the round alive when self-epinephrine is enabled; this uses the
+same inventory and native eligibility check as the Space action. Enabling the
+setting without carrying an eligible injector does not block defeat. Conscious
+reserved reconnecting prisoners and an evacuation carrying survivors retain their
+existing protections. Empty servers do not start this countdown.
+
+Unsupported effects, active treatment interactions, and incomplete predictions
+fall back to the old observed-treatment/natural-recovery safeguards. In particular,
+changing blood-state bands can change native passive resilience rates: unless even
+an optimistic blood-only forecast cannot recover in five minutes, that case is
+reported as uncertain rather than assigned an invented wake time. There is no
+five-minute hard timeout for uncertain cases. Messages distinguish self-injection,
+expected timely recovery, uncertainty, and the 30-second defeat grace. Medical
+logs record forecast seconds (-1 means beyond the horizon; -2 means uncertain).
+Existing all-dead/missing-body and exhausted-admission handling remains active.
 
 The `recovery` fixture exercises the real team-failure timer and treatment on an
 admitted prisoner. `medical-combat` checks an actual hunter medic's inventory,