Count occupied restarts as failed missions; sync published Workshop version

docs/telemetry.md

@@ -124,15 +124,15 @@ existing queued payloads retain their original values and event IDs.
 | `phase_changed` | An actual nonterminal mission transition. Use elapsed times for milestone durations. |
 | `heartbeat` | A snapshot every five minutes while unfinished. |
 | `telemetry_resumed` | Re-enabled during the same mission; the mission ID stays the same and `partial` is true. |
-| `mission_finished` | Exactly one local result snapshot, before normal teardown. |
+| `mission_finished` | One local result snapshot, at teardown or recovered on the next startup. |
 
 | Outcome | Count as a gameplay result? |
 | --- | --- |
 | `victory` | Yes, successful mission. |
-| `defeat` | Yes, failed mission, including administrator abandonment. |
+| `defeat` | Yes, failed mission, including administrator abandonment and a restart with players connected. |
 | `preparation_failed` | No, startup error; inspect `preparationError`. |
 | `restarted_empty` | No, automatic last-disconnect or idle-empty restart. |
-| `interrupted` | No, session ended without a gameplay result. |
+| `interrupted` | No, an empty session ended without a gameplay result (also used by older clients for occupied interruptions). |
 | `unfinished` in `previousOutcome` | No confirmed ending survived. May be a crash/forced stop. Do not infer a defeat. |
 
 Player names and stable game account UUIDs support history across servers. No IP
@@ -161,8 +161,8 @@ summary containing matching map/server/mission/event/outcome identifiers plus
 `server` and `allServers` records. Each record has completed rounds, wins,
 failures, win rate and partial-round coverage. The mission validates these
 identifiers and counts before displaying the current map's record on its result
-screen. Retries never increase the totals twice. Startup failures, interrupted
-sessions and empty restarts are excluded from win/failure totals. If a summary
+screen. Retries never increase the totals twice. Startup failures, events marked `interrupted`, and empty restarts are excluded
+from win/failure totals. Occupied restarts now produce explicit `defeat` events. If a summary
 cannot be delivered before the next mission starts, the screen reports it as
 unavailable and keeps local statistics visible.
 Once a confirmed record is displayed, failures uploading older queued events
@@ -209,8 +209,10 @@ retry without edits; retries still use the original event IDs and count once.
 
 Requests have a 15-second timeout, with a 30-second callback watchdog. Retries
 back off from 10 seconds to five minutes. A five-second dispatch tick sends one
-request at a time. Disk writes occur on events and acknowledgement, not every
-player sample. Delivery never blocks mission startup or shutdown.
+request at a time. Disk writes occur on events and acknowledgement. While occupied, a private
+restart checkpoint is also saved every five seconds and on roster changes; it
+is not sent as a result while the mission is running. An empty snapshot clears
+that candidate, so earlier attendance alone does not turn a restart into a loss. Delivery never blocks mission startup or shutdown.
 
 The profile queue holds at most 64 events of 64 KiB each. On overflow it discards
 queued heartbeats first, then the oldest non-in-flight event; `droppedEvents`
@@ -220,9 +222,15 @@ recovery. An unreadable queue suspends telemetry and preserves evidence for
 repair instead of silently replacing the server identity.
 
 Unsent final results survive normal scenario reloads and are retried in the next
-enabled instance. Abrupt termination can lose the latest event; the next start's
-`previousOutcome` remains unfinished if no result was saved. A permanently
-stopped host cannot send further data.
+enabled instance. After abrupt termination, the next enabled instance promotes the last saved
+occupied checkpoint to a `defeat` for the original mission, with its original
+players and statistics. The checkpoint and queue transition are saved together;
+retries retain the recovered event ID. Its timestamp and duration reflect the
+last sample, not the next startup time. Connection changes in the final five
+seconds may be missed if their roster callback or profile write did not complete.
+Completed results are never replaced. Empty or legacy states without an occupied
+checkpoint remain unknown rather than inventing a result. A permanently stopped
+host cannot send further data.
 
 Disabling immediately stops collection/new requests and discards queued events
 and recovery copies. It cannot recall an HTTP request already submitted or erase
@@ -232,6 +240,15 @@ discards unsent data instead of forwarding old records to a different recipient.
 
 Native API references: [RestContext](https://community.bistudio.com/wikidata/external-data/arma-reforger/EnfusionScriptAPIPublic/interfaceRestContext.html) and [RestCallback](https://community.bistudio.com/wikidata/external-data/arma-reforger/EnfusionScriptAPIPublic/interfaceRestCallback.html).
 
+### Restart verification
+
+The [native restart fixture](../tests/native/telemetry_restart/README.md) runs
+two isolated Workbench processes with a real connected local player. It checks
+native shutdown results, JSON/profile persistence, unfinished-state recovery,
+completed-state deduplication and receiver validation of the generated events.
+Telemetry network dispatch is replaced in the test copy only. This does not
+certify a multiplayer AMP deployment or optional asset integrity.
+
 ### Round combat counters
 
 Player records additionally include `kills`, `friendlyKills`, `deaths`, `downed`