PROPOSAL ONLY; successor/reference untouched; no native launch.

Scope: at most TWO one-time PMN4 spawn attempts in each existing original admitted
ammo truck. Quantity is a conservative successor allowance, not a copied convoy
quantity. Owned EAI_Mines.STOCK is2 per soldier; original supply convoy only fills
weapons/magazines, while original EAI_AmmoSupply.Fill dynamically fills requested
mines (maximum96 spawned cargo items). Two spares support one original engineer's
standard carried allowance without implementing recurring refill.

Files in fix.patch:
- new ERR_ConvoyMineStock.c (task-owned optional initial batch and callback)
- ERR_SupplyConvoyService.c (pin at IssueCargo, tick with existing original-owner guard)
- ERR_SupplyConvoyTactics.c (task-owned ref, terminal Stop hook)
- new tests/test_convoy_mine_stock.py
Registration is a separate registration.patch because tools/check.py has prior edits.
Copied ERR_HQ.c and ERR_MountedMagazineSeed.c are test inputs only, NOT patch files.

Primary weapon/magazine/mounted callbacks remain unchanged in task.Cargo. Optional
mine requests wait until every primary callback is finished; no mine callback is
inserted into that primary array. Normal InfantryResupply.Stock therefore never
waits for optional mine operations. Mine requests use remaining actual128 inventory
headroom and remaining128 combined primary+optional callback allowance. Magazine96
limits and their priority remain unchanged. Refused submissions still consume an
attempt; resource/capacity/ownership refusal never retries. One fixed90-second
window begins on first tick; timeout/stop/capture/mode loss is terminal.

Native GetItem is valid for Spawn (SDK generated callback lines15-18). Vanilla
SCR_AITakeItemFromArsenal_InventoryCallback lines12-15 resolves its RplId through
Replication.FindItem/RplComponent.GetEntity. Only those exact successful native
spawn identities can enter the final two-entry snapshot, after exact prefab,
initial-item exclusion, reciprocal slot, original truck storage ownership, alive,
collision handler and inactive pressure-trigger checks. No inventory-difference
fallback. Duplicate callback items deduplicate. Missing/late/unsupported identities
are omitted permanently. Physical uncertain items are preserved; callbacks remain
retained by the task batch and cannot schedule new work or reopen its snapshot.

Count()/At() expose frozen INITIAL identities, not a validated current available
stock count and not authority to transfer them. There is NO mine courier, no new
spent ledger and no reservation claim in this slice. Future finite mine delivery
must use these exact originals with the existing service's shared m_Spent and
appropriate total-cap/mutual-exclusion checks. It cannot pass the magazine-only
m_Stock to ERR_FiniteMagazineReservation and expect a mine to be accepted. Do not
claim mine replenishment, physical delivery, native insertion or multiplayer proof.

Tests: four focused programs pass; logs and results.json alongside proposal.
New actual-method harness covers the complete batch/callback methods, synchronous
success with false return, missing/unknown primary callbacks, primary independence,
128 item/callback limits, owner/mode/manager loss, fixed expiry then late callback,
preexisting/foreign/armed/dead/non-PMN items, duplicate callback identity and freeze.
Source hooks are checked directly; native Source/PAK validation remains future work.