EscapistsReintroduced/docs/evidence/rifle-transfer-cancellation-2026-10-02/infantry-resupply.md.before

# Finite infantry ammunition resupply

The successor implements HQ-directed rendezvous between existing infantry patrols and the original ammunition trucks of all admitted finite convoys. Up to twenty immutable convoy slots are supported; each keeps its own original magazine identities and transfer state. Shared delivered-demand history and per-recipient cooldowns prevent another truck from replaying an already consumed report. HQ rotates donors and starts at most one new trip each five-second planning cadence. [Multi-convoy integration and evidence](multiconvoy-resupply.md). Convoy creation remains owned by the existing finite convoy system; resupply creates no vehicles, troops or replacement cargo. This remains a partial migration of the user-owned AI extension, not full logistics parity.

## Reports and rendezvous

Local own-roster ammunition sampling runs about every 30 seconds when a radio and free uplink are available, with six initial phases five seconds apart. Complete small-arms stock at or below 30 magazine-plus-chamber rounds per living member can prompt an early status report, including known empty stock. This is a formation average; incomplete or unknown inventories do not establish a shortage. Any queued status imposes a 60-second urgent-call cooldown. Routine status retains its 180-second interval, while requested check-ins bypass the urgent cooldown. Contact traffic and physical negative-search rules keep their existing order after due status.

Complete low mounted stock can also request the same early status frame and
cooldown, while remaining in a [separate mounted payload](hq-ammunition.md#early-mounted-ammunition-check-ins-1-october-2026).
It never enters carried totals or satisfies the infantry demand predicate.

HQ acts only on successfully delivered status. Both formations need a fresh report, at most 120 seconds old, with living and fit members; their reported positions must be within 200 metres. The recipient must be an available patrol rather than a home guard. Existing reservations, hostile perception, convoy combat, capture and ownership changes can refuse or terminate the task. Local physical checks validate execution; they do not silently update HQ's reported positions or ammunition knowledge.

The truck receives a real radio downlink to stop. After it physically stops, its original crew is asked for a new status report. HQ waits for that report to arrive before sending the infantry a separate downlink to a rendezvous three metres from the reported position. Native move/defend waypoints then direct the existing infantry. Both use a 0.5 m completion radius: the previous 2 m move radius could accept arrival five metres from the reported truck center, beyond the transfer distance. The destination still comes from the delivered report, and no actor is snapped or teleported. Stock formation/defend behavior can choose other positions; these parameters do not prove that every member reaches a usable storage access point. The task expires after at most 120 seconds and cannot extend beyond 180 seconds from the demand observation. A consumed demand message is not reused; that formation has a three-minute planning cooldown.

## Finite cargo and physical transfer

The service waits for the convoy's cargo startup to settle, including the supply convoy's separate faction-weapon and matching-ammunition phases. It captures actual identities of up to 96 magazine-component items already in the ammunition truck, independent of faction or AK74 prefab. A single 90-second deadline starts when this service first observes the ready convoy; repeated waiting cannot extend it. This allows the producer's weapon phase and a bounded magazine-callback grace without treating the earlier crew-admission deadline as cargo failure. The unchanged 128-item inventory bound and 96-magazine bound stop conservatively if exceeded; recipient weapon compatibility is still checked before each transfer. Failed insertion, looting or subsequent loss reduces usable stock. New items added later are not adopted, and missing stock is never recreated. The service uses the original registered truck, crew, ledger records and recipient roster.

A trip allows at most six magazine transfers, one per served soldier. The individual must still have complete local small-arms stock of at most 30 rounds, carry a compatible weapon, remain on foot and be within four metres of the stopped truck. The leaf checks actual native inventory capacity, managed storage and magazine-well compatibility. It submits one `TryMoveItemToStorage` for the exact existing magazine. Success requires **both** a completed native callback and physical proof: that identity is absent from donor inventory, present in recipient inventory and parented to the selected destination storage.

When available storage blocks an incoming magazine, the ground coordinator may now [return one unused compatible empty magazine](empty-magazine-return.md) to the original truck first. The return is a separate, once-only native operation with its own callback and exact storage proof. No return occurs when incoming capacity already exists, and the original incoming stock is revalidated before the later delivery. Returned empties are not added to the one-time stock snapshot.

Each magazine identity is reserved before its first leaf check. If that check submits no native operation, temporary approach geometry, motion, access or capacity refusal releases the reservation and another member may try. There is at most one such preflight per member per existing slow tick, within the unchanged rendezvous deadline. Once native submission is attempted, the identity remains spent even after synchronous rejection; the native operation is never retried. Each phase has an eight-second deadline and the whole transaction has a sixteen-second ceiling. Either native submission consumes the selected incoming identity even if only the empty return was attempted; this conservative reservation prevents automatic replay. A deadline does not cancel an accepted native operation. Unresolved operations remain reserved after failure/Stop; a late completion does not turn a failed task into success. Cleanup removes only owned waypoints and releases reservations, retaining physical forces and remaining cargo. No magazine spawning, refilling, forced reload or actor teleportation is involved.

## Evidence and limits

The [current-source native HQ run](evidence/native-2026-09-20-072839-infantry-resupply/report.json) compiles the integration and completes one scripted round with 59 assertions, zero script/runtime failures, unchanged source/external inputs and confirmed hidden/muted cleanup. Four installed RHS/WCS localization errors remain, so strict qualification stays failed. The [initial compile failure](evidence/native-2026-09-20-072533-infantry-resupply-compile/report.json) is retained: splitting an overlong Enfusion condition corrected it. This fixture does not dispatch a supply convoy or prove a successful native inventory transfer.

The [controlled native transfer](evidence/native-2026-09-20-091854-infantry-transfer/report.json) now completes 43 assertions and one round without script/runtime failures. An existing original patrol actor is deliberately positioned beside the existing automatic convoy ammo truck; after native pose update, one original magazine transfers with unchanged round count and no new force entry. Exact native callback, source absence and destination storage ownership agree. Source/external fingerprints and private cleanup are confirmed; four external localization errors remain. This is direct transfer evidence, not a walking rendezvous.

Actual-method tests cover the coordinator's delivered-report rules, radio transitions and cleanup, the transfer's exact identity/ownership and callback requirements, and early-report scheduling with deterministic radio/legacy contact doubles. Captured native contact priority is outside that fairness harness. Native navigation, a full HQ-directed rendezvous, ordinary play and multiplayer still require direct evidence. Before submission, [physical access qualification](infantry-resupply-access.md) now requires an unobstructed native trace to a root-owned authored truck storage-action context. Missing anchors or blocked/uncertain geometry refuse the operation. This does not prove an AI walking route or door-opening animation. This slice does not implement demand-triggered supply dispatch, broad supply catalogs, launcher/vehicle rearming or complete original logistics behavior.

Provenance: the authorized user-owned `escapists-ai` files `EAI_Resupply.c` (SHA-256 `dfa28d0741c5515c85a6e62bc6d1a104f5474ddc22a6e58931be1583133f3586`) and `EAI_HQStatus.c` supplied behavioral references. The successor mortar transfer supplied its physical-proof pattern; installed vanilla storage and magazine-well APIs supplied native contracts. The original protected Escapists implementation and its helpers were not imported. Related background: [HQ ammunition](hq-ammunition.md) and [finite convoys](convoy-migration.md).

### Approach corrections after the controlled transfer checkpoint

Actual coordinator and complete leaf methods now run together in regressions that reproduced the former premature item-spending/whole-trip-abort. Transient 3D range, stopped state, storage capacity or access refusal submits nothing, releases only that unsubmitted item's reservation and lets another original member approach. One preflight per member per existing slow tick and the original trip deadline bound the wait. A rejected or failed native submission remains spent; accepted uncertainty never retries. Inline native completion is still counted once. Waypoint tests cover the smaller positive radii, unchanged report-derived target and native move-before-hold ordering.

The [local-handoff integration run](evidence/native-2026-09-20-101306-local-handoff/report.json) compiles these changes with all five addons. It does not exercise autonomous resupply. The earlier direct-transfer evidence retains its own source snapshot; no full walking delivery or performance result is claimed.

### Supply convoy cargo integration correction (30 September 2026)

Actual-method stock/planning regressions now exercise phased issue readiness, completion after the former crew deadline, the early-ready producer timeout boundary, a fixed expiry, NATO magazine identities, 96/97-item stock limits and exclusion of later replacement identities. Coordinator cleanup and native-operation quarantine policy regressions still pass. The cargo producer and inventory callbacks are doubled by these checks; this change has not yet been exercised in a native walking rendezvous. A patrol with incompatible remaining cargo can still consume a planning attempt and wait until the bounded trip expires; no incompatible magazine can pass the physical-transfer compatibility guard.

The [30 September native rerun](resupply-fixes-2026-09-30.md) reached both real cargo phases and captured 56 original magazine identities. It failed recipient selection before any transfer; no eligible compatible original patrol could be reserved at that point. Source/external fingerprints remained unchanged and hidden/muted cleanup completed. Current native transfer, autonomous rendezvous and release qualification remain open.


The [mounted courier integration](hq-ammunition.md#mounted-courier-integration-1-october-2026)
now shares each original truck's frozen stock/spent identities and the fleet's
delivered-report history. Infantry planning retains priority. An active or
quarantined mounted operation blocks infantry reuse, and unresolved infantry
operations block mounted dispatch. Ground-supply status counts both kinds of
active trip and labels its moved counter explicitly as infantry-only. This source
integration does not constitute native mounted-transfer qualification.


## Finite mine top-ups (1 October 2026)

The 1 October checkpoint added the ability for the same original-truck coordinator to send **one original PMN4 to an existing carrier with exactly one usable mine**, after scanning ordinary infantry and mounted-ammunition demand. HQ admits this narrow case only from fresh delivered, complete mine status: `MineMembers == Count` and `ReadyMines == 1`. Both formations still need the existing fresh reported positions within 200 metres, original ownership and idle-force admission. Unknown, empty and multiple-mine counts do not establish this demand; no initial mine chance or grant policy is overridden.

The truck stop, new stopped-position report and infantry rendezvous each retain the existing radio and physical movement requirements. At the truck, selection requires an attributable original living on-foot member still carrying exactly one usable PMN4. Its startup mine grant must have finished with no pending insertion callback, including callbacks surviving a grant timeout. The selected actor remains fixed through unsubmitted capacity/access refusals. The leaf additionally pins its exact carried mine, incoming mine, original roster slot, driver, force records and inventory managers.

Supply comes only from the optional convoy batch's at-most-two frozen original identities. Those mines use the **same spent ledger** as the truck's infantry/mounted magazines, with the unchanged 96-spent ceiling and shared recipient replay/cooldown maps. The reservation commits before one native `TryMoveItemToStorage`. Success requires a successful callback, exact source absence and reciprocal destination storage custody. One confirmed mine ends the trip; no spawn, refill, rollback, retry of a submitted item or mine-placement reset occurs.

A refused or expired move with uncertain custody retains the exact truck and recipient claims in state 7, even after service Stop. Owned waypoints/downlink are cleared. A second truck cannot use a newer delivered report after cooldown to race the retained operation. Polling releases only matching claims after exact terminal custody/failure evidence or deletion of the incoming identity; damage/capture alone cannot resolve an unknown move. Late completion never changes a failed trip to success or refunds its stock. Admin supply totals distinguish magazines from mines and include unresolved claimed trips.

[Independent review, mutations and preservation](evidence/mine-resupply-2026-10-01/review.json) accompany **268 passing regression programs**. Removing the startup callback guard or retained claims produces compiled assertion failures, including an attempted second-truck admission after cooldown. The hidden/muted normal native route uses a frozen combined-source copy after concurrent equipment edits invalidated the first run; it compiles the integration and completes 63 assertions and one round with zero script/runtime failures; thirteen installed-resource errors retain strict failure. This proves base-loop integration, **not actual mine transfer or multiplayer**. Native approach/insertion/movement remains unqualified. At that checkpoint, zero-stock recovery, per-actor full need manifests and repeated mine placement remained outside this partial migration. The later zero-stock increment is described below.


## Designated engineer zero-stock replacement (2 October 2026)

A fresh, complete delivered mine report with `ReadyMines == 0` can now authorize one finite PMN4 replacement. Before reserving a truck or consuming the report, HQ requires an attributable member of the original recipient roster whose startup mine lottery selected it and whose initial grant has settled. A failed lottery never creates this entitlement; later setting changes do not alter the recorded designation. An unfinished native insertion still blocks resupply, including after a timeout or a false native submission return. Existing one-to-two top-ups remain supported. No arbitrary zero-stock infantry group receives mines.

At the physical rendezvous, bounded inventory inspection distinguishes proven zero from unknown or malformed inventory. The selected original actor and its zero-or-one mode remain fixed through unsubmitted capacity/access retries. For zero replacement, the transfer independently rechecks the current mission/HQ designation and exact empty inventory on each tick; after submission it excludes only the exact incoming item from that count. For one-to-two top-ups, the leaf retains the exact pre-existing carried mine. Original roster, driver, custody, access and stopped-truck guards apply to both paths.

Each trip still transfers at most one exact identity from the original finite convoy mine snapshot through the shared spent ledger. Existing report freshness, priority, cooldown, callback proof and uncertain-operation quarantine are unchanged. This replenishes carried stock only: it does not reset `EngineerMineAttempted`, authorize repeated mine laying, spawn replacement stock or refund submitted items.

Six focused actual-method programs passed independently: startup designation and settings changes, original equipment membership, known-zero versus unknown inventory, pinned modes through retries, delivered-report admission, and existing callback/quarantine behavior. The old planning method compiled and failed the new designated-zero admission assertion. All **272 registered regression programs pass across a resumed run**: the initial `native_package` stop exhausted the per-user `/tmp` quota; verified relocation of completed task snapshots recovered space, and that program plus the remaining suite passed with the existing canonical `/tmp` guards. The infrastructure failure is preserved. The [hidden/muted frozen-source normal route](evidence/native-2026-10-02-zero-mine-integration/report.json) compiles this increment and passes **63 assertions and one round**, with zero script/runtime failures and thirteen retained installed-resource errors. Cleanup and unchanged inputs are confirmed. This proves compilation/base-loop integration, not actual zero-stock transfer. [Review and preservation](evidence/zero-mine-resupply-2026-10-02/review.json). Actual walking mine delivery, repeated placement and multiplayer remain unqualified; earlier native evidence retains its original source scope.

### Authored camp imports (2 October 2026)

The historical one-time truck snapshot above now has one narrow extension: [proved finite camp deliveries](ground-depot-loading.md) can append an original startup camp magazine after two separately acknowledged native moves. Existing stock/spent entries and the lifetime 96-identity limit remain intact; arbitrary later deposits and returned empty magazines remain excluded. Admission requires conservative known finite-magazine commitments beyond prior imports, not merely unused truck capacity. Autonomous physical loading remains unqualified.

## Supported carried launcher supply (2 October 2026)

HQ now considers supported empty launchers after existing rifle and mounted supply requests and before mine top-ups. Demand requires a fresh, complete delivered launcher snapshot for the entire known living formation, a positive count of reloadable magazine-well muzzles, and zero reported launcher rounds/chambers. The new `LauncherMuzzles` field survives detached status copying and validation. It does not assume an expended rocket/grenade leaves an empty magazine entity behind.

Before reserving the original infantry group and ammunition truck, the coordinator requires a compatible, unspent identity in its existing finite stock. The bounded scan covers all 96 stock entries and 32 original members; rifle-only prefixes cannot hide compatible cargo. Native muzzle disposal flags and scripted `CanBeReloaded` restrictions both refuse one-shot weapons. Exact supported wells, carried-weapon ownership and reciprocal loaded-item slots are checked. Installed RPG7/GP25/M203 round prefabs are projectile entities with magazine components; their entity type alone does not exclude them. This adds no stock, replacement actors or virtual ammunition.

The existing radio hold, reported rendezvous, physical access, shared spent ledger and native inventory proof govern transfer. Launcher trips do not return empty projectile rounds. Unknown delayed operations retain the original claims; a terminal negative callback releases them only after exact unchanged original source slot/storage, managers and exclusive custody are proved. Submitted stock remains spent even after refusal: no retry or refund. A failed move therefore cannot silently duplicate cargo or permanently pin forces when its unchanged source custody is confirmed.

Eleven focused programs pass independently, with failing mutation controls for copied muzzle presence, stock-prefix reachability and terminal refusal settlement. All 283 registered programs pass. The [final-source normal route](evidence/native-2026-10-02-recovery-launcher-normal/report.json) compiles the implementation and completes 63 assertions with zero script failures; thirteen retained engine errors preserve strict failure. Actual launcher walking delivery, subsequent AI reloading/firing, remote inventory behavior and performance remain unqualified. [Source, installed-API review and limits](evidence/recovery-launcher-2026-10-02/review.json). The existing packaged handoff predates this feature.