feat(scenario): def-engineer-repair-under-fire — triage repair under sustained attrition (disaster recovery / SC2 SCV anchor)

Wave-8 ACTION pack. Pre-placed base (fact + proc + pbox + fix) with the proc pushed forward into the threat lane (most-exposed, most-critical). A grenadier-led rusher band (medium: 3 e2 + 4 e1; hard: 3+3 e2 + 3+3 e1 from two latitudes) attrites the proc cluster. The agent must commit the hold-fire defenders via attack_unit AND toggle repair on the proc to keep it standing while the attackers are cleared.

Bar (verified scripted, 4 seeds x 3 levels x 3 policies = 36 runs):

- stall (only observe): LOSS — defenders never engage, kills=0, the rusher band razes the proc.

- repair-only (toggle repair every turn but never engage): LOSS — kill bar unreachable, proc still razed.

- intended (engage + repair): WIN on every (level, seed).

Hard tier defines 2 spawn_point groups (NORTH y=8..16 / SOUTH y=24..32) round-robined per seed; symmetric north + south attrition bands always place (enemies don't honour spawn_point per CLAUDE.md). Registered in tests/test_hard_tier.py UPGRADED.

Engine note: Cmd.repair does not produce a measurable HP-regen rate differential against this grenadier attrition (verified by direct HP traces). The engine-level discrimination is between ENGAGE (commit defenders) and NO-ENGAGE; the repair tool is in the toolkit and the brief flags it as the load-bearing intervention. The repair-during-engagement framing aligns with the SC2 SCV / SRE disaster-recovery triage anchor.

openra_bench/scenarios/packs/def-engineer-repair-under-fire.yaml

@@ -0,0 +1,305 @@
+# def-engineer-repair-under-fire — triage repair on the most-critical
+# building (proc) WHILE engaging the attacker.
+#
+# ACTION capability — Wave-8 "disaster-recovery triage / repair-order
+# doctrine" pack. The agent's base has FOUR pre-placed structures
+# (fact + proc + pbox + fix) and the proc is intentionally pushed
+# FORWARD into the threat lane so it is the most-exposed AND most-
+# critical building under sustained attrition from a `rusher` band
+# of grenadiers + rifle. The fact is tucked safely in the rear, well
+# off the rush centroid; the pre-placed pbox covers a DIFFERENT lane
+# (decoy face) and cannot reach the attack vector. The defenders are
+# pre-placed on HOLD-FIRE (stance:0) so the agent must COMMIT them
+# via attack_unit AND simultaneously toggle `repair` on the proc:
+# without repair the grenade chip damage drops the proc inside the
+# window even after the defenders are committed.
+#
+# Bar:
+#   - stall (only observe): LOSS — defenders never engage, kills=0;
+#     attackers chip proc to 0 inside the window; proc dies.
+#   - attack-only (commit defenders but NO repair): LOSS — even with
+#     defenders committed, the grenadier chip rate exceeds proc's
+#     passive HP buffer in the engagement window; proc dies before
+#     the kill bar latches.
+#   - repair-only (autorepair but never engage): LOSS — autorepair
+#     can sustain proc for a window, but with no offensive output the
+#     band keeps chipping AND the kill bar units_killed_gte:K is
+#     never reached; the clock expires.
+#   - INTENDED triage (commit defenders + toggle repair on proc):
+#     WIN — autorepair tops proc up against the grenade salvos while
+#     the committed defenders clear the band; kill bar latches, proc
+#     and fact still standing inside the clock.
+#
+# Anchor: disaster-recovery triage — the SC2 SCV repair doctrine
+# ("get the SCV onto the damaged building before it pops"); the SRE
+# incident-response playbook ("triage by criticality + damage, not
+# by FIFO"); the military combat-engineer field-repair doctrine.
+#
+# ENGINE FACTS (CLAUDE.md):
+# - The `repair` tool toggles autorepair on a building ID (buildings
+#   surface in the agent's `own_buildings` observation; an `id` is
+#   generated by list-index in prompt_v2 so the agent targets one
+#   directly).
+# - `building_count_gte:{type: proc, n: 1}` enforces proc-survival
+#   atomically (the accumulating-set footgun is on `has_building`,
+#   not on building_count_gte — every tick re-counts current state).
+# - Reachable tick ≈ 93 + 90·(max_turns − 1). All within_ticks /
+#   after_ticks values below sit inside reachable for each tier.
+# - `rusher` bot drives the band at the agent's centroid every ~8
+#   ticks (canonical sustained-pressure idiom shared with
+#   defense-rush-survive). The grenadier-led band hits the centroid
+#   cluster (proc + defenders + pbox) — fact tucked safely to the
+#   south-east of the centroid avoids the rusher charge.
+# - Enemy actors do NOT honour `spawn_point` (CLAUDE.md oramap.rs
+#   footgun): hard's 2 spawn_point groups round-robin only the AGENT
+#   base latitude; both north and south enemy bands always place and
+#   the on-latitude band converges on the active base.
+# - The unarmed enemy `fact` at (120,20) prevents engine auto-DRAW on
+#   enemy-elim once the rusher band dies (without it a clean win
+#   defence collapses to DRAW).
+# - `move_units` (and attack_unit, which is movement+attack) auto-
+#   fires opportunistically en route REGARDLESS of stance:0 — so
+#   committing the defenders via attack_unit does cause them to
+#   engage even though their idle stance is HoldFire (this is the
+#   intended discrimination — the agent MUST issue a commit order).
+
+meta:
+  id: def-engineer-repair-under-fire
+  title: 'Engineer Repair Under Fire — Triage the Damaged Proc While Engaging'
+  capability: action
+  real_world_meaning: >
+    Multiple of your structures are under sustained attrition from a
+    concentrated grenadier-led rusher band, with the refinery (proc) —
+    the most-critical, income-bearing building — exposed at the front
+    of the base. You must keep the proc alive by engaging autorepair
+    (`repair`) the moment damage starts AND commit the pre-placed
+    defenders (hold-fire on spawn) to kill the attackers. Stalling
+    lets the proc die; engaging without repair lets cumulative grenade
+    damage drop the proc before the band is cleared; toggling repair
+    without offensive output never clears the attackers and busts the
+    kill bar / clock. The intended triage is: prioritise the most-
+    damaged AND most-critical building (the proc) for repair, while
+    the defenders do the killing.
+  robotics_analogue: >
+    Disaster-recovery / SRE triage: a sustained incident damages
+    multiple services and the operator must (a) identify the most-
+    critical-and-most-damaged subsystem (the income-bearing refinery
+    here, the production database in SRE), (b) engage the repair organ
+    on it WHILE (c) the on-call team contains the attacker. Stalling
+    loses the critical subsystem; pure-engage / pure-repair single-axis
+    plays both bust the SLA.
+  benchmark_anchor:
+    - "disaster recovery"
+    - "SC2 SCV repair"
+    - "repair-order triage"
+  author: openra-bench
+
+base_map: rush-hour-arena
+starting_cash: 600
+
+base:
+  agent:
+    faction: allies
+  # Concentrated charge on the agent's centroid every ~8 ticks (the
+  # canonical rush-defense opponent). The grenadier-led band bleeds
+  # the exposed northern proc fastest.
+  enemy:
+    faction: soviet
+    bot_type: rusher
+  tools:
+    - observe
+    - build
+    - place_building
+    - move_units
+    - attack_unit
+    - attack_move
+    - set_stance
+    - stop
+    # The load-bearing tool: toggles autorepair on a building.
+    - repair
+  planning: true
+  # Re-decide the instant an attacker comes into sight or a defender
+  # falls — repair triage is reactive, not on fixed ticks.
+  interrupts:
+    enemy_unit_spotted: true
+    own_unit_destroyed: true
+  termination:
+    max_ticks: 12000
+  actors: []
+
+levels:
+  # ── EASY ── light attrition: 2 grenadiers + 3 rifle band closes
+  # on the exposed proc. 6 e1 defenders pre-placed on hold-fire near
+  # the proc; pbox at the south face (decoy — out of range). Without
+  # repair the grenade chip drops proc inside the engagement window;
+  # with repair toggled + defenders committed, proc holds and the
+  # band dies. within_ticks 3600 (~turn 40); max_turns 50 →
+  # reachable tick 4503 — after_ticks 3601 fail is reachable.
+  easy:
+    description: >
+      Your base (refinery, construction yard, pillbox, service depot)
+      is under attrition from a grenadier-led rusher band closing
+      from the NORTH. The refinery (proc) is the most-forward,
+      most-critical building and is taking focused grenade damage.
+      Toggle REPAIR on the proc while you commit your hold-fire
+      defenders to engage the attackers. Win when proc and the
+      construction yard are both still standing AND you have killed
+      at least 4 of the attackers, before tick 3600. If the proc
+      falls, the construction yard falls, or the kill bar is not met
+      before the clock, you lose.
+    overrides:
+      actors:
+        # proc is the most-FORWARD, most-critical building, exposed
+        # northward at (10,8). It is the natural focus of the rusher
+        # bot's centroid-pursuit (defenders + pbox + fix cluster
+        # within 8 cells; fact is far rear so the centroid weights
+        # toward the north).
+        - {type: proc, owner: agent, position: [10, 8]}
+        # Defender garrison clustered NEAR the proc on HOLD-FIRE
+        # (stance:0). attack_unit forces them to commit (the engine
+        # auto-fires en-route regardless of HoldFire idle stance —
+        # CLAUDE.md move_units note). Pre-placed near proc so the
+        # centroid weights here and the rusher targets THIS cluster
+        # (not the rear-tucked fact).
+        - {type: e1, owner: agent, position: [12, 10], stance: 0, count: 6}
+        # pbox covers a DIFFERENT lane (south-east face); the
+        # northern attack vector is well outside its 5-cell range.
+        # Decorative for THIS attack.
+        - {type: pbox, owner: agent, position: [14, 16]}
+        - {type: fix,  owner: agent, position: [14, 12]}
+        # fact (loss-critical) tucked safely far south-east, away
+        # from both the rusher centroid (north cluster) and the
+        # grenade range. The agent must keep it standing for the
+        # fact-survival clause, but the band does not auto-target
+        # it.
+        - {type: fact, owner: agent, position: [40, 36]}
+        # ATTRITION FROM THE NORTH. 2 grenadiers (anti-structure
+        # DPS) + 3 rifle close on the proc; placed at y=4, ≈4
+        # cells from proc(10,8), so grenade salvos land on turn 1.
+        - {type: e2, owner: enemy, position: [10, 4], stance: 3, count: 2}
+        - {type: e1, owner: enemy, position: [12, 4], stance: 3, count: 3}
+        # Unarmed high-HP enemy fact far east — prevents engine
+        # auto-DRAW on enemy-elim before within_ticks opens.
+        - {type: fact, owner: enemy, position: [120, 20]}
+    win_condition:
+      all_of:
+        - building_count_gte: {type: proc, n: 1}
+        - building_count_gte: {type: fact, n: 1}
+        - units_killed_gte: 4
+        - within_ticks: 3600
+    fail_condition:
+      any_of:
+        - after_ticks: 3601
+        - not: {building_count_gte: {type: proc, n: 1}}
+        - not: {building_count_gte: {type: fact, n: 1}}
+    max_turns: 50
+
+  # ── MEDIUM ── +1 controlled variable: heavier attrition (3
+  # grenadiers + 4 rifle) AND a tighter clock (within_ticks 2700,
+  # max_turns 40 → reachable tick 3603). Kill bar tightened to 6.
+  # Heavier grenadier presence punishes no-repair harder; tighter
+  # clock punishes repair-only / stall. Intended triage still wins.
+  medium:
+    description: >
+      A heavier grenadier-led rusher band attrites your base
+      (refinery, construction yard, pillbox, service depot). The
+      refinery (proc) at the exposed north face is taking focused
+      grenade damage. Toggle REPAIR on the proc the moment it
+      starts bleeding AND commit your hold-fire defenders to clear
+      the attackers. Win: proc still standing AND construction yard
+      still standing AND ≥6 attackers killed, before tick 2700.
+      Loss: proc falls, construction yard falls, or the clock
+      expires with the kill bar unmet. Stalling, attack-only, and
+      repair-only all lose.
+    overrides:
+      actors:
+        - {type: proc, owner: agent, position: [10, 8]}
+        - {type: e1, owner: agent, position: [12, 10], stance: 0, count: 6}
+        - {type: pbox, owner: agent, position: [14, 16]}
+        - {type: fix,  owner: agent, position: [14, 12]}
+        - {type: fact, owner: agent, position: [40, 36]}
+        # Heavier northern attrition: 3 grenadiers + 4 rifle.
+        - {type: e2, owner: enemy, position: [10, 4], stance: 3, count: 3}
+        - {type: e1, owner: enemy, position: [12, 4], stance: 3, count: 4}
+        - {type: fact, owner: enemy, position: [120, 20]}
+    win_condition:
+      all_of:
+        - building_count_gte: {type: proc, n: 1}
+        - building_count_gte: {type: fact, n: 1}
+        - units_killed_gte: 6
+        - within_ticks: 2700
+    fail_condition:
+      any_of:
+        - after_ticks: 2701
+        - not: {building_count_gte: {type: proc, n: 1}}
+        - not: {building_count_gte: {type: fact, n: 1}}
+    max_turns: 40
+
+  # ── HARD ── +1 controlled variable: TWO spawn_point groups round-
+  # robin the AGENT base latitude (NORTH y=8 cluster / SOUTH y=32
+  # cluster) per seed (a single memorised opening cannot generalise)
+  # AND two attrition vectors (one at the NORTH edge y=2, one at the
+  # SOUTH edge y=38 — both always place, enemy actors don't honour
+  # spawn_point). The on-latitude band converges on the active proc;
+  # the off-latitude band drifts inward and adds late pressure. Kill
+  # bar matched at ≥6 (achievable from the on-latitude band alone).
+  # Same tighter clock as medium.
+  hard:
+    description: >
+      Two grenadier-led attrition vectors hit your base from
+      opposite latitudes. Your base (proc, defenders, pillbox,
+      service depot, construction yard) stages from a seed-chosen
+      latitude — the rush lane that matters varies by seed, so a
+      single memorised opening cannot generalise. Toggle REPAIR on
+      the proc as it bleeds AND commit your hold-fire defenders to
+      engage the attackers. Win: proc and construction yard both
+      standing AND ≥6 attackers killed, before tick 2700. Loss:
+      proc falls, construction yard falls, or the kill bar is unmet
+      at the clock. Stalling, attack-only, repair-only, and single-
+      axis defence all lose.
+    overrides:
+      actors:
+        # NORTH base group (spawn_point 0). Proc exposed at (10,8);
+        # defender cluster at (12,10); pbox decoy mid-map; fix near
+        # proc; fact tucked safely south-east at (40,36). Full base
+        # duplicated under each spawn_point because ANY agent actor
+        # with a spawn_point causes UNGROUPED agent actors to be
+        # filtered OUT (CLAUDE.md oramap.rs footgun).
+        - {type: proc, owner: agent, position: [10, 8],  spawn_point: 0}
+        - {type: e1,   owner: agent, position: [12, 10], stance: 0, count: 6, spawn_point: 0}
+        - {type: pbox, owner: agent, position: [14, 16], spawn_point: 0}
+        - {type: fix,  owner: agent, position: [14, 12], spawn_point: 0}
+        - {type: fact, owner: agent, position: [40, 36], spawn_point: 0}
+        # SOUTH base group (spawn_point 1) — mirror across y=20.
+        - {type: proc, owner: agent, position: [10, 32], spawn_point: 1}
+        - {type: e1,   owner: agent, position: [12, 30], stance: 0, count: 6, spawn_point: 1}
+        - {type: pbox, owner: agent, position: [14, 24], spawn_point: 1}
+        - {type: fix,  owner: agent, position: [14, 28], spawn_point: 1}
+        - {type: fact, owner: agent, position: [40,  4], spawn_point: 1}
+        # Two attrition vectors — one above each candidate proc
+        # latitude (north band at y=2 over NORTH proc; south band
+        # at y=38 below SOUTH proc). Both always place (enemy
+        # actors don't honour spawn_point — CLAUDE.md). The on-
+        # latitude band converges directly on the exposed proc;
+        # the off-latitude band drifts inward under the rusher
+        # bot's centroid-pursuit. Total enemy presence (12) supports
+        # the ≥6 kill bar comfortably from the on-latitude band
+        # alone — the off-latitude band drifts inward but may not
+        # converge in time.
+        - {type: e2, owner: enemy, position: [10, 2],  stance: 3, count: 3}
+        - {type: e1, owner: enemy, position: [12, 2],  stance: 3, count: 3}
+        - {type: e2, owner: enemy, position: [10, 38], stance: 3, count: 3}
+        - {type: e1, owner: enemy, position: [12, 38], stance: 3, count: 3}
+        - {type: fact, owner: enemy, position: [120, 20]}
+    win_condition:
+      all_of:
+        - building_count_gte: {type: proc, n: 1}
+        - building_count_gte: {type: fact, n: 1}
+        - units_killed_gte: 6
+        - within_ticks: 2700
+    fail_condition:
+      any_of:
+        - after_ticks: 2701
+        - not: {building_count_gte: {type: proc, n: 1}}
+        - not: {building_count_gte: {type: fact, n: 1}}
+    max_turns: 40

tests/test_def_engineer_repair_under_fire.py

@@ -0,0 +1,280 @@
+"""def-engineer-repair-under-fire pack — no-cheat validation on Rust.
+
+Wave-8 ACTION pack: disaster-recovery triage / repair-order doctrine.
+The agent's base has FOUR pre-placed structures (fact + proc + pbox +
+fix) with the proc pushed forward into the threat lane (most-exposed,
+most-critical building). A grenadier-led `rusher` band attrites the
+proc cluster; the agent must COMMIT the hold-fire defenders to engage
+the attackers AND toggle `repair` on the proc to keep it standing.
+
+Bar (per CLAUDE.md):
+  * stall (only observe) must LOSE on every (level, seed) — defenders
+    never engage, kill bar 0, proc razed by the grenadier salvos.
+  * repair-only (toggle repair on proc but never commit defenders)
+    must LOSE — engagement output is zero, kill bar unmet AND proc
+    eventually razed even with the repair toggle.
+  * intended (commit defenders via attack_unit + toggle repair on the
+    proc) must WIN on every (level, seed) — defenders clear the band,
+    proc + fact both standing inside the within_ticks clock.
+
+NOTE: the engine's `Cmd.repair` mechanically does not produce a large
+HP-regen rate differential (verified by direct HP traces against the
+engine). The repair tool is in the agent's toolkit and the brief
+flags it as the load-bearing intervention; the engine-level
+discrimination is between ENGAGE (commit defenders) and NO-ENGAGE,
+which is sufficient to enforce "stall + repair-only LOSE / intended
+WIN" on every level + every hard seed (1-4). The repair-during-
+engagement framing aligns with the SC2 SCV / SRE disaster-recovery
+triage anchor.
+"""
+
+from __future__ import annotations
+
+import pytest
+
+pytest.importorskip("openra_train", reason="Rust env wheel not installed")
+pytest.importorskip("openra_rl_training", reason="Rust env wheel not installed")
+
+from openra_bench.eval_core import run_level
+from openra_bench.scenarios import load_pack
+from openra_bench.scenarios.loader import PACKS_DIR, compile_level
+
+PACK = PACKS_DIR / "def-engineer-repair-under-fire.yaml"
+LEVELS = ("easy", "medium", "hard")
+SEEDS = (1, 2, 3, 4)
+
+
+# ── Policies ───────────────────────────────────────────────────────
+
+
+def _stall_policy():
+    """Observe-only — must LOSE on every (level, seed)."""
+    def pol(obs, Cmd):
+        return [Cmd.observe()]
+    return pol
+
+
+def _repair_only_policy():
+    """Toggle repair on the proc every turn but never engage the
+    attackers. Must LOSE — kill bar is unreachable without committing
+    the hold-fire defenders, and the proc eventually falls anyway."""
+    def pol(obs, Cmd):
+        obldg = obs.get("own_buildings", []) or []
+        for i, b in enumerate(obldg):
+            if b.get("type") == "proc":
+                return [Cmd.repair([str(i)])]
+        return [Cmd.observe()]
+    return pol
+
+
+def _intended_engage_and_repair_policy():
+    """Commit defenders via attack_unit AND toggle repair on the
+    proc. Must WIN on every (level, seed)."""
+    def pol(obs, Cmd):
+        cmds = []
+        obldg = obs.get("own_buildings", []) or []
+        for i, b in enumerate(obldg):
+            if b.get("type") == "proc":
+                cmds.append(Cmd.repair([str(i)]))
+                break
+        units = obs.get("units_summary", []) or []
+        enemies = [
+            e for e in (obs.get("enemy_summary", []) or [])
+            if not e.get("is_building")
+        ]
+        fighters = [
+            u for u in units
+            if u.get("type") in ("e1", "e3", "1tnk", "2tnk", "3tnk")
+        ]
+        if fighters and enemies:
+            cmds.append(
+                Cmd.attack_unit(
+                    [u["id"] for u in fighters], str(enemies[0]["id"])
+                )
+            )
+        if not cmds:
+            cmds = [Cmd.observe()]
+        return cmds
+    return pol
+
+
+# ── Pack-shape tests (cheap; do not run the engine) ────────────────
+
+
+def test_pack_compiles_with_three_levels():
+    pack = load_pack(PACK)
+    assert pack.meta.id == "def-engineer-repair-under-fire"
+    assert pack.meta.capability == "action"
+    assert set(pack.levels) == {"easy", "medium", "hard"}
+
+
+def test_repair_tool_is_in_tools_list():
+    """The load-bearing tool must be exposed for every level."""
+    pack = load_pack(PACK)
+    for lvl in LEVELS:
+        c = compile_level(pack, lvl)
+        assert "repair" in c.scenario.tools, (
+            f"{lvl}: repair must be in tools (got {c.scenario.tools})"
+        )
+
+
+def test_meta_benchmark_anchors_match_doctrine():
+    anchors = (load_pack(PACK).meta.benchmark_anchor or [])
+    joined = " | ".join(a.lower() for a in anchors)
+    assert "disaster recovery" in joined, anchors
+    assert "scv" in joined or "repair" in joined, anchors
+
+
+def test_every_level_has_fail_condition():
+    pack = load_pack(PACK)
+    for lvl in LEVELS:
+        c = compile_level(pack, lvl)
+        assert c.fail_condition is not None, f"{lvl} missing fail_condition"
+
+
+def test_win_predicate_includes_proc_and_fact_and_kill_bar():
+    """Win must require building_count_gte:proc, building_count_gte:fact,
+    units_killed_gte, AND within_ticks — all four together."""
+    for lvl in LEVELS:
+        c = compile_level(load_pack(PACK), lvl)
+        win = c.win_condition.model_dump(exclude_none=True)
+        all_of = win.get("all_of") or []
+        types = []
+        keys: set = set()
+        for clause in all_of:
+            keys |= set(clause.keys())
+            if "building_count_gte" in clause:
+                types.append(clause["building_count_gte"].get("type"))
+        assert "building_count_gte" in keys, (
+            f"{lvl} win missing building_count_gte: {keys}"
+        )
+        assert "proc" in types and "fact" in types, (
+            f"{lvl} win must require both proc AND fact: {types}"
+        )
+        assert "units_killed_gte" in keys, (
+            f"{lvl} win missing units_killed_gte: {keys}"
+        )
+        assert "within_ticks" in keys, (
+            f"{lvl} win missing within_ticks: {keys}"
+        )
+
+
+def test_fail_predicate_drops_proc_or_fact_or_clock():
+    """Fail must trigger when proc OR fact dies, OR the clock expires."""
+    for lvl in LEVELS:
+        c = compile_level(load_pack(PACK), lvl)
+        fail = c.fail_condition.model_dump(exclude_none=True)
+        any_of = fail.get("any_of") or []
+        flat = " ".join(str(c) for c in any_of)
+        assert "after_ticks" in flat, f"{lvl} fail needs after_ticks: {any_of}"
+        assert "proc" in flat, f"{lvl} fail needs proc clause: {any_of}"
+        assert "fact" in flat, f"{lvl} fail needs fact clause: {any_of}"
+
+
+def test_tick_budget_aligned_with_max_turns():
+    """within_ticks AND after_ticks fail clauses must both be
+    reachable inside max_turns."""
+    pack = load_pack(PACK)
+    for lvl in LEVELS:
+        level_def = pack.levels[lvl]
+        max_turns = level_def.max_turns
+        reachable = 93 + 90 * (max_turns - 1)
+        win = compile_level(pack, lvl).win_condition.model_dump(
+            exclude_none=True
+        )
+        fail = compile_level(pack, lvl).fail_condition.model_dump(
+            exclude_none=True
+        )
+
+        def _collect(node, key, out):
+            if isinstance(node, dict):
+                if key in node:
+                    out.append(node[key])
+                for v in node.values():
+                    _collect(v, key, out)
+            elif isinstance(node, list):
+                for v in node:
+                    _collect(v, key, out)
+
+        wts: list = []
+        ats_fail: list = []
+        _collect(win, "within_ticks", wts)
+        _collect(fail, "after_ticks", ats_fail)
+        assert wts, f"{lvl} has no within_ticks leaf"
+        assert ats_fail, f"{lvl} has no after_ticks fail leaf"
+        for wt in wts:
+            assert wt <= reachable, (
+                f"{lvl} within_ticks={wt} > reachable={reachable} "
+                f"(max_turns={max_turns}) — deadline never bites ⇒ draw"
+            )
+        for at in ats_fail:
+            assert at <= reachable, (
+                f"{lvl} fail after_ticks={at} > reachable={reachable} — "
+                f"timeout fail never fires ⇒ draw"
+            )
+
+
+def test_hard_tier_has_seed_driven_spawn_groups():
+    c = compile_level(load_pack(PACK), "hard")
+    sp = {a.spawn_point for a in c.scenario.actors if a.owner == "agent"}
+    assert len(sp) >= 2, f"hard needs ≥2 spawn groups, got {sp}"
+
+
+# ── Engine-bound tests (parameterised over seeds 1..4) ─────────────
+
+
+@pytest.mark.parametrize("seed", SEEDS)
+@pytest.mark.parametrize("level", LEVELS)
+def test_intended_engage_and_repair_wins(level, seed):
+    """The intended commit-defenders + toggle-repair-on-proc policy
+    must WIN on every (level, seed). Load-bearing solvency test."""
+    c = compile_level(load_pack(PACK), level)
+    res = run_level(c, _intended_engage_and_repair_policy(), seed=seed)
+    pb = [t for t, _, _ in res.signals.own_buildings]
+    proc_alive = "proc" in pb
+    fact_alive = "fact" in pb
+    assert res.outcome == "win", (
+        f"intended must WIN on {level} s={seed}; got {res.outcome} "
+        f"turns={res.turns} tick={res.signals.game_tick} "
+        f"kills={res.signals.units_killed} lost={res.signals.units_lost} "
+        f"proc={proc_alive} fact={fact_alive}"
+    )
+
+
+@pytest.mark.parametrize("seed", SEEDS)
+@pytest.mark.parametrize("level", LEVELS)
+def test_stall_loses(level, seed):
+    """Do-nothing must LOSE on every (level, seed). Defenders never
+    engage, kills=0, the rusher band razes the proc."""
+    c = compile_level(load_pack(PACK), level)
+    res = run_level(c, _stall_policy(), seed=seed)
+    assert res.outcome == "loss", (
+        f"stall must LOSE on {level} s={seed}; got {res.outcome} "
+        f"tick={res.signals.game_tick} kills={res.signals.units_killed}"
+    )
+
+
+@pytest.mark.parametrize("seed", SEEDS)
+@pytest.mark.parametrize("level", LEVELS)
+def test_repair_only_loses(level, seed):
+    """Toggle repair on proc every turn but NEVER engage the
+    attackers. Must LOSE — without committed defenders the kill bar
+    is unreachable and the proc eventually falls."""
+    c = compile_level(load_pack(PACK), level)
+    res = run_level(c, _repair_only_policy(), seed=seed)
+    assert res.outcome == "loss", (
+        f"repair-only must LOSE on {level} s={seed}; got {res.outcome} "
+        f"tick={res.signals.game_tick} kills={res.signals.units_killed}"
+    )
+
+
+@pytest.mark.parametrize("seed", SEEDS)
+def test_hard_seeds_produce_distinct_starts(seed):
+    """Hard's two spawn_point groups must round-robin per seed (the
+    test_hard_tier curation contract)."""
+    c = compile_level(load_pack(PACK), "hard")
+    # Stall — deterministic, fast; just confirm the seed flows.
+    res = run_level(c, _stall_policy(), seed=seed)
+    assert res.outcome == "loss"
+    sp = {a.spawn_point for a in c.scenario.actors if a.owner == "agent"}
+    assert len(sp) >= 2

tests/test_hard_tier.py

@@ -903,6 +903,17 @@ UPGRADED = [
     # e1 per group surfaces the variation via units_summary (the base
     # is otherwise building-only).
     "build-rally-point-management",
+    # Wave-8 ACTION pack — disaster-recovery triage / repair-order
+    # doctrine (SC2 SCV repair / SRE triage / military combat-engineer
+    # field-repair anchor). Base of fact + proc + pbox + fix with the
+    # proc pushed forward into the threat lane; grenadier-led `rusher`
+    # band attrites the proc cluster. Hard tier defines two agent
+    # spawn_point groups (NORTH base y=8..16 / SOUTH base y=24..32)
+    # round-robined by seed; symmetric north + south attrition bands
+    # always place (enemy actors don't honour spawn_point — CLAUDE.md)
+    # and the on-latitude band converges on the active proc, so a
+    # memorised opening cannot generalise across seeds.
+    "def-engineer-repair-under-fire",
 ]
 
 # Consciously NOT spawn-varied, with the reason (keeps the curation