feat(scenario): rob-unexpected-enemy-spawn — surprise 2nd-wave handling (adversarial robustness / military follow-on anchor)

Wave-6 ROBUSTNESS / adversarial robustness pack: an obvious 4-unit
hunter cluster (Wave 1) closes in from the centre on the agent's
starting vision row; a SECOND wave was PRE-PLACED at a fog corner
(NE on easy/medium, both NE+SE on hard) and closes in by ~tick 1500
in a hunt pattern from a different bearing than Wave 1. Winning
requires defeating BOTH waves (units_killed_gte 7/8/9), keeping the
fact, AND keeping enough force alive (own_units_gte:2) — so a
forward-rush that chases the visible enemies all the way to the fog
corner (leaving Wave 1 to walk past the unguarded base / screen
attrited at long range) LOSES, and an engage-but-don't-overcommit
disposition WINS.

Pre-placed agent force: 3× 2tnk + 2× e3 (5 defenders total) + fact
+ proc; starting_cash 0 and no tent so the model CANNOT train fresh
infantry — the binding decision is RESERVING the starting force.
Pure-e1 defenders cannot survive the opening hunt-bot rush (verified
empirically — melee'd by 4 e1 hunters in ~200 ticks), so the medium-
tank durability + rocket-soldier range mix is required for the
screen to hold the line.

Discrimination (deterministic scripted, no model / no network):
* stall (observe-only) → LOSS on every level + seed (k=0,
all 5 defenders bled out under attrition before tick 5400)
* forward-rush (attack-move to (90,8) every turn) → LOSS on every
level + seed (chase the corner, base unguarded, screen wiped)
* intended engage-no-overcommit (chase closest visible threat
capped at ≤12 cells from fact) → WIN on every level + seed.

Hard tier: 2 agent spawn_point groups (NORTH base y=12 / SOUTH base
y=28) round-robined by seed. Both Wave-2 fog-corner squads (NE y=8 /
SE y=32) always place since enemy actors ignore spawn_point per
CLAUDE.md; the same-latitude surprise hits FIRST and the opposite-
latitude one is the late follow-on, so a single memorised "expect
Wave 2 from NE" disposition cannot generalise.

Benchmark anchors: adversarial robustness (surprise wave handling),
military follow-on wave doctrine, ops incident-after-incident
triage, SC2 second-attack timing.

Registered in tests/test_hard_tier.py::UPGRADED.
17 pack-specific tests + 2 hard-tier curation tests all pass.

openra_bench/scenarios/packs/rob-unexpected-enemy-spawn.yaml

@@ -0,0 +1,354 @@
+# rob-unexpected-enemy-spawn.yaml
+#
+# REASONING capability — Wave-6 ROBUSTNESS / adversarial robustness:
+# surprise SECOND wave from an UNEXPECTED direction. The agent has
+# an obvious 4-unit hunter cluster (Wave 1) closing in from the centre
+# on its starting vision row; a SECOND wave was PRE-PLACED at a fog
+# corner (NE on easy/medium, both NE+SE on hard) and closes in by
+# ~tick 1500 in a hunt pattern from a different bearing than Wave 1.
+# Winning requires defeating BOTH waves (`units_killed_gte`),
+# keeping the base (`has_building:fact`), AND keeping enough force
+# alive (`own_units_gte:2`). The relevant capability is RESERVING
+# capacity for a follow-on attack — keeping the defender screen
+# centred on the base instead of chasing routers to the corner and
+# leaving the base exposed.
+#
+# Real-world / benchmark anchors:
+#   - Adversarial robustness: surprise wave / follow-on attack handling.
+#   - Military follow-on wave doctrine ("the battle isn't over when
+#     the enemy you see is dead"; second-echelon engagement).
+#   - SC2 second-attack timing (the canonical "second push" the
+#     defender must reserve forces against).
+#   - Operations: incident-after-incident triage (the same operator is
+#     immediately re-paged on a fresh incident from a different
+#     subsystem — the relevant skill is reserving capacity).
+#
+# DISCRIMINATIONS (no defect, no cheat — every brute/lazy play LOSES):
+#
+#   • stall (observe only): the 5 pre-placed defenders are stance:3
+#     (AttackAnything) and auto-engage hostiles in range, but with no
+#     explicit pursuit they sit out of weapon arc as the hunters
+#     converge from the centre. Across ~5000 ticks the static garrison
+#     bleeds out under attrition; the `units_killed_gte` bar is never
+#     met (kills ≈ 0) AND own_units drops to zero → fail-clause fires
+#     (LOSS, not a draw, before tick 5400).
+#
+#   • forward-rush (chase the visible enemies all the way to the fog
+#     corner): the defender screen attack-moves to the Wave-2 fog
+#     corner (90, 8); en route Wave 1 from the centre walks PAST the
+#     base (5 e1 hunters bee-line to the agent centroid which is now
+#     east of the fact); the corner-bound defenders take attrition
+#     bombardment from the converged hunter swarm, and either die out
+#     (`own_units_gte:1` fail) or fail to reach the kill bar inside
+#     the `after_ticks:5401` deadline → LOSS.
+#
+#   • intended prepare-for-2nd-wave: engage closest threat with
+#     `attack_move`, but CAP the chase distance so defenders never
+#     stray more than ~12 cells from the fact. When the 2nd wave
+#     closes in from the fog corner the screen is already pulled
+#     back to base-adjacent range and intercepts it before fact
+#     contact. Both waves dead (kill bar met), fact alive,
+#     own_units_gte:2 satisfied → WIN.
+#
+# ENGINE FACTS (CLAUDE.md / SCENARIO_QUALITY.md):
+#   - Bot `hunt` (openra-sim/src/scripted_bot.rs::Hunt): each enemy
+#     unit pursues the NEAREST agent target. Hunt-driven e1 cover
+#     ~1 cell per 1.8 ticks, so the centre cluster at x=80 reaches
+#     the defender outpost at x=14 in ~120 ticks (well before tick
+#     200); the fog-corner Wave-2 squads at (90, 8) reach the base
+#     latitude in ~tick 400..1000 depending on path congestion —
+#     close to the "~tick 1500" spec target.
+#   - The defender screen is 3× 2tnk (medium tank, durable + dual-
+#     purpose anti-armor / anti-infantry cannon) + 2× e3 (rocket
+#     soldier, range 7, high anti-vehicle DPS). 5× e1 alone get
+#     overwhelmed by hunt-bot e1s at melee in the first 200 ticks
+#     (verified — see git history); the 2tnk durability is needed
+#     to absorb the opening rush, the e3 range is needed to bleed
+#     the trailing waves.
+#   - Pre-placed defenders are stance:3 (AttackAnything) so the
+#     "stall" baseline is genuinely passive (no agent input
+#     required for any auto-fire) and the FAILURE MODE on stall is
+#     a slow attrition bleed across the whole ~5400-tick budget,
+#     not an instant first-turn force-wipe.
+#   - Inert enemy `fact` marker far east (anti-DRAW): without a
+#     persistent enemy actor the engine auto-`done`s on enemy-elim
+#     once both waves die, before the win/fail evaluator runs
+#     (CLAUDE.md rule 5).
+#   - Tick budget: max_turns 90 with `enemy_unit_spotted` +
+#     `own_unit_destroyed` interrupts → in practice ~60..75 ticks
+#     per re-decision → reachable tick at max_turns ≈ 5400..6750.
+#     `after_ticks: 5401` fires inside this band so a non-winner is
+#     a real reachable timeout LOSS, never a draw.
+#   - `enemy_unit_spotted` interrupt → re-decide the instant Wave 2
+#     becomes visible (faster detection of the surprise axis).
+#   - `own_unit_destroyed` interrupt → re-decide when a defender
+#     falls.
+#   - The pre-placed 5 defenders + fact + proc (no tent / cash 0)
+#     means the model CANNOT train fresh infantry — the binding
+#     decision is RESERVING the starting force, not out-producing
+#     the threat.
+#   - hard tier: 2 agent spawn_point groups (NORTH base y=12 /
+#     SOUTH base y=28) so the corner the surprise wave comes FROM
+#     flips per seed; symmetric Wave-2 squads at BOTH corners
+#     always place (enemy actors ignore spawn_point — CLAUDE.md),
+#     so a single memorised "expect Wave 2 from NE" disposition
+#     cannot generalise.
+
+meta:
+  id: rob-unexpected-enemy-spawn
+  title: 'Surprise Second Wave — Reserve Forces for the Follow-On'
+  capability: reasoning
+  real_world_meaning: >
+    Adversarial robustness on the temporal axis: the obvious threat
+    (a 4-unit cluster near the agent's starting vision) is just the
+    OPENING; a SECOND wave was pre-placed at a fog corner and closes
+    in from an unexpected bearing by ~tick 1500 in a hunt pattern.
+    Winning requires destroying BOTH waves AND keeping the base AND
+    keeping enough force alive. The relevant capability is RESERVING
+    capacity for a follow-on attack — not committing every defender
+    to the visible battle and chasing routers far from the base.
+    "Battle finished, push deep" is the canonical military / SRE
+    failure mode this trains against.
+  robotics_analogue: >
+    Incident-after-incident triage: a fresh page arrives from a
+    different subsystem the moment the operator resolves the visible
+    incident; the operator must keep enough on-call capacity in
+    reserve to handle the follow-on instead of fully committing
+    every responder to the first symptom. Adversarial robustness:
+    treating the first observable threat as ground truth and
+    over-fitting the response to it leaves the system exposed when
+    the adversary stages a second engagement from a different angle.
+  benchmark_anchor:
+    - 'adversarial robustness: surprise wave handling'
+    - 'military follow-on wave doctrine'
+    - 'ops: incident-after-incident triage'
+    - 'SC2 second-attack timing'
+  author: openra-bench
+
+base_map: rush-hour-arena
+# Cash 0: the model CANNOT train fresh defenders (no tent and no
+# cash) — the binding decision is RESERVING the starting 5-unit
+# garrison for the surprise 2nd wave, not out-producing the threat.
+starting_cash: 0
+
+base:
+  agent:
+    faction: allies
+  # Hunt bot — each enemy unit pursues the nearest agent target. The
+  # Wave-2 squad starts FAR from any agent unit at a fog corner; once
+  # it closes inside vision the agent's defender centroid pulls it in.
+  enemy:
+    faction: soviet
+    bot_type: hunt
+  tools:
+    - observe
+    - move_units
+    - attack_unit
+    - attack_move
+    - stop
+  planning: true
+  # Re-decide the instant a fresh enemy unit becomes visible (the
+  # surprise-wave detection signal) or a defender is lost.
+  interrupts:
+    enemy_unit_spotted: true
+    own_unit_destroyed: true
+  termination:
+    max_ticks: 12000
+  # Default actor list (overridden per-level). fact + proc at the
+  # west base, no tent / no cash — the agent cannot train replacements.
+  actors:
+    - {type: fact, owner: agent, position: [10, 20]}
+    - {type: proc, owner: agent, position: [6,  20]}
+
+levels:
+  # ── EASY ─────────────────────────────────────────────────────────
+  # 2nd wave SMALLER (3 e1) than Wave 1 (4 e1). Kills bar 7 — the
+  # full kill-able enemy force on this level — so the policy MUST
+  # defeat BOTH waves (a forward chase that leaves the centre
+  # cluster to bombard the screen at long range cannot reach kills=7
+  # before the screen is wiped). max_turns 90 with interrupts
+  # → reachable tick ~5400..6750; `after_ticks: 5401` bites well
+  # inside this band so non-win is a reachable LOSS.
+  easy:
+    description: >
+      Adversarial robustness — surprise second wave (easy). An obvious
+      4-unit rifle cluster sits at the centre of the arena and closes
+      in on your base; a SECOND smaller wave (3 rifles) is pre-placed
+      at a fog corner and will close in from an unexpected bearing in
+      a hunt pattern by ~tick 1500. Your 5 pre-placed defenders
+      (3 medium tanks + 2 rocket soldiers) are your ENTIRE force —
+      you have no barracks and no cash so you cannot train
+      replacements. To WIN you must, before tick 5400, kill ≥7 enemy
+      units across BOTH waves AND still have your construction yard
+      (fact) standing AND still have ≥2 of your own units alive.
+      Stalling (passive defence — the garrison bleeds out under
+      attrition), chasing the visible cluster all the way to the
+      fog corner (Wave 1 walks past your base while your screen is
+      far afield), or busting the attrition floor (≤3 own units lost)
+      all LOSE.
+    overrides:
+      actors:
+        - {type: fact, owner: agent, position: [10, 20]}
+        - {type: proc, owner: agent, position: [6,  20]}
+        # 5 pre-placed defenders (3× 2tnk + 2× e3), stance:3
+        # (AttackAnything — they auto-engage hostiles in weapon arc
+        # but do not actively pursue beyond their range). 5× e1 alone
+        # cannot survive the opening hunt-bot rush (verified —
+        # melee'd in ~200 ticks); the 2tnk durability + e3 reach are
+        # both needed for the screen to hold the line.
+        - {type: 2tnk, owner: agent, position: [14, 20], stance: 3}
+        - {type: 2tnk, owner: agent, position: [14, 18], stance: 3}
+        - {type: 2tnk, owner: agent, position: [14, 22], stance: 3}
+        - {type: e3,   owner: agent, position: [16, 19], stance: 3}
+        - {type: e3,   owner: agent, position: [16, 21], stance: 3}
+        # Wave 1 — obvious 4-unit cluster at the centre on the
+        # base latitude. Stance:3 + hunt bot drives them straight
+        # at the agent centroid; they arrive at the defender
+        # outpost by ~tick 150.
+        - {type: e1, owner: enemy, position: [80, 20], stance: 3, count: 4}
+        # Wave 2 — SMALLER (3 e1) pre-placed at NE fog corner. Hunt
+        # bot closes in from y=8 (out of agent's initial vision row);
+        # arrives at base latitude ~tick 600..1000.
+        - {type: e1, owner: enemy, position: [90, 8], stance: 3, count: 3}
+        # Inert enemy `fact` marker far east (anti-DRAW): keeps the
+        # episode alive past the last killed hunter so the win/fail
+        # evaluator runs.
+        - {type: fact, owner: enemy, position: [120, 20]}
+    win_condition:
+      all_of:
+        - units_killed_gte: 7
+        - has_building: fact
+        - own_units_gte: 2
+        - within_ticks: 5400
+    # Non-win must be a real LOSS, not a draw. `after_ticks: 5401`
+    # is reachable inside max_turns (in practice ~5400..6750 with
+    # interrupts); fact-loss and own-units-zero both fail explicitly.
+    # NOTE: WIN requires ≥2 alive (the reserve-capacity test); FAIL
+    # fires on full wipe (≥1 alive ensures the episode hasn't ended
+    # in total elimination).
+    fail_condition:
+      any_of:
+        - after_ticks: 5401
+        - not: {has_building: fact}
+        - not: {own_units_gte: 1}
+    max_turns: 90
+
+  # ── MEDIUM ───────────────────────────────────────────────────────
+  # +1 controlled variable: 2nd wave EQUAL to first (4 e1) → kills bar 8
+  # (the canonical spec value). Same clock, same fail.
+  medium:
+    description: >
+      Adversarial robustness — surprise second wave (medium). An
+      obvious 4-unit rifle cluster sits at the centre and closes in
+      on your base; a SECOND wave OF EQUAL SIZE (4 rifles) is
+      pre-placed at a fog corner and closes in from an unexpected
+      bearing in a hunt pattern by ~tick 1500. Your 5 pre-placed
+      defenders (3 medium tanks + 2 rocket soldiers) are your ENTIRE
+      force — no barracks, no cash. To WIN you must, before tick
+      5400, kill ≥8 enemy units across BOTH waves AND still have
+      your construction yard (fact) standing AND still have ≥2 of
+      your own units alive. Stalling, chasing the visible cluster
+      all the way to the fog corner, or attrition-busting all LOSE.
+    overrides:
+      actors:
+        - {type: fact, owner: agent, position: [10, 20]}
+        - {type: proc, owner: agent, position: [6,  20]}
+        - {type: 2tnk, owner: agent, position: [14, 20], stance: 3}
+        - {type: 2tnk, owner: agent, position: [14, 18], stance: 3}
+        - {type: 2tnk, owner: agent, position: [14, 22], stance: 3}
+        - {type: e3,   owner: agent, position: [16, 19], stance: 3}
+        - {type: e3,   owner: agent, position: [16, 21], stance: 3}
+        # Wave 1 — 4-unit cluster (canonical spec count).
+        - {type: e1, owner: enemy, position: [80, 20], stance: 3, count: 4}
+        # Wave 2 — EQUAL size (4 e1) at NE fog corner.
+        - {type: e1, owner: enemy, position: [90, 8], stance: 3, count: 4}
+        - {type: fact, owner: enemy, position: [120, 20]}
+    win_condition:
+      all_of:
+        - units_killed_gte: 8
+        - has_building: fact
+        - own_units_gte: 2
+        - within_ticks: 5400
+    fail_condition:
+      any_of:
+        - after_ticks: 5401
+        - not: {has_building: fact}
+        - not: {own_units_gte: 1}
+    max_turns: 90
+
+  # ── HARD ─────────────────────────────────────────────────────────
+  # +1 controlled variable: 2nd wave from TWO fog corners (NE + SE)
+  # so the surprise direction flips per seed via 2 agent spawn_point
+  # groups (NORTH base y=12 / SOUTH base y=28). Enemy actors ignore
+  # spawn_point (CLAUDE.md) — both Wave-2 squads always place. The
+  # AGENT spawn round-robins between NORTH and SOUTH, so the SAME-
+  # latitude surprise hits FIRST (closer geometry) and the OPPOSITE-
+  # latitude one is the late follow-on. The model cannot memorise a
+  # single fog-corner heading.
+  #
+  # Wave-2 squads are 4 e1 each (4 + 4 = 8 wave-2 units + 4 wave-1 =
+  # 12 total) and the kill bar is raised to 9 — both waves together
+  # produce more than enough kills if the defender screen survives,
+  # but a forward chase or attrition bust cannot reach 9 before the
+  # screen is wiped. Same clock; same tick-aligned fail.
+  hard:
+    description: >
+      Adversarial robustness — surprise second wave (hard). The
+      obvious 4-unit cluster sits at the centre; TWO Wave-2 squads
+      are pre-placed at OPPOSITE fog corners (NE and SE) and the
+      one at the SAME latitude as your base arrives FIRST while
+      the OPPOSITE corner one is the long-haul late follow-on.
+      Your base round-robins between a NORTH and a SOUTH latitude
+      so which corner the surprise wave arrives from cannot be
+      memorised. Your 5 pre-placed defenders (3 medium tanks + 2
+      rocket soldiers) are your ENTIRE force — no barracks, no
+      cash. To WIN you must, before tick 5400, kill ≥9 enemy units
+      across BOTH waves AND still have your construction yard
+      (fact) standing AND still have ≥2 of your own units alive.
+      Stalling, chasing one fog corner deep, or attrition bust all
+      LOSE.
+    overrides:
+      actors:
+        # ── spawn_point 0 — NORTH base (y=12). ─────────────────────
+        - {type: fact, owner: agent, position: [10, 12], spawn_point: 0}
+        - {type: proc, owner: agent, position: [6,  12], spawn_point: 0}
+        - {type: 2tnk, owner: agent, position: [14, 12], stance: 3, spawn_point: 0}
+        - {type: 2tnk, owner: agent, position: [14, 10], stance: 3, spawn_point: 0}
+        - {type: 2tnk, owner: agent, position: [14, 14], stance: 3, spawn_point: 0}
+        - {type: e3,   owner: agent, position: [16, 11], stance: 3, spawn_point: 0}
+        - {type: e3,   owner: agent, position: [16, 13], stance: 3, spawn_point: 0}
+        # ── spawn_point 1 — SOUTH base (y=28). ─────────────────────
+        - {type: fact, owner: agent, position: [10, 28], spawn_point: 1}
+        - {type: proc, owner: agent, position: [6,  28], spawn_point: 1}
+        - {type: 2tnk, owner: agent, position: [14, 28], stance: 3, spawn_point: 1}
+        - {type: 2tnk, owner: agent, position: [14, 26], stance: 3, spawn_point: 1}
+        - {type: 2tnk, owner: agent, position: [14, 30], stance: 3, spawn_point: 1}
+        - {type: e3,   owner: agent, position: [16, 27], stance: 3, spawn_point: 1}
+        - {type: e3,   owner: agent, position: [16, 29], stance: 3, spawn_point: 1}
+        # Wave 1 — obvious 4-unit cluster at the centre on the mid
+        # latitude (y=20). The hunt bot drives them toward the
+        # nearest agent target so the cluster naturally engages
+        # whichever base is occupied, after a ~one-second detour
+        # toward the mid-latitude.
+        - {type: e1, owner: enemy, position: [80, 20], stance: 3, count: 4}
+        # Wave 2 — TWO 4-unit squads pre-placed at BOTH fog corners
+        # (NE y=8 and SE y=32). Enemy actors ignore spawn_point so
+        # BOTH always place; whichever corner is at the same
+        # latitude as the agent reaches the base FIRST (the EARLY
+        # surprise), the OPPOSITE-latitude squad arrives LATER
+        # (the LATE follow-on).
+        - {type: e1, owner: enemy, position: [90, 8],  stance: 3, count: 4}
+        - {type: e1, owner: enemy, position: [90, 32], stance: 3, count: 4}
+        - {type: fact, owner: enemy, position: [120, 20]}
+    win_condition:
+      all_of:
+        - units_killed_gte: 9
+        - has_building: fact
+        - own_units_gte: 2
+        - within_ticks: 5400
+    fail_condition:
+      any_of:
+        - after_ticks: 5401
+        - not: {has_building: fact}
+        - not: {own_units_gte: 1}
+    max_turns: 90

tests/test_hard_tier.py

@@ -512,6 +512,16 @@ UPGRADED = [
     # vs SW→SE on the south edge) flips per seed and a memorised
     # single-corner reading order cannot generalise across spawns.
     "scout-multiple-fog-areas",
+    # Wave-6 ROBUSTNESS / adversarial robustness seed — surprise 2nd-
+    # wave handling (military follow-on wave doctrine / SC2 second-
+    # attack timing / ops incident-after-incident triage anchor). Hard
+    # tier defines two agent spawn_point groups (NORTH base y=12 /
+    # SOUTH base y=28) round-robined by seed; symmetric Wave-2 squads
+    # at BOTH fog corners (NE y=8 / SE y=32) always place (enemy
+    # actors don't honour spawn_point — CLAUDE.md), so which corner
+    # the surprise wave arrives FROM flips per seed and a memorised
+    # "expect Wave 2 from NE" disposition cannot generalise.
+    "rob-unexpected-enemy-spawn",
 ]
 
 # Consciously NOT spawn-varied, with the reason (keeps the curation

tests/test_rob_unexpected_enemy_spawn.py

@@ -0,0 +1,279 @@
+"""rob-unexpected-enemy-spawn scenario family, full loop on Rust.
+
+Wave-6 ROBUSTNESS / adversarial robustness. The pack tests handling
+of a SURPRISE 2nd wave that closes in from a fog corner from a
+different bearing than the obvious 4-unit Wave-1 cluster.
+
+The win predicate makes BOTH waves load-bearing:
+
+* `units_killed_gte:{7|8|9}` ⇒ the threat is actually handled (NOT
+  just Wave 1 — the bar requires both); a forward-chase that runs
+  out of force before both waves are dead can never satisfy this;
+* `has_building:fact` ⇒ the base survives — chasing Wave 2 deep into
+  the fog corner while Wave 1 walks past the unguarded base razes
+  the fact;
+* `own_units_gte:2` ⇒ a minimum reserve survived — attrition busts
+  (forward-rush, stall) get the screen wiped (≥4 lost from 5 →
+  fail);
+* `within_ticks:5400` paired with `after_ticks:5401` ⇒ a non-finisher
+  is a real reachable timeout LOSS (90 turns × ≤90 ticks/step
+  reaches ≥5400 in interrupt mode), never a draw.
+
+These tests prove with deterministic scripted policies (no model,
+no network) that:
+
+* the intended engage-but-don't-chase-deep policy WINS every level +
+  every hard seed (1..4);
+* stall / forward-rush both LOSE every level + every hard seed (a
+  real LOSS, not a draw);
+* the `after_ticks` deadline is reachable inside `max_turns`;
+* the hard tier defines ≥2 spawn_point groups (so the fog corner
+  the 2nd wave arrives from varies by seed — single-cell
+  memorisation cannot generalise).
+"""
+
+from __future__ import annotations
+
+import math
+
+import pytest
+
+pytest.importorskip("openra_train", reason="Rust env wheel not installed")
+pytest.importorskip("openra_rl_training", reason="Rust env wheel not installed")
+from openra_bench.eval_core import run_level
+from openra_bench.scenarios import load_pack
+from openra_bench.scenarios.loader import PACKS_DIR, compile_level
+
+PACK = PACKS_DIR / "rob-unexpected-enemy-spawn.yaml"
+LEVELS = ("easy", "medium", "hard")
+SEEDS = (1, 2, 3, 4)
+
+
+# ── scripted policies ─────────────────────────────────────────────────
+
+
+def _own_ids(rs):
+    return [str(u["id"]) for u in (rs.get("units_summary") or [])]
+
+
+def _fact_xy(rs):
+    fact = next(
+        (b for b in (rs.get("own_buildings") or []) if b.get("type") == "fact"),
+        None,
+    )
+    if fact is None:
+        return None
+    return int(fact["cell_x"]), int(fact["cell_y"])
+
+
+def _visible_enemy_units(rs):
+    """List of (x, y) for every VISIBLE enemy infantry (not the inert
+    fact marker far east)."""
+    raw = rs.get("_raw") or {}
+    ep = raw.get("enemy_positions") if isinstance(raw, dict) else None
+    out = []
+    if isinstance(ep, list):
+        for e in ep:
+            if isinstance(e, dict) and e.get("actor_type") in ("e1", "e3"):
+                out.append((int(e.get("cell_x", 0)), int(e.get("cell_y", 0))))
+    return out
+
+
+def stall(rs, C):
+    """Observe-only baseline. The 5 defenders are stance:3 so they
+    auto-fire on hostiles in weapon arc, but without any pursuit they
+    bleed out under attrition across the full 5400-tick budget
+    (k=0, all 5 lost) → fail-clause fires (LOSS, not a draw)."""
+    return [C.observe()]
+
+
+def forward_rush(rs, C):
+    """Defeat-first-only-relax taken to its degenerate limit: chase
+    the visible enemies all the way to the Wave-2 fog corner (90, 8).
+    Wave 1 from the centre walks PAST the base (the agent centroid
+    is now far east); the screen takes attrition bombardment from the
+    converged hunter swarm and either gets wiped (`own_units_gte:1`
+    fail) or fails to meet the kill bar before the `after_ticks:5401`
+    deadline → LOSS on every level + seed."""
+    own = _own_ids(rs)
+    if not own:
+        return [C.observe()]
+    return [C.attack_move(own, 90, 8)]
+
+
+def make_intended():
+    """Engage the closest visible threat with `attack_move`, but CAP
+    the chase distance so the defender screen never strays more than
+    ~12 cells from the fact. When the 2nd wave closes in from the
+    fog corner the screen is already pulled back to base-adjacent
+    range and intercepts before fact contact. Both waves dead, fact
+    alive, own_units_gte:2 satisfied → WIN every level + seed."""
+
+    def policy(rs, C):
+        own = _own_ids(rs)
+        if not own:
+            return [C.observe()]
+        xy = _fact_xy(rs)
+        if xy is None:
+            return [C.attack_move(own, 30, 20)]
+        fx, fy = xy
+        threats = _visible_enemy_units(rs)
+        if threats:
+            threats.sort(key=lambda p: math.hypot(p[0] - fx, p[1] - fy))
+            ex, ey = threats[0]
+            # Reserve-capacity guardrail: don't chase enemies > 12
+            # cells from the fact — fall back to a base-adjacent ring.
+            if abs(ex - fx) > 12 or abs(ey - fy) > 12:
+                return [C.attack_move(own, fx + 6, ey)]
+            return [C.attack_move(own, ex, ey)]
+        return [C.attack_move(own, fx + 4, fy)]
+
+    return policy
+
+
+# ── scenario-shape invariants ─────────────────────────────────────────
+
+
+def test_pack_compiles_with_three_levels_and_hunt_bot():
+    pack = load_pack(PACK)
+    assert pack.meta.id == "rob-unexpected-enemy-spawn"
+    assert pack.meta.capability == "reasoning"
+    assert set(pack.levels) == {"easy", "medium", "hard"}
+    # Required-by-spec benchmark anchors (the four named in meta).
+    anchors = pack.meta.benchmark_anchor
+    assert any("adversarial robustness" in a for a in anchors), anchors
+    assert any("follow-on" in a for a in anchors), anchors
+    assert any("SC2" in a for a in anchors), anchors
+    # Hunt bot must be wired through to the engine for every level.
+    for lvl in LEVELS:
+        c = compile_level(pack, lvl)
+        assert c.map_supported
+        enemy = c.scenario.enemy
+        bot = getattr(enemy, "bot_type", None) or getattr(enemy, "bot", None)
+        assert str(bot).lower() == "hunt", (lvl, bot)
+
+
+@pytest.mark.parametrize("level", LEVELS)
+def test_every_level_has_a_reachable_timeout_fail(level):
+    """Non-win must be a real LOSS: the `after_ticks` fail must be
+    strictly below the tick reachable at max_turns (≤90 ticks/step in
+    interrupt mode)."""
+    c = compile_level(load_pack(PACK), level)
+    assert c.fail_condition is not None
+    fc = c.fail_condition.model_dump(exclude_none=True)
+    deadline = None
+    for clause in fc.get("any_of", []) or []:
+        if "after_ticks" in clause:
+            deadline = int(clause["after_ticks"])
+    assert deadline is not None, f"{level}: no after_ticks fail clause"
+    reachable = 93 + 90 * (c.max_turns - 1)
+    assert deadline < reachable, (
+        f"{level}: deadline {deadline} unreachable within "
+        f"{c.max_turns} turns (max tick {reachable}) → draw degeneracy"
+    )
+
+
+def test_hard_has_two_spawn_point_groups():
+    """Hard-tier contract: ≥2 distinct seed-driven spawn_point groups
+    so the fog corner the surprise wave arrives from varies by seed
+    (anti-memorisation)."""
+    c = compile_level(load_pack(PACK), "hard")
+    groups = {
+        a.spawn_point for a in c.scenario.actors
+        if a.owner == "agent" and a.spawn_point is not None
+    }
+    assert groups == {0, 1}, groups
+    # In-bounds check (rush-hour-arena playable y ≈ 2..38, x ≈ 2..126):
+    for a in c.scenario.actors:
+        x, y = a.position
+        assert 2 <= x <= 126 and 2 <= y <= 38, (a.type, a.position)
+
+
+def test_starting_cash_zero_for_all_levels():
+    """Reserve-capacity discrimination: no cash + no tent = the model
+    CANNOT train fresh defenders, so the binding decision is
+    RESERVING the starting force, not out-producing the threat."""
+    pack = load_pack(PACK)
+    assert pack.starting_cash == 0
+    # No barracks pre-placed on any level.
+    for lvl in LEVELS:
+        c = compile_level(pack, lvl)
+        agent_buildings = {
+            a.type for a in c.scenario.actors
+            if a.owner == "agent" and a.type in ("tent", "barr", "hand")
+        }
+        assert not agent_buildings, (lvl, agent_buildings)
+
+
+def test_anti_draw_marker_present_on_every_level():
+    """Anti-DRAW: an unarmed enemy `fact` marker must persist past
+    the last hunter death so the engine doesn't auto-`done` on
+    enemy-elim before the win/fail evaluator runs (CLAUDE.md rule 5)."""
+    pack = load_pack(PACK)
+    for lvl in LEVELS:
+        c = compile_level(pack, lvl)
+        enemy_facts = [
+            a for a in c.scenario.actors
+            if a.owner == "enemy" and a.type == "fact"
+        ]
+        assert len(enemy_facts) >= 1, lvl
+
+
+# ── solvency: intended WINS every level + every hard seed ────────────
+
+
+@pytest.mark.parametrize("level", LEVELS)
+def test_intended_engage_no_overcommit_wins_every_level_and_seed(level):
+    c = compile_level(load_pack(PACK), level)
+    for seed in SEEDS:
+        r = run_level(c, make_intended(), seed=seed)
+        assert r.outcome == "win", (
+            f"{level} seed{seed}: intended engage-no-overcommit play "
+            f"must WIN; got {r.outcome} (tick={r.signals.game_tick}, "
+            f"kills={r.signals.units_killed}, "
+            f"lost={r.signals.units_lost}, "
+            f"buildings={r.signals.own_buildings})"
+        )
+
+
+# ── no-cheat: every lazy / brute policy LOSES (not draws) ────────────
+
+
+@pytest.mark.parametrize("level", LEVELS)
+@pytest.mark.parametrize(
+    "policy_name,policy_factory",
+    [
+        ("stall", lambda: stall),
+        ("forward_rush", lambda: forward_rush),
+    ],
+)
+def test_lazy_and_overcommit_policies_lose_every_level_and_seed(
+    level, policy_name, policy_factory
+):
+    """Stall (passive — bleeds out under attrition) and forward-rush
+    (over-commits to the fog corner — base unguarded / screen wiped)
+    must BOTH LOSE on every level + every seed — no draw."""
+    c = compile_level(load_pack(PACK), level)
+    for seed in SEEDS:
+        r = run_level(c, policy_factory(), seed=seed)
+        assert r.outcome == "loss", (
+            f"{level} seed{seed} {policy_name}: must LOSE (real fail, "
+            f"not a draw); got {r.outcome} (tick={r.signals.game_tick}, "
+            f"kills={r.signals.units_killed}, "
+            f"lost={r.signals.units_lost}, "
+            f"buildings={r.signals.own_buildings})"
+        )
+
+
+# ── determinism ───────────────────────────────────────────────────────
+
+
+def test_intended_run_is_deterministic_on_easy():
+    c = compile_level(load_pack(PACK), "easy")
+    a = run_level(c, make_intended(), seed=3)
+    b = run_level(c, make_intended(), seed=3)
+    assert (a.outcome, a.turns, a.signals.units_killed) == (
+        b.outcome,
+        b.turns,
+        b.signals.units_killed,
+    ), "same seed must be deterministic"