Torso: the TWIST goes LIVE -- electrical watchdog chain, centered crosshair, coherent controls (task #57/#58)

The MadCat torso twists, the view turns with it, and targeting follows.
Three reconstruction fronts closed:

THE ELECTRICAL WATCHDOG CHAIN (why the torso never powered up):
- PowerWatcher::UpdateWatch reconstructed (@004b181c, the REAL registered
  Performance -- PTR @0050f5fc; Ghidra missed the fn start): the watchdog
  MIRRORS the watched subsystem's electrical level (+0x278), brownout
  downgrade when gen output <= minVoltage% x rated.  @004b1804 relabeled
  ResetToInitialState (slot 10) -- the old "Simulation" tag was wrong.
- The factory watcher-CONNECT pass reconstructed (vtable slot +0x38,
  @004aee2c/@004b1a40 byte-identical, recovered from raw exe bytes):
  watchedLink.Add(roster[watchedSubsystem]) on the master node.  Was the
  SubProxy::Start() no-op -- every watchdog sat at 0 forever.
- MinVoltageScale = 0.01 (a 10-byte x87 literal @0x4b1924; was 1.0f =
  permanent brownout) and PowerWatcher's Derivation chains its REAL base
  HeatWatcher (the HeatableSubsystem stand-in broke IsDerivedFrom for the
  whole Torso/Searchlight/ThermalSight family).
- KB correction swept: derivation tag 0x50e604 = HEATWATCHER (not
  "HeatSink"); the btl4gaug heat-widget gate now tests it via the
  BTIsHeatWatcher bridge.

THE CROSSHAIR (task #58 forensics, 6-agent workflow + live probes):
- The VIEW is TORSO-MOUNTED: jointtorso -> jointeye -> siteeyepoint in
  every twist-capable .SKL; the camera + canopy ride the same hinge
  subtree through HingeRenderable's live matrix-stack compose -- ALREADY
  WORKING in the port.  The crosshair stays screen-centered (center IS
  the boresight); the twist reads on the tape carets/compass/radar.
- The real bug was the port's gBTAimX = tan(twist) slew (the falsified
  "body-mounted view" model): the camera already carried the twist, so
  the crosshair counter-slid to hull-forward and the fire ray with it.
  Deleted; the pick ray inherits the twist from the yawing eye basis.
- Two instrumentation traps documented (chase-eye-as-default-camera,
  BT_FORCE_TORSO clobbering real joints -> the hook now only fills
  unresolved ones); an over-correcting explicit eye compose was added on
  those false readings and retired the same day.

CONTROLS + REPLICATION:
- Q/E spring-center on release (the axis is a twist-RATE demand; the old
  hold-deflection model drifted forever); X also zeroes the axis and
  pulses the authentic torso Recenter (@004b6918).  M cycles control
  mode via the real CycleControlMode body.
- Torso update-record DIRECTION fixed: engine truth is Write=serialize /
  Read=apply; @004b6a78 is the READ (was mislabeled Write) and the
  missing WRITE @004b6a1c recovered from raw disasm (recordLength 0x1C,
  twist/vel/rate at +0x10/14/18) -- kills the replicant's 0xCDCDCDCD
  -140-degree ghost twist.
- Marching-ghost desync: 4 Standing-case guards zero stale reverse
  cycleSpeed (negative cadence passed the <= ZeroSpeed stop gate).
- Kill credit rerouted to the OBSERVED killer (lastInflictingID ->
  killer's player link) -- kills count, target K/D populates.

KB: subsystems.md (watcher chain), multiplayer.md (record direction),
combat-damage.md + gauges-hud.md + cockpit-view.md (torso-mounted view
re-correction), decomp-reference.md (new addresses + tag fix),
open-questions.md (dead capability-roster loops 2-4, snapshot CD read).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

context/open-questions.md

@@ -21,7 +21,43 @@ authentic path scoped.
 - Pod specifics for Phase 8: the 7-monitor driver setup, the RIO cockpit I/O protocol, current
   Win10+wrapper pod config. Status: OPEN.
 
+## BINARY-COVERAGE AUDIT discoveries (2026-07-13, 6-agent decomp census) [T1 verified-uncited]
+New unaccounted functionality no prior list knew (addresses verified absent from game/+context/+docs):
+- **`BTL4VideoRenderer::StartEntityEffectImplementation` @004d097c** (+helpers @4d0c14/@4d0c5c,
+  ~93 ln) — the per-zone EFFECT DISPATCHER, vtable-dispatched from the engine's
+  StartEntityEffectMessageHandler (hence invisible to address-grep).  Body fully mapped: zone
+  position (+0x74), video index (+0xc4→+0xc0), jointToDCS socket (+0x3a4, in CLASSMAP),
+  SearchList type 10, atoi-dispatch into the SAME effect-number bands the port already serves
+  (>=1000 psfx ✓, 3-15 specialfx ✓, 104 SwapToWreck ✓).  **The whole per-zone damage/destruction
+  visual chain is dead without it.  RECOMMENDED NEXT TARGET (S/M).**
+- **Six L4VIDRND effect-renderable bodies** @4540ac/45447c/455eb8/456cf0/4589e0/458e5c (~576 ln)
+  incl. the 40-param ScalingExplosionRenderable ctor ExplosionScripts calls 6× — the live 1995
+  bodies behind the STUBBED markers (wreck flames/booms land into these).
+- **FUN_00472480** (273 ln) — unnamed analog→discrete stepper Execute in the gauge band
+  (hysteresis + key-repeat), no caller found; the one hole in "gauge system complete".
+  Settle via vtable lookup (plausibly a config/roster scroller).
+- **FUN_00454a70** (193 ln) — the PNAME1-8/PLACE1-8.bgf MP name-billboard loader (the known
+  "MP target identification" gap's exact function).
+- **Explosion::SplashDamage @0042fad0** — substantial, unreferenced, directly in the combat
+  path; one-time diff vs engine EXPLODE.cpp would rule out 1995-vs-WinTesla falloff drift.
+- **The binary's own VelociRender BGF/BMF/BSL/VTX loader (~4,550 ln, dead code)** — a free
+  ground-truth cross-check for [[bgf-format]]/[[asset-formats]] claims.
+Full ranked audit: the workflow output (2026-07-13); top-10 ranking cross-checked against this
+register.  ⚠ The audit also flags the damage-economy item as SELF-CONTRADICTORY in the KB
+(task #8 "landed" vs the kShotDamage=12 bring-up residue) — audit before reworking.
+
 ## Deferred subsystems / feeds (authentic path scoped, marked in code)
+- **Factory capability-roster loops 2-4 are STILL DEAD (task #57 discovery).** mech.cpp's
+  post-roster loops add to `heatableSubsystems`(0x51155c)/`weaponRoster`(0x511830)/
+  `damageableSubsystems`(0x50e4fc) through the local `SubProxy` stub whose `IsDerivedFrom`
+  RETURNS 0 — so those three mech-level rosters stay EMPTY (whatever consumes them sees
+  nothing; weapons demonstrably work through other paths, so audit consumers before assuming
+  impact). Loop 1 (the watcher CONNECT, 0x50e604) was reconstructed for real in task #57 —
+  use the same bridge pattern (family-side derivation test + typed body) for the other three. [T2]
+- **Initial-snapshot torso record carries no twist extras**: the replicant's blind +0x10 read
+  can latch 0xCDCDCDCD ONCE at spawn until the first real twist record; clamps contain it
+  (invisible on fixed-torso mechs). Binary-authentic blind read — fix only if a visibly wrong
+  spawn pose ever surfaces. See [[multiplayer]]. [T2]
 - **✅ 0xBD3 SubsystemMessageManager — UNTANGLED + LIVE (task #7, 2026-07-11) [T1/T2].**
   Both halves landed: (1) the factory case builds the REAL messmgr (ctor @0049bca4, 0x130,
   static reconstruction messmgr.cpp) cached at `mech+0x434` — the binary-wide census found