#110: the zone destruction cascade is LIVE -- an arm now takes its gun pod with it

Lynx: "You can destroy an upper arm, and the gun pod is intact and can still
fire."  Conn Man's audit: three chassis, both arms, reproducible.  And the user
is right that this family was claimed fixed before: #86 gated fire on the
WEAPON's own destruction and was verified by destroying the weapon directly
(BT_KILL_SUBSYS) -- the field scenario was the ARM ZONE dying with the weapon
subsystem healthy, which that bench never reproduced.  Oracle's 693-night "I can
still fire destroyed energy weapons" was almost certainly this mechanism.

ROOT CAUSE -- a silent stub.  Mech__DamageZone::RecurseSegmentTable @0049cad4
was transcribed faithfully... against three local shim types whose iterators
unconditionally return NULL:
    struct SegmentIterator { DZRef *Next() { return 0; } };
    struct SegTableX       { SegmentRecord *operator[](int) { return 0; } };
The cascade fired on zone death (bench: 72 [cascade] lines), "descended", and
touched nothing.  Every line read correct; none of it did anything.

THE REAL WALK (decomp re-read, FUN_0049cad4): iterate the mech's segment table
(mech+0x300, vtbl+0x34 GetNth) to this zone's segment, then
    destroySiblingsOnDestruction (Wword 0x68): recurse every other zone on the
        SAME segment (seg+0xD0), setting graphic state 2 (Gone)
    descendOnDestruction (Wword 0x67): recurse every zone on every CHILD
        segment (seg+0xE8 -> child+0xD0) -- the arm takes the gun
The engine ALREADY HAS both structures: EntitySegment::damageZoneTable @0xD0 /
childIndexTable @0xE8 (TableOf is 0x18 -- byte-identical to the decomp offsets),
populated at stream time by JMOVER.cpp:373 [T0].  The stub was never necessary.
Implemented with the engine iterators via two new read accessors on
EntitySegment (SEGMENT.h); the binary's asymmetry is reproduced as-is (the
sibling loop checks graphic state != 1, the child loop does not; re-hits on a
1.0 zone re-run the cascade -- idempotent in effect).

VERIFIED (ava1, self-damage to one zone, autofire everything):
  dz_rarm -> [cascade] zone 9 -> zone 17; AFC100 + AmmoBinAFC100 + Condenser6
      ForceCriticalFailure'd; "[ammo] AFC100 -> NoAmmo (gate1): destroyed=1";
      torso LRM5/SRM2 keep firing (correct)
  dz_larm -> [cascade] zone 2 -> zone 6; PPC + Condenser4 force-failed;
      "[emitter] 'PPC' fire REFUSED (destroyed=1)" x4998 -- the emitter gate now
      logs refusals BY NAME (the FIRED line never named its weapon, which is how
      #86's verification gap survived)
  regression smoke: frame time 7.13/7.20ms, 0 asserts, 0 cascades in ordinary
      combat (they fire only on genuine zone deaths)

Authored data (now dumped under BT_DMG_LOG): descend=1 on exactly the four arm
zones (ava1: 2/6/9/17), destroySibs=0 everywhere -- so legs/torso behavior is
untouched by this change.

KB: combat-damage.md cascade section; reconstruction-gotchas #26 (the
silent-stub trap: a shim that returns EMPTY converts a reconstruction into
fiction that reads correct -- shims must Fail() loudly or log their emptiness).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

context/combat-damage.md

@@ -939,6 +939,32 @@ the subsystem TakeDamage virtual into its PRIVATE crit zone). Un-won rolls land
 same way. Measured on bhk1 (mass 60000, e=0.2): scale 4.5e-5; a 94k spawn-slam = 4.2 rattle
 points; taps free. `[colldmg]` (BT_DMG_LOG) + `[crashdmg]` (always-on, rare) are the probes.
 
+## The zone DESTRUCTION CASCADE is live -- an arm takes its gun (#110, 2026-08-02) [T1 decomp / T2 verified]
+
+`Mech__DamageZone::RecurseSegmentTable @0049cad4`: when a zone reaches damageLevel
+1.0 (non-leg, non-vital path in TakeDamage), the binary walks the mech's SEGMENT
+TREE (mech+0x300, the engine `JointedMover::segmentTable` [T0]):
+  * `destroySiblingsOnDestruction` (streamed, Wword 0x68) -> every other zone on
+    the SAME segment (`EntitySegment::damageZoneTable`, seg+0xD0) recurses and is
+    set graphic state 2 (**Gone**);
+  * `descendOnDestruction` (Wword 0x67) -> every zone on every CHILD segment
+    (`childIndexTable` seg+0xE8 -> child's damageZoneTable) recurses -- **the arm
+    takes the gun pod with it**.  Each recursed zone's `SendSubsystemDamage
+    @0049c9a8` pushes the unused crit allotment and `ForceCriticalFailure`s any
+    subsystem driven to 1.0 -- which the #86 fire gates then refuse.
+Authored (measured, ava1): descend=1 on the four arm zones (2/6/9/17); everything
+else 0.  Verified live: dz_rarm destroyed -> zone 17 cascades -> AFC100 + bin +
+Condenser6 force-failed, `AFC100 -> NoAmmo (gate1): destroyed=1`; dz_larm -> PPC
+force-failed, `[emitter] 'PPC' fire REFUSED (destroyed=1)` x4998.  Torso weapons
+unaffected.  Re-entry note: every further hit on a 1.0 zone re-runs the cascade
+(no guard in the binary's child loop; only the sibling loop checks graphic state
+!= 1) -- authentic, idempotent in effect.
+
+⚠ The walk was a SILENT STUB until 2026-08-02 (three shim types whose iterators
+returned NULL) -- the cascade "ran" and touched nothing, which is why blown-off
+arms left firing gun pods across every chassis (Conn Man's three-chassis audit).
+See reconstruction-gotchas #25.
+
 ## Key Relationships
 - Weapons/roster: [[subsystems]]. Aim source: [[locomotion]] (drive/facing). Effects: [[rendering]].
 - P5 forensics: `docs/HARD_PROBLEMS.md`. Data: [[decomp-reference]] §4-5.

context/reconstruction-gotchas.md

@@ -774,3 +774,24 @@ splash code derives it from a distance falloff — nobody spends instructions ro
 value.  **If a field is called dead, ask who still writes it, and why.**
 **Rule:** tag the VERIFIED clause, not the paragraph.  An inference sitting next to a [T1] fact is
 still [T4] — split them, or the next reader (including you) will build on the guess.
+
+## 26. The SILENT-STUB walk: empty iterators make a faithful-looking mechanism a no-op (#110)
+
+`RecurseSegmentTable` was "reconstructed" against local shim types whose
+iterators unconditionally returned NULL (`SegmentIterator::Next() { return 0; }`,
+`SegTableX::operator[] { return 0; }`).  Every line of the walk mirrored the
+binary -- and none of it did anything: the destruction cascade fired, logged,
+"descended", and touched no other zone.  The symptom (gun pods surviving their
+blown-off arms) was field-reported for weeks while the code READ correct.
+
+The trap: a stub that returns EMPTY (rather than asserting/crashing) converts a
+reconstruction into silent fiction, and the no-stand-ins rule cannot catch it by
+reading the call site -- the stand-in hides in the TYPES.  The engine already had
+the real structures (`EntitySegment::damageZoneTable` / `childIndexTable`, T0,
+byte-matching the decomp's seg+0xD0/+0xE8) -- the stub was never necessary.
+
+Rules: (a) when a reconstructed mechanism runs but nothing downstream changes,
+grep its helper types for `return 0` bodies FIRST; (b) a bring-up shim must
+either Fail() loudly or log its own emptiness, never silently iterate nothing;
+(c) before shimming an engine-side structure, check whether the engine already
+has it -- the offsets in the decomp comment ARE the lookup key.