KB: Gitea #12 incident findings -- @004bbd04 firing machine recovered, gauge-freeze root cause, dirty-bit gotcha

- decomp-reference: ProjectileWeaponSimulation @004bbd04 FULLY RECOVERED (capstone):
  fault gate reads simulationState@0x40==1 (not simulationFlags); ammo-bin gates;
  Loaded-case view/target denial = SetLevel(4);SetLevel(2) blip BEFORE FeedAmmo;
  updateModel@0x18|=1 is the replication dirty (== ForceUpdate); slot 17 @004b9c9c
  = rechargeLevel writer; FireWeapon @004bcc60 carries no gating.
- gauges-hud: CORRECTION -- launcher recharge dial is NOT authentically static
  (slot 17 @004b9c9c animates it); MP gauge-window freeze root-caused = lobby-built
  gauge tree dangling over the launch mech re-stream + permanent SEH disable.
- reconstruction-gotchas #20: updateModel@0x18 vs simulationFlags@0x28 bit 0
  (DelayWatchersFlag) mis-mapping class (Emitter::SetDirty, mislanch salvo mark).
- open-questions: #12 status ledger -- fixes pending a live-verify window; J/K/L
  preset hypothesis refuted for solo (scripted A/B); symptom-4 pip set unresolved.
- GAUGE_COMPOSITE row 13 verdict corrected (WRONG-STATIC, fix pending).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

context/decomp-reference.md

@@ -199,8 +199,34 @@ From the weapon `.SUB` records + the charge-curve `.data` constants (PE-parsed a
   GENERATOR's `pendingHeat@0x1c8` (~3.5e8/full PPC charge).  `ComputeOutputVoltage` @004ba738
   snaps rechargeLevel@0x320 to 1.0 within 0.01.  **FailureHeat consumers:** `this+0x184`
   (own heatAlarm level) == 2 -> emitter @004baa88 resets firing + holds charge 0; ballistic
-  @004bbd36 pins `recoil=rechargeRate` + alarm 7.  @004bbd04 (ProjectileWeaponSimulation)
-  opens with `call 0x4b0bd0` (the powered/heat step), like @004baa88.  Cockpit power-routing
+  @004bbd36 pins `recoil=rechargeRate` + alarm 7.
+- **@004bbd04 ProjectileWeaponSimulation FULLY RECOVERED (capstone disasm, Gitea #12,
+  2026-07-19) [T1]** — the port's RivetGun-modeled body diverges; the authentic machine:
+  PoweredSubsystemSimulation@4b0bd0; trigger=CheckFireEdge@4b9608; UpdateEject@4bbb50;
+  **gate 1 @4bbd36: `simulationState@0x40==1` (destroyed — NOT simulationFlags@0x28!) ||
+  heatAlarm@0x184==2 || FUN_49fb54(owner disabled) → recoil=rechargeRate + alarm 7**;
+  gate 2 @4bbd71: bin=Resolve(this+0x43c)@417ab4; bin alarm LEVEL@+0x1A8 ∈{2,3} || bin
+  simulationState@0x40==1 → alarm 7 (re-pinned per frame while dry).  switch(alarm@0x364):
+  **Loaded(2) @4bbec2**: on trigger — `viewFireEnable@0x3E0==0 || ownerTarget@[owner+0x388]==0
+  → SetLevel(4);SetLevel(2)` (denial BLIP, stays Loaded, NO ammo pull); else
+  `bin->FeedAmmo@4bd4f4` (fail → stays Loaded silently) → SetLevel(0 Firing) →
+  **`updateModel@0x18 |= 1`** → vtbl+0x48 FireWeapon → (bin level==2 → SetLevel(7)) else
+  (CheckForJam@4bbfcc → SetLevel(5)) else SetLevel(3) → `updateModel|=1` →
+  recoil=rechargeRate.  **Loading(3) @4bbdd2**: trigger → blip 4→3; if
+  electricalState@0x278==4 { DrawFiringCharge@4bbc78; recoil<0 → clamp 0 + (bin level==1 →
+  SetLevel(2)) }; always vtbl+0x44.  **Jammed(5) @4bbe8e**: trigger → 6→5;
+  recoil=rechargeRate.  **7 (unavailable/NoAmmo) @4bbe4d**: trigger → blip 1;
+  re-SetLevel(7) unconditionally (roach motel — permanent once entered);
+  recoil=rechargeRate; vtbl+0x44.  States 0/1/4/6 = transient audio blips (no case body).
+  **vtbl+0x44 (slot 17) @004b9c9c = `rechargeLevel@0x320 = (rechargeRate@0x3DC −
+  recoil@0x3E8)/rechargeRate`** — the projectile recharge-dial writer (Emitter overrides this
+  slot with ComputeOutputVoltage@4ba738).  **MissileLauncher::FireWeapon @004bcc60 carries NO
+  view/target/ammo gating and NO recoil set** (part_013.c:8741+: heat add + spawn descriptor
+  only) — ALL gating lives in the caller's Loaded case.  ⚠ The DIRTY-for-replication bit is
+  `Simulation::updateModel@0x18 |= 1` (== engine `ForceUpdate()`), NOT
+  `simulationFlags@0x28 |= 1` — bit 0 of simulationFlags is the engine **DelayWatchersFlag**
+  (SIMULATE.h): setting it permanently skips the subsystem's ExecuteWatchers (audio watchers).
+  Cockpit power-routing
   handlers @004b099c/@004b09e4/@004b0a2c/@004b0a74 (bind generator by authored id 1-4 via
   @004b0b18) + @004b0abc (auto/manual, modeAlarm@0x2CC); attach/detach @004b0dd8/@004b0e30
   (generator client capacity @0x1e4/count @0x1e8).