diff --git a/context/combat-damage.md b/context/combat-damage.md
index c9af100..803ba8f 100644
--- a/context/combat-damage.md
+++ b/context/combat-damage.md
@@ -148,6 +148,35 @@ port's external camera exposes it, so the arc is gated on the **torso twist rang
 (`BT_FIRE_ARC`, a labeled PORT presentation param). Beams fire from the mech's real gun-port SITE
 segments (siterugunport etc.) resolved via `GetSegment(name)→segmentToEntity×localToWorld`. [T2]
 
+## REAR-FIRE + look views (task #68, 2026-07-16) [T1]
+The pod had a rear arsenal + a five-state LOOK-VIEW system (all reconstructed + live):
+- **weapon.rearFiring @0x334** = the MOUNT SEGMENT page name contains 'b' (ctor marker @0x511aa2;
+  the back ports `sitelbgunport`/`siterbgunport`). Roster survey: **the Blackhawk's ERMLaser_2/3
+  are the ONLY rear weapons in the game** (both loadout variants; the Owens model HAS back ports
+  but mounts nothing on them; every missile rack is forward).
+- **mech.rearFiring @0x410** = OR of the weapons' flags (ctor part_012.c:10220).
+- The mapper look machine (part_013.c:396-459; modes 0=fwd 1=left 2=right 3=BACK 4=down from the
+  look buttons): on change it writes **EyepointRotation (mech+0x360)** — side yaw = the authored
+  per-mech look angles (model rec +0x50-0x5c → mech 0x564-0x570), look-back = yaw π + lookBackAngle
+  pitch — and re-arms each weapon's **viewFireEnable @0x3E0** (fwd = !rear, back = rear, else 0).
+  0x3E0 is the fire gate (the Loaded→Firing transition, part_013.c:7689 — the old
+  `useConfiguredPip` label) AND selects the HUD pips: the reticle registers each pip in group
+  1(front)/2(rear) from the RearFiring attr (part_014.c:5429-34) and draws the group in the mech's
+  reticleElementMask low bits (mech+0x390: fwd |1&~2, back |2&~1, part_013.c:5588-95).
+- Port: keyboard **HOLD 'V' = look back**; side/down looks not yet key-bound. `[rearfire]`/
+  `[look]` traces under BT_PROJ_LOG/BT_KEY_LOG.
+- Missile LAUNCH direction: rounds leave along the **mount segment's world frame** (the binary
+  spawns the missile with the full muzzle-segment AffineMatrix, fire builder @0x4bcc60:8762-64,
+  authored MuzzleVelocity composed with z NEGATED + the mech's own velocity) — was the
+  "missiles fire out of his back" torso-twist bug (launch followed the LEGS while the muzzle
+  followed the twist).
+- BANKED for the full Missile-entity revival (decoded, not yet ported — commit ab6ea83): the three
+  authentic performances — Seeker 0x4be9a0 (aim = target-frame offset / 100u-ahead-of-own-frame
+  dumb + loft/lead 0x4beae4), Thruster 0x4be474 (quaternion-slerp BODY turn toward the aim at
+  turnRate°/s), MoveAndCollide 0x4bef78 (velocity aerodynamically aligned to thrust via
+  signed-square per-axis gains, ballistic droop as fuel burns, PROXIMITY FUSE on seeker
+  rangeToTarget, max-range + altitude-floor retire).
+
 ## Weapon fire is a PORT reconstruction (the dpl_* beam layer is unported)
 `Emitter::FireWeapon` builds a muzzle→target beam but the `dpl_*` beam renderable was never ported →
 the beam is drawn by `BTPushBeam`/`BTDrawBeams` (L4VIDEO — an additive quad / the real `ermlaser.bgf`
diff --git a/context/decomp-reference.md b/context/decomp-reference.md
index abf2336..0b701f7 100644
--- a/context/decomp-reference.md
+++ b/context/decomp-reference.md
@@ -127,6 +127,35 @@ valid for reading the decomp, NOT for our compiled layout (see [[reconstruction-
 
 `mech+0x100` (a subsystem-view of localOrigin.linearPosition): `.x@+0x100, .z@+0x108`. [T1]
 
+### Binary ATTRIBUTE TABLES (2026-07-16, walked from the image) [T1]
+
+**Row format: 16-byte `{id, namePtr, memberOffset+1, 0}`** (MIND THE ALIGNMENT — an 8-off walk
+invents a fake one-slot shift; verified against the live-tested ConfigureActivePress row
+@0x50de54).  Walker: find the attr NAME string in DATA, find the pointer to it, decode ±16-byte
+rows until sanity fails (`python + struct`, see the session commits `cc2b109`/`21378ec`).
+
+- **Mech entity table @0x50c0xx, ids 21–56**: MaxAcceleration@0x344 (=forwardCycleRate),
+  CurrentSpeed@0x348 (=legCycleSpeed), MaxRunSpeed@0x34c (=run-cycle avg = the mapper's demand
+  multiplier), Collision{State,Normal,Speed,MaterialType}@0x450/0x4a8/0x4b4/0x4a4,
+  EyepointRotation@0x360 (the eye renderable's view rotation — the old `mechName@0x360` label is a
+  MISREAD), TargetReticle@0x36c, FootStep@0x394, AnimationState@0x39c, ReplicantAnimationState
+  @0x714, LinearSpeed/AngularSpeed/ClimbRate/AccelerationLastFrame@0x81c/0x824/0x828/0x82c (the
+  15-sample-ring velocity means + the accel snapshot), damage levels @0x354-0x35c, TestButton1-6
+  @0x328-0x33c, ReduceButton@0x340, Radar{Range,LinearPosition,AngularPosition}@0x404-0x40c,
+  **RearFiring@0x410** (OR of the weapons' rear flags; old `stateFlags` label was wrong),
+  RequestDuckAnimation@0x398, UnstablePercentage@0x3f0, SuperStop@0x3f4, DuckState@0x3f8,
+  IncomingLock@0x3fc, DistanceToMissile@0x400 (FLT_MAX far default; old `maxSpeed` label wrong).
+- **HeatSink table @0x50e438, ids 3–12**: HeatSink@0x164, CurrentTemperature@0x114,
+  Degradation/FailureTemperature@0x118/0x11c, Normalized/DegradationPressure@0x120/0x124,
+  CoolantCapacity@0x128, CoolantMass@0x12c, CoolantMassLeakRate@0x130, **ReportLeak@0x138**
+  (= coolantActive, the leak hysteresis flag).  Confirms every port heat binding.
+- **Torso table, ids 3–15**: RotationOfTorsoVertical/Horizontal@0x1e4/0x1d8, HorizontalLimit
+  R/L@0x1dc/0x1e0, SpeedOfTorsoVertical/Horizontal@0x1ec/0x1e8 (|rate|, abs'd),
+  StickPosition@0x1f0, TorsoUp/Down/Left/Right/Center@0x1f8-0x208, MotionState@0x20c
+  (statusFlags; ==2 = the limit-hit frame).
+- **MechWeapon rows**: RearFiring id 0x1B @0x334 = "the mount segment page name contains 'b'"
+  (marker @0x511aa2 — the back gun ports `sitelbgunport`/`siterbgunport`; ctor part_013.c:6913-30).
+
 ---
 
 ## 4. Damage delivery
diff --git a/context/open-questions.md b/context/open-questions.md
index 8c68ade..7d8ee17 100644
--- a/context/open-questions.md
+++ b/context/open-questions.md
@@ -24,6 +24,10 @@ authentic path scoped.
   software path is notch-free [T1, [[pod-hardware]]], but the gait SM's walk/run dead band
   ([[locomotion]]) only makes sense if the hardware discouraged parking the lever mid-band —
   "5 speeds" pod lore suggests physical notches. Status: OPEN.
+- ~~Which mechs used rear fire~~ **ANSWERED from data (2026-07-16, task #68)**: the Blackhawk's
+  ERMLaser_2/3 (back gun ports) are the only rear weapons in the roster; see [[combat-damage]].
+  Remaining: bind the side/down look views to keys (only 'V' look-back is bound); pod look-button
+  mappings for Phase 8.
 
 ## BINARY-COVERAGE AUDIT discoveries (2026-07-13, 6-agent decomp census) [T1 verified-uncited]
 New unaccounted functionality no prior list knew (addresses verified absent from game/+context/+docs):
diff --git a/context/wintesla-port.md b/context/wintesla-port.md
index c459f5c..57e99b2 100644
--- a/context/wintesla-port.md
+++ b/context/wintesla-port.md
@@ -113,10 +113,20 @@ on top of it. Full detail: `docs/PROGRESS_LOG.md §5b, §8`.
     watchers extract |linearMotion|, motionValue=3); localAcceleration.linear = d(published
     velocity)/dt (binary part_012.c:15186-15195); the mech2.cpp step broadcast is REMOVED.
     **attrnull count = 0** — every authored audio attribute binds a real member.
-  - Still deferred: UnstablePercentage@0x3F0 (needs the gyro sway/overspeed model — its live
-    writer is unexported), F21 attack velocity/time (all captured events were default 1),
-    per-zone static filter fc/Q baking (F14 residue), F22 HRTF (user has 2 speakers; enable
-    via alsoft.ini `hrtf=true` for headphones).
+  - **Post-Phase-4 closures (2026-07-16):** UnstablePercentage is LIVE (the instability model
+    @0x3F0 byte-decoded + reconstructed — accel-sway² + gun-the-engine + turn-in-place terms,
+    feeds gyro swayBias + the audio alarm; commit c51d64a). The F14 per-zone static resonant
+    low-pass is BAKED (RBJ biquad at the AWE 100–8000 Hz curve, float pipeline + peak
+    normalization; 232 zones incl the LaserLoaded charge hum fc=57 Q=87; c581553). The
+    **footstep 10–20 s warm-up bug** is fixed (a11a697): an idle source's watcher chain executes
+    only at Start attempts and each hop is audio-frame-gated, so the authored fill-0 N=30
+    smoothers starved behind the 0.3 transient drop gate — fixes: AudioScaleOf sends EVERY poll
+    (the bitwise change-gate froze on our deterministic gait floats), recursive gate-free
+    Component::PrimeWatchers(30) on every transient Start request (AUDREND), and
+    localAcceleration via the binary's exact 15-sample ring buffers.  LESSON: trace caps
+    saturate early and fake "per-stride" rates — always timestamp before inferring cadence.
+  - Still deferred: F21 attack velocity/time (all captured events were default 1), F22 HRTF
+    (user has 2 speakers; enable via alsoft.ini `hrtf=true` for headphones).
 - **L4 HAL on Windows + the VS build system: DONE.** [T1]
 - **Red Planet game logic: COMPLETE & buildable** — `VTV/VTVMPPR/WEAPSYS/...`. RP is at/near playable. [T1]
 - **Multiplayer: the DOS `NETNUB` driver is already replaced by a ~3.5k-line WinSock2 TCP
diff --git a/docs/AUDIO_FIDELITY.md b/docs/AUDIO_FIDELITY.md
index 36efa79..efa6a73 100644
--- a/docs/AUDIO_FIDELITY.md
+++ b/docs/AUDIO_FIDELITY.md
@@ -2,11 +2,13 @@
 
 > **STATUS (2026-07-16): Phases 1-4 SHIPPED** (commits fc7f311, 691e885, 0ca7d26,
 > cc2b109..0e2401f).  Fixed: F1-F5, F7, F9-F13, F15, F16, F18-F20, F23, KB items;
-> F6 fixed (ReportLeak -> coolantActive@0x138, binary table [T1]); F14 partial
-> (attenuation baked; static fc/Q deferred); F17 FIXED (CollisionSpeed +
-> ReduceButton real; UnstablePercentage live -- the instability model @0x3F0 is
-> byte-decoded and reconstructed, task #66);
+> F6 fixed (ReportLeak -> coolantActive@0x138, binary table [T1]); F14 FIXED
+> (attenuation + the static resonant fc/Q low-pass both baked, c581553);
+> F17 FIXED (CollisionSpeed + ReduceButton real; UnstablePercentage live --
+> the instability model @0x3F0 is byte-decoded and reconstructed, task #66);
 > F8/F21/F22 open (voice budget unhit / attack polish / HRTF option).
+> Post-audit: the footstep cold-start warm-up bug (idle watcher chains +
+> fill-0 smoothers vs the transient drop gate) fixed in a11a697.
 > attrnull = 0: every authored audio attribute binds a real member.