handoff: evening eject sprint + MFD corruption arc addendum

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scratchpad/SESSION_HANDOFF_20260803.md

@@ -0,0 +1,111 @@
+# Session handoff — 2026-08-03 (armor visibility + eject arm chain)
+
+## Committed this session (all on master, exe deployed to content/)
+- `fe48acc` **#87 root cause**: zone-level replication send was missing — the binary's
+  effect watcher (FUN_0042aa2c) ForceUpdates on BAND-THRESHOLD crossings (master-gated);
+  the port only had the gstate branch. Observers saw 0.0 forever. Fixed + 2-node verified
+  (replicant peaks == master finals to 4 decimals).
+- `440cee1` #87 dig closure: host response is LINEAR (raw re-read @004573e4/@00457784,
+  0.1 literal at call site); the pixel curve was i860 DIV-CARD firmware (flush_material
+  @0048d4d4 just marshals) — logged in open-questions. Field claim reconciled: one 25-pt
+  hit snaps a 77-pt arm 0→0.325 (measured; snap is visible, 2-pt ERS creep is not).
+  Bench: BT_WALK_ZONES filter (legwalk.sh), BindArmourDamage ORPHAN inventory (0 orphans).
+- `8165cee` **#118 eject alive**: the evaluator's per-frame caller found by E8-scan —
+  FUN_004a9b5c (Mech MASTER PERF, export hole)+0x10 calls @0049fa1c every frame. Restored
+  at top of Mech::PerformAndWatch (master-gated). Mislabel swept: mech+0x414 =
+  ejectPermitted (NOT missionReviewMode; real review mode = GLOBAL DAT_004fd550).
+  Verified: gen-kill → panic-arm mode ON → miniconsole Panic button LIGHTS (pixel proof
+  panicbtn.png) → punch-out → respawn disarms. BT_EJECT_LOG=1 logs edges.
+  Also: msg id 0x1a = DuckRequest@0049fa00 latches mech+0x398 — NO reader in image (vestigial).
+- `0089b32` **G = Flush binding** (was: action existed, NO key bound — desktop players
+  could never flush!) + BT_FLUSH_HOLD=<frames> scalpel.
+
+## IN FLIGHT — the user's firsthand eject test (they asked, then had to shut down)
+Dry run result (content/fl.log): full flush drains the TANK to 0/14 in ~30 s but does
+NOT arm eject — InjectCoolant moves tank coolant INTO the loops (bank RISES); idle heat
+draw won't burn the loops below the 5% arm threshold in minutes.
+**Firsthand recipe to give the user next session** (needs build with 0089b32 — exe in
+content/ is current, but the DIST zip is not):
+1. Solo (play_solo), get in.
+2. HOLD **G** until the COOLANT RES gauge hits 0 (~30 s; flush cloud + audio confirm).
+3. Then run HOT: hold fire (lasers) continuously / keep moving. With the tank dry the
+   loops burn coolant with no refill. Watch coolant bars fall.
+4. When the bank crosses 5%: **the Panic button (bottom-left panel) lights bright** —
+   press it (or Backspace = key Back action Eject) → punch-out.
+   Faster alternates that also arm: lose all 4 generators; or (novice sim) leg-gimp.
+OPEN: how long step 3 takes firsthand (not yet measured — the 3-min idle bench never
+armed; sustained fire should be much faster). If it's tediously long, consider whether
+weapon heat actually draws LOOP coolant in our reconstruction (#100/#120 territory —
+check ConsumeCoolant path under fire before telling testers "minutes").
+
+## Next-session queue
+1. Give the user the firsthand recipe above (they explicitly asked to test it).
+2. Time-to-arm under sustained fire — bench it (fire scalpel + BT_COOL_LOG) BEFORE
+   promising the recipe works in reasonable time.
+3. Cut dist 717: carries score fix, 28 Hz, eject core+arm chain, #119, #124 triangle
+   pick, #87 replication send, G-flush binding. Testers verify: missile snap darkening
+   visible in MP now; eject lamp + punch-out.
+4. Gitea: #87 and #118 both commented + awaiting-verification (labels set). #118 note
+   says flash-vs-solid lamp is answerable if pod veterans remember blinking (GaugeAlarm
+   SetAlertState overlay — not authored for panic in shipped streams as far as checked).
+5. Carried: #55, #100 (reservoir drain — RELATED to step 2 above), #120 (flush floor —
+   note: our tank DID reach 0/14, so the floor report may be the LOOP levels, not the
+   tank), #121-#123, #125-#130; mover-gravity dt-less lead in open-questions.
+
+## Bench inventory added today
+- scratchpad/night10/zonewalk.sh (A now has BT_ARMOR_LOG + BT_SHOT_EVERY=zwA) — the
+  standing zone-replication receipt bench; digest_walk.py reads it.
+- scratchpad/night10/legwalk.sh — leg/foot concentrated audit (BT_WALK_ZONES=leg,foot).
+- scratchpad/night10/armorpx.sh — BT_ARMOR_FORCE 0/1 pixel A/B.
+- BT_EJECT_LOG, BT_FLUSH_HOLD, BT_WALK_ZONES, armor ORPHAN dump (BT_ARMOR_LOG).
+- Proof artifacts in content/: panicbtn.png, forceladder.png, snapdiff.png, legdiff.png,
+  dollcrop_*.png (all disposable).
+
+## KB updated (all committed)
+combat-damage §Zone-LEVEL replication + snap-vs-creep fidelity boundary;
+decomp-reference §4 (effect watcher cluster) + EJECT ARM CHAIN entry;
+multiplayer (band-granularity observer model); test-harness (zone-walk armor receipts);
+open-questions (i860 DIV-CARD firmware ask).
+
+---
+## EVENING SESSION ADDENDUM (the eject sprint + the MFD corruption arc)
+
+### Eject system — COMPLETE and firsthand-verified (commits 8165cee..7872254)
+- Arm chain per-frame (FUN_004a9b5c+0x10, E8-scan) [T1]; mislabel swept (mech+0x414
+  = ejectPermitted; review mode = GLOBAL DAT_004fd550).
+- EjectPilot @0049f854 confirmed via the image message table ('EjectPilot' id 0x19);
+  DuckRequest = id 0x1a @0049fa00 (mech+0x398 latch, NO reader — vestigial).
+- KEY FINDING: **eject was UNFINISHED in shipped 4.10** — the evaluator had zero
+  callers/pointers until the master-perf call was restored; the arcade never armed.
+- Inputs, all live: Panic button (0x3D→pilot-keypad wire), NUMPAD = pilot keypad
+  (CONTROLS.MAP `keypad pilot` bindings), Backspace/pad action, and the eng-page
+  EJECT key (0x0B/0x23/0x03) page-gated in the RIO drain [T3 intent-completion].
+  MFD soft keys otherwise keep authored functions (streamed .CTL: no 0x200000
+  records — the 109-record dump is the proof).
+- Generator destruction → stateAlarm 4 (GeneratorOut, renamed from placeholder)
+  [T3 inferred link] → the AUTHORED invite trail flashes (gotoEngineering 0x80 +
+  engEject 0x85, alarm conditions 4/5).
+- KeypressMessageID pinned to binary 0x19 (chain arithmetic gave 0x17 — the armed
+  press was silently swallowed; two mapper ids 0x17/0x18 remain unreconstructed).
+
+### The MFD corruption arc (gotcha #27) — RESOLVED
+Root cause = MY two new draws, not eject logic: (1) the eject-wipe gauge scribbling
+a shared ENG/weapon composite plane during eject cycles (re-stubbed, class kept in
+btl4gaug for a proper FUN_004c5fb8 draw-op RE); (2) the full-face flash overlays
+(L4VB16 + L4GLASSWIN, both REMOVED — the side buttons are big under-surface rects;
+the protruding edge IS the lamp; DrawDevSurface's bound texture turned un-reset
+fills into gauge-atlas stripes). Pixel-verified clean under full stress; edge lamp
+0x27 square-waves 34.0↔28.9 across captures = the flash works at authentic scale.
+
+### Next-session queue (no release went out tonight)
+1. Cut dist 717 after a fresh operator pass on 0535a7a-era build.
+2. Eject-wipe draw-op RE (FUN_004c5fb8 view vtbl+0x58 arg roles) → un-stub the slot
+   graphic.
+3. The eng-page label-vs-lamp position question: operator saw the flash beside
+   GEN-MODE, not EJECT, on one page — cross-check the DRAWN eng-page layout
+   (streamed gauge pages) against kBTEngBankTop math per bank.
+4. Authentic generator death (combat crits / overload, not the scalpel) reaching
+   state 4/5 — then the [T3] MarkGeneratorOut bridge can be checked against the
+   real transition site (MechSubsystem::TakeDamage/OnAlarmChanged cluster RE).
+5. Flash presentation: the edge-lamp scale is the design; if the operator wants
+   more presence it is a DELIBERATE glass-layer decision (discuss, don't impose).