THE CLASS (established by Gitea #35's 515 fix, confirmed growing tonight):
code the binary could run bare because a pod's mission world always existed,
crashing in the port's MP join/teardown/respawn windows where mission, player,
or a roster link is briefly NULL. Swept every GetMissionPlayer()/
GetPlayerVehicle()/GetCurrentMission() chain in the tree (23+7 sites).
GUARDED (the 515 pattern -- authentic behavior whenever the object exists,
skip/degrade + loud log when mid-teardown):
1. DPLRenderer::SortAndReloadNameBitmaps -- runs in the round-STOP path (the
end-of-round circle), raw mission+player+entity-manager derefs.
2. DPLRenderer::LoadOrdinalBitmaps -- called from (1); raw
GetMissionPlayer()->GetInstance() evaluated on EVERY machine (the camera-
director test derefs before it branches).
3. DPLRenderer::LoadNameBitmaps -- same window, raw GetPlayerCount() chain.
4. Reservoir::Reservoir master-gate block -- THE CAPTURED GAMES-NIGHT CRASH
([crash] btl4+0x4990d = this ctor inlined into CreateReservoirSubsystem,
AV reading NULL+0x1d0): linkedSinks.Resolve() derefed raw; +0x1d0 is
exactly the masterScale FILD of the resolved master heat-sink bank
(heatSinkCount @0x1D0 -- the offset the crash named). Observed trigger: a
DUPLICATE-PILOT egg (the seat-ghost bug put one identity in two seats)
poisoning the ID registry, so Resolve() nulled during viewpoint-entity
construction and at least two pods died loading the same egg. Now: loud
'[spawn] FATAL-AVOIDED' + degrade to the inactive-copy shape. The
duplicate-pilot ROOT CAUSE is the seat-ghost fix (tracked separately);
this guard makes the failure survivable and self-identifying either way.
CLASSIFIED SAFE, not touched: btl4mppr/btplayer/mechmppr/btl4gau3 chains
(guarded or null-tolerant by design); APP.cpp's five Check(player) sites
(mission state machine -- player exists by construction, original engine
ordering); CAMMGR/CULTURAL GetCurrentMission chains (construction-time).
VERIFIED: build clean (0 errors, no new unresolved externs); solo smoke on the
guarded exe -- zero FATAL-AVOIDED lines (guards silent on the healthy path),
subsystems simulating, no faults. STILL OWED: a full launch->stop rig cycle
(exercises the guarded round-stop path live) and the duplicate-pilot-egg repro
-- both blocked on port 1500 while the operator's console session is up.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
