Cockpit: the CONFIG-MODE weapon-regrouping session + the live-play fire fixes (tasks #6+#11)

TASK #6 -- the pod's in-cockpit weapon regrouping, fully reconstructed and
live-verified (hold-configure -> tap fire button -> toggle membership ->
release-commit):
- MechWeapon handlers id 9 ConfigureMappables @004b9550 / id 10 ChooseButton
  @004b95b8 (binary table @0x511860; the old "Myomers fns" mislabel swept)
  + the GetMessageHandlers() accessor chain through Emitter/ProjectileWeapon/
  MissileLauncher/GAUSS/PPC (empty per-class sets swallowed dispatch).
- Mapper vtable truth: +0x38 EnterConfiguration / +0x3C ExitConfiguration /
  +0x40,+0x44 AddOrErase evt/dir.  No "secondary vtable @0050f498", no
  "CreateTemporaryEventMappings" virtual (RP-name drift; swept incl CLASSMAP).
  L4 Enter/Exit rebuilt complete: StartMappableButtonsConfigure (the
  NonMapping 0x10000 <-> Mapping 0x8000 mode flip + the gauge's active-weapon
  latch) + the held-button re-arm + the 4 fire-button temp maps; only the RIO
  mapper implements the toggle (Thrustmaster no-ops = can't regroup).
- MechSubsystem +0xE8/+0xEC corrected to controlDestination/controlMessageID
  (ex hostEntity/subsystemId2 mislabel); MechWeapon ctor defaults the
  destination to &fireImpulse (@004b99a8).
- ConfigMapGauge state loop reconstructed (PE-recovered DAT_00518eb4 table;
  buttonGroup GetMapState sampler -- the "needs ModeManager" guard rationale
  was wrong).  Finding [T1]: the shipped binary NEVER enables this gauge (no
  SetColor caller) -- authentically dormant; BT_CONFIGMAP=1 is the dev enable.
- Dev harness: HOLD 'G' opens the session (BT_CONFIG_SLOT picks the weapon);
  BT_CONFIG_TEST scripts a headless verify.  @004afbc4 corrected to its real
  Fail-trap body (the guessed AddOrErase(NULL) body would corrupt groups).
- Bonus [T1]: the binary MechWeapon ATTRIBUTE table has ELEVEN entries
  (PercentDone..WeaponState) -- "TriggerState is the only one" was wrong.

TASK #11 -- the user-reported live-play regressions (both real bugs):
- PHANTOM FIRE: the mech4 bring-up shot block painted an explosion at the
  victim on its OWN 0.3s cadence whenever fire was held -- desynced once the
  authentic recharges landed.  Retired (the real impact visual flows from
  each discharge via the messmgr SubmitExplosion).
- WEAPON BRICKING (the "cuts out" bug): the Loading->Loaded snap window
  (+-0.01 around seekV) assumes the pod's LOCKED 60 fps; one port dt-spike
  jumps it, the byte-verified >1.0 clamp (_DAT_004ba830=0) zeroes readiness,
  and the weapon sticks in Loading at level ~10000 forever (observed live).
  Fixed with pod-frame (1/60s) sub-stepping of the binary's own Loading tick
  -- also fixes the I^2R integral over-heating generators on big steps.
  NEW GOTCHA CLASS recorded: reconstruction-gotchas #12 (frame-pacing trap).
- Duty-cycle measured (max-rate autofire): generators equilibrate in the
  degradation band (recharge stretch ~3.5-4.4x), the FailureHeat breaker
  never trips solo, PPCs sustain ~11.8-damage full-charge fire.  The slow
  kill pacing and recharge gaps are the AUTHENTIC heat economy; the pilot's
  counters (this regrouping UI, generator reassignment, coolant valves) are
  the reconstruction queue.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

game/reconstructed/mechsub.cpp

@@ -124,8 +124,8 @@ MechSubsystem::MechSubsystem(
 {
 	refCount		= NewRefCount(0x10);		// this[0x3d]
 	this->owner		= owner;					// this[0x34] -- the owning Mech (canonical)
-	hostEntity		= owner;					// this[0x3a] = param_7
-	subsystemId2	= subsystem_ID;				// this[0x3b] = param_8
+	controlDestination	= 0;					// this[0x3a] = param_7 (ctor pass-through;
+	controlMessageID	= 0;					// this[0x3b] = param_8  weapons override -- task #6)
 	vitalSubsystem	= 0;						// this[0x39]
 	BindName(refCount, "None");					// FUN_00402a98(.,this+0x3d,"None") @0x50df7a
 	alarmModel = 0;							// identity ResourceID							// FUN_00408440(this+0x3e, identity)
@@ -159,8 +159,8 @@ MechSubsystem::MechSubsystem(
 												// ctor only set hostEntity; subclasses read
 												// `owner` widely -> must be set or it is garbage.)
 	statusAlarm.SetLevel(0);					// FUN_0041bbd8(this+0xb, 0)
-	hostEntity		= (Mech *)subsystem_resource->segmentIndex;	// this[0x3a]=param_6
-	subsystemId2	= subsystem_ID;				// this[0x3b]=param_7
+	controlDestination	= 0;					// this[0x3a]=param_6 (ctor pass-through;
+	controlMessageID	= 0;					// this[0x3b]=param_7  weapons override -- task #6)
 	resource		= subsystem_resource;		// this[0x3c]
 	vitalSubsystemIndex	= -1;					// this[0x44]
 	vitalSubsystem	= (subsystem_resource->vitalSubsystemIndex == 1);	// res+0x48==1
@@ -487,3 +487,27 @@ int
 	Check_Fpu();
 	return True;
 }
+
+
+//#############################################################################
+// BTSubsystemControlFeed -- complete-type bridge (task #6)
+//
+// ConfigMapGauge::Execute (@004c6f1c) reads the subsystem's controls feed
+// (*(subsys+0xE8) destination, *(subsys+0xEC) message id) for GetMapState.
+// The gauge TU has no complete MechSubsystem (databinding-trap rules: never
+// raw-read a compiled object's offsets) -- this bridge reads the NAMED members
+// and hands back the Receiver upcast alongside.
+//
+void
+	BTSubsystemControlFeed(
+		void	*subsystem_in,
+		void	**destination_out,
+		int		*message_id_out,
+		void	**receiver_out
+	)
+{
+	MechSubsystem *sub = (MechSubsystem *)subsystem_in;
+	*destination_out = sub->controlDestination;		// @0xE8
+	*message_id_out  = sub->controlMessageID;		// @0xEC
+	*receiver_out    = (Receiver *)sub;
+}