WAVE 7 Phase A: wire the projectile/missile weapon SUBSYSTEMS byte-exact (un-mislabeled)

An 8-agent decomp-mapping workflow mapped every weapon-family ctor + fire/spawn path
(scratchpad/wave7_maps.txt).  KEY IDENTITY CORRECTION via VDATA.h enum (base 3000=0xBB8):
the factory ctor-address comments were right but the built CLASS names were stubs/base --
    0xBCD == ProjectileWeapon  (was building the base MechWeapon stub)
    0xBCE == GaussRifle         (NOT MissileLauncher -- was a MissileLauncher stub)
    0xBD0 == MissileLauncher    (NOT BallisticWeapon -- was a BallisticWeapon stub)
Un-mislabeled + wired via Create<Class>Subsystem bridges (mirroring CreateEmitterSubsystem),
each static_assert-locked byte-exact on the now-locked MechWeapon(0x3F0)/Emitter(0x478) bases:

  * ProjectileWeapon (0xBCD, @4bc3fc : MechWeapon, sizeof 0x448)
      FIX: AmmoBinConnection was an empty 1-byte struct -> retyped to the binary's 0xC
           SharedData::Connection (was making the object 8 bytes short, sliding
           MissileLauncher's missileCount off 0x448).
  * MissileLauncher (0xBD0, @4bcff0 : ProjectileWeapon, sizeof 0x44C)
      FIX: deleted muzzleVelocity (ALIAS of inherited ProjectileWeapon launchVelocity@0x410)
           and salvoCount (SHADOW of inherited MechWeapon damageData.burstCount@0x3d4),
           keeping the single own field missileCount@0x448.
  * GaussRifle (0xBCE, @4bdcb4 : Emitter, sizeof 0x484 = Emitter + Vector3D muzzleVelocity)
      DEDICATED bridge (not CreateEmitter): its FireWeapon is a no-op (mov [eax+0x414],0) --
      a non-functional weapon in this 1995 build.  Also fixed GAUSS.CPP's discharge write
      rechargeLevel -> currentLevel@0x414 (the binary writes this+0x414).

Phase A safe-stubs FireWeapon (consume round + recoil, NO spawn): the reconstructed
Projectile (@4be1bc, 0x340) + Missile (@4bf5b4, 0x368) ENTITY classes are NOT spawn-ready
(Entity-base phantom members overflow their New() alloc -> heap corruption; New() takes
(int)this instead of the 0xD4 descriptor; Entity base size unconfirmed 2007-vs-1995, the
Mech 0x638-vs-0x854 problem).  The workflow's adversarial verify flagged the live spawn as a
heap-overflow hazard and recommended exactly this phasing.  Phase B = the entity byte-exactness
+ descriptor build + New(MakeMessage*) so a fired shot becomes a flying entity that damages.

Factory now 18 of 20 cases wired to real ticking classes (remaining: SubsystemMessageManager
0xBD3 [WAVE 8], Gyroscope 0xBC4 [deferred]).  Verified: Mad Cat (LRM/ballistic) + BLH construct
the real weapon classes + tick authentic charge/ammo/heat/recoil, DESTROYED-in-8, 0 crashes,
heapcheck-clean through construction.  Energy weapons already damage via the mech4 beam path,
so combat is unaffected.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

game/reconstructed/projweap.cpp

@@ -565,13 +565,20 @@ void
 	// DrawFiringCharge before the weapon is ReadyToFire again).
 	recoil = rechargeRate;								// this[0xfa] = this[0xf7]
 
-	// Spawn the generic tracer/ballistic round at the muzzle.  The lead solution
-	// in leadPosition (ComputeTimeOfFlight) and launchVelocity seed the descriptor;
-	// the spent round is a streamed Projectile entity (FUN_004bf8bc family).
-	// MissileLauncher overrides this method (@004bcc60) to spawn guided Missiles.
+	// Resolve the live muzzle (used to seed the projectile descriptor).
 	Point3D muzzle;
 	GetMuzzlePoint(muzzle);								// MechWeapon @004b9948
-	Projectile::New((int)this);							// @004be384 generic projectile
+
+	// ⚠ SPAWN DEFERRED (WAVE 7 Phase B): the shipped code builds a ~0xD4-byte projectile
+	// MakeMessage here (muzzle transform + lead point + the 12-word Damage descriptor +
+	// owner/target) and hands it to Projectile::New (@004be384).  The reconstructed
+	// Projectile/Missile ENTITY classes are NOT spawn-ready yet: they carry Entity-base
+	// phantom members that overflow their New() alloc (0x340/0x368), and New() currently
+	// takes (int)this instead of the descriptor -> a live spawn would corrupt the heap.
+	// So the weapon SUBSYSTEM ticks authentically (charge/ammo/heat/recoil) but does NOT
+	// spawn until the entity byte-exact base + descriptor build land.  See scratchpad/
+	// wave7_maps.txt (Projectile/Missile maps) + docs/SUBSYS_PLAN.md.
+	//   Projectile::New((int)this);   // <-- Phase B
 
 	simulationFlags |= 0x1;								// replication-dirty
 	Check_Fpu();
@@ -689,3 +696,20 @@ int
 
 	return True;
 }
+
+
+//===========================================================================//
+// WAVE 7 factory bridge -- ProjectileWeapon (factory case 0xBCD, "MechWeapon"
+//   mislabel).  The real class at 0xBCD (ctor @004bc3fc) is ProjectileWeapon
+//   (the autocannon/ballistic ammo weapon); the factory built the base MechWeapon
+//   stub (whose FireWeapon is the pure-virtual trap @004ba45c).  alloc 0x448 (==
+//   the byte-exact ProjectileWeapon sizeof).  Constructs the AmmoBin connection +
+//   ticks its real ProjectileWeaponSimulation (charge/ammo/jam/eject); FireWeapon
+//   consumes a round + recoils but DEFERS the projectile spawn (Phase B).
+//===========================================================================//
+Subsystem *CreateProjectileWeaponSubsystem(Mech *owner, int id, void *seg)
+{
+	Check(sizeof(ProjectileWeapon) <= 0x448);
+	return (Subsystem *) new (Memory::Allocate(0x448))
+		ProjectileWeapon(owner, id, (ProjectileWeapon::SubsystemResource *)seg, ProjectileWeapon::DefaultData);
+}