CydandClaude Fable 5
fdf26d6e55
The death-row page fault was the THIRD strike of the uninitialized zone-array trap: the staged spawn rides the mech family's resourceID, whose DamageZoneStream makes the Entity base ctor allocate the 20-pointer damageZones[] array with UNINITIALIZED slots -- the Missile never fills it, and ~Entity's teardown deleted 20 garbage pointers through trash vtables (the dtor-chain bisect showed every dtor completing, then EIP-in-heap). Fix: the Projectile ctor NULLs every inherited zone slot. RULE, now three-crashes-proven: any entity subclass that does not FILL the allocated zone array must NULL it -- the engine never initializes the slots, on construction OR destruction. Missiles are now the default SRM delivery (BT_MISSILE_INSTANT=1 = the 5.3.18a instant-hit as an A/B opt-out). Verified: 20 launches -> 20 detonations -> 20 clean death-row teardowns over a 110s mutual fight, zero faults; smoke + novice regressions green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
75 lines
4.2 KiB
Markdown
75 lines
4.2 KiB
Markdown
# MISSILE.CPP / SEEKER.CPP / MISTHRST.CPP / PROJTILE.CPP — the flying rounds
|
|
|
|
**Status: LIVE and DEFAULT (5.3.19) — the full entity lifecycle is verified:
|
|
spawn → guided flight → proximity detonation → death-row teardown, 20/20/20
|
|
over a 110s mutual fight with zero faults. `BT_MISSILE_INSTANT=1` keeps the
|
|
5.3.18a instant-hit delivery as an A/B dev opt-out.**
|
|
|
|
## Interfaces
|
|
|
|
- `SEEKER.HPP` + `MISTHRST.HPP` are AUTHENTIC survivors (CODE/BT/BT/). The
|
|
Subsystem base chain is the NAME ctor (binary FUN_0041c52c) with the
|
|
shipped strings "Seeker" @00512e1e and **"MissleThruster"** @00512e25 (the
|
|
1995 misspelling is authentic — keep it).
|
|
- `MISSILE.HPP` / `PROJTILE.HPP` are STAGED (only MISSILE.TCP / PROJTILE.TCP
|
|
survive). Binary chain: Entity → Projectile (@004be1bc, 0x340) → Missile
|
|
(@004bf5b4, vtable @00512f2c, 0x368). Our staged chain matches:
|
|
Projectile : Mover (make-message path), Missile : Projectile.
|
|
|
|
## What is verified live (BT_MISSILE_FLIGHT=1 fight run)
|
|
|
|
ONE cluster Missile entity per SRM salvo, spawned through the real Mover make
|
|
machinery mid-weapon-sim (the Entity ctor self-registers — the engine
|
|
tolerates mid-roster-walk creation, as the binary did); flight telemetry
|
|
shows thruster acceleration (150→153 u/s) and closing range; the proximity
|
|
fuse (rangeToTarget <= 20u staged) delivers `damageData` (salvo-split amount,
|
|
burstCount=missileCount) exactly once via TakeDamageMessage with the LAUNCHER
|
|
as inflictor; lifetime fizzle retires unexploded rounds. Guidance constants
|
|
are binary-decoded (steer deadband 1e-4, turn gain 4.0, seeker loft
|
|
200/50/300/0.1 — .rdata @004bec18/@004bf594).
|
|
|
|
## The teardown crash — SOLVED (5.3.19)
|
|
|
|
The dtor-chain bisect (logs in ~Missile/~Projectile/~Seeker/~MissileThruster)
|
|
showed the whole chain COMPLETING, then the fault. The killer was the third
|
|
strike of the uninitialized-zone-array trap: the staged spawn uses the MECH
|
|
FAMILY's resourceID, whose DamageZoneStream makes the Entity base ctor
|
|
allocate the 20-pointer `damageZones[]` array (entity.cpp:1032, slots
|
|
UNINITIALIZED) — the Missile never fills it, and `~Entity`'s teardown loop
|
|
`if (damageZones[i]) delete damageZones[i]` called 20 virtual dtors through
|
|
trash vtables (EIP-in-heap AFTER the subsystem dtors — exactly the bisect
|
|
signature). FIX: the Projectile ctor NULLs every inherited zone slot.
|
|
**RULE (three crashes now): any entity subclass that does not FILL the
|
|
allocated zone array must NULL it — the Entity base never initializes the
|
|
slots, on construction OR destruction.** Also fixed en route: the Subsystem
|
|
NAME ctor left `damageZone` uninitialized (the resource ctor NULLs it).
|
|
Ruled out along the way: AlwaysExecute flags, interestZoneID (message base
|
|
NULLs it), the subsystemArray idiom, Sensor caching, FryDeathRow timing (an
|
|
app task, one delete per frame, not mid-walk).
|
|
|
|
## Engine truths learned (load-bearing)
|
|
|
|
- `ResourceFile::SearchList(id, type)` CRASHES (@0x414938) when `id` is not
|
|
in the top-level directory — it derefs its inner FindResourceDescription
|
|
unconditionally. `FindResourceDescription(int)` is the NULL-safe probe.
|
|
- Resource IDs in MakeMessages must be FAMILY ids: the Mover base ctor runs
|
|
its own `SearchList(resourceID, GameModelResourceType)`, and member
|
|
resources resolve only through their family head.
|
|
- The streamed `explosionModelFile` is a small INDEX (SRM6 reads 17), a
|
|
model-list indirection like voltageSourceIndex/ammoBinIndex — decoding it
|
|
into the real projectile family is the projectile-model brick. Until then
|
|
the round spawns on the OWNER's family (GameModel member provably present;
|
|
our staged flight reads none of the Mover mass/drag).
|
|
|
|
## Staged / deferred
|
|
|
|
- Muzzle = mech origin; the authored MuzzleVelocity arc through the MOUNT
|
|
segment world frame (fire builder @0x4bcc60:8758-64, z NEGATED + mech
|
|
velocity) is the muzzle wave.
|
|
- Flight envelope defaults (lifetime 10s, burn 2s @120 u/s², launch 150 u/s,
|
|
fuse 20u) pending the missile GameModel record decode (model +0x44
|
|
lifetime, +0x48 thrust, +0x50 detonation mode).
|
|
- Cluster SPLASH + explosion entity (ClassID 0x5C @004be078), world-geometry
|
|
collision (@0042291c), target-velocity intercept lead, Missile
|
|
WriteUpdateRecord (tag 0x78) for MP replication.
|