feat: port CTaskTeam__CreateWeatherFilter to Rust, extract wa_lcg

Port the cloud spawning factory (0x552960) that creates a CTaskFilter
and spawns CTaskCloud children with deterministic LCG randomization.

- Add rng.rs with shared wa_lcg() used by advance_rng, advance_effect_rng,
and cloud spawning (eliminates duplicated LCG constants)
- Port create_weather_filter in task/team.rs with naked asm bridge for
CTaskFilter constructor (usercall ECX=0x1B)
- Add Subscribe (slot 8) and SubscribeAll (slot 7) to CTaskFilterVTable
- Add CTASK_TEAM_CREATE_WEATHER_FILTER and CTASK_FILTER_SUBSCRIBE addresses
- Hook via MinHook in wormkit cloud.rs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

crates/openwa-core/src/address.rs

@@ -41,7 +41,10 @@ pub mod va {
         CTASK_CLOUD_CTOR, CTASK_CLOUD_READ_REPLAY_STATE, CTASK_CLOUD_VTABLE,
         CTASK_CLOUD_WRITE_REPLAY_STATE,
     };
-    pub use crate::task::filter::{CTASK_FILTER_CTOR, CTASK_FILTER_VTABLE};
+    pub use crate::task::filter::{
+        CTASK_FILTER_CTOR, CTASK_FILTER_SUBSCRIBE, CTASK_FILTER_VTABLE,
+        CTASK_TEAM_CREATE_WEATHER_FILTER,
+    };
     pub use crate::task::fire::{CTASK_FIRE_CTOR, CTASK_FIRE_VTABLE};
     pub use crate::task::game_task::{
         CGAMETASK_CONSTRUCTOR, CGAMETASK_SOUND_EMITTER_VT, CGAMETASK_VT0, CGAMETASK_VT1_FREE,

crates/openwa-core/src/engine/ddgame.rs

@@ -509,10 +509,7 @@ impl DDGame {
     /// shared RNG — both gameplay and visual effects advance it. Any difference in
     /// RNG call count between Rust and original code causes replay desync.
     pub fn advance_rng(&mut self) -> u32 {
-        let rng = (self.frame_counter as u32)
-            .wrapping_add(self.game_rng)
-            .wrapping_mul(0x19660D)
-            .wrapping_add(0x3C6EF35F);
+        let rng = crate::rng::wa_lcg((self.frame_counter as u32).wrapping_add(self.game_rng));
         self.game_rng = rng;
         rng
     }
@@ -524,9 +521,7 @@ impl DDGame {
     /// 1-indexed health ratio array, repurposed by WA as a secondary RNG for weapon
     /// release visual effects.
     pub fn advance_effect_rng(&mut self) -> u32 {
-        let rng = (self.team_health_ratio[0] as u32)
-            .wrapping_mul(0x19660D)
-            .wrapping_add(0x3C6EF35F);
+        let rng = crate::rng::wa_lcg(self.team_health_ratio[0] as u32);
         self.team_health_ratio[0] = rng as i32;
         rng
     }

crates/openwa-core/src/lib.rs

@@ -47,5 +47,6 @@ pub mod snapshot;
 pub mod task;
 pub mod vtable;
 pub mod wa;
+pub mod rng;
 pub mod wa_alloc;
 pub mod wa_call;

crates/openwa-core/src/rng.rs

@@ -0,0 +1,12 @@
+//! WA's LCG random number generator.
+
+/// Single step of WA's LCG: `state * 0x19660D + 0x3C6EF35F`.
+///
+/// This is the core PRNG used throughout WA.exe. The game RNG
+/// ([`DDGame::advance_rng`](crate::engine::ddgame::DDGame::advance_rng))
+/// adds `frame_counter` before the multiply; the effect RNG and standalone
+/// uses (e.g. cloud spawning) use this directly.
+#[inline]
+pub fn wa_lcg(state: u32) -> u32 {
+    state.wrapping_mul(0x19660D).wrapping_add(0x3C6EF35F)
+}

crates/openwa-core/src/task/cloud.rs

@@ -254,3 +254,4 @@ impl CTaskCloud {
         }
     }
 }
+

crates/openwa-core/src/task/filter.rs

@@ -5,11 +5,20 @@ crate::define_addresses! {
     class "CTaskFilter" {
         /// CTaskFilter vtable - role unclear; 4 instances in a 2-team 3-worm game
         vtable CTASK_FILTER_VTABLE = 0x0066_9DAC;
+        /// CTaskFilter constructor (usercall: ECX=init_val_1c, stdcall params: this, parent).
+        /// RET 0x8. Returns constructed pointer in EAX.
         ctor CTASK_FILTER_CTOR = 0x0054_F3D0;
+        /// CTaskFilter::Subscribe — sets subscription_table[msg_id] = 1.
+        /// thiscall + 1 stack param (msg_id), RET 0x4.
+        vmethod CTASK_FILTER_SUBSCRIBE = 0x0054_F370;
     }
+
+    /// CTaskTeam__CreateWeatherFilter — creates a CTaskFilter + spawns CTaskCloud children.
+    /// stdcall, 1 stack param (parent task), RET 0x4.
+    fn/Stdcall CTASK_TEAM_CREATE_WEATHER_FILTER = 0x0055_2960;
 }
 
-/// CTaskFilter vtable — 12 slots. Extends CTask base (8 slots) with filter behavior.
+/// CTaskFilter vtable — 12 slots. Extends CTask base (7 slots) with filter behavior.
 ///
 /// Vtable at Ghidra 0x669DAC. Slot 2 (HandleMessage) checks the subscription
 /// table before forwarding messages to children.
@@ -20,10 +29,14 @@ pub struct CTaskFilterVTable {
     #[slot(2)]
     pub handle_message:
         fn(this: *mut CTaskFilter, sender: *mut CTask, msg_type: u32, size: u32, data: *const u8),
-    /// ProcessFrame — per-frame filter update.
-    /// thiscall + 1 stack param (flags), RET 0x4.
+    /// SubscribeAll — sets all 100 subscription table entries to 1.
+    /// thiscall, no stack params.
     #[slot(7)]
-    pub process_frame: fn(this: *mut CTaskFilter, flags: u32),
+    pub subscribe_all: fn(this: *mut CTaskFilter),
+    /// Subscribe — sets subscription_table[msg_id] = 1.
+    /// thiscall + 1 stack param (msg_id), RET 0x4.
+    #[slot(8)]
+    pub subscribe: fn(this: *mut CTaskFilter, msg_id: u32),
 }
 
 /// Message-subscription filter task — routes messages selectively to child tasks.

crates/openwa-core/src/task/team.rs

@@ -177,3 +177,153 @@ impl CTaskTeam {
         );
     }
 }
+
+// ---------------------------------------------------------------------------
+// CTaskTeam__CreateWeatherFilter (0x552960) — cloud spawning factory
+// ---------------------------------------------------------------------------
+
+use crate::address::va;
+use crate::engine::ddgame::DDGame;
+use crate::rebase::rb;
+use crate::rng::wa_lcg;
+use crate::task::cloud::{CTaskCloud, CloudType};
+use crate::task::filter::CTaskFilter;
+use crate::wa_alloc::WABox;
+
+/// Bridge: call CTaskFilter constructor (usercall: ECX=0x1B, stdcall params: this, parent).
+/// Returns constructed pointer in EAX.
+///
+/// # Safety
+/// `this` must point to a zeroed 0xB4-byte allocation. `parent` must be a valid CTask.
+#[unsafe(naked)]
+unsafe extern "cdecl" fn call_filter_ctor(
+    _this: *mut u8,
+    _parent: *mut u8,
+    _addr: u32,
+) -> *mut CTaskFilter {
+    core::arch::naked_asm!(
+        "mov ecx, 0x1b",     // init_val_1c register param
+        "mov eax, [esp+12]", // addr (3rd cdecl param)
+        "push [esp+8]",      // push parent (2nd cdecl param)
+        "push [esp+8]",      // push this (1st cdecl param, shifted by 1 push)
+        "call eax",          // stdcall, callee cleans 2 params (RET 8)
+        "ret",               // cdecl return; caller cleans our 3 params
+    )
+}
+
+/// Pure Rust port of CTaskTeam__CreateWeatherFilter (0x552960).
+///
+/// Creates a CTaskFilter subscribed to messages {1, 2, 3, 0x54}, then spawns
+/// CTaskCloud children with deterministic LCG randomization.
+///
+/// Cloud count: 32 if `level_width_raw == 0`, else 10.
+///
+/// Called from CTaskTeam constructor. stdcall with 1 param (parent task).
+///
+/// # Safety
+/// `parent` must be a valid CTask pointer (typically a CTaskTeam child).
+pub unsafe extern "stdcall" fn create_weather_filter(parent: *mut CTask) {
+    // 1. Allocate and construct CTaskFilter
+    let filter_box = WABox::<CTaskFilter>::alloc(0xB4, 0x94);
+    let filter = call_filter_ctor(
+        filter_box.as_ptr() as *mut u8,
+        parent as *mut u8,
+        rb(va::CTASK_FILTER_CTOR),
+    );
+    filter_box.leak(); // ownership transfers to the task tree
+
+    // 2. Subscribe to messages: FrameStart(1), FrameFinish(2), RenderScene(3), SetWind(0x54)
+    (*filter).subscription_table[1] = 1;
+    (*filter).subscription_table[2] = 1;
+    (*filter).subscription_table[3] = 1;
+    (*filter).subscription_table[0x54] = 1;
+
+    // 3. Read level geometry from DDGame
+    let ddgame = (*parent).ddgame;
+    let level_right = (*ddgame).level_bound_max_x.0;
+    let level_left = (*ddgame).level_bound_min_x.0;
+    let level_width_int = (level_right - level_left) >> 16; // integer pixels
+    let level_min_x_int = (*ddgame).level_bound_min_x.0 >> 16; // integer part (signed)
+    let level_height = (*ddgame).level_height as i32;
+
+    // 4. Determine cloud count and weather modifier
+    let (cloud_count, weather_mod): (i32, i32) = if (*ddgame).level_width_raw != 0 {
+        (10, 0)
+    } else {
+        (32, -256)
+    };
+
+    if cloud_count <= 0 || level_width_int <= 0 {
+        return;
+    }
+
+    // 5. LCG random loop — spawn clouds as children of the filter
+    let mut rng_state: u32 = 0x12345678;
+    let mut layer_depth = 0x19_0000i32; // Fixed 25.0
+    let mut accum_3i = 0i32;
+
+    // Height contribution: (level_height + rounding) / 16
+    // Matches MSVC signed-division rounding: (val + (val >> 31 & 15)) >> 4
+    let height_round = if level_height < 0 {
+        level_height & 0xF
+    } else {
+        0
+    };
+    let height_contrib = (level_height + height_round) >> 4;
+
+    // Height tenth: level_height / 10 with MSVC magic-number divide
+    let height_tenth = {
+        let h = level_height as i64;
+        let raw = ((h * 0x6666_6667) >> 34) as i32;
+        raw + ((raw as u32 >> 31) as i32) // round toward zero
+    };
+
+    let ctask_ctor: unsafe extern "stdcall" fn(*mut u8, *mut u8, *mut DDGame) =
+        core::mem::transmute(rb(va::CTASK_CONSTRUCTOR) as usize);
+
+    for i in 0..cloud_count {
+        // X position: random within level bounds
+        let rand_frac = (rng_state & 0xFFFF) as i32;
+        rng_state = wa_lcg(rng_state);
+
+        let pos_x_int = rand_frac % level_width_int + level_min_x_int;
+
+        // Y seed: height/16 + scaled offset + weather modifier
+        let y_offset = height_tenth * i / cloud_count;
+        let y_seed = ((height_contrib + y_offset + weather_mod) << 16) as u32;
+
+        // X velocity: random magnitude + 0x8000, random sign
+        let vel_x_base = (rng_state & 0xFFFF) as i32 + 0x8000;
+        rng_state = wa_lcg(rng_state);
+        let vel_x = if rng_state & 0x10000 != 0 {
+            Fixed(-vel_x_base)
+        } else {
+            Fixed(vel_x_base)
+        };
+        rng_state = wa_lcg(rng_state); // advance a third time per iteration
+
+        // Cloud type: distributes large→medium→small across the batch
+        let cloud_type = match 2 - accum_3i / cloud_count {
+            0 => CloudType::Large,
+            1 => CloudType::Medium,
+            _ => CloudType::Small,
+        };
+
+        // Allocate cloud, construct CTask base, then init cloud fields
+        let cloud_box = WABox::<CTaskCloud>::alloc(0x74, 0x54);
+        let cloud_ptr = cloud_box.as_ptr();
+        ctask_ctor(cloud_ptr as *mut u8, filter as *mut u8, ddgame);
+        CTaskCloud::init(
+            cloud_ptr,
+            cloud_type,
+            Fixed(layer_depth),
+            Fixed(pos_x_int << 16),
+            vel_x,
+            y_seed,
+        );
+        cloud_box.leak(); // ownership transfers to the task tree
+
+        layer_depth -= 1;
+        accum_3i += 3;
+    }
+}

crates/openwa-wormkit/src/replacements/task/cloud.rs

@@ -1,10 +1,10 @@
-//! CTaskCloud vtable hooks.
+//! CTaskCloud vtable hooks and CreateWeatherFilter replacement.
 //!
-//! Thin wormkit shim — game logic lives in `openwa_core::task::cloud::cloud_handle_message`.
+//! Thin wormkit shim — game logic lives in `openwa_core::task::cloud`.
 
 use openwa_core::address::va;
 use openwa_core::log::log_line;
-use openwa_core::task::cloud;
+use openwa_core::task::{cloud, team};
 
 pub fn install() -> Result<(), String> {
     use openwa_core::vtable_replace;
@@ -13,6 +13,14 @@ pub fn install() -> Result<(), String> {
         handle_message => cloud::cloud_handle_message,
     })?;
 
-    let _ = log_line("[Cloud] HandleMessage hooked via vtable_replace");
+    unsafe {
+        crate::hook::install(
+            "CTaskTeam__CreateWeatherFilter",
+            va::CTASK_TEAM_CREATE_WEATHER_FILTER,
+            team::create_weather_filter as *const (),
+        )?;
+    }
+
+    let _ = log_line("[Cloud] HandleMessage + CreateWeatherFilter hooked");
     Ok(())
 }