Merge branch 'master' into worktree-debug-cli

crates/openwa-core/src/engine/ddgame.rs

@@ -175,19 +175,14 @@ pub struct DDGame {
     /// Initialized to 0x10000 (1.0). Not read by the render method — may be
     /// target/previous value for interpolation, or used by update logic.
     pub team_health_ratio_2: [i32; 6],
-    /// 0x4620-0x64D7: Unknown
-    ///
-    /// Known landmarks:
-    /// - 0x64D8: cleared by init
-    pub _unknown_4620: [u8; 0x64D8 - 0x4620],
-    /// 0x64D8: Cleared by InitFields. Purpose unknown.
-    pub init_field_64d8: u32,
-    /// 0x64DC-0x72A3: Unknown
-    pub _unknown_64dc: [u8; 0x72A4 - 0x64DC],
-    /// 0x72A4: Cleared by InitFields. Purpose unknown.
-    pub init_field_72a4: u32,
-    /// 0x72A8-0x72D7: Unknown
-    pub _unknown_72a8: [u8; 0x72D8 - 0x72A8],
+    /// 0x4620-0x4627: Unknown
+    pub _unknown_4620: [u8; 0x4628 - 0x4620],
+    /// 0x4628: Team arena state — per-team data, ammo, delays, alliance tracking.
+    /// Note: fields previously named init_field_64d8 (= team_count at arena+0x1EB0)
+    /// and init_field_72a4 (= weapon_slots entry at arena+0x2A7C) are inside this struct.
+    pub team_arena: TeamArenaState,
+    /// 0x7270-0x72D7: Unknown
+    pub _unknown_7270: [u8; 0x72D8 - 0x7270],
 
     /// 0x72D8: Game speed multiplier (Fixed-point, 0x10000 = 1.0x).
     pub game_speed: i32,
@@ -415,8 +410,10 @@ pub unsafe fn ddgame_init_fields(ddgame: *mut DDGame) {
         *(base.add(off) as *mut u32) = 0;
     }
 
-    (*ddgame).init_field_64d8 = 0;
-    (*ddgame).init_field_72a4 = 0;
+    // init_field_64d8 = TeamArenaState.team_count (arena+0x1EB0)
+    (*ddgame).team_arena.team_count = 0;
+    // init_field_72a4 = weapon_slots flat[754] = alliance 5, ammo[44]
+    (*ddgame).team_arena.weapon_slots.teams[5].ammo[44] = 0;
 
     // InitRenderIndices — original sets ESI = ddgame + 0x72D8, now uses typed DDGame ptr
     ddgame_init_render_indices(ddgame);
@@ -1431,17 +1428,17 @@ pub mod offsets {
     /// GetAmmo/AddAmmo/SubtractAmmo.
     pub const TEAM_ARENA_STATE: usize = 0x4628;
 
-    // === Team block array (7 × FullTeamBlock, stride 0x51C) ===
+    // === Team block array (7 × TeamBlock, stride 0x51C) ===
     /// Start of team block array within DDGame (7 blocks, stride 0x51C).
     /// Derived: entry_ptr(team=0) - 0x598 = 0x4628 - 0x598 = 0x4090.
     /// Runtime-confirmed: block[0] is zeroed preamble, blocks[1-6] hold team data.
     pub const TEAM_BLOCKS: usize = 0x4090;
 
-    /// Byte offset from TeamArenaState base back to FullTeamBlock array start.
-    /// `blocks_ptr = (tws_base as *const c_char).sub(ARENA_TO_BLOCKS) as *const FullTeamBlock`
+    /// Byte offset from TeamArenaState base back to TeamBlock array start.
+    /// `blocks_ptr = (tws_base as *const c_char).sub(ARENA_TO_BLOCKS) as *const TeamBlock`
     ///
     /// entry_ptr(0) = DDGame+0x4628 = TEAM_BLOCKS + 0x598.
-    /// 0x598 = sizeof(FullTeamBlock) + 0x7C = one block + offset into TeamBlockHeader.
+    /// 0x598 = sizeof(TeamBlock) + 0x7C = one block + offset into TeamHeader.
     pub const ARENA_TO_BLOCKS: usize = 0x598;
 
     // === FUN_00526120 init offsets (stride 0x194, 10 entries) ===
@@ -1639,7 +1636,7 @@ const _: () = assert!(core::mem::size_of::<SoundQueueEntry>() == 0x24);
 ///
 /// WA supports up to 8 playable worms per team. The original code accesses
 /// worms via raw pointer arithmetic from the team entry pointer, using
-/// stride 0x9C. This means the 8th worm crosses the FullTeamBlock boundary
+/// stride 0x9C. This means the 8th worm crosses the TeamBlock boundary
 /// into the next block's header slot — see `TeamArenaRef::team_worm()`.
 ///
 /// Field offsets confirmed by runtime memory dump (validator DLL):
@@ -1678,7 +1675,7 @@ pub struct WormEntry {
 
 const _: () = assert!(core::mem::size_of::<WormEntry>() == 0x9C);
 
-/// Team-level metadata stored at slot 0 of each FullTeamBlock (0x9C bytes).
+/// Team-level metadata stored at slot 0 of each TeamBlock (0x9C bytes).
 ///
 /// This struct overlays the same memory as a WormEntry but interprets the
 /// high offsets (0x6C+) as team metadata rather than worm data. The low
@@ -1688,9 +1685,9 @@ const _: () = assert!(core::mem::size_of::<WormEntry>() == 0x9C);
 /// Accessed via `TeamArenaRef::team_header()` and `team_header_b()`.
 #[repr(C)]
 #[derive(Clone, Copy)]
-pub struct TeamBlockHeader {
+pub struct TeamHeader {
     /// 0x00-0x5F: Opaque — may hold 8th worm data from previous team.
-    pub _worm_overlap: [u8; 0x60],
+    pub worm_overlap: [u8; 0x60],
     /// 0x60-0x6B: Unknown padding.
     pub _unknown_60: [u8; 0x0C],
     /// 0x6C: Team eliminated flag (nonzero = eliminated).
@@ -1701,8 +1698,11 @@ pub struct TeamBlockHeader {
     pub active_worm: i32,
     /// 0x78: Number of worms on this team.
     pub worm_count: i32,
-    /// 0x7C: Unknown.
-    pub _unknown_7c: [u8; 4],
+    /// 0x7C: Per-team turn action flags (bitfield).
+    /// Skip Go (weapon 57) toggles a bit here based on the weapon's fire_params.
+    /// Bit is set to mark the team should skip; in game_version > 0x1C, toggling
+    /// again clears it.
+    pub turn_action_flags: u32,
     /// 0x80: Alliance ID for ammo/delay table indexing (GetAmmo/AddAmmo/SubtractAmmo).
     /// Teams with the same weapon_alliance share ammo pools. Distinct from
     /// `alliance` at 0x70 which is used by CountTeamsByAlliance.
@@ -1713,27 +1713,27 @@ pub struct TeamBlockHeader {
     pub _unknown_98: [u8; 4],
 }
 
-const _: () = assert!(core::mem::size_of::<TeamBlockHeader>() == 0x9C);
+const _: () = assert!(core::mem::size_of::<TeamHeader>() == 0x9C);
 
-/// Union for slot 0 of a FullTeamBlock.
+/// Union for slot 0 of a TeamBlock.
 ///
 /// This slot is dual-purpose: its high offsets store team metadata
-/// (`TeamBlockHeader`), while its low offsets may contain the 8th worm
+/// (`TeamHeader`), while its low offsets may contain the 8th worm
 /// of the previous team (`WormEntry`). The two uses don't conflict
 /// because worm data occupies 0x00-0x5F and header data starts at 0x6C.
 #[repr(C)]
 #[derive(Clone, Copy)]
-pub union TeamBlockSlot0 {
+pub union TeamSlot0 {
     /// View as worm data (used when the previous team has 8 worms).
     pub worm: core::mem::ManuallyDrop<WormEntry>,
     /// View as team metadata (eliminated, alliance, worm_count, etc.).
-    pub team: core::mem::ManuallyDrop<TeamBlockHeader>,
+    pub team: core::mem::ManuallyDrop<TeamHeader>,
 }
 
 /// Full per-team data block (0x51C bytes, 7 blocks in DDGame).
 ///
-/// Each block starts with a `TeamBlockSlot0` union (0x9C bytes) that serves
-/// dual purpose: its high offsets hold team metadata (`TeamBlockHeader`),
+/// Each block starts with a `TeamSlot0` union (0x9C bytes) that serves
+/// dual purpose: its high offsets hold team metadata (`TeamHeader`),
 /// while its low offsets may contain the 8th worm of the previous team.
 /// The remaining 7 worm slots follow, then 0x3C bytes of metadata.
 ///
@@ -1742,19 +1742,19 @@ pub union TeamBlockSlot0 {
 /// which uses raw pointer arithmetic and naturally crosses block boundaries.
 ///
 /// **Header access**: Use `TeamArenaRef::team_header(idx)` to get the
-/// `TeamBlockHeader` for a team (reads from `blocks[idx+1].header.team`).
+/// `TeamHeader` for a team (reads from `blocks[idx+1].header.team`).
 #[repr(C)]
-pub struct FullTeamBlock {
-    /// 0x000-0x09B: Header slot (union of TeamBlockHeader and WormEntry).
+pub struct TeamBlock {
+    /// 0x000-0x09B: Header slot (union of TeamHeader and WormEntry).
     /// Team metadata at high offsets; may hold 8th worm data at low offsets.
-    pub header: TeamBlockSlot0,
+    pub header: TeamSlot0,
     /// 0x09C-0x4DF: 7 worm entries (slots 1-7, stride 0x9C)
     pub worms: [WormEntry; 7],
     /// 0x4E0-0x51B: Team metadata (0x3C bytes)
-    pub _metadata: [u8; 0x3C],
+    pub trailer: [u8; 0x3C],
 }
 
-const _: () = assert!(core::mem::size_of::<FullTeamBlock>() == 0x51C);
+const _: () = assert!(core::mem::size_of::<TeamBlock>() == 0x51C);
 
 /// Team arena state area within DDGame (at DDGame + 0x4628).
 ///
@@ -1769,8 +1769,26 @@ const _: () = assert!(core::mem::size_of::<FullTeamBlock>() == 0x51C);
 /// The original code accesses these as two arrays at different base offsets
 /// (0x1EB4 and 0x1FD0) using the same index `alliance_id * 142 + weapon_id`.
 /// Since 0x1FD0 - 0x1EB4 = 71 * 4, this is equivalent to accessing
-/// `weapon_slots[alliance * 142 + weapon]` for ammo and
-/// `weapon_slots[alliance * 142 + 71 + weapon]` for delay.
+/// `weapon_slots.teams[alliance].ammo[weapon]` and
+/// `weapon_slots.teams[alliance].delay[weapon]`.
+
+/// Per-alliance weapon ammo and delay data (0x238 = 568 bytes per alliance).
+#[repr(C)]
+pub struct TeamWeaponSlots {
+    /// Ammo counts per weapon (71 entries). -1 = unlimited, 0 = none, >0 = count.
+    pub ammo: [i32; 71],
+    /// Delay flags per weapon (71 entries). Nonzero = weapon on cooldown.
+    pub delay: [i32; 71],
+}
+const _: () = assert!(core::mem::size_of::<TeamWeaponSlots>() == 0x238);
+
+/// Weapon slot data for all 6 alliances (0xD50 = 3408 bytes total).
+#[repr(C)]
+pub struct WeaponSlots {
+    pub teams: [TeamWeaponSlots; 6],
+}
+const _: () = assert!(core::mem::size_of::<WeaponSlots>() == 852 * 4);
+
 #[repr(C)]
 pub struct TeamArenaState {
     /// 0x0000-0x1EAF: Per-team data region (opaque).
@@ -1778,20 +1796,19 @@ pub struct TeamArenaState {
     /// This region contains 7 team entries at stride 0x51C (1-indexed, index 0
     /// is preamble). The original WA.exe accesses team data via raw pointer
     /// arithmetic relative to the arena base. In our Rust code, team data is
-    /// accessed through `TeamArenaRef`, `FullTeamBlock`, and `TeamBlockHeader`,
+    /// accessed through `TeamArenaRef`, `TeamBlock`, and `TeamHeader`,
     /// so this region is treated as opaque padding.
     ///
     /// The 7th entry (team 6, 1-indexed) only has 8 bytes before team_count;
     /// the rest overlaps with weapon_slots.
-    pub _teams_region: [u8; 0x1EB0],
+    pub team_blocks_region: [u8; 0x1EB0],
     /// 0x1EB0: Number of teams in the game (used by team iteration loops)
     pub team_count: i32,
-    /// 0x1EB4: Interleaved ammo/delay slots.
-    /// Per alliance: [ammo_0..ammo_70, delay_0..delay_70] = 142 i32 entries.
-    /// 6 alliances * 142 = 852 total entries.
+    /// 0x1EB4: Per-alliance weapon ammo and delay data.
+    /// 6 alliances, each with 71 ammo + 71 delay i32 entries.
     /// Ammo: -1 = unlimited, 0 = none, >0 = count.
     /// Delay: nonzero = weapon on delay.
-    pub weapon_slots: [i32; 852],
+    pub weapon_slots: WeaponSlots,
     /// 0x2C04: Padding between weapon_slots end and game_mode_flag.
     /// weapon_slots: 852 * 4 = 3408 = 0xD50. 0x1EB4 + 0xD50 = 0x2C04.
     pub _pad_2c04: [u8; 8],
@@ -1851,20 +1868,19 @@ pub const GAME_PHASE_SUDDEN_DEATH: i32 = 0x1E4; // 484
 pub const GAME_PHASE_NORMAL_MIN: i32 = -2;
 
 impl TeamArenaState {
-    /// Get ammo count for a weapon slot (by flat index).
-    pub fn get_ammo(&self, index: usize) -> i32 {
-        self.weapon_slots[index]
+    /// Get ammo count for a weapon by alliance and weapon ID.
+    pub fn get_ammo(&self, alliance: usize, weapon_id: usize) -> i32 {
+        self.weapon_slots.teams[alliance].ammo[weapon_id]
     }
 
-    /// Get mutable reference to ammo count for a weapon slot.
-    pub fn ammo_mut(&mut self, index: usize) -> &mut i32 {
-        &mut self.weapon_slots[index]
+    /// Get mutable reference to ammo count.
+    pub fn ammo_mut(&mut self, alliance: usize, weapon_id: usize) -> &mut i32 {
+        &mut self.weapon_slots.teams[alliance].ammo[weapon_id]
     }
 
-    /// Get delay flag for a weapon slot (by flat index).
-    /// Delay is at +71 offset from the ammo index within the same alliance block.
-    pub fn get_delay(&self, index: usize) -> i32 {
-        self.weapon_slots[index + 71]
+    /// Get delay flag for a weapon by alliance and weapon ID.
+    pub fn get_delay(&self, alliance: usize, weapon_id: usize) -> i32 {
+        self.weapon_slots.teams[alliance].delay[weapon_id]
     }
 }
 
@@ -1872,7 +1888,7 @@ impl TeamArenaState {
 ///
 /// Wraps the raw `base: u32` from trampoline register captures and provides
 /// accessor methods that encapsulate the backward pointer arithmetic to reach
-/// FullTeamBlock worm data. The FullTeamBlock array lives 0x598 bytes before
+/// TeamBlock worm data. The TeamBlock array lives 0x598 bytes before
 /// the TeamArenaState in DDGame memory.
 ///
 /// # Safety
@@ -1882,18 +1898,29 @@ impl TeamArenaState {
 #[repr(transparent)]
 #[derive(Clone, Copy)]
 pub struct TeamArenaRef {
-    base: *const u8,
+    base: *mut u8,
 }
 
 impl TeamArenaRef {
-    /// Wrap a raw base pointer (for non-trampoline contexts like validation).
+    /// Wrap a raw integer pointer (for usercall trampoline register captures).
     ///
     /// # Safety
-    /// `base` must point to DDGame + TEAM_ARENA_STATE (0x4628).
+    /// `base` must point to a valid TeamArenaState (DDGame + 0x4628).
     #[inline]
     pub unsafe fn from_raw(base: u32) -> Self {
         Self {
-            base: base as *const u8,
+            base: base as *mut u8,
+        }
+    }
+
+    /// Wrap a typed pointer to TeamArenaState.
+    ///
+    /// # Safety
+    /// `arena` must point to a valid TeamArenaState within a live DDGame.
+    #[inline]
+    pub unsafe fn from_ptr(arena: *mut TeamArenaState) -> Self {
+        Self {
+            base: arena as *mut u8,
         }
     }
 
@@ -1909,10 +1936,10 @@ impl TeamArenaRef {
         &mut *(self.base as *mut TeamArenaState)
     }
 
-    /// Get pointer to the FullTeamBlock array base.
+    /// Get pointer to the TeamBlock array base.
     #[inline]
-    pub unsafe fn blocks(&self) -> *const FullTeamBlock {
-        self.base.sub(offsets::ARENA_TO_BLOCKS) as *const FullTeamBlock
+    pub unsafe fn blocks(&self) -> *mut TeamBlock {
+        self.base.sub(offsets::ARENA_TO_BLOCKS) as *mut TeamBlock
     }
 
     /// Get the team header (metadata) for a team.
@@ -1920,15 +1947,21 @@ impl TeamArenaRef {
     /// Returns `&block[team_idx+1].header.team`, which holds team metadata:
     /// worm_count, eliminated flag, weapon_alliance, team_name.
     #[inline]
-    pub unsafe fn team_header(&self, team_idx: usize) -> &TeamBlockHeader {
+    pub unsafe fn team_header(&self, team_idx: usize) -> &TeamHeader {
         &(*self.blocks().add(team_idx + 1)).header.team
     }
 
+    /// Get a mutable team header for a team.
+    #[inline]
+    pub unsafe fn team_header_mut(&self, team_idx: usize) -> &mut TeamHeader {
+        &mut (*self.blocks().add(team_idx + 1)).header.team
+    }
+
     /// Get a playable worm entry by 1-indexed worm number (1..=8).
     ///
     /// Uses raw pointer arithmetic matching the original WA code:
     /// `base + team_idx * 0x51C + worm_num * 0x9C - 0x598`.
-    /// This naturally crosses FullTeamBlock boundaries when worm_num = 8,
+    /// This naturally crosses TeamBlock boundaries when worm_num = 8,
     /// since the 8th worm's early fields (state, health) spill into the
     /// next block's header slot. The header metadata lives at high offsets
     /// (0x6C+) that don't conflict with worm data (0x00-0x5F).
@@ -1951,7 +1984,7 @@ impl TeamArenaRef {
     /// **Note**: For accessing worms, prefer `team_worm()` which handles
     /// 8-worm teams correctly via cross-boundary pointer arithmetic.
     #[inline]
-    pub unsafe fn team_and_header(&self, team_idx: usize) -> (&FullTeamBlock, &TeamBlockHeader) {
+    pub unsafe fn team_and_header(&self, team_idx: usize) -> (&TeamBlock, &TeamHeader) {
         let blocks = self.blocks();
         let block = &*blocks.add(team_idx);
         let header = &(*blocks.add(team_idx + 1)).header.team;
@@ -1963,14 +1996,14 @@ impl TeamArenaRef {
     /// Pattern B indexes from block[i+2] for 0-indexed team `i`:
     /// `base + 0x510 + i*0x51C` = `blocks[i+2].header.team + 0x70`.
     #[inline]
-    pub unsafe fn team_header_b(&self, team_idx: usize) -> &TeamBlockHeader {
+    pub unsafe fn team_header_b(&self, team_idx: usize) -> &TeamHeader {
         &(*self.blocks().add(team_idx + 2)).header.team
     }
 
     /// Get mutable team header for Pattern B access.
     #[inline]
-    pub unsafe fn team_header_b_mut(&self, team_idx: usize) -> &mut TeamBlockHeader {
-        &mut (*(self.blocks() as *mut FullTeamBlock).add(team_idx + 2))
+    pub unsafe fn team_header_b_mut(&self, team_idx: usize) -> &mut TeamHeader {
+        &mut (*(self.blocks() as *mut TeamBlock).add(team_idx + 2))
             .header
             .team
     }
@@ -1984,9 +2017,10 @@ impl TeamArenaRef {
     /// then 71 delay slots (stride 142 per alliance).
     /// Ammo: `weapon_slots[alliance_id * 142 + weapon_id]`
     /// Delay: `weapon_slots[alliance_id * 142 + 71 + weapon_id]`
+    /// Returns (alliance_id, weapon_id) for accessing weapon slots.
     #[inline]
-    pub unsafe fn ammo_index(&self, team_index: usize, weapon_id: u32) -> usize {
+    pub unsafe fn weapon_slot_key(&self, team_index: usize, weapon_id: u32) -> (usize, usize) {
         let alliance_id = self.team_header(team_index).weapon_alliance as usize;
-        alliance_id * 142 + weapon_id as usize
+        (alliance_id, weapon_id as usize)
     }
 }

crates/openwa-core/src/engine/game_state_init.rs

@@ -385,11 +385,11 @@ pub unsafe fn check_weapon_avail(ddgame: *mut DDGame, weapon_index: u32) -> i32
         _ => {}
     }
 
-    // Step 2: Branch on weapon name pointer (non-null = weapon defined).
+    // Step 2: Branch on weapon defined flag (nonzero = weapon exists in table).
     let weapon_table = (*ddgame).weapon_table;
-    let name_ptr = (*weapon_table).entries[weapon_index as usize].name1;
+    let defined = (*weapon_table).entries[weapon_index as usize].defined;
 
-    if (*ddgame).level_width_raw == 0 || !name_ptr.is_null() {
+    if (*ddgame).level_width_raw == 0 || defined != 0 {
         // Main path: check super weapon flag
         let super_result = is_super_weapon(weapon_index, (*ddgame).version_flag_3);
         if super_result != 0 && (*gi).super_weapon_allowed == 0 {

crates/openwa-core/src/engine/mod.rs

@@ -9,8 +9,8 @@ pub mod net_bridge;
 pub mod net_wrapper;
 
 pub use ddgame::{
-    DDGame, FullTeamBlock, RenderEntry, SoundQueueEntry, TeamArenaRef, TeamArenaState,
-    TeamBlockHeader, TeamBlockSlot0, TeamIndexMap, WormEntry, GAME_PHASE_NORMAL_MIN,
+    DDGame, RenderEntry, SoundQueueEntry, TeamArenaRef, TeamArenaState, TeamBlock,
+    TeamHeader, TeamIndexMap, TeamSlot0, WormEntry, GAME_PHASE_NORMAL_MIN,
     GAME_PHASE_SUDDEN_DEATH,
 };
 pub use ddgame_wrapper::DDGameWrapper;

crates/openwa-core/src/game/weapon.rs

@@ -104,35 +104,61 @@ impl TryFrom<u32> for Weapon {
 /// 71 standard entries (indices 0..70), matching the `Weapon` enum.
 /// Source: wkJellyWorm/src/CustomWeapons.h (WeaponStruct).
 ///
-/// Only 3 fields are confirmed; the rest is opaque. wkJellyWorm copies
-/// entire entries via memcpy when creating custom weapons.
+/// Known fields from wkJellyWorm and InitWeaponTable (0x53CAB0) analysis.
+/// wkJellyWorm copies entire entries via memcpy when creating custom weapons.
 #[repr(C)]
 pub struct WeaponEntry {
     /// +0x00: Pointer to primary weapon name string.
-    /// Non-null means the weapon is defined/available.
     pub name1: *const c_char,
     /// +0x04: Pointer to secondary weapon name string.
     pub name2: *const c_char,
-    /// +0x08: Weapon panel row index (0..12).
-    pub panel_row: i32,
+    /// +0x08: Panel state (init: 0xFFFFFFFF). wkJellyWorm calls this `panelRow`.
+    pub panel_state: i32,
     /// +0x0C: Unknown.
     pub _unknown_0c: i32,
-    /// +0x10-0x1CF: Unknown fields (113 × i32).
-    pub _unknown_10: [u8; 0x1D0 - 0x10],
+    /// +0x10: Weapon defined flag. Nonzero = weapon exists in table.
+    /// Checked by DDGame__CheckWeaponAvail to determine if weapon is valid.
+    pub defined: i32,
+    /// +0x14-0x23: Unknown.
+    pub _unknown_14: [u8; 0x24 - 0x14],
+    /// +0x24: Availability flag. Init: 0xFFFFFFFF, then set to 0 (unavailable)
+    /// or 1 (available) per weapon. Weapon::None, SkipGo, Surrender default to 0.
+    pub availability: i32,
+    /// +0x28: Enabled flag (init: 1).
+    pub enabled: i32,
+    /// +0x2C-0x2F: Unknown.
+    pub _unknown_2c: [u8; 4],
+    /// +0x30: Weapon fire type (1=projectile, 2=rope, 3=grenade, 4=special).
+    /// Read by FireWeapon to dispatch to the correct handler.
+    pub fire_type: i32,
+    /// +0x34: Fire subtype for weapon types 3 (grenade/mortar) and 4 (special).
+    pub fire_subtype_34: i32,
+    /// +0x38: Fire subtype for weapon types 1 (projectile) and 2 (rope).
+    pub fire_subtype_38: i32,
+    /// +0x3C: Fire parameters sub-structure. Pointer to this field is passed
+    /// to fire sub-functions (PlacedExplosive, Projectile, CreateWeaponProjectile, etc.).
+    pub fire_params: WeaponFireParams,
 }
 const _: () = assert!(core::mem::size_of::<WeaponEntry>() == 0x1D0);
 
-/// Weapon table header (0x10 = 16 bytes before the first entry).
+/// Weapon fire parameters — embedded at WeaponEntry+0x3C.
 ///
-/// The table is allocated by `InitWeaponTable` (0x53CAB0) and stored
-/// at DDGame+0x510. Layout: 16-byte header + 71 × WeaponEntry.
+/// Pointer to this struct is passed to all fire dispatch sub-functions.
+/// Internal layout is mostly unknown (0x194 bytes).
+#[repr(C)]
+pub struct WeaponFireParams {
+    /// +0x00 (WeaponEntry+0x3C): First param DWORD.
+    pub _data: [u8; 0x1D0 - 0x3C],
+}
+const _: () = assert!(core::mem::size_of::<WeaponFireParams>() == 0x1D0 - 0x3C);
+
+/// Weapon table — flat array of 71 entries, no header.
+///
+/// Allocated by `InitWeaponTable` (0x53CAB0), stored at DDGame+0x510.
+/// Total size: 71 × 0x1D0 = 0x80B0 bytes.
 #[repr(C)]
 pub struct WeaponTable {
-    /// +0x00-0x0F: Header (purpose unknown).
-    pub _header: [u8; 0x10],
-    /// +0x10: Weapon entries array (71 standard weapons).
+    /// Weapon entries array (71 standard weapons, indices 0..70).
     pub entries: [WeaponEntry; 71],
 }
-const _: () = assert!(
-    core::mem::size_of::<WeaponTable>() == 0x10 + 71 * 0x1D0
-);
+const _: () = assert!(core::mem::size_of::<WeaponTable>() == 71 * 0x1D0);

crates/openwa-core/src/task/base.rs

@@ -139,6 +139,25 @@ impl SharedDataTable {
         h
     }
 
+    /// Look up an entity by key pair. Returns the entity pointer, or null.
+    ///
+    /// Pure Rust equivalent of `FUN_004FDF90` (SharedData__Lookup).
+    /// fastcall(ECX=key_esi, EDX=key_edi, stack=task) in the original.
+    ///
+    /// # Safety
+    /// The table and all linked nodes must be valid.
+    pub unsafe fn lookup(&self, key_esi: u32, key_edi: u32) -> *mut u8 {
+        let bucket = Self::bucket_for(key_esi, key_edi) as usize;
+        let mut node = *self.buckets.add(bucket);
+        while !node.is_null() {
+            if (*node).key_edi == key_edi && (*node).key_esi == key_esi {
+                return (*node).entity;
+            }
+            node = (*node).next;
+        }
+        core::ptr::null_mut()
+    }
+
     /// Iterate all nodes across all 256 buckets.
     ///
     /// # Safety

crates/openwa-core/src/task/game_task.rs

@@ -13,8 +13,15 @@ use crate::fixed::Fixed;
 pub struct CGameTask {
     /// 0x00-0x2F: Base CTask fields
     pub base: CTask,
-    /// 0x30-0x83: Unknown gameplay fields (84 bytes)
-    pub _unknown_30: [u8; 0x54],
+    /// 0x30-0x83: Subclass-specific data (84 bytes). Each CGameTask derivative
+    /// uses this region differently:
+    /// - CTaskWorm: weapon fire state (+0x30 type, +0x34/+0x38 subtypes, +0x3C flag)
+    /// - CTaskFilter: boolean message subscription table (+0x30..+0x93)
+    /// - CTaskMissile: spawn/physics parameters
+    /// - CTaskTeam: secondary vtable pointer (+0x30)
+    /// - CTaskCloud: parallax scroll depth (+0x30)
+    /// Access via subclass accessor methods, not directly.
+    pub subclass_data: [u8; 0x54],
     /// 0x84: X position in fixed-point
     pub pos_x: Fixed,
     /// 0x88: Y position in fixed-point

crates/openwa-core/src/task/mod.rs

@@ -3,14 +3,14 @@ pub mod bit_grid;
 mod cloud;
 mod filter;
 mod fire;
-mod game_task;
+pub mod game_task;
 mod mine_oil_drum;
 mod missile;
 mod overlays;
 mod supply_crate;
 mod team;
 mod turn_game;
-mod worm;
+pub mod worm;
 
 pub use base::{CTask, CTaskBfsIter, SharedDataIter, SharedDataNode, SharedDataTable};
 pub use cloud::CTaskCloud;

crates/openwa-core/src/task/worm.rs

@@ -1,5 +1,6 @@
 use super::base::CTask;
 use super::game_task::CGameTask;
+use crate::game::weapon::WeaponEntry;
 
 /// Virtual method table for CTaskWorm (vtable at 0x6644C8, 20 slots).
 ///
@@ -75,7 +76,7 @@ const _: () = assert!(core::mem::size_of::<CTaskWormVTable>() == 20 * 4);
 /// Vtable at 0x6644C8. Class type byte: 0x12.
 ///
 /// # Important fields in the CGameTask base
-/// The worm state field lives at **offset +0x44** (inside `base._unknown_30`).
+/// The worm state field lives at **offset +0x44** (inside `base.subclass_data`).
 /// Use [`CTaskWorm::state`] to read it without pointer arithmetic.
 ///
 /// Source: Ghidra decompilation of 0x50BFB0, vtable analysis of 0x6644C8,
@@ -151,8 +152,12 @@ pub struct CTaskWorm {
     pub _unknown_338: [u8; 0x368 - 0x338],
     /// 0x368: Animator / controller object (dispatched via vtable for state animations)
     pub animator: *mut u8,
-    /// 0x36C–0x3DB: Unknown (rope anchor, weapon-specific data, etc.)
-    pub _unknown_36c: [u8; 0x3DC - 0x36C],
+    /// 0x36C: Active weapon entry pointer. Points to `&WeaponTable.entries[selected_weapon]`.
+    /// Contains fire type (+0x30), subtypes (+0x34/+0x38), and completion flag (+0x3C).
+    /// Used by WeaponRelease: `MOV EAX, [EDI+0x36C]` before calling FireWeapon.
+    pub active_weapon_entry: *mut WeaponEntry,
+    /// 0x370–0x3DB: Unknown (rope anchor, weapon-specific data, etc.)
+    pub _unknown_370: [u8; 0x3DC - 0x370],
     /// 0x3DC: Facing direction. -1 = facing left, +1 = facing right.
     pub facing_direction: i32,
     /// 0x3E0–0x3E3: Unknown
@@ -172,17 +177,30 @@ pub struct CTaskWorm {
 const _: () = assert!(core::mem::size_of::<CTaskWorm>() == 0x3FC);
 
 impl CTaskWorm {
-    /// Returns the worm's current state code (lives at offset +0x44, inside the
-    /// CGameTask base's `_unknown_30` padding region).
+    /// Returns the worm's current state code (lives at offset +0x44, inside
+    /// `base.subclass_data`).
     ///
     /// Known states: `0x65`=idle, `0x67`=active turn, `0x7F`=drowning,
     /// `0x80`=hurt, `0x81`/`0x86`=dead, `0x87`=dead variant, `0x8B`=unknown.
     pub fn state(&self) -> u32 {
-        // SAFETY: offset 0x44 is within CGameTask._unknown_30 (0x30..0x84).
-        // Aligned to 4 bytes; repr(C) guarantees no reordering.
         unsafe { *((self as *const CTaskWorm as *const u8).add(0x44) as *const u32) }
     }
 
+    // Weapon fire dispatch state:
+    // - Fire type/subtypes live in the WeaponEntry (via active_weapon_entry at +0x36C)
+    // - Completion flag lives in CGameTask.subclass_data[12] (this object, at +0x3C)
+
+    /// Weapon fire completion flag at CGameTask+0x3C (subclass_data[12]).
+    /// Set to 0 before FireWeapon dispatch, 1 after.
+    pub fn fire_complete(&self) -> i32 {
+        i32::from_ne_bytes(self.base.subclass_data[12..16].try_into().unwrap())
+    }
+
+    /// Set the weapon fire completion flag.
+    pub fn set_fire_complete(&mut self, value: i32) {
+        self.base.subclass_data[12..16].copy_from_slice(&value.to_ne_bytes());
+    }
+
     /// Returns a reference to the vtable.
     ///
     /// # Safety

crates/openwa-debugui/src/app.rs

@@ -84,6 +84,25 @@ unsafe fn get_ddgame() -> Option<*const DDGame> {
     Some(ddgame_ptr)
 }
 
+/// Unlock all weapons: set ammo to unlimited (-1) and delays to 0 for all teams.
+unsafe fn cheat_unlock_all_weapons() {
+    let Some(ddgame) = get_ddgame() else {
+        log::push("[Cheats] Not in game");
+        return;
+    };
+    let ddgame = ddgame as *mut DDGame;
+    let arena = &mut (*ddgame).team_arena;
+    for team in &mut arena.weapon_slots.teams {
+        for ammo in &mut team.ammo {
+            *ammo = -1; // unlimited
+        }
+        for delay in &mut team.delay {
+            *delay = 0; // no delay
+        }
+    }
+    log::push("[Cheats] All weapons unlocked (infinite ammo, no delays)");
+}
+
 /// Read child task pointers from a CTask's children array.
 ///
 /// The array is **sparse**: slots are nulled when a child is removed rather than
@@ -221,6 +240,14 @@ impl eframe::App for DebugApp {
         self.nav_history.retain(|a| live_addrs.contains(a));
 
         egui::TopBottomPanel::top("toolbar").show(ctx, |ui| {
+            egui::menu::bar(ui, |ui| {
+                ui.menu_button("Cheats", |ui| {
+                    if ui.button("Unlock all weapons").clicked() {
+                        unsafe { cheat_unlock_all_weapons() };
+                        ui.close_menu();
+                    }
+                });
+            });
             ui.horizontal(|ui| {
                 ui.checkbox(&mut self.show_transient, "Show transient");
             });

crates/openwa-wormkit/src/replacements/weapon.rs

@@ -1,14 +1,20 @@
-//! Weapon ammo hooks.
+//! Weapon hooks.
 //!
 //! Replaces WA.exe functions that manage weapon ammo in the TeamArenaState area (DDGame + 0x4628):
 //! - GetAmmo (0x5225E0): query ammo count with delay/phase checks
 //! - AddAmmo (0x522640): add ammo to a weapon slot
 //! - SubtractAmmo (0x522680): decrement ammo count
 //! - CountAliveWorms (0x5225A0): check if >1 worm alive on team
+//! - FireWeapon (0x51EE60): passthrough with weapon type logging
+
+use core::sync::atomic::{AtomicU32, Ordering};
 
 use openwa_core::address::va;
 use openwa_core::engine::ddgame::{self, TeamArenaRef};
+use openwa_core::game::weapon::{WeaponEntry, WeaponFireParams};
 use openwa_core::game::Weapon;
+use openwa_core::log::log_line;
+use openwa_core::task::worm::CTaskWorm;
 
 use crate::hook::{self, usercall_trampoline};
 
@@ -24,14 +30,14 @@ unsafe extern "cdecl" fn add_ammo_impl(
     arena: TeamArenaRef,
     weapon_id: u32,
 ) {
-    let idx = arena.ammo_index(team_index as usize, weapon_id);
+    let (alliance, wid) = arena.weapon_slot_key(team_index as usize, weapon_id);
     let state = arena.state_mut();
-    let ammo = state.get_ammo(idx);
+    let ammo = state.get_ammo(alliance, wid);
     if ammo >= 0 {
         if amount < 0 {
-            *state.ammo_mut(idx) = -1; // set unlimited
+            *state.ammo_mut(alliance, wid) = -1;
         } else {
-            *state.ammo_mut(idx) = ammo + amount;
+            *state.ammo_mut(alliance, wid) = ammo + amount;
         }
     }
 }
@@ -46,11 +52,11 @@ usercall_trampoline!(fn trampoline_add_ammo; impl_fn = add_ammo_impl;
 // RET 0x4
 
 unsafe extern "cdecl" fn subtract_ammo_impl(team_index: u32, arena: TeamArenaRef, weapon_id: u32) {
-    let idx = arena.ammo_index(team_index as usize, weapon_id);
+    let (alliance, wid) = arena.weapon_slot_key(team_index as usize, weapon_id);
     let state = arena.state_mut();
-    let ammo = state.get_ammo(idx);
+    let ammo = state.get_ammo(alliance, wid);
     if ammo > 0 {
-        *state.ammo_mut(idx) = ammo - 1;
+        *state.ammo_mut(alliance, wid) = ammo - 1;
     }
 }
 
@@ -68,11 +74,11 @@ unsafe extern "cdecl" fn get_ammo_impl(
     arena: TeamArenaRef,
     weapon_id: u32,
 ) -> u32 {
-    let idx = arena.ammo_index(team_index as usize, weapon_id);
+    let (alliance, wid) = arena.weapon_slot_key(team_index as usize, weapon_id);
     let state = arena.state();
 
     // Check weapon delay
-    if state.get_delay(idx) != 0 {
+    if state.get_delay(alliance, wid) != 0 {
         if state.game_mode_flag == 0 {
             return 0;
         }
@@ -92,7 +98,7 @@ unsafe extern "cdecl" fn get_ammo_impl(
         }
     }
 
-    state.get_ammo(idx) as u32
+    state.get_ammo(alliance, wid) as u32
 }
 
 usercall_trampoline!(fn trampoline_get_ammo; impl_fn = get_ammo_impl;
@@ -123,6 +129,439 @@ unsafe extern "cdecl" fn count_alive_worms_impl(team_index: u32, arena: TeamAren
 usercall_trampoline!(fn trampoline_count_alive_worms; impl_fn = count_alive_worms_impl;
     regs = [eax, ecx]);
 
+// ============================================================
+// FireWeapon replacement (0x51EE60)
+// ============================================================
+// Convention: usercall(EAX=worm, ECX=local_struct) + 1 stack(worm), RET 0x4.
+// Note: EAX = *(CTaskWorm+0x36C) = worm self-pointer, so EAX == stack param.
+//
+// Weapon launch data offsets (relative to worm/EAX):
+//   +0x30 = weapon type (1-4)
+//   +0x34 = subtype for types 3,4
+//   +0x38 = subtype for types 1,2
+//   +0x3C = params base
+//
+// worm = CTaskWorm pointer (ESI in original).
+// local_struct = stack-local buffer from WeaponRelease (ECX at call site).
+//
+// Sub-functions are usercall: ESI=worm, ECX=local_struct (for some).
+// We capture all three in our naked trampoline.
+
+static ORIG_FIRE_WEAPON: AtomicU32 = AtomicU32::new(0);
+
+/// Naked trampoline for FireWeapon.
+/// Must save ALL callee-saved registers (ESI, EDI, EBX, EBP) because the
+/// Rust cdecl impl may clobber them, and WeaponRelease (our caller) depends
+/// on them being preserved.
+#[unsafe(naked)]
+unsafe extern "C" fn trampoline_fire_weapon() {
+    core::arch::naked_asm!(
+        // Save all callee-saved + EDX
+        "push ebx",
+        "push esi",
+        "push edi",
+        "push ebp",
+        "push edx",
+        // Push cdecl args: (weapon_ctx=EAX, local_struct=ECX, worm)
+        // Stack: 5 pushes (20) + ret (4) = 24 to stack param
+        "push [esp+24]",      // worm
+        "push ecx",           // local_struct
+        "push eax",           // weapon_ctx
+        "call {impl_fn}",
+        "add esp, 12",
+        // Restore everything
+        "pop edx",
+        "pop ebp",
+        "pop edi",
+        "pop esi",
+        "pop ebx",
+        "ret 0x4",
+        impl_fn = sym fire_weapon_impl,
+    );
+}
+
+/// Rust implementation of FireWeapon dispatch.
+///
+/// `entry`: EAX = active WeaponEntry pointer (from CTaskWorm+0x36C).
+/// `local_struct`: ECX = stack-local buffer from WeaponRelease.
+/// `worm`: stack param = CTaskWorm pointer (ESI in original).
+///
+/// Completion flag at worm+0x3C (CGameTask.subclass_data[12]).
+/// Params pointer at entry+0x3C (WeaponEntry.fire_complete) — different object, same offset.
+unsafe extern "cdecl" fn fire_weapon_impl(
+    entry: *const WeaponEntry, local_struct: u32, worm: *mut CTaskWorm,
+) {
+    use openwa_core::rebase::rb;
+
+    let weapon_type = (*entry).fire_type;
+    let subtype_34 = (*entry).fire_subtype_34;
+    let subtype_38 = (*entry).fire_subtype_38;
+    let fire_params = &raw const (*entry).fire_params;
+    let w = worm as u32;
+
+    // Log weapon fire
+    let weapon_id = (*worm).selected_weapon;
+    let weapon_name = Weapon::try_from(weapon_id)
+        .map(|wp| format!("{:?}", wp))
+        .unwrap_or_else(|id| format!("Unknown({})", id));
+    let _ = log_line(&format!(
+        "[Weapon] FireWeapon: {} (id={}) type={} sub34={} sub38={}",
+        weapon_name, weapon_id, weapon_type, subtype_34, subtype_38
+    ));
+
+    (*worm).set_fire_complete(0);
+
+    match weapon_type {
+        1 => match subtype_38 {
+            1 => call_fire_stdcall1(w, fire_params, rb(0x51EC80)),                    // PlacedExplosive
+            2 => call_fire_stdcall3(w, fire_params, local_struct, rb(0x51DFB0)),      // Projectile
+            3 => call_fire_thiscall2(w, fire_params, local_struct, rb(0x51E0F0)),     // CreateWeaponProjectile
+            4 => call_fire_stdcall2(w, fire_params, local_struct, rb(0x51ED90)),      // Shotgun
+            _ => {}
+        },
+        2 => match subtype_38 {
+            1 => call_fire_stdcall3(w, fire_params, local_struct, rb(0x51E1C0)),      // RopeType1
+            2 => call_fire_thiscall2(w, fire_params, local_struct, rb(0x51E0F0)),     // CreateWeaponProjectile
+            3 => call_fire_stdcall3(w, fire_params, local_struct, rb(0x51E240)),      // RopeType3
+            _ => {}
+        },
+        3 => {
+            // GrenadeMortar receives &fire_subtype_34 as its params pointer
+            let subtype_34_ptr = &raw const (*entry).fire_subtype_34 as *const WeaponFireParams;
+            call_fire_stdcall3(w, subtype_34_ptr, local_struct, rb(0x51E2C0));
+        }
+        4 => {
+            let subtype_38_ptr = &raw const (*entry).fire_subtype_38 as u32;
+            fire_weapon_special(subtype_34, subtype_38_ptr, worm, local_struct, entry);
+        }
+        _ => {}
+    }
+
+    (*worm).set_fire_complete(1);
+}
+
+// ── Sub-function bridges ────────────────────────────────────
+// All preserve ESI=worm for usercall sub-functions.
+
+// ── Sub-function bridges ────────────────────────────────────
+// All bridges set ESI=worm AND EDI=worm before calling, since
+// sub-functions are usercall and read both registers implicitly.
+// Stack offsets are carefully calculated for each bridge.
+
+// ── Sub-function bridges ────────────────────────────────────
+// All bridges save/restore ESI+EDI, set ESI=EDI=worm, then call.
+// This preserves LLVM's callee-saved registers while providing
+// the usercall context that sub-functions expect.
+
+/// Bridge: PlacedExplosive — stdcall(fire_params), RET 0x4.
+#[unsafe(naked)]
+unsafe extern "C" fn call_fire_stdcall1(
+    _worm: u32, _fire_params: *const WeaponFireParams, _addr: u32,
+) {
+    core::arch::naked_asm!(
+        "push ebx",
+        "push esi",
+        "push edi",
+        "mov esi, [esp+16]",  // worm (3 saves=12 + ret=4 = 16)
+        "mov edi, [esp+16]",
+        "mov ebx, [esp+24]",  // addr
+        "push [esp+20]",      // params
+        "call ebx",
+        "pop edi",
+        "pop esi",
+        "pop ebx",
+        "ret",
+    );
+}
+
+/// Bridge: Projectile/Rope/Grenade — stdcall(worm, fire_params, local_struct), RET 0xC.
+#[unsafe(naked)]
+unsafe extern "C" fn call_fire_stdcall3(
+    _worm: u32, _fire_params: *const WeaponFireParams, _local: u32, _addr: u32,
+) {
+    core::arch::naked_asm!(
+        "push ebx",
+        "push esi",
+        "push edi",
+        "mov esi, [esp+16]",  // worm (3 saves=12 + ret=4 = 16)
+        "mov edi, [esp+16]",
+        "mov ebx, [esp+28]",  // addr (saves=12 + ret=4 + 3 args=12 = 28)
+        "push [esp+24]",      // local_struct
+        "push [esp+24]",      // params (shifted +4)
+        "push [esp+24]",      // worm (shifted +8)
+        "call ebx",
+        "pop edi",
+        "pop esi",
+        "pop ebx",
+        "ret",
+    );
+}
+
+/// Bridge: CreateWeaponProjectile — thiscall(ECX=worm, fire_params, local_struct), RET 0x8.
+#[unsafe(naked)]
+unsafe extern "C" fn call_fire_thiscall2(
+    _worm: u32, _fire_params: *const WeaponFireParams, _local: u32, _addr: u32,
+) {
+    core::arch::naked_asm!(
+        "push ebx",
+        "push esi",
+        "push edi",
+        "mov esi, [esp+16]",  // worm
+        "mov edi, [esp+16]",
+        "mov ecx, [esp+16]",  // ECX = worm (this)
+        "mov ebx, [esp+28]",  // addr
+        "push [esp+24]",      // local_struct
+        "push [esp+24]",      // params (shifted +4)
+        "call ebx",
+        "pop edi",
+        "pop esi",
+        "pop ebx",
+        "ret",
+    );
+}
+
+/// Bridge: Shotgun — stdcall(fire_params, local_struct), RET 0x8.
+#[unsafe(naked)]
+unsafe extern "C" fn call_fire_stdcall2(
+    _worm: u32, _fire_params: *const WeaponFireParams, _local: u32, _addr: u32,
+) {
+    core::arch::naked_asm!(
+        "push ebx",
+        "push esi",
+        "push edi",
+        "mov esi, [esp+16]",  // worm
+        "mov edi, [esp+16]",
+        "mov ebx, [esp+28]",  // addr
+        "push [esp+24]",      // local_struct
+        "push [esp+24]",      // params (shifted +4)
+        "call ebx",
+        "pop edi",
+        "pop esi",
+        "pop ebx",
+        "ret",
+    );
+}
+
+/// Type 4 (special) weapon dispatch.
+/// Type 4 (special) weapon dispatch.
+///
+/// EAX at entry = weapon entry pointer (unchanged from type-4 switch).
+/// Some handlers explicitly set EAX=worm or EAX=*(worm+0x44).
+/// Handlers without explicit MOV EAX inherit the entry pointer.
+unsafe fn fire_weapon_special(
+    subtype: i32, params_38: u32, worm: *mut CTaskWorm, local_struct: u32,
+    entry: *const WeaponEntry,
+) {
+    use openwa_core::rebase::rb;
+    let w = worm as u32;
+    let e = entry as u32;
+
+    match subtype {
+        1 => fire_worm_vtable_0xe(w, 0x6C),                                             // Blowtorch
+        2 => call_fire_usercall(e, w, rb(0x51E3E0)),                                     // Drill (EAX=entry)
+        3 => call_fire_stdcall3(w, params_38 as *const WeaponFireParams, local_struct, rb(0x51E350)), // Girder
+        4 => fire_worm_vtable_0xe(w, 0x6D),                                             // Baseball Bat
+        5 => fire_worm_vtable_0xe(w, 0x75),                                             // Fire Punch
+        6 => fire_worm_vtable_0xe(w, 0x70),                                             // Dragon Ball
+        8 => fire_worm_vtable_0xe(w, 0x6E),                                             // Kamikaze
+        9 => call_fire_usercall_stdcall1(e, w, local_struct, rb(0x51E480)),              // Prod (EAX=entry)
+        10 => call_fire_usercall(w, w, rb(0x51E710)),                                    // Air Strike (EAX=worm)
+        11 => fire_worm_vtable_0xe(w, 0x71),                                            // Scales of Justice
+        13 => fire_send_team_message(worm, 0x2B),                                          // Napalm Strike
+        14 => call_fire_usercall(w, w, rb(0x51E670)),                                    // Mail/Mine/Mole (EAX=worm)
+        16 => {
+            // Teleport: MOV EAX,[ESI+0x44] (worm state) before check
+            let worm_state = (*worm).state();
+            let result = call_fire_usercall_ret(worm_state, w, rb(0x516930));
+            if result != 0 {
+                call_fire_usercall(result as u32, w, rb(0x51EB00));
+            } else {
+                fire_worm_vtable_0xe(w, 0x74);
+            }
+        }
+        17 => call_fire_usercall(w, w, rb(0x51E920)),                                    // Freeze (EAX=worm)
+        18 => fire_worm_vtable_0xe(w, 0x72),                                            // Suicide Bomber
+        19 => fire_skip_go(worm, entry),                                                 // Skip Go (pure Rust)
+        20 => call_fire_usercall(w, w, rb(0x51E600)),                                    // Surrender (EAX=worm)
+        21 => fire_select_worm(worm),                                                     // Select Worm (pure Rust)
+        22 => call_fire_usercall(e, w, rb(0x51EC30)),                                    // Jet Pack (EAX=entry)
+        23 => fire_worm_vtable_0xe(w, 0x78),                                            // Magic Bullet
+        24 => call_fire_usercall(e, w, rb(0x51EA60)),                                    // Low Grav (EAX=entry)
+        _ => {}
+    }
+}
+
+// ── Pure Rust fire handlers (no bridge needed) ──────────────
+
+/// Send a message to the worm's CTaskTeam entity via SharedData lookup.
+///
+/// Pattern shared by Napalm Strike (msg 0x2B), Surrender (msg 0x29), etc.
+/// Looks up entity with key (0, 0x14=CTaskTeam) in worm's shared data table,
+/// then calls entity->vtable[2] (HandleMessage) with the given message type.
+///
+/// The 0x40C-byte local buffer is passed as data pointer; team_index is written
+/// at buf+0x08 to identify which team fired.
+unsafe fn fire_send_team_message(worm: *mut CTaskWorm, msg_type: u32) {
+    use openwa_core::task::SharedDataTable;
+
+    let task = &(*worm).base.base; // CTask base
+    let table = SharedDataTable::from_task(task);
+
+    // Lookup CTaskTeam (key_esi=0, key_edi=0x14)
+    let team_entity = table.lookup(0, 0x14);
+    if team_entity.is_null() {
+        return;
+    }
+
+    // Prepare local buffer (0x40C bytes, mostly zero)
+    let mut buf = [0u8; 0x40C];
+    let team_index = (*worm).team_index;
+    buf[8..12].copy_from_slice(&team_index.to_ne_bytes());
+
+    // Call entity->vtable[2] = HandleMessage(sender=worm, msg, size=4, data=&buf)
+    let vtable = *(team_entity as *const u32);
+    let handle_message: unsafe extern "thiscall" fn(*mut u8, *mut CTaskWorm, u32, u32, *const u8) =
+        core::mem::transmute(*(vtable as *const u32).add(2));
+    handle_message(team_entity, worm, msg_type, 4, buf.as_ptr());
+}
+
+/// Select Worm (subtype 21) — pure Rust replacement for 0x51EBE0.
+///
+/// Sends message 0x5D to CTaskTeam with buf = [8, team_index, ...].
+unsafe fn fire_select_worm(worm: *mut CTaskWorm) {
+    use openwa_core::task::SharedDataTable;
+
+    let task = &(*worm).base.base;
+    let table = SharedDataTable::from_task(task);
+    let team_entity = table.lookup(0, 0x14);
+    if team_entity.is_null() {
+        return;
+    }
+
+    let mut buf = [0u8; 0x40C];
+    // buf[0..4] = 8 (constant), buf[4..8] = team_index
+    buf[0..4].copy_from_slice(&8u32.to_ne_bytes());
+    buf[4..8].copy_from_slice(&(*worm).team_index.to_ne_bytes());
+
+    let vtable = *(team_entity as *const u32);
+    let handle_message: unsafe extern "thiscall" fn(*mut u8, *mut CTaskWorm, u32, u32, *const u8) =
+        core::mem::transmute(*(vtable as *const u32).add(2));
+    handle_message(team_entity, worm, 0x5D, 0x408, buf.as_ptr());
+}
+
+/// Skip Go (subtype 19) — pure Rust replacement for 0x51E8C0.
+///
+/// Toggles a bit in the team's `TeamHeader.turn_action_flags` (+0x7C).
+/// Bit position comes from weapon entry's fire_params.
+/// In game_version > 0x1C: toggles (set/clear). Otherwise: always sets.
+unsafe fn fire_skip_go(worm: *const CTaskWorm, entry: *const WeaponEntry) {
+    use openwa_core::engine::ddgame::TeamArenaRef;
+    use openwa_core::engine::DDGame;
+
+    let ddgame = (*worm).base.base.ddgame as *mut DDGame;
+    let game_version = (*(*ddgame).game_info).game_version;
+    let team_index = (*worm).team_index as usize;
+
+    let bit_index = (*entry).fire_params._data[0] & 0x1F;
+    let bit = 1u32 << bit_index;
+
+    let arena = TeamArenaRef::from_ptr(&raw mut (*ddgame).team_arena);
+    let header = arena.team_header_mut(team_index);
+    let flags = header.turn_action_flags;
+
+    if game_version > 0x1C && (flags & bit) != 0 {
+        header.turn_action_flags = flags & !bit;
+    } else {
+        header.turn_action_flags = flags | bit;
+    }
+}
+
+// ── Naked asm bridges ───────────────────────────────────────
+
+/// Bridge: usercall(EAX=eax_val, ESI=worm, EDI=worm), plain RET.
+/// Args: (eax_val, worm, addr). Saves/restores ESI+EDI. Uses EBX to hold addr.
+#[unsafe(naked)]
+unsafe extern "C" fn call_fire_usercall(_eax: u32, _worm: u32, _addr: u32) {
+    core::arch::naked_asm!(
+        "push ebx",
+        "push esi",
+        "push edi",
+        "mov eax, [esp+16]",  // eax_val (3 saves=12 + ret=4 = 16)
+        "mov esi, [esp+20]",  // worm
+        "mov edi, [esp+20]",
+        "mov ebx, [esp+24]",  // addr
+        "call ebx",
+        "pop edi",
+        "pop esi",
+        "pop ebx",
+        "ret",
+    );
+}
+
+/// Bridge: usercall(EAX=eax_val, ESI=worm, EDI=worm), plain RET, returns EAX.
+#[unsafe(naked)]
+unsafe extern "C" fn call_fire_usercall_ret(_eax: u32, _worm: u32, _addr: u32) -> i32 {
+    core::arch::naked_asm!(
+        "push ebx",
+        "push esi",
+        "push edi",
+        "mov eax, [esp+16]",
+        "mov esi, [esp+20]",
+        "mov edi, [esp+20]",
+        "mov ebx, [esp+24]",
+        "call ebx",
+        "pop edi",
+        "pop esi",
+        "pop ebx",
+        "ret",
+    );
+}
+
+/// Bridge: usercall(EAX=eax_val, ESI=worm, EDI=worm) + stdcall(1 param), RET 0x4.
+#[unsafe(naked)]
+unsafe extern "C" fn call_fire_usercall_stdcall1(
+    _eax: u32, _worm: u32, _param: u32, _addr: u32,
+) {
+    core::arch::naked_asm!(
+        "push ebx",
+        "push esi",
+        "push edi",
+        "mov eax, [esp+16]",  // eax_val
+        "mov esi, [esp+20]",  // worm
+        "mov edi, [esp+20]",
+        "mov ebx, [esp+28]",  // addr (3 saves=12 + ret=4 + 3 args=12 = 28)
+        "push [esp+24]",      // param
+        "call ebx",
+        "pop edi",
+        "pop esi",
+        "pop ebx",
+        "ret",
+    );
+}
+
+/// Call worm->vtable[0xE](msg_id) — thiscall(ECX=worm, stack=msg_id), RET 0x4.
+/// Original: `(**(code **)(*worm + 0x38))(msg_id)`.
+/// Uses naked bridge to avoid LLVM stack tracking issues with push/RET mismatch.
+#[unsafe(naked)]
+unsafe extern "C" fn fire_worm_vtable_0xe(_worm: u32, _msg_id: u32) {
+    core::arch::naked_asm!(
+        "push ebx",
+        "push esi",
+        "push edi",
+        "mov ecx, [esp+16]",  // worm (3 saves=12 + ret=4 = 16)
+        "mov esi, [esp+16]",  // ESI = worm
+        "mov edi, [esp+16]",  // EDI = worm
+        "mov ebx, [ecx]",     // vtable
+        "mov ebx, [ebx+0x38]",// vtable[0xE]
+        "push [esp+20]",      // msg_id
+        "call ebx",           // thiscall: ECX=worm, RET 0x4 cleans msg_id
+        "pop edi",
+        "pop esi",
+        "pop ebx",
+        "ret",
+    );
+}
+
 // ============================================================
 // Hook installation
 // ============================================================
@@ -144,6 +583,13 @@ pub fn install() -> Result<(), String> {
             va::COUNT_ALIVE_WORMS,
             trampoline_count_alive_worms as *const (),
         )?;
+
+        let trampoline = hook::install(
+            "FireWeapon",
+            va::FIRE_WEAPON,
+            trampoline_fire_weapon as *const (),
+        )?;
+        ORIG_FIRE_WEAPON.store(trampoline as u32, Ordering::Relaxed);
     }
 
     Ok(())

crates/openwa-wormkit/src/validation/mod.rs

@@ -1529,7 +1529,7 @@ unsafe fn dump_missile_raw(ptr: u32) {
     let base = ptr as *const u32;
     let sections: &[(usize, usize, &str)] = &[
         (0x000, 0x030, "CTask base"),
-        (0x030, 0x084, "CGameTask _unknown_30"),
+        (0x030, 0x084, "CGameTask subclass_data"),
         (0x084, 0x098, "CGameTask pos/speed (0x84–0x97)"),
         (0x098, 0x0FC, "CGameTask _unknown_98"),
         (0x0FC, 0x130, "CTaskMissile 0xFC–0x12F"),

docs/re-notes/weapon-system.md

@@ -0,0 +1,482 @@
+# Weapon System
+
+Comprehensive reference for the Worms Armageddon 3.8.1 weapon system internals.
+
+## Overview
+
+The weapon system spans multiple subsystems: a **weapon table** defining all 71 weapons, an **ammo/delay tracker** per team/alliance, a **firing dispatch** that routes weapon activation to type-specific handlers, **CTaskMissile** objects for in-flight projectiles, and an **explosion system** for terrain damage.
+
+### Object Relationships
+
+```mermaid
+graph TD
+    DDGame["DDGame (0x98B8 bytes)"]
+    WT["WeaponTable<br/>DDGame+0x510"]
+    TAS["TeamArenaState<br/>DDGame+0x4628"]
+    WP["WeaponPanel<br/>DDGame+0x548"]
+    CTW["CTaskWorm<br/>(per-live-worm task)"]
+    CTM["CTaskMissile<br/>(per-projectile task)"]
+    EXP["CreateExplosion"]
+    LAND["PCLandscape"]
+
+    DDGame --> WT
+    DDGame --> TAS
+    DDGame --> WP
+    CTW -->|"FireWeapon"| CTM
+    CTW -->|"GetAmmo/SubtractAmmo"| TAS
+    CTM -->|"impact"| EXP
+    EXP -->|"terrain damage"| LAND
+    WP -->|"reads availability"| WT
+    WP -->|"reads ammo"| TAS
+```
+
+### Firing Sequence
+
+```mermaid
+sequenceDiagram
+    participant P as Player Input
+    participant W as CTaskWorm
+    participant FR as WeaponRelease
+    participant FW as FireWeapon
+    participant CW as CreateWeaponProjectile
+    participant M as CTaskMissile
+    participant E as CreateExplosion
+    participant L as PCLandscape
+
+    P->>W: Fire key pressed
+    W->>FR: WeaponRelease(0x51C3D0)<br/>position, angle
+    FR->>FW: FireWeapon(0x51EE60)<br/>weapon type dispatch
+    FW->>CW: CreateWeaponProjectile(0x51E0F0)
+    CW->>M: CTaskMissile__Constructor(0x507D10)<br/>allocate 0x40C bytes
+    loop Every frame
+        M->>M: PhysicsUpdate(0x508C90)<br/>gravity, wind, collision
+    end
+    M->>E: CreateExplosion(0x548080)
+    E->>L: ApplyExplosion(0x57C820)<br/>terrain bitmap damage
+```
+
+## WeaponEntry & WeaponTable
+
+### WeaponTable (DDGame+0x510)
+
+Allocated by `InitWeaponTable` (0x53CAB0, stdcall(wrapper), RET 0x4). Called once
+during `CTaskGameState__vmethod_7` at game start.
+
+```
++0x00   [WeaponEntry; 71]   entries     Standard weapons (0..70)
+Total:  71 × 0x1D0 = 0x80B0 bytes (no header)
+```
+
+### WeaponEntry (0x1D0 = 464 bytes per entry)
+
+Source: `wkJellyWorm/src/CustomWeapons.h` (WeaponStruct) + InitWeaponTable analysis.
+
+```
++0x00   *const c_char   name1           Primary weapon name string
++0x04   *const c_char   name2           Secondary weapon name string
++0x08   i32             panel_state     Panel state (init: 0xFFFFFFFF). wkJellyWorm: panelRow
++0x0C   i32             unknown_0c      Unknown
++0x10   i32             defined         Nonzero = weapon exists. Checked by CheckWeaponAvail.
++0x14   [u8; 0x10]      unknown_14      Unknown
++0x24   i32             availability    Init: 0xFFFFFFFF, then 0 or 1. None/SkipGo/Surrender = 0.
++0x28   i32             enabled         Init: 1
++0x2C   [u8; 0x1A4]     unknown_2c      Remaining fields (opaque)
+```
+
+**InitWeaponTable per-entry initialization:**
+- +0x08 = 0xFFFFFFFF (panel_state)
+- +0x24 = 0xFFFFFFFF (availability, then overwritten per-weapon)
+- +0x28 = 1 (enabled)
+- Weapon 0 (None), 57 (SkipGo), 58 (Surrender): availability forced to 0
+
+**Rust types:** `WeaponEntry`, `WeaponTable` in `openwa-core/src/game/weapon.rs`.
+
+### Weapon Enum (71 entries)
+
+Defined in `openwa-core/src/game/weapon.rs`. Key weapon IDs:
+
+| ID | Hex | Name | Category |
+|----|-----|------|----------|
+| 0 | 0x00 | None | - |
+| 1 | 0x01 | Bazooka | Projectile |
+| 2 | 0x02 | HomingMissile | Projectile (homing) |
+| 6 | 0x06 | Grenade | Thrown |
+| 10 | 0x0A | Earthquake | Special (net-disabled) |
+| 24 | 0x18 | SuperSheep | Animal (restricted) |
+| 25 | 0x19 | AquaSheep | Animal (restricted) |
+| 37 | 0x25 | NinjaRope | Rope |
+| 40 | 0x28 | Teleport | Utility (immune to sudden death) |
+| 54 | 0x36 | Donkey | Special (disable flag) |
+| 55 | 0x37 | NuclearTest | Special (net-disabled) |
+| 56 | 0x38 | Armageddon | Special (net-disabled) |
+| 59 | 0x3B | SelectWorm | Action (needs >1 alive worm) |
+| 66 | 0x42 | Invisibility | Power-up (mode flag) |
+| 69 | 0x45 | DoubleTurnTime | Power-up (threshold) |
+
+## Ammunition & Delay System
+
+### Storage: TeamArenaState (DDGame+0x4628)
+
+Ammo and delay are stored in a flat array indexed by alliance and weapon ID.
+
+```
+Flat index = alliance_id × 142 + weapon_id
+
+Ammo:  TeamArenaState + 0x1EB4 + flat_index × 4
+Delay: TeamArenaState + 0x1EB4 + (flat_index + 71) × 4
+
+Values: -1 = unlimited, 0 = none, >0 = count
+Delay:  0 = available, >0 = turns until available
+```
+
+6 alliances × 142 entries (71 ammo + 71 delay) = 852 total slots.
+
+Alliance ID is read from the team's sentinel worm field at offset +0x80
+(`sentinel_weapon_alliance`).
+
+### Functions
+
+| Function | Address | Convention | Parameters |
+|----------|---------|------------|------------|
+| GetAmmo | 0x5225E0 | usercall | EAX=team_index, ESI=arena_base, EDX=weapon_id → EAX=ammo |
+| AddAmmo | 0x522640 | usercall | EAX=team_index, EDX=amount, stack(base, weapon_id), RET 0x8 |
+| SubtractAmmo | 0x522680 | usercall | EAX=team_index, ECX=arena_base, stack(weapon_id), RET 0x4 |
+| SubtractAmmo_v2 | 0x558E80 | fastcall | ECX=param1, EDX=CTaskTeam* |
+| CountAliveWorms | 0x5225A0 | usercall | EAX=team_index, ECX=arena_base → EAX=count |
+
+**GetAmmo special rules:**
+- Returns 0 if weapon delay > 0 (weapon on cooldown)
+- Sudden death (game_phase ≥ 484): returns 0 for all except Teleport (0x28)
+- SelectWorm (0x3B): returns 0 if team has ≤1 alive worm
+- Game mode flag at TeamArenaState+0x2C0C can override delay checks
+
+**SubtractAmmo call sites (verified):**
+- `CTaskWorm__HandleMessage` (0x512C27): subtracts Teleport (0x28) ammo
+- `CTaskTeam_vt2__vmethod_2` (0x558443): subtracts the team's selected weapon
+- `FUN_0055f8c0` (3 sites): subtracts DamageX2 (0x43), CrateSpy (0x44), and others
+
+Our hook reportedly never triggered — this was because the test replay (bots)
+doesn't use Teleport, DamageX2, or CrateSpy. The hook implementation is correct.
+
+The second variant at 0x558E80 (fastcall) has 3 xrefs from `CTaskTeam_vt2__vmethod_2`.
+
+**Port status:** All 4 functions ported in `replacements/weapon.rs`.
+
+## Weapon Availability
+
+### DDGame__CheckWeaponAvail (0x53FFC0)
+
+Convention: fastcall(DDGame), ESI=weapon_id. Ported as `check_weapon_avail`
+in `openwa-core/src/engine/game_state_init.rs`.
+
+**Per-weapon disable rules:**
+
+| Weapon(s) | Condition | Result |
+|-----------|-----------|--------|
+| Earthquake (10), NuclearTest (55), Armageddon (56) | `net_config_2 != 0 && net_weapon_exception == 0` | Disabled in network games |
+| Donkey (54) | `donkey_disabled != 0` | GameInfo+0xD94C flag |
+| Invisibility (66) | `invisibility_mode == 0 && network_ecx == 0` | Needs network or mode flag |
+| DoubleTurnTime (69) | `game_version > 0xD1 && threshold > 0x7FFF` | GameInfo+0xD932 threshold |
+
+**General availability path:**
+1. Check weapon table entry: name1 non-null = weapon defined
+2. If `level_width_raw == 0` OR weapon defined: check super weapon rules
+3. `IsSuperWeapon` (0x565960): if super and `super_weapon_allowed == 0`, disable (unless game_version < 0x2A)
+4. `supersheep_restricted` (DDGame+0x7E25): gates SuperSheep/AquaSheep check
+5. `aquasheep_is_supersheep` (GameInfo+0xD956): when set, AquaSheep slot becomes SuperSheep
+
+### DDGame__IsSuperWeapon (0x565960)
+
+Convention: fastcall(weapon_id). Returns 1 for super weapons:
+
+Super weapon IDs: 16, 19, 29-31, 36, 41-42, 45-46, 49-51, 54-56, 60-61
+
+## FireWeapon Dispatch (0x51EE60)
+
+Convention: thiscall. `in_EAX` = weapon context structure where:
+- +0x30: weapon type (1-4)
+- +0x34: subtype for type 3 and type 4
+- +0x38: subtype for type 1 and type 2
+- +0x3C: parameters base (passed to sub-functions)
+
+`param_2` = DDGameWrapper pointer. Sets `param_2[0xF] = 1` on completion.
+
+### Type 1: Projectile Weapons
+
+| Subtype | Function | Address | Weapons |
+|---------|----------|---------|---------|
+| 1 | FireWeapon__PlacedExplosive | 0x51EC80 | Dynamite, Mine, Petrol Bomb |
+| 2 | FireWeapon__Projectile | 0x51DFB0 | Bazooka, Mortar, Longbow |
+| 3 | CreateWeaponProjectile | 0x51E0F0 | Homing Missile, Homing Pigeon |
+| 4 | FireWeapon__Shotgun | 0x51ED90 | Shotgun, Handgun, Uzi, Minigun |
+
+### Type 2: Rope Weapons
+
+| Subtype | Function | Address | Weapons |
+|---------|----------|---------|---------|
+| 1 | FireWeapon__RopeType1 | 0x51E1C0 | Ninja Rope (attach) |
+| 2 | CreateWeaponProjectile | 0x51E0F0 | Ninja Rope (projectile mode) |
+| 3 | FireWeapon__RopeType3 | 0x51E240 | Bungee |
+
+### Type 3: Thrown Weapons
+
+| Subtype | Function | Address | Weapons |
+|---------|----------|---------|---------|
+| (all) | FireWeapon__GrenadeMortar | 0x51E2C0 | Grenade, Cluster Bomb, Banana Bomb, Holy Grenade |
+
+### Type 4: Special Weapons
+
+| Subtype | Function | Address | Description |
+|---------|----------|---------|-------------|
+| 1 | vtable[0xE](0x6C) | (indirect) | Blowtorch |
+| 2 | FireWeapon__Special_Type2 | 0x51E3E0 | Pneumatic Drill |
+| 3 | FireWeapon__Special_Type3 | 0x51E350 | Girder |
+| 4 | vtable[0xE](0x6D) | (indirect) | Baseball Bat |
+| 5 | vtable[0xE](0x75) | (indirect) | Fire Punch |
+| 6 | vtable[0xE](0x70) | (indirect) | Dragon Ball |
+| 8 | vtable[0xE](0x6E) | (indirect) | Kamikaze |
+| 9 | FireWeapon__Special_Type9 | 0x51E480 | Prod |
+| 10 | FireWeapon__Special_Type10 | 0x51E710 | Air Strike |
+| 11 | vtable[0xE](0x71) | (indirect) | Scales of Justice |
+| 13 | FireWeapon__Special_Type13 | 0x51E5C0 | Napalm Strike |
+| 14 | FireWeapon__Special_Type14 | 0x51E670 | Mail/Mine/Mole Strike |
+| 16 | FUN_0051EB00 (conditional) | 0x51EB00 | Teleport (checks FUN_516930 first) |
+| 17 | FireWeapon__Special_Type17 | 0x51E920 | Freeze |
+| 18 | vtable[0xE](0x72) | (indirect) | Suicide Bomber |
+| 19 | FireWeapon__Special_Type19 | 0x51E8C0 | Skip Go |
+| 20 | FireWeapon__Special_Type20 | 0x51E600 | Surrender |
+| 21 | FireWeapon__Special_Type21 | 0x51EBE0 | Select Worm |
+| 22 | FireWeapon__Special_Type22 | 0x51EC30 | Jet Pack |
+| 23 | vtable[0xE](0x78) | (indirect) | Magic Bullet |
+| 24 | FireWeapon__Special_Type24 | 0x51EA60 | Low Gravity / Fast Walk |
+
+## CTaskMissile (0x40C bytes)
+
+Extends CGameTask (0xFC base). Represents an in-flight projectile.
+
+```
+Constructor:  0x507D10 (stdcall, 4 params)
+Vtable:       0x664438
+Class type:   0x0B
+Allocation:   0x40C bytes via wa_malloc
+```
+
+### Structure Layout
+
+```
++0x000  CGameTask base          (0xFC bytes)
+        +0x084  speed_x         Fixed16.16 horizontal velocity
+        +0x088  speed_y         Fixed16.16 vertical velocity
+        +0x090  pos_x           Fixed16.16 world X
+        +0x094  pos_y           Fixed16.16 world Y
+
++0x128  u32     launch_seed     Position-derived seed
++0x12C  u32     slot_id         Object pool slot index
+
++0x130  spawn_params [11 DWORDs = 44 bytes]
+        [0]     owner_id        Team that fired
+        [2-3]   spawn_x/y       Fixed16.16 launch position
+        [4-5]   speed_x/y       Fixed16.16 initial velocity
+        [8]     pellet_index    Cluster volley index
+
++0x15C  weapon_data [94 DWORDs = 376 bytes]
+        [0x0F]  gravity_pct     100 = 1.0× gravity
+        [0x10]  bounce_pct      Bounce coefficient
+        [0x12]  friction_pct    Friction coefficient
+        [0x1A]  missile_type    2=Standard, 3=Homing, 4=Sheep, 5=Cluster
+        [0x1C]  render_timer    Fuse countdown
+
++0x2D4  render_data [42 DWORDs = 168 bytes]
+        Physics parameters (shifted copy of weapon_data)
+
++0x3C8  i32     direction       -1 (left) or +1 (right)
+```
+
+### Missile Type Enum
+
+| Value | Type | Behavior |
+|-------|------|----------|
+| 2 | Standard | Straight trajectory with gravity |
+| 3 | Homing | Tracks target position |
+| 4 | Sheep | Walking behavior on terrain |
+| 5 | Cluster | Splits into sub-munitions on impact |
+
+### Key Methods
+
+| Method | Address | Description |
+|--------|---------|-------------|
+| Constructor | 0x507D10 | Initialize physics, copy weapon data from scheme |
+| Init | 0x508640 | Reset physics state |
+| PhysicsUpdate | 0x508C90 | Per-frame trajectory, gravity, wind, collision |
+| HandleMessage | 0x50B400 | Event processing (detonation triggers, etc.) |
+| Free | 0x508330 | Cleanup and pool return |
+| vt12 | 0x508C70 | Vtable slot 12 |
+| vt18_GetField130 | 0x50BFA0 | Returns spawn_params pointer |
+
+### Missile Count Limit
+
+DDGame+0x72A4 tracks active missile count. `CreateWeaponProjectile` checks:
+- If count + 7 < 0x2BD (701): create missile normally
+- If exceeded and game_version < 0x3C: set error code 6 at DDGame+0x4624, load
+  string resource 0x70F as error message at DDGame+0x7EF4
+- Otherwise: silently fail
+
+## Projectile Creation (0x51E0F0)
+
+`CreateWeaponProjectile`: thiscall(this=context, param_2=missile_params, param_3=launch_params).
+
+1. Read DDGame via `this+0x2C` (CTask.ddgame field)
+2. Check missile count limit (DDGame+0x72A4 + 7 < 0x2BD)
+3. Call `FUN_004FDF90(this)` — pool slot allocator
+4. `wa_malloc(0x40C)` + `memset(0, 0x3EC)`
+5. `CTaskMissile__Constructor(slot, missile_params, launch_params)`
+6. Return allocated missile pointer
+
+## Explosion & Terrain Damage
+
+| Function | Address | Convention | Description |
+|----------|---------|------------|-------------|
+| CreateExplosion | 0x548080 | usercall(ESI=context) | Spawns explosion task via pool allocator + vtable dispatch |
+| PCLandscape_ApplyExplosion | 0x57C820 | (unknown) | Modifies terrain bitmap, creates crater |
+
+CreateExplosion is a thin wrapper: allocates via `FUN_004FDF90`, then calls
+`vtable[2]()` on the allocated object. The actual explosion logic (radius,
+damage, terrain removal) lives in the explosion task's ProcessFrame.
+
+## Weapon Panel UI
+
+| Function | Address | Description |
+|----------|---------|-------------|
+| DDGame__InitWeaponPanel_Maybe | 0x567770 | Initialize panel structures and availability grid |
+| PrepareWeaponPanel | 0x568220 | Main panel renderer (~2000 lines). Iterates weapons by row, checks availability, renders tiles |
+| WeaponPanelDrawTile | 0x567AA0 | Render individual weapon tile |
+| WeaponPanelDescription | 0x567F80 | Show ammo/delay info on hover |
+| WeaponPanelCheckClick | 0x5690B0 | Handle weapon selection clicks |
+
+**Panel geometry:** 5 columns × 13 rows. Each tile is 29px wide.
+Custom weapons (wkJellyWorm): dynamic columns up to 256 weapons.
+
+## Weapon Crate System
+
+- `CTaskCrate__Constructor` (0x502490): creates a weapon crate in the game world
+- Crate probability per weapon defined in scheme (`WeaponSettings.crate_probability`, 0-100%)
+- Crate drops award random weapons weighted by probability
+
+## Scheme Integration
+
+Weapon configuration flows from `.wsc` scheme files into GameInfo, then into the
+weapon table and ammo arrays at game start.
+
+### WeaponSettings (4 bytes per weapon)
+
+```
++0x00   u8  ammo              0=none, 1-10=count, 0x80+=infinite
++0x01   u8  power             0-20 (max varies per weapon)
++0x02   u8  delay             Turn cooldown before available
++0x03   u8  crate_probability 0-100 percentage
+```
+
+### Scheme Formats
+
+| Version | Payload | Weapons |
+|---------|---------|---------|
+| V1 | 0xD8 bytes | 45 standard weapons |
+| V2 | 0x124 bytes | V1 + 19 super weapons |
+| V3 | 0x192 bytes | V2 + 110 extended options (physics tweaks) |
+
+**Port status:** Scheme parsing fully ported in `openwa-core/src/game/scheme.rs`
+(10 hooks in `replacements/scheme.rs`).
+
+## Complete Function Address Table
+
+### Weapon Table & Initialization
+
+| Function | Address | Convention | Port Status |
+|----------|---------|------------|-------------|
+| InitWeaponTable | 0x53CAB0 | stdcall(wrapper), RET 0x4 | Hooked (passthrough) |
+| DDGame__CheckWeaponAvail | 0x53FFC0 | fastcall(DDGame) | **Ported** |
+| DDGame__IsSuperWeapon | 0x565960 | fastcall(weapon_id) | **Ported** |
+| DDGame__LoadHudAndWeaponSprites | 0x53D0E0 | stdcall(wrapper, ...) | Bridge call |
+
+### Ammo System
+
+| Function | Address | Convention | Port Status |
+|----------|---------|------------|-------------|
+| GetAmmo | 0x5225E0 | usercall(EAX,ESI,EDX) | **Ported** |
+| AddAmmo | 0x522640 | usercall(EAX,EDX,stack), RET 0x8 | **Ported** |
+| SubtractAmmo | 0x522680 | usercall(EAX,ECX,stack), RET 0x4 | **Ported** (may not trigger) |
+| SubtractAmmo_v2 | 0x558E80 | fastcall(ECX,EDX) | Unported |
+| CountAliveWorms | 0x5225A0 | usercall(EAX,ECX) | **Ported** |
+
+### Firing & Projectiles
+
+| Function | Address | Convention | Port Status |
+|----------|---------|------------|-------------|
+| WeaponRelease | 0x51C3D0 | thiscall(CTaskWorm*, ...) | Unported |
+| FireWeapon | 0x51EE60 | thiscall, EAX=weapon_ctx | Unported |
+| CreateWeaponProjectile | 0x51E0F0 | thiscall(context, params, launch) | Unported |
+| CTaskMissile__Constructor | 0x507D10 | stdcall, 4 params | Unported |
+| CTaskMissile__PhysicsUpdate | 0x508C90 | (unknown) | Unported |
+| CTaskMissile__HandleMessage | 0x50B400 | thiscall | Unported |
+| CreateExplosion | 0x548080 | usercall(ESI=context) | Unported |
+| PCLandscape_ApplyExplosion | 0x57C820 | (unknown) | Unported |
+
+### Fire Dispatch Targets
+
+| Function | Address | Weapon Category |
+|----------|---------|-----------------|
+| FireWeapon__Projectile | 0x51DFB0 | Bazooka-class |
+| FireWeapon__PlacedExplosive | 0x51EC80 | Dynamite/Mine/Petrol |
+| FireWeapon__Shotgun | 0x51ED90 | Shotgun/Handgun/Uzi |
+| FireWeapon__RopeType1 | 0x51E1C0 | Ninja Rope attach |
+| FireWeapon__RopeType3 | 0x51E240 | Bungee |
+| FireWeapon__GrenadeMortar | 0x51E2C0 | Grenade/Cluster/Banana |
+| FireWeapon__Special_Type2 | 0x51E3E0 | Pneumatic Drill |
+| FireWeapon__Special_Type3 | 0x51E350 | Girder |
+| FireWeapon__Special_Type9 | 0x51E480 | Prod |
+| FireWeapon__Special_Type10 | 0x51E710 | Air Strike |
+| FireWeapon__Special_Type13 | 0x51E5C0 | Napalm Strike |
+| FireWeapon__Special_Type14 | 0x51E670 | Mail/Mine/Mole Strike |
+
+### Weapon Panel
+
+| Function | Address | Convention | Port Status |
+|----------|---------|------------|-------------|
+| DDGame__InitWeaponPanel_Maybe | 0x567770 | thiscall | Unported |
+| PrepareWeaponPanel | 0x568220 | cdecl | Unported |
+| WeaponPanelDrawTile | 0x567AA0 | (unknown) | Unported |
+| WeaponPanelDescription | 0x567F80 | (unknown) | Unported |
+| WeaponPanelCheckClick | 0x5690B0 | (unknown) | Unported |
+
+### Scheme
+
+| Function | Address | Convention | Port Status |
+|----------|---------|------------|-------------|
+| Scheme__CheckWeaponLimits | 0x4D50E0 | stdcall | **Ported** |
+| Scheme__ValidateExtendedOptions | 0x4D5110 | stdcall | **Ported** |
+| Scheme__ReadFile | 0x4D3890 | stdcall | **Ported** |
+
+## Port Recommendations
+
+### Already Done
+- Weapon enum and struct types (`WeaponEntry`, `WeaponTable`)
+- Ammo system (4 hooks: GetAmmo, AddAmmo, SubtractAmmo, CountAliveWorms)
+- Availability checks (2 hooks: CheckWeaponAvail, IsSuperWeapon)
+- Scheme parsing (10 hooks covering all scheme I/O)
+- Team/worm state queries (8 hooks in replacements/team.rs)
+
+### Next Priority
+1. **InitWeaponTable internals** — populate WeaponEntry fields from scheme data
+2. **SubtractAmmo investigation** — verify hook triggers, check v2 variant
+3. **Weapon panel init** — DDGame__InitWeaponPanel_Maybe (self-contained)
+
+### Medium Term
+4. **FireWeapon dispatch** — the type/subtype routing logic
+5. **CreateWeaponProjectile** — missile allocation and pool management
+6. **WeaponRelease** — coordinate transform and launch logic
+
+### Long Term
+7. **CTaskMissile physics** — gravity, wind, collision, homing AI
+8. **Individual weapon behaviors** — each Fire__* handler
+9. **Explosion system** — terrain damage, damage calculation
+10. **Weapon panel rendering** — PrepareWeaponPanel (~2000 lines)