fix: correct CTask children field names and children count display

Runtime analysis of CTask__AppendChild (0x4fdc70) and CTask__UnlinkChild
(0x4fdce0) reveals the true semantics of the children sub-struct:

+0x08 children_capacity — starts 0x10, doubles on overflow
+0x0C children_dirty — flag set to 1 when any child is unlinked
+0x10 children_watermark — insertion counter, never decremented on remove
+0x14 children_data — sparse pointer array; dead slots are nulled

The append-only watermark means CTaskFilter's "(N children)" label was
rising unboundedly as sea bubbles spawned. Fixed by computing live count
from non-null slots rather than reading children_watermark directly.

Also adds dump_ctask_children() to validation (F8 hotkey) for live
verification of these fields. Ghidra functions renamed accordingly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

crates/openwa-core/src/task/base.rs

@@ -23,13 +23,18 @@ pub struct CTask {
     pub vtable: *mut u8,
     /// 0x04: Parent task in the hierarchy
     pub parent: *mut u8,
-    /// 0x08: Children list max capacity (set to 0x10 in constructor)
-    pub children_max_size: u32,
-    /// 0x0C: Children list unknown field (set to 0 in constructor)
-    pub children_unk: u32,
-    /// 0x10: Children list current size
-    pub children_size: u32,
-    /// 0x14: Pointer to children data array (allocated 0x60 bytes in constructor)
+    /// 0x08: Children array capacity — starts at 0x10, doubles via realloc when full.
+    pub children_capacity: u32,
+    /// 0x0C: Set to 1 by `FUN_004fdce0` when a child slot is nulled (dirty flag).
+    /// Zero at construction. Not decremented; purely a "child was removed" marker.
+    pub children_dirty: u32,
+    /// 0x10: Insert watermark — incremented on every child insertion, never decremented
+    /// on removal. Dead children leave null slots; `children_data[0..children_watermark]`
+    /// is a sparse array. This grows without bound within a session (e.g., sea bubbles
+    /// continuously spawn/die, each consuming a new slot and doubling capacity as needed).
+    pub children_watermark: u32,
+    /// 0x14: Pointer to children data array (sparse, allocated 0x60 bytes initially,
+    /// reallocated to `children_capacity * 8 + 0x20` bytes on overflow).
     pub children_data: *mut u8,
     /// 0x18: Children hash list pointer (set to 0 in constructor)
     pub children_hash: *mut u8,

crates/openwa-debugui/src/app.rs

@@ -76,11 +76,11 @@ unsafe fn get_ddgame() -> Option<*const DDGame> {
 /// Read child task pointers from a CTask's children array.
 ///
 /// The array is **sparse**: slots are nulled when a child is removed rather than
-/// compacted. `children_size` is the slot high-watermark (loop upper bound used
+/// compacted. `children_watermark` is the insertion counter (loop upper bound used
 /// by CTask::HandleMessage), not the live-child count. We return all slots up to
 /// that bound so the caller can filter nulls and display the live set.
 unsafe fn read_children(task: *const CTask) -> Vec<u32> {
-    let slots = (*task).children_size as usize;
+    let slots = (*task).children_watermark as usize;
     let data  = (*task).children_data as *const u32;
     if data.is_null() || slots == 0 { return Vec::new(); }
     // Hard safety cap: 4096 slots × 4 bytes = 16 KB max read
@@ -343,8 +343,8 @@ impl DebugApp {
                         }
                         ui.end_row();
 
-                        // children_size = slot high-watermark (sparse array); live = non-null slots
-                        ui.label("child slots"); ui.label(format!("{} used / {} cap", (*task).children_size, (*task).children_max_size)); ui.end_row();
+                        // children_watermark = total insertions (sparse array); live = non-null slots
+                        ui.label("child slots"); ui.label(format!("{} watermark / {} cap", (*task).children_watermark, (*task).children_capacity)); ui.end_row();
                         ui.label("class_type");  ui.label(format!("{:?}", (*task).class_type));                                  ui.end_row();
                     });
                 });
@@ -353,7 +353,7 @@ impl DebugApp {
             // read_children returns all slots (sparse); filter nulls for live count.
             let children = read_children(task);
             let live_count = children.iter().filter(|&&a| a != 0).count();
-            let slot_count = (*task).children_size as usize;
+            let slot_count = (*task).children_watermark as usize;
             if live_count > 0 || slot_count > 0 {
                 egui::CollapsingHeader::new(format!("Children ({} live / {} slots)", live_count, slot_count))
                     .default_open(true)
@@ -365,7 +365,8 @@ impl DebugApp {
 
                             // Expand inline if the child itself has children
                             let child_task = child_addr as *const CTask;
-                            let grandchild_count = (*child_task).children_size;
+                            let grandchildren = read_children(child_task);
+                            let grandchild_count = grandchildren.iter().filter(|&&a| a != 0).count();
 
                             if grandchild_count > 0 {
                                 // Show as a sub-collapsing header with its own children
@@ -382,7 +383,6 @@ impl DebugApp {
                                             *navigate_to = Some(child_addr);
                                         }
                                         // Show grandchildren
-                                        let grandchildren = read_children(child_task);
                                         for gc_addr in &grandchildren {
                                             let gc_addr = *gc_addr;
                                             if gc_addr == 0 { continue; }

crates/openwa-wormkit/src/validation/mod.rs

@@ -262,7 +262,7 @@ fn validate_struct_offsets(result: &mut ValidationResult) {
     let _ = log_validation("  CTask:");
     check_offset!(result, CTask, vtable, 0x00);
     check_offset!(result, CTask, parent, 0x04);
-    check_offset!(result, CTask, children_max_size, 0x08);
+    check_offset!(result, CTask, children_capacity, 0x08);
     check_offset!(result, CTask, children_data, 0x14);
     check_offset!(result, CTask, class_type, 0x20);
     check_offset!(result, CTask, shared_data, 0x24);
@@ -1048,6 +1048,85 @@ fn dump_turngame() {
     }
 }
 
+// ---------------------------------------------------------------------------
+// CTask children sub-struct live dump
+// ---------------------------------------------------------------------------
+//
+// We need to confirm the layout of the four fields at CTask+0x08..+0x17:
+//   +0x08  children_capacity  (u32, starts 0x10)
+//   +0x0C  children_dirty     (u32, flag)
+//   +0x10  children_watermark (u32, insertion counter)
+//   +0x14  children_data      (*mut u8, array pointer)
+//
+// We dump the raw DWORDs at these offsets for a few representative tasks so
+// we can verify against what WA actually stores at runtime.
+
+fn dump_ctask_children() {
+    use crate::replacements::input::dump_region;
+
+    let _ = log_validation("");
+    let _ = log_validation("--- CTask children sub-struct dump ---");
+
+    unsafe {
+        let session_ptr = read_u32(rb(va::G_GAME_SESSION));
+        if session_ptr == 0 { let _ = log_validation("  No game session."); return; }
+        let wrapper_addr = read_u32(session_ptr + 0xA0);
+        if wrapper_addr == 0 { let _ = log_validation("  No DDGameWrapper."); return; }
+        let ddgame_ptr = read_u32(wrapper_addr + 0x488);
+        if ddgame_ptr == 0 { let _ = log_validation("  No DDGame."); return; }
+
+        let task_land_ptr = read_u32(ddgame_ptr + 0x54C);
+        if task_land_ptr == 0 { let _ = log_validation("  CTaskLand NULL."); return; }
+
+        // Walk up to root (CTaskTurnGame)
+        let mut cursor = task_land_ptr;
+        for _ in 0..10 {
+            let parent = read_u32(cursor + 0x04);
+            if parent == 0 { break; }
+            cursor = parent;
+        }
+        let root = cursor;
+
+        // Print the children sub-struct fields for root, then walk its first
+        // child (CTaskTeam level) and each of its children (CTaskFilter level).
+        let print_task_children = |label: &str, addr: u32| {
+            if addr == 0 { return; }
+            let cap   = read_u32(addr + 0x08);
+            let dirty = read_u32(addr + 0x0C);
+            let wmark = read_u32(addr + 0x10);
+            let data  = read_u32(addr + 0x14);
+            let _ = log_validation(&format!(
+                "  {}  @ 0x{:08X}  cap={}  dirty={}  watermark={}  data=0x{:08X}",
+                label, addr, cap, dirty, wmark, data
+            ));
+            // Raw dump of the 0x30-byte CTask base so we can cross-check all fields
+            dump_region(addr as *const u8, 0x00, 0x30, "CTask");
+        };
+
+        print_task_children("root (CTaskTurnGame)", root);
+
+        // First two children of root (CTaskTeam instances)
+        let root_watermark = read_u32(root + 0x10) as usize;
+        let root_data      = read_u32(root + 0x14);
+        let mut teams_found = 0;
+        for i in 0..root_watermark.min(64) {
+            let child = read_u32(root_data + i as u32 * 4);
+            if child == 0 { continue; }
+            print_task_children(&format!("  child[{}] (CTaskTeam?)", i), child);
+            // And print the first few children of this child (CTaskFilter level)
+            let child_wmark = read_u32(child + 0x10) as usize;
+            let child_data  = read_u32(child + 0x14);
+            for j in 0..child_wmark.min(16) {
+                let gc = read_u32(child_data + j as u32 * 4);
+                if gc == 0 { continue; }
+                print_task_children(&format!("    grandchild[{}] (CTaskFilter?)", j), gc);
+            }
+            teams_found += 1;
+            if teams_found >= 2 { break; }
+        }
+    }
+}
+
 // ---------------------------------------------------------------------------
 // CTaskTeam entity dump
 // ---------------------------------------------------------------------------
@@ -1181,6 +1260,8 @@ pub fn run() -> Result<(), String> {
             dump_turngame();
             let _ = log_validation("  Running CTaskTeam entity dump (5s mark)...");
             dump_ctaskteam_entities();
+            let _ = log_validation("  Running CTask children sub-struct dump (5s mark)...");
+            dump_ctask_children();
 
             // Wait briefly for replay to start, then dump game state
             // (fast-forward finishes the replay in ~10-15s total, so dump early)
@@ -1240,11 +1321,11 @@ pub fn start_hotkeys() {
         const VK_F10: i32 = 0x79;
         const VK_F11: i32 = 0x7A;
         const VK_F12: i32 = 0x7B;
-        let _ = log_validation("  Hotkeys: F8=team entities, F9=team blocks, F10=landscape, F11=worm tasks, F12=entity census");
+        let _ = log_validation("  Hotkeys: F8=ctask children, F9=team blocks, F10=landscape, F11=worm tasks, F12=entity census");
         loop {
             std::thread::sleep(std::time::Duration::from_millis(100));
             unsafe {
-                if GetAsyncKeyState(VK_F8)  & 1 != 0 { dump_ctaskteam_entities(); }
+                if GetAsyncKeyState(VK_F8)  & 1 != 0 { dump_ctask_children(); }
                 if GetAsyncKeyState(VK_F9)  & 1 != 0 { dump_team_blocks(); }
                 if GetAsyncKeyState(VK_F10) & 1 != 0 { dump_landscape(); }
                 if GetAsyncKeyState(VK_F11) & 1 != 0 { dump_worm_tasks(); }