refactor: propagate types and trim comments in render hook shims

Replace u32 params with Fixed, SpriteOp, and typed pointers across
render_queue.rs and display_vtable.rs. Propagate to core callees
(blit_sprite, bungee_trail, crosshair_line). Trim comments to just
Ghidra name + address.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

crates/openwa-core/src/render/bungee_trail.rs

@@ -21,8 +21,8 @@ use crate::trig::trig_lookup;
 ///
 /// `task_ptr` must point to a valid `BungeeTrailTask`. ASLR rebase must be
 /// initialized.
-pub unsafe fn draw_bungee_trail(task_ptr: u32, style: u32, fill: u32) {
-    let task = &*(task_ptr as *const BungeeTrailTask);
+pub unsafe fn draw_bungee_trail(task: *const BungeeTrailTask, style: u32, fill: u32) {
+    let task = &*task;
 
     if task.trail_visible == 0 {
         return;

crates/openwa-core/src/render/crosshair_line.rs

@@ -22,11 +22,10 @@ use crate::trig::trig_lookup;
 ///
 /// `task_ptr` must point to a valid `WeaponAimTask`. ASLR rebase must be
 /// initialized.
-pub unsafe fn draw_crosshair_line(task_ptr: u32) {
-    let task = &*(task_ptr as *const WeaponAimTask);
-    let gt = &task.game_task;
+pub unsafe fn draw_crosshair_line(task: *const WeaponAimTask) {
+    let gt = &(*task).game_task;
 
-    if task.aim_active == 0 {
+    if (*task).aim_active == 0 {
         return;
     }
 
@@ -36,7 +35,7 @@ pub unsafe fn draw_crosshair_line(task_ptr: u32) {
     let start_x = gt.pos_x.0;
     let start_y = gt.pos_y.0;
 
-    let angle = task.aim_angle;
+    let angle = (*task).aim_angle;
 
     // Trig interpolation
     let sin_table = rb(va::G_SIN_TABLE) as *const i32;
@@ -45,7 +44,7 @@ pub unsafe fn draw_crosshair_line(task_ptr: u32) {
     let cos_interp = trig_lookup(cos_table, angle);
 
     // Scale = fixed_mul(DDGame.parallax_scale, 0x140000) + task.aim_range_offset
-    let scale = Fixed(ddgame.parallax_scale).mul_raw(Fixed(0x14_0000)).0 + task.aim_range_offset;
+    let scale = Fixed(ddgame.parallax_scale).mul_raw(Fixed(0x14_0000)).0 + (*task).aim_range_offset;
 
     // Endpoint = start + direction * scale
     let mut endpoint_x = Fixed(sin_interp.0)

crates/openwa-core/src/render/display/blit_sprite.rs

@@ -23,7 +23,7 @@ pub unsafe fn blit_sprite(
     this: *mut DisplayGfx,
     x: Fixed,
     y: Fixed,
-    sprite_flags: u32,
+    sprite: SpriteOp,
     palette: u32,
 ) {
     let gfx = this;
@@ -32,7 +32,6 @@ pub unsafe fn blit_sprite(
     // ---------------------------------------------------------------
     // Extract sprite index and flags
     // ---------------------------------------------------------------
-    let sprite = SpriteOp(sprite_flags);
     let flags = sprite.flags();
     let sprite_id = sprite.index() as u32;
 

crates/openwa-dll/src/replacements/render/display_vtable.rs

@@ -1,11 +1,5 @@
-//! DisplayGfx vtable patches — DisplayBase pure-call stubs, headless destructor,
-//! and ported DisplayGfx methods.
-//!
-//! Patches DisplayBase vtables in WA.exe's .rdata:
-//! - Primary vtable (0x6645F8): replaces _purecall slots with safe no-op stubs
-//! - Headless vtable (0x66A0F8): replaces destructor with Rust version that
-//!   correctly frees our Rust-allocated sprite cache sub-objects
-//! - DisplayGfx vtable (0x66A218): replaces ported methods with Rust
+//! DisplayGfx vtable patches — DisplayBase purecall stubs, headless destructor,
+//! and ported DisplayGfx method wiring.
 
 use core::ffi::c_char;
 
@@ -18,6 +12,7 @@ use openwa_core::render::display::vtable::{self as display_vtable_impl, DisplayG
 use openwa_core::render::display::DisplayBase;
 use openwa_core::render::display::DisplayGfx;
 use openwa_core::render::sprite::gfx_dir::GfxDir;
+use openwa_core::render::SpriteOp;
 use openwa_core::vtable::patch_vtable;
 use openwa_core::vtable_replace;
 use openwa_core::wa_alloc::wa_free;
@@ -33,8 +28,6 @@ const VTABLE_SLOTS: usize = 32;
 
 unsafe extern "thiscall" fn noop_thiscall(_this: *mut u8) {}
 
-/// Rust destructor for headless DisplayBase. Frees the sprite cache chain
-/// (SpriteCache -> FrameCache -> buffer) that was allocated by new_headless().
 unsafe extern "thiscall" fn headless_destructor(
     this: *mut DisplayBase,
     flags: u8,
@@ -57,22 +50,18 @@ unsafe extern "thiscall" fn headless_destructor(
     this
 }
 
-// No saved originals needed — all paths are fully ported or use direct bridges.
-
-/// Thiscall stub for DisplayGfx::BlitSprite (slot 19, 0x56B080).
-/// Implementation in `openwa_core::render::display::blit_sprite`.
+// BlitSprite (slot 19, 0x56B080)
 unsafe extern "thiscall" fn blit_sprite(
     this: *mut DisplayGfx,
     x: Fixed,
     y: Fixed,
-    sprite_flags: u32,
+    sprite: SpriteOp,
     palette: u32,
 ) {
-    openwa_core::render::display::blit_sprite::blit_sprite(this, x, y, sprite_flags, palette);
+    openwa_core::render::display::blit_sprite::blit_sprite(this, x, y, sprite, palette);
 }
 
-/// Thiscall stub for DisplayGfx::DrawScaledSprite (slot 20).
-/// Implementation in `openwa_core::render::display::blit_sprite`.
+// DrawScaledSprite (slot 20, 0x56B5F0)
 unsafe extern "thiscall" fn draw_scaled_sprite(
     this: *mut DisplayGfx,
     x: Fixed,
@@ -89,21 +78,7 @@ unsafe extern "thiscall" fn draw_scaled_sprite(
     );
 }
 
-// =========================================================================
-// Font vtable method wrappers
-// =========================================================================
-//
-// Font slot wrappers (slots 7/8/9/10/34/35/36) all live in openwa-core's
-// `display::vtable` module. The wrappers in this file (slots 31/34/35/37
-// for sprite/font loading) are thin forwarders only because they need to
-// capture a bridge function pointer (`wa_load_sprite_from_vfs` etc.) at
-// install time.
-
-// =========================================================================
-// Sprite loading vtable method wrappers
-// =========================================================================
-
-/// Thiscall wrapper for DisplayGfx::LoadSprite (vtable slot 31, 0x523400).
+// LoadSprite (slot 31, 0x523400)
 unsafe extern "thiscall" fn load_sprite(
     this: *mut DisplayGfx,
     layer: u32,
@@ -123,13 +98,7 @@ unsafe extern "thiscall" fn load_sprite(
     )
 }
 
-/// Bridge to LoadSpriteFromVfs (0x4FAAF0).
-/// Usercall: ECX=gfx, EAX=name, stack(sprite, layer_ctx), RET 0x8.
-///
-/// Verified from caller at 0x523489:
-///   ECX ← layer_contexts[layer] (gfx/VFS context)... wait, re-checked:
-///   ECX ← gfx param, EAX ← name param.
-///   Stack: sprite (EDI from ConstructSprite), layer_ctx.
+// LoadSpriteFromVfs (0x4FAAF0) — naked bridge
 #[unsafe(naked)]
 unsafe extern "cdecl" fn wa_load_sprite_from_vfs(
     _sprite: *mut openwa_core::render::sprite::Sprite,
@@ -151,11 +120,7 @@ unsafe extern "cdecl" fn wa_load_sprite_from_vfs(
 
 static mut LOAD_SPRITE_FROM_VFS_ADDR: u32 = 0;
 
-// GetSpriteFrameForBlit (slot 33) is NOT ported — see the docstring on
-// `DisplayVtable::get_sprite_frame_for_blit` in openwa-core for the full
-// rationale. Our `blit_sprite` (slot 19) above calls it via the bound
-// vtable wrapper on every sprite render.
-
+// LoadSpriteByLayer (slot 34)
 unsafe extern "thiscall" fn load_sprite_by_layer(
     this: *mut DisplayGfx,
     layer: u32,
@@ -166,6 +131,7 @@ unsafe extern "thiscall" fn load_sprite_by_layer(
     display_vtable_impl::load_sprite_by_layer(this, layer, id, gfx_dir, name)
 }
 
+// LoadFont (slot 35)
 unsafe extern "thiscall" fn load_font(
     this: *mut DisplayGfx,
     mode: u32,
@@ -176,6 +142,7 @@ unsafe extern "thiscall" fn load_font(
     display_vtable_impl::load_font(this, mode, font_id, gfx_dir, filename)
 }
 
+// LoadFontExtension (slot 36)
 unsafe extern "thiscall" fn load_font_extension(
     this: *mut DisplayGfx,
     font_id: i32,
@@ -187,10 +154,6 @@ unsafe extern "thiscall" fn load_font_extension(
     display_vtable_impl::load_font_extension(this, font_id, path, char_map, palette_value, flag)
 }
 
-// ---------------------------------------------------------------------------
-// Installation
-// ---------------------------------------------------------------------------
-
 pub fn install() -> Result<(), String> {
     let _ = log_line("[Display] Patching DisplayBase vtables");
 
@@ -198,7 +161,6 @@ pub fn install() -> Result<(), String> {
         let purecall_addr = rb(PURECALL);
         let noop_addr = noop_thiscall as *const () as u32;
 
-        // Patch primary vtable (0x6645F8): replace _purecall with no-ops.
         let primary = rb(va::DISPLAY_BASE_VTABLE) as *mut u32;
         patch_vtable(primary, VTABLE_SLOTS, |vt| {
             let mut patched = 0u32;
@@ -214,81 +176,57 @@ pub fn install() -> Result<(), String> {
             ));
         })?;
 
-        // Patch headless vtable (0x66A0F8): replace destructor (slot 0)
-        // with our Rust version that frees the Rust-allocated sprite cache.
         let headless = rb(va::DISPLAY_BASE_HEADLESS_VTABLE) as *mut u32;
         patch_vtable(headless, VTABLE_SLOTS, |vt| {
             *vt = headless_destructor as *const () as u32;
             let _ = log_line("[Display]   Headless: patched slot 0 (destructor) -> Rust");
         })?;
 
-        // Initialize bridge address statics for sprite loading
         LOAD_SPRITE_FROM_VFS_ADDR = rb(va::LOAD_SPRITE_FROM_VFS);
 
-        // Patch DisplayGfx vtable (0x66A218): replace ported methods with Rust.
         vtable_replace!(DisplayGfxVtable, va::DISPLAY_GFX_VTABLE, {
-            destructor          => display_destructor::display_gfx_destructor,
-            get_dimensions      => display_vtable_impl::get_dimensions,
-            set_layer_color     => display_vtable_impl::set_layer_color,
-            set_active_layer    => display_vtable_impl::set_active_layer,
-            get_sprite_info     => display_vtable_impl::get_sprite_info,
-            draw_text_on_bitmap => display_vtable_impl::draw_text_on_bitmap,
-            draw_tiled_bitmap   => display_vtable_impl::draw_tiled_bitmap,
-            get_font_info       => display_vtable_impl::get_font_info,
-            get_font_metric     => display_vtable_impl::get_font_metric,
-            set_font_param      => display_vtable_impl::set_font_param,
-            draw_polyline       => display_vtable_impl::draw_polyline,
-            draw_line           => display_vtable_impl::draw_line,
-            draw_line_clipped   => display_vtable_impl::draw_line_clipped,
-            draw_pixel_strip    => display_vtable_impl::draw_pixel_strip,
-            draw_crosshair      => display_vtable_impl::draw_crosshair,
-            draw_outlined_pixel => display_vtable_impl::draw_outlined_pixel,
-            fill_rect           => display_vtable_impl::fill_rect,
-            draw_via_callback   => display_vtable_impl::draw_via_callback,
-            draw_tiled_terrain  => display_vtable_impl::draw_tiled_terrain,
-            flush_render        => display_vtable_impl::flush_render,
-            set_camera_offset   => display_vtable_impl::set_camera_offset,
-            set_clip_rect       => display_vtable_impl::set_clip_rect,
-            is_sprite_loaded    => display_vtable_impl::is_sprite_loaded,
-            load_sprite          => load_sprite,
-            draw_scaled_sprite  => draw_scaled_sprite,
-            set_layer_visibility => display_vtable_impl::set_layer_visibility,
-            update_palette      => display_vtable_impl::update_palette,
-            set_font_palette    => display_vtable_impl::set_font_palette,
-            slot 19 => blit_sprite,
-            get_sprite_frame_for_blit => display_vtable_impl::get_sprite_frame_for_blit,
-            load_sprite_by_layer => load_sprite_by_layer,
-            load_font            => load_font,
-            load_font_extension  => load_font_extension,
+            destructor                 => display_destructor::display_gfx_destructor,
+            get_dimensions             => display_vtable_impl::get_dimensions,
+            set_layer_color            => display_vtable_impl::set_layer_color,
+            set_active_layer           => display_vtable_impl::set_active_layer,
+            get_sprite_info            => display_vtable_impl::get_sprite_info,
+            draw_text_on_bitmap        => display_vtable_impl::draw_text_on_bitmap,
+            draw_tiled_bitmap          => display_vtable_impl::draw_tiled_bitmap,
+            get_font_info              => display_vtable_impl::get_font_info,
+            get_font_metric            => display_vtable_impl::get_font_metric,
+            set_font_param             => display_vtable_impl::set_font_param,
+            draw_polyline              => display_vtable_impl::draw_polyline,
+            draw_line                  => display_vtable_impl::draw_line,
+            draw_line_clipped          => display_vtable_impl::draw_line_clipped,
+            draw_pixel_strip           => display_vtable_impl::draw_pixel_strip,
+            draw_crosshair             => display_vtable_impl::draw_crosshair,
+            draw_outlined_pixel        => display_vtable_impl::draw_outlined_pixel,
+            fill_rect                  => display_vtable_impl::fill_rect,
+            draw_via_callback          => display_vtable_impl::draw_via_callback,
+            draw_tiled_terrain         => display_vtable_impl::draw_tiled_terrain,
+            flush_render               => display_vtable_impl::flush_render,
+            set_camera_offset          => display_vtable_impl::set_camera_offset,
+            set_clip_rect              => display_vtable_impl::set_clip_rect,
+            is_sprite_loaded           => display_vtable_impl::is_sprite_loaded,
+            load_sprite                => load_sprite,
+            draw_scaled_sprite         => draw_scaled_sprite,
+            set_layer_visibility       => display_vtable_impl::set_layer_visibility,
+            update_palette             => display_vtable_impl::update_palette,
+            set_font_palette           => display_vtable_impl::set_font_palette,
+            blit_sprite                => blit_sprite,
+            get_sprite_frame_for_blit  => display_vtable_impl::get_sprite_frame_for_blit,
+            load_sprite_by_layer       => load_sprite_by_layer,
+            load_font                  => load_font,
+            load_font_extension        => load_font_extension,
         })?;
         let _ = log_line("[Display]   DisplayGfx: patched 32 methods -> Rust");
 
-        // DisplayGfx::LoadSpriteEx (vtable slot 30) has zero callers in both
-        // WA.exe (no instructions reach vtable[+0x78] on a DisplayGfx) and our
-        // own Rust code (no `bind_DisplayVtable!` invocation, no direct call).
-        // Trap it so we'll be alerted the moment any future caller appears.
+        // Slot 30: zero callers in WA.exe or Rust.
         hook::install_trap!("DisplayGfx__LoadSpriteEx", va::DISPLAY_GFX_LOAD_SPRITE_EX);
 
-        // ── Slot 33 leaf functions: trap the WA-side originals ────────
-        //
-        // After `vtable_replace!` swapped slot 33 to our Rust impl, the
-        // original `DisplayGfx::GetSpriteFrameForBlit` (0x5237C0) is no
-        // longer reached, which means its leaves have no remaining
-        // callers in shipping WA either:
-        //
-        // - `Sprite__GetFrameForBlit` (0x4FAD30): only caller was the
-        //   original slot 33 dispatcher.
-        // - `SpriteBank__GetFrameForBlit` (0x4F9710): same. Also bank
-        //   objects are themselves unreachable (LoadSpriteEx is trapped).
-        // - `FrameCache__Allocate` (0x4FA950): only callers were the
-        //   two GetFrameForBlit helpers above.
-        // - `DisplayBitGrid::SetExternalBuffer` (0x4F6470): only caller
-        //   was `SpriteBank__GetFrameForBlit`.
-        //
-        // `Sprite_LZSS_Decode` (0x5B29E0) is NOT trapped — it has
-        // independent callers (`IMG_Decode`, `FUN_0048EE32`) reachable
-        // from `DDGame__Constructor`/`SoundEmitter`/`LoadHudAndWeaponSprites`,
-        // all still bridged. Trapping it would break those.
+        // Slot 33 leaf functions — only callers were the original WA-side
+        // GetSpriteFrameForBlit (now replaced). Note: Sprite_LZSS_Decode
+        // (0x5B29E0) is NOT trapped — it has independent live callers.
         hook::install_trap!("Sprite__GetFrameForBlit", va::SPRITE_GET_FRAME_FOR_BLIT);
         hook::install_trap!(
             "SpriteBank__GetFrameForBlit",
@@ -300,26 +238,10 @@ pub fn install() -> Result<(), String> {
             va::DISPLAY_BIT_GRID_SET_EXTERNAL_BUFFER
         );
 
-        // ── Slot 0 destructor leaves: trap the WA-side originals ──────
-        //
-        // After `vtable_replace!` swapped slot 0 to our Rust impl, the
-        // original `DisplayGfx::DestructorImpl` (0x56A010) is no longer
-        // reached, so its only-callee helpers lose their last live
-        // caller too.
-        //
-        // `TileBitmapSet::Destructor` (0x569BC0) has a *second* xref to
-        // `FUN_0056C2E0` (a tile-bitmap-set realloc helper called only
-        // from `CBitmap__Constructor_Maybe` at 0x56C060). That second
-        // chain is **structurally dead** in shipping WA: 0x56C060 sits
-        // in the DisplayGfx vtable .rdata block at slot index 38 (offset
-        // 0x98 past the vtable base 0x66A218), but no instruction in
-        // WA.exe loads from offset 0x98 of any pointer — verified by
-        // byte-pattern search for `FF 90 98 00 00 00` (CALL [reg+0x98])
-        // and `8B 4? 98` (MOV reg,[reg+0x98]) returning no DisplayGfx
-        // hits. The compiler emitted slots 38/39 of DisplayGfx into
-        // .rdata but the C++ source has no live caller for them — they
-        // are vestigial vtable entries from a removed feature. So
-        // trapping `TileBitmapSet::Destructor` is safe.
+        // Slot 0 destructor leaf functions — only caller was the original
+        // WA-side DestructorImpl (now replaced). TileBitmapSet::Destructor's
+        // second xref (via slot 38) is structurally dead — no instruction
+        // in WA.exe dispatches through vtable offset 0x98.
         hook::install_trap!(
             "DisplayGfx__DestructorImpl",
             va::DISPLAY_GFX_DESTRUCTOR_IMPL

crates/openwa-dll/src/replacements/render/render_queue.rs

@@ -1,382 +1,322 @@
-//! RenderQueue enqueue hooks — full Rust replacements for command enqueueing,
-//! plus the per-frame RenderDrawingQueue dispatcher bridge.
+//! RenderQueue enqueue hooks and the per-frame dispatcher bridge.
 
 use openwa_core::address::va;
+use openwa_core::bitgrid::DisplayBitGrid;
 use openwa_core::fixed::Fixed;
+use openwa_core::render::display::vtable::TiledBitmapSource;
 use openwa_core::render::display::DisplayGfx;
 use openwa_core::render::queue::*;
 use openwa_core::render::queue_dispatch::{render_drawing_queue, ClipContext};
 use openwa_core::render::SpriteOp;
+use openwa_core::task::{BungeeTrailTask, WeaponAimTask};
 
 use crate::hook::{self, usercall_trampoline};
 
-// ---------------------------------------------------------------------------
-// EnqueueTiledBitmap (0x541D60) — type 0xD, EAX=this, 3 stack, RET 0xC
-//
-// Mis-labelled `RQ_DrawPixel` in earlier reverse-engineering passes. It does
-// NOT enqueue a single-pixel draw — it enqueues a tile-cached bitmap draw
-// dispatched by `RenderDrawingQueue` case 0xD into vtable slot 11.
-// ---------------------------------------------------------------------------
+// EnqueueTiledBitmap (0x541D60)
 
 usercall_trampoline!(fn trampoline_enqueue_tiled_bitmap; impl_fn = enqueue_tiled_bitmap_impl;
     reg = eax; stack_params = 3; ret_bytes = "0xC");
 
 unsafe extern "cdecl" fn enqueue_tiled_bitmap_impl(
-    this: u32,
-    y_fixed16: u32,
-    source_descriptor: u32,
+    queue: *mut RenderQueue,
+    y: Fixed,
+    source: *const TiledBitmapSource,
     flags: u32,
 ) {
-    let q = &mut *(this as *mut RenderQueue);
-
-    if let Some(entry) = q.alloc::<DrawTiledBitmapCmd>() {
+    if let Some(entry) = (*queue).alloc::<DrawTiledBitmapCmd>() {
         *entry = DrawTiledBitmapCmd {
             command_type: command_type::DRAW_TILED_BITMAP,
             layer: 0x1B_0000,
             x: Fixed(0xFF00_0000u32 as i32),
-            y: Fixed(y_fixed16 as i32),
-            source: source_descriptor as *const _,
+            y,
+            source,
             flags: flags as u8,
             _pad: [0; 3],
         };
     }
 }
 
-// ---------------------------------------------------------------------------
-// DrawLineStrip (0x541DD0) — type 8, EAX=this, EDI=count, 2 stack, RET 0x8
-// Allocation: count * 0xC + 0x1C (variable size)
-// ---------------------------------------------------------------------------
+// DrawLineStrip (0x541DD0) — variable-size allocation: count * 0xC + 0x1C
 
 usercall_trampoline!(fn trampoline_draw_line_strip; impl_fn = draw_line_strip_impl;
     regs = [eax, edi]; stack_params = 2; ret_bytes = "0x8");
 
 unsafe extern "cdecl" fn draw_line_strip_impl(
-    this: u32,
+    queue: *mut RenderQueue,
     count: u32,
-    vertex_ptr: u32,
-    param_1: u32,
+    vertices: *const u8,
+    color: u32,
 ) {
-    let q = &mut *(this as *mut RenderQueue);
     let total_size = count as usize * 0xC + 0x1C;
 
-    if let Some(ptr) = q.alloc_raw(total_size) {
+    if let Some(ptr) = (*queue).alloc_raw(total_size) {
         let header = &mut *(ptr as *mut DrawLineStripHeader);
         *header = DrawLineStripHeader {
             command_type: command_type::DRAW_LINE_STRIP,
             layer: 0xE_0000,
             count,
-            color: param_1,
+            color,
         };
         core::ptr::copy_nonoverlapping(
-            vertex_ptr as *const u8,
+            vertices,
             ptr.add(core::mem::size_of::<DrawLineStripHeader>()),
             count as usize * 0xC,
         );
     }
 }
 
-// ---------------------------------------------------------------------------
-// DrawPolygon (0x541E50) — type 9, ECX=this, ESI=count, 3 stack, RET 0xC
-// Allocation: count * 0xC + 0x20 (variable size)
-// ---------------------------------------------------------------------------
+// DrawPolygon (0x541E50) — variable-size allocation: count * 0xC + 0x20
 
 usercall_trampoline!(fn trampoline_draw_polygon; impl_fn = draw_polygon_impl;
     regs = [ecx, esi]; stack_params = 3; ret_bytes = "0xC");
 
 unsafe extern "cdecl" fn draw_polygon_impl(
-    this: u32,
+    queue: *mut RenderQueue,
     count: u32,
-    vertex_ptr: u32,
-    param_1: u32,
-    param_2: u32,
+    vertices: *const u8,
+    color1: u32,
+    color2: u32,
 ) {
-    let q = &mut *(this as *mut RenderQueue);
     let total_size = count as usize * 0xC + 0x20;
 
-    if let Some(ptr) = q.alloc_raw(total_size) {
+    if let Some(ptr) = (*queue).alloc_raw(total_size) {
         let header = &mut *(ptr as *mut DrawPolygonHeader);
         *header = DrawPolygonHeader {
             command_type: command_type::DRAW_POLYGON,
             layer: 0xE_0000,
             count,
-            color1: param_1,
-            color2: param_2,
+            color1,
+            color2,
         };
         core::ptr::copy_nonoverlapping(
-            vertex_ptr as *const u8,
+            vertices,
             ptr.add(core::mem::size_of::<DrawPolygonHeader>()),
             count as usize * 0xC,
         );
     }
 }
 
-// ---------------------------------------------------------------------------
-// DrawCrosshair (0x541ED0) — type 0xB, ECX=this, 5 stack, RET 0x14
-// Enqueues a crosshair draw command. Dispatched by RenderDrawingQueue
-// case 0xB → DisplayGfx::draw_crosshair (vtable slot 16).
-// ---------------------------------------------------------------------------
+// DrawCrosshair (0x541ED0)
 
 usercall_trampoline!(fn trampoline_draw_crosshair; impl_fn = draw_crosshair_impl;
     reg = ecx; stack_params = 5; ret_bytes = "0x14");
 
 unsafe extern "cdecl" fn draw_crosshair_impl(
-    this: u32,
+    queue: *mut RenderQueue,
     layer: u32,
-    x_pos: u32,
-    y_pos: u32,
+    x: Fixed,
+    y: Fixed,
     color_fg: u32,
     color_bg: u32,
 ) {
-    let q = &mut *(this as *mut RenderQueue);
-
-    if let Some(entry) = q.alloc::<DrawCrosshairCmd>() {
+    if let Some(entry) = (*queue).alloc::<DrawCrosshairCmd>() {
         *entry = DrawCrosshairCmd {
             command_type: command_type::DRAW_CROSSHAIR,
             layer,
             color_fg,
             color_bg,
-            x: Fixed(x_pos as i32),
-            y: Fixed(y_pos as i32),
+            x,
+            y,
             ref_z: 0,
         };
     }
 }
 
-// ---------------------------------------------------------------------------
-// DrawRect (0x541F40) — type 0, ECX=this, EDX=y_clip, 6 stack, RET 0x18
-// ---------------------------------------------------------------------------
+// DrawRect (0x541F40)
 
 usercall_trampoline!(fn trampoline_draw_rect; impl_fn = draw_rect_impl;
     regs = [ecx, edx]; stack_params = 6; ret_bytes = "0x18");
 
 unsafe extern "cdecl" fn draw_rect_impl(
-    this: u32,
-    y_clip: u32,
+    queue: *mut RenderQueue,
+    y_clip: Fixed,
     layer: u32,
-    x1: u32,
-    y1: u32,
-    x2: u32,
-    y2: u32,
+    x1: Fixed,
+    y1: Fixed,
+    x2: Fixed,
+    y2: Fixed,
     color: u32,
 ) {
-    let q = &mut *(this as *mut RenderQueue);
-
-    if let Some(entry) = q.alloc::<DrawRectCmd>() {
+    if let Some(entry) = (*queue).alloc::<DrawRectCmd>() {
         *entry = DrawRectCmd {
             command_type: command_type::DRAW_RECT,
             layer,
             color,
-            x1: Fixed(x1 as i32).floor(),
-            y1: Fixed(y1 as i32).floor(),
-            x2: Fixed(x2 as i32).floor(),
-            y2: Fixed(y2 as i32).floor(),
-            ref_z: Fixed(y_clip as i32).floor().0,
+            x1: x1.floor(),
+            y1: y1.floor(),
+            x2: x2.floor(),
+            y2: y2.floor(),
+            ref_z: y_clip.floor().0,
         };
     }
 }
 
-// ---------------------------------------------------------------------------
-// DrawSpriteGlobal (0x541FE0) — type 4, EAX=y, ECX=this, 4 stack, RET 0x10
-// ---------------------------------------------------------------------------
+// DrawSpriteGlobal (0x541FE0)
 
 usercall_trampoline!(fn trampoline_draw_sprite_global; impl_fn = draw_sprite_global_impl;
     regs = [eax, ecx]; stack_params = 4; ret_bytes = "0x10");
 
 unsafe extern "cdecl" fn draw_sprite_global_impl(
-    y_pos: u32,
-    this: u32,
+    y_pos: Fixed,
+    queue: *mut RenderQueue,
     layer: u32,
-    x_pos: u32,
-    sprite_id: u32,
+    x_pos: Fixed,
+    sprite: SpriteOp,
     frame: u32,
 ) {
-    let q = &mut *(this as *mut RenderQueue);
-
-    if let Some(entry) = q.alloc::<DrawSpriteCmd>() {
+    if let Some(entry) = (*queue).alloc::<DrawSpriteCmd>() {
         *entry = DrawSpriteCmd {
             command_type: command_type::DRAW_SPRITE_GLOBAL,
             layer,
-            x: Fixed(x_pos as i32).floor(),
-            y: Fixed(y_pos as i32).floor(),
-            sprite: SpriteOp(sprite_id),
+            x: x_pos.floor(),
+            y: y_pos.floor(),
+            sprite,
             palette: frame,
         };
     }
 }
 
-// ---------------------------------------------------------------------------
-// DrawSpriteLocal (0x542060) — type 5, EAX=y, ECX=this, 4 stack, RET 0x10
-// ---------------------------------------------------------------------------
+// DrawSpriteLocal (0x542060)
 
 usercall_trampoline!(fn trampoline_draw_sprite_local; impl_fn = draw_sprite_local_impl;
     regs = [eax, ecx]; stack_params = 4; ret_bytes = "0x10");
 
 unsafe extern "cdecl" fn draw_sprite_local_impl(
-    y_pos: u32,
-    this: u32,
+    y_pos: Fixed,
+    queue: *mut RenderQueue,
     layer: u32,
-    x_pos: u32,
-    sprite_id: u32,
+    x_pos: Fixed,
+    sprite: SpriteOp,
     frame: u32,
 ) {
-    let q = &mut *(this as *mut RenderQueue);
-
-    if let Some(entry) = q.alloc::<DrawSpriteCmd>() {
+    if let Some(entry) = (*queue).alloc::<DrawSpriteCmd>() {
         *entry = DrawSpriteCmd {
             command_type: command_type::DRAW_SPRITE_LOCAL,
             layer,
-            x: Fixed(x_pos as i32).floor(),
-            y: Fixed(y_pos as i32).floor(),
-            sprite: SpriteOp(sprite_id),
+            x: x_pos.floor(),
+            y: y_pos.floor(),
+            sprite,
             palette: frame,
         };
     }
 }
 
-// ---------------------------------------------------------------------------
-// DrawSpriteOffset (0x5420E0) — type 6, ECX=this, EDX=y_clip, 6 stack, RET 0x18
-// ---------------------------------------------------------------------------
+// DrawSpriteOffset (0x5420E0)
 
 usercall_trampoline!(fn trampoline_draw_sprite_offset; impl_fn = draw_sprite_offset_impl;
     regs = [ecx, edx]; stack_params = 6; ret_bytes = "0x18");
 
 unsafe extern "cdecl" fn draw_sprite_offset_impl(
-    this: u32,
-    y_clip: u32,
+    queue: *mut RenderQueue,
+    y_clip: Fixed,
     layer: u32,
-    x_pos: u32,
-    y_pos: u32,
-    sprite_id: u32,
-    param_7: u32,
-    param_8: u32,
+    x_pos: Fixed,
+    y_pos: Fixed,
+    flags: u32,
+    sprite: SpriteOp,
+    palette: u32,
 ) {
-    let q = &mut *(this as *mut RenderQueue);
-
-    if let Some(entry) = q.alloc::<DrawSpriteOffsetCmd>() {
+    if let Some(entry) = (*queue).alloc::<DrawSpriteOffsetCmd>() {
         *entry = DrawSpriteOffsetCmd {
             command_type: command_type::DRAW_SPRITE_OFFSET,
             layer,
-            flags: sprite_id,
-            x: Fixed(x_pos as i32).floor(),
-            y: Fixed(y_pos as i32).floor(),
+            flags,
+            x: x_pos.floor(),
+            y: y_pos.floor(),
             ref_z: 0,
-            ref_z_2: Fixed(y_clip as i32).floor().0,
-            sprite: SpriteOp(param_7),
-            palette: param_8,
+            ref_z_2: y_clip.floor().0,
+            sprite,
+            palette,
         };
     }
 }
 
-// ---------------------------------------------------------------------------
-// DrawBitmapGlobal (0x542170) — type 1, ECX=this, EDX=y, 7 stack, RET 0x1C
-// ---------------------------------------------------------------------------
+// DrawBitmapGlobal (0x542170)
 
 usercall_trampoline!(fn trampoline_draw_bitmap_global; impl_fn = draw_bitmap_global_impl;
     regs = [ecx, edx]; stack_params = 7; ret_bytes = "0x1C");
 
 unsafe extern "cdecl" fn draw_bitmap_global_impl(
-    this: u32,
-    y_pos: u32,
+    queue: *mut RenderQueue,
+    y_pos: Fixed,
     layer: u32,
-    x_pos: u32,
-    bitmap_ptr: u32,
-    param_6: u32,
-    param_7: u32,
-    param_8: u32,
-    param_9: u32,
+    x_pos: Fixed,
+    bitmap: *mut DisplayBitGrid,
+    src_y: i32,
+    src_w: i32,
+    src_h: i32,
+    flags: u32,
 ) {
-    let q = &mut *(this as *mut RenderQueue);
-
-    if let Some(entry) = q.alloc::<DrawBitmapGlobalCmd>() {
+    if let Some(entry) = (*queue).alloc::<DrawBitmapGlobalCmd>() {
         *entry = DrawBitmapGlobalCmd {
             command_type: command_type::DRAW_BITMAP_GLOBAL,
             layer,
-            x: Fixed(x_pos as i32).floor(),
-            y: Fixed(y_pos as i32).floor(),
-            bitmap: bitmap_ptr as *mut _,
+            x: x_pos.floor(),
+            y: y_pos.floor(),
+            bitmap,
             src_x: 0,
-            src_y: param_6 as i32,
-            src_w: param_7 as i32,
-            src_h: param_8 as i32,
-            flags: param_9,
+            src_y,
+            src_w,
+            src_h,
+            flags,
         };
     }
 }
 
-// ---------------------------------------------------------------------------
-// DrawTextboxLocal (0x542200) — type 2, ECX=this, EDX=y, 6 stack, RET 0x18
-// ---------------------------------------------------------------------------
+// DrawTextboxLocal (0x542200)
 
 usercall_trampoline!(fn trampoline_draw_textbox_local; impl_fn = draw_textbox_local_impl;
     regs = [ecx, edx]; stack_params = 6; ret_bytes = "0x18");
 
 unsafe extern "cdecl" fn draw_textbox_local_impl(
-    this: u32,
-    y_pos: u32,
+    q: *mut RenderQueue,
+    y_pos: Fixed,
     layer: u32,
-    x_pos: u32,
-    text_ptr: u32,
-    param_6: u32,
-    param_7: u32,
-    param_8: u32,
+    x_pos: Fixed,
+    bitmap: *mut DisplayBitGrid,
+    src_w: i32,
+    src_h: i32,
+    flags: u32,
 ) {
-    let q = &mut *(this as *mut RenderQueue);
-
-    if let Some(entry) = q.alloc::<DrawTextboxLocalCmd>() {
+    if let Some(entry) = (*q).alloc::<DrawTextboxLocalCmd>() {
         *entry = DrawTextboxLocalCmd {
             command_type: command_type::DRAW_TEXTBOX_LOCAL,
             layer,
             mode: 0,
-            x: Fixed(x_pos as i32).floor(),
-            y: Fixed(y_pos as i32).floor(),
+            x: x_pos.floor(),
+            y: y_pos.floor(),
             ref_z: 0,
             ref_z_2: 0,
-            bitmap: text_ptr as *mut _,
+            bitmap,
             src_x: 0,
             src_y: 0,
-            src_w: param_6 as i32,
-            src_h: param_7 as i32,
-            flags: param_8,
+            src_w,
+            src_h,
+            flags,
         };
     }
 }
 
-// ---------------------------------------------------------------------------
-// DrawBungeeTrail (0x500720) — stdcall(task, style, fill), RET 0xC
-//
-// Draws bungee drop trajectory path. Logic lives in openwa_core::render::bungee_trail.
-// ---------------------------------------------------------------------------
+// DrawBungeeTrail (0x500720)
 
-unsafe extern "stdcall" fn draw_bungee_trail_impl(task_ptr: u32, style: u32, fill: u32) {
-    openwa_core::render::bungee_trail::draw_bungee_trail(task_ptr, style, fill);
+unsafe extern "stdcall" fn draw_bungee_trail_impl(
+    task: *const BungeeTrailTask,
+    style: u32,
+    fill: u32,
+) {
+    openwa_core::render::bungee_trail::draw_bungee_trail(task, style, fill);
 }
 
-// ---------------------------------------------------------------------------
-// DrawCrosshairLine (0x5197D0) — usercall(EDI=task_ptr), plain RET
-//
-// Draws the weapon aiming crosshair line:
-//   1. Compute direction from angle at task+0x264
-//   2. Compute line length from DDGame scale + task offset
-//   3. Endpoint = start + direction * length (with overflow clamping)
-//   4. DrawPolygon (2 vertices) for the line
-//   5. Conditionally DrawSpriteLocal at endpoint (crosshair sprite)
-// ---------------------------------------------------------------------------
+// DrawCrosshairLine (0x5197D0)
 
 usercall_trampoline!(fn trampoline_draw_crosshair_line; impl_fn = draw_crosshair_line_impl;
     reg = edi);
 
-unsafe extern "cdecl" fn draw_crosshair_line_impl(task_ptr: u32) {
-    openwa_core::render::crosshair_line::draw_crosshair_line(task_ptr);
+unsafe extern "cdecl" fn draw_crosshair_line_impl(task: *const WeaponAimTask) {
+    openwa_core::render::crosshair_line::draw_crosshair_line(task);
 }
 
-// ---------------------------------------------------------------------------
-// RenderDrawingQueue (0x542350) — usercall(EAX=RenderQueue*) + 2 stack
-// (DisplayGfx*, ClipContext*), RET 0x8.
-//
-// The per-frame render-queue dispatcher. Pure Rust port lives in
-// `openwa_core::render::queue_dispatch::render_drawing_queue`. The
-// trampoline captures EAX and forwards the two stack args.
-// ---------------------------------------------------------------------------
+// RenderDrawingQueue (0x542350)
 
 usercall_trampoline!(fn trampoline_render_drawing_queue;
     impl_fn = render_drawing_queue_impl;
@@ -390,10 +330,6 @@ unsafe extern "cdecl" fn render_drawing_queue_impl(
     render_drawing_queue(rq, display, clip);
 }
 
-// ---------------------------------------------------------------------------
-// Installation
-// ---------------------------------------------------------------------------
-
 pub fn install() -> Result<(), String> {
     unsafe {
         let _ = hook::install(