debug: add OPENWA_WATCH_FRAME for runtime hardware watchpoints

Arms DR0 on DDGame+0x50 at the specified frame via the existing VEH
watchpoint infrastructure. Set OPENWA_WATCH_FRAME=0 to arm from the
first frame.

Key finding: DDGame+0x50 is a sprite pointer at frame 1350, NOT a
small integer. The earlier raw-dump comparison was flawed (cross-
process pointer values compared without ASLR normalization). The real
desync is in sub-object content, not in DDGame field values.

Also adds shotgun replay (PASSES with both constructors, confirming
the desync is longbow-specific, not arrow-handler-specific).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

crates/openwa-wormkit/src/debug_watchpoint.rs

@@ -32,12 +32,8 @@ use windows_sys::Win32::System::Diagnostics::Debug::{
 
 /// DDGame offsets to watch. Hardware limit: 4 watchpoints (DR0–DR3).
 /// Change these to investigate different fields.
-const WATCH_OFFSETS: [(u32, &str); 4] = [
-    (0x041C, "sprite_cache[38]"),
-    (0x0420, "sprite_cache[39]"),
-    (0x7820, "render_idx[0]"),
-    (0x7824, "render_idx[1]"),
-    // Swap in (0x7828, "render_idx[2]") if needed — likely same writer as [0]/[1]
+const WATCH_OFFSETS: [(u32, &str); 1] = [
+    (0x0050, "ddgame+0x50"),
 ];
 
 /// DDGame base address (set when allocation is reported).
@@ -87,10 +83,12 @@ unsafe extern "system" fn veh_handler(info: *mut EXCEPTION_POINTERS) -> i32 {
             SAVED_DR = [ctx.Dr0, ctx.Dr1, ctx.Dr2, ctx.Dr3, ctx.Dr6, ctx.Dr7];
 
             let base = DDGAME_BASE.load(Ordering::Relaxed);
-            ctx.Dr0 = base + WATCH_OFFSETS[0].0;
-            ctx.Dr1 = base + WATCH_OFFSETS[1].0;
-            ctx.Dr2 = base + WATCH_OFFSETS[2].0;
-            ctx.Dr3 = base + WATCH_OFFSETS[3].0;
+            let dr_regs = [&mut ctx.Dr0, &mut ctx.Dr1, &mut ctx.Dr2, &mut ctx.Dr3];
+            for (i, dr) in dr_regs.into_iter().enumerate() {
+                if i < WATCH_OFFSETS.len() {
+                    *dr = base + WATCH_OFFSETS[i].0;
+                }
+            }
             ctx.Dr6 = 0;
             ctx.Dr7 = dr7_for_count(WATCH_OFFSETS.len());
 

crates/openwa-wormkit/src/replacements/input.rs

@@ -186,6 +186,19 @@ unsafe extern "stdcall" fn hook_turn_manager(turngame: u32) {
     if !ddgame.is_null() {
         let game_frame = (*ddgame).frame_counter;
         crate::debug_sync::on_frame_start(game_frame);
+
+        // Hardware watchpoint: arm once at the watch frame
+        static WATCH_ARMED: core::sync::atomic::AtomicBool = core::sync::atomic::AtomicBool::new(false);
+        if !WATCH_ARMED.load(Ordering::Relaxed) {
+            if let Ok(val) = std::env::var("OPENWA_WATCH_FRAME") {
+                let target: i32 = val.parse().unwrap_or(0);
+                if game_frame >= target {
+                    WATCH_ARMED.store(true, Ordering::Relaxed);
+                    crate::debug_watchpoint::prepare();
+                    crate::debug_watchpoint::on_ddgame_alloc(ddgame as *mut u8);
+                }
+            }
+        }
     }
 
     // Call original

testdata/replays/shotgun.WAgame

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:e1e1bdccaf88674cae5c859ebf5b9fc1e5ace782e1d157aae4bb14f593be3ea9
+size 12318

testdata/replays/shotgun_expected.log

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:1cc0c12cdf6c012f1ce153bdc7f5ed03199a0602a9e486c64c7cdfad8cecd12e
+size 1186