fix: broadcast_message now works — use read_volatile for children state

The pure Rust CTask::HandleMessage port (broadcast_message) was failing
because LLVM cached children_watermark and children_data reads across
virtual dispatch calls. Child handlers can modify the parent's children
array (add/remove/realloc), so these fields must be re-read each
iteration.

Fix: use read_volatile via core::ptr::addr_of! for both fields.
This matches the original WA code which re-reads [EDI+0x10] and
[EDI+0x14] from memory each iteration.

CTaskCloud and CTaskFilter handlers now use broadcast_message directly
instead of calling the original WA CTask::HandleMessage at 0x562F30.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

crates/openwa-core/src/task/base.rs

@@ -208,49 +208,46 @@ pub unsafe trait Task {
     /// # Safety
     /// All non-null children must be valid CTask pointers with valid vtables.
     unsafe fn broadcast_message(
-        &self,
+        &mut self,
         sender: *mut CTask,
         msg_type: u32,
         size: u32,
         data: *const u8,
     ) {
-        let task_ptr = self.as_task_ptr();
-
-        // Find the first non-null child
+        let task_ptr = self.as_task_ptr_mut();
+
+        // Scan for non-null children and dispatch HandleMessage.
+        // Mirrors WA's CTask::HandleMessage at 0x562F30 exactly:
+        // scan → dispatch → re-read watermark → scan next → ...
+        //
+        // IMPORTANT: read_volatile is required for watermark and children_data
+        // because child handlers may modify this task's children array
+        // (add/remove children, realloc the array). LLVM would otherwise cache
+        // these reads across the virtual dispatch call.
         let mut i: usize = 0;
-        let mut child = core::ptr::null_mut::<CTask>();
         loop {
-            let watermark = (*task_ptr).children_watermark as usize;
-            if i >= watermark {
-                break;
-            }
-            child = *(*task_ptr).children_data.add(i);
-            i += 1;
-            if !child.is_null() {
-                break;
-            }
-        }
-
-        while !child.is_null() {
-            // Dispatch via typed CTaskVtable — every task's vtable starts
-            // with the same 8-slot layout, so this cast is always valid.
-            let vt = &*((*child).vtable as *const CTaskVtable);
-            (vt.handle_message)(child, sender, msg_type, size, data);
-
-            // Find next non-null child — re-read watermark each time
-            // because the handler may have added or removed siblings
-            child = core::ptr::null_mut();
-            loop {
-                let watermark = (*task_ptr).children_watermark as usize;
+            // Scan for next non-null child
+            let child = loop {
+                let watermark = core::ptr::read_volatile(
+                    core::ptr::addr_of!((*task_ptr).children_watermark),
+                ) as usize;
                 if i >= watermark {
-                    break;
+                    return;
                 }
-                child = *(*task_ptr).children_data.add(i);
+                let children = core::ptr::read_volatile(
+                    core::ptr::addr_of!((*task_ptr).children_data),
+                );
+                let c = *children.add(i);
                 i += 1;
-                if !child.is_null() {
-                    break;
+                if !c.is_null() {
+                    break c;
                 }
-            }
+            };
+
+            // Dispatch via CTaskVtable — every task's vtable starts with
+            // the same 8-slot base layout, so this cast is always valid.
+            let vt = &*((*child).vtable as *const CTaskVtable);
+            (vt.handle_message)(child, sender, msg_type, size, data);
         }
     }
 }

crates/openwa-wormkit/src/replacements/task/cloud.rs

@@ -96,10 +96,8 @@ unsafe extern "thiscall" fn cloud_handle_message(
         _ => {}
     }
 
-    // Broadcast to children via original WA CTask::HandleMessage
-    let base_handler: unsafe extern "thiscall" fn(*mut CTask, *mut CTask, u32, u32, *const u8) =
-        core::mem::transmute(openwa_core::rebase::rb(va::CTASK_VT2_HANDLE_MESSAGE) as usize);
-    base_handler(cloud.as_task_ptr_mut(), sender, msg_type, size, data);
+    // Broadcast to children (pure Rust port of CTask::HandleMessage)
+    cloud.broadcast_message(sender, msg_type, size, data);
 }
 
 pub fn install() -> Result<(), String> {

crates/openwa-wormkit/src/replacements/task/filter.rs

@@ -29,10 +29,8 @@ unsafe extern "thiscall" fn filter_handle_message(
         return; // message not subscribed — drop silently
     }
 
-    // Broadcast to children via original WA CTask::HandleMessage
-    let base_handler: unsafe extern "thiscall" fn(*mut CTask, *mut CTask, u32, u32, *const u8) =
-        core::mem::transmute(openwa_core::rebase::rb(va::CTASK_VT2_HANDLE_MESSAGE) as usize);
-    base_handler(filter.as_task_ptr() as *mut CTask, sender, msg_type, size, data);
+    // Broadcast to children (pure Rust port of CTask::HandleMessage)
+    (*this).broadcast_message(sender, msg_type, size, data);
 }
 
 pub fn install() -> Result<(), String> {