feat: add SharedData entity census and CTaskFilter RE

- Add SharedDataNode/SharedDataTable/SharedDataIter types to task.rs for
iterating the 256-bucket entity hash table at CTask.shared_data
- Add 8 new CTASK_*_VTABLE constants to address.rs (Worm, Land, TurnGame,
Team, Filter, Dirt, SpriteAnim, CPU)
- Add CTaskFilter struct (0xB4 bytes) with subscription_table[100] at +0x30;
documents the message-subscription filter pattern used per team
- Add dump_entity_census() to validation: iterates SharedData table, groups
by vtable, names all known task types; auto-runs at 5s mark and on F12
- Refactor dump_worm_tasks() to use SharedDataTable::iter()

RE findings:
- CTaskFilter overrides HandleMessage to drop messages not in its
subscription table; 4 instances per team with different message sets
- CTaskCPU is transient (only present during AI turn)
- Dead worms are removed from SharedData on death

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

crates/openwa-core/src/address.rs

@@ -47,8 +47,22 @@ pub mod va {
     pub const OPENGL_CPU_VTABLE: u32 = 0x0067_74C0;
     /// WaterEffect vtable (0xBC-byte object)
     pub const WATER_EFFECT_VTABLE: u32 = 0x0066_B268;
-    /// CTaskLand vtable - 12 entries, landscape/terrain task (DDGame+0x054C)
+    /// CTaskLand vtable - landscape/terrain task (DDGame+0x054C)
     pub const CTASK_LAND_VTABLE: u32 = 0x0066_4388;
+    /// CTaskWorm vtable - worm entity task (constructor 0x50BFB0)
+    pub const CTASK_WORM_VTABLE: u32 = 0x0066_44C8;
+    /// CTaskTurnGame vtable - global turn flow manager (1 per game)
+    pub const CTASK_TURN_GAME_VTABLE: u32 = 0x0066_9F70;
+    /// CTaskTeam vtable - per-team task (1 per team, constructor 0x555BF0)
+    pub const CTASK_TEAM_VTABLE: u32 = 0x0066_9EE4;
+    /// CTaskFilter vtable - role unclear; 4 instances in a 2-team 3-worm game
+    pub const CTASK_FILTER_VTABLE: u32 = 0x0066_9DAC;
+    /// CTaskDirt vtable - dirt/particle system (1 per game, constructor 0x54EDF0)
+    pub const CTASK_DIRT_VTABLE: u32 = 0x0066_9D74;
+    /// CTaskSpriteAnim vtable - sprite animation manager (1 per game, constructor 0x5466F0)
+    pub const CTASK_SPRITE_ANIM_VTABLE: u32 = 0x0066_9D00;
+    /// CTaskCPU vtable - AI/CPU bot controller (1 per game, constructor 0x548620)
+    pub const CTASK_CPU_VTABLE: u32 = 0x0066_9D54;
     /// Sprite vtable (0x70-byte objects, 8 entries)
     pub const SPRITE_VTABLE: u32 = 0x0066_418C;
 

crates/openwa-core/src/task.rs

@@ -50,6 +50,134 @@ pub struct CTask {
 
 const _: () = assert!(core::mem::size_of::<CTask>() == 0x30);
 
+// ---------------------------------------------------------------------------
+// Shared-data entity registry
+// ---------------------------------------------------------------------------
+
+/// A 0x30-byte node in CTask's shared-data entity hash table.
+///
+/// Inserted by `SharedData__Insert` (0x5406A0, called from task constructors).
+/// All game task types (CTaskWorm, CTaskLand, projectiles, …) share the same
+/// 256-bucket table at `CTask.shared_data`. Use the vtable pointer at
+/// `entity[0]` to identify the object type.
+///
+/// Hash function (from Ghidra decompilation of `SharedData__Insert`):
+/// ```text
+/// bucket = (key_esi * 0x11 + key_edi) & 0x800000ff;
+/// if (int)bucket < 0 { bucket = bucket.wrapping_sub(1) | 0xffffff00; bucket += 1; }
+/// ```
+/// In practice (small positive key values), this reduces to:
+/// `bucket = (key_esi * 0x11 + key_edi) & 0xff`
+///
+/// Runtime observation: for `CTaskWorm`, `key_esi` encodes a compound worm
+/// identity (e.g. `0x11` = team 1, worm 1) and `key_edi` is a small integer.
+/// Companion remove function: `SharedData__Remove` (0x540700).
+#[repr(C)]
+pub struct SharedDataNode {
+    /// +0x00: Next node in this bucket's linked list (null = end).
+    pub next: *mut SharedDataNode,
+    /// +0x04: EDI register value at registration time.
+    pub key_edi: u32,
+    /// +0x08: ESI register value at registration time.
+    pub key_esi: u32,
+    /// +0x0C: Registered entity pointer (first DWORD = vtable).
+    pub entity: *mut u8,
+    /// +0x10..0x2F: Unused allocation padding.
+    pub _padding: [u8; 0x20],
+}
+
+const _: () = assert!(core::mem::size_of::<SharedDataNode>() == 0x30);
+
+/// View of the 256-bucket entity hash table at `CTask.shared_data`.
+///
+/// Root tasks own 0x420 bytes of shared data:
+/// - `0x000..0x3FF`: 256 × `*mut SharedDataNode` bucket heads
+/// - `0x400..0x41F`: Other root-task data (layout unknown)
+///
+/// All tasks in the same game tree inherit the same `shared_data` pointer, so
+/// any task can be used to access the full table. Use [`SharedDataTable::iter`]
+/// to walk all registered entities and filter by vtable address.
+///
+/// Registered by `SharedData__Insert` (0x5406A0); removed by
+/// `SharedData__Remove` (0x540700).
+pub struct SharedDataTable {
+    buckets: *const *mut SharedDataNode,
+}
+
+impl SharedDataTable {
+    /// Construct from a raw `CTask.shared_data` pointer.
+    ///
+    /// # Safety
+    /// `ptr` must point to a valid shared-data region of at least 256 × 4 = 1024 bytes.
+    pub unsafe fn from_ptr(ptr: *mut u8) -> Self {
+        Self { buckets: ptr as *const *mut SharedDataNode }
+    }
+
+    /// Construct from a `CTask` pointer (reads `task.shared_data`).
+    ///
+    /// # Safety
+    /// `task` must be a valid, aligned `CTask` pointer.
+    pub unsafe fn from_task(task: *const CTask) -> Self {
+        Self::from_ptr((*task).shared_data)
+    }
+
+    /// Compute the bucket index for a (key_esi, key_edi) pair.
+    ///
+    /// Exact transcription of the hash in `FUN_005406a0`.
+    pub fn bucket_for(key_esi: u32, key_edi: u32) -> u32 {
+        let mut h = key_esi.wrapping_mul(0x11).wrapping_add(key_edi) & 0x800000ff;
+        if (h as i32) < 0 {
+            h = h.wrapping_sub(1) | 0xffffff00;
+            h = h.wrapping_add(1);
+        }
+        h
+    }
+
+    /// Iterate all nodes across all 256 buckets.
+    ///
+    /// # Safety
+    /// The table and all linked nodes must be valid and not concurrently modified.
+    pub unsafe fn iter(&self) -> SharedDataIter {
+        SharedDataIter {
+            buckets: self.buckets,
+            bucket: 0,
+            node: core::ptr::null_mut(),
+        }
+    }
+}
+
+/// Iterator over all [`SharedDataNode`]s in a [`SharedDataTable`].
+///
+/// Created by [`SharedDataTable::iter`]. Walks all 256 buckets in order,
+/// following `next` pointers within each bucket.
+pub struct SharedDataIter {
+    buckets: *const *mut SharedDataNode,
+    bucket: usize,
+    node: *mut SharedDataNode,
+}
+
+impl Iterator for SharedDataIter {
+    type Item = *mut SharedDataNode;
+
+    fn next(&mut self) -> Option<Self::Item> {
+        // SAFETY: caller of SharedDataTable::iter() guarantees table validity.
+        unsafe {
+            loop {
+                if !self.node.is_null() {
+                    let current = self.node;
+                    self.node = (*self.node).next;
+                    return Some(current);
+                }
+                if self.bucket >= 256 {
+                    return None;
+                }
+                self.node = *self.buckets.add(self.bucket);
+                self.bucket += 1;
+            }
+        }
+    }
+}
+
 /// Game task - extends CTask with physics and gameplay data.
 ///
 /// PARTIAL: Most fields between 0x30-0x83 and 0x98-0xE7 are unknown.
@@ -120,6 +248,207 @@ pub struct SoundEmitterVTable {
     pub _base_methods: [*const (); 7],
 }
 
+/// Virtual method table for CTaskWorm (vtable at 0x6644C8, 20 slots).
+///
+/// CTaskWorm overrides 14 of the 20 inherited CTask/CGameTask slots;
+/// 6 slots pass through unchanged. Slot layout by vtable byte offset:
+///
+/// ```text
+/// 0x00 WriteReplayState  0x04 Free             0x08 HandleMessage
+/// 0x0C GetEntityData     0x10-0x18 inherited   0x1C OnContactEntity
+/// 0x20 OnWormPush        0x24 OnLandBounce     0x28 OnLandSlide
+/// 0x2C OnSink            0x30 inherited        0x34 OnKilled
+/// 0x38 SetState          0x3C CheckPendingAction 0x40 IsNotOnRope
+/// 0x44 inherited         0x48 GetTeamIndex     0x4C inherited
+/// ```
+#[repr(C)]
+pub struct CTaskWormVTable {
+    /// [0] 0x0050CAA0: WriteReplayState — serializes worm state to a replay stream;
+    ///   writes entity type byte 0x12, then packs field groups based on current state
+    pub write_replay_state: unsafe extern "thiscall" fn(*mut CTaskWorm, *mut u8),
+    /// [1] 0x0050C7E0: Free — calls inner destructor, then `_free(this)` if flags & 1
+    pub free: unsafe extern "thiscall" fn(*mut CTaskWorm, u8) -> *mut CTaskWorm,
+    /// [2] 0x00510B40: HandleMessage — processes all TaskMessages sent to this worm
+    pub handle_message:
+        unsafe extern "thiscall" fn(*mut CTaskWorm, *mut CTask, u32, u32, *const u8),
+    /// [3] 0x00516780: GetEntityData — returns worm data by query code:
+    ///   0x7D0=(pos_x, pos_y), 0x7D1/0x7D2=collision test, 0x7D4=full state dump
+    pub get_entity_data: unsafe extern "thiscall" fn(*mut CTaskWorm, u32, u32, *mut u32) -> u32,
+    /// [4]-[6]: Inherited CTask stubs (not overridden by CTaskWorm)
+    pub _inherited_4_to_6: [*const (); 3],
+    /// [7] 0x0050D5D0: OnContactEntity — handles physical contact with another entity;
+    ///   worm-on-dying-worm → apply crush damage; projectile close-pass → SetState(0x80)
+    pub on_contact_entity:
+        unsafe extern "thiscall" fn(*mut CTaskWorm, *mut CGameTask, u32) -> u32,
+    /// [8] 0x0050D9A0: OnWormPush — post-contact worm-worm push impulse;
+    ///   deduplicates via a recent-collision table, then adjusts pos_x or pos_y
+    pub on_worm_push: unsafe extern "thiscall" fn(*mut CTaskWorm, *mut CGameTask, u32) -> u32,
+    /// [9] 0x0050D810: OnLandBounce — worm lands on terrain; plays thud sound, bounce physics
+    pub on_land_bounce: unsafe extern "thiscall" fn(*mut CTaskWorm),
+    /// [10] 0x0050D820: OnLandSlide — secondary landing callback; sliding/friction physics
+    pub on_land_slide: unsafe extern "thiscall" fn(*mut CTaskWorm),
+    /// [11] 0x0050D570: OnSink — worm sinks in water/acid; applies (dx, dy) displacement,
+    ///   transitions to drowning state (0x7F) unless already flying/rope/dead
+    pub on_sink: unsafe extern "thiscall" fn(*mut CTaskWorm, i32, i32) -> u32,
+    /// [12]: Inherited (vtable30 from CGameTask — not overridden)
+    pub _inherited_12: *const (),
+    /// [13] 0x0050D3B0: OnKilled — worm death; plays death sound (0x3A),
+    ///   transitions to dead state (0x81 or 0x89) based on game round count
+    pub on_killed: unsafe extern "thiscall" fn(*mut CTaskWorm),
+    /// [14] 0x0050E850: SetState — worm state machine; handles all state transitions
+    ///   (0x65=idle, 0x67=active turn, 0x7F=drowning, 0x80=hurt, 0x81/0x86=dead, …)
+    pub set_state: unsafe extern "thiscall" fn(*mut CTaskWorm, u32),
+    /// [15] 0x00516900: CheckPendingAction — if field +0xBC is set, calls SetState(0x73)
+    pub check_pending_action: unsafe extern "thiscall" fn(*mut CTaskWorm),
+    /// [16] 0x00516920: IsNotOnRope — returns true if worm state != 0x7C (rope-swinging)
+    pub is_not_on_rope: unsafe extern "thiscall" fn(*const CTaskWorm) -> bool,
+    /// [17]: Inherited (vtable44 from CGameTask — not overridden)
+    pub _inherited_17: *const (),
+    /// [18] 0x005168F0: GetTeamIndex — returns worm's team index (field +0xFC)
+    pub get_team_index: unsafe extern "thiscall" fn(*const CTaskWorm) -> u32,
+    /// [19]: Inherited (vtable4C from CGameTask — not overridden)
+    pub _inherited_19: *const (),
+}
+
+const _: () = assert!(core::mem::size_of::<CTaskWormVTable>() == 20 * 4);
+
+/// Worm entity task — the primary playable character in WA.
+///
+/// Extends CGameTask (0xFC bytes) with worm identity, physics overrides, and
+/// per-worm state. Total size: 0x3FC bytes.
+///
+/// Constructor: 0x50BFB0 (stdcall, 5 params):
+///   this, parent_task, team_index, worm_index, init_data_ptr
+///
+/// Vtable at 0x6644C8. Class type byte: 0x12.
+///
+/// # Important fields in the CGameTask base
+/// The worm state field lives at **offset +0x44** (inside `base._unknown_30`).
+/// Use [`CTaskWorm::state`] to read it without pointer arithmetic.
+///
+/// Source: Ghidra decompilation of 0x50BFB0, vtable analysis of 0x6644C8,
+///         wkJellyWorm CTaskWorm.h
+#[repr(C)]
+pub struct CTaskWorm {
+    /// 0x00–0xFB: CGameTask base (position, velocity, sound emitter, etc.)
+    pub base: CGameTask,
+
+    /// 0xFC: Team index (0-based); 3rd constructor param
+    pub team_index: u32,
+    /// 0x100: Worm index within team (0-based); 4th constructor param
+    pub worm_index: u32,
+    /// 0x104: Unknown flag (checked in OnContactEntity)
+    pub _unknown_104: u32,
+    /// 0x108–0x10F: Unknown
+    pub _unknown_108: [u8; 8],
+    /// 0x110–0x137: Ten u32s copied from spawn init_data (5th constructor param)
+    pub spawn_params: [u32; 10],
+    /// 0x138–0x14F: Unknown
+    pub _unknown_138: [u8; 0x18],
+    /// 0x150: Unknown (slot 9 in GetEntityData query 0x7D4 output)
+    pub _unknown_150: u32,
+    /// 0x154: Unknown (rope-related; cleared in some SetState transitions)
+    pub _unknown_154: u32,
+    /// 0x158: Worm pool slot index in DDGame (assigned from pool at construction)
+    pub slot_id: u32,
+    /// 0x15C–0x247: Unknown
+    pub _unknown_15c: [u8; 0xEC],
+    /// 0x248–0x25B: Aiming / weapon data (slots 4–8 in GetEntityData query 0x7D4)
+    pub _unknown_248: [u32; 5],
+    /// 0x25C–0x283: Unknown
+    pub _unknown_25c: [u8; 0x28],
+    /// 0x284–0x28B: Aiming data (slots 5–6 in GetEntityData query 0x7D4)
+    pub _unknown_284: [u32; 2],
+    /// 0x28C–0x2EF: Unknown
+    pub _unknown_28c: [u8; 0x64],
+    /// 0x2F0: Worm name, null-terminated (max 17 chars, from spawn init_data+3)
+    pub worm_name: [u8; 0x11],
+    /// 0x301: Country / team name from scheme, null-terminated (max 17 chars)
+    pub country_name: [u8; 0x11],
+    /// 0x312–0x367: Unknown (rope string, state history, etc.)
+    pub _unknown_312: [u8; 0x56],
+    /// 0x368: Animator / controller object (dispatched via vtable for state animations)
+    pub animator: *mut u8,
+    /// 0x36C–0x3FB: Unknown (rope anchor, weapon-specific data, etc.)
+    pub _unknown_36c: [u8; 0x90],
+}
+
+const _: () = assert!(core::mem::size_of::<CTaskWorm>() == 0x3FC);
+
+/// Message-subscription filter task — routes messages selectively to child tasks.
+///
+/// CTaskFilter is a CTask subclass that overrides HandleMessage to only forward
+/// messages whose type is marked in a 100-entry boolean subscription table. Each
+/// CTaskFilter instance subscribes to a specific set of message IDs at construction
+/// time; all other messages are silently dropped before reaching the subtree.
+///
+/// **Role in the task tree**: CTaskTeam creates multiple CTaskFilter children per
+/// team during construction. Each filter represents a different event-routing path
+/// (e.g., movement, UI, game-flow, weather). Messages from CTaskTurnGame propagate
+/// down through these filters, which gate access to their subtrees.
+///
+/// **Allocation size**: 0xB4 bytes (via operator new in factory functions).
+///
+/// **Constructor**: `CTaskFilter__Constructor` (0x54F3D0, thiscall):
+/// - `init_val_1c`: stored at CTask+0x1C (role unknown)
+/// - `parent_task`: parent in the task tree (determines shared_data)
+///
+/// **Key vtable methods** (vtable at 0x669DAC):
+/// - [2] `CTaskFilter__HandleMessage` (0x54F4A0): checks subscription table, forwards
+///   only if `msg_type < 100 && subscription_table[msg_type] != 0`
+/// - [7] `CTaskFilter__SubscribeAll` (0x54F390): sets all 100 entries to 1
+/// - [8] `CTaskFilter__Subscribe` (0x54F370): sets `subscription_table[msg_id] = 1`
+///
+/// **Four factory functions** (all called by `CTaskTeam__Constructor_Maybe` 0x550E70):
+/// - `FUN_00552030`: subscribes to messages 0, 1, 3, 5
+/// - `FUN_005520D0`: subscribes to messages 0, 1, 2, 3, 0x15, 0x18, 0x1C
+/// - `FUN_00552190`: subscribes to messages 0, 1, 2, 3, 5, 0x15, 0x17, 0x1C, 0x2C–0x2E, 0x4B,
+///   and optionally 0x0E (if `GameInfo+0xD778 < -1`)
+/// - `CTaskTeam__CreateWeatherFilter` (0x552960): subscribes to 1, 2, 3, 0x54, then
+///   spawns `CTaskCloud` children using randomised positions (only if `DDGame+0x777C == 0`)
+#[repr(C)]
+pub struct CTaskFilter {
+    /// 0x00–0x2F: CTask base.
+    ///
+    /// Notable base fields set by CTaskFilter__Constructor:
+    /// - CTask+0x18 (`_unknown_18`): set to 0
+    /// - CTask+0x1C (`_unknown_1c`): set to `init_val_1c` constructor param
+    /// - CTask+0x20 (`_unknown_20`): set to 7 (task type / mode constant)
+    pub base: CTask,
+    /// 0x30–0x93: Boolean subscription table, indexed by message type ID (0–99).
+    ///
+    /// `subscription_table[id] != 0` means this filter will forward messages of
+    /// that type. Cleared to 0 at construction, then populated by Subscribe/SubscribeAll
+    /// calls. Max 100 distinct message IDs (IDs >= 100 always pass through).
+    pub subscription_table: [u8; 100],
+    /// 0x94–0xB3: Unknown (present in 0xB4-byte allocation; not set by constructor).
+    pub _unknown_94: [u8; 0x20],
+}
+
+const _: () = assert!(core::mem::size_of::<CTaskFilter>() == 0xB4);
+
+impl CTaskWorm {
+    /// Returns the worm's current state code (lives at offset +0x44, inside the
+    /// CGameTask base's `_unknown_30` padding region).
+    ///
+    /// Known states: `0x65`=idle, `0x67`=active turn, `0x7F`=drowning,
+    /// `0x80`=hurt, `0x81`/`0x86`=dead, `0x87`=dead variant, `0x8B`=unknown.
+    pub fn state(&self) -> u32 {
+        // SAFETY: offset 0x44 is within CGameTask._unknown_30 (0x30..0x84).
+        // Aligned to 4 bytes; repr(C) guarantees no reordering.
+        unsafe { *((self as *const CTaskWorm as *const u8).add(0x44) as *const u32) }
+    }
+
+    /// Returns a reference to the vtable.
+    ///
+    /// # Safety
+    /// The vtable pointer at offset 0 must be the genuine CTaskWorm vtable
+    /// (0x6644C8 in Ghidra, rebased at runtime).
+    pub unsafe fn vtable(&self) -> &'static CTaskWormVTable {
+        &*(self.base.base.vtable as *const CTaskWormVTable)
+    }
+}
+
 // ============================================================
 // Derived task overlays — for accessing task-specific fields
 // beyond or within CGameTask that differ per task type.

crates/openwa-wormkit/src/validation/mod.rs

@@ -11,7 +11,7 @@ use std::sync::atomic::{AtomicU32, Ordering};
 
 use openwa_core::rebase::rb;
 use openwa_core::address::va;
-use openwa_core::task::{CTask, CGameTask};
+use openwa_core::task::{CTask, CGameTask, SharedDataTable};
 use openwa_core::ddgame::DDGame;
 use openwa_core::ddgame_wrapper::DDGameWrapper;
 
@@ -711,6 +711,215 @@ fn log_hex_dump(data: &[u8]) {
     }
 }
 
+// ---------------------------------------------------------------------------
+// Entity census — enumerate all registered task types via shared_data table
+// ---------------------------------------------------------------------------
+
+fn dump_entity_census() {
+    let _ = log_validation("");
+    let _ = log_validation("--- Entity Census (SharedData hash table) ---");
+
+    unsafe {
+        let session_ptr = read_u32(rb(va::G_GAME_SESSION));
+        if session_ptr == 0 { let _ = log_validation("  No game session — skipping."); return; }
+        let wrapper_addr = read_u32(session_ptr + 0xA0);
+        if wrapper_addr == 0 { let _ = log_validation("  No DDGameWrapper."); return; }
+        let ddgame_ptr = read_u32(wrapper_addr + 0x488);
+        if ddgame_ptr == 0 { let _ = log_validation("  No DDGame."); return; }
+
+        let task_land_ptr = read_u32(ddgame_ptr + 0x54C);
+        if task_land_ptr == 0 {
+            let _ = log_validation("  CTaskLand NULL — game not loaded yet.");
+            return;
+        }
+
+        let task_land = task_land_ptr as *const CTask;
+        let shared_data_ptr = (*task_land).shared_data;
+        if shared_data_ptr.is_null() {
+            let _ = log_validation("  shared_data is NULL.");
+            return;
+        }
+
+        let table = SharedDataTable::from_ptr(shared_data_ptr);
+
+        // Name table: Ghidra VA → display name
+        let known: &[(u32, &str)] = &[
+            (va::CTASK_WORM_VTABLE,        "CTaskWorm"),
+            (va::CTASK_LAND_VTABLE,        "CTaskLand"),
+            (va::CTASK_TURN_GAME_VTABLE,   "CTaskTurnGame"),
+            (va::CTASK_TEAM_VTABLE,        "CTaskTeam"),
+            (va::CTASK_FILTER_VTABLE,      "CTaskFilter"),
+            (va::CTASK_DIRT_VTABLE,        "CTaskDirt"),
+            (va::CTASK_SPRITE_ANIM_VTABLE, "CTaskSpriteAnim"),
+            (va::CTASK_CPU_VTABLE,         "CTaskCPU"),
+            (va::CTASK_VTABLE,             "CTask"),
+            (va::CGAMETASK_VTABLE,         "CGameTask"),
+        ];
+
+        // Collect (ghidra_va, entity_ptr) for every node.
+        let delta = rb(va::IMAGE_BASE).wrapping_sub(va::IMAGE_BASE);
+        let mut entries: Vec<(u32, u32)> = Vec::new();
+        let mut total = 0u32;
+
+        for node in table.iter() {
+            let entity = (*node).entity;
+            if entity.is_null() { continue; }
+            let vtable_runtime = read_u32(entity as u32);
+            if !is_in_rdata(vtable_runtime) { continue; }
+            let vtable_ghidra = vtable_runtime.wrapping_sub(delta);
+            entries.push((vtable_ghidra, entity as u32));
+            total += 1;
+        }
+
+        let _ = log_validation(&format!("  Total entities: {}", total));
+
+        // Group by vtable, sort by count descending.
+        let mut groups: Vec<(u32, Vec<u32>)> = Vec::new();
+        for (vt, ptr) in &entries {
+            if let Some(g) = groups.iter_mut().find(|(v, _)| *v == *vt) {
+                g.1.push(*ptr);
+            } else {
+                groups.push((*vt, vec![*ptr]));
+            }
+        }
+        groups.sort_by(|a, b| b.1.len().cmp(&a.1.len()));
+
+        for (vt_ghidra, ptrs) in &groups {
+            let name = known.iter().find(|(v, _)| *v == *vt_ghidra)
+                .map(|(_, n)| *n)
+                .unwrap_or("UNKNOWN");
+            let _ = log_validation(&format!(
+                "  {:>3}x  {:<20}  (vtable 0x{:08X})",
+                ptrs.len(), name, vt_ghidra
+            ));
+            for &ptr in ptrs.iter().take(8) {
+                use openwa_core::task::CTaskWorm;
+                if *vt_ghidra == va::CTASK_WORM_VTABLE {
+                    let w = &*(ptr as *const CTaskWorm);
+                    let nlen = w.worm_name.iter().position(|&c| c == 0).unwrap_or(w.worm_name.len());
+                    let wname = core::str::from_utf8(&w.worm_name[..nlen]).unwrap_or("?");
+                    let _ = log_validation(&format!(
+                        "       @ 0x{:08X}  team={} idx={} state=0x{:02X} name=\"{}\"",
+                        ptr, w.team_index, w.worm_index, w.state(), wname
+                    ));
+                } else {
+                    let a = read_u32(ptr + 4);
+                    let b = read_u32(ptr + 8);
+                    let c = read_u32(ptr + 12);
+                    let d = read_u32(ptr + 16);
+                    let _ = log_validation(&format!(
+                        "       @ 0x{:08X}  [+4:{:08X} +8:{:08X} +c:{:08X} +10:{:08X}]",
+                        ptr, a, b, c, d
+                    ));
+                }
+            }
+        }
+    }
+}
+
+// ---------------------------------------------------------------------------
+// CTaskWorm entity dump
+// ---------------------------------------------------------------------------
+
+fn dump_worm_tasks() {
+    use openwa_core::task::CTaskWorm;
+
+    let _ = log_validation("");
+    let _ = log_validation("--- CTaskWorm Entity Dump ---");
+
+    unsafe {
+        let session_ptr = read_u32(rb(va::G_GAME_SESSION));
+        if session_ptr == 0 { let _ = log_validation("  No game session — skipping."); return; }
+
+        let wrapper_addr = read_u32(session_ptr + 0xA0);
+        if wrapper_addr == 0 { let _ = log_validation("  No DDGameWrapper."); return; }
+
+        let ddgame_ptr = read_u32(wrapper_addr + 0x488);
+        if ddgame_ptr == 0 { let _ = log_validation("  No DDGame."); return; }
+
+        // DDGame+0x54C = CTaskLand* — always present once map is loaded.
+        let task_land_ptr = read_u32(ddgame_ptr + 0x54C);
+        if task_land_ptr == 0 {
+            let _ = log_validation("  CTaskLand is NULL — game not fully loaded yet.");
+            return;
+        }
+        let _ = log_validation(&format!("  DDGame @ 0x{:08X}", ddgame_ptr));
+        let _ = log_validation(&format!("  CTaskLand @ 0x{:08X}", task_land_ptr));
+
+        // CTask.shared_data at +0x24 — root tasks own 0x420 bytes with a
+        // 256-bucket hash table (FUN_005406a0). All tasks in the same game
+        // tree share this block via the inherited shared_data pointer.
+        let task_land = task_land_ptr as *const CTask;
+        let shared_data_ptr = (*task_land).shared_data;
+        if shared_data_ptr.is_null() {
+            let _ = log_validation("  shared_data is NULL.");
+            return;
+        }
+        let _ = log_validation(&format!("  shared_data @ 0x{:08X}", shared_data_ptr as u32));
+
+        let table = SharedDataTable::from_ptr(shared_data_ptr);
+
+        let expected_vtable = rb(va::CTASK_WORM_VTABLE) as *const u8;
+        let _ = log_validation(&format!("  Expected CTaskWorm vtable: 0x{:08X}", expected_vtable as u32));
+
+        let mut worm_count = 0u32;
+
+        for node in table.iter() {
+            let candidate = (*node).entity;
+            if candidate.is_null() { continue; }
+            // Vtable is the first pointer in the object; must be in .rdata.
+            let vtable = read_u32(candidate as u32) as *const u8;
+            if !is_in_rdata(vtable as u32) || vtable != expected_vtable { continue; }
+
+            worm_count += 1;
+            let worm = &*(candidate as *const CTaskWorm);
+
+            let state = worm.state();
+            let pos_x_f = worm.base.pos_x.0 as f32 / 65536.0;
+            let pos_y_f = worm.base.pos_y.0 as f32 / 65536.0;
+            let team_idx = worm.team_index;
+            let worm_idx = worm.worm_index;
+            let slot_id = worm.slot_id;
+
+            let name_len = worm.worm_name.iter().position(|&c| c == 0).unwrap_or(worm.worm_name.len());
+            let name = core::str::from_utf8(&worm.worm_name[..name_len]).unwrap_or("?");
+
+            let _ = log_validation(&format!(
+                "  worm#{} @ 0x{:08X}: team={} worm_idx={} slot={} state=0x{:04X} pos=({:.1},{:.1}) name=\"{}\"",
+                worm_count, candidate as u32,
+                team_idx, worm_idx, slot_id,
+                state, pos_x_f, pos_y_f, name
+            ));
+
+            // Cross-validate against WormEntry in TeamArena.
+            // WormEntry = DDGame+0x4090 + team*0x51C + worm_idx*0x9C
+            //   +0x00: state, +0x78: name (17 bytes)
+            if team_idx < 6 && worm_idx < 8 {
+                let entry_addr = ddgame_ptr + 0x4090 + team_idx * 0x51C + worm_idx * 0x9C;
+                let entry_state = read_u32(entry_addr);
+                let mut entry_name = [0u8; 17];
+                for i in 0..17usize {
+                    entry_name[i] = read_u8(entry_addr + 0x78 + i as u32);
+                    if entry_name[i] == 0 { break; }
+                }
+                let entry_name_len = entry_name.iter().position(|&c| c == 0).unwrap_or(17);
+                let entry_name_str = core::str::from_utf8(&entry_name[..entry_name_len]).unwrap_or("?");
+
+                let state_msg = if state == entry_state { "state:OK".to_string() }
+                    else { format!("state:MISMATCH(entry=0x{:04X})", entry_state) };
+                let name_msg = if name == entry_name_str { "name:OK".to_string() }
+                    else { format!("name:MISMATCH(entry=\"{}\")", entry_name_str) };
+                let _ = log_validation(&format!(
+                    "    xcheck WormEntry[{},{}] @ 0x{:08X}: {} {}",
+                    team_idx, worm_idx, entry_addr, state_msg, name_msg
+                ));
+            }
+        }
+
+        let _ = log_validation(&format!("  Total CTaskWorm entities found: {}", worm_count));
+    }
+}
+
 // ---------------------------------------------------------------------------
 // Public entry point — called from wormkit's run()
 // ---------------------------------------------------------------------------
@@ -773,6 +982,10 @@ pub fn run() -> Result<(), String> {
             std::thread::sleep(std::time::Duration::from_secs(3));
             let _ = log_validation("  Running deferred global validation...");
             deferred_global_validation();
+            let _ = log_validation("  Running entity census (5s mark)...");
+            dump_entity_census();
+            let _ = log_validation("  Running worm entity dump (5s mark)...");
+            dump_worm_tasks();
 
             // Wait briefly for replay to start, then dump game state
             // (fast-forward finishes the replay in ~10-15s total, so dump early)
@@ -827,18 +1040,18 @@ pub fn start_hotkeys() {
 
     std::thread::spawn(|| {
         use windows_sys::Win32::UI::Input::KeyboardAndMouse::GetAsyncKeyState;
-        const VK_F9: i32 = 0x78;
+        const VK_F9: i32  = 0x78;
         const VK_F10: i32 = 0x79;
-        let _ = log_validation("  Hotkey listener started (F9=team blocks, F10=landscape).");
+        const VK_F11: i32 = 0x7A;
+        const VK_F12: i32 = 0x7B;
+        let _ = log_validation("  Hotkeys: F9=team blocks, F10=landscape, F11=worm tasks, F12=entity census");
         loop {
             std::thread::sleep(std::time::Duration::from_millis(100));
             unsafe {
-                if GetAsyncKeyState(VK_F9) & 1 != 0 {
-                    dump_team_blocks();
-                }
-                if GetAsyncKeyState(VK_F10) & 1 != 0 {
-                    dump_landscape();
-                }
+                if GetAsyncKeyState(VK_F9) & 1 != 0 { dump_team_blocks(); }
+                if GetAsyncKeyState(VK_F10) & 1 != 0 { dump_landscape(); }
+                if GetAsyncKeyState(VK_F11) & 1 != 0 { dump_worm_tasks(); }
+                if GetAsyncKeyState(VK_F12) & 1 != 0 { dump_entity_census(); }
             }
         }
     });