feat: identify weapon_ctx as WeaponEntry pointer, add fire fields

Runtime investigation confirmed CTaskWorm+0x36C points to the active
WeaponEntry in the WeaponTable (entry index matches selected_weapon).

Add newly discovered WeaponEntry fields:
- fire_type (+0x30): weapon dispatch type (1-4)
- fire_subtype_34 (+0x34): subtype for types 3/4
- fire_subtype_38 (+0x38): subtype for types 1/2
- fire_complete (+0x3C): completion flag / params base

Type CTaskWorm.active_weapon_entry as *mut WeaponEntry.
Remove incorrect CTaskWorm weapon accessors (they read from the worm's
subclass_data instead of the WeaponEntry).

Verified: headless PASS (byte-identical).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

crates/openwa-core/src/game/weapon.rs

@@ -126,8 +126,20 @@ pub struct WeaponEntry {
     pub availability: i32,
     /// +0x28: Enabled flag (init: 1).
     pub enabled: i32,
-    /// +0x2C-0x1CF: Unknown fields.
-    pub _unknown_2c: [u8; 0x1D0 - 0x2C],
+    /// +0x2C-0x2F: Unknown.
+    pub _unknown_2c: [u8; 4],
+    /// +0x30: Weapon fire type (1=projectile, 2=rope, 3=grenade, 4=special).
+    /// Read by FireWeapon to dispatch to the correct handler.
+    pub fire_type: i32,
+    /// +0x34: Fire subtype for weapon types 3 (grenade/mortar) and 4 (special).
+    pub fire_subtype_34: i32,
+    /// +0x38: Fire subtype for weapon types 1 (projectile) and 2 (rope).
+    pub fire_subtype_38: i32,
+    /// +0x3C: Fire completion flag / params base.
+    /// Set to 0 before dispatch, 1 after. Address also passed to fire handlers.
+    pub fire_complete: i32,
+    /// +0x40-0x1CF: Unknown fields.
+    pub _unknown_40: [u8; 0x1D0 - 0x40],
 }
 const _: () = assert!(core::mem::size_of::<WeaponEntry>() == 0x1D0);
 

crates/openwa-core/src/task/worm.rs

@@ -1,5 +1,6 @@
 use super::base::CTask;
 use super::game_task::CGameTask;
+use crate::game::weapon::WeaponEntry;
 
 /// Virtual method table for CTaskWorm (vtable at 0x6644C8, 20 slots).
 ///
@@ -151,11 +152,10 @@ pub struct CTaskWorm {
     pub _unknown_338: [u8; 0x368 - 0x338],
     /// 0x368: Animator / controller object (dispatched via vtable for state animations)
     pub animator: *mut u8,
-    /// 0x36C: Weapon context pointer. Points to a separate object containing
-    /// weapon fire state (type at +0x30, subtypes at +0x34/+0x38, params at +0x3C).
-    /// NOT a self-pointer — weapon_ctx != worm (confirmed via runtime logging).
+    /// 0x36C: Active weapon entry pointer. Points to `&WeaponTable.entries[selected_weapon]`.
+    /// Contains fire type (+0x30), subtypes (+0x34/+0x38), and completion flag (+0x3C).
     /// Used by WeaponRelease: `MOV EAX, [EDI+0x36C]` before calling FireWeapon.
-    pub weapon_ctx: *mut u8,
+    pub active_weapon_entry: *mut WeaponEntry,
     /// 0x370–0x3DB: Unknown (rope anchor, weapon-specific data, etc.)
     pub _unknown_370: [u8; 0x3DC - 0x370],
     /// 0x3DC: Facing direction. -1 = facing left, +1 = facing right.
@@ -186,13 +186,9 @@ impl CTaskWorm {
         unsafe { *((self as *const CTaskWorm as *const u8).add(0x44) as *const u32) }
     }
 
-    // Weapon fire state lives in the WEAPON CONTEXT object (at CTaskWorm+0x36C),
-    // NOT in CTaskWorm itself. The weapon_ctx is a separate allocation with:
-    //   +0x30: weapon_fire_type (1=projectile, 2=rope, 3=grenade, 4=special)
-    //   +0x34: weapon_fire_subtype_34 (for types 3/4)
-    //   +0x38: weapon_fire_subtype_38 (for types 1/2)
-    //   +0x3C: weapon_fire_complete (0 before, 1 after dispatch)
-    // Accessed via raw pointers in the FireWeapon hook (weapon.rs).
+    // Weapon fire state lives in the WeaponEntry pointed to by active_weapon_entry
+    // (+0x36C), NOT in CTaskWorm itself. See WeaponEntry fields: fire_type (+0x30),
+    // fire_subtype_34 (+0x34), fire_subtype_38 (+0x38), fire_complete (+0x3C).
 
     /// Returns a reference to the vtable.
     ///

crates/openwa-wormkit/src/replacements/weapon.rs

@@ -187,6 +187,9 @@ unsafe extern "cdecl" fn fire_weapon_impl(weapon_ctx: u32, local_struct: u32, wo
     let params = weapon_ctx.wrapping_add(0x3C);
     let worm_ptr = worm as *mut u8;
 
+    // weapon_ctx = pointer to WeaponEntry in WeaponTable (confirmed via runtime logging).
+    // CTaskWorm+0x36C stores &WeaponTable.entries[selected_weapon].
+
     // Log weapon fire
     let weapon_id = *(worm_ptr.add(0x170) as *const u32);
     let weapon_name = Weapon::try_from(weapon_id)