docs: update CLAUDE.md for typed vtable infrastructure

Document new patterns from this session:
- Generic CTask<V: Vtable> and CGameTask<V> for typed vtable pointers
- Task trait with ddgame(), as_task_ptr(), broadcast_message()
- read_volatile requirement in broadcast_message (LLVM caching bug)
- Vtable method hooking via vtable_replace! and replacements/task/
- bind macro dotted field path support (base.vtable)
- Decompiler calling convention warning
- CTaskMissile constructor exception (thiscall, not stdcall)
- New key files: task/base.rs, team_arena.rs, ddgame_constructor.rs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -150,9 +150,11 @@ All addresses in `address.rs` are Ghidra VAs. Always use `rb()` to convert to ru
 
 ## Calling Convention Rules
 
-These are critical — wrong conventions cause stack corruption and crashes:
+These are critical — wrong conventions cause stack corruption and crashes.
 
-- **Constructors are `__stdcall`**, NOT `__thiscall`. `this` is passed on stack, not ECX.
+**The Ghidra decompiler is UNTRUSTWORTHY for calling conventions.** It frequently misidentifies stdcall/thiscall/usercall. Always verify via disassembly: check the `RET imm16` instruction AND the caller's register setup at the call site.
+
+- **Constructors are usually `__stdcall`** — `this` passed on stack, not ECX. **Exception**: CTaskMissile constructor (0x507D10) is `__thiscall` (ECX=this, 3 stack params, RET 0xC). Always verify by checking the call site's register setup.
 - **VTable methods are `__thiscall`**: ECX = this, remaining params on stack.
 - **Always check `RET imm16`** in disassembly to verify stack parameter count. The immediate value = bytes of params cleaned by callee (stdcall/thiscall). `RET 0x10` = 16 bytes = 4 params.
 - **MSVC `__usercall`**: Some functions pass implicit params in registers (e.g., FrontendChangeScreen uses ESI for dialog pointer). These need `#[unsafe(naked)]` trampolines.
@@ -166,6 +168,8 @@ Hooks use the `minhook` crate. Two patterns:
 
 For `__usercall` functions, use a naked trampoline to capture register params before calling the Rust impl.
 
+3. **Vtable method replacement**: Use `vtable_replace!` to patch vtable slots at runtime. Write the replacement as `unsafe extern "thiscall" fn`. For base-class call-through, either save the original via `[ORIG_STATIC]` syntax, or call `broadcast_message()` for CTask::HandleMessage. See `replacements/task/cloud.rs`.
+
 ## Desync Debugging
 
 Replay desyncs (checksum mismatches) can be caused by any code difference — constructor side effects, hooked function behaviour, missing state, wrong calling conventions, etc. Key methodology:
@@ -196,7 +200,11 @@ Currently dormant — no hooks wired up. Activate by adding calls in `game_sessi
 - `crates/openwa-core/src/wa_call.rs` — Helpers for calling WA functions (thiscall, stdcall wrappers)
 - `crates/openwa-core/src/rebase.rs` — ASLR delta computation
 - `crates/openwa-core/src/wa/` — Typed WA function wrappers (MFC, frontend, registry, DDGame)
+- `crates/openwa-core/src/task/base.rs` — CTask<V>, CTaskVtable, Task trait, SharedDataTable, broadcast_message
+- `crates/openwa-core/src/engine/team_arena.rs` — TeamArenaState, WormEntry, TeamHeader, TeamArenaRef
+- `crates/openwa-core/src/engine/ddgame_constructor.rs` — DDGame constructor (create_ddgame, init_graphics_and_resources)
 - `crates/openwa-wormkit/src/replacements/` — Function replacements (one file per subsystem)
+- `crates/openwa-wormkit/src/replacements/task/` — Vtable method replacements (cloud, filter, ...)
 - `docs/re-notes/` — Reverse engineering documentation (task hierarchy, memory map, frontend screens)
 - `docs/plans/` — Design docs and implementation plans
 
@@ -312,8 +320,11 @@ vtable_replace!(DSSoundVtable, va::DS_SOUND_VTABLE, {
 - Unknown struct fields as `_unknown_XX` padding arrays
 - Fixed-point: `Fixed(i32)` newtype, 16.16 format (0x10000 = 1.0)
 - Naked asm uses `naked_asm!` (Rust 1.79+ syntax), not `asm!`
-- **Typed vtable structs via `#[vtable(...)]`**: Use the attribute macro to define vtable structs with `fn(this: *mut T, ...)` shorthand and `#[slot(N)]` for sparse layouts. The macro handles `unsafe extern "thiscall"`, gap-filling, registry metadata, and generates `bind_!` calling wrappers. See the `#[vtable(...)]` section above.
-- **`bind_XxxVtable!`**: Generated by `#[vtable(...)]`, creates `&mut self` method wrappers on the class struct. Callers write `(*obj).method(args)`.
+- **Generic CTask<V> for typed vtables**: `CTask<V: Vtable = *const c_void>` and `CGameTask<V: Vtable = *const c_void>` take a vtable pointer type parameter. Subclasses specify their typed vtable: `CTaskTeam { base: CTask<*const CTaskTeamVTable> }`. The `Vtable` marker trait is auto-implemented by the `#[vtable]` macro. `FieldRegistry` derive supports generics by substituting type params with their defaults for `offset_of`/`size_of`.
+- **`Task` trait**: Provides `task()`, `ddgame()`, `as_task_ptr()`, `as_task_ptr_mut()`, and `broadcast_message()` on all CTask subclasses. Eliminates `.base.base` chains. Implemented for all task types in `task/mod.rs`.
+- **`broadcast_message()`**: Pure Rust port of CTask::HandleMessage (0x562F30). Iterates the sparse children array and calls each child's vtable[2]. Uses `read_volatile` for `children_watermark` and `children_data` — **required** because LLVM caches these reads across virtual dispatch calls even through `*mut`.
+- **Typed vtable structs via `#[vtable(...)]`**: Use the attribute macro to define vtable structs with `fn(this: *mut T, ...)` shorthand and `#[slot(N)]` for sparse layouts. The macro handles `unsafe extern "thiscall"`, gap-filling, registry metadata, generates `bind_!` calling wrappers, and implements the `Vtable` marker trait. See the `#[vtable(...)]` section above.
+- **`bind_XxxVtable!`**: Generated by `#[vtable(...)]`, creates `&mut self` method wrappers on the class struct. Supports dotted field paths for inherited vtables: `bind_CTaskTeamVTable!(CTaskTeam, base.vtable)`.
 - **`vcall!` macro**: Still available for raw-pointer vtable dispatch without bind wrappers. Expands to `((*(*obj).vtable).method)(obj, args...)`.
 
 ## FFI Style