fix(types): correct CTask struct layout from Ghidra decompilation

Expanded opaque padding into named fields based on cross-referencing
Ghidra decompilation of CTask::Constructor (0x5625A0) and its helper
(0x562520) with wkJellyWorm CTask.h. Key findings:
- 3rd constructor param is DDGame pointer (stored at 0x2C), not class_type
- Children list fields (0x08-0x18) now individually named
- shared_data (0x24) and owns_shared_data (0x28) identified
- 82/82 static validation checks pass (up from 78)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

crates/openwa-harness/src/lib.rs

@@ -551,8 +551,8 @@ mod tests {
             eprintln!("  Security cookie initialized");
         }
 
-        // CTask::Constructor is __stdcall: (this, parent, class_type) -> this
-        type CTaskCtorFn = unsafe extern "stdcall" fn(this: *mut u8, parent: u32, class_type: u32) -> *mut u8;
+        // CTask::Constructor is __stdcall: (this, parent, ddgame) -> this
+        type CTaskCtorFn = unsafe extern "stdcall" fn(this: *mut u8, parent: u32, ddgame: u32) -> *mut u8;
 
         unsafe {
             let ctor: CTaskCtorFn = img.func_ptr(va::CTASK_CONSTRUCTOR);
@@ -576,9 +576,9 @@ mod tests {
                 va::CTASK_VTABLE
             );
 
-            // Verify class_type at offset 0x2C
-            let stored_class = *((task_ptr as usize + 0x2C) as *const u32);
-            assert_eq!(stored_class, 0, "class_type should be 0");
+            // Verify ddgame pointer at offset 0x2C (3rd ctor param, we passed 0)
+            let stored_ddgame = *((task_ptr as usize + 0x2C) as *const u32);
+            assert_eq!(stored_ddgame, 0, "ddgame should be 0 (we passed 0)");
 
             // Verify field at 0x08 is 0x10
             let field_08 = *((task_ptr as usize + 0x08) as *const u32);
@@ -591,7 +591,7 @@ mod tests {
             eprintln!("CTask::Constructor succeeded!");
             eprintln!("  vtable = 0x{vtable_ghidra:08X}");
             eprintln!("  children = 0x{children:08X}");
-            eprintln!("  class_type = {stored_class}");
+            eprintln!("  ddgame = {stored_ddgame}");
         }
     }
 }

crates/openwa-types/src/task.rs

@@ -9,9 +9,7 @@ pub type Ptr32 = u32;
 /// All game objects inherit from CTask. Tasks form a tree via parent/children
 /// pointers and communicate through the TaskMessage system.
 ///
-/// PARTIAL: Many fields between known offsets are unknown.
-///
-/// Source: wkJellyWorm CTask.h
+/// Source: wkJellyWorm CTask.h, Ghidra decompilation of 0x5625A0 + 0x562520
 ///
 /// Vtable at 0x669F8C (8 methods):
 ///   0x00: 0x562710 vtable0 (init?)
@@ -28,15 +26,28 @@ pub struct CTask {
     pub vtable: Ptr32,
     /// 0x04: Parent task in the hierarchy
     pub parent: Ptr32,
-    /// 0x08: Unknown (set to 0x10 in constructor — possibly capacity/flags)
-    pub _unknown_08: u32,
-    /// 0x0C-0x1F: Children task list (CList<CTask*>)
-    /// Internal structure: max_size(4), unk4(4), size(4), data_ptr(4), hash_list(4)
-    pub _children_raw: [u8; 20],
-    /// 0x20: Task classification type
+    /// 0x08: Children list max capacity (set to 0x10 in constructor)
+    pub children_max_size: u32,
+    /// 0x0C: Children list unknown field (set to 0 in constructor)
+    pub children_unk: u32,
+    /// 0x10: Children list current size
+    pub children_size: u32,
+    /// 0x14: Pointer to children data array (allocated 0x60 bytes in constructor)
+    pub children_data: Ptr32,
+    /// 0x18: Children hash list pointer (set to 0 in constructor)
+    pub children_hash: Ptr32,
+    /// 0x1C: Unknown (set to 0 by parent-linking helper FUN_00562520)
+    pub _unknown_1c: u32,
+    /// 0x20: Task classification type (set to ClassType::Task by FUN_00562520,
+    /// overridden by derived constructors)
     pub class_type: ClassType,
-    /// 0x24-0x2F: Unknown padding to 0x30
-    pub _unknown_24: [u8; 12],
+    /// 0x24: Shared data buffer pointer (inherited from parent, or allocated
+    /// 0x420 bytes for root tasks)
+    pub shared_data: Ptr32,
+    /// 0x28: 1 if this task owns shared_data (root), 0 if inherited from parent
+    pub owns_shared_data: u32,
+    /// 0x2C: DDGame pointer (3rd param to CTask::Constructor, stored at this+0x2C)
+    pub ddgame: Ptr32,
 }
 
 const _: () = assert!(core::mem::size_of::<CTask>() == 0x30);

crates/openwa-validator/src/hooks/detour.rs

@@ -57,14 +57,15 @@ unsafe extern "stdcall" fn hook_frontend_change_screen(screen_id: u32) {
 static ORIG_CTASK_CONSTRUCTOR: AtomicU32 = AtomicU32::new(0);
 
 /// Hook for CTask::Constructor (0x5625A0).
-/// stdcall(this, parent, class_type) -> this
-unsafe extern "stdcall" fn hook_ctask_constructor(this: u32, parent: u32, class_type: u32) -> u32 {
+/// stdcall(this, parent, ddgame) -> this
+/// 3rd param is the DDGame pointer, stored at this+0x2C.
+unsafe extern "stdcall" fn hook_ctask_constructor(this: u32, parent: u32, ddgame: u32) -> u32 {
     let orig: unsafe extern "stdcall" fn(u32, u32, u32) -> u32 =
         core::mem::transmute(ORIG_CTASK_CONSTRUCTOR.load(Ordering::Relaxed));
-    let result = orig(this, parent, class_type);
+    let result = orig(this, parent, ddgame);
     // Log after calling original (so vtable is set)
     let _ = log_line(&format!(
-        "[HOOK] CTask::ctor(this=0x{this:08X}, parent=0x{parent:08X}, type={class_type}) -> 0x{result:08X}"
+        "[HOOK] CTask::ctor(this=0x{this:08X}, parent=0x{parent:08X}, ddgame=0x{ddgame:08X}) -> 0x{result:08X}"
     ));
     result
 }

crates/openwa-validator/src/lib.rs

@@ -324,8 +324,12 @@ fn validate_struct_offsets(result: &mut ValidationResult) {
     let _ = log_line("  CTask:");
     check_offset!(result, CTask, vtable, 0x00);
     check_offset!(result, CTask, parent, 0x04);
-    check_offset!(result, CTask, _unknown_08, 0x08);
+    check_offset!(result, CTask, children_max_size, 0x08);
+    check_offset!(result, CTask, children_data, 0x14);
     check_offset!(result, CTask, class_type, 0x20);
+    check_offset!(result, CTask, shared_data, 0x24);
+    check_offset!(result, CTask, owns_shared_data, 0x28);
+    check_offset!(result, CTask, ddgame, 0x2C);
 
     // CGameTask offsets
     let _ = log_line("");