refactor: rename CGameTask._unknown_30 to subclass_data, fix CTaskWorm weapon_ctx

Rename the polymorphic 84-byte region at CGameTask+0x30 to
subclass_data with documentation of per-subclass usage.

CTaskWorm+0x36C (weapon_ctx) is NOT a self-pointer — runtime logging
confirmed weapon_ctx != worm (differ by ~0x20000). It points to a
separate weapon context object with fire state at +0x30..+0x3C.
Renamed from weapon_self_ptr to weapon_ctx: *mut u8.

Removed incorrect CTaskWorm weapon fire accessors that read from
subclass_data (wrong object). Weapon state must be read from the
weapon_ctx pointer, as done in the working FireWeapon impl.

Verified: headless PASS (byte-identical), headful 133+3 / 0 FAIL.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

crates/openwa-core/src/task/worm.rs

@@ -151,9 +151,11 @@ pub struct CTaskWorm {
     pub _unknown_338: [u8; 0x368 - 0x338],
     /// 0x368: Animator / controller object (dispatched via vtable for state animations)
     pub animator: *mut u8,
-    /// 0x36C: Self-pointer (points to this CTaskWorm). Used by WeaponRelease
-    /// to load EAX before calling FireWeapon: `MOV EAX, [EDI+0x36C]`.
-    pub weapon_self_ptr: *mut CTaskWorm,
+    /// 0x36C: Weapon context pointer. Points to a separate object containing
+    /// weapon fire state (type at +0x30, subtypes at +0x34/+0x38, params at +0x3C).
+    /// NOT a self-pointer — weapon_ctx != worm (confirmed via runtime logging).
+    /// Used by WeaponRelease: `MOV EAX, [EDI+0x36C]` before calling FireWeapon.
+    pub weapon_ctx: *mut u8,
     /// 0x370–0x3DB: Unknown (rope anchor, weapon-specific data, etc.)
     pub _unknown_370: [u8; 0x3DC - 0x370],
     /// 0x3DC: Facing direction. -1 = facing left, +1 = facing right.
@@ -184,49 +186,13 @@ impl CTaskWorm {
         unsafe { *((self as *const CTaskWorm as *const u8).add(0x44) as *const u32) }
     }
 
-    // ── Weapon fire state accessors (offsets +0x30..+0x3C in subclass_data) ──
-
-    /// Weapon fire type (1=projectile, 2=rope, 3=grenade, 4=special).
-    /// Offset +0x30 in CGameTask.subclass_data.
-    pub fn weapon_fire_type(&self) -> i32 {
-        unsafe { *(self.base.subclass_data.as_ptr().add(0) as *const i32) }
-    }
-
-    /// Weapon fire subtype for types 3 and 4. Offset +0x34.
-    pub fn weapon_fire_subtype_34(&self) -> i32 {
-        unsafe { *(self.base.subclass_data.as_ptr().add(4) as *const i32) }
-    }
-
-    /// Weapon fire subtype for types 1 and 2. Offset +0x38.
-    pub fn weapon_fire_subtype_38(&self) -> i32 {
-        unsafe { *(self.base.subclass_data.as_ptr().add(8) as *const i32) }
-    }
-
-    /// Weapon fire completion flag. Offset +0x3C.
-    /// Set to 0 before dispatch, 1 after.
-    pub fn weapon_fire_complete(&self) -> i32 {
-        unsafe { *(self.base.subclass_data.as_ptr().add(12) as *const i32) }
-    }
-
-    /// Mutable pointer to weapon_fire_complete for setting the flag.
-    pub fn weapon_fire_complete_mut(&mut self) -> &mut i32 {
-        unsafe { &mut *(self.base.subclass_data.as_mut_ptr().add(12) as *mut i32) }
-    }
-
-    /// Address of weapon_fire_complete field (passed as params base to fire handlers).
-    pub fn weapon_params_ptr(&self) -> u32 {
-        self as *const _ as u32 + 0x3C
-    }
-
-    /// Address of weapon_fire_subtype_34 field (params for GrenadeMortar).
-    pub fn weapon_params_34_ptr(&self) -> u32 {
-        self as *const _ as u32 + 0x34
-    }
-
-    /// Address of weapon_fire_subtype_38 field (params for type-4 specials).
-    pub fn weapon_params_38_ptr(&self) -> u32 {
-        self as *const _ as u32 + 0x38
-    }
+    // Weapon fire state lives in the WEAPON CONTEXT object (at CTaskWorm+0x36C),
+    // NOT in CTaskWorm itself. The weapon_ctx is a separate allocation with:
+    //   +0x30: weapon_fire_type (1=projectile, 2=rope, 3=grenade, 4=special)
+    //   +0x34: weapon_fire_subtype_34 (for types 3/4)
+    //   +0x38: weapon_fire_subtype_38 (for types 1/2)
+    //   +0x3C: weapon_fire_complete (0 before, 1 after dispatch)
+    // Accessed via raw pointers in the FireWeapon hook (weapon.rs).
 
     /// Returns a reference to the vtable.
     ///

crates/openwa-wormkit/src/replacements/weapon.rs

@@ -179,38 +179,28 @@ unsafe extern "C" fn trampoline_fire_weapon() {
 }
 
 /// Rust implementation of FireWeapon dispatch.
-/// EAX = worm self-pointer (== stack param), ECX = local_struct from WeaponRelease.
-unsafe extern "cdecl" fn fire_weapon_impl(worm_eax: u32, local_struct: u32, worm: u32) {
-    use openwa_core::rebase::rb;
-
-    // EAX (worm_eax) = *(CTaskWorm+0x36C), stack param (worm) = CTaskWorm*.
-    // Check if they're actually the same — they might not be!
-    if worm_eax != worm {
-        let _ = log_line(&format!(
-            "[Weapon] WARNING: EAX={:#x} != worm={:#x} (delta={})",
-            worm_eax, worm, worm_eax.wrapping_sub(worm) as i32
-        ));
-    }
-
-    // Use worm_eax (original EAX) for field reads — this is what the original code uses
-    let ctx = worm_eax as *const u8;
+unsafe extern "cdecl" fn fire_weapon_impl(weapon_ctx: u32, local_struct: u32, worm: u32) {
+    let ctx = weapon_ctx as *const u8;
     let weapon_type = *(ctx.add(0x30) as *const i32);
     let subtype_34 = *(ctx.add(0x34) as *const i32);
     let subtype_38 = *(ctx.add(0x38) as *const i32);
-    let params = worm_eax.wrapping_add(0x3C);
+    let params = weapon_ctx.wrapping_add(0x3C);
+    let worm_ptr = worm as *mut u8;
 
     // Log weapon fire
-    let weapon_id = *((worm as *const u8).add(0x170) as *const u32);
+    let weapon_id = *(worm_ptr.add(0x170) as *const u32);
     let weapon_name = Weapon::try_from(weapon_id)
-        .map(|wp| format!("{:?}", wp))
+        .map(|w| format!("{:?}", w))
         .unwrap_or_else(|id| format!("Unknown({})", id));
     let _ = log_line(&format!(
         "[Weapon] FireWeapon: {} (id={}) type={} sub34={} sub38={}",
         weapon_name, weapon_id, weapon_type, subtype_34, subtype_38
     ));
 
-    // Clear completion flag before dispatch
-    core::ptr::write_volatile((worm + 0x3C) as *mut i32, 0);
+    // worm+0x3C = completion flag
+    *(worm_ptr.add(0x3C) as *mut i32) = 0;
+
+    use openwa_core::rebase::rb;
 
     match weapon_type {
         1 => match subtype_38 {
@@ -226,13 +216,18 @@ unsafe extern "cdecl" fn fire_weapon_impl(worm_eax: u32, local_struct: u32, worm
             3 => call_fire_stdcall3(worm, params, local_struct, rb(0x51E240)),      // RopeType3
             _ => {}
         },
-        3 => call_fire_stdcall3(worm, worm_eax.wrapping_add(0x34), local_struct, rb(0x51E2C0)),
-        4 => fire_weapon_special(subtype_34, worm_eax.wrapping_add(0x38), worm, local_struct),
+        3 => {
+            let params_34 = weapon_ctx.wrapping_add(0x34);
+            call_fire_stdcall3(worm, params_34, local_struct, rb(0x51E2C0));        // GrenadeMortar
+        }
+        4 => {
+            let params_38 = weapon_ctx.wrapping_add(0x38);
+            fire_weapon_special(subtype_34, params_38, worm, local_struct);
+        }
         _ => {}
     }
 
-    // Set completion flag after dispatch
-    core::ptr::write_volatile((worm + 0x3C) as *mut i32, 1);
+    *(worm_ptr.add(0x3C) as *mut i32) = 1;
 }
 
 // ── Sub-function bridges ────────────────────────────────────