feat: add sub-object hashing to snapshot system

Add hash_region_canonical() and hash_pointer_targets() to the snapshot
module. These follow every heap pointer in a struct, hash the first N
bytes of each target with pointer canonicalization, and produce
deterministic fingerprints for cross-run comparison.

Integrated into the snapshot capture() output as [SubObjectHashes].
This is the technique that found the arrow collision region desync —
sub-object content differences invisible to flat struct comparisons.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

crates/openwa-core/src/snapshot.rs

@@ -106,3 +106,65 @@ fn is_likely_pointer(val: u32, delta: u32) -> bool {
     }
     false
 }
+
+// ── Sub-object hashing ──
+
+/// CRC32 hash of a memory region with pointer values replaced by 0.
+///
+/// Uses [`is_likely_pointer`] to detect pointer-sized values and exclude them,
+/// producing a pointer-independent fingerprint. Useful for A/B comparison of
+/// objects across runs with different heap layouts.
+#[cfg(target_arch = "x86")]
+pub unsafe fn hash_region_canonical(ptr: *const u8, len: usize) -> u32 {
+    let delta = rb(va::IMAGE_BASE).wrapping_sub(va::IMAGE_BASE);
+    let mut h: u32 = 0xFFFF_FFFF;
+    for i in (0..len).step_by(4) {
+        let val = if i + 4 <= len {
+            *(ptr.add(i) as *const u32)
+        } else { 0 };
+        let hash_val = if is_likely_pointer(val, delta) { 0u32 } else { val };
+        for byte in hash_val.to_le_bytes() {
+            h ^= byte as u32;
+            for _ in 0..8 {
+                h = if h & 1 != 0 { (h >> 1) ^ 0xEDB88320 } else { h >> 1 };
+            }
+        }
+    }
+    !h
+}
+
+/// Hash all sub-objects reachable from a base struct via pointer fields.
+///
+/// Walks every DWORD in `base[0..struct_size]`. For each non-null value that
+/// looks like a heap pointer, hashes the first `target_window` bytes of the
+/// target using [`hash_region_canonical`]. Writes `[HASH] name+OFFSET hash=XX`
+/// lines to the output.
+///
+/// This is the tool that found the arrow collision region desync: sub-objects
+/// pointed to by DDGame had different non-pointer content between the Rust
+/// and original constructors, invisible to flat DDGame comparisons.
+#[cfg(target_arch = "x86")]
+pub unsafe fn hash_pointer_targets(
+    w: &mut dyn fmt::Write,
+    base: *const u8,
+    struct_size: usize,
+    target_window: usize,
+    name: &str,
+) -> fmt::Result {
+    let delta = rb(va::IMAGE_BASE).wrapping_sub(va::IMAGE_BASE);
+
+    for off in (0..struct_size).step_by(4) {
+        let val = *(base.add(off) as *const u32);
+        if val == 0 { continue; }
+        if !is_likely_pointer(val, delta) { continue; }
+        // Skip WA code/data pointers — only follow heap pointers
+        let ghidra = val.wrapping_sub(delta);
+        if ghidra >= va::TEXT_START && ghidra < va::DATA_END { continue; }
+        // Verify target is readable
+        if !mem::can_read(val, target_window as u32) { continue; }
+
+        let h = hash_region_canonical(val as *const u8, target_window);
+        writeln!(w, "[HASH] {}+0x{:04X} hash={:08X}", name, off, h)?;
+    }
+    Ok(())
+}

crates/openwa-wormkit/src/snapshot.rs

@@ -8,7 +8,7 @@ use core::fmt::Write;
 use openwa_core::address::va;
 use openwa_core::engine::GameSession;
 use openwa_core::rebase::rb;
-use openwa_core::snapshot::{write_raw_region, Snapshot};
+use openwa_core::snapshot::{hash_pointer_targets, write_raw_region, Snapshot};
 use openwa_core::task::{CTask, CTaskBfsIter, CTaskMissile, CTaskWorm};
 
 /// Capture a full game state snapshot as text.
@@ -43,6 +43,18 @@ pub unsafe fn capture() -> String {
     let _ = (*ddgame).write_snapshot(&mut out, 1);
     let _ = writeln!(out);
 
+    // ── Sub-object hashes (pointer-independent) ──
+    // Hashes the first 256 bytes of every heap object pointed to by DDGame
+    // and PCLandscape. Differences here indicate sub-object state mismatches
+    // that flat DDGame comparisons miss.
+    let _ = writeln!(out, "[SubObjectHashes]");
+    let _ = hash_pointer_targets(&mut out, ddgame as *const u8, 0x550, 256, "ddgame");
+    let landscape = (*ddgame).landscape as *const u8;
+    if !landscape.is_null() {
+        let _ = hash_pointer_targets(&mut out, landscape, 0xB44, 256, "landscape");
+    }
+    let _ = writeln!(out);
+
     // ── Team blocks + worm entries ──
     let team_count = (*ddgame).team_arena.team_count as usize;
     let _ = writeln!(out, "[Teams] count={}", team_count);