feat: add CTaskTeamVTable and typed handle_message dispatch

Define CTaskTeamVTable (12 slots, vtable at 0x669EE4) via #[vtable] macro
with typed signatures for handle_message (slot 2), write_replay_state,
free, get_entity_data, and process_frame.

Add CTaskTeam::vtable() accessor and CTaskTeam::handle_message() method
that replaces raw vtable pointer arithmetic in weapon fire handlers.

Extract lookup_team_task() helper for SharedData CTaskTeam lookup.

Note: bind_CTaskTeamVTable! not used because CTask.vtable is *mut u8
(FieldRegistry derive doesn't support generic structs, so CTask<V>
would require manual impls across the entire task hierarchy).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

crates/openwa-core/src/task/mod.rs

@@ -23,6 +23,6 @@ pub use mine_oil_drum::{CTaskMine, CTaskOilDrum};
 pub use missile::{CTaskMissile, MissileType};
 pub use overlays::{BungeeTrailTask, WeaponAimTask};
 pub use supply_crate::CTaskCrate;
-pub use team::CTaskTeam;
+pub use team::{CTaskTeam, CTaskTeamVTable};
 pub use turn_game::{CTaskTurnGame, TurnGameCtx};
 pub use worm::{CTaskWorm, CTaskWormVTable};

crates/openwa-core/src/task/team.rs

@@ -10,6 +10,35 @@ crate::define_addresses! {
     }
 }
 
+/// CTaskTeam vtable — 12 slots. Extends CTask base (8 slots) with team-specific behavior.
+///
+/// Vtable at Ghidra 0x669EE4. Slot 2 (HandleMessage) is the main team message
+/// dispatcher (1701 instructions, handles weapon fire, surrender, worm selection, etc.)
+#[openwa_core::vtable(size = 12, va = 0x0066_9EE4, class = "CTaskTeam")]
+pub struct CTaskTeamVTable {
+    /// WriteReplayState — serializes team state to replay stream.
+    /// thiscall + 1 stack param (stream), RET 0x4.
+    #[slot(0)]
+    pub write_replay_state: fn(this: *mut CTaskTeam, stream: *mut u8),
+    /// Free — destructor. thiscall + 1 stack param (flags), RET 0x4.
+    #[slot(1)]
+    pub free: fn(this: *mut CTaskTeam, flags: u8) -> *mut CTaskTeam,
+    /// HandleMessage — processes messages sent to this team (weapon fire,
+    /// surrender, worm selection, napalm strike, etc.)
+    /// thiscall + 4 stack params, RET 0x10.
+    #[slot(2)]
+    pub handle_message: fn(this: *mut CTaskTeam, sender: *mut CTask, msg_type: u32, size: u32, data: *const u8),
+    /// GetEntityData — returns team data by query code.
+    /// thiscall + 3 stack params, RET 0xC.
+    #[slot(3)]
+    pub get_entity_data: fn(this: *mut CTaskTeam, query: u32, param: u32, out: *mut u32) -> u32,
+    // Slots 4-6: inherited CTask methods
+    /// ProcessFrame — per-frame team update.
+    /// thiscall + 1 stack param (flags), RET 0x4.
+    #[slot(7)]
+    pub process_frame: fn(this: *mut CTaskTeam, flags: u32),
+}
+
 /// Per-team state-tracker task — one instance per team, child of CTaskTurnGame.
 ///
 /// Tracks per-team data: which team number it represents, how many worms were
@@ -82,3 +111,28 @@ pub struct CTaskTeam {
 }
 
 const _: () = assert!(core::mem::size_of::<CTaskTeam>() == 0x460);
+
+impl CTaskTeam {
+    /// Get the typed vtable pointer.
+    pub fn vtable(&self) -> &CTaskTeamVTable {
+        unsafe { &*(self.base.vtable as *const CTaskTeamVTable) }
+    }
+
+    /// Call HandleMessage (vtable slot 2) on this team task.
+    ///
+    /// This is the main team message dispatcher — handles weapon fire results,
+    /// surrender, worm selection, napalm strike, and many other team-level events.
+    ///
+    /// # Safety
+    /// `sender` must be a valid CTask pointer. `data` must point to `size` bytes.
+    pub unsafe fn handle_message(
+        &mut self,
+        sender: *mut CTask,
+        msg_type: u32,
+        size: u32,
+        data: *const u8,
+    ) {
+        let vt = self.vtable();
+        (vt.handle_message)(self as *mut Self, sender, msg_type, size, data);
+    }
+}

crates/openwa-wormkit/src/replacements/weapon.rs

@@ -402,62 +402,62 @@ unsafe fn fire_weapon_special(
 
 // ── Pure Rust fire handlers (no bridge needed) ──────────────
 
+/// Look up the CTaskTeam entity for a worm via SharedData.
+///
+/// Returns null if not found.
+unsafe fn lookup_team_task(worm: *const CTaskWorm) -> *mut openwa_core::task::CTaskTeam {
+    use openwa_core::task::SharedDataTable;
+
+    let task = &(*worm).base.base;
+    let table = SharedDataTable::from_task(task);
+    // CTaskTeam is registered with key (0, 0x14) in SharedData
+    table.lookup(0, 0x14) as *mut openwa_core::task::CTaskTeam
+}
+
 /// Send a message to the worm's CTaskTeam entity via SharedData lookup.
 ///
 /// Pattern shared by Napalm Strike (msg 0x2B), Surrender (msg 0x29), etc.
-/// Looks up entity with key (0, 0x14=CTaskTeam) in worm's shared data table,
-/// then calls entity->vtable[2] (HandleMessage) with the given message type.
+/// Looks up CTaskTeam, then calls HandleMessage (vtable slot 2).
 ///
 /// The 0x40C-byte local buffer is passed as data pointer; team_index is written
-/// at buf+0x08 to identify which team fired.
+/// at buf+0x00 to identify which team fired.
 unsafe fn fire_send_team_message(worm: *mut CTaskWorm, msg_type: u32) {
-    use openwa_core::task::SharedDataTable;
-
-    let task = &(*worm).base.base; // CTask base
-    let table = SharedDataTable::from_task(task);
-
-    // Lookup CTaskTeam (key_esi=0, key_edi=0x14)
-    let team_entity = table.lookup(0, 0x14);
-    if team_entity.is_null() {
+    let team = lookup_team_task(worm);
+    if team.is_null() {
         return;
     }
 
-    // Prepare local buffer (0x40C bytes).
-    // Original: buffer[0] = worm->team_index (from worm+0xFC), rest is stack garbage.
-    // We zero-fill for safety, then set buffer[0] = team_index.
     let mut buf = [0u8; 0x40C];
     let team_index = (*worm).team_index;
     buf[0..4].copy_from_slice(&team_index.to_ne_bytes());
 
-    // Call entity->vtable[2] = HandleMessage(sender=worm, msg, size=4, data=&buf)
-    let vtable = *(team_entity as *const u32);
-    let handle_message: unsafe extern "thiscall" fn(*mut u8, *mut CTaskWorm, u32, u32, *const u8) =
-        core::mem::transmute(*(vtable as *const u32).add(2));
-    handle_message(team_entity, worm, msg_type, 4, buf.as_ptr());
+    (*team).handle_message(
+        &raw mut (*worm).base.base,
+        msg_type,
+        4,
+        buf.as_ptr(),
+    );
 }
 
 /// Select Worm (subtype 21) — pure Rust replacement for 0x51EBE0.
 ///
 /// Sends message 0x5D to CTaskTeam with buf = [8, team_index, ...].
 unsafe fn fire_select_worm(worm: *mut CTaskWorm) {
-    use openwa_core::task::SharedDataTable;
-
-    let task = &(*worm).base.base;
-    let table = SharedDataTable::from_task(task);
-    let team_entity = table.lookup(0, 0x14);
-    if team_entity.is_null() {
+    let team = lookup_team_task(worm);
+    if team.is_null() {
         return;
     }
 
     let mut buf = [0u8; 0x40C];
-    // buf[0..4] = 8 (constant), buf[4..8] = team_index
     buf[0..4].copy_from_slice(&8u32.to_ne_bytes());
     buf[4..8].copy_from_slice(&(*worm).team_index.to_ne_bytes());
 
-    let vtable = *(team_entity as *const u32);
-    let handle_message: unsafe extern "thiscall" fn(*mut u8, *mut CTaskWorm, u32, u32, *const u8) =
-        core::mem::transmute(*(vtable as *const u32).add(2));
-    handle_message(team_entity, worm, 0x5D, 0x408, buf.as_ptr());
+    (*team).handle_message(
+        &raw mut (*worm).base.base,
+        0x5D,
+        0x408,
+        buf.as_ptr(),
+    );
 }
 
 /// Skip Go (subtype 19) — pure Rust replacement for 0x51E8C0.