Summary

• replace the legacy Warden implementation with a typed WardenServer/WardenManager architecture and grouped opcode handler
• preserve the Classic wire protocol while matching retail-style pre-world module negotiation, hashing, initialization, and recurring checks
• load and atomically publish exact database-backed check profiles for 5875/enUS, 6005/enGB, and 6141/zhCN
• add strict packet budgeting, transactional result decoding, exact module custody, and fail-closed startup validation
• separate audit-only evidence from actionable incidents, require isolated confirmation, kick confirmed actionable mismatches, and retain repeated-incident escalation
• add concise lifecycle/health logging, full source headers, inline protocol comments, configuration validation, and focused security boundaries

Why

The previous implementation mixed fixed checks, transport, policy, and persistence, contained incompatible module-initialization checksums, and could not represent exact client profiles safely. This redesign follows the delivered 1.12.x module's verified behavior and keeps check policy in reviewed database rows instead of hardcoded runtime payloads.

Dependencies

• exact authenticated locale persistence: mangos/realmd#40
• World/Character/Realm structures and check catalogue: mangoszero/database#158
• Realm schema source: mangos/Realm_DB#10

Operator impact

Apply the required database updates before startup. The server now requires World 22/06/003, Character 22/05/004, and Realm 22/04/001; missing, empty, malformed, incomplete, or over-budget catalogues stop startup before player admission. Distributed configuration documents exact-profile admission and enforcement modes. mangosd ConfVersion advances to 2026081700, so older local configuration files trigger the existing stale-config warning.

Validation

• Claude Opus 5/max security/correctness review plus one focused re-review; all substantiated blocking/important findings closed
• clean RelWithDebInfo build with PlayerBots and Eluna enabled
• 130/130 Warden tests and 1/1 database-version test passed
• 10/10 selected realmd/protocol/build/Warden integration gates passed
• five malformed-catalogue startup cases failed closed before listener startup
• clean live acceptance on 5875/enUS, 6005/enGB, and 6141/zhCN
• Lua/MPQ mismatch and unavailable outcomes remained audit-only and deduplicated
• profileless Observe initialized without sending an empty check plan
• controlled check 1566 required confirmation, created one incident, kicked immediately, and did not ban at count one

This change is