# MapleWeb v83 feature matrix

Status values follow `docs/BLUEPRINT.md`: `catalogued`, `parsed`, `state-applied`, `rendered`, `interactive`, `fixture-tested`, `live-tested`, `browser-tested`, `verified`, or `blocked`.

Statuses below include evidence accumulated in this workspace; remaining rows
retain their baseline classification until their closure gate is exercised.

| Domain | Baseline client evidence | Baseline status | Required closure evidence |
|---|---|---|---|
| Boot/game loop/WebGL/audio | Journey initialization, renderer, audio and 800×600 canvas exist | catalogued | Clean WASM build; cold/warm browser boot; audio unlock; context loss/retry |
| NX loading/cache | LazyFS WebSocket + IndexedDB implementation exists | catalogued | 16-file manifest; bounds/corruption/quota/LRU tests; memory budget |
| Registration | Two-field same-origin UI/API and in-game Register bridge implemented | browser-tested | Secure disposable-DB API test plus browser and in-game entry flow |
| Password login | Bounded result parser and complete recovery handling implemented | live-tested | Success/failure/ban/already-online fixtures and live WSS test |
| TOS/gender | Explicit consent and account-gender state machine implemented | live-tested | Standard state-machine fixtures and live first-login test |
| PIN/PIC | PIN is server-configurable and disabled publicly; PIC plus enabled-PIN registration, retry, cancellation, and selection are implemented | live-tested | PIN-disabled public login plus enabled-flow create/verify/bypass/error/reconnect tests; no hardcoded value |
| World/channel list | Bounded world/channel flow and live Cosmic selection implemented | live-tested | Recommended/full/offline/re-request/change-channel/browser tests |
| Character list/create/delete/select | Bounded list/create/delete/select flows and live Beginner creation implemented | live-tested | All jobs/genders/looks, validation, birthday/PIC, delete/retry fixtures |
| View-all/name/world transfer/relog | Relog request/response and fresh-login transition implemented; transfer flows remain | live-tested | All applicable v83/Cosmic flows and cooldown/error tests |
| Set-field/full character state | Bounded envelope/tail and authoritative channel stats implemented; atomic body DTO remains | parsed | Full body consumption fixtures for every optional section; authoritative state assertions |
| Maps/backgrounds/tiles/footholds | Core rendering exists | catalogued | Representative map corpus, link/fallback, layer/order, load/reload tests |
| Movement/portals/ladders/swim/ice | Mostly present; ice TODO | catalogued | Local/remote/invalid movement, portal, channel/map, terrain tests |
| Remote character presence | Strict full Cosmic spawn/remove envelopes; visible buff variants, look, embedded pets, mount, shop/minigame, chalkboard, rings, New Year tail, same-ID replacement, and queued removal/map-clear handling | fixture-tested | Two-client live/browser enter/leave/re-enter, full appearance corpus, shop/minigame/ring/chalkboard rendering, malformed disconnect policy |
| Field effects/objects/obstacles/UI locks | Strict obstacle single/list/reset envelopes and NX object-name targeting implemented; modes 0/1 applied and raw mode 2 retained; other field effects/UI locks remain partial/no-op | state-applied | Prove mode-2 reverse/toggle animation, atomic snapshots, named-object corpus, UI locks, and live scripted CWKPQ/trap scenarios |
| Character stats/AP/SP/fame | Core stats/AP/SP exist; broader flows partial | catalogued | Stat caps, multi-SP jobs, fame, level/job advancement persistence |
| Inventory/equipment/use | Core move/use/gather/sort exists | catalogued | All inventory types, full/invalid/stack/expiry/cash/reconnect cases |
| Scrolling/skill books/hammer/Vega | Scrolling partial; others absent | catalogued | Success/fail/protection/slot/stat/economy transaction tests |
| Melee/ranged/magic combat | Basic attacks exist | catalogued | All weapon/skill/hit/critical/miss/death/revive and multi-client broadcasts |
| Skills/passives/buffs/debuffs/cooldowns | Narrow whitelists/subsets | catalogued | Every Explorer/Cygnus/Aran v83 skill and status fixture/live scenario |
| Mist/affected areas | Strict 39-byte spawn and four-byte removal envelopes; keyed queued lifecycle; authoritative removal; mob/player NX tile rendering | fixture-tested | Representative v83 NX corpus plus player/mob live and browser spawn/replace/remove/map-change scenarios |
| Summons/doors/dragons | Door lifecycle/use and all six inbound summon envelopes are strict; field and town directions use server-authored owner/party coordinates; NX-backed summon states, authoritative movement, damage numbers, queued ordering, and removal/clear safety are applied; exact C2S movement/attack/damage serializers exist, but local-owner AI/targeting does not yet drive them; Cosmic dragons are dormant v84 Evan leftovers | fixture-tested | Wire serializers into local summon movement/target/attack/damage control, owner reconnect, representative NX/browser/live summon and two-map party-door scenarios; dragon envelope coverage without claiming a v83 Evan runtime |
| Mobs/controllers/status/HP | Strict spawn/control/kill/status/cancel/damage/HP envelopes; masks retained, external damage rendered, real Cosmic controller spawn consumed | fixture-tested | Individual status/reflect/immunity visuals and behavior, healing visuals, boss/death/respawn/reconnect/browser tests |
| Drops/reactors/pickup | Strict spawn/ownership/removal/pet/explosion and reactor spawn/hit/destroy envelopes; delayed removal and NX state animation applied | fixture-tested | Ownership/party/FFA/expiry/pickup rejection, multi-client/live/browser and representative NX reactor corpus tests |
| Pets/mounts/autopot | Strict pet summon/dismiss/move/chat/name/exception/command envelopes; full-width IDs, authoritative movement, chat bubble, rename, and exception replacement applied; command IDs retained; mount/autopot remain partial/no-op | fixture-tested | NX command-action mapping, feed/loot/equip/autopot/mount fatigue/expire and two-client live/browser tests |
| NPC field lifecycle/script metadata | Strict ordinary/controller/remove/scriptable envelopes; queued removal, controller ownership, OID replacement, minimap visibility, movement bounds, and login-scoped script metadata retained | live-tested | Script/quest-marker consumer, NPC action/movement/speech sync, PlayerNPC appearance (`0x51`), remove/reuse/map-change/browser scenarios |
| NPC dialogue | Core dialog exists | catalogued | All dialog types/tokens/scroll/cancel/race/script progression fixtures |
| NPC shops | Core shop UI exists | catalogued | Buy/sell/recharge/quantity/currency/full-inventory/retry tests |
| Storage | Core UI exists | catalogued | Item/meso/deposit/withdraw/slot/full/disconnect transaction tests |
| Quests/log/progress/expiry | Data parsing only/partial | catalogued | UI and all start/complete/forfeit/scripted/update/expiry paths |
| General/whisper/multi/spouse chat | General/multi/spouse portions exist; whisper UI incomplete | catalogued | Filters, commands, offline/error, multi-client delivery and UI tests |
| Party/search/HP | Basic party exists | catalogued | Create/invite/join/deny/leave/expel/leader/search/map/HP/disconnect tests |
| Buddy | Inbound list is a no-op | catalogued | Add/accept/delete/capacity/offline/channel-change multi-client tests |
| Guild/BBS/alliance | Guild inbound is a no-op; broader UIs absent | catalogued | Full membership/rank/emblem/BBS/alliance lifecycle tests |
| Family | Inbound packets are no-ops | catalogued | Tree/invite/rep/privilege/cooldown/disconnect tests |
| Messenger/memo | Missing/no-op | catalogued | Invite/join/leave/chat/memo/read/delete/offline tests |
| Marriage/wedding/rings | Missing/partial data | catalogued | Engagement/reservation/ceremony/ring/chat/divorce persistence tests |
| Player trade | Status button inert; system absent | catalogued | Offer/confirm/cancel/full/retry/disconnect/atomicity multi-client tests |
| Duey/delivery | Absent | catalogued | Send/fee/receive/expiry/full-inventory/retry tests |
| Player shop/hired merchant/Owl | Absent | catalogued | Open/list/buy/withdraw/search/close/disconnect/atomicity tests |
| Cash Shop/coupons/gifts | Status button inert; system absent | catalogued | Enter/leave/inventory/purchase/gift/coupon/wishlist/error/persistence tests |
| MTS/name/world transfer | Absent/partial login packets | catalogued | Listing/search/buy/transfer/cooldown/name conflict/restart tests |
| Maker/crafting | Absent | catalogued | Recipe/material/stimulant/gem/fee/success/fail/inventory tests |
| Monster Book/Teleport Rock | Parsed storage fragments; no complete UI/actions | catalogued | UI, add/cover/set bonus, save/warp/restriction/persistence tests |
| Minigames/Carnival/PQs/expeditions/Dojo | Missing; some set-field bodies TODO | catalogued | Each canonical/Cosmic feature scenario with multi-client fixtures |
| Events/field scripts | Partial field effects; multiple no-ops | catalogued | Clock, effects, obstacles, scripted transitions, reconnect tests |
| GM/admin | Hide response exists; wider operations absent | catalogued | Only supported v83 admin packets, permissions, visibility and audit tests |
| UI windows/status-bar actions | Core inventory/stats/skills/maps; many buttons inert | catalogued | Every visible action functional, cancellable, keyboard/mouse tested |
| Settings/keymap/fullscreen/audio | Keymap/fullscreen/audio foundations exist | catalogued | Persistence, conflict, resize/focus/audio and reload browser tests |
| Touch/mobile/accessibility | Not implemented | catalogued | Scope decision; if required, controls/labels/focus/contrast/touch tests |
| Packet framing/crypto | v83 crypto exists; fragmentation/length risks found | catalogued | Golden vectors, split/coalesced frames, max length, fuzz/property tests |
| WSS bridge security | Baseline is an open arbitrary TCP proxy | blocked | Origin/allowlist/limit/timeout/abuse/load/reconnect suite |
| Web security/base path | Development server exposes repo/root-relative URLs | blocked | Root-path and `/mapleweb/` prefix, CSP/isolation/MIME/range/dotfile/cache automated tests |
| Account/database security | No registration adapter | blocked | Least-privilege credentials, bcrypt compatibility, rate limit, CSRF and audit tests |
| Build/reproducibility/SBOM | Local toolchain missing; CI build only | blocked | Pinned clean builds, checksums, SBOM and zero warnings |
| Backup/restore/rollback | Not implemented | catalogued | Timed backup, clean restore, state check and atomic rollback rehearsal |
| Production deployment/monitoring | Docker host port 80 is free; public IP is a NAT edge and trusted TLS is not yet provisioned | catalogued | Isolated Docker edge, NAT/firewall proof, trusted HTTPS/WSS, full Stage 9 smoke, synthetic checks, alerts, backup and rollback |

## Packet-level inventory

The generated packet inventory will live under `docs/generated/` and is the fine-grained companion to this domain matrix. It must compare:

- `src/client/Net/OutPacket.h`;
- `src/client/Net/PacketSwitch.cpp`;
- `docs/ms-network-protocol.md`;
- pinned Cosmic receive/send opcode declarations and handler registrations.

Each packet row must record direction, numeric opcode, expected state, parser/packet class, UI/state consumer, fixture, live scenario, and status.
