{
  "inputs": {
    "protocol_sha256": "0f973969a5f68319b37270205adb9f1c53e329ac1ba0e821eb7933b5f7322661",
    "save_formats_sha256": "4e9d5791ec735745c0b0ba4852eb900e46f29670dff1786894abc15827cf37ee"
  },
  "rows": [
    {
      "disposition": "in-phase-7",
      "feature": "account-create",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0392-users_load.gml",
        "extracted/server-5-4/scripts/0367-users_restore.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [
        "localList.txt#username",
        "User_DBUpdated.bnu#username"
      ],
      "reason": "Original appends to localList.txt; rebuild creates accounts row with argon2id hash. Phase 7 adds CAPTCHA + email verification.",
      "subsystem": "account-auth"
    },
    {
      "disposition": "in-phase-7",
      "feature": "account-recovery-email",
      "modernized_replacement": "POST /admin/account-recover {targetAccountId, action: 'reset-password-email'|'unlock', reason}",
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0392-users_load.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [
        "localList.txt#username"
      ],
      "reason": "FEATURES.md differentiator: email-based password reset. NEW (no original equivalent — admin used Old Account Updater binaries). Modernized as account-recover web-UI endpoint.",
      "subsystem": "account-auth"
    },
    {
      "disposition": "in-phase-7",
      "feature": "account-settings",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0386-load_settings.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [
        "MSettings.bno#playername"
      ],
      "reason": "FEATURES.md differentiator: per-user keybinds, audio, accessibility. Mostly client-only; server validates a small allowlist (display-name, mute-list).",
      "subsystem": "account-auth"
    },
    {
      "disposition": "rejected-with-reason",
      "feature": "admin-ctrl-9-clipboard-snippets",
      "modernized_replacement": "POST /admin/kick { targetAccountId, reason, durationSec? } (and `mute`)",
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0364-scontrolmenu.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [],
      "reason": "Ctrl+9 pops snippet menu that auto-fills clipboard for Ctrl+E execution. Composes with Ctrl+E into fully-templated RCE — *worse* than raw Ctrl+E because new operators don't realise snippets execute with full game-state authority. CLAUDE.md hard rule #3.",
      "subsystem": "admin"
    },
    {
      "disposition": "rejected-with-reason",
      "feature": "admin-ctrl-e-clipboard-rce",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0008-ChtCmdRec.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [],
      "reason": "Ctrl+E runs operator clipboard contents as GML in server process. RCE-as-feature — clipboard is a shared OS resource (browser autocomplete, password manager, virus all write to it → admin). No equivalent exists; surface deleted entirely. CLAUDE.md hard rule #3.",
      "subsystem": "admin"
    },
    {
      "disposition": "rejected-with-reason",
      "feature": "admin-ctrl-m-mb-view",
      "modernized_replacement": "POST /admin/mb-moderate { boardId, action: 'view'|'delete-topic'|'delete-reply'|'pin'|'unpin'|'lock'|'unlock', ... }",
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0008-ChtCmdRec.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [],
      "reason": "Ctrl+M views any message board by number with no UI filtering. Mild content-bypass risk; modernized as typed mb-moderate admin endpoint with structured operations.",
      "subsystem": "admin"
    },
    {
      "disposition": "rejected-with-reason",
      "feature": "admin-ctrl-q-clipboard-kick",
      "modernized_replacement": "POST /admin/view-audit-log { sinceMinutes?, actorAccountId?, eventTypes?, limit? } + POST /admin/kick",
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0008-ChtCmdRec.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [],
      "reason": "Ctrl+Q exposes server internals via clipboard-style GML eval. Modernized as typed view-audit-log + kick admin endpoints. CLAUDE.md hard rule #3.",
      "subsystem": "admin"
    },
    {
      "disposition": "rejected-with-reason",
      "feature": "admin-ctrl-question-target-rce",
      "modernized_replacement": "POST /admin/assign-role { targetAccountId, role } + POST /admin/ban { targetAccountId, reason, permanent, durationDays? }",
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0008-ChtCmdRec.gml"
      ],
      "originating_opcodes": [
        12
      ],
      "originating_save_fields": [],
      "reason": "Sends operator clipboard GML to highlighted player to be executed on THEIR client. Doubly rejected: client-side RCE inflicted by server. Worst single feature of original system. Wire path (opcode 12) deleted; modernized as typed assign-role + ban intents. CLAUDE.md hard rule #3.",
      "subsystem": "admin"
    },
    {
      "disposition": "rejected-with-reason",
      "feature": "admin-hexport-anim",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0364-scontrolmenu.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [],
      "reason": "Operator self-animation via execute_string-stored GML snippet (HexportOut/HexportIn). Cosmetic-bypass not in v1 scope; uses execute_string mechanism that is rejected wholesale. Drop entirely.",
      "subsystem": "admin"
    },
    {
      "disposition": "rejected-with-reason",
      "feature": "admin-old-account-updater-binary",
      "modernized_replacement": "POST /admin/account-recover { targetAccountId, action: 'reset-password-email'|'unlock'|'merge-duplicate'|'force-reauth', reason }",
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0392-users_load.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [
        "localList.txt#username"
      ],
      "reason": "Legacy `Old Account Updater.exe` / `Account Updater.exe` sibling binaries — no source GML present in open-source release; original behaviour unrecoverable. Modernized as account-recover web-UI endpoint per Phase 7 PAR-07.",
      "subsystem": "admin"
    },
    {
      "disposition": "rejected-with-reason",
      "feature": "admin-stash-location-snippet",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0364-scontrolmenu.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [],
      "reason": "Operator self-teleport via Ctrl+A storing GML in global.helpmsg + Ctrl+Alt+A execute_string. Mechanism is the entire RCE surface. Rebuild offers admin-self-teleport as a UI form behind admin auth (not a typed wire intent).",
      "subsystem": "admin"
    },
    {
      "disposition": "in-phase-7",
      "feature": "area-broadcast",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0359-server_receive.gml"
      ],
      "originating_opcodes": [
        16
      ],
      "originating_save_fields": [],
      "reason": "Original opcode 16 broadcasts area state to clients. Phase 7 reconstructs as typed `area-state` event.",
      "subsystem": "room-management"
    },
    {
      "disposition": "in-phase-7",
      "feature": "area-scoping",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0117-change_area.gml",
        "extracted/server-5-4/objects/0109-ac_centralsquare",
        "extracted/server-5-4/objects/0110-ac_naturegrounds",
        "extracted/server-5-4/objects/0111-ac_whirlpool"
      ],
      "originating_opcodes": [
        16
      ],
      "originating_save_fields": [
        "UserData/Areas/Areas_<uid>.bnu#area-flags"
      ],
      "reason": "Logical chat-channel grouping (rooms partitioned into named regions). Phase 6 ships per-room scope; Phase 7 layers per-area on top of room.",
      "subsystem": "room-management"
    },
    {
      "disposition": "in-phase-7",
      "feature": "chat-history-buffer",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0001-addline.gml",
        "extracted/server-5-4/scripts/0093-dynamicaddline.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [],
      "reason": "FEATURES.md differentiator: rolling N-line per-room buffer broadcast on room-enter so mid-conversation joiners see context. Original has 30-line operator-screen scrollback only.",
      "subsystem": "chat"
    },
    {
      "disposition": "in-phase-7",
      "feature": "chat-moderation",
      "modernized_replacement": "POST /admin/mb-moderate { boardId, action, ... }",
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0008-ChtCmdRec.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [],
      "reason": "FEATURES.md differentiator: profanity wordlist + report queue + admin-mute. NEW (original has no moderation surface; admin used Ctrl+9 clipboard snippets).",
      "subsystem": "chat"
    },
    {
      "disposition": "in-phase-6",
      "feature": "chat-public",
      "modernized_replacement": null,
      "mvp": true,
      "originating_gml": [
        "extracted/server-5-4/scripts/0359-server_receive.gml:164",
        "extracted/server-5-4/scripts/0359-server_receive.gml:603",
        "extracted/server-5-4/scripts/0106-caddline.gml"
      ],
      "originating_opcodes": [
        4
      ],
      "originating_save_fields": [],
      "reason": "CLI-08 MVP slice: area-scoped public chat broadcast. Server tags sender from socket auth (PITFALLS B1).",
      "subsystem": "chat"
    },
    {
      "disposition": "deferred-stage-8",
      "feature": "chat-scrollback-operator",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0001-addline.gml",
        "extracted/server-5-4/scripts/0093-dynamicaddline.gml",
        "extracted/server-5-4/scripts/0006-scroll.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [],
      "reason": "30-line server-operator-screen rolling scrollback (`global.cline[i]`). Rebuild surfaces equivalent in admin web UI as live event log; deferred unless operator workflow audit demands it.",
      "subsystem": "admin"
    },
    {
      "disposition": "rejected-with-reason",
      "feature": "client-supplied-chat-origin",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0359-server_receive.gml:164"
      ],
      "originating_opcodes": [
        4
      ],
      "originating_save_fields": [],
      "reason": "Original prepends username from server-tracked global.p_name[pid] but trusts the chat-line payload exactly as sent. Server tags every chat line with senderId from socket auth in rebuild — payload sender field is ignored. PITFALLS B1.",
      "subsystem": "chat"
    },
    {
      "disposition": "rejected-with-reason",
      "feature": "client-trusted-pid",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0360-init_user.gml:36"
      ],
      "originating_opcodes": [
        6
      ],
      "originating_save_fields": [],
      "reason": "Original assigns numeric pid via opcode 6 broadcast. Rebuild uses session cookies tied to argon2id-verified accounts; pid is server-internal only. PITFALLS B1.",
      "subsystem": "client-server-bridge"
    },
    {
      "disposition": "rejected-with-reason",
      "feature": "client-trusted-position",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0359-server_receive.gml:588"
      ],
      "originating_opcodes": [
        3
      ],
      "originating_save_fields": [],
      "reason": "Original accepts client-supplied x/y verbatim and broadcasts. Rebuild server validates delta_t * max_speed + tile collision per intent before broadcast; client never authoritative for position. PITFALLS B1.",
      "subsystem": "world-simulation"
    },
    {
      "disposition": "rejected-with-reason",
      "feature": "client-trusted-sprite-index",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0359-server_receive.gml:575"
      ],
      "originating_opcodes": [
        2
      ],
      "originating_save_fields": [],
      "reason": "Original accepts client-supplied sprite index verbatim — could spoof animations / state. Server tracks intent (move-direction, action) only; sprite resolution is client-local in rebuild. PITFALLS B1.",
      "subsystem": "world-simulation"
    },
    {
      "disposition": "deferred-stage-8",
      "feature": "cmd-clear-scrollback",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0008-ChtCmdRec.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [],
      "reason": "Operator-screen-only `clear screen` command. Operator UI lives in web UI in rebuild — N/A as a wire intent.",
      "subsystem": "admin"
    },
    {
      "disposition": "in-phase-7",
      "feature": "cmd-clientver",
      "modernized_replacement": "POST /admin/set-min-client-version { version }",
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0008-ChtCmdRec.gml",
        "extracted/server-5-4/scripts/0387-save_settings.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [
        "MSettings.bno#clientversion"
      ],
      "reason": "Operator command to bump minimum required client version. Modernized as typed admin-UI endpoint.",
      "subsystem": "admin"
    },
    {
      "disposition": "rejected-with-reason",
      "feature": "cmd-end-session-broadcast",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0008-ChtCmdRec.gml"
      ],
      "originating_opcodes": [
        12
      ],
      "originating_save_fields": [],
      "reason": "Backtick `end session` broadcasts opcode 12 with payload `show_message(...); global.online = 0; game_restart();` to every client. Mechanism (broadcasting executable GML) is the RCE surface. Rebuild emits typed `server-restart-warning` event instead; opcode 12 wire path permanently removed.",
      "subsystem": "admin"
    },
    {
      "disposition": "deferred-stage-8",
      "feature": "cmd-goto-ocs",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0008-ChtCmdRec.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [],
      "reason": "Operator self-teleport to Online_Command_Screen. Irrelevant when admin lives in separate web UI; deferred unless a need surfaces.",
      "subsystem": "admin"
    },
    {
      "disposition": "deferred-stage-8",
      "feature": "cmd-help-text",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0008-ChtCmdRec.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [],
      "reason": "`command` prints operator help text. Deferred — admin help is a typed UI surface, not a chat command.",
      "subsystem": "admin"
    },
    {
      "disposition": "in-phase-7",
      "feature": "cmd-maintmode-toggle",
      "modernized_replacement": "POST /admin/maintenance-mode { enabled, reason }",
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0008-ChtCmdRec.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [
        "MSettings.bno#maintmode"
      ],
      "reason": "Operator toggles `global.maintmode`. Modernized as typed admin endpoint.",
      "subsystem": "admin"
    },
    {
      "disposition": "rejected-with-reason",
      "feature": "cmd-run-shell-out",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0008-ChtCmdRec.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [],
      "reason": "Backtick `` `run take-a-break.exe `` calls datafile_export + execute_program. RCE-as-feature; rebuild has no shell-out surface. CLAUDE.md hard rule #3.",
      "subsystem": "admin"
    },
    {
      "disposition": "in-phase-7",
      "feature": "cmd-servermsg",
      "modernized_replacement": "POST /admin/set-motd { motd }",
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0008-ChtCmdRec.gml",
        "extracted/server-5-4/scripts/0387-save_settings.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [
        "MSettings.bno#servermessage"
      ],
      "reason": "Operator sets MOTD broadcast on login. Modernized as typed admin endpoint.",
      "subsystem": "admin"
    },
    {
      "disposition": "deferred-stage-8",
      "feature": "dabypass-flag",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0359-server_receive.gml"
      ],
      "originating_opcodes": [
        1
      ],
      "originating_save_fields": [],
      "reason": "Per-account `dabypass` flag set when entering room 49 (Whirlpool_Promenade) — Disconnected Alley access gate. Niche; restore if Phase 7 PAR enumerates rooms requiring it.",
      "subsystem": "world-simulation"
    },
    {
      "disposition": "in-phase-7",
      "feature": "duo-relay-system",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0359-server_receive.gml"
      ],
      "originating_opcodes": [
        15,
        22,
        23
      ],
      "originating_save_fields": [],
      "reason": "Two-player interaction relay (trade/duel?). Opcodes 15/22/23 wire it. Phase 7 reconstructs after observing legacy server traffic; specific feature shape TBD.",
      "subsystem": "client-server-bridge"
    },
    {
      "disposition": "in-phase-7",
      "feature": "friends-list",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0359-server_receive.gml"
      ],
      "originating_opcodes": [
        9
      ],
      "originating_save_fields": [],
      "reason": "FEATURES.md differentiator: persistent symmetric friend graph + presence push. NEW (original has online-list opcode 9 only).",
      "subsystem": "world-simulation"
    },
    {
      "disposition": "in-phase-6",
      "feature": "heartbeat",
      "modernized_replacement": null,
      "mvp": true,
      "originating_gml": [
        "extracted/server-5-4/scripts/0349-operations.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [],
      "reason": "CLI-08 MVP slice: keepalive ping. Original BNO has no opcode-level heartbeat — relies on TCP RST and 30 fps step polling. Phase 4 SRV adds explicit ws ping/pong with reconnect grace window.",
      "subsystem": "client-server-bridge"
    },
    {
      "disposition": "in-phase-7",
      "feature": "ignore-list",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0359-server_receive.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [],
      "reason": "FEATURES.md differentiator: per-user blocks(blocker, blocked) for chat/whisper/visibility. NEW.",
      "subsystem": "chat"
    },
    {
      "disposition": "deferred-stage-8",
      "feature": "legacy-alt-login-exemption",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0392-users_load.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [
        "localList.txt#username"
      ],
      "reason": "Hardcoded alt-login exemptions for `Saber Mage` / `Vance Serori` (legacy operator accounts). Deferred per RESEARCH disposition rules; not in Phase 7 unless impact surfaces.",
      "subsystem": "account-auth"
    },
    {
      "disposition": "deferred-stage-8",
      "feature": "legacy-superweird-import",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0367-users_restore.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [
        "User_DBUpdated.bnu#username"
      ],
      "reason": "Phase 1 informational A7 — if enlyzeam-current contains Superweird files, run import. Deferred until Phase 1 confirms A7 enumeration.",
      "subsystem": "account-auth"
    },
    {
      "disposition": "in-phase-7",
      "feature": "legacy-userlist-import",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0367-users_restore.gml",
        "extracted/server-5-4/scripts/0392-users_load.gml",
        "extracted/server-5-4/scripts/0379-users_restore_old.gml",
        "extracted/server-5-4/scripts/0391-users_load_old.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [
        "localList.txt#username",
        "User_DBUpdated.bnu#username"
      ],
      "reason": "Phase 4 SRV-09/10/11 read-once-then-purge migration. Plaintext rows land in legacy_credentials_staging; first login re-hashes via argon2id and deletes staging row in same tx (CLAUDE.md hard rule #2).",
      "subsystem": "account-auth"
    },
    {
      "disposition": "in-phase-6",
      "feature": "login",
      "modernized_replacement": null,
      "mvp": true,
      "originating_gml": [
        "extracted/server-5-4/scripts/0359-server_receive.gml:523",
        "extracted/server-5-4/scripts/0392-users_load.gml",
        "extracted/server-5-4/scripts/0360-init_user.gml"
      ],
      "originating_opcodes": [
        0
      ],
      "originating_save_fields": [
        "localList.txt#username",
        "User_DBUpdated.bnu#username"
      ],
      "reason": "CLI-08 MVP slice: username + password auth via argon2id. Migrated accounts re-hashed on first successful auth (see legacy-userlist-import).",
      "subsystem": "account-auth"
    },
    {
      "disposition": "in-phase-6",
      "feature": "login-response",
      "modernized_replacement": null,
      "mvp": true,
      "originating_gml": [
        "extracted/server-5-4/scripts/0359-server_receive.gml"
      ],
      "originating_opcodes": [
        8
      ],
      "originating_save_fields": [],
      "reason": "CLI-08 MVP slice: server emits ok/reason after credential validation.",
      "subsystem": "account-auth"
    },
    {
      "disposition": "in-phase-7",
      "feature": "logout",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0359-server_receive.gml:541",
        "extracted/server-5-4/scripts/0349-operations.gml",
        "extracted/server-5-4/scripts/0362-uninit_user.gml"
      ],
      "originating_opcodes": [
        5
      ],
      "originating_save_fields": [],
      "reason": "Original detects logout by socket EOF (no dedicated opcode); broadcast-logoff opcode 5 propagates. Phase 7 adds graceful logout intent + reconnect grace window.",
      "subsystem": "account-auth"
    },
    {
      "disposition": "in-phase-7",
      "feature": "mb-list-boards",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0359-server_receive.gml",
        "extracted/server-5-4/scripts/0366-mb_restore.gml"
      ],
      "originating_opcodes": [
        13
      ],
      "originating_save_fields": [
        "MB_Log.bnb#mb_board"
      ],
      "reason": "Server emits opcode 13 listing every board in MB_Log.bnb. Phase 7 PAR ships full message-board surface.",
      "subsystem": "message-board"
    },
    {
      "disposition": "in-phase-7",
      "feature": "mb-list-replies",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0359-server_receive.gml"
      ],
      "originating_opcodes": [
        14
      ],
      "originating_save_fields": [
        "MB_Log.bnb#mb_reply"
      ],
      "reason": "Server emits opcode 14 listing replies for a topic.",
      "subsystem": "message-board"
    },
    {
      "disposition": "in-phase-7",
      "feature": "mb-log-persistence",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0365-mb_backup.gml",
        "extracted/server-5-4/scripts/0366-mb_restore.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [
        "MB_Log.bnb#mb_board",
        "MB_Log.bnb#mb_topic",
        "MB_Log.bnb#mb_reply"
      ],
      "reason": "Original rewrites entire MB_Log.bnb on every change (full file rewrite). Rebuild uses per-row SQLite tx + WAL replication via Litestream.",
      "subsystem": "persistence"
    },
    {
      "disposition": "in-phase-7",
      "feature": "mb-newmsg-flags",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0359-server_receive.gml"
      ],
      "originating_opcodes": [
        19
      ],
      "originating_save_fields": [
        "UserData/MB_News/News_<uid>.bnu#read-flag"
      ],
      "reason": "Per-user unread-flag broadcast. Persisted in News_<uid>.bnu.",
      "subsystem": "message-board"
    },
    {
      "disposition": "in-phase-7",
      "feature": "mb-post-reply",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0365-mb_backup.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [
        "MB_Log.bnb#mb_reply"
      ],
      "reason": "c2s opcode for reply post is absent from current protocol.json (s2c-only enumeration). Phase 7 reverses from MB_Log writer call sites.",
      "subsystem": "message-board"
    },
    {
      "disposition": "in-phase-7",
      "feature": "mb-post-topic",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0365-mb_backup.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [
        "MB_Log.bnb#mb_topic"
      ],
      "reason": "c2s opcode for topic create is absent from current protocol.json (s2c-only enumeration). Phase 7 reverses from MB_Log writer call sites.",
      "subsystem": "message-board"
    },
    {
      "disposition": "in-phase-7",
      "feature": "mb-summary",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0359-server_receive.gml"
      ],
      "originating_opcodes": [
        18
      ],
      "originating_save_fields": [
        "MB_Log.bnb#mb_topic"
      ],
      "reason": "Server emits opcode 18 with topic summary (title + reply count + flag).",
      "subsystem": "message-board"
    },
    {
      "disposition": "in-phase-6",
      "feature": "movement",
      "modernized_replacement": null,
      "mvp": true,
      "originating_gml": [
        "extracted/server-5-4/scripts/0359-server_receive.gml:588"
      ],
      "originating_opcodes": [
        3
      ],
      "originating_save_fields": [],
      "reason": "CLI-08 MVP slice: server broadcasts authoritative x/y/dir per player. Phase 4 server validates delta_t * max_speed + collision per intent (PITFALLS B1).",
      "subsystem": "world-simulation"
    },
    {
      "disposition": "in-phase-7",
      "feature": "online-list",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0359-server_receive.gml"
      ],
      "originating_opcodes": [
        9
      ],
      "originating_save_fields": [],
      "reason": "Server emits opcode 9 with full per-player snapshot. Phase 7 supersedes via Colyseus state replication; legacy clients can still receive on parity wire.",
      "subsystem": "world-simulation"
    },
    {
      "disposition": "rejected-with-reason",
      "feature": "opcode-12-mod-execute",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0359-server_receive.gml",
        "extracted/server-5-4/scripts/0008-ChtCmdRec.gml"
      ],
      "originating_opcodes": [
        12
      ],
      "originating_save_fields": [],
      "reason": "Wire path for broadcasting executable GML strings to clients (`mod-execute` payload). Worst single feature of original system. Permanently removed from rebuild wire — typed events only. CLAUDE.md hard rule #3.",
      "subsystem": "packet-protocol"
    },
    {
      "disposition": "in-phase-7",
      "feature": "pid-assignment",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0360-init_user.gml:36",
        "extracted/server-5-4/scripts/0363-reinit_userr.gml:19"
      ],
      "originating_opcodes": [
        6,
        7
      ],
      "originating_save_fields": [],
      "reason": "Original assigns numeric pid + UDP port via opcodes 6/7. Rebuild uses Colyseus session-id; pid no longer wire-visible. Parity opcode preserved for legacy clients in Phase 7.",
      "subsystem": "client-server-bridge"
    },
    {
      "disposition": "rejected-with-reason",
      "feature": "plaintext-passwords-canonical",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0392-users_load.gml",
        "extracted/server-5-4/scripts/0367-users_restore.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [
        "localList.txt#password",
        "User_DBUpdated.bnu#password"
      ],
      "reason": "Original stores passwords plaintext in localList.txt and User_DBUpdated.bnu (parallel arrays global.u_pwd[i]). CLAUDE.md hard rule #2: argon2id from packet 1. Plaintext appears only transiently in legacy_credentials_staging during one-shot migration; production accounts table never holds plaintext.",
      "subsystem": "account-auth"
    },
    {
      "disposition": "in-phase-7",
      "feature": "player-nameplate",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0359-server_receive.gml:523"
      ],
      "originating_opcodes": [
        0
      ],
      "originating_save_fields": [],
      "reason": "FEATURES.md MVP-critical-but-deferrable: render username above sprite. Server publishes account-name; rendering is client-side. Phase 6 may carry informally.",
      "subsystem": "world-simulation"
    },
    {
      "disposition": "in-phase-7",
      "feature": "reconnect-grace-window",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0349-operations.gml",
        "extracted/server-5-4/scripts/0362-uninit_user.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [],
      "reason": "FEATURES.md MVP-critical: keep player state in memory N seconds (e.g., 60s) after socket close; reconnect within window resumes session. NEW (original is hard disconnect on EOF).",
      "subsystem": "world-simulation"
    },
    {
      "disposition": "in-phase-6",
      "feature": "room-join",
      "modernized_replacement": null,
      "mvp": true,
      "originating_gml": [
        "extracted/server-5-4/scripts/0359-server_receive.gml:533",
        "extracted/server-5-4/objects/0123-roomchangeob"
      ],
      "originating_opcodes": [
        1
      ],
      "originating_save_fields": [],
      "reason": "CLI-08 MVP slice: client requests room change; server is authoritative for p_room. Server validates target room id is reachable.",
      "subsystem": "room-management"
    },
    {
      "disposition": "in-phase-6",
      "feature": "room-leave",
      "modernized_replacement": null,
      "mvp": true,
      "originating_gml": [
        "extracted/server-5-4/scripts/0359-server_receive.gml:541",
        "extracted/server-5-4/scripts/0349-operations.gml",
        "extracted/server-5-4/scripts/0362-uninit_user.gml"
      ],
      "originating_opcodes": [
        1,
        5
      ],
      "originating_save_fields": [],
      "reason": "CLI-08 MVP slice: client departs room (paired w/ room-join opcode 1) OR socket disconnect (broadcast-logoff opcode 5). Server emits leave broadcast to remaining occupants.",
      "subsystem": "room-management"
    },
    {
      "disposition": "in-phase-7",
      "feature": "room-snapshot",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0359-server_receive.gml"
      ],
      "originating_opcodes": [
        11
      ],
      "originating_save_fields": [],
      "reason": "Server emits opcode 11 listing every other player in destination room after room-join. Colyseus state replication subsumes for new client; preserved for legacy parity.",
      "subsystem": "client-server-bridge"
    },
    {
      "disposition": "rejected-with-reason",
      "feature": "scheduled-save-cadence",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0349-operations.gml",
        "extracted/server-5-4/scripts/0389-all_backup.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [],
      "reason": "Original couples saves to 30s alarm (`p_sendalarm = 900` at 30 fps). Crash-loss surface = 30s typical / 90s worst. Rebuild uses per-event SQLite tx + WAL replication via Litestream; crash-loss drops to ~1s. CONCERNS.md crash-loss requirement.",
      "subsystem": "persistence"
    },
    {
      "disposition": "in-phase-7",
      "feature": "server-settings-persistence",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0386-load_settings.gml",
        "extracted/server-5-4/scripts/0387-save_settings.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [
        "MSettings.bno#servermessage",
        "MSettings.bno#clientversion",
        "MSettings.bno#alphaon",
        "MSettings.bno#playername"
      ],
      "reason": "Server-wide settings (MOTD, min client version, alpha-on flag, server playername). Migrate MSettings.bno → settings table.",
      "subsystem": "persistence"
    },
    {
      "disposition": "in-phase-7",
      "feature": "tick-loop",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0349-operations.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [],
      "reason": "Original couples sim tick to GameMaker step event (~30 Hz). Phase 4 SRV-05 adds explicit fixed-tick simulation step (Colyseus 50ms / 20 Hz) decoupled from network read loop.",
      "subsystem": "world-simulation"
    },
    {
      "disposition": "in-phase-7",
      "feature": "tilemap-collision",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0085-place_meeting.gml",
        "extracted/server-5-4/scripts/0086-instance_create.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [],
      "reason": "Server-authoritative wall/tile collision. Phase 6 ships room-bounds clamp only; Phase 7 adds full tile-grid collision (PITFALLS B1).",
      "subsystem": "world-simulation"
    },
    {
      "disposition": "deferred-stage-8",
      "feature": "unknown-opcode-24",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0359-server_receive.gml"
      ],
      "originating_opcodes": [
        24
      ],
      "originating_save_fields": [],
      "reason": "Empty-payload s2c opcode; semantics not yet recovered (see docs/extracted-server/unknown-actions-status.md). Deferred until reverse-engineering yields intent.",
      "subsystem": "packet-protocol"
    },
    {
      "disposition": "deferred-stage-8",
      "feature": "unknown-opcode-26",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0359-server_receive.gml"
      ],
      "originating_opcodes": [
        26
      ],
      "originating_save_fields": [],
      "reason": "Empty-payload s2c opcode; semantics not yet recovered. Deferred until reverse-engineering yields intent.",
      "subsystem": "packet-protocol"
    },
    {
      "disposition": "in-phase-7",
      "feature": "user-area-persistence",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0368-uarea_restore.gml",
        "extracted/server-5-4/scripts/0369-uarea_backup.gml",
        "extracted/server-5-4/scripts/0370-all_uarea_rb.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [
        "UserData/Areas/Areas_<uid>.bnu#area-flags"
      ],
      "reason": "Per-user area-state persistence. Migrate User_Area.bnu rows → SQLite user_area table.",
      "subsystem": "persistence"
    },
    {
      "disposition": "in-phase-7",
      "feature": "user-hexbridge-persistence",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0383-uhxb_restore.gml",
        "extracted/server-5-4/scripts/0384-uhxb_backup.gml",
        "extracted/server-5-4/scripts/0385-all_uhxb_rb.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [
        "UserData/HXB/Bridges_<uid>.bnu#bridges"
      ],
      "reason": "Per-user hexport-bookmark (teleport) state. Migrate User_Hxb.bnu → user_hexbridges table.",
      "subsystem": "persistence"
    },
    {
      "disposition": "in-phase-7",
      "feature": "user-init-lifecycle",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0358-join_monitor.gml",
        "extracted/server-5-4/scripts/0360-init_user.gml",
        "extracted/server-5-4/scripts/0362-uninit_user.gml",
        "extracted/server-5-4/scripts/0363-reinit_userr.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [],
      "reason": "Original allocates per-player slot in global.p_* arrays via init_user. Phase 4 wraps in Colyseus onJoin/onLeave; the in-memory shape is opaque to clients.",
      "subsystem": "account-auth"
    },
    {
      "disposition": "in-phase-7",
      "feature": "user-inventory-persistence",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0374-uinv_set.gml",
        "extracted/server-5-4/scripts/0375-uinv_get.gml",
        "extracted/server-5-4/scripts/0376-uinv_backup.gml",
        "extracted/server-5-4/scripts/0377-uinv_restore.gml",
        "extracted/server-5-4/scripts/0378-all_uinv_rb.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [
        "UserData/Inv/Inventory_<uid>.bnu#inventory"
      ],
      "reason": "Per-user inventory persistence. Migrate User_Inv.bnu → user_inventory table.",
      "subsystem": "persistence"
    },
    {
      "disposition": "in-phase-7",
      "feature": "user-news-persistence",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0371-unews_backup.gml",
        "extracted/server-5-4/scripts/0372-unews_restore.gml",
        "extracted/server-5-4/scripts/0373-all_unews_rb.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [
        "UserData/MB_News/News_<uid>.bnu#read-flag"
      ],
      "reason": "Per-user MB-news read-flag persistence. Migrate User_News.bnu → user_mb_news table.",
      "subsystem": "persistence"
    },
    {
      "disposition": "in-phase-7",
      "feature": "whisper-private-chat",
      "modernized_replacement": null,
      "mvp": false,
      "originating_gml": [
        "extracted/server-5-4/scripts/0359-server_receive.gml"
      ],
      "originating_opcodes": [],
      "originating_save_fields": [],
      "reason": "FEATURES.md differentiator: cross-room directed message addressed by recipient accountId. NEW (original chat is broadcast-only by area).",
      "subsystem": "chat"
    }
  ]
}