mangosfour · MadMaxMangos · Aug 18, 2026 · Aug 17, 2026 · Aug 17, 2026 · Aug 17, 2026
diff --git a/CMakeLists.txt b/CMakeLists.txt
@@ -196,7 +196,7 @@ endif()
 #
 #   mangos_openssl        - what to link against and where the headers live.
 #                           Linked by anything that touches OpenSSL types
-#                           (Auth, Warden) so consumers inherit it.
+#                           (Auth) so consumers inherit it.
 #
 #   mangos_openssl_strict - the API level we hold ourselves to. Together these
 #                           two definitions delete the *declarations* of

diff --git a/contrib/sync_mop_opcode_reference_status.ps1 b/contrib/sync_mop_opcode_reference_status.ps1
@@ -143,7 +143,7 @@ $counts = @{
     'C|DORMANT' = 0
 }
 
-$rowPattern = '^(?<prefix>[ \t]*\*[ \t]+(?<name>(CMSG|SMSG|MSG)_[A-Za-z0-9_]+)[ \t]+(?<hex>0x[0-9A-Fa-f]+)[ \t]+)(?<status>ACTIVE|DOC|DORMANT)(?<suffix>[^\r\n]*)$'
+$rowPattern = '^(?<prefix>[ \t]*\*[ \t]+(?<name>(?<kind>CMSG|SMSG|MSG)_[A-Za-z0-9_]+)[ \t]+(?<hex>0x[0-9A-Fa-f]+)[ \t]+)(?<status>ACTIVE|DOC|DORMANT)(?<suffix>[^\r\n]*)$'
 $linePattern = '(?m)^[^\r\n]*'
 
 $updatedText = [regex]::Replace($originalText, $linePattern, {
@@ -181,8 +181,10 @@ $updatedText = [regex]::Replace($originalText, $linePattern, {
         $expectedStatus = 'DOC'
     }
 
-    $counts["TOTAL|$expectedStatus"]++
-    $counts["$($script:section)|$expectedStatus"]++
+    if ($rowMatch.Groups['kind'].Value -ne 'MSG') {
+        $counts["TOTAL|$expectedStatus"]++
+        $counts["$($script:section)|$expectedStatus"]++
+    }
     if ($rowMatch.Groups['status'].Value -ne $expectedStatus) {
         $script:statusChangeCount++
     }
@@ -243,8 +245,8 @@ if ($rowCount -ne 1520) {
 }
 
 $summaryReplacements = @{
-    '(?m)^[ \t]*\*[ \t]+STATUS TOTALS:[^\r\n]*(\r?)$' =
-        " * STATUS TOTALS: ACTIVE=$($counts['TOTAL|ACTIVE']), DOC=$($counts['TOTAL|DOC']), DORMANT=$($counts['TOTAL|DORMANT'])"
+    '(?m)^[ \t]*\*[ \t]+STATUS TOTALS(?: \(excludes 3 shared MSG aliases\))?:[^\r\n]*(\r?)$' =
+        " * STATUS TOTALS (excludes 3 shared MSG aliases): ACTIVE=$($counts['TOTAL|ACTIVE']), DOC=$($counts['TOTAL|DOC']), DORMANT=$($counts['TOTAL|DORMANT'])"
     '(?m)^[ \t]*\*[ \t]+SMSG: ACTIVE=[^\r\n]*(\r?)$' =
         " *   SMSG: ACTIVE=$($counts['S|ACTIVE']), DOC=$($counts['S|DOC']), DORMANT=$($counts['S|DORMANT'])"
     '(?m)^[ \t]*\*[ \t]+CMSG: ACTIVE=[^\r\n]*(\r?)$' =

diff --git a/src/game/CMakeLists.txt b/src/game/CMakeLists.txt
@@ -67,14 +67,6 @@ file(GLOB SRC_GRP_TOOL Tools/*.cpp Tools/*.h)
 source_group("Tool" FILES ${SRC_GRP_TOOL})
 
 #VMap group
-#Warden group
-file(GLOB SRC_GRP_WARDEN Warden/*.cpp Warden/*.h)
-source_group("Warden" FILES ${SRC_GRP_WARDEN})
-
-#Warden Modules group
-file(GLOB SRC_GRP_WARDEN_MODULES Warden/Modules/*.cpp Warden/Modules/*.h)
-source_group("Warden\\Modules" FILES ${SRC_GRP_WARDEN_MODULES})
-
 #World and Handlers group
 file(GLOB SRC_GRP_WORLD_HANDLERS WorldHandlers/*.cpp WorldHandlers/*.h)
 source_group("World\\Handlers" FILES ${SRC_GRP_WORLD_HANDLERS})
@@ -197,8 +189,6 @@ add_library(game STATIC
     ${SRC_GRP_SERVER}
     ${SRC_GRP_TIME}
     ${SRC_GRP_TOOL}
-    ${SRC_GRP_WARDEN}
-    ${SRC_GRP_WARDEN_MODULES}
     ${SRC_GRP_WORLD_HANDLERS}
     $<$<BOOL:${SCRIPT_LIB_ELUNA}>:${SRC_GRP_ELUNA}>
     $<$<BOOL:${PLAYERBOTS}>:${SRC_GRP_BOTS}>
@@ -218,8 +208,6 @@ target_include_directories(game
         Server
         Time
         Tools
-        Warden
-        Warden/Modules
         WorldHandlers
         $<$<BOOL:${SCRIPT_LIB_ELUNA}>:
             ${CMAKE_SOURCE_DIR}/src/modules/Eluna
@@ -260,9 +248,8 @@ target_link_libraries(game
         $<$<BOOL:${SCRIPT_LIB_SD3}>:mangosscript>
         $<$<BOOL:${SCRIPT_LIB_ELUNA}>:lualib>
     PRIVATE
-        # Holds game to the same OpenSSL 3.x API level as shared and mangosd.
-        # It was the one target left out, which is why Warden could keep
-        # calling the low-level MD5_* functions OpenSSL 3.0 deprecated.
+        # Holds game to the same OpenSSL 3.x API level as shared and mangosd,
+        # rejecting deprecated low-level crypto use in game sources.
         mangos_openssl_strict
 )
 
@@ -293,4 +280,4 @@ endif()
 # build.
 if(WITH_TESTS)
     add_subdirectory(Server/tests)
-endif()
+endif()
diff --git a/src/game/Server/Opcodes.cpp b/src/game/Server/Opcodes.cpp
@@ -192,6 +192,12 @@ void InitializeOpcodes()
     // --- Opcodes registered beyond the Phase 1a login closure (kept here so they survive
     //     regeneration of opcode_register.inc). ---
 
+    // The legacy Warden implementation is intentionally absent during the
+    // schema-first transition. Keep its one grouped inbound transport known,
+    // authenticated and on the world thread, but consume the opaque body only.
+    DefC(CMSG_WARDEN_DATA, "CMSG_WARDEN_DATA", STATUS_AUTHED,
+        PROCESS_THREADUNSAFE, &WorldSession::HandleWardenDataOpcode);
+
     // CMSG_CHAR_DELETE (0x04E2) / SMSG_CHAR_DELETE (0x0C9F): delete a character from char-select.
     // The handler already exists; MoP sends the GUID bit-packed (decoded in HandleCharDeleteOpcode).
     DefC(CMSG_CHAR_DELETE, "CMSG_CHAR_DELETE", STATUS_AUTHED, PROCESS_THREADUNSAFE, &WorldSession::HandleCharDeleteOpcode);

diff --git a/src/game/Server/Opcodes_reference.h b/src/game/Server/Opcodes_reference.h
@@ -175,9 +175,9 @@
  *   TOTAL SMSG rows                   925
  *
  * SUBSYSTEM CONFIDENCE: high=365, low=221, medium=182, none=157
- * STATUS TOTALS: ACTIVE=658, DOC=420, DORMANT=442
- *   SMSG: ACTIVE=362, DOC=270, DORMANT=293
- *   CMSG: ACTIVE=296, DOC=150, DORMANT=149
+ * STATUS TOTALS (excludes 3 shared MSG aliases): ACTIVE=662, DOC=420, DORMANT=435
+ *   SMSG: ACTIVE=364, DOC=270, DORMANT=290
+ *   CMSG: ACTIVE=298, DOC=150, DORMANT=145
  */
 
 // CAVEATS -- read before trusting any single row:
@@ -1819,7 +1819,7 @@ typedef uint16_t uint16;
  *   CMSG_SET_PARTY_ASSIGNMENT                      0x1802  ACTIVE
  *   CMSG_BATTLEFIELD_MANAGER_ENTRY_INVITE_RESPONSE 0x1806  DORMANT
  *   CMSG_MESSAGECHAT_ADDON_OFFICER                 0x180B  ACTIVE
- *   CMSG_WARDEN_DATA                               0x1816  DORMANT
+ *   CMSG_WARDEN_DATA                               0x1816  ACTIVE
  *   CMSG_UNLEARN_SPECIALIZATION                    0x1841  DORMANT
  *   CMSG_FORCE_SWIM_SPEED_CHANGE_ACK               0x1853  ACTIVE
  *   CMSG_MOVE_START_SWIM                           0x1858  DORMANT

diff --git a/src/game/Server/WorldGateway.cpp b/src/game/Server/WorldGateway.cpp
@@ -233,25 +233,11 @@ proto::AuthLookup WorldGateway::LookupAccount(const proto::AuthRequest& request)
         return result;
     }
 
-    // Phase 3 defers Warden structurally (re-homed from WorldSocket.cpp:1440-1456,
-    // that file now deleted). Everything needed to re-enable it correctly is stated
-    // there; do not re-add the code without addressing all four points:
-    //   1. K CONSUMER. Warden is the fourth consumer of K (after the digest check,
-    //      AuthCrypt::Prepare and this row). WorldSession::InitWarden still takes
-    //      BigNumber* k and currently has ZERO callers, so the compiler will NOT
-    //      flag it when the key representation changes -- this comment is the only
-    //      barrier.
-    //   2. SHORT-K BUG. WardenWin.cpp/WardenMac.cpp reseed from k->AsByteArray(),
-    //      k->GetNumBytes(). A raw-40 K (row->sessionKey / m_sessionKey) fixes this
-    //      by construction; a BigNumber-shaped K does not -- never re-wrap it.
-    //   3. NO KEY LOGGING. Warden logged its derived encryption keys; that logging
-    //      was removed and must not be reintroduced.
-    //   4. ORDERING. InitWarden previously ran BEFORE session publication, making
-    //      SMSG_WARDEN_DATA the first encrypted server packet, ahead of
-    //      SMSG_AUTH_RESPONSE. Re-enabling must decide that ordering deliberately.
-    // Also unlike MangosThree's WorldGateway: M4's account table has no `os` column,
-    // so there is no Warden client-OS gate to port -- do not add one without a
-    // schema migration.
+    // Warden is intentionally absent during this schema-first transition. A
+    // later implementation must consume the canonical raw-40 K without a
+    // BigNumber round trip, never log key material, and deliberately order its
+    // first server packet after authentication. This path deliberately does not
+    // select or gate on `account.os`; removal must not change that auth policy.
 
     result.status = proto::AuthStatus::Ok;
     std::memcpy(result.sessionKey, row->sessionKey, sizeof(result.sessionKey));

diff --git a/src/game/Server/WorldSession.cpp b/src/game/Server/WorldSession.cpp
@@ -35,7 +35,6 @@
  * - Character management
  * - Movement and action handling
  * - Chat and social interactions
- * - Warden anti-cheat integration
  *
  * The session filters packets based on thread safety and context:
  * - Map::Update() context: Only process thread-safe packets
@@ -79,9 +78,6 @@
 //#include "playerbot.h"
 #endif
 
-// Warden
-#include "WardenWin.h"
-#include "WardenMac.h"
 #include <cstring>
 #include <mutex>
 #include <utility>
@@ -205,11 +201,6 @@ WorldSession::~WorldSession()
         m_Socket.reset();
     }
 
-    // CAUSES CRASH ON PLAYER EXITING TO LOGIN SCREEN
-    // Warden
-//    if (_warden)
-//        delete _warden;
-
     ///- empty incoming packet queue
     WorldPacket* packet = NULL;
     while (_recvQueue.next(packet))
@@ -1037,10 +1028,6 @@ bool WorldSession::Update(PacketFilter& updater)
         m_Socket.reset();
     }
 
- // WARDEN ISSUE - commented out to stop crash
- //   if (m_Socket && !m_Socket->IsClosed() && _warden)
- //       _warden->Update();
-
     // check if we are safe to proceed with logout
     // logout procedure should happen only in World::UpdateSessions() method!!!
     if (updater.ProcessLogout())
@@ -1051,10 +1038,6 @@ bool WorldSession::Update(PacketFilter& updater)
         {
             LogoutPlayer(true);
         }
-// WARDEN ISSUE - commented out to stop crash
-//        if (m_Socket && GetPlayer() && _warden)
-//           _warden->Update();
-
         if (!m_Socket)
         {
             return false;                                    // Will remove this session from the world session map
@@ -2062,26 +2045,3 @@ void WorldSession::ExecuteOpcode(OpcodeHandler const& opHandle, WorldPacket* pac
         LogUnprocessedTail(packet);
     }
 }
-
-/**
- * @brief Initializes Warden for the authenticated client platform.
- *
- * @param build The client build number.
- * @param k The session key material.
- * @param os The reported client operating system.
- */
-void WorldSession::InitWarden(uint16 build, BigNumber* k, std::string const& os)
-{
-    _build = build;
-
-    if (os == "Win" && sWorld.getConfig(CONFIG_BOOL_WARDEN_WIN_ENABLED))
-    {
-        _warden = new WardenWin();
-        _warden->Init(this, k);
-    }
-    else if (os == "OSX" && sWorld.getConfig(CONFIG_BOOL_WARDEN_OSX_ENABLED))
-    {
-        _warden = new WardenMac();
-        _warden->Init(this, k);
-    }
-}
diff --git a/src/game/Server/WorldSession.h b/src/game/Server/WorldSession.h
@@ -31,7 +31,6 @@
 #define MANGOS_H_WORLDSESSION
 
 #include "Common.h"
-#include "Auth/BigNumber.h"
 #include "Auth/MopAuthKey.h"
 #include "SharedDefines.h"
 #include "ObjectGuid.h"
@@ -58,7 +57,6 @@ class Item;
 class Object;
 class Player;
 class Unit;
-class Warden;
 class WorldPacket;
 class QueryResult;
 class LoginQueryHolder;
@@ -1500,8 +1498,8 @@ class WorldSession
          * @param locale Locale
          * @param sessionKey The account's canonical raw-40 session key (K),
          *             carried in from WorldGateway::LookupAccount rather than
-         *             re-read: SendRedirectClient()'s HMAC seed and (once
-         *             re-enabled) Warden both need it, and re-deriving it a
+         *             re-read: SendRedirectClient()'s HMAC seed and future
+         *             authenticated subsystems need it, and re-deriving it a
          *             second time from the DB is how a stale/second read
          *             desyncs from the key proto already proved the client
          *             holds.
@@ -1617,9 +1615,6 @@ class WorldSession
         }
         uint8 Expansion() const { return m_expansion; }
 
-        // Warden
-        void InitWarden(uint16 build, BigNumber* k, std::string const& os);
-
         /// Session in auth.queue currently
         void SetInQueue(bool state)
         {
@@ -2251,9 +2246,6 @@ class WorldSession
         void HandleBotPackets();
 #endif
 
-        // for Warden
-        uint16 GetClientBuild() const { return _build; }
-
         // Guild Bank
         void HandleGuildPermissions(WorldPacket& recv_data);
         void HandleGuildBankMoneyWithdrawn(WorldPacket& recv_data);
@@ -2352,10 +2344,6 @@ class WorldSession
         uint32 _accountId;
         uint8 m_expansion;
 
-        // Warden
-        Warden* _warden;                                    // Remains NULL if Warden system is not enabled by config
-        uint16 _build;                                      // connected client build
-
         time_t _logoutTime;
         uint32 m_pendingTransferRootCounter;
         uint32 m_suspendTokenCounter;