Realm of Forgotten Souls - Creation Requirements ================================================= Purpose ------- GamePlan.txt describes the game vision, but the decisions below materially affect the architecture, security model, data model, and implementation schedule. Please answer these questions before the final development plan is created. Suggested defaults are included in brackets. Accepting a default is sufficient. 1. Initial Release Scope (highest priority) ------------------------------------------- 1. Is the first target: A. a small playable MVP, B. a public beta containing most described systems, or C. the complete game described in GamePlan.txt? [Suggested: A, followed by phased releases.] 2. Which systems are mandatory for the first playable release? Suggested MVP: registration/email verification, login, news/main menu, one town, one world area, movement, basic Fighter combat, monsters, death/loot recovery, character and backpack screens, one shop, chat, and admin content tools. 3. Should PvP, clans, banking, post office, quests, puzzles, bosses, race progression, leaderboards, and all four skill groups launch later in phases? [Suggested: yes.] 4. Is there a target date, budget, or team size that the plan must accommodate? 2. Runtime and Hosting Architecture (highest priority) ------------------------------------------------------ 5. Must the backend use plain PHP with mysqli, or may it use a maintained PHP framework and PDO/its database layer? PHP frameworks substantially reduce the risk of inconsistent authentication, validation, CSRF protection, routing, migrations, and authorization. [Suggested: current Laravel release with MySQL; do not require direct mysqli.] 6. What hosting environment will be used (shared hosting, VPS, containers, or a cloud provider), and what operating system/runtime versions are available? [Suggested: containerized Linux deployment.] 7. May the project use Redis for sessions, caching, presence, rate limiting, queues, and real-time message distribution? [Suggested: yes.] 8. Should movement, combat, chat, and presence update in real time through WebSockets, or should the mobile browser poll the PHP server? [Suggested: WebSockets with HTTP fallback.] 9. Should this be a responsive browser game/PWA only, or are native Android/iOS applications expected? [Suggested: responsive PWA first.] 3. World and Concurrency Rules (highest priority) ------------------------------------------------- 10. Is the world one shared persistent map, multiple shards, or instanced copies? How many simultaneous players should one world support at launch and at peak? [Suggested starting target: one shared world, 100 concurrent users at launch, designed so zones can later be distributed.] 11. Is the displayed 9x9 area a tile grid centered on the player (an 81-tile viewport), and is movement exactly one tile per action? 12. What happens near map edges: clamp the viewport, render unknown/empty tiles, or transition into an adjacent zone? 13. Can multiple friendly players occupy one tile? GamePlan.txt says players block movement, but this could allow one player to trap another. Define occupancy, passing, safe-tile, and anti-blocking rules. [Suggested: players do not block friendly movement; hostile engagement can temporarily restrict movement.] 14. Is game state authoritative on the server with actions processed in a fixed tick, or does each valid request resolve immediately? [Suggested: server-authoritative fixed tick for world actions.] 15. What are the movement and attack cooldowns for Mortal, Undead, and Lich? Does "can move longer" mean more fatigue, lower movement cost, or speed? 16. Does the world continue changing when no players are in a zone? Define monster respawn, dropped-pile expiration, hazards, boss state, and puzzle persistence after restarts. 4. Combat, Stats, and Progression (highest priority) ---------------------------------------------------- 17. Please define or authorize the design team to balance formulas for: - maximum HP, mana, and fatigue; - physical and spell damage; - hit, miss, critical chance, and critical damage; - armor mitigation; - regeneration; - movement and action costs; - XP gain and level thresholds. [Suggested: authorize documented, data-driven formulas with automated balance simulations before values are finalized.] 18. The stated armor rule allows 1000 armor to reduce 100% of damage. Should damage immunity really be possible? It can make combat unwinnable. [Suggested: use diminishing returns and a mitigation cap below 100%.] 19. Is there a maximum base level or maximum level for Fighter, Ranger, Mage, and Healer? Can every character level all four groups? 20. How does an action award subgroup XP (weapon attacks to Fighter, bows to Ranger, offensive spells to Mage, healing to Healer), and can XP be gained by repeatedly acting on allies or trivial enemies? 21. Are classes equipment restrictions, action-derived skills, or only XP categories? What weapons, spells, and armor can each race and skill group use? 22. Define the complete Mortal -> Undead -> Lich transition: - Does "complete 5 levels" mean reach level 5, gain five levels after a point, or another measure? - Is transformation optional every time? - Does a race change retain stats, subgroup levels, gear, spells, and titles? - Does any death reset Undead progress toward Lich? 23. Are Mortals and Chaos races permanent PvP factions? Can members of the same faction attack each other? Can races communicate, trade, group, or share clans? 24. What exactly counts as a player kill for the 50-kill curse: lifetime kills, unique victims, recent kills, hostile-faction kills, or unjustified kills? Is the curse reversible? 25. What prevents kill trading, spawn killing, low-level farming, multi-account farming, safe-zone camping, and repeatedly killing the same victim? 26. Is combat turn-based, cooldown-based, or auto-attacking after engagement? Can a player move away, log out, or be sent to the main menu during combat? 27. The two-minute inactivity rule could let players escape danger by waiting or disconnecting. Should inactive/disconnected characters remain vulnerable for a combat-logout period? [Suggested: safe removal only when out of combat; otherwise remain in-world for a configured timeout.] 5. Death, Corpses, and Item Ownership ------------------------------------- 28. Does every death, including disconnect-related death, drop every equipped item, backpack item, and all carried gold? Are quest, bound, premium, or starter items exempt? 29. While the skull protects a pile, who can loot it: nobody, only the dead player, their clan/group, or the killer? When does protection end? 30. If the player does not manually resurrect, how long does the corpse remain? What happens when the pile expires, the server restarts, or its tile is altered by a boss? 31. Where does a resurrected player appear, with how much health/mana/fatigue, and is there temporary protection? 6. Economy, Items, Shops, Bank, and Mail ---------------------------------------- 32. Should gold be stored as integers, and what are the maximum carried, banked, mailed, and clan balances? [Suggested: integer smallest units with explicit transaction limits.] 33. Are items unique instances with durability/random stats, or stackable references to fixed item definitions? Which items bind to characters? 34. Can players trade directly or only through the post office? Is there an auction house or player market planned? 35. Does mail require acceptance, a postage fee, recipient capacity checks, and confirmation for valuable transfers? Can mail be canceled? 36. Clarify mail expiry: return unclaimed mail after 7 days, then permanently delete it 7 days after return? What happens if the sender no longer exists or has no capacity? 37. Is bank storage per character or per account? Define slot/currency limits and whether all towns share one bank. 38. Should shops have infinite fixed stock, limited stock, buyback, selling, repairs, price variation, and race/reputation restrictions? 39. Are real-money donations planned? "Top Donations" is ambiguous. If yes, define payment provider, currencies, refunds/chargebacks, age restrictions, whether donations grant gameplay benefits, and whether amounts are publicly displayed. [Suggested: do not publicly rank real-money spending.] 7. Accounts, Identity, Safety, and Privacy ------------------------------------------ 40. Is one account allowed multiple characters, or exactly one character? [Suggested: separate Account and Character models even if launch permits one.] 41. What are the minimum age and launch countries? These determine privacy, parental-consent, consumer-protection, and payment requirements. 42. Is a binary Male/Female public field a firm gameplay requirement? Is it the player's real-world sex or a character attribute? A public real-world sex field creates avoidable privacy/moderation concerns. [Suggested: make it an optional fictional character presentation field.] 43. What account fields may players change, and which are public? Define policies for email changes, password recovery, session/device management, account deletion, data export, and retention. 44. Should usernames be unique case-insensitively? Define allowed characters, length, reserved words, impersonation/profanity rules, and whether prior names are reserved after a rename. 45. Does the seven-day rename cooldown begin at creation or the last rename? Are renames free, and are name histories visible to moderators? 46. Which email service should send verification and recovery messages? How long do tokens last, and may unverified accounts reserve names? 47. Is multi-factor authentication required for administrators/moderators? [Suggested: mandatory for privileged accounts.] 48. Define session limits, rate limits, CAPTCHA/bot controls, and policy on multiple accounts from one device/network. 49. MySQL injection does not have meaningful "first/second/third tier" standard categories. May the security plan instead use OWASP ASVS and Cheat Sheet guidance, parameterized queries, contextual output encoding, CSRF protection, strict authorization, CSP, secure cookies, rate limiting, dependency scanning, audit logs, and threat modeling? [Suggested: yes; target OWASP ASVS Level 2.] 8. Chat, Messaging, Clans, and Moderation ----------------------------------------- 50. Which channels exist at launch: direct message, town, world, clan, combat log, system, group, and trade? Are messages retained, and for how long? 51. Can opposing races see and understand each other's messages? Can dead, cursed, muted, or unverified players chat? 52. Define block, mute, report, profanity filtering, spam throttling, link policy, moderator review, sanctions, and appeals. 53. Are direct messages real-time only or stored as an inbox? Can offline players receive them? 54. Are clans cross-faction? Define clan name/tag rules, member limit, roles, permissions, leadership transfer, kicking, leaving, disbanding, and what happens to clan storage/gold. 55. Does the 10,000 gold clan creation fee come from carried gold or banked gold? Is it refunded on disbanding? 56. How are "top clans" calculated for experience, monster kills, player kills, and donations? Is it lifetime member totals, totals earned while in the clan, or current-member totals? How is clan-hopping abuse prevented? 57. What can moderators and administrators do? At minimum, decide permissions for player sanctions, chat review, item/gold adjustments, content editing, world control, account recovery, and immutable audit-log review. 9. Content and Administration ----------------------------- 58. Should maps, tiles, portals, monsters, loot tables, items, shops, spells, quests, bosses, hazards, news, rules, and titles be data-driven and editable through an admin interface? [Suggested: yes, with versioned publishing and audit logs.] 59. Who creates map art/icons for the 9x9 viewport? Is "square image" one image per tile, a composed map image, ASCII/text symbols, or another presentation? 60. What initial content quantities are required for the MVP and public launch: maps/zones, towns, monsters, bosses, items, spells, quests, puzzles, titles, and news/rules pages? 61. Provide the initial world layout and the location/role of Hammerfall, Stumpy's Outpost, Chaos lands, safe zones, portals, and locked regions, or authorize their design. 62. How should collaborative world puzzles behave after being solved: globally and permanently unlocked, per faction, per server season, or periodically reset? Who receives credit/rewards? 63. What boss encounters and map-changing abilities are required initially? Define reset rules and recovery if an encounter becomes impossible. 10. Interface and Accessibility ------------------------------- 64. What are the minimum supported browsers, devices, viewport sizes, and network conditions? [Suggested: current mobile Safari/Chrome/Firefox/Edge plus desktop equivalents, with degraded-network handling.] 65. Is landscape orientation supported? Must the entire 9x9 map and controls fit without scrolling? 66. Should movement support buttons, swipe, keyboard, and accessibility controls? 67. What accessibility target is required? [Suggested: WCAG 2.2 AA, reduced motion, scalable text, keyboard operation, sufficient contrast, and non-color-only status indicators.] 68. Should the warning before entering the world appear every time, once per session, or until the player opts out? 11. Operations, Quality, and Legal ---------------------------------- 69. Define availability, backup frequency, recovery objectives, maintenance windows, log retention, monitoring, and incident-response expectations. 70. Are separate development, staging, and production environments acceptable? [Suggested: yes, with automated tests and deployment gates.] 71. What level of automated testing is expected? [Suggested: unit tests for formulas, integration tests for transactions/authorization, concurrency tests for world actions, browser tests for critical flows, load tests, and security tests.] 72. Should the game support seasons, resets, migrations, or multiple rulesets? 73. Who owns and supplies the game name, lore, artwork, audio, privacy policy, terms of service, rules, and community standards? Confirm that all supplied assets may legally be used. 74. Is account deletion required to anonymize leaderboard, clan, mail, combat, moderation, and audit records while preserving game integrity? Requested Response Format ------------------------- Please copy this file and write each answer beneath its question, or provide a separate response using the question numbers. Questions 1-16, 17-18, 22-27, 39-42, 49, 58-61, and 64 are the minimum needed to produce a dependable initial architecture and phased implementation plan. Unanswered lower-priority items can use their suggested defaults and be recorded as explicit assumptions.