Implement OSRS-style Ironman game modes

[gradwahl]

Goal

Implement OSRS-style Ironman modes in the 2004 progressive server without modernising unrelated game content.

Requested modes:

• NORMAL
• IRONMAN
• HARDCORE_IRONMAN
• ULTIMATE_IRONMAN
• GROUP_IRONMAN
• HARDCORE_GROUP_IRONMAN

The detailed implementation and anti-bypass matrix is committed in IRONMAN_MODE_CHECKLIST.md. This PR is intentionally draft and should stay that way while the phases are completed.

Scope guardrails

• Integrate with the content/systems that actually exist in 2004sp-progressive.
• Do not add a Grand Exchange or other modern systems purely because OSRS Ironman has rules for them.
• Keep normal 2004 gameplay unchanged for NORMAL accounts.
• Treat bots as players for Ironman anti-transfer restrictions.
• Keep restrictions server-authoritative; client UI/icons are presentation only.

Asset scope

Only these modern assets should be backported for Ironman:

• Ironman/HCIM/UIM/GIM/HCGIM helmet/status icons for chat/player identity.
• Ironman armour sets and their required object/model/icon dependencies.

Everything else should reuse native 2004 cache content/interfaces:

• Tutorial Island Ironman NPC uses an NPC already in the native cache.
• Group creation/management reuses existing dialogue/input/player operations.
• Group storage reuses a compatible existing bank/container interface.
• No modern GIM interface/NPC backport.

Existing integration points

This work should extend the current architecture rather than build parallel systems:

• engine/src/engine/entity/Player.ts
• engine/src/engine/entity/PlayerLoading.ts
• content/scripts/login_logout/login.rs2
• content/scripts/interface_trade/scripts/trade.rs2
• content/scripts/player/scripts/death.rs2
• content/scripts/shop/scripts/shop.rs2
• current RuneScript ground-object/inventory operations
• current Duel Arena/minigame content
• current bot-player implementation

---

Phase checklist

Phase 0 — Rules matrix

• Freeze mode transitions, interaction permissions, safe/deadly deaths, group size, HCGIM lives and quest exceptions.
• Do not introduce an unrequested UNRANKED_GROUP_IRONMAN mode silently.

Phase 1 — Core model and persistence

• Add the six-value GameMode enum and centralized rules/helpers.
• Store mode authoritatively on Player.
• Expose minimal RuneScript game-mode/group queries.
• Version player saves; existing version-7 saves load as NORMAL.
• Add save/load/migration tests.

Phase 2 — Group persistence

• Add persistent group ID/type/leader/members/creation state.
• Persist HCGIM shared lives and prestige/ranked state if used.
• Make membership/life changes restart-safe and auditable.

Phase 3 — Tutorial Island onboarding

• Add a native-cache Ironman tutor NPC spawn on Tutorial Island.
• Let new accounts choose all six requested modes before tutorial completion.
• Require confirmation and lock the selection at the proper tutorial boundary.
• Add GIM/HCGIM creation/invitation for eligible new accounts without modern UI assets.
• Enforce 2–5 player groups and finalized HCGIM starting lives.

Phase 4 — Direct trading

• Gate the existing RuneScript trade flow at request, accept, confirm and settlement.
• Solo Ironman/HCIM/UIM cannot trade players.
• GIM/HCGIM may trade only members of the exact same group.
• Bots cannot be used as mules.
• Preserve NORMAL <-> NORMAL trade behaviour.

Phase 5 — Ground-item provenance

• Track enough provenance for dropped/public items to prevent drop trading.
• Own items remain eligible where intended.
• GIM/HCGIM can receive same-group eligible drops.
• Outsider/bot drops remain blocked even after public timers expire.
• Prevent stack-merging/provenance laundering.

Phase 6 — NPC contribution/drop eligibility

• Track player contribution to NPC kills.
• Outside-player assistance invalidates solo Ironman drops under the chosen rules.
• Same-group GIM/HCGIM contribution is allowed.
• Outside-group/bot contribution is not.
• Apply centrally to normal NPCs and existing bosses/custom bosses.

Phase 7 — PvP/death anti-transfer

• Integrate with the existing death.rs2 PvM/PvP death path.
• Ironmen cannot receive victim inventory/equipment wealth through PvP.
• Public timers must not turn player-sourced PvP loot into valid Ironman loot.
• Prevent bot coin-drop/PvP behaviour becoming an Ironman money source.
• Preserve normal-player skull/protect-item/deathkeep behaviour.

Phase 8 — Hardcore Ironman

• Add a central dangerous-death classification.
• HARDCORE_IRONMAN -> IRONMAN on qualifying death.
• Persist status loss before/with respawn so reconnect/restart cannot restore it.
• Refresh identity icon/state immediately.
• Audit current Duel Arena/minigame death contexts rather than using a blind modern list.

Phase 9 — Hardcore Group Ironman

• Initialize shared lives from the finalized starting roster.
• Consume exactly one life per qualifying death.
• Never regenerate lives by later membership changes.
• At zero lives, downgrade the whole group to GROUP_IRONMAN, including offline members.
• Test near-simultaneous deaths.

Phase 10 — Ultimate Ironman

• Block every authoritative bank access/manipulation path.
• Audit bankers, booths/chests, direct interface opens and direct bank inventory operations.
• Do not add modern UIM storage content that does not exist here.
• Explicitly classify any existing alternate storage.
• Keep quests completable through narrow fixes where necessary.
• Keep death recovery playable using existing ground/death systems without importing modern death UI.

Phase 11 — NPC shops

• Integrate with the existing shop/restock system.
• Natural/restocked NPC stock remains usable.
• Player/bot-sold excess stock cannot be laundered into Ironman inventory.
• Cross-Ironman/cross-group shop laundering is blocked.
• Normal shop behaviour remains unchanged.

Phase 12 — Duel Arena/minigames/communal rewards

• Audit the existing Duel Arena.
• Block Ironman stakes/winnings while allowing zero-stake duels if desired.
• Audit Fishing Trawler/current multiplayer content for transfer loopholes.
• Audit party/drop-party style content if present.
• Do not implement GE/LootShare/CoinShare/raids/LMS/etc. if absent.

Phase 13 — Multiplayer-required quests

• Audit Shield of Arrav.
• Audit Heroes' Quest if enabled.
• Find any quest that relies on trade/player drops/cooperation.
• Add only narrow quest-item/state exceptions; never lift generic Ironman trade rules.

Phase 14 — Group storage

• Add one persistent shared inventory per group.
• Reuse an existing 2004 container/bank interface.
• Restrict access to current members of the exact group.
• Make deposits/withdrawals disconnect/restart/concurrency safe.
• Re-check membership on every mutation.
• Define eligible untradeable/quest/degradable items centrally.
• Log all storage mutations.

Phase 15 — Group lifecycle/ranked integrity

• Implement create/invite/accept and leadership rules.
• Implement leave/kick handling under the frozen no-UGIM policy.
• Prevent membership hopping from becoming a wealth-transfer path.
• Apply prestige/new-member penalties or wealth caps if included.
• Invalidate open trade/storage sessions on membership changes.

Phase 16 — Ironman armour backport

• Freeze one exact OSRS cache/client source snapshot.
• Build source-ID -> local-ID mappings.
• Import the requested mode armour sets only.
• Import inventory + male/female worn model dependencies.
• Preserve source item properties/recolours without renumbering existing 2004 IDs.
• Add safe tutor reclaim that cannot generate wealth.
• Verify Java client and webclient rendering.

Phase 17 — Helmet/status icon backport

• Import only required Ironman mode icon sprites.
• Keep mode icons separate from moderator/staff rights.
• Render correct icons beside player names/public chat and existing identity surfaces.
• Refresh immediately on HCIM/HCGIM loss.
• Support the Java client and webclient paths as required.

Phase 18 — Login/social UX

• Load mode/group before economy interactions become possible.
• Add clear blocked-action messages.
• Add clear Hardcore/group-life status messages.
• Keep client presentation non-authoritative.

Phase 19 — Hiscores/site integration

• Expose mode/group state to the existing hiscore/site data path where supported.
• Add mode-filtered/group categories through companion site work if needed.
• Preserve Hardcore death metadata if required by hiscore semantics.

Phase 20 — Moderation/audit/recovery

• Add staff inspection for mode/group/lives/storage metadata.
• Log testing/admin mode changes.
• Log group membership/storage/Hardcore state transitions.
• Add safe recovery tooling without exposing live promotion/dupe paths.

Phase 21 — Anti-bypass matrix

• Complete trade matrix for all solo/group/normal combinations.
• Complete ground-item source/expiry/stack-merge matrix.
• Complete NPC-assistance matrix including bots and same-group contributors.
• Complete shop laundering matrix.
• Complete UIM bank-entry matrix.
• Complete HCIM/HCGIM death/restart/concurrency matrix.
• Complete group-storage concurrency/disconnect/restart matrix.
• Complete quest/minigame exception tests.

Phase 22 — Regression

• Existing normal saves load unchanged.
• Normal trade/shop/PvM/PvP/death/Duel Arena/Tutorial Island behaviour remains unchanged.
• Existing bots continue normal gameplay but cannot bypass Ironman restrictions.
• Existing quest flows remain unchanged except documented Ironman exceptions.
• Existing object/model IDs stay stable.
• Java client/webclient remain playable.
• Staff crowns retain their meaning.
• No unrelated modern content has been introduced.

Phase 23 — Ready for review

• All six modes persist and select correctly.
• Trade/drop/shop/NPC/PvP anti-transfer rules are server-authoritative and tested.
• UIM banking restrictions are complete.
• HCIM death and HCGIM shared lives work across restart/offline members.
• Same-group GIM/HCGIM trade and shared storage work without cross-group transfer.
• Required multiplayer quests remain completable through narrow exceptions.
• Ironman armour sets render/equip/reclaim correctly.
• Correct mode icon appears beside player identity without colliding with staff rights.
• Normal-player behaviour remains unchanged.
• No modern system absent from this codebase was added merely for Ironman parity.