healer-man/docs/STOCKADE_UTILITY_ATTACK_AUDIT_2026-10-04.md

Stockade utility attack source audit — 2026-10-04

Later continuations enable sourced shouts, Enrage, NPC stances and ordinary creature auto-attack blocking as utility effects, with no fabricated direct hit. See enemy mechanics and stances/blocking. The dated omissions and failed-route evidence below describe the earlier correction.

Finding: The flagged entries were real NPC damage packets in the failed route artifact, not damage caused by the adjacent player actions. The route’s old generated attacks lacked explicit effects, so the runtime treated them as direct damage. Two source corrections now omit thirteen audited utility/extra-attack IDs and preserve supported damage/control with verified delivery, targets and ranges; no runtime aura values or encounter damage were guessed.

First correction and failed-route evidence

Stockade source	Failed-route generated attack	Captured route events
Kam Deepfury, entry 1666 / actor creature-79088; spell 7164 Defensive Stance	smart-1666-0-defensive-stance, primary target, projectile, damage multiplier 1.35	14 records, 12 landed, 6,079.14 effective damage; 10 records hit Durnik for 4,991.14 total
Defias Inmate, entry 1708; spell 7165 Battle Stance	spell-7165, primary target, projectile, damage multiplier 1.12	11 records, 10 landed, 2,577.78 effective damage
Defias Convict, entry 1711; spell 16244 Demoralizing Shout	spell-16244, primary target, projectile, damage multiplier 1.12	27 records, 24 landed, 5,115 effective damage
Defias Insurgent, entry 1715; spell 13730 Demoralizing Shout	spell-13730, primary target, projectile, damage multiplier 1.12	17 records, 16 landed, 4,620.29 effective damage

These four IDs account for 69 recorded events, 62 landed, and 18,392.20 effective damage in the failed artifact. They contributed damage during the attempt, but the known LOS and GCD harness problems prevent assigning them as the sole cause of any death or route failure. The refreshed campaign catalog contains none of these four as direct-damage attacks.

Source contract

The compiler’s default 3.3.5a Ascension source is ../LadiksMPQEditor/client-current/area-52/patch-D/DBFilesClient/Spell.dbc (ASCENSION_SPELL_DBC can override it). Its SHA-256 is 2f77f18b91ffbae32a19568e4bc05ec78ee384b6ba8dd2a6e05f0e97abbb2dce, matching the local pin in src/game/ascensionCustomEncounterCatalog.ts. The DBC effect rows show:

• 7164 Defensive Stance and 7165 Battle Stance each contain only effect 6 (APPLY_AURA), aura 36 (MOD_SHAPESHIFT), caster target A 1, and target B 0. Their misc values are 18 and 17. Neither has a damage opcode.
• 16244 contains only APPLY_AURA, aura 79 (MOD_DAMAGE_PERCENT_DONE), target A 22 (TARGET_SRC_CASTER), target B 15 (TARGET_UNIT_SRC_AREA_ENEMY), misc value 1, and no damage opcode.
• 13730 contains only APPLY_AURA, aura 166 (MOD_ATTACK_POWER_PCT), with the same source-centered enemy-area target pair, misc value 0, and no damage opcode.

The generated azerothCoreWorldAi.json identifies the AzerothCore world SQL snapshot as commit 4d9d1d4b5723e819c5c390f6ca1177283dbfb8e3. Its exact rows agree with the read-only historical SQL reference under ../wow-pvt-server-backups-2/azerothcore-wotlk/data/sql/base/db_world/:

• Entry 1666, row 0 casts 7164 in combat with target_type=1 (SMART_TARGET_SELF).
• Entry 1708, row 0 casts 7165 out of combat with target_type=1 (self). The creature spell list also includes 7165, which is why the generic spell-list path had incorrectly emitted an in-combat attack.
• Entry 1715, row 1 casts 13730 in combat with target_type=1 (self). The DBC specifies the source-centered enemy area.
• Entry 1711’s creature spell list includes 16244; its SmartAI rows do not declare it as a primary-target damage action.

Owning boundary and correction

The defect belonged to scripts/dungeon-pipeline/compile-campaign-catalog.mjs: spellSemantic() did not support these aura families, and spellAttack() filled the missing semantics with an inferred direct-damage attack. The generic creature-spell path also lost the Inmate’s out-of-combat phase; the SmartAI path could turn a self target into primary when constructing an attack.

The first source pass recognized only the four audited spell IDs and their pinned aura opcode, aura type, source target pair, and misc value. With no supported semantic or direct-damage opcode, each attack was omitted. A signature change failed generation explicitly. Null results were filtered from both creature-spell and SmartAI paths.

The runtime’s generic aura effect does not faithfully model shapeshift form 36 or the outgoing damage / attack-power modifiers here. Omitting unsupported utility spells keeps them from becoming damage while avoiding invented aura magnitudes. No runtime schema change was needed. The first compiler refresh removed these four IDs from 17 generated entity rows across 10 dungeon definitions; no other spell IDs were suppressed in that pass. At the end of that pass, Kam retained Shield Slam 8242 and Improved Blocking 3419, and Houndmaster Grebmar retained 21049 and 15615 without a fallback surge. The second pass below removes 3419 and retargets 8242. Stockade Rend 6547 / 16509 remain, and mixed-damage Shield Slam 8242 remains a control effect with its supported damage multiplier.

The generated catalog had additional pre-existing drift: the committed compiler already emitted schoolMask, damageOrigin, and damageClass (plus attackKind where applicable), but the committed generated JSON had none of these fields on 3,762 attacks. The first refresh added 2,392 schoolMask, 2,392 damageOrigin, 2,392 damageClass, and 1,751 attackKind fields. Its structural comparison confirmed that, after removing those four already-supported metadata fields and the four first-pass utility attack IDs from the pre-refresh catalog, the result exactly matched the refreshed JSON; only the corresponding two mechanicIds entries were also removed. No health, damage multiplier, or encounter scalar changed in that pass.

The earlier completed backlog item about preserving enemy damage class and school covers damage typing, not non-damaging NPC aura semantics or SmartAI self/phase handling. No narrower item covered these rows at audit start. The four-spell damage-fallback correction now has its own completed item in docs/ACTIVE_CLASS_MECHANICS_BACKLOG.md; full utility aura modeling remains open.

Verification: node --check scripts/dungeon-pipeline/compile-campaign-catalog.mjs passed; the catalog generator refreshed src/game/generated/dungeonCampaignCatalog.json and its compressed TypeScript output; the focused dungeonCampaignCatalog.test.ts Stockade utility regression passed. No full suite, production build, browser QA, or route retest was run.

The coordinating parent subsequently passed the corrected campaign catalog at 32/32, enemy attack/casting/damage-type/content checks at 24/24, Ready-five at 7 Vitest plus 20 Python checks, and the utility-corrected production build. The registry-total regression now verifies the six existing additional RuneWaker definitions from their committed source snapshots rather than retaining the stale 92-entry total; the current registry has 98 definitions. The normal Stockade campaign retry uses this new build and is documented separately in docs/STORMWIND_STOCKADE_PLAYTEST_2026-10-04.md.

Source-semantic pass two

The corrected route exposed more Stockade contract errors: Backhand 6253 was a random-party projectile instead of a victim stun at melee range; Shield Slam 8242 was self-targeted despite combining victim stun and damage; and Battle Shout 9128 plus Improved Blocking 3419 were emitted as damage packets. The same source review found wrong targeting or range for Kick 11978, Strike 11976, Backstab 15657, Chain Lightning 421, Intimidating Shout 5246, Frightening Shout 19134, and Smoke Bomb 7964.

The compiler tags parsed spells with the recipe's DBC profile and validates an exact ordered signature for every audited ID: range index, school mask, damage class, duration, effect type/aura/base/mechanic/targets/radius/misc, and period. An unmatched profile or changed signature fails generation. Unsupported utilities are omitted only after the selected profile signature matches and has no supported semantic or direct/mixed damage effect.

Utility/extra-attack ID	Removed rows	Affected definitions
674 Dual Wield	1	Stormwind Stockade
2457 Battle Stance	4	Shadowfang Keep, Stormwind Stockade, Uldaman
3391 Thrash	26	Blackrock Depths, Blackrock Spire, Blood Furnace, Deadmines, Dire Maul, Maraudon, Razorfen Downs, Scarlet Monastery, Scholomance, Shadow Labyrinth, Shattered Halls, Stormwind Stockade, Stratholme, Sunken Temple, Uldaman, Zul'Farrak
3419 Improved Blocking	1	Stormwind Stockade
6713 Disarm	7	Hellfire Ramparts, Scarlet Monastery, Shadowfang Keep, Steamvault, Stormwind Stockade, Stratholme, Uldaman
6742 Bloodlust	4	Blackrock Spire, Scarlet Monastery, Stormwind Stockade, Uldaman
9128 Battle Shout	6	Blackrock Depths, Dire Maul, Razorfen Downs, Razorfen Kraul, Stormwind Stockade
17230 Infected Wound	1	Stormwind Stockade
29651 Dual Wield	1	Stormwind Stockade

These nine exact signatures remove 51 false direct-hit rows across 20 definitions. Dual Wield is an offhand capability; Thrash adds two extra attacks; the remaining IDs are non-damaging stance, buff, block, disarm, or target-debuff effects. Those unsupported behaviors remain documented gaps.

Preserved/corrected ID	Updated rows and definitions	Generated contract
6253 Backhand	5: Stockade, Blackrock Spire	Stun remains; primary victim, melee, range 5.
8242 Shield Slam	3: Stockade, Ragefire Chasm	Mixed stun/damage remains; primary victim, melee, range 5. Existing damage multipliers remain 1.12 for mobs and 1.35 for bosses.
11976 Strike	6: Stockade, Blackrock Depths, Stratholme, Ragefire Chasm, Underbog	Weapon damage remains; primary melee, range 5.
15657 Backstab	2: Stockade, Maraudon	Direct damage remains; primary melee, range 5.
11978 Kick	5: Stockade, Scarlet Monastery, Blackrock Depths, Stratholme, Blood Furnace	Ascension's pure interrupt is primary melee for 4 seconds; the compiler's former synthetic direct hit is removed. The pinned Epoch variant adds source damage and a 6-second interrupt; its damage remains represented with the prior scalar.
421 Chain Lightning	1: Stockade	Direct damage remains; range is corrected from 28 to the sourced 30 yards. The runtime still resolves one target, so DBC chain fan-out is unsupported.
5246 Intimidating Shout	3: Stockade, Dire Maul, Slave Pens	Fear remains caster-centered at radius 8; effective source range 8.
19134 Frightening Shout	3: Stockade, Dire Maul, The Nexus	Fear remains caster-centered at radius 8; source range 10. Duration follows the selected profile.
7964 Smoke Bomb	2: Stockade, Maraudon	Stun remains caster-centered at radius 5; effective cast range 5.

The shouts' triggered secondary effects remain unsupported because they require different target sets from the caster-centered fear. Stockade controls use nearby-party, preserving all eligible party actors in the sourced radius. Rend 6547/16509 and Enrage 8599 were not changed. Rend's periodic damage and Enrage's buff values remain existing approximation gaps rather than being reclassified as direct damage.

The second-pass structural comparison used playtest-artifacts/campaign-boss-pass/catalog-before-second-source-pass.json. It found exactly the nine utility/extra-attack removals above (51 rows), 30 corrected attack rows, and corresponding mechanic-ID removals on 15 bosses. No attack was added, no other entity or encounter field changed, and no boss gained fallback surge mechanics. Damage scalars stayed unchanged except that the five pure Ascension 11978 interrupt rows no longer carry the former synthetic direct-hit multiplier.

The Ascension source is ../LadiksMPQEditor/client-current/area-52/patch-D/DBFilesClient/Spell.dbc (SHA-256 2f77f18b91ffbae32a19568e4bc05ec78ee384b6ba8dd2a6e05f0e97abbb2dce). The Epoch source used by the catalog is ../HealerMan-Storage/pipeline-work/dungeons/epoch-client/DBFilesClient/Spell.dbc (SHA-256 D5CCE1A83550DCFA9EB2F0251DBB11FD24C272534B2B1A9B230924A44D817AB3). Epoch has no sibling SpellDuration.dbc or SpellRadius.dbc, so the compiler uses its established shared patch-S fallback tables (SHA-256 EEAE44EF0185924F3D6EC57AB2701C66566DB86E51AB0BAE017A9449126EB3A0 and DBA6ED2F165F75C84DDA5F32AE46B1A01FE562EFD88FA51FD19365705C3E6A44). These are the exact duration/radius inputs used for Epoch imports, not pristine Epoch-client support tables. Profile differences are pinned separately: Epoch's three shouts use aura 99 (MOD_ATTACK_POWER); its Battle Stance and Disarm signatures have fewer aura rows; Shield Slam and Backstab use different direct-damage bases/effects; Kick includes a small damage effect and lasts 6 seconds; and 421, 5246, and 19134 have different damage or control-duration values. No Ascension-only signature suppresses an unmatched Epoch spell.

The focused test checks Stockade as an Ascension fixture and The Nexus Frightening Shout as an Epoch fixture: both receive the same sourced area target/radius, while the fallback-backed durations remain 4 seconds and 6 seconds respectively. Verification: node --check scripts/dungeon-pipeline/compile-campaign-catalog.mjs; the catalog compiler completed for 54 definitions; and npx vitest run src/game/dungeonCampaignCatalog.test.ts passed all 33 tests. The generated JSON and compressed TypeScript were refreshed. No build, browser QA, encounter tuning, or full test suite was run by this audit.

The parent independently reran 57 catalog/enemy checks and Ready-five (7 Vitest and 20 Python), verified raw/compressed catalog equality, and reproduced the exact second-pass structural diff. A separate reviewer decoded all 22 pins from both live DBC inputs and found no concrete issue. Smoke Bomb's raw range is self-only: runtime range 5 is a hostile-target gate adapted to its sourced caster-area radius 5. The final source-aware production build passed under index-CM5EW2MK.js; full-route live evidence belongs to the Stockade report.