# 实现与验收状态 / Implementation status

本文描述当前源码边界，不是发布承诺。`implemented` 表示存在可执行代码；只有完成四个目标版本的专服启动、原版客户端握手、正常停止和数据库重启恢复后，版本才可标记为 production-ready。

This document describes the current source boundary, not a release promise. `Implemented` means executable code exists. A version is production-ready only after dedicated-server start, vanilla-client handshake, clean stop, and database restart/recovery pass on all four targets.

| Area / 区域 | Current state / 当前状态 | Outstanding gate / 剩余门槛 |
|---|---|---|
| Neutral API, policy and domain core / 中立 API、策略与领域核心 | Implemented on Java 17, with deterministic tests / 已按 Java 17 实现并有确定性测试 | Forge facts and runtime behaviour still require per-version integration tests / 仍需逐版本验证 Forge 事实提取与运行行为 |
| Forge command policy / Forge 命令策略 | Brigadier analysis, multiple independently enabled named groups, explicit low-permission grant reparse, selectors/items, recursive `execute run`, function controls, and atomic hot publication / 已实现多命名策略组、独立启停及原子热发布 | Dedicated-server command matrix and mod-command compatibility suite / 专服命令矩阵及第三方模组命令兼容测试 |
| Web authentication / Web 认证 | First-owner bootstrap, Argon2id, TOTP/recovery codes, account-wide three-attempt/ten-minute second-factor throttling, session revocation, login rate limits, Origin/CSRF, recent reauthentication, and owner-gated multi-account RBAC UI/API / 首位 owner、二次认证、按账户统一的十分钟三次二要素限速、会话与多账户 RBAC UI/API 已实现 | Deployment penetration testing and durable idempotency across process restarts / 部署渗透测试及跨进程重启的持久幂等 |
| Status and online players / 状态与在线玩家 | Live status DTO/SSE, player detail/actions, destructive preview token, inventory and ender-chest revision CAS, and Web workflows / 状态、玩家操作、预览确认及背包界面已实现 | Four-version gameplay/disconnect races; component-bearing slots are redacted and fail closed except deletion / 四版本实机与掉线竞态；含组件槽位除删除外故障关闭 |
| Player join experience / 玩家入服体验 | Legacy welcome, bulletin, rules and maintenance notices migrate idempotently into ordinary triggers; timezone and per-player/day delivery state remain durable / 旧欢迎、每日公告、规则及维护提醒会幂等迁移为普通触发器，时区与按玩家每日投递状态持久化 | Dedicated-server rendering, localization and reconnect-storm acceptance / 专服显示、本地化与重连风暴验收 |
| Trigger automation / 触发器自动化 | Durable trigger groups, unrestricted authoring depth/node count, recoverable leased daily/interval schedules, broad Forge player/item/block/entity/world/chunk events, ALL/ANY comparisons, ordered actions, visual authoring, XFE Script, scoped trigger/global variables with recursively nested typed containers, module copy/paste, optimistic revisions, bounded runtime execution, audit admission, rich-message validation, and idempotent migration of legacy messages / 已实现持久触发器组、编辑节点数与嵌套层级不限、可恢复租约定时任务、广泛 Forge 事件、条件与顺序动作、可视化和脚本双编辑、递归嵌套强类型容器变量、模块复制粘贴、版本控制、有界运行时执行、审计准入、富文本校验及旧消息迁移 | Dedicated-server event/action matrix on all four targets; third-party events beyond stable Forge hooks depend on custom adapters / 四版本专服事件动作矩阵；稳定 Forge 钩子之外的第三方事件依赖自定义适配器 |
| Crash protection / 崩服防护 | Hot-reloadable loaded-entity/chunk/namespace limits, dropped-item cleanup, spawn-burst and command-block circuit breakers, slow-tick/heap signals, nine trigger events, variable catalog and Web settings / 已接通可热更新的实体、区块、命名空间上限，掉落物清理、生成与命令方块熔断、慢刻/内存信号、九类触发事件、变量目录及 Web 设置 | Four-version dedicated-server stress tests with vanilla and Create workloads; thresholds require per-pack tuning / 仍需四版本专服原版及 Create 负载压测；阈值需按整合包调优 |
| Multi-currency economy / 多货币经济 | Exact fixed-point balances, configurable currency icons/precision/bounds, one primary currency, atomic CAS adjustments/transfers, immutable ledger, Web UI, player commands, OP-only balance administration commands, SSE, RBAC, audit admission, event-player and arbitrary-player trigger actions/events/variables, and menu-variable/image linkage / 已接通精确定点余额、图标/精度/边界、主货币、原子 CAS 调整与转账、不可变流水、Web、玩家指令、仅 OP 可用的余额管理指令、SSE、权限、审计、事件玩家及指定玩家触发器操作与菜单联动 | Dedicated-server concurrency/load tests, UX acceptance and third-party economy compatibility adapters / 仍需专服并发压力、交互验收及第三方经济模组兼容适配 |
| Audit and operations / 审计与操作 | Redaction, bounded SQLite queues, operation registry, SSE progress, checkpoint and gap accounting / 已实现 | Soak/load tests, crash-boundary validation, and explicit verification of the queue-admission durability boundary / 长稳压力、崩溃边界及队列准入持久性边界验证 |
| Metrics, webhook and soft probes / 指标、Webhook 与软检测 | Token-protected OpenMetrics formatter/endpoint, HMAC webhook sink, Spark/BlueMap presence probes / 部件已实现 | Outbound webhook configuration wiring and third-party API integrations / 出站 Webhook 配置接线及第三方 API 集成 |
| Graceful maintenance shutdown / 优雅维护关服 | Creation-time target notice, five-minute final-hour reminders, per-second final-minute countdown, `save-all flush`, SQLite checkpoint and vanilla stop are wired / 已接通创建提醒、末小时五分钟提醒、末分钟逐秒倒计时、保存、检查点与原版停服 | Dedicated-server shutdown ordering and failure-injection acceptance / 专服关停顺序与故障注入验收 |
| v2 moderation and schedules / v2 处罚与计划 | Durable cases, warn/mute/kick/(temp)ban, revoke, join/chat enforcement, maintenance admission, announcements and structured schedules are wired to REST/Web / 案件、处罚撤销、进服与聊天执行、维护、公告和计划任务已接通 | Vanilla ban-list reconciliation and third-party chat-mod compatibility matrix / 原版封禁列表对账及第三方聊天模组兼容矩阵 |
| v2 claims / v2 认领 | Quota/adjacency/member snapshots, CAS Web CRUD, break/place/interact/entity/explosion enforcement and piston/fluid boundaries are wired / 配额、相邻、成员、CAS 管理及 Forge 行为保护已接通 | Gameplay matrix across all four targets and richer player self-service commands / 四版本实机矩阵及更完整的玩家自助命令 |
| v2 world tracking and rollback / v2 世界追踪与回滚 | Segmented SQLite journal, Forge block/entity/item/explosion capture, container Mixin, codecs, chunk tickets, fixed-watermark preview, conflict skipping, pause/resume and redo are wired / 世界日志、Forge/Mixin 捕获、codec、区块票、预览、冲突跳过、暂停续跑与 redo 已接通 | Soak, disk-exhaustion, mod-removal and crash-resume acceptance; item despawn coverage remains partial / 长稳、磁盘耗尽、模组缺失与崩溃续跑验收；物品自然消失覆盖仍不完整 |

## Fail-closed boundaries / 故障关闭边界

- A control-database migration failure disables HTTP and every write path, then attempts a migration-free, SQLite read-only load of the checksum-validated ACTIVE (or newest published) policy. Existing `DENY`/`CONSTRAIN` rules continue when recovery succeeds; `GRANT` remains denied because the bounded audit writer is unavailable. / 控制库迁移失败会关闭 HTTP 与全部写路径，并以 SQLite 只读、无迁移方式恢复经校验的 ACTIVE（或最新已发布）策略；恢复成功时继续执行 `DENY`/`CONSTRAIN`，`GRANT` 因有界审计写队列不可用而保持拒绝。
- A privileged in-game command is denied unless its audit event is accepted by the healthy bounded SQLite writer queue. Disk completion is asynchronous so the server tick never waits for I/O; an I/O failure marks the store unhealthy and rejects later grants, but this does not claim an `fsync` happened before the admitted command executed. HTTP account mutations do await their admission write off the Minecraft thread. / 游戏内提权命令只有在审计事件被健康的有界 SQLite 写队列接收后才执行；为避免 tick 等待 I/O，落盘异步完成，I/O 失败会将存储标记为异常并拒绝后续提权，但不声称该命令执行前已经完成 `fsync`。HTTP 账户变更则会在非 Minecraft 线程等待准入记录写入完成。
- Multi-slot inventory writes and non-deletion edits to slots containing opaque NBT/data components are rejected; the current cross-version bridge does not claim reversible component editing. / 多槽背包写入，以及对含不透明 NBT/Data Components 槽位的非删除编辑都会被拒绝；当前跨版本桥不承诺可逆组件编辑。
- Optional v2 routes remain disabled until their explicit configuration flags are enabled and the governance runtime is healthy. / v2 路由只有在显式配置开关启用且治理运行时健康时才开放。
- Web settings atomically hot-apply runtime-safe feature switches and the inherited default message sender. Migrated message fields are read-only there and editable only through triggers; listener/proxy/executor/session/OpenMetrics startup changes continue to require an audited graceful restart. / Web 设置会原子热加载运行时安全的功能开关和可继承的默认消息发送者；已迁移消息字段在此只读且只能通过触发器编辑，监听、代理、执行器、会话和 OpenMetrics 启动项仍需审计后的优雅重启。
- The repository registers no client-required blocks, items or custom network payloads. This supports the server-only design, but does not substitute for real handshake testing. / 仓库不注册客户端必需方块、物品或自定义网络负载，但这不能替代真实握手测试。