Changelog: v0.2.0...v1.0.0

[1.0.0] - 2026-09-13

Security & Access Control

• Restricted Server Toggle Permission: /dd toggle now strictly requires operator level 2 (Commands.LEVEL_GAMEMASTERS), preventing non-operators and moderators from toggling the mod. Public telemetry access (/dd stats) remains open to all players.
• Decoupled Client Rendering Switch: Added clientRenderingEnabled to DistantDecorationsConfig. Executing /ddc toggle via DistantDecorationsClient now toggles local client-side rendering only, eliminating accidental mutation of the server masterEnabled flag during singleplayer / integrated-server play.

---

Storage Safety & Persistence

• Diagnosed Corruption Quarantine:
  • Region files with corrupt magic bytes (0x4445434F), invalid format versions, payload length mismatches, or truncated streams are moved to unique, collision-safe quarantine files (r.X.Z.dat.corrupt.<timestamp>.<uuid>) to preserve raw data for forensic recovery.
  • Invalid stored identifiers in DecorationId.readFromStream() translate IdentifierException into IOException, allowing ServerDecorationWorldIndex to quarantine malformed files rather than propagating unhandled runtime errors into chunk reconciliation.
• Quarantine Failure Overwrite Protection:
  • If moving a corrupted region file to quarantine fails (e.g., due to file locks or filesystem permission denials), the region key is added to blockedRegions and throws a storage exception.
  • getOrCreateRegion() and saveRegionToFile() strictly refuse to create or overwrite blocked regions, guaranteeing that locked or unmovable files are never overwritten with blank regions.
• Read-Error vs. Missing File Classification:
  • Replaced indeterminate Files.exists() checks with direct stream opening.
  • Non-corruption I/O errors (e.g., AccessDeniedException) are classified as READ_ERROR without quarantining, and the region is blocked from overwrite. Only confirmed file absence (NoSuchFileException / Files.notExists()) triggers new region creation.
• Atomic Move Fallback: Added fallback to StandardCopyOption.REPLACE_EXISTING when AtomicMoveNotSupportedException is encountered across different storage filesystems.

---

Lifecycle & Single-Writer Protection

• Storage-Keyed Recovery Queue:
  • ServerDecorationManager tracks failed unloads by normalized Path storageDir in pendingRecoveryByStorage rather than dimension ID alone.
  • Prevents cross-session contamination: cleanly unloading an index in one world session does not evict pending recovery state for the same dimension in another directory.
• Single-Writer Safety Guard:
  • ServerDecorationManager.openIndex() verifies whether pending recovery exists for the target directory. If flushing the pending index fails, opening a new writable index is refused (returns null), preventing split-brain data corruption.
• Server Stopping Flush:
  • ServerDecorationManager.handleServerStopping() attempts to flush all active and pending recovery indices, returning true only when all paths persist cleanly.

---

Network Streaming & Synchronization

• Network Tick Exception Containment:
  • Wrapped snapshot resolution in ServerNetworkManager.tick() with dedicated exception handling. Storage failures cannot crash the network tick, do not stream empty snapshots, and do not falsely mark regions as synced.
• Work Budget Accounting & Retry Backoff:
  • Failed snapshot loading attempts increment materializedRegions++, ensuring faulty storage calls consume the per-tick region budget (limit: 2/tick) and prevent starvation of other network tasks.
  • Failed region jobs are deferred with a 3-second retry backoff delay (FAILED_JOB_RETRY_BACKOFF_MS = 3000L) for up to 3 retries (MAX_REGION_JOB_RETRIES = 3) before abandonment.
• Subscription Eviction Cleanup:
  • When out-of-range regions are removed from desiredRegions, retry counters and timestamps are purged so that re-subscribed regions begin with a clean retry budget.

---

Build & Publication Hygiene

• Benchmark Dependency Isolation:
  • Gated optional benchmark mods (voxy, sodium, spark) into a dedicated benchmarkRuntime configuration (canBeResolved = true, canBeConsumed = false) in build.gradle, used exclusively by runIntegrationClient.
• Publication Metadata Assertions:
  • Added validation in build.gradle asserting published Maven POM (pom-default.xml) and Gradle module metadata (module.json) strictly expose only fabric-loader and fabric-api, with zero benchmark dependency leakage regardless of whether -PenableBenchmarkMods is enabled.

---

Testing & Verification

• Test Suite Expansion (53 total automated tests):
  • CommandAuthorizationRegressionTest (6 tests): Validates permission level enforcement on /dd toggle and verifies client /ddc toggle independence from server state.
  • StorageSafetyRegressionTest (13 tests): Validates dirty region retention, quarantine mechanics, quarantine-failure overwrite blocking, permission/access-denied handling, storage-path isolation, single-writer guards, shutdown flushes, and malformed identifier containment.
  • ServerStorageAndNetworkTest (8 tests): Validates per-tick work budget consumption and retry backoff delay across multi-region streaming queues.
  • DistantDecorationsIntegrationGameTest (4 GameTests): Strengthened testProviderCaptureAndPublish to verify real container block entity capture (Blocks.BARREL), payload decoding, bounding box accuracy, and revision invariance.

Full Changelog: https://github.com/justbecauseph/distant-decorations/compare/v0.2.0...v1.0.0