Complete runtime parity and remaining live acceptance branches

NEXT THREAD: remaining work — partial delivery, do not close

PR #88 was merged into develop on 2026-10-22 at 12:49 UTC after all PR CI checks passed (merge commit bce37e14cc634d2ae45cc7e4428e82c141713c56). It does NOT complete PAR-502 or parent PAR-499. Keep both open. Continue the checklist below in the next thread, starting from develop at or after that merge. Do not re-implement the completed work listed farther down.

Remaining acceptance, in priority order

• Finish source-by-source behavioral review. The 587-entry annotation inventory is not exhaustive review. Cover remaining Treasury/Business commands and aliases, individual permissions, offline/console/contextual variants, configuration branches and scheduled jobs. Strengthen weak list/info/header-only assertions. Resolve partial-disband destination/concurrent-ownership policy, transaction export/audit boundaries, and actual tax/salary downtime journeys.
• Finish real integration branches (PAR-496). Nexo metadata/dye variants and reload behavior; Bolt owner/access/protection combinations; BreweryX unsealed-brew behavior; VaultStorage capture/removal; other combinations in the matrix. Available local JARs are not unavailable and loading them is not full behavioral acceptance.
• Fix/retest the external Utilities 3.0.0 reload defect. Its reload command reads YAML but omits ShopPermissionManager.reload(), leaving old restrictions active. Red run: 20261022T095004Z-3048952. UtilitiesReloadTest retains the failing assertion with a named PAR-496 disable. Obtain a corrected provider artifact, remove the disable and rerun; startup-loaded restriction coverage is a separate pass.
• Complete genuine manual/artifact prerequisites. Graphical Nexo model/dye/resource-pack fidelity needs a graphical Minecraft client and an authorized pack; the mock protocol client cannot certify rendering. No standalone TreasuryIngest JAR was found in the bounded clone/workspace search: supply it and execute the three explicitly skipped ingest cases. Do not substitute the diagnostic stub or copy private clone assets/credentials.
• Finish group and identity edge cases. Same-selector concurrent publication and remaining stale/concurrent interleavings; actual elapsed lease expiry (current evidence models expiry by moving the timestamp); Keycloak/identity-provider role changes. Binding retarget/removal, provider failure, scoped DB publication failure, manual-grant independence and browser revocation already have evidence.
• Finish lifecycle/game combinations. DB outage/recovery, configuration reload failure, in-flight crash atomicity, remaining REST recovery boundaries, chunk unload/WorldEdit cleanup, business-role container/automation variants, richer finder/custom-item combinations and metrics rollover. SIGKILL coverage is after an explicit saved checkpoint and committed trade, not an in-flight atomicity guarantee.
• Reconcile deployed runtime and final acceptance. Disposable Java 25/Paper 26.3/protocol 777 parity is proven for the recorded journeys; staging deployment and Bedrock behavior remain separate. PR #88 includes the still-unmerged PR #80 runtime commits; reconcile that overlapping workstream. After follow-up changes, run applicable profiles twice clean, with exact source/runtime/counts/skips/durations and preserved failures. The full core pair below predates later focused additions and is not a final-tree full rerun.

Already implemented and verified in PR #88

Commit: 4c70ece1. Full evidence, reproduction, hashes, failed attempts and limitations. Current acceptance matrix.

• Reuses PR #80 through 8847227e: Java 25, Paper 26.3 build 206, protocol 777, tick-end packets, game-time parsing, dependency updates and Recharts 3 compatibility.
• Fixes stale-binding membership deletion, cached rolled-back Vault SYSTEM wallet IDs, and Explorer's generated Auth.js ID being mistaken for Keycloak's stable subject.
• Adds real Realty/Vault permission/failure/success and scheduled owner publication; native Nexo selling/identity rejection/failed-payment recovery; Utilities startup restriction denial/grant with real Bolt/BoltChestShop/BreweryX co-loaded.
• Adds REST process restart/idempotent replay/token revocation, saved-checkpoint crash recovery, contextual balance-alias checks, expanded group scheduler and publication-failure cases.
• Same-stack Chromium verifies business/market/tax pages. Real Minecraft-realm login is now complete for the tested flow: two real logins, stable signed subjects and Minecraft claims, durable identity links, in-game proprietorship transfer, and old/new access reversal in unchanged sessions. Both temporary realm users and the local credential file were deleted; no realm/client settings were changed. Do not list real login or the current/revoked proprietor flow as still blocked.

Verification and handoff constraints

• Full Java 25 build passed. Core passed twice with 747 passes / 19 skips per run, before the later focused additions.
• All recorded applicable profiles have clean pairs; providers: 3 passes / 1 named external Utilities reload skip per run. Standalone ingest remains explicitly skipped.
• Real Keycloak profile: 1 browser journey / 0 skips per run, 125.64s / 121.30s, evidence 20261022T102700Z-3135919, source fingerprint a0f9e8d23b3340b241cb2641c656ccfdeb4f6bff72464d23555cd3cdb54228dd.
• Explorer: 167 unit tests, typecheck, lint and production build passed. Four acceptance-runner tests passed.
• Local evidence remains in build/integration-acceptance/; source snapshots and investigation notes in .context/par-502/. The committed report has the complete directory/hash table. The temporary Keycloak identities must be recreated for another real-login run; credential fixture requirements are documented.
• No failed assertion was retry-masked. Preserve the observed failures and do not weaken gates. Each unresolved feature needs executable evidence or a specific genuine blocked/manual reason with a linked task.
• No successful product screenshots were retained for the partial PR; browser assertions are not a substitute for missing visual pack/chart verification.

<details> <summary>Historical scope and baseline before PR #88 (retained for context; the checklist above is current)</summary>

Status reconciliation — 2026-10-22

Runtime-parity work is underway under ADT-193 in draft PR #80. GitHub confirms Java25/Paper26.3 harness/build updates with full live acceptance unfinished. Latest ADT-193 comments identify missing mock-client tick-end packets and an owned movement regression/repair. Reuse that workstream; remaining integration, permission, browser and lifecycle acceptance below stays open.

---

Continue PAR-499 after PR #76, merged into develop at 18fa4e7e86b1a3a18bbe9fc8bcccc54b6d77ae3c on 2026-10-22 01:39 UTC. Keep PAR-499 open: the existing suite and reviewed matrix make substantial progress but do not establish exhaustive acceptance.

Use the current source inventory and explicit gaps in matrix.md and its linked route/REST reviews. Preserve exact balances, paired postings, inventory and access assertions; exercise real entry points and demonstrate fault detection for new high-risk tests.

Remaining work, in priority order:

1. Reconcile actual staging runtime (ADT-193: Paper 26.3/protocol 777/Java 25) with the disposable profile (Paper 1.21.11/Java 21). Upgrade the mock client/profile together and prove the same critical money/access journeys on the deployed runtime. Do not silently treat the earlier protocol as deployment certification.
2. Extend real integrations beyond the narrow Nexo purchase/identity-rejection profile: custom-item selling, metadata/dyes, reloads, resource-pack rendering, Utilities/BreweryX/Bolt and other provider/protection combinations (PAR-496), real Realty/Vault money/access flows, and the missing standalone ingest plugin. Compatible Nexo 1.29.1 is available locally and the real nexo profile passed ordinary-material rejection and native-item purchase twice; do not describe all licensed artifacts as unavailable. Realty and VaultStorage artifacts are also present on the clone but require Java 25 (class major 69), with Realty declaring API 26.1.2. Build compatible isolated profiles without copying clone credentials/assets or treating a stub as acceptance.
3. Finish source-by-source review of remaining commands, aliases, permissions/configuration branches and scheduled jobs. The 587-entry annotation index is an inventory, not a claim of reviewed behavioral coverage. Prioritize Treasury/Business routes still in the review queue, offline/console/contextual permission variants, partial-disband destination policy, transaction export/audit boundaries and tax/salary schedules across downtime.
4. Extend scheduled Explorer group acceptance to binding retarget/removal, lease expiry, provider/database failures and stale/concurrent publication; prove browser authorization reflects revocation. Existing groups profile covers production Business publication, offline FINANCIAL/ADMIN staff, archival, manual-source preservation and missing-Realty isolation, with disabled-scheduler fault detection.
5. Broaden same-stack browser journeys beyond balance/history: business/market/tax pages, real Keycloak login and role changes, and current-owner versus revoked-owner sessions. Keep signed test sessions distinct from real identity-provider acceptance.
6. Complete game/lifecycle combinations recorded in the matrix: crash and REST restart recovery, DB outage/recovery, configuration reload failures, chunk/WorldEdit cleanup, business-role container/automation branches, richer finder/custom-item combinations and metrics rollover.

Acceptance: every remaining feature has reviewed executable evidence or a specific blocked/manual reason and linked task; critical available integrations have success/denial/failure coverage; all applicable profiles pass twice consecutively from clean state, with exact head/runtime/duration/test/skip evidence. Preserve failure observations and do not retry-mask them or weaken CI gates.

Completed baseline: final tested head 91ff8dce4fb09ff95195c5b0516d631327d4417e passed all CI checks and all eight profiles twice from clean state. Core: 743 passes and 15 explicit profile/ingest skips per run; protection 4, restart 1, tax 6, groups 1, webhook-failure 2, same-stack Chromium 1, and real Nexo 1 passed per run. Exact durations and commands are in PR #76 and integration-tests/acceptance/results.md; final local artifacts remain under build/integration-acceptance/. Three standalone-ingest cases remain unavailable. No failed assertion was retry-masked. One zero-test startup attempt exceeded MariaDB's Unix-socket path limit; shortening the disposable work path fixed it. Keep custom work paths below that limit (or improve the runner's diagnostic).

The original twelve product-defect areas are fixed and regressions enabled. Later reconciliation also fixes released-firm default-account naming and sole-name ownership transfer (additive V41). Develop's PR #77 supplies the shared V38/V39/V40 collision repair. Read-only clone inspection confirmed taxation V38 was the only applied colliding migration; no clone SQL repair or mutation was necessary.

Preserve the existing framework and its eight profiles. Supply IT_NEXO_JAR for --profile nexo; ordinary CI still uses the labeled stub. The real-plugin artifact tested was Nexo 1.29.1, SHA-256 66c38e677d19bf45d43b744b8a5d4914cd2ea68c40f082e8f1d779fd363326cc. Do not copy clone secrets or private resource assets into the repository.

Post-merge verification also completed successfully: develop push CI and automatic release-PR CI are green for merge commit 18fa4e7e. CodeQL and all automatic plugin/API/container publishing workflows succeeded. Develop's tree was confirmed identical to the locally tested 91ff8dce tree.

</details>