Project Status

Current state only. History → sessions/; changelog → version.md.

Version: 1.4.3 (source of truth: repo-root VERSION). Released: v1.1.0 → v1.2.0 (Brigadier commands) → v1.3.0 (naming + quality gates) → v1.3.1 (package → io.fairyfox.papermc.despawneditems) → v1.3.2 (docs site wears the shared fairyfox chrome, bundle v2.2.1) → v1.3.3 (full standards audit: nav/subnav corrected, Downloads page, mandatory branch protection + PR releases, provenance attestation) → v1.3.4–1.3.6 (docs-site fixes: rendered notes/README pages, self-hosted legal pages + Legal subnav) → v1.3.7 (badge wall + supply-chain/quality tooling parity with random-ai-prompt) → v1.4.0 (full-layer test suite 44%→~95% Kover-gated ≥90, 3 bug fixes found by it, /despi recycle + renameable commands, CodeQL restored on Kotlin 2.4.0) → v1.4.1 (server + client layers automated in CI: Testcontainers MariaDB, headless Paper 1.21.11 + 26.1.2 smoke, Mineflayer in-game acceptance; Sonar CI scan wired) → v1.4.2 (123-node permission matrix, combined load + throughput proofs, Kotest/Pitest/JMH adopted, spark+JFR profiling) → v1.4.3 (docs/process: the "Owner Mandates Become Ledgers" standing instruction + mandate-execution failure analysis). Artifact/plugin-id/data-folder are all papermc-despawned-items.

Release path (since 2026-07-20): main is branch-protected — releases go through a PR (gh pr create --base main → checks green → gh pr merge --merge → back-merge git merge --ff-only main on dev). Direct dev → main pushes no longer work. Tags stay by-hand (CI does not own tagging). Full audit: notes/plans/standards-audit-2026-07-20.md.

Ship contract (since 2026-07-21, enforced in CLAUDE.md): a "ship"/release, by default and every time, also (a) drives OpenSSF Scorecard toward its max / never below the ≥ 7.0 floor, (b) removes tech debt (no stale dep PRs, no deprecation warnings, Quality Bar intact), and (c) triages + handles every open PR (merge or close-with-reason). Phase by default: any owner/fairyfox request — or a self-set task — is broken into as many phases as needed. Worked example: notes/plans/mandate-2026-07-21-ship-contract.md.

Full-CI gate (owner 2026-07-21) — now platform-enforced. No merge to main until the entire CI suite is green on the release PR. As of 2026-07-22 main's required status checks are: build, Analyze (java-kotlin), Server smoke (Paper 1.21.11), Server smoke (Paper 26.1.2), In-game client smoke (Mineflayer), with strict up-to-date — so GitHub itself blocks a merge unless all of them pass. A green local ./gradlew build is necessary but not sufficient (the v1.4.4 PR proved it: local build green, but server-smoke caught a runtime sqlite-jdbc version absent from Paper's library-loader mirror).

OpenSSF Scorecard: 7.1 (2026-07-22, up from 6.9). Lift came from Signed-Releases (0→2, provenance .intoto.jsonl release asset) + Binary-Artifacts (9→10). Remaining headroom (logged in the mandate ledger): npm lockfile for Pinned-Deps, more releases for Signed-Releases; Code-Review/Contributors/CII/Fuzzing are solo-capped.

Current state (read this first)

Major refactor largely complete (2026-07-20) on dev — see notes/plans/refactor-2026-07.md (plan) and notes/version/2026-07.md (per-commit log). The plugin was modernised beyond the API: new indexed data model, pluggable storage, a throttled pipeline, permission-based limits, and a real test suite.

Done on dev (all green, CI passing):

• Retargeted Paper 26.1/Java 25 → Paper 1.21.11 / Java 21 (foojay auto-provisions the JDK); existing code compiled with zero API changes.
• Correctness fixes: /recycle rewards (now PDC), particle-data crashes, stale static strategy list, RemoveMaterials IOOBE, /despi reload now re-reads config.
• Scale: indexed LocationStore (O(1) lookups), incremental off-thread persistence, throttled DespawnScheduler.
• Storage backends: YAML (default) + SQLite + MySQL/MariaDB (HikariCP, runtime libraries:), with YAML→DB migration.
• Limits: per-user caps via despi.limit.<n> group permissions + bypass.
• Tests: JUnit 5 + MockBukkit suite (unit, property/fuzz, database, performance, mocked-server integration) — ~49 tests, gating build; CI green on dev.
• Docs/branding: display name → "PaperMC Despawned Items", rewritten README, filled context notes, GitHub Pages Dokka workflow (deploys on release to main).

Next

• Consider a Brigadier command rewrite (optional polish; current commands work + tested).
• ~~Headless runtime smoke + forward-compat + in-game test~~ ✅ automated in CI (v1.4.1).
• ~~Account-gated badges~~ ✅ owner uploaded CODECOV_TOKEN / SONAR_TOKEN / SCORECARD_TOKEN (2026-07-21); Codecov + Sonar scans wired in ci.yml, CodeFactor active (it checks PRs). Remaining owner-side: if the Sonar CI scan reports an Automatic-Analysis conflict, disable Automatic Analysis on the SonarCloud project (Administration → Analysis Method) — mutually exclusive with CI scans.
• Hub registration (hub-side; incl. registry docs:/repo: check — audit item #23) and Hangar project + HANGAR_API_TOKEN secret — then uncomment the Hangar/Modrinth usage badges in README.md and wire the release-publish workflow (hangar-publish-plugin / mc-publish).
• Follow-ups from the standards audit: themed Changelog/Tutorials pages, vendored fox icon (see plans/future.md).

Health