Align supported server settings with vanilla 1.21.4

AGENTS.md

@@ -65,6 +65,7 @@
 - PR には変更理由、対象範囲、テスト手順、既知の制限、必要な証跡を記載し、レビュー可能な小さな単位に分ける。サブエージェントの変更も同じPRに統合してから提出する。
 - PR作成後は `.github/workflows/` の GitHub Actions を必ず実行し、必須ジョブ（configure/build、対象テスト、lint/quality checks）が成功するまで修正と再実行を行う。Actions が未実行・失敗・キャンセルのPRはマージしない。
 - マージ、rebase、release向けタグ付けは GitHub 上のPR保護ルールとActionsの成功結果を通して行う。ローカルの `git merge` は検証用worktree内に限り、`main` の統合手段にはしない。
+- **条件付きマージ方針（全PR共通）**: このリポジトリのPRは、全差分をレビューしたうえで実装品質に確信があり、重大な未解決の正確性・セキュリティ・データ保全上の懸念がなく、当該head SHAの必須Actionsとブランチ保護条件がすべて成功している場合に限り、GitHub経由でマージしてよい。レビューコメントや競合などの未解決条件がある場合、または品質に確信が持てない場合はマージせず、懸念点を報告する。積み上げPRでは対象PRの指定baseにのみ統合し、親PRや `main` への統合は別途そのPRを評価してから行う。
 - ローカルのビルド・テストはPR提出前の短時間な検証として実施してよいが、GitHub Actionsの結果を置き換えない。Actionsで再現できない結果はPR本文にコマンド、ログ、環境、制限を明記する。
 - Actions設定やPR保護ルール自体を変更する場合も、別PRでレビューし、変更前後のActions実行結果を保存する。秘密情報・トークン・個人環境の設定をリポジトリへ書き込まない。
 

CMakeLists.txt

@@ -716,6 +716,11 @@ target_include_directories(test_settings_matrix PRIVATE src src/generated)
 add_test(NAME settings_matrix COMMAND test_settings_matrix)
 set_tests_properties(settings_matrix PROPERTIES TIMEOUT 30)
 
+add_executable(test_secure_chat_policy tests/test_secure_chat_policy.cpp)
+target_include_directories(test_secure_chat_policy PRIVATE src)
+add_test(NAME secure_chat_policy COMMAND test_secure_chat_policy)
+set_tests_properties(secure_chat_policy PROPERTIES TIMEOUT 30)
+
 # Version-pinned Play S→C ID locks plus selected field/order vectors. This is
 # broad wire coverage, not an exhaustive proof of every packet payload branch.
 add_executable(test_wire_full tests/test_wire_full.cpp

README.md

@@ -116,10 +116,7 @@ The latest recorded runs include:
   limitations remain as listed above.
 - The explicit no-JNI configure/build and its `42/42` non-package CTest set,
   plus the four-binary ASan/UBSan key set
-  (`core_safety`, `spec_wire`, `fuzz`, and `gameplay_full`) also pass. The safe
-  Plan54 cleanup is partial: the protected-scope ledger is reproducible, but the
-  strict 18,341-line reduction target was not reached and no tests or fixtures were
-  removed to claim it.
+  (`core_safety`, `spec_wire`, `fuzz`, and `gameplay_full`) also pass.
 - Real-client check: the mc-pilot-managed Fabric 1.21.4 client logged in offline,
   entered the world, stayed connected for more than one minute, and completed
   chat, `say`, position, block read/break/read, status, and screenshot probes.
@@ -249,9 +246,26 @@ extension surface, not a copy of the official Minecraft server or a promise
 that every Fabric mod can run unchanged. It does not ship the official Mojang
 GameProvider, client, or GUI runtime.
 
-Connect with a Minecraft 1.21.4 client in offline mode, for example by using a
-launcher profile pointed at `127.0.0.1`. The production default is normal terrain;
-set `level-type=flat` explicitly when a creative superflat fixture is wanted.
+On its first launch, cppfm creates `server.properties` with the supported
+vanilla-facing Minecraft 1.21.4 defaults, including `motd=A Minecraft Server`,
+`difficulty=easy`, `view-distance=10`, an empty `level-seed`,
+`online-mode=true`, and `enforce-secure-profile=true`. An empty seed selects a
+random seed for a new world; a saved world's seed is retained from `level.dat`.
+Existing `server.properties` files are preserved.
+Normal startup therefore expects clients to authenticate and satisfy secure
+profile enforcement, as they do when joining a vanilla online-mode server.
+
+For an intentionally offline local test, launch with both authentication
+checks disabled and point an offline launcher profile at `127.0.0.1`:
+
+```bash
+./build/cppfm --online-mode=false --enforce-secure-profile=false
+```
+
+Both options must be explicit for offline clients; this is a development/test
+mode, not the compatibility-oriented default. The default world uses normal
+terrain; set `level-type=flat` explicitly when a creative superflat fixture is
+wanted.
 
 ## Running tests
 

docs/CURRENT_STATE.md

@@ -34,7 +34,7 @@ handoff notes are not part of the public documentation set.
 | `research_viewpoints` | `16` current viewpoints; old `13` wording is historical |
 | `taxonomy_snapshot` | MISSING `#1–#90`; historical matrix counts `DONE=90, PARTIAL=0, TODO=0` |
 | `strict_assessment_1` | `78 gaps`; `HISTORICAL` archive label, not a current aggregate |
-| `next_plan` | close current PR #1 gates; the local plan55 protocol-primitive follow-up is implemented, while plan56 server.properties audit research remains to be implemented and verified |
+| `next_plan` | submit the locally validated vanilla 1.21.4 server.properties compatibility follow-up as a PR stacked on PR #1, then resolve any exact-SHA Actions failures before merge; the property surface remains explicitly partial |
 
 The previous baseline was the plan50 runtime follow-up after the plan49 implementation integration and cleanup commit
 `db12df96093a0869e958f62b11f9a9cd68ba3ef1` and safety commit
@@ -45,11 +45,12 @@ for binaries built with the required JNI inputs, without changing generated data
 protocol 769, or the `docs-legacy/` archive. The
 plan51 implementation and its no-ff integration are recorded above.
 
-## 1A. Current working-tree verification
+## 1A. Working-tree verification baseline (2026-09-19)
 
-The following evidence is from the current uncommitted working tree after the
+The following evidence is from the 2026-09-19 working-tree snapshot after the
 settings/security/authority hardening pass. It supersedes neither the historical
-`335fca5` baseline above nor the declared release boundaries below.
+`335fca5` baseline above nor the declared release boundaries below, and it is not
+the result of the separate plan56 compatibility follow-up in §1C.
 
 | gate | measured result | scope / limitation |
 |---|---|---|
@@ -88,6 +89,32 @@ MISSING #71's row-specific evidence is now `PASS` in the 90-row coverage ledger
 (`14 PASS`, `38 PARTIAL`, `38 UNVERIFIED`). This does not remove the independent
 publication boundaries below or imply universal protocol parity.
 
+## 1C. Vanilla 1.21.4 settings compatibility follow-up (2026-09-23)
+
+This work is on branch `plan56/compatibility`, based on PR #1 head
+`26e399c0`, and is submitted as stacked PR #2; it is not yet part of `main`.
+The result changes vanilla-facing defaults and property interpretation while
+keeping unsupported properties declared as unsupported.
+
+| gate | measured result | scope / limitation |
+|---|---|---|
+| RelWithDebInfo configure/full build | `PASS` | Full Ninja build completed in the integration worktree; all commands had explicit timeouts |
+| defaults, whitelist key, difficulty IDs, and signed integers | `49 PASS / 0 FAIL` | `settings_matrix`; vanilla online/profile defaults, view distance, MOTD, difficulty, random new-world seed, canonical `white-list`, source-order alias behavior, difficulty IDs `0..3`, leading `+`, and malformed doubled signs are covered |
+| Java Properties parsing and configuration | `64 PASS / 0 FAIL` | `properties`; separators, escapes, continuations, key case, UTF-8/ISO-8859-1 fallback, Java boolean semantics, CLI precedence, and rejection of malformed `+-` integers; isolated UTF-16 surrogates map to U+FFFD in the UTF-8 API |
+| effective secure-chat policy | `12 PASS / 0 FAIL` | `secure_chat_policy`; status and Join Game share the effective policy, `enforce-secure-profile || enforces-secure-chat`; unsigned-after-session behavior remains unverified |
+| fake-client authentication options | `PASS` | source guard and Python syntax checks cover local fake-client launchers; each offline launcher explicitly disables both online mode and secure-profile enforcement |
+| full non-nightly CTest | `55/55 PASS` | 516.24s on pre-review head `5eb101d1`; exact-SHA Actions must also pass for PR #2's current head; command and scope in [VERIFICATION.md](VERIFICATION.md#vanilla-server-settings-compatibility-follow-up-2026-09-23-pre-merge) |
+| server child cleanup | `PASS` | post-suite `pgrep -a -f 'cppfm --por[t]'` found no remaining `cppfm` server process |
+| remaining property parity | `PARTIAL` | `enforce-whitelist`, query/status/network, permission, datapack, and several world/pack/operations effects are not fully implemented; `ServerProperties::save` is not `Properties.store`-compatible |
+
+Additional exploratory offline Python runs reported failures identical on the
+unmodified parent binary: replay `5/8` (signed `n=0` command, sign block-entity
+update, survival ability flags), `run_plan43_suite.py` `10/23` (signed chat,
+damage, horse IDs, join flags, and sign placement/text), and short soak-bot runs
+with `0` chunks against an expected minimum of `10`. These checks have no
+retained per-run logs and are not part of the passing CTest aggregate; the C++
+`plan43` target separately passes `87/87`.
+
 ## 2. Prior plan48 and cleanup record
 
 | item | state at this tracker | evidence / scope |

docs/DEVELOPMENT.md

@@ -133,7 +133,7 @@ contracts:
   secure-chat policy requires it. Signed command argument transcripts are not
   reconstructed and therefore fail closed instead of dispatching.
 
-The final implementation evidence is `test_settings_matrix` (25/25),
+The 2026-09-19 final-gate baseline recorded `test_settings_matrix` (27/27),
 `test_properties` (33/33), `test_recovery` (55/55), `test_core_safety` (45/45),
 Plan43 (87/87), smoke80 (224/224), the full live matrix (240/240), and the
 non-nightly CTest aggregate (46/46). The 120-client stress, 300-second soak,

docs/MISSING_FEATURES_1_21_4.md

@@ -20,7 +20,7 @@
 - `strict_assessment_1_gap_count: 78` is a separate historical audit label. Its
   archive result is not a current aggregate, and it must not be added to or
   substituted for the 90-row taxonomy count.
-- Current publication state is `BLOCKED` only by the declared scope/evidence
+- At the 2026-09-19 source snapshot, publication state was `BLOCKED` by the declared scope/evidence
   boundaries: the final focused matrices report `settings 27 PASS / 0 FAIL`,
   `properties 33 PASS / 0 FAIL`, `recovery 55 PASS / 0 FAIL`, and
   `core_safety 45 PASS / 0 FAIL`; Plan43 reports `87 PASS / 0 FAIL`; smoke80
@@ -38,16 +38,16 @@
   properties `33 PASS`, and the live server matrix `240 PASS / 0 FAIL`.
   Older duplicate timings are `HISTORICAL` context only.
 
-## Current working-tree hardening evidence
+## Working-tree hardening baseline (2026-09-19)
 
 This section records the later uncommitted verification pass without changing the
 historical numbered taxonomy.
 
 | concern | current result | evidence / declared boundary |
 |---|---|---|
-| server settings and precedence | `PASS` | `test_settings_matrix`: `27 PASS / 0 FAIL`; invalid values retain prior fields, textual/numeric seed semantics are distinguished, secure-profile and secure-chat settings remain separate, and unsupported keys are reported |
+| server settings and precedence | `PASS / SUBSET` | 2026-09-19 baseline `test_settings_matrix`: `27 PASS / 0 FAIL`; invalid values retain prior fields, textual/numeric seeds are distinguished, stored secure-profile and cppfm secure-chat settings remain separate, and unsupported keys are reported. The 2026-09-23 compatibility follow-up is recorded in [CURRENT_STATE.md §1C](CURRENT_STATE.md#1c-vanilla-1214-settings-compatibility-follow-up-2026-09-23): `49` settings, `64` properties, and `12` secure-chat-policy assertions pass, with the full settings surface still partial. |
 | command/authority and inventory boundaries | `PASS` | `test_properties`: `33 PASS / 0 FAIL`; full live matrix: `240 PASS / 0 FAIL`; Plan43: `87 PASS / 0 FAIL`; op-gated roots, one-shot trigger enablement, creative/range/sign/beacon/pick checks, source-dimension item commands, resource-pack UUID completion, and signed-command offset parsing are covered |
-| secure chat/profile | `PASS / BOUNDED` | valid signed inbound chat is verified with the protocol-769 SHA256 transcript and relayed as `SystemChat` under enforced secure chat; Mojang profile certificates use SHA1withRSA and all configured keys are tried; rejected profiles terminate; signed command argument transcripts are deliberately fail-closed and remain a declared limitation |
+| secure chat/profile | `PASS / BOUNDED` | valid signed inbound chat is verified with the protocol-769 SHA256 transcript and relayed as `SystemChat` under enforced secure chat; Mojang profile certificates use SHA1withRSA and all configured keys are tried; rejected profiles terminate; signed command argument transcripts are deliberately fail-closed and remain a declared limitation. The 2026-09-23 policy/advertisement follow-up and its unsigned-after-session boundary are recorded in [CURRENT_STATE.md §1C](CURRENT_STATE.md#1c-vanilla-1214-settings-compatibility-follow-up-2026-09-23). |
 | event and persistence ordering | `PASS` | cancellable block events run before mutations; scoped callbacks synchronize removal; moving-piston source/destination commits are flushed under the simulation gate before synchronous/background snapshots; transient moving-piston NBT remains intentionally omitted |
 | stalled-client isolation | `PASS` | framed output is encoded while the simulation gate is held and sent by a per-connection writer with a 4 MiB queue cap; encrypted frames remain FIFO; graceful output drains for at most 100 ms, then teardown is bounded; no generic gate release occurs during a mutation |
 
@@ -263,7 +263,7 @@ table rather than being hidden inside a numbered `DONE` row.
 | Feature | Status | Notes |
 |---|---|---|
 | RCON `whitelist` | DONE | `RconServer` dispatches Brigadier commands and persists whitelist state. |
-| `server.properties` subset | DONE | Includes spawn protection, whitelist, online mode, secure profile, view/simulation distance, MOTD, seed, level type, difficulty, resource pack, PVP, flight, hardcore, and max players. |
+| `server.properties` subset | PARTIAL | The implemented subset now defaults to vanilla 1.21.4 values (including online/profile enforcement, view distance 10, vanilla MOTD, easy difficulty, and a random seed for a new world); parsing follows Java Properties key case, separators, escapes, continuations, Unicode escapes, UTF-8/ISO-8859-1 fallback, and `Boolean.parseBoolean` semantics. Supported integer values accept Java's leading `+`, and difficulty IDs `0`–`3` map to vanilla names. `white-list` is canonical and legacy `whitelist` remains an alias. This is not full property parity: `enforce-whitelist`, query/status/network, permission, datapack, and several world/pack/operations properties do not yet have complete runtime effects. `ServerProperties::save` also remains a simple legacy writer rather than a `Properties.store` equivalent. Do not interpret focused parser/config passes as completion of the full 1.21.4 settings surface. |
 
 ## Test and gate mapping
 

docs/README.md

@@ -78,15 +78,22 @@ default-on strict JVM startup without an external classes/assets override.
 
 ## Verification at a glance
 
-The latest recorded working-tree evidence includes:
+The 2026-09-19 integrated working-tree baseline recorded:
 
-- The final integrated rerun on 2026-09-19 is non-nightly CTest `52/52 PASS`
+- The 2026-09-19 integrated rerun is non-nightly CTest `52/52 PASS`
   in `441.35s`; the separately run source-tree smoke matrix reports
   `224 PASS / 0 FAIL`, Plan43 reports `87 PASS / 0 FAIL`, and the full
   `test_server_full.py` matrix reports `240 PASS / 0 FAIL / 240 total`.
   The named focused targets also pass: settings `27`, properties `33`,
   recovery `55`, core safety `45`, and the specification wire vectors `417`,
   all with zero failures.
+- A separate pre-merge server-settings follow-up based on PR #1 head
+  `26e399c0` reports `settings_matrix` `47/47`, `properties` `63/63`,
+  `secure_chat_policy` `12/12`, and non-nightly CTest `55/55` in `516.24s`.
+  It aligns defaults and parsing for the implemented subset only; unsupported
+  vanilla settings and several runtime effects remain partial. Offline fake-client
+  launchers explicitly disable both authentication checks. Full commands and
+  limitations are recorded in [Verification](VERIFICATION.md#vanilla-server-settings-compatibility-follow-up-2026-09-23-pre-merge).
 - The 120-client stress gate joined `120/120` in `68.5s`; the 300-second soak
   passed with 150 keepalives, 0 disconnects, 2,899 actions, and `0.2%`
   post-fill RSS growth. The strict synthetic view-distance-32 benchmark
@@ -128,7 +135,7 @@ The latest recorded working-tree evidence includes:
   not retained release assets; the exact scope is in [Real-client
   verification](MC_PILOT_REAL_TEST.md).
 
-### Current working-tree hardening run
+### 2026-09-19 working-tree hardening baseline
 
 The final deterministic settings/security/authority pass reports
 `test_settings_matrix` `27 PASS / 0 FAIL`, `test_properties` `33 PASS / 0 FAIL`,

docs/SPEC_OPS.md

@@ -41,6 +41,26 @@ the root layout for this target, 20 TPS scheduling, and Play KeepAlive `0x27` ar
 1.21.4 facts. `SPEC_OPS` does not turn a chosen safety threshold into a claim about
 all vanilla servers.
 
+### Vanilla-facing `server.properties`
+
+The implemented settings remain a **partial** 1.21.4 subset. On first launch,
+the generated defaults use `view-distance=10`, `motd=A Minecraft Server`,
+`difficulty=easy`, an empty `level-seed` (random for a new world),
+`online-mode=true`, and `enforce-secure-profile=true`; an existing world's
+`level.dat` seed remains authoritative. Property names are case-sensitive and
+use Java Properties separators, escapes, continuations, and boolean conversion.
+Supported integer settings accept Java's leading `+`; difficulty IDs `0`–`3`
+map to `peaceful`, `easy`, `normal`, and `hard`. `white-list` is the canonical
+key; `whitelist` remains a legacy cppfm alias.
+
+The compatibility-oriented defaults require account authentication and secure
+profile enforcement. An intentionally offline fake-client test must explicitly
+pass both `--online-mode=false` and `--enforce-secure-profile=false`. This does
+not make the settings surface complete: for example, `enforce-whitelist`, query,
+permission, datapack, and several world/pack/operations keys still lack full
+vanilla runtime behavior. Passing the parser/configuration gates is not evidence
+that unsupported vanilla keys take effect.
+
 ## 3. Classes and operational data
 
 | area | implementation path/symbol | observable metric/state | evidence/status |