Document lure deaths and restarts, Surgery identity fixes and Research shutdown

projects/Infestations/overview.md

@@ -89,13 +89,18 @@ second until they leave.
   Survival or Adventure, until `/lure leave` drops them out. Coming back into
   the province stops that damage without dropping them. `/lure leave` fails
   the lure when nobody committed remains.
-- **Departure:** switching character, quitting, or shutting down starts
+- **Departure:** switching character or quitting starts
   `logout-grace-seconds` for the outgoing character, which remains committed.
+  A server restart is not a departure: if no committed player is back when
+  the lure next checks, it fails with no penalty.
   Only that character's ready return ends its grace. After the grace expires,
   it is killed when it next becomes ready. A directory record belonging to
   the same account with status `DEAD` or `MISSING` settles the pending death
   without damaging the current character. Unknown records do not settle it.
-  A committed character's death removes its own commitment.
+  A committed character's death removes its own commitment: an ordinary
+  death at once, and a permanent death once RPCharacters has saved it. If
+  that save fails, the character stays alive and committed, and the death
+  starts no grace.
 - **Other characters:** another character on the same account takes no
   deserter damage for the waiting commitment, and its death or `/lure leave`
   does not touch it. Further departures preserve the first character and
@@ -198,8 +203,7 @@ map data.
   and reload.
 
 State is saved after each change and every five seconds. On a normal disable,
-the plugin records departures for ready committed characters, removes lure
-text displays, and saves state. Existing grace deadlines and penalties are
+the plugin removes lure text displays and saves state. Existing grace deadlines and penalties are
 preserved, and the JSON field layout is unchanged. Lure timers use
 wall-clock time, so a join window that expired during downtime activates immediately.
 Stop the server before editing the data file, since periodic saves overwrite

projects/Research/overview.md

@@ -81,13 +81,13 @@ shuffled into random rows when the project starts, and the remaining rows are
 decoys, so an output can require at most six aspects. After each experiment, a
 pulse in the scoring aspect's `pulse_color` crosses the left panel.
 
-Each menu belongs to the session that opened it. Switching characters, quitting,
-permanent death, or provider shutdown closes the outgoing menu and returns its
-experiment item once, before the outgoing character is saved or unloaded. An old
-menu cannot spend focus or scrap a project after switching away and back to the
-same character. Delayed menu refreshes and completion sounds also stop applying
-to that player when the captured session ends; station and dropped-item particle
-effects remain world effects.
+Each menu belongs to the session that opened it. When that session ends, the
+menu closes and returns its experiment item once, before the outgoing character
+is saved. At server stop, Research disables before RPCharacters and returns the
+item itself. A menu from an earlier session cannot spend focus or scrap a
+project, even after switching back to the same character. Delayed refreshes and
+completion sounds stop with the session; station and dropped-item particles
+still play.
 
 ## Configuration files
 
@@ -141,6 +141,8 @@ open station menus before changing `labels` titles or `colors.inventory_title`.
   a missing attribute counts as zero.
 - **TLibs.** TLibs builds and matches every item path, formats text, and supplies
   shared character identity and session events through RPCharacters' provider.
+  Research needs TLibs 2.3.0 or newer; with an older TLibs it logs a severe
+  error and disables itself.
 - **`ResearchCompleteEvent`.** Listen for
   `net.tfminecraft.research.event.ResearchCompleteEvent`, which fires
   synchronously after the result spawns and cannot be cancelled. It exposes

projects/Surgery/README.md

@@ -6,10 +6,7 @@ Technical documentation is maintained here. Run commands from the source checkou
 
 TFMC runs Minecraft **1.21.10**. See the [shared platform and build baseline](../../PLATFORM.md) for runtime, build and validation conventions.
 
-Build with Java 21 and pinned TLibs **2.3.0** / RPCharacters **2.16.0** release
-artifacts. The shared dependency installer prepares them before `mvn clean
-verify`. Runtime requires those versions or newer; see the installation and
-lifecycle guidance below.
+Build with Java 21 against the pinned TLibs and RPCharacters releases, which the shared dependency installer prepares before `mvn clean verify`. See [Installation](overview.md#installation) for the runtime versions and [Failure](overview.md#failure) for how sessions end operations.
 
 - [Project overview](overview.md)
 

projects/Surgery/overview.md

@@ -40,7 +40,7 @@ src/main/java/net/tfminecraft/surgery/
 
 ## Installation
 
-1. Install **TLibs 2.3.0+** and **RPCharacters 2.16.0+**, then drop `surgery-<version>.jar` into `plugins/`.
+1. Install TLibs and RPCharacters at the versions in the table below, then drop `surgery-<version>.jar` into `plugins/`.
 2. Restart the server. Surgery declares a hard dependency on both.
 3. Give physicians `professions.physician` (the same permission that crafts the instruments).
 4. Point `surgeryItemsConfig.yml` at the surgical items. The defaults are the existing `m.surgery.*` MMOItems ids.
@@ -87,33 +87,13 @@ A healing trait added later needs a `procedures:` entry only when it should diff
 
 Temperature at or above 110°F, an expired collapse countdown, consecutive extremely weak pulse, consecutive red temperature, cutting while awake, too much chloroform, or closing the menu after the patient was sedated or cut. That last group adds `failure-healing-penalty` (12 hours by default) to the ailment. Closing the menu before then cancels with no penalty.
 
-Both participants need ready character sessions before an offer can be sent or
-accepted. Consent belongs to those exact sessions and expires when either
-ends, including a reconnect or switching Alice → Bob → Alice. An unavailable
-identity provider cannot turn an old offer into consent for a new character.
-
-An operation also belongs to both captured sessions. If the patient walks out
-of range, dies, logs off, or switches character, the operation ends. A physician
-who changes character gives up. Ordinary failure after sedation or cutting
-extends only the original patient's healing injury. During the patient's quit
-event, the outgoing body is still loaded, so that same injury receives the
-penalty. A patient who switches character or is permakilled receives no
-penalty from the ended operation. A physician's departure still penalizes a
-patient whose original session is current. Shutdown cancels operations and
-clears offers without a healing penalty.
-
-Configured completion commands name accounts. They run only while **both
-original sessions are current**, and are skipped on every session end,
-including logout. The operation is removed before injury changes or command
-dispatch, so a command cannot complete it twice or erase a replacement
-operation. Old inventory clicks and close events cannot act on a new
-operation. A deferred close checks the original inventory, connection, and
-physician session before closing anything.
-
-Surgery uses TLibs for identity and lifecycle and keeps RPCharacters for
-`HealingInjuries.list`, `cure`, and `extend`. An older TLibs installation disables
-Surgery at startup with an upgrade message. A missing or not-yet-ready identity
-provider blocks new operations.
+Both participants need ready character sessions before an offer can be sent or accepted. Consent belongs to those exact sessions and expires when either ends, including a reconnect or switching Alice → Bob → Alice. An unavailable identity provider cannot turn an old offer into consent for a new character.
+
+An operation also belongs to both captured sessions. If the patient walks out of range, dies, logs off, or switches character, the operation ends. A physician who changes character or is permakilled gives up, and still receives the failure message while online. Ordinary failure after sedation or cutting extends only the original patient's healing injury. A patient who quits or switches character after sedation or cutting receives the penalty on the outgoing character, which is still loaded when its session ends. A permakilled patient receives none. A physician's departure still penalises a patient whose original session is current. Shutdown cancels operations and clears offers without a healing penalty.
+
+Configured completion commands name accounts. They run only while **both original sessions are current**, so a session end never runs them. A physician who logs off with the menu open closes it first, which runs the failure command before the session ends. The operation is removed before injury changes or command dispatch, so a command cannot complete it twice or erase a replacement operation. Old inventory clicks and close events cannot act on a new operation. A deferred close checks the original inventory, connection, and physician session before closing anything.
+
+Surgery uses TLibs for identity and lifecycle and keeps RPCharacters for `HealingInjuries.list`, `cure`, and `extend`. An older TLibs installation disables Surgery at startup with an upgrade message. If RPCharacters is enabled but provides no character identity once the server has started, as older releases do, Surgery logs a warning because every offer would fail. A missing or not-yet-ready identity provider blocks new operations.
 
 ## Configuration
 
@@ -133,16 +113,16 @@ python3 ../tlibs/tools/install-plugins.py --pom pom.xml --mode pinned
 mvn clean verify
 ```
 
-Use JDK 21. The installer verifies the pinned TLibs 2.3.0 and RPCharacters
-2.16.0 releases. Paper API resolves from Maven. `mvn clean verify` enforces
-100% executable-line coverage.
+Use JDK 21. The installer verifies the pinned TLibs and RPCharacters releases, and Paper API resolves from Maven.
+
+## Testing
+
+`mvn clean verify` runs the unit tests and enforces 100% executable-line coverage. On a test server, check that:
 
-For live validation, test offers and active operations across switches,
-Alice → Bob → Alice, reconnects, provider loss, and both shutdown orders.
-Confirm quitting after treatment extends only the outgoing patient's injury,
-while patient switches and permanent deaths do not. Test a completion command that starts
-another operation, then verify the old completion and deferred close cannot
-alter its state or inventory.
+- offers and operations end when either character switches (including Alice → Bob → Alice), reconnects, or loses its identity provider;
+- a server stop, and RPCharacters disabling while Surgery keeps running, both end operations and clear offers without a healing penalty;
+- quitting or switching after sedation or cutting extends only the outgoing patient's injury, and a permanent death extends nothing;
+- a completion command that starts another operation leaves that operation's state and menu untouched.
 
 ## Author