Chronicle World Replacement 🚦🌍
Replacing Aterra is the most sensitive part of the Chronicle lifecycle. The system therefore uses a fail-closed readiness gate. Every required condition must pass before the live world can be changed.
Required gates
World replacement is permitted only when all of the following are true:
- the outgoing Chronicle legitimately finalized
- The Last Bell was delivered and acknowledged
- the configured Final Stand elapsed, with an absolute minimum of eight hours
- a staged
.mcworldpackage exists - the staged package passed validation
- an authorized administrator explicitly approved the package
- the stored file still matches its approved SHA-256 checksum
- no replacement for that Chronicle already completed
One red light means the cart stays parked. 🛑🛒
Fail-closed behavior
When any condition fails, the system must not:
- stop BDS
- move or replace world directories
- change PvP settings
- activate the next Chronicle
- invoke a world-operation relay
- mark replacement complete
The current world remains online, and the administration page explains every blocking reason individually.
Expected replacement sequence
Once all gates pass and a separately authorized production operation begins, the expected sequence is:
- announce the maintenance boundary
- save the outgoing world
- create and verify a recoverable final backup
- stop BDS cleanly
- install the exact approved staged package
- verify the installed checksum and world structure
- start BDS
- verify server health and player connectivity
- activate the new Chronicle through the authorized lifecycle path
- retain durable completion and rollback evidence
Packaging proof is not gameplay proof. A successful file operation does not prove spawn, menus, behavior packs, Realm behavior, death behavior, or actual play. Minecraft always gets the final word. ⛏️