v3.8 — 2026-10-29

The base network protocol remains 3.7, so existing v3.7 clients can still connect. The new capital-relocation screen and the improved nation-management shortcuts require the v3.8 client. Capital management uses separately versioned optional channels; existing required payloads and hub snapshot formats are unchanged. The earlier server-only CBC, physics and void-recovery changes are listed separately below. The new YIGD pack addition requires installation on both sides; base-protocol compatibility alone does not install the new mod.

Discord Notifications

• In-game Delivery Failure Warnings: Online citizens with notification-management permission are warned when a Discord delivery fails, the channel cannot be used, or pending alerts cannot send because the bot is disconnected. Retry warnings are limited to once per recipient/nation every five minutes; reaching the retry limit or expiring past retention triggers a separate loss warning. These operational warnings bypass notification opt-out and include Japanese/English fallback text for v3.7 clients. Failure reasons remain available in the delivery audit.

• Release Review — Delivery Retention and Completion: Outbox expiration now runs while the bot is disconnected or cannot authenticate, so expired alerts are removed and their terminal-loss notice is not deferred until reconnect. Delivery leases remain held until acknowledgement/retry mutation finishes on the server thread; releasing them on the JDA callback thread could let the next tick resend the same pending alert. Stale callbacks cannot release a replacement server's lease.

Nation Management

• King Transfer Is Easier to Find: The owner's nation overview now has a named king-transfer button that opens a focused successor list and confirmation, rather than hiding the action among nation-name settings. The existing transfer service and v3.7 packet are reused: only the current owner can transfer to another citizen, transfers are refused during a siege or unsettled fall, and the former owner becomes a regular member. The old settings route remains compatible.

• Move the Capital to an Existing Outpost: The owner can open capital relocation from the same overview and select an existing outpost. A confirmation shows that the old capital becomes an outpost and both maximum core health values follow their new roles. Core IDs, physical positions, radii, territory boundaries and vault location are preserved. Both cores must be sealed, fully healed, past their damage delay and loaded as matching physical cores. Confirmation scans both walls again. Sieges, unsettled falls, recovery and settlement protection prevent relocation. An outpost in the vault chunk cannot become the capital until the vault is moved. After a successful move, the default wait is 24 hours of server-open time; this survives restarts and is set by [s2Territory.core] capitalRelocationCooldownOpenMinutes (1440). Old and new wall caches are cleared, the new capital is rechecked, and online citizens are told where the capital moved. No command is added. This screen requires the v3.8 client; v3.7 clients can continue normal play.

Peace-Time Territory Ranged Protection

• Citizens Can Work Without Answering Every Armed Scout: In effective home territory, foreign ranged damage to citizens is blocked during peace. The resident's current position determines protection, not the shooter's position. Nationless and unidentified artificial ranged sources cannot bypass it. Residents can shoot foreign visitors on their land without losing protection: there is no retaliation window, first-shot exception or attack-history toggle. Same-nation/self damage, melee, mobs/natural hazards and the separate PvP arena retain their existing rules. Delayed shots use the recorded actor's current nationality, or a frozen dispatch combat side where applicable; nation-only weapons use their recorded nation.

• Siege Areas Allow Both Sides to Fight: Protection is disabled in any siege footprint covering the resident's location, including initial lock and live occupation/counteroffensive after a fall. Overlapping core areas are checked rather than only the nearest core. A siege on a different outpost does not remove protection everywhere else, and finalized fallen records do not keep an area permanently unprotected. This removes only the new peace shield; armor, captivity, arena and other existing damage restrictions still apply.

• Block Before Combat Costs: TaCZ's pre-hit event and the beginning of ServerPlayer damage processing prevent protected hits from spending armor durability, absorption or MekaSuit shield energy and from creating combat tags. Protected residents are removed from explosion target lists before both damage and knockback. CBC damage types that omit their owner, plus Mekanism laser/flamethrower damage, are classified as ranged; sources are resolved through the exact projectile/explosion context and attribution snapshots. A blocked shooter's explanation is limited to once every five seconds, with Japanese/English fallback text for older clients. The change is server-side and leaves the base 3.7 protocol intact.

Attributable World Actions

• Reject Unidentified Artificial Damage and Placement: Artificial explosions, projectile impacts, machine breaking, entity placement and replacement now require an attributable player or nation. Natural growth, flowing fluids, ordinary fire spread and terrain generation are not blanket-disabled; mob-origin effects remain under their existing rules. Scoped causal origins cover entity/passenger ticks, block-entity ticks, scheduled actuators, player item use and explosion processing, and are restored even on exceptions. Unknown blast lists lose all terrain targets and nonliving objects; the provenance gate itself does not change living combat; the separate peace-time territory shield above governs ranged PvP. The common Level mutation gate also rejects unidentified changes inside these artificial execution scopes before block removal/drops. Known housekeeping changes to a machine's own block state remain allowed. Unscoped mod jobs and mods that write raw chunk storage outside these execution paths still need their own adapters; this does not claim to sandbox arbitrary mod code.

• Exact CBC Sources, Including Ordinary Terrain: CBC checks attribution before the unprotected-area fast path, and the nearest-munition fallback is removed. Duplicate impact suppression uses the actual projectile ID rather than an unrelated nearby hit. Projectile hooks use the actual active round, and explosions capture their actual caller at construction (including mortar-stone explosions whose direct source is null). Big-cannon/autocannon penetration, shrapnel and persistent partial-block damage, custom explosions, and derived fluid/fragment effects share the source gate. Unknown damage cannot accumulate cracking progress, break ordinary terrain, replace blocks, ignite blocks, or damage protected cores/reinforcement through these paths. Warnautics' dedicated blast/chip paths also refuse unverified sources; reflection errors no longer intentionally keep an unverified blast list. C4 uses its exact recorded placement at the explosion center, not a nearby weapon's identity.

• No CBC Impact Terrain Conversion: The explosion edit hooks for shell, impact and mortar-stone blasts are disabled, and CBC's transformation API returns the original state. This stops gravel and other impact-generated replacement terrain even for attributed shots and despite config/datapack transforms. Normal attributable projectile destruction and reinforcement/core damage remain subject to the existing combat rules. This avoids surrounding-block replacement bypassing the destruction checks.

• Machine Ownership and Safe Actuation: Newly player-placed block entities persist their responsible actor/nation; piston placement is stored separately because piston bases have no block entity. Source identity propagates to spawned projectiles and moving piston block entities. Otherwise the source machine's vehicle/territory nation can supply its identity. Legacy machines without recorded ownership outside attributable land may stop; placing them again records the responsible player. Unidentified piston/dispenser actions are refused before movement or item consumption. Removed piston records are discarded. These checks run on the server; existing clients can read the new behavior without a protocol change.

Client Loading QoL

• Earlier World Entry: Joining, respawning and dimension transitions may finish their loading screen once the server's vanilla loading-start signal has arrived and actual full chunk packet data covers the player's footprint. The renderer no longer has to finish compiling that section first. This can reduce waiting on clients with a rendering backlog; surrounding terrain may briefly be invisible while rendering catches up. Chunk edges/corners require the two/four chunks beneath the player's body, so an unrelated received chunk cannot unlock the screen. Placeholder client chunks are not accepted. The server hand-off, vanilla timeout and disconnect handling remain unchanged. Server chunk generation, resource loading and physics payload cost are not accelerated.
• Client Option: “MoveEarth設定 → 演出 → ワールドの操作開始を早める” is enabled by default; disabling it restores vanilla readiness. This improvement requires the v3.8 player jar, while the base network protocol stays compatible with v3.7. Older clients keep their existing loading behavior.

Siege Start Window

• No Last-Hour New Sieges: Dedicated servers accept new Sieges only during the opening window until one hour before closing (currently 19:00–22:00 JST, with the server closing at 23:00). The cutoff derives from the shared closing hour. This avoids forcing defenders into a new battle when the online population declines near closing. Damage/break gates and final registration enforce the same rule before consent prompts and Siege side effects; rejected attempts receive translated fallback text readable by v3.7 clients. The rule applies to nation and individual attackers, normal breaking, artillery/explosions, C4 and core sabotage. Unrelated unowned terrain and friendly construction are unaffected.

• Existing Conflicts Continue: An existing record for the same attacker identity and target core can continue from initial lock to rolling combat and refresh its timers after the cutoff. Other attackers, other cores, and a restarted expired/withdrawn Siege require a new record and wait for the next opening. Live fallen occupation and counteroffensive rules remain unchanged. No active Siege is deleted or automatically ended at 22:00. Integrated single-player servers keep their existing exemption from opening hours. Server-side only, without a protocol change.

• Start-Window Review Fixes: Reinforcement mining and CBC/Warnautics damage paths now honor the final registration refusal before applying damage or removing a reinforcement record, including when the wall-clock crosses 22:00 between the initial check and registration. A blast batch preserves refusal results for subsequent targets instead of replaying them as ignored attempts. Read-only core sabotage hints no longer emit the new closing-window chat warning merely from looking at a core. The real Minecraft SavedData and batch replay regression probe is reproducible with tools/verification/siege-window.gradle.

Failed Siege: One Attempt per Opening Session

• Reattack Waits Until the Next Opening: A rolling Siege that times out without a fall, or an attacker withdrawing during rolling combat/occupation, prevents the same attacker nation or individual from attacking the same core until the next scheduled opening (currently 19:00 JST). This replaces the one-hour open-time countdown so repeated attempts do not consume an entire short evening of defense. Other attackers and cores remain independent. Initial-lock-only expiry/withdrawal retains its separate retry rule; successful falls retain existing settlement rules.
• Calendar Deadline and Migration: The next-opening Unix timestamp is persisted and checked directly, so restart/downtime cannot extend the wait and the lock clears exactly at opening without needing a timer tick. Combat withdrawals no longer also create a separate one-hour retry counter that could spill into the next session. Undated legacy failed-Siege countdowns are cleared once during migration rather than imposing a fresh session-long restriction whose start date cannot be established. The old failedSiegeCooldownSeconds setting is retained for config compatibility but no longer controls new failed-Siege restrictions.
• Compatible Notices: Refusal messages include the exact next opening with Japanese/English fallback text for v3.7 clients. The required v3.7 prompt/protection packet formats are unchanged. New clients use an optional 3.8-session-siege-v1 prompt to display the session rule; old clients receive the original prompt and a server-rendered explanation that its numeric estimate is no longer the authoritative rule. The restriction works on the server without requiring a client update. The old protection duration field remains a presentation estimate of time left in the current opening, separate from the authoritative calendar deadline.

Unattributed Action Diagnostics

• Rejection Logs, Daily Summary and Route Rankings: Actual unidentified-source refusals now feed the existing authenticated analytics dashboard under “攻撃元不明の操作”, including Japan-calendar daily totals, rankings sorted by refusal count, and recent records with a dimension and representative location. The existing event log/export also exposes provenance.rejected. This helps identify broken attribution adapters and repeatedly stopped machines without guessing an attacker.
• Bounded Collection: Counts are merged per route/dimension for each wall-clock minute and flushed on graceful shutdown, with one server warning per bucket even if analytics is disabled. Each row's value is the refusal count; COUNT(*) is only the number of batches. A per-explosion latch prevents repeated event listeners from counting the same explosion again. Repeated machine/fragment attempts remain separate refusals, not estimates of attacks, people or affected blocks. At most 256 route/dimension keys plus an overflow bucket are held. Natural/mob actions and separate intentional bans (CBC terrain conversion and peace-time player shielding) are excluded. Analytics is best-effort through the existing queue: queue-wide drops are displayed; crashes can lose the current minute. See docs/unattributed-action-analytics.md for routes and operational limits.

Death Recovery (YIGD)

• Replace Corpse with YIGD: The v3.8 pack adopts YIGD 2.0.13 NeoForge as an MIT-licensed, configurable grave-and-recovery base. Click recovery prioritizes the original equipment/inventory layout. Extra abilities, soulbound, keys, scrolls, remote recovery, teleporting, random enemies, extra death debuffs and random item loss are disabled by the rollout profile. Curios/backpack integration is enabled; final in-game verification is required before rollout. PlayerRevive still handles living downed players, while YIGD handles final death. Both clients and servers need YIGD and Cloth Config; MoveEarth's base protocol remains 3.7. The pack supplies matching v3.8 MoveEarth jars.

• Graves Follow National Storage Protection: The grave's death-time player and nation are persisted independently of later membership changes. Graves born outside their home territory (including nation-less deaths) are public immediately. A protected grave placed at a different location outside its home territory permanently becomes public, even if returned home. Initial binding and YIGD relocation hooks record placement; access checks, border changes and reloading the same position do not unlock it. Citizens, allies granted storage access at that location, and attackers with a matching siege-loot grant can recover protected graves; the deceased and operators retain recovery access. Physical range, actual grave ID, living player state and dimension are checked. The YIGD claim event is authoritative, so default timers, keys and lock flags cannot bypass territory rules. No carrying mechanic is added. Existing untracked YIGD graves fail closed to their owner/operators rather than guessing past ownership.