feat(sentinel): persist alerts as CloudEvent JSONL

Merge PR #6 for Kaneo SM-349 after exact-candidate checks 3833 and 3834 passed.

README.md

@@ -2,7 +2,9 @@
 
 Passive, explainable movement-pattern observation for Purpur servers.
 
-Sentinel gives permitted operators bounded evidence of suspicious on-foot speed, unauthorized unsupported flight, unsupported boat travel, source-less elytra propulsion, and statistically implausible elytra wear. Elytra analysis correlates server-recognized gliding, equipped-item identity, observed rocket use, external propulsion, altitude conversion, wear opportunities, Unbreaking, Mending/XP repair, and unbreakable items; high speed alone is never evidence. Sentinel does not cancel movement, alter vehicles or items, consume rockets, change flight permissions, punish players, persist player evidence, or export telemetry.
+Sentinel gives permitted operators bounded evidence of suspicious on-foot speed, unauthorized unsupported flight, unsupported boat travel, source-less elytra propulsion, and statistically implausible elytra wear. Elytra analysis correlates server-recognized gliding, equipped-item identity, observed rocket use, external propulsion, altitude conversion, wear opportunities, Unbreaking, Mending/XP repair, and unbreakable items; high speed alone is never evidence. Sentinel does not cancel movement, alter vehicles or items, consume rockets, change flight permissions, or punish players.
+
+Each generated alert is also appended asynchronously as a CloudEvents 1.0 JSON object to `plugins/PurpurSentinel/events/YYYY-MM-DD.jsonl`. Dates and timestamps use UTC, files retain 30 UTC days, and durable events identify the subject by UUID without display names, coordinates, raw trajectories, inventory contents, IP addresses, or permission state. Queue or disk failures never interrupt detection or gameplay.
 
 ## Development
 

src/main/java/games/dmg/purpursentinel/AlertEventSink.java

@@ -0,0 +1,8 @@
+package games.dmg.purpursentinel;
+
+@FunctionalInterface
+interface AlertEventSink {
+    AlertEventSink NONE = alert -> {};
+
+    void offer(AlertDecision alert);
+}

src/main/java/games/dmg/purpursentinel/CloudEventLog.java

@@ -0,0 +1,284 @@
+package games.dmg.purpursentinel;
+
+import java.io.BufferedWriter;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.DirectoryStream;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.StandardOpenOption;
+import java.time.Clock;
+import java.time.Duration;
+import java.time.Instant;
+import java.time.LocalDate;
+import java.time.ZoneOffset;
+import java.time.format.DateTimeFormatter;
+import java.time.format.DateTimeParseException;
+import java.time.temporal.ChronoUnit;
+import java.util.Locale;
+import java.util.UUID;
+import java.util.concurrent.ArrayBlockingQueue;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.function.Consumer;
+
+final class CloudEventLog implements AlertEventSink, AutoCloseable {
+    static final int DEFAULT_QUEUE_CAPACITY = 1_024;
+    static final int RETENTION_DAYS = 30;
+    private static final Duration WARNING_INTERVAL = Duration.ofMinutes(1);
+    private static final Duration SHUTDOWN_TIMEOUT = Duration.ofSeconds(5);
+    private static final DateTimeFormatter FILE_DATE = DateTimeFormatter.ISO_LOCAL_DATE;
+    private final Clock clock;
+    private final Consumer<String> warning;
+    private final ArrayBlockingQueue<Event> queue;
+    private final AtomicBoolean accepting = new AtomicBoolean(true);
+    private final Object lifecycleLock = new Object();
+    private final Duration shutdownTimeout;
+    private final EventStore store;
+    private final Thread worker;
+    private long nextWarningAtMillis;
+
+    CloudEventLog(Path directory, Clock clock, Consumer<String> warning) {
+        this(clock, warning, DEFAULT_QUEUE_CAPACITY, SHUTDOWN_TIMEOUT, new DailyEventStore(directory));
+    }
+
+    CloudEventLog(Clock clock, Consumer<String> warning, int capacity, Duration shutdownTimeout, EventStore store) {
+        if (capacity < 1) throw new IllegalArgumentException("capacity must be positive");
+        this.clock = clock;
+        this.warning = warning;
+        this.shutdownTimeout = shutdownTimeout;
+        this.store = store;
+        queue = new ArrayBlockingQueue<>(capacity);
+        worker = Thread.ofPlatform().name("purpur-sentinel-event-log").daemon(true).start(this::run);
+    }
+
+    @Override public void offer(AlertDecision alert) {
+        boolean dropped;
+        synchronized (lifecycleLock) {
+            if (!accepting.get()) return;
+            dropped = !queue.offer(new Event(clock.instant(), alert));
+        }
+        if (dropped) warn("Sentinel event log queue is full; one durable alert was dropped.");
+    }
+
+    @Override public void close() {
+        synchronized (lifecycleLock) {
+            if (!accepting.getAndSet(false)) return;
+        }
+        worker.interrupt();
+        try {
+            worker.join(shutdownTimeout.toMillis());
+        } catch (InterruptedException exception) {
+            Thread.currentThread().interrupt();
+        }
+        if (worker.isAlive()) warn("Sentinel event log did not finish its bounded shutdown drain.");
+        queue.clear();
+    }
+
+    int queuedEventCount() { return queue.size(); }
+
+    private void run() {
+        try {
+            while (accepting.get() || !queue.isEmpty()) {
+                Event event;
+                try {
+                    event = queue.poll(250, TimeUnit.MILLISECONDS);
+                } catch (InterruptedException exception) {
+                    continue;
+                }
+                if (event == null) continue;
+                try {
+                    store.append(event.observedAt, event.alert);
+                } catch (RetentionException exception) {
+                    warn("Sentinel could not apply event log retention; detection remains active.");
+                } catch (IOException | RuntimeException exception) {
+                    warn("Sentinel could not write a durable alert; detection remains active.");
+                }
+            }
+        } finally {
+            try {
+                store.close();
+            } catch (IOException exception) {
+                warn("Sentinel could not close its event log cleanly.");
+            }
+        }
+    }
+
+    private static Writer open(Path directory, LocalDate date) throws IOException {
+        Files.createDirectories(directory);
+        Path file = directory.resolve(FILE_DATE.format(date) + ".jsonl");
+        if (Files.exists(file)) truncatePartialTail(file);
+        return new Writer(date, Files.newBufferedWriter(file, StandardCharsets.UTF_8,
+                StandardOpenOption.CREATE, StandardOpenOption.WRITE, StandardOpenOption.APPEND));
+    }
+
+    private static void truncatePartialTail(Path file) throws IOException {
+        try (var channel = java.nio.channels.FileChannel.open(file, StandardOpenOption.READ, StandardOpenOption.WRITE)) {
+            long size = channel.size();
+            if (size == 0) return;
+            var buffer = java.nio.ByteBuffer.allocate(8_192);
+            long end = size;
+            while (end > 0) {
+                int length = (int) Math.min(buffer.capacity(), end);
+                long start = end - length;
+                buffer.clear().limit(length);
+                channel.position(start);
+                while (buffer.hasRemaining() && channel.read(buffer) >= 0) { }
+                byte[] bytes = buffer.array();
+                for (int index = length - 1; index >= 0; index--) {
+                    if (bytes[index] == '\n' || bytes[index] == '\r') {
+                        if (start + index + 1 < size) channel.truncate(start + index + 1);
+                        return;
+                    }
+                }
+                end = start;
+            }
+            channel.truncate(0);
+        }
+    }
+
+    private static void retain(Path directory, LocalDate currentDate) throws IOException {
+        LocalDate oldest = currentDate.minusDays(RETENTION_DAYS - 1L);
+        try (DirectoryStream<Path> files = Files.newDirectoryStream(directory, "*.jsonl")) {
+            for (Path file : files) {
+                String name = file.getFileName().toString();
+                if (!name.matches("\\d{4}-\\d{2}-\\d{2}\\.jsonl")) continue;
+                try {
+                    LocalDate date = LocalDate.parse(name.substring(0, 10), FILE_DATE);
+                    if (date.isBefore(oldest)) Files.deleteIfExists(file);
+                } catch (DateTimeParseException ignored) { }
+            }
+        }
+    }
+
+    private static String toJson(Instant observedAt, AlertDecision alert) {
+        String type = alert.signal().name().toLowerCase(Locale.ROOT).replace('_', '-');
+        StringBuilder data = new StringBuilder(256);
+        data.append("{\"signal\":\"").append(alert.signal()).append('\"');
+        switch (alert.signal()) {
+            case ABSOLUTE_GROUND_SPEED, CONTEXTUAL_GROUND_SPEED -> data
+                    .append(",\"breachCount\":").append(alert.breachCount())
+                    .append(",\"observedSpeed\":").append(number(alert.peakSpeed()))
+                    .append(",\"capturedLimit\":").append(number(alert.capturedLimit()))
+                    .append(",\"ratio\":").append(number(alert.ratio()))
+                    .append(",\"evidenceWindowSeconds\":").append(alert.evidenceWindowSeconds());
+            case UNAUTHORIZED_FLIGHT_STATE, UNSUPPORTED_ASCENT, UNSUPPORTED_HOVER,
+                    UNSUPPORTED_CRUISE -> appendTravel(data, alert);
+            case UNSUPPORTED_BOAT_ASCENT, UNSUPPORTED_BOAT_HOVER, UNSUPPORTED_BOAT_CRUISE -> {
+                appendTravel(data, alert);
+                String vehicleType = alert.vehicleType() == null ? "UNKNOWN" : alert.vehicleType();
+                data.append(",\"vehicleType\":\"").append(escape(vehicleType)).append('\"');
+            }
+            case ELYTRA_SOURCELESS_PROPULSION, ELYTRA_IMPLAUSIBLE_WEAR -> data
+                    .append(",\"eligibleTicks\":").append(alert.eligibleTicks())
+                    .append(",\"ascent\":").append(number(alert.verticalDisplacement()))
+                    .append(",\"peakAcceleration\":").append(number(alert.peakSpeed()))
+                    .append(",\"observedBoosts\":").append(alert.evidenceWindowSeconds())
+                    .append(",\"wearOpportunities\":").append(alert.breachCount())
+                    .append(",\"unbreakingLevel\":").append((int) alert.capturedLimit());
+        }
+        data.append('}');
+        return "{\"specversion\":\"1.0\",\"id\":\"" + UUID.randomUUID()
+                + "\",\"source\":\"urn:somc:purpur-sentinel\",\"type\":\"games.dmg.purpursentinel.alert."
+                + type + "\",\"subject\":\"" + alert.playerId() + "\",\"time\":\""
+                + DateTimeFormatter.ISO_INSTANT.format(observedAt.truncatedTo(ChronoUnit.MILLIS))
+                + "\",\"datacontenttype\":\"application/json\",\"data\":" + data + '}';
+    }
+
+    private static void appendTravel(StringBuilder data, AlertDecision alert) {
+        data.append(",\"eligibleTicks\":").append(alert.eligibleTicks())
+                .append(",\"horizontalDistance\":").append(number(alert.horizontalDistance()))
+                .append(",\"verticalDisplacement\":").append(number(alert.verticalDisplacement()));
+    }
+
+    private static String number(double value) {
+        return Double.isFinite(value) ? Double.toString(value) : "0.0";
+    }
+
+    private static String escape(String value) {
+        StringBuilder escaped = new StringBuilder(value.length() + 8);
+        for (int index = 0; index < value.length(); index++) {
+            char character = value.charAt(index);
+            switch (character) {
+                case '\"' -> escaped.append("\\\"");
+                case '\\' -> escaped.append("\\\\");
+                case '\b' -> escaped.append("\\b");
+                case '\f' -> escaped.append("\\f");
+                case '\n' -> escaped.append("\\n");
+                case '\r' -> escaped.append("\\r");
+                case '\t' -> escaped.append("\\t");
+                default -> {
+                    if (character < 0x20) escaped.append(String.format(Locale.ROOT, "\\u%04x", (int) character));
+                    else escaped.append(character);
+                }
+            }
+        }
+        return escaped.toString();
+    }
+
+    private synchronized void warn(String message) {
+        long now = clock.millis();
+        if (now < nextWarningAtMillis) return;
+        nextWarningAtMillis = now + WARNING_INTERVAL.toMillis();
+        try {
+            warning.accept(message);
+        } catch (RuntimeException ignored) {
+            // A logging backend failure must not stop durable event processing.
+        }
+    }
+
+    @FunctionalInterface
+    interface EventStore extends AutoCloseable {
+        void append(Instant observedAt, AlertDecision alert) throws IOException;
+        @Override default void close() throws IOException { }
+    }
+
+    private static final class DailyEventStore implements EventStore {
+        private final Path directory;
+        private Writer writer;
+
+        private DailyEventStore(Path directory) { this.directory = directory; }
+
+        @Override public void append(Instant observedAt, AlertDecision alert) throws IOException {
+            LocalDate date = observedAt.atZone(ZoneOffset.UTC).toLocalDate();
+            IOException retentionFailure = null;
+            try {
+                if (writer == null || !writer.date.equals(date)) {
+                    close();
+                    writer = open(directory, date);
+                    try {
+                        retain(directory, date);
+                    } catch (IOException exception) {
+                        retentionFailure = exception;
+                    }
+                }
+                writer.output.write(toJson(observedAt, alert));
+                writer.output.newLine();
+                writer.output.flush();
+            } catch (IOException exception) {
+                try { close(); } catch (IOException closeFailure) { exception.addSuppressed(closeFailure); }
+                throw exception;
+            }
+            if (retentionFailure != null) warnRetention(retentionFailure);
+        }
+
+        private static void warnRetention(IOException failure) throws RetentionException {
+            throw new RetentionException(failure);
+        }
+
+        @Override public void close() throws IOException {
+            if (writer == null) return;
+            try { writer.close(); } finally { writer = null; }
+        }
+    }
+
+    static final class RetentionException extends IOException {
+        private static final long serialVersionUID = 1L;
+        RetentionException(IOException cause) { super(cause); }
+    }
+
+    private record Event(Instant observedAt, AlertDecision alert) { }
+    private record Writer(LocalDate date, BufferedWriter output) implements AutoCloseable {
+        @Override public void close() throws IOException { output.close(); }
+    }
+}

src/main/java/games/dmg/purpursentinel/PurpurSentinelPlugin.java

@@ -2,6 +2,7 @@ package games.dmg.purpursentinel;
 
 import java.io.IOException;
 import java.nio.file.Files;
+import java.time.Clock;
 import java.util.Objects;
 import org.bukkit.event.HandlerList;
 import org.bukkit.plugin.java.JavaPlugin;
@@ -12,6 +13,7 @@ public final class PurpurSentinelPlugin extends JavaPlugin {
     private BukkitMovementListener listener;
     private BukkitBoatObserver boatObserver;
     private BukkitElytraObserver elytraObserver;
+    private CloudEventLog eventLog;
     private BukkitTask tickTask;
 
     @Override public void onEnable() {
@@ -24,6 +26,8 @@ public final class PurpurSentinelPlugin extends JavaPlugin {
             listener = new BukkitMovementListener(getServer(), monitor, settings::current, System::nanoTime);
             boatObserver = new BukkitBoatObserver(getServer(), monitor, settings::current, System::nanoTime);
             elytraObserver = new BukkitElytraObserver(getServer(), monitor, settings::current, System::nanoTime);
+            eventLog = new CloudEventLog(getDataFolder().toPath().resolve("events"), Clock.systemUTC(),
+                    message -> getLogger().warning(message));
             var command = Objects.requireNonNull(getCommand("sentinel"), "Missing sentinel command");
             var handler = new SentinelCommand(getServer(), monitor, settings, System::nanoTime);
             command.setExecutor(handler);
@@ -31,7 +35,7 @@ public final class PurpurSentinelPlugin extends JavaPlugin {
             getServer().getPluginManager().registerEvents(listener, this);
             getServer().getPluginManager().registerEvents(boatObserver, this);
             getServer().getPluginManager().registerEvents(elytraObserver, this);
-            var alerts = new SentinelAlerts(getServer());
+            var alerts = new SentinelAlerts(getServer(), eventLog);
             tickTask = getServer().getScheduler().runTaskTimer(this, () -> {
                 listener.sampleFlight();
                 boatObserver.sample();
@@ -41,6 +45,9 @@ public final class PurpurSentinelPlugin extends JavaPlugin {
         } catch (IOException | IllegalArgumentException exception) {
             getLogger().severe("Sentinel configuration is invalid or unavailable; observation was not activated: " + exception.getMessage());
             getServer().getPluginManager().disablePlugin(this);
+        } catch (RuntimeException exception) {
+            getLogger().severe("Sentinel could not activate observation.");
+            getServer().getPluginManager().disablePlugin(this);
         }
     }
 
@@ -68,5 +75,9 @@ public final class PurpurSentinelPlugin extends JavaPlugin {
             monitor.clear();
             monitor = null;
         }
+        if (eventLog != null) {
+            eventLog.close();
+            eventLog = null;
+        }
     }
 }

src/main/java/games/dmg/purpursentinel/SentinelAlerts.java

@@ -5,12 +5,19 @@ import org.bukkit.Server;
 
 final class SentinelAlerts {
     private final Server server;
+    private final AlertEventSink events;
 
     SentinelAlerts(Server server) {
+        this(server, AlertEventSink.NONE);
+    }
+
+    SentinelAlerts(Server server, AlertEventSink events) {
         this.server = server;
+        this.events = events;
     }
 
     void send(AlertDecision alert) {
+        events.offer(alert);
         var subject = server.getPlayer(alert.playerId());
         if (subject == null || !subject.isOnline()) return;
         String message;

src/nativeTest/java/games/dmg/purpursentinel/PluginLifecycleTest.java

@@ -7,6 +7,7 @@ import io.papermc.paper.plugin.manager.NativeEvents;
 import java.io.File;
 import java.lang.reflect.Field;
 import java.nio.file.Files;
+import java.nio.file.Path;
 import java.util.Collection;
 import java.util.List;
 import java.util.UUID;
@@ -136,6 +137,13 @@ class PluginLifecycleTest {
             var monitor = (MovementMonitor) monitorField.get(plugin);
             assertEquals(1, monitor.trackedPlayerCount());
             plugin.onDisable();
+            Path eventFile = directory.toPath().resolve("events/" + java.time.LocalDate.now(java.time.ZoneOffset.UTC) + ".jsonl");
+            assertTrue(Files.isRegularFile(eventFile));
+            var eventLines = Files.readAllLines(eventFile);
+            assertEquals(1, eventLines.size());
+            assertTrue(eventLines.getFirst().contains("\"specversion\":\"1.0\""));
+            assertTrue(eventLines.getFirst().contains("\"subject\":\"" + subject.getUniqueId() + "\""));
+            assertFalse(eventLines.getFirst().contains("Alex"));
             verify(task).cancel();
             assertEquals(0, monitor.trackedPlayerCount());
             assertEquals(0, PlayerMoveEvent.getHandlerList().getRegisteredListeners().length);

src/test/java/games/dmg/purpursentinel/CloudEventLogTest.java

@@ -0,0 +1,263 @@
+package games.dmg.purpursentinel;
+
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.time.Clock;
+import java.time.Instant;
+import java.time.ZoneOffset;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.UUID;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicInteger;
+import org.bukkit.Server;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+import org.yaml.snakeyaml.Yaml;
+
+class CloudEventLogTest {
+    private static final Instant FIRST_DAY = Instant.parse("2026-10-29T23:59:58Z");
+    @TempDir Path directory;
+
+    @Test
+    void persistsOneStructuredCloudEventWhenNoAdministratorIsOnline() throws Exception {
+        var clock = Clock.fixed(FIRST_DAY, ZoneOffset.UTC);
+        var subjectId = UUID.fromString("39f42621-37ca-42de-a303-a2abdd2218f4");
+        var server = mock(Server.class);
+        when(server.getPlayer(subjectId)).thenReturn(null);
+        when(server.getOnlinePlayers()).thenReturn(List.of());
+
+        try (var events = new CloudEventLog(directory.resolve("events"), clock, warning -> fail(warning))) {
+            new SentinelAlerts(server, events).send(
+                    AlertDecision.contextual(subjectId, 6, 0.34, 0.22, 10));
+        }
+
+        Path file = directory.resolve("events/2026-10-29.jsonl");
+        var lines = Files.readAllLines(file);
+        assertEquals(1, lines.size());
+        @SuppressWarnings("unchecked")
+        var event = (java.util.Map<String, Object>) new Yaml().load(lines.getFirst());
+        assertEquals("1.0", event.get("specversion"));
+        assertEquals("2026-10-29T23:59:58Z", event.get("time"));
+        assertEquals("urn:somc:purpur-sentinel", event.get("source"));
+        assertEquals("games.dmg.purpursentinel.alert.contextual-ground-speed", event.get("type"));
+        assertEquals(subjectId.toString(), event.get("subject"));
+        assertEquals("application/json", event.get("datacontenttype"));
+        assertNotNull(event.get("id"));
+        assertFalse(lines.getFirst().contains("Alex"));
+    }
+
+    @Test
+    void appendsAfterRestartAndRemovesAnExistingPartialTail() throws Exception {
+        Path events = directory.resolve("events");
+        Files.createDirectories(events);
+        Path file = events.resolve("2026-10-29.jsonl");
+        Files.writeString(file, "partial");
+        var alert = new AlertDecision(UUID.randomUUID(), 6, 1.03, 0.80);
+
+        try (var log = new CloudEventLog(events, Clock.fixed(FIRST_DAY, ZoneOffset.UTC), warning -> fail(warning))) {
+            log.offer(alert);
+        }
+        try (var log = new CloudEventLog(events, Clock.fixed(FIRST_DAY.plusSeconds(1), ZoneOffset.UTC), warning -> fail(warning))) {
+            log.offer(alert);
+        }
+
+        var lines = Files.readAllLines(file);
+        assertEquals(2, lines.size());
+        assertTrue(lines.getFirst().startsWith("{\"specversion\":\"1.0\""));
+        assertTrue(lines.get(1).startsWith("{\"specversion\":\"1.0\""));
+        @SuppressWarnings("unchecked")
+        var first = (java.util.Map<String, Object>) new Yaml().load(lines.getFirst());
+        @SuppressWarnings("unchecked")
+        var second = (java.util.Map<String, Object>) new Yaml().load(lines.get(1));
+        assertNotEquals(first.get("id"), second.get("id"));
+    }
+
+    @Test
+    void rollsOverAtUtcMidnightAndRetainsOnlyThirtyNamedUtcDayFiles() throws Exception {
+        Path events = directory.resolve("events");
+        Files.createDirectories(events);
+        Files.writeString(events.resolve("2026-09-30.jsonl"), "old\n");
+        Files.writeString(events.resolve("2026-10-01.jsonl"), "boundary\n");
+        Files.writeString(events.resolve("notes.jsonl"), "keep\n");
+        var clock = new MutableClock(FIRST_DAY);
+        var alert = new AlertDecision(UUID.randomUUID(), 6, 1.03, 0.80);
+
+        try (var log = new CloudEventLog(events, clock, warning -> fail(warning))) {
+            log.offer(alert);
+            await(() -> Files.exists(events.resolve("2026-10-29.jsonl")));
+            clock.set(Instant.parse("2026-10-30T00:00:01Z"));
+            log.offer(alert);
+        }
+
+        assertEquals(1, Files.readAllLines(events.resolve("2026-10-29.jsonl")).size());
+        assertEquals(1, Files.readAllLines(events.resolve("2026-10-30.jsonl")).size());
+        assertFalse(Files.exists(events.resolve("2026-09-30.jsonl")));
+        assertTrue(Files.exists(events.resolve("2026-10-01.jsonl")));
+        assertTrue(Files.exists(events.resolve("notes.jsonl")));
+    }
+
+    @Test
+    void everySignalProducesValidUuidOnlyBoundedDataWithJsonEscaping() throws Exception {
+        Path events = directory.resolve("events");
+        var id = UUID.randomUUID();
+        try (var log = new CloudEventLog(events, Clock.fixed(FIRST_DAY, ZoneOffset.UTC), warning -> fail(warning))) {
+            for (var signal : DetectionSignal.values()) {
+                log.offer(new AlertDecision(id, signal, 3, 1.5, 0.8, 20, 4.5, 2.0));
+            }
+            log.offer(new AlertDecision(id, DetectionSignal.UNSUPPORTED_BOAT_CRUISE,
+                    0, 0, 0, 0, 0, 40, 12, 0, "BAMBOO_\"RAFT\\TEST"));
+        }
+
+        var lines = Files.readAllLines(events.resolve("2026-10-29.jsonl"));
+        assertEquals(DetectionSignal.values().length + 1, lines.size());
+        for (String line : lines) {
+            @SuppressWarnings("unchecked")
+            var event = (java.util.Map<String, Object>) new Yaml().load(line);
+            @SuppressWarnings("unchecked")
+            var data = (java.util.Map<String, Object>) event.get("data");
+            assertEquals(id.toString(), event.get("subject"));
+            assertTrue(event.get("type").toString().startsWith("games.dmg.purpursentinel.alert."));
+            assertNotNull(data.get("signal"));
+            assertFalse(line.contains("displayName"));
+            assertFalse(line.contains("coordinate"));
+            assertFalse(line.contains("inventory"));
+            assertFalse(line.contains("permission"));
+        }
+        assertTrue(lines.getLast().contains("BAMBOO_\\\"RAFT\\\\TEST"));
+    }
+
+    @Test
+    void queueSaturationDropsOnlyNewRecordAndRateLimitsWarnings() throws Exception {
+        var warnings = new ArrayList<String>();
+        var gate = new CountDownLatch(1);
+        var entered = new CountDownLatch(1);
+        CloudEventLog.EventStore blocked = (observedAt, alert) -> {
+            entered.countDown();
+            try { gate.await(); } catch (InterruptedException exception) { Thread.currentThread().interrupt(); }
+        };
+        var clock = new MutableClock(FIRST_DAY);
+        var alert = new AlertDecision(UUID.randomUUID(), 6, 1.03, 0.80);
+        var log = new CloudEventLog(clock, warnings::add, 1, java.time.Duration.ofSeconds(1), blocked);
+        try {
+            log.offer(alert);
+            assertTrue(entered.await(1, TimeUnit.SECONDS));
+            log.offer(alert);
+            log.offer(alert);
+            log.offer(alert);
+            assertEquals(1, log.queuedEventCount());
+            gate.countDown();
+            await(() -> warnings.size() == 1);
+            assertFalse(warnings.getFirst().contains(alert.playerId().toString()));
+        } finally {
+            gate.countDown();
+            log.close();
+        }
+    }
+
+    @Test
+    void closeIsBoundedStopsAcceptanceAndClearsQueuedState() throws Exception {
+        var gate = new CountDownLatch(1);
+        var entered = new CountDownLatch(1);
+        CloudEventLog.EventStore blocked = (observedAt, alert) -> {
+            entered.countDown();
+            try { gate.await(); } catch (InterruptedException exception) { Thread.currentThread().interrupt(); }
+        };
+        var alert = new AlertDecision(UUID.randomUUID(), 6, 1.03, 0.80);
+        var log = new CloudEventLog(new MutableClock(FIRST_DAY), ignored -> {}, 2,
+                java.time.Duration.ofMillis(25), blocked);
+        log.offer(alert);
+        assertTrue(entered.await(1, TimeUnit.SECONDS));
+        log.offer(alert);
+
+        long started = System.nanoTime();
+        log.close();
+        long elapsedMillis = TimeUnit.NANOSECONDS.toMillis(System.nanoTime() - started);
+        log.offer(alert);
+
+        assertTrue(elapsedMillis < 500, "shutdown must remain bounded");
+        assertEquals(0, log.queuedEventCount());
+        gate.countDown();
+    }
+
+    @Test
+    void directoryFailuresFailOpenWithoutLeakingPathsOrSubjectData() throws Exception {
+        Path events = directory.resolve("events");
+        Files.writeString(events, "not a directory");
+        var warnings = new ArrayList<String>();
+        var alert = new AlertDecision(UUID.randomUUID(), 6, 1.03, 0.80);
+
+        try (var log = new CloudEventLog(events, Clock.fixed(FIRST_DAY, ZoneOffset.UTC), warnings::add)) {
+            log.offer(alert);
+        }
+
+        assertEquals(List.of("Sentinel could not write a durable alert; detection remains active."), warnings);
+        assertFalse(warnings.getFirst().contains(events.toString()));
+        assertFalse(warnings.getFirst().contains(alert.playerId().toString()));
+    }
+
+    @Test
+    void retentionFailuresHaveASeparateRateLimitedWarningAndRemainFailOpen() throws Exception {
+        var warnings = new ArrayList<String>();
+        var attempts = new AtomicInteger();
+        var completed = new CountDownLatch(1);
+        CloudEventLog.EventStore failing = (observedAt, alert) -> {
+            attempts.incrementAndGet();
+            completed.countDown();
+            throw new CloudEventLog.RetentionException(new java.io.IOException("sensitive retention detail"));
+        };
+        var alert = new AlertDecision(UUID.randomUUID(), 6, 1.03, 0.80);
+
+        try (var log = new CloudEventLog(new MutableClock(FIRST_DAY), warnings::add, 4,
+                java.time.Duration.ofSeconds(1), failing)) {
+            log.offer(alert);
+            assertTrue(completed.await(1, TimeUnit.SECONDS));
+        }
+
+        assertEquals(1, attempts.get());
+        assertEquals(List.of("Sentinel could not apply event log retention; detection remains active."), warnings);
+    }
+
+    @Test
+    void writeFailuresAreRateLimitedAndDoNotRejectLaterOffers() throws Exception {
+        var warnings = new ArrayList<String>();
+        var attempts = new AtomicInteger();
+        var completed = new CountDownLatch(2);
+        CloudEventLog.EventStore failing = (observedAt, alert) -> {
+            attempts.incrementAndGet();
+            completed.countDown();
+            throw new java.io.IOException("sensitive failure detail");
+        };
+        var clock = new MutableClock(FIRST_DAY);
+        var alert = new AlertDecision(UUID.randomUUID(), 6, 1.03, 0.80);
+
+        try (var log = new CloudEventLog(clock, warnings::add, 4, java.time.Duration.ofSeconds(1), failing)) {
+            log.offer(alert);
+            log.offer(alert);
+            assertTrue(completed.await(1, TimeUnit.SECONDS));
+        }
+
+        assertEquals(2, attempts.get());
+        assertEquals(1, warnings.size());
+        assertFalse(warnings.getFirst().contains("sensitive failure detail"));
+        assertFalse(warnings.getFirst().contains(alert.playerId().toString()));
+    }
+
+    private static void await(java.util.function.BooleanSupplier condition) throws InterruptedException {
+        for (int attempt = 0; attempt < 100 && !condition.getAsBoolean(); attempt++) Thread.sleep(10);
+        assertTrue(condition.getAsBoolean());
+    }
+
+    private static final class MutableClock extends Clock {
+        private volatile Instant instant;
+        private MutableClock(Instant instant) { this.instant = instant; }
+        private void set(Instant instant) { this.instant = instant; }
+        @Override public ZoneOffset getZone() { return ZoneOffset.UTC; }
+        @Override public Clock withZone(java.time.ZoneId zone) { return this; }
+        @Override public Instant instant() { return instant; }
+    }
+}

src/test/java/games/dmg/purpursentinel/PrivacyBoundaryTest.java

@@ -11,7 +11,7 @@ import org.junit.jupiter.api.io.TempDir;
 class PrivacyBoundaryTest {
     @TempDir Path directory;
 
-    @Test void observationAndInspectionNeverPersistPlayerIdentityOrEvidence() throws Exception {
+    @Test void observationAndInspectionDoNotWriteOutsideTheExplicitAlertLogBoundary() throws Exception {
         var file = directory.resolve("config.yml");
         AtomicYamlSettingsStore.writeDefaults(file);
         var service = SettingsService.load(new AtomicYamlSettingsStore(file));