feat(stealth): break concealed sessions on player damage

Resolve direct native damage sources and explicitly observed poison/wither provenance, including hidden layers and effective replacements. Preserve progression and potion effects while reusing identity/session cleanup. Verify native effect application, ticks, tab codecs and plugin registration. No deployment is included.

README.md

@@ -10,12 +10,32 @@ Progression-gated identity concealment for Purpur 26.2 build 2618, built and tes
 
 Artifacts are written to `build/libs/purpur-stealth-<version>.jar`. Gitea CI verifies pushes/pull requests; approved main-branch conventional commits drive versioned releases. The distribution tests inspect the built JAR, embedded version/runtime identity, Java 25 bytecode, and workflow naming.
 
+## Combat breaks stealth
+
+Dealing uncancelled positive damage to another player ends the attacker's concealed session and tells them: **Your stealth was broken because you hurt another player.** Melee, player-attributed projectiles and potions qualify; misses, cancelled/zero hits, self-damage, attacking mobs and merely taking damage do not. Identity and prior sleep-count participation are restored, including withdrawing Eye projections. Progress, unlocks and unrelated invisibility remain intact; re-entry uses the existing qualifying logout/login process.
+
+Delayed poison/wither use explicitly observed application sources and read-only native effect-layer snapshots, including hidden-layer restoration and rejected/cosmetic replacements. No nearby-player or wall-clock guess is made. Provenance is runtime-only and discarded on victim disconnect; unknown effects loaded after reconnect/restart are not assigned an invented attacker. The separately tracked signed-chat validation/system-message work remains pending.
+
+## Eye of True Seeing
+
+Earn a separate, personal unlock through eight cumulative online hours of Night Vision from directly drunk potions. Splash/lingering potions, commands, plugins and other sources do not count. Rejected and cosmetic-only replacements do not change attribution. Unattributed restored effects cannot inherit the drink timer; a new effective drink can start a new interval. Offline time is excluded.
+
+After the unlock is saved, craft an **Eye of True Seeing** with eight Netherite Blocks around an Eye of Ender. Right-click an authenticated Eye in either hand to move it into an empty helmet slot. Existing helmets are not replaced. Traded Eyes still require the holder's own saved unlock; renamed ordinary Eyes do not qualify. Automated crafters cannot bypass progression. Vanilla handles crafting ingredient consumption.
+
+While worn by an eligible player, the Eye reveals active Stealth targets' real overhead names within **16 blocks in three dimensions and line of sight**. It also reveals their bodies if they have gameplay invisibility, only to that observer. Ordinary invisible players without a concealed Stealth session are not revealed. Platform hiding, spectator mode, vanished metadata and effective team name-visibility restrictions take precedence. Eligibility is checked even for an Eye manually placed in the helmet slot.
+
+Revelation uses private client-only teams and recipient-specific metadata; it does not change server teams, remove potion effects or end Stealth sessions. Tab-list, chat, suggestions and server-list concealment remain unchanged, including for the wearer. Unequipping, leaving range/sight, lifecycle changes and disable withdraw the projection and restore current raw state. Failed deliveries revoke authorization and queue cleanup before recreation. Live-client appearance/timing and compatibility remain separate validation follow-ups.
+
+Eye records are independently UUID-keyed in `plugins/SpigotStealth/state.yml` (schema 2). Legacy Stealth records and extension fields are preserved. Crafting/use wait for successful save acknowledgement. Shutdown queues a final snapshot without blocking the tick thread, and initialization callbacks cannot revive a disabled or superseded lifecycle. Unacknowledged progress at abrupt process/power loss is not guaranteed.
+
+`check` includes `nativeStealthTest`, which downloads SHA-256-pinned Purpur 2618, patches it without starting a listening server, and exercises real potion events, items, recipes, event dispatch and plugin lifecycle with external platform doubles. Live-client appearance and gameplay checks remain separate follow-ups.
+
 ## Migration compatibility
 
 The repository and checkout are now `purpur-stealth` (previously remote `spigot-stealth`, local `spigot-invisibilty`). Runtime identity remains **SpigotStealth**, including `plugins/SpigotStealth/`, the existing Java entrypoint/packages, command names, `spigotstealth` permission/namespace identifiers, and persisted progression/session data. Java 17 is no longer supported for new builds or artifacts.
 
 Replace the old plugin JAR when installing the new distribution; never load both JARs together. Old tags and `spigot-stealth-*` release assets are preserved. Repository rename redirects have been checked against the previously deployed v1.5.0 download. Publishing a release does not authorize deployment.
 
-This migration does not implement the pending Eye, combat reveal, or concealed-chat stories. Existing gameplay and plugin metadata are unchanged.
+The v2.0.0 migration itself left the Eye, combat reveal and concealed-chat stories pending. Subsequent Eye acquisition, local revelation and combat-session breaking are described above; system-chat routing remains a separate unfinished story. Runtime plugin metadata is unchanged.
 
 See the [canonical project](https://git.garvis.dev/dmg/somc-okf/src/branch/main/projects/purpur-stealth/index.md), [stories](https://git.garvis.dev/dmg/somc-okf/src/branch/main/user-stories/purpur-stealth/index.md), and [development cycle](https://git.garvis.dev/dmg/somc-okf/src/branch/main/runbooks/development-cycle.md).

build.gradle.kts

@@ -1,3 +1,6 @@
+import java.net.URI
+import java.security.MessageDigest
+
 plugins {
     java
 }
@@ -43,6 +46,60 @@ tasks.test {
     systemProperty("distribution.version", project.version.toString())
 }
 
+// Exercise real potion events, item components and recipes without starting a listening server.
+val stealthRuntime = layout.buildDirectory.dir("stealth-runtime")
+val downloadStealthRuntime = tasks.register("downloadStealthRuntime") {
+    val launcher = stealthRuntime.map { it.file("purpur-26.2-2618.jar") }
+    outputs.file(launcher)
+    doLast {
+        val file = launcher.get().asFile
+        file.parentFile.mkdirs()
+        val connection = URI("https://api.purpurmc.org/v2/purpur/26.2/2618/download").toURL().openConnection()
+        connection.connectTimeout = 30_000
+        connection.readTimeout = 120_000
+        val bytes = connection.getInputStream().use { it.readBytes() }
+        val digest = MessageDigest.getInstance("SHA-256").digest(bytes).joinToString("") { "%02x".format(it) }
+        check(digest == "4a32d046a118804d89ca74ba89b798c98f6d8d1f310c18077ac573597049de31") {
+            "Purpur 2618 checksum mismatch"
+        }
+        file.writeBytes(bytes)
+    }
+}
+val prepareStealthRuntime = tasks.register<JavaExec>("prepareStealthRuntime") {
+    dependsOn(downloadStealthRuntime)
+    javaLauncher = javaToolchains.launcherFor { languageVersion = JavaLanguageVersion.of(25) }
+    classpath = files(stealthRuntime.map { it.file("purpur-26.2-2618.jar") })
+    mainClass = "io.papermc.paperclip.Main"
+    jvmArgs("-Dpaperclip.patchonly=true")
+    workingDir(stealthRuntime)
+    outputs.dir(stealthRuntime.map { it.dir("versions") })
+    outputs.dir(stealthRuntime.map { it.dir("libraries") })
+}
+val nativeTest = sourceSets.create("nativeTest")
+dependencies {
+    add(nativeTest.implementationConfigurationName, platform("org.junit:junit-bom:5.13.4"))
+    add(nativeTest.implementationConfigurationName, "org.junit.jupiter:junit-jupiter")
+    add(nativeTest.implementationConfigurationName, "org.mockito:mockito-core:5.18.0")
+    add(nativeTest.implementationConfigurationName, "net.dmulloy2:ProtocolLib:5.4.0")
+    add(nativeTest.compileOnlyConfigurationName, "org.jetbrains:annotations:26.0.2")
+    add(nativeTest.compileOnlyConfigurationName, "org.checkerframework:checker-qual:3.49.2")
+    add(nativeTest.runtimeOnlyConfigurationName, "org.junit.platform:junit-platform-launcher")
+}
+val nativeRuntimeJars = files(fileTree(stealthRuntime) {
+    include("versions/**/*.jar", "libraries/**/*.jar")
+}).builtBy(prepareStealthRuntime)
+nativeTest.compileClasspath += sourceSets.main.get().output + nativeRuntimeJars
+nativeTest.runtimeClasspath += sourceSets.main.get().output + nativeRuntimeJars
+val nativeStealthTest = tasks.register<Test>("nativeStealthTest") {
+    description = "Runs native Purpur adapter regressions without starting a server"
+    testClassesDirs = nativeTest.output.classesDirs
+    classpath = nativeTest.runtimeClasspath
+    useJUnitPlatform()
+    maxHeapSize = "1G"
+    workingDir(stealthRuntime)
+}
+tasks.check { dependsOn(nativeStealthTest) }
+
 val pluginVersion = version
 
 tasks.processResources {

src/main/java/games/dmg/spigotstealth/CombatRevealListener.java

@@ -0,0 +1,44 @@
+package games.dmg.spigotstealth;
+
+import java.util.UUID;
+import java.util.function.Consumer;
+import org.bukkit.event.EventHandler;
+import org.bukkit.event.EventPriority;
+import org.bukkit.event.Listener;
+import org.bukkit.event.entity.EntityDamageEvent;
+
+/** Ends identity concealment on attributed, successful player damage; never removes potion effects. */
+public final class CombatRevealListener implements Listener {
+    private final StealthSessionService sessions;
+    private final IdentityPresentation presentation;
+    private final Consumer<UUID> withdrawEyeTarget;
+    private final Consumer<Throwable> failures;
+    private final java.util.function.Function<EntityDamageEvent, org.bukkit.entity.Player> potionAttacker;
+
+    public CombatRevealListener(StealthSessionService sessions, IdentityPresentation presentation,
+            Consumer<UUID> withdrawEyeTarget, Consumer<Throwable> failures) {
+        this(sessions, presentation, withdrawEyeTarget, failures, event -> null);
+    }
+
+    public CombatRevealListener(StealthSessionService sessions, IdentityPresentation presentation,
+            Consumer<UUID> withdrawEyeTarget, Consumer<Throwable> failures,
+            java.util.function.Function<EntityDamageEvent, org.bukkit.entity.Player> potionAttacker) {
+        this.sessions = java.util.Objects.requireNonNull(sessions);
+        this.presentation = java.util.Objects.requireNonNull(presentation);
+        this.withdrawEyeTarget = java.util.Objects.requireNonNull(withdrawEyeTarget);
+        this.failures = java.util.Objects.requireNonNull(failures);
+        this.potionAttacker = java.util.Objects.requireNonNull(potionAttacker);
+    }
+
+    @EventHandler(priority = EventPriority.MONITOR, ignoreCancelled = true)
+    public void onDamage(EntityDamageEvent event) {
+        if (event.isCancelled() || !Double.isFinite(event.getFinalDamage()) || event.getFinalDamage() <= 0
+                || !(event.getEntity() instanceof org.bukkit.entity.Player victim)) { return; }
+        var attacker = event.getDamageSource().getCausingEntity() instanceof org.bukkit.entity.Player direct ? direct : potionAttacker.apply(event);
+        if (attacker == null || attacker.getUniqueId().equals(victim.getUniqueId()) || !sessions.isConcealed(attacker.getUniqueId())) { return; }
+        sessions.endConcealment(attacker.getUniqueId()).exceptionally(failure -> { failures.accept(failure); return null; });
+        withdrawEyeTarget.accept(attacker.getUniqueId());
+        presentation.reveal(attacker);
+        attacker.sendMessage("Your stealth was broken because you hurt another player.");
+    }
+}

src/main/java/games/dmg/spigotstealth/EyeCrafting.java

@@ -0,0 +1,66 @@
+package games.dmg.spigotstealth;
+
+import java.util.Objects;
+import org.bukkit.Keyed;
+import org.bukkit.Material;
+import org.bukkit.NamespacedKey;
+import org.bukkit.entity.Player;
+import org.bukkit.event.EventHandler;
+import org.bukkit.event.EventPriority;
+import org.bukkit.event.Listener;
+import org.bukkit.event.inventory.PrepareItemCraftEvent;
+import org.bukkit.inventory.ShapedRecipe;
+
+/** Personal crafting unlock for the transferable Eye. Vanilla owns ingredient consumption. */
+public final class EyeCrafting implements Listener {
+    public static final NamespacedKey RECIPE_KEY = new NamespacedKey("spigotstealth", "eye_of_true_seeing");
+    private final EyeItems items;
+    private final EyeProgressionService progression;
+
+    public EyeCrafting(EyeProgressionService progression, EyeItems items) {
+        this.progression = Objects.requireNonNull(progression, "progression");
+        this.items = Objects.requireNonNull(items, "items");
+    }
+
+    public ShapedRecipe recipe() {
+        return new ShapedRecipe(RECIPE_KEY, items.create()).shape("NNN", "NEN", "NNN")
+                .setIngredient('N', Material.NETHERITE_BLOCK).setIngredient('E', Material.ENDER_EYE);
+    }
+
+    @EventHandler(priority = EventPriority.HIGHEST, ignoreCancelled = true)
+    public void onCraft(org.bukkit.event.inventory.CraftItemEvent event) {
+        if (event.isCancelled() || !matches(event.getRecipe())) { return; }
+        if (!(event.getWhoClicked() instanceof Player player) || !progression.isUnlocked(player.getUniqueId())
+                || !accepts(event.getInventory().getMatrix()) || !items.isEye(event.getInventory().getResult())
+                || event.getInventory().getResult().getAmount() != 1) {
+            event.setCancelled(true);
+            event.getInventory().setResult(null);
+        }
+    }
+
+    @EventHandler(priority = EventPriority.HIGHEST, ignoreCancelled = true)
+    public void onCrafter(org.bukkit.event.block.CrafterCraftEvent event) {
+        if (matches(event.getRecipe())) { event.setCancelled(true); }
+    }
+
+    private static boolean matches(org.bukkit.inventory.Recipe recipe) {
+        return recipe instanceof Keyed keyed && RECIPE_KEY.equals(keyed.getKey());
+    }
+
+    private static boolean accepts(org.bukkit.inventory.ItemStack[] matrix) {
+        if (matrix.length != 9) { return false; }
+        for (int index = 0; index < matrix.length; index++) {
+            if (matrix[index] == null || matrix[index].getAmount() <= 0
+                    || matrix[index].getType() != (index == 4 ? Material.ENDER_EYE : Material.NETHERITE_BLOCK)) { return false; }
+        }
+        return true;
+    }
+
+    @EventHandler(priority = EventPriority.HIGHEST)
+    public void onPrepare(PrepareItemCraftEvent event) {
+        if (!(event.getInventory().getRecipe() instanceof Keyed keyed) || !RECIPE_KEY.equals(keyed.getKey())) { return; }
+        if (!(event.getView().getPlayer() instanceof Player player) || !progression.isUnlocked(player.getUniqueId())) {
+            event.getInventory().setResult(null);
+        }
+    }
+}

src/main/java/games/dmg/spigotstealth/EyeEquipment.java

@@ -0,0 +1,47 @@
+package games.dmg.spigotstealth;
+
+import java.util.Objects;
+import org.bukkit.entity.Player;
+import org.bukkit.event.Event;
+import org.bukkit.event.EventHandler;
+import org.bukkit.event.EventPriority;
+import org.bukkit.event.Listener;
+import org.bukkit.event.player.PlayerInteractEvent;
+import org.bukkit.inventory.EquipmentSlot;
+
+/** Player-specific eligibility and inventory movement; never invokes native Ender Eye use. */
+public final class EyeEquipment implements Listener {
+    private final EyeProgressionService progression;
+    private final EyeItems items;
+
+    public EyeEquipment(EyeProgressionService progression, EyeItems items) {
+        this.progression = Objects.requireNonNull(progression, "progression");
+        this.items = Objects.requireNonNull(items, "items");
+    }
+
+    public boolean isEligibleWearer(Player player) {
+        return progression.isUnlocked(player.getUniqueId()) && items.isEye(player.getInventory().getHelmet());
+    }
+
+    // Interact-in-air may start with block use denied; respect item-use denial rather than isCancelled().
+    @EventHandler(priority = EventPriority.HIGHEST)
+    public void onUse(PlayerInteractEvent event) {
+        if (!event.getAction().isRightClick() || event.useItemInHand() == Event.Result.DENY || !items.isEye(event.getItem())) { return; }
+        event.setUseItemInHand(Event.Result.DENY);
+        event.setUseInteractedBlock(Event.Result.DENY);
+        Player player = event.getPlayer();
+        if (player.isDead() || !progression.isUnlocked(player.getUniqueId())
+                || (event.getHand() != EquipmentSlot.HAND && event.getHand() != EquipmentSlot.OFF_HAND)) { return; }
+        var inventory = player.getInventory();
+        var helmet = inventory.getHelmet();
+        if (helmet != null && helmet.getAmount() > 0 && !helmet.getType().isAir()) { return; }
+        var held = inventory.getItem(event.getHand());
+        if (!items.isEye(held)) { return; }
+        var equipped = held.clone();
+        equipped.setAmount(1);
+        var remaining = held.clone();
+        remaining.setAmount(held.getAmount() - 1);
+        inventory.setItem(event.getHand(), remaining.getAmount() == 0 ? null : remaining);
+        inventory.setHelmet(equipped);
+    }
+}

src/main/java/games/dmg/spigotstealth/EyeItems.java

@@ -0,0 +1,34 @@
+package games.dmg.spigotstealth;
+
+import net.kyori.adventure.text.Component;
+import org.bukkit.Material;
+import org.bukkit.NamespacedKey;
+import org.bukkit.inventory.EquipmentSlot;
+import org.bukkit.inventory.ItemStack;
+import org.bukkit.persistence.PersistentDataType;
+
+/** Creates and identifies the transferable Eye; eligibility belongs to the holder's durable progression. */
+public final class EyeItems {
+    private static final NamespacedKey IDENTITY = new NamespacedKey("spigotstealth", "eye_of_true_seeing");
+
+    public ItemStack create() {
+        var eye = new ItemStack(Material.ENDER_EYE);
+        var meta = eye.getItemMeta();
+        meta.displayName(Component.text("Eye of True Seeing"));
+        meta.getPersistentDataContainer().set(IDENTITY, PersistentDataType.BYTE, (byte) 1);
+        meta.setMaxStackSize(1);
+        var equippable = meta.getEquippable();
+        equippable.setSlot(EquipmentSlot.HEAD);
+        equippable.setDispensable(false);
+        equippable.setEquipOnInteract(false);
+        equippable.setDamageOnHurt(false);
+        meta.setEquippable(equippable);
+        eye.setItemMeta(meta);
+        return eye;
+    }
+
+    public boolean isEye(ItemStack item) {
+        return item != null && item.getAmount() > 0 && item.getType() == Material.ENDER_EYE && item.hasItemMeta()
+                && Byte.valueOf((byte) 1).equals(item.getItemMeta().getPersistentDataContainer().get(IDENTITY, PersistentDataType.BYTE));
+    }
+}

src/main/java/games/dmg/spigotstealth/EyePacketListener.java

@@ -0,0 +1,66 @@
+package games.dmg.spigotstealth;
+
+import com.comphenix.protocol.PacketType;
+import com.comphenix.protocol.events.ListenerPriority;
+import com.comphenix.protocol.events.PacketAdapter;
+import com.comphenix.protocol.events.PacketContainer;
+import com.comphenix.protocol.events.PacketEvent;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Set;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.UUID;
+import java.util.function.Consumer;
+import java.util.function.Supplier;
+import org.bukkit.plugin.Plugin;
+
+/** Outgoing packet projection reads immutable authorization and never queries world or inventory state. */
+public final class EyePacketListener extends PacketAdapter {
+    private final Supplier<Map<UUID, Map<Integer, EyeRevealController.Projection>>> views;
+    private final Consumer<UUID> refresh;
+    private final Consumer<String> warning;
+    private final Set<PacketType> warned = ConcurrentHashMap.newKeySet();
+
+    public EyePacketListener(Plugin plugin, Supplier<Map<UUID, Map<Integer, EyeRevealController.Projection>>> views,
+            Consumer<UUID> refresh, Consumer<String> warning) {
+        super(plugin, ListenerPriority.HIGHEST, PacketType.Play.Server.ENTITY_METADATA, PacketType.Play.Server.SCOREBOARD_TEAM);
+        this.views = Objects.requireNonNull(views);
+        this.refresh = Objects.requireNonNull(refresh);
+        this.warning = Objects.requireNonNull(warning);
+    }
+
+    @Override public void onPacketSending(PacketEvent event) {
+        if (event.isCancelled() || event.getPlayer() == null || event.isPlayerTemporary()) { return; }
+        try {
+            // UUID is immutable connection identity; no inventory, world, visibility or effect queries occur here.
+            UUID viewer = event.getPlayer().getUniqueId();
+            if (viewer == null) { return; }
+            var current = views.get().getOrDefault(viewer, Map.of());
+            if (current.isEmpty()) { return; }
+            Object original = event.getPacket().getHandle();
+            if (event.getPacketType().equals(PacketType.Play.Server.ENTITY_METADATA)) {
+                int id = (Integer) original.getClass().getMethod("id").invoke(original);
+                var projection = current.get(id);
+                if (projection != null && projection.revealBody()) {
+                    event.setPacket(new PacketContainer(event.getPacketType(), EyePacketProjection.metadataPacket(original)));
+                }
+            } else if (event.getPacketType().equals(PacketType.Play.Server.SCOREBOARD_TEAM)) {
+                String name = (String) original.getClass().getMethod("getName").invoke(original);
+                var privateTeams = current.values().stream().map(EyeRevealController.Projection::privateTeam)
+                        .collect(java.util.stream.Collectors.toUnmodifiableSet());
+                var names = current.values().stream().map(EyeRevealController.Projection::playerName)
+                        .collect(java.util.stream.Collectors.toUnmodifiableSet());
+                if (!privateTeams.contains(name) && current.values().stream().anyMatch(p -> p.sourceTeam().filter(name::equals).isPresent())) {
+                    refresh.accept(viewer); // Only marks work; the callback must not query Bukkit here.
+                }
+                Object projected = EyePacketProjection.teamPacket(original, privateTeams, names);
+                if (projected != original) { event.setPacket(new PacketContainer(event.getPacketType(), projected)); }
+            }
+        } catch (ReflectiveOperationException | RuntimeException exception) {
+            if (warned.add(event.getPacketType())) {
+                warning.accept("Eye projection unavailable for " + event.getPacketType()
+                        + "; original packet retained. Failure: " + exception.getClass().getSimpleName());
+            }
+        }
+    }
+}

src/main/java/games/dmg/spigotstealth/EyePacketProjection.java

@@ -0,0 +1,115 @@
+package games.dmg.spigotstealth;
+
+import java.lang.reflect.RecordComponent;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Objects;
+
+/** Pure copies of declared-runtime packet data; no Bukkit lookups or global entity/team mutations. */
+public final class EyePacketProjection {
+    private static final String TEAM_PARAMETERS = "net.minecraft.network.protocol.game.ClientboundSetPlayerTeamPacket$Parameters";
+    private EyePacketProjection() { }
+
+    public static Object teamPacket(Object original, java.util.Set<String> privateTeams, java.util.Set<String> projectedPlayers) {
+        Objects.requireNonNull(original, "original");
+        Class<?> type = original.getClass();
+        if (!type.getName().equals("net.minecraft.network.protocol.game.ClientboundSetPlayerTeamPacket")) {
+            throw new IllegalArgumentException("Unsupported native team packet");
+        }
+        try {
+            String name = (String) type.getMethod("getName").invoke(original);
+            var players = (java.util.Collection<?>) type.getMethod("getPlayers").invoke(original);
+            var parameters = (java.util.Optional<?>) type.getMethod("getParameters").invoke(original);
+            boolean privateTeam = privateTeams.contains(name);
+            var projectedParameters = privateTeam ? parameters.map(EyePacketProjection::teamParameters) : parameters;
+            var projectedMembers = privateTeam ? players : players.stream().filter(player -> !projectedPlayers.contains(player)).toList();
+            if (projectedParameters == parameters && projectedMembers.size() == players.size()) { return original; }
+            var method = type.getDeclaredField("method");
+            method.setAccessible(true);
+            var constructor = type.getDeclaredConstructor(String.class, int.class, java.util.Optional.class, java.util.Collection.class);
+            constructor.setAccessible(true);
+            return constructor.newInstance(name, method.getInt(original), projectedParameters, projectedMembers);
+        } catch (ReflectiveOperationException exception) {
+            throw new IllegalStateException("Could not project native team membership", exception);
+        }
+    }
+
+    public static Object metadataPacket(Object original) {
+        Objects.requireNonNull(original, "original");
+        Class<?> type = original.getClass();
+        if (!type.getName().equals("net.minecraft.network.protocol.game.ClientboundSetEntityDataPacket")) {
+            throw new IllegalArgumentException("Unsupported native metadata packet");
+        }
+        try {
+            var values = (List<?>) type.getMethod("packedItems").invoke(original);
+            var projected = new ArrayList<Object>(values.size());
+            for (Object value : values) {
+                Class<?> valueType = value.getClass();
+                if (!valueType.getName().equals("net.minecraft.network.syncher.SynchedEntityData$DataValue")) {
+                    throw new IllegalArgumentException("Unsupported native metadata value");
+                }
+                int index = (Integer) valueType.getMethod("id").invoke(value);
+                if (index != 0) { projected.add(value); continue; }
+                Object raw = valueType.getMethod("value").invoke(value);
+                if (!(raw instanceof Byte flags)) { throw new IllegalArgumentException("Shared entity flags must be a byte"); }
+                Object serializer = valueType.getMethod("serializer").invoke(value);
+                projected.add(valueType.getConstructor(int.class,
+                        Class.forName("net.minecraft.network.syncher.EntityDataSerializer"), Object.class)
+                        .newInstance(index, serializer, (byte) (flags & ~0x20)));
+            }
+            return type.getConstructor(int.class, List.class)
+                    .newInstance(type.getMethod("id").invoke(original), List.copyOf(projected));
+        } catch (ReflectiveOperationException exception) {
+            throw new IllegalStateException("Could not project native entity metadata", exception);
+        }
+    }
+
+    public static Object teamParameters(Object original) {
+        try {
+            Object empty = Class.forName("net.minecraft.network.chat.Component").getMethod("empty").invoke(null);
+            return copyParameters(original, java.util.Map.of("playerPrefix", empty));
+        } catch (ReflectiveOperationException exception) {
+            throw new IllegalStateException("Could not project the native team prefix", exception);
+        }
+    }
+
+    public static Object teamVisibility(Object original, boolean visible) {
+        try {
+            Object visibility = Class.forName("net.minecraft.world.scores.Team$Visibility").getField(visible ? "ALWAYS" : "NEVER").get(null);
+            return copyParameters(original, java.util.Map.of("nameTagVisibility", visibility));
+        } catch (ReflectiveOperationException exception) {
+            throw new IllegalStateException("Could not preserve effective team visibility", exception);
+        }
+    }
+
+    private static Object copyParameters(Object original, java.util.Map<String, Object> replacements) {
+        Objects.requireNonNull(original, "original");
+        Class<?> type = original.getClass();
+        if (!TEAM_PARAMETERS.equals(type.getName()) || !type.isRecord()) {
+            throw new IllegalArgumentException("Unsupported native team parameter layout");
+        }
+        try {
+            RecordComponent[] components = type.getRecordComponents();
+            Class<?>[] types = new Class<?>[components.length];
+            Object[] values = new Object[components.length];
+            int replaced = 0;
+            for (int index = 0; index < components.length; index++) {
+                var component = components[index];
+                types[index] = component.getType();
+                if (replacements.containsKey(component.getName())) {
+                    values[index] = replacements.get(component.getName());
+                    replaced++;
+                } else {
+                    // Accessors may consult global collision configuration. Copy the stored record data verbatim.
+                    var field = type.getDeclaredField(component.getName());
+                    field.setAccessible(true);
+                    values[index] = field.get(original);
+                }
+            }
+            if (replaced != replacements.size()) { throw new IllegalArgumentException("Required native team fields are unavailable"); }
+            return type.getDeclaredConstructor(types).newInstance(values);
+        } catch (ReflectiveOperationException exception) {
+            throw new IllegalStateException("Could not project the native team prefix", exception);
+        }
+    }
+}

src/main/java/games/dmg/spigotstealth/EyePotionListener.java

@@ -0,0 +1,101 @@
+package games.dmg.spigotstealth;
+
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Objects;
+import java.util.UUID;
+import java.util.concurrent.CompletableFuture;
+import java.util.function.Consumer;
+import java.util.function.Function;
+import org.bukkit.entity.Player;
+import org.bukkit.event.EventHandler;
+import org.bukkit.event.EventPriority;
+import org.bukkit.event.Listener;
+import org.bukkit.event.entity.EntityPotionEffectEvent;
+import org.bukkit.event.player.PlayerQuitEvent;
+import org.bukkit.potion.PotionEffect;
+import org.bukkit.potion.PotionEffectType;
+
+/** Night Vision potion-event adapter; progression and persistence are owned by the service. */
+public final class EyePotionListener implements Listener {
+    private final EyeProgressionService progression;
+    private final Consumer<Throwable> saveFailure;
+    private final Map<UUID, PotionEffect> expectedEffects = new HashMap<>();
+
+    public EyePotionListener(EyeProgressionService progression, Consumer<Throwable> saveFailure) {
+        this.progression = Objects.requireNonNull(progression, "progression");
+        this.saveFailure = Objects.requireNonNull(saveFailure, "saveFailure");
+    }
+
+    @EventHandler(priority = EventPriority.MONITOR, ignoreCancelled = true)
+    public void onPotionEffect(EntityPotionEffectEvent event) {
+        if (event.isCancelled() || !(event.getEntity() instanceof Player player)
+                || !PotionEffectType.NIGHT_VISION.equals(event.getModifiedType())) {
+            return;
+        }
+        if (event.getAction() == EntityPotionEffectEvent.Action.CHANGED && !replacesActiveEffect(event)) {
+            return;
+        }
+        boolean addedOrChanged = event.getAction() == EntityPotionEffectEvent.Action.ADDED
+                || event.getAction() == EntityPotionEffectEvent.Action.CHANGED;
+        if (addedOrChanged && event.getCause() == EntityPotionEffectEvent.Cause.POTION_DRINK) {
+            if (!continuesEffect(expectedEffects.get(player.getUniqueId()), event.getOldEffect())) {
+                progression.abandon(player.getUniqueId());
+            }
+            expectedEffects.put(player.getUniqueId(), event.getNewEffect());
+            observe(progression.begin(player.getUniqueId()));
+        } else {
+            finish(player.getUniqueId(), event.getOldEffect());
+        }
+    }
+
+    @EventHandler(priority = EventPriority.MONITOR)
+    public void onQuit(PlayerQuitEvent event) {
+        finish(event.getPlayer().getUniqueId(), event.getPlayer().getPotionEffect(PotionEffectType.NIGHT_VISION));
+    }
+
+    /** Server-thread observation; a missing/unattributed effect cannot inherit an old drink interval. */
+    public void checkpoint(Function<UUID, Player> onlinePlayer) {
+        for (var id : progression.activePlayerIds()) {
+            Player player = onlinePlayer.apply(id);
+            var actual = player == null || !player.isOnline() || player.isDead()
+                    ? null : player.getPotionEffect(PotionEffectType.NIGHT_VISION);
+            var expected = expectedEffects.get(id);
+            if (!continuesEffect(expected, actual) || (!actual.isInfinite() && actual.getDuration() <= 0)) {
+                expectedEffects.remove(id);
+                progression.abandon(id); // Discard the unobserved tail, never attribute it to the old source.
+            } else {
+                expectedEffects.put(id, actual);
+                observe(progression.checkpoint(id));
+            }
+        }
+    }
+
+    private void finish(UUID id, PotionEffect finalEffect) {
+        var expected = expectedEffects.remove(id);
+        if (continuesEffect(expected, finalEffect)) { observe(progression.stop(id)); }
+        else { progression.abandon(id); }
+    }
+
+    private static boolean continuesEffect(PotionEffect expected, PotionEffect actual) {
+        return actual != null && expected != null && actual.getAmplifier() == expected.getAmplifier()
+                && (expected.isInfinite() ? actual.isInfinite()
+                    : !actual.isInfinite() && actual.getDuration() <= expected.getDuration());
+    }
+
+    private void observe(CompletableFuture<Void> saved) {
+        saved.whenComplete((ignored, failure) -> {
+            if (failure != null) { saveFailure.accept(failure); }
+        });
+    }
+
+    private static boolean replacesActiveEffect(EntityPotionEffectEvent event) {
+        if (!event.isOverride() || event.getOldEffect() == null || event.getNewEffect() == null) { return false; }
+        var previous = event.getOldEffect();
+        var next = event.getNewEffect();
+        // Native update can return true for particles/icons alone. Hidden weaker effects are not active yet.
+        return next.getAmplifier() > previous.getAmplifier()
+                || (next.getAmplifier() == previous.getAmplifier() && !previous.isInfinite()
+                    && (next.isInfinite() || next.getDuration() > previous.getDuration()));
+    }
+}

src/main/java/games/dmg/spigotstealth/EyeProgress.java

@@ -0,0 +1,13 @@
+package games.dmg.spigotstealth;
+
+import java.util.Map;
+
+/** Independent durable Eye of True Seeing progress. Active potion intervals are never resumed from disk. */
+public record EyeProgress(long accumulatedMillis, boolean unlocked, Map<String, Object> unknownFields) {
+    public EyeProgress {
+        if (accumulatedMillis < 0) { throw new IllegalArgumentException("Eye progress cannot be negative"); }
+        unknownFields = Map.copyOf(unknownFields);
+    }
+    public EyeProgress(long accumulatedMillis, boolean unlocked) { this(accumulatedMillis, unlocked, Map.of()); }
+    public static EyeProgress empty() { return new EyeProgress(0, false); }
+}

src/main/java/games/dmg/spigotstealth/EyeProgressionService.java

@@ -0,0 +1,73 @@
+package games.dmg.spigotstealth;
+
+import java.time.Duration;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Set;
+import java.util.UUID;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.function.Consumer;
+import java.util.function.LongSupplier;
+
+/** Server-thread qualifying intervals; durable rewards are acknowledged by the existing I/O executor. */
+public final class EyeProgressionService {
+    public static final Duration UNLOCK_THRESHOLD = Duration.ofHours(8);
+    private record Interval(long startedNanos, long creditedMillis) { }
+    private final StealthStateManager states;
+    private final LongSupplier nanoTime;
+    private final Consumer<UUID> unlocked;
+    private final Map<UUID, Interval> active = new HashMap<>();
+    private final Set<UUID> announced = ConcurrentHashMap.newKeySet();
+
+    /** The notification callback must marshal Bukkit work onto the server thread. */
+    public EyeProgressionService(StealthStateManager states, LongSupplier nanoTime, Consumer<UUID> unlocked) {
+        this.states = Objects.requireNonNull(states, "states");
+        this.nanoTime = Objects.requireNonNull(nanoTime, "nanoTime");
+        this.unlocked = Objects.requireNonNull(unlocked, "unlocked");
+        states.durableSnapshot().eyes().forEach((id, progress) -> {
+            if (progress.unlocked()) { announced.add(id); }
+        });
+    }
+
+    public CompletableFuture<Void> begin(UUID id) {
+        Objects.requireNonNull(id, "id");
+        if (active.containsKey(id)) { return checkpoint(id); }
+        active.put(id, new Interval(nanoTime.getAsLong(), 0));
+        return CompletableFuture.completedFuture(null);
+    }
+
+    public CompletableFuture<Void> checkpoint(UUID id) {
+        Interval interval = active.get(id);
+        if (interval == null) { return CompletableFuture.completedFuture(null); }
+        // Keep the original start: repeated checkpoints must not discard fractional milliseconds.
+        long total = Math.max(interval.creditedMillis(), Math.max(0, nanoTime.getAsLong() - interval.startedNanos()) / 1_000_000);
+        long elapsed = total - interval.creditedMillis();
+        if (elapsed == 0) { return CompletableFuture.completedFuture(null); }
+        active.put(id, new Interval(interval.startedNanos(), total));
+        return states.update(state -> {
+            EyeProgress previous = state.eyeProgress(id);
+            long accumulated = Math.addExact(previous.accumulatedMillis(), elapsed);
+            return state.withEyeProgress(id, new EyeProgress(accumulated,
+                previous.unlocked() || accumulated >= UNLOCK_THRESHOLD.toMillis(), previous.unknownFields()));
+        }).thenRun(() -> {
+            if (isUnlocked(id) && announced.add(id)) { unlocked.accept(id); }
+        });
+    }
+
+    public CompletableFuture<Void> stop(UUID id) {
+        CompletableFuture<Void> saved = checkpoint(id);
+        active.remove(id);
+        return saved;
+    }
+
+    public CompletableFuture<Void> stopAll() {
+        return CompletableFuture.allOf(activePlayerIds().stream().map(this::stop).toArray(CompletableFuture[]::new));
+    }
+
+    /** Defensive offline sweep: do not invent credit for the unobserved interval after the last checkpoint. */
+    public void abandon(UUID id) { active.remove(id); }
+    public boolean isUnlocked(UUID id) { return states.durableSnapshot().eyeProgress(id).unlocked(); }
+    public Set<UUID> activePlayerIds() { return Set.copyOf(active.keySet()); }
+}

src/main/java/games/dmg/spigotstealth/EyeRevealController.java

@@ -0,0 +1,233 @@
+package games.dmg.spigotstealth;
+
+import java.util.Collection;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.Set;
+import java.util.UUID;
+import java.util.function.Predicate;
+import java.util.function.Supplier;
+import org.bukkit.GameMode;
+import org.bukkit.Location;
+import org.bukkit.World;
+import org.bukkit.entity.Player;
+import org.bukkit.metadata.MetadataValue;
+import org.bukkit.potion.PotionEffectType;
+
+/** Server-thread visibility capture and delivery; published projections contain no mutable Bukkit objects. */
+public final class EyeRevealController implements Runnable, AutoCloseable {
+    public record Projection(UUID targetId, int entityId, String playerName, String privateTeam,
+            Optional<String> sourceTeam, boolean revealBody) { }
+    public interface Delivery {
+        void show(Player viewer, Player target, Projection projection, boolean create);
+        void restore(Player viewer, Optional<Player> target, Projection projection);
+    }
+
+    private final Supplier<? extends Collection<? extends Player>> onlinePlayers;
+    private final EyeEquipment equipment;
+    private final Predicate<UUID> concealed;
+    private final Delivery delivery;
+    private final Supplier<String> teamNames;
+    private final java.util.function.Consumer<Throwable> failure;
+    private record RestoreKey(UUID viewer, String team) { }
+    private record TargetKey(UUID viewer, UUID target) { }
+    private final Map<RestoreKey, Projection> restoring = new java.util.LinkedHashMap<>();
+    private final Set<UUID> warned = new HashSet<>();
+    private volatile Map<UUID, Map<Integer, Projection>> views = Map.of();
+    private volatile boolean closed;
+    private final Set<UUID> dirty = java.util.concurrent.ConcurrentHashMap.newKeySet();
+
+    public EyeRevealController(Supplier<? extends Collection<? extends Player>> onlinePlayers, EyeEquipment equipment,
+            Predicate<UUID> concealed, Delivery delivery, Supplier<String> teamNames) {
+        this(onlinePlayers, equipment, concealed, delivery, teamNames,
+                error -> java.util.logging.Logger.getLogger(EyeRevealController.class.getName())
+                        .warning("Eye delivery failed; cleanup queued: " + error.getClass().getSimpleName()));
+    }
+
+    public EyeRevealController(Supplier<? extends Collection<? extends Player>> onlinePlayers, EyeEquipment equipment,
+            Predicate<UUID> concealed, Delivery delivery, Supplier<String> teamNames, java.util.function.Consumer<Throwable> failure) {
+        this.onlinePlayers = Objects.requireNonNull(onlinePlayers);
+        this.equipment = Objects.requireNonNull(equipment);
+        this.concealed = Objects.requireNonNull(concealed);
+        this.delivery = Objects.requireNonNull(delivery);
+        this.teamNames = Objects.requireNonNull(teamNames);
+        this.failure = Objects.requireNonNull(failure);
+    }
+
+    public Map<UUID, Map<Integer, Projection>> snapshot() { return views; }
+
+    /** Packet-thread safe: defer all Bukkit access and actual delivery to the next server-thread frame. */
+    public void requestRefresh(UUID viewer) {
+        if (!closed) { dirty.add(Objects.requireNonNull(viewer)); }
+    }
+
+    @Override public void run() {
+        if (closed) { return; }
+        var requested = Set.copyOf(dirty);
+        requested.forEach(dirty::remove);
+        List<? extends Player> online = List.copyOf(onlinePlayers.get());
+        var players = new HashMap<UUID, Player>();
+        online.forEach(player -> players.put(player.getUniqueId(), player));
+        var attemptedRestores = new HashSet<RestoreKey>();
+        retryRestores(players, attemptedRestores);
+        var blocked = restoring.entrySet().stream().map(entry -> new TargetKey(entry.getKey().viewer(), entry.getValue().targetId()))
+                .collect(java.util.stream.Collectors.toUnmodifiableSet());
+        Map<UUID, Map<Integer, Projection>> previous = views;
+        var usedNames = new HashSet<String>();
+        previous.values().forEach(view -> view.values().forEach(projection -> usedNames.add(projection.privateTeam())));
+        restoring.values().forEach(projection -> usedNames.add(projection.privateTeam()));
+        var next = new HashMap<UUID, Map<Integer, Projection>>();
+        for (Player viewer : online) {
+            try {
+                if (!viewer.isOnline() || viewer.isDead() || !equipment.isEligibleWearer(viewer)) { continue; }
+                Location origin = viewer.getLocation();
+                var observer = new EyeVisibility.Viewer(viewer.getUniqueId(), position(origin), true);
+                var targets = new HashMap<Integer, Projection>();
+                for (Player target : online) {
+                    if (!target.isOnline() || target.isDead() || blocked.contains(new TargetKey(viewer.getUniqueId(), target.getUniqueId()))) { continue; }
+                    Location destination = target.getLocation();
+                    var subject = new EyeVisibility.Target(target.getUniqueId(), position(destination),
+                            concealed.test(target.getUniqueId()), target.getGameMode() == GameMode.SPECTATOR,
+                            target.getMetadata("vanished").stream().anyMatch(MetadataValue::asBoolean));
+                    boolean visible = viewer.canSee(target) && target.getTrackedBy().contains(viewer);
+                    if (!EyeVisibility.canReveal(observer, subject, visible, true)) { continue; }
+                    var sourceTeam = viewer.getScoreboard().getEntryTeam(target.getName());
+                    if (!EyeTeamVisibility.visible(viewer, sourceTeam)
+                            || !chunksLoaded(origin.getWorld(), origin, destination) || !viewer.hasLineOfSight(target)) { continue; }
+                    Projection old = previous.getOrDefault(viewer.getUniqueId(), Map.of()).get(target.getEntityId());
+                    String team = old != null && old.targetId().equals(target.getUniqueId()) && old.playerName().equals(target.getName())
+                            ? old.privateTeam() : allocateTeam(viewer, usedNames);
+                    var baseline = Optional.ofNullable(sourceTeam).map(org.bukkit.scoreboard.Team::getName);
+                    targets.put(target.getEntityId(), new Projection(target.getUniqueId(), target.getEntityId(), target.getName(),
+                            team, baseline, target.hasPotionEffect(PotionEffectType.INVISIBILITY)));
+                }
+                if (!targets.isEmpty()) { next.put(viewer.getUniqueId(), Map.copyOf(targets)); }
+            } catch (RuntimeException error) {
+                // Never retain a stale authorization when an authoritative visibility query fails.
+                report(viewer.getUniqueId(), error);
+            }
+        }
+        views = Map.copyOf(next); // Publish authorization before any outgoing projection/restoration packet.
+        previous.forEach((viewerId, targets) -> {
+            Player viewer = players.get(viewerId);
+            if (viewer == null || !viewer.isOnline()) { return; }
+            targets.values().forEach(old -> {
+                Projection current = views.getOrDefault(viewerId, Map.of()).get(old.entityId());
+                if (current == null || !current.privateTeam().equals(old.privateTeam())) {
+                    restoring.putIfAbsent(new RestoreKey(viewerId, old.privateTeam()), old);
+                }
+            });
+        });
+        retryRestores(players, attemptedRestores);
+        views.forEach((viewerId, targets) -> targets.values().forEach(current -> {
+            Projection old = previous.getOrDefault(viewerId, Map.of()).get(current.entityId());
+            if (!current.equals(old) || requested.contains(viewerId)) {
+                try {
+                    delivery.show(players.get(viewerId), players.get(current.targetId()), current,
+                            old == null || !current.privateTeam().equals(old.privateTeam()));
+                    warned.remove(viewerId);
+                } catch (RuntimeException error) {
+                    deny(viewerId, current.targetId());
+                    restoring.putIfAbsent(new RestoreKey(viewerId, current.privateTeam()), current);
+                    report(viewerId, error);
+                }
+            }
+        }));
+    }
+
+    public void hide(UUID viewer, UUID target) {
+        withdraw((observer, projection) -> observer.equals(viewer) && projection.targetId().equals(target));
+    }
+    public void withdrawViewer(UUID viewer) { withdraw((observer, projection) -> observer.equals(viewer)); }
+    public void withdrawTarget(UUID target) { withdraw((observer, projection) -> projection.targetId().equals(target)); }
+
+    /** Lifecycle callbacks call this on the server thread before the next scheduled visibility capture. */
+    private void withdraw(java.util.function.BiPredicate<UUID, Projection> remove) {
+        var previous = views;
+        var next = new HashMap<UUID, Map<Integer, Projection>>();
+        previous.forEach((viewer, targets) -> {
+            var retained = new HashMap<Integer, Projection>();
+            targets.forEach((id, projection) -> { if (!remove.test(viewer, projection)) { retained.put(id, projection); } });
+            if (!retained.isEmpty()) { next.put(viewer, Map.copyOf(retained)); }
+        });
+        views = Map.copyOf(next);
+        var players = new HashMap<UUID, Player>();
+        onlinePlayers.get().forEach(player -> players.put(player.getUniqueId(), player));
+        previous.forEach((viewerId, targets) -> {
+            Player viewer = players.get(viewerId);
+            if (viewer != null && viewer.isOnline()) {
+                targets.values().stream().filter(projection -> remove.test(viewerId, projection))
+                        .forEach(projection -> restoring.putIfAbsent(new RestoreKey(viewerId, projection.privateTeam()), projection));
+            }
+        });
+        retryRestores(players, new HashSet<>());
+    }
+
+    @Override public void close() {
+        if (closed && restoring.isEmpty()) { return; }
+        closed = true;
+        dirty.clear();
+        withdraw((viewer, projection) -> true);
+    }
+
+    private void retryRestores(Map<UUID, Player> players, Set<RestoreKey> attempted) {
+        for (var entry : List.copyOf(restoring.entrySet())) {
+            var key = entry.getKey();
+            if (!attempted.add(key)) { continue; }
+            var projection = entry.getValue();
+            Player viewer = players.get(key.viewer());
+            if (viewer == null || !viewer.isOnline()) { restoring.remove(key); continue; }
+            try {
+                delivery.restore(viewer, Optional.ofNullable(players.get(projection.targetId())), projection);
+                restoring.remove(key);
+            } catch (RuntimeException error) {
+                deny(key.viewer(), projection.targetId());
+                report(key.viewer(), error);
+            }
+        }
+    }
+
+    private void deny(UUID viewer, UUID target) {
+        var next = new HashMap<>(views);
+        var retained = new HashMap<>(next.getOrDefault(viewer, Map.of()));
+        retained.values().removeIf(projection -> projection.targetId().equals(target));
+        if (retained.isEmpty()) { next.remove(viewer); }
+        else { next.put(viewer, Map.copyOf(retained)); }
+        views = Map.copyOf(next);
+    }
+
+    private void report(UUID viewer, RuntimeException error) {
+        if (warned.add(viewer)) { failure.accept(error); }
+    }
+
+    private String allocateTeam(Player viewer, Set<String> used) {
+        for (int attempt = 0; attempt < 32; attempt++) {
+            String name = teamNames.get();
+            if (name != null && name.matches("[a-zA-Z0-9_-]{1,16}") && !used.contains(name)
+                    && viewer.getScoreboard().getTeam(name) == null) {
+                used.add(name);
+                return name;
+            }
+        }
+        throw new IllegalStateException("Could not allocate an isolated Eye team name");
+    }
+
+    private static EyeVisibility.Position position(Location location) {
+        return new EyeVisibility.Position(location.getWorld().getUID(), location.getX(), location.getY(), location.getZ());
+    }
+
+    private static boolean chunksLoaded(World world, Location from, Location to) {
+        int minX = (int) Math.floor(Math.min(from.getX(), to.getX())) >> 4;
+        int maxX = (int) Math.floor(Math.max(from.getX(), to.getX())) >> 4;
+        int minZ = (int) Math.floor(Math.min(from.getZ(), to.getZ())) >> 4;
+        int maxZ = (int) Math.floor(Math.max(from.getZ(), to.getZ())) >> 4;
+        for (int x = minX; x <= maxX; x++) {
+            for (int z = minZ; z <= maxZ; z++) { if (!world.isChunkLoaded(x, z)) { return false; } }
+        }
+        return true;
+    }
+}

src/main/java/games/dmg/spigotstealth/EyeRevealEvents.java

@@ -0,0 +1,57 @@
+package games.dmg.spigotstealth;
+
+import com.destroystokyo.paper.event.player.PlayerArmorChangeEvent;
+import io.papermc.paper.event.player.PlayerUntrackEntityEvent;
+import org.bukkit.event.EventHandler;
+import org.bukkit.event.EventPriority;
+import org.bukkit.event.Listener;
+import org.bukkit.event.entity.EntityPotionEffectEvent;
+import org.bukkit.event.entity.PlayerDeathEvent;
+import org.bukkit.event.player.PlayerChangedWorldEvent;
+import org.bukkit.event.player.PlayerGameModeChangeEvent;
+import org.bukkit.event.player.PlayerHideEntityEvent;
+import org.bukkit.event.player.PlayerQuitEvent;
+import org.bukkit.event.player.PlayerRespawnEvent;
+import org.bukkit.event.player.PlayerTeleportEvent;
+
+/** Immediate server-thread invalidation; ordinary motion and line-of-sight changes are polled each tick. */
+public final class EyeRevealEvents implements Listener {
+    private final EyeRevealController controller;
+    public EyeRevealEvents(EyeRevealController controller) { this.controller = java.util.Objects.requireNonNull(controller); }
+
+    @EventHandler(priority = EventPriority.MONITOR) public void onHide(PlayerHideEntityEvent event) {
+        if (event.getEntity() instanceof org.bukkit.entity.Player player) { controller.hide(event.getPlayer().getUniqueId(), player.getUniqueId()); }
+    }
+    @EventHandler(priority = EventPriority.MONITOR) public void onUntrack(PlayerUntrackEntityEvent event) {
+        if (event.getEntity() instanceof org.bukkit.entity.Player player) { controller.hide(event.getPlayer().getUniqueId(), player.getUniqueId()); }
+    }
+    @EventHandler(priority = EventPriority.MONITOR) public void onArmor(PlayerArmorChangeEvent event) {
+        if (event.getSlot() == org.bukkit.inventory.EquipmentSlot.HEAD) { controller.withdrawViewer(event.getPlayer().getUniqueId()); }
+    }
+    @EventHandler(priority = EventPriority.MONITOR, ignoreCancelled = true) public void onGameMode(PlayerGameModeChangeEvent event) {
+        if (!event.isCancelled() && event.getNewGameMode() == org.bukkit.GameMode.SPECTATOR) { both(event.getPlayer().getUniqueId()); }
+    }
+    @EventHandler(priority = EventPriority.MONITOR, ignoreCancelled = true) public void onEffect(EntityPotionEffectEvent event) {
+        if (!event.isCancelled() && event.getEntity() instanceof org.bukkit.entity.Player player
+                && org.bukkit.potion.PotionEffectType.INVISIBILITY.equals(event.getModifiedType())) {
+            controller.withdrawTarget(player.getUniqueId());
+        }
+    }
+    @EventHandler(priority = EventPriority.MONITOR) public void onQuit(PlayerQuitEvent event) { both(event.getPlayer().getUniqueId()); }
+    @EventHandler(priority = EventPriority.MONITOR, ignoreCancelled = true) public void onTeleport(PlayerTeleportEvent event) {
+        if (!event.isCancelled()) { both(event.getPlayer().getUniqueId()); }
+    }
+    @EventHandler(priority = EventPriority.MONITOR) public void onRespawn(PlayerRespawnEvent event) { both(event.getPlayer().getUniqueId()); }
+    @EventHandler(priority = EventPriority.MONITOR, ignoreCancelled = true) public void onDeath(PlayerDeathEvent event) {
+        if (!cancelled(event)) { both(event.getEntity().getUniqueId()); }
+    }
+    @EventHandler(priority = EventPriority.MONITOR) public void onWorld(PlayerChangedWorldEvent event) { both(event.getPlayer().getUniqueId()); }
+
+    private void both(java.util.UUID player) {
+        controller.withdrawViewer(player);
+        controller.withdrawTarget(player);
+    }
+    private static boolean cancelled(org.bukkit.event.Event event) {
+        return event instanceof org.bukkit.event.Cancellable cancellable && cancellable.isCancelled();
+    }
+}

src/main/java/games/dmg/spigotstealth/EyeRevealRuntime.java

@@ -0,0 +1,60 @@
+package games.dmg.spigotstealth;
+
+import com.comphenix.protocol.ProtocolManager;
+import java.util.Objects;
+import java.util.UUID;
+import java.util.function.Predicate;
+import org.bukkit.event.HandlerList;
+import org.bukkit.plugin.java.JavaPlugin;
+import org.bukkit.scheduler.BukkitTask;
+
+/** Owns only the Eye's viewer-specific runtime and its lifecycle resources. */
+final class EyeRevealRuntime implements AutoCloseable {
+    private final JavaPlugin plugin;
+    private final ProtocolManager protocol;
+    private final EyeRevealController controller;
+    private final EyePacketListener packets;
+    private final EyeRevealEvents events;
+    private BukkitTask task;
+    private boolean started;
+    private boolean closed;
+
+    EyeRevealRuntime(JavaPlugin plugin, EyeEquipment equipment, Predicate<UUID> concealed, ProtocolManager protocol) {
+        this.plugin = Objects.requireNonNull(plugin);
+        this.protocol = Objects.requireNonNull(protocol);
+        controller = new EyeRevealController(plugin.getServer()::getOnlinePlayers, equipment, concealed, new NativeEyeDelivery(),
+                () -> UUID.randomUUID().toString().replace("-", "").substring(0, 16),
+                failure -> plugin.getLogger().warning("Eye rendering failed; unsafe views withheld: " + failure.getClass().getSimpleName()));
+        packets = new EyePacketListener(plugin, controller::snapshot, controller::requestRefresh, plugin.getLogger()::warning);
+        events = new EyeRevealEvents(controller);
+    }
+
+    public void start() {
+        if (closed) { throw new IllegalStateException("Eye runtime is closed"); }
+        if (started) { return; }
+        if (!plugin.isEnabled()) { throw new IllegalStateException("Cannot start Eye rendering for a disabled plugin"); }
+        started = true;
+        try {
+            protocol.addPacketListener(packets);
+            plugin.getServer().getPluginManager().registerEvents(events, plugin);
+            task = plugin.getServer().getScheduler().runTaskTimer(plugin, controller, 1L, 1L);
+        } catch (RuntimeException exception) {
+            close();
+            throw exception;
+        }
+    }
+
+    public void withdrawTarget(UUID player) { controller.withdrawTarget(player); }
+
+    @Override public void close() {
+        if (closed) { return; }
+        closed = true;
+        if (task != null) { task.cancel(); }
+        try {
+            controller.close(); // Withdraw authorization and restore raw state before unregistering the outgoing gate.
+        } finally {
+            protocol.removePacketListener(packets);
+            HandlerList.unregisterAll(events);
+        }
+    }
+}

src/main/java/games/dmg/spigotstealth/EyeTeamVisibility.java

@@ -0,0 +1,20 @@
+package games.dmg.spigotstealth;
+
+import org.bukkit.entity.Player;
+import org.bukkit.scoreboard.Team;
+
+/** Preserve effective name visibility when a viewer-only team changes client membership relationships. */
+final class EyeTeamVisibility {
+    private EyeTeamVisibility() { }
+    static boolean visible(Player viewer, Team source) {
+        if (source == null) { return true; }
+        boolean sameTeam = source.equals(viewer.getScoreboard().getEntryTeam(viewer.getName()));
+        return switch (source.getOption(Team.Option.NAME_TAG_VISIBILITY)) {
+            case ALWAYS -> true;
+            case NEVER -> false;
+            // CraftTeam maps these to native HIDE_FOR_* values by ordinal, not to SHOW_FOR_*.
+            case FOR_OWN_TEAM -> !sameTeam;
+            case FOR_OTHER_TEAMS -> sameTeam;
+        };
+    }
+}

src/main/java/games/dmg/spigotstealth/EyeVisibility.java

@@ -0,0 +1,21 @@
+package games.dmg.spigotstealth;
+
+import java.util.UUID;
+
+/** Immutable, platform-independent inputs to the local Eye reveal decision. */
+public final class EyeVisibility {
+    private EyeVisibility() { }
+    public record Position(UUID world, double x, double y, double z) { }
+    public record Viewer(UUID id, Position position, boolean eligible) { }
+    public record Target(UUID id, Position position, boolean concealed, boolean spectator, boolean vanished) { }
+
+    public static boolean canReveal(Viewer viewer, Target target, boolean visibleToViewer, boolean lineOfSight) {
+        if (!viewer.eligible() || !target.concealed() || target.spectator() || target.vanished()
+                || !visibleToViewer || !lineOfSight || viewer.id().equals(target.id())
+                || !viewer.position().world().equals(target.position().world())) { return false; }
+        double dx = viewer.position().x() - target.position().x();
+        double dy = viewer.position().y() - target.position().y();
+        double dz = viewer.position().z() - target.position().z();
+        return dx * dx + dy * dy + dz * dz <= 16.0 * 16.0;
+    }
+}

src/main/java/games/dmg/spigotstealth/NativeEyeDelivery.java

@@ -0,0 +1,108 @@
+package games.dmg.spigotstealth;
+
+import java.lang.reflect.Constructor;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.List;
+import java.util.Optional;
+import org.bukkit.entity.Player;
+
+/** Main-thread native packet preparation/delivery. Outgoing authorization performs the final projection. */
+final class NativeEyeDelivery implements EyeRevealController.Delivery {
+    private final Constructor<?> teamPacket;
+    private final Constructor<?> parameters;
+    private final Constructor<?> scoreboard;
+    private final Constructor<?> playerTeam;
+    private final Constructor<?> metadata;
+    private final Constructor<?> dataValue;
+    private final Field nativeTeam;
+    private final Method playerHandle;
+    private final Method entityData;
+    private final Method dataGet;
+    private final Object sharedFlags;
+    private final Object byteSerializer;
+    private final Field connection;
+    private final Method sendPacket;
+
+    NativeEyeDelivery() {
+        try {
+            Class<?> team = Class.forName("net.minecraft.world.scores.PlayerTeam");
+            Class<?> board = Class.forName("net.minecraft.world.scores.Scoreboard");
+            teamPacket = Class.forName("net.minecraft.network.protocol.game.ClientboundSetPlayerTeamPacket")
+                    .getDeclaredConstructor(String.class, int.class, Optional.class, Collection.class);
+            teamPacket.setAccessible(true);
+            parameters = Class.forName("net.minecraft.network.protocol.game.ClientboundSetPlayerTeamPacket$Parameters")
+                    .getConstructor(team);
+            scoreboard = board.getConstructor();
+            playerTeam = team.getConstructor(board, String.class);
+            nativeTeam = Class.forName("org.bukkit.craftbukkit.scoreboard.CraftTeam").getDeclaredField("team");
+            nativeTeam.setAccessible(true);
+            playerHandle = Class.forName("org.bukkit.craftbukkit.entity.CraftPlayer").getMethod("getHandle");
+            Class<?> entity = Class.forName("net.minecraft.world.entity.Entity");
+            entityData = entity.getMethod("getEntityData");
+            var flags = entity.getDeclaredField("DATA_SHARED_FLAGS_ID");
+            flags.setAccessible(true);
+            sharedFlags = flags.get(null);
+            Class<?> accessor = Class.forName("net.minecraft.network.syncher.EntityDataAccessor");
+            dataGet = Class.forName("net.minecraft.network.syncher.SynchedEntityData").getMethod("get", accessor);
+            byteSerializer = Class.forName("net.minecraft.network.syncher.EntityDataSerializers").getField("BYTE").get(null);
+            dataValue = Class.forName("net.minecraft.network.syncher.SynchedEntityData$DataValue").getConstructor(
+                    int.class, Class.forName("net.minecraft.network.syncher.EntityDataSerializer"), Object.class);
+            metadata = Class.forName("net.minecraft.network.protocol.game.ClientboundSetEntityDataPacket").getConstructor(int.class, List.class);
+            connection = Class.forName("net.minecraft.server.level.ServerPlayer").getField("connection");
+            sendPacket = Class.forName("net.minecraft.server.network.ServerCommonPacketListenerImpl")
+                    .getMethod("send", Class.forName("net.minecraft.network.protocol.Packet"));
+        } catch (ReflectiveOperationException exception) {
+            throw new IllegalStateException("Native Eye delivery is unsupported on this server version", exception);
+        }
+    }
+
+    @Override public void show(Player viewer, Player target, EyeRevealController.Projection projection, boolean create) {
+        try {
+            var source = viewer.getScoreboard().getEntryTeam(projection.playerName());
+            Object basis = source == null ? playerTeam.newInstance(scoreboard.newInstance(), projection.privateTeam()) : nativeTeam.get(source);
+            // Send unprojected data. The packet listener checks the latest per-viewer authorization at dispatch.
+            Object privateParameters = EyePacketProjection.teamVisibility(parameters.newInstance(basis), EyeTeamVisibility.visible(viewer, source));
+            Object team = teamPacket.newInstance(projection.privateTeam(), create ? 0 : 2,
+                    Optional.of(privateParameters), create ? List.of(projection.playerName()) : List.of());
+            var packets = List.of(team, rawMetadata(target));
+            for (Object packet : packets) { send(viewer, packet); }
+        } catch (ReflectiveOperationException exception) {
+            throw new IllegalStateException("Could not deliver a private Eye view", exception);
+        }
+    }
+
+    @Override public void restore(Player viewer, Optional<Player> target, EyeRevealController.Projection projection) {
+        try {
+            var packets = new ArrayList<Object>();
+            var source = viewer.getScoreboard().getEntryTeam(projection.playerName());
+            Object basis = source == null ? playerTeam.newInstance(scoreboard.newInstance(), projection.privateTeam()) : nativeTeam.get(source);
+            Object baseline = parameters.newInstance(basis);
+            // Restore presentation before changing membership, avoiding a temporary unteamed/plain-name gap.
+            packets.add(teamPacket.newInstance(projection.privateTeam(), 2,
+                    Optional.of(EyePacketProjection.teamVisibility(baseline, EyeTeamVisibility.visible(viewer, source))), List.of()));
+            if (target.isPresent() && target.orElseThrow().isOnline()) { packets.add(rawMetadata(target.orElseThrow())); }
+            if (source != null) {
+                packets.add(teamPacket.newInstance(source.getName(), 2, Optional.of(baseline), List.of()));
+                packets.add(teamPacket.newInstance(source.getName(), 3, Optional.empty(), List.of(projection.playerName())));
+            }
+            packets.add(teamPacket.newInstance(projection.privateTeam(), 1, Optional.empty(), List.of()));
+            // Prepare everything before sending, avoiding half-created views on reflection/layout failures.
+            for (Object packet : packets) { send(viewer, packet); }
+        } catch (ReflectiveOperationException exception) {
+            throw new IllegalStateException("Could not restore an Eye observer's baseline", exception);
+        }
+    }
+
+    private Object rawMetadata(Player player) throws ReflectiveOperationException {
+        Object value = dataGet.invoke(entityData.invoke(playerHandle.invoke(player)), sharedFlags);
+        if (!(value instanceof Byte)) { throw new IllegalStateException("Native player flags are unavailable"); }
+        return metadata.newInstance(player.getEntityId(), List.of(dataValue.newInstance(0, byteSerializer, value)));
+    }
+
+    private void send(Player viewer, Object packet) throws ReflectiveOperationException {
+        sendPacket.invoke(connection.get(playerHandle.invoke(viewer)), packet);
+    }
+}

src/main/java/games/dmg/spigotstealth/NativePotionEffects.java

@@ -0,0 +1,40 @@
+package games.dmg.spigotstealth;
+
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import org.bukkit.entity.Player;
+
+/** Read-only, server-thread snapshots of the exact Purpur effect objects and their hidden layers. */
+final class NativePotionEffects {
+    private final Method handle, effect, duration, amplifier;
+    private final Field hidden;
+    private final Object poison, wither;
+
+    NativePotionEffects() {
+        try {
+            var living = Class.forName("net.minecraft.world.entity.LivingEntity");
+            var instance = Class.forName("net.minecraft.world.effect.MobEffectInstance");
+            var effects = Class.forName("net.minecraft.world.effect.MobEffects");
+            handle = Class.forName("org.bukkit.craftbukkit.entity.CraftLivingEntity").getMethod("getHandle");
+            effect = living.getMethod("getEffect", Class.forName("net.minecraft.core.Holder"));
+            duration = instance.getMethod("getDuration");
+            amplifier = instance.getMethod("getAmplifier");
+            hidden = instance.getField("hiddenEffect");
+            poison = effects.getField("POISON").get(null);
+            wither = effects.getField("WITHER").get(null);
+        } catch (ReflectiveOperationException exception) {
+            throw new IllegalStateException("Unsupported native potion provenance layout", exception);
+        }
+    }
+
+    PotionDamageAttribution.Snapshot snapshot(Player player, PotionDamageAttribution.Kind kind) throws ReflectiveOperationException {
+        Object current = effect.invoke(handle.invoke(player), kind == PotionDamageAttribution.Kind.POISON ? poison : wither);
+        return current == null ? null : new PotionDamageAttribution.Snapshot(current, read(current, 0));
+    }
+
+    private PotionDamageAttribution.Effect read(Object current, int depth) throws ReflectiveOperationException {
+        if (current == null) { return null; }
+        if (depth > 256) { throw new IllegalStateException("Invalid native effect chain"); }
+        return new PotionDamageAttribution.Effect((int) amplifier.invoke(current), (int) duration.invoke(current), read(hidden.get(current), depth + 1));
+    }
+}

src/main/java/games/dmg/spigotstealth/PersistentStealthState.java

@@ -9,11 +9,18 @@ import java.util.UUID;
 public record PersistentStealthState(
         Map<UUID, PlayerStealthState> players,
         SleepCountPolicy sleepCountPolicy,
-        Map<String, Object> unknownFields) {
+        Map<String, Object> unknownFields,
+        Map<UUID, EyeProgress> eyes) {
     public PersistentStealthState {
         players = Map.copyOf(new LinkedHashMap<>(Objects.requireNonNull(players, "players")));
         Objects.requireNonNull(sleepCountPolicy, "sleepCountPolicy");
         unknownFields = Map.copyOf(new LinkedHashMap<>(Objects.requireNonNull(unknownFields, "unknownFields")));
+        eyes = Map.copyOf(Objects.requireNonNull(eyes, "eyes"));
+    }
+
+    public PersistentStealthState(Map<UUID, PlayerStealthState> players, SleepCountPolicy sleepCountPolicy,
+            Map<String, Object> unknownFields) {
+        this(players, sleepCountPolicy, unknownFields, Map.of());
     }
 
     public PersistentStealthState(
@@ -22,6 +29,14 @@ public record PersistentStealthState(
         this(players, SleepCountPolicy.EXCLUDE, unknownFields);
     }
 
+    public EyeProgress eyeProgress(UUID playerId) { return eyes.getOrDefault(playerId, EyeProgress.empty()); }
+
+    public PersistentStealthState withEyeProgress(UUID playerId, EyeProgress progress) {
+        Map<UUID, EyeProgress> updated = new LinkedHashMap<>(eyes);
+        updated.put(playerId, progress);
+        return new PersistentStealthState(players, sleepCountPolicy, unknownFields, updated);
+    }
+
     public PlayerStealthState player(UUID playerId) {
         return players.getOrDefault(playerId, PlayerStealthState.empty(playerId));
     }
@@ -29,10 +44,10 @@ public record PersistentStealthState(
     public PersistentStealthState withPlayer(PlayerStealthState player) {
         Map<UUID, PlayerStealthState> updated = new LinkedHashMap<>(players);
         updated.put(player.playerId(), player);
-        return new PersistentStealthState(updated, sleepCountPolicy, unknownFields);
+        return new PersistentStealthState(updated, sleepCountPolicy, unknownFields, eyes);
     }
 
     public PersistentStealthState withSleepCountPolicy(SleepCountPolicy policy) {
-        return new PersistentStealthState(players, policy, unknownFields);
+        return new PersistentStealthState(players, policy, unknownFields, eyes);
     }
 }

src/main/java/games/dmg/spigotstealth/PotionDamageAttribution.java

@@ -0,0 +1,96 @@
+package games.dmg.spigotstealth;
+
+import java.util.Optional;
+import java.util.UUID;
+
+/** Runtime provenance of poison/wither layers, reconciled against actual native effect state. */
+final class PotionDamageAttribution {
+    enum Kind { POISON, WITHER }
+    record Effect(int amplifier, int duration, Effect hidden) { }
+    record Snapshot(Object identity, Effect effect) { }
+    private record Key(UUID victim, Kind kind) { }
+    private record Owned(int amplifier, int duration, UUID source, Owned hidden) { }
+    private record Entry(Object identity, Owned effect) { }
+    private final java.util.Map<Key, Entry> entries = new java.util.HashMap<>();
+
+    public void change(UUID victim, Kind kind, Snapshot before, Effect incoming, UUID source, boolean override) {
+        var key = new Key(victim, kind);
+        if (incoming == null) { entries.remove(key); return; }
+        var old = reconcile(entries.get(key), before);
+        if (old == null && before != null) { old = unowned(before.effect()); }
+        var next = merge(old, incoming, source, override);
+        entries.put(key, new Entry(before == null ? null : before.identity(), next));
+    }
+
+    public void forget(UUID victim) { entries.keySet().removeIf(key -> key.victim().equals(victim)); }
+    public void clear() { entries.clear(); }
+
+    private static Owned merge(Owned old, Effect incoming, UUID source, boolean override) {
+        if (old == null) { return new Owned(incoming.amplifier(), incoming.duration(), source, null); }
+        if (override && incoming.amplifier() > old.amplifier()) {
+            return new Owned(incoming.amplifier(), incoming.duration(), source,
+                    shorter(incoming.duration(), old.duration()) ? old : old.hidden());
+        }
+        if (shorter(old.duration(), incoming.duration())) {
+            if (override && incoming.amplifier() == old.amplifier()) {
+                return new Owned(old.amplifier(), incoming.duration(), source, old.hidden());
+            }
+            if (incoming.amplifier() < old.amplifier()) {
+                return new Owned(old.amplifier(), old.duration(), old.source(), merge(old.hidden(), incoming, source, true));
+            }
+        }
+        return old; // Rejected or cosmetic-only changes do not replace the damaging layer.
+    }
+
+    public Optional<UUID> attacker(UUID victim, Kind kind, Snapshot current) {
+        var key = new Key(victim, kind);
+        var owned = reconcile(entries.get(key), current);
+        if (owned == null || owned.duration() != -1 && owned.duration() <= 0) { entries.remove(key); return Optional.empty(); }
+        entries.put(key, new Entry(current.identity(), owned));
+        return Optional.ofNullable(owned.source());
+    }
+
+    private static Owned reconcile(Entry entry, Snapshot current) {
+        if (entry == null || current == null || entry.identity() != null && entry.identity() != current.identity()) { return null; }
+        int expired = 0;
+        for (var candidate = entry.effect(); candidate != null; candidate = candidate.hidden()) {
+            if (matches(candidate, current.effect(), expired)) { return rebase(candidate, current.effect()); }
+            if (candidate.duration() == -1) { break; } // An infinite active layer cannot expire into its hidden layer.
+            expired = Math.max(expired, candidate.duration());
+        }
+        return null;
+    }
+
+    private static boolean shorter(int duration, int other) {
+        return duration != -1 && (other == -1 || duration < other);
+    }
+
+    /** All layers count down together. Solve their elapsed-duration constraints, including frozen/infinite effects. */
+    private static boolean matches(Owned expected, Effect actual, int expired) {
+        long minimum = expired, maximum = Long.MAX_VALUE;
+        while (expected != null && actual != null) {
+            if (expected.amplifier() != actual.amplifier() || actual.duration() < -1) { return false; }
+            if (expected.duration() == -1) {
+                if (actual.duration() != -1) { return false; }
+            } else {
+                if (actual.duration() == -1 || actual.duration() > expected.duration()) { return false; }
+                if (actual.duration() == 0) { minimum = Math.max(minimum, expected.duration()); }
+                else {
+                    long elapsed = (long) expected.duration() - actual.duration();
+                    minimum = Math.max(minimum, elapsed);
+                    maximum = Math.min(maximum, elapsed);
+                }
+            }
+            expected = expected.hidden();
+            actual = actual.hidden();
+        }
+        return expected == null && actual == null && minimum <= maximum;
+    }
+
+    private static Owned rebase(Owned owner, Effect actual) {
+        return owner == null ? null : new Owned(actual.amplifier(), actual.duration(), owner.source(), rebase(owner.hidden(), actual.hidden()));
+    }
+    private static Owned unowned(Effect effect) {
+        return effect == null ? null : new Owned(effect.amplifier(), effect.duration(), null, unowned(effect.hidden()));
+    }
+}

src/main/java/games/dmg/spigotstealth/PotionDamageListener.java

@@ -0,0 +1,71 @@
+package games.dmg.spigotstealth;
+
+import java.util.UUID;
+import java.util.function.Consumer;
+import java.util.function.Function;
+import org.bukkit.entity.Player;
+import org.bukkit.event.EventHandler;
+import org.bukkit.event.EventPriority;
+import org.bukkit.event.Listener;
+import org.bukkit.event.entity.EntityDamageEvent;
+import org.bukkit.event.entity.EntityPotionEffectEvent;
+
+/** Observes explicit effect sources; does not change effects or infer a nearby attacker. */
+final class PotionDamageListener implements Listener, Function<EntityDamageEvent, Player> {
+    private final Function<UUID, Player> onlinePlayer;
+    private final Consumer<Throwable> failures;
+    private final PotionDamageAttribution attribution = new PotionDamageAttribution();
+    private final NativePotionEffects effects = new NativePotionEffects();
+    private boolean reported;
+
+    PotionDamageListener(Function<UUID, Player> onlinePlayer, Consumer<Throwable> failures) {
+        this.onlinePlayer = java.util.Objects.requireNonNull(onlinePlayer);
+        this.failures = java.util.Objects.requireNonNull(failures);
+    }
+
+    @EventHandler(priority = EventPriority.MONITOR, ignoreCancelled = true)
+    public void onEffect(EntityPotionEffectEvent event) {
+        if (event.isCancelled() || !(event.getEntity() instanceof Player player)) { return; }
+        var kind = kind(event.getModifiedType());
+        if (kind == null) { return; }
+        try {
+            var incoming = event.getNewEffect();
+            var source = source(event.getSource());
+            attribution.change(player.getUniqueId(), kind, effects.snapshot(player, kind),
+                    incoming == null ? null : new PotionDamageAttribution.Effect(Math.clamp(incoming.getAmplifier(), 0, 255), incoming.getDuration(), null),
+                    source == null ? null : source.getUniqueId(), event.isOverride());
+        } catch (ReflectiveOperationException | RuntimeException exception) { attribution.forget(player.getUniqueId()); report(exception); }
+    }
+
+    @Override public Player apply(EntityDamageEvent event) {
+        if (!(event.getEntity() instanceof Player player)) { return null; }
+        var kind = switch (event.getCause()) {
+            case POISON -> PotionDamageAttribution.Kind.POISON;
+            case WITHER -> PotionDamageAttribution.Kind.WITHER;
+            default -> null;
+        };
+        if (kind == null) { return null; }
+        try {
+            return attribution.attacker(player.getUniqueId(), kind, effects.snapshot(player, kind)).map(onlinePlayer).orElse(null);
+        } catch (ReflectiveOperationException | RuntimeException exception) { attribution.forget(player.getUniqueId()); report(exception); return null; }
+    }
+
+    @EventHandler(priority = EventPriority.MONITOR)
+    public void onQuit(org.bukkit.event.player.PlayerQuitEvent event) { attribution.forget(event.getPlayer().getUniqueId()); }
+    public void close() { attribution.clear(); }
+
+    private static PotionDamageAttribution.Kind kind(org.bukkit.potion.PotionEffectType type) {
+        if (org.bukkit.potion.PotionEffectType.POISON.equals(type)) { return PotionDamageAttribution.Kind.POISON; }
+        if (org.bukkit.potion.PotionEffectType.WITHER.equals(type)) { return PotionDamageAttribution.Kind.WITHER; }
+        return null;
+    }
+    private static Player source(org.bukkit.entity.Entity entity) {
+        if (entity instanceof Player player) { return player; }
+        if (entity instanceof org.bukkit.entity.Projectile projectile && projectile.getShooter() instanceof Player player) { return player; }
+        if (entity instanceof org.bukkit.entity.AreaEffectCloud cloud && cloud.getSource() instanceof Player player) { return player; }
+        return null;
+    }
+    private void report(Throwable failure) {
+        if (!reported) { reported = true; failures.accept(failure); }
+    }
+}

src/main/java/games/dmg/spigotstealth/SpigotStealthPlugin.java

@@ -12,14 +12,22 @@ import org.bukkit.plugin.java.JavaPlugin;
 /** Bukkit entry point for Spigot Stealth. */
 public final class SpigotStealthPlugin extends JavaPlugin {
     private CompletableFuture<StealthStateManager> stateManagerFuture;
+    private CompletableFuture<Void> shutdown;
+    private volatile long lifecycleEpoch;
     private StealthSettings settings;
     private QualifyingInvisibilityService progression;
     private StealthSessionService sessions;
     private IdentityPresentation identityPresentation;
     private ProtocolManager protocolManager;
+    private EyeProgressionService eyeProgression;
+    private EyePotionListener eyePotions;
+    private boolean eyeRecipeRegistered;
+    private EyeRevealRuntime eyeReveal;
+    private PotionDamageListener combatPotions;
 
     @Override
     public void onEnable() {
+        long epoch = ++lifecycleEpoch;
         saveDefaultConfig();
         try {
             settings = StealthSettings.from(getConfig().getValues(true));
@@ -30,45 +38,75 @@ public final class SpigotStealthPlugin extends JavaPlugin {
         }
 
         Path stateFile = getDataFolder().toPath().resolve("state.yml");
-        stateManagerFuture = StealthStateManager.load(new YamlStealthStateRepository(stateFile));
+        stateManagerFuture = shutdownCompletion().thenCompose(ignored ->
+                StealthStateManager.load(new YamlStealthStateRepository(stateFile)));
         stateManagerFuture.whenComplete((manager, failure) -> {
             if (failure != null) {
                 getLogger().severe("Unable to load Spigot Stealth state: " + rootMessage(failure));
-                getServer().getScheduler().runTask(this, () -> getServer().getPluginManager().disablePlugin(this));
+                onServer(epoch, () -> getServer().getPluginManager().disablePlugin(this));
                 return;
             }
-            getServer().getScheduler().runTask(this, () -> finishInitialization(manager));
+            if (!isEnabled() || epoch != lifecycleEpoch) {
+                logSaveFailure(manager.closeAsync());
+                return;
+            }
+            try {
+                getServer().getScheduler().runTask(this, () -> {
+                    if (!isEnabled() || epoch != lifecycleEpoch) { logSaveFailure(manager.closeAsync()); }
+                    else { finishInitialization(manager, epoch); }
+                });
+            } catch (org.bukkit.plugin.IllegalPluginAccessException ignored) {
+                logSaveFailure(manager.closeAsync());
+            }
         });
     }
 
     @Override
     public void onDisable() {
-        if (protocolManager != null) {
-            protocolManager.removePacketListeners(this);
-        }
-        if (identityPresentation != null && sessions != null) {
-            for (org.bukkit.entity.Player player : getServer().getOnlinePlayers()) {
-                if (sessions.isConcealed(player.getUniqueId())) {
-                    identityPresentation.reveal(player);
-                    sessions.endConcealment(player.getUniqueId());
+        ++lifecycleEpoch;
+        try {
+            if (eyePotions != null) {
+                eyePotions.checkpoint(getServer()::getPlayer);
+                logSaveFailure(eyeProgression.stopAll());
+            }
+            if (progression != null) { logSaveFailure(progression.stopAll()); }
+            if (combatPotions != null) { combatPotions.close(); }
+            if (eyeReveal != null) { eyeReveal.close(); }
+            if (protocolManager != null) { protocolManager.removePacketListeners(this); }
+            if (identityPresentation != null && sessions != null) {
+                for (org.bukkit.entity.Player player : getServer().getOnlinePlayers()) {
+                    if (sessions.isConcealed(player.getUniqueId())) {
+                        try { identityPresentation.reveal(player); }
+                        finally { logSaveFailure(sessions.endConcealment(player.getUniqueId())); }
+                    }
+                }
+            }
+        } finally {
+            try {
+                if (eyeRecipeRegistered) {
+                    getServer().removeRecipe(EyeCrafting.RECIPE_KEY);
+                    eyeRecipeRegistered = false;
+                }
+            } finally {
+                if (stateManagerFuture != null) {
+                    shutdown = stateManagerFuture.thenCompose(StealthStateManager::closeAsync);
+                    logSaveFailure(shutdown);
                 }
             }
         }
-        if (progression != null) {
-            progression.stopAll().join();
-        }
-        if (stateManagerFuture != null && stateManagerFuture.isDone() && !stateManagerFuture.isCompletedExceptionally()) {
-            stateManagerFuture.join().close();
-        }
+    }
+
+    /** Durable shutdown acknowledgement; never wait for it on the server thread. */
+    CompletableFuture<Void> shutdownCompletion() {
+        return shutdown == null ? CompletableFuture.completedFuture(null) : shutdown;
     }
 
     public StealthSettings settings() {
         return settings;
     }
 
-    private void finishInitialization(StealthStateManager manager) {
-        java.util.function.Consumer<Runnable> mainThread =
-                runnable -> getServer().getScheduler().runTask(this, runnable);
+    private void finishInitialization(StealthStateManager manager, long epoch) {
+        java.util.function.Consumer<Runnable> mainThread = runnable -> onServer(epoch, runnable);
         BukkitUnlockNotifier notifier = new BukkitUnlockNotifier(
                 getServer()::getPlayer,
                 mainThread,
@@ -113,6 +151,50 @@ public final class SpigotStealthPlugin extends JavaPlugin {
                 settings.unlockThreshold());
         stealthAdminPluginCommand.setExecutor(stealthAdminCommand);
         stealthAdminPluginCommand.setTabCompleter(stealthAdminCommand);
+        eyeProgression = new EyeProgressionService(manager, this::monotonicNanos, id -> mainThread.accept(() -> {
+            var player = getServer().getPlayer(id);
+            if (player != null) {
+                player.discoverRecipe(EyeCrafting.RECIPE_KEY);
+                player.sendMessage("You unlocked the Eye of True Seeing! Craft it with eight Netherite Blocks around an Eye of Ender.");
+            }
+        }));
+        eyePotions = new EyePotionListener(eyeProgression,
+                failure -> getLogger().severe("Unable to save Eye progression: " + rootMessage(failure)));
+        var eyeItems = new EyeItems();
+        var eyeCrafting = new EyeCrafting(eyeProgression, eyeItems);
+        if (!getServer().addRecipe(eyeCrafting.recipe())) {
+            getLogger().severe("Unable to register the Eye recipe; disabling Stealth rather than replacing another recipe.");
+            getServer().getPluginManager().disablePlugin(this);
+            return;
+        }
+        eyeRecipeRegistered = true;
+        getServer().getPluginManager().registerEvents(eyePotions, this);
+        getServer().getPluginManager().registerEvents(eyeCrafting, this);
+        var eyeEquipment = new EyeEquipment(eyeProgression, eyeItems);
+        getServer().getPluginManager().registerEvents(eyeEquipment, this);
+        try {
+            eyeReveal = new EyeRevealRuntime(this, eyeEquipment, sessions::isConcealed, protocolManager);
+            eyeReveal.start();
+            java.util.function.Consumer<Throwable> combatFailure = failure -> getLogger().warning("Unable to complete combat reveal: " + rootMessage(failure));
+            combatPotions = new PotionDamageListener(getServer()::getPlayer, combatFailure);
+            getServer().getPluginManager().registerEvents(combatPotions, this);
+            getServer().getPluginManager().registerEvents(new CombatRevealListener(sessions, identityPresentation,
+                    eyeReveal::withdrawTarget, combatFailure, combatPotions), this);
+        } catch (RuntimeException exception) {
+            getLogger().severe("Unable to initialize Stealth gameplay: " + rootMessage(exception));
+            getServer().getPluginManager().disablePlugin(this);
+            return;
+        }
+        getServer().getScheduler().runTaskTimer(this, ignored -> {
+            eyePotions.checkpoint(getServer()::getPlayer);
+            for (var player : getServer().getOnlinePlayers()) {
+                if (eyeProgression.isUnlocked(player.getUniqueId())) {
+                    if (!player.hasDiscoveredRecipe(EyeCrafting.RECIPE_KEY)) { player.discoverRecipe(EyeCrafting.RECIPE_KEY); }
+                } else if (player.hasDiscoveredRecipe(EyeCrafting.RECIPE_KEY)) {
+                    player.undiscoverRecipe(EyeCrafting.RECIPE_KEY);
+                }
+            }
+        }, 20L, 20L);
         getServer().getScheduler().runTaskTimer(this, ignored -> {
             for (java.util.UUID playerId : progression.activePlayerIds()) {
                 logSaveFailure(progression.checkpoint(playerId));
@@ -127,6 +209,20 @@ public final class SpigotStealthPlugin extends JavaPlugin {
         getLogger().info("Spigot Stealth enabled");
     }
 
+    /** Clock boundary for deterministic gameplay lifecycle verification. */
+    long monotonicNanos() { return System.nanoTime(); }
+
+    private void onServer(long epoch, Runnable action) {
+        if (!isEnabled() || epoch != lifecycleEpoch) { return; }
+        try {
+            getServer().getScheduler().runTask(this, () -> {
+                if (isEnabled() && epoch == lifecycleEpoch) { action.run(); }
+            });
+        } catch (org.bukkit.plugin.IllegalPluginAccessException ignored) {
+            // A durable unlock remains saved even if disable races its notification.
+        }
+    }
+
     private void logSaveFailure(CompletableFuture<Void> save) {
         save.exceptionally(failure -> {
             getLogger().severe("Unable to save Spigot Stealth state: " + rootMessage(failure));

src/main/java/games/dmg/spigotstealth/StealthStateManager.java

@@ -14,7 +14,9 @@ import java.util.function.UnaryOperator;
 public final class StealthStateManager implements AutoCloseable {
     private final StealthStateRepository repository;
     private final AtomicReference<PersistentStealthState> state;
+    private final AtomicReference<PersistentStealthState> durableState;
     private final ExecutorService ioExecutor;
+    private CompletableFuture<Void> closing;
 
     public StealthStateManager(StealthStateRepository repository, PersistentStealthState initialState) {
         this(repository, initialState, newIoExecutor());
@@ -26,6 +28,7 @@ public final class StealthStateManager implements AutoCloseable {
             ExecutorService ioExecutor) {
         this.repository = Objects.requireNonNull(repository, "repository");
         this.state = new AtomicReference<>(Objects.requireNonNull(initialState, "initialState"));
+        this.durableState = new AtomicReference<>(initialState);
         this.ioExecutor = ioExecutor;
     }
 
@@ -35,7 +38,7 @@ public final class StealthStateManager implements AutoCloseable {
         return CompletableFuture.supplyAsync(() -> {
             try {
                 return new StealthStateManager(repository, repository.load(), executor);
-            } catch (IOException exception) {
+            } catch (IOException | RuntimeException exception) {
                 executor.shutdown();
                 throw new CompletionException(exception);
             }
@@ -46,36 +49,51 @@ public final class StealthStateManager implements AutoCloseable {
         return state.get();
     }
 
-    public CompletableFuture<Void> update(UnaryOperator<PersistentStealthState> operation) {
+    /** Last successfully written snapshot, for rewards that must not precede persistence acknowledgement. */
+    public PersistentStealthState durableSnapshot() { return durableState.get(); }
+
+    public synchronized CompletableFuture<Void> update(UnaryOperator<PersistentStealthState> operation) {
+        if (closing != null) { return CompletableFuture.failedFuture(new IllegalStateException("Stealth state is closing")); }
         PersistentStealthState updated = state.updateAndGet(operation);
         return persist(updated);
     }
 
-    public CompletableFuture<Void> save() {
-        return persist(state.get());
+    public synchronized CompletableFuture<Void> save() {
+        return closing == null ? persist(state.get()) : closing;
     }
 
     private CompletableFuture<Void> persist(PersistentStealthState snapshot) {
         return CompletableFuture.runAsync(() -> {
             try {
                 repository.save(snapshot);
+                durableState.set(snapshot);
             } catch (IOException exception) {
                 throw new CompletionException(exception);
             }
         }, ioExecutor);
     }
 
+    /** Queue the final snapshot and stop accepting mutations, without waiting on the caller's thread. */
+    public synchronized CompletableFuture<Void> closeAsync() {
+        if (closing == null) {
+            closing = persist(state.get());
+            ioExecutor.shutdown();
+        }
+        return closing;
+    }
+
+    /** Blocking convenience for non-server callers such as tests; server lifecycle callers should use closeAsync. */
     @Override
     public void close() {
-        save().join();
-        ioExecutor.shutdown();
         try {
-            if (!ioExecutor.awaitTermination(10L, TimeUnit.SECONDS)) {
+            closeAsync().join();
+        } finally {
+            try {
+                if (!ioExecutor.awaitTermination(10L, TimeUnit.SECONDS)) { ioExecutor.shutdownNow(); }
+            } catch (InterruptedException exception) {
                 ioExecutor.shutdownNow();
+                Thread.currentThread().interrupt();
             }
-        } catch (InterruptedException exception) {
-            ioExecutor.shutdownNow();
-            Thread.currentThread().interrupt();
         }
     }
 

src/main/java/games/dmg/spigotstealth/YamlStealthStateRepository.java

@@ -17,7 +17,8 @@ import org.bukkit.configuration.file.YamlConfiguration;
 
 /** Defensive YAML repository using atomic file replacement where available. */
 public final class YamlStealthStateRepository implements StealthStateRepository {
-    private static final Set<String> ROOT_FIELDS = Set.of("schema-version", "sleep-count-policy", "players");
+    private static final Set<String> ROOT_FIELDS = Set.of("schema-version", "sleep-count-policy", "players", "eye-progress");
+    private static final Set<String> EYE_FIELDS = Set.of("accumulated-millis", "unlocked");
     private static final Set<String> PLAYER_FIELDS = Set.of(
             "last-known-name", "accumulated-millis", "unlocked", "prepared-login", "concealed", "qualifying-since");
     private final Path stateFile;
@@ -56,14 +57,15 @@ public final class YamlStealthStateRepository implements StealthStateRepository
         return new PersistentStealthState(
                 players,
                 SleepCountPolicy.fromPersisted(yaml.get("sleep-count-policy")),
-                unknownRoot);
+                unknownRoot,
+                parseEyes(yaml.getConfigurationSection("eye-progress")));
     }
 
     @Override
     public void save(PersistentStealthState state) throws IOException {
         YamlConfiguration yaml = new YamlConfiguration();
         state.unknownFields().forEach(yaml::set);
-        yaml.set("schema-version", 1);
+        yaml.set("schema-version", 2);
         yaml.set("sleep-count-policy", state.sleepCountPolicy().persistedValue());
         for (PlayerStealthState player : state.players().values()) {
             String base = "players." + player.playerId() + ".";
@@ -75,6 +77,12 @@ public final class YamlStealthStateRepository implements StealthStateRepository
             yaml.set(base + "concealed", player.concealed());
             yaml.set(base + "qualifying-since", player.qualifyingSince() == null ? null : player.qualifyingSince().toString());
         }
+        state.eyes().forEach((id, progress) -> {
+            String base = "eye-progress." + id + ".";
+            progress.unknownFields().forEach((key, value) -> yaml.set(base + key, value));
+            yaml.set(base + "accumulated-millis", progress.accumulatedMillis());
+            yaml.set(base + "unlocked", progress.unlocked());
+        });
         Path parent = stateFile.toAbsolutePath().getParent();
         if (parent != null) {
             Files.createDirectories(parent);
@@ -88,6 +96,27 @@ public final class YamlStealthStateRepository implements StealthStateRepository
         }
     }
 
+    private static Map<UUID, EyeProgress> parseEyes(ConfigurationSection section) {
+        Map<UUID, EyeProgress> eyes = new LinkedHashMap<>();
+        if (section == null) { return eyes; }
+        for (String key : section.getKeys(false)) {
+            try {
+                UUID id = UUID.fromString(key);
+                ConfigurationSection entry = section.getConfigurationSection(key);
+                if (entry == null) { continue; }
+                Object raw = entry.get("accumulated-millis");
+                if (!(raw instanceof Long || raw instanceof Integer || raw instanceof Short || raw instanceof Byte)) {
+                    continue;
+                }
+                eyes.put(id, new EyeProgress(requireNonNegativeLong(entry, "accumulated-millis"),
+                    requireBoolean(entry, "unlocked"), unknownValues(entry, EYE_FIELDS)));
+            } catch (IllegalArgumentException ignored) {
+                // A malformed Eye record cannot grant an unlock or erase independent Stealth records.
+            }
+        }
+        return eyes;
+    }
+
     private static PlayerStealthState parsePlayer(UUID playerId, ConfigurationSection section) {
         long accumulated = requireNonNegativeLong(section, "accumulated-millis");
         boolean unlocked = requireBoolean(section, "unlocked");

src/nativeTest/java/games/dmg/spigotstealth/CombatRevealTest.java

@@ -0,0 +1,135 @@
+package games.dmg.spigotstealth;
+
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+import java.time.Duration;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import java.util.UUID;
+import net.minecraft.world.scores.Scoreboard;
+import org.bukkit.craftbukkit.scoreboard.CraftScoreboard;
+import org.bukkit.entity.Player;
+import org.bukkit.event.entity.EntityDamageByEntityEvent;
+import org.bukkit.event.entity.EntityDamageEvent.DamageCause;
+import org.junit.jupiter.api.BeforeAll;
+
+class CombatRevealTest {
+    @BeforeAll static void bootstrap() throws Exception { NativeRuntime.bootstrap(); }
+
+    @org.junit.jupiter.params.ParameterizedTest
+    @org.junit.jupiter.params.provider.ValueSource(strings = {"melee", "arrow", "instant-potion", "cancelled", "zero", "self", "mob-target", "taking-only", "miss", "poison", "wither"})
+    void attributedDamageEndsOnlyAttackerSessionAndRestoresIdentityExactlyOnce(String kind) throws Exception {
+        Player attacker = player("Attacker"), victim = player("Victim");
+        var initial = new PersistentStealthState(Map.of(), Map.of())
+                .withPlayer(unlocked(attacker).withSession(true, false))
+                .withPlayer(unlocked(victim).withSession(true, false));
+        var repository = new StealthStateRepository() {
+            @Override public PersistentStealthState load() { return initial; }
+            @Override public void save(PersistentStealthState state) { }
+        };
+        try (var states = new StealthStateManager(repository, initial)) {
+            var progression = new QualifyingInvisibilityService(states, Duration.ofHours(8), () -> 0L, id -> { });
+            var sessions = new StealthSessionService(states, progression);
+            sessions.login(attacker.getUniqueId(), attacker.getName()).saved().join();
+            sessions.login(victim.getUniqueId(), victim.getName()).saved().join();
+            var board = new Scoreboard();
+            var constructor = CraftScoreboard.class.getDeclaredConstructor(Scoreboard.class);
+            constructor.setAccessible(true);
+            var restoredTabs = new ArrayList<UUID>();
+            var tabs = new TabListController() {
+                @Override public void remove(Player observer, UUID target) { }
+                @Override public void add(Player observer, Player target) { restoredTabs.add(target.getUniqueId()); }
+            };
+            var presentation = new BukkitIdentityPresentation(() -> List.of(attacker, victim), constructor.newInstance(board), tabs);
+            presentation.conceal(attacker);
+            presentation.conceal(victim);
+            var withdrawn = new ArrayList<UUID>();
+            var failures = new ArrayList<Throwable>();
+            var potions = new PotionDamageListener(id -> id.equals(attacker.getUniqueId()) ? attacker : null, failures::add);
+            var listener = new CombatRevealListener(sessions, presentation, withdrawn::add, failures::add, potions);
+            boolean delayed = kind.equals("poison") || kind.equals("wither");
+            if (delayed) {
+                var type = kind.equals("poison") ? org.bukkit.potion.PotionEffectType.POISON : org.bukkit.potion.PotionEffectType.WITHER;
+                var nativeType = kind.equals("poison") ? net.minecraft.world.effect.MobEffects.POISON : net.minecraft.world.effect.MobEffects.WITHER;
+                potions.onEffect(new org.bukkit.event.entity.EntityPotionEffectEvent(victim, null,
+                        new org.bukkit.potion.PotionEffect(type, 100, 0), attacker,
+                        org.bukkit.event.entity.EntityPotionEffectEvent.Cause.POTION_SPLASH,
+                        org.bukkit.event.entity.EntityPotionEffectEvent.Action.ADDED, true));
+                when(((org.bukkit.craftbukkit.entity.CraftPlayer) victim).getHandle().getEffect(nativeType))
+                        .thenReturn(new net.minecraft.world.effect.MobEffectInstance(nativeType, 100, 0));
+            }
+            var sources = new net.minecraft.world.damagesource.DamageSources(new net.minecraft.core.RegistryAccess.ImmutableRegistryAccess(
+                    List.of(org.bukkit.craftbukkit.CraftRegistry.getMinecraftRegistry(net.minecraft.core.registries.Registries.DAMAGE_TYPE))));
+            var handle = ((org.bukkit.craftbukkit.entity.CraftPlayer) attacker).getHandle();
+            var nativeSource = switch (kind) {
+                case "arrow" -> sources.arrow(mock(net.minecraft.world.entity.projectile.arrow.AbstractArrow.class), handle);
+                case "instant-potion" -> sources.indirectMagic(mock(net.minecraft.world.entity.Entity.class), handle);
+                case "taking-only", "poison" -> sources.magic();
+                case "wither" -> sources.wither();
+                default -> sources.playerAttack(handle);
+            };
+            var source = new org.bukkit.craftbukkit.damage.CraftDamageSource(nativeSource);
+            org.bukkit.entity.Entity target = switch (kind) {
+                case "mob-target" -> mock(org.bukkit.entity.Zombie.class);
+                case "self" -> attacker;
+                default -> victim;
+            };
+            org.bukkit.event.entity.EntityDamageEvent damage = delayed
+                    ? new org.bukkit.event.entity.EntityDamageEvent(victim, kind.equals("poison") ? DamageCause.POISON : DamageCause.WITHER, source, 1.0)
+                    : new EntityDamageByEntityEvent(attacker, target, DamageCause.ENTITY_ATTACK, source, kind.equals("zero") ? 0 : 3.0);
+            damage.setCancelled(kind.equals("cancelled"));
+            var before = states.snapshot();
+            if (!kind.equals("miss")) { listener.onDamage(damage); }
+            if (java.util.Set.of("cancelled", "zero", "self", "mob-target", "taking-only", "miss").contains(kind)) {
+                assertEquals(before, states.snapshot());
+                assertEquals(java.util.Set.of("Attacker", "Victim"), presentation.concealedNames());
+                assertTrue(restoredTabs.isEmpty());
+                assertTrue(withdrawn.isEmpty());
+                verify(attacker, never()).sendMessage(anyString());
+                return;
+            }
+
+            assertFalse(sessions.isConcealed(attacker.getUniqueId()), "positive damage must end the attacker's active session");
+            assertTrue(sessions.isConcealed(victim.getUniqueId()), "taking damage alone must not end the victim's session");
+            assertEquals(java.util.Set.of(victim.getUniqueId()), sessions.concealedPlayerIds());
+            assertEquals(java.util.Set.of("Victim"), presentation.concealedNames());
+            assertNull(board.getPlayerTeam(BukkitIdentityPresentation.teamName(attacker.getUniqueId())));
+            assertNotNull(board.getPlayerTeam(BukkitIdentityPresentation.teamName(victim.getUniqueId())));
+            verify(attacker).setDisplayName("Original Attacker");
+            verify(attacker).setSleepingIgnored(false);
+            assertEquals(List.of(attacker.getUniqueId()), restoredTabs);
+            assertEquals(List.of(attacker.getUniqueId()), withdrawn);
+            verify(attacker).sendMessage("Your stealth was broken because you hurt another player.");
+            verify(attacker, never()).removePotionEffect(any());
+            verify(attacker, never()).setInvisible(anyBoolean());
+            assertTrue(states.snapshot().player(attacker.getUniqueId()).unlocked());
+            assertEquals(28_800_000, states.snapshot().player(attacker.getUniqueId()).accumulatedMillis());
+            assertFalse(states.snapshot().player(attacker.getUniqueId()).preparedLogin());
+            listener.onDamage(damage);
+            assertEquals(1, restoredTabs.size());
+            verify(attacker, times(1)).sendMessage("Your stealth was broken because you hurt another player.");
+            assertFalse(sessions.login(attacker.getUniqueId(), attacker.getName()).concealed(), "damage must not prepare a direct re-entry");
+            progression.begin(attacker.getUniqueId(), attacker.getName(), java.time.Instant.EPOCH).join();
+            sessions.disconnect(attacker.getUniqueId()).join();
+            assertTrue(sessions.login(attacker.getUniqueId(), attacker.getName()).concealed(), "a later qualifying logout/login still works");
+            states.save().join();
+            assertTrue(failures.isEmpty());
+        }
+    }
+
+    private static Player player(String name) {
+        var player = mock(org.bukkit.craftbukkit.entity.CraftPlayer.class);
+        var handle = mock(net.minecraft.server.level.ServerPlayer.class);
+        when(handle.getBukkitEntity()).thenReturn(player);
+        when(player.getHandle()).thenReturn(handle);
+        when(player.getUniqueId()).thenReturn(UUID.randomUUID());
+        when(player.getName()).thenReturn(name);
+        when(player.getDisplayName()).thenReturn("Original " + name);
+        return player;
+    }
+    private static PlayerStealthState unlocked(Player player) {
+        return new PlayerStealthState(player.getUniqueId(), player.getName(), 28_800_000, true, false, false, null, Map.of());
+    }
+}

src/nativeTest/java/games/dmg/spigotstealth/EyeCraftingTest.java

@@ -0,0 +1,215 @@
+package games.dmg.spigotstealth;
+
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+import java.nio.file.Path;
+import java.util.UUID;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicReference;
+import org.bukkit.Material;
+import org.bukkit.entity.Player;
+import org.bukkit.event.inventory.PrepareItemCraftEvent;
+import org.bukkit.inventory.CraftingInventory;
+import org.bukkit.inventory.InventoryView;
+import org.bukkit.inventory.ItemStack;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+class EyeCraftingTest {
+    @TempDir Path directory;
+    @BeforeAll static void bootstrap() throws Exception { NativeRuntime.bootstrap(); }
+
+    @Test
+    void eightNetheriteBlocksAroundAnEnderEyeCanOnlyBeCraftedAfterThePersonalUnlock() throws Exception {
+        var repository = new YamlStealthStateRepository(directory.resolve("state.yml"));
+        UUID id = UUID.randomUUID();
+        try (var states = new StealthStateManager(repository, repository.load())) {
+            var progression = new EyeProgressionService(states, () -> 0L, ignored -> { });
+            var items = new EyeItems();
+            var crafting = new EyeCrafting(progression, items);
+            var recipe = crafting.recipe();
+            assertArrayEquals(new String[] {"NNN", "NEN", "NNN"}, recipe.getShape());
+            assertEquals(Material.NETHERITE_BLOCK, recipe.getIngredientMap().get('N').getType());
+            assertEquals(Material.ENDER_EYE, recipe.getIngredientMap().get('E').getType());
+            assertTrue(items.isEye(recipe.getResult()));
+            var player = mock(Player.class);
+            when(player.getUniqueId()).thenReturn(id);
+            var inventory = mock(CraftingInventory.class);
+            when(inventory.getRecipe()).thenReturn(recipe);
+            when(inventory.getMatrix()).thenReturn(matrix());
+            var result = new AtomicReference<>(recipe.getResult());
+            when(inventory.getResult()).thenAnswer(ignored -> result.get());
+            doAnswer(call -> { result.set(call.getArgument(0)); return null; }).when(inventory).setResult(any());
+            var view = mock(InventoryView.class);
+            when(view.getPlayer()).thenReturn(player);
+            when(view.getTopInventory()).thenReturn(inventory);
+            var event = new PrepareItemCraftEvent(inventory, view, false);
+            crafting.onPrepare(event);
+            assertNull(result.get(), "a locked player cannot obtain the recipe result");
+            states.update(state -> state.withEyeProgress(id, new EyeProgress(28_800_000, true))).get(3, TimeUnit.SECONDS);
+            result.set(recipe.getResult()); // A fresh native recipe preparation after earning the unlock.
+            crafting.onPrepare(event);
+            assertTrue(items.isEye(result.get()));
+            assertEquals(1, result.get().getAmount());
+            verify(inventory, never()).setMatrix(any()); // Vanilla owns all ingredient consumption.
+        }
+    }
+
+    @Test
+    void resultClicksRecheckEligibilityIngredientsAndIdentityWithoutBypassingCancellation() throws Exception {
+        var repository = new YamlStealthStateRepository(directory.resolve("state.yml"));
+        UUID id = UUID.randomUUID();
+        try (var states = new StealthStateManager(repository, repository.load())) {
+            var progression = new EyeProgressionService(states, () -> 0L, ignored -> { });
+            var items = new EyeItems();
+            var crafting = new EyeCrafting(progression, items);
+            var recipe = crafting.recipe();
+            var player = mock(Player.class);
+            when(player.getUniqueId()).thenReturn(id);
+            var inventory = mock(CraftingInventory.class);
+            when(inventory.getRecipe()).thenReturn(recipe);
+            ItemStack[] ingredients = matrix();
+            when(inventory.getMatrix()).thenReturn(ingredients);
+            var result = new AtomicReference<>(recipe.getResult());
+            when(inventory.getResult()).thenAnswer(ignored -> result.get());
+            doAnswer(call -> { result.set(call.getArgument(0)); return null; }).when(inventory).setResult(any());
+            var view = mock(InventoryView.class);
+            when(view.getPlayer()).thenReturn(player);
+            when(view.getTopInventory()).thenReturn(inventory);
+            var locked = click(recipe, view);
+            crafting.onCraft(locked);
+            assertTrue(locked.isCancelled(), "a stale preview must not bypass the personal unlock on shift-click");
+            assertNull(result.get());
+            states.update(state -> state.withEyeProgress(id, new EyeProgress(28_800_000, true))).get(3, TimeUnit.SECONDS);
+            result.set(recipe.getResult());
+            var allowed = click(recipe, view);
+            crafting.onCraft(allowed);
+            assertFalse(allowed.isCancelled());
+            assertTrue(items.isEye(result.get()));
+            ingredients[0] = new ItemStack(Material.DIRT);
+            var invalidIngredients = click(recipe, view);
+            crafting.onCraft(invalidIngredients);
+            assertTrue(invalidIngredients.isCancelled());
+            assertNull(result.get());
+            ingredients[0] = new ItemStack(Material.NETHERITE_BLOCK);
+            result.set(new ItemStack(Material.ENDER_EYE));
+            var invalidResult = click(recipe, view);
+            crafting.onCraft(invalidResult);
+            assertTrue(invalidResult.isCancelled());
+            result.set(recipe.getResult());
+            result.get().setAmount(2);
+            var inflatedResult = click(recipe, view);
+            crafting.onCraft(inflatedResult);
+            assertTrue(inflatedResult.isCancelled());
+            result.set(recipe.getResult());
+            var cancelled = click(recipe, view);
+            cancelled.setCancelled(true);
+            crafting.onCraft(cancelled);
+            assertTrue(cancelled.isCancelled());
+            var otherRecipe = new org.bukkit.inventory.ShapedRecipe(new org.bukkit.NamespacedKey("other", "eye"),
+                    new ItemStack(Material.ENDER_EYE)).shape("E").setIngredient('E', Material.ENDER_EYE);
+            var unrelated = click(otherRecipe, view);
+            crafting.onCraft(unrelated);
+            assertFalse(unrelated.isCancelled());
+            verify(inventory, never()).setMatrix(any());
+        }
+    }
+
+    @Test
+    void pendingOrFailedUnlockWritesCannotExposeACraftableResult() throws Exception {
+        var disk = new YamlStealthStateRepository(directory.resolve("state.yml"));
+        var started = new java.util.concurrent.CountDownLatch(1);
+        var release = new java.util.concurrent.CountDownLatch(1);
+        var firstWrite = new java.util.concurrent.atomic.AtomicBoolean(true);
+        StealthStateRepository repository = new StealthStateRepository() {
+            @Override public PersistentStealthState load() throws java.io.IOException { return disk.load(); }
+            @Override public void save(PersistentStealthState state) throws java.io.IOException {
+                if (firstWrite.getAndSet(false)) {
+                    started.countDown();
+                    try {
+                        if (!release.await(3, TimeUnit.SECONDS)) { throw new java.io.IOException("Test write gate timed out"); }
+                    } catch (InterruptedException exception) {
+                        Thread.currentThread().interrupt();
+                        throw new java.io.IOException(exception);
+                    }
+                    throw new java.io.IOException("Injected write failure");
+                }
+                disk.save(state);
+            }
+        };
+        UUID id = UUID.randomUUID();
+        try (var states = new StealthStateManager(repository, repository.load())) {
+            try {
+                var items = new EyeItems();
+                var crafting = new EyeCrafting(new EyeProgressionService(states, () -> 0L, ignored -> { }), items);
+                var recipe = crafting.recipe();
+                var player = mock(Player.class);
+                when(player.getUniqueId()).thenReturn(id);
+                var inventory = mock(CraftingInventory.class);
+                when(inventory.getRecipe()).thenReturn(recipe);
+                when(inventory.getMatrix()).thenReturn(matrix());
+                var result = new AtomicReference<>(recipe.getResult());
+                when(inventory.getResult()).thenAnswer(ignored -> result.get());
+                doAnswer(call -> { result.set(call.getArgument(0)); return null; }).when(inventory).setResult(any());
+                var view = mock(InventoryView.class);
+                when(view.getPlayer()).thenReturn(player);
+                when(view.getTopInventory()).thenReturn(inventory);
+                var event = new PrepareItemCraftEvent(inventory, view, false);
+                var pending = states.update(state -> state.withEyeProgress(id, new EyeProgress(28_800_000, true)));
+                assertTrue(started.await(3, TimeUnit.SECONDS));
+                assertTrue(states.snapshot().eyeProgress(id).unlocked());
+                crafting.onPrepare(event);
+                assertNull(result.get(), "in-memory progress is not a durable crafting unlock");
+                release.countDown();
+                assertThrows(java.util.concurrent.ExecutionException.class, () -> pending.get(3, TimeUnit.SECONDS));
+                result.set(recipe.getResult());
+                crafting.onPrepare(event);
+                assertNull(result.get(), "failed writes must not grant the recipe");
+                var denied = click(recipe, view);
+                crafting.onCraft(denied);
+                assertTrue(denied.isCancelled());
+                states.save().get(3, TimeUnit.SECONDS);
+                result.set(recipe.getResult());
+                crafting.onPrepare(event);
+                assertTrue(items.isEye(result.get()));
+                var allowed = click(recipe, view);
+                crafting.onCraft(allowed);
+                assertFalse(allowed.isCancelled());
+            } finally { release.countDown(); }
+        }
+    }
+
+    @Test
+    void automatedCraftersCannotBypassPersonalProgression() throws Exception {
+        var repository = new YamlStealthStateRepository(directory.resolve("state.yml"));
+        try (var states = new StealthStateManager(repository, repository.load())) {
+            var items = new EyeItems();
+            var crafting = new EyeCrafting(new EyeProgressionService(states, () -> 0L, ignored -> { }), items);
+            var block = mock(org.bukkit.block.Block.class);
+            var event = new org.bukkit.event.block.CrafterCraftEvent(block, crafting.recipe(), items.create());
+            crafting.onCrafter(event);
+            assertTrue(event.isCancelled(), "a block has no personal Eye unlock");
+            var other = new org.bukkit.inventory.ShapedRecipe(new org.bukkit.NamespacedKey("other", "eye"),
+                    new ItemStack(Material.ENDER_EYE)).shape("E").setIngredient('E', Material.ENDER_EYE);
+            var unrelated = new org.bukkit.event.block.CrafterCraftEvent(block, other, other.getResult());
+            crafting.onCrafter(unrelated);
+            assertFalse(unrelated.isCancelled());
+        }
+    }
+
+    private static org.bukkit.event.inventory.CraftItemEvent click(org.bukkit.inventory.Recipe recipe, InventoryView view) {
+        return new org.bukkit.event.inventory.CraftItemEvent(recipe, view,
+                org.bukkit.event.inventory.InventoryType.SlotType.RESULT, 0,
+                org.bukkit.event.inventory.ClickType.SHIFT_LEFT, org.bukkit.event.inventory.InventoryAction.MOVE_TO_OTHER_INVENTORY);
+    }
+
+    private static ItemStack[] matrix() {
+        var result = new ItemStack[9];
+        for (int index = 0; index < result.length; index++) {
+            result[index] = new ItemStack(index == 4 ? Material.ENDER_EYE : Material.NETHERITE_BLOCK);
+        }
+        return result;
+    }
+}

src/nativeTest/java/games/dmg/spigotstealth/EyeEquipmentTest.java

@@ -0,0 +1,92 @@
+package games.dmg.spigotstealth;
+
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+import java.nio.file.Path;
+import java.util.EnumMap;
+import java.util.UUID;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicReference;
+import org.bukkit.Material;
+import org.bukkit.block.BlockFace;
+import org.bukkit.entity.Player;
+import org.bukkit.event.Event;
+import org.bukkit.event.block.Action;
+import org.bukkit.event.player.PlayerInteractEvent;
+import org.bukkit.inventory.EquipmentSlot;
+import org.bukkit.inventory.ItemStack;
+import org.bukkit.inventory.PlayerInventory;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+class EyeEquipmentTest {
+    @TempDir Path directory;
+    @BeforeAll static void bootstrap() throws Exception { NativeRuntime.bootstrap(); }
+
+    @Test
+    void tradedEyesRequireTheHoldersOwnUnlockAndEquipWithoutThrowingOrReplacingAHelmet() throws Exception {
+        UUID earner = UUID.randomUUID(), holder = UUID.randomUUID();
+        var repository = new YamlStealthStateRepository(directory.resolve("state.yml"));
+        try (var states = new StealthStateManager(repository, repository.load())) {
+            states.update(state -> state.withEyeProgress(earner, new EyeProgress(28_800_000, true))).get(3, TimeUnit.SECONDS);
+            var items = new EyeItems();
+            var equipment = new EyeEquipment(new EyeProgressionService(states, () -> 0L, ignored -> { }), items);
+            var player = mock(Player.class);
+            when(player.getUniqueId()).thenReturn(holder);
+            var inventory = mock(PlayerInventory.class);
+            when(player.getInventory()).thenReturn(inventory);
+            var helmet = new AtomicReference<ItemStack>();
+            when(inventory.getHelmet()).thenAnswer(ignored -> helmet.get());
+            doAnswer(call -> { helmet.set(call.getArgument(0)); return null; }).when(inventory).setHelmet(any());
+            var hands = new EnumMap<EquipmentSlot, ItemStack>(EquipmentSlot.class);
+            when(inventory.getItem(any(EquipmentSlot.class))).thenAnswer(call -> hands.get(call.getArgument(0)));
+            doAnswer(call -> { hands.put(call.getArgument(0), call.getArgument(1)); return null; })
+                    .when(inventory).setItem(any(EquipmentSlot.class), nullable(ItemStack.class));
+            ItemStack traded = items.create();
+            hands.put(EquipmentSlot.HAND, traded);
+            helmet.set(traded.clone());
+            assertFalse(equipment.isEligibleWearer(player), "equipping somebody else's Eye must not bypass the personal unlock");
+            helmet.set(null);
+            var denied = use(player, traded, EquipmentSlot.HAND);
+            equipment.onUse(denied);
+            assertEquals(Event.Result.DENY, denied.useItemInHand(), "custom Eyes must never fall through to vanilla Ender Eye use");
+            assertNull(helmet.get());
+            assertSame(traded, hands.get(EquipmentSlot.HAND));
+            states.update(state -> state.withEyeProgress(holder, new EyeProgress(28_800_000, true))).get(3, TimeUnit.SECONDS);
+            var allowed = use(player, traded, EquipmentSlot.HAND);
+            equipment.onUse(allowed);
+            assertEquals(Event.Result.DENY, allowed.useItemInHand());
+            assertNull(hands.get(EquipmentSlot.HAND));
+            assertTrue(items.isEye(helmet.get()));
+            assertEquals(1, helmet.get().getAmount());
+            assertTrue(equipment.isEligibleWearer(player));
+            var ordinaryHelmet = new ItemStack(Material.IRON_HELMET);
+            helmet.set(ordinaryHelmet);
+            hands.put(EquipmentSlot.OFF_HAND, items.create());
+            equipment.onUse(use(player, hands.get(EquipmentSlot.OFF_HAND), EquipmentSlot.OFF_HAND));
+            assertSame(ordinaryHelmet, helmet.get());
+            assertTrue(items.isEye(hands.get(EquipmentSlot.OFF_HAND)));
+            assertFalse(equipment.isEligibleWearer(player), "holding an Eye is not wearing it");
+            helmet.set(null);
+            equipment.onUse(use(player, hands.get(EquipmentSlot.OFF_HAND), EquipmentSlot.OFF_HAND));
+            assertNull(hands.get(EquipmentSlot.OFF_HAND));
+            assertTrue(equipment.isEligibleWearer(player));
+            helmet.set(null);
+            hands.put(EquipmentSlot.HAND, items.create());
+            var cancelled = use(player, hands.get(EquipmentSlot.HAND), EquipmentSlot.HAND);
+            cancelled.setUseItemInHand(Event.Result.DENY);
+            equipment.onUse(cancelled);
+            assertNull(helmet.get());
+            assertTrue(items.isEye(hands.get(EquipmentSlot.HAND)));
+            var ordinary = use(player, new ItemStack(Material.ENDER_EYE), EquipmentSlot.HAND);
+            equipment.onUse(ordinary);
+            assertEquals(Event.Result.DEFAULT, ordinary.useItemInHand());
+        }
+    }
+
+    private static PlayerInteractEvent use(Player player, ItemStack item, EquipmentSlot hand) {
+        return new PlayerInteractEvent(player, Action.RIGHT_CLICK_AIR, item, null, BlockFace.SELF, hand);
+    }
+}

src/nativeTest/java/games/dmg/spigotstealth/EyeItemsTest.java

@@ -0,0 +1,39 @@
+package games.dmg.spigotstealth;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+import net.kyori.adventure.text.Component;
+import org.bukkit.Material;
+import org.bukkit.inventory.EquipmentSlot;
+import org.bukkit.inventory.ItemStack;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+
+class EyeItemsTest {
+    @BeforeAll static void bootstrap() throws Exception { NativeRuntime.bootstrap(); }
+
+    @Test
+    void createdEyeIsAnAuthenticatedHelmetItemButPlainAndRenamedEyesAreNot() {
+        var items = new EyeItems();
+        ItemStack eye = items.create();
+        assertEquals(Material.ENDER_EYE, eye.getType());
+        assertEquals(Component.text("Eye of True Seeing"), eye.getItemMeta().displayName());
+        assertTrue(items.isEye(eye));
+        assertTrue(items.isEye(eye.clone()), "ordinary inventory transfer must retain item identity");
+        assertEquals(EquipmentSlot.HEAD, eye.getItemMeta().getEquippable().getSlot());
+        assertEquals(1, eye.getMaxStackSize());
+        assertFalse(eye.getItemMeta().getEquippable().isDispensable());
+        assertFalse(eye.getItemMeta().getEquippable().isEquipOnInteract(),
+                "the eligibility-checked interaction handler, not native item use, equips the Eye");
+        var ordinary = new ItemStack(Material.ENDER_EYE);
+        assertFalse(items.isEye(ordinary));
+        var renamed = ordinary.getItemMeta();
+        renamed.displayName(eye.getItemMeta().displayName());
+        ordinary.setItemMeta(renamed);
+        assertFalse(items.isEye(ordinary), "anvil/display names cannot authenticate an Eye");
+        var wrongMaterial = eye.clone();
+        wrongMaterial.setType(Material.STONE);
+        assertFalse(items.isEye(wrongMaterial));
+        assertFalse(items.isEye(null));
+    }
+}

src/nativeTest/java/games/dmg/spigotstealth/EyeMetadataProjectionTest.java

@@ -0,0 +1,58 @@
+package games.dmg.spigotstealth;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+import io.netty.buffer.Unpooled;
+import java.util.List;
+import net.minecraft.network.RegistryFriendlyByteBuf;
+import net.minecraft.network.protocol.game.ClientboundSetEntityDataPacket;
+import net.minecraft.network.syncher.EntityDataAccessor;
+import net.minecraft.network.syncher.EntityDataSerializers;
+import net.minecraft.network.syncher.SynchedEntityData;
+import org.bukkit.craftbukkit.CraftRegistry;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+
+class EyeMetadataProjectionTest {
+    @BeforeAll static void bootstrap() throws Exception { NativeRuntime.bootstrap(); }
+
+    @Test
+    void nativeMetadataProjectionClearsOnlyInvisibilityAndKeepsTheSharedPacketUnchanged() throws Exception {
+        var config = new io.papermc.paper.configuration.GlobalConfiguration();
+        config.anticheat = config.new Anticheat();
+        config.anticheat.obfuscation = config.anticheat.new Obfuscation();
+        config.anticheat.obfuscation.items = config.anticheat.obfuscation.new Items();
+        var server = org.mockito.Mockito.mock(net.minecraft.server.MinecraftServer.class);
+        org.mockito.Mockito.when(server.registryAccess()).thenReturn(CraftRegistry.getMinecraftRegistry().freeze());
+        try (var runtime = org.mockito.Mockito.mockStatic(net.minecraft.server.MinecraftServer.class);
+                var platform = org.mockito.Mockito.mockStatic(io.papermc.paper.configuration.GlobalConfiguration.class)) {
+            runtime.when(net.minecraft.server.MinecraftServer::getServer).thenReturn(server);
+            platform.when(io.papermc.paper.configuration.GlobalConfiguration::get).thenReturn(config);
+            config.anticheat.obfuscation.items.bindDataSanitizer();
+            assertProjection();
+        }
+    }
+
+    private static void assertProjection() throws Exception {
+        var accessorField = net.minecraft.world.entity.Entity.class.getDeclaredField("DATA_SHARED_FLAGS_ID");
+        accessorField.setAccessible(true);
+        var accessor = assertInstanceOf(EntityDataAccessor.class, accessorField.get(null));
+        assertEquals(0, accessor.id());
+        assertSame(EntityDataSerializers.BYTE, accessor.serializer());
+        for (int flags = 0; flags <= 255; flags++) {
+            var sharedFlags = new SynchedEntityData.DataValue<>(0, EntityDataSerializers.BYTE, (byte) flags);
+            var air = new SynchedEntityData.DataValue<>(1, EntityDataSerializers.INT, 300);
+            var original = new ClientboundSetEntityDataPacket(42, List.of(sharedFlags, air));
+            var projected = assertInstanceOf(ClientboundSetEntityDataPacket.class, EyePacketProjection.metadataPacket(original));
+            assertEquals(42, projected.id());
+            assertEquals((byte) (flags & ~0x20), projected.packedItems().getFirst().value(), "flag byte " + flags);
+            assertSame(air, projected.packedItems().get(1));
+            assertEquals((byte) flags, original.packedItems().getFirst().value());
+            var buffer = new RegistryFriendlyByteBuf(Unpooled.buffer(), CraftRegistry.getMinecraftRegistry());
+            try {
+                ClientboundSetEntityDataPacket.STREAM_CODEC.encode(buffer, projected);
+                assertEquals(projected, ClientboundSetEntityDataPacket.STREAM_CODEC.decode(buffer));
+            } finally { buffer.release(); }
+        }
+    }
+}

src/nativeTest/java/games/dmg/spigotstealth/EyePacketListenerTest.java

@@ -0,0 +1,122 @@
+package games.dmg.spigotstealth;
+
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+import com.comphenix.protocol.PacketType;
+import com.comphenix.protocol.events.PacketContainer;
+import com.comphenix.protocol.events.PacketEvent;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.Set;
+import java.util.UUID;
+import java.util.concurrent.atomic.AtomicReference;
+import net.minecraft.network.protocol.game.ClientboundSetEntityDataPacket;
+import net.minecraft.network.syncher.EntityDataSerializers;
+import net.minecraft.network.syncher.SynchedEntityData;
+import org.bukkit.entity.Player;
+import org.bukkit.plugin.Plugin;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+
+class EyePacketListenerTest {
+    @BeforeAll static void bootstrap() throws Exception { NativeRuntime.bootstrap(); }
+
+    @Test
+    @SuppressWarnings("try")
+    void metadataIsProjectedOnlyForTheCurrentlyAuthorizedRecipientWithoutMutatingSharedPackets() {
+        var server = mock(org.bukkit.craftbukkit.CraftServer.class);
+        try (var platform = mockStatic(org.bukkit.Bukkit.class, call -> switch (call.getMethod().getName()) {
+            case "getServer" -> server;
+            case "isPrimaryThread" -> true;
+            case "getVersion" -> "Purpur 2618 (MC: 26.2)";
+            case "getMinecraftVersion" -> "26.2";
+            case "getBukkitVersion" -> "26.2-R0.1-SNAPSHOT";
+            default -> call.callRealMethod();
+        })) {
+            UUID viewerId = UUID.randomUUID();
+            var viewer = mock(Player.class);
+            when(viewer.getUniqueId()).thenReturn(viewerId);
+            var other = mock(Player.class);
+            when(other.getUniqueId()).thenReturn(UUID.randomUUID());
+            var projection = new EyeRevealController.Projection(UUID.randomUUID(), 42, "Concealed", "eye-private", Optional.of("source"), true);
+            var snapshot = new AtomicReference<>(Map.of(viewerId, Map.of(42, projection)));
+            var warnings = new ArrayList<String>();
+            var dirty = new ArrayList<UUID>();
+            var listener = new EyePacketListener(mock(Plugin.class), snapshot::get, dirty::add, warnings::add);
+            assertEquals(Set.of(PacketType.Play.Server.ENTITY_METADATA, PacketType.Play.Server.SCOREBOARD_TEAM),
+                    listener.getSendingWhitelist().getTypes());
+            var raw = new ClientboundSetEntityDataPacket(42, List.of(new SynchedEntityData.DataValue<>(0, EntityDataSerializers.BYTE, (byte) 0x63)));
+            var shared = new PacketContainer(PacketType.Play.Server.ENTITY_METADATA, raw);
+            var first = PacketEvent.fromServer(this, shared, viewer);
+            listener.onPacketSending(first);
+            var shown = assertInstanceOf(ClientboundSetEntityDataPacket.class, first.getPacket().getHandle());
+            assertEquals((byte) 0x43, shown.packedItems().getFirst().value());
+            assertEquals((byte) 0x63, raw.packedItems().getFirst().value());
+            var second = PacketEvent.fromServer(this, shared, other);
+            listener.onPacketSending(second);
+            assertSame(shared, second.getPacket());
+            snapshot.set(Map.of());
+            var late = PacketEvent.fromServer(this, shared, viewer);
+            listener.onPacketSending(late);
+            assertSame(shared, late.getPacket(), "queued packets must use current, not captured authorization");
+            snapshot.set(Map.of(viewerId, Map.of(42, projection)));
+            var cancelled = PacketEvent.fromServer(this, shared, viewer);
+            cancelled.setCancelled(true);
+            listener.onPacketSending(cancelled);
+            assertTrue(cancelled.isCancelled());
+            assertSame(shared, cancelled.getPacket());
+            var noBody = new EyeRevealController.Projection(projection.targetId(), 42, projection.playerName(),
+                    projection.privateTeam(), projection.sourceTeam(), false);
+            snapshot.set(Map.of(viewerId, Map.of(42, noBody)));
+            var notGameplayInvisible = PacketEvent.fromServer(this, shared, viewer);
+            listener.onPacketSending(notGameplayInvisible);
+            assertSame(shared, notGameplayInvisible.getPacket());
+            snapshot.set(Map.of(viewerId, Map.of(42, projection)));
+            var board = new net.minecraft.world.scores.Scoreboard();
+            var privateTeam = board.addPlayerTeam("eye-private");
+            privateTeam.setPlayerPrefix(net.minecraft.network.chat.Component.empty().withStyle(net.minecraft.ChatFormatting.OBFUSCATED));
+            board.addPlayerToTeam("Concealed", privateTeam);
+            var privateRaw = net.minecraft.network.protocol.game.ClientboundSetPlayerTeamPacket.createAddOrModifyPacket(privateTeam, true);
+            var privateWrapped = new PacketContainer(PacketType.Play.Server.SCOREBOARD_TEAM, privateRaw);
+            var privateEvent = PacketEvent.fromServer(this, privateWrapped, viewer);
+            listener.onPacketSending(privateEvent);
+            var shownTeam = assertInstanceOf(net.minecraft.network.protocol.game.ClientboundSetPlayerTeamPacket.class, privateEvent.getPacket().getHandle());
+            assertFalse(shownTeam.getParameters().orElseThrow().playerPrefix().getStyle().isObfuscated());
+            assertTrue(privateRaw.getParameters().orElseThrow().playerPrefix().getStyle().isObfuscated());
+            assertTrue(dirty.isEmpty(), "our own private updates must not create a refresh loop");
+            var source = board.addPlayerTeam("source");
+            source.setPlayerPrefix(net.minecraft.network.chat.Component.empty().withStyle(net.minecraft.ChatFormatting.OBFUSCATED));
+            board.addPlayerToTeam("Concealed", source);
+            board.addPlayerToTeam("Other", source);
+            var sourceRaw = net.minecraft.network.protocol.game.ClientboundSetPlayerTeamPacket.createAddOrModifyPacket(source, true);
+            var sourceWrapped = new PacketContainer(PacketType.Play.Server.SCOREBOARD_TEAM, sourceRaw);
+            var sourceEvent = PacketEvent.fromServer(this, sourceWrapped, viewer);
+            listener.onPacketSending(sourceEvent);
+            var filtered = assertInstanceOf(net.minecraft.network.protocol.game.ClientboundSetPlayerTeamPacket.class, sourceEvent.getPacket().getHandle());
+            assertEquals(Set.of("Other"), Set.copyOf(filtered.getPlayers()));
+            assertTrue(filtered.getParameters().orElseThrow().playerPrefix().getStyle().isObfuscated());
+            assertEquals(List.of(viewerId), dirty, "source style updates request a main-thread refresh");
+            var otherEvent = PacketEvent.fromServer(this, sourceWrapped, other);
+            listener.onPacketSending(otherEvent);
+            assertSame(sourceWrapped, otherEvent.getPacket());
+            var system = new PacketContainer(PacketType.Play.Server.SYSTEM_CHAT,
+                    new net.minecraft.network.protocol.game.ClientboundSystemChatPacket(net.minecraft.network.chat.Component.literal("Unchanged"), false));
+            var systemEvent = PacketEvent.fromServer(this, system, viewer);
+            listener.onPacketSending(systemEvent);
+            assertSame(system, systemEvent.getPacket());
+            var tabRemoval = new PacketContainer(PacketType.Play.Server.PLAYER_INFO_REMOVE);
+            tabRemoval.getUUIDLists().write(0, List.of(projection.targetId()));
+            var tabEvent = PacketEvent.fromServer(this, tabRemoval, viewer);
+            listener.onPacketSending(tabEvent);
+            assertSame(tabRemoval, tabEvent.getPacket());
+            assertEquals(List.of(projection.targetId()), tabEvent.getPacket().getUUIDLists().read(0));
+            assertTrue(warnings.isEmpty());
+            verify(viewer, never()).getInventory();
+            verify(viewer, never()).getWorld();
+            verify(viewer, never()).hasLineOfSight(any(org.bukkit.entity.Entity.class));
+        }
+    }
+}

src/nativeTest/java/games/dmg/spigotstealth/EyePluginLifecycleTest.java

@@ -0,0 +1,223 @@
+package games.dmg.spigotstealth;
+
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+import com.comphenix.protocol.ProtocolLibrary;
+import com.comphenix.protocol.ProtocolManager;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import java.util.UUID;
+import java.util.concurrent.LinkedBlockingQueue;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicReference;
+import java.util.function.Consumer;
+import java.util.logging.Logger;
+import org.bukkit.Server;
+import org.bukkit.command.PluginCommand;
+import org.bukkit.configuration.file.YamlConfiguration;
+import org.bukkit.entity.Player;
+import org.bukkit.event.Event;
+import org.bukkit.event.EventHandler;
+import org.bukkit.event.Listener;
+import org.bukkit.event.inventory.PrepareItemCraftEvent;
+import org.bukkit.inventory.CraftingInventory;
+import org.bukkit.inventory.InventoryView;
+import org.bukkit.inventory.ItemStack;
+import org.bukkit.inventory.Recipe;
+import org.bukkit.plugin.EventExecutor;
+import org.bukkit.plugin.PluginDescriptionFile;
+import org.bukkit.plugin.PluginManager;
+import org.bukkit.plugin.RegisteredListener;
+import org.bukkit.scheduler.BukkitScheduler;
+import org.bukkit.scheduler.BukkitTask;
+import org.bukkit.scoreboard.Scoreboard;
+import org.bukkit.scoreboard.ScoreboardManager;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+class EyePluginLifecycleTest {
+    @TempDir Path directory;
+    @BeforeAll static void bootstrap() throws Exception { NativeRuntime.bootstrap(); }
+
+    @org.junit.jupiter.params.ParameterizedTest
+    @org.junit.jupiter.params.provider.ValueSource(strings = {"normal", "disabled", "reenabled", "presentation-failure"})
+    @SuppressWarnings("try") // The scoped Bukkit boundary delegates non-server-metadata operations to native code.
+    void startupAndLateCallbacksRespectSavedUnlocksAndDisable(String mode) throws Exception {
+        UUID id = UUID.randomUUID(), learner = UUID.randomUUID();
+        var disk = new YamlStealthStateRepository(directory.resolve("state.yml"));
+        disk.save(new PersistentStealthState(Map.of(), Map.of()).withEyeProgress(id, new EyeProgress(28_800_000, true)));
+        var plugin = mock(SpigotStealthPlugin.class, CALLS_REAL_METHODS);
+        var clock = new java.util.concurrent.atomic.AtomicLong();
+        doAnswer(ignored -> clock.get()).when(plugin).monotonicNanos();
+        Server server = mock(org.bukkit.craftbukkit.CraftServer.class);
+        var plugins = mock(PluginManager.class);
+        BukkitScheduler scheduler = mock(org.bukkit.craftbukkit.scheduler.CraftScheduler.class);
+        var player = mock(Player.class);
+        when(player.getUniqueId()).thenReturn(id);
+        doReturn(List.of(player)).when(server).getOnlinePlayers();
+        when(server.getPlayer(id)).thenReturn(player);
+        doReturn(server).when(plugin).getServer();
+        doReturn(true).when(plugin).isEnabled();
+        doReturn(directory.toFile()).when(plugin).getDataFolder();
+        doReturn(new YamlConfiguration()).when(plugin).getConfig();
+        doReturn(Logger.getAnonymousLogger()).when(plugin).getLogger();
+        doReturn(new PluginDescriptionFile("SpigotStealth", "test", SpigotStealthPlugin.class.getName()))
+                .when(plugin).getDescription();
+        doNothing().when(plugin).saveDefaultConfig();
+        doReturn(mock(PluginCommand.class)).when(plugin).getCommand("stealth");
+        doReturn(mock(PluginCommand.class)).when(plugin).getCommand("stealthadmin");
+        when(server.getPluginManager()).thenReturn(plugins);
+        when(server.getScheduler()).thenReturn(scheduler);
+        ScoreboardManager boards = mock(org.bukkit.craftbukkit.scoreboard.CraftScoreboardManager.class);
+        when(server.getScoreboardManager()).thenReturn(boards);
+        when(boards.getMainScoreboard()).thenReturn(mock(org.bukkit.craftbukkit.scoreboard.CraftScoreboard.class));
+        var main = new LinkedBlockingQueue<Runnable>();
+        when(scheduler.runTask(eq(plugin), any(Runnable.class))).thenAnswer(call -> {
+            main.add(call.getArgument(1)); return mock(BukkitTask.class);
+        });
+        var timers = new ArrayList<Runnable>();
+        doAnswer(call -> {
+            Consumer<BukkitTask> action = call.getArgument(1);
+            timers.add(() -> action.accept(mock(BukkitTask.class)));
+            return null;
+        }).when(scheduler).runTaskTimer(eq(plugin), org.mockito.ArgumentMatchers.<Consumer<BukkitTask>>any(), anyLong(), anyLong());
+        when(scheduler.runTaskTimer(eq(plugin), any(Runnable.class), anyLong(), anyLong())).thenAnswer(call -> {
+            timers.add(call.getArgument(1)); return mock(BukkitTask.class);
+        });
+        var recipe = new AtomicReference<Recipe>();
+        when(server.addRecipe(any(Recipe.class))).thenAnswer(call -> { recipe.set(call.getArgument(0)); return true; });
+        var listeners = new ArrayList<Listener>();
+        doAnswer(call -> { listeners.add(call.getArgument(0)); return null; }).when(plugins).registerEvents(any(), eq(plugin));
+        try (var platform = mockStatic(org.bukkit.Bukkit.class, call -> switch (call.getMethod().getName()) {
+            case "getServer" -> server;
+            case "getVersion" -> "Purpur 2618 (MC: 26.2)";
+            case "getMinecraftVersion" -> "26.2";
+            case "getBukkitVersion" -> "26.2-R0.1-SNAPSHOT";
+            default -> call.callRealMethod();
+        }); var protocol = mockStatic(ProtocolLibrary.class)) {
+            var protocolManager = mock(ProtocolManager.class);
+            var registeredPackets = new ArrayList<com.comphenix.protocol.events.PacketListener>();
+            doAnswer(call -> { registeredPackets.add(call.getArgument(0)); return null; }).when(protocolManager).addPacketListener(any());
+            doAnswer(call -> { registeredPackets.remove(call.getArgument(0)); return null; }).when(protocolManager).removePacketListener(any());
+            protocol.when(ProtocolLibrary::getProtocolManager).thenReturn(protocolManager);
+            try {
+                plugin.onEnable();
+                assertNull(recipe.get(), "Bukkit registration must wait for durable state initialization and main-thread dispatch");
+                Runnable initialization = main.poll(3, TimeUnit.SECONDS);
+                assertNotNull(initialization);
+                if (mode.equals("disabled") || mode.equals("reenabled")) {
+                    doReturn(false).when(plugin).isEnabled();
+                    plugin.onDisable();
+                    if (mode.equals("reenabled")) {
+                        doReturn(true).when(plugin).isEnabled();
+                        plugin.onEnable();
+                        Runnable currentInitialization = main.poll(3, TimeUnit.SECONDS);
+                        assertNotNull(currentInitialization);
+                        currentInitialization.run();
+                        int registeredCount = listeners.size();
+                        assertNotNull(recipe.get());
+                        initialization.run();
+                        assertEquals(registeredCount, listeners.size(), "an old lifecycle callback must not touch a re-enabled plugin");
+                        verify(server, times(1)).addRecipe(any(Recipe.class));
+                        return;
+                    }
+                    initialization.run();
+                    assertTrue(listeners.isEmpty(), "a queued initialization must not register listeners after disable");
+                    assertNull(recipe.get());
+                    verify(server, never()).removeRecipe(any());
+                    return;
+                }
+                initialization.run();
+                assertNotNull(recipe.get(), "plugin startup must register the Eye recipe");
+                assertTrue(new EyeItems().isEye(recipe.get().getResult()));
+                assertTrue(listeners.stream().anyMatch(EyePotionListener.class::isInstance));
+                assertTrue(listeners.stream().anyMatch(EyeEquipment.class::isInstance));
+                assertTrue(listeners.stream().anyMatch(CombatRevealListener.class::isInstance), "plugin startup must install combat breaking");
+                assertTrue(listeners.stream().anyMatch(PotionDamageListener.class::isInstance), "plugin startup must observe potion provenance");
+                assertTrue(listeners.stream().anyMatch(EyeRevealEvents.class::isInstance), "plugin startup must register reveal invalidation hooks");
+                assertTrue(registeredPackets.stream().anyMatch(EyePacketListener.class::isInstance), "plugin startup must register the per-observer packet gate");
+                var inventory = mock(CraftingInventory.class);
+                when(inventory.getRecipe()).thenAnswer(ignored -> recipe.get());
+                var result = new AtomicReference<>(recipe.get().getResult());
+                when(inventory.getResult()).thenAnswer(ignored -> result.get());
+                doAnswer(call -> { result.set(call.getArgument(0)); return null; }).when(inventory).setResult(any());
+                var view = mock(InventoryView.class);
+                when(view.getPlayer()).thenReturn(player);
+                when(view.getTopInventory()).thenReturn(inventory);
+                var prepare = new PrepareItemCraftEvent(inventory, view, false);
+                dispatch(plugin, listeners, prepare);
+                assertTrue(new EyeItems().isEye(result.get()), "the restored personal unlock must permit crafting");
+                when(player.getUniqueId()).thenReturn(learner);
+                when(server.getPlayer(learner)).thenReturn(player);
+                dispatch(plugin, listeners, prepare);
+                assertNull(result.get(), "registered handlers must deny an unearned player's result");
+                var effect = new org.bukkit.potion.PotionEffect(org.bukkit.potion.PotionEffectType.NIGHT_VISION, 9600, 0);
+                dispatch(plugin, listeners, new org.bukkit.event.entity.EntityPotionEffectEvent(player, null, effect, player,
+                        org.bukkit.event.entity.EntityPotionEffectEvent.Cause.POTION_DRINK,
+                        org.bukkit.event.entity.EntityPotionEffectEvent.Action.ADDED, false));
+                clock.set(java.time.Duration.ofHours(8).toNanos());
+                dispatch(plugin, listeners, new org.bukkit.event.entity.EntityPotionEffectEvent(player, effect, null, null,
+                        org.bukkit.event.entity.EntityPotionEffectEvent.Cause.EXPIRATION,
+                        org.bukkit.event.entity.EntityPotionEffectEvent.Action.REMOVED, false));
+                Runnable unlocked = main.poll(3, TimeUnit.SECONDS);
+                assertNotNull(unlocked, "the registered potion listener must persist the unlock and schedule its notification");
+                assertTrue(disk.load().eyeProgress(learner).unlocked());
+                unlocked.run();
+                result.set(recipe.get().getResult());
+                dispatch(plugin, listeners, prepare);
+                assertTrue(new EyeItems().isEye(result.get()), "the registered crafting listener must see the newly saved unlock");
+                clearInvocations(player);
+                when(player.getUniqueId()).thenReturn(id);
+                timers.forEach(Runnable::run);
+                verify(player).discoverRecipe(EyeCrafting.RECIPE_KEY);
+                // Disable must checkpoint and drain an in-flight qualifying interval, not just remove the recipe.
+                when(player.getUniqueId()).thenReturn(learner);
+                when(player.isOnline()).thenReturn(true);
+                when(player.getPotionEffect(org.bukkit.potion.PotionEffectType.NIGHT_VISION)).thenReturn(effect);
+                dispatch(plugin, listeners, new org.bukkit.event.entity.EntityPotionEffectEvent(player, null, effect, player,
+                        org.bukkit.event.entity.EntityPotionEffectEvent.Cause.POTION_DRINK,
+                        org.bukkit.event.entity.EntityPotionEffectEvent.Action.ADDED, false));
+                clock.addAndGet(1_234_000_000L);
+            } finally {
+                if (mode.equals("presentation-failure")) {
+                    doThrow(new IllegalStateException("Injected presentation cleanup failure"))
+                            .when(protocolManager).removePacketListeners(plugin);
+                    try {
+                        assertThrows(IllegalStateException.class, plugin::onDisable);
+                        plugin.shutdownCompletion().get(3, TimeUnit.SECONDS);
+                        assertEquals(28_801_234, disk.load().eyeProgress(learner).accumulatedMillis(),
+                                "presentation cleanup failure must not prevent Eye progress from draining");
+                    } finally {
+                        doNothing().when(protocolManager).removePacketListeners(plugin);
+                        plugin.onDisable();
+                        plugin.shutdownCompletion().get(3, TimeUnit.SECONDS);
+                    }
+                } else {
+                    plugin.onDisable();
+                    plugin.shutdownCompletion().get(3, TimeUnit.SECONDS);
+                }
+            }
+        }
+        verify(server).removeRecipe(EyeCrafting.RECIPE_KEY);
+        assertEquals(28_801_234, disk.load().eyeProgress(learner).accumulatedMillis());
+    }
+
+    private static void dispatch(SpigotStealthPlugin plugin, List<Listener> listeners, Event event) throws Exception {
+        var registered = new ArrayList<RegisteredListener>();
+        for (var listener : listeners) {
+            for (var method : listener.getClass().getMethods()) {
+                var handler = method.getAnnotation(EventHandler.class);
+                if (handler == null || method.getParameterCount() != 1 || !method.getParameterTypes()[0].isInstance(event)) { continue; }
+                registered.add(new RegisteredListener(listener,
+                        EventExecutor.create(method, method.getParameterTypes()[0].asSubclass(Event.class)),
+                        handler.priority(), plugin, handler.ignoreCancelled()));
+            }
+        }
+        registered.sort(java.util.Comparator.comparing(RegisteredListener::getPriority));
+        for (var handler : registered) { handler.callEvent(event); }
+    }
+}

src/nativeTest/java/games/dmg/spigotstealth/EyePotionProgressionTest.java

@@ -0,0 +1,302 @@
+package games.dmg.spigotstealth;
+
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+import java.nio.file.Path;
+import java.time.Duration;
+import java.util.UUID;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicLong;
+import org.bukkit.entity.Player;
+import org.bukkit.event.entity.EntityPotionEffectEvent;
+import org.bukkit.potion.PotionEffect;
+import org.bukkit.potion.PotionEffectType;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+/** Real Purpur effect/event objects, real progression/persistence, only player and clock are external doubles. */
+class EyePotionProgressionTest {
+    @TempDir Path directory;
+    @BeforeAll static void bootstrap() throws Exception { NativeRuntime.bootstrap(); }
+
+    @Test
+    void aTransitionBeforeTheNextObservationCannotCreditAnUnattributedRestoredEffect() throws Exception {
+        for (String transition : java.util.List.of("quit", "remove", "refresh")) {
+            UUID id = UUID.randomUUID();
+            var player = mock(Player.class);
+            when(player.getUniqueId()).thenReturn(id);
+            when(player.isOnline()).thenReturn(true);
+            var clock = new AtomicLong();
+            var repository = new YamlStealthStateRepository(directory.resolve(transition + ".yml"));
+            try (var states = new StealthStateManager(repository, repository.load())) {
+                var progression = new EyeProgressionService(states, clock::get, ignored -> { });
+                var listener = new EyePotionListener(progression, failure -> fail(failure));
+                var strong = new PotionEffect(PotionEffectType.NIGHT_VISION, 100, 1);
+                var restored = new PotionEffect(PotionEffectType.NIGHT_VISION, 400, 0);
+                listener.onPotionEffect(new EntityPotionEffectEvent(player, null, strong, player,
+                        EntityPotionEffectEvent.Cause.POTION_DRINK, EntityPotionEffectEvent.Action.ADDED, false));
+                when(player.getPotionEffect(PotionEffectType.NIGHT_VISION)).thenReturn(strong);
+                clock.set(Duration.ofSeconds(1).toNanos());
+                listener.checkpoint(ignored -> player);
+                clock.set(Duration.ofSeconds(3).toNanos());
+                when(player.getPotionEffect(PotionEffectType.NIGHT_VISION)).thenReturn(restored);
+                switch (transition) {
+                    case "quit" -> listener.onQuit(new org.bukkit.event.player.PlayerQuitEvent(
+                            player, net.kyori.adventure.text.Component.empty()));
+                    case "remove" -> listener.onPotionEffect(new EntityPotionEffectEvent(player, restored, null, null,
+                            EntityPotionEffectEvent.Cause.EXPIRATION, EntityPotionEffectEvent.Action.REMOVED, false));
+                    case "refresh" -> listener.onPotionEffect(new EntityPotionEffectEvent(player, restored,
+                            new PotionEffect(PotionEffectType.NIGHT_VISION, 800, 0), player,
+                            EntityPotionEffectEvent.Cause.POTION_DRINK, EntityPotionEffectEvent.Action.CHANGED, true));
+                    default -> throw new AssertionError(transition);
+                }
+                states.save().get(3, TimeUnit.SECONDS);
+                assertEquals(1000, repository.load().eyeProgress(id).accumulatedMillis(), transition);
+            }
+        }
+    }
+
+    @Test
+    void periodicObservationStopsAtUnattributedHiddenEffectRestorationOrMissingPlayer() throws Exception {
+        UUID id = UUID.randomUUID();
+        var player = mock(Player.class);
+        when(player.getUniqueId()).thenReturn(id);
+        when(player.isOnline()).thenReturn(true);
+        var clock = new AtomicLong();
+        var repository = new YamlStealthStateRepository(directory.resolve("state.yml"));
+        try (var states = new StealthStateManager(repository, repository.load())) {
+            var progression = new EyeProgressionService(states, clock::get, ignored -> { });
+            var listener = new EyePotionListener(progression, failure -> fail(failure));
+            var strong = new PotionEffect(PotionEffectType.NIGHT_VISION, 100, 1);
+            listener.onPotionEffect(new EntityPotionEffectEvent(player, null, strong, player,
+                    EntityPotionEffectEvent.Cause.POTION_DRINK, EntityPotionEffectEvent.Action.ADDED, false));
+            when(player.getPotionEffect(PotionEffectType.NIGHT_VISION)).thenReturn(
+                    new PotionEffect(PotionEffectType.NIGHT_VISION, 80, 1));
+            clock.set(Duration.ofSeconds(1).toNanos());
+            listener.checkpoint(ignored -> player);
+            states.save().get(3, TimeUnit.SECONDS);
+            assertEquals(1000, repository.load().eyeProgress(id).accumulatedMillis());
+            // Native hidden-effect promotion need not emit a new potion-source event.
+            when(player.getPotionEffect(PotionEffectType.NIGHT_VISION)).thenReturn(
+                    new PotionEffect(PotionEffectType.NIGHT_VISION, 400, 0));
+            clock.set(Duration.ofSeconds(2).toNanos());
+            listener.checkpoint(ignored -> player);
+            clock.set(Duration.ofHours(12).toNanos());
+            listener.checkpoint(ignored -> player);
+            states.save().get(3, TimeUnit.SECONDS);
+            assertEquals(1000, repository.load().eyeProgress(id).accumulatedMillis(),
+                    "unattributed restored effects must not inherit the drink timer");
+            assertTrue(progression.activePlayerIds().isEmpty());
+            listener.onPotionEffect(new EntityPotionEffectEvent(player, null, strong, player,
+                    EntityPotionEffectEvent.Cause.POTION_DRINK, EntityPotionEffectEvent.Action.ADDED, false));
+            clock.addAndGet(Duration.ofDays(1).toNanos());
+            listener.checkpoint(ignored -> null);
+            states.save().get(3, TimeUnit.SECONDS);
+            assertEquals(1000, repository.load().eyeProgress(id).accumulatedMillis());
+            assertTrue(progression.activePlayerIds().isEmpty());
+        }
+    }
+
+    @Test
+    void disconnectClosesTheIntervalAndRestartDoesNotCountTheOfflineGap() throws Exception {
+        UUID id = UUID.randomUUID();
+        var player = mock(Player.class);
+        when(player.getUniqueId()).thenReturn(id);
+        var clock = new AtomicLong();
+        var repository = new YamlStealthStateRepository(directory.resolve("state.yml"));
+        try (var states = new StealthStateManager(repository, repository.load())) {
+            var progression = new EyeProgressionService(states, clock::get, ignored -> { });
+            var listener = new EyePotionListener(progression, failure -> fail(failure));
+            var effect = new PotionEffect(PotionEffectType.NIGHT_VISION, 200, 0);
+            listener.onPotionEffect(new EntityPotionEffectEvent(player, null, effect, player,
+                    EntityPotionEffectEvent.Cause.POTION_DRINK, EntityPotionEffectEvent.Action.ADDED, false));
+            clock.set(Duration.ofSeconds(1).toNanos());
+            when(player.getPotionEffect(PotionEffectType.NIGHT_VISION)).thenReturn(effect);
+            listener.onQuit(new org.bukkit.event.player.PlayerQuitEvent(player, net.kyori.adventure.text.Component.empty()));
+            clock.addAndGet(Duration.ofDays(7).toNanos());
+            progression.checkpoint(id).get(3, TimeUnit.SECONDS);
+            states.save().get(3, TimeUnit.SECONDS);
+            assertEquals(1000, repository.load().eyeProgress(id).accumulatedMillis(),
+                    "disconnect must close the qualifying interval before offline time passes");
+            assertFalse(progression.isUnlocked(id));
+        }
+        try (var restarted = new StealthStateManager(repository, repository.load())) {
+            var progression = new EyeProgressionService(restarted, clock::get, ignored -> { });
+            assertEquals(1000, restarted.snapshot().eyeProgress(id).accumulatedMillis());
+            assertTrue(progression.activePlayerIds().isEmpty());
+            assertFalse(progression.isUnlocked(id));
+        }
+    }
+
+    @Test
+    void everyNonDrinkSourceIsExcludedAndAnEffectiveExternalReplacementStopsCredit() throws Exception {
+        UUID id = UUID.randomUUID();
+        var player = mock(Player.class);
+        when(player.getUniqueId()).thenReturn(id);
+        var clock = new AtomicLong();
+        var repository = new YamlStealthStateRepository(directory.resolve("state.yml"));
+        try (var states = new StealthStateManager(repository, repository.load())) {
+            var progression = new EyeProgressionService(states, clock::get, ignored -> { });
+            var listener = new EyePotionListener(progression, failure -> fail(failure));
+            var effect = new PotionEffect(PotionEffectType.NIGHT_VISION, 200, 0);
+            for (var cause : EntityPotionEffectEvent.Cause.values()) {
+                if (cause == EntityPotionEffectEvent.Cause.POTION_DRINK) { continue; }
+                listener.onPotionEffect(new EntityPotionEffectEvent(player, null, effect, null,
+                        cause, EntityPotionEffectEvent.Action.ADDED, false));
+                clock.addAndGet(Duration.ofSeconds(1).toNanos());
+                progression.checkpoint(id).get(3, TimeUnit.SECONDS);
+                assertEquals(0, states.snapshot().eyeProgress(id).accumulatedMillis(), cause.toString());
+                listener.onPotionEffect(new EntityPotionEffectEvent(player, effect, null, null,
+                        EntityPotionEffectEvent.Cause.EXPIRATION, EntityPotionEffectEvent.Action.REMOVED, false));
+            }
+            listener.onPotionEffect(new EntityPotionEffectEvent(player, null, effect, player,
+                    EntityPotionEffectEvent.Cause.POTION_DRINK, EntityPotionEffectEvent.Action.ADDED, false));
+            clock.addAndGet(Duration.ofSeconds(1).toNanos());
+            listener.onPotionEffect(new EntityPotionEffectEvent(player, effect,
+                    new PotionEffect(PotionEffectType.NIGHT_VISION, 400, 0), null,
+                    EntityPotionEffectEvent.Cause.PLUGIN, EntityPotionEffectEvent.Action.CHANGED, true));
+            clock.addAndGet(Duration.ofHours(12).toNanos());
+            progression.checkpoint(id).get(3, TimeUnit.SECONDS);
+            states.save().get(3, TimeUnit.SECONDS);
+            assertEquals(1000, repository.load().eyeProgress(id).accumulatedMillis());
+            assertFalse(progression.isUnlocked(id));
+        }
+    }
+
+    @Test
+    void cancelledAndUnrelatedEffectEventsCannotStartOrInterruptCredit() throws Exception {
+        UUID id = UUID.randomUUID();
+        var player = mock(Player.class);
+        when(player.getUniqueId()).thenReturn(id);
+        var clock = new AtomicLong();
+        var repository = new YamlStealthStateRepository(directory.resolve("state.yml"));
+        try (var states = new StealthStateManager(repository, repository.load())) {
+            var progression = new EyeProgressionService(states, clock::get, ignored -> { });
+            var listener = new EyePotionListener(progression, failure -> fail(failure));
+            var effect = new PotionEffect(PotionEffectType.NIGHT_VISION, 200, 0);
+            var cancelled = new EntityPotionEffectEvent(player, null, effect, player,
+                    EntityPotionEffectEvent.Cause.POTION_DRINK, EntityPotionEffectEvent.Action.ADDED, false);
+            cancelled.setCancelled(true);
+            listener.onPotionEffect(cancelled);
+            clock.set(Duration.ofSeconds(1).toNanos());
+            progression.checkpoint(id).get(3, TimeUnit.SECONDS);
+            assertEquals(0, states.snapshot().eyeProgress(id).accumulatedMillis());
+            cancelled.setCancelled(false);
+            listener.onPotionEffect(cancelled);
+            clock.set(Duration.ofSeconds(2).toNanos());
+            var cancelledRemoval = new EntityPotionEffectEvent(player, effect, null, null,
+                    EntityPotionEffectEvent.Cause.MILK, EntityPotionEffectEvent.Action.CLEARED, false);
+            cancelledRemoval.setCancelled(true);
+            listener.onPotionEffect(cancelledRemoval);
+            listener.onPotionEffect(new EntityPotionEffectEvent(player, null,
+                    new PotionEffect(PotionEffectType.INVISIBILITY, 200, 0), null,
+                    EntityPotionEffectEvent.Cause.PLUGIN, EntityPotionEffectEvent.Action.ADDED, false));
+            clock.set(Duration.ofSeconds(3).toNanos());
+            progression.stop(id).get(3, TimeUnit.SECONDS);
+            assertEquals(2000, repository.load().eyeProgress(id).accumulatedMillis());
+        }
+    }
+
+    @Test
+    void cosmeticOnlyOverridesDoNotReassignTheActiveEffectsSource() throws Exception {
+        // Purpur reports override=true even when only particle/icon flags change.
+        var nativeActive = new net.minecraft.world.effect.MobEffectInstance(
+                net.minecraft.world.effect.MobEffects.NIGHT_VISION, 200, 1);
+        assertTrue(nativeActive.update(new net.minecraft.world.effect.MobEffectInstance(
+                net.minecraft.world.effect.MobEffects.NIGHT_VISION, 100, 0, false, false, false)));
+        assertEquals(1, nativeActive.getAmplifier());
+        assertEquals(200, nativeActive.getDuration());
+        UUID id = UUID.randomUUID();
+        var player = mock(Player.class);
+        when(player.getUniqueId()).thenReturn(id);
+        var clock = new AtomicLong();
+        var repository = new YamlStealthStateRepository(directory.resolve("state.yml"));
+        try (var states = new StealthStateManager(repository, repository.load())) {
+            var progression = new EyeProgressionService(states, clock::get, ignored -> { });
+            var listener = new EyePotionListener(progression, failure -> fail(failure));
+            var weak = new PotionEffect(PotionEffectType.NIGHT_VISION, 100, 0, false, false, false);
+            var strong = new PotionEffect(PotionEffectType.NIGHT_VISION, 200, 1);
+            listener.onPotionEffect(new EntityPotionEffectEvent(player, strong, weak, player,
+                    EntityPotionEffectEvent.Cause.POTION_DRINK, EntityPotionEffectEvent.Action.CHANGED, true));
+            clock.set(Duration.ofSeconds(1).toNanos());
+            progression.checkpoint(id).get(3, TimeUnit.SECONDS);
+            assertEquals(0, states.snapshot().eyeProgress(id).accumulatedMillis(),
+                    "a cosmetic drink change must not claim the stronger existing effect");
+            listener.onPotionEffect(new EntityPotionEffectEvent(player, null, strong, player,
+                    EntityPotionEffectEvent.Cause.POTION_DRINK, EntityPotionEffectEvent.Action.ADDED, false));
+            clock.set(Duration.ofSeconds(2).toNanos());
+            listener.onPotionEffect(new EntityPotionEffectEvent(player, strong, weak, null,
+                    EntityPotionEffectEvent.Cause.PLUGIN, EntityPotionEffectEvent.Action.CHANGED, true));
+            clock.set(Duration.ofSeconds(3).toNanos());
+            listener.onPotionEffect(new EntityPotionEffectEvent(player, strong, null, null,
+                    EntityPotionEffectEvent.Cause.EXPIRATION, EntityPotionEffectEvent.Action.REMOVED, false));
+            states.save().get(3, TimeUnit.SECONDS);
+            assertEquals(2000, states.snapshot().eyeProgress(id).accumulatedMillis());
+        }
+    }
+
+    @Test
+    void rejectedReplacementsNeitherStartNorStopQualifyingTime() throws Exception {
+        UUID id = UUID.randomUUID();
+        var player = mock(Player.class);
+        when(player.getUniqueId()).thenReturn(id);
+        var clock = new AtomicLong();
+        var repository = new YamlStealthStateRepository(directory.resolve("state.yml"));
+        try (var states = new StealthStateManager(repository, repository.load())) {
+            var progression = new EyeProgressionService(states, clock::get, ignored -> { });
+            var listener = new EyePotionListener(progression, failure -> fail(failure));
+            var weak = new PotionEffect(PotionEffectType.NIGHT_VISION, 100, 0);
+            var strong = new PotionEffect(PotionEffectType.NIGHT_VISION, 200, 1);
+            listener.onPotionEffect(new EntityPotionEffectEvent(player, strong, weak, player,
+                    EntityPotionEffectEvent.Cause.POTION_DRINK, EntityPotionEffectEvent.Action.CHANGED, false));
+            clock.set(Duration.ofSeconds(1).toNanos());
+            progression.checkpoint(id).get(3, TimeUnit.SECONDS);
+            assertEquals(0, states.snapshot().eyeProgress(id).accumulatedMillis(),
+                    "a rejected drink must not claim an existing non-drink effect");
+            listener.onPotionEffect(new EntityPotionEffectEvent(player, null, strong, player,
+                    EntityPotionEffectEvent.Cause.POTION_DRINK, EntityPotionEffectEvent.Action.ADDED, false));
+            clock.set(Duration.ofSeconds(2).toNanos());
+            listener.onPotionEffect(new EntityPotionEffectEvent(player, strong, weak, null,
+                    EntityPotionEffectEvent.Cause.PLUGIN, EntityPotionEffectEvent.Action.CHANGED, false));
+            clock.set(Duration.ofSeconds(3).toNanos());
+            listener.onPotionEffect(new EntityPotionEffectEvent(player, strong, null, null,
+                    EntityPotionEffectEvent.Cause.EXPIRATION, EntityPotionEffectEvent.Action.REMOVED, false));
+            states.save().get(3, TimeUnit.SECONDS);
+            assertEquals(2000, states.snapshot().eyeProgress(id).accumulatedMillis(),
+                    "a rejected plugin replacement must not interrupt the effective drunk potion");
+        }
+    }
+
+    @Test
+    void effectiveDirectDrinkAccumulatesAcrossRefreshAndDurablyUnlocksAtEightHours() throws Exception {
+        UUID id = UUID.randomUUID();
+        var player = mock(Player.class);
+        when(player.getUniqueId()).thenReturn(id);
+        var clock = new AtomicLong();
+        var repository = new YamlStealthStateRepository(directory.resolve("state.yml"));
+        try (var states = new StealthStateManager(repository, repository.load())) {
+            var progression = new EyeProgressionService(states, clock::get, ignored -> { });
+            var listener = new EyePotionListener(progression, failure -> fail(failure));
+            var nightVision = new PotionEffect(PotionEffectType.NIGHT_VISION, 9600, 0);
+            listener.onPotionEffect(new EntityPotionEffectEvent(player, null, nightVision, player,
+                    EntityPotionEffectEvent.Cause.POTION_DRINK, EntityPotionEffectEvent.Action.ADDED, true));
+            for (int refresh = 1; refresh < 60; refresh++) {
+                clock.set(Duration.ofSeconds(refresh * 480L).toNanos());
+                listener.onPotionEffect(new EntityPotionEffectEvent(player, new PotionEffect(PotionEffectType.NIGHT_VISION, 1, 0), nightVision, player,
+                        EntityPotionEffectEvent.Cause.POTION_DRINK, EntityPotionEffectEvent.Action.CHANGED, true));
+            }
+            clock.set(Duration.ofHours(8).toNanos() - 1_000_000);
+            progression.checkpoint(id).get(3, TimeUnit.SECONDS);
+            assertFalse(progression.isUnlocked(id));
+            clock.addAndGet(1_000_000);
+            listener.onPotionEffect(new EntityPotionEffectEvent(player, nightVision, null, null,
+                    EntityPotionEffectEvent.Cause.EXPIRATION, EntityPotionEffectEvent.Action.REMOVED, false));
+            states.save().get(3, TimeUnit.SECONDS);
+            assertTrue(progression.isUnlocked(id), "eight hours of effective drink events must unlock the Eye");
+            assertEquals(28_800_000, repository.load().eyeProgress(id).accumulatedMillis());
+            assertTrue(progression.activePlayerIds().isEmpty());
+        }
+    }
+}

src/nativeTest/java/games/dmg/spigotstealth/EyeRevealControllerTest.java

@@ -0,0 +1,335 @@
+package games.dmg.spigotstealth;
+
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.Set;
+import java.util.UUID;
+import java.util.concurrent.atomic.AtomicInteger;
+import java.util.concurrent.atomic.AtomicReference;
+import org.bukkit.GameMode;
+import org.bukkit.Location;
+import org.bukkit.Material;
+import org.bukkit.World;
+import org.bukkit.entity.Player;
+import org.bukkit.inventory.ItemStack;
+import org.bukkit.inventory.PlayerInventory;
+import org.bukkit.potion.PotionEffectType;
+import org.bukkit.scoreboard.Scoreboard;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+class EyeRevealControllerTest {
+    @TempDir Path directory;
+    @BeforeAll static void bootstrap() throws Exception { NativeRuntime.bootstrap(); }
+
+    @Test
+    void onlyTheEligibleObserverGetsAnImmutableProjectionAndUnequippingRestoresTheBaseline() throws Exception {
+        var world = mock(World.class);
+        when(world.getUID()).thenReturn(UUID.randomUUID());
+        when(world.isChunkLoaded(anyInt(), anyInt())).thenReturn(true);
+        var viewer = player(world, "Viewer", 1, 0);
+        var unearned = player(world, "Unearned", 2, 0);
+        var target = player(world, "Concealed", 42, 8);
+        when(target.getTrackedBy()).thenReturn(Set.of(viewer, unearned));
+        when(viewer.canSee(target)).thenReturn(true);
+        when(viewer.hasLineOfSight(target)).thenReturn(true);
+        when(target.hasPotionEffect(PotionEffectType.INVISIBILITY)).thenReturn(true);
+        var items = new EyeItems();
+        var helmet = new AtomicReference<>(items.create());
+        when(viewer.getInventory().getHelmet()).thenAnswer(ignored -> helmet.get());
+        when(unearned.getInventory().getHelmet()).thenReturn(items.create());
+        var repository = new YamlStealthStateRepository(directory.resolve("state.yml"));
+        var initial = new PersistentStealthState(Map.of(), Map.of())
+                .withEyeProgress(viewer.getUniqueId(), new EyeProgress(28_800_000, true));
+        var actions = new ArrayList<String>();
+        var controllerRef = new AtomicReference<EyeRevealController>();
+        var delivery = new EyeRevealController.Delivery() {
+            @Override public void show(Player observer, Player subject, EyeRevealController.Projection projection, boolean create) {
+                actions.add((create ? "create:" : "refresh:") + observer.getName() + ":" + subject.getName());
+                assertTrue(projection.revealBody());
+                assertEquals(projection, controllerRef.get().snapshot().get(observer.getUniqueId()).get(projection.entityId()));
+            }
+            @Override public void restore(Player observer, Optional<Player> subject, EyeRevealController.Projection projection) {
+                assertFalse(controllerRef.get().snapshot().getOrDefault(observer.getUniqueId(), Map.of()).containsKey(projection.entityId()),
+                        "authorization must be withdrawn before sending restoration packets");
+                actions.add("restore:" + observer.getName() + ":" + projection.playerName());
+            }
+        };
+        try (var states = new StealthStateManager(repository, initial)) {
+            var equipment = new EyeEquipment(new EyeProgressionService(states, () -> 0L, ignored -> { }), items);
+            var ids = new AtomicInteger();
+            var controller = new EyeRevealController(() -> List.of(viewer, unearned, target), equipment,
+                    id -> id.equals(target.getUniqueId()), delivery, () -> "eye" + ids.incrementAndGet());
+            controllerRef.set(controller);
+            controller.run();
+            var snapshot = controller.snapshot();
+            assertNotNull(snapshot.get(viewer.getUniqueId()), "an eligible observer needs a projection");
+            assertEquals(Set.of(42), snapshot.get(viewer.getUniqueId()).keySet());
+            assertFalse(snapshot.containsKey(unearned.getUniqueId()));
+            assertEquals(List.of("create:Viewer:Concealed"), actions);
+            assertThrows(UnsupportedOperationException.class, () -> snapshot.clear());
+            assertThrows(UnsupportedOperationException.class, () -> snapshot.get(viewer.getUniqueId()).clear());
+            controller.run();
+            assertEquals(1, actions.size(), "unchanged frames must not resend packets");
+            UUID observerId = viewer.getUniqueId();
+            java.util.concurrent.CompletableFuture.runAsync(() -> {
+                controller.requestRefresh(observerId);
+                controller.requestRefresh(observerId);
+            }).get(3, java.util.concurrent.TimeUnit.SECONDS);
+            assertEquals(1, actions.size(), "packet-thread invalidation must not perform delivery");
+            controller.run();
+            assertEquals(List.of("create:Viewer:Concealed", "refresh:Viewer:Concealed"), actions,
+                    "source updates must coalesce into a main-thread refresh");
+            helmet.set(new ItemStack(Material.IRON_HELMET));
+            controller.run();
+            assertTrue(controller.snapshot().isEmpty());
+            assertEquals(List.of("create:Viewer:Concealed", "refresh:Viewer:Concealed", "restore:Viewer:Concealed"), actions);
+            assertEquals(1, snapshot.get(viewer.getUniqueId()).size(), "published snapshots cannot be mutated by later frames");
+            helmet.set(items.create());
+            controller.run();
+            controller.close();
+            assertTrue(controller.snapshot().isEmpty(), "disable must withdraw all projections");
+            assertEquals(5, actions.size());
+            assertEquals("restore:Viewer:Concealed", actions.getLast());
+            controller.close();
+            controller.run();
+            assertEquals(5, actions.size(), "closed controllers cannot resend or revive projections");
+            verify(target, never()).removePotionEffect(any());
+            verify(target, never()).setInvisible(anyBoolean());
+            verify(viewer, never()).hasLineOfSight(unearned);
+            verify(unearned, never()).hasLineOfSight(any(org.bukkit.entity.Entity.class));
+        }
+    }
+
+    @org.junit.jupiter.params.ParameterizedTest
+    @org.junit.jupiter.params.provider.ValueSource(strings = {"range", "sight", "hidden", "spectator", "vanished", "untracked", "unloaded", "world", "death", "session", "capture-failure", "team-hidden"})
+    void platformChangesWithdrawTheProjectionWithoutLoadingChunksOrForcingVisibility(String change) throws Exception {
+        var world = mock(World.class);
+        when(world.getUID()).thenReturn(UUID.randomUUID());
+        when(world.isChunkLoaded(anyInt(), anyInt())).thenReturn(true);
+        var viewer = player(world, "Viewer", 1, 0);
+        var target = player(world, "Concealed", 42, 8);
+        when(target.getTrackedBy()).thenReturn(Set.of(viewer));
+        when(viewer.canSee(target)).thenReturn(true);
+        when(viewer.hasLineOfSight(target)).thenReturn(true);
+        var items = new EyeItems();
+        when(viewer.getInventory().getHelmet()).thenReturn(items.create());
+        var initial = new PersistentStealthState(Map.of(), Map.of())
+                .withEyeProgress(viewer.getUniqueId(), new EyeProgress(28_800_000, true));
+        var repository = new YamlStealthStateRepository(directory.resolve("state.yml"));
+        var session = new java.util.concurrent.atomic.AtomicBoolean(true);
+        var restored = new AtomicInteger();
+        var delivery = new EyeRevealController.Delivery() {
+            @Override public void show(Player observer, Player subject, EyeRevealController.Projection projection, boolean create) {
+                assertFalse(projection.revealBody(), "identity concealment alone does not authorize changing body flags");
+            }
+            @Override public void restore(Player observer, Optional<Player> subject, EyeRevealController.Projection projection) {
+                assertSame(viewer, observer);
+                assertEquals(target.getUniqueId(), projection.targetId());
+                restored.incrementAndGet();
+            }
+        };
+        try (var states = new StealthStateManager(repository, initial)) {
+            var controller = new EyeRevealController(() -> List.of(viewer, target),
+                    new EyeEquipment(new EyeProgressionService(states, () -> 0L, ignored -> { }), items),
+                    id -> id.equals(target.getUniqueId()) && session.get(), delivery, () -> "eye1");
+            controller.run();
+            assertEquals(1, controller.snapshot().get(viewer.getUniqueId()).size());
+            switch (change) {
+                case "range" -> when(target.getLocation()).thenReturn(new Location(world, 16.001, 64, 0));
+                case "sight" -> when(viewer.hasLineOfSight(target)).thenReturn(false);
+                case "hidden" -> when(viewer.canSee(target)).thenReturn(false);
+                case "spectator" -> when(target.getGameMode()).thenReturn(GameMode.SPECTATOR);
+                case "vanished" -> {
+                    var flag = mock(org.bukkit.metadata.MetadataValue.class);
+                    when(flag.asBoolean()).thenReturn(true);
+                    when(target.getMetadata("vanished")).thenReturn(List.of(flag));
+                }
+                case "untracked" -> when(target.getTrackedBy()).thenReturn(Set.of());
+                case "unloaded" -> when(world.isChunkLoaded(anyInt(), anyInt())).thenReturn(false);
+                case "world" -> {
+                    var otherWorld = mock(World.class);
+                    when(otherWorld.getUID()).thenReturn(UUID.randomUUID());
+                    when(target.getLocation()).thenReturn(new Location(otherWorld, 8, 64, 0));
+                }
+                case "death" -> when(target.isDead()).thenReturn(true);
+                case "session" -> session.set(false);
+                case "capture-failure" -> when(target.getMetadata("vanished")).thenThrow(new IllegalStateException("Visibility state unavailable"));
+                case "team-hidden" -> {
+                    var hidden = mock(org.bukkit.scoreboard.Team.class);
+                    when(hidden.getOption(org.bukkit.scoreboard.Team.Option.NAME_TAG_VISIBILITY)).thenReturn(org.bukkit.scoreboard.Team.OptionStatus.NEVER);
+                    when(viewer.getScoreboard().getEntryTeam(target.getName())).thenReturn(hidden);
+                }
+                default -> throw new AssertionError(change);
+            }
+            org.mockito.Mockito.<Object>clearInvocations(world, viewer, target);
+            controller.run();
+            assertTrue(controller.snapshot().isEmpty(), change);
+            assertEquals(1, restored.get());
+            if (!change.equals("sight")) { verify(viewer, never()).hasLineOfSight(target); }
+            verify(world, never()).getChunkAt(anyInt(), anyInt());
+            verify(world, never()).loadChunk(anyInt(), anyInt());
+            verify(viewer, never()).showPlayer(any(), any());
+            verify(target, never()).removePotionEffect(any());
+            verify(target, never()).setInvisible(anyBoolean());
+        }
+    }
+
+    @org.junit.jupiter.params.ParameterizedTest
+    @org.junit.jupiter.params.provider.ValueSource(strings = {"pair", "viewer", "target", "hide-event", "untrack-event", "helmet-event", "spectator-event", "potion-event", "quit-event", "teleport-event", "respawn-event", "death-event", "world-event", "cancelled-teleport", "cancelled-mode", "cancelled-potion", "other-armor", "other-effect"})
+    void lifecycleInvalidationWithdrawsAuthorizationImmediatelyAndOnlyForAffectedViews(String change) throws Exception {
+        var world = mock(World.class);
+        when(world.getUID()).thenReturn(UUID.randomUUID());
+        when(world.isChunkLoaded(anyInt(), anyInt())).thenReturn(true);
+        var first = player(world, "First", 1, 0);
+        var second = player(world, "Second", 2, 0);
+        var target = player(world, "Concealed", 42, 8);
+        when(target.getTrackedBy()).thenReturn(Set.of(first, second));
+        var items = new EyeItems();
+        for (var viewer : List.of(first, second)) {
+            when(viewer.canSee(target)).thenReturn(true);
+            when(viewer.hasLineOfSight(target)).thenReturn(true);
+            when(viewer.getInventory().getHelmet()).thenReturn(items.create());
+        }
+        var initial = new PersistentStealthState(Map.of(), Map.of())
+                .withEyeProgress(first.getUniqueId(), new EyeProgress(28_800_000, true))
+                .withEyeProgress(second.getUniqueId(), new EyeProgress(28_800_000, true));
+        var restored = new ArrayList<UUID>();
+        var delivery = new EyeRevealController.Delivery() {
+            @Override public void show(Player observer, Player subject, EyeRevealController.Projection projection, boolean create) { }
+            @Override public void restore(Player observer, Optional<Player> subject, EyeRevealController.Projection projection) {
+                restored.add(observer.getUniqueId());
+            }
+        };
+        var repository = new YamlStealthStateRepository(directory.resolve("state.yml"));
+        try (var states = new StealthStateManager(repository, initial)) {
+            var ids = new AtomicInteger();
+            var controller = new EyeRevealController(() -> List.of(first, second, target),
+                    new EyeEquipment(new EyeProgressionService(states, () -> 0L, ignored -> { }), items),
+                    id -> id.equals(target.getUniqueId()), delivery, () -> "eye" + ids.incrementAndGet());
+            controller.run();
+            assertEquals(2, controller.snapshot().size());
+            var events = new EyeRevealEvents(controller);
+            switch (change) {
+                case "cancelled-teleport" -> {
+                    var event = new org.bukkit.event.player.PlayerTeleportEvent(first, first.getLocation(), target.getLocation());
+                    event.setCancelled(true);
+                    events.onTeleport(event);
+                }
+                case "cancelled-mode" -> {
+                    var event = new org.bukkit.event.player.PlayerGameModeChangeEvent(target, GameMode.SPECTATOR);
+                    event.setCancelled(true);
+                    events.onGameMode(event);
+                }
+                case "cancelled-potion" -> {
+                    var event = new org.bukkit.event.entity.EntityPotionEffectEvent(target,
+                            new org.bukkit.potion.PotionEffect(PotionEffectType.INVISIBILITY, 100, 0), null, null,
+                            org.bukkit.event.entity.EntityPotionEffectEvent.Cause.MILK, org.bukkit.event.entity.EntityPotionEffectEvent.Action.REMOVED, false);
+                    event.setCancelled(true);
+                    events.onEffect(event);
+                }
+                case "other-armor" -> events.onArmor(new com.destroystokyo.paper.event.player.PlayerArmorChangeEvent(first,
+                        com.destroystokyo.paper.event.player.PlayerArmorChangeEvent.SlotType.CHEST, new ItemStack(Material.AIR), new ItemStack(Material.IRON_CHESTPLATE)));
+                case "other-effect" -> events.onEffect(new org.bukkit.event.entity.EntityPotionEffectEvent(target, null,
+                        new org.bukkit.potion.PotionEffect(PotionEffectType.NIGHT_VISION, 100, 0), null,
+                        org.bukkit.event.entity.EntityPotionEffectEvent.Cause.COMMAND, org.bukkit.event.entity.EntityPotionEffectEvent.Action.ADDED, false));
+                case "hide-event" -> events.onHide(new org.bukkit.event.player.PlayerHideEntityEvent(first, target));
+                case "untrack-event" -> events.onUntrack(new io.papermc.paper.event.player.PlayerUntrackEntityEvent(first, target));
+                case "helmet-event" -> events.onArmor(new com.destroystokyo.paper.event.player.PlayerArmorChangeEvent(first,
+                        com.destroystokyo.paper.event.player.PlayerArmorChangeEvent.SlotType.HEAD, items.create(), new ItemStack(Material.AIR)));
+                case "spectator-event" -> events.onGameMode(new org.bukkit.event.player.PlayerGameModeChangeEvent(target, GameMode.SPECTATOR));
+                case "potion-event" -> events.onEffect(new org.bukkit.event.entity.EntityPotionEffectEvent(target,
+                        new org.bukkit.potion.PotionEffect(PotionEffectType.INVISIBILITY, 100, 0), null, null,
+                        org.bukkit.event.entity.EntityPotionEffectEvent.Cause.MILK, org.bukkit.event.entity.EntityPotionEffectEvent.Action.REMOVED, false));
+                case "quit-event" -> events.onQuit(new org.bukkit.event.player.PlayerQuitEvent(first, net.kyori.adventure.text.Component.empty()));
+                case "teleport-event" -> events.onTeleport(new org.bukkit.event.player.PlayerTeleportEvent(first, first.getLocation(), target.getLocation()));
+                case "respawn-event" -> events.onRespawn(new org.bukkit.event.player.PlayerRespawnEvent(first, first.getLocation(), false));
+                case "death-event" -> events.onDeath(new org.bukkit.event.entity.PlayerDeathEvent(target, mock(org.bukkit.damage.DamageSource.class),
+                        new ArrayList<>(), 0, net.kyori.adventure.text.Component.empty(), false));
+                case "world-event" -> events.onWorld(new org.bukkit.event.player.PlayerChangedWorldEvent(first, world));
+                case "pair" -> controller.hide(first.getUniqueId(), target.getUniqueId());
+                case "viewer" -> controller.withdrawViewer(first.getUniqueId());
+                case "target" -> controller.withdrawTarget(target.getUniqueId());
+                default -> throw new AssertionError(change);
+            }
+            if (change.startsWith("cancelled-") || change.startsWith("other-")) {
+                assertEquals(2, controller.snapshot().size());
+                assertTrue(restored.isEmpty(), "cancelled or unrelated events must not disturb valid projections");
+                return;
+            }
+            assertFalse(controller.snapshot().containsKey(first.getUniqueId()), "invalidation cannot wait for the next frame");
+            boolean allObservers = Set.of("target", "spectator-event", "potion-event", "death-event").contains(change);
+            assertEquals(allObservers ? 0 : 1, controller.snapshot().size());
+            assertEquals(allObservers ? Set.of(first.getUniqueId(), second.getUniqueId()) : Set.of(first.getUniqueId()), Set.copyOf(restored));
+        }
+    }
+
+    @Test
+    void failedDeliveryRevokesAuthorizationAndCleanupMustSucceedBeforeRetryingTheView() throws Exception {
+        var world = mock(World.class);
+        when(world.getUID()).thenReturn(UUID.randomUUID());
+        when(world.isChunkLoaded(anyInt(), anyInt())).thenReturn(true);
+        var viewer = player(world, "Viewer", 1, 0);
+        var target = player(world, "Concealed", 42, 8);
+        when(target.getTrackedBy()).thenReturn(Set.of(viewer));
+        when(viewer.canSee(target)).thenReturn(true);
+        when(viewer.hasLineOfSight(target)).thenReturn(true);
+        var items = new EyeItems();
+        when(viewer.getInventory().getHelmet()).thenReturn(items.create());
+        var initial = new PersistentStealthState(Map.of(), Map.of())
+                .withEyeProgress(viewer.getUniqueId(), new EyeProgress(28_800_000, true));
+        var shows = new AtomicInteger();
+        var restores = new AtomicInteger();
+        var failures = new ArrayList<Throwable>();
+        var delivery = new EyeRevealController.Delivery() {
+            @Override public void show(Player observer, Player subject, EyeRevealController.Projection projection, boolean create) {
+                assertTrue(create);
+                if (shows.incrementAndGet() == 1) { throw new IllegalStateException("Injected partial delivery failure"); }
+            }
+            @Override public void restore(Player observer, Optional<Player> subject, EyeRevealController.Projection projection) {
+                if (restores.incrementAndGet() == 1) { throw new IllegalStateException("Injected restoration failure"); }
+            }
+        };
+        var repository = new YamlStealthStateRepository(directory.resolve("state.yml"));
+        try (var states = new StealthStateManager(repository, initial)) {
+            var ids = new AtomicInteger();
+            var controller = new EyeRevealController(() -> List.of(viewer, target),
+                    new EyeEquipment(new EyeProgressionService(states, () -> 0L, ignored -> { }), items),
+                    id -> id.equals(target.getUniqueId()), delivery, () -> "eye" + ids.incrementAndGet(), failures::add);
+            assertDoesNotThrow(controller::run);
+            assertTrue(controller.snapshot().isEmpty(), "failed delivery cannot retain outgoing reveal authorization");
+            assertDoesNotThrow(controller::run);
+            assertEquals(1, shows.get(), "failed cleanup must block recreation of the view");
+            assertTrue(controller.snapshot().isEmpty());
+            controller.run();
+            assertEquals(2, shows.get());
+            assertEquals(2, restores.get());
+            assertEquals(1, controller.snapshot().get(viewer.getUniqueId()).size());
+            assertFalse(failures.isEmpty());
+            controller.withdrawViewer(viewer.getUniqueId());
+            assertEquals(3, restores.get());
+            assertTrue(controller.snapshot().isEmpty());
+            controller.close();
+        }
+    }
+
+    private static Player player(World world, String name, int entityId, double x) {
+        var player = mock(Player.class);
+        when(player.getUniqueId()).thenReturn(UUID.randomUUID());
+        when(player.getName()).thenReturn(name);
+        when(player.getEntityId()).thenReturn(entityId);
+        when(player.getLocation()).thenReturn(new Location(world, x, 64, 0));
+        when(player.isOnline()).thenReturn(true);
+        when(player.getGameMode()).thenReturn(GameMode.SURVIVAL);
+        when(player.getInventory()).thenReturn(mock(PlayerInventory.class));
+        when(player.getScoreboard()).thenReturn(mock(Scoreboard.class));
+        return player;
+    }
+}

src/nativeTest/java/games/dmg/spigotstealth/EyeRevealRuntimeTest.java

@@ -0,0 +1,169 @@
+package games.dmg.spigotstealth;
+
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+import com.comphenix.protocol.PacketType;
+import com.comphenix.protocol.ProtocolManager;
+import com.comphenix.protocol.events.PacketContainer;
+import com.comphenix.protocol.events.PacketEvent;
+import com.comphenix.protocol.events.PacketListener;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.UUID;
+import net.minecraft.ChatFormatting;
+import net.minecraft.network.chat.Component;
+import net.minecraft.network.protocol.Packet;
+import net.minecraft.network.protocol.game.ClientboundSetEntityDataPacket;
+import net.minecraft.network.protocol.game.ClientboundSetPlayerTeamPacket;
+import net.minecraft.network.syncher.EntityDataAccessor;
+import net.minecraft.network.syncher.SynchedEntityData;
+import net.minecraft.server.level.ServerPlayer;
+import net.minecraft.server.network.ServerGamePacketListenerImpl;
+import net.minecraft.world.scores.Scoreboard;
+import org.bukkit.Location;
+import org.bukkit.World;
+import org.bukkit.craftbukkit.CraftServer;
+import org.bukkit.craftbukkit.entity.CraftPlayer;
+import org.bukkit.craftbukkit.inventory.CraftInventoryPlayer;
+import org.bukkit.craftbukkit.scheduler.CraftScheduler;
+import org.bukkit.craftbukkit.scoreboard.CraftScoreboard;
+import org.bukkit.event.Listener;
+import org.bukkit.plugin.PluginManager;
+import org.bukkit.plugin.java.JavaPlugin;
+import org.bukkit.potion.PotionEffectType;
+import org.bukkit.scheduler.BukkitTask;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+class EyeRevealRuntimeTest {
+    @TempDir Path directory;
+    @BeforeAll static void bootstrap() throws Exception { NativeRuntime.bootstrap(); }
+
+    @Test
+    @SuppressWarnings({"try", "unchecked"})
+    void registeredRuntimeProjectsAndRestoresRealPacketsWithoutChangingTheServerOrIdentityChannels() throws Exception {
+        var server = mock(CraftServer.class);
+        try (var platform = mockStatic(org.bukkit.Bukkit.class, call -> switch (call.getMethod().getName()) {
+            case "getServer" -> server;
+            case "isPrimaryThread" -> true;
+            case "getVersion" -> "Purpur 2618 (MC: 26.2)";
+            case "getMinecraftVersion" -> "26.2";
+            case "getBukkitVersion" -> "26.2-R0.1-SNAPSHOT";
+            default -> call.callRealMethod();
+        })) {
+            var world = mock(World.class);
+            when(world.getUID()).thenReturn(UUID.randomUUID());
+            when(world.isChunkLoaded(anyInt(), anyInt())).thenReturn(true);
+            var viewer = mock(CraftPlayer.class);
+            var target = mock(CraftPlayer.class);
+            UUID viewerId = UUID.randomUUID(), targetId = UUID.randomUUID();
+            when(viewer.getUniqueId()).thenReturn(viewerId);
+            when(target.getUniqueId()).thenReturn(targetId);
+            when(viewer.getName()).thenReturn("Viewer");
+            when(target.getName()).thenReturn("Concealed");
+            when(viewer.isOnline()).thenReturn(true);
+            when(target.isOnline()).thenReturn(true);
+            when(viewer.getEntityId()).thenReturn(1);
+            when(target.getEntityId()).thenReturn(42);
+            when(viewer.getLocation()).thenReturn(new Location(world, 0, 64, 0));
+            when(target.getLocation()).thenReturn(new Location(world, 8, 64, 0));
+            when(viewer.canSee(target)).thenReturn(true);
+            when(viewer.hasLineOfSight(target)).thenReturn(true);
+            when(target.getTrackedBy()).thenReturn(Set.of(viewer));
+            when(target.hasPotionEffect(PotionEffectType.INVISIBILITY)).thenReturn(true);
+            var inventory = mock(CraftInventoryPlayer.class);
+            when(viewer.getInventory()).thenReturn(inventory);
+            var items = new EyeItems();
+            when(inventory.getHelmet()).thenReturn(items.create());
+            var board = new Scoreboard();
+            var baseline = board.addPlayerTeam("source");
+            baseline.setPlayerPrefix(Component.empty().withStyle(ChatFormatting.OBFUSCATED));
+            board.addPlayerToTeam("Concealed", baseline);
+            var constructor = CraftScoreboard.class.getDeclaredConstructor(Scoreboard.class);
+            constructor.setAccessible(true);
+            when(viewer.getScoreboard()).thenReturn(constructor.newInstance(board));
+            var viewerHandle = mock(ServerPlayer.class);
+            viewerHandle.connection = mock(ServerGamePacketListenerImpl.class);
+            when(viewer.getHandle()).thenReturn(viewerHandle);
+            var targetHandle = mock(ServerPlayer.class);
+            when(target.getHandle()).thenReturn(targetHandle);
+            var data = mock(SynchedEntityData.class);
+            when(targetHandle.getEntityData()).thenReturn(data);
+            var field = net.minecraft.world.entity.Entity.class.getDeclaredField("DATA_SHARED_FLAGS_ID");
+            field.setAccessible(true);
+            var flags = (EntityDataAccessor<Byte>) field.get(null);
+            when(data.get(flags)).thenReturn((byte) 0x60);
+            var protocol = mock(ProtocolManager.class);
+            var packetListeners = new ArrayList<PacketListener>();
+            doAnswer(call -> { packetListeners.add(call.getArgument(0)); return null; }).when(protocol).addPacketListener(any());
+            doAnswer(call -> { packetListeners.remove(call.getArgument(0)); return null; }).when(protocol).removePacketListener(any());
+            var sent = new ArrayList<Packet<?>>();
+            doAnswer(call -> {
+                Packet<?> raw = call.getArgument(0);
+                PacketType type = raw instanceof ClientboundSetPlayerTeamPacket ? PacketType.Play.Server.SCOREBOARD_TEAM : PacketType.Play.Server.ENTITY_METADATA;
+                var event = PacketEvent.fromServer(this, new PacketContainer(type, raw), viewer);
+                for (var listener : List.copyOf(packetListeners)) {
+                    if (listener.getSendingWhitelist().getTypes().contains(type)) { listener.onPacketSending(event); }
+                }
+                if (!event.isCancelled()) { sent.add((Packet<?>) event.getPacket().getHandle()); }
+                return null;
+            }).when(viewerHandle.connection).send(org.mockito.ArgumentMatchers.<Packet<?>>any());
+            var plugin = mock(JavaPlugin.class);
+            when(plugin.getServer()).thenReturn(server);
+            when(plugin.isEnabled()).thenReturn(true);
+            when(plugin.getLogger()).thenReturn(java.util.logging.Logger.getAnonymousLogger());
+            var manager = mock(PluginManager.class);
+            when(server.getPluginManager()).thenReturn(manager);
+            var listeners = new ArrayList<Listener>();
+            doAnswer(call -> { listeners.add(call.getArgument(0)); return null; }).when(manager).registerEvents(any(), eq(plugin));
+            doReturn(List.of(viewer, target)).when(server).getOnlinePlayers();
+            var scheduler = mock(CraftScheduler.class);
+            when(server.getScheduler()).thenReturn(scheduler);
+            var ticks = new ArrayList<Runnable>();
+            var task = mock(BukkitTask.class);
+            when(scheduler.runTaskTimer(eq(plugin), any(Runnable.class), eq(1L), eq(1L))).thenAnswer(call -> {
+                ticks.add(call.getArgument(1)); return task;
+            });
+            var initial = new PersistentStealthState(Map.of(), Map.of()).withEyeProgress(viewerId, new EyeProgress(28_800_000, true));
+            var repository = new YamlStealthStateRepository(directory.resolve("state.yml"));
+            try (var states = new StealthStateManager(repository, initial)) {
+                var equipment = new EyeEquipment(new EyeProgressionService(states, () -> 0L, ignored -> { }), items);
+                var runtime = new EyeRevealRuntime(plugin, equipment, targetId::equals, protocol);
+                runtime.start();
+                assertEquals(1, ticks.size(), "the runtime must register a one-tick visibility loop");
+                ticks.getFirst().run();
+                var create = assertInstanceOf(ClientboundSetPlayerTeamPacket.class, sent.getFirst());
+                assertFalse(create.getParameters().orElseThrow().playerPrefix().getStyle().isObfuscated());
+                assertEquals((byte) 0x40, assertInstanceOf(ClientboundSetEntityDataPacket.class, sent.get(1)).packedItems().getFirst().value());
+                assertSame(baseline, board.getPlayersTeam("Concealed"));
+                assertNull(board.getPlayerTeam(create.getName()));
+                var events = assertInstanceOf(EyeRevealEvents.class, listeners.getFirst());
+                when(viewer.canSee(target)).thenReturn(false);
+                events.onHide(new org.bukkit.event.player.PlayerHideEntityEvent(viewer, target));
+                assertTrue(assertInstanceOf(ClientboundSetPlayerTeamPacket.class, sent.get(2)).getParameters().orElseThrow().playerPrefix().getStyle().isObfuscated());
+                assertEquals((byte) 0x60, assertInstanceOf(ClientboundSetEntityDataPacket.class, sent.get(3)).packedItems().getFirst().value());
+                ticks.getFirst().run();
+                assertEquals(7, sent.size(), "platform-hidden targets must remain hidden");
+                when(viewer.canSee(target)).thenReturn(true);
+                ticks.getFirst().run();
+                assertFalse(assertInstanceOf(ClientboundSetPlayerTeamPacket.class, sent.get(7)).getParameters().orElseThrow().playerPrefix().getStyle().isObfuscated());
+                runtime.close();
+                int count = sent.size();
+                ticks.getFirst().run();
+                assertEquals(count, sent.size());
+                assertTrue(packetListeners.isEmpty());
+                verify(task).cancel();
+                assertSame(baseline, board.getPlayersTeam("Concealed"));
+                assertEquals((byte) 0x60, data.get(flags));
+                verify(target, never()).removePotionEffect(any());
+                verify(target, never()).setInvisible(anyBoolean());
+                assertEquals(initial, states.snapshot());
+            }
+        }
+    }
+}

src/nativeTest/java/games/dmg/spigotstealth/EyeTeamProjectionTest.java

@@ -0,0 +1,82 @@
+package games.dmg.spigotstealth;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+import io.netty.buffer.Unpooled;
+import java.util.Optional;
+import net.minecraft.ChatFormatting;
+import net.minecraft.network.RegistryFriendlyByteBuf;
+import net.minecraft.network.chat.Component;
+import net.minecraft.network.protocol.game.ClientboundSetPlayerTeamPacket.Parameters;
+import net.minecraft.world.scores.Team;
+import net.minecraft.world.scores.TeamColor;
+import org.bukkit.craftbukkit.CraftRegistry;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+
+class EyeTeamProjectionTest {
+    @BeforeAll static void bootstrap() throws Exception { NativeRuntime.bootstrap(); }
+
+    @Test
+    void nativeTeamProjectionRemovesOnlyTheScramblingPrefixAndRoundTripsEveryOtherField() {
+        var config = new io.papermc.paper.configuration.GlobalConfiguration();
+        config.collisions = config.new Collisions();
+        config.collisions.enablePlayerCollisions = true;
+        try (var platform = org.mockito.Mockito.mockStatic(io.papermc.paper.configuration.GlobalConfiguration.class)) {
+            platform.when(io.papermc.paper.configuration.GlobalConfiguration::get).thenReturn(config);
+            assertProjection();
+        }
+    }
+
+    @Test
+    void privateTeamsRevealOnlyTheirTargetWhileSharedServerMembershipUpdatesStayMasked() {
+        var board = new net.minecraft.world.scores.Scoreboard();
+        var shared = board.addPlayerTeam("shared");
+        shared.setPlayerPrefix(Component.empty().withStyle(ChatFormatting.OBFUSCATED));
+        board.addPlayerToTeam("Alice", shared);
+        board.addPlayerToTeam("Bob", shared);
+        var packet = net.minecraft.network.protocol.game.ClientboundSetPlayerTeamPacket.createAddOrModifyPacket(shared, true);
+        var filtered = assertInstanceOf(net.minecraft.network.protocol.game.ClientboundSetPlayerTeamPacket.class,
+                EyePacketProjection.teamPacket(packet, java.util.Set.of("eye-private"), java.util.Set.of("Alice")));
+        assertEquals(java.util.Set.of("Bob"), java.util.Set.copyOf(filtered.getPlayers()),
+                "server membership updates must not pull an active Eye target out of its private team");
+        assertSame(packet.getParameters().orElseThrow(), filtered.getParameters().orElseThrow());
+        assertTrue(filtered.getParameters().orElseThrow().playerPrefix().getStyle().isObfuscated());
+        assertEquals(java.util.Set.of("Alice", "Bob"), java.util.Set.copyOf(packet.getPlayers()));
+        var isolated = board.addPlayerTeam("eye-private");
+        isolated.setPlayerPrefix(Component.empty().withStyle(ChatFormatting.OBFUSCATED));
+        board.addPlayerToTeam("Alice", isolated);
+        var privatePacket = net.minecraft.network.protocol.game.ClientboundSetPlayerTeamPacket.createAddOrModifyPacket(isolated, true);
+        var revealed = assertInstanceOf(net.minecraft.network.protocol.game.ClientboundSetPlayerTeamPacket.class,
+                EyePacketProjection.teamPacket(privatePacket, java.util.Set.of("eye-private"), java.util.Set.of("Alice")));
+        assertEquals(java.util.Set.of("Alice"), java.util.Set.copyOf(revealed.getPlayers()));
+        assertFalse(revealed.getParameters().orElseThrow().playerPrefix().getStyle().isObfuscated());
+        assertTrue(privatePacket.getParameters().orElseThrow().playerPrefix().getStyle().isObfuscated());
+        assertSame(privatePacket, EyePacketProjection.teamPacket(privatePacket, java.util.Set.of(), java.util.Set.of()),
+                "without current authorization even queued private packets must retain their original mask");
+        for (var action : net.minecraft.network.protocol.game.ClientboundSetPlayerTeamPacket.Action.values()) {
+            var membership = net.minecraft.network.protocol.game.ClientboundSetPlayerTeamPacket.createPlayerPacket(shared, "Alice", action);
+            var projected = assertInstanceOf(net.minecraft.network.protocol.game.ClientboundSetPlayerTeamPacket.class,
+                    EyePacketProjection.teamPacket(membership, java.util.Set.of("eye-private"), java.util.Set.of("Alice")));
+            assertTrue(projected.getPlayers().isEmpty());
+            assertEquals(membership.getPlayerAction(), projected.getPlayerAction());
+        }
+    }
+
+    private static void assertProjection() {
+        var original = new Parameters(Component.literal("Keep team display"),
+                Component.empty().withStyle(ChatFormatting.OBFUSCATED), Component.literal("Keep suffix"),
+                Team.Visibility.ALWAYS, Team.CollisionRule.PUSH_OWN_TEAM, Optional.of(TeamColor.AQUA), (byte) 0x53);
+        var projected = assertInstanceOf(Parameters.class, EyePacketProjection.teamParameters(original));
+        var expected = new Parameters(original.displayName(), Component.empty(), original.playerSuffix(),
+                original.nameTagVisibility(), original.collisionRule(), original.color(), original.options());
+        assertEquals(expected, projected);
+        assertNotSame(original, projected);
+        assertTrue(original.playerPrefix().getStyle().isObfuscated(), "the shared server/team packet must remain unchanged");
+        var buffer = new RegistryFriendlyByteBuf(Unpooled.buffer(), CraftRegistry.getMinecraftRegistry());
+        try {
+            Parameters.STREAM_CODEC.encode(buffer, projected);
+            assertEquals(projected, Parameters.STREAM_CODEC.decode(buffer));
+        } finally { buffer.release(); }
+    }
+}

src/nativeTest/java/games/dmg/spigotstealth/NativeCombatTabRestoreTest.java

@@ -0,0 +1,68 @@
+package games.dmg.spigotstealth;
+
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+import com.comphenix.protocol.PacketType;
+import com.comphenix.protocol.ProtocolManager;
+import com.comphenix.protocol.events.PacketContainer;
+import java.util.ArrayList;
+import java.util.UUID;
+import net.minecraft.network.protocol.game.ClientboundPlayerInfoUpdatePacket;
+import org.bukkit.Bukkit;
+import org.bukkit.craftbukkit.CraftServer;
+import org.bukkit.craftbukkit.entity.CraftPlayer;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+
+class NativeCombatTabRestoreTest {
+    @BeforeAll static void bootstrap() throws Exception { NativeRuntime.bootstrap(); }
+
+    @Test
+    @SuppressWarnings("try")
+    void sharedRestorationProducesARealListedPlayerEntryWithCurrentIdentity() {
+        var server = mock(CraftServer.class);
+        try (var platform = mockStatic(Bukkit.class, call -> switch (call.getMethod().getName()) {
+            case "getServer" -> server;
+            case "isPrimaryThread" -> true;
+            case "getVersion" -> "Purpur 2618 (MC: 26.2)";
+            case "getMinecraftVersion" -> "26.2";
+            case "getBukkitVersion" -> "26.2-R0.1-SNAPSHOT";
+            default -> call.callRealMethod();
+        })) {
+            var target = mock(CraftPlayer.class);
+            var observer = mock(CraftPlayer.class);
+            UUID id = UUID.randomUUID();
+            when(target.getUniqueId()).thenReturn(id);
+            when(target.getName()).thenReturn("Attacker");
+            when(target.getPlayerListName()).thenReturn("Original Attacker");
+            when(target.getGameMode()).thenReturn(org.bukkit.GameMode.SURVIVAL);
+            when(target.getPing()).thenReturn(37);
+            var handle = mock(net.minecraft.server.level.ServerPlayer.class);
+            handle.gameProfile = new com.mojang.authlib.GameProfile(id, "Attacker");
+            when(target.getHandle()).thenReturn(handle);
+            when(target.getProfile()).thenReturn(handle.gameProfile);
+            var protocol = mock(ProtocolManager.class);
+            when(protocol.createPacket(any(PacketType.class))).thenAnswer(call -> new PacketContainer(call.getArgument(0)));
+            var sent = new ArrayList<PacketContainer>();
+            doAnswer(call -> { sent.add(call.getArgument(1)); return null; }).when(protocol).sendServerPacket(eq(observer), any(PacketContainer.class));
+            new ProtocolLibTabListController(protocol).add(observer, target);
+            var packet = assertInstanceOf(ClientboundPlayerInfoUpdatePacket.class, sent.getFirst().getHandle());
+            assertTrue(packet.actions().contains(ClientboundPlayerInfoUpdatePacket.Action.ADD_PLAYER));
+            assertTrue(packet.actions().contains(ClientboundPlayerInfoUpdatePacket.Action.UPDATE_LISTED));
+            var entry = packet.entries().getFirst();
+            assertEquals(id, entry.profileId());
+            assertEquals("Attacker", entry.profile().name());
+            assertTrue(entry.listed());
+            assertEquals(37, entry.latency());
+            assertEquals(net.minecraft.world.level.GameType.SURVIVAL, entry.gameMode());
+            assertEquals("Original Attacker", entry.displayName().getString());
+            var buffer = new net.minecraft.network.RegistryFriendlyByteBuf(io.netty.buffer.Unpooled.buffer(), org.bukkit.craftbukkit.CraftRegistry.getMinecraftRegistry());
+            try {
+                ClientboundPlayerInfoUpdatePacket.STREAM_CODEC.encode(buffer, packet);
+                var decoded = ClientboundPlayerInfoUpdatePacket.STREAM_CODEC.decode(buffer);
+                assertEquals(packet.actions(), decoded.actions());
+                assertEquals(packet.entries(), decoded.entries());
+            } finally { buffer.release(); }
+        }
+    }
+}

src/nativeTest/java/games/dmg/spigotstealth/NativeEyeDeliveryTest.java

@@ -0,0 +1,125 @@
+package games.dmg.spigotstealth;
+
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+import java.util.ArrayList;
+import java.util.Optional;
+import java.util.Set;
+import java.util.UUID;
+import java.util.concurrent.atomic.AtomicReference;
+import net.minecraft.ChatFormatting;
+import net.minecraft.network.chat.Component;
+import net.minecraft.network.protocol.Packet;
+import net.minecraft.network.protocol.game.ClientboundSetEntityDataPacket;
+import net.minecraft.network.protocol.game.ClientboundSetPlayerTeamPacket;
+import net.minecraft.network.syncher.EntityDataAccessor;
+import net.minecraft.network.syncher.SynchedEntityData;
+import net.minecraft.server.level.ServerPlayer;
+import net.minecraft.server.network.ServerGamePacketListenerImpl;
+import net.minecraft.world.scores.Scoreboard;
+import net.minecraft.world.scores.TeamColor;
+import org.bukkit.craftbukkit.entity.CraftPlayer;
+import org.bukkit.craftbukkit.scoreboard.CraftScoreboard;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+
+class NativeEyeDeliveryTest {
+    @BeforeAll static void bootstrap() throws Exception { NativeRuntime.bootstrap(); }
+
+    @org.junit.jupiter.params.ParameterizedTest
+    @org.junit.jupiter.params.provider.CsvSource({"ALWAYS,false,true", "NEVER,false,false", "HIDE_FOR_OWN_TEAM,true,false",
+            "HIDE_FOR_OWN_TEAM,false,true", "HIDE_FOR_OTHER_TEAMS,true,true", "HIDE_FOR_OTHER_TEAMS,false,false"})
+    @SuppressWarnings("unchecked") // The declared runtime accessor's BYTE serializer is verified in the metadata codec tests.
+    void deliveryUsesOnlyTheViewerConnectionAndRestoresCurrentStateWithoutChangingServerTeamsOrFlags(
+            net.minecraft.world.scores.Team.Visibility visibility, boolean teammate, boolean visible) throws Exception {
+        var board = new Scoreboard();
+        var baseline = board.addPlayerTeam("source");
+        baseline.setPlayerPrefix(Component.empty().withStyle(ChatFormatting.OBFUSCATED));
+        baseline.setColor(Optional.of(TeamColor.AQUA));
+        baseline.setNameTagVisibility(visibility);
+        if (teammate) { board.addPlayerToTeam("Viewer", baseline); }
+        board.addPlayerToTeam("Concealed", baseline);
+        board.addPlayerToTeam("OtherConcealed", baseline);
+        var boardConstructor = CraftScoreboard.class.getDeclaredConstructor(Scoreboard.class);
+        boardConstructor.setAccessible(true);
+        var bukkitBoard = boardConstructor.newInstance(board);
+        var viewer = mock(CraftPlayer.class);
+        var viewerHandle = mock(ServerPlayer.class);
+        var connection = mock(ServerGamePacketListenerImpl.class);
+        viewerHandle.connection = connection;
+        when(viewer.getHandle()).thenReturn(viewerHandle);
+        when(viewer.getName()).thenReturn("Viewer");
+        when(viewer.getScoreboard()).thenReturn(bukkitBoard);
+        var sent = new ArrayList<Packet<?>>();
+        doAnswer(call -> { sent.add(call.getArgument(0)); return null; })
+                .when(connection).send(org.mockito.ArgumentMatchers.<Packet<?>>any());
+        var target = mock(CraftPlayer.class);
+        var targetHandle = mock(ServerPlayer.class);
+        when(target.getHandle()).thenReturn(targetHandle);
+        when(target.getEntityId()).thenReturn(42);
+        when(target.isOnline()).thenReturn(true);
+        var data = mock(SynchedEntityData.class);
+        when(targetHandle.getEntityData()).thenReturn(data);
+        var accessorField = net.minecraft.world.entity.Entity.class.getDeclaredField("DATA_SHARED_FLAGS_ID");
+        accessorField.setAccessible(true);
+        var flagsAccessor = (EntityDataAccessor<Byte>) accessorField.get(null);
+        var flags = new AtomicReference<>((byte) 0xa0);
+        when(data.get(flagsAccessor)).thenAnswer(ignored -> flags.get());
+        var projection = new EyeRevealController.Projection(UUID.randomUUID(), 42, "Concealed", "eye-private",
+                Optional.of("source"), true);
+        var delivery = new NativeEyeDelivery();
+        delivery.show(viewer, target, projection, true);
+        assertEquals(2, sent.size(), "a private team and raw metadata refresh are required");
+        var team = assertInstanceOf(ClientboundSetPlayerTeamPacket.class, sent.get(0));
+        assertEquals("eye-private", team.getName());
+        assertEquals(ClientboundSetPlayerTeamPacket.Action.ADD, team.getTeamAction());
+        assertEquals(java.util.List.of("Concealed"), java.util.List.copyOf(team.getPlayers()));
+        assertEquals(visible ? net.minecraft.world.scores.Team.Visibility.ALWAYS : net.minecraft.world.scores.Team.Visibility.NEVER,
+                team.getParameters().orElseThrow().nameTagVisibility(), "private teams must preserve effective visibility, not change team relationships");
+        assertTrue(team.getParameters().orElseThrow().playerPrefix().getStyle().isObfuscated(),
+                "raw state must reach the outgoing authorization gate before any prefix is revealed");
+        var metadata = assertInstanceOf(ClientboundSetEntityDataPacket.class, sent.get(1));
+        assertEquals(42, metadata.id());
+        assertEquals((byte) 0xa0, metadata.packedItems().getFirst().value());
+        assertNull(board.getPlayerTeam("eye-private"));
+        assertEquals(teammate ? Set.of("Viewer", "Concealed", "OtherConcealed") : Set.of("Concealed", "OtherConcealed"), Set.copyOf(baseline.getPlayers()));
+        assertEquals((byte) 0xa0, flags.get());
+        // Another plugin can move the actor to a different real team while the private view is active.
+        var replacement = board.addPlayerTeam("replacement");
+        replacement.setPlayerPrefix(Component.empty().withStyle(ChatFormatting.OBFUSCATED));
+        replacement.setColor(Optional.of(TeamColor.GOLD));
+        replacement.setNameTagVisibility(visibility);
+        board.addPlayerToTeam("Concealed", replacement);
+        flags.set((byte) 9);
+        sent.clear();
+        delivery.restore(viewer, Optional.of(target), projection);
+        assertEquals(5, sent.size(), "restore the mask and flags before moving or removing client team membership");
+        var privateMask = assertInstanceOf(ClientboundSetPlayerTeamPacket.class, sent.get(0));
+        assertEquals("eye-private", privateMask.getName());
+        assertTrue(privateMask.getParameters().orElseThrow().playerPrefix().getStyle().isObfuscated());
+        boolean nowVisible = visibility == net.minecraft.world.scores.Team.Visibility.ALWAYS
+                || visibility == net.minecraft.world.scores.Team.Visibility.HIDE_FOR_OWN_TEAM;
+        assertEquals(nowVisible ? net.minecraft.world.scores.Team.Visibility.ALWAYS : net.minecraft.world.scores.Team.Visibility.NEVER,
+                privateMask.getParameters().orElseThrow().nameTagVisibility());
+        var restoredFlags = assertInstanceOf(ClientboundSetEntityDataPacket.class, sent.get(1));
+        assertEquals((byte) 9, restoredFlags.packedItems().getFirst().value());
+        var restoredTeam = assertInstanceOf(ClientboundSetPlayerTeamPacket.class, sent.get(2));
+        assertEquals("replacement", restoredTeam.getName());
+        assertEquals(Optional.of(TeamColor.GOLD), restoredTeam.getParameters().orElseThrow().color());
+        assertEquals(visibility, restoredTeam.getParameters().orElseThrow().nameTagVisibility());
+        var membership = assertInstanceOf(ClientboundSetPlayerTeamPacket.class, sent.get(3));
+        assertEquals("replacement", membership.getName());
+        assertEquals(ClientboundSetPlayerTeamPacket.Action.ADD, membership.getPlayerAction());
+        assertEquals(java.util.List.of("Concealed"), java.util.List.copyOf(membership.getPlayers()));
+        var removal = assertInstanceOf(ClientboundSetPlayerTeamPacket.class, sent.get(4));
+        assertEquals("eye-private", removal.getName());
+        assertEquals(ClientboundSetPlayerTeamPacket.Action.REMOVE, removal.getTeamAction());
+        assertSame(replacement, board.getPlayersTeam("Concealed"));
+        assertEquals(teammate ? Set.of("Viewer", "OtherConcealed") : Set.of("OtherConcealed"), Set.copyOf(baseline.getPlayers()));
+        assertNull(board.getPlayerTeam("eye-private"));
+        verify(data, never()).set(any(), any());
+        verify(connection, times(7)).send(org.mockito.ArgumentMatchers.<Packet<?>>any());
+        verifyNoMoreInteractions(connection);
+    }
+}

src/nativeTest/java/games/dmg/spigotstealth/NativePotionDamageTest.java

@@ -0,0 +1,104 @@
+package games.dmg.spigotstealth;
+
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.UUID;
+import net.minecraft.core.RegistryAccess;
+import net.minecraft.core.registries.Registries;
+import net.minecraft.server.level.ServerLevel;
+import net.minecraft.server.level.ServerPlayer;
+import net.minecraft.world.damagesource.DamageSource;
+import net.minecraft.world.damagesource.DamageSources;
+import net.minecraft.world.effect.MobEffectInstance;
+import net.minecraft.world.effect.MobEffects;
+import net.minecraft.world.entity.LivingEntity;
+import org.bukkit.Bukkit;
+import org.bukkit.craftbukkit.CraftRegistry;
+import org.bukkit.craftbukkit.damage.CraftDamageSource;
+import org.bukkit.craftbukkit.entity.CraftPlayer;
+import org.bukkit.event.entity.EntityDamageEvent;
+import org.bukkit.event.entity.EntityPotionEffectEvent;
+import org.bukkit.plugin.PluginManager;
+import org.junit.jupiter.api.BeforeAll;
+
+class NativePotionDamageTest {
+    @BeforeAll static void bootstrap() throws Exception { NativeRuntime.bootstrap(); }
+
+    @org.junit.jupiter.params.ParameterizedTest
+    @org.junit.jupiter.params.provider.ValueSource(booleans = {false, true})
+    @SuppressWarnings("try")
+    void actualNativeApplicationAndDamageTickKeepTheObservedPlayerSource(boolean wither) throws Exception {
+        var manager = mock(PluginManager.class);
+        try (var platform = mockStatic(Bukkit.class, call -> switch (call.getMethod().getName()) {
+            case "getPluginManager" -> manager;
+            case "isPrimaryThread" -> true;
+            default -> call.callRealMethod();
+        })) {
+            var victim = mock(CraftPlayer.class);
+            var attacker = mock(CraftPlayer.class);
+            UUID victimId = UUID.randomUUID(), attackerId = UUID.randomUUID();
+            when(victim.getUniqueId()).thenReturn(victimId);
+            when(attacker.getUniqueId()).thenReturn(attackerId);
+            var nativeVictim = mock(ServerPlayer.class);
+            var nativeAttacker = mock(ServerPlayer.class);
+            when(victim.getHandle()).thenReturn(nativeVictim);
+            when(nativeVictim.getBukkitEntity()).thenReturn(victim);
+            when(nativeVictim.getBukkitLivingEntity()).thenReturn(victim);
+            when(nativeAttacker.getBukkitEntity()).thenReturn(attacker);
+            var active = new HashMap<net.minecraft.core.Holder<net.minecraft.world.effect.MobEffect>, MobEffectInstance>();
+            var field = LivingEntity.class.getDeclaredField("activeEffects");
+            field.setAccessible(true);
+            field.set(nativeVictim, active);
+            when(nativeVictim.canBeAffected(any(MobEffectInstance.class))).thenReturn(true);
+            when(nativeVictim.getEffect(any())).thenAnswer(call -> active.get(call.getArgument(0)));
+            when(nativeVictim.addEffect(any(MobEffectInstance.class), any(net.minecraft.world.entity.Entity.class), any(EntityPotionEffectEvent.Cause.class), anyBoolean())).thenCallRealMethod();
+            var failures = new ArrayList<Throwable>();
+            var attribution = new PotionDamageListener(id -> id.equals(attackerId) ? attacker : null, failures::add);
+            var applications = new ArrayList<EntityPotionEffectEvent>();
+            doAnswer(call -> {
+                if (call.getArgument(0) instanceof EntityPotionEffectEvent event) {
+                    applications.add(event);
+                    attribution.onEffect(event);
+                }
+                return null;
+            }).when(manager).callEvent(any());
+            var type = wither ? MobEffects.WITHER : MobEffects.POISON;
+            var potion = new MobEffectInstance(type, wither ? 80 : 100, 0);
+            assertTrue(nativeVictim.addEffect(potion, nativeAttacker, EntityPotionEffectEvent.Cause.POTION_SPLASH, true));
+            assertSame(attacker, applications.getFirst().getSource());
+            assertSame(potion, active.get(type));
+            var world = mock(ServerLevel.class);
+            var config = mock(org.purpurmc.purpur.PurpurWorldConfig.class);
+            config.entityMinimalHealthPoison = 1;
+            config.entityPoisonDegenerationAmount = 1;
+            config.entityWitherDegenerationAmount = 1;
+            var worldConfig = net.minecraft.world.level.Level.class.getField("purpurConfig");
+            worldConfig.setAccessible(true);
+            worldConfig.set(world, config);
+            when(nativeVictim.level()).thenReturn(world);
+            when(nativeVictim.getHealth()).thenReturn(10f);
+            var sources = new DamageSources(new RegistryAccess.ImmutableRegistryAccess(List.of(CraftRegistry.getMinecraftRegistry(Registries.DAMAGE_TYPE))));
+            when(nativeVictim.damageSources()).thenReturn(sources);
+            var resolved = new ArrayList<UUID>();
+            doAnswer(call -> {
+                DamageSource raw = call.getArgument(1);
+                assertNull(raw.getEntity(), "native delayed damage does not carry the applying player's identity");
+                var event = new EntityDamageEvent(victim, wither ? EntityDamageEvent.DamageCause.WITHER : EntityDamageEvent.DamageCause.POISON,
+                        new CraftDamageSource(raw), ((Float) call.getArgument(2)).doubleValue());
+                var responsible = attribution.apply(event);
+                assertNotNull(responsible, "observed native potion provenance must resolve the responsible player");
+                resolved.add(responsible.getUniqueId());
+                return true;
+            }).when(nativeVictim).hurtServer(eq(world), any(DamageSource.class), anyFloat());
+            assertTrue(potion.tickServer(world, nativeVictim, () -> { }));
+            assertEquals(List.of(attackerId), resolved);
+            attribution.onQuit(new org.bukkit.event.player.PlayerQuitEvent(victim, net.kyori.adventure.text.Component.empty()));
+            assertNull(attribution.apply(new EntityDamageEvent(victim, wither ? EntityDamageEvent.DamageCause.WITHER : EntityDamageEvent.DamageCause.POISON,
+                    new CraftDamageSource(wither ? sources.wither() : sources.magic()), 1.0)), "disconnect must discard runtime-only victim provenance");
+            assertTrue(failures.isEmpty(), failures.toString());
+        }
+    }
+}

src/nativeTest/java/games/dmg/spigotstealth/NativeRuntime.java

@@ -0,0 +1,61 @@
+package games.dmg.spigotstealth;
+
+import java.util.List;
+import java.util.stream.Stream;
+import net.minecraft.SharedConstants;
+import net.minecraft.commands.Commands;
+import net.minecraft.core.HolderLookup;
+import net.minecraft.core.LayeredRegistryAccess;
+import net.minecraft.core.Registry;
+import net.minecraft.core.RegistryAccess;
+import net.minecraft.resources.Identifier;
+import net.minecraft.resources.RegistryDataLoader;
+import net.minecraft.server.Bootstrap;
+import net.minecraft.server.MinecraftServer;
+import net.minecraft.server.RegistryLayer;
+import net.minecraft.server.ReloadableServerResources;
+import net.minecraft.server.packs.PackType;
+import net.minecraft.server.packs.repository.ServerPacksSource;
+import net.minecraft.server.packs.resources.MultiPackResourceManager;
+import net.minecraft.server.permissions.LevelBasedPermissionSet;
+import net.minecraft.tags.TagLoader;
+import net.minecraft.util.Util;
+import net.minecraft.world.flag.FeatureFlags;
+import net.minecraft.world.level.DataPackConfig;
+import net.minecraft.world.level.WorldDataConfiguration;
+import org.bukkit.craftbukkit.CraftRegistry;
+
+/** Loads vanilla registries/tags/components using the same path as the server's own tests. */
+final class NativeRuntime {
+    private NativeRuntime() {}
+    private static boolean ready;
+
+    static synchronized void bootstrap() throws Exception {
+        if (ready) { return; }
+        SharedConstants.tryDetectVersion();
+        Bootstrap.bootStrap();
+        var flags = FeatureFlags.VANILLA_SET;
+        var packs = ServerPacksSource.createVanillaTrustedRepository();
+        MinecraftServer.configurePackRepository(packs, new WorldDataConfiguration(new DataPackConfig(
+                FeatureFlags.REGISTRY.toNames(flags).stream().map(Identifier::getPath).toList(), List.of()), flags), true, false);
+        try (var resources = new MultiPackResourceManager(PackType.SERVER_DATA, packs.openAllSelected())) {
+            LayeredRegistryAccess<RegistryLayer> layers = RegistryLayer.createRegistryAccess();
+            List<Registry.PendingTags<?>> tags = TagLoader.loadTagsForExistingRegistries(resources, layers.getLayer(RegistryLayer.STATIC));
+            List<HolderLookup.RegistryLookup<?>> lookups = TagLoader.buildUpdatedLookups(layers.getAccessForLoading(RegistryLayer.WORLDGEN), tags);
+            RegistryAccess.Frozen worldgen = RegistryDataLoader.load(resources, lookups,
+                    RegistryDataLoader.WORLDGEN_REGISTRIES, Util.backgroundExecutor()).join();
+            layers = layers.replaceFrom(RegistryLayer.WORLDGEN, worldgen);
+            RegistryAccess.Frozen dimensions = RegistryDataLoader.load(resources,
+                    Stream.concat(lookups.stream(), worldgen.listRegistries()).toList(),
+                    RegistryDataLoader.DIMENSION_REGISTRIES, Util.backgroundExecutor()).join();
+            layers = layers.replaceFrom(RegistryLayer.DIMENSIONS, dimensions);
+            Class.forName(org.bukkit.Registry.class.getName());
+            var datapack = ReloadableServerResources.loadResources(resources, layers, tags, flags,
+                    Commands.CommandSelection.DEDICATED, LevelBasedPermissionSet.ALL_PERMISSIONS,
+                    Util.backgroundExecutor(), Runnable::run).join();
+            datapack.updateComponentsAndStaticRegistryTags();
+            CraftRegistry.setMinecraftRegistry(layers.compositeAccess().freeze());
+        }
+        ready = true;
+    }
+}

src/nativeTest/java/games/dmg/spigotstealth/PotionDamageAttributionTest.java

@@ -0,0 +1,117 @@
+package games.dmg.spigotstealth;
+
+import static org.junit.jupiter.api.Assertions.*;
+import java.util.UUID;
+import net.minecraft.world.effect.MobEffectInstance;
+import net.minecraft.world.effect.MobEffects;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+
+class PotionDamageAttributionTest {
+    @BeforeAll static void bootstrap() throws Exception { NativeRuntime.bootstrap(); }
+
+    @Test
+    void actualPoisonCountdownRetainsTheExplicitSourceWithoutAClockGuess() {
+        UUID victim = UUID.randomUUID(), owner = UUID.randomUUID();
+        var attribution = new PotionDamageAttribution();
+        var poison = new MobEffectInstance(MobEffects.POISON, 100, 0);
+        attribution.change(victim, PotionDamageAttribution.Kind.POISON, null, effect(poison), owner, true);
+        assertEquals(java.util.Optional.of(owner), attribution.attacker(victim, PotionDamageAttribution.Kind.POISON, snapshot(poison)));
+        for (int tick = 0; tick < 20; tick++) { poison.tickClient(); }
+        assertEquals(java.util.Optional.of(owner), attribution.attacker(victim, PotionDamageAttribution.Kind.POISON, snapshot(poison)));
+        assertTrue(attribution.attacker(UUID.randomUUID(), PotionDamageAttribution.Kind.POISON, snapshot(poison)).isEmpty());
+    }
+
+    @Test
+    void strongerShortPotionReturnsOwnershipToTheRestoredHiddenLayer() {
+        UUID victim = UUID.randomUUID(), first = UUID.randomUUID(), second = UUID.randomUUID();
+        var attribution = new PotionDamageAttribution();
+        var poison = new MobEffectInstance(MobEffects.POISON, 100, 0);
+        attribution.change(victim, PotionDamageAttribution.Kind.POISON, null, effect(poison), first, true);
+        assertEquals(java.util.Optional.of(first), attribution.attacker(victim, PotionDamageAttribution.Kind.POISON, snapshot(poison)));
+        var stronger = new MobEffectInstance(MobEffects.POISON, 20, 1);
+        attribution.change(victim, PotionDamageAttribution.Kind.POISON, snapshot(poison), effect(stronger), second, true);
+        assertTrue(poison.update(stronger));
+        assertEquals(java.util.Optional.of(second), attribution.attacker(victim, PotionDamageAttribution.Kind.POISON, snapshot(poison)));
+        for (int tick = 0; tick < 20; tick++) { poison.tickClient(); }
+        assertEquals(0, poison.getAmplifier());
+        assertEquals(80, poison.getDuration());
+        assertEquals(java.util.Optional.of(first), attribution.attacker(victim, PotionDamageAttribution.Kind.POISON, snapshot(poison)));
+    }
+
+    @org.junit.jupiter.params.ParameterizedTest
+    @org.junit.jupiter.params.provider.ValueSource(strings = {"weaker-hidden", "equal-shorter", "cosmetic", "equal-longer", "stronger-longer", "rejected-stronger", "unknown-stronger"})
+    void nativeReplacementRulesDoNotGiveRejectedOrCosmeticSourcesOwnership(String scenario) {
+        UUID victim = UUID.randomUUID(), first = UUID.randomUUID(), second = UUID.randomUUID();
+        var attribution = new PotionDamageAttribution();
+        boolean weaker = scenario.equals("weaker-hidden");
+        var poison = new MobEffectInstance(MobEffects.POISON, weaker ? 20 : 100, weaker ? 2 : 0);
+        attribution.change(victim, PotionDamageAttribution.Kind.POISON, null, effect(poison), first, true);
+        int amp = scenario.contains("stronger") || weaker ? 1 : 0;
+        int duration = scenario.contains("longer") ? 200 : weaker ? 100 : 20;
+        var incoming = new MobEffectInstance(MobEffects.POISON, duration, amp, false, !scenario.equals("cosmetic"));
+        boolean override = !scenario.equals("rejected-stronger") && new MobEffectInstance(poison).update(incoming);
+        attribution.change(victim, PotionDamageAttribution.Kind.POISON, snapshot(poison), effect(incoming),
+                scenario.equals("unknown-stronger") ? null : second, override);
+        if (!scenario.equals("rejected-stronger")) { poison.update(incoming); }
+        UUID expected = scenario.equals("unknown-stronger") ? null : scenario.contains("longer") ? second : first;
+        assertEquals(java.util.Optional.ofNullable(expected), attribution.attacker(victim, PotionDamageAttribution.Kind.POISON, snapshot(poison)));
+        if (weaker || scenario.equals("unknown-stronger")) {
+            for (int tick = 0; tick < 20; tick++) { poison.tickClient(); }
+            assertEquals(java.util.Optional.of(weaker ? second : first), attribution.attacker(victim, PotionDamageAttribution.Kind.POISON, snapshot(poison)));
+        }
+    }
+
+    @org.junit.jupiter.params.ParameterizedTest
+    @org.junit.jupiter.params.provider.ValueSource(strings = {"infinite-active", "infinite-hidden", "expired", "removed", "replaced-native"})
+    void witherInfiniteDurationsAndEffectLifecycleDoNotLeakOldOwnership(String scenario) {
+        UUID victim = UUID.randomUUID(), owner = UUID.randomUUID(), other = UUID.randomUUID();
+        var attribution = new PotionDamageAttribution();
+        var kind = PotionDamageAttribution.Kind.WITHER;
+        var effect = new MobEffectInstance(MobEffects.WITHER, scenario.startsWith("infinite") ? -1 : 100, 0);
+        attribution.change(victim, kind, null, effect(effect), owner, true);
+        assertEquals(java.util.Optional.of(owner), attribution.attacker(victim, kind, snapshot(effect)));
+        assertTrue(attribution.attacker(victim, PotionDamageAttribution.Kind.POISON, snapshot(effect)).isEmpty());
+        if (scenario.equals("infinite-hidden")) {
+            var incoming = new MobEffectInstance(MobEffects.WITHER, 20, 1);
+            attribution.change(victim, kind, snapshot(effect), effect(incoming), other, true);
+            effect.update(incoming);
+            assertEquals(java.util.Optional.of(other), attribution.attacker(victim, kind, snapshot(effect)));
+        }
+        for (int tick = 0; tick < (scenario.equals("expired") ? 100 : 20); tick++) { effect.tickClient(); }
+        if (scenario.equals("removed")) { attribution.change(victim, kind, snapshot(effect), null, null, false); }
+        if (scenario.equals("replaced-native")) { effect = new MobEffectInstance(effect); }
+        assertEquals(scenario.startsWith("infinite") ? java.util.Optional.of(owner) : java.util.Optional.empty(), attribution.attacker(victim, kind, snapshot(effect)));
+    }
+
+    @Test
+    void repeatedNativeMergesAndCountdownsKeepKnownOwnershipAcrossDeepChains() {
+        var random = new java.util.Random(2618);
+        UUID victim = UUID.randomUUID(), owner = UUID.randomUUID();
+        var attribution = new PotionDamageAttribution();
+        MobEffectInstance current = null;
+        for (int step = 0; step < 2_000; step++) {
+            if (current == null || random.nextBoolean()) {
+                var incoming = new MobEffectInstance(MobEffects.POISON, random.nextInt(10) == 0 ? -1 : 1 + random.nextInt(200), random.nextInt(8));
+                boolean override = current == null || new MobEffectInstance(current).update(incoming);
+                attribution.change(victim, PotionDamageAttribution.Kind.POISON, snapshot(current), effect(incoming), owner, override);
+                if (current == null) { current = incoming; } else { current.update(incoming); }
+            } else {
+                for (int tick = 0; tick < 1 + random.nextInt(20) && current.getDuration() != 0; tick++) { current.tickClient(); }
+            }
+            if (current.getDuration() == 0) {
+                attribution.change(victim, PotionDamageAttribution.Kind.POISON, snapshot(current), null, null, false);
+                current = null;
+            }
+            assertEquals(current == null ? java.util.Optional.empty() : java.util.Optional.of(owner),
+                    attribution.attacker(victim, PotionDamageAttribution.Kind.POISON, snapshot(current)), "native operation " + step);
+        }
+    }
+
+    static PotionDamageAttribution.Snapshot snapshot(MobEffectInstance effect) {
+        return effect == null ? null : new PotionDamageAttribution.Snapshot(effect, effect(effect));
+    }
+    static PotionDamageAttribution.Effect effect(MobEffectInstance effect) {
+        return effect == null ? null : new PotionDamageAttribution.Effect(effect.getAmplifier(), effect.getDuration(), effect(effect.hiddenEffect));
+    }
+}

src/test/java/games/dmg/spigotstealth/EyeProgressStateTest.java

@@ -0,0 +1,37 @@
+package games.dmg.spigotstealth;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+import java.util.HashMap;
+import java.util.Map;
+import java.util.UUID;
+import org.junit.jupiter.api.Test;
+
+class EyeProgressStateTest {
+    @Test
+    void eyeProgressRemainsIndependentAcrossExistingStealthAndSleepUpdates() {
+        UUID id = UUID.randomUUID();
+        var original = new PersistentStealthState(Map.of(), Map.of("future-root", "preserved"));
+        var eye = new EyeProgress(28_800_123, true, Map.of("future-eye", "preserved"));
+        var withEye = original.withEyeProgress(id, eye);
+        assertEquals(eye, withEye.eyeProgress(id));
+        assertEquals(EyeProgress.empty(), original.eyeProgress(id), "Updates must leave old snapshots immutable");
+        var changed = withEye.withPlayer(PlayerStealthState.empty(id).withProgress(123, true))
+            .withSleepCountPolicy(SleepCountPolicy.INCLUDE);
+        assertEquals(eye, changed.eyeProgress(id));
+        assertEquals(123, changed.player(id).accumulatedMillis());
+        assertEquals("preserved", changed.unknownFields().get("future-root"));
+        assertEquals(EyeProgress.empty(), changed.eyeProgress(UUID.randomUUID()));
+    }
+
+    @Test
+    void progressRejectsNegativeTimeAndCopiesUnknownFields() {
+        assertThrows(IllegalArgumentException.class, () -> new EyeProgress(-1, false));
+        var extras = new HashMap<String, Object>();
+        extras.put("extension", "old");
+        var progress = new EyeProgress(1, false, extras);
+        extras.put("extension", "new");
+        assertEquals("old", progress.unknownFields().get("extension"));
+        assertThrows(UnsupportedOperationException.class, () -> progress.unknownFields().put("other", 1));
+    }
+}

src/test/java/games/dmg/spigotstealth/EyeProgressionServiceTest.java

@@ -0,0 +1,90 @@
+package games.dmg.spigotstealth;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+import java.nio.file.Path;
+import java.time.Duration;
+import java.util.List;
+import java.util.Map;
+import java.util.UUID;
+import java.util.concurrent.CopyOnWriteArrayList;
+import java.util.concurrent.atomic.AtomicLong;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+class EyeProgressionServiceTest {
+    @TempDir Path directory;
+    private final UUID id = UUID.randomUUID();
+    private final AtomicLong clock = new AtomicLong();
+    private final List<UUID> notifications = new CopyOnWriteArrayList<>();
+
+    @Test
+    void exactEightHoursUnlocksOnceWithoutOverlapOrLostSubmillisecondCredit() throws Exception {
+        var repository = new YamlStealthStateRepository(directory.resolve("state.yml"));
+        try (var states = new StealthStateManager(repository, repository.load())) {
+            var progression = new EyeProgressionService(states, clock::get, notifications::add);
+            progression.begin(id).join();
+            clock.set(600_000);
+            progression.checkpoint(id).join();
+            clock.set(1_200_000);
+            progression.begin(id).join(); // A refresh, not an overlapping timer.
+            assertEquals(1, states.snapshot().eyeProgress(id).accumulatedMillis());
+            clock.set(Duration.ofHours(8).toNanos() - 1);
+            progression.checkpoint(id).join();
+            assertFalse(progression.isUnlocked(id));
+            clock.incrementAndGet();
+            progression.checkpoint(id).join();
+            assertTrue(progression.isUnlocked(id));
+            assertEquals(List.of(id), notifications);
+            clock.addAndGet(Duration.ofSeconds(3).toNanos());
+            progression.stop(id).join();
+            assertEquals(28_803_000, states.snapshot().eyeProgress(id).accumulatedMillis());
+            assertEquals(List.of(id), notifications);
+            assertTrue(progression.activePlayerIds().isEmpty());
+        }
+    }
+
+    @Test
+    void intervalsAndRestartPreserveProgressWithoutOfflineOrUnobservedCredit() throws Exception {
+        var repository = new YamlStealthStateRepository(directory.resolve("state.yml"));
+        try (var states = new StealthStateManager(repository, repository.load())) {
+            var progression = new EyeProgressionService(states, clock::get, notifications::add);
+            progression.begin(id).join();
+            clock.addAndGet(Duration.ofHours(2).toNanos());
+            progression.stop(id).join();
+            clock.addAndGet(Duration.ofDays(30).toNanos());
+            progression.checkpoint(id).join();
+            assertEquals(Duration.ofHours(2).toMillis(), states.snapshot().eyeProgress(id).accumulatedMillis());
+        }
+        try (var states = new StealthStateManager(repository, repository.load())) {
+            var restarted = new EyeProgressionService(states, clock::get, notifications::add);
+            assertTrue(restarted.activePlayerIds().isEmpty());
+            restarted.begin(id).join();
+            clock.addAndGet(Duration.ofHours(6).toNanos());
+            restarted.stopAll().join();
+            assertTrue(restarted.isUnlocked(id));
+            assertEquals(28_800_000, repository.load().eyeProgress(id).accumulatedMillis());
+            assertTrue(restarted.activePlayerIds().isEmpty());
+        }
+    }
+
+    @Test
+    void missingDisconnectObservationDiscardsUnobservedTailAndExistingUnlocksDoNotRenotify() throws Exception {
+        var repository = new YamlStealthStateRepository(directory.resolve("state.yml"));
+        var existing = new PersistentStealthState(Map.of(), Map.of())
+            .withEyeProgress(id, new EyeProgress(28_800_000, true));
+        try (var states = new StealthStateManager(repository, existing)) {
+            var progression = new EyeProgressionService(states, clock::get, notifications::add);
+            assertTrue(progression.isUnlocked(id));
+            progression.begin(id).join();
+            clock.addAndGet(Duration.ofSeconds(1).toNanos());
+            progression.checkpoint(id).join();
+            clock.addAndGet(Duration.ofHours(1).toNanos());
+            progression.abandon(id);
+            progression.checkpoint(id).join();
+            assertEquals(28_801_000, states.snapshot().eyeProgress(id).accumulatedMillis());
+            assertTrue(progression.activePlayerIds().isEmpty());
+            assertTrue(notifications.isEmpty());
+        }
+    }
+}

src/test/java/games/dmg/spigotstealth/EyeStatePersistenceTest.java

@@ -0,0 +1,103 @@
+package games.dmg.spigotstealth;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Map;
+import java.util.UUID;
+import java.util.concurrent.CompletionException;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicBoolean;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+class EyeStatePersistenceTest {
+    @TempDir Path directory;
+
+    @Test
+    void yamlRoundTripPreservesEyeAndStealthProgressAndUnknownFields() throws Exception {
+        UUID id = UUID.randomUUID();
+        var repository = new YamlStealthStateRepository(directory.resolve("state.yml"));
+        var eye = new EyeProgress(28_800_123, true, Map.of("future-eye", "keep"));
+        var state = new PersistentStealthState(Map.of(id, PlayerStealthState.empty(id).withProgress(456, true)),
+            Map.of("future-root", "keep")).withEyeProgress(id, eye);
+        repository.save(state);
+        var loaded = repository.load();
+        assertEquals(eye, loaded.eyeProgress(id));
+        assertEquals(state.player(id), loaded.player(id));
+        assertEquals(state.unknownFields(), loaded.unknownFields());
+    }
+
+    @Test
+    void legacyFilesStartAtZeroAndMalformedEyeRecordsCannotGrantUnlocksOrEraseStealth() throws Exception {
+        UUID id = UUID.randomUUID();
+        Path file = directory.resolve("state.yml");
+        var repository = new YamlStealthStateRepository(file);
+        var legacy = new PersistentStealthState(Map.of(id, PlayerStealthState.empty(id).withProgress(456, true)), Map.of());
+        repository.save(legacy);
+        assertEquals(EyeProgress.empty(), repository.load().eyeProgress(id));
+        // Deliberately malformed independent section, not a malformed existing player record.
+        Files.writeString(file, Files.readString(file) + "\neye-progress:\n  " + id
+            + ":\n    accumulated-millis: -1\n    unlocked: true\n");
+        var loaded = repository.load();
+        assertEquals(EyeProgress.empty(), loaded.eyeProgress(id));
+        assertEquals(legacy.player(id), loaded.player(id));
+    }
+
+    @Test
+    void pendingWriteDoesNotExposeDurableUnlockAndSavesOffTheCallingThread() throws Exception {
+        UUID id = UUID.randomUUID();
+        var initial = new PersistentStealthState(Map.of(), Map.of());
+        var entered = new CountDownLatch(1);
+        var release = new CountDownLatch(1);
+        Thread caller = Thread.currentThread();
+        var repository = new StealthStateRepository() {
+            @Override public PersistentStealthState load() { return initial; }
+            @Override public void save(PersistentStealthState state) throws IOException {
+                assertNotEquals(caller, Thread.currentThread());
+                entered.countDown();
+                try {
+                    if (!release.await(5, TimeUnit.SECONDS)) { throw new IOException("test write timeout"); }
+                } catch (InterruptedException exception) {
+                    Thread.currentThread().interrupt();
+                    throw new IOException(exception);
+                }
+            }
+        };
+        var manager = new StealthStateManager(repository, initial);
+        try {
+            var saved = manager.update(state -> state.withEyeProgress(id, new EyeProgress(28_800_000, true)));
+            assertTrue(entered.await(5, TimeUnit.SECONDS));
+            assertTrue(manager.snapshot().eyeProgress(id).unlocked());
+            assertFalse(manager.durableSnapshot().eyeProgress(id).unlocked());
+            release.countDown();
+            saved.join();
+            assertTrue(manager.durableSnapshot().eyeProgress(id).unlocked());
+        } finally { release.countDown(); manager.close(); }
+    }
+
+    @Test
+    void failedWriteCannotGrantDurableUnlockAndSuccessfulRetryCan() {
+        UUID id = UUID.randomUUID();
+        var initial = new PersistentStealthState(Map.of(), Map.of());
+        var fail = new AtomicBoolean(true);
+        var repository = new StealthStateRepository() {
+            @Override public PersistentStealthState load() { return initial; }
+            @Override public void save(PersistentStealthState state) throws IOException {
+                if (fail.get()) { throw new IOException("test disk failure"); }
+            }
+        };
+        var manager = new StealthStateManager(repository, initial);
+        try {
+            assertThrows(CompletionException.class, () -> manager.update(state ->
+                state.withEyeProgress(id, new EyeProgress(28_800_000, true))).join());
+            assertFalse(manager.durableSnapshot().eyeProgress(id).unlocked());
+            fail.set(false);
+            manager.save().join();
+            assertTrue(manager.durableSnapshot().eyeProgress(id).unlocked());
+        } finally { fail.set(false); manager.close(); }
+    }
+}

src/test/java/games/dmg/spigotstealth/EyeVisibilityTest.java

@@ -0,0 +1,47 @@
+package games.dmg.spigotstealth;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+import java.util.UUID;
+import org.junit.jupiter.api.Test;
+
+class EyeVisibilityTest {
+    private final UUID world = UUID.randomUUID();
+    private final UUID viewerId = UUID.randomUUID();
+    private final UUID targetId = UUID.randomUUID();
+
+    @Test
+    void personalEligibilityConcealmentVisibilityAndSightMustAllPermitTheReveal() {
+        var position = new EyeVisibility.Position(world, 0, 64, 0);
+        var viewer = new EyeVisibility.Viewer(viewerId, position, true);
+        var target = new EyeVisibility.Target(targetId, position, true, false, false);
+        assertFalse(EyeVisibility.canReveal(new EyeVisibility.Viewer(viewerId, position, false), target, true, true),
+                "an unearned or unequipped observer cannot reveal a target");
+        assertFalse(EyeVisibility.canReveal(viewer, new EyeVisibility.Target(targetId, position, false, false, false), true, true));
+        assertFalse(EyeVisibility.canReveal(viewer, new EyeVisibility.Target(targetId, position, true, true, false), true, true),
+                "the Eye must not bypass spectator hiding");
+        assertFalse(EyeVisibility.canReveal(viewer, new EyeVisibility.Target(targetId, position, true, false, true), true, true),
+                "the Eye must not bypass administrative vanish");
+        assertFalse(EyeVisibility.canReveal(viewer, target, false, true), "platform visibility denial takes precedence");
+        assertFalse(EyeVisibility.canReveal(viewer, target, true, false), "walls must block revelation");
+        assertFalse(EyeVisibility.canReveal(viewer, new EyeVisibility.Target(viewerId, position, true, false, false), true, true));
+        assertFalse(EyeVisibility.canReveal(viewer, new EyeVisibility.Target(targetId,
+                new EyeVisibility.Position(UUID.randomUUID(), 0, 64, 0), true, false, false), true, true));
+        assertFalse(EyeVisibility.canReveal(viewer, new EyeVisibility.Target(targetId,
+                new EyeVisibility.Position(world, Double.NaN, 64, 0), true, false, false), true, true));
+        assertTrue(EyeVisibility.canReveal(viewer, target, true, true));
+    }
+
+    @Test
+    void anEligibleWearerCanRevealAtTheInclusiveThreeDimensionalSixteenBlockBoundary() {
+        var viewer = new EyeVisibility.Viewer(viewerId, new EyeVisibility.Position(world, 0, 64, 0), true);
+        var horizontal = new EyeVisibility.Target(targetId, new EyeVisibility.Position(world, 16, 64, 0), true, false, false);
+        var vertical = new EyeVisibility.Target(targetId, new EyeVisibility.Position(world, 0, 80, 0), true, false, false);
+        assertTrue(EyeVisibility.canReveal(viewer, horizontal, true, true));
+        assertTrue(EyeVisibility.canReveal(viewer, vertical, true, true));
+        var diagonal = new EyeVisibility.Target(targetId, new EyeVisibility.Position(world, 12, 76, 0), true, false, false);
+        var beyond = new EyeVisibility.Target(targetId, new EyeVisibility.Position(world, 16.001, 64, 0), true, false, false);
+        assertFalse(EyeVisibility.canReveal(viewer, diagonal, true, true));
+        assertFalse(EyeVisibility.canReveal(viewer, beyond, true, true));
+    }
+}

src/test/java/games/dmg/spigotstealth/StealthStateShutdownTest.java

@@ -0,0 +1,57 @@
+package games.dmg.spigotstealth;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+import java.io.IOException;
+import java.nio.file.Path;
+import java.util.UUID;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.ExecutionException;
+import java.util.concurrent.TimeUnit;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+class StealthStateShutdownTest {
+    @TempDir Path directory;
+
+    @Test
+    void shutdownReturnsWithoutWaitingForDiskButDrainsTheFinalSnapshotAndRejectsLaterMutations() throws Exception {
+        var disk = new YamlStealthStateRepository(directory.resolve("state.yml"));
+        var saving = new CountDownLatch(1);
+        var release = new CountDownLatch(1);
+        StealthStateRepository repository = new StealthStateRepository() {
+            @Override public PersistentStealthState load() throws IOException { return disk.load(); }
+            @Override public void save(PersistentStealthState state) throws IOException {
+                saving.countDown();
+                try {
+                    if (!release.await(5, TimeUnit.SECONDS)) { throw new IOException("Test disk gate timed out"); }
+                } catch (InterruptedException exception) {
+                    Thread.currentThread().interrupt();
+                    throw new IOException(exception);
+                }
+                disk.save(state);
+            }
+        };
+        var states = new StealthStateManager(repository, repository.load());
+        UUID id = UUID.randomUUID();
+        try {
+            states.update(state -> state.withEyeProgress(id, new EyeProgress(1234, false)));
+            assertTrue(saving.await(3, TimeUnit.SECONDS));
+            // A blocked save must not block the lifecycle caller. The test thread still releases the disk on failure.
+            var closing = CompletableFuture.supplyAsync(states::closeAsync).get(1, TimeUnit.SECONDS);
+            assertFalse(closing.isDone(), "shutdown completion must await the queued durable snapshot");
+            assertSame(closing, states.closeAsync());
+            assertThrows(ExecutionException.class, () -> states.update(state ->
+                    state.withEyeProgress(id, new EyeProgress(28_800_000, true))).get(1, TimeUnit.SECONDS));
+            assertEquals(1234, states.snapshot().eyeProgress(id).accumulatedMillis());
+            release.countDown();
+            closing.get(3, TimeUnit.SECONDS);
+            assertEquals(1234, disk.load().eyeProgress(id).accumulatedMillis());
+            assertEquals(disk.load(), states.durableSnapshot());
+        } finally {
+            release.countDown();
+            states.close();
+        }
+    }
+}