feat(persistence): add durable stealth state

design/log.md

@@ -2,6 +2,8 @@
 
 ## 2026-08-14
 
+- **Completion**: Completed US-005 with validated eight-hour defaults and configurable messages, UUID-keyed immutable state, RFC 3339 timing metadata, safe invalid-record defaults, unknown-field preservation, atomic YAML replacement, periodic saves, and serialized off-thread persistence; verified the full Gradle build.
+- **Implementation**: Began US-005 with test-first validated settings, UUID-keyed state, and defensive asynchronous persistence.
 - **Completion**: Completed US-006 with a Java 17 Gradle build, strict compiler linting, Spigot API, JUnit 5, Mockito, plugin metadata, OKF validation, Gitea CI, conventional-commit checks, semantic releases, and versioned release assets; verified the full build and a `1.2.3` release JAR.
 - **Implementation**: Began US-006 with a test-driven Java 17, Gradle, Spigot, OKF validation, and Gitea delivery foundation modeled on Spigot Tyrant.
 - **Creation**: Established the OKF v0.1 product record for Spigot Stealth.

design/user-stories/us-005-configure-and-persist-progression.md

@@ -2,7 +2,7 @@
 type: User Story
 title: "US-005: Configure and persist stealth progression"
 description: Give operators validated settings and durable, defensive storage for stealth behavior.
-status: backlog
+status: done
 ---
 
 # US-005: Configure and persist stealth progression
@@ -11,18 +11,22 @@ As a **server operator**, I want stealth progression to be configurable and dura
 
 ## Acceptance criteria
 
-- [ ] The qualifying-time threshold is configurable and defaults to eight hours.
-- [ ] Player-facing progress, unlock, prepared-login, and concealed-session messages are configurable.
-- [ ] Startup validates required settings before registering partially functional listeners, commands, or tasks.
-- [ ] Invalid required configuration prevents initialization and produces a clear server log message.
-- [ ] UUID-keyed state stores accumulated qualifying duration, unlock ownership, active qualifying timing data, prepared-login state, and any current concealment metadata needed for safe recovery.
-- [ ] Qualifying runtime intervals use a monotonic elapsed-time source so wall-clock adjustments cannot grant or remove progress.
-- [ ] Durable timestamps, when required, use RFC 3339 UTC notation.
-- [ ] State is saved periodically, after material state changes, and during orderly plugin disable.
-- [ ] State uses atomic replacement where supported so an interrupted write does not replace valid data with a partial file.
-- [ ] Corrupt, unknown, or invalid records cannot silently grant time, an unlock, a prepared login, or concealment.
-- [ ] Unknown forward-compatible fields are preserved where practical.
-- [ ] Persistence work does not perform blocking file operations on the server tick thread.
+- [x] The qualifying-time threshold is configurable and defaults to eight hours.
+- [x] Player-facing progress, unlock, prepared-login, and concealed-session messages are configurable.
+- [x] Startup validates required settings before registering partially functional listeners, commands, or tasks.
+- [x] Invalid required configuration prevents initialization and produces a clear server log message.
+- [x] UUID-keyed state stores accumulated qualifying duration, unlock ownership, active qualifying timing data, prepared-login state, and any current concealment metadata needed for safe recovery.
+- [x] Qualifying runtime intervals use a monotonic elapsed-time source so wall-clock adjustments cannot grant or remove progress.
+- [x] Durable timestamps, when required, use RFC 3339 UTC notation.
+- [x] State is saved periodically, after material state changes, and during orderly plugin disable.
+- [x] State uses atomic replacement where supported so an interrupted write does not replace valid data with a partial file.
+- [x] Corrupt, unknown, or invalid records cannot silently grant time, an unlock, a prepared login, or concealment.
+- [x] Unknown forward-compatible fields are preserved where practical.
+- [x] Persistence work does not perform blocking file operations on the server tick thread.
+
+## Validation
+
+Verified settings defaults and rejection, packaged configuration, safe UUID-state defaults, RFC 3339 round trips, unknown-field preservation, invalid-record rejection, atomic repository writes, and dedicated-thread loading and saving with automated tests and `./gradlew clean check jar`.
 
 ## Related