fix(stealth): hide concealed players from server ping

design/log.md

@@ -1,5 +1,9 @@
 # Spigot Stealth Design Log
 
+## 2026-09-05
+
+- **Completion**: Extended US-002 with ProtocolLib filtering of concealed sessions from multiplayer server-list counts and player samples while preserving actual online state and advertised capacity; verified the complete Gradle build and OKF bundle.
+
 ## 2026-09-04
 
 - **Completion**: Extended US-002 so concealed players disconnect without a public quit announcement while ordinary quit messages remain unchanged; verified listener tests, the complete Gradle build, and the OKF bundle.

design/user-stories/us-002-rejoin-without-visible-identity.md

@@ -19,6 +19,10 @@ As an **unlocked player**, I want to disconnect while invisibility from a potion
 - [x] Ordinary players' quit messages remain unchanged.
 - [x] Concealment is checked before disconnect cleanup so announcement suppression is reliable.
 - [x] Throughout the concealed session, the player is absent from every other player's tab list, including administrators' tab lists.
+- [x] The multiplayer server list's online-player count excludes currently concealed players.
+- [x] Concealed players are excluded from any player-name sample shown for the server-list count, while ordinary players remain represented.
+- [x] The public count never becomes negative, and the configured maximum-player count remains unchanged.
+- [x] Server-list concealment changes only the public ping response and does not alter actual online-player state or gameplay.
 - [x] Throughout the concealed session, no overhead name tag identifies the player to any other player, including administrators.
 - [x] The concealed player's physical character remains visible in the world and retains ordinary movement, interaction, combat, and permission behavior.
 - [x] The concealed player receives a private message explaining that stealth is active for the session.
@@ -29,7 +33,7 @@ As an **unlocked player**, I want to disconnect while invisibility from a potion
 
 ## Validation
 
-Automated tests verify unlocked and locked disconnect transitions, ordinary-disconnect clearing, one-login consumption, concealed join and quit announcement suppression, preservation of ordinary announcements, private activation messaging, ordinary-login presentation, tab removal for existing and new observers, overhead-name suppression, and the absence of entity-hiding calls. ProtocolLib is declared as a required dependency, prepared state round trips through YAML, and `./gradlew clean check jar` passes.
+Automated tests verify unlocked and locked disconnect transitions, ordinary-disconnect clearing, one-login consumption, concealed join and quit announcement suppression, preservation of ordinary announcements, private activation messaging, ordinary-login presentation, tab removal for existing and new observers, overhead-name suppression, active concealed-session tracking, public server-list count and sample filtering, nonnegative counts, unchanged maximum capacity, and the absence of entity-hiding calls. ProtocolLib is declared as a required dependency, prepared state round trips through YAML, and `./gradlew clean check jar` passes.
 
 ## Related