Safety and limits

Safety and limits

Elah makes narrow claims and tries to prove those claims with evidence.

Observer safety

Observer:

• opens observed inputs read-only;
• rejects symbolic links in the selected world tree;
• checks every report-driving input twice;
• returns no success report if those inputs change;
• limits compressed data, decompressed data, NBT sequences, paths, and advanced details;
• never repairs, rewrites, renames, deletes, or locks the selected world.

What read-only does not mean

Read-only inspection does not make a changing live world into a consistent snapshot. If a server is still saving files, Observer may detect a change and stop. A filesystem snapshot or stopped server is the safer input.

What timestamps mean

Saved timestamps and filesystem modification times are metadata. They can help describe files, but they do not prove that a player was active at a specific time.

Observer does not read player intent, session logs, gameplay events, or audit records.

Supported world boundary

Observer supports offline Minecraft Java Edition Anvil terrain regions in .mca files. It does not support Bedrock worlds or legacy .mcr regions.

Project maturity

The planned distributed runtime has not been released. Current tests do not prove gameplay compatibility, plugin compatibility, seamless handoff, ownership fencing, crash recovery, or multi-machine performance.

The project will only make those claims after dedicated release evidence exists.

Scaling limits

Future elasticity cannot make every Minecraft workload divisible. Spread-out players and generation work are promising because separate cells can do useful work independently. A dense lobby, one large mob farm, one small combat arena, or another tightly connected hotspot may remain limited by one local simulation area.

Total CPU utilization is not enough to prove that more workers would help. Elah must also inspect Folia region pressure, MSPT, TPS, entities, players, chunks, storage, network traffic, and cell boundaries.

Published performance or cost claims must identify hardware, world, settings, plugins, workload, measurements, and failure evidence.

Provider safety

A future Runtime Provider may prepare or stop generic worker capacity, but it cannot grant itself cell ownership. A HOT worker may be stopped or reclaimed only after Elah proves that it owns zero authoritative cells.

An uncertain drain fails closed and keeps the worker allocated. Capacity savings never outrank world ownership safety.