Route Naldo brain through OpenCode free models

README.md

@@ -10,328 +10,56 @@ app_file: app.py
 pinned: false
 ---
 
-# Programa — servidor Minecraft + Voyager
-
-## Objetivo Ender Dragon e modelos separados
-
-Os dois runners usam o endpoint público do Space `Erinaldordso/Mine`.
-`GEMINI_BOT_BACKEND=mine` mantém o nome Gemini_Bot e seu checkpoint, mas
-substitui o cliente Gemini CLI pelo mesmo backend CPU do Naldo_Bot. O nome
-do jogador não identifica o provedor da IA. Nenhum modelo é carregado aqui.
-
-`MINECRAFT_GAME_GOAL` acrescenta um objetivo permanente aos prompts de Action
-e Curriculum. A IA continua escolhendo cada tarefa e gerando suas ações.
-O aprendizado e os checkpoints existentes são retomados. Não se chama
-`inference(task=...)`, pois o upstream limpa as listas do currículo nesse método.
-
-O mundo Creative atual é preservado. Avançar nele até o dragão é uma execução
-assistida por Creative, sem tempo de speedrun Survival comprovado.
-
-Cada runner inicia numa sessão de processos própria. Quando o watchdog sai,
-o supervisor encerra também seus filhos antes de reconectar; um Mineflayer
-órfão não pode bloquear as portas 3000/3001. O motor possui seu próprio helper
-de deadline, verificado executando a classe realmente produzida pelo patcher.
-
-O Mineflayer espaça mensagens e comandos em pelo menos 1,1 segundo por conexão.
-A recuperação em Creative mantém os itens existentes e seus dados NBT, repõe
-apenas itens ausentes pelo protocolo de inventário e não usa `/clear` ou `/kill`.
-Uma expulsão encerra imediatamente a requisição pendente; `/start` tem limite de
-120 segundos e `/health` só indica pronto após completar a conexão e o preparo.
-
-Pesquisa de alternativas: AltoClef/MiranCZ tem tarefa de conclusão, porém é um
-mod de cliente e sua versão publicada 1.19.4 difere do servidor 1.19 atual.
-Mindcraft aceita endpoints OpenAI compatíveis e bots sem tela, mas sua
-documentação não comprova uma conclusão rápida com estes modelos locais.
-O projeto rmalde/minecraft-agent relata 8min43s em Java 1.16.5, usando modelos
-pagos e uma seed conhecida com portal ativo; esse resultado não é um benchmark
-deste Space. Não há substituição silenciosa por um desses motores.
-
-Este Space hospeda o **jogo**: servidor Minecraft Java 1.19, ViaProxy, o relay
-para Xbox Friends, o processo Mineflayer e os bots autônomos (Naldo_Bot e
-Gemini_Bot). Ele **não** roda mais inferência de linguagem.
-
-## Onde fica o cérebro
-
-A inferência saiu deste Space. Rodar o modelo aqui disputava CPU e RAM com o
-servidor Java, o ViaProxy, o relay Go e dois bots — e o próprio modelo era o
-maior consumidor dos três (18,56 GB de pesos mais o KV cache). Agora quem serve
-é o Space separado [`Erinaldordso/Mine`](https://huggingface.co/spaces/Erinaldordso/Mine):
-
-- **Cérebro principal** — `qwen3-coder-30b-a3b-instruct` (Qwen3-Coder-30B-A3B,
-  contexto 16384, quantização `UD-Q3_K_XL`), servindo Action, Curriculum e Critic.
-- **Cérebro auxiliar** — `granite-4.0-h-tiny` (contexto 8192), servindo o QA do
-  Curriculum e o Skill Manager. Os dois papéis são curtos e frequentes; um
-  segundo exemplar do modelo grande só somaria latência.
-- **Embeddings** — `Qwen/Qwen3-Embedding-0.6B-GGUF`, alias `text-embedding-ada-002`.
-
-Como os dois Spaces não compartilham rede, a URL do cérebro é a **pública**
-(`https://erinaldordso-mine.hf.space/v1`), nunca loopback.
-
-Os aliases antigos continuam aceitos apenas para compatibilidade de checkpoints
-e clientes: `granite-4.0-h-tiny` resolve para o modelo auxiliar e
-`voyager-qwen3-coder` para o principal.
-
-### Brain lock
-
-`voyager_runner.py` recusa iniciar se a tupla
-`(perfil, base_url, modelo, modelo_auxiliar)` não for exatamente a esperada.
-Sem isso, um deploy poderia apontar silenciosamente para outro provedor. A
-checagem tem escape: definir `VOYAGER_BRAIN_LOCK=off` no Space pula o lock, o
-que permite subir o bot mesmo com o Mine fora do ar.
-
-## Política de exploração do Action Agent
-
-O mundo é um **bolo de camadas** (`WORLD_FLAT_LAYERS` em `minecraft_stack.py`).
-Todo minério é uma **camada horizontal contínua numa altura fixa**, e o bot pisa
-na grama em `y=63`:
-
-| Camada | y | Distância da superfície |
-|---|---|---|
-| `emerald_ore` | 58 | 5 |
-| `lapis_ore` | 57 | 6 |
-| `diamond_ore` | 56 | 7 |
-| `redstone_ore` | 54-55 | 8-9 |
-| `gold_ore` | 52-53 | 10-11 |
-| `iron_ore` | 48-51 | 12-15 |
-| `copper_ore` | 44-47 | 16-19 |
-| `coal_ore` | 40-43 | 20-23 |
-| `deepslate_*_ore` | −57 até −42 | ~100 (repetição no fundo) |
-
-Entre a superfície e o minério mais fundo há **81 camadas de pedra**. Logo um
-minério que o bot enxerga está **sempre logo abaixo dele** — e andar na
-horizontal nunca muda o `y`, então um passeio horizontal é incapaz de alcançar
-uma camada que está de 5 a 23 blocos reto para baixo. As alturas exatas são
-afirmadas no Action prompt e conferidas contra o mundo por
-`tests/test_voyager_mineblock_depth.py`.
-
-Por isso `exploreUntil` tem dois modos, e o modo é escolhido pelo lugar onde o
-alvo realmente está:
-
-| Alvo | Direção | Comportamento |
-|---|---|---|
-| Bloco de superfície (tronco, grama, areia, bioma) | `y = 0` | Caminhada horizontal, como sempre |
-| Minério ou qualquer bloco subterrâneo | `y = -1` ou `"down"` | Escava uma escada na própria coluna, um bloco por vez |
-
-A descida é **controlada**: o bot mina o bloco sob os próprios pés em vez de
-pedir ao pathfinder um destino mais baixo, nunca cai, e para em 32 blocos de
-profundidade. Como ele permanece na própria coluna X/Z, cada camada minerada é
-uma célula por onde consegue voltar — e `allow1by1towers` fica ligado em
-Creative justamente para que ele consiga sair do próprio poço. O próprio
-`mineBlock` também desce até a camada quando ela está fora de alcance, então o
-modelo não precisa orquestrar a descida à mão.
-
-> Nota histórica: uma versão anterior forçava `dy = 0` para toda exploração em
-> Creative, para impedir que o `Vec3(0,-1,0)` do upstream derrubasse o bot de
-> uma beirada. Isso resolvia aquele problema e criava um pior: o Action prompt
-> mandava cavar para baixo e a primitiva reescrevia o pedido em um passeio
-> horizontal, então todo minério subterrâneo falhava. Medido no bot ao vivo:
-> 8 dos últimos 12 fracassos eram minérios subterrâneos (ferro, ouro, lápis,
-> redstone, cobre, diamante, esmeralda, quartzo), enquanto as tarefas que
-> concluíam eram todas alcançáveis na superfície. A guarda contra regressão
-> está em `tests/test_voyager_vertical_exploration.py`.
-
-> Nota histórica 2 — **o piso que se movia**. A primeira tentativa de deixar o
-> `mineBlock` cavar usou `candidate.position.y >= Math.floor(bot.y) - 2`. O
-> problema é que esse piso era medido **a partir do bot**, então descia junto
-> com ele: em `y=63` o filtro era `y >= 61` e recusava o ferro em `y=48`, que
-> estava visível no raio de 32. O bot lançava `use exploreUntil to descend`, o
-> modelo descia um bloco, e o piso descia um bloco junto — a janela recuava na
-> mesma velocidade que o bot. **Por construção o minério era inalcançável.**
-> Sintoma: `completed_count` parado em 145 por horas, 51 restarts do watchdog,
-> `mine.distinct_count = 2` (só `diamond_pickaxe` e `obsidian`, nenhum minério
-> real) e `explore.distinct_count = 2` (só horizontal). A correção troca o piso
-> relativo por um **orçamento de profundidade absoluto** (`MAX_DIG_DEPTH = 28`)
-> e faz a primitiva escavar uma escada até a camada. Guarda em
-> `tests/test_voyager_mineblock_depth.py`, que lê as alturas do próprio
-> `minecraft_stack.py` para que o prompt não possa divergir do mundo.
-
-> Nota histórica 3 — **o boot que nunca terminava**. Depois de corrigir o piso,
-> o `completed_count` continuou parado em 145. A pista decisiva foi o log: ele
-> terminava **exatamente** em `Loading Skill Manager from ...`, sem uma linha
-> depois, com o processo vivo e `restart_count` subindo a cada ~25 min.
->
-> A causa: `SkillManager.__init__` construía `Chroma(...)` **sem deadline
-> nenhum**, com `embedding_function=OpenAIEmbeddings()`. No `langchain==0.0.350`
-> esse cliente é o `openai==0.28.1`, cujo `Embedding.create` **não tem timeout
-> default**. Como a base URL passou a ser o cérebro remoto, uma resposta travada
-> de `/v1/embeddings` bloqueava o construtor para sempre — e como o construtor
-> vem antes de `learn()`, o loop nunca chegava a propor tarefa: **nada falhava,
-> nada retentava, nenhum contador se movia.** O watchdog de estagnação, que
-> dispara a cada 900 s, parecia a causa e era o sintoma.
->
-> O mesmo construtor terminava com um `assert` de sincronia. Um índice uma
-> unidade fora de sincronia é **recuperável** — `skills.json` é a fonte da
-> verdade e já traz código e descrição de cada skill —, mas o `assert`
-> transformava isso num processo morto, exatamente o passo manual que a própria
-> mensagem de erro mandava fazer. Agora o `__init__` reindexa o que falta e
-> remove o que sobra.
->
-> A correção: abertura sob deadline (`VECTORDB_OPEN_SECONDS = 180`) e timeout
-> explícito na função de embedding (`EMBED_DEADLINE_SECONDS = 60`), de modo que
-> uma dependência lenta vire exceção retentável em vez de bloqueio. Guarda em
-> `tests/test_voyager_skillmanager_bounds.py`.
->
-> **Lição de observabilidade:** diagnosticar isso de fora era impossível.
-> `/voyager/status` remove `log_tail` de propósito, e o stream de log da
-> Hugging Face servia uma janela ~35 h atrasada (terminava em
-> `2026-09-29T00:24Z` com o boot atual em `2026-09-30T11:34Z`), então um runner
-> travado e um saudável ficavam indistinguíveis. O `GET /voyager/log` lê o mesmo
-> arquivo do status, sob demanda, com `?lines=` e `?find=`; a guarda está em
-> `tests/test_voyager_log_observability.py`.
-
-> Nota histórica 4 — **o mesmo bug, uma camada acima**. Com o construtor do
-> `SkillManager` liberado, o loop finalmente chegou ao modelo (uma rodada real
-> de `Curriculum Agent Question` / `Answer` aparece no log) e morreu assim no
-> ciclo seguinte:
->
-> ```
-> [voyager] learning loop raised AssertionError: ; keeping the Minecraft
-> connection and retrying in 120s (attempt 4)
-> ```
->
-> A mensagem **vazia** é a assinatura: `AssertionError` sem texto só vem de um
-> `assert` puro. A linha exata estava em `run_qa`:
->
-> ```python
-> if docs_and_scores and docs_and_scores[0][1] < 0.05:
->     question_cached = docs_and_scores[0][0].page_content
->     assert question_cached in self.qa_cache        # <-- sem mensagem
-> ```
->
-> O vetor de `qa_cache` e o `qa_cache.json` divergem assim que um dos dois é
-> reconstruído ou escrito pela metade, e então a busca por similaridade devolve
-> uma pergunta que o JSON não tem mais. O `assert` puro **escapava de `learn()`**
-> — o `try` interno só envolve `rollout()` — e chegava ao runner, que retentava
-> a cada 120 s. Novamente: erro a cada ciclo, nenhum avanço, `completed_count`
-> parado.
->
-> Um acerto de cache que não existe no JSON **não é corrupção**, é um miss:
-> recalcula-se a resposta e segue. Agora o acerto ausente é descartado (com o
-> vetor obsoleto removido) e a busca tem deadline (`QA_LOOKUP_SECONDS = 45`),
-> porque `similarity_search` embeda a pergunta e essa chamada também não tinha
-> limite. `run_qa` não é um método de decisão atestado, então a mudança não
-> toca a atestação; `tests/test_voyager_qacache_selfheal.py` fixa as três
-> propriedades (sem `assert`, miss vira recálculo, busca limitada).
-
-> Nota histórica 5 — **o deadline que não valia nada**. Depois das três
-> correções de `assert`, o runner parou de reiniciar em laço, mas ficou **343 s
-> sem escrever uma linha** depois de `Loading Skill Manager`, com
-> `action_model_messages = 0` e `curriculum_model_messages = 0` — ou seja,
-> `learn()` nunca foi alcançado. O detalhe que denuncia o problema: **já
-> existia um deadline de 180 s** naquele caminho, e mesmo assim pendurou.
->
-> A causa, reproduzida fora do Space:
->
-> ```python
-> with concurrent.futures.ThreadPoolExecutor(max_workers=1) as pool:
->     future = pool.submit(chamada_que_trava)
->     try:
->         return future.result(timeout=180)
->     except concurrent.futures.TimeoutError:
->         raise RuntimeError("deadline hit")
-> ```
->
-> `future.result(timeout=...)` levanta `TimeoutError` no prazo, sim. Mas sair do
-> bloco `with` chama `shutdown(wait=True)`, que faz **join no worker** — a mesma
-> chamada que está travada. O prazo dispara e o join bloqueia logo atrás, para
-> sempre. Saída do experimento real:
->
-> ```
-> [2.0s] TimeoutError raised as expected
-> (nunca imprime "RuntimeError propagated")
-> (nunca imprime "reached end")
-> ```
->
-> O `except` nunca roda, então o erro é indistinguível de um travamento. O
-> deadline era decorativo. Quatro pontos tinham exatamente essa forma:
-> `_open_vectordb`, `_open_qa_vectordb`, a busca do `qa_cache` e `_bounded_step`
-> (que embrulha o `env.step("")` do boot do `learn()` — o mais provável dos
-> quatro, por estar no caminho quente).
->
-> A correção usa thread **daemon** e, no timeout, **abandona** a thread em vez
-> de esperá-la: `worker.join(seconds)`, `if worker.is_alive(): raise`. Uma
-> thread daemon não segura o interpretador vivo, então abandoná-la é seguro.
-> Levantar (em vez de degradar para um índice quebrado) é deliberado — o
-> supervisor do runner reinicia com backoff, então um endpoint de embedding
-> realmente inalcançável vira retentativa em vez de loop meio-funcional.
-> `tests/test_voyager_executor_deadline.py` fixa as propriedades **e roda a
-> prova viva do bug** num subprocesso, para que a regressão não possa voltar
-> silenciosamente.
-
-## Só o servidor de Minecraft
-
-O cérebro mora no Space `Erinaldordso/Mine`. Este Space roda o servidor Java, a
-ponte Mineflayer, o runner do Voyager e o proxy do Gemini — e **nenhum peso de
-modelo**.
-
-Por que: o Qwen principal e o Granite auxiliar eram carregados aqui e ninguém
-os usava. O runner do Voyager define `OPENAI_API_BASE` para o endpoint do Mine,
-então tanto o chat quanto os embeddings dele já saíam deste Space; o único
-consumidor local restante era o embedding do Gemini_Bot. Manter dois GGUF
-residentes por causa disso consumia a RAM que o servidor Java precisa — e uma
-carga local que falhava aparecia como `aux_ready: false` em `/health`, o que se
-lê como "bot quebrado" quando na verdade é "carregador sem uso".
-
-`MINECRAFT_SERVER_ONLY=1` (default) faz cada ponto de entrada que poderia tocar
-um peso falhar com o host correto na mensagem, em vez de iniciar um download de
-18 GB na primeira requisição:
-
-| Superfície | Comportamento |
-|---|---|
-| `_load_model`, `_load_aux_model`, `_load_embed_model` | `RuntimeError` nomeando `BRAIN_BASE_URL`, antes de qualquer `hf_hub_download`/`Llama(` |
-| `_startup` | não cria nenhuma das três threads de preload; servidor, Voyager e Gemini sobem normalmente |
-| `_select_chat_model` | recusa com redirect, em vez de tentar carregar |
-| `POST /v1/embeddings` | recusa **antes** de ler o corpo, para o erro ler como "host errado" e não "requisição inválida" |
-| `GET /health` | `server_only: true`, `local_models: false` e o mapa de papéis para o host real — sem `aux_ready`/`ready` |
-| `GET /status` | idem, mantendo as métricas de RAM/CPU, que continuam verdadeiras |
-| `GET /v1/models` | lista vazia + `brain_base_url`: anunciar um modelo que este Space recusa servir manda o cliente para o host errado com base numa descoberta bem-sucedida |
-
-Os embeddings do Gemini_Bot passam a apontar para o Mine
-(`GEMINI_VOYAGER_EMBED_BASE`). A troca é segura porque **os dois Spaces carregam
-o mesmo `Qwen/Qwen3-Embedding-0.6B-GGUF`** (alias `text-embedding-ada-002`) e os
-dois devolvem vetores de **1024 dimensões**, então nenhum índice Chroma
-existente muda de significado. `EMBED_BASE` é usado só para `/embeddings`, nunca
-para chat — a guarda em `tests/test_voyager_server_only.py` verifica isso, além
-de cada recusa e cada default que apontava para `127.0.0.1:7860`.
-
-## Defesas contra o congelamento silencioso
-
-Depois da correção acima o bot passou a se mover, mas apareceu uma falha de
-outra natureza, sem nenhum sinal de erro: **o processo continuava vivo
-(`running=true`, `restart_count=0`), todos os contadores de erro em zero, e
-nenhuma chamada ao modelo em 45 minutos.** Não era lentidão nem falha — era um
-**bloqueio**. Um loop que falha deixa contadores; um bloqueio não deixa nada.
-
-A causa estava no caminho de recuperação: o upstream espera processos e responde
-a HTTP sem limite de tempo, e uma dependência travada transforma a própria
-recuperação na trava.
-
-| Onde | Antes | Agora |
-|---|---|---|
-| `SubprocessMonitor.stop()` | `self.process.wait()` sem limite — um node travado ignora SIGTERM e o wait nunca volta | `wait(timeout=10)`, depois `kill()` |
-| `SubprocessMonitor.run()` | `self.ready_event.wait()` sem limite — se o node nunca imprime a linha de ready, trava para sempre | `wait(timeout=60)`, então erro explícito |
-| `env.step("")` no início de `learn()`/`inference()` | sem limite | `_bounded_step("", timeout=120)` |
-| Recuperação de exceção no `voyager.py` | `env.step("")` sem limite no lugar do reset duro | mesmo helper, com `timeout=60`, caindo no reset duro |
-| Loop `learn()` do runner | retry infinito (`MAX_ATTEMPTS=0`); um bloqueio nunca é detectado | watchdog de estagnação: sem tarefa concluída em 15 min, o runner sai para o supervisor reiniciar |
-
-O `bridge.reset()` chama `mineflayer.stop()`, e o `learn()` começa por um
-`env.reset()` — ou seja, **a recuperação era exatamente o ponto de travamento**.
-O watchdog lê o progresso dos arquivos de checkpoint (não de uma linha de log,
-que pode não existir) e só arma depois da primeira tarefa concluída, então um
-boot frio nunca é interrompido. O limite é ajustável por
-`VOYAGER_STALL_SECONDS`.
-
-O watchdog observa **três** arquivos — `completed_tasks.json`,
-`failed_tasks.json` e `skill/skills.json` —, os mesmos que
-`voyager_learning._signature()` já usava para definir progresso. Vigiar só as
-tarefas concluídas o deixava cego para um bot que trabalha e falha: ele
-reciclava um runner no meio de uma tentativa. **Uma falha também é progresso**
-— o bot agiu e o Critic julgou —, então ela reinicia o relógio. Só um loop que
-não faz *nada* pela janela inteira é estagnação.
-
-A guarda contra regressão está em `tests/test_voyager_stall_contract.py`, que
-clona o upstream pinado, aplica o patcher e verifica o **código gerado** — não o
-texto do patch, que poderia virar um no-op silencioso.
+# Programa — endpoint CPU para Voyager
+
+Endpoint OpenAI-compatible dedicado ao projeto original MineDojo/Voyager.
+
+## Endpoint local de compatibilidade (Granite)
+
+O endpoint OpenAI-compatible público continua disponível para clientes antigos e
+para os componentes locais auxiliares. Ele não é mais o cérebro generativo do
+`Naldo_Bot`; o Naldo usa OpenCode conforme a seção seguinte.
+
+- GGUF oficial: `ibm-granite/granite-4.0-h-tiny-GGUF`
+- Arquivo: `granite-4.0-h-tiny-Q4_K_M.gguf`
+- Revisão fixada: `08d5a8a9741dd5c1a95d2d39e25253226aa1464e`
+- Quantização: `Q4_K_M`
+- Arquitetura: Granite 4.0 H-Tiny MoE/Mamba2, 7B totais e ~1B parâmetros ativos
+- Contexto operacional do Voyager: 8.192 tokens
+- Saída padrão: 384 tokens
+- Saída máxima: 512 tokens
+- Alias principal: `granite-4.0-h-tiny`
+- CPU: 16 threads de decode e 16 threads de prefill/batch
+
+Os aliases antigos permanecem aceitos apenas para compatibilidade de clientes e
+continuam roteando para o Granite local. O Voyager do Naldo não usa esses aliases
+para geração.
+
+## Cérebro do Naldo_Bot: OpenCode
+
+Action, Curriculum, Critic e Skill Manager do `Naldo_Bot` usam uma ponte
+OpenAI-compatible local em `127.0.0.1:7864`, que traduz as chamadas do Voyager
+para um servidor `opencode serve` preso ao loopback em `127.0.0.1:7865`.
+
+- OpenCode pinado: `opencode-ai@1.18.33`, instalado localmente no runtime sem `npm -g`.
+- Provider: `opencode`.
+- Modelo principal: `muse-spark-1.3-contributor-free`.
+- Fallbacks: `fledge-alpha-free` e `nemotron-3-ultra-free`, somente do provider OpenCode gratuito.
+- Nenhuma credencial do usuário é copiada; o processo recebe HOME/XDG próprios no runtime.
+- As mensagens de inferência enviam `tools: {}`. No OpenCode 1.18.33 isso foi validado
+  sem execução de bash/arquivos; permissões customizadas de sessão não são usadas porque
+  o Zen gratuito as rejeita com `FreeTierError`.
+- O bridge não inventa suporte a `temperature`/`max_tokens`: registra os valores pedidos
+  e preserva a resposta integral, evitando cortar JavaScript do Action Agent.
+- Embeddings continuam locais em `127.0.0.1:7860/v1/embeddings`.
+- Se OpenCode ou bridge morrerem, o supervisor interrompe o Naldo e recupera o cérebro
+  antes de religar o bot; não existe fallback generativo para Granite ou Gemini.
+
+O Curriculum em Creative continua usando o estado real e os checkpoints persistentes.
+A conclusão da tarefa continua exigindo verificação independente do mundo.
+
+Referência do modelo:
+https://huggingface.co/ibm-granite/granite-4.0-h-tiny-GGUF
 
 ## Embeddings
 
@@ -393,12 +121,11 @@ O endpoint mantém a compatibilidade HTTP de chat e embeddings para os clientes.
 ## Segundo jogador: Gemini_Bot
 
 `Gemini_Bot` executa uma segunda instância completa do Voyager no mesmo servidor
-Java 1.19, com processo Mineflayer e checkpoint próprios. O backend padrão
-atual é `GEMINI_BOT_BACKEND=mine`: ambos consultam Qwen para Action, Curriculum
-e Critic, Granite para QA e descrição de skills, e o embedding do Space Mine.
-`GEMINI_BOT_BACKEND=gemini` mantém disponível o proxy do Gemini CLI com as
-chaves privadas já configuradas. Ambos validam tarefas Creative pela mudança
-real no mundo ou pelo inventário.
+Java 1.19, com processo Mineflayer e checkpoint próprios. Curriculum, Action,
+Critic e Skill Manager consultam o Gemini CLI por um proxy local exclusivo;
+somente os embeddings usam o modelo local. `Naldo_Bot` usa exclusivamente o
+bridge OpenCode descrito acima para geração. Ambos validam tarefas Creative pela
+mudança real no mundo ou pelo inventário.
 
 O Curriculum permanece no modo automático do Voyager: cada IA observa o estado
 atual, consulta seu checkpoint e decide o próximo objetivo. Não existe sequência
@@ -438,14 +165,18 @@ blocos, não teleporta e não altera a exploração horizontal do Curriculum.
 - Controle de inicialização: `GEMINI_BOT_AUTOSTART=0` desativa somente o
   segundo bot. O Naldo_Bot e o mundo persistente seguem independentes.
 
-Base URL:
+API pública de compatibilidade:
 
 `https://erinaldordso-minecraft-friends-ai-zerogpu.hf.space/v1`
 
-Modelo de chat:
+Modelo de chat público (não é o cérebro do Naldo):
 
 `granite-4.0-h-tiny`
 
+Cérebro interno do Naldo:
+
+`opencode/muse-spark-1.3-contributor-free` via `127.0.0.1:7864/v1`
+
 Modelo de embeddings:
 
 `text-embedding-ada-002`
@@ -545,44 +276,3 @@ Validação offline, sem iniciar modelos ou servidor de jogo:
 O contrato do runtime (decisões upstream, adaptação declarada do retry do
 curriculum e patch aplicado sobre a árvore oficial) é verificado por
 `tests/test_voyager_official_contract.py` e `tests/test_voyager_patch_application.py`.
-
-## Terceiro bot: AltoClef com OpenCode
-
-`OpenCode_Bot` usa **AltoClef 0.19 / Baritone**, do fork
-[MiranCZ/altoclef](https://github.com/MiranCZ/altoclef). O motor tem tarefas reais
-para encontrar o stronghold, abrir o portal, enfrentar o dragão e entrar no portal
-de retorno. É uma alternativa ao Voyager focada em concluir o jogo; não depende
-de gerar JavaScript para cada movimento. Os dois jogadores Voyager existentes
-mantêm seus checkpoints.
-
-O cliente Fabric **1.19.4** conecta ao servidor **1.19** pelo ViaProxy já existente
-em `127.0.0.1:25568`. Não há alteração da versão do mundo. Xvfb e Mesa llvmpipe
-renderizam o cliente em CPU, a 20 FPS, com heap de 2 GiB e dois processadores
-ativos. Os pesos de IA continuam exclusivamente no Space Mine.
-
-OpenCode **1.18.34** recebe observações reais para supervisionar o progresso.
-O provedor ativo é o endpoint Mine do usuário, sem API key, temperatura 0 e
-contexto compatível com Qwen (16K) e Granite (8K). Os modelos gratuitos do
-catálogo OpenCode apareceram na consulta, mas uma chamada genérica a
-`opencode/big-pickle` retornou HTTP 403. Eles não são o cérebro padrão e nenhuma
-disponibilidade contínua é presumida. Uma indisponibilidade do modelo não
-interrompe as tarefas determinísticas do AltoClef.
-
-O mundo atual continua **Creative / Peaceful**. O equipamento inicial ausente
-é fornecido somente ao novo jogador, sem limpar inventários. Isso é uma
-conclusão assistida em Creative, não um speedrun de Survival. Não são usados
-comandos para matar o dragão, construir um portal artificial ou teleportar o bot.
-`goal_completed` exige que o cliente tenha entrado no End e observado os créditos.
-
-Estado e logs: `/opencode-bot/status`, `/opencode-bot/log`. Dados persistentes:
-`/persist/minecraft-friends/altoclef/`; cliente, configuração e observações
-sobrevivem a reinícios. `ALTOCLEF_AUTOSTART=0` desativa o início automático.
-Falhas de inicialização têm backoff de 30 a 480 segundos. O adaptador Java
-usa as classes e os métodos conferidos no JAR AltoClef e nas mappings Yarn
-1.19.4. Para recompilá-lo com Java 17: `python altoclef/build.py`.
-
-Revisão: Phoenix foi descartado porque seu pipeline `DefeatEnderDragon` usa
-`UnsupportedEndgameTask` e lança `NOT_IMPLEMENTED`. O AltoClef tem implementação
-de portal e combate; sua conclusão ainda precisa ser observada neste mundo.
-O toolkit dos Voyager inclui 64 cobblestones para a navegação subir torres quando
-os jogadores estão abaixo da superfície; em Creative, minerar não gera drops.

gemini_bot_stack.py

@@ -12,10 +12,9 @@ import urllib.request
 from pathlib import Path
 from typing import Any
 
-from voyager_stack import ROOT as VOYAGER_ROOT, SRC as VOYAGER_SRC, CKPT_DIR as NALDO_CKPT_DIR, VOYAGER, _wait_tcp
-from voyager_runtime_contract import UPSTREAM_COMMIT, read_attestation, read_exit_report
+from voyager_stack import ROOT as VOYAGER_ROOT, SRC as VOYAGER_SRC, CKPT_DIR as NALDO_CKPT_DIR, VOYAGER, _wait_tcp, restart_backoff_after, tail_lines
+from voyager_runtime_contract import UPSTREAM_COMMIT, read_attestation
 from voyager_learning import read_learning_state
-from voyager_processes import stop_runner
 
 ROOT = Path(os.environ.get("GEMINI_BOT_RUNTIME_HOME", "/tmp/gemini-bot-runtime"))
 PERSIST_ROOT = Path(os.environ.get("MINECRAFT_PERSIST_HOME", "/persist/minecraft-friends"))
@@ -39,7 +38,14 @@ def _node_version() -> int:
 
 
 def _terminate(proc: subprocess.Popen[str] | None, timeout: int = 15) -> None:
-    stop_runner(proc, timeout=timeout)
+    if not proc or proc.poll() is not None:
+        return
+    proc.terminate()
+    try:
+        proc.wait(timeout=timeout)
+    except subprocess.TimeoutExpired:
+        proc.kill()
+        proc.wait(timeout=5)
 
 
 def _read_json(path: Path) -> list[str]:
@@ -52,7 +58,6 @@ def _read_json(path: Path) -> list[str]:
 
 class GeminiBotStack:
     def __init__(self) -> None:
-        self.remote_mine = os.environ.get("GEMINI_BOT_BACKEND", "mine") == "mine"
         self.lock = threading.RLock()
         self.worker: threading.Thread | None = None
         self.proc: subprocess.Popen[str] | None = None
@@ -157,39 +162,10 @@ class GeminiBotStack:
             "GEMINI_BOT_SYSTEM_MD": str(workspace / ".gemini" / "system.md"),
             "GEMINI_VOYAGER_MODEL": MODEL,
             "GEMINI_VOYAGER_PROXY_PORT": str(PROXY_PORT),
-            # Embeddings live in the Mine Space alongside the rest of the brain.
-            # This Space no longer loads a local embedding model (see the
-            # SERVER_ONLY note in app.py), so the old default of
-            # http://127.0.0.1:7860/v1 would now answer 503. Mine serves the
-            # same Qwen3-Embedding-0.6B alias and the same 1024-dim vectors, so
-            # switching hosts cannot change any stored vector.
-            "GEMINI_VOYAGER_EMBED_BASE": os.environ.get(
-                "VOYAGER_BRAIN_BASE_URL", "https://erinaldordso-mine.hf.space/v1"
-            ),
+            "GEMINI_VOYAGER_EMBED_BASE": "http://127.0.0.1:7860/v1",
         })
         return env
 
-    def _mine_env(self) -> dict[str, str]:
-        """No Gemini CLI or model weights are needed by the second runner."""
-        ROOT.mkdir(parents=True, exist_ok=True)
-        CKPT_DIR.mkdir(parents=True, exist_ok=True)
-        node_modules = VOYAGER_SRC / "voyager" / "env" / "mineflayer" / "node_modules"
-        marker = VOYAGER_ROOT / ".node-ready"
-        deadline = time.monotonic() + 900
-        while not self.stop_event.is_set() and (
-            not marker.exists() or not (node_modules / "mineflayer").exists()
-        ):
-            if time.monotonic() > deadline:
-                raise RuntimeError("Voyager Mineflayer dependencies did not become ready")
-            self.stop_event.wait(2)
-        if self.stop_event.is_set():
-            raise RuntimeError("stopped")
-        env = os.environ.copy()
-        for name in (*KEY_NAMES, "GEMINI_API_KEY", "GOOGLE_API_KEY"):
-            env.pop(name, None)
-        env["NODE_PATH"] = str(node_modules)
-        return env
-
     def _start_proxy(self, env: dict[str, str]) -> None:
         entrypoint = Path(__file__).resolve().parent / "gemini_voyager_proxy.py"
         PROXY_LOG_PATH.write_text("", encoding="utf-8")
@@ -201,7 +177,6 @@ class GeminiBotStack:
             stderr=subprocess.STDOUT,
             text=True,
             bufsize=1,
-            start_new_session=(os.name == "posix"),
         )
         threading.Thread(
             target=self._pump,
@@ -240,15 +215,6 @@ class GeminiBotStack:
             "ANONYMIZED_TELEMETRY": "False",
             "PYTHONPATH": str(VOYAGER_SRC),
         })
-        if self.remote_mine:
-            from voyager_stack import BRAIN_BASE_URL, BRAIN_MODEL, BRAIN_AUX_MODEL
-            voyager_env.update({
-                "VOYAGER_OPENAI_BASE": BRAIN_BASE_URL,
-                "VOYAGER_BRAIN_PROFILE": "gemini-mine-qwen3-coder",
-                "VOYAGER_API_KEY": os.environ.get("VOYAGER_API_KEY", "local-voyager"),
-                "VOYAGER_MODEL": BRAIN_MODEL,
-                "VOYAGER_AUX_MODEL": BRAIN_AUX_MODEL,
-            })
         LOG_PATH.write_text("", encoding="utf-8")
         self.proc = subprocess.Popen(
             [sys.executable, "-u", str(runner)],
@@ -258,7 +224,6 @@ class GeminiBotStack:
             stderr=subprocess.STDOUT,
             text=True,
             bufsize=1,
-            start_new_session=(os.name == "posix"),
         )
         threading.Thread(
             target=self._pump,
@@ -288,7 +253,7 @@ class GeminiBotStack:
             if not ready_file.exists():
                 raise RuntimeError("Minecraft world did not finish loading")
 
-            if not self.remote_mine and not any(os.environ.get(name) for name in KEY_NAMES):
+            if not any(os.environ.get(name) for name in KEY_NAMES):
                 with self.lock:
                     self.state = "waiting-credentials"
                     self.error = "Set GEMINI_BOT_KEY_1 as a Space secret"
@@ -296,19 +261,16 @@ class GeminiBotStack:
 
             with self.lock:
                 self.state = "preparing"
-            if self.remote_mine:
-                env = self._mine_env()
-            else:
-                cli, workspace = self._prepare()
-                env = self._child_env(cli, workspace)
+            cli, workspace = self._prepare()
+            env = self._child_env(cli, workspace)
             backoff = 5
 
             while not self.stop_event.is_set():
-                if not self.remote_mine:
-                    self._start_proxy(env)
+                run_started = time.monotonic()
+                self._start_proxy(env)
                 self._start_voyager(env)
                 time.sleep(3)
-                if self.proc.poll() is None and (self.remote_mine or self.proxy_proc.poll() is None):
+                if self.proc.poll() is None and self.proxy_proc.poll() is None:
                     with self.lock:
                         self.state = "running"
                         self.error = ""
@@ -316,7 +278,7 @@ class GeminiBotStack:
                 while (
                     not self.stop_event.is_set()
                     and self.proc.poll() is None
-                    and (self.remote_mine or self.proxy_proc.poll() is None)
+                    and self.proxy_proc.poll() is None
                 ):
                     self.stop_event.wait(1)
 
@@ -325,8 +287,8 @@ class GeminiBotStack:
 
                 runner_rc = self.proc.returncode if self.proc else None
                 proxy_rc = self.proxy_proc.returncode if self.proxy_proc else None
-                stop_runner(self.proc)
-                stop_runner(self.proxy_proc)
+                _terminate(self.proc)
+                _terminate(self.proxy_proc)
                 self.restart_count += 1
                 with self.lock:
                     self.state = "restarting"
@@ -336,15 +298,15 @@ class GeminiBotStack:
                     )
                 if self.stop_event.wait(backoff):
                     break
-                backoff = min(backoff * 2, 120)
+                backoff = restart_backoff_after(backoff, time.monotonic() - run_started)
 
-            stop_runner(self.proc)
-            stop_runner(self.proxy_proc)
+            _terminate(self.proc)
+            _terminate(self.proxy_proc)
             with self.lock:
                 self.state = "stopped"
         except Exception as exc:
-            stop_runner(self.proc)
-            stop_runner(self.proxy_proc)
+            _terminate(self.proc)
+            _terminate(self.proxy_proc)
             with self.lock:
                 self.state = "error"
                 self.error = str(exc)[:200]
@@ -385,8 +347,6 @@ class GeminiBotStack:
             return {"ready": False}
 
     def _proxy_status(self) -> dict[str, Any]:
-        if self.remote_mine:
-            return {"enabled": False, "reason": "all model roles use the Mine Space"}
         try:
             with urllib.request.urlopen(
                 f"http://127.0.0.1:{PROXY_PORT}/health", timeout=1.5
@@ -399,10 +359,7 @@ class GeminiBotStack:
     def status(self) -> dict[str, Any]:
         completed = _read_json(CKPT_DIR / "curriculum" / "completed_tasks.json")
         failed = _read_json(CKPT_DIR / "curriculum" / "failed_tasks.json")
-        try:
-            lines = LOG_PATH.read_text(encoding="utf-8", errors="replace").splitlines()
-        except OSError:
-            lines = []
+        lines = tail_lines(LOG_PATH)
         mineflayer = self._mineflayer_status()
         learning = read_learning_state(CKPT_DIR)
         proxy = self._proxy_status()
@@ -418,24 +375,20 @@ class GeminiBotStack:
             return {
                 "state": self.state,
                 "error": self.error or None,
-                "running": runner_running and (self.remote_mine or proxy_running),
+                "running": runner_running and proxy_running,
                 "pid": proc.pid if runner_running else None,
                 "proxy_pid": proxy_proc.pid if proxy_running else None,
                 "restart_count": self.restart_count,
-                "last_exit": read_exit_report(VOYAGER_ROOT, "Gemini_Bot"),
                 "started_at": self.started_at,
                 "architecture": "Voyager",
                 "same_voyager_runtime_as_naldo": bool(engine and naldo_engine and engine.get("source_root") == naldo_engine.get("source_root") == str(VOYAGER_SRC.resolve()) and engine.get("upstream_commit") == naldo_engine.get("upstream_commit") == UPSTREAM_COMMIT),
                 "engine_runtime": engine,
                 "bot_username": "Gemini_Bot",
-                "goal": os.environ.get("MINECRAFT_GAME_GOAL") or None,
-                "model": os.environ.get("VOYAGER_BRAIN_MODEL", "qwen3-coder-30b-a3b-instruct") if self.remote_mine else MODEL,
-                "aux_model": os.environ.get("VOYAGER_BRAIN_AUX_MODEL", "granite-4.0-h-tiny") if self.remote_mine else MODEL,
-                "openai_base": os.environ.get("VOYAGER_BRAIN_BASE_URL", "https://erinaldordso-mine.hf.space/v1") if self.remote_mine else f"http://127.0.0.1:{PROXY_PORT}/v1",
-                "decision_brain": "remote-mine-space" if self.remote_mine else "gemini-cli-only",
-                "brain_profile": "gemini-mine-qwen3-coder" if self.remote_mine else "gemini-cli",
-                "embedding_backend": "remote-mine-space",
-                "cli_version": None if self.remote_mine else CLI_VERSION,
+                "model": MODEL,
+                "decision_brain": "gemini-cli-only",
+                "brain_profile": "gemini-cli",
+                "embedding_backend": "local-embeddings-only",
+                "cli_version": CLI_VERSION,
                 "configured_key_count": sum(
                     bool(os.environ.get(name)) for name in KEY_NAMES
                 ),

minecraft_stack.py

@@ -1,221 +1,226 @@
-from __future__ import annotations
-
+from __future__ import annotations
+
 import hashlib
 import uuid
 import json
 import datetime
-import os
-import re
-import shutil
-import socket
-import subprocess
-import tarfile
-import threading
-import tempfile
-import time
-import urllib.request
-from pathlib import Path
-from typing import Any
-
+import os
+import re
+import shutil
+import socket
+import subprocess
+import tarfile
+import threading
+import tempfile
+import time
+import urllib.request
+from pathlib import Path
+from typing import Any
+
 import yaml
-
-BASE = Path(os.environ.get("MINECRAFT_HOME", "/tmp/minecraft-stack"))
-PERSIST_ROOT = Path(os.environ.get("MINECRAFT_PERSIST_HOME", "/persist/minecraft-friends"))
-JAVA_DIR = BASE / "java"
-VIA_DIR = BASE / "viaproxy"
-# Microsoft/Xbox OAuth cache must survive Space rebuilds/restarts. The HF Bucket
-# mounted at /persist is private and read-write; nether2rak refreshes token.json
-# in-place, so using this directory preserves both initial login and token rotation.
-RELAY_DIR = PERSIST_ROOT / "relay"
-WORLD_DIR = PERSIST_ROOT / "world-20260929-features-y64-v1"
-# Generator settings are only read when the world is created, so replacing the map
-# means pointing at a new directory. The previous world is kept so the human
-# player's Bedrock session can be carried over instead of being reset.
-PREVIOUS_WORLD_DIR = PERSIST_ROOT / "world-20260928-ores-y64-v1"
-WORLD_PROFILE = "minecraft:flat"
-WORLD_SURFACE_Y = 64
-# Resource-rich farming map, bottom to top. Two constraints fix this shape:
-# 1.18+ superflat stacks the layers upward from the -64 world floor, and Voyager's
-# placement, navigation and prompts are all pinned to a walkable surface at Y=64,
-# so the heights below must total exactly WORLD_FLOOR + WORLD_SURFACE_Y.
-# Every ore is duplicated: a shallow band 6-24 blocks under the topsoil that a
-# mining bot reaches from the surface, and a deepslate band at the bottom of the
-# column. Plains with no lakes and no features keeps the surface predictable for
-# the pathfinder and for players building on it.
-WORLD_FLAT_LAYERS = (
-    ("minecraft:bedrock", 1),
-    ("minecraft:deepslate", 6),
-    ("minecraft:deepslate_coal_ore", 3),
-    ("minecraft:deepslate_copper_ore", 3),
-    ("minecraft:deepslate_iron_ore", 3),
-    ("minecraft:deepslate_gold_ore", 2),
-    ("minecraft:deepslate_redstone_ore", 2),
-    ("minecraft:deepslate_diamond_ore", 1),
-    ("minecraft:deepslate_lapis_ore", 1),
-    ("minecraft:deepslate_emerald_ore", 1),
-    ("minecraft:stone", 81),
-    ("minecraft:coal_ore", 4),
-    ("minecraft:copper_ore", 4),
-    ("minecraft:iron_ore", 4),
-    ("minecraft:gold_ore", 2),
-    ("minecraft:redstone_ore", 2),
-    ("minecraft:diamond_ore", 1),
-    ("minecraft:lapis_ore", 1),
-    ("minecraft:emerald_ore", 1),
-    ("minecraft:gravel", 1),
-    ("minecraft:dirt", 3),
-    ("minecraft:grass_block", 1),
-)
-WORLD_FLOOR_Y = -64
-if sum(height for _, height in WORLD_FLAT_LAYERS) != WORLD_SURFACE_Y - WORLD_FLOOR_Y:
-    raise RuntimeError(
-        "World layers must total the distance from the world floor to WORLD_SURFACE_Y"
-    )
-FLAT_GENERATOR_SETTINGS = json.dumps(
-    {
-        "biome": "minecraft:plains",
-        "layers": [{"block": block, "height": height} for block, height in WORLD_FLAT_LAYERS],
-        # Per minecraft.wiki/w/Superflat/Settings (Java 1.19+):
-        #   features            - "whether or not to generate biome-specific placed
-        #                         features". Without it a plains superflat has no
-        #                         trees, grass or flowers, so the official curriculum
-        #                         asks for wood it can never obtain.
-        #   lakes               - only controls lava lakes, so it stays off.
-        #   structure_overrides - omitted on purpose: the documented default is
-        #                         "all the structure sets". An empty list, which is
-        #                         what this used to pass, disables every structure.
-        "lakes": False,
-        "features": True,
-    },
-    separators=(",", ":"),
+
+BASE = Path(os.environ.get("MINECRAFT_HOME", "/tmp/minecraft-stack"))
+PERSIST_ROOT = Path(os.environ.get("MINECRAFT_PERSIST_HOME", "/persist/minecraft-friends"))
+JAVA_DIR = BASE / "java"
+VIA_DIR = BASE / "viaproxy"
+# Microsoft/Xbox OAuth cache must survive Space rebuilds/restarts. The HF Bucket
+# mounted at /persist is private and read-write; nether2rak refreshes token.json
+# in-place, so using this directory preserves both initial login and token rotation.
+RELAY_DIR = PERSIST_ROOT / "relay"
+WORLD_DIR = PERSIST_ROOT / "world-20260928-ores-y64-v1"
+# Generator settings are only read when the world is created, so replacing the map
+# means pointing at a new directory. The previous world is kept so the human
+# player's Bedrock session can be carried over instead of being reset.
+PREVIOUS_WORLD_DIR = PERSIST_ROOT / "world-20260927-flat-y64-v1"
+WORLD_PROFILE = "minecraft:flat"
+WORLD_SURFACE_Y = 64
+# Resource-rich farming map, bottom to top. Two constraints fix this shape:
+# 1.18+ superflat stacks the layers upward from the -64 world floor, and Voyager's
+# placement, navigation and prompts are all pinned to a walkable surface at Y=64,
+# so the heights below must total exactly WORLD_FLOOR + WORLD_SURFACE_Y.
+# Every ore is duplicated: a shallow band 6-24 blocks under the topsoil that a
+# mining bot reaches from the surface, and a deepslate band at the bottom of the
+# column. Plains with no lakes and no features keeps the surface predictable for
+# the pathfinder and for players building on it.
+WORLD_FLAT_LAYERS = (
+    ("minecraft:bedrock", 1),
+    ("minecraft:deepslate", 6),
+    ("minecraft:deepslate_coal_ore", 3),
+    ("minecraft:deepslate_copper_ore", 3),
+    ("minecraft:deepslate_iron_ore", 3),
+    ("minecraft:deepslate_gold_ore", 2),
+    ("minecraft:deepslate_redstone_ore", 2),
+    ("minecraft:deepslate_diamond_ore", 1),
+    ("minecraft:deepslate_lapis_ore", 1),
+    ("minecraft:deepslate_emerald_ore", 1),
+    ("minecraft:stone", 81),
+    ("minecraft:coal_ore", 4),
+    ("minecraft:copper_ore", 4),
+    ("minecraft:iron_ore", 4),
+    ("minecraft:gold_ore", 2),
+    ("minecraft:redstone_ore", 2),
+    ("minecraft:diamond_ore", 1),
+    ("minecraft:lapis_ore", 1),
+    ("minecraft:emerald_ore", 1),
+    ("minecraft:gravel", 1),
+    ("minecraft:dirt", 3),
+    ("minecraft:grass_block", 1),
+)
+WORLD_FLOOR_Y = -64
+if sum(height for _, height in WORLD_FLAT_LAYERS) != WORLD_SURFACE_Y - WORLD_FLOOR_Y:
+    raise RuntimeError(
+        "World layers must total the distance from the world floor to WORLD_SURFACE_Y"
+    )
+FLAT_GENERATOR_SETTINGS = json.dumps(
+    {
+        "biome": "minecraft:plains",
+        "layers": [{"block": block, "height": height} for block, height in WORLD_FLAT_LAYERS],
+        "lakes": False,
+        "features": False,
+        "structure_overrides": [],
+    },
+    separators=(",", ":"),
 )
 BOT_USERNAME = os.environ.get("MC_USERNAME", "Naldo_Bot")
 ADMIN_USERNAME = "IffyBinkie6134"
 MAX_PLAYERS = 100
-TOOLS_DIR = BASE / "tools"
-BIN_DIR = BASE / "bin"
-LOG_PATH = BASE / "stack.log"
-READY_FILE = BASE / "minecraft.ready"
-
-FABRIC_INSTALLER_URL = "https://maven.fabricmc.net/net/fabricmc/fabric-installer/0.11.2/fabric-installer-0.11.2.jar"
-FABRIC_MC_VERSION = "1.19"
-FABRIC_LOADER_VERSION = "0.14.18"
-
-# Official Voyager Fabric 1.19 server-side mod stack.
-FABRIC_API_URL = "https://cdn.modrinth.com/data/P7dR8mSH/versions/0.58.0%2B1.19/fabric-api-0.58.0%2B1.19.jar"
-FABRIC_API_SHA256 = "0a3d2dba1ed45b002483ae7c08e2c0bcfcb8d2b166801a6c29d8ea64dba64370"
-COMPLETE_CONFIG_URL = "https://cdn.modrinth.com/data/GtqG8z1h/versions/2.0.0/completeconfig-2.0.0.jar"
-COMPLETE_CONFIG_SHA256 = "d34a3e167bf7942348d3f8c650fcefead6284878b39277ba43282ef69fa2d566"
-SERVER_PAUSE_URL = "https://mediafilez.forgecdn.net/files/3822/586/Multiplayer-Server-Pause-1.19-Fabric-1.1.0.jar"
-
-# Not part of the official Voyager mod set. Measured need: the Bedrock player
-# received ~100 "moved too quickly" corrections in under a minute, with a single
-# delta of -3556 blocks in x, so the server kept snapping their position back.
-# Geyser translates Bedrock movement to Java and the two disagree, which upstream
-# has not resolved (GeyserMC/Geyser#3407 is still open), and the Spigot/Paper
-# thresholds that issue mentions do not exist on a Fabric server. This mixin is
-# the server-side fix: it removes the vanilla speed check that produced the
-# corrections. Trade-off, stated plainly: it also stops the server rejecting an
-# actually-too-fast client, which is acceptable on a private world with friends.
-TOO_FAST_URL = "https://cdn.modrinth.com/data/w6JSkKSH/versions/ARqi4mgF/toofast-1.19-1.0.0.jar"
-TOO_FAST_SHA256 = "f703fed1f9be34ede7444069ec1a8ebcd50aeaac89ff507bfc98a062f435418c"
-SERVER_PAUSE_SHA256 = "4f92d4a4cef4627acbdfa1c601f0c58e392eee4159a69515fd0d622d3eeccd66"
-BETTER_RESPAWN_URL = "https://cdn.modrinth.com/data/ZUQINcGy/versions/fabric-1.19-2.0.0/better-respawn-fabric-1.19-2.0.0.jar"
-BETTER_RESPAWN_SHA256 = "9405e2ae53f031d5c32505dc3ee774c3f723c2d465230aaed7e6f7b3cdec0948"
-
-VIAPROXY_URL = "https://github.com/ViaVersion/ViaProxy/releases/download/v3.4.13/ViaProxy-3.4.13.jar"
-VIAPROXY_SHA256 = "4bbb6a6b9d3dd6a2028773ed44b97a98751e4a48e416aaad4bf6d9c860083be9"
-
-GEYSER_URL = "https://download.geysermc.org/v2/projects/geyser/versions/2.11.3/builds/1247/downloads/viaproxy"
-GEYSER_SHA256 = "85eea53e7fe58e4d97c2144a9d061577d37f619ab635227b68a948aa62d22924"
-
-GO_URL = "https://go.dev/dl/go1.25.14.linux-amd64.tar.gz"
-GO_SHA256 = "a21ae5633a269bcd7e90cf767e48225633795e99d831742cbf3397064fee7712"
-
-JAVA_URL = "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.12.1%2B1/OpenJDK21U-jre_x64_linux_hotspot_21.0.12.1_1.tar.gz"
-JAVA_SHA256 = "2413149700df0f7d440500a84a8f764c535f21e5a5e87d38328b64eec2c5b500"
-MC_JAVA_URL = "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.20.1%2B1/OpenJDK17U-jre_x64_linux_hotspot_17.0.20.1_1.tar.gz"
-MC_JAVA_SHA256 = "0b2b640e3046b64c8ec504de0ab9d91bb5610182bda21fad454681ce54d45a62"
-
-BEDROCK_PROTOCOL = int(os.environ.get("BEDROCK_PROTOCOL", "2193"))
-BEDROCK_VERSION = os.environ.get("BEDROCK_VERSION", "1.26.51")
-WORLD_NAME = os.environ.get("MINECRAFT_WORLD_NAME", "Voyager AI World")
-HOST_NAME = os.environ.get("MINECRAFT_HOST_NAME", "Voyager AI")
-
-
-def _mkdirs() -> None:
-    for path in (BASE, PERSIST_ROOT, JAVA_DIR, VIA_DIR, RELAY_DIR, WORLD_DIR, TOOLS_DIR, BIN_DIR):
-        path.mkdir(parents=True, exist_ok=True)
-
-
-def _log(message: str) -> None:
-    _mkdirs()
-    line = f"[{time.strftime('%Y-%m-%d %H:%M:%S')}] {message}"
-    print(line, flush=True)
-    with LOG_PATH.open("a", encoding="utf-8", errors="replace") as fh:
-        fh.write(line + "\n")
-
-
-def _sha256(path: Path) -> str:
-    h = hashlib.sha256()
-    with path.open("rb") as fh:
-        for chunk in iter(lambda: fh.read(1024 * 1024), b""):
-            h.update(chunk)
-    return h.hexdigest()
-
-
-def _download(url: str, path: Path, sha256: str | None = None) -> Path:
-    path.parent.mkdir(parents=True, exist_ok=True)
-    if path.exists() and (not sha256 or _sha256(path) == sha256):
-        return path
-    tmp = path.with_suffix(path.suffix + ".part")
-    tmp.unlink(missing_ok=True)
-    req = urllib.request.Request(url, headers={"User-Agent": "minecraft-friends-ai-zerogpu/1.0"})
-    _log(f"download {url}")
-    with urllib.request.urlopen(req, timeout=120) as response, tmp.open("wb") as out:
-        shutil.copyfileobj(response, out)
-    if sha256 and _sha256(tmp) != sha256:
-        tmp.unlink(missing_ok=True)
-        raise RuntimeError(f"SHA256 mismatch for {url}")
-    tmp.replace(path)
-    return path
-
-
-def _wait_tcp(host: str, port: int, timeout: float) -> bool:
-    deadline = time.time() + timeout
-    while time.time() < deadline:
-        try:
-            with socket.create_connection((host, port), timeout=1):
-                return True
-        except OSError:
-            time.sleep(1)
-    return False
-
-
-def _run_capture(args: list[str], cwd: Path, timeout: int = 300, env: dict[str, str] | None = None) -> str:
-    _log("exec " + " ".join(args))
-    proc = subprocess.run(
-        args,
-        cwd=str(cwd),
-        env=env,
-        text=True,
-        stdout=subprocess.PIPE,
-        stderr=subprocess.STDOUT,
-        timeout=timeout,
-        check=False,
-    )
-    output = proc.stdout or ""
-    for line in output.splitlines()[-80:]:
-        _log("setup> " + line)
-    if proc.returncode != 0:
-        raise RuntimeError(f"command failed rc={proc.returncode}: {' '.join(args)}")
-    return output
-
-
+TOOLS_DIR = BASE / "tools"
+BIN_DIR = BASE / "bin"
+LOG_PATH = BASE / "stack.log"
+READY_FILE = BASE / "minecraft.ready"
+
+FABRIC_INSTALLER_URL = "https://maven.fabricmc.net/net/fabricmc/fabric-installer/0.11.2/fabric-installer-0.11.2.jar"
+FABRIC_MC_VERSION = "1.19"
+FABRIC_LOADER_VERSION = "0.14.18"
+
+# Official Voyager Fabric 1.19 server-side mod stack.
+FABRIC_API_URL = "https://cdn.modrinth.com/data/P7dR8mSH/versions/0.58.0%2B1.19/fabric-api-0.58.0%2B1.19.jar"
+FABRIC_API_SHA256 = "0a3d2dba1ed45b002483ae7c08e2c0bcfcb8d2b166801a6c29d8ea64dba64370"
+COMPLETE_CONFIG_URL = "https://cdn.modrinth.com/data/GtqG8z1h/versions/2.0.0/completeconfig-2.0.0.jar"
+COMPLETE_CONFIG_SHA256 = "d34a3e167bf7942348d3f8c650fcefead6284878b39277ba43282ef69fa2d566"
+SERVER_PAUSE_URL = "https://mediafilez.forgecdn.net/files/3822/586/Multiplayer-Server-Pause-1.19-Fabric-1.1.0.jar"
+SERVER_PAUSE_SHA256 = "4f92d4a4cef4627acbdfa1c601f0c58e392eee4159a69515fd0d622d3eeccd66"
+BETTER_RESPAWN_URL = "https://cdn.modrinth.com/data/ZUQINcGy/versions/fabric-1.19-2.0.0/better-respawn-fabric-1.19-2.0.0.jar"
+BETTER_RESPAWN_SHA256 = "9405e2ae53f031d5c32505dc3ee774c3f723c2d465230aaed7e6f7b3cdec0948"
+
+VIAPROXY_URL = "https://github.com/ViaVersion/ViaProxy/releases/download/v3.4.13/ViaProxy-3.4.13.jar"
+VIAPROXY_SHA256 = "4bbb6a6b9d3dd6a2028773ed44b97a98751e4a48e416aaad4bf6d9c860083be9"
+
+GEYSER_URL = "https://download.geysermc.org/v2/projects/geyser/versions/2.11.3/builds/1247/downloads/viaproxy"
+GEYSER_SHA256 = "85eea53e7fe58e4d97c2144a9d061577d37f619ab635227b68a948aa62d22924"
+
+GO_URL = "https://go.dev/dl/go1.25.14.linux-amd64.tar.gz"
+GO_SHA256 = "a21ae5633a269bcd7e90cf767e48225633795e99d831742cbf3397064fee7712"
+
+JAVA_URL = "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.12.1%2B1/OpenJDK21U-jre_x64_linux_hotspot_21.0.12.1_1.tar.gz"
+JAVA_SHA256 = "2413149700df0f7d440500a84a8f764c535f21e5a5e87d38328b64eec2c5b500"
+MC_JAVA_URL = "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.20.1%2B1/OpenJDK17U-jre_x64_linux_hotspot_17.0.20.1_1.tar.gz"
+MC_JAVA_SHA256 = "0b2b640e3046b64c8ec504de0ab9d91bb5610182bda21fad454681ce54d45a62"
+
+BEDROCK_PROTOCOL = int(os.environ.get("BEDROCK_PROTOCOL", "2193"))
+BEDROCK_VERSION = os.environ.get("BEDROCK_VERSION", "1.26.51")
+WORLD_NAME = os.environ.get("MINECRAFT_WORLD_NAME", "Voyager AI World")
+HOST_NAME = os.environ.get("MINECRAFT_HOST_NAME", "Voyager AI")
+
+
+def _mkdirs() -> None:
+    for path in (BASE, PERSIST_ROOT, JAVA_DIR, VIA_DIR, RELAY_DIR, WORLD_DIR, TOOLS_DIR, BIN_DIR):
+        path.mkdir(parents=True, exist_ok=True)
+
+
+def _log(message: str) -> None:
+    _mkdirs()
+    line = f"[{time.strftime('%Y-%m-%d %H:%M:%S')}] {message}"
+    print(line, flush=True)
+    with LOG_PATH.open("a", encoding="utf-8", errors="replace") as fh:
+        fh.write(line + "\n")
+
+
+def _sha256(path: Path) -> str:
+    h = hashlib.sha256()
+    with path.open("rb") as fh:
+        for chunk in iter(lambda: fh.read(1024 * 1024), b""):
+            h.update(chunk)
+    return h.hexdigest()
+
+
+def _download(url: str, path: Path, sha256: str | None = None) -> Path:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    if path.exists() and (not sha256 or _sha256(path) == sha256):
+        return path
+    tmp = path.with_suffix(path.suffix + ".part")
+    tmp.unlink(missing_ok=True)
+    req = urllib.request.Request(url, headers={"User-Agent": "minecraft-friends-ai-zerogpu/1.0"})
+    _log(f"download {url}")
+    with urllib.request.urlopen(req, timeout=120) as response, tmp.open("wb") as out:
+        shutil.copyfileobj(response, out)
+    if sha256 and _sha256(tmp) != sha256:
+        tmp.unlink(missing_ok=True)
+        raise RuntimeError(f"SHA256 mismatch for {url}")
+    tmp.replace(path)
+    return path
+
+
+def _wait_tcp(host: str, port: int, timeout: float) -> bool:
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        try:
+            with socket.create_connection((host, port), timeout=1):
+                return True
+        except OSError:
+            time.sleep(1)
+    return False
+
+
+def _tail_lines(path: Path, max_lines: int = 5000) -> list[str]:
+    """Read at most max_lines trailing lines without loading a days-long log.
+
+    status() runs on every supervisor tick and UI click, so a full read of an
+    ever-growing stack.log would stall the watchdog it is meant to serve.
+    """
+    try:
+        with path.open("rb") as fh:
+            fh.seek(0, os.SEEK_END)
+            size = fh.tell()
+            chunk_size = 65536
+            data = b""
+            position = size
+            while position > 0 and data.count(b"\n") <= max_lines:
+                step = min(chunk_size, position)
+                position -= step
+                fh.seek(position)
+                data = fh.read(step) + data
+                if len(data) > (max_lines + 1) * 512:
+                    break
+        return data.decode("utf-8", errors="replace").splitlines()[-max_lines:]
+    except OSError:
+        return []
+
+
+def _run_capture(args: list[str], cwd: Path, timeout: int = 300, env: dict[str, str] | None = None) -> str:
+    _log("exec " + " ".join(args))
+    proc = subprocess.run(
+        args,
+        cwd=str(cwd),
+        env=env,
+        text=True,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.STDOUT,
+        timeout=timeout,
+        check=False,
+    )
+    output = proc.stdout or ""
+    for line in output.splitlines()[-80:]:
+        _log("setup> " + line)
+    if proc.returncode != 0:
+        raise RuntimeError(f"command failed rc={proc.returncode}: {' '.join(args)}")
+    return output
+
+
 def _patch_scalar(text: str, key: str, value: str) -> str:
-    pattern = rf"(?m)^(\s*{re.escape(key)}:\s*).*$"
-    if re.search(pattern, text):
-        return re.sub(pattern, lambda m: m.group(1) + value, text, count=1)
+    pattern = rf"(?m)^(\s*{re.escape(key)}:\s*).*$"
+    if re.search(pattern, text):
+        return re.sub(pattern, lambda m: m.group(1) + value, text, count=1)
     return text + f"\n{key}: {value}\n"
 
 
@@ -272,85 +277,43 @@ def _relay_diagnostics(lines: list[str]) -> dict[str, Any]:
     }
 
 
-RELAY_PING_PORT = 7777
-RELAY_PING_URL = f"http://127.0.0.1:{RELAY_PING_PORT}/ping"
-
-
-def _relay_player_latency(events) -> dict[str, Any]:
-    """Report the joining player's real end-to-end RTT, as measured by the relay.
-
-    nether2rak registers each connected player's client-leg and backend-leg
-    rolling round-trip time and exposes the sum over a loopback-only HTTP API
-    (bridge/pingserver.go). Nothing else measures what the player actually
-    experiences, so publish it rather than guessing from CPU counters. The full
-    XUID is a personal identifier and is deliberately not published.
-    """
-    player = xuid = None
-    for line in events:
-        if "player authenticated via xbox live" not in line:
-            continue
-        name = re.search(r"displayName=\"?([^\"\s]+)\"?", line)
-        ident = re.search(r"xuid=(\d+)", line)
-        if ident:
-            player = name.group(1) if name else player
-            xuid = ident.group(1)
-    if not xuid:
-        return {"available": False, "reason": "no authenticated player in the relay log yet"}
-    try:
-        with urllib.request.urlopen(f"{RELAY_PING_URL}?xuid={xuid}", timeout=3) as response:
-            payload = json.loads(response.read().decode())
-    except Exception as exc:
-        return {
-            "available": False,
-            "player": player,
-            "reason": f"{type(exc).__name__}: {exc}",
-        }
-    return {
-        "available": True,
-        "player": player,
-        "xuid_suffix": xuid[-4:],
-        "rtt_ms": int(payload.get("ms", 0)),
-        "measured_by": "nether2rak client leg + backend leg, rolling average",
-    }
-
-
-def _offline_player_uuid(username: str) -> str:
-    return str(uuid.UUID(bytes=hashlib.md5(
-        f"OfflinePlayer:{username}".encode("utf-8")
-    ).digest(), version=3))
-
-
-def _carry_player_saves(previous: Path, current: Path) -> None:
-    """Copy human player saves into a newly generated world.
-
-    The Xbox OAuth token lives in RELAY_DIR and is never touched here, so a map
-    change must not cost a player their session. Player saves are copied instead
-    of the world itself: they only store a player's position, inventory and
-    gamemode, which are valid in any world of the same dimension.
-
-    The bot is deliberately excluded. A full bot inventory is what pins the
-    official CurriculumAgent to its hardcoded full-inventory branch, so a fresh
-    world has to start the bot from an empty save.
-    """
-    source = previous / "playerdata"
-    if not source.is_dir():
-        return
-    destination = current / "playerdata"
-    destination.mkdir(parents=True, exist_ok=True)
-    bot_save = f"{_offline_player_uuid(BOT_USERNAME)}.dat"
-    carried = []
-    for save in sorted(source.glob("*.dat")):
-        if save.name == bot_save:
-            continue
-        try:
-            shutil.copy2(save, destination / save.name)
-        except OSError as exc:
-            _log(f"could not carry player save {save.name}: {exc}")
-            continue
-        carried.append(save.name)
-    if carried:
-        _log(f"Carried {len(carried)} player save(s) into the new world: {', '.join(carried)}")
-    else:
+def _offline_player_uuid(username: str) -> str:
+    return str(uuid.UUID(bytes=hashlib.md5(
+        f"OfflinePlayer:{username}".encode("utf-8")
+    ).digest(), version=3))
+
+
+def _carry_player_saves(previous: Path, current: Path) -> None:
+    """Copy human player saves into a newly generated world.
+
+    The Xbox OAuth token lives in RELAY_DIR and is never touched here, so a map
+    change must not cost a player their session. Player saves are copied instead
+    of the world itself: they only store a player's position, inventory and
+    gamemode, which are valid in any world of the same dimension.
+
+    The bot is deliberately excluded. A full bot inventory is what pins the
+    official CurriculumAgent to its hardcoded full-inventory branch, so a fresh
+    world has to start the bot from an empty save.
+    """
+    source = previous / "playerdata"
+    if not source.is_dir():
+        return
+    destination = current / "playerdata"
+    destination.mkdir(parents=True, exist_ok=True)
+    bot_save = f"{_offline_player_uuid(BOT_USERNAME)}.dat"
+    carried = []
+    for save in sorted(source.glob("*.dat")):
+        if save.name == bot_save:
+            continue
+        try:
+            shutil.copy2(save, destination / save.name)
+        except OSError as exc:
+            _log(f"could not carry player save {save.name}: {exc}")
+            continue
+        carried.append(save.name)
+    if carried:
+        _log(f"Carried {len(carried)} player save(s) into the new world: {', '.join(carried)}")
+    else:
         _log("No human player saves to carry into the new world")
 
 
@@ -362,31 +325,12 @@ def _server_performance(lines: list[str], now: datetime.datetime | None = None)
     tick_lag = [line for line in recent if "Can't keep up!" in line]
     delays = [int(match.group(1)) for line in tick_lag
               if (match := re.search(r"Running (\d+)ms or \d+ ticks behind", line))]
-    movement = [line for line in recent
-                if "moved too quickly" in line or "moved wrongly" in line]
-    # The count alone cannot say whether this is one entity joining or the whole
-    # server degrading. Measured: the counter went 0 -> 107 in under a minute and
-    # then stopped, which is a burst, so the entity behind it has to be visible.
-    # Deduplicate on the message, not the raw line: a burst carries a distinct
-    # timestamp on every entry, so comparing raw lines would fill the payload with
-    # five copies of one problem instead of showing five distinct ones.
-    samples: list[str] = []
-    seen: set[str] = set()
-    for line in movement:
-        trimmed = line.strip()[:200]
-        key = re.sub(r"^\[[^\]]*\]\s*", "", trimmed)
-        if key in seen:
-            continue
-        seen.add(key)
-        samples.append(trimmed)
-        if len(samples) >= 5:
-            break
     return {
         "window_seconds": 300,
         "tick_lag_events": len(tick_lag),
         "max_reported_tick_delay_ms": max(delays, default=None),
-        "movement_warnings": len(movement),
-        "movement_warning_samples": samples,
+        "movement_warnings": sum("moved too quickly" in line or "moved wrongly" in line
+                                 for line in recent),
         "last_tick_lag_at": tick_lag[-1][1:20] if tick_lag else None,
     }
 
@@ -427,163 +371,169 @@ def _ensure_admin_operator(path: Path, username: str) -> None:
     )]
     preserved.append(entry)
     path.write_text(json.dumps(preserved, indent=2) + "\n", encoding="utf-8")
-
-
-class MinecraftStack:
-    def __init__(self) -> None:
-        self.lock = threading.RLock()
-        self.worker: threading.Thread | None = None
-        self.processes: dict[str, subprocess.Popen[str]] = {}
-        self.state = "stopped"
-        self.error = ""
-        self.started_at: float | None = None
-        self.minecraft_ready = threading.Event()
-
-    def _pump(self, name: str, proc: subprocess.Popen[str]) -> None:
-        assert proc.stdout is not None
-        try:
-            for line in proc.stdout:
-                clean = line.rstrip()
-                _log(f"{name}> {clean}")
-                if name == "minecraft" and "Done (" in clean:
-                    self.minecraft_ready.set()
-        except Exception as exc:
-            _log(f"{name} log pump error: {exc!r}")
-
-    def _spawn(self, name: str, args: list[str], cwd: Path, env: dict[str, str] | None = None) -> subprocess.Popen[str]:
-        _log(f"start {name}: {' '.join(args)}")
-        proc = subprocess.Popen(
-            args,
-            cwd=str(cwd),
-            env=env,
-            stdin=subprocess.PIPE,
-            stdout=subprocess.PIPE,
-            stderr=subprocess.STDOUT,
-            text=True,
-            bufsize=1,
-        )
-        self.processes[name] = proc
-        threading.Thread(target=self._pump, args=(name, proc), daemon=True, name=f"log-{name}").start()
-        return proc
-
-    def _stop_process(self, name: str) -> None:
-        proc = self.processes.get(name)
-        if not proc or proc.poll() is not None:
-            return
-        try:
-            if name == "minecraft" and proc.stdin:
-                proc.stdin.write("stop\n")
-                proc.stdin.flush()
-                proc.wait(timeout=20)
-                return
-        except Exception:
-            pass
-        try:
-            proc.terminate()
-            proc.wait(timeout=12)
-        except Exception:
-            try:
-                proc.kill()
-            except Exception:
-                pass
-
-    def _ensure_java(self) -> Path:
-        root = TOOLS_DIR / "jre21"
-        existing = list(root.glob("*/bin/java")) if root.exists() else []
-        if existing:
-            return existing[0]
-        archive = _download(JAVA_URL, TOOLS_DIR / "temurin21-jre.tar.gz", JAVA_SHA256)
-        if root.exists():
-            shutil.rmtree(root)
-        root.mkdir(parents=True, exist_ok=True)
-        with tarfile.open(archive, "r:gz") as tf:
-            tf.extractall(root)
-        found = list(root.glob("*/bin/java"))
-        if not found:
-            raise RuntimeError("Temurin JRE 21 extraction failed")
-        found[0].chmod(0o755)
-        version = _run_capture([str(found[0]), "-version"], BASE, timeout=30)
-        _log("portable Java ready: " + version.splitlines()[0])
-        return found[0]
-
-    def _ensure_minecraft_java(self) -> Path:
-        root = TOOLS_DIR / "jre17"
-        existing = list(root.glob("*/bin/java")) if root.exists() else []
-        if existing:
-            return existing[0]
-        archive = _download(MC_JAVA_URL, TOOLS_DIR / "temurin17-jre.tar.gz", MC_JAVA_SHA256)
-        if root.exists():
-            shutil.rmtree(root)
-        root.mkdir(parents=True, exist_ok=True)
-        with tarfile.open(archive, "r:gz") as tf:
-            tf.extractall(root)
-        found = list(root.glob("*/bin/java"))
-        if not found:
-            raise RuntimeError("Temurin JRE 17 extraction failed")
-        found[0].chmod(0o755)
-        version = _run_capture([str(found[0]), "-version"], BASE, timeout=30)
-        _log("Minecraft Java 17 ready: " + version.splitlines()[0])
-        return found[0]
-
-    def _ensure_persistent_world(self) -> None:
-        WORLD_DIR.mkdir(parents=True, exist_ok=True)
-        # level.dat only exists once the server has generated the world, so its
-        # absence means this is the first boot of a new map.
-        if not (WORLD_DIR / "level.dat").exists() and PREVIOUS_WORLD_DIR.is_dir():
-            _carry_player_saves(PREVIOUS_WORLD_DIR, WORLD_DIR)
-        # Probe the exact temporary-file + rename pattern used by player saves.
-        # This never touches a player's .dat file or existing world data.
-        player_dir = WORLD_DIR / "playerdata"
-        probe = None
-        target = player_dir / ".voyager-storage-probe"
-        try:
-            player_dir.mkdir(parents=True, exist_ok=True)
-            marker = player_dir / ".keep"
-            if not marker.exists():
-                marker.write_text("Preserve playerdata directory in object storage.\n", encoding="utf-8")
-            fd, filename = tempfile.mkstemp(prefix=".voyager-probe-", suffix=".dat", dir=player_dir)
-            probe = Path(filename)
-            with os.fdopen(fd, "wb") as handle:
-                handle.write(b"voyager storage check")
-            probe.replace(target)
-            assert target.read_bytes() == b"voyager storage check"
-            _log("Player storage probe: temporary create/write/rename/read succeeded")
-        except Exception as exc:
-            _log(f"PLAYER STORAGE PROBE FAILED: {type(exc).__name__}: {exc}")
-        finally:
-            for candidate in (probe, target):
-                if candidate is not None:
-                    try:
-                        candidate.unlink(missing_ok=True)
-                    except OSError:
-                        pass
-        WORLD_DIR.mkdir(parents=True, exist_ok=True)
-        world_link = JAVA_DIR / "world"
-        if world_link.is_symlink():
-            try:
-                if world_link.resolve() == WORLD_DIR.resolve():
-                    return
-            except OSError:
-                pass
-            world_link.unlink(missing_ok=True)
-        elif world_link.exists():
-            if not any(WORLD_DIR.iterdir()):
-                shutil.copytree(world_link, WORLD_DIR, dirs_exist_ok=True)
-                _log("Migrated existing world into persistent storage")
-            shutil.rmtree(world_link)
-        world_link.symlink_to(WORLD_DIR, target_is_directory=True)
-        _log(f"Persistent Minecraft world linked: {world_link} -> {WORLD_DIR}")
-
-    def _ensure_voyager_mods(self) -> None:
-        mods_dir = JAVA_DIR / "mods"
-        mods_dir.mkdir(parents=True, exist_ok=True)
-        mods = (
-            ("fabric-api-0.58.0+1.19.jar", FABRIC_API_URL, FABRIC_API_SHA256),
-            ("completeconfig-2.0.0.jar", COMPLETE_CONFIG_URL, COMPLETE_CONFIG_SHA256),
-            ("Multiplayer-Server-Pause-1.19-Fabric-1.1.0.jar", SERVER_PAUSE_URL, SERVER_PAUSE_SHA256),
-            # Local addition, not an upstream requirement: see TOO_FAST_URL.
-            ("toofast-1.19-1.0.0.jar", TOO_FAST_URL, TOO_FAST_SHA256),
-        )
+
+
+class MinecraftStack:
+    def __init__(self) -> None:
+        self.lock = threading.RLock()
+        self.worker: threading.Thread | None = None
+        self.processes: dict[str, subprocess.Popen[str]] = {}
+        self.state = "stopped"
+        self.error = ""
+        self.started_at: float | None = None
+        self.minecraft_ready = threading.Event()
+        self.failed_saves_since_boot = 0
+        self.respawn_npe_since_boot = 0
+
+    def _pump(self, name: str, proc: subprocess.Popen[str]) -> None:
+        assert proc.stdout is not None
+        try:
+            for line in proc.stdout:
+                clean = line.rstrip()
+                _log(f"{name}> {clean}")
+                if name == "minecraft":
+                    with self.lock:
+                        if "Failed to save player data" in clean:
+                            self.failed_saves_since_boot += 1
+                        if "respawnDimension" in clean and "null" in clean:
+                            self.respawn_npe_since_boot += 1
+                if name == "minecraft" and "Done (" in clean:
+                    self.minecraft_ready.set()
+        except Exception as exc:
+            _log(f"{name} log pump error: {exc!r}")
+
+    def _spawn(self, name: str, args: list[str], cwd: Path, env: dict[str, str] | None = None) -> subprocess.Popen[str]:
+        _log(f"start {name}: {' '.join(args)}")
+        proc = subprocess.Popen(
+            args,
+            cwd=str(cwd),
+            env=env,
+            stdin=subprocess.PIPE,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.STDOUT,
+            text=True,
+            bufsize=1,
+        )
+        self.processes[name] = proc
+        threading.Thread(target=self._pump, args=(name, proc), daemon=True, name=f"log-{name}").start()
+        return proc
+
+    def _stop_process(self, name: str) -> None:
+        proc = self.processes.get(name)
+        if not proc or proc.poll() is not None:
+            return
+        try:
+            if name == "minecraft" and proc.stdin:
+                proc.stdin.write("stop\n")
+                proc.stdin.flush()
+                proc.wait(timeout=20)
+                return
+        except Exception:
+            pass
+        try:
+            proc.terminate()
+            proc.wait(timeout=12)
+        except Exception:
+            try:
+                proc.kill()
+            except Exception:
+                pass
+
+    def _ensure_java(self) -> Path:
+        root = TOOLS_DIR / "jre21"
+        existing = list(root.glob("*/bin/java")) if root.exists() else []
+        if existing:
+            return existing[0]
+        archive = _download(JAVA_URL, TOOLS_DIR / "temurin21-jre.tar.gz", JAVA_SHA256)
+        if root.exists():
+            shutil.rmtree(root)
+        root.mkdir(parents=True, exist_ok=True)
+        with tarfile.open(archive, "r:gz") as tf:
+            tf.extractall(root)
+        found = list(root.glob("*/bin/java"))
+        if not found:
+            raise RuntimeError("Temurin JRE 21 extraction failed")
+        found[0].chmod(0o755)
+        version = _run_capture([str(found[0]), "-version"], BASE, timeout=30)
+        _log("portable Java ready: " + version.splitlines()[0])
+        return found[0]
+
+    def _ensure_minecraft_java(self) -> Path:
+        root = TOOLS_DIR / "jre17"
+        existing = list(root.glob("*/bin/java")) if root.exists() else []
+        if existing:
+            return existing[0]
+        archive = _download(MC_JAVA_URL, TOOLS_DIR / "temurin17-jre.tar.gz", MC_JAVA_SHA256)
+        if root.exists():
+            shutil.rmtree(root)
+        root.mkdir(parents=True, exist_ok=True)
+        with tarfile.open(archive, "r:gz") as tf:
+            tf.extractall(root)
+        found = list(root.glob("*/bin/java"))
+        if not found:
+            raise RuntimeError("Temurin JRE 17 extraction failed")
+        found[0].chmod(0o755)
+        version = _run_capture([str(found[0]), "-version"], BASE, timeout=30)
+        _log("Minecraft Java 17 ready: " + version.splitlines()[0])
+        return found[0]
+
+    def _ensure_persistent_world(self) -> None:
+        WORLD_DIR.mkdir(parents=True, exist_ok=True)
+        # level.dat only exists once the server has generated the world, so its
+        # absence means this is the first boot of a new map.
+        if not (WORLD_DIR / "level.dat").exists() and PREVIOUS_WORLD_DIR.is_dir():
+            _carry_player_saves(PREVIOUS_WORLD_DIR, WORLD_DIR)
+        # Probe the exact temporary-file + rename pattern used by player saves.
+        # This never touches a player's .dat file or existing world data.
+        player_dir = WORLD_DIR / "playerdata"
+        probe = None
+        target = player_dir / ".voyager-storage-probe"
+        try:
+            player_dir.mkdir(parents=True, exist_ok=True)
+            marker = player_dir / ".keep"
+            if not marker.exists():
+                marker.write_text("Preserve playerdata directory in object storage.\n", encoding="utf-8")
+            fd, filename = tempfile.mkstemp(prefix=".voyager-probe-", suffix=".dat", dir=player_dir)
+            probe = Path(filename)
+            with os.fdopen(fd, "wb") as handle:
+                handle.write(b"voyager storage check")
+            probe.replace(target)
+            assert target.read_bytes() == b"voyager storage check"
+            _log("Player storage probe: temporary create/write/rename/read succeeded")
+        except Exception as exc:
+            _log(f"PLAYER STORAGE PROBE FAILED: {type(exc).__name__}: {exc}")
+        finally:
+            for candidate in (probe, target):
+                if candidate is not None:
+                    try:
+                        candidate.unlink(missing_ok=True)
+                    except OSError:
+                        pass
+        WORLD_DIR.mkdir(parents=True, exist_ok=True)
+        world_link = JAVA_DIR / "world"
+        if world_link.is_symlink():
+            try:
+                if world_link.resolve() == WORLD_DIR.resolve():
+                    return
+            except OSError:
+                pass
+            world_link.unlink(missing_ok=True)
+        elif world_link.exists():
+            if not any(WORLD_DIR.iterdir()):
+                shutil.copytree(world_link, WORLD_DIR, dirs_exist_ok=True)
+                _log("Migrated existing world into persistent storage")
+            shutil.rmtree(world_link)
+        world_link.symlink_to(WORLD_DIR, target_is_directory=True)
+        _log(f"Persistent Minecraft world linked: {world_link} -> {WORLD_DIR}")
+
+    def _ensure_voyager_mods(self) -> None:
+        mods_dir = JAVA_DIR / "mods"
+        mods_dir.mkdir(parents=True, exist_ok=True)
+        mods = (
+            ("fabric-api-0.58.0+1.19.jar", FABRIC_API_URL, FABRIC_API_SHA256),
+            ("completeconfig-2.0.0.jar", COMPLETE_CONFIG_URL, COMPLETE_CONFIG_SHA256),
+            ("Multiplayer-Server-Pause-1.19-Fabric-1.1.0.jar", SERVER_PAUSE_URL, SERVER_PAUSE_SHA256),
+        )
         for filename, url, sha256 in mods:
             _download(url, mods_dir / filename, sha256)
 
@@ -597,279 +547,280 @@ class MinecraftStack:
             _log("Removed faulty Better Respawn 1.19 mod from Fabric mods directory")
         _log(
             "Official Voyager Fabric mods ready: Fabric API 0.58.0+1.19, "
-            "CompleteConfig 2.0.0, Multiplayer Server Pause 1.1.0, "
-            "TooFast 1.0.0 (local, removes the Bedrock movement corrections). "
+            "CompleteConfig 2.0.0, Multiplayer Server Pause 1.1.0. "
             "Better Respawn 1.19-2.0.0 is disabled due to its player-save NPE. Mod Menu is client-only and is "
-            "intentionally omitted on this headless dedicated server."
-        )
-
-    def _ensure_fabric(self) -> Path:
-        java = self._ensure_minecraft_java()
-        installer = _download(FABRIC_INSTALLER_URL, TOOLS_DIR / "fabric-installer-0.11.2.jar")
-        JAVA_DIR.mkdir(parents=True, exist_ok=True)
-        launcher = JAVA_DIR / "fabric-server-launch.jar"
-        if not launcher.exists():
-            _run_capture(
-                [
-                    str(java), "-jar", str(installer), "server",
-                    "-mcversion", FABRIC_MC_VERSION,
-                    "-loader", FABRIC_LOADER_VERSION,
-                    "-downloadMinecraft",
-                    "-dir", str(JAVA_DIR),
-                ],
-                JAVA_DIR,
-                timeout=300,
-            )
-        self._ensure_voyager_mods()
-        (JAVA_DIR / "eula.txt").write_text("eula=true\n", encoding="utf-8")
-        props = {
-            "server-ip": "127.0.0.1",
-            "server-port": "25565",
-            "online-mode": "false",
-            "enforce-secure-profile": "false",
-            "enable-command-block": "true",
-            "spawn-protection": "0",
-            "allow-flight": "true",
-            "gamemode": "creative",
-            "force-gamemode": "true",
+            "intentionally omitted on this headless dedicated server."
+        )
+
+    def _ensure_fabric(self) -> Path:
+        java = self._ensure_minecraft_java()
+        installer = _download(FABRIC_INSTALLER_URL, TOOLS_DIR / "fabric-installer-0.11.2.jar")
+        JAVA_DIR.mkdir(parents=True, exist_ok=True)
+        launcher = JAVA_DIR / "fabric-server-launch.jar"
+        if not launcher.exists():
+            _run_capture(
+                [
+                    str(java), "-jar", str(installer), "server",
+                    "-mcversion", FABRIC_MC_VERSION,
+                    "-loader", FABRIC_LOADER_VERSION,
+                    "-downloadMinecraft",
+                    "-dir", str(JAVA_DIR),
+                ],
+                JAVA_DIR,
+                timeout=300,
+            )
+        self._ensure_voyager_mods()
+        (JAVA_DIR / "eula.txt").write_text("eula=true\n", encoding="utf-8")
+        props = {
+            "server-ip": "127.0.0.1",
+            "server-port": "25565",
+            "online-mode": "false",
+            "enforce-secure-profile": "false",
+            "enable-command-block": "true",
+            "spawn-protection": "0",
+            "allow-flight": "true",
+            "gamemode": "creative",
+            "force-gamemode": "true",
             "difficulty": "peaceful",
             "max-players": str(MAX_PLAYERS),
             "op-permission-level": "4",
-            "view-distance": "8",
-            "simulation-distance": "6",
-            "level-name": "world",
+            "view-distance": "8",
+            "simulation-distance": "6",
+            "level-name": "world",
             "level-type": "minecraft:flat",
             "generator-settings": FLAT_GENERATOR_SETTINGS,
-            "generate-structures": "true",
-            "motd": "Voyager AI + Bedrock Friends",
-        }
+            "generate-structures": "false",
+            "motd": "Voyager AI + Bedrock Friends",
+        }
         (JAVA_DIR / "server.properties").write_text(
             "\n".join(f"{k}={v}" for k, v in props.items()) + "\n",
             encoding="utf-8",
         )
         _ensure_admin_operator(JAVA_DIR / "ops.json", ADMIN_USERNAME)
         self._ensure_persistent_world()
-        return launcher
-
-    def _start_fabric(self) -> None:
-        launcher = self._ensure_fabric()
-        self.minecraft_ready.clear()
-        READY_FILE.unlink(missing_ok=True)
-        proc = self._spawn(
-            "minecraft",
-            [str(self._ensure_minecraft_java()), "-Xms1G", "-Xmx8G",
-             "--add-exports=java.base/jdk.internal.org.objectweb.asm=ALL-UNNAMED",
-             f"-javaagent:{Path(__file__).resolve().parent / 'diagnostics/player-save-diagnostics.jar'}",
-             "-jar", str(launcher), "nogui"],
-            JAVA_DIR,
-        )
-        if not _wait_tcp("127.0.0.1", 25565, 120):
-            raise RuntimeError("Minecraft Java 1.19 did not open 127.0.0.1:25565")
-        if not self.minecraft_ready.wait(timeout=180):
-            raise RuntimeError("Minecraft Java opened 25565 but world did not finish loading")
-        if proc.stdin:
-            for cmd in (
-                f"op {BOT_USERNAME}",
-                f"gamemode creative {BOT_USERNAME}",
-                "gamerule keepInventory true",
-                "gamerule doDaylightCycle false",
-                # The cycle is frozen, so set the time once: the world used to be
-                # frozen at night, which is what the bot reported in every
-                # observation and what a player saw on join.
-                "time set day",
-                "difficulty peaceful",
-            ):
-                proc.stdin.write(cmd + "\n")
-            proc.stdin.flush()
-        READY_FILE.write_text("ready\n", encoding="utf-8")
-        _log("Minecraft Java 1.19/Fabric fully ready on 127.0.0.1:25565")
-
-    def _ensure_viaproxy(self) -> tuple[Path, Path]:
-        jar = _download(VIAPROXY_URL, VIA_DIR / "ViaProxy-3.4.13.jar", VIAPROXY_SHA256)
-        plugin_dir = VIA_DIR / "plugins"
-        plugin_dir.mkdir(parents=True, exist_ok=True)
-        _download(GEYSER_URL, plugin_dir / "Geyser-ViaProxy.jar", GEYSER_SHA256)
-        cfg = VIA_DIR / "viaproxy.yml"
-        if not cfg.exists():
-            proc = subprocess.Popen(
-                [str(self._ensure_java()), "-jar", str(jar), "config", str(cfg)],
-                cwd=str(VIA_DIR),
-                stdout=subprocess.PIPE,
-                stderr=subprocess.STDOUT,
-                text=True,
-            )
-            deadline = time.time() + 25
-            while time.time() < deadline and not cfg.exists() and proc.poll() is None:
-                time.sleep(1)
-            if proc.poll() is None:
-                proc.terminate()
-                try:
-                    proc.wait(timeout=8)
-                except Exception:
-                    proc.kill()
-            if not cfg.exists():
-                raise RuntimeError("ViaProxy did not generate viaproxy.yml")
-        text = cfg.read_text(encoding="utf-8", errors="replace")
-        text = _patch_scalar(text, "bind-address", "127.0.0.1:25568")
-        text = _patch_scalar(text, "target-address", "127.0.0.1:25565")
-        text = _patch_scalar(text, "proxy-online-mode", "false")
-        text = _patch_scalar(text, "auth-method", "none")
-        cfg.write_text(text, encoding="utf-8")
-        return jar, cfg
-
-    def _patch_geyser(self, path: Path) -> None:
-        data: dict[str, Any] = yaml.safe_load(path.read_text(encoding="utf-8")) or {}
-        bedrock = data.setdefault("bedrock", {})
-        bedrock["address"] = "127.0.0.1"
-        bedrock["port"] = 19132
-        bedrock["clone-remote-port"] = False
-        java = data.setdefault("java", {})
-        java["auth-type"] = "offline"
-        advanced = data.setdefault("advanced", {})
-        adv_bedrock = advanced.setdefault("bedrock", {})
-        adv_bedrock["broadcast-port"] = 19132
-        adv_bedrock["validate-bedrock-login"] = False
-        data["debug-mode"] = False
-        path.write_text(yaml.safe_dump(data, sort_keys=False), encoding="utf-8")
-        _log("Geyser configured loopback-only; Xbox/NetherNet relay remains the auth boundary")
-
-    def _start_viaproxy(self) -> None:
-        jar, cfg = self._ensure_viaproxy()
-        geyser_cfg = VIA_DIR / "plugins" / "Geyser" / "config.yml"
-        if not geyser_cfg.exists():
-            proc = self._spawn("viaproxy-bootstrap", [str(self._ensure_java()), "-jar", str(jar), "config", str(cfg)], VIA_DIR)
-            deadline = time.time() + 35
-            while time.time() < deadline and not geyser_cfg.exists() and proc.poll() is None:
-                time.sleep(1)
-            self._stop_process("viaproxy-bootstrap")
-            if not geyser_cfg.exists():
-                raise RuntimeError("Geyser-ViaProxy did not generate plugins/Geyser/config.yml")
-        self._patch_geyser(geyser_cfg)
-        proc = self._spawn("viaproxy", [str(self._ensure_java()), "-jar", str(jar), "config", str(cfg)], VIA_DIR)
-        time.sleep(12)
-        if proc.poll() is not None:
-            raise RuntimeError(f"ViaProxy/Geyser exited rc={proc.returncode}")
-        _log("ViaProxy + Geyser running; Bedrock backend is 127.0.0.1:19132")
-
-    def _ensure_go(self) -> Path:
-        go = TOOLS_DIR / "go" / "bin" / "go"
-        if go.exists():
-            return go
-        archive = _download(GO_URL, TOOLS_DIR / "go1.25.14.linux-amd64.tar.gz", GO_SHA256)
-        target = TOOLS_DIR / "go"
-        if target.exists():
-            shutil.rmtree(target)
-        with tarfile.open(archive, "r:gz") as tf:
-            tf.extractall(TOOLS_DIR)
-        if not go.exists():
-            raise RuntimeError("Go toolchain extraction failed")
-        return go
-
-    def _ensure_nether2rak(self) -> Path:
-        binary = BIN_DIR / "nether2rak"
-        if binary.exists():
-            return binary
-        go = self._ensure_go()
-        src = Path("/app/third_party/nether2rak")
-        if not src.exists():
-            src = Path(__file__).resolve().parent / "third_party" / "nether2rak"
-        if not src.exists():
-            raise RuntimeError("Vendored nether2rak source is missing")
-        env = os.environ.copy()
-        env.update(
-            {
-                "PATH": f"{go.parent}:{env.get('PATH', '')}",
-                "GOTOOLCHAIN": "local",
-                "GOCACHE": str(BASE / "go-cache"),
-                "GOMODCACHE": str(BASE / "go-mod-cache"),
-                "CGO_ENABLED": "0",
-            }
-        )
-        _run_capture([str(go), "build", "-trimpath", "-o", str(binary), "."], src, timeout=900, env=env)
-        binary.chmod(0o755)
-        return binary
-
-    def _write_relay_config(self) -> Path:
-        cfg = {
-            "backend_transport": "raknet",
-            "geyser_address": "127.0.0.1:19132",
-            "nethernet_backend_address": "http://127.0.0.1:19134",
-            "host_name": HOST_NAME,
-            "world_name": WORLD_NAME,
-            "max_players": MAX_PLAYERS,
-            "fake_player_count": 0,
-            "protocol": BEDROCK_PROTOCOL,
-            "version": BEDROCK_VERSION,
-            "update_interval_seconds": 30,
-            "allowed_xuids": [],
-            "compression": "snappy",
-            "compression_threshold": 256,
-            "fix_native_bds_persistence": False,
-            "disable_client_encryption": False,
-            "relay_direct_ip": False,
-            "relay_direct_ip_listen_address": ":19134",
-            "invite_port": 7782,
-            "ping_port": 7777,
-            "pprof_port": 6060,
-            "extra_broadcasts": [],
-        }
-        path = RELAY_DIR / "config.json"
-        path.write_text(json.dumps(cfg, indent=2), encoding="utf-8")
-        return path
-
-    def _start_relay(self) -> None:
-        binary = self._ensure_nether2rak()
-        self._write_relay_config()
-        proc = self._spawn("friends", [str(binary)], RELAY_DIR)
-        time.sleep(4)
-        if proc.poll() is not None:
-            raise RuntimeError(f"Xbox Friends relay exited rc={proc.returncode}")
-        _log("Xbox Friends relay started; Microsoft device-code login may be required")
-
-    def _boot(self) -> None:
+        return launcher
+
+    def _reset_boot_counters(self) -> None:
         with self.lock:
-            self.state = "starting"
-            self.error = ""
-            self.started_at = time.time()
-        try:
-            _mkdirs()
-            _log("=== Minecraft stack bootstrap ===")
-            self._start_fabric()
-            self._start_viaproxy()
-            self._start_relay()
-            with self.lock:
-                self.state = "running"
-            _log("=== Minecraft stack running ===")
-        except Exception as exc:
-            with self.lock:
-                self.state = "error"
-                self.error = repr(exc)
-            _log(f"STACK ERROR: {exc!r}")
-
-    def start_async(self) -> dict[str, Any]:
-        with self.lock:
-            if self.worker and self.worker.is_alive():
-                return self.status()
-            if any(p.poll() is None for p in self.processes.values()) and self.state == "running":
-                return self.status()
-            self.worker = threading.Thread(target=self._boot, daemon=True, name="minecraft-stack")
-            self.worker.start()
-        return self.status()
-
-    def stop(self) -> dict[str, Any]:
-        with self.lock:
-            for name in ("friends", "viaproxy", "viaproxy-bootstrap", "minecraft"):
-                self._stop_process(name)
-            self.state = "stopped"
-        _log("Minecraft stack stopped")
-        return self.status()
-
-    def tail(self, lines: int = 160) -> str:
-        if not LOG_PATH.exists():
-            return "Sem logs do Minecraft ainda."
-        items = LOG_PATH.read_text(encoding="utf-8", errors="replace").splitlines()
-        return "\n".join(items[-max(10, min(lines, 500)):])
-
+            self.failed_saves_since_boot = 0
+            self.respawn_npe_since_boot = 0
+
+    def _start_fabric(self) -> None:
+        launcher = self._ensure_fabric()
+        self.minecraft_ready.clear()
+        self._reset_boot_counters()
+        READY_FILE.unlink(missing_ok=True)
+        proc = self._spawn(
+            "minecraft",
+            [str(self._ensure_minecraft_java()), "-Xms1G", "-Xmx8G",
+             "--add-exports=java.base/jdk.internal.org.objectweb.asm=ALL-UNNAMED",
+             f"-javaagent:{Path(__file__).resolve().parent / 'diagnostics/player-save-diagnostics.jar'}",
+             "-jar", str(launcher), "nogui"],
+            JAVA_DIR,
+        )
+        if not _wait_tcp("127.0.0.1", 25565, 120):
+            raise RuntimeError("Minecraft Java 1.19 did not open 127.0.0.1:25565")
+        if not self.minecraft_ready.wait(timeout=180):
+            raise RuntimeError("Minecraft Java opened 25565 but world did not finish loading")
+        if proc.stdin:
+            for cmd in (
+                f"op {BOT_USERNAME}",
+                f"gamemode creative {BOT_USERNAME}",
+                "gamerule keepInventory true",
+                "gamerule doDaylightCycle false",
+                "difficulty peaceful",
+            ):
+                proc.stdin.write(cmd + "\n")
+            proc.stdin.flush()
+        READY_FILE.write_text("ready\n", encoding="utf-8")
+        _log("Minecraft Java 1.19/Fabric fully ready on 127.0.0.1:25565")
+
+    def _ensure_viaproxy(self) -> tuple[Path, Path]:
+        jar = _download(VIAPROXY_URL, VIA_DIR / "ViaProxy-3.4.13.jar", VIAPROXY_SHA256)
+        plugin_dir = VIA_DIR / "plugins"
+        plugin_dir.mkdir(parents=True, exist_ok=True)
+        _download(GEYSER_URL, plugin_dir / "Geyser-ViaProxy.jar", GEYSER_SHA256)
+        cfg = VIA_DIR / "viaproxy.yml"
+        if not cfg.exists():
+            proc = subprocess.Popen(
+                [str(self._ensure_java()), "-jar", str(jar), "config", str(cfg)],
+                cwd=str(VIA_DIR),
+                stdout=subprocess.PIPE,
+                stderr=subprocess.STDOUT,
+                text=True,
+            )
+            deadline = time.time() + 25
+            while time.time() < deadline and not cfg.exists() and proc.poll() is None:
+                time.sleep(1)
+            if proc.poll() is None:
+                proc.terminate()
+                try:
+                    proc.wait(timeout=8)
+                except Exception:
+                    proc.kill()
+            if not cfg.exists():
+                raise RuntimeError("ViaProxy did not generate viaproxy.yml")
+        text = cfg.read_text(encoding="utf-8", errors="replace")
+        text = _patch_scalar(text, "bind-address", "127.0.0.1:25568")
+        text = _patch_scalar(text, "target-address", "127.0.0.1:25565")
+        text = _patch_scalar(text, "proxy-online-mode", "false")
+        text = _patch_scalar(text, "auth-method", "none")
+        cfg.write_text(text, encoding="utf-8")
+        return jar, cfg
+
+    def _patch_geyser(self, path: Path) -> None:
+        data: dict[str, Any] = yaml.safe_load(path.read_text(encoding="utf-8")) or {}
+        bedrock = data.setdefault("bedrock", {})
+        bedrock["address"] = "127.0.0.1"
+        bedrock["port"] = 19132
+        bedrock["clone-remote-port"] = False
+        java = data.setdefault("java", {})
+        java["auth-type"] = "offline"
+        advanced = data.setdefault("advanced", {})
+        adv_bedrock = advanced.setdefault("bedrock", {})
+        adv_bedrock["broadcast-port"] = 19132
+        adv_bedrock["validate-bedrock-login"] = False
+        data["debug-mode"] = False
+        path.write_text(yaml.safe_dump(data, sort_keys=False), encoding="utf-8")
+        _log("Geyser configured loopback-only; Xbox/NetherNet relay remains the auth boundary")
+
+    def _start_viaproxy(self) -> None:
+        jar, cfg = self._ensure_viaproxy()
+        geyser_cfg = VIA_DIR / "plugins" / "Geyser" / "config.yml"
+        if not geyser_cfg.exists():
+            proc = self._spawn("viaproxy-bootstrap", [str(self._ensure_java()), "-jar", str(jar), "config", str(cfg)], VIA_DIR)
+            deadline = time.time() + 35
+            while time.time() < deadline and not geyser_cfg.exists() and proc.poll() is None:
+                time.sleep(1)
+            self._stop_process("viaproxy-bootstrap")
+            if not geyser_cfg.exists():
+                raise RuntimeError("Geyser-ViaProxy did not generate plugins/Geyser/config.yml")
+        self._patch_geyser(geyser_cfg)
+        proc = self._spawn("viaproxy", [str(self._ensure_java()), "-jar", str(jar), "config", str(cfg)], VIA_DIR)
+        time.sleep(12)
+        if proc.poll() is not None:
+            raise RuntimeError(f"ViaProxy/Geyser exited rc={proc.returncode}")
+        _log("ViaProxy + Geyser running; Bedrock backend is 127.0.0.1:19132")
+
+    def _ensure_go(self) -> Path:
+        go = TOOLS_DIR / "go" / "bin" / "go"
+        if go.exists():
+            return go
+        archive = _download(GO_URL, TOOLS_DIR / "go1.25.14.linux-amd64.tar.gz", GO_SHA256)
+        target = TOOLS_DIR / "go"
+        if target.exists():
+            shutil.rmtree(target)
+        with tarfile.open(archive, "r:gz") as tf:
+            tf.extractall(TOOLS_DIR)
+        if not go.exists():
+            raise RuntimeError("Go toolchain extraction failed")
+        return go
+
+    def _ensure_nether2rak(self) -> Path:
+        binary = BIN_DIR / "nether2rak"
+        if binary.exists():
+            return binary
+        go = self._ensure_go()
+        src = Path("/app/third_party/nether2rak")
+        if not src.exists():
+            src = Path(__file__).resolve().parent / "third_party" / "nether2rak"
+        if not src.exists():
+            raise RuntimeError("Vendored nether2rak source is missing")
+        env = os.environ.copy()
+        env.update(
+            {
+                "PATH": f"{go.parent}:{env.get('PATH', '')}",
+                "GOTOOLCHAIN": "local",
+                "GOCACHE": str(BASE / "go-cache"),
+                "GOMODCACHE": str(BASE / "go-mod-cache"),
+                "CGO_ENABLED": "0",
+            }
+        )
+        _run_capture([str(go), "build", "-trimpath", "-o", str(binary), "."], src, timeout=900, env=env)
+        binary.chmod(0o755)
+        return binary
+
+    def _write_relay_config(self) -> Path:
+        cfg = {
+            "backend_transport": "raknet",
+            "geyser_address": "127.0.0.1:19132",
+            "nethernet_backend_address": "http://127.0.0.1:19134",
+            "host_name": HOST_NAME,
+            "world_name": WORLD_NAME,
+            "max_players": MAX_PLAYERS,
+            "fake_player_count": 0,
+            "protocol": BEDROCK_PROTOCOL,
+            "version": BEDROCK_VERSION,
+            "update_interval_seconds": 30,
+            "allowed_xuids": [],
+            "compression": "snappy",
+            "compression_threshold": 256,
+            "fix_native_bds_persistence": False,
+            "disable_client_encryption": False,
+            "relay_direct_ip": False,
+            "relay_direct_ip_listen_address": ":19134",
+            "invite_port": 7782,
+            "ping_port": 7777,
+            "pprof_port": 6060,
+            "extra_broadcasts": [],
+        }
+        path = RELAY_DIR / "config.json"
+        path.write_text(json.dumps(cfg, indent=2), encoding="utf-8")
+        return path
+
+    def _start_relay(self) -> None:
+        binary = self._ensure_nether2rak()
+        self._write_relay_config()
+        proc = self._spawn("friends", [str(binary)], RELAY_DIR)
+        time.sleep(4)
+        if proc.poll() is not None:
+            raise RuntimeError(f"Xbox Friends relay exited rc={proc.returncode}")
+        _log("Xbox Friends relay started; Microsoft device-code login may be required")
+
+    def _boot(self) -> None:
+        with self.lock:
+            self.state = "starting"
+            self.error = ""
+            self.started_at = time.time()
+        try:
+            _mkdirs()
+            _log("=== Minecraft stack bootstrap ===")
+            self._start_fabric()
+            self._start_viaproxy()
+            self._start_relay()
+            with self.lock:
+                self.state = "running"
+            _log("=== Minecraft stack running ===")
+        except Exception as exc:
+            with self.lock:
+                self.state = "error"
+                self.error = repr(exc)
+            _log(f"STACK ERROR: {exc!r}")
+
+    def start_async(self) -> dict[str, Any]:
+        with self.lock:
+            if self.worker and self.worker.is_alive():
+                return self.status()
+            if any(p.poll() is None for p in self.processes.values()) and self.state == "running":
+                return self.status()
+            self.worker = threading.Thread(target=self._boot, daemon=True, name="minecraft-stack")
+            self.worker.start()
+        return self.status()
+
+    def stop(self) -> dict[str, Any]:
+        with self.lock:
+            for name in ("friends", "viaproxy", "viaproxy-bootstrap", "minecraft"):
+                self._stop_process(name)
+            self.state = "stopped"
+        _log("Minecraft stack stopped")
+        return self.status()
+
+    def tail(self, lines: int = 160) -> str:
+        if not LOG_PATH.exists():
+            return "Sem logs do Minecraft ainda."
+        items = _tail_lines(LOG_PATH, max(10, min(lines, 500)))
+        return "\n".join(items[-max(10, min(lines, 500)):])
+
     def status(self) -> dict[str, Any]:
         with self.lock:
             processes = {
@@ -879,14 +830,10 @@ class MinecraftStack:
             for name, process in processes.items():
                 if process["running"]:
                     process["rss_gib"] = _process_rss_gib(process["pid"])
-            try:
-                all_lines = LOG_PATH.read_text(encoding="utf-8", errors="replace").splitlines()
-                boot = next((i for i in range(len(all_lines) - 1, -1, -1)
-                             if "=== Minecraft stack bootstrap ===" in all_lines[i]), 0)
-                server_lines = [line for line in all_lines[boot:] if "minecraft>" in line]
-            except OSError:
-                all_lines = []
-                server_lines = []
+            all_lines = _tail_lines(LOG_PATH)
+            boot = next((i for i in range(len(all_lines) - 1, -1, -1)
+                         if "=== Minecraft stack bootstrap ===" in all_lines[i]), 0)
+            server_lines = [line for line in all_lines[boot:] if "minecraft>" in line]
             log = "\n".join(all_lines[-120:]) if all_lines else "Sem logs do Minecraft ainda."
             relay_health = _relay_diagnostics(all_lines[boot:] if all_lines else [])
             access_state = _access_state(self.state, self.started_at, relay_health)
@@ -921,57 +868,55 @@ class MinecraftStack:
                 player_stat = None
             player_save = {
                 "better_respawn_jar_present": (JAVA_DIR / "mods" / "better-respawn-fabric-1.19-2.0.0.jar").exists(),
-                "failed_saves_since_boot": sum("Failed to save player data" in line for line in server_lines),
-                "respawn_npe_since_boot": sum("respawnDimension" in line and "null" in line
-                                             for line in server_lines),
+                "failed_saves_since_boot": self.failed_saves_since_boot,
+                "respawn_npe_since_boot": self.respawn_npe_since_boot,
                 "player_file_exists": player_stat is not None,
                 "player_file_size": player_stat.st_size if player_stat else None,
                 "player_file_mtime": player_stat.st_mtime if player_stat else None,
             }
-            login_url = None
-            device_code = None
-            url_match = re.findall(r"https://(?:www\.)?microsoft\.com/link", log, flags=re.I)
-            if url_match:
-                login_url = url_match[-1]
-            for pattern in (
-                r"(?:code|c[oó]digo)\s*[:=]\s*([A-Z0-9-]{6,16})",
-                r"enter\s+([A-Z0-9-]{6,16})\s+(?:to|at)",
-                r"using\s+the\s+code\s+([A-Z0-9-]{6,16})",
-            ):
-                found = re.findall(pattern, log, flags=re.I)
-                if found:
-                    device_code = found[-1].upper()
-                    break
-            return {
-                "state": self.state,
-                "error": self.error or None,
-                "started_at": self.started_at,
-                "java_server": "127.0.0.1:25565",
-                "bedrock_backend": "127.0.0.1:19132",
-                "access": "Xbox/Microsoft Friends via NetherNet; no public UDP tunnel",
-                "auth_persistence": str(RELAY_DIR / "token.json"),
-                "auth_token_cached": (RELAY_DIR / "token.json").exists(),
-                "persistent_root": str(PERSIST_ROOT),
+            login_url = None
+            device_code = None
+            url_match = re.findall(r"https://(?:www\.)?microsoft\.com/link", log, flags=re.I)
+            if url_match:
+                login_url = url_match[-1]
+            for pattern in (
+                r"(?:code|c[oó]digo)\s*[:=]\s*([A-Z0-9-]{6,16})",
+                r"enter\s+([A-Z0-9-]{6,16})\s+(?:to|at)",
+                r"using\s+the\s+code\s+([A-Z0-9-]{6,16})",
+            ):
+                found = re.findall(pattern, log, flags=re.I)
+                if found:
+                    device_code = found[-1].upper()
+                    break
+            return {
+                "state": self.state,
+                "error": self.error or None,
+                "started_at": self.started_at,
+                "java_server": "127.0.0.1:25565",
+                "bedrock_backend": "127.0.0.1:19132",
+                "access": "Xbox/Microsoft Friends via NetherNet; no public UDP tunnel",
+                "auth_persistence": str(RELAY_DIR / "token.json"),
+                "auth_token_cached": (RELAY_DIR / "token.json").exists(),
+                "persistent_root": str(PERSIST_ROOT),
                 "world_persistence": str(WORLD_DIR),
                 "world_profile": WORLD_PROFILE,
                 "world_surface_y": WORLD_SURFACE_Y,
                 "player_save": player_save,
                 "relay_health": relay_health,
-                "relay_latency": _relay_player_latency(all_lines[boot:] if all_lines else []),
                 "access_state": access_state,
                 "performance": performance,
                 "player_limit": {"java": java_player_limit, "xbox_friends": xbox_player_limit},
                 "admin_operator": admin_operator,
                 "admin_player_file_exists": admin_player_file_exists,
-                "bot_username": BOT_USERNAME,
-                "bot_display_name": "Naldo Bot",
-                "bedrock_protocol": BEDROCK_PROTOCOL,
-                "bedrock_version": BEDROCK_VERSION,
-                "microsoft_login_url": login_url,
-                "microsoft_device_code": device_code,
-                "processes": processes,
-                "log_tail": log,
-            }
-
-
-STACK = MinecraftStack()
+                "bot_username": BOT_USERNAME,
+                "bot_display_name": "Naldo Bot",
+                "bedrock_protocol": BEDROCK_PROTOCOL,
+                "bedrock_version": BEDROCK_VERSION,
+                "microsoft_login_url": login_url,
+                "microsoft_device_code": device_code,
+                "processes": processes,
+                "log_tail": log,
+            }
+
+
+STACK = MinecraftStack()

naldo_opencode.py

@@ -0,0 +1,348 @@
+"""Naldo_Bot brain constants and offline-safe helpers for the OpenCode path.
+
+Only Naldo_Bot uses OpenCode. Gemini_Bot keeps its own proxy and must not
+import this module's model list as a fallback.
+
+Design notes (do not drift without updating the tests):
+- Provider is always ``opencode``. Only FREE opencode models are allowed.
+  Never Granite, Gemini, external OpenAI, Anthropic, or any other family.
+- No OPENCODE_API_KEY is required: the free opencode models work with cost 0
+  in a clean HOME. This module never reads, copies, or logs credential files.
+- ``opencode serve`` binds 127.0.0.1 only, on a dedicated internal port.
+- The bridge (naldo_opencode_bridge.py) binds 127.0.0.1 only on its own port
+  and translates OpenAI-compatible chat calls into OpenCode session calls:
+  POST /session -> POST /session/{id}/message, health via GET /global/health.
+- OpenCode session message API exposes no temperature field, so the bridge
+  cannot forward Voyager's temperature. The requested value is recorded for
+  observability; the effective sampling is the provider default.
+- OpenCode here is a TEXT GENERATOR for Voyager agents (Curriculum/Action/
+  Critic/SkillManager). In OpenCode 1.18.33, message-level ``tools: {}``
+  disables tool execution while remaining compatible with the Zen free tier.
+  Custom deny-all session permissions are intentionally not sent because Zen
+  rejects those customized sessions with FreeTierError/403.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import urllib.parse
+import urllib.request
+from pathlib import Path
+from typing import Any
+
+OPENCODE_PROVIDER = "opencode"
+OPENCODE_VERSION = "1.18.33"
+OPENCODE_NPM_SPEC = "opencode-ai@1.18.33"
+
+PRIMARY_MODEL = "muse-spark-1.3-contributor-free"
+FALLBACK_MODELS: tuple[str, ...] = (
+    "muse-spark-1.3-contributor-free",
+    "fledge-alpha-free",
+    "nemotron-3-ultra-free",
+)
+ALLOWED_MODELS = frozenset(FALLBACK_MODELS)
+
+BRAIN_PROFILE = "naldo-opencode"
+
+RUNTIME_HOME = Path(os.environ.get("VOYAGER_RUNTIME_HOME", "/tmp/voyager-runtime"))
+OPENCODE_INSTALL_DIR = Path(os.environ.get("OPENCODE_INSTALL_DIR", str(RUNTIME_HOME / "opencode-cli")))
+OPENCODE_HOME_DIR = Path(os.environ.get("OPENCODE_HOME_DIR", str(RUNTIME_HOME / "opencode-home")))
+OPENCODE_SESSION_DIR = Path(os.environ.get("OPENCODE_SESSION_DIR", str(RUNTIME_HOME / "opencode-sessions")))
+
+OPENCODE_PORT = int(os.environ.get("OPENCODE_PORT", "7865"))
+BRIDGE_PORT = int(os.environ.get("NALDO_BRIDGE_PORT", "7864"))
+OPENCODE_BASE = os.environ.get("OPENCODE_BASE", f"http://127.0.0.1:{OPENCODE_PORT}").rstrip("/")
+BRIDGE_BASE = os.environ.get("NALDO_BRIDGE_BASE", f"http://127.0.0.1:{BRIDGE_PORT}/v1").rstrip("/")
+
+# Local embeddings stay on the public 7860 endpoint so SkillManager/QA keep
+# working. Only generative chat moves to the OpenCode bridge.
+LOCAL_EMBED_BASE = os.environ.get("NALDO_EMBED_BASE", "http://127.0.0.1:7860/v1").rstrip("/")
+
+FORBIDDEN_MODEL_SUBSTRINGS = (
+    "granite",
+    "gemini",
+    "gpt-",
+    "openai",
+    "anthropic",
+    "claude",
+    "qwen",
+)
+
+LOOPBACK_HOSTS = frozenset({"127.0.0.1", "localhost", "::1"})
+
+TEMPERATURE_NOTE = (
+    "OpenCode session message API exposes no temperature field; "
+    "Voyager's requested temperature is recorded but not forwarded. "
+    "Effective sampling is the opencode provider default."
+)
+
+
+def canonical_model_id(name: str) -> str:
+    """Strip an optional ``opencode/`` prefix to the bare free-model id."""
+    text = str(name or "").strip()
+    if "/" in text:
+        provider, _, model = text.partition("/")
+        if provider.strip().lower() == OPENCODE_PROVIDER:
+            return model.strip()
+        return text
+    return text
+
+
+def is_allowed_model(name: str) -> bool:
+    """True only for FREE models of the ``opencode`` provider."""
+    text = str(name or "").strip()
+    if not text:
+        return False
+    lowered = text.lower()
+    for forbidden in FORBIDDEN_MODEL_SUBSTRINGS:
+        if forbidden in lowered:
+            return False
+    if "/" in text:
+        provider, _, model = text.partition("/")
+        if provider.strip().lower() != OPENCODE_PROVIDER:
+            return False
+        return model.strip() in ALLOWED_MODELS
+    return text in ALLOWED_MODELS
+
+
+def is_loopback_url(url: str) -> bool:
+    try:
+        host = (urllib.parse.urlparse(url).hostname or "").lower()
+    except Exception:
+        return False
+    return host in LOOPBACK_HOSTS
+
+
+def _content(value: Any) -> str:
+    if value is None:
+        return ""
+    if isinstance(value, str):
+        return value
+    if isinstance(value, list):
+        parts: list[str] = []
+        for item in value:
+            if isinstance(item, dict):
+                text = item.get("text")
+                if isinstance(text, str):
+                    parts.append(text)
+            elif isinstance(item, str):
+                parts.append(item)
+        return "\n".join(parts)
+    return str(value)
+
+
+def build_opencode_prompt(messages: list[dict[str, Any]]) -> dict[str, str]:
+    """Render OpenAI-style messages into a deterministic role-tagged prompt.
+
+    System messages go to the OpenCode ``system`` field AND stay tagged in the
+    prompt body so role boundaries survive a single-text-part transport.
+    tool_calls/tool outputs are rendered as inert text; they are never
+    executed. OpenCode tools stay disabled server-side.
+    """
+    systems: list[str] = []
+    rendered: list[str] = []
+    has_tool_traffic = False
+    for raw in messages or []:
+        if not isinstance(raw, dict):
+            continue
+        role = str(raw.get("role", "user")).upper()
+        body = _content(raw.get("content"))
+        extra = ""
+        tool_calls = raw.get("tool_calls")
+        if isinstance(tool_calls, list) and tool_calls:
+            has_tool_traffic = True
+            try:
+                extra = "\n[TOOL_CALLS]\n" + json.dumps(tool_calls, ensure_ascii=False)[:4000]
+            except Exception:
+                extra = "\n[TOOL_CALLS]\n<unserializable>"
+        if raw.get("tool_call_id") or role == "TOOL":
+            has_tool_traffic = True
+        if role == "SYSTEM":
+            if body:
+                systems.append(body)
+            rendered.append(f"[SYSTEM]\n{body}{extra}")
+        else:
+            rendered.append(f"[{role}]\n{body}{extra}")
+    header = (
+        "You are the language model inside the Voyager Minecraft agent. "
+        "Follow the supplied system and user instructions exactly. "
+        "Return only the response format requested by the final prompt; no wrapper commentary. "
+        "OpenCode tools are disabled; you are a text generator, not a file/shell executor."
+    )
+    if has_tool_traffic:
+        header += (
+            " Note: any TOOL_CALLS/TOOL sections above are rendered as inert text "
+            "from the client; do not attempt tool calls, return plain text only."
+        )
+    system_text = "\n\n".join(systems)
+    prompt = header + "\n\n" + "\n\n".join(rendered) if rendered else header
+    return {"system": system_text, "prompt": prompt}
+
+
+def extract_assistant_text(payload: Any) -> str:
+    """Return only assistant ``text`` parts from an OpenCode message result."""
+    parts: Any = None
+    if isinstance(payload, dict):
+        parts = payload.get("parts", payload.get("message", {}).get("parts") if isinstance(payload.get("message"), dict) else None)
+        if parts is None and isinstance(payload.get("info"), dict):
+            # Some shapes nest under info/parts; fall through to generic scan.
+            parts = payload.get("parts")
+    elif isinstance(payload, list):
+        parts = payload
+    if not isinstance(parts, list):
+        return ""
+    texts: list[str] = []
+    for part in parts:
+        if not isinstance(part, dict):
+            continue
+        if part.get("type") != "text":
+            continue
+        text = part.get("text")
+        if isinstance(text, str) and text:
+            texts.append(text)
+    return "".join(texts)
+
+
+def opencode_message_body(model_id: str, system: str, prompt: str) -> dict[str, Any]:
+    """Build POST /session/{id}/message body with tools blocked.
+
+    No temperature is sent: the session API has no such field (see
+    TEMPERATURE_NOTE). ``tools: {}`` disables file/shell execution.
+    """
+    body: dict[str, Any] = {
+        "model": {"providerID": OPENCODE_PROVIDER, "modelID": canonical_model_id(model_id)},
+        "tools": {},
+        "parts": [{"type": "text", "text": prompt}],
+    }
+    if system:
+        body["system"] = system
+    return body
+
+
+def opencode_binary_path(install_dir: Path = OPENCODE_INSTALL_DIR) -> Path:
+    name = "opencode.cmd" if os.name == "nt" else "opencode"
+    return install_dir / "node_modules" / ".bin" / name
+
+
+def opencode_serve_command(binary: str | Path, port: int = OPENCODE_PORT) -> list[str]:
+    return [str(binary), "serve", "--hostname", "127.0.0.1", "--port", str(port)]
+
+
+def bridge_command(port: int = BRIDGE_PORT) -> list[str]:
+    import sys
+
+    entrypoint = Path(__file__).resolve().parent / "naldo_opencode_bridge.py"
+    return [sys.executable, "-u", str(entrypoint)]
+
+
+def _http_json(
+    url: str,
+    method: str = "GET",
+    body: dict[str, Any] | None = None,
+    timeout: float = 10.0,
+) -> Any:
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    request = urllib.request.Request(url, data=data, method=method)
+    if data is not None:
+        request.add_header("Content-Type", "application/json")
+    with urllib.request.urlopen(request, timeout=timeout) as response:
+        raw = response.read().decode("utf-8", errors="replace")
+    try:
+        return json.loads(raw) if raw else {}
+    except ValueError:
+        return {"raw": raw}
+
+
+def check_opencode_health(base: str = OPENCODE_BASE, timeout: float = 5.0) -> dict[str, Any]:
+    try:
+        payload = _http_json(base.rstrip("/") + "/global/health", timeout=timeout)
+        ready = bool(isinstance(payload, dict) and payload.get("healthy") is True)
+        return {
+            "ok": ready,
+            "ready": ready,
+            "detail": payload if isinstance(payload, dict) else {"raw": str(payload)[:200]},
+        }
+    except Exception as exc:
+        return {"ok": False, "ready": False, "error": f"{type(exc).__name__}: {str(exc)[:160]}"}
+
+
+def check_bridge_health(base: str = BRIDGE_BASE, timeout: float = 5.0) -> dict[str, Any]:
+    try:
+        root = base.rstrip("/")
+        health_url = root + "/health" if root.endswith("/v1") else root + "/health"
+        # BRIDGE_BASE ends with /v1; health lives at /health (no /v1 prefix).
+        if health_url.endswith("/v1/health"):
+            health_url = health_url[: -len("/v1/health")] + "/health"
+        payload = _http_json(health_url, timeout=timeout)
+        ready = bool(isinstance(payload, dict) and payload.get("ready"))
+        return {"ok": True, "ready": ready, "detail": payload if isinstance(payload, dict) else {}}
+    except Exception as exc:
+        return {"ok": False, "ready": False, "error": f"{type(exc).__name__}: {str(exc)[:160]}"}
+
+
+def opencode_subprocess_env(
+    base_env: dict[str, str] | None = None,
+    home_dir: Path = OPENCODE_HOME_DIR,
+) -> dict[str, str]:
+    """Build an isolated child environment without inheriting OpenCode auth."""
+    env = dict(base_env if base_env is not None else os.environ)
+    config_dir = home_dir / "config"
+    data_dir = home_dir / "data"
+    for directory in (home_dir, config_dir, data_dir, OPENCODE_SESSION_DIR):
+        directory.mkdir(parents=True, exist_ok=True)
+    env.pop("OPENCODE_API_KEY", None)
+    env["HOME"] = str(home_dir)
+    env["XDG_CONFIG_HOME"] = str(config_dir)
+    env["XDG_DATA_HOME"] = str(data_dir)
+    return env
+
+
+def _probe_opencode(binary: Path, timeout: int) -> str:
+    try:
+        proc = subprocess.run(
+            [str(binary), "--version"],
+            stdout=subprocess.PIPE,
+            stderr=subprocess.STDOUT,
+            text=True,
+            timeout=timeout,
+            check=False,
+        )
+    except (OSError, subprocess.SubprocessError):
+        return ""
+    return (proc.stdout or "").strip() if proc.returncode == 0 else ""
+
+
+def ensure_opencode_installed(
+    install_dir: Path = OPENCODE_INSTALL_DIR,
+    timeout: int = 60,
+) -> tuple[str, str]:
+    """Install the pinned CLI locally; never require a global npm prefix/root."""
+    install_dir.mkdir(parents=True, exist_ok=True)
+    binary = opencode_binary_path(install_dir)
+    reported = _probe_opencode(binary, timeout)
+    if reported == OPENCODE_VERSION:
+        return str(binary), reported
+
+    npm = "npm.cmd" if os.name == "nt" else "npm"
+    proc = subprocess.run(
+        [
+            npm, "install", "--no-audit", "--no-fund",
+            "--prefix", str(install_dir), OPENCODE_NPM_SPEC,
+        ],
+        stdout=subprocess.PIPE,
+        stderr=subprocess.STDOUT,
+        text=True,
+        timeout=600,
+        check=False,
+    )
+    output = proc.stdout or ""
+    if proc.returncode != 0:
+        raise RuntimeError(f"opencode local install failed rc={proc.returncode}: {output[-2000:]}")
+    reported = _probe_opencode(binary, timeout)
+    if reported != OPENCODE_VERSION:
+        raise RuntimeError(
+            f"opencode CLI version mismatch after local install: expected={OPENCODE_VERSION!r} got={reported!r}"
+        )
+    return str(binary), reported

naldo_opencode_bridge.py

@@ -0,0 +1,321 @@
+"""OpenAI-compatible bridge for Naldo_Bot backed exclusively by OpenCode.
+
+Listens on 127.0.0.1 only. Translates POST /v1/chat/completions into the real
+OpenCode session API discovered via /doc:
+
+- POST /session -> create session (body may carry title)
+- POST /session/{sessionID}/message -> send prompt, wait for reply
+- GET /global/health -> opencode health
+
+Each inference creates a fresh session (isolated per Voyager call) and sends
+``tools: {}`` on the message. OpenCode 1.18.33 was verified to return no tool
+parts and perform no requested bash side effect in this mode. Custom deny-all
+session permissions are not used because Zen free-tier rejects them with 403.
+Only assistant ``text`` parts are returned.
+
+Temperature: OpenCode session API exposes no temperature field, so Voyager's
+requested temperature is recorded and logged, never forwarded. See
+naldo_opencode.TEMPERATURE_NOTE.
+
+Embeddings (SkillManager/QA) are NOT served here; /v1/embeddings proxies to
+the existing local 7860 endpoint to preserve upstream behavior.
+
+No OPENCODE_API_KEY is used. No credential file is read or copied. Logs never
+include prompts, completions, or credentials.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import threading
+import time
+import urllib.request
+import uuid
+from typing import Any
+
+from fastapi import FastAPI, HTTPException, Request
+from fastapi.responses import JSONResponse, StreamingResponse
+from starlette.concurrency import run_in_threadpool
+
+from naldo_opencode import (
+    ALLOWED_MODELS,
+    BRIDGE_PORT,
+    FALLBACK_MODELS,
+    LOCAL_EMBED_BASE,
+    OPENCODE_BASE,
+    OPENCODE_PROVIDER,
+    OPENCODE_SESSION_DIR,
+    PRIMARY_MODEL,
+    TEMPERATURE_NOTE,
+    build_opencode_prompt,
+    canonical_model_id,
+    extract_assistant_text,
+    is_allowed_model,
+    opencode_message_body,
+)
+
+OPENCODE = OPENCODE_BASE.rstrip("/")
+EMBED_BASE = LOCAL_EMBED_BASE.rstrip("/")
+PORT = int(os.environ.get("NALDO_BRIDGE_PORT", str(BRIDGE_PORT)))
+REQUEST_TIMEOUT = float(os.environ.get("NALDO_BRIDGE_TIMEOUT", "240"))
+SESSION_TIMEOUT = float(os.environ.get("NALDO_BRIDGE_SESSION_TIMEOUT", "15"))
+
+STATE_LOCK = threading.Lock()
+state: dict[str, Any] = {
+    "calls": 0,
+    "failures": 0,
+    "fallbacks_used": 0,
+    "last_model": None,
+    "last_fallback": None,
+    "last_elapsed_s": None,
+    "prompt_tokens": 0,
+    "completion_tokens": 0,
+    "last_error": None,
+    "last_requested_temperature": None,
+    "last_requested_max_tokens": None,
+    "effective_temperature": TEMPERATURE_NOTE,
+    "opencode_base": OPENCODE,
+}
+
+
+def _http_json(
+    url: str,
+    method: str = "GET",
+    body: dict[str, Any] | None = None,
+    timeout: float = 10.0,
+    retries: int = 2,
+) -> Any:
+    last: Exception | None = None
+    for attempt in range(retries + 1):
+        try:
+            data = json.dumps(body).encode("utf-8") if body is not None else None
+            request = urllib.request.Request(url, data=data, method=method)
+            if data is not None:
+                request.add_header("Content-Type", "application/json")
+            with urllib.request.urlopen(request, timeout=timeout) as response:
+                raw = response.read().decode("utf-8", errors="replace")
+                return json.loads(raw) if raw else {}
+        except Exception as exc:  # noqa: BLE001 - mapped to HTTP below
+            last = exc
+            if attempt < retries:
+                time.sleep(min(2.0 * (attempt + 1), 5.0))
+    raise RuntimeError(f"{type(last).__name__}: {str(last)[:200]}" if last else "request failed")
+
+
+def _create_session(model_id: str, timeout: float = SESSION_TIMEOUT) -> str:
+    model = canonical_model_id(model_id)
+    if model not in ALLOWED_MODELS:
+        raise RuntimeError(f"refusing non-OpenCode/free session model: {model_id}")
+    OPENCODE_SESSION_DIR.mkdir(parents=True, exist_ok=True)
+    session_body = {
+        "title": "naldo-voyager",
+        "model": {"id": model, "providerID": OPENCODE_PROVIDER},
+        "location": {"directory": str(OPENCODE_SESSION_DIR)},
+    }
+    payload = _http_json(
+        OPENCODE + "/session", method="POST", body=session_body, timeout=timeout, retries=0
+    )
+    session_id = ""
+    if isinstance(payload, dict):
+        session_id = str(payload.get("id") or payload.get("sessionID") or payload.get("session_id") or "")
+        info = payload.get("info")
+        if not session_id and isinstance(info, dict):
+            session_id = str(info.get("id") or "")
+    if not session_id:
+        raise RuntimeError("OpenCode session creation returned no id")
+    return session_id
+
+
+def _send_message(session_id: str, model_id: str, system: str, prompt: str) -> str:
+    body = opencode_message_body(model_id, system, prompt)
+    url = OPENCODE + f"/session/{session_id}/message"
+    try:
+        # Never retry the same generation POST: a loopback timeout can mean the
+        # first request is still running, and retrying would duplicate the turn.
+        result = _http_json(url, method="POST", body=body, timeout=REQUEST_TIMEOUT, retries=0)
+    finally:
+        try:
+            _http_json(OPENCODE + f"/session/{session_id}", method="DELETE", timeout=5.0)
+        except Exception:
+            pass
+    text = extract_assistant_text(result)
+    if not text:
+        raise RuntimeError("OpenCode returned no assistant text parts")
+    return text
+
+
+def _candidate_models(requested: str) -> list[str]:
+    ordered: list[str] = []
+    bare_requested = canonical_model_id(requested)
+    if bare_requested in ALLOWED_MODELS:
+        ordered.append(bare_requested)
+    for model in FALLBACK_MODELS:
+        if model not in ordered:
+            ordered.append(model)
+    return ordered
+
+
+def _chat_payload(body: dict[str, Any]) -> dict[str, Any]:
+    requested_model = str(body.get("model") or PRIMARY_MODEL)
+    if not is_allowed_model(requested_model):
+        raise ValueError(f"Unknown model for Naldo OpenCode bridge: {requested_model}")
+    requested_temp = body.get("temperature")
+    requested_max_tokens = body.get("max_tokens", body.get("max_completion_tokens"))
+    with STATE_LOCK:
+        state["last_requested_temperature"] = requested_temp
+        state["last_requested_max_tokens"] = requested_max_tokens
+        state["effective_temperature"] = TEMPERATURE_NOTE
+    if isinstance(requested_temp, (int, float)) and float(requested_temp) != 0.0:
+        # Voyager normally sends temperature 0; OpenCode session API has no
+        # temperature parameter, so record drift without inventing support.
+        print(
+            f"[naldo-bridge] requested temperature={requested_temp}; {TEMPERATURE_NOTE}",
+            flush=True,
+        )
+    # max_tokens is also not supported by the OpenCode session endpoint. Keep
+    # it only as telemetry: never character-truncate JavaScript/JSON responses.
+    rendered = build_opencode_prompt(body.get("messages") or [])
+
+    last_error = "OpenCode inference failed"
+    tried: list[str] = []
+    for model_id in _candidate_models(requested_model):
+        tried.append(model_id)
+        started = time.monotonic()
+        try:
+            session_id = _create_session(model_id)
+            answer = _send_message(session_id, model_id, rendered["system"], rendered["prompt"])
+        except Exception as exc:  # noqa: BLE001 - retried across free models
+            last_error = f"{type(exc).__name__}: {str(exc)[:200]}"
+            continue
+        elapsed = round(time.monotonic() - started, 2)
+        with STATE_LOCK:
+            state["calls"] += 1
+            state["last_model"] = model_id
+            state["last_elapsed_s"] = elapsed
+            state["last_error"] = None
+            if model_id != canonical_model_id(requested_model):
+                state["fallbacks_used"] += 1
+                state["last_fallback"] = model_id
+            else:
+                state["last_fallback"] = None
+        return {
+            "id": "chatcmpl-" + uuid.uuid4().hex[:16],
+            "object": "chat.completion",
+            "created": int(time.time()),
+            "model": canonical_model_id(requested_model),
+            "choices": [
+                {"index": 0, "message": {"role": "assistant", "content": answer}, "finish_reason": "stop"}
+            ],
+            "usage": {"prompt_tokens": 0, "completion_tokens": 0, "total_tokens": 0},
+            "backend": "opencode-bridge",
+            "provider": OPENCODE_PROVIDER,
+        }
+    with STATE_LOCK:
+        state["failures"] += 1
+        state["last_error"] = f"tried={tried} last={last_error}"
+    raise RuntimeError(f"All OpenCode free models failed (tried={tried}): {last_error}")
+
+
+api = FastAPI(title="Naldo OpenCode Bridge", version="1.0.0")
+
+
+@api.get("/health")
+def health() -> dict[str, Any]:
+    try:
+        upstream = _http_json(OPENCODE + "/global/health", timeout=5.0, retries=0)
+        upstream_ok = bool(isinstance(upstream, dict) and upstream.get("healthy") is True)
+    except Exception as exc:  # noqa: BLE001 - health must not raise
+        upstream = {"error": f"{type(exc).__name__}"}
+        upstream_ok = False
+    with STATE_LOCK:
+        snapshot = dict(state)
+    return {
+        "ready": upstream_ok,
+        "bridge": "naldo-opencode",
+        "provider": OPENCODE_PROVIDER,
+        "primary_model": PRIMARY_MODEL,
+        "fallback_models": list(FALLBACK_MODELS),
+        "opencode_base": OPENCODE,
+        "opencode": {"ok": upstream_ok, "detail": "ok" if upstream_ok else upstream},
+        "temperature": TEMPERATURE_NOTE,
+        **{k: v for k, v in snapshot.items() if k != "opencode_base"},
+    }
+
+
+@api.get("/v1/models")
+def models() -> dict[str, Any]:
+    now = int(time.time())
+    return {
+        "object": "list",
+        "data": [
+            {"id": model, "object": "model", "owned_by": OPENCODE_PROVIDER}
+            for model in FALLBACK_MODELS
+        ]
+        + [
+            {"id": f"{OPENCODE_PROVIDER}/{model}", "object": "model", "owned_by": OPENCODE_PROVIDER}
+            for model in FALLBACK_MODELS
+        ],
+    }
+
+
+@api.post("/v1/chat/completions")
+async def chat(request: Request) -> Any:
+    try:
+        body = await request.json()
+    except Exception as exc:
+        raise HTTPException(status_code=400, detail=f"Invalid JSON: {str(exc)[:160]}") from exc
+    if not isinstance(body.get("messages"), list):
+        raise HTTPException(status_code=400, detail="messages must be a list")
+    requested_model = str(body.get("model") or PRIMARY_MODEL)
+    if not is_allowed_model(requested_model):
+        raise HTTPException(status_code=404, detail=f"Unknown model: {requested_model}")
+    try:
+        payload = await run_in_threadpool(_chat_payload, body)
+    except ValueError as exc:
+        raise HTTPException(status_code=404, detail=str(exc)[:200]) from None
+    except RuntimeError as exc:
+        raise HTTPException(status_code=503, detail=str(exc)[:800]) from None
+    if not body.get("stream"):
+        return JSONResponse(payload)
+    content = payload["choices"][0]["message"]["content"]
+    chunk = {
+        "id": payload["id"],
+        "object": "chat.completion.chunk",
+        "created": payload["created"],
+        "model": payload["model"],
+        "choices": [{"index": 0, "delta": {"role": "assistant", "content": content}, "finish_reason": "stop"}],
+    }
+
+    async def events():  # pragma: no cover - streaming passthrough
+        yield "data: " + json.dumps(chunk, ensure_ascii=False) + "\n\n"
+        yield "data: [DONE]\n\n"
+
+    return StreamingResponse(events(), media_type="text/event-stream")
+
+
+@api.post("/v1/embeddings")
+async def embeddings(request: Request) -> Any:
+    """Preserve local embeddings for SkillManager/QA via the 7860 endpoint."""
+    raw = await request.body()
+    forward = urllib.request.Request(
+        EMBED_BASE.rstrip("/") + "/embeddings", data=raw, method="POST"
+    )
+    forward.add_header("Content-Type", "application/json")
+    api_key = os.environ.get("API_KEY", "").strip()
+    if api_key:
+        forward.add_header("Authorization", f"Bearer {api_key}")
+    try:
+        with urllib.request.urlopen(forward, timeout=120) as response:
+            return JSONResponse(json.loads(response.read().decode("utf-8")))
+    except Exception as exc:  # noqa: BLE001 - mapped to 503 without payload
+        raise HTTPException(
+            status_code=503, detail=f"embedding backend unavailable: {type(exc).__name__}"
+        ) from None
+
+
+if __name__ == "__main__":
+    import uvicorn
+
+    # Loopback only: never expose OpenCode or this bridge externally.
+    uvicorn.run(api, host="127.0.0.1", port=PORT, log_level="warning")

tests/test_agent.py

@@ -17,8 +17,8 @@ import urllib.request
 
 import tiktoken
 
-BASE = os.environ.get("BASE", "https://erinaldordso-programa.hf.space/v1").rstrip("/")
-MODEL = os.environ.get("MODEL", "qwen3-coder-30b-a3b-instruct")
+BASE = os.environ.get("BASE", "https://erinaldordso-minecraft-friends-ai-zerogpu.hf.space/v1").rstrip("/")
+MODEL = os.environ.get("MODEL", "granite-4.0-h-tiny")
 APIKEY = os.environ.get("APIKEY", "")
 PASS, FAIL = "PASS", "FAIL"
 results = []
@@ -81,7 +81,7 @@ def main():
 
     st, models = req("GET", "/models")
     ids = [m.get("id", "") for m in models.get("data", [])]
-    check("models", st == 200 and any(MODEL in i or "qwen" in i.lower() for i in ids), f"ids={ids[:4]}")
+    check("models", st == 200 and any(MODEL in i or "granite" in i.lower() for i in ids), f"ids={ids[:4]}")
 
     st, emb = req("POST", "/embeddings", {"model": "text-embedding-ada-002", "input": ["mine wood", "craft pickaxe"]})
     vecs = emb.get("data", [])

tests/test_autonomy_stability.py

@@ -0,0 +1,157 @@
+"""Stability of autonomous operation: bounded status reads, restart backoff,
+and a single configurable local LLM path for Naldo_Bot.
+
+Offline-safe: pure stdlib plus text-level assertions on the deployment files.
+"""
+from __future__ import annotations
+
+import re
+import sys
+from pathlib import Path
+from types import SimpleNamespace
+from unittest import mock
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT))
+
+from voyager_stack import restart_backoff_after, tail_lines  # noqa: E402
+import gemini_bot_stack as gemini_module  # noqa: E402
+import minecraft_stack as mc_stack  # noqa: E402
+from minecraft_stack import _tail_lines as mc_tail_lines  # noqa: E402
+
+
+def test_tail_lines_matches_full_read_on_small_logs(tmp_path):
+    path = tmp_path / "voyager.log"
+    expected = [f"line {i} [llm_metric] payload" for i in range(500)]
+    path.write_text("\n".join(expected) + "\n", encoding="utf-8")
+    assert tail_lines(path) == expected
+    assert mc_tail_lines(path, 500) == expected
+
+
+def test_tail_lines_is_bounded_on_long_logs(tmp_path):
+    path = tmp_path / "voyager.log"
+    total = 60000
+    with path.open("w", encoding="utf-8") as fh:
+        for i in range(total):
+            fh.write(f"line {i}\n")
+    window = tail_lines(path, 20000)
+    assert len(window) == 20000
+    assert window[0] == f"line {total - 20000}"
+    assert window[-1] == f"line {total - 1}"
+    assert tail_lines(tmp_path / "missing.log") == []
+    assert mc_tail_lines(tmp_path / "missing.log") == []
+
+
+def test_restart_backoff_doubles_on_quick_crash_and_resets_when_healthy():
+    assert restart_backoff_after(5, 12.0) == 10
+    assert restart_backoff_after(60, 30.0) == 120
+    assert restart_backoff_after(120, 1.0) == 120
+    assert restart_backoff_after(120, 3600.0) == 5
+    assert restart_backoff_after(120, 600.0) == 5
+    assert restart_backoff_after(10, 599.9) == 20
+
+
+def test_both_bots_share_the_same_backoff_policy():
+    assert gemini_module.restart_backoff_after is restart_backoff_after
+    assert gemini_module.tail_lines is tail_lines
+
+
+def test_naldo_uses_only_the_configurable_local_endpoint():
+    stack = (ROOT / "voyager_stack.py").read_text(encoding="utf-8")
+    # Naldo generative brain is the loopback OpenCode bridge; 7860 stays only
+    # for local embeddings compatibility.
+    assert "NALDO_BRIDGE_BASE" in stack
+    assert "NALDO_BRAIN_PROFILE" in stack
+    assert "NALDO_PRIMARY_MODEL" in stack
+    assert "naldo-opencode" in stack or "NALDO_BRAIN_PROFILE" in stack
+    assert "granite-4.0-h-tiny" not in stack
+    runner = (ROOT / "voyager_runner.py").read_text(encoding="utf-8")
+    assert "http://127.0.0.1:7864/v1" in runner
+    assert "NALDO_BRAIN_PROFILE" in runner
+    assert "from naldo_opencode import" in runner
+    assert "naldo-granite" not in runner
+    assert "voyager.learn(reset_env=False)" in runner
+
+
+def test_no_new_direct_llm_sdk_dependency():
+    requirements = (ROOT / "requirements.txt").read_text(encoding="utf-8").lower()
+    assert "google-generativeai" not in requirements
+    assert "google-genai" not in requirements
+    assert "anthropic" not in requirements
+    assert "openai==0.28.1" in requirements
+    assert "llama-cpp-python" in requirements
+
+
+def test_local_endpoint_stays_cpu_only():
+    app = (ROOT / "app.py").read_text(encoding="utf-8")
+    assert "n_gpu_layers=0" in app
+    assert 'os.environ["CUDA_VISIBLE_DEVICES"] = ""' in app
+
+
+def test_acceptance_script_defaults_match_this_deployment():
+    agent = (ROOT / "tests" / "test_agent.py").read_text(encoding="utf-8")
+    app = (ROOT / "app.py").read_text(encoding="utf-8")
+    readme = (ROOT / "README.md").read_text(encoding="utf-8")
+    base = re.search(r'BASE = os.environ.get\("BASE", "(.*?)"\)', agent).group(1)
+    model = re.search(r'MODEL = os.environ.get\("MODEL", "(.*?)"\)', agent).group(1)
+    assert base in readme, "acceptance BASE default must be the documented Space URL"
+    assert base.endswith("/v1")
+    assert model == "granite-4.0-h-tiny"
+    assert f'"{model}"' in app or f"'{model}'" in app or model in app
+
+
+def test_boot_counters_survive_tail_window_and_reset_on_new_boot(tmp_path):
+    import inspect
+
+    # Wiring: every new minecraft boot must reset the counters.
+    assert "_reset_boot_counters" in inspect.getsource(
+        mc_stack.MinecraftStack._start_fabric
+    )
+    stack = mc_stack.MinecraftStack()
+    empty_log = tmp_path / "stack.log"
+    empty_log.write_text("log line without markers\n", encoding="utf-8")
+    with mock.patch.object(mc_stack, "_log", lambda *args, **kwargs: None), \
+         mock.patch.object(mc_stack, "LOG_PATH", empty_log):
+        stack._pump("minecraft", SimpleNamespace(stdout=[
+            "Starting minecraft server version 1.19\n",
+            "Failed to save player data for Naldo_Bot\n",
+            'java.lang.NullPointerException: Cannot read field "respawnDimension" because "player" is null\n',
+            "Failed to save player data for IffyBinkie6134\n",
+            'Done (1.234s)! For help, type "help"\n',
+        ]))
+        assert stack.failed_saves_since_boot == 2
+        assert stack.respawn_npe_since_boot == 1
+
+        stack._pump("viaproxy", SimpleNamespace(stdout=[
+            "Failed to save player data for x\n",
+        ]))
+        assert stack.failed_saves_since_boot == 2
+        assert stack.respawn_npe_since_boot == 1
+
+        # The tail window holds none of those lines, yet the counters behind
+        # the *_since_boot contract must still report them.
+        report = stack.status()
+        assert report["player_save"]["failed_saves_since_boot"] == 2
+        assert report["player_save"]["respawn_npe_since_boot"] == 1
+
+        stack._reset_boot_counters()
+        report = stack.status()
+        assert report["player_save"]["failed_saves_since_boot"] == 0
+        assert report["player_save"]["respawn_npe_since_boot"] == 0
+
+
+if __name__ == "__main__":
+    import tempfile
+
+    with tempfile.TemporaryDirectory() as tmp:
+        tmp_path = Path(tmp)
+        test_tail_lines_matches_full_read_on_small_logs(tmp_path)
+        test_tail_lines_is_bounded_on_long_logs(tmp_path)
+        test_boot_counters_survive_tail_window_and_reset_on_new_boot(tmp_path)
+    test_restart_backoff_doubles_on_quick_crash_and_resets_when_healthy()
+    test_both_bots_share_the_same_backoff_policy()
+    test_naldo_uses_only_the_configurable_local_endpoint()
+    test_no_new_direct_llm_sdk_dependency()
+    test_local_endpoint_stays_cpu_only()
+    test_acceptance_script_defaults_match_this_deployment()
+    print("PASS autonomy stability")

tests/test_naldo_opencode.py

@@ -0,0 +1,271 @@
+"""Naldo_Bot on OpenCode only: offline unit tests.
+
+No network, no model, no Minecraft. Pure stdlib plus text-level assertions
+on the deployment files.
+"""
+
+from __future__ import annotations
+
+import ast
+import sys
+from pathlib import Path
+from types import SimpleNamespace
+from unittest import mock
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT))
+
+import naldo_opencode as brain  # noqa: E402
+import naldo_opencode_bridge as bridge_module  # noqa: E402
+
+
+def test_primary_and_fallbacks_are_all_opencode_free():
+    assert brain.OPENCODE_PROVIDER == "opencode"
+    assert brain.PRIMARY_MODEL == "muse-spark-1.3-contributor-free"
+    assert brain.FALLBACK_MODELS[0] == brain.PRIMARY_MODEL
+    assert set(brain.FALLBACK_MODELS) == {
+        "muse-spark-1.3-contributor-free",
+        "fledge-alpha-free",
+        "nemotron-3-ultra-free",
+    }
+    for model in brain.FALLBACK_MODELS:
+        assert brain.is_allowed_model(model)
+        assert brain.is_allowed_model(f"opencode/{model}")
+        lowered = model.lower()
+        for forbidden in ("granite", "gemini", "gpt", "claude", "anthropic", "qwen"):
+            assert forbidden not in lowered
+
+
+def test_no_granite_gemini_fallback_anywhere():
+    for name in ("granite", "gemini", "gpt-", "anthropic", "claude"):
+        assert name not in {m.lower() for m in brain.FALLBACK_MODELS}
+    stack = (ROOT / "voyager_stack.py").read_text(encoding="utf-8")
+    assert "granite-4.0-h-tiny" not in stack, "Naldo stack must not reference Granite anymore"
+    bridge = (ROOT / "naldo_opencode_bridge.py").read_text(encoding="utf-8")
+    lowered = bridge.lower()
+    for forbidden in ("granite", "gemini", "anthropic"):
+        assert forbidden not in lowered, f"bridge leaked {forbidden}"
+    runner = (ROOT / "voyager_runner.py").read_text(encoding="utf-8")
+    # Gemini_Bot's own lock stays; Naldo's lock must not accept granite.
+    assert "naldo-granite" not in runner
+
+
+def test_brain_lock_requires_opencode_profile_base_and_models():
+    runner = (ROOT / "voyager_runner.py").read_text(encoding="utf-8")
+    assert "NALDO_BRAIN_PROFILE" in runner or "naldo-opencode" in runner
+    assert "http://127.0.0.1:7864/v1" in runner
+    assert "muse-spark-1.3-contributor-free" in runner
+    assert "_naldo_model_allowed" in runner
+    # Rejected models: granite/gemini must not pass the predicate.
+    assert not brain.is_allowed_model("granite-4.0-h-tiny")
+    assert not brain.is_allowed_model("gemini-3.5-flash-lite")
+    assert not brain.is_allowed_model("gpt-4o")
+    assert brain.is_allowed_model("fledge-alpha-free")
+    assert brain.is_allowed_model("nemotron-3-ultra-free")
+
+
+def test_bridge_formats_messages_without_confusing_roles():
+    messages = [
+        {"role": "system", "content": "You are a planner."},
+        {"role": "user", "content": "Do X"},
+        {"role": "assistant", "content": "Plan Y"},
+        {"role": "tool", "content": "tool output Z"},
+        {"role": "user", "content": "Now?", "tool_calls": [{"id": "1", "function": {"name": "f", "arguments": "{}"}}]},
+    ]
+    rendered = brain.build_opencode_prompt(messages)
+    assert "[SYSTEM]" in rendered["prompt"]
+    assert "[USER]" in rendered["prompt"]
+    assert "[ASSISTANT]" in rendered["prompt"]
+    assert "[TOOL]" in rendered["prompt"]
+    assert "You are a planner." in rendered["system"]
+    assert "TOOL_CALLS" in rendered["prompt"]
+    assert "text generator, not a file/shell executor" in rendered["prompt"]
+
+
+def test_bridge_extracts_only_text_parts():
+    payload = {
+        "info": {"role": "assistant"},
+        "parts": [
+            {"type": "reasoning", "thinking": "secret plan"},
+            {"type": "text", "text": "hello "},
+            {"type": "tool", "name": "bash", "input": "rm -rf /"},
+            {"type": "text", "text": "world"},
+        ],
+    }
+    assert brain.extract_assistant_text(payload) == "hello world"
+    assert brain.extract_assistant_text({"parts": []}) == ""
+    assert brain.extract_assistant_text({}) == ""
+
+
+def test_sessions_use_free_tier_compatible_tool_sandbox(tmp_path):
+    captured = {}
+
+    def fake_http(url, method="GET", body=None, timeout=0, retries=0):
+        captured.update({"url": url, "method": method, "body": body})
+        return {"id": "ses_test"}
+
+    with mock.patch.object(bridge_module, "OPENCODE_SESSION_DIR", tmp_path), \
+         mock.patch.object(bridge_module, "_http_json", side_effect=fake_http):
+        session_id = bridge_module._create_session("muse-spark-1.3-contributor-free")
+
+    assert session_id == "ses_test"
+    assert captured["method"] == "POST"
+    assert captured["url"].endswith("/session")
+    assert captured["body"]["model"] == {
+        "id": "muse-spark-1.3-contributor-free",
+        "providerID": "opencode",
+    }
+    assert captured["body"]["location"] == {"directory": str(tmp_path)}
+    assert "permission" not in captured["body"], "custom permissions trigger Zen free-tier 403"
+
+    message = brain.opencode_message_body("muse-spark-1.3-contributor-free", "sys", "do X")
+    assert message["tools"] == {}, "empty tools map is the verified free-tier tool sandbox"
+    assert "temperature" not in message
+
+
+def test_loopback_only():
+    assert brain.is_loopback_url(brain.OPENCODE_BASE)
+    assert brain.is_loopback_url(brain.BRIDGE_BASE)
+    assert "0.0.0.0" not in (ROOT / "naldo_opencode_bridge.py").read_text(encoding="utf-8")
+    stack = (ROOT / "voyager_stack.py").read_text(encoding="utf-8")
+    assert "opencode_serve_command(opencode_binary" in stack
+    assert 'host="127.0.0.1"' in (ROOT / "naldo_opencode_bridge.py").read_text(encoding="utf-8")
+    assert "shell=True" not in (ROOT / "naldo_opencode_bridge.py").read_text(encoding="utf-8")
+    assert "shell=True" not in (ROOT / "naldo_opencode.py").read_text(encoding="utf-8")
+    serve = brain.opencode_serve_command("/tmp/opencode-local", 7865)
+    assert serve[:3] == ["/tmp/opencode-local", "serve", "--hostname"]
+    assert "127.0.0.1" in serve
+    assert "0.0.0.0" not in serve
+
+
+def test_no_credential_dependency_or_leak(tmp_path):
+    bridge_src = (ROOT / "naldo_opencode_bridge.py").read_text(encoding="utf-8")
+    assert "auth.json" not in bridge_src
+    assert 'os.environ.get("OPENCODE_API_KEY"' not in bridge_src
+    assert 'os.environ["OPENCODE_API_KEY"]' not in bridge_src
+
+    base = {"OPENCODE_API_KEY": "must-not-survive", "PATH": "x"}
+    env = brain.opencode_subprocess_env(base, tmp_path / "home")
+    assert "OPENCODE_API_KEY" not in env
+    assert env["PATH"] == "x"
+    assert env["HOME"] == str(tmp_path / "home")
+    assert env["XDG_CONFIG_HOME"] == str(tmp_path / "home" / "config")
+    assert env["XDG_DATA_HOME"] == str(tmp_path / "home" / "data")
+    assert base["OPENCODE_API_KEY"] == "must-not-survive", "parent env must not be mutated"
+    assert "TEMPERATURE_NOTE" in (ROOT / "naldo_opencode.py").read_text(encoding="utf-8")
+
+
+def test_local_opencode_install_is_pinned_and_non_root(tmp_path):
+    calls = []
+
+    def fake_run(args, **kwargs):
+        calls.append(list(args))
+        return SimpleNamespace(returncode=0, stdout="installed")
+
+    with mock.patch.object(brain, "_probe_opencode", side_effect=["", brain.OPENCODE_VERSION]), \
+         mock.patch.object(brain.subprocess, "run", side_effect=fake_run):
+        binary, version = brain.ensure_opencode_installed(tmp_path / "cli")
+
+    assert version == brain.OPENCODE_VERSION
+    assert Path(binary) == brain.opencode_binary_path(tmp_path / "cli")
+    install = calls[0]
+    assert "-g" not in install and "--global" not in install
+    assert "--prefix" in install
+    assert install[install.index("--prefix") + 1] == str(tmp_path / "cli")
+    assert brain.OPENCODE_NPM_SPEC in install
+
+
+def test_max_tokens_is_telemetry_not_output_truncation():
+    long_answer = "function build() { return 1; }\n" * 300
+    with mock.patch.object(bridge_module, "_create_session", return_value="ses_x"), \
+         mock.patch.object(bridge_module, "_send_message", return_value=long_answer):
+        result = bridge_module._chat_payload({
+            "model": brain.PRIMARY_MODEL,
+            "messages": [{"role": "user", "content": "write program"}],
+            "temperature": 0,
+            "max_tokens": 1,
+        })
+    assert result["choices"][0]["message"]["content"] == long_answer
+    assert bridge_module.state["last_requested_max_tokens"] == 1
+
+
+def test_supervisor_start_stop_contract():
+    stack_src = (ROOT / "voyager_stack.py").read_text(encoding="utf-8")
+    for marker in (
+        "_ensure_naldo_brain",
+        "_brain_healthy",
+        "_stop_brain",
+        "brain_status",
+        "_terminate_naldo_child",
+        "ensure_opencode_installed",
+        "NALDO_BRIDGE_BASE",
+        "NALDO_BRAIN_PROFILE",
+        "NALDO_PRIMARY_MODEL",
+        "opencode_serve_command",
+        "opencode_subprocess_env",
+    ):
+        assert marker in stack_src, f"supervisor marker missing: {marker}"
+    assert "without Granite fallback" in stack_src or "without granite" in stack_src.lower()
+    tree = ast.parse(stack_src)
+    methods = set()
+    for node in ast.walk(tree):
+        if isinstance(node, ast.ClassDef) and node.name == "VoyagerStack":
+            for child in node.body:
+                if isinstance(child, (ast.FunctionDef, ast.AsyncFunctionDef)):
+                    methods.add(child.name)
+    for required in ("_ensure_naldo_brain", "_brain_healthy", "_stop_brain", "brain_status", "stop", "start_async"):
+        assert required in methods
+    assert "self.stop_event.wait(7)" in stack_src
+    assert "OpenCode/bridge died mid-run; stopping Naldo immediately" in stack_src
+    assert "opencode_serve_command(opencode_binary" in stack_src
+
+    runner_src = (ROOT / "voyager_runner.py").read_text(encoding="utf-8")
+    assert "Naldo OpenCode brain module unavailable" in runner_src
+    assert "except Exception as exc" in runner_src
+
+
+def test_supervisor_stop_terminates_all_children():
+    import voyager_stack as stack_module
+
+    stack = stack_module.VoyagerStack()
+    naldo = SimpleNamespace(poll=lambda: None, terminate=lambda: setattr(naldo, "t", True), kill=lambda: None, wait=lambda timeout=None: 0)
+    bridge = SimpleNamespace(poll=lambda: None, terminate=lambda: setattr(bridge, "t", True), kill=lambda: None, wait=lambda timeout=None: 0)
+    opencode = SimpleNamespace(poll=lambda: None, terminate=lambda: setattr(opencode, "t", True), kill=lambda: None, wait=lambda timeout=None: 0)
+    stack.proc = naldo  # type: ignore[assignment]
+    stack.bridge_proc = bridge  # type: ignore[assignment]
+    stack.opencode_proc = opencode  # type: ignore[assignment]
+    naldo.pid = 111
+    bridge.pid = 222
+    opencode.pid = 333
+    stack.stop_event.set()
+    with mock.patch.object(stack_module, "_wait_tcp", return_value=True):
+        with mock.patch.object(stack, "brain_status", return_value={"ok": True}):
+            with mock.patch.object(stack, "_mineflayer_status", return_value={"ready": False}):
+                status = stack.stop()
+    assert getattr(naldo, "t", False) is True
+    assert getattr(bridge, "t", False) is True
+    assert getattr(opencode, "t", False) is True
+    assert status["state"] == "stopped"
+
+
+def test_gemini_bot_untouched():
+    stack_src = (ROOT / "gemini_bot_stack.py").read_text(encoding="utf-8")
+    assert "7863" in stack_src
+    assert "gemini-3.5-flash-lite" in stack_src
+    assert "opencode" not in stack_src.lower()
+    assert "7864" not in stack_src
+    assert "7865" not in stack_src
+
+
+if __name__ == "__main__":
+    test_primary_and_fallbacks_are_all_opencode_free()
+    test_no_granite_gemini_fallback_anywhere()
+    test_brain_lock_requires_opencode_profile_base_and_models()
+    test_bridge_formats_messages_without_confusing_roles()
+    test_bridge_extracts_only_text_parts()
+    test_sessions_created_with_denied_permissions()
+    test_loopback_only()
+    test_no_credential_dependency_or_leak()
+    test_supervisor_start_stop_contract()
+    test_gemini_bot_untouched()
+    print("PASS naldo opencode")

voyager_runner.py

@@ -5,8 +5,6 @@ import json
 import logging
 import shutil
 import sys
-import threading
-import time
 from pathlib import Path
 
 VOYAGER_HOME = Path(os.environ.get("VOYAGER_HOME", "/tmp/voyager-runtime/Voyager"))
@@ -15,14 +13,10 @@ if str(VOYAGER_HOME) not in sys.path:
 
 from voyager import Voyager  # noqa: E402
 from voyager_verification import (
-    quarantine_invalid_skills, quarantine_placeholder_skills,
-    quarantine_template_skills, task_spec,
+    quarantine_invalid_skills, quarantine_template_skills, task_spec,
 )
 from voyager_creative_critic import VerifiedCreativeCritic
-from voyager_runtime_contract import (
-    ADAPTED_UPSTREAM_FILES, ADDED_UPSTREAM_FILES, attest_original_runtime,
-    read_divergence, record_exit as record_exit_report, write_attestation,
-)
+from voyager_runtime_contract import attest_original_runtime, write_attestation
 from voyager_metrics import attach_role_metrics
 
 
@@ -30,70 +24,47 @@ def env(name: str, default: str) -> str:
     return os.environ.get(name, default)
 
 
-def record_exit(bot_username: str, exc: BaseException) -> None:
-    """Record why this runner died, so the next restart is diagnosable.
-
-    The logic lives in voyager_runtime_contract so it can be executed by a test:
-    this module imports the pinned upstream package, which a unit test should not
-    need. Measured need: Gemini_Bot reached restart_count 9 with the only visible
-    symptom being "runner=1".
-    """
-    record_exit_report(VOYAGER_HOME, bot_username, exc)
-
-
 def main() -> None:
     from voyager_learning import refresh_learning_state, start_learning_watcher
     # Surface Mineflayer's subprocess logs as well as Python tracebacks.
     logging.basicConfig(level=logging.INFO, format="[%(name)s] %(levelname)s %(message)s")
-    model = env("VOYAGER_MODEL", "qwen3-coder-30b-a3b-instruct")
-    aux_model = env("VOYAGER_AUX_MODEL", "granite-4.0-h-tiny")
-    # Sem default local: o cérebro mudou de casa. Um fallback para
-    # http://127.0.0.1:7860/v1 apontaria para este Space, que agora roda só o
-    # servidor de Minecraft e responde 503 em /v1/embeddings. O default é o
-    # host real; o brain lock abaixo ainda derruba o processo se um deploy
-    # apontar para outro provedor.
-    base_url = env("VOYAGER_OPENAI_BASE", "https://erinaldordso-mine.hf.space/v1")
+    model = env("VOYAGER_MODEL", "muse-spark-1.3-contributor-free")
+    aux_model = env("VOYAGER_AUX_MODEL", "muse-spark-1.3-contributor-free")
+    base_url = env("VOYAGER_OPENAI_BASE", "http://127.0.0.1:7864/v1")
     api_key = env("VOYAGER_API_KEY", "local-voyager")
     ckpt_dir = env("VOYAGER_CKPT_DIR", "/persist/minecraft-friends/voyager/ckpt-20260927-flat-y64-v1")
     bot_username = env("MC_USERNAME", "Naldo_Bot")
     brain_profile = env("VOYAGER_BRAIN_PROFILE", "")
-    # Escape hatch. O lock derruba o processo quando a tupla não bate, e o
-    # watchdog reinicia em loop — um deploy ruim deixa o bot parado. Com
-    # VOYAGER_BRAIN_LOCK=off a checagem inteira é pulada, então dá para subir
-    # o bot mesmo com o cérebro remoto fora do ar.
-    brain_lock = env("VOYAGER_BRAIN_LOCK", "enforce") != "off"
     if bot_username == "Naldo_Bot":
-        # O cérebro saiu deste Space: quem serve é o Space `Erinaldordso/Mine`.
-        # A URL precisa ser a pública, porque os dois Spaces não compartilham
-        # rede. O lock continua valendo para o caso de um deploy silenciosamente
-        # apontar para outro provedor.
-        #
-        # O modelo auxiliar (QA do curriculum e descrição de skill) também vem
-        # de lá — o Mine serve os dois, para que nenhum peso de modelo sobre no
-        # Space onde roda o jogo.
-        expected = (
-            "naldo-qwen3-coder",
-            "https://erinaldordso-mine.hf.space/v1",
-            "qwen3-coder-30b-a3b-instruct",
-            "granite-4.0-h-tiny",
-        )
+        try:
+            from naldo_opencode import (
+                ALLOWED_MODELS as NALDO_ALLOWED_MODELS,
+                BRAIN_PROFILE as NALDO_BRAIN_PROFILE,
+                BRIDGE_BASE as NALDO_BRIDGE_BASE,
+                is_allowed_model as _naldo_model_allowed,
+            )
+        except Exception as exc:
+            raise RuntimeError(f"Naldo OpenCode brain module unavailable: {exc}") from exc
+        if (
+            brain_profile != NALDO_BRAIN_PROFILE
+            or base_url != NALDO_BRIDGE_BASE
+            or not _naldo_model_allowed(model)
+            or not _naldo_model_allowed(aux_model)
+        ):
+            raise RuntimeError(
+                f"Brain lock rejected {bot_username}: profile={brain_profile!r}, base={base_url!r}, "
+                f"model={model!r}, aux={aux_model!r}; Naldo requires profile={NALDO_BRAIN_PROFILE!r}, "
+                f"base={NALDO_BRIDGE_BASE!r}, models in {sorted(NALDO_ALLOWED_MODELS)} (opencode provider only)"
+            )
+        expected = None
     elif bot_username == "Gemini_Bot":
-        if env("GEMINI_BOT_BACKEND", "mine") == "mine":
-            expected = ("gemini-mine-qwen3-coder", "https://erinaldordso-mine.hf.space/v1", "qwen3-coder-30b-a3b-instruct", "granite-4.0-h-tiny")
-        else:
-            expected = ("gemini-cli", "http://127.0.0.1:7863/v1", "gemini-3.5-flash-lite", "gemini-3.5-flash-lite")
+        expected = ("gemini-cli", "http://127.0.0.1:7863/v1", "gemini-3.5-flash-lite", "gemini-3.5-flash-lite")
     else:
         expected = None
-    if expected and brain_lock and (brain_profile, base_url, model, aux_model) != expected:
+    if expected and (brain_profile, base_url, model, aux_model) != expected:
         raise RuntimeError(
             f"Brain lock rejected {bot_username}: profile={brain_profile!r}, base={base_url!r}, "
-            f"model={model!r}, aux={aux_model!r}; expected={expected!r}"
-        )
-    if expected and not brain_lock:
-        print(
-            f"[voyager] brain lock DESLIGADO (VOYAGER_BRAIN_LOCK=off); aceitando "
-            f"profile={brain_profile!r} base={base_url!r} model={model!r} aux={aux_model!r}",
-            flush=True,
+            f"model={model!r}, aux={aux_model!r}"
         )
     ckpt = Path(ckpt_dir)
     required_resume_defaults = {
@@ -236,45 +207,20 @@ def main() -> None:
         critic_agent_temperature=0,
         skill_manager_model_name=aux_model,
         skill_manager_temperature=0,
-        # Documented departure from the upstream code default (5), from the
-        # upstream FAQ: "It's highly recommended to use GPT-4 ... If you insist
-        # on using GPT-3.5, it is essential to configure it with
-        # skill_manager_retrieval_top_k <= 2 to reduce the context length of the
-        # prompt."
-        #
-        # The brain is now Qwen3-Coder-30B-A3B with a 32768-token window, so the
-        # context pressure the FAQ describes is much lower than it was at 8192.
-        # The limit is kept until a benchmark shows that retrieving more skills
-        # pays for the extra prefill; it only costs compositional reuse, not
-        # correctness. Overridable without a rebuild through VOYAGER_SKILL_TOP_K.
-        skill_manager_retrieval_top_k=int(env("VOYAGER_SKILL_TOP_K", "2")),
+        skill_manager_retrieval_top_k=5,
         openai_api_request_timeout=int(env("OPENAI_API_REQUEST_TIMEOUT", "240")),
         ckpt_dir=ckpt_dir,
         resume=resume,
     )
-    # Install the declared Critic wrapper *before* attesting. Attesting first
-    # certified the upstream CriticAgent and then replaced it, so the report
-    # named a decision method that was no longer the one being called. The
-    # attestation now resolves the wrapper's upstream delegate and attests that.
+    attestation = attest_original_runtime(voyager, VOYAGER_HOME)
     attach_role_metrics(voyager, bot_username)
     voyager.critic_agent = VerifiedCreativeCritic(voyager.critic_agent)
-    # The boot verified the real divergence against the declared contract before
-    # npm install and published the measurement. Carry it into the attestation so
-    # `checkout_verified` cannot be read as "the tree is pristine".
-    divergence = read_divergence(VOYAGER_HOME)
-    attestation = attest_original_runtime(voyager, VOYAGER_HOME)
-    attestation["declared_adapted_files"] = dict(ADAPTED_UPSTREAM_FILES)
-    attestation["declared_added_files"] = dict(ADDED_UPSTREAM_FILES)
-    attestation["measured_divergence"] = divergence
     write_attestation(env("VOYAGER_ATTESTATION_FILE", ""), attestation, bot_username)
     print(
         f"[voyager] verified original engine {attestation['upstream_commit']} for "
         f"{bot_username}; decision methods attested: "
-        f"{', '.join(attestation['decision_methods_verified'])}; declared wrappers: "
-        f"{', '.join(attestation['declared_wrappers']) or 'none'}; divergence vs the "
-        f"declared contract: {len(divergence.get('modified', []))} adapted, "
-        f"{len(divergence.get('removed', []))} removed, "
-        f"{len(divergence.get('added', []))} added",
+        f"{', '.join(attestation['decision_methods_verified'])}; official Critic with "
+        f"independent world evidence",
         flush=True,
     )
 
@@ -308,108 +254,10 @@ def main() -> None:
 
     # Supported upstream option: retain the live connection and observe every step.
     # The existing disconnect recovery and process watchdog still reconnect on failure.
-    #
-    # A transient provider failure must not tear down the Minecraft connection.
-    # Upstream learn() lets an LLM error propagate: it leaves this process, the
-    # finally block below kills the Mineflayer child, and the watchdog restarts
-    # the runner -- so the bot visibly leaves and rejoins the server on every
-    # quota blip. Measured on Gemini_Bot: three leave/rejoin cycles in 3.5
-    # minutes, each one an openai.error.ServiceUnavailableError raised from
-    # curriculum.run_qa. Retry in place with bounded backoff instead.
-    # learn(reset_env=False) keeps the live connection, and because upstream
-    # sets self.resume = True after the first call, every retry takes the soft
-    # reset path and keeps the inventory.
-    max_attempts = int(env("VOYAGER_LEARN_MAX_ATTEMPTS", "0"))  # 0 = retry until it works
-    delay = float(env("VOYAGER_LEARN_BACKOFF_SECONDS", "15"))
-    delay_cap = float(env("VOYAGER_LEARN_BACKOFF_CAP_SECONDS", "300"))
-    attempt = 0
-
-    # A watchdog for the failure mode that retry-forever hides: the process is
-    # alive, every error counter is zero, and nothing progresses because
-    # learn() is parked on a wedged dependency. Retrying cannot help there --
-    # the loop is blocked, not failing -- so the only recovery is to exit and
-    # let the supervisor start a fresh runner. Measured: the bot sat in that
-    # state for 45+ minutes with zero model calls. Progress is read from the
-    # checkpoint files (not from a log line), so it is immune to the log being
-    # absent, and the watchdog only arms once a task has actually completed,
-    # so a cold start is never killed.
-    stall_seconds = float(env("VOYAGER_STALL_SECONDS", "900"))
-
-    def _progress_fingerprint():
-        # Every file that changes when the loop advances. These are the same
-        # three voyager_learning._signature() watches, so the watchdog and the
-        # learning watcher agree on what "progress" means.
-        #
-        # Watching only completed_tasks.json made the watchdog blind to a bot
-        # that is working but failing: it would recycle a runner that was
-        # mid-attempt. A failure is progress -- the bot acted and the Critic
-        # judged -- so it resets the clock. Only a loop that does NOTHING for the
-        # whole window is a stall. A new skill counts too, because the skill
-        # library only grows when a task actually succeeded.
-        parts = []
-        for path in (
-            ckpt / "curriculum" / "completed_tasks.json",
-            ckpt / "curriculum" / "failed_tasks.json",
-            ckpt / "skill" / "skills.json",
-        ):
-            try:
-                stat = path.stat()
-                parts.append((path.name, stat.st_mtime_ns, stat.st_size))
-            except OSError:
-                parts.append((path.name, None, None))
-        return tuple(parts)
-
-    def _watch_stall():
-        last_seen = _progress_fingerprint()
-        last_change = time.time()
-        while True:
-            time.sleep(60)
-            current = _progress_fingerprint()
-            if current != last_seen:
-                last_seen = current
-                last_change = time.time()
-                continue
-            idle = time.time() - last_change
-            if idle >= stall_seconds:
-                # os._exit is deliberate: the learning thread is blocked inside
-                # a call that will not return, so a cooperative shutdown would
-                # itself hang. Exiting hard lets the Space watchdog observe it.
-                print(
-                    f"[voyager] STALL WATCHDOG: no completed task in {idle:.0f}s "
-                    f"(limit {stall_seconds:.0f}s); exiting so the supervisor can "
-                    f"restart the runner",
-                    flush=True,
-                )
-                sys.stdout.flush()
-                sys.stderr.flush()
-                os._exit(75)
-
     try:
         quarantine_invalid_skills(voyager, ckpt)
         quarantine_template_skills(voyager, ckpt)
-        quarantine_placeholder_skills(voyager, ckpt)
-        threading.Thread(target=_watch_stall, daemon=True, name="voyager-stall-watch").start()
-        while True:
-            attempt += 1
-            try:
-                voyager.learn(reset_env=False)
-                break
-            except Exception as exc:
-                if max_attempts and attempt >= max_attempts:
-                    print(
-                        f"[voyager] learning loop failed {attempt} times; giving up: "
-                        f"{type(exc).__name__}: {exc}",
-                        flush=True,
-                    )
-                    raise
-                print(
-                    f"[voyager] learning loop raised {type(exc).__name__}: {exc}; "
-                    f"keeping the Minecraft connection and retrying in {delay:.0f}s "
-                    f"(attempt {attempt})",
-                    flush=True,
-                )
-                time.sleep(delay)
-                delay = min(delay * 2, delay_cap)
+        voyager.learn(reset_env=False)
     finally:
         # Upstream's non-daemon log-monitor thread keeps Python alive after a
         # fatal curriculum error. Stop only this runner's Mineflayer child so
@@ -425,8 +273,4 @@ def main() -> None:
 
 
 if __name__ == "__main__":
-    try:
-        main()
-    except BaseException as exc:  # noqa: BLE001 - record it, then let the exit code stand
-        record_exit(os.environ.get("MC_USERNAME", "unknown"), exc)
-        raise
+    main()