Fail-closed review fixes

- Modded logins are refused only when this save's dimension registry lists the primary world
- Otherwise Iris warns once and leaves routing idle
- An unreadable dimension registry counts as expecting the primary world
- A vanilla slot bound to Iris without Iris storage points at the bukkit.yml entry and /iris replace
- The refusal consequence comes from whether startup worlds exist instead of the first tick
- The first WorldLoadEvent or a hotload marks startup worlds as existing
- A failed enable on a hotload says the server keeps running
- Reconciler resolution failures report the refusal banner
- Operators get a join notice for such failures until the world loads
- The fail-closed generator is built even when the cause message cannot be read
- Tests drive Iris.onEnable for the lock, the unsupported-server lock and the rethrow
- The failed-enable teardown decision lives in FailedEnableLock with a test

adapters/modded-common/src/main/java/art/arcane/iris/modded/ModdedPrimaryWorldRouter.java

@@ -40,6 +40,7 @@ public final class ModdedPrimaryWorldRouter {
     private static final Set<UUID> inFlight = ConcurrentHashMap.newKeySet();
     private static int tickCounter = 0;
     private static volatile String loginRefusal;
+    private static volatile String absentPrimary;
 
     private ModdedPrimaryWorldRouter() {
     }
@@ -48,6 +49,7 @@ public final class ModdedPrimaryWorldRouter {
         routed.clear();
         inFlight.clear();
         loginRefusal = null;
+        absentPrimary = null;
     }
 
     /**
@@ -99,7 +101,7 @@ public final class ModdedPrimaryWorldRouter {
         NativeWorld target = ModdedDimensionManager.level(server, primary);
         if (target == null) {
             if (ModdedStartup.dimensionsRestored()) {
-                refuseLogins(server, primary);
+                judgeMissingPrimary(server, primary);
             }
             return;
         }
@@ -141,9 +143,37 @@ public final class ModdedPrimaryWorldRouter {
         });
     }
 
+    /**
+     * primaryWorld is instance-wide but the dimension it names belongs to one save. Only a save whose registry lists
+     * it expected it here, so only that save has a primary world that failed to load.
+     */
+    private static void judgeMissingPrimary(NativeModdedServer server, String primary) {
+        if (loginRefusal == null && primary.equals(absentPrimary)) {
+            return;
+        }
+        if (loginRefusal == null && !expectedInThisSave(server, primary)) {
+            absentPrimary = primary;
+            ModdedIrisLog.warn("Iris primary world '" + primary + "' from config/irisworldgen/modded.json does not"
+                    + " exist in this save, so players are not routed. Create it here with /iris world replace-overworld"
+                    + " <pack> or clear primaryWorld.");
+            return;
+        }
+        refuseLogins(server, primary);
+    }
+
+    private static boolean expectedInThisSave(NativeModdedServer server, String primary) {
+        try {
+            return ModdedDimensionRegistryStore.get(server, primary) != null;
+        } catch (RuntimeException unreadable) {
+            ModdedIrisLog.error("Iris could not read this save's dimension registry to judge primary world '"
+                    + primary + "'", unreadable);
+            return true;
+        }
+    }
+
     /**
      * Players left in the overworld would generate the terrain the primary Iris world was configured to replace, so a
-     * primary world that did not load refuses every player instead.
+     * primary world this save expected and did not load refuses every player instead.
      */
     private static void refuseLogins(NativeModdedServer server, String primary) {
         String refusal = "Iris primary world '" + primary + "' is not loaded, so this server refuses players."
@@ -152,7 +182,7 @@ public final class ModdedPrimaryWorldRouter {
             for (String line : GenerationRefusalNotice.compose(
                     "Iris refused player logins: primary world '" + primary + "' is not loaded",
                     List.of("routePlayersToPrimaryWorld sends players to '" + primary
-                            + "', which did not load at startup."),
+                            + "', which this save's dimension registry expects but did not load at startup."),
                     List.of(
                             "Players are disconnected instead of playing in the overworld, so no chunks are"
                                     + " written there.",

adapters/modded-common/src/test/java/art/arcane/iris/modded/ModdedPrimaryWorldRouterTest.java

@@ -37,7 +37,7 @@ public class ModdedPrimaryWorldRouterTest {
     }
 
     @Test
-    public void aMissingPrimaryWorldRefusesPlayersOnceStartupHasRestoredDimensions() {
+    public void aPrimaryWorldThisSaveListsButDidNotRestoreRefusesPlayers() {
         NativeModdedServer server = mock(NativeModdedServer.class);
         NativeProtocolPlayer online = mock(NativeProtocolPlayer.class);
         onlinePlayers(server, online);
@@ -45,10 +45,12 @@ public class ModdedPrimaryWorldRouterTest {
 
         try (MockedStatic<ModdedModConfig> configs = mockStatic(ModdedModConfig.class);
              MockedStatic<ModdedDimensionManager> manager = mockStatic(ModdedDimensionManager.class);
+             MockedStatic<ModdedDimensionRegistryStore> registry = mockStatic(ModdedDimensionRegistryStore.class);
              MockedStatic<ModdedStartup> startup = mockStatic(ModdedStartup.class);
              MockedStatic<ModdedIrisLog> log = mockStatic(ModdedIrisLog.class)) {
             configs.when(ModdedModConfig::get).thenReturn(routed);
             manager.when(() -> ModdedDimensionManager.level(server, PRIMARY)).thenReturn(null);
+            registry.when(() -> ModdedDimensionRegistryStore.get(server, PRIMARY)).thenReturn(persisted());
             startup.when(ModdedStartup::dimensionsRestored).thenReturn(true);
 
             evaluate(server);
@@ -63,6 +65,37 @@ public class ModdedPrimaryWorldRouterTest {
         }
     }
 
+    /**
+     * primaryWorld lives in the instance-wide modded.json, but the dimension it names lives in one save. Another
+     * save, a new world or a reset world folder never had it, so nothing failed there and nothing is refused.
+     */
+    @Test
+    public void aPrimaryWorldThisSaveNeverHadLeavesRoutingIdleWithOneWarning() {
+        NativeModdedServer server = mock(NativeModdedServer.class);
+        NativeProtocolPlayer online = mock(NativeProtocolPlayer.class);
+        onlinePlayers(server, online);
+        ModdedModConfig routed = config(true, PRIMARY);
+
+        try (MockedStatic<ModdedModConfig> configs = mockStatic(ModdedModConfig.class);
+             MockedStatic<ModdedDimensionManager> manager = mockStatic(ModdedDimensionManager.class);
+             MockedStatic<ModdedDimensionRegistryStore> registry = mockStatic(ModdedDimensionRegistryStore.class);
+             MockedStatic<ModdedStartup> startup = mockStatic(ModdedStartup.class);
+             MockedStatic<ModdedIrisLog> log = mockStatic(ModdedIrisLog.class)) {
+            configs.when(ModdedModConfig::get).thenReturn(routed);
+            manager.when(() -> ModdedDimensionManager.level(server, PRIMARY)).thenReturn(null);
+            registry.when(() -> ModdedDimensionRegistryStore.get(server, PRIMARY)).thenReturn(null);
+            startup.when(ModdedStartup::dimensionsRestored).thenReturn(true);
+
+            evaluate(server);
+            evaluate(server);
+
+            verify(online, never()).disconnect(anyString());
+            assertFalse(ModdedPrimaryWorldRouter.refuseIfUnavailable(mock(NativeProtocolPlayer.class)));
+            log.verify(() -> ModdedIrisLog.warn(argThat((String line) -> line != null && line.contains(PRIMARY))), times(1));
+            log.verify(() -> ModdedIrisLog.error(anyString()), never());
+        }
+    }
+
     /**
      * Joins are processed before the first Iris tick restores persistent dimensions, so a primary world that is
      * missing then is still loading, not broken.
@@ -100,8 +133,10 @@ public class ModdedPrimaryWorldRouterTest {
 
         try (MockedStatic<ModdedModConfig> configs = mockStatic(ModdedModConfig.class);
              MockedStatic<ModdedDimensionManager> manager = mockStatic(ModdedDimensionManager.class);
+             MockedStatic<ModdedDimensionRegistryStore> registry = mockStatic(ModdedDimensionRegistryStore.class);
              MockedStatic<ModdedStartup> startup = mockStatic(ModdedStartup.class);
              MockedStatic<ModdedIrisLog> log = mockStatic(ModdedIrisLog.class)) {
+            registry.when(() -> ModdedDimensionRegistryStore.get(server, PRIMARY)).thenReturn(persisted());
             startup.when(ModdedStartup::dimensionsRestored).thenReturn(true);
             configs.when(ModdedModConfig::get).thenReturn(routed);
             evaluate(server);
@@ -119,6 +154,38 @@ public class ModdedPrimaryWorldRouterTest {
         }
     }
 
+    /**
+     * A registry that cannot be read cannot prove the primary world was never here, so it counts as expected.
+     */
+    @Test
+    public void anUnreadableRegistryRefusesPlayersRatherThanGuessing() {
+        NativeModdedServer server = mock(NativeModdedServer.class);
+        NativeProtocolPlayer online = mock(NativeProtocolPlayer.class);
+        onlinePlayers(server, online);
+        ModdedModConfig routed = config(true, PRIMARY);
+
+        try (MockedStatic<ModdedModConfig> configs = mockStatic(ModdedModConfig.class);
+             MockedStatic<ModdedDimensionManager> manager = mockStatic(ModdedDimensionManager.class);
+             MockedStatic<ModdedDimensionRegistryStore> registry = mockStatic(ModdedDimensionRegistryStore.class);
+             MockedStatic<ModdedStartup> startup = mockStatic(ModdedStartup.class);
+             MockedStatic<ModdedIrisLog> log = mockStatic(ModdedIrisLog.class)) {
+            configs.when(ModdedModConfig::get).thenReturn(routed);
+            manager.when(() -> ModdedDimensionManager.level(server, PRIMARY)).thenReturn(null);
+            registry.when(() -> ModdedDimensionRegistryStore.get(server, PRIMARY))
+                    .thenThrow(new IllegalStateException("registry could not be read"));
+            startup.when(ModdedStartup::dimensionsRestored).thenReturn(true);
+
+            evaluate(server);
+
+            verify(online).disconnect(contains(PRIMARY));
+            assertTrue(ModdedPrimaryWorldRouter.refuseIfUnavailable(mock(NativeProtocolPlayer.class)));
+        }
+    }
+
+    private static ModdedDimensionRegistryStore.PersistentDimension persisted() {
+        return new ModdedDimensionRegistryStore.PersistentDimension(PRIMARY, "overworld", "overworld", 1337L);
+    }
+
     private static void evaluate(NativeModdedServer server) {
         for (int tick = 0; tick < TICK_INTERVAL; tick++) {
             ModdedPrimaryWorldRouter.tick(server);