401U-8: 实现排序、权限备份与投票强制操作

[401U]

401U-11/401U-12拆分替代已就绪：

• 列表：https://github.com/FAS-Server/Mount/pull/14，head ad5929305c252214c6347607e3648fe4d5c62051，base main。
• 投票与受控操作：https://github.com/FAS-Server/Mount/pull/15，head 11a61aaaed208cc12e8c2d244f77beb4398562aa，base agent/401U-11-list。

按用户授权关闭混合PR13，保留旧分支、原head 91bd3dcee4d1c606b974fdf4d46e463da2df924a、全部评论及证据。两新PR分别待独立QA/验收，未合并发布；平台关联仍为空。新SHA三版本回归和隔离Java证据交付401U-11/12，旧Java证据仅历史。客户端、认证玩家、Paper/生产配置及既有风险继续保留。

---

Summary

Mount now routes legacy and new switch/reset commands through frozen online-player voting (60% switch, 100% reset), adds separately authorized offline backups and personally confirmed force operations, and supports pinned lists with optional trustworthy activity ordering. Request ownership, statistics, cleanup and reload handling are repaired. Backups commit only after per-file path/size/SHA-256 verification; backup clicks execute directly for authorized users.

switch/reset → frozen vote → exact target recheck → exclusive executor → recovery/cleanup
backup → permission/preflight → exclusive executor → offline copy/hash/commit → recovery
force → allowlist → owner confirmation (old vote continues) → exclusive executor

Reset broadcasts and status show mode/worlds/template and full/region player-data consequences before Yes. Creation broadcasts include actual ratio, required votes, frozen N, time and join/leave rules. Lists show pinned/current and specific availability reasons, names with duplicate-name numbering, private exact-path tokens, inactive boundary navigation, invalid-page correction and explicit activity fallback. Manual full paths remain compatible; restricted backup/force entries remain hidden. Bilingual help and migration/verification docs describe final behavior.

Evidence

• Before revision: independent acceptance at 13c36ad reproduced 8 passed / 4 failed (reset scope visibility, creation rules, list/navigation). All 12 independent assertions are retained unchanged.
• After: MCDR 2.7.0 and 2.16.0 each 66 passed on Windows/Python 3.11: original 43 + independent 12 + 11 additional semantic cases. Added coverage includes invalid pages, unavailable reasons, duplicate names/exact token targets, private paths, ordering fallback, bilingual full/region scope before buttons.
• Real MCDR subprocesses with a disposable Python vanilla-output simulator have successful English and Chinese flows on both versions, including lists, votes, other-voter reset status, spaced paths, backup, full/region reset, reload during execution and shutdown. Actual tellraw-derived text artifacts are attached to 401U-8; no client screenshot is claimed. One 2.7 Chinese final-batch run completed operations/bye but exited nonzero; two reruns passed. This intermittent exit is recorded and not treated as proven stable.
• Reproduction and limitations: docs/verification.md, docs/migration.md. No CI workflow or credential scope changes.

Merge Danger

Door: one-way for executed world resets; code changes can be reverted.

Blast Radius: instance. Voting intentionally changes old switch/reset behavior; backups briefly stop a running server. The deployed MCDR version is confirmed as 2.14.0. QA isolated real Java evidence covers 19 assertions at f981c3f and is reused because product files are unchanged; authenticated players/clients, Paper, production configuration and localized/custom output remain unverified. Existing cross-instance occupied_by TOCTOU remains; partial reset failures can need manual recovery. The known artifact-v3/workflow-scope packaging limitation remains. No merge, release, EULA acceptance or production-world operations were performed.

401U-8 MCDR 2.14 test compatibility revision

command_root now uses the real _entry_execute result: 2.14 callbacks run synchronously (None), while 2.16 returned executions use DirectCallbackInvoker; 2.7 keeps its execute API. Only tests/test_commands_stats.py changed; no parser mock, assertion weakening or conditional skips.

Before at f981c3f: 2.14 original suite 62 passed / 4 failed (callback module import). After at 7d8d83b: MCDR 2.7.0, 2.14.0 and 2.16.0 each 66 passed; 2.14 QA's original additional 11 passed. Python 3.11.16 / Windows; complete separate stdout/stderr, commands and capture/test exit codes are attached to 401U-8. Product files are identical to f981c3f, so the existing QA real Java 2.14 evidence (19 assertions, prior SHA) is reused; Java was not rerun in this test-only revision. Authenticated client acceptance remains external. Historical bye/nonzero-exit cause remains unlocated.

401U-8 documentation correction

At 91bd3dc, only README.md, README_en.md, docs/migration.md and docs/verification.md changed. Bilingual setup now uses overwrite_path, valid config links and JSON punctuation, explicit vote initiation and admin configuration permissions. Reset wording matches the three template-provided worlds and the exact main-world region preservation scope. Feature descriptions cover actual permissions, offline backup/recovery reporting, frozen thresholds, personal force confirmation and legacy migration. Verification records distinguish historical failures/simulator runs, the 2.14 manager rerun, old-SHA Java evidence and unverified clients/production. Product and test files are unchanged from 7d8d83b. README JSON examples (comments removed), local links/anchors, document-only scope and git diff --check pass; no tests or Java were rerun for this documentation-only revision. Implementation mapping and the full diff are attached to 401U-8 for the project manager's review. Multica PR association remains a separate unresolved owner action.

[401U]

401U-11/401U-12拆分替代已就绪：

• 列表：https://github.com/FAS-Server/Mount/pull/14，head ad5929305c252214c6347607e3648fe4d5c62051，base main。
• 投票与受控操作：https://github.com/FAS-Server/Mount/pull/15，head 11a61aaaed208cc12e8c2d244f77beb4398562aa，base agent/401U-11-list。

按用户授权关闭混合PR13，保留旧分支、原head 91bd3dcee4d1c606b974fdf4d46e463da2df924a、全部评论及证据。两新PR分别待独立QA/验收，未合并发布；平台关联仍为空。新SHA三版本回归和隔离Java证据交付401U-11/12，旧Java证据仅历史。客户端、认证玩家、Paper/生产配置及既有风险继续保留。