## LeavePulse Agent 0.12.3 ### Security - **Whitelist fail-closed**: closed a critical hole where the plugin admitted everyone when the whitelist service was unreachable. The plugin now keeps the last successful snapshot and serves it as a stale cache — known players still join, unknown ones are denied — instead of disabling enforcement on refresh errors. - **Cold-start protection**: if no whitelist snapshot has ever been fetched (gateway not ready on startup, etc.), unknown players are kicked with a clear "service temporarily unavailable" message instead of being silently admitted. ### Added - New `WhitelistAccessState.SERVICE_UNAVAILABLE` state used while bootstrap has not succeeded. - `bootstrapFailed` and `staleSnapshotActive` flags exposed via `/leavepulse diagnostics` to make outage state observable. - English and Ukrainian translations for the new service-unavailable kick / restrict messages. ### Changed - `AbstractWhitelistListener.isKickMode()` / `shouldEnforce()` now also enforce while bootstrap is failed, regardless of the configured enforcement mode. - `WhitelistService.handleRefreshFailure()` no longer clears local enforcement on errors. ### Tests - New unit tests cover stale-snapshot retention, bootstrap-failure denial, and recovery after the service comes back.

## LeavePulse Agent 0.12.3 ### Security - **Whitelist fail-closed**: closed a critical hole where the plugin admitted everyone when the whitelist service was unreachable. The plugin now keeps the last successful snapshot and serves it as a stale cache — known players still join, unknown ones are denied — instead of disabling enforcement on refresh errors. - **Cold-start protection**: if no whitelist snapshot has ever been fetched (gateway not ready on startup, etc.), unknown players are kicked with a clear "service temporarily unavailable" message instead of being silently admitted. ### Added - New `WhitelistAccessState.SERVICE_UNAVAILABLE` state used while bootstrap has not succeeded. - `bootstrapFailed` and `staleSnapshotActive` flags exposed via `/leavepulse diagnostics` to make outage state observable. - English and Ukrainian translations for the new service-unavailable kick / restrict messages. ### Changed - `AbstractWhitelistListener.isKickMode()` / `shouldEnforce()` now also enforce while bootstrap is failed, regardless of the configured enforcement mode. - `WhitelistService.handleRefreshFailure()` no longer clears local enforcement on errors. ### Tests - New unit tests cover stale-snapshot retention, bootstrap-failure denial, and recovery after the service comes back.

## LeavePulse Agent 0.12.3 ### Security - **Whitelist fail-closed**: closed a critical hole where the plugin admitted everyone when the whitelist service was unreachable. The plugin now keeps the last successful snapshot and serves it as a stale cache — known players still join, unknown ones are denied — instead of disabling enforcement on refresh errors. - **Cold-start protection**: if no whitelist snapshot has ever been fetched (gateway not ready on startup, etc.), unknown players are kicked with a clear "service temporarily unavailable" message instead of being silently admitted. ### Added - New `WhitelistAccessState.SERVICE_UNAVAILABLE` state used while bootstrap has not succeeded. - `bootstrapFailed` and `staleSnapshotActive` flags exposed via `/leavepulse diagnostics` to make outage state observable. - English and Ukrainian translations for the new service-unavailable kick / restrict messages. ### Changed - `AbstractWhitelistListener.isKickMode()` / `shouldEnforce()` now also enforce while bootstrap is failed, regardless of the configured enforcement mode. - `WhitelistService.handleRefreshFailure()` no longer clears local enforcement on errors. ### Tests - New unit tests cover stale-snapshot retention, bootstrap-failure denial, and recovery after the service comes back.

## LeavePulse Agent 0.12.3 ### Security - **Whitelist fail-closed**: closed a critical hole where the plugin admitted everyone when the whitelist service was unreachable. The plugin now keeps the last successful snapshot and serves it as a stale cache — known players still join, unknown ones are denied — instead of disabling enforcement on refresh errors. - **Cold-start protection**: if no whitelist snapshot has ever been fetched (gateway not ready on startup, etc.), unknown players are kicked with a clear "service temporarily unavailable" message instead of being silently admitted. ### Added - New `WhitelistAccessState.SERVICE_UNAVAILABLE` state used while bootstrap has not succeeded. - `bootstrapFailed` and `staleSnapshotActive` flags exposed via `/leavepulse diagnostics` to make outage state observable. - English and Ukrainian translations for the new service-unavailable kick / restrict messages. ### Changed - `AbstractWhitelistListener.isKickMode()` / `shouldEnforce()` now also enforce while bootstrap is failed, regardless of the configured enforcement mode. - `WhitelistService.handleRefreshFailure()` no longer clears local enforcement on errors. ### Tests - New unit tests cover stale-snapshot retention, bootstrap-failure denial, and recovery after the service comes back.

## LeavePulse Agent 0.12.3 ### Security - **Whitelist fail-closed**: closed a critical hole where the plugin admitted everyone when the whitelist service was unreachable. The plugin now keeps the last successful snapshot and serves it as a stale cache — known players still join, unknown ones are denied — instead of disabling enforcement on refresh errors. - **Cold-start protection**: if no whitelist snapshot has ever been fetched (gateway not ready on startup, etc.), unknown players are kicked with a clear "service temporarily unavailable" message instead of being silently admitted. ### Added - New `WhitelistAccessState.SERVICE_UNAVAILABLE` state used while bootstrap has not succeeded. - `bootstrapFailed` and `staleSnapshotActive` flags exposed via `/leavepulse diagnostics` to make outage state observable. - English and Ukrainian translations for the new service-unavailable kick / restrict messages. ### Changed - `AbstractWhitelistListener.isKickMode()` / `shouldEnforce()` now also enforce while bootstrap is failed, regardless of the configured enforcement mode. - `WhitelistService.handleRefreshFailure()` no longer clears local enforcement on errors. ### Tests - New unit tests cover stale-snapshot retention, bootstrap-failure denial, and recovery after the service comes back.

## LeavePulse Agent 0.12.3 ### Security - **Whitelist fail-closed**: closed a critical hole where the plugin admitted everyone when the whitelist service was unreachable. The plugin now keeps the last successful snapshot and serves it as a stale cache — known players still join, unknown ones are denied — instead of disabling enforcement on refresh errors. - **Cold-start protection**: if no whitelist snapshot has ever been fetched (gateway not ready on startup, etc.), unknown players are kicked with a clear "service temporarily unavailable" message instead of being silently admitted. ### Added - New `WhitelistAccessState.SERVICE_UNAVAILABLE` state used while bootstrap has not succeeded. - `bootstrapFailed` and `staleSnapshotActive` flags exposed via `/leavepulse diagnostics` to make outage state observable. - English and Ukrainian translations for the new service-unavailable kick / restrict messages. ### Changed - `AbstractWhitelistListener.isKickMode()` / `shouldEnforce()` now also enforce while bootstrap is failed, regardless of the configured enforcement mode. - `WhitelistService.handleRefreshFailure()` no longer clears local enforcement on errors. ### Tests - New unit tests cover stale-snapshot retention, bootstrap-failure denial, and recovery after the service comes back.

## LeavePulse Agent 0.12.3 ### Security - **Whitelist fail-closed**: closed a critical hole where the plugin admitted everyone when the whitelist service was unreachable. The plugin now keeps the last successful snapshot and serves it as a stale cache — known players still join, unknown ones are denied — instead of disabling enforcement on refresh errors. - **Cold-start protection**: if no whitelist snapshot has ever been fetched (gateway not ready on startup, etc.), unknown players are kicked with a clear "service temporarily unavailable" message instead of being silently admitted. ### Added - New `WhitelistAccessState.SERVICE_UNAVAILABLE` state used while bootstrap has not succeeded. - `bootstrapFailed` and `staleSnapshotActive` flags exposed via `/leavepulse diagnostics` to make outage state observable. - English and Ukrainian translations for the new service-unavailable kick / restrict messages. ### Changed - `AbstractWhitelistListener.isKickMode()` / `shouldEnforce()` now also enforce while bootstrap is failed, regardless of the configured enforcement mode. - `WhitelistService.handleRefreshFailure()` no longer clears local enforcement on errors. ### Tests - New unit tests cover stale-snapshot retention, bootstrap-failure denial, and recovery after the service comes back.

## LeavePulse Agent 0.12.3 ### Security - **Whitelist fail-closed**: closed a critical hole where the plugin admitted everyone when the whitelist service was unreachable. The plugin now keeps the last successful snapshot and serves it as a stale cache — known players still join, unknown ones are denied — instead of disabling enforcement on refresh errors. - **Cold-start protection**: if no whitelist snapshot has ever been fetched (gateway not ready on startup, etc.), unknown players are kicked with a clear "service temporarily unavailable" message instead of being silently admitted. ### Added - New `WhitelistAccessState.SERVICE_UNAVAILABLE` state used while bootstrap has not succeeded. - `bootstrapFailed` and `staleSnapshotActive` flags exposed via `/leavepulse diagnostics` to make outage state observable. - English and Ukrainian translations for the new service-unavailable kick / restrict messages. ### Changed - `AbstractWhitelistListener.isKickMode()` / `shouldEnforce()` now also enforce while bootstrap is failed, regardless of the configured enforcement mode. - `WhitelistService.handleRefreshFailure()` no longer clears local enforcement on errors. ### Tests - New unit tests cover stale-snapshot retention, bootstrap-failure denial, and recovery after the service comes back.

## LeavePulse Agent 0.12.3 ### Security - **Whitelist fail-closed**: closed a critical hole where the plugin admitted everyone when the whitelist service was unreachable. The plugin now keeps the last successful snapshot and serves it as a stale cache — known players still join, unknown ones are denied — instead of disabling enforcement on refresh errors. - **Cold-start protection**: if no whitelist snapshot has ever been fetched (gateway not ready on startup, etc.), unknown players are kicked with a clear "service temporarily unavailable" message instead of being silently admitted. ### Added - New `WhitelistAccessState.SERVICE_UNAVAILABLE` state used while bootstrap has not succeeded. - `bootstrapFailed` and `staleSnapshotActive` flags exposed via `/leavepulse diagnostics` to make outage state observable. - English and Ukrainian translations for the new service-unavailable kick / restrict messages. ### Changed - `AbstractWhitelistListener.isKickMode()` / `shouldEnforce()` now also enforce while bootstrap is failed, regardless of the configured enforcement mode. - `WhitelistService.handleRefreshFailure()` no longer clears local enforcement on errors. ### Tests - New unit tests cover stale-snapshot retention, bootstrap-failure denial, and recovery after the service comes back.

## LeavePulse Agent 0.12.3 ### Security - **Whitelist fail-closed**: closed a critical hole where the plugin admitted everyone when the whitelist service was unreachable. The plugin now keeps the last successful snapshot and serves it as a stale cache — known players still join, unknown ones are denied — instead of disabling enforcement on refresh errors. - **Cold-start protection**: if no whitelist snapshot has ever been fetched (gateway not ready on startup, etc.), unknown players are kicked with a clear "service temporarily unavailable" message instead of being silently admitted. ### Added - New `WhitelistAccessState.SERVICE_UNAVAILABLE` state used while bootstrap has not succeeded. - `bootstrapFailed` and `staleSnapshotActive` flags exposed via `/leavepulse diagnostics` to make outage state observable. - English and Ukrainian translations for the new service-unavailable kick / restrict messages. ### Changed - `AbstractWhitelistListener.isKickMode()` / `shouldEnforce()` now also enforce while bootstrap is failed, regardless of the configured enforcement mode. - `WhitelistService.handleRefreshFailure()` no longer clears local enforcement on errors. ### Tests - New unit tests cover stale-snapshot retention, bootstrap-failure denial, and recovery after the service comes back.