401U · Oct 3, 2026 · Oct 3, 2026 · Oct 4, 2026 · Oct 4, 2026
diff --git a/.gitignore b/.gitignore
@@ -1,4 +1,9 @@
 .idea
+.venv/
+.venv-*/
+.pytest_cache/
+isolated-mcdr.log
+rendered-*.txt
 *.mcdr
 *.pyz
 */__pycache__/
diff --git a/README.md b/README.md
@@ -13,13 +13,13 @@
 
 1. 配置一个MCDR实例(包括MC服务端)并加入此插件, 将其启动
 
-2. 依照 (配置选项)[## 配置选项] 修改主体插件配置, **特别是自动检测挂载点的配置**, 然后重载此插件(使用指令`!!mount -r`即可)
+2. 依照 [配置选项](#配置选项) 修改主体插件配置, **特别是自动检测挂载点的配置**, 然后重载此插件(使用指令`!!mount -r`即可，需要 MCDR 3 级权限)
 
-3. 修改在第二步配置的`overwrite_name`文件, 建议添加服务器端口和RCON相关配置来获取一致的体验
+3. 修改在第二步配置的`overwrite_path`所指文件, 建议添加服务器端口和RCON相关配置来获取一致的体验
 
-4. 在第二步配置的自动检测目录中, 放入更多MC服务端实例, 然后可以游戏内输入`!!mount -l`查看并修改相关配置选项, 在修改完毕之后将`人工检查`项设置为`True`
+4. 在第二步配置的自动检测目录中, 放入更多MC服务端实例，重载后输入`!!mount -l`查看。检查各实例的`mountable.json`；游戏内用`!!mount --config <完整路径>`查看或修改配置需要 MCDR 3 级权限。确认配置后将`checked`设置为`true`
 
-5. 此时重新输入`!!mount -l` 即可看到人工检查通过的服务端处于可用状态, 挂载即可
+5. 重新输入`!!mount -l`查看可用状态；在线玩家可点击投票切换按钮发起投票，再用带会话 ID 的赞成按钮投票。达到门槛后才执行切换
 
 6. 更多指令, 可在游戏内输入`!!mount`获取帮助信息
 
@@ -66,7 +66,8 @@
   "occupied_by": "",
   // 此挂载点的重置路径, 空或者.代表无重置路径
   "reset_path": "",
-  // 此挂载点的重置方法, full代表全部重置, region代表保留玩家信息(如跑酷记录)
+  // 仅替换reset_path模板提供的world/world_nether/world_the_end；缺失的世界不变
+  // full替换所选整个世界；region仅保留主世界world内的playerdata/advancements/stats，下界/末地仍整世界替换
   "reset_type": "full",
   // 专为此挂载点的mcdr插件目录, 使得每个挂载点可使用专有的插件, 空或者.代表无
   "plugin_dir": "",
@@ -78,4 +79,16 @@
 ## 其他
 - 在自动检测目录的子目录下添加名为`.mount-ignore`的文件可以使该子目录免于检测
 - 通过手动修改配置文件, 可以添加任意目录的服务器作为挂载点
-- 实际配置格式均需要满足json格式，即不得包含上例中以`//`开头的注释
+- 实际配置格式均需要满足json格式，即不得包含上例中以`//`开头的注释
+
+## 投票、备份与排序升级
+
+安装包含这些功能的版本后，普通切换和重置均创建在线玩家投票：默认切换 60%、重置 100%，门槛为 `ceil(N×ratio)`；创建时冻结在线集合，发起者也须显式投票。首票不能更改，后来者不加入、离开不降低门槛；无人在线或快照不可信时拒绝发起。超时及同类投票终结后的冷却默认均为 60 秒，可配置。
+
+备份权限由`backup_permission`控制，默认 MCDR 3 级；授权者点击即执行，无投票或二次确认。运行中的服务器完全停止后，复制配置的世界及其中玩家数据，再尝试启动；原已停机则保持停机。默认备份`world`、`world_nether`、`world_the_end`，可配置相对路径；不备份插件数据，不提供恢复命令或自动清理。副本校验成功与服务器恢复启动成功分别报告。
+
+强制名单`force_players`默认空，控制台强制`force_console`默认关闭；名单不授予备份或管理取消权限。所有`force switch/reset`均须操作者本人在默认 60 秒内执行`force confirm <id>`。确认前原投票继续；目标、配置或原会话变化会使摘要失效，不能抢占执行中的操作。备份和强制入口仅向授权者显示，手动输入也会检查权限。
+
+列表默认配置顺序，置顶优先，可选可信活跃度排序；同分稳定，排序先于分页，不隐藏不可用项，统计不可信时明确降级。旧`<路径>`及`<路径> --confirm`创建切换投票；单独`--confirm`只查进度，`--reset/-rs`仍走重置投票，`!!m`别名可配置。重置失败可能留下部分替换，无自动回滚；跨实例文件占用检查不提供原子锁保证。
+
+配置、命令及迁移细节见 [迁移与命令说明](docs/migration.md)。测试层级、历史失败和未验证范围见 [验证证据](docs/verification.md)，其中测试结果不代表客户端或生产部署验收，也不表示该版本已正式发布。
diff --git a/README_en.md b/README_en.md
@@ -13,13 +13,13 @@
 
 1. Deploy a MCDR instance(with MC server), and start it with this plugin
 
-2. Edit the main config according to (Config)[## Config], then reload this plugin(by command `!!mount -r` or other command provided by MCDR)
+2. Edit the main config according to [Config](#config), then reload this plugin (`!!mount -r` requires MCDR permission level 3)
 
-3. Edit the file of `overwrite_name` which is configed at setp 2, Recommand to set up server port and rcon to get a consistent experience 
+3. Edit the file specified by `overwrite_path` in step 2. Setting server port and RCON options can provide a consistent experience
 
-4. Add more MC server into the `servers_path` at step 2, then you can use `!!mount -l` to see them and edit their config according to (Config)[## Config], finally make sure set `checked` to true
+4. Add more MC servers under `servers_path`, reload, and use `!!mount -l` to list them. Check each instance's `mountable.json`; viewing or editing configuration with `!!mount --config <full path>` requires MCDR permission level 3. Set `checked` to `true` after checking the configuration
 
-5. Type `!!mount -l` now, you can see available servers now, and then mount it
+5. Type `!!mount -l` to check availability. An online player can click the vote-switch button to start a vote, then explicitly vote with its session-ID Yes button. Switching runs only after the threshold is reached
 
 6. For more command, type `!!mount` in game to get help
 
@@ -66,10 +66,11 @@
   "occupied_by": "",
   // reset path for this server, '' and '.' means empty
   "reset_path": "",
-  // reset method, full for reset all, region for keep up player data(e.g. Parkour record)
+  // Only replace world/world_nether/world_the_end provided by reset_path; missing worlds stay unchanged
+  // full replaces entire selected worlds; region preserves only main-world playerdata/advancements/stats; selected Nether/End worlds are replaced entirely
   "reset_type": "full",
   // mcdr plugin dir for this server, '' and '.' means empty
-  "plugin_dir": ""，
+  "plugin_dir": "",
   "stats": {
     // Stats for this server, will generate automaticaly
   }
@@ -78,4 +79,16 @@
 ## Other
 - add file with name `.mount-ignore` under folder in auto-detect folder to not detect that folder
 - by editing config file, you can add any server in any folder as mountable server
-- the actual config file must be json format, so remove the comments starting with `//` from above config sample
+- the actual config file must be json format, so remove the comments starting with `//` from above config sample
+
+## Voting, backup and ordering upgrade
+
+After installing a version containing these features, ordinary switch/reset commands create online-player votes: defaults are 60%/100%, with a threshold of `ceil(N×ratio)` and the online electorate frozen at creation. The initiator must vote explicitly. First votes cannot change; arrivals are excluded and departures do not lower the threshold. Empty or untrusted player snapshots refuse initiation. Timeout and cooldown after each vote of the same kind ends both default to 60 seconds and are configurable.
+
+`backup_permission` defaults to MCDR level 3. Authorized backup clicks execute immediately without voting or confirmation. A running server is fully stopped before copying configured worlds and their player data, then startup is attempted; an originally stopped server stays stopped. Defaults are `world`, `world_nether`, `world_the_end`, with configurable relative paths. Plugin data, restore commands and automatic retention cleanup are excluded. Verified-copy success and server-startup success are reported separately.
+
+`force_players` defaults to empty and `force_console` to false. Force names grant neither backup nor management-cancel permission. Every `force switch/reset` requires the operator's own `force confirm <id>` within 60 seconds by default. The old vote continues before confirmation; target, configuration or old-session changes invalidate the summary. Running operations cannot be preempted. Backup/force entries are visible only to authorized users, and manually typed commands also check authorization.
+
+Lists default to configured order, with pins first and optional trusted activity sorting. Ties are stable, sorting precedes pagination, unavailable entries remain visible, and untrusted statistics trigger an explicit fallback. Legacy `<path>` and `<path> --confirm` create switch votes; bare `--confirm` only shows progress, `--reset/-rs` creates reset votes, and `!!m` is configurable. Failed resets may leave partial replacements with no automatic rollback; file-based cross-instance occupancy does not provide atomic locking.
+
+See [migration and commands](docs/migration.md) for configuration and migration details, and [verification evidence](docs/verification.md) for test layers, historical failures and unverified areas. Tests do not establish client or production acceptance or imply a formal release.