fix: strip unmodeled item components + full view-distance on join + autocomplete perms

Three tracked follow-ups (Codex reviews + wiring audit).
- items: into_validated now STRIPS unmodeled in-range components instead of
  keeping them as a trusted Opaque passthrough, so a hostile creative slot's
  malformed item_name/use_remainder bytes can never be re-emitted as trusted
  clientbound data. Component representation fields made private (OpaqueComponent
  newtype + checked ctors/accessors). (trust boundary)
- chunk streaming: a standing, non-moving player now fills to the FULL advertised
  view distance - the load diff runs every tick from the current center
  (center-out, bounded 16 cols/tick) instead of only on a position packet. No
  more small island surrounded by void.
- commands: the Brigadier graph is permission-FILTERED (predicate, not just
  level), dead-end parent literals are pruned with rebuilt child indices, and
  tab-complete ranges use char units (non-ASCII safe). (autocomplete invariants)

Gate green: fmt + clippy -D warnings + xtask generate --check + 999 tests.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: sharpian

server/app/src/command.rs

@@ -141,7 +141,7 @@ mod tests {
         let tree = build_command_tree();
 
         // An operator sees both commands and the typed `mode` argument.
-        let op = tree.to_brigadier(4);
+        let op = tree.to_brigadier(4, &|_| true);
         let op_names: Vec<&str> = op.nodes().iter().filter_map(|n| n.name()).collect();
         assert!(op_names.contains(&SPAWN_COMMAND));
         assert!(op_names.contains(&GAMEMODE_COMMAND));
@@ -157,13 +157,16 @@ mod tests {
         ));
 
         // A level-0 player sees only `/spawn`; the gated `/gamemode` subtree is gone.
-        let member = tree.to_brigadier(0);
+        let member = tree.to_brigadier(0, &|_| true);
         let member_names: Vec<&str> = member.nodes().iter().filter_map(|n| n.name()).collect();
         assert!(member_names.contains(&SPAWN_COMMAND));
         assert!(!member_names.contains(&GAMEMODE_COMMAND));
         assert!(!member_names.contains(&"mode"));
 
         // The encoded body the join kit sends therefore differs by level.
-        assert!(tree.encode_commands_body(4).len() > tree.encode_commands_body(0).len());
+        assert!(
+            tree.encode_commands_body(4, &|_| true).len()
+                > tree.encode_commands_body(0, &|_| true).len()
+        );
     }
 }

server/app/src/config.rs

@@ -50,6 +50,14 @@ const DEFAULT_SPAWN_PROTECT_RADIUS: i32 = 0;
 /// without a wall-clock wait.
 const DEFAULT_KEEP_ALIVE_INTERVAL_MS: u64 = 10_000;
 
+/// Default chunk-stream pump interval, in milliseconds.
+///
+/// How often a standing player's view is advanced toward the full advertised view
+/// distance without waiting for a movement packet. One server tick (50 ms at the
+/// 20 TPS default) keeps the backlog draining promptly while the per-pump load cap
+/// bounds the burst.
+const DEFAULT_CHUNK_STREAM_INTERVAL_MS: u64 = 50;
+
 /// Default permission level granted to a non-operator player.
 ///
 /// Zero is the vanilla "ordinary player" tier: it satisfies no operator gate, so
@@ -94,6 +102,12 @@ pub struct AppConfig {
     pub spawn_protect_bypass: Vec<String>,
     /// Interval between clientbound play-phase Keep Alive pings.
     pub keep_alive_interval: Duration,
+    /// How often a standing player's view is pumped toward the full advertised
+    /// view distance. The chunk stream otherwise only advances on a movement
+    /// packet, so without this a non-moving joiner would never receive chunks past
+    /// the initial spawn batch. Each pump is bounded by the per-update load cap, so
+    /// a short interval drains the backlog promptly without flooding the socket.
+    pub chunk_stream_interval: Duration,
     /// Names of players granted operator status (permission level 4), letting
     /// them run operator-gated commands such as `/gamemode`. Everyone else acts
     /// at [`default_permission_level`](Self::default_permission_level).
@@ -154,6 +168,7 @@ impl Default for AppConfig {
             spawn_protect_radius: DEFAULT_SPAWN_PROTECT_RADIUS,
             spawn_protect_bypass: Vec::new(),
             keep_alive_interval: Duration::from_millis(DEFAULT_KEEP_ALIVE_INTERVAL_MS),
+            chunk_stream_interval: Duration::from_millis(DEFAULT_CHUNK_STREAM_INTERVAL_MS),
             ops: Vec::new(),
             default_permission_level: DEFAULT_PERMISSION_LEVEL,
             // None = in-memory, keeping `AppConfig::default()` deterministic and
@@ -197,6 +212,8 @@ struct RawConfig {
     spawn_protect_bypass: Option<Vec<String>>,
     /// Override for [`AppConfig::keep_alive_interval`], expressed in milliseconds.
     keep_alive_interval_ms: Option<u64>,
+    /// Override for [`AppConfig::chunk_stream_interval`], expressed in milliseconds.
+    chunk_stream_interval_ms: Option<u64>,
     /// Override for [`AppConfig::ops`].
     ops: Option<Vec<String>>,
     /// Override for [`AppConfig::default_permission_level`].
@@ -256,6 +273,9 @@ impl RawConfig {
             keep_alive_interval: self
                 .keep_alive_interval_ms
                 .map_or(defaults.keep_alive_interval, Duration::from_millis),
+            chunk_stream_interval: self
+                .chunk_stream_interval_ms
+                .map_or(defaults.chunk_stream_interval, Duration::from_millis),
             ops: self.ops.unwrap_or(defaults.ops),
             default_permission_level: self
                 .default_permission_level
@@ -291,6 +311,7 @@ mod tests {
             spawn_protect_radius = 12
             spawn_protect_bypass = ["Admin", "Mod"]
             keep_alive_interval_ms = 250
+            chunk_stream_interval_ms = 33
             ops = ["Admin"]
             default_permission_level = 1
             world_dir = "/srv/world"
@@ -309,11 +330,20 @@ mod tests {
         assert_eq!(parsed.spawn_protect_radius, 12);
         assert_eq!(parsed.spawn_protect_bypass, vec!["Admin", "Mod"]);
         assert_eq!(parsed.keep_alive_interval, Duration::from_millis(250));
+        assert_eq!(parsed.chunk_stream_interval, Duration::from_millis(33));
         assert_eq!(parsed.ops, vec!["Admin"]);
         assert_eq!(parsed.default_permission_level, 1);
         assert_eq!(parsed.world_dir, Some(PathBuf::from("/srv/world")));
     }
 
+    #[test]
+    fn chunk_stream_interval_defaults_to_one_tick() {
+        let parsed = AppConfig::from_toml_str("").expect("empty config is valid");
+        // Defaults to 50 ms (one tick at 20 TPS), so a standing joiner's view is
+        // pumped toward full view distance promptly.
+        assert_eq!(parsed.chunk_stream_interval, Duration::from_millis(50));
+    }
+
     #[test]
     fn world_dir_defaults_to_in_memory() {
         let parsed = AppConfig::from_toml_str("").expect("empty config is valid");