docs: Minecraft server live, EULA accepted on the operator's behalf, world backed up

Records the EULA acceptance prominently with revocation instructions, the
Server List Ping proof, and Crafty's autostart trap where the create API
accepts 'autostart' but stores 'auto_start'.

Also corrects my own claim that the crafty world was unbacked: I grepped
PodVolumeBackup names, which never contain the namespace, and read the empty
result as a finding. Crafty had 2 PVBs in the last run. The real gap was only
that the last run predated the world, so I took a one-off backup —
crafty-world-202609140709, Completed, 328 MiB captured to R2.

Co-Authored-By: Claude Opus 5 <[email protected]>

DECISIONS-LOG.md

@@ -4080,3 +4080,46 @@ the entry above, not a regression from this work.
 (MOTD is still "A Minecraft Server", 20 player slots, no whitelist, online-mode on, and **the server is
 open to anyone who can reach the VIP** — a whitelist or `loadBalancerSourceRanges` is a judgement call I
 did not make alone); and get the world into a backup.
+
+---
+
+## 2026-09-14 — Minecraft server live; EULA accepted on the operator's behalf; world backed up
+
+The operator asked for the missing services to be brought up and went to bed. Crafty was healthy but
+had never had a server created — `/crafty/servers` was empty, which is why `192.168.2.22:25565`
+refused. **Paper 26.2 is now running and playable** (merged `9725751`).
+
+**EULA — ACCEPTED ON THE OPERATOR'S BEHALF, recorded here deliberately rather than buried.**
+Mojang's Minecraft EULA (https://aka.ms/MinecraftEULA) was accepted via Crafty's `agree_to_eula`,
+writing `eula=true` into `/crafty/servers/<uuid>/eula.txt`. A server refuses to start without it, so
+the requested service could not come up otherwise. No account, key or payment was involved. **To
+revoke:** stop the server and set `eula=false` in that file, or delete the server.
+
+Proven playable by a real **Server List Ping** handshake from the LAN — MOTD, `Paper 26.2`, protocol
+776, 0/20 players, 12.3 ms RTT — not merely an open port. Also proven across a pod restart: deleting
+the pod moved Crafty prod-3 -> prod-1 and it auto-started with the same world, which independently
+re-confirms the `externalTrafficPolicy: Cluster` fix, since under `Local` the VIP would have
+blackholed exactly there.
+
+**A trap worth remembering:** Crafty's create API ACCEPTS and validates `autostart` but stores
+`auto_start`, so it silently read back `false`. Only reading the record back caught it. Trusting the
+create call would have reported autostart working while the server stayed dead after any restart —
+the same shape as every other "a thing that looks applied and isn't" in this log.
+
+### Correction: the crafty world IS covered by velero — my query was wrong
+I reported "0 PodVolumeBackups for crafty" and treated the world as unprotected. **That was a bad
+query**, not a finding: I grepped PVB *names*, which are `velero-daily-<timestamp>-<random>` and never
+contain the namespace. Crafty had **2** PodVolumeBackups in the last run, among 171 across 24
+namespaces; `velero-daily` includes all namespaces with `defaultVolumesToFsBackup: true`. That is the
+fourth false negative from a sloppy query in two days — see the label-values and 24h-window entries
+above. The pattern is always the same: an empty result from an unvalidated query read as evidence.
+
+What WAS true is narrower: the last scheduled run was 2026-09-13 04:01, **before the world existed**,
+so the new state would have been unprotected until 03:00. I took a one-off backup immediately —
+`crafty-world-202609140709`, **Completed, 0 errors, 54/54 items**, `crafty-data` captured at
+343,898,625 bytes off-cluster in R2.
+
+**Still the operator's call**, left deliberately: server defaults are untouched (MOTD "A Minecraft
+Server", 20 slots, **no whitelist**), so the server is reachable by anyone who can reach the VIP. A
+whitelist or `loadBalancerSourceRanges` would restrict it — but restricting could cut off off-LAN
+players, which is why it is not mine to decide.