fix(lobby): 大厅变成安全的中转大厅并提示 /menu，大厅上限 200、登录门不限人数

deploy/limbo/README.md

@@ -116,6 +116,10 @@ LOOHP/Limbo would otherwise default to `30000`, unreachable through the Velocity
 idempotent, so a persisted world volume keeps all its other `server.properties`
 settings. Do **not** override `FELIS_GAME_PORT` except in lockstep with the operator.
 
+It also pins `max-players=-1` (no cap, Limbo's own default): unbound players wait at
+the gate for up to ten minutes and a stopped server's players all fall back here at
+once, so a cap left on the volume would turn players away at the door.
+
 ## Configure (deployer's responsibility)
 
 One setting this image does **not** guess (it keeps the release's own default):

deploy/limbo/entrypoint.sh

@@ -61,7 +61,11 @@ set_prop() {
     # The secret is base64/hex-ish, but a '/' or '&' would still break a bare sed s///.
     # '|' as the delimiter plus escaping it is enough for every value we write.
     esc=$(printf '%s' "$2" | sed 's/[|\\&]/\\&/g')
-    sed -i "s|^$1=.*|$1=${esc}|" "$PROPS"
+    # Through a temp file rather than sed -i, which BSD sed reads differently, so the
+    # same function runs under the entrypoint tests on any machine.
+    sed "s|^$1=.*|$1=${esc}|" "$PROPS" > "$PROPS.tmp"
+    cat "$PROPS.tmp" > "$PROPS"
+    rm -f "$PROPS.tmp"
   else
     printf '%s=%s\n' "$1" "$2" >> "$PROPS"
   fi
@@ -75,6 +79,11 @@ set_prop bungeecord false
 set_prop bungee-guard false
 set_prop velocity-modern true
 set_prop forwarding-secrets "$SECRET"
+# Unbound players wait here for up to ten minutes, and a stopped server's players all
+# fall back here at once, so the gate must never be full. -1 (no cap) is Limbo's own
+# default; it is pinned so a hand-edited properties file on the volume cannot bring
+# a cap back.
+set_prop max-players -1
 
 echo "felis-limbo: server-port=${PORT}, velocity-modern=true (forwarding secret loaded, UUIDs are Mojang-verified)"
 JAVA_MEMORY_ARG=""

deploy/lobby/README.md

@@ -46,3 +46,25 @@ sudo felis setup
 - Align `online-mode` / player forwarding with the off-cluster Velocity proxy.
 - The lobby speaks only the `felis:control` plugin-message channel; it holds no
   felis-api token by design (spec §12).
+
+## What the lobby allows
+
+felis-paper's `LobbyGuard` keeps the lobby a hub that nobody can hurt, get hurt in,
+or leave a mark on:
+
+- every world is peaceful, with natural spawning, PvP, mob griefing and TNT off,
+  time frozen at noon, clear weather and inventories kept;
+- players take no damage and never go hungry; a fall into the void lands at spawn;
+- a player without `felis.lobby.build` joins at spawn in adventure mode and cannot
+  break or place blocks, use buckets, trample farmland, light fires, or harm mobs,
+  item frames, paintings, armor stands or vehicles. Buttons, doors, pressure plates
+  and containers keep working;
+- every join gets a chat line with a click that runs `/menu`.
+
+`felis.lobby.build` defaults to ops. To let an admin build the lobby, grant it with
+LuckPerms (`lp user <name> permission set felis.lobby.build true` on the lobby console)
+or op them.
+
+The entrypoint pins `max-players=200` on every boot, over Paper's default of 20: every
+authenticated player passes through here, and a stopped server's players arrive all at
+once.

deploy/lobby/entrypoint.sh

@@ -57,7 +57,11 @@ set_prop() {
     # otherwise corrupt this bare sed s||| and silently break the key. Same escaping as
     # deploy/limbo — without it an unlucky password kills the console/permission channel.
     esc=$(printf '%s' "$2" | sed 's/[|\\&]/\\&/g')
-    sed -i "s|^$1=.*|$1=${esc}|" "$PROPS"
+    # Through a temp file rather than sed -i, which BSD sed reads differently, so the
+    # same function runs under the entrypoint tests on any machine.
+    sed "s|^$1=.*|$1=${esc}|" "$PROPS" > "$PROPS.tmp"
+    cat "$PROPS.tmp" > "$PROPS"
+    rm -f "$PROPS.tmp"
   else
     printf '%s=%s\n' "$1" "$2" >> "$PROPS"
   fi
@@ -66,6 +70,14 @@ set_prop() {
 set_prop server-port "$PORT"
 set_prop online-mode false
 
+# Every authenticated player passes through the lobby, and a stopped server's players
+# arrive together (they fall back to the login gate, which sends them straight on).
+# Paper's default cap of 20 would turn the 21st away at the door. 200 is far above
+# what one node serves at once, and a flood beyond it is refused at the door instead
+# of running the 1Gi lobby out of memory. What the world itself allows (no damage, no
+# building, the /menu hint) is felis-paper's LobbyGuard.
+set_prop max-players 200
+
 # RCON is the control plane's write channel (spec §8 写=RCON): the operator probes it
 # for readiness and the player tally, and felis-api runs console/permission commands over
 # it. Paper only reads these three keys from server.properties, so the operator's injected