The Invisible Guardian — and Bans That Finally Explain Themselves 👁️

A while ago we wrote here about child-friendly by design — reporting, feedback and a watchful eye. Honestly, the watchful eye was the weakest part of that: we could receive reports, but we could barely look into what was actually happening in a world. That's what we've been working on — with two building blocks: an observer mode for oversight, and a completely reworked ban system that finally tells affected players what's going on.

Observer mode. When a report comes in ("someone is building nonsense", "someone is writing mean things"), we can now enter that world without disturbing it. Genuinely invisible, too — not the "please don't draw me" kind that a modified game could simply ignore. The server keeps the observer entirely to itself: no avatar, no parked ship, no claimed landing pad, no descent animation, no pets, no speeder, no occupied player slot and no change to the player count. To everyone in that world, literally nobody is there. Flight passes through walls (otherwise you could never get inside a sealed-up base), creatures ignore the observer, and shooting isn't possible anyway.

Watching means watching. The observer may not touch anything in the world — with exactly one exception: they can mine blocks. That's the only lever that actually removes an offensive build from a world, and every single removal is logged. In chat the observer is muted; showing yourself deliberately takes a separate command. And a permanent SPECTATOR badge sits on screen the whole time — you should never accidentally believe you're playing normally.

Why it's built so strictly. Two decisions that are invisible from the outside but mattered to us. First: the observer role is not stored in the save game, it's recomputed from the server configuration on every join. Saves can be downloaded and re-uploaded elsewhere — a stored supervisor role would travel with them, onto machines we don't own. Second: it is not a world option. Whoever owns a world must not be able to switch off oversight of that world. Which is also why it doesn't hang off the "admin cheats" setting that worlds keep switched off by default anyway.

Finding where something happened. For that there are new commands: /players shows who's online — and everyone who has ever played on this world; /builds shows where somebody has built; /where leads you to a player; /goto jumps across planets too (the old teleport only set coordinates and dropped you on the wrong planet 🙈). On top of that, an overview page in our admin panel reads straight from the world save: players, structures and "build hotspots" — that's how you find a house someone parked in the middle of nowhere without a base core. And every changed cell now remembers who touched it last and when. Before building that in, we measured what it costs in storage: not a single extra row in the database, because storage is per cell anyway.

In private worlds too — behind a double lock. The first versions had an absurd hole: the invisible observer could only reach public, password-free worlds — precisely the ones where the least happens. Kids almost always play in private worlds whose password gets passed around a circle of friends. So oversight now reaches those as well. To keep that from becoming a back door, access is double-locked: it takes an operator account that can only be created by presenting a secret code — and the dedicated player name for it, which is reserved system-wide and which nobody else can register or play under. Miss either one and nothing happens at all.

And then the bans. This used to be handled genuinely badly: a banned account could sign in perfectly normally, and the wall only appeared when joining a world — with no reason, no date and no way to ask. From the player's side, the game was simply broken. Now the sign-in itself carries the state of things, and there's a message inbox: "your world was deleted (reason)", "your ban has been lifted". That message is written at the moment something happens — later the information no longer exists, a deleted world being, well, gone.

A time-out instead of an exile. Bans are now primarily temporary — three days by default. An expired time-out counts as "not banned" at every checkpoint, so "three days off" can never quietly turn into a permanent exclusion. The record stays for the history all the same. Reasons come as fixed categories (chat, griefing, cheating, name, other) shown translated in German and English — and if a human adds something, it appears verbatim, exactly as typed. The most important part of the whole thing: the message can name the day you're welcome back.

World owners can moderate their own world now. If you own a world, you get the same lever for your world: your own ban list, enforced just as reliably as ours. It remembers the account (so renaming doesn't help) and the in-game name (arcade guests have no account at all). You pick from a list of people who actually visited the world — typing names by hand is exactly how you end up blocking the wrong kid. And because a ban only ever decides the next join, there's kicking as well: the player lands back in the menu immediately, with a reason, in their own language. The message goes out before the connection closes — so a modified game can't just ignore it and play on.

What we deliberately did not build. The obvious move against ban evasion would be device recognition ("new account, same PC"). We rejected it, for three reasons: the identifier changes as soon as a USB stick is plugged in or Windows does a bigger update; a modified game can fake it in five minutes; and identically imaged school computers would all look the same. Plus the legal part — reading a device identifier requires consent under German law, which under-16s cannot validly give. Oversight must not turn into surveillance. And one more rule written into the code: the operator account itself can neither be banned nor kicked — otherwise oversight could be switched off from the inside.

All of this is in the code already and goes live with the next server update. We sincerely hope to need it as rarely as possible. 🌟