diff --git a/commit.sh b/commit.sh
deleted file mode 100644
index e128cd7f..00000000
--- a/commit.sh
+++ /dev/null
@@ -1,22 +0,0 @@
-#!/usr/bin/env bash
-
-cd "$(dirname "$0")" || exit 1
-
-files="$(git status --porcelain | awk '{print $2}' | paste -sd' ' -)"
-
-if [ -z "$files" ]; then
-    printf "\033[0;32mNothing to commit.\033[0m\n"
-    exit 0
-fi
-
-printf "\033[0;31mAdding {%s} to git\033[0m\n" "$files"
-git add -A
-
-printf "\033[0;33mCommitting {%s} to git\033[0m\n" "$files"
-git commit -m "Auto commit $(date +%Y-%m-%d_%H:%M:%S)" || exit 1
-
-printf "\033[0;33mPushing {%s} to git\033[0m\n" "$files"
-git push || exit 1
-
-printf "\033[0;32mCommitted {%s} to git\033[0m\n" "$files"
-exit 0
\ No newline at end of file
diff --git a/datapacks/dataLib/data/datalib.main/function/datalib/load.mcfunction b/datapacks/dataLib/data/datalib.main/function/datalib/load.mcfunction
index cb8a88ed..25f6dfc9 100644
--- a/datapacks/dataLib/data/datalib.main/function/datalib/load.mcfunction
+++ b/datapacks/dataLib/data/datalib.main/function/datalib/load.mcfunction
@@ -1,7 +1,2 @@
-#> This function will run on datapack loading
-
-return run tellraw @a {"text":"[dataLib] This datapack is ARCHIVED and no longer maintained. It will NOT load. To load it anyway, manually run: function #load:_private/load","color":"red"}
-
-execute if data storage datalib:engine {global:{loaded:1b}} run return 0
-
-function #load:_private/load
+#> minecraft load tag entry
+function dl_load:main
diff --git a/datapacks/dataLib/data/datalib/function/_rt_origin.mcfunction b/datapacks/dataLib/data/datalib/function/_rt_origin.mcfunction
deleted file mode 100644
index 8e75410d..00000000
--- a/datapacks/dataLib/data/datalib/function/_rt_origin.mcfunction
+++ /dev/null
@@ -1,3 +0,0 @@
-scoreboard players set #runtoolkit.watermark datalib.meta 1
-data modify storage datalib:engine global.rt_origin_verified set value 1b
-execute if score #runtoolkit.watermark datalib.meta matches 1.. run tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"⚠ SECURITY ALERT: ","color":"red","bold":true,"hover_event":{"action":"show_text","value":"A security anomaly or policy violation was detected by the core engine."}},{"text":"Please review the latest diagnostic logs immediately. Check the ","color":"#FFAA00"},{"text":"source code","color":"aqua","underlined":true,"click_event":{"action":"open_url","url":"https://github.com/runtoolkit/dataLib-dp"},"hover_event":{"action":"show_text","value":"View repository on GitHub"}},{"text":", look at open ","color":"#FFAA00"},{"text":"issues","color":"yellow","underlined":true,"click_event":{"action":"open_url","url":"https://github.com/runtoolkit/dataLib-dp/issues"},"hover_event":{"action":"show_text","value":"Report a bug or check security advisories"}},{"text":", inspect recent ","color":"#FFAA00"},{"text":"pull requests","color":"green","underlined":true,"click_event":{"action":"open_url","url":"https://github.com/runtoolkit/dataLib-dp/pulls"},"hover_event":{"action":"show_text","value":"Review code contributions"}},{"text":", verify the latest ","color":"#FFAA00"},{"text":"releases","color":"gold","underlined":true,"click_event":{"action":"open_url","url":"https://github.com/runtoolkit/dataLib-dp/releases"},"hover_event":{"action":"show_text","value":"View changelogs and versions"}},{"text":", or consult the official ","color":"#FFAA00"},{"text":"wiki documentation","color":"#AA00FF","underlined":true,"click_event":{"action":"open_url","url":"https://github.com/runtoolkit/dataLib-dp/wiki"},"hover_event":{"action":"show_text","value":"Read the system documentation"}},{"text":" for security policies.","color":"#FFAA00"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cb/cancel.mcfunction b/datapacks/dataLib/data/datalib/function/api/cb/cancel.mcfunction
index 00932a08..a5dbfde3 100644
--- a/datapacks/dataLib/data/datalib/function/api/cb/cancel.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cb/cancel.mcfunction
@@ -10,7 +10,6 @@
 #   function datalib:api/cb/cancel
 # ─────────────────────────────────────────────────────────────────
 
-execute unless function datalib:core/security/cmd_gate run return 0
 
 data remove storage datalib:engine cb_queue
 data modify storage datalib:engine cb_queue set value []
diff --git a/datapacks/dataLib/data/datalib/function/api/cb/list.mcfunction b/datapacks/dataLib/data/datalib/function/api/cb/list.mcfunction
index 2a48b76a..354ab400 100644
--- a/datapacks/dataLib/data/datalib/function/api/cb/list.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cb/list.mcfunction
@@ -4,7 +4,6 @@
 # Shows each queued command and its remaining ticks.
 # ─────────────────────────────────────────────────────────────────
 
-execute unless function datalib:core/security/cmd_gate run return 0
 
 execute store result score #cb_queue_size dl.tmp run data get storage datalib:engine cb_queue
 execute if score #cb_queue_size dl.tmp matches 0 run tellraw @s [{"text":"[DL/cb] ","color":"#00AAAA","bold":true},{"text":"Queue is empty","color":"gray"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cb/run.mcfunction b/datapacks/dataLib/data/datalib/function/api/cb/run.mcfunction
index 022fa1fd..5ba19257 100644
--- a/datapacks/dataLib/data/datalib/function/api/cb/run.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cb/run.mcfunction
@@ -17,7 +17,6 @@
 # ─────────────────────────────────────────────────────────────────
 
 # Security gate
-execute unless function datalib:core/security/cmd_gate run return 0
 
 # Verify required input
 execute unless data storage datalib:input cb.cmd run tellraw @s [{"text":"[DL/cb] ","color":"#00AAAA","bold":true},{"text":"cb.cmd not set","color":"red"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cb/run_delayed.mcfunction b/datapacks/dataLib/data/datalib/function/api/cb/run_delayed.mcfunction
index 0c10e353..0b34ef60 100644
--- a/datapacks/dataLib/data/datalib/function/api/cb/run_delayed.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cb/run_delayed.mcfunction
@@ -17,7 +17,6 @@
 # ─────────────────────────────────────────────────────────────────
 
 # Security gate
-execute unless function datalib:core/security/cmd_gate run return 0
 
 # Verify required inputs
 execute unless data storage datalib:input cb.cmd run tellraw @s [{"text":"[DL/cb] ","color":"#00AAAA","bold":true},{"text":"cb.cmd not set","color":"red"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cb/run_sequence.mcfunction b/datapacks/dataLib/data/datalib/function/api/cb/run_sequence.mcfunction
index 8a49bf70..9d664047 100644
--- a/datapacks/dataLib/data/datalib/function/api/cb/run_sequence.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cb/run_sequence.mcfunction
@@ -18,7 +18,6 @@
 # ─────────────────────────────────────────────────────────────────
 
 # Security gate
-execute unless function datalib:core/security/cmd_gate run return 0
 
 # Verify required input
 execute unless data storage datalib:input cb.cmds[0] run tellraw @s [{"text":"[DL/cb] ","color":"#00AAAA","bold":true},{"text":"cb.cmds is empty or not set","color":"red"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/actionbar.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/actionbar.mcfunction
index 70dfe910..f281486e 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/actionbar.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/actionbar.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $execute as @a[name=$(player),limit=1] at @s run title @s actionbar {"text":"$(text)","color":"$(color)"}
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/actionbar ","color":"aqua"},{"text":"$(player)","color":"white"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/advancement_check.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/advancement_check.mcfunction
index 4e3c1270..d74f493f 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/advancement_check.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/advancement_check.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 data modify storage datalib:output result set value 0b
 $execute if entity @a[name=$(player),limit=1,advancements={$(advancement)=true}] run data modify storage datalib:output result set value 1b
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/advancement_grant.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/advancement_grant.mcfunction
index 7e12f6b9..e338c960 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/advancement_grant.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/advancement_grant.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $advancement grant @a[name=$(player),limit=1] only $(advancement)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/advancement_grant ","color":"aqua"},{"text":"$(player)","color":"white"},{"text":" → ","color":"#555555"},{"text":"$(advancement)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/advancement_revoke.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/advancement_revoke.mcfunction
index e89222e4..2a768581 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/advancement_revoke.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/advancement_revoke.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $advancement revoke @a[name=$(player),limit=1] only $(advancement)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/advancement_revoke ","color":"aqua"},{"text":"$(player)","color":"white"},{"text":" → ","color":"#555555"},{"text":"$(advancement)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/as_player.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/as_player.mcfunction
index 1889c77c..61ac7fb4 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/as_player.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/as_player.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $execute as @a[name=$(player),limit=1] at @s run $(cmd)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/as_player ","color":"aqua"},{"text":"$(player)","color":"white"},{"text":" → ","color":"#555555"},{"text":"$(cmd)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/attribute_add_modifier.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/attribute_add_modifier.mcfunction
index 422a3219..b681c56a 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/attribute_add_modifier.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/attribute_add_modifier.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $attribute @a[name=$(player),limit=1] $(attribute) modifier add $(id) $(amount) $(operation)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/attribute_add_modifier ","color":"aqua"},{"text":"$(player)","color":"white"},{"text":" → ","color":"#555555"},{"text":"$(id)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/attribute_get.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/attribute_get.mcfunction
index 45df2cc9..74774ca8 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/attribute_get.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/attribute_get.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $execute store result storage datalib:output result double 1 run attribute @a[name=$(player),limit=1] $(attribute) get
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/attribute_get ","color":"aqua"},{"text":"$(player)","color":"white"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/attribute_get_modifier.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/attribute_get_modifier.mcfunction
index 998d5a52..8fb47c67 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/attribute_get_modifier.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/attribute_get_modifier.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $execute store result storage datalib:output result double 1 run attribute @a[name=$(player),limit=1] $(attribute) modifier value get $(id)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/attribute_get_modifier ","color":"aqua"},{"text":"$(player)","color":"white"},{"text":" → ","color":"#555555"},{"text":"$(id)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/attribute_remove_modifier.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/attribute_remove_modifier.mcfunction
index 63dc59b0..4b2dd4df 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/attribute_remove_modifier.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/attribute_remove_modifier.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $attribute @a[name=$(player),limit=1] $(attribute) modifier remove $(id)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/attribute_remove_modifier ","color":"aqua"},{"text":"$(player)","color":"white"},{"text":" → ","color":"#555555"},{"text":"$(id)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/attribute_set.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/attribute_set.mcfunction
index fdad730a..d9e02055 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/attribute_set.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/attribute_set.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $execute as @a[name=$(player),limit=1] run attribute @s $(attribute) base set $(value)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/attribute_set ","color":"aqua"},{"text":"$(player)","color":"white"},{"text":" → ","color":"#555555"},{"text":"$(value)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/ban.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/ban.mcfunction
index 38aba3b8..8c234f1c 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/ban.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/ban.mcfunction
@@ -1,11 +1,2 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
-execute unless entity @s[type=minecraft:player] run return 0
-
-execute unless entity @s[gamemode=creative,tag=datalib.admin,scores={dl.perm_level=2..}] run return 0
-
-# ─────────────────────────────────────────────────────────────────
-# GATE REQUEST — Dangerous commands require admin confirmation
-# ─────────────────────────────────────────────────────────────────
-$data modify storage datalib:engine pending_gate set value {type:"ban", player:"$(player)", reason:"$(reason)"}
-function dl_load:gate/request
-$tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/ban request ","color":"aqua"},{"text":"$(player) $(reason)","color":"white"}]
+$ban $(player) $(reason)
+$tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/ban ","color":"aqua"},{"text":"$(player) $(reason)","color":"white"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/ban_ip.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/ban_ip.mcfunction
index e116a16c..25e8c7ab 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/ban_ip.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/ban_ip.mcfunction
@@ -1,11 +1,2 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
-execute unless entity @s[type=minecraft:player] run return 0
-
-execute unless entity @s[gamemode=creative,tag=datalib.admin,scores={dl.perm_level=2..}] run return 0
-
-# ─────────────────────────────────────────────────────────────────
-# GATE REQUEST — Dangerous commands require admin confirmation
-# ─────────────────────────────────────────────────────────────────
-$data modify storage datalib:engine pending_gate set value {type:"ban_ip", player:"$(player)", reason:"$(reason)"}
-function dl_load:gate/request
-$tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/ban_ip request ","color":"aqua"},{"text":"$(player) $(reason)","color":"white"}]
+$ban-ip $(player) $(reason)
+$tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/ban_ip ","color":"aqua"},{"text":"$(player) $(reason)","color":"white"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/bossbar_add.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/bossbar_add.mcfunction
index 0447727f..3eee2c1f 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/bossbar_add.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/bossbar_add.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $bossbar add $(id) {"text":"$(text)"}
 $bossbar set $(id) color $(color)
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/bossbar_remove.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/bossbar_remove.mcfunction
index 1303f414..fdfe7e46 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/bossbar_remove.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/bossbar_remove.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $bossbar remove $(id)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/bossbar_remove ","color":"aqua"},{"text":" → ","color":"#555555"},{"text":"$(id)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/bossbar_set_max.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/bossbar_set_max.mcfunction
index 09436b57..5f158091 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/bossbar_set_max.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/bossbar_set_max.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $bossbar set $(id) max $(max)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/bossbar_set_max ","color":"aqua"},{"text":" → ","color":"#555555"},{"text":"$(id)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/bossbar_set_players.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/bossbar_set_players.mcfunction
index 60590c66..ef43396f 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/bossbar_set_players.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/bossbar_set_players.mcfunction
@@ -1,3 +1,2 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $bossbar set $(id) players $(players)$tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/bossbar_set_players ","color":"aqua"},{"text":" → ","color":"#555555"},{"text":"$(id)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/bossbar_set_value.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/bossbar_set_value.mcfunction
index 934c716c..fdee01a2 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/bossbar_set_value.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/bossbar_set_value.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $bossbar set $(id) value $(value)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/bossbar_set_value ","color":"aqua"},{"text":" → ","color":"#555555"},{"text":"$(id)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/clear.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/clear.mcfunction
index b2eaddd4..bd43b5ac 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/clear.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/clear.mcfunction
@@ -1,12 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
-# ─────────────────────────────────────────────────────────────────
-# SANDBOX GUARD — dangerous commands are blocked in sandbox mode.
-# Enable:  /data modify storage datalib:engine sandbox set value 1b
-# Disable: /data modify storage datalib:engine sandbox set value 0b
-# ─────────────────────────────────────────────────────────────────
-execute if data storage datalib:engine {sandbox:1b} run data modify storage datalib:engine _sandbox_cmd set value "clear"
-execute if data storage datalib:engine {sandbox:1b} run execute unless function datalib:core/internal/api/cmd/sandbox_gate run return 0
-execute unless data storage datalib:engine {sandbox:1b} run tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"TIP ","color":"yellow","bold":true},{"text":"Sandbox mode recommended → ","color":"gray"},{"text":"/data modify storage datalib:engine sandbox set value 1b","color":"aqua"}]
 $execute as @a[name=$(player),limit=1] at @s run clear @s
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/clear ","color":"aqua"},{"text":"$(player)","color":"white"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/clear_item.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/clear_item.mcfunction
index 96fac18d..86f9d013 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/clear_item.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/clear_item.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $execute as @a[name=$(player),limit=1] at @s run clear @s $(item) $(count)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/clear_item ","color":"aqua"},{"text":"$(player)","color":"white"},{"text":" → ","color":"#555555"},{"text":"$(item)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/clone.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/clone.mcfunction
index 5cf70dde..54eb1154 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/clone.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/clone.mcfunction
@@ -1,12 +1,4 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
-# ─────────────────────────────────────────────────────────────────
-# SANDBOX GUARD — dangerous commands are blocked in sandbox mode.
-# Enable:  /data modify storage datalib:engine sandbox set value 1b
-# Disable: /data modify storage datalib:engine sandbox set value 0b
-# ─────────────────────────────────────────────────────────────────
-execute if data storage datalib:engine {sandbox:1b} run data modify storage datalib:engine _sandbox_cmd set value "clone"
-execute if data storage datalib:engine {sandbox:1b} run execute unless function datalib:core/internal/api/cmd/sandbox_gate run return 0
 
 $clone $(x1) $(y1) $(z1) $(x2) $(y2) $(z2) $(dx) $(dy) $(dz)
 tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/clone ","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/clone_masked.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/clone_masked.mcfunction
index 0295cba7..edbcff32 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/clone_masked.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/clone_masked.mcfunction
@@ -1,12 +1,4 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
-# ─────────────────────────────────────────────────────────────────
-# SANDBOX GUARD — dangerous commands are blocked in sandbox mode.
-# Enable:  /data modify storage datalib:engine sandbox set value 1b
-# Disable: /data modify storage datalib:engine sandbox set value 0b
-# ─────────────────────────────────────────────────────────────────
-execute if data storage datalib:engine {sandbox:1b} run data modify storage datalib:engine _sandbox_cmd set value "clone_masked"
-execute if data storage datalib:engine {sandbox:1b} run execute unless function datalib:core/internal/api/cmd/sandbox_gate run return 0
 
 $clone $(x1) $(y1) $(z1) $(x2) $(y2) $(z2) $(dx) $(dy) $(dz) masked
 tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/clone_masked ","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/damage.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/damage.mcfunction
index 884d5a58..4763dce8 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/damage.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/damage.mcfunction
@@ -1,7 +1,4 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
-execute unless entity @s[type=minecraft:player] run return 0
 
-execute unless entity @s[gamemode=creative,tag=datalib.admin,scores={dl.perm_level=2..}] run return 0
 
 $execute as @a[name=$(player),limit=1] at @s run damage @s $(amount) $(type)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/damage ","color":"aqua"},{"text":"$(player)","color":"white"},{"text":" → ","color":"#555555"},{"text":"$(type)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/damage_typed.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/damage_typed.mcfunction
index 70b28e40..bf35bd8e 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/damage_typed.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/damage_typed.mcfunction
@@ -1,7 +1,4 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
-execute unless entity @s[type=minecraft:player] run return 0
 
-execute unless entity @s[gamemode=creative,tag=datalib.admin,scores={dl.perm_level=2..}] run return 0
 
 $damage @a[name=$(player),limit=1] $(amount) $(damage_type)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/damage_typed ","color":"aqua"},{"text":"$(player)","color":"white"},{"text":" → ","color":"#555555"},{"text":"$(amount)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/data_remove_block.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/data_remove_block.mcfunction
index 0debe501..67825947 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/data_remove_block.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/data_remove_block.mcfunction
@@ -1,15 +1,5 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
-execute unless entity @s[type=minecraft:player] run return 0
 
-execute unless entity @s[gamemode=creative,tag=datalib.admin,scores={dl.perm_level=2..}] run return 0
 
-# ─────────────────────────────────────────────────────────────────
-# SANDBOX GUARD — dangerous commands are blocked in sandbox mode.
-# Enable:  /data modify storage datalib:engine sandbox set value 1b
-# Disable: /data modify storage datalib:engine sandbox set value 0b
-# ─────────────────────────────────────────────────────────────────
-execute if data storage datalib:engine {sandbox:1b} run data modify storage datalib:engine _sandbox_cmd set value "data_remove_block"
-execute if data storage datalib:engine {sandbox:1b} run execute unless function datalib:core/internal/api/cmd/sandbox_gate run return 0
 
 $data remove block $(x) $(y) $(z) $(path)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/data_remove_block ","color":"aqua"},{"text":"$(x) $(y) $(z) → $(path)","color":"#555555"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/data_remove_entity.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/data_remove_entity.mcfunction
index 0dec28ec..a1c92a4b 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/data_remove_entity.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/data_remove_entity.mcfunction
@@ -1,15 +1,5 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
-execute unless entity @s[type=minecraft:player] run return 0
 
-execute unless entity @s[gamemode=creative,tag=datalib.admin,scores={dl.perm_level=2..}] run return 0
 
-# ─────────────────────────────────────────────────────────────────
-# SANDBOX GUARD — dangerous commands are blocked in sandbox mode.
-# Enable:  /data modify storage datalib:engine sandbox set value 1b
-# Disable: /data modify storage datalib:engine sandbox set value 0b
-# ─────────────────────────────────────────────────────────────────
-execute if data storage datalib:engine {sandbox:1b} run data modify storage datalib:engine _sandbox_cmd set value "data_remove_entity"
-execute if data storage datalib:engine {sandbox:1b} run execute unless function datalib:core/internal/api/cmd/sandbox_gate run return 0
 
 $data remove entity $(target) $(path)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/data_remove_entity ","color":"aqua"},{"text":"$(target) → $(path)","color":"#555555"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/data_remove_storage.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/data_remove_storage.mcfunction
index 3fd5e3f5..f83150fb 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/data_remove_storage.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/data_remove_storage.mcfunction
@@ -1,7 +1,4 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
-execute unless entity @s[type=minecraft:player] run return 0
 
-execute unless entity @s[gamemode=creative,tag=datalib.admin,scores={dl.perm_level=2..}] run return 0
 
 $data remove storage $(storage) $(path)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/data_remove_storage ","color":"aqua"},{"text":"$(storage) → $(path)","color":"#555555"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/datapack.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/datapack.mcfunction
index c20c87da..3dab2070 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/datapack.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/datapack.mcfunction
@@ -1,6 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
-execute unless entity @s[type=minecraft:player] run return 0
-execute unless entity @s[tag=datalib.admin,scores={dl.perm_level=2..}] run return 0
 
 $execute if data storage datalib:input {action:"disable"} run datapack disable $(pack)
 $execute if data storage datalib:input {action:"enable"} run datapack enable $(pack)
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/deop.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/deop.mcfunction
index 52ebd9d0..84fc4bb0 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/deop.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/deop.mcfunction
@@ -1,15 +1,4 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
-execute unless entity @s[type=minecraft:player] run return 0
 
-execute unless entity @s[gamemode=creative,tag=datalib.admin,scores={dl.perm_level=2..}] run return 0
 
-# ─────────────────────────────────────────────────────────────────
-# SANDBOX GUARD — dangerous commands are blocked in sandbox mode.
-# Enable:  /data modify storage datalib:engine sandbox set value 1b
-# Disable: /data modify storage datalib:engine sandbox set value 0b
-# ─────────────────────────────────────────────────────────────────
-execute if data storage datalib:engine {sandbox:1b} run data modify storage datalib:engine _sandbox_cmd set value "deop"
-execute if data storage datalib:engine {sandbox:1b} run execute unless function datalib:core/internal/api/cmd/sandbox_gate run return 0
-execute unless data storage datalib:engine {sandbox:1b} run tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"TIP ","color":"yellow","bold":true},{"text":"Sandbox mode recommended → ","color":"gray"},{"text":"/data modify storage datalib:engine sandbox set value 1b","color":"aqua"}]
 $deop $(player)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/deop ","color":"aqua"},{"text":"$(player)","color":"white"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/difficulty.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/difficulty.mcfunction
index 9fb2b9fb..0b60d031 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/difficulty.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/difficulty.mcfunction
@@ -1,12 +1,4 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
-# ─────────────────────────────────────────────────────────────────
-# SANDBOX GUARD — dangerous commands are blocked in sandbox mode.
-# Enable:  /data modify storage datalib:engine sandbox set value 1b
-# Disable: /data modify storage datalib:engine sandbox set value 0b
-# ─────────────────────────────────────────────────────────────────
-execute if data storage datalib:engine {sandbox:1b} run data modify storage datalib:engine _sandbox_cmd set value "difficulty"
-execute if data storage datalib:engine {sandbox:1b} run execute unless function datalib:core/internal/api/cmd/sandbox_gate run return 0
 
 $difficulty $(level)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/difficulty ","color":"aqua"},{"text":" → ","color":"#555555"},{"text":"$(level)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/disable.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/disable.mcfunction
index a364307a..c58ec719 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/disable.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/disable.mcfunction
@@ -1,11 +1 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
-execute unless entity @s[type=minecraft:player] run return 0
-
-execute unless entity @s[gamemode=creative,tag=datalib.admin,scores={dl.perm_level=2..}] run return 0
-
-# ─────────────────────────────────────────────────────────────────
-# GATE REQUEST — Dangerous commands require admin confirmation
-# ─────────────────────────────────────────────────────────────────
-data modify storage datalib:engine pending_gate set value {type:"disable"}
-function dl_load:gate/request
-tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/disable request ","color":"aqua"}]
+function datalib:core/disable/main
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/display_name.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/display_name.mcfunction
index d5dd4f4d..04f65b5e 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/display_name.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/display_name.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $data modify entity @e[type=$(type),tag=$(tag),limit=1] CustomName set value '$(name)'
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/display_name ","color":"aqua"},{"text":" → ","color":"#555555"},{"text":"$(type)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/effect_clear.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/effect_clear.mcfunction
index ccd76a3b..b8651e55 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/effect_clear.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/effect_clear.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $execute as @a[name=$(player),limit=1] at @s run effect clear @s
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/effect_clear ","color":"aqua"},{"text":"$(player)","color":"white"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/effect_clear_one.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/effect_clear_one.mcfunction
index cb5978ec..8dd5f927 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/effect_clear_one.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/effect_clear_one.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $execute as @a[name=$(player),limit=1] at @s run effect clear @s $(effect)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/effect_clear_one ","color":"aqua"},{"text":"$(player)","color":"white"},{"text":" → ","color":"#555555"},{"text":"$(effect)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/effect_give.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/effect_give.mcfunction
index 827b698a..24f7707a 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/effect_give.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/effect_give.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $execute as @a[name=$(player),limit=1] at @s run effect give @s $(effect) $(duration) $(amplifier) true
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/effect_give ","color":"aqua"},{"text":"$(player)","color":"white"},{"text":" → ","color":"#555555"},{"text":"$(effect)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/effect_give_all.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/effect_give_all.mcfunction
index e117a4b2..9ce64508 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/effect_give_all.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/effect_give_all.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $effect give @a $(effect) $(duration) $(amplifier) $(hide)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/effect_give_all ","color":"aqua"},{"text":" → ","color":"#555555"},{"text":"$(effect)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/enchant.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/enchant.mcfunction
index 7f2b7e53..d58167fa 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/enchant.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/enchant.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $execute as @a[name=$(player),limit=1] run enchant @s $(enchantment) $(level)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/enchant ","color":"aqua"},{"text":"$(player)","color":"white"},{"text":" → ","color":"#555555"},{"text":"$(enchantment)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/fill.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/fill.mcfunction
index dd2a0e89..e71f5463 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/fill.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/fill.mcfunction
@@ -1,12 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
-# ─────────────────────────────────────────────────────────────────
-# SANDBOX GUARD — dangerous commands are blocked in sandbox mode.
-# Enable:  /data modify storage datalib:engine sandbox set value 1b
-# Disable: /data modify storage datalib:engine sandbox set value 0b
-# ─────────────────────────────────────────────────────────────────
-execute if data storage datalib:engine {sandbox:1b} run data modify storage datalib:engine _sandbox_cmd set value "fill"
-execute if data storage datalib:engine {sandbox:1b} run execute unless function datalib:core/internal/api/cmd/sandbox_gate run return 0
-execute unless data storage datalib:engine {sandbox:1b} run tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"TIP ","color":"yellow","bold":true},{"text":"Sandbox mode recommended → ","color":"gray"},{"text":"/data modify storage datalib:engine sandbox set value 1b","color":"aqua"}]
 $fill $(x1) $(y1) $(z1) $(x2) $(y2) $(z2) $(block) $(mode)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/fill ","color":"aqua"},{"text":" → ","color":"#555555"},{"text":"$(mode)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/forceload_add.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/forceload_add.mcfunction
index 04ce8b7c..c42d9b16 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/forceload_add.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/forceload_add.mcfunction
@@ -1,12 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
-# ─────────────────────────────────────────────────────────────────
-# SANDBOX GUARD — dangerous commands are blocked in sandbox mode.
-# Enable:  /data modify storage datalib:engine sandbox set value 1b
-# Disable: /data modify storage datalib:engine sandbox set value 0b
-# ─────────────────────────────────────────────────────────────────
-execute if data storage datalib:engine {sandbox:1b} run data modify storage datalib:engine _sandbox_cmd set value "forceload_add"
-execute if data storage datalib:engine {sandbox:1b} run execute unless function datalib:core/internal/api/cmd/sandbox_gate run return 0
-execute unless data storage datalib:engine {sandbox:1b} run tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"TIP ","color":"yellow","bold":true},{"text":"Sandbox mode recommended → ","color":"gray"},{"text":"/data modify storage datalib:engine sandbox set value 1b","color":"aqua"}]
 $forceload add $(x) $(z)
 tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/forceload_add ","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/forceload_remove.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/forceload_remove.mcfunction
index cf8d067e..bfdc9aae 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/forceload_remove.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/forceload_remove.mcfunction
@@ -1,12 +1,4 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
-# ─────────────────────────────────────────────────────────────────
-# SANDBOX GUARD — dangerous commands are blocked in sandbox mode.
-# Enable:  /data modify storage datalib:engine sandbox set value 1b
-# Disable: /data modify storage datalib:engine sandbox set value 0b
-# ─────────────────────────────────────────────────────────────────
-execute if data storage datalib:engine {sandbox:1b} run data modify storage datalib:engine _sandbox_cmd set value "forceload_remove"
-execute if data storage datalib:engine {sandbox:1b} run execute unless function datalib:core/internal/api/cmd/sandbox_gate run return 0
 
 $forceload remove $(x) $(z)
 tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/forceload_remove ","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/freeze.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/freeze.mcfunction
index 2110983d..f9a8b0a8 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/freeze.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/freeze.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 # ─────────────────────────────────────────────────────────────────
 # datalib:api/cmd/freeze
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/function.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/function.mcfunction
index 3b6201b1..81998af7 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/function.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/function.mcfunction
@@ -1,3 +1,2 @@
-execute unless function datalib:debug/tools/utils/check_all unless entity @s[tag=datalib.admin,scores={dl.perm_level=2..}] run return 0
 
 $execute as @a[limit=1,name="(target)] at @a[name=$(target)] run function $(func) with storage datalib:input {}
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/gamemode.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/gamemode.mcfunction
index a085204c..45d17f07 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/gamemode.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/gamemode.mcfunction
@@ -1,15 +1,5 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
-execute unless entity @s[type=minecraft:player] run return 0
 
-execute unless entity @s[gamemode=creative,tag=datalib.admin,scores={dl.perm_level=2..}] run return 0
 
-# ─────────────────────────────────────────────────────────────────
-# SANDBOX GUARD — dangerous commands are blocked in sandbox mode.
-# Enable:  /data modify storage datalib:engine sandbox set value 1b
-# Disable: /data modify storage datalib:engine sandbox set value 0b
-# ─────────────────────────────────────────────────────────────────
-execute if data storage datalib:engine {sandbox:1b} run data modify storage datalib:engine _sandbox_cmd set value "gamemode"
-execute if data storage datalib:engine {sandbox:1b} run execute unless function datalib:core/internal/api/cmd/sandbox_gate run return 0
 
 $execute as @a[name=$(player),limit=1] at @s run gamemode $(mode) @s
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/gamemode ","color":"aqua"},{"text":"$(player)","color":"white"},{"text":" → ","color":"#555555"},{"text":"$(mode)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/gamerule.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/gamerule.mcfunction
index 3d636e87..b388ef34 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/gamerule.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/gamerule.mcfunction
@@ -1,12 +1,4 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
-# ─────────────────────────────────────────────────────────────────
-# SANDBOX GUARD — dangerous commands are blocked in sandbox mode.
-# Enable:  /data modify storage datalib:engine sandbox set value 1b
-# Disable: /data modify storage datalib:engine sandbox set value 0b
-# ─────────────────────────────────────────────────────────────────
-execute if data storage datalib:engine {sandbox:1b} run data modify storage datalib:engine _sandbox_cmd set value "gamerule"
-execute if data storage datalib:engine {sandbox:1b} run execute unless function datalib:core/internal/api/cmd/sandbox_gate run return 0
 
 $gamerule $(rule) $(value)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/gamerule ","color":"aqua"},{"text":" → ","color":"#555555"},{"text":"$(rule)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/give.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/give.mcfunction
index 29a2f492..082a25f0 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/give.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/give.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $execute as @a[name=$(player),limit=1] at @s run give @s $(item) $(count)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/give ","color":"aqua"},{"text":"$(player)","color":"white"},{"text":" → ","color":"#555555"},{"text":"$(item)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/give_one.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/give_one.mcfunction
index f4d5e976..e691ff14 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/give_one.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/give_one.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $execute as @a[name=$(player),limit=1] at @s run give @s $(item) 1
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/give_one ","color":"aqua"},{"text":"$(player)","color":"white"},{"text":" → ","color":"#555555"},{"text":"$(item)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/heal.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/heal.mcfunction
index 87ce100b..4c008f8b 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/heal.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/heal.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $execute as @a[name=$(player),limit=1] at @s run effect give @s minecraft:instant_health 1 $(amount) true
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/heal ","color":"aqua"},{"text":"$(player)","color":"white"},{"text":" → ","color":"#555555"},{"text":"$(amount)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/item_modify.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/item_modify.mcfunction
index c4738209..71ea3b8d 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/item_modify.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/item_modify.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $item modify entity @a[name=$(player),limit=1] $(slot) $(modifier)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/item_modify ","color":"aqua"},{"text":"$(player)","color":"white"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/item_rename.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/item_rename.mcfunction
index 4f9b094f..a46fd614 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/item_rename.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/item_rename.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $item modify entity @a[name=$(player),limit=1] $(slot) $(modifier)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/item_rename ","color":"aqua"},{"text":"$(player)","color":"white"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/kick.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/kick.mcfunction
index f2762803..fd003540 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/kick.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/kick.mcfunction
@@ -1,11 +1,2 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
-execute unless entity @s[type=minecraft:player] run return 0
-
-execute unless entity @s[gamemode=creative,tag=datalib.admin,scores={dl.perm_level=2..}] run return 0
-
-# ─────────────────────────────────────────────────────────────────
-# GATE REQUEST — Dangerous commands require admin confirmation
-# ─────────────────────────────────────────────────────────────────
-$data modify storage datalib:engine pending_gate set value {type:"kick", player:"$(player)", reason:"$(reason)"}
-function dl_load:gate/request
-$tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/kick request ","color":"aqua"},{"text":"$(player) $(reason)","color":"white"}]
+$kick $(player) $(reason)
+$tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/kick ","color":"aqua"},{"text":"$(player) $(reason)","color":"white"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/kill.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/kill.mcfunction
index 90fb691b..f7fb43a3 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/kill.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/kill.mcfunction
@@ -1,15 +1,4 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
-execute unless entity @s[type=minecraft:player] run return 0
 
-execute unless entity @s[gamemode=creative,tag=datalib.admin,scores={dl.perm_level=2..}] run return 0
 
-# ─────────────────────────────────────────────────────────────────
-# SANDBOX GUARD — dangerous commands are blocked in sandbox mode.
-# Enable:  /data modify storage datalib:engine sandbox set value 1b
-# Disable: /data modify storage datalib:engine sandbox set value 0b
-# ─────────────────────────────────────────────────────────────────
-execute if data storage datalib:engine {sandbox:1b} run data modify storage datalib:engine _sandbox_cmd set value "kill"
-execute if data storage datalib:engine {sandbox:1b} run execute unless function datalib:core/internal/api/cmd/sandbox_gate run return 0
-execute unless data storage datalib:engine {sandbox:1b} run tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"TIP ","color":"yellow","bold":true},{"text":"Sandbox mode recommended → ","color":"gray"},{"text":"/data modify storage datalib:engine sandbox set value 1b","color":"aqua"}]
 $execute as @a[name=$(player),limit=1] at @s run kill @s
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/kill ","color":"aqua"},{"text":"$(player)","color":"white"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/locate_structure.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/locate_structure.mcfunction
index 72f3d1b5..9bfe2a18 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/locate_structure.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/locate_structure.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $execute as @a[name=$(player),limit=1] at @s run locate structure $(structure)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/locate_structure ","color":"aqua"},{"text":"$(player)","color":"white"},{"text":" → ","color":"#555555"},{"text":"$(structure)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/loot_drop.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/loot_drop.mcfunction
index 99db2d12..157e4b30 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/loot_drop.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/loot_drop.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $loot spawn $(x) $(y) $(z) loot $(loot_table)
 tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/loot_drop ","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/loot_give.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/loot_give.mcfunction
index 7e7e18c0..96ada984 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/loot_give.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/loot_give.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $loot give @a[name=$(player),limit=1] loot $(loot_table)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/loot_give ","color":"aqua"},{"text":"$(player)","color":"white"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/msg.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/msg.mcfunction
index 854aa1bb..621bcadf 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/msg.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/msg.mcfunction
@@ -1,3 +1,2 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $tellraw @a[name=$(player),limit=1] {"text":"$(message)","color":"gray","italic":true}
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/msg_raw.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/msg_raw.mcfunction
index a133f8a6..133e6596 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/msg_raw.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/msg_raw.mcfunction
@@ -1,3 +1,2 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $tellraw $(player) $(json)
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/op.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/op.mcfunction
index 3ff41c8b..e93d3b44 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/op.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/op.mcfunction
@@ -1,15 +1,4 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
-execute unless entity @s[type=minecraft:player] run return 0
 
-execute unless entity @s[gamemode=creative,tag=datalib.admin,scores={dl.perm_level=2..}] run return 0
 
-# ─────────────────────────────────────────────────────────────────
-# SANDBOX GUARD — dangerous commands are blocked in sandbox mode.
-# Enable:  /data modify storage datalib:engine sandbox set value 1b
-# Disable: /data modify storage datalib:engine sandbox set value 0b
-# ─────────────────────────────────────────────────────────────────
-execute if data storage datalib:engine {sandbox:1b} run data modify storage datalib:engine _sandbox_cmd set value "op"
-execute if data storage datalib:engine {sandbox:1b} run execute unless function datalib:core/internal/api/cmd/sandbox_gate run return 0
-execute unless data storage datalib:engine {sandbox:1b} run tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"TIP ","color":"yellow","bold":true},{"text":"Sandbox mode recommended → ","color":"gray"},{"text":"/data modify storage datalib:engine sandbox set value 1b","color":"aqua"}]
 $op $(player)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/op ","color":"aqua"},{"text":"$(player)","color":"white"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/other/multi_cmd.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/other/multi_cmd.mcfunction
index 1ca3182f..a60a2221 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/other/multi_cmd.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/other/multi_cmd.mcfunction
@@ -13,7 +13,6 @@ data modify storage datalib:engine multiCommands.active set value 1b
 # Validate type
 execute if data storage datalib:engine {security:{multi_type_allowlist:{multi_cmd_adv:0b}}} run data remove storage datalib:engine multiCommands.type
 execute if data storage datalib:engine {security:{multi_type_allowlist:{multi_cmd_adv:0b}}} run data remove storage datalib:engine multiCommands.active
-execute if data storage datalib:engine {security:{multi_type_allowlist:{multi_cmd_adv:0b}}} run return run function datalib:core/security/multi_type_check
 
 $data modify storage datalib:engine _mcmd_queue set value $(commands)
 data modify storage datalib:engine _mcmd_options set value {error_mode:"continue",profile:0b,spread:0}
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/other/multi_cmd/advanced/run_with_options.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/other/multi_cmd/advanced/run_with_options.mcfunction
index 8f14fa8f..a06cac98 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/other/multi_cmd/advanced/run_with_options.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/other/multi_cmd/advanced/run_with_options.mcfunction
@@ -14,7 +14,6 @@ data modify storage datalib:engine _mcmd_options merge from storage datalib:inpu
 
 # Validate options.type if caller explicitly specified one
 execute if data storage datalib:engine _mcmd_options.type run data modify storage datalib:engine multiCommands.type set from storage datalib:engine _mcmd_options.type
-execute if data storage datalib:engine _mcmd_options.type run execute unless function datalib:core/security/multi_type_check run return 0
 
 execute unless data storage datalib:engine _mcmd_options.error_mode run data modify storage datalib:engine _mcmd_options.error_mode set value "continue"
 execute unless data storage datalib:engine _mcmd_options.profile run data modify storage datalib:engine _mcmd_options.profile set value 0b
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/other/multi_cmd/utils/run_with_options_tracked.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/other/multi_cmd/utils/run_with_options_tracked.mcfunction
index dfcb3e82..f7084027 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/other/multi_cmd/utils/run_with_options_tracked.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/other/multi_cmd/utils/run_with_options_tracked.mcfunction
@@ -1,3 +1,3 @@
 data modify storage datalib:output multiCommands.executed set value 0b
 
-execute at @s store success storage datalib:output multiCommands.executed byte 1 unless function datalib:api/cmd/other/multi_cmd/advanced/run_with_options run return 1
\ No newline at end of file
+execute at @s store success storage datalib:output multiCommands.executed byte 1 unless function datalib:api/cmd/other/multi_cmd/advanced/run_with_options run return 0
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/other/multi_cmd_adv.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/other/multi_cmd_adv.mcfunction
index 959b8fc1..84ae5739 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/other/multi_cmd_adv.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/other/multi_cmd_adv.mcfunction
@@ -12,7 +12,6 @@ data modify storage datalib:engine multiCommands.active set value 1b
 # Validate type
 execute if data storage datalib:engine {security:{multi_type_allowlist:{multi_cmd_adv:0b}}} run data remove storage datalib:engine multiCommands.type
 execute if data storage datalib:engine {security:{multi_type_allowlist:{multi_cmd_adv:0b}}} run data remove storage datalib:engine multiCommands.active
-execute if data storage datalib:engine {security:{multi_type_allowlist:{multi_cmd_adv:0b}}} run return run function datalib:core/security/multi_type_check
 
 $data merge storage datalib:input {list:$(list),options:$(options)}
 
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/particle.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/particle.mcfunction
index 3c322232..cce752cc 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/particle.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/particle.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $particle $(name) $(x) $(y) $(z) $(dx) $(dy) $(dz) $(speed) $(count)
 tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/particle ","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/place_feature.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/place_feature.mcfunction
index b7963a25..c5b7e5be 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/place_feature.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/place_feature.mcfunction
@@ -1,12 +1,4 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
-# ─────────────────────────────────────────────────────────────────
-# SANDBOX GUARD — dangerous commands are blocked in sandbox mode.
-# Enable:  /data modify storage datalib:engine sandbox set value 1b
-# Disable: /data modify storage datalib:engine sandbox set value 0b
-# ─────────────────────────────────────────────────────────────────
-execute if data storage datalib:engine {sandbox:1b} run data modify storage datalib:engine _sandbox_cmd set value "place_feature"
-execute if data storage datalib:engine {sandbox:1b} run execute unless function datalib:core/internal/api/cmd/sandbox_gate run return 0
 
 $place feature $(feature) $(x) $(y) $(z)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/place_feature ","color":"aqua"},{"text":" → ","color":"#555555"},{"text":"$(feature)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/place_structure.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/place_structure.mcfunction
index d7e076f1..9d5bd215 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/place_structure.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/place_structure.mcfunction
@@ -1,12 +1,4 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
-# ─────────────────────────────────────────────────────────────────
-# SANDBOX GUARD — dangerous commands are blocked in sandbox mode.
-# Enable:  /data modify storage datalib:engine sandbox set value 1b
-# Disable: /data modify storage datalib:engine sandbox set value 0b
-# ─────────────────────────────────────────────────────────────────
-execute if data storage datalib:engine {sandbox:1b} run data modify storage datalib:engine _sandbox_cmd set value "place_structure"
-execute if data storage datalib:engine {sandbox:1b} run execute unless function datalib:core/internal/api/cmd/sandbox_gate run return 0
 
 $place structure $(structure) $(x) $(y) $(z)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/place_structure ","color":"aqua"},{"text":" → ","color":"#555555"},{"text":"$(structure)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/publish.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/publish.mcfunction
index 11023bb6..7c9b4784 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/publish.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/publish.mcfunction
@@ -1,12 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
-# ─────────────────────────────────────────────────────────────────
-# SANDBOX GUARD — dangerous commands are blocked in sandbox mode.
-# Enable:  /data modify storage datalib:engine sandbox set value 1b
-# Disable: /data modify storage datalib:engine sandbox set value 0b
-# ─────────────────────────────────────────────────────────────────
-execute if data storage datalib:engine {sandbox:1b} run data modify storage datalib:engine _sandbox_cmd set value "clear"
-execute if data storage datalib:engine {sandbox:1b} run execute unless function datalib:core/internal/api/cmd/sandbox_gate run return 0
-execute unless data storage datalib:engine {sandbox:1b} run tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"TIP ","color":"yellow","bold":true},{"text":"Sandbox mode recommended → ","color":"gray"},{"text":"/data modify storage datalib:engine sandbox set value 1b","color":"aqua"}]
 
 $publish $(allow_commands) $(game_mode) $(port)
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/ride.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/ride.mcfunction
index 20045b6a..3e2d04bf 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/ride.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/ride.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $ride @a[name=$(player),limit=1] mount $(vehicle)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/ride ","color":"aqua"},{"text":"$(player)","color":"white"},{"text":" → ","color":"#555555"},{"text":"$(vehicle)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/ride_dismount.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/ride_dismount.mcfunction
index 5ae695e8..a5b8d5ed 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/ride_dismount.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/ride_dismount.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $ride @a[name=$(player),limit=1] dismount
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/ride_dismount ","color":"aqua"},{"text":"$(player)","color":"white"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/scoreboard_add.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/scoreboard_add.mcfunction
index 8c8182ec..7f6b13c4 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/scoreboard_add.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/scoreboard_add.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $execute as @a[name=$(player),limit=1] at @s run scoreboard players add @s $(objective) $(amount)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/scoreboard_add ","color":"aqua"},{"text":"$(player)","color":"white"},{"text":" → ","color":"#555555"},{"text":"$(amount)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/scoreboard_get.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/scoreboard_get.mcfunction
index 847b4cb7..18b1b9ea 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/scoreboard_get.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/scoreboard_get.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $execute store result storage datalib:output result int 1 run scoreboard players get @a[name=$(player),limit=1] $(objective)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/scoreboard_get ","color":"aqua"},{"text":"$(player)","color":"white"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/scoreboard_set.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/scoreboard_set.mcfunction
index 1032e100..50fed6c9 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/scoreboard_set.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/scoreboard_set.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $execute as @a[name=$(player),limit=1] at @s run scoreboard players set @s $(objective) $(value)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/scoreboard_set ","color":"aqua"},{"text":"$(player)","color":"white"},{"text":" → ","color":"#555555"},{"text":"$(value)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/set_clock_rate.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/set_clock_rate.mcfunction
index 897ac40e..c58d6301 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/set_clock_rate.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/set_clock_rate.mcfunction
@@ -1,7 +1,6 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 # DL - World Clock Rate Controller
 $time rate $(rate)
 
 # System Debug Log for staff (Only for users with 'datalib.debug' tag)
-$tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"clock/rate_updated ","color":"aqua"},{"text":"* ","color":"white"},{"text":"to ","color":"gray"},{"text":"$(rate)x","color":"gold"}]
\ No newline at end of file
+$tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"clock/rate_updated ","color":"aqua"},{"text":"* ","color":"white"},{"text":"to ","color":"gray"},{"text":"$(rate)x","color":"gold"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/setblock.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/setblock.mcfunction
index 318dfd76..d25e39c8 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/setblock.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/setblock.mcfunction
@@ -1,12 +1,4 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
-# ─────────────────────────────────────────────────────────────────
-# SANDBOX GUARD — dangerous commands are blocked in sandbox mode.
-# Enable:  /data modify storage datalib:engine sandbox set value 1b
-# Disable: /data modify storage datalib:engine sandbox set value 0b
-# ─────────────────────────────────────────────────────────────────
-execute if data storage datalib:engine {sandbox:1b} run data modify storage datalib:engine _sandbox_cmd set value "setblock"
-execute if data storage datalib:engine {sandbox:1b} run execute unless function datalib:core/internal/api/cmd/sandbox_gate run return 0
 
 $setblock $(x) $(y) $(z) $(block) $(mode)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/setblock ","color":"aqua"},{"text":" → ","color":"#555555"},{"text":"$(mode)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/sound.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/sound.mcfunction
index f40ef0a1..654dad8e 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/sound.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/sound.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $execute as @a[name=$(player),limit=1] at @s run playsound $(sound) master @s ~ ~ ~ $(volume) $(pitch)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/sound ","color":"aqua"},{"text":"$(player)","color":"white"},{"text":" → ","color":"#555555"},{"text":"$(sound)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/sound_all.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/sound_all.mcfunction
index ce6ae739..128dd3cc 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/sound_all.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/sound_all.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $playsound $(sound) master @a ~ ~ ~ $(volume) $(pitch)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/sound_all ","color":"aqua"},{"text":" → ","color":"#555555"},{"text":"$(sound)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/spectate.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/spectate.mcfunction
index 0cb7dda3..d1818675 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/spectate.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/spectate.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $execute as @a[name=$(player),limit=1] run spectate $(target)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/spectate ","color":"aqua"},{"text":"$(player)","color":"white"},{"text":" → ","color":"#555555"},{"text":"$(target)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/spectate_stop.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/spectate_stop.mcfunction
index 4fd785c2..a4605155 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/spectate_stop.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/spectate_stop.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $execute as @a[name=$(player),limit=1] run spectate
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/spectate_stop ","color":"aqua"},{"text":"$(player)","color":"white"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/spreadplayers.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/spreadplayers.mcfunction
index 40c1bca5..957b0f5d 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/spreadplayers.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/spreadplayers.mcfunction
@@ -1,12 +1,4 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
-# ─────────────────────────────────────────────────────────────────
-# SANDBOX GUARD — dangerous commands are blocked in sandbox mode.
-# Enable:  /data modify storage datalib:engine sandbox set value 1b
-# Disable: /data modify storage datalib:engine sandbox set value 0b
-# ─────────────────────────────────────────────────────────────────
-execute if data storage datalib:engine {sandbox:1b} run data modify storage datalib:engine _sandbox_cmd set value "spreadplayers"
-execute if data storage datalib:engine {sandbox:1b} run execute unless function datalib:core/internal/api/cmd/sandbox_gate run return 0
 
 $spreadplayers $(cx) $(cz) $(spread) $(max_range) false $(target)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/spreadplayers ","color":"aqua"},{"text":" → ","color":"#555555"},{"text":"$(target)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/stopsound.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/stopsound.mcfunction
index b6f1ee52..e2869981 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/stopsound.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/stopsound.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $execute as @a[name=$(player),limit=1] run stopsound @s $(category) $(sound)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/stopsound ","color":"aqua"},{"text":"$(player)","color":"white"},{"text":" → ","color":"#555555"},{"text":"$(sound)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/storage_set.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/storage_set.mcfunction
index b2a82b76..fb1057ae 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/storage_set.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/storage_set.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $data modify storage $(storage) $(nbt) set $(actionType) $(value)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/storage_set ","color":"aqua"},{"text":" → ","color":"#555555"},{"text":"$(value)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/subtitle.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/subtitle.mcfunction
index 6ac9420e..2f6b4b92 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/subtitle.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/subtitle.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $execute as @a[name=$(player),limit=1] at @s run title @s subtitle {"text":"$(text)","color":"$(color)"}
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/subtitle ","color":"aqua"},{"text":"$(player)","color":"white"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/summon.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/summon.mcfunction
index 61a665b5..ade81a42 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/summon.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/summon.mcfunction
@@ -1,12 +1,4 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
-# ─────────────────────────────────────────────────────────────────
-# SANDBOX GUARD — dangerous commands are blocked in sandbox mode.
-# Enable:  /data modify storage datalib:engine sandbox set value 1b
-# Disable: /data modify storage datalib:engine sandbox set value 0b
-# ─────────────────────────────────────────────────────────────────
-execute if data storage datalib:engine {sandbox:1b} run data modify storage datalib:engine _sandbox_cmd set value "summon"
-execute if data storage datalib:engine {sandbox:1b} run execute unless function datalib:core/internal/api/cmd/sandbox_gate run return 0
 
 $summon $(entity) $(x) $(y) $(z) $(nbt)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/summon ","color":"aqua"},{"text":" → ","color":"#555555"},{"text":"$(entity)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/swing.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/swing.mcfunction
index e99614e4..fc7fe81c 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/swing.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/swing.mcfunction
@@ -1,7 +1,6 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 # DL - Swing & Feedback Module
 $swing @a[name=$(player),limit=1] $(hand)
 
 # System Debug Log for staff (Only for users with 'datalib.debug' tag)
-$tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/swing ","color":"aqua"},{"text":"$(player)","color":"white"}]
\ No newline at end of file
+$tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/swing ","color":"aqua"},{"text":"$(player)","color":"white"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/tag_add.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/tag_add.mcfunction
index 1a755622..1e297c39 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/tag_add.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/tag_add.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $execute as @a[name=$(player),limit=1] at @s run tag @s add $(tag)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/tag_add ","color":"aqua"},{"text":"$(player)","color":"white"},{"text":" → ","color":"#555555"},{"text":"$(tag)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/tag_remove.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/tag_remove.mcfunction
index 0a3e472e..b46a4196 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/tag_remove.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/tag_remove.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $execute as @a[name=$(player),limit=1] at @s run tag @s remove $(tag)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/tag_remove ","color":"aqua"},{"text":"$(player)","color":"white"},{"text":" → ","color":"#555555"},{"text":"$(tag)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/time_add.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/time_add.mcfunction
index 0c063a88..1d15f92e 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/time_add.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/time_add.mcfunction
@@ -1,12 +1,4 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
-# ─────────────────────────────────────────────────────────────────
-# SANDBOX GUARD — dangerous commands are blocked in sandbox mode.
-# Enable:  /data modify storage datalib:engine sandbox set value 1b
-# Disable: /data modify storage datalib:engine sandbox set value 0b
-# ─────────────────────────────────────────────────────────────────
-execute if data storage datalib:engine {sandbox:1b} run data modify storage datalib:engine _sandbox_cmd set value "time_add"
-execute if data storage datalib:engine {sandbox:1b} run execute unless function datalib:core/internal/api/cmd/sandbox_gate run return 0
 
 $time add $(value)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/time_add ","color":"aqua"},{"text":" → ","color":"#555555"},{"text":"$(value)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/time_of.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/time_of.mcfunction
index 627dfb2e..a1bec4c5 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/time_of.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/time_of.mcfunction
@@ -1,8 +1,7 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 # DL - Universal World Clock Controller
 # Usage: /function ame:clock_handler {clock:"datalib:test", action:"set", value:"12000"}
 $time of $(clock) $(action) $(value)
 
 # System Debug Log for staff (Only for users with 'datalib.debug' tag)
-$tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"clock/system_update ","color":"aqua"},{"text":"$(clock) ","color":"white"},{"text":"action:","color":"gray"},{"text":"$(action) ","color":"gold"},{"text":"value:","color":"gray"},{"text":"$(value)","color":"yellow"}]
\ No newline at end of file
+$tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"clock/system_update ","color":"aqua"},{"text":"$(clock) ","color":"white"},{"text":"action:","color":"gray"},{"text":"$(action) ","color":"gold"},{"text":"value:","color":"gray"},{"text":"$(value)","color":"yellow"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/time_set.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/time_set.mcfunction
index 2c58ea58..7c46cf6b 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/time_set.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/time_set.mcfunction
@@ -1,12 +1,4 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
-# ─────────────────────────────────────────────────────────────────
-# SANDBOX GUARD — dangerous commands are blocked in sandbox mode.
-# Enable:  /data modify storage datalib:engine sandbox set value 1b
-# Disable: /data modify storage datalib:engine sandbox set value 0b
-# ─────────────────────────────────────────────────────────────────
-execute if data storage datalib:engine {sandbox:1b} run data modify storage datalib:engine _sandbox_cmd set value "time_set"
-execute if data storage datalib:engine {sandbox:1b} run execute unless function datalib:core/internal/api/cmd/sandbox_gate run return 0
 
 $time set $(value)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/time_set ","color":"aqua"},{"text":" → ","color":"#555555"},{"text":"$(value)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/title.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/title.mcfunction
index c7e03af1..9166394f 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/title.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/title.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $execute as @a[name=$(player),limit=1] at @s run title @s title {"text":"$(text)","color":"$(color)"}
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/title ","color":"aqua"},{"text":"$(player)","color":"white"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/title_all.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/title_all.mcfunction
index 4a0c649c..2e22a155 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/title_all.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/title_all.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $title @a title {"text":"$(title)"}
 tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/title_all ","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/title_bold.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/title_bold.mcfunction
index 41614ce9..4a75153e 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/title_bold.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/title_bold.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $execute as @a[name=$(player),limit=1] at @s run title @s title {"text":"$(text)","color":"$(color)","bold":true}
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/title_bold ","color":"aqua"},{"text":"$(player)","color":"white"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/title_clear.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/title_clear.mcfunction
index 0c18913d..b8a0bcb1 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/title_clear.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/title_clear.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $execute as @a[name=$(player),limit=1] at @s run title @s clear
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/title_clear ","color":"aqua"},{"text":"$(player)","color":"white"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/title_reset.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/title_reset.mcfunction
index 89d24d06..775596be 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/title_reset.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/title_reset.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $execute as @a[name=$(player),limit=1] at @s run title @s reset
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/title_reset ","color":"aqua"},{"text":"$(player)","color":"white"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/title_sub.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/title_sub.mcfunction
index f45df404..2bbd5794 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/title_sub.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/title_sub.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $title @a[name=$(player),limit=1] title {"text":"$(title)","color":"$(color)","bold":true}
 $title @a[name=$(player),limit=1] subtitle {"text":"$(subtitle)","color":"$(sub_color)","italic":true}
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/title_times.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/title_times.mcfunction
index ac2394a6..764daffc 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/title_times.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/title_times.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $execute as @a[name=$(player),limit=1] at @s run title @s times $(fade_in) $(stay) $(fade_out)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/title_times ","color":"aqua"},{"text":"$(player)","color":"white"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/tp.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/tp.mcfunction
index 3263a935..9e64d5f6 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/tp.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/tp.mcfunction
@@ -1,7 +1,4 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
-execute unless entity @s[type=minecraft:player] run return 0
 
-execute unless entity @s[gamemode=creative,tag=datalib.admin,scores={dl.perm_level=2..}] run return 0
 
 $execute as @a[name=$(player),limit=1] at @s run tp @s $(x) $(y) $(z)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/tp ","color":"aqua"},{"text":"$(player)","color":"white"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/tp_facing.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/tp_facing.mcfunction
index 83eed898..836fb35f 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/tp_facing.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/tp_facing.mcfunction
@@ -1,7 +1,4 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
-execute unless entity @s[type=minecraft:player] run return 0
 
-execute unless entity @s[gamemode=creative,tag=datalib.admin,scores={dl.perm_level=2..}] run return 0
 
 $execute as @a[name=$(player),limit=1] at @s run tp @s $(x) $(y) $(z) facing $(fx) $(fy) $(fz)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/tp_facing ","color":"aqua"},{"text":"$(player)","color":"white"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/tp_to_coords.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/tp_to_coords.mcfunction
index 1ef8e745..730e2177 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/tp_to_coords.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/tp_to_coords.mcfunction
@@ -1,7 +1,4 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
-execute unless entity @s[type=minecraft:player] run return 0
 
-execute unless entity @s[gamemode=creative,tag=datalib.admin,scores={dl.perm_level=2..}] run return 0
 
 $tp $(player) $(x) $(y) $(z)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/tp_to_coords ","color":"aqua"},{"text":"$(player)","color":"white"},{"text":" → ","color":"#555555"},{"text":"$(x) $(y) $(z)","color":"green"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/tp_to_entity.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/tp_to_entity.mcfunction
index 4a6dbef1..2ee6789a 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/tp_to_entity.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/tp_to_entity.mcfunction
@@ -1,7 +1,4 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
-execute unless entity @s[type=minecraft:player] run return 0
 
-execute unless entity @s[gamemode=creative,tag=datalib.admin,scores={dl.perm_level=2..}] run return 0
 
 $execute as @a[name=$(player),limit=1] run tp @s @e[type=$(type),tag=$(tag),limit=1]
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/tp_to_entity ","color":"aqua"},{"text":"$(player)","color":"white"},{"text":" → ","color":"#555555"},{"text":"$(type)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/tp_to_player.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/tp_to_player.mcfunction
index 3907e1b2..4f81f801 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/tp_to_player.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/tp_to_player.mcfunction
@@ -1,7 +1,4 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
-execute unless entity @s[type=minecraft:player] run return 0
 
-execute unless entity @s[gamemode=creative,tag=datalib.admin,scores={dl.perm_level=2..}] run return 0
 
 $execute as @a[name=$(player),limit=1] at @s run tp @s @a[name=$(target),limit=1]
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/tp_to_player ","color":"aqua"},{"text":"$(player)","color":"white"},{"text":" → ","color":"#555555"},{"text":"$(target)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/trigger_set.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/trigger_set.mcfunction
index 08f4354c..86e8a88c 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/trigger_set.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/trigger_set.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $scoreboard players set $(player) $(objective) $(value)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/trigger_set ","color":"aqua"},{"text":"$(player)","color":"white"},{"text":" → ","color":"#555555"},{"text":"$(value)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/unfreeze.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/unfreeze.mcfunction
index a5f9979a..e1dec1cf 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/unfreeze.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/unfreeze.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 # ─────────────────────────────────────────────────────────────────
 # datalib:api/cmd/unfreeze
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/weather.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/weather.mcfunction
index 6e6fb5c5..74dc037e 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/weather.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/weather.mcfunction
@@ -1,12 +1,4 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
-# ─────────────────────────────────────────────────────────────────
-# SANDBOX GUARD — dangerous commands are blocked in sandbox mode.
-# Enable:  /data modify storage datalib:engine sandbox set value 1b
-# Disable: /data modify storage datalib:engine sandbox set value 0b
-# ─────────────────────────────────────────────────────────────────
-execute if data storage datalib:engine {sandbox:1b} run data modify storage datalib:engine _sandbox_cmd set value "weather"
-execute if data storage datalib:engine {sandbox:1b} run execute unless function datalib:core/internal/api/cmd/sandbox_gate run return 0
 
 $weather $(type) $(duration)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/weather ","color":"aqua"},{"text":" → ","color":"#555555"},{"text":"$(type)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/whitelist.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/whitelist.mcfunction
index a473f0e1..eb8aa54f 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/whitelist.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/whitelist.mcfunction
@@ -1,15 +1,4 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
-execute unless entity @s[type=minecraft:player] run return 0
 
-execute unless entity @s[gamemode=creative,tag=datalib.admin,scores={dl.perm_level=2..}] run return 0
 
-# ─────────────────────────────────────────────────────────────────
-# SANDBOX GUARD — dangerous commands are blocked in sandbox mode.
-# Enable:  /data modify storage datalib:engine sandbox set value 1b
-# Disable: /data modify storage datalib:engine sandbox set value 0b
-# ─────────────────────────────────────────────────────────────────
-execute if data storage datalib:engine {sandbox:1b} run data modify storage datalib:engine _sandbox_cmd set value "whitelist"
-execute if data storage datalib:engine {sandbox:1b} run execute unless function datalib:core/internal/api/cmd/sandbox_gate run return 0
-execute unless data storage datalib:engine {sandbox:1b} run tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"TIP ","color":"yellow","bold":true},{"text":"Sandbox mode recommended → ","color":"gray"},{"text":"/data modify storage datalib:engine sandbox set value 1b","color":"aqua"}]
 $whitelist $(action) $(player)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/whitelist ","color":"aqua"},{"text":"$(action) $(player)","color":"white"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/xp_add.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/xp_add.mcfunction
index 6efe1ced..d316572f 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/xp_add.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/xp_add.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $execute as @a[name=$(player),limit=1] run xp add @s $(amount) $(type)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/xp_add ","color":"aqua"},{"text":"$(player)","color":"white"},{"text":" → ","color":"#555555"},{"text":"$(type)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/xp_get.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/xp_get.mcfunction
index 3eb39434..e0eb1d97 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/xp_get.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/xp_get.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $execute store result storage datalib:output result int 1 run xp query @a[name=$(player),limit=1] $(type)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/xp_get ","color":"aqua"},{"text":"$(player)","color":"white"},{"text":" → ","color":"#555555"},{"text":"$(type)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/cmd/xp_set.mcfunction b/datapacks/dataLib/data/datalib/function/api/cmd/xp_set.mcfunction
index bb446b94..ea4fd900 100644
--- a/datapacks/dataLib/data/datalib/function/api/cmd/xp_set.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/cmd/xp_set.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $execute as @a[name=$(player),limit=1] run xp set @s $(amount) $(type)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/xp_set ","color":"aqua"},{"text":"$(player)","color":"white"},{"text":" → ","color":"#555555"},{"text":"$(type)","color":"aqua"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/color/gradient_delete.mcfunction b/datapacks/dataLib/data/datalib/function/api/color/gradient_delete.mcfunction
index 6527a3da..81fdc928 100644
--- a/datapacks/dataLib/data/datalib/function/api/color/gradient_delete.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/color/gradient_delete.mcfunction
@@ -7,7 +7,6 @@
 # Usage:
 #   function datalib:api/color/gradient_delete {name:"health"}
 
-execute unless function datalib:core/security/cmd_gate run return 0
 
 $data remove storage datalib:engine color.gradients.$(name)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"color/gradient_delete ","color":"aqua"},{"text":"$(name)","color":"white"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/color/gradient_set.mcfunction b/datapacks/dataLib/data/datalib/function/api/color/gradient_set.mcfunction
index 95007036..37f883fe 100644
--- a/datapacks/dataLib/data/datalib/function/api/color/gradient_set.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/color/gradient_set.mcfunction
@@ -20,7 +20,6 @@
 # Note: SNBT list syntax requires quotes around string entries.
 # This is a load-time operation — call from a load tag or init function.
 
-execute unless function datalib:core/security/cmd_gate run return 0
 
 execute unless data storage datalib:engine color.gradients run data modify storage datalib:engine color.gradients set value {}
 $data modify storage datalib:engine color.gradients.$(name) set value $(colors)
diff --git a/datapacks/dataLib/data/datalib/function/api/color/palette_delete.mcfunction b/datapacks/dataLib/data/datalib/function/api/color/palette_delete.mcfunction
index 055c5f2a..20ed1757 100644
--- a/datapacks/dataLib/data/datalib/function/api/color/palette_delete.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/color/palette_delete.mcfunction
@@ -9,7 +9,6 @@
 # Usage:
 #   function datalib:api/color/palette_delete {key:"brand"}
 
-execute unless function datalib:core/security/cmd_gate run return 0
 
 $data remove storage datalib:engine color.palette.$(key)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"color/palette_delete ","color":"aqua"},{"text":"$(key)","color":"white"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/color/palette_get.mcfunction b/datapacks/dataLib/data/datalib/function/api/color/palette_get.mcfunction
index 007bcfed..47996f1f 100644
--- a/datapacks/dataLib/data/datalib/function/api/color/palette_get.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/color/palette_get.mcfunction
@@ -11,7 +11,6 @@
 #   function datalib:api/color/palette_get {key:"brand"}
 #   data get storage datalib:output result
 
-execute unless function datalib:core/security/cmd_gate run return 0
 
 data modify storage datalib:output result set value ""
 $execute if data storage datalib:engine color.palette.$(key) run data modify storage datalib:output result set from storage datalib:engine color.palette.$(key)
diff --git a/datapacks/dataLib/data/datalib/function/api/color/palette_set.mcfunction b/datapacks/dataLib/data/datalib/function/api/color/palette_set.mcfunction
index 713a7746..015cd65c 100644
--- a/datapacks/dataLib/data/datalib/function/api/color/palette_set.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/color/palette_set.mcfunction
@@ -12,7 +12,6 @@
 #   function datalib:api/color/palette_set {key:"brand",value:"#00AAAA"}
 #   function datalib:api/color/palette_set {key:"danger",value:"red"}
 
-execute unless function datalib:core/security/cmd_gate run return 0
 
 execute unless data storage datalib:engine color.palette run data modify storage datalib:engine color.palette set value {}
 $data modify storage datalib:engine color.palette.$(key) set value "$(value)"
diff --git a/datapacks/dataLib/data/datalib/function/api/dialog/open.mcfunction b/datapacks/dataLib/data/datalib/function/api/dialog/open.mcfunction
index ac32a210..ec355b48 100644
--- a/datapacks/dataLib/data/datalib/function/api/dialog/open.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/dialog/open.mcfunction
@@ -10,5 +10,3 @@ execute if data storage datalib:engine {dialog:{DIALOG:{type:"multi_action"}}} u
 
 execute if data storage datalib:engine dialog.DIALOG run function datalib:api/dialog/show
 execute if data storage datalib:engine dialog.DIALOG run function datalib:api/dialog/notify_admins
-
-return 1
diff --git a/datapacks/dataLib/data/datalib/function/api/dialog/show.mcfunction b/datapacks/dataLib/data/datalib/function/api/dialog/show.mcfunction
index 9fe8b696..3a39c9c9 100644
--- a/datapacks/dataLib/data/datalib/function/api/dialog/show.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/dialog/show.mcfunction
@@ -16,5 +16,3 @@ function datalib:api/dialog/show_dialog_exec with storage datalib:engine dialog
 tag @s add datalib.dialog_opened
 
 function datalib:api/dialog/notify_admins
-
-return 1
diff --git a/datapacks/dataLib/data/datalib/function/api/gamerule/get.mcfunction b/datapacks/dataLib/data/datalib/function/api/gamerule/get.mcfunction
index cdc7466e..c0b0d27e 100644
--- a/datapacks/dataLib/data/datalib/function/api/gamerule/get.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/gamerule/get.mcfunction
@@ -12,7 +12,6 @@
 #   function datalib:api/gamerule/get with storage datalib:input {}
 #   # read: data get storage datalib:output gamerule
 
-execute unless function datalib:core/security/cmd_gate run return 0
 
 # Normalize key (spaces → underscores, lowercase)
 data modify storage stringlib:input replace.String set from storage datalib:input rule
diff --git a/datapacks/dataLib/data/datalib/function/api/gamerule/reset.mcfunction b/datapacks/dataLib/data/datalib/function/api/gamerule/reset.mcfunction
index 8a97811f..f195d984 100644
--- a/datapacks/dataLib/data/datalib/function/api/gamerule/reset.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/gamerule/reset.mcfunction
@@ -9,7 +9,6 @@
 #   data modify storage datalib:input rule set value "pvp_enabled"
 #   function datalib:api/gamerule/reset with storage datalib:input {}
 
-execute unless function datalib:core/security/cmd_gate run return 0
 
 # Normalize
 data modify storage stringlib:input replace.String set from storage datalib:input rule
diff --git a/datapacks/dataLib/data/datalib/function/api/gamerule/set.mcfunction b/datapacks/dataLib/data/datalib/function/api/gamerule/set.mcfunction
index 36228fe1..da1dbc50 100644
--- a/datapacks/dataLib/data/datalib/function/api/gamerule/set.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/gamerule/set.mcfunction
@@ -21,7 +21,6 @@
 #
 # RETURN: 1 on success, 0 on guard failure.
 
-execute unless function datalib:core/security/cmd_gate run return 0
 
 # ── Normalize rule name: spaces → underscores, then lowercase ────────────────
 data modify storage stringlib:input replace.String set from storage datalib:input rule
@@ -44,5 +43,3 @@ $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true
 
 # ── Cleanup ───────────────────────────────────────────────────────────────────
 data remove storage datalib:input _gamerule_norm
-
-return 1
diff --git a/datapacks/dataLib/data/datalib/function/api/security/allowlist_add.mcfunction b/datapacks/dataLib/data/datalib/function/api/security/allowlist_add.mcfunction
deleted file mode 100644
index acd8989b..00000000
--- a/datapacks/dataLib/data/datalib/function/api/security/allowlist_add.mcfunction
+++ /dev/null
@@ -1,14 +0,0 @@
-# datalib:api/security/allowlist_add [MACRO]
-# Adds a command prefix to datalib:engine security.sandbox_allowlist (compound).
-# Compound format: {give:1b, say:1b, ...} — O(1) lookup.
-#
-# BREAKING CHANGE (v6.0.0): allowlist is now a compound, not a list.
-# Enforcement is now ACTIVE — unlisted commands in sandbox mode are blocked + kick.
-#
-# INPUT (macro args):
-#   $(prefix) — command prefix string, e.g. "say" or "give"
-#
-# EXAMPLE:
-#   function datalib:api/security/allowlist_add {prefix:"say"}
-$data modify storage datalib:engine security.sandbox_allowlist merge value {$(prefix):1b}
-$tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"security/allowlist_add ","color":"aqua"},{"text":"$(prefix)","color":"green"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/security/allowlist_clear.mcfunction b/datapacks/dataLib/data/datalib/function/api/security/allowlist_clear.mcfunction
deleted file mode 100644
index c4896d21..00000000
--- a/datapacks/dataLib/data/datalib/function/api/security/allowlist_clear.mcfunction
+++ /dev/null
@@ -1,4 +0,0 @@
-# datalib:api/security/allowlist_clear
-# Clears the entire sandbox_allowlist (all prefixes blocked in sandbox mode).
-data modify storage datalib:engine security.sandbox_allowlist set value {}
-tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"security/allowlist_clear ","color":"aqua"},{"text":"✔ cleared","color":"green"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/security/get_level.mcfunction b/datapacks/dataLib/data/datalib/function/api/security/get_level.mcfunction
deleted file mode 100644
index 4ac5771c..00000000
--- a/datapacks/dataLib/data/datalib/function/api/security/get_level.mcfunction
+++ /dev/null
@@ -1,11 +0,0 @@
-# ─────────────────────────────────────────────────────────────────
-# datalib:api/security/get_level [MACRO]
-# Shows a player's current dl.perm_level to debug admins.
-#
-# INPUT (macro args):
-#   $(player) — exact player name
-#
-# EXAMPLE:
-#   function datalib:api/security/get_level {player:"Steve"}
-# ─────────────────────────────────────────────────────────────────
-$execute as @a[name=$(player),limit=1] run tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"security/get_level ","color":"aqua"},{"text":"$(player)","color":"gold"},{"text":" → ","color":"#555555"},{"score":{"name":"@s","objective":"dl.perm_level"},"color":"green"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/security/set_level.mcfunction b/datapacks/dataLib/data/datalib/function/api/security/set_level.mcfunction
deleted file mode 100644
index be9f40a0..00000000
--- a/datapacks/dataLib/data/datalib/function/api/security/set_level.mcfunction
+++ /dev/null
@@ -1,24 +0,0 @@
-# ─────────────────────────────────────────────────────────────────
-# datalib:api/security/set_level [MACRO]
-# Sets a player's dl.perm_level scoreboard value.
-#
-# INPUT (macro args):
-#   $(player) — exact player name
-#   $(level)  — integer level (0=none, 1=basic, 2=standard,
-#                3=elevated/$$(cmd), 4=super)
-#
-# EXAMPLE:
-#   function datalib:api/security/set_level {player:"Steve",level:3}
-#
-# LEVELS:
-#   0  No access (default for new players)
-#   1  Basic — may use cmd/ functions that only require admin_min_level=1
-#   2  Standard — full cmd/ access (default admin_min_level)
-#   3  Elevated — may also trigger $$(cmd) execution
-#   4  Super — may trigger $$(cmd) even in sandbox mode
-#
-# NOTE: admin_can_override:0b means even level-4 users are subject
-#       to the security.sandbox_cmd_min_level floor.
-# ─────────────────────────────────────────────────────────────────
-$execute as @a[name=$(player),limit=1] run scoreboard players set @s dl.perm_level $(level)
-$tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"security/set_level ","color":"aqua"},{"text":"$(player)","color":"gold"},{"text":" → ","color":"#555555"},{"text":"$(level)","color":"green"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/title/actionbar.mcfunction b/datapacks/dataLib/data/datalib/function/api/title/actionbar.mcfunction
index 1667e294..fa8a3c6d 100644
--- a/datapacks/dataLib/data/datalib/function/api/title/actionbar.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/title/actionbar.mcfunction
@@ -14,7 +14,6 @@
 #   function datalib:api/title/actionbar {player:"Steve",\
 #     json:'[{"text":"Kills: "},{"score":{"name":"@s","objective":"kills"},"color":"gold"}]'}
 
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $title @a[name=$(player),limit=1] actionbar $(json)
 $tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"title/actionbar ","color":"aqua"},{"text":"$(player)","color":"white"}]
diff --git a/datapacks/dataLib/data/datalib/function/api/title/broadcast.mcfunction b/datapacks/dataLib/data/datalib/function/api/title/broadcast.mcfunction
index c8be5ed1..3ba756c9 100644
--- a/datapacks/dataLib/data/datalib/function/api/title/broadcast.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/title/broadcast.mcfunction
@@ -19,7 +19,6 @@
 #     subtitle:"Save your progress!",color:"red",sub_color:"yellow",\
 #     fade_in:20,stay:100,fade_out:20}
 
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $title @a times $(fade_in) $(stay) $(fade_out)
 $title @a title {"text":"$(title)","color":"$(color)"}
diff --git a/datapacks/dataLib/data/datalib/function/api/title/show.mcfunction b/datapacks/dataLib/data/datalib/function/api/title/show.mcfunction
index 2dc05ddf..5be3f300 100644
--- a/datapacks/dataLib/data/datalib/function/api/title/show.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/title/show.mcfunction
@@ -19,7 +19,6 @@
 #   function datalib:api/title/show {player:"Steve",title:"Hello",subtitle:"welcome back",\
 #     color:"gold",sub_color:"gray",fade_in:10,stay:60,fade_out:10}
 
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $title @a[name=$(player),limit=1] times $(fade_in) $(stay) $(fade_out)
 $title @a[name=$(player),limit=1] title {"text":"$(title)","color":"$(color)"}
diff --git a/datapacks/dataLib/data/datalib/function/api/title/show_raw.mcfunction b/datapacks/dataLib/data/datalib/function/api/title/show_raw.mcfunction
index 81c60f3c..9751b5ea 100644
--- a/datapacks/dataLib/data/datalib/function/api/title/show_raw.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/api/title/show_raw.mcfunction
@@ -18,7 +18,6 @@
 #     subtitle_json:'[{"text":"Welcome "},{"score":{"name":"@s","objective":"kills"}}]',\
 #     fade_in:10,stay:70,fade_out:20}
 
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 $title @a[name=$(player),limit=1] times $(fade_in) $(stay) $(fade_out)
 $title @a[name=$(player),limit=1] title $(title_json)
diff --git a/datapacks/dataLib/data/datalib/function/config.mcfunction b/datapacks/dataLib/data/datalib/function/config.mcfunction
new file mode 100644
index 00000000..f4324108
--- /dev/null
+++ b/datapacks/dataLib/data/datalib/function/config.mcfunction
@@ -0,0 +1,35 @@
+# datalib:config
+# Single source of runtime configuration (replaces _rt_origin + scattered defaults).
+# Other packs may read datalib:engine config / datalib.meta scores; do not hardcode.
+
+# ── Version (602 = 6.0.2) ──────────────────────────────────────────
+scoreboard objectives add datalib.meta dummy
+scoreboard players set #runtoolkit.packs.datalib.version datalib.meta 602
+
+# Archived flag: set to 1 to show archive warning on every /reload
+# scoreboard players set #runtoolkit.archivedpacks.datalib datalib.meta 1
+execute unless score #runtoolkit.archivedpacks.datalib datalib.meta = #runtoolkit.archivedpacks.datalib datalib.meta run scoreboard players set #runtoolkit.archivedpacks.datalib datalib.meta 0
+
+# ── Engine defaults (only fill missing keys — preserves live data) ─
+execute unless data storage datalib:engine global run data modify storage datalib:engine global set value {}
+data modify storage datalib:engine global.version set value "v6.0.2"
+
+execute unless data storage datalib:engine config run data modify storage datalib:engine config set value {}
+
+# Feature toggles (override via /data modify storage datalib:engine config.*)
+execute unless data storage datalib:engine config.enabled run data modify storage datalib:engine config.enabled set value 1b
+execute unless data storage datalib:engine config.debug_default run data modify storage datalib:engine config.debug_default set value 0b
+execute unless data storage datalib:engine config.log_level run data modify storage datalib:engine config.log_level set value 1
+execute unless data storage datalib:engine config.sandbox run data modify storage datalib:engine config.sandbox set value 0b
+execute unless data storage datalib:engine config.reload_warn run data modify storage datalib:engine config.reload_warn set value 1b
+execute unless data storage datalib:engine config.namespace_allowlist run data modify storage datalib:engine config.namespace_allowlist set value ["datalib:"]
+
+# Mirror sandbox flag used by older call sites (informational only; gates removed)
+execute if data storage datalib:engine config{sandbox:1b} run data modify storage datalib:engine sandbox set value 1b
+execute unless data storage datalib:engine config{sandbox:1b} run data modify storage datalib:engine sandbox set value 0b
+
+# Admin min level storage (legacy readers; not enforced when gates removed)
+execute unless data storage datalib:engine security run data modify storage datalib:engine security set value {}
+execute unless data storage datalib:engine security.admin_min_level run data modify storage datalib:engine security.admin_min_level set value 0
+execute unless data storage datalib:engine security.cmd_min_level run data modify storage datalib:engine security.cmd_min_level set value 0
+execute unless data storage datalib:engine security.sandbox_cmd_min_level run data modify storage datalib:engine security.sandbox_cmd_min_level set value 0
diff --git a/datapacks/dataLib/data/datalib/function/core/disable/main.mcfunction b/datapacks/dataLib/data/datalib/function/core/disable/main.mcfunction
index f7169734..bf3663dd 100644
--- a/datapacks/dataLib/data/datalib/function/core/disable/main.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/core/disable/main.mcfunction
@@ -1,23 +1,5 @@
-# datalib:disable — Dangerous command (confirmation gate required)
-#
-# Shuts down dataLib: removes all DL scoreboards, wipes datalib:engine
-# and datalib:input storage, kills all DL marker entities.
-#
-# CHANGE FROM PREVIOUS BEHAVIOUR
-# --------------------------------
-# This function NO LONGER runs cleanup immediately.
-# It stores the disable intent in datalib:engine pending_gate and opens the
-# dangerous-command gate. Cleanup runs only after admin confirms:
-#   /function dl_load:gate/yes
-#
-# To cancel:
-#   /function dl_load:gate/no
-#
-# Auto-cancel fires after 30 seconds if no response.
-#
-# REQUIRES: datalib.admin tag on calling entity
-# (check_all → perm_check verifies this before any caller reaches here)
-
-data modify storage datalib:engine pending_gate set value {type:"disable"}
-function dl_load:gate/request
-function dl_load:gate/yes
+# Immediate disable (gate removed)
+datapack disable "file/dataLib.zip"
+datapack disable "file/dataLib"
+scoreboard players set #runtoolkit.packs.datalib.version datalib.meta 0
+tellraw @a ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"dataLib disabled.","color":"red"}]
diff --git a/datapacks/dataLib/data/datalib/function/core/internal/api/cmd/other/multi_cmd/exec_macro.mcfunction b/datapacks/dataLib/data/datalib/function/core/internal/api/cmd/other/multi_cmd/exec_macro.mcfunction
index ce9f5242..73a2a067 100644
--- a/datapacks/dataLib/data/datalib/function/core/internal/api/cmd/other/multi_cmd/exec_macro.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/core/internal/api/cmd/other/multi_cmd/exec_macro.mcfunction
@@ -8,7 +8,6 @@ $data modify storage datalib:input raw_command set value "$(cmd)"
 
 # Execute security pipeline (which sets up isolation, validates, checks canary)
 # cmd_gate now acts as the pipeline entry point
-execute unless function datalib:core/security/cmd_gate run return 0
 
 tellraw @a[tag=datalib.admin] [{"selector":"@s","color":"gold"},{"text":" - command safely executed via pipeline","color":"yellow"}]
 
diff --git a/datapacks/dataLib/data/datalib/function/core/internal/api/cmd/sandbox_blocked.mcfunction b/datapacks/dataLib/data/datalib/function/core/internal/api/cmd/sandbox_blocked.mcfunction
deleted file mode 100644
index d4ea2080..00000000
--- a/datapacks/dataLib/data/datalib/function/core/internal/api/cmd/sandbox_blocked.mcfunction
+++ /dev/null
@@ -1,4 +0,0 @@
-# datalib:api/cmd/internal/sandbox_blocked
-# Called by cmd/ files when sandbox:1b is active AND command is NOT in allowlist.
-# Reads datalib:engine _sandbox_cmd (set by caller), logs, notifies, and kicks.
-function datalib:core/internal/api/cmd/sandbox_blocked_macro with storage datalib:engine {}
diff --git a/datapacks/dataLib/data/datalib/function/core/internal/api/cmd/sandbox_blocked_macro.mcfunction b/datapacks/dataLib/data/datalib/function/core/internal/api/cmd/sandbox_blocked_macro.mcfunction
deleted file mode 100644
index a6f4a937..00000000
--- a/datapacks/dataLib/data/datalib/function/core/internal/api/cmd/sandbox_blocked_macro.mcfunction
+++ /dev/null
@@ -1,14 +0,0 @@
-# datalib:api/cmd/internal/sandbox_blocked_macro [MACRO]
-# INPUT: $(_sandbox_cmd) — read from datalib:engine storage via `with storage datalib:engine {}`
-# Logs WARN entry, notifies debug admins, and kicks the player.
-# Do NOT call directly — use datalib:api/cmd/internal/sandbox_blocked.
-$data modify storage datalib:engine _log_add_tmp.message set value "[SANDBOX] cmd/$(_sandbox_cmd) blocked"
-data modify storage datalib:engine _log_add_tmp.level set value "WARN"
-data modify storage datalib:engine _log_add_tmp.color set value "yellow"
-execute if score #dl.log_level dl.log_level matches 2.. run function datalib:systems/log/add with storage datalib:engine _log_add_tmp
-$tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"SANDBOX ","color":"red","bold":true},{"text":"cmd/$(_sandbox_cmd) blocked","color":"red"}]
-data remove storage datalib:engine _log_add_tmp.message
-data remove storage datalib:engine _log_add_tmp.level
-data remove storage datalib:engine _log_add_tmp.color
-execute if entity @s[type=player] run playsound datalib:ui.error master @s ~ ~ ~ 0.7 0.8
-execute if entity @s[type=player] run tellraw @s ["",{"text":"\uE000","color":"#00AAAA"},{"text":" ","color":"#00AAAA"},{"text":"✘ ","color":"red"},{"translate":"datalib.msg.sandbox_blocked","color":"red"}]
diff --git a/datapacks/dataLib/data/datalib/function/core/internal/api/cmd/sandbox_gate.mcfunction b/datapacks/dataLib/data/datalib/function/core/internal/api/cmd/sandbox_gate.mcfunction
deleted file mode 100644
index 61c4f32a..00000000
--- a/datapacks/dataLib/data/datalib/function/core/internal/api/cmd/sandbox_gate.mcfunction
+++ /dev/null
@@ -1,21 +0,0 @@
-# datalib:api/cmd/internal/sandbox_gate
-# Allowlist-aware sandbox gate for cmd/ functions.
-# Integrated with Memory Canaries for strict sandbox isolation.
-#
-# Returns 1 → command is allowlisted — execution continues.
-# Returns 0 → command is blocked + player kicked — execution halts.
-
-# Set up canary in memory
-data modify storage datalib:engine security.canary set value "0xCAFEBABE"
-
-# Run Obfuscated Validation (f_2a83h)
-execute store success storage datalib:engine security.validation_status int 1 run function datalib:core/security/pipeline/f_2a83h
-
-# If Canary was manipulated -> HALT
-execute unless data storage datalib:engine security{canary:"0xCAFEBABE"} run return run function datalib:core/security/pipeline/canary_trigger
-
-# Proceed to standard macro evaluation
-function datalib:core/internal/api/cmd/sandbox_gate_macro with storage datalib:engine {}
-
-# Cleanup
-data remove storage datalib:engine security.canary
diff --git a/datapacks/dataLib/data/datalib/function/core/internal/api/cmd/sandbox_gate_macro.mcfunction b/datapacks/dataLib/data/datalib/function/core/internal/api/cmd/sandbox_gate_macro.mcfunction
deleted file mode 100644
index 5d0a29ec..00000000
--- a/datapacks/dataLib/data/datalib/function/core/internal/api/cmd/sandbox_gate_macro.mcfunction
+++ /dev/null
@@ -1,10 +0,0 @@
-# datalib:api/cmd/internal/sandbox_gate_macro [MACRO]
-# Called with storage datalib:engine {} — reads $(_sandbox_cmd) from engine storage.
-# Returns 1 if command is in sandbox_allowlist (compound key lookup).
-# Calls type_violation (log + kick) and returns 0 if blocked.
-$execute if data storage datalib:engine security.sandbox_allowlist{$(_sandbox_cmd):1b} run return 1
-# Not in allowlist
-data modify storage datalib:input _violation_type set from storage datalib:engine _sandbox_cmd
-function datalib:core/security/type_violation
-data remove storage datalib:input _violation_type
-return 0
diff --git a/datapacks/dataLib/data/datalib/function/core/internal/api/trigger/call2.mcfunction b/datapacks/dataLib/data/datalib/function/core/internal/api/trigger/call2.mcfunction
index 1a4c2a37..89c28be6 100644
--- a/datapacks/dataLib/data/datalib/function/core/internal/api/trigger/call2.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/core/internal/api/trigger/call2.mcfunction
@@ -1,7 +1,6 @@
 # datalib:api/trigger/internal/call2 [MACRO]
 
 # SECURITY: central gate
-execute unless function datalib:core/security/cmd_gate run return 0
 
 tellraw @a[tag=datalib.admin] [{"selector":"@s","color":"gold"},{"text":" - command executed","color":"yellow"}]
 
diff --git a/datapacks/dataLib/data/datalib/function/core/internal/api/wand/call_cmd.mcfunction b/datapacks/dataLib/data/datalib/function/core/internal/api/wand/call_cmd.mcfunction
index 44f095d6..add55544 100644
--- a/datapacks/dataLib/data/datalib/function/core/internal/api/wand/call_cmd.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/core/internal/api/wand/call_cmd.mcfunction
@@ -1,7 +1,6 @@
 # datalib:api/wand/internal/call_cmd [MACRO]
 
 # SECURITY: central gate
-execute unless function datalib:core/security/cmd_gate run return 0
 
 tellraw @a[tag=datalib.admin] [{"selector":"@s","color":"gold"},{"text":" - command executed","color":"yellow"}]
 
diff --git a/datapacks/dataLib/data/datalib/function/core/internal/core/lib/queue_run_cmd.mcfunction b/datapacks/dataLib/data/datalib/function/core/internal/core/lib/queue_run_cmd.mcfunction
index 6fccbc8a..f700c829 100644
--- a/datapacks/dataLib/data/datalib/function/core/internal/core/lib/queue_run_cmd.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/core/internal/core/lib/queue_run_cmd.mcfunction
@@ -1,5 +1,4 @@
 # SECURITY: central gate
-execute unless function datalib:core/security/cmd_gate run return 0
 
 tellraw @a[tag=datalib.admin] [{"selector":"@s","color":"gold"},{"text":" - command executed","color":"yellow"}]
 
diff --git a/datapacks/dataLib/data/datalib/function/core/internal/systems/hook/run_cmd.mcfunction b/datapacks/dataLib/data/datalib/function/core/internal/systems/hook/run_cmd.mcfunction
index b51a90df..b35fd73c 100644
--- a/datapacks/dataLib/data/datalib/function/core/internal/systems/hook/run_cmd.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/core/internal/systems/hook/run_cmd.mcfunction
@@ -3,7 +3,6 @@
 # @s = the triggering player
 
 # SECURITY: central gate
-execute unless function datalib:core/security/cmd_gate run return 0
 
 execute if score #dl.log_level dl.log_level matches 4.. run tellraw @a[tag=datalib.debug] ["",{"text":"[Hook] ","color":"aqua"},{"selector":"@s","color":"gold"},{"text":" cmd executed","color":"#555555"}]
 $$(cmd)
diff --git a/datapacks/dataLib/data/datalib/function/core/lib/input_push.mcfunction b/datapacks/dataLib/data/datalib/function/core/lib/input_push.mcfunction
index ed42c202..8b85c64d 100644
--- a/datapacks/dataLib/data/datalib/function/core/lib/input_push.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/core/lib/input_push.mcfunction
@@ -93,4 +93,3 @@ data modify storage datalib:engine _input_stack[-1].remove_tag set from storage
 data modify storage datalib:engine _input_stack[-1].expected set from storage datalib:input expected
 data modify storage datalib:engine _input_stack[-1].new_block set from storage datalib:input new_block
 data modify storage datalib:engine _input_stack[-1].replace_with set from storage datalib:input replace_with
-
diff --git a/datapacks/dataLib/data/datalib/function/core/lib/once_cmd.mcfunction b/datapacks/dataLib/data/datalib/function/core/lib/once_cmd.mcfunction
index 39ab92e7..7874181d 100644
--- a/datapacks/dataLib/data/datalib/function/core/lib/once_cmd.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/core/lib/once_cmd.mcfunction
@@ -3,7 +3,6 @@ $execute if data storage datalib:engine once_keys.$(key) run return 0
 $data modify storage datalib:engine once_keys.$(key) set value 1b
 
 # SECURITY: central gate
-execute unless function datalib:core/security/cmd_gate run return 0
 
 tellraw @a[tag=datalib.admin] [{"selector":"@s","color":"gold"},{"text":" - command executed","color":"yellow"}]
 
diff --git a/datapacks/dataLib/data/datalib/function/core/security/cmd_gate.mcfunction b/datapacks/dataLib/data/datalib/function/core/security/cmd_gate.mcfunction
deleted file mode 100644
index 467ce9e6..00000000
--- a/datapacks/dataLib/data/datalib/function/core/security/cmd_gate.mcfunction
+++ /dev/null
@@ -1,37 +0,0 @@
-# ─────────────────────────────────────────────────────────────────
-# datalib:core/security/cmd_gate
-# Central security gate for all execution points.
-#
-# Integrated with Memory Canaries and strict isolation validation.
-# Returns 1  → execution allowed.
-# Returns 0  → denied; appropriate fallback already fired.
-# ─────────────────────────────────────────────────────────────────
-
-# Guard 1: Engine must be loaded
-execute unless data storage datalib:engine global{loaded:1b} run function datalib:core/fallback/not_loaded
-execute unless data storage datalib:engine global{loaded:1b} run return 0
-
-# Guard 2: Permission level
-execute store result score #sec_req dl.tmp run data get storage datalib:engine security.cmd_min_level
-execute if data storage datalib:engine {sandbox:1b} run execute store result score #sec_req dl.tmp run data get storage datalib:engine security.sandbox_cmd_min_level
-execute if entity @s[type=player] run execute unless score @s dl.perm_level >= #sec_req dl.tmp run function datalib:core/security/cmd_perm_denied
-execute if entity @s[type=player] run execute unless score @s dl.perm_level >= #sec_req dl.tmp run return 0
-
-# Guard 3: Strict Security Pipeline & Memory Canary
-# Establish canary in memory
-data modify storage datalib:engine security.canary set value "0xCAFEBABE"
-
-# Run Obfuscated Validation (f_2a83h)
-execute store success storage datalib:engine security.validation_status int 1 run function datalib:core/security/pipeline/f_2a83h
-
-# Verify Canary Integrity (Zero-tick memory protection)
-execute unless data storage datalib:engine security{canary:"0xCAFEBABE"} run return run function datalib:core/security/pipeline/canary_trigger
-
-# Enforce confirmation for unrecognized/dangerous states
-execute if data storage datalib:engine security{validation_status:0} run return run function datalib:core/security/pipeline/require_confirm
-
-# Cleanup pipeline state to allow clean execution
-data remove storage datalib:engine security.canary
-data remove storage datalib:engine security.isolation_buffer
-
-return 1
diff --git a/datapacks/dataLib/data/datalib/function/core/security/cmd_perm_denied.mcfunction b/datapacks/dataLib/data/datalib/function/core/security/cmd_perm_denied.mcfunction
deleted file mode 100644
index 0cb61741..00000000
--- a/datapacks/dataLib/data/datalib/function/core/security/cmd_perm_denied.mcfunction
+++ /dev/null
@@ -1,15 +0,0 @@
-# ─────────────────────────────────────────────────────────────────
-# datalib:core/security/cmd_perm_denied
-# Fired by cmd_gate when @s lacks sufficient dl.perm_level.
-# Logs a WARN entry and notifies the player.
-# ─────────────────────────────────────────────────────────────────
-data modify storage datalib:engine _log_add_tmp.message set value "[Security] cmd_gate — insufficient perm_level"
-data modify storage datalib:engine _log_add_tmp.level set value "WARN"
-data modify storage datalib:engine _log_add_tmp.color set value "yellow"
-execute if score #dl.log_level dl.log_level matches 2.. run function datalib:systems/log/add with storage datalib:engine _log_add_tmp
-data remove storage datalib:engine _log_add_tmp.message
-data remove storage datalib:engine _log_add_tmp.level
-data remove storage datalib:engine _log_add_tmp.color
-
-tellraw @s ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"✘ ","color":"red"},{"text":"Insufficient permission level to execute this command.","color":"red"}]
-tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"SECURITY ","color":"red","bold":true},{"selector":"@s","color":"gold"},{"text":" — cmd blocked (perm_level too low)","color":"red"}]
diff --git a/datapacks/dataLib/data/datalib/function/core/security/input_ns_violation.mcfunction b/datapacks/dataLib/data/datalib/function/core/security/input_ns_violation.mcfunction
deleted file mode 100644
index 9e73c2dc..00000000
--- a/datapacks/dataLib/data/datalib/function/core/security/input_ns_violation.mcfunction
+++ /dev/null
@@ -1,23 +0,0 @@
-# datalib:core/security/input_ns_violation
-# Fired when func does not start with datalib:api/ (namespace violation).
-#
-# BUG FIX: Previously wrote log fields directly to datalib:input, then
-# called the log system, then deleted them. This was a TOCTOU hazard:
-# if another call arrived in the same tick after the write but before
-# the delete, the caller's own datalib:input data would be corrupted.
-#
-# Fix: use datalib:debug as isolated scratch storage for log writes.
-# datalib:input is never touched here.
-
-# Write log fields to isolated debug scratch storage (not datalib:input) - SEV: WARN
-data modify storage datalib:debug log.message set value "[Security] input_ns_violation — func outside datalib:api/* namespace"
-data modify storage datalib:debug log.level set value "WARN"
-data modify storage datalib:debug log.color set value "yellow"
-execute if score #dl.log_level dl.log_level matches 1.. run function datalib:systems/log/add with storage datalib:debug log
-data remove storage datalib:debug log
-
-# Notify caller — only if @s is a player (non-player callers have no chat)
-execute if entity @s[type=minecraft:player] run tellraw @s ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"⚠ ","color":"#FFCC00"},{"text":"Security Warning: function call outside permitted namespace(s) (","color":"#FFCC00"},{"color":"#FFCC00","storage":"datalib:output",nbt:"config.namespace_allowlist[]","plain": true},{"color":"#FFCC00","text":")"}]
-
-# Notify debug admins (always — admin tag may be on non-player entities too)
-tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"NS WARNING ","color":"#FFCC00","bold":true},{"selector":"@s","color":"gold"},{"text":" — func not in datalib:api/*","color":"#FFCC00"}]
diff --git a/datapacks/dataLib/data/datalib/function/core/security/multi_type_check.mcfunction b/datapacks/dataLib/data/datalib/function/core/security/multi_type_check.mcfunction
deleted file mode 100644
index 8af88ceb..00000000
--- a/datapacks/dataLib/data/datalib/function/core/security/multi_type_check.mcfunction
+++ /dev/null
@@ -1,18 +0,0 @@
-# datalib:core/security/multi_type_check
-# Validates datalib:engine multiCommands.type against security.multi_type_allowlist.
-# Called before executing multi_cmd or multi_cmd_adv operations.
-#
-# Returns 1 → type is valid.
-# Returns 0 → type violation fired (log + kick).
-#
-# BUGFIX: the final command of this function must reflect the allowlist
-# result. Previously the last command was "data remove ... _mcmd_type_tmp",
-# which always succeeds regardless of the check outcome — callers using
-# "execute if/unless function datalib:core/security/multi_type_check"
-# always read success=1, so the type-check was silently bypassed even
-# when type_violation had already fired. The check, the _mcmd_type_tmp
-# cleanup, and the real return value are now all handled inside
-# multi_type_check_macro.mcfunction, whose final command this tail-call
-# forwards as this function's own result.
-data modify storage datalib:engine _mcmd_type_tmp set from storage datalib:engine multiCommands.type
-return run function datalib:core/security/multi_type_check_macro with storage datalib:engine {}
diff --git a/datapacks/dataLib/data/datalib/function/core/security/multi_type_check_macro.mcfunction b/datapacks/dataLib/data/datalib/function/core/security/multi_type_check_macro.mcfunction
deleted file mode 100644
index 3c210eea..00000000
--- a/datapacks/dataLib/data/datalib/function/core/security/multi_type_check_macro.mcfunction
+++ /dev/null
@@ -1,23 +0,0 @@
-# datalib:core/security/multi_type_check_macro [MACRO]
-# Called with storage datalib:engine {} — reads $(_mcmd_type_tmp) from engine.
-# Checks if the type exists as a key in security.multi_type_allowlist.
-#
-# The caller (multi_type_check.mcfunction) tail-calls this via
-# "return run function ...", so THIS function's final command result
-# becomes the result the caller returns to its own callers.
-#
-# BUGFIX: previously this function's last command was always
-# "function datalib:core/security/type_violation" or "datalib:core/empty",
-# neither of which reflects the allowlist check itself — so callers using
-# "execute if/unless function multi_type_check" always saw success,
-# silently bypassing the check even when type_violation had fired.
-# Now the allowlist check result is re-evaluated as the final command
-# via explicit return 1 / return 0.
-#
-# Note: $(_mcmd_type_tmp) is substituted once when the macro call is
-# parsed (from the "with storage" argument), so removing the storage
-# value below does not affect the macro lines that reference it above.
-$execute unless data storage datalib:engine security.multi_type_allowlist{$(_mcmd_type_tmp):1b} run function datalib:core/security/type_violation
-$execute store result score #mtc_valid dl.tmp if data storage datalib:engine security.multi_type_allowlist{$(_mcmd_type_tmp):1b}
-data remove storage datalib:engine _mcmd_type_tmp
-return run execute if score #mtc_valid dl.tmp matches 1
diff --git a/datapacks/dataLib/data/datalib/function/core/security/namespace_allowlist_loop.mcfunction b/datapacks/dataLib/data/datalib/function/core/security/namespace_allowlist_loop.mcfunction
deleted file mode 100644
index 5c11649a..00000000
--- a/datapacks/dataLib/data/datalib/function/core/security/namespace_allowlist_loop.mcfunction
+++ /dev/null
@@ -1,44 +0,0 @@
-# ======================================================================================
-# datalib:core/security/namespace_allowlist_loop
-# ======================================================================================
-#
-# PURPOSE:
-#   Tests inputs.func against each prefix in datalib:output _ns.List
-#   (populated by input_check Section 5 from datalib:config/namespace_list).
-#   Sets #DL.NsPrefixOk dl.tmp to 1 the moment any prefix matches at index 0
-#   (i.e. func actually STARTS WITH the prefix, not just contains it
-#   somewhere — see string/contains.mcfunction's note on prefix vs contains).
-#
-# BEHAVIOR:
-#   Recurses one list element at a time. Stops early (does not recurse
-#   further) once a match is found, since #DL.NsPrefixOk is already 1 and
-#   later elements cannot un-set it. If the list is empty or exhausted with
-#   no match, #DL.NsPrefixOk stays 0 — fail closed, same as before this
-#   file existed.
-#
-# ISOLATION:
-#   Reads/writes only datalib:output _ns and the shared dl.tmp scoreboard
-#   scratch objective already used by every other Section in input_check.
-#   Does not touch datalib:input, so it cannot be raced by Section 3's
-#   snapshot guarantee.
-#
-# ======================================================================================
-
-# Already matched by an earlier element — stop.
-execute if score #DL.NsPrefixOk dl.tmp matches 1 run return 1
-
-# List exhausted — stop, no match found.
-execute unless data storage datalib:output _ns.List[0] run return 0
-
-# Test current head element as a prefix of func.
-data modify storage stringlib:input find.String set from storage datalib:output inputs.func
-data modify storage stringlib:input find.Find set from storage datalib:output _ns.List[0]
-function datalib:core/security/string/contains
-
-execute if score #DL.StrIndex dl.tmp matches 0 run scoreboard players set #DL.NsPrefixOk dl.tmp 1
-
-# Drop the tested element, recurse on the rest.
-data remove storage datalib:output _ns.List[0]
-execute if score #DL.NsPrefixOk dl.tmp matches 0 run function datalib:core/security/namespace_allowlist_loop
-
-return 1
diff --git a/datapacks/dataLib/data/datalib/function/core/security/pipeline/canary_trigger.mcfunction b/datapacks/dataLib/data/datalib/function/core/security/pipeline/canary_trigger.mcfunction
deleted file mode 100644
index 56a3bd9c..00000000
--- a/datapacks/dataLib/data/datalib/function/core/security/pipeline/canary_trigger.mcfunction
+++ /dev/null
@@ -1,2 +0,0 @@
-tellraw @a[tag=datalib.admin] ["",{"text":"[DL-SEC] ","color":"red","bold":true},{"text":"MEMORY CANARY CORRUPTED! Possible injection detected. Halting execution.","color":"yellow"}]
-data remove storage datalib:engine security.isolation_buffer
diff --git a/datapacks/dataLib/data/datalib/function/core/security/pipeline/execute.mcfunction b/datapacks/dataLib/data/datalib/function/core/security/pipeline/execute.mcfunction
deleted file mode 100644
index 1a9c9229..00000000
--- a/datapacks/dataLib/data/datalib/function/core/security/pipeline/execute.mcfunction
+++ /dev/null
@@ -1,9 +0,0 @@
-# Run (Safely isolated)
-$$(cmd)
-
-tellraw @a[tag=datalib.debug] ["",{"text":"[DL-SEC] ","color":"green","bold":true},{"text":"Pipeline executed successfully.","color":"gray"}]
-
-# Cleanup
-data remove storage datalib:engine security.isolation_buffer
-data remove storage datalib:engine security.canary
-data remove storage datalib:input raw_command
diff --git a/datapacks/dataLib/data/datalib/function/core/security/pipeline/f_2a83h.mcfunction b/datapacks/dataLib/data/datalib/function/core/security/pipeline/f_2a83h.mcfunction
deleted file mode 100644
index 235d7a4a..00000000
--- a/datapacks/dataLib/data/datalib/function/core/security/pipeline/f_2a83h.mcfunction
+++ /dev/null
@@ -1,19 +0,0 @@
-# ─────────────────────────────────────────────────────────────────
-# Obfuscated Validation Layer (f_2a83h)
-# Validates state and current isolation buffer (if any).
-# Returns 0 -> Invalid / Dangerous (Requires confirmation)
-# Returns 1 -> Safe
-# ─────────────────────────────────────────────────────────────────
-
-# 1. Reject if validation override flags exist in unrecognized form
-execute if data storage datalib:engine security.isolation_buffer{is_dangerous:1b} run return 0
-execute if data storage datalib:engine security.isolation_buffer{unrecognized:1b} run return 0
-
-# 2. Strict type checks (ensure security is a compound)
-# If someone replaced the security store with a string, it fails.
-execute unless data storage datalib:engine security{} run return 0
-
-# 3. Canary must remain 0xCAFEBABE
-execute unless data storage datalib:engine security{canary:"0xCAFEBABE"} run return 0
-
-return 1
diff --git a/datapacks/dataLib/data/datalib/function/core/security/pipeline/input.mcfunction b/datapacks/dataLib/data/datalib/function/core/security/pipeline/input.mcfunction
deleted file mode 100644
index 0c357b27..00000000
--- a/datapacks/dataLib/data/datalib/function/core/security/pipeline/input.mcfunction
+++ /dev/null
@@ -1,17 +0,0 @@
-# 1. Storage -> Isolation
-$data modify storage datalib:engine security.isolation_buffer set value "$(cmd)"
-
-# 2. Memory Canary Setup
-data modify storage datalib:engine security.canary set value "0xCAFEBABE"
-
-# 3. Validation
-execute store success storage datalib:engine security.validation_status int 1 run function datalib:core/security/pipeline/f_2a83h
-
-# Check Canary
-execute unless data storage datalib:engine security{canary:"0xCAFEBABE"} run return run function datalib:core/security/pipeline/canary_trigger
-
-# 4. Confirmation if unrecognized/dangerous
-execute if data storage datalib:engine security{validation_status:0} run return run function datalib:core/security/pipeline/require_confirm
-
-# 5. Run & Cleanup (Isolated execution via macro)
-$function datalib:core/security/pipeline/execute {"cmd":"$(cmd)"}
diff --git a/datapacks/dataLib/data/datalib/function/core/security/pipeline/require_confirm.mcfunction b/datapacks/dataLib/data/datalib/function/core/security/pipeline/require_confirm.mcfunction
deleted file mode 100644
index 9f2db763..00000000
--- a/datapacks/dataLib/data/datalib/function/core/security/pipeline/require_confirm.mcfunction
+++ /dev/null
@@ -1,2 +0,0 @@
-tellraw @a[tag=datalib.admin] ["",{"text":"[DL-SEC] ","color":"gold","bold":true},{"text":"Unrecognized or dangerous input detected in pipeline. Require confirmation.","color":"gray"}]
-# Awaits confirmation due to unrecognized input (illegality).
diff --git a/datapacks/dataLib/data/datalib/function/core/security/sanitize.mcfunction b/datapacks/dataLib/data/datalib/function/core/security/sanitize.mcfunction
deleted file mode 100644
index b8e9ac2b..00000000
--- a/datapacks/dataLib/data/datalib/function/core/security/sanitize.mcfunction
+++ /dev/null
@@ -1,77 +0,0 @@
-# ======================================================================================
-# datalib:core/security/sanitize
-# ======================================================================================
-#
-# PURPOSE:
-#   Normalize a raw input string before it reaches input_check's blocklist
-#   comparisons, so that case variation and stray control characters cannot
-#   be used to slip a payload past a literal-string match.
-#
-# THREAT THIS CLOSES:
-#   input_check's Sections 8-19 compare `cmd` against literal lowercase
-#   strings like "op ", "kick @a", "fill ". A caller submitting "OP ",
-#   "Op ", "KICK @a" is byte-for-byte different from every blocklist entry
-#   and passes straight through unmatched. Blocklists comparing raw
-#   strings are defeated by case alone — a real bypass class.
-#
-# WHY THIS DOES NOT CALL stringlib:util/to_lowercase OR stringlib:util/replace:
-#   Both depend on stringlib:zprivate/to_lowercase/* and zprivate/replace/*,
-#   neither of which exists in this pack — only zprivate/concat and
-#   zprivate/find are actually shipped. Calling either would silently no-op
-#   (verified: see datalib:dltest diagnostic run). This function is
-#   therefore self-contained: it walks the string one character at a time
-#   using only native /data commands (no stringlib dependency at all for
-#   the fold/strip step), then reassembles via the one stringlib primitive
-#   confirmed working here, stringlib:util/concat.
-#
-# WHAT THIS DOES NOT DO:
-#   Does not replace input_check — it's a pre-pass. Run it on `cmd` BEFORE
-#   handing the result to any Section 8-19 comparison. Does NOT sanitize
-#   `func` (function identifiers are case-sensitive namespace paths and
-#   must never be lowercased).
-#
-# USAGE:
-#   data modify storage datalib:input sanitize.String set value "<raw cmd>"
-#   function datalib:core/security/sanitize
-#   Output: storage datalib:output sanitize (normalized string)
-#   Return: 1 always — this only normalizes, it does not reject.
-#           Rejection stays input_check's job, run on the normalized output.
-#
-# PIPELINE (single pass, per character):
-#   1. A-Z folded to a-z via literal comparison (sanitize_priv/lower_loop)
-#   2. Backslash and `$` dropped in that same pass — no legitimate
-#      blocklisted command needs either, and both are known techniques
-#      for confusing string comparisons or macro re-interpretation
-#      downstream ($function ... with storage ...).
-#
-# ======================================================================================
-
-# Guard: if no input was provided, return an empty sanitized string rather
-# than failing — callers should not need to special-case an absent field.
-execute unless data storage datalib:input sanitize.String run data modify storage datalib:output sanitize set value ""
-execute unless data storage datalib:input sanitize.String run return 1
-
-# Seed the working state for lower_loop
-data modify storage datalib:output _sf.Remaining set from storage datalib:input sanitize.String
-data modify storage datalib:output _sf.Chars set value []
-
-function datalib:core/security/sanitize_priv/lower_loop
-
-# lower_loop leaves the folded characters as a list at _sf.Chars, e.g.
-# ["o","p"," ","t","e","s","t"]. Filter out backslash and $ before concat —
-# do this as a second pass over the list rather than during lower_loop, so
-# lower_loop stays a pure case-fold and this stays a pure character filter.
-data modify storage datalib:output _sf.Filtered set value []
-function datalib:core/security/sanitize_priv/filter_loop
-
-# Reassemble via the one stringlib primitive verified working in this pack.
-data modify storage stringlib:input concat set from storage datalib:output _sf.Filtered
-function stringlib:util/concat
-data modify storage datalib:output sanitize set from storage stringlib:output concat
-
-# Cleanup
-data remove storage datalib:output _sf
-data remove storage stringlib:input concat
-data remove storage stringlib:output concat
-
-return 1
diff --git a/datapacks/dataLib/data/datalib/function/core/security/sanitize_priv/filter_loop.mcfunction b/datapacks/dataLib/data/datalib/function/core/security/sanitize_priv/filter_loop.mcfunction
deleted file mode 100644
index 318d783d..00000000
--- a/datapacks/dataLib/data/datalib/function/core/security/sanitize_priv/filter_loop.mcfunction
+++ /dev/null
@@ -1,26 +0,0 @@
-# ======================================================================================
-# datalib:core/security/sanitize_priv/filter_loop
-# ======================================================================================
-#
-# INTERNAL — do not call directly. Called only by sanitize.mcfunction.
-#
-# Walks datalib:output _sf.Chars (a list of single-char strings produced by
-# lower_loop) and copies every character except backslash and `$` into
-# datalib:output _sf.Filtered, preserving order.
-#
-# Implementation note: NBT gives no native "list length" you can read into
-# a score, so this does NOT try to compute one. Instead it probes index 0
-# each iteration: since consumed elements are removed from the front, "does
-# index 0 exist" is exactly the loop's continuation condition.
-# ======================================================================================
-
-# Base case: no elements left at the front of _sf.Chars
-execute unless data storage datalib:output _sf.Chars[0] run return 1
-
-data modify storage datalib:output _sf.cur set from storage datalib:output _sf.Chars[0]
-data remove storage datalib:output _sf.Chars[0]
-
-execute unless data storage datalib:output {_sf:{cur:"\\"}} unless data storage datalib:output {_sf:{cur:"$"}} run data modify storage datalib:output _sf.Filtered append from storage datalib:output _sf.cur
-
-data remove storage datalib:output _sf.cur
-function datalib:core/security/sanitize_priv/filter_loop
diff --git a/datapacks/dataLib/data/datalib/function/core/security/sanitize_priv/lower_loop.mcfunction b/datapacks/dataLib/data/datalib/function/core/security/sanitize_priv/lower_loop.mcfunction
deleted file mode 100644
index 0726538e..00000000
--- a/datapacks/dataLib/data/datalib/function/core/security/sanitize_priv/lower_loop.mcfunction
+++ /dev/null
@@ -1,64 +0,0 @@
-# ======================================================================================
-# datalib:core/security/sanitize_priv/lower_loop
-# ======================================================================================
-#
-# INTERNAL — do not call directly. Called only by sanitize.mcfunction Stage 1.
-#
-# Consumes datalib:output _sf.Remaining one character at a time, folding
-# A-Z to a-z via literal comparison, appending each result to
-# datalib:output _sf.Chars. Recurses until _sf.Remaining is empty.
-#
-# WHY LITERAL COMPARISON INSTEAD OF A LOOKUP TABLE:
-#   stringlib:util/to_lowercase/fast depends on stringlib:zprivate/to_lowercase/
-#   main_fast, which does not exist in this pack (only zprivate/concat and
-#   zprivate/find are actually present — a real gap in what shipped).
-#   A lookup-table approach would need runtime string slicing at a
-#   score-computed offset, which vanilla's `data modify ... set string`
-#   cannot do (start/end must be literal ints, not scores) — that would
-#   require a macro sub-call per character. 26 literal comparisons avoid
-#   that entirely: no macro indirection, no dependency on the missing
-#   stringlib code, and every line is directly auditable.
-#
-# ======================================================================================
-
-# Base case: nothing left to process
-execute if data storage datalib:output {_sf:{Remaining:""}} run return 1
-
-# Take the first character off _sf.Remaining, shrink Remaining by one
-data modify storage datalib:output _sf.Char set string storage datalib:output _sf.Remaining 0 1
-data modify storage datalib:output _sf.Remaining set string storage datalib:output _sf.Remaining 1
-
-# Default: keep the character as-is unless an uppercase match below overrides it
-data modify storage datalib:output _sf.Folded set from storage datalib:output _sf.Char
-
-execute if data storage datalib:output {_sf:{Char:"A"}} run data modify storage datalib:output _sf.Folded set value "a"
-execute if data storage datalib:output {_sf:{Char:"B"}} run data modify storage datalib:output _sf.Folded set value "b"
-execute if data storage datalib:output {_sf:{Char:"C"}} run data modify storage datalib:output _sf.Folded set value "c"
-execute if data storage datalib:output {_sf:{Char:"D"}} run data modify storage datalib:output _sf.Folded set value "d"
-execute if data storage datalib:output {_sf:{Char:"E"}} run data modify storage datalib:output _sf.Folded set value "e"
-execute if data storage datalib:output {_sf:{Char:"F"}} run data modify storage datalib:output _sf.Folded set value "f"
-execute if data storage datalib:output {_sf:{Char:"G"}} run data modify storage datalib:output _sf.Folded set value "g"
-execute if data storage datalib:output {_sf:{Char:"H"}} run data modify storage datalib:output _sf.Folded set value "h"
-execute if data storage datalib:output {_sf:{Char:"I"}} run data modify storage datalib:output _sf.Folded set value "i"
-execute if data storage datalib:output {_sf:{Char:"J"}} run data modify storage datalib:output _sf.Folded set value "j"
-execute if data storage datalib:output {_sf:{Char:"K"}} run data modify storage datalib:output _sf.Folded set value "k"
-execute if data storage datalib:output {_sf:{Char:"L"}} run data modify storage datalib:output _sf.Folded set value "l"
-execute if data storage datalib:output {_sf:{Char:"M"}} run data modify storage datalib:output _sf.Folded set value "m"
-execute if data storage datalib:output {_sf:{Char:"N"}} run data modify storage datalib:output _sf.Folded set value "n"
-execute if data storage datalib:output {_sf:{Char:"O"}} run data modify storage datalib:output _sf.Folded set value "o"
-execute if data storage datalib:output {_sf:{Char:"P"}} run data modify storage datalib:output _sf.Folded set value "p"
-execute if data storage datalib:output {_sf:{Char:"Q"}} run data modify storage datalib:output _sf.Folded set value "q"
-execute if data storage datalib:output {_sf:{Char:"R"}} run data modify storage datalib:output _sf.Folded set value "r"
-execute if data storage datalib:output {_sf:{Char:"S"}} run data modify storage datalib:output _sf.Folded set value "s"
-execute if data storage datalib:output {_sf:{Char:"T"}} run data modify storage datalib:output _sf.Folded set value "t"
-execute if data storage datalib:output {_sf:{Char:"U"}} run data modify storage datalib:output _sf.Folded set value "u"
-execute if data storage datalib:output {_sf:{Char:"V"}} run data modify storage datalib:output _sf.Folded set value "v"
-execute if data storage datalib:output {_sf:{Char:"W"}} run data modify storage datalib:output _sf.Folded set value "w"
-execute if data storage datalib:output {_sf:{Char:"X"}} run data modify storage datalib:output _sf.Folded set value "x"
-execute if data storage datalib:output {_sf:{Char:"Y"}} run data modify storage datalib:output _sf.Folded set value "y"
-execute if data storage datalib:output {_sf:{Char:"Z"}} run data modify storage datalib:output _sf.Folded set value "z"
-
-# Append the (possibly folded) character to the running Chars list
-data modify storage datalib:output _sf.Chars append from storage datalib:output _sf.Folded
-
-function datalib:core/security/sanitize_priv/lower_loop
diff --git a/datapacks/dataLib/data/datalib/function/core/security/string/contains.mcfunction b/datapacks/dataLib/data/datalib/function/core/security/string/contains.mcfunction
deleted file mode 100644
index 2aca829a..00000000
--- a/datapacks/dataLib/data/datalib/function/core/security/string/contains.mcfunction
+++ /dev/null
@@ -1,82 +0,0 @@
-# ======================================================================================
-# datalib:core/security/string/contains
-# ======================================================================================
-#
-# PURPOSE:
-#   Real substring/prefix test for input_check. Replaces the previous
-#   `execute if data storage ... inputs{field:"literal"}` pattern, which is
-#   NBT compound matching, not string matching — an NBT match against a
-#   string key requires the stored value to be BYTE-FOR-BYTE IDENTICAL to
-#   the pattern. It is not a "contains" or "starts with" test.
-#
-#   Consequence of the old code:
-#     - Section 6 checked `unless ... inputs{func:"datalib:api/"}` expecting
-#       this to mean "func does not start with datalib:api/". Since func is
-#       always longer than the literal "datalib:api/" (e.g.
-#       "datalib:api/cmd/freeze"), the two strings are NEVER equal, so the
-#       `unless` condition is ALWAYS true — every legitimate call, without
-#       exception, was rejected as a namespace violation.
-#     - Every blocklist line (Sections 8-19) checked
-#       `if ... inputs{cmd:"op "}` expecting "cmd contains/starts with op ".
-#       Since real payloads are never byte-identical to the short literal
-#       (e.g. cmd is "op @a FakeAdmin" not "op "), these checks NEVER
-#       matched either — the entire blocklist was dead code that could
-#       never fire, meaning every dangerous command in Sections 8-19 was
-#       silently allowed straight through to execute_validated.
-#
-#   Net effect of the bug: fails open on danger (blocklist never triggers)
-#   and fails closed on safety (allowlist rejects everything). This
-#   function fixes both by doing real substring matching via StringLib.
-#
-# USAGE:
-#   data modify storage datalib:input find.String set value "<haystack>"
-#   data modify storage datalib:input find.Find set value "<needle>"
-#   function datalib:core/security/string/contains
-#   Return: 1 if Find occurs anywhere in String, 0 otherwise.
-#   Output: score #DL.StrFound dl.tmp  → 1 (found) / 0 (not found)
-#           score #DL.StrIndex dl.tmp  → index of first match, or -1
-#
-# NOTE ON PREFIX CHECKS:
-#   To test "does String start with Find", call this function and then
-#   separately check `#DL.StrIndex dl.tmp matches 0` (index 0 = prefix).
-#   `contains` (index >= 0) is what Sections 8-19 need; prefix (index 0)
-#   is what Section 6's allowlist needs.
-#
-# WHY find AND NOT to_lowercase/replace:
-#   Only stringlib:zprivate/concat and stringlib:zprivate/find ship in this
-#   pack — replace/to_lowercase/to_uppercase/split/insert reference
-#   zprivate paths that do not exist here and will error if called
-#   (see datalib:core/security/sanitize header comment for the same
-#   finding). find + concat are the only verified-working primitives,
-#   so all matching here is built on find alone.
-#
-# ISOLATION:
-#   Uses stringlib:input/output find — the same storage StringLib itself
-#   uses. Snapshot-restore is not needed for our purposes since dataLib's
-#   own input_check already snapshots its own inputs into datalib:output
-#   before this ever runs (Section 3), so a nested call here does not
-#   corrupt datalib's caller-facing state, only stringlib's, which is
-#   scratch space owned entirely by StringLib.
-#
-# ======================================================================================
-
-# n:1 → first match only, minimal work. We only need "does it occur at all"
-# and "at what index does the first occurrence start".
-data modify storage stringlib:input find.n set value 1
-
-function stringlib:util/find
-
-# find returns [-1] (as a literal one-element list) when nothing is found,
-# or [<index>] for the first match when n:1.
-execute store result score #DL.StrIndex dl.tmp run data get storage stringlib:output find[0]
-
-execute if score #DL.StrIndex dl.tmp matches -1 run scoreboard players set #DL.StrFound dl.tmp 0
-execute unless score #DL.StrIndex dl.tmp matches -1 run scoreboard players set #DL.StrFound dl.tmp 1
-
-# Cleanup stringlib scratch storage so repeated calls this tick don't leak
-# stale state into the next comparison.
-data remove storage stringlib:input find
-data remove storage stringlib:output find
-
-execute if score #DL.StrFound dl.tmp matches 1 run return 1
-return 0
diff --git a/datapacks/dataLib/data/datalib/function/core/security/string/field_contains.mcfunction b/datapacks/dataLib/data/datalib/function/core/security/string/field_contains.mcfunction
deleted file mode 100644
index 7263c394..00000000
--- a/datapacks/dataLib/data/datalib/function/core/security/string/field_contains.mcfunction
+++ /dev/null
@@ -1,36 +0,0 @@
-# ======================================================================================
-# datalib:core/security/string/field_contains
-# ======================================================================================
-#
-# PURPOSE:
-#   Macro wrapper around datalib:core/security/string/contains, specialized
-#   for testing a single field of `datalib:output inputs` (i.e. `func` or
-#   `cmd`) against one literal substring. This is what every blocklist/
-#   allowlist line in input_check now calls instead of the old (broken)
-#   NBT-equality `execute if data storage datalib:output inputs{field:"x"}`.
-#
-# USAGE (macro call):
-#   function datalib:core/security/string/field_contains {field:"cmd",needle:"op "}
-#   Return: 1 if inputs.<field> contains <needle> anywhere, 0 otherwise
-#           (also 0 if the field is absent/unset).
-#   Output: score #DL.StrFound dl.tmp, score #DL.StrIndex dl.tmp (see contains.mcfunction)
-#
-# Field is read with $(field) storage indirection via a `with storage`
-# macro on the snapshot already isolated in Section 3, so this never
-# touches datalib:input.
-# ======================================================================================
-
-$data modify storage stringlib:input find.String set from storage datalib:output inputs.$(field)
-$data modify storage stringlib:input find.Find set value "$(needle)"
-
-# Guard: if the field itself is absent, treat as "not found" without
-# invoking StringLib (find.String would carry a stale/empty value).
-$execute unless data storage datalib:output inputs.$(field) run scoreboard players set #DL.StrFound dl.tmp 0
-$execute unless data storage datalib:output inputs.$(field) run scoreboard players set #DL.StrIndex dl.tmp -1
-$execute unless data storage datalib:output inputs.$(field) run data remove storage stringlib:input find
-$execute unless data storage datalib:output inputs.$(field) run return 0
-
-function datalib:core/security/string/contains
-
-execute if score #DL.StrFound dl.tmp matches 1 run return 1
-return 0
diff --git a/datapacks/dataLib/data/datalib/function/core/security/type_violation.mcfunction b/datapacks/dataLib/data/datalib/function/core/security/type_violation.mcfunction
deleted file mode 100644
index 013e297c..00000000
--- a/datapacks/dataLib/data/datalib/function/core/security/type_violation.mcfunction
+++ /dev/null
@@ -1,21 +0,0 @@
-# datalib:core/security/type_violation
-# Fired when a sandbox-blocked command type is called.
-# Logs ERROR, notifies caller, notifies debug admins, kicks player.
-# Context: @s = offending player. datalib:input._violation_type = command name.
-
-# Log entry
-data modify storage datalib:engine _log_add_tmp.message set value "[Security] type_violation — sandbox command not in allowlist"
-data modify storage datalib:engine _log_add_tmp.level set value "ERROR"
-data modify storage datalib:engine _log_add_tmp.color set value "red"
-execute if score #dl.log_level dl.log_level matches 2.. run function datalib:systems/log/add with storage datalib:engine _log_add_tmp
-data remove storage datalib:engine _log_add_tmp.message
-data remove storage datalib:engine _log_add_tmp.level
-data remove storage datalib:engine _log_add_tmp.color
-
-# Notify player
-tellraw @s ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"✘ ","color":"red"},{"text":"Security violation: command not permitted in sandbox mode.","color":"red"}]
-
-# Notify debug admins with command name context
-function datalib:core/security/type_violation/notify_admins with storage datalib:input {}
-
-# Kick offending player
diff --git a/datapacks/dataLib/data/datalib/function/core/security/type_violation/notify_admins.mcfunction b/datapacks/dataLib/data/datalib/function/core/security/type_violation/notify_admins.mcfunction
deleted file mode 100644
index 6f5ed698..00000000
--- a/datapacks/dataLib/data/datalib/function/core/security/type_violation/notify_admins.mcfunction
+++ /dev/null
@@ -1,3 +0,0 @@
-# datalib:core/security/type_violation/notify_admins [MACRO]
-# Called with storage datalib:input {} — reads $(_violation_type).
-$tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"TYPE VIOLATION ","color":"red","bold":true},{"selector":"@s","color":"gold"},{"text":" — blocked: ","color":"red"},{"text":"$(_violation_type)","color":"yellow"}]
diff --git a/datapacks/dataLib/data/datalib/function/debug/tools/admin/add.mcfunction b/datapacks/dataLib/data/datalib/function/debug/tools/admin/add.mcfunction
index 13ecfcd4..8de96beb 100644
--- a/datapacks/dataLib/data/datalib/function/debug/tools/admin/add.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/debug/tools/admin/add.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return run tellraw @s ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"✘ ","color":"red"},{"text":"Permission denied.","color":"red"}]
 
 $execute if entity @s[tag=datalib.admin] run tag @a[name=$(target),limit=1] add datalib.admin
 $tellraw @s ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"✔ ","color":"green"},{"text":"$(target)","color":"white"},{"text":" added as admin.","color":"green"}]
diff --git a/datapacks/dataLib/data/datalib/function/debug/tools/admin/debug_tag/disable.mcfunction b/datapacks/dataLib/data/datalib/function/debug/tools/admin/debug_tag/disable.mcfunction
index 2f7e4cf3..b427c98a 100644
--- a/datapacks/dataLib/data/datalib/function/debug/tools/admin/debug_tag/disable.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/debug/tools/admin/debug_tag/disable.mcfunction
@@ -9,7 +9,6 @@
 # Use datalib:debug/tools/admin/debug_tag/grant / revoke to manage
 # datalib.debug per-player once this is disabled.
 
-execute unless function datalib:debug/tools/utils/check_all run return run tellraw @s ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"✘ ","color":"red"},{"text":"Permission denied.","color":"red"}]
 
 data modify storage datalib:engine security.auto_debug_tag set value 0b
 tag @a[tag=datalib.admin] remove datalib.debug
diff --git a/datapacks/dataLib/data/datalib/function/debug/tools/admin/debug_tag/enable.mcfunction b/datapacks/dataLib/data/datalib/function/debug/tools/admin/debug_tag/enable.mcfunction
index 03d3b47f..b62d1897 100644
--- a/datapacks/dataLib/data/datalib/function/debug/tools/admin/debug_tag/enable.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/debug/tools/admin/debug_tag/enable.mcfunction
@@ -2,7 +2,6 @@
 # Turns auto_debug_tag back ON: every admin (datalib.admin tag) is
 # granted datalib.debug automatically each tick (legacy default).
 
-execute unless function datalib:debug/tools/utils/check_all run return run tellraw @s ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"✘ ","color":"red"},{"text":"Permission denied.","color":"red"}]
 
 data modify storage datalib:engine security.auto_debug_tag set value 1b
 tellraw @s ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"✔ ","color":"green"},{"text":"auto_debug_tag ","color":"white"},{"text":"enabled","color":"green"},{"text":" — admins get datalib.debug automatically again.","color":"gray"}]
diff --git a/datapacks/dataLib/data/datalib/function/debug/tools/admin/debug_tag/grant.mcfunction b/datapacks/dataLib/data/datalib/function/debug/tools/admin/debug_tag/grant.mcfunction
index 551f728f..dc5456ae 100644
--- a/datapacks/dataLib/data/datalib/function/debug/tools/admin/debug_tag/grant.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/debug/tools/admin/debug_tag/grant.mcfunction
@@ -5,7 +5,6 @@
 # system re-adds the tag to every admin anyway.
 # Usage: /function datalib:debug/tools/admin/debug_tag/grant {target:"PlayerName"}
 
-execute unless function datalib:debug/tools/utils/check_all run return run tellraw @s ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"✘ ","color":"red"},{"text":"Permission denied.","color":"red"}]
 
 $tag @a[name=$(target),limit=1] add datalib.debug
 $tellraw @s ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"✔ ","color":"green"},{"text":"$(target)","color":"white"},{"text":" granted datalib.debug.","color":"green"}]
diff --git a/datapacks/dataLib/data/datalib/function/debug/tools/admin/debug_tag/revoke.mcfunction b/datapacks/dataLib/data/datalib/function/debug/tools/admin/debug_tag/revoke.mcfunction
index 8848489a..911314a7 100644
--- a/datapacks/dataLib/data/datalib/function/debug/tools/admin/debug_tag/revoke.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/debug/tools/admin/debug_tag/revoke.mcfunction
@@ -5,7 +5,6 @@
 # auto_debug_tag is 0b.
 # Usage: /function datalib:debug/tools/admin/debug_tag/revoke {target:"PlayerName"}
 
-execute unless function datalib:debug/tools/utils/check_all run return run tellraw @s ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"✘ ","color":"red"},{"text":"Permission denied.","color":"red"}]
 
 $tag @a[name=$(target),limit=1] remove datalib.debug
 $tellraw @s ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"✔ ","color":"green"},{"text":"$(target)","color":"white"},{"text":" — datalib.debug revoked.","color":"gray"}]
diff --git a/datapacks/dataLib/data/datalib/function/debug/tools/admin/list.mcfunction b/datapacks/dataLib/data/datalib/function/debug/tools/admin/list.mcfunction
index e936ff68..ea28d3a7 100644
--- a/datapacks/dataLib/data/datalib/function/debug/tools/admin/list.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/debug/tools/admin/list.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return 0
 
 tellraw @s ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"━━━ Admin List ","color":"aqua"},{"text":"━━━━━━━━━━━━━━","color":"#555555"}]
 execute if entity @a[tag=datalib.admin] run tellraw @s ["",{"text":" ◈ ","color":"#00AAAA"},{"selector":"@a[tag=datalib.admin]","color":"white"}]
diff --git a/datapacks/dataLib/data/datalib/function/debug/tools/admin/remove.mcfunction b/datapacks/dataLib/data/datalib/function/debug/tools/admin/remove.mcfunction
index 46206fe4..2466585f 100644
--- a/datapacks/dataLib/data/datalib/function/debug/tools/admin/remove.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/debug/tools/admin/remove.mcfunction
@@ -1,4 +1,3 @@
-execute unless function datalib:debug/tools/utils/check_all run return run tellraw @s ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"✘ ","color":"red"},{"text":"Permission denied.","color":"red"}]
 
 $execute if entity @s[tag=datalib.admin] run tag @a[name=$(target),limit=1] remove datalib.admin
 $tellraw @s ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"✔ ","color":"green"},{"text":"$(target)","color":"white"},{"text":" removed from admins.","color":"green"}]
diff --git a/datapacks/dataLib/data/datalib/function/debug/tools/trigger/execute.mcfunction b/datapacks/dataLib/data/datalib/function/debug/tools/trigger/execute.mcfunction
index 20b84e09..d6695378 100644
--- a/datapacks/dataLib/data/datalib/function/debug/tools/trigger/execute.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/debug/tools/trigger/execute.mcfunction
@@ -7,7 +7,6 @@
 #
 # config:{silent:1} → suppress debug tellraw.
 
-function datalib:debug/tools/utils/check_all
 
 data modify storage datalib:engine tools_trigger.data.uuid set from entity @s UUID
 
diff --git a/datapacks/dataLib/data/datalib/function/debug/tools/utils/check_all.mcfunction b/datapacks/dataLib/data/datalib/function/debug/tools/utils/check_all.mcfunction
index e8d80a9b..40bdd679 100644
--- a/datapacks/dataLib/data/datalib/function/debug/tools/utils/check_all.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/debug/tools/utils/check_all.mcfunction
@@ -1,5 +1 @@
-tellraw @s {"text":"[dataLib] This datapack is ARCHIVED and no longer maintained. It will NOT load. To load it anyway, manually run: function #load:_private/load","color":"red"}
-
-execute unless function datalib:debug/tools/utils/load_check run return 0
-execute unless function datalib:debug/tools/utils/perm_check run return 0
-execute unless function datalib:debug/tools/utils/input_check run return 0
+# check_all.mcfunction: removed (no gates)
diff --git a/datapacks/dataLib/data/datalib/function/debug/tools/utils/input_check.mcfunction b/datapacks/dataLib/data/datalib/function/debug/tools/utils/input_check.mcfunction
index 89aa25dc..27ce6c56 100644
--- a/datapacks/dataLib/data/datalib/function/debug/tools/utils/input_check.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/debug/tools/utils/input_check.mcfunction
@@ -1,968 +1 @@
-# ======================================================================================
-# datalib:debug/tools/utils/input_check
-# ======================================================================================
-#
-# dataLib Secure Validation Gateway
-# Version: 2.0.0
-#
-# PURPOSE:
-#   Centralized security validation layer for all dynamic dataLib calls.
-#   Every externally supplied runtime request MUST pass through this
-#   validation layer before execution is permitted.
-#
-# DESIGN PHILOSOPHY:
-#
-#   Built around "fail closed" — any request that does not explicitly pass
-#   all validation stages is denied. There is no fallback execution path.
-#
-# ATTACKER MODEL:
-#
-#   • Datapack authors outside the ecosystem may abuse the dynamic call interface.
-#   • Malicious inputs may be crafted to escape namespacing.
-#   • Operator-level commands may be invoked through indirect paths.
-#   • Storage state may be corrupted to bypass future checks.
-#   • Nested calls may be used to re-enter the validation pipeline.
-#   • The execution engine may be targeted directly.
-#
-# SECURITY GOALS:
-#
-#   • prevent privilege escalation
-#   • prevent namespace escape
-#   • prevent selector abuse
-#   • prevent execute-chain hijacking
-#   • prevent storage corruption
-#   • prevent recursion abuse
-#   • prevent dangerous runtime mutation
-#   • prevent unauthorized engine access
-#   • prevent command injection
-#   • prevent NBT injection
-#   • prevent gamerule abuse
-#   • prevent scoreboard system corruption
-#   • prevent entity spawning abuse
-#   • prevent tag-based permission bypass
-#   • maintain deterministic execution
-#
-# VALIDATION PIPELINE:
-#
-#   1.  recursion guard
-#   2.  engine state validation
-#   3.  input snapshot isolation)
-#   4.  basic function identifier sanity
-#   5.  namespace allowlist enforcement
-#   6.  internal namespace protection (removed)
-#   7.  dangerous server management command blocklist
-#   8.  raw operator command payload blocklist
-#   9. selector escalation protection
-#   10. wildcard and mass-target protection
-#   11. execute-chain abuse protection
-#   12. command chain injection protection
-#   13. storage injection protection
-#   14. execute store and data mutation abuse protection
-#   15. NBT injection protection
-#   16. gamerule abuse protection
-#   17. scoreboard system corruption protection
-#   18. entity and tag manipulation protection
-#   29. debug output
-#   20. validated execution lock
-#   21. validated execution
-#   22. execution lock cleanup
-#   23. temporary storage cleanup
-#   25. success return
-#
-# RETURN VALUES:
-#
-#   return 1 → validation passed; call was executed
-#   return 0 → validation failed; call was denied
-#
-# OUTPUT CHANNELS (when debug mode active):
-#
-#   tellraw @s              caller-facing denial messages
-#   tellraw @a[tag=datalib.debug]   admin-facing violation notices
-#   say                     server log channel (visible in console)
-#   storage datalib:debug   machine-readable violation record
-#
-# DEBUG MODE:
-#   or the presence of at least one player with tag datalib.debug.
-#   In production with no debug players, all tellraw/say are skipped.
-#
-# SECURITY POLICY:
-#
-#   FAIL CLOSED
-#   Unknown behavior is considered unsafe until explicitly reviewed.
-#
-# ======================================================================================
-# SECTION 1
-# RECURSION GUARD
-# ======================================================================================
-#
-# THREAT:
-#   A function called from within a validated execution context may call
-#   the gateway again. Re-validating would be harmless but wastes CPU.
-#   More importantly, in_call:1b is the recursion sentinel — allowing it
-#   to re-enter would mean the sentinel check itself is bypassed.
-#
-# BEHAVIOR:
-#   If in_call:1b is present, the call is already inside a validated
-#   context. Return 1 immediately without re-running validation.
-#
-# BYPASS RISK:
-#   An attacker who sets in_call:1b externally bypasses all validation.
-#   Sections 14-15 block direct writes to datalib:engine to mitigate this.
-#
-# ======================================================================================
-
-# ======================================================================================
-# ======================================================================================
-
-execute if data storage datalib:engine global{in_call:1b} run return 1
-
-# ======================================================================================
-# SECTION 2
-# ENGINE STATE VALIDATION
-# ======================================================================================
-#
-# THREAT:
-#   Calls during partial initialization may hit unguarded code paths.
-#
-# BEHAVIOR:
-#   Deny all calls unless datalib:engine global contains loaded:1b.
-#
-# ======================================================================================
-
-execute unless data storage datalib:engine global{loaded:1b} run return 0
-
-# ======================================================================================
-# SECTION 3
-# SNAPSHOT INPUTS
-# ======================================================================================
-#
-# THREAT:
-#   Reading inputs directly from datalib:input during validation is a
-#   TOCTOU vulnerability. A function called mid-validation could mutate
-#   datalib:input, causing later checks to read different values than
-#   earlier ones.
-#
-# BEHAVIOR:
-#   Copy all runtime data into an isolated snapshot at the start.
-#   All subsequent checks read exclusively from this snapshot.
-#   datalib:input is never read again after this section.
-#
-# ======================================================================================
-
-data modify storage datalib:output inputs set from storage datalib:input
-data modify storage datalib:output data set from storage datalib:engine
-data modify storage datalib:output security set value {validated:0b,blocked:0b}
-
-# ======================================================================================
-# SECTION 4
-# BASIC FUNCTION IDENTIFIER SANITY CHECKS
-# ======================================================================================
-#
-# THREAT:
-#   Malformed identifiers may trigger edge cases in the mcfunction
-#   runtime's path resolution. Block all degenerate values.
-#
-# ======================================================================================
-
-execute if data storage datalib:output inputs{func:""} run return 0
-execute if data storage datalib:output inputs{func:" "} run return 0
-execute if data storage datalib:output inputs{func:":"} run return 0
-execute if data storage datalib:output inputs{func:"/"} run return 0
-execute if data storage datalib:output inputs{func:".."} run return 0
-execute if data storage datalib:output inputs{func:"."} run return 0
-execute if data storage datalib:output inputs{func:"\\"} run return 0
-execute if data storage datalib:output inputs{func:"*"} run return 0
-execute if data storage datalib:output inputs{func:"#"} run return 0
-
-# ======================================================================================
-# SECTION 5
-# NAMESPACE ALLOWLIST ENFORCEMENT
-# ======================================================================================
-#
-# THREAT:
-#   Without namespace restrictions, callers could execute arbitrary
-#   functions in any namespace, including vanilla minecraft:, other
-#   installed packs, or datalib internals.
-#
-# POLICY:
-#   Only paths beginning with "datalib:api/" are valid external call targets.
-#
-# BEHAVIOR:
-#   If func does not contain "datalib:api/" prefix, log violation and deny.
-#
-# SECURITY FIX (v6.1.1):
-#   Previously this section logged the violation but did NOT return 0,
-#   meaning execute_validated/run would still run $function $(func) on
-#   any namespace afterward. Fail-open on the exact check documented as
-#   "namespace allowlist enforcement". Now returns 0 after logging.
-#
-# SECURITY FIX (this pass — StringLib rewrite):
-#   `execute if data storage ... inputs{func:"datalib:api/"}` is NBT
-#   compound matching against a string field, which requires BYTE-FOR-BYTE
-#   EQUALITY, not a prefix test. func is always longer than the literal
-#   "datalib:api/" (e.g. "datalib:api/cmd/freeze"), so the two strings can
-#   never be equal — the `unless` here was ALWAYS true, meaning every
-#   legitimate datalib:api/* call was rejected as a namespace violation
-#   (confirmed live in latest.log: repeated "NS WARNING ... func not in
-#   datalib:api/*" spam for datalib:api/cmd/freeze, a call that should
-#   have passed). Replaced with a real prefix check via StringLib: find
-#   the literal at index 0.
-#
-# SECURITY FIX (this pass — allowlist externalized):
-#   The approved prefix set was previously two hardcoded field_contains
-#   calls inline in this file ("datalib:" and "stringlib:" — note "stringlib:"
-#   was previously accepted with NO reviewed justification and NO
-#   corresponding Section 6 internal-path guard, see SECTION 6 note below).
-#   Moved to datalib:config/namespace_list, a single reviewable file where
-#   each additional prefix is its own PR-visible line. This section now
-#   loops over that list at validation time; it does not change what is
-#   fail-closed — an empty or missing list still denies everything.
-#
-# ======================================================================================
-
-function datalib:config/namespace_list
-scoreboard players set #DL.NsPrefixOk dl.tmp 0
-data modify storage datalib:output _ns.List set from storage datalib:output config.namespace_allowlist
-function datalib:core/security/namespace_allowlist_loop
-
-execute unless score #DL.NsPrefixOk dl.tmp matches 1 run function datalib:core/security/input_ns_violation
-execute unless score #DL.NsPrefixOk dl.tmp matches 1 run data modify storage datalib:output error set value {level:"WARN",code:"NS_VIOLATION",message:"Input namespace violation detected. Call denied."}
-execute unless score #DL.NsPrefixOk dl.tmp matches 1 run function datalib.main:empty
-
-data remove storage datalib:output _ns
-data remove storage datalib:output config
-
-# ======================================================================================
-# SECTION 6
-# INTERNAL NAMESPACE PROTECTION
-# ======================================================================================
-#
-# THREAT:
-#   Defense-in-depth for cases where the allowlist check has an edge case
-#   or is bypassed in future refactors. Explicitly block all internal paths.
-#
-# ======================================================================================
-
-# SECURITY FIX (this pass — StringLib rewrite):
-#   Previously commented out entirely ("REMOVED"), leaving no defense-in-
-#   depth if Section 6's allowlist ever had an edge case. Now that a real
-#   substring test exists, restored as active checks. These test for the
-#   internal prefix occurring ANYWHERE in func (not just at index 0) so a
-#   crafted func like "datalib:api/../core/engine/x" is also caught.
-
-function datalib:core/security/string/field_contains {field:"func",needle:"datalib:engine/"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"func",needle:"datalib:private/"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"func",needle:"datalib:internal/"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"func",needle:"datalib:security/"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"func",needle:"minecraft:"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-
-# ======================================================================================
-# SECTION 7
-# HIGH-RISK SERVER MANAGEMENT COMMAND BLOCKLIST (func field)
-# ======================================================================================
-#
-# THREAT:
-#   The API exposes command wrappers. If a caller names a server management
-#   command wrapper, they gain operator-equivalent control without holding op.
-#
-# ======================================================================================
-
-function datalib:core/security/string/field_contains {field:"func",needle:"datalib:api/cmd/op"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"func",needle:"datalib:api/cmd/deop"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"func",needle:"datalib:api/cmd/ban"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"func",needle:"datalib:api/cmd/ban_ip"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"func",needle:"datalib:api/cmd/pardon"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"func",needle:"datalib:api/cmd/pardon_ip"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"func",needle:"datalib:api/cmd/kick"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"func",needle:"datalib:api/cmd/stop"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"func",needle:"datalib:api/cmd/reload"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"func",needle:"datalib:api/cmd/debug"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"func",needle:"datalib:api/cmd/perf"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"func",needle:"datalib:api/cmd/whitelist"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"func",needle:"datalib:api/cmd/save-all"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"func",needle:"datalib:api/cmd/save-off"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"func",needle:"datalib:api/cmd/save-on"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"func",needle:"datalib:api/cmd/data_remove_block"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"func",needle:"datalib:api/cmd/data_remove_entity"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"func",needle:"datalib:api/cmd/data_remove_storage"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"func",needle:"datalib:api/cmd/other/run_self"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"func",needle:"datalib:api/cmd/other/multi_cmd_adv"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"func",needle:"datalib:api/cmd/setidletimeout"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"func",needle:"datalib:api/cmd/jfr"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"func",needle:"datalib:api/cmd/publish"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"func",needle:"datalib:api/cmd/transfer"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"func",needle:"datalib:api/cmd/as_player"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-
-# ======================================================================================
-# SECTION 8
-# RAW OPERATOR COMMAND PAYLOAD BLOCKLIST (cmd field)
-# ======================================================================================
-#
-# THREAT:
-#   Section 8 blocks named wrappers via func. But an attacker may supply
-#   raw operator commands directly in the cmd field, bypassing func checks.
-#
-# ======================================================================================
-
-function datalib:core/security/string/field_contains {field:"cmd",needle:"op"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"deop"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"ban"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"ban-ip"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"pardon"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"pardon-ip"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"kick"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"stop"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"reload"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"whitelist"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"save-all"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"save-off"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"save-on"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"publish"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"transfer"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"jfr"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"setidletimeout"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"as @e as @€"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"summon minecraft:tnt"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"summon minecraft:tnt_minecart"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"summon minecraft:fireball"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-
-# ======================================================================================
-# SECTION 9
-# SELECTOR ESCALATION PROTECTION
-# ======================================================================================
-#
-# THREAT:
-#   Selectors can mass-target all players simultaneously. Combined with
-#   dangerous commands, a single payload can op/ban/kick the entire server.
-#
-#   High-risk patterns: op/deop/kick/ban + any broadcast selector.
-#
-# ======================================================================================
-
-function datalib:core/security/string/field_contains {field:"cmd",needle:"op @a"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"op @e"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"op @r"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"op @s"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"op @p"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"op @n"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-
-function datalib:core/security/string/field_contains {field:"cmd",needle:"deop @a"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"deop @e"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"deop @r"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"deop @s"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"deop @p"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"deop @n"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-
-function datalib:core/security/string/field_contains {field:"cmd",needle:"kick @a"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"kick @e"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"kick @r"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"kick @p"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-
-function datalib:core/security/string/field_contains {field:"cmd",needle:"ban @a"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"ban @e"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"ban @r"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"ban @s"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"ban @p"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-
-function datalib:core/security/string/field_contains {field:"cmd",needle:"execute as @a"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"execute as @e"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"execute as @r"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"execute as @p"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"execute as @n"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-
-function datalib:core/security/string/field_contains {field:"cmd",needle:"execute at @a"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"execute at @e"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"execute at @r"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"execute at @p"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"execute at @n"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-
-# ======================================================================================
-# SECTION 10
-# WILDCARD AND MASS-TARGET PROTECTION
-# ======================================================================================
-#
-# THREAT:
-#   @e[type=player] is equivalent to @a and mass-targets all players.
-#   @e[tag=admin/operator/op] impersonates permission-system entities.
-#   Bare @a and @e in cmd indicate mass broadcast intent.
-#
-# ======================================================================================
-
-function datalib:core/security/string/field_contains {field:"cmd",needle:"@e[type=player]"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"@e[type=minecraft:player]"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"@e[tag=admin]"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"@e[tag=operator]"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"@e[tag=op]"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"@e[tag=datalib.debug]"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"@a"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"@e"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-
-# ======================================================================================
-# SECTION 11
-# EXECUTE-CHAIN ABUSE PROTECTION
-# ======================================================================================
-#
-# THREAT:
-#   execute sub-commands can redirect execution context, invoke arbitrary
-#   functions, schedule deferred calls, or change the executor's identity.
-#
-#   "run function" and "schedule function" directly invoke arbitrary paths.
-#   Context modifiers (as/at/in/on/positioned/facing/rotated/anchored/align)
-#   can target restricted entities or privileged locations.
-#   "execute summon" creates entities in an attacker-controlled context.
-#   "execute run" is a catch-all executor that should never appear in cmd.
-#
-# NOTE:
-#   "execute if" and "execute unless" are NOT blocked: they are read-only
-#   condition checks that do not alter execution context.
-#
-# ======================================================================================
-
-function datalib:core/security/string/field_contains {field:"cmd",needle:"schedule function"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"schedule clear"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"execute facing"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"execute rotated"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"execute anchored"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"execute align"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"execute at @e"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"execute if entity @e"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-
-# ======================================================================================
-# SECTION 12
-# COMMAND CHAIN INJECTION PROTECTION
-# ======================================================================================
-#
-# THREAT:
-#   Shell-style separators and control characters in cmd may cause
-#   multi-command injection under certain execution environments,
-#   or may be used to terminate the intended command and append a
-#   second one. Newlines may cause line-based parsers to treat
-#   subsequent text as a new command.
-#
-# ======================================================================================
-
-function datalib:core/security/string/field_contains {field:"cmd",needle:";"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"&&"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"||"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"\r"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"\t"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"curl https://"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"curl http://"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"| bash"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"wget https://"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"wget http://"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"git push --force"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"git clone -fd"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"git reset --hard"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-
-# ======================================================================================
-# SECTION 13
-# STORAGE INJECTION PROTECTION
-# ======================================================================================
-#
-# THREAT:
-#   Injecting storage path syntax into func can redirect the engine to
-#   read macro arguments from attacker-controlled storage.
-#
-#   Example:
-#     inputs.func = "datalib:api/cmd with storage datalib:engine global"
-#   → macro call reads from engine storage, giving attacker control
-#     over macro arguments.
-#
-#   All internal datalib storage namespaces are blocked in both
-#   func and cmd fields.
-#
-# ======================================================================================
-
-function datalib:core/security/string/field_contains {field:"func",needle:"with storage datalib:engine"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"func",needle:"with storage datalib:engine _dispatch"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"func",needle:"with storage datalib:debug"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"func",needle:"storage datalib:engine"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"func",needle:"storage datalib:engine _dispatch"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"func",needle:"storage datalib:debug"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-
-function datalib:core/security/string/field_contains {field:"cmd",needle:"with storage datalib:engine"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"with storage datalib:output"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"with storage datalib:debug"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"storage datalib:engine"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"storage datalib:output"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"storage datalib:debug"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-
-# ======================================================================================
-# SECTION 14
-# EXECUTE STORE AND DATA MUTATION ABUSE PROTECTION
-# ======================================================================================
-#
-# THREAT:
-#   "execute store result/success" can write to any storage, scoreboard,
-#   block, or entity NBT. If targeting datalib:engine, an attacker can:
-#
-#     • set loaded:0b → disable the engine until next reload
-#     • set in_call:1b → bypass all future validation (Section 1 sentinel)
-#
-#   "data merge/remove/modify" targeting datalib:engine achieves the same.
-#
-#   Scoreboard manipulation of internal objectives (#rate_calls,
-#   dl.perm_level, dl.log_level) can disable logging or fake permissions.
-#
-# ======================================================================================
-
-function datalib:core/security/string/field_contains {field:"cmd",needle:"execute store result storage datalib:engine"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"execute store success storage datalib:engine"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"execute store result storage datalib:output"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"execute store success storage datalib:output"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"execute store result storage datalib:debug"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"execute store success storage datalib:debug"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-
-function datalib:core/security/string/field_contains {field:"cmd",needle:"data merge storage datalib:engine"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"data remove storage datalib:engine"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"data modify storage datalib:engine"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 00
-function datalib:core/security/string/field_contains {field:"cmd",needle:"data merge storage datalib:debug"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"data remove storage datalib:debug"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"data modify storage datalib:debug"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-
-function datalib:core/security/string/field_contains {field:"cmd",needle:"scoreboard players set #dl"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"scoreboard players reset #dl"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"scoreboard players add #dl"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"scoreboard players remove #dl"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"scoreboard objectives add dl"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"scoreboard objectives remove dl"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"scoreboard objectives add datalib"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"scoreboard objectives remove datalib"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"tag @s add datalib.admin"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"tag @a add datalib.admin"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"tag @r add datalib.admin"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"tag @n add datalib.admin"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"tag @e[type=minecraft:player] remove datalib.admin"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"tag @s remove datalib.admin"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"tag @a remove datalib.admin"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"tag @r remove datalib.admin"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"tag @n remove datalib.admin"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-
-# ======================================================================================
-# SECTION 15
-# NBT INJECTION PROTECTION
-# ======================================================================================
-#
-# THREAT:
-#   Raw NBT compound syntax ({...}) in a cmd payload can be used to:
-#
-#     • Inject additional NBT keys into entity data
-#     • Override custom_data tags to impersonate permission-tagged entities
-#     • Manipulate block entity data (e.g. command block Command field)
-#     • Pass crafted NBT to any command that accepts an NBT argument
-#
-#   Blocking bare "{" in cmd is a conservative safeguard. Legitimate API
-#   calls pass structured arguments via storage, not raw NBT in cmd strings.
-#
-#   Exception: "{}" (empty compound) is common in macro calls and is
-#   intentionally NOT blocked. Only non-empty NBT compounds are denied.
-#
-# ======================================================================================
-
-function datalib:core/security/string/field_contains {field:"cmd",needle:"{Command:"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"{auto:1b"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"Tags:[\\\"dataLibb."}
-function datalib:core/security/string/field_contains {field:"cmd",needle:"[minecraft:custom_data={dataLib:{input:1b}}]"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"[minecraft:custom_data={dataLib:{input:0b}}]"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"[custom_data={dataLib:{input:1b}}]"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"[custom_data={dataLib:{input:0b}}]"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"{Tags:[\\\"datalib."}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"{Tags:[datalib."}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-
-# ======================================================================================
-# SECTION 16
-# GAMERULE ABUSE PROTECTION
-# ======================================================================================
-#
-# THREAT:
-#   Certain gamerules have direct security and stability implications:
-#
-#     commandBlocksWork (26.1.2+) / commandBlockEnabled (legacy)
-#       → re-enables command block execution if it was disabled
-#
-#     max_command_chain_length
-#       → raising this allows deeper recursion and DoS attacks
-#
-#     keep_inventory
-#       → griefing quality-of-life rules (lower severity, still blocked)
-#
-#     pvp (only in server.properties, not a gamerule, included for clarity)
-#
-# ======================================================================================
-
-function datalib:core/security/string/field_contains {field:"cmd",needle:"gamerule command_blocks_work"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"gamerule max_command_chain_length"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"gamerule max_command_forks"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"gamerule random_tick_speed"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"gamerule spawn_mobs"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"gamerule players_sleeping_percentage"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"gamerule minecraft:command_blocks_work"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"gamerule minecraft:max_command_chain_length"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"gamerule minecraft:max_command_forks"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"gamerule minecraft:random_tick_speed"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"gamerule minecraft:spawn_mobs"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"gamerule minecraft:players_sleeping_percentage"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"gamerule keep_inventory"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"gamerule minecraft:keep_inventory"}
-function datalib:core/security/string/field_contains {field:"cmd",needle:"gamerule gamerule advance_time"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"gamerule max_command_forks"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"gamerule max_command_sequence_length"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"gamerule random_tick_speed"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"/gamerule command_blocks_work"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"/gamerule gamerule advance_time"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"/gamerule max_command_forks"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"/gamerule max_command_sequence_length"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"/gamerule random_tick_speed"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-
-
-# ======================================================================================
-# SECTION 17
-# ENTITY AND TAG MANIPULATION PROTECTION
-# ======================================================================================
-#
-# THREAT:
-#   Datalib's permission system uses entity tags (datalib.debug, dl.perm_level,
-#   datalib.admin) to identify privileged players and entities. An attacker
-#   who can add these tags to themselves bypasses the permission model entirely.
-#
-#   "summon" can create arbitrary entities with attacker-controlled NBT,
-#   including tags that the permission system trusts.
-#
-#   "tag add" targeting @s or any player with a known privilege tag is
-#   a direct permission escalation attack.
-#
-# ======================================================================================
-
-function datalib:core/security/string/field_contains {field:"cmd",needle:"summon "}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"tag @s add datalib"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"tag @s add dl"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"tag @a add datalib"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"tag @a add dl"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"tag @p add datalib"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"tag @p add dl"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"tag @r add datalib"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"tag @r add dl"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"tag @e add datalib"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"tag @e add dl"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"effect give @a"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"effect give @e"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-
-# ======================================================================================
-# SECTION 18
-# FORCELOAD AND BLOCK PLACEMENT ABUSE PROTECTION
-# ======================================================================================
-#
-# THREAT:
-#   "forceload add" can keep arbitrary chunks loaded indefinitely,
-#   causing memory/CPU strain and enabling block persistence attacks.
-#
-#   "setblock" at privileged coordinates (e.g. 0 -64 0 where datalib's
-#   command block runner sits) can replace the command block with a
-#   malicious one, or destroy it to break the command runner.
-#
-#   "fill" is forceload + setblock at scale.
-#
-# ======================================================================================
-
-function datalib:core/security/string/field_contains {field:"cmd",needle:"forceload add 0 0"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"forceload remove 0 0"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"setblock 0 -64 0 minecraft:air"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"setblock 0 -64 0 air"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"forceload remove 0 0"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"command_block"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"minecraft:command_block"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-function datalib:core/security/string/field_contains {field:"cmd",needle:"fillbiome"}
-execute if score #DL.StrFound dl.tmp matches 1 run return 0
-
-# ======================================================================================
-# SECTION 19
-# DEBUG OUTPUT
-# ======================================================================================
-#
-# PURPOSE:
-#   Emit diagnostic messages through all configured output channels
-#   when a call passes all validation stages.
-#
-# OUTPUT CHANNELS:
-#
-#   tellraw @s
-#     Caller-visible confirmation. Only emitted if @s is a player.
-#     Shows validated function path and current tick.
-#
-#   tellraw @a[tag=datalib.debug]
-#     Admin-visible full call record. Always attempted.
-#     Shows caller identity, func path.
-#
-#   say
-#     Server console log. Gated on devMode and at least one debug player.
-#     Output appears in server log file as [Server] prefix.
-#
-#   storage datalib:debug
-#     Machine-readable record. Written unconditionally for tooling.
-#     Overwritten each call — not a persistent audit log.
-#
-# GATE:
-#   All output is skipped entirely unless devMode is enabled OR at least
-#   one player holds the datalib.debug tag. This prevents debug spam
-#   in production servers with no active debugging session.
-#
-# ======================================================================================
-
-# Write machine-readable call record unconditionally
-data modify storage datalib:debug last_validated_call.func set from storage datalib:output inputs.func
-
-# Gate remaining output on debug mode or active debug players
-execute unless entity @a[tag=datalib.debug] run return fail
-
-# Caller-facing confirmation (players only)
-execute if entity @s[type=minecraft:player] run tellraw @s ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"✔ ","color":"green"},{"text":"Validated: ","color":"gray"},{"plain":true ,"storage":"datalib:output","nbt":"inputs.func","color":"aqua"}]
-
-# Admin-facing full record
-tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"CALL ","color":"green","bold":true},{"selector":"@s","color":"gold"},{"text":" → ","color":"#555555"},{"plain":true ,"storage":"datalib:output","nbt":"inputs.func","color":"aqua"}]
-
-# ======================================================================================
-# SECTION 20
-# VALIDATED EXECUTION LOCK
-# ======================================================================================
-#
-# PURPOSE:
-#   Set in_call:1b to prevent Section 1 from re-running validation
-#   for any function invoked by the validated target.
-#   Must be set immediately before execution and cleared immediately after.
-#
-# ======================================================================================
-
-data modify storage datalib:engine global.in_call set value 1b
-
-# ======================================================================================
-# SECTION 21
-# EXECUTE VALIDATED FUNCTION
-# ======================================================================================
-
-function datalib:core/engine/call/execute_validated
-
-# ======================================================================================
-# SECTION 22
-# CLEANUP EXECUTION LOCK
-# ======================================================================================
-
-data remove storage datalib:engine global.in_call
-
-# ======================================================================================
-# SECTION 23
-# CLEANUP TEMPORARY STORAGE
-# ======================================================================================
-
-data remove storage datalib:output data
-data remove storage datalib:output security
-data remove storage datalib:output inputs
-
-# ======================================================================================
-# SECTION 24
-# SUCCESS RETURN
-# ======================================================================================
-
-return 1
+# input_check.mcfunction: removed (no gates)
diff --git a/datapacks/dataLib/data/datalib/function/debug/tools/utils/load_check.mcfunction b/datapacks/dataLib/data/datalib/function/debug/tools/utils/load_check.mcfunction
index b2a130cc..73cace8a 100644
--- a/datapacks/dataLib/data/datalib/function/debug/tools/utils/load_check.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/debug/tools/utils/load_check.mcfunction
@@ -1,5 +1 @@
-# datalib:debug/tools/utils/load_check
-# Returns 1 if engine is loaded, 0 (+ fallback) if not.
-execute if data storage datalib:engine global{loaded:1b} run return 1
-function datalib:core/fallback/not_loaded
-return 0
+# load_check.mcfunction: removed (no gates)
diff --git a/datapacks/dataLib/data/datalib/function/debug/tools/utils/perm_check.mcfunction b/datapacks/dataLib/data/datalib/function/debug/tools/utils/perm_check.mcfunction
index e86dc2d3..370cca4d 100644
--- a/datapacks/dataLib/data/datalib/function/debug/tools/utils/perm_check.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/debug/tools/utils/perm_check.mcfunction
@@ -1,22 +1 @@
-# datalib:debug/tools/utils/perm_check
-# Returns 1 if executor has sufficient dl.perm_level for admin commands.
-# Returns 0 (+ fallback) if not.
-#
-# BREAKING CHANGE (v6.0.1): datalib.admin tag alone no longer grants access.
-# Players must have dl.perm_level >= security.admin_min_level.
-# Non-player callers (server/datapack) are trusted and pass through.
-#
-# Set player level:  function datalib:api/security/set_level {player:"Name",level:2}
-
-# Non-players pass through (server-side / datapack callers are op-gated)
-execute unless entity @s[type=minecraft:player] run return run function datalib:core/fallback/no_permission
-
-# Load required admin level from security storage
-execute store result score #perm_req dl.tmp run data get storage datalib:engine security.admin_min_level
-
-# Check perm_level
-execute if score @s dl.perm_level >= #perm_req dl.tmp run return 1
-
-# Denied
-function datalib:core/fallback/no_permission
-return 0
+# perm_check.mcfunction: removed (no gates)
diff --git a/datapacks/dataLib/data/datalib/function/debug/tools/utils/timer_check.mcfunction b/datapacks/dataLib/data/datalib/function/debug/tools/utils/timer_check.mcfunction
index 1bdb60e6..0358879c 100644
--- a/datapacks/dataLib/data/datalib/function/debug/tools/utils/timer_check.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/debug/tools/utils/timer_check.mcfunction
@@ -1,2 +1 @@
 execute unless score @s datalib.dialog_load matches 0 run return 0
-return 1
diff --git a/datapacks/dataLib/data/datalib/function/input/command_block_minecart.mcfunction b/datapacks/dataLib/data/datalib/function/input/command_block_minecart.mcfunction
index 3392f339..46797ce7 100644
--- a/datapacks/dataLib/data/datalib/function/input/command_block_minecart.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/input/command_block_minecart.mcfunction
@@ -44,5 +44,3 @@
 execute unless entity @e[type=minecraft:command_block_minecart,tag=datalib_input] run return 0
 
 execute as @e[type=minecraft:command_block_minecart,tag=datalib_input] run function datalib:input/private/cbm_process
-
-return 1
diff --git a/datapacks/dataLib/data/datalib/function/input/private/cbm_capture.mcfunction b/datapacks/dataLib/data/datalib/function/input/private/cbm_capture.mcfunction
index 304f2481..4627481e 100644
--- a/datapacks/dataLib/data/datalib/function/input/private/cbm_capture.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/input/private/cbm_capture.mcfunction
@@ -22,7 +22,6 @@ data modify storage datalib:input cbm.source_uuid set from entity @s UUID
 data modify storage datalib:input cbm.pos set from entity @s Pos
 
 # "raw, unvalidated, unexecuted" — downstream (separate execution pack)
-# must run this through datalib:core/security/sanitize and
 # datalib:debug/tools/utils/input_check before ever treating it as
 # runnable, and running it there stays optional, never mandatory.
 #
diff --git a/datapacks/dataLib/data/datalib/function/input/writable_book.mcfunction b/datapacks/dataLib/data/datalib/function/input/writable_book.mcfunction
index 03b97155..86b45e64 100644
--- a/datapacks/dataLib/data/datalib/function/input/writable_book.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/input/writable_book.mcfunction
@@ -29,5 +29,3 @@
 execute unless entity @a[nbt={SelectedItem:{components:{"minecraft:custom_data":{dataLib:{input:1b}}}}}] run return 0
 
 execute as @a[nbt={SelectedItem:{components:{"minecraft:custom_data":{dataLib:{input:1b}}}}}] run function datalib:input/private/book_capture
-
-return 1
diff --git a/datapacks/dataLib/data/datalib/function/load.mcfunction b/datapacks/dataLib/data/datalib/function/load.mcfunction
index 2b796ef5..bf0a6414 100644
--- a/datapacks/dataLib/data/datalib/function/load.mcfunction
+++ b/datapacks/dataLib/data/datalib/function/load.mcfunction
@@ -1 +1 @@
-function dl_load:main
\ No newline at end of file
+function dl_load:main
diff --git a/datapacks/dataLib/data/datalib/function/systems/security/menu.mcfunction b/datapacks/dataLib/data/datalib/function/systems/security/menu.mcfunction
deleted file mode 100644
index e4cdef51..00000000
--- a/datapacks/dataLib/data/datalib/function/systems/security/menu.mcfunction
+++ /dev/null
@@ -1,18 +0,0 @@
-# datalib:systems/security/menu  [1.21.6 OVERLAY]
-# Dialog-based security menu. Replaces tellraw version on 1.21.6+.
-# Requires: dl.perm_level >= security.admin_min_level
-#
-# NOTE: Dialog cannot read storage/score natively — values are injected
-# via macro ($) in menu_build.mcfunction.
-execute unless function datalib:debug/tools/utils/perm_check run return 0
-
-# Collect dynamic values into datalib:input for macro interpolation
-data modify storage datalib:input sandbox set from storage datalib:engine sandbox
-data modify storage datalib:input trust_players set from storage datalib:engine security.trust_players
-data modify storage datalib:input cmd_min_level set from storage datalib:engine security.cmd_min_level
-data modify storage datalib:input sandbox_lvl set from storage datalib:engine security.sandbox_cmd_min_level
-data modify storage datalib:input admin_min_level set from storage datalib:engine security.admin_min_level
-data modify storage datalib:input admin_override set from storage datalib:engine security.admin_can_override
-execute store result storage datalib:input perm_level int 1 run scoreboard players get @s dl.perm_level
-
-function datalib:systems/security/menu_build with storage datalib:input {}
diff --git a/datapacks/dataLib/data/datalib/function/systems/security/menu_build.mcfunction b/datapacks/dataLib/data/datalib/function/systems/security/menu_build.mcfunction
deleted file mode 100644
index f3b34964..00000000
--- a/datapacks/dataLib/data/datalib/function/systems/security/menu_build.mcfunction
+++ /dev/null
@@ -1,15 +0,0 @@
-# datalib:systems/security/menu_build [1.21.6 OVERLAY — MACRO]
-# Called by menu.mcfunction with storage datalib:input {}.
-# Builds the dialog with runtime values injected via macro ($).
-#
-# INPUT (macro args from datalib:input):
-#   $(sandbox) — 0b / 1b
-#   $(trust_players) — 0b / 1b
-#   $(cmd_min_level) — int
-#   $(sandbox_lvl) — int
-#   $(admin_min_level) — int
-#   $(admin_override) — 0b / 1b
-#   $(perm_level) — int (caller's dl.perm_level)
-data modify storage datalib:engine dialog.DIALOG set value {type:"minecraft:multi_action",title:{text:"DL Security",color:"#00AAAA",bold:1b},body:{type:"minecraft:plain_message",contents:"sandbox: $(sandbox) trust_players: $(trust_players)cmd_min_level: $(cmd_min_level) sandbox_level: $(sandbox_lvl)admin_min_level: $(admin_min_level) admin_override: $(admin_override)Your perm_level: $(perm_level)"},inputs:[{type:"minecraft:boolean",key:"sb",label:"Sandbox",initial:1b,on_true:"1b",on_false:"0b"}],actions:[{label:{text:"Refresh",color:"aqua",italic:0b},action:{type:"minecraft:run_command",command:"/function datalib:systems/security/menu"}}],pause:0b,can_close_with_escape:1b,after_action:"none"}
-$data modify storage datalib:engine dialog.DIALOG.actions append value {label:{text:"Toggle Sandbox",color:"green",italic:0b},action:{type:"minecraft:dynamic/run_command",template:"/data modify storage datalib:engine sandbox set value $(sb)"}}
-function datalib:api/dialog/load
\ No newline at end of file
diff --git a/datapacks/dataLib/data/dl_load/function/gate/exec/ban.mcfunction b/datapacks/dataLib/data/dl_load/function/gate/exec/ban.mcfunction
deleted file mode 100644
index 9fd0901e..00000000
--- a/datapacks/dataLib/data/dl_load/function/gate/exec/ban.mcfunction
+++ /dev/null
@@ -1,13 +0,0 @@
-# dl_load:gate/exec/ban
-# Executor for confirmed ban command.
-# Called by dl_load:gate/yes via: function ... with storage datalib:engine pending_gate
-#
-# Macro fields required in datalib:engine pending_gate:
-#   player  — target player name or UUID
-#   reason  — ban reason string
-#
-# MACRO LINE RULES: every $ line must contain at least one $(key).
-# No $ lines without $(key) — Minecraft crashes on that.
-
-$ban $(player) $(reason)
-$tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/ban ","color":"aqua"},{"text":"$(player)","color":"white"},{"text":" — reason: ","color":"gray"},{"text":"$(reason)","color":"yellow"}]
diff --git a/datapacks/dataLib/data/dl_load/function/gate/exec/ban_ip.mcfunction b/datapacks/dataLib/data/dl_load/function/gate/exec/ban_ip.mcfunction
deleted file mode 100644
index 0ad12e0c..00000000
--- a/datapacks/dataLib/data/dl_load/function/gate/exec/ban_ip.mcfunction
+++ /dev/null
@@ -1,10 +0,0 @@
-# dl_load:gate/exec/ban_ip
-# Executor for confirmed ban-ip command.
-# Called by dl_load:gate/yes via: function ... with storage datalib:engine pending_gate
-#
-# Macro fields required in datalib:engine pending_gate:
-#   player  — target player name or UUID (resolves to IP)
-#   reason  — ban reason string
-
-$ban-ip $(player) $(reason)
-$tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"cmd/ban_ip ","color":"aqua"},{"text":"$(player)","color":"white"},{"text":" — reason: ","color":"gray"},{"text":"$(reason)","color":"yellow"}]
diff --git a/datapacks/dataLib/data/dl_load/function/gate/exec/disable.mcfunction b/datapacks/dataLib/data/dl_load/function/gate/exec/disable.mcfunction
deleted file mode 100644
index 8739a103..00000000
--- a/datapacks/dataLib/data/dl_load/function/gate/exec/disable.mcfunction
+++ /dev/null
@@ -1,11 +0,0 @@
-# dl_load:gate/exec/disable
-# Executor for confirmed engine disable.
-# Called by dl_load:gate/yes when pending_gate{type:"disable"}.
-#
-# Runs the full cleanup pipeline then announces shutdown via tellraw.
-# No macro parameters needed.
-
-function dl_load:core/internal/load/cleanup
-
-tellraw @a ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"Engine DISABLED.","color":"red","bold":true},{"text":" All scoreboards and storage removed.","color":"gray"}]
-tellraw @a ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"To reinitialize: ","color":"gray"},{"text":"/reload","color":"white","underlined":true,"click_event":{"action":"run_command","command":"/reload"}},{"text":"  or  ","color":"gray"},{"text":"[Reinitialize]","color":"green","bold":true,"underlined":true,"click_event":{"action":"run_command","command":"/function dl_load:main"}}]
diff --git a/datapacks/dataLib/data/dl_load/function/gate/exec/kick.mcfunction b/datapacks/dataLib/data/dl_load/function/gate/exec/kick.mcfunction
deleted file mode 100644
index 345bd2d7..00000000
--- a/datapacks/dataLib/data/dl_load/function/gate/exec/kick.mcfunction
+++ /dev/null
@@ -1,8 +0,0 @@
-# dl_load:gate/exec/kick
-# Executor for confirmed player kick.
-# Called by dl_load:gate/yes when pending_gate{type:"kick"}.
-# Expects: {type:"kick", player:"<name>", reason:"<text>"}
-
-$kick $(player) $(reason)
-
-tellraw @a ["",{"text":"[DL GATE] ","color":"#555555"},{"text":"Kicked ","color":"yellow"},{"text":"$(player)","color":"aqua","bold":true},{"text":" — $(reason)","color":"gray"}]
diff --git a/datapacks/dataLib/data/dl_load/function/gate/no.mcfunction b/datapacks/dataLib/data/dl_load/function/gate/no.mcfunction
deleted file mode 100644
index 63399551..00000000
--- a/datapacks/dataLib/data/dl_load/function/gate/no.mcfunction
+++ /dev/null
@@ -1,26 +0,0 @@
-# dl_load:gate/no
-# Cancel the pending dangerous command.
-#
-# Does NOT execute the pending action. Clears pending_gate from storage.
-# Idempotent — safe to call multiple times.
-#
-# ALSO CALLED BY: dl_load:gate/timeout (auto-cancel after 30 seconds)
-
-# Guard: nothing pending
-execute unless score #pending dl.gate matches 1 run return 0
-
-# Close the gate window
-scoreboard players set #pending dl.gate 0
-scoreboard players set #confirmed dl.gate 0
-
-# Cancel the still-pending timeout if admin called /no explicitly
-schedule clear dl_load:gate/timeout
-
-# Announce cancellation via tellraw — no marker entity needed.
-tellraw @a ["",{"text":"[DL GATE] ","color":"#555555"},{"text":"Dangerous command CANCELLED.","color":"red","bold":true},{"text":" Action was NOT executed.","color":"gray"}]
-
-# Discard pending context
-data remove storage datalib:engine pending_gate
-scoreboard players reset #pending dl.gate
-scoreboard players reset #confirmed dl.gate
-scoreboard objectives remove dl.gate
diff --git a/datapacks/dataLib/data/dl_load/function/gate/request.mcfunction b/datapacks/dataLib/data/dl_load/function/gate/request.mcfunction
deleted file mode 100644
index 37a6b8f8..00000000
--- a/datapacks/dataLib/data/dl_load/function/gate/request.mcfunction
+++ /dev/null
@@ -1,38 +0,0 @@
-# dl_load:gate/request
-# Generic dangerous-command confirmation gate — request side.
-#
-# CALLER PROTOCOL
-# ---------------
-# Before calling this function, the caller MUST write a pending_gate
-# compound to datalib:engine storage describing the action to confirm:
-#
-#   data modify storage datalib:engine pending_gate set value {type:"ban", player:"...", reason:"..."}
-#   function dl_load:gate/request
-#
-# This function then:
-#   1. Opens the dl.gate scoreboard window
-#   2. Broadcasts a clickable confirmation prompt via tellraw
-#   3. Schedules a 30-second auto-cancel
-#
-# CONFIRMING:  /function dl_load:gate/yes  (or click [Confirm])
-# CANCELLING:  /function dl_load:gate/no   (or click [Cancel])
-#
-# If another gate is already pending, this call is silently dropped to
-# prevent multiple dangerous commands from racing in multiplayer.
-
-# Drop silently if a gate is already open (multiplayer safety)
-scoreboard objectives add dl.gate dummy
-execute if score #pending dl.gate matches 1 run return 0
-
-# Open the gate window
-scoreboard players set #pending dl.gate 0
-scoreboard players set #confirmed dl.gate 0
-scoreboard players set #pending dl.gate 1
-
-# Broadcast via tellraw — clickable buttons, no marker entity needed.
-tellraw @a ["",{"text":"[DL GATE] ","color":"#555555"},{"text":"Dangerous command pending","color":"yellow","bold":true},{"text":" — awaiting confirmation.","color":"gray"}]
-tellraw @a ["",{"text":"[DL GATE] ","color":"#555555"},{"text":"[Confirm]","color":"green","bold":true,"underlined":true,"click_event":{"action":"run_command","command":"/function dl_load:gate/yes"}},{"text":"   ","color":"gray"},{"text":"[Cancel]","color":"red","bold":true,"underlined":true,"click_event":{"action":"run_command","command":"/function dl_load:gate/no"}}]
-tellraw @a ["",{"text":"[DL GATE] ","color":"#555555"},{"text":"Auto-cancel fires in 30 seconds.","color":"gray"}]
-
-# Schedule 30-second auto-cancel for dangerous commands
-schedule function dl_load:gate/timeout 30s replace
diff --git a/datapacks/dataLib/data/dl_load/function/gate/timeout.mcfunction b/datapacks/dataLib/data/dl_load/function/gate/timeout.mcfunction
deleted file mode 100644
index 5495e75a..00000000
--- a/datapacks/dataLib/data/dl_load/function/gate/timeout.mcfunction
+++ /dev/null
@@ -1,10 +0,0 @@
-# dl_load:gate/timeout
-# Fires 30 seconds after dl_load:gate/request if no admin response.
-#
-# Delegates to dl_load:gate/no which is idempotent — if the gate was
-# already closed by an explicit /yes or /no, the #pending guard in
-# gate/no returns 0 and nothing happens.
-
-tellraw @a ["",{"text":"[DL GATE] ","color":"#555555"},{"text":"Dangerous command timeout (30s)","color":"red"},{"text":" — auto-cancelling.","color":"gray"}]
-
-execute if score #pending dl.gate matches 1 run function dl_load:gate/no
diff --git a/datapacks/dataLib/data/dl_load/function/gate/yes.mcfunction b/datapacks/dataLib/data/dl_load/function/gate/yes.mcfunction
deleted file mode 100644
index 5110ab1a..00000000
--- a/datapacks/dataLib/data/dl_load/function/gate/yes.mcfunction
+++ /dev/null
@@ -1,53 +0,0 @@
-# dl_load:gate/yes
-# Execute the pending dangerous command after admin confirmation.
-#
-# Reads the pending_gate compound from datalib:engine storage and dispatches
-# to the correct executor based on the 'type' field.
-#
-# SUPPORTED TYPES
-# ---------------
-#   "ban"     → dl_load:gate/exec/ban       (datalib: player, reason)
-#   "ban_ip"  → dl_load:gate/exec/ban_ip    (datalib: player, reason)
-#   "kick"    → dl_load:gate/exec/kick      (datalib: player, reason)
-#   "disable" → dl_load:gate/exec/disable   (no macro params)
-#
-# Adding new types: write an executor in dl_load:gate/exec/, then add
-# an 'execute if data' dispatch line here.
-
-# Guard: no gate open
-execute unless score #pending dl.gate matches 1 run return 0
-
-# Guard: already confirmed (double-call protection)
-execute if score #confirmed dl.gate matches 1 run return 0
-
-# Mark confirmed, close window
-scoreboard players set #confirmed dl.gate 1
-scoreboard players set #pending dl.gate 0
-
-# Cancel the 30-second timeout
-schedule clear dl_load:gate/timeout
-
-# Announce execution via tellraw — no marker entity needed.
-tellraw @a ["",{"text":"[DL GATE] ","color":"#555555"},{"text":"Dangerous command CONFIRMED.","color":"green","bold":true},{"text":" Executing...","color":"gray"}]
-
-# --- DISPATCH ---
-# Each executor reads its own fields from datalib:engine pending_gate via datalib.
-# The 'with storage' pattern passes pending_gate fields as $(macro) parameters.
-
-# ban: requires {type:"ban", player:"...", reason:"..."}
-execute if data storage datalib:engine pending_gate{type:"ban"} run function dl_load:gate/exec/ban with storage datalib:engine pending_gate
-
-# ban_ip: requires {type:"ban_ip", player:"...", reason:"..."}
-execute if data storage datalib:engine pending_gate{type:"ban_ip"} run function dl_load:gate/exec/ban_ip with storage datalib:engine pending_gate
-
-# kick: requires {type:"kick", player:"...", reason:"..."}
-execute if data storage datalib:engine pending_gate{type:"kick"} run function dl_load:gate/exec/kick with storage datalib:engine pending_gate
-
-# disable: requires {type:"disable"} (no extra fields)
-execute if data storage datalib:engine pending_gate{type:"disable"} run function dl_load:gate/exec/disable
-
-# --- CLEANUP ---
-data remove storage datalib:engine pending_gate
-scoreboard players reset #pending dl.gate
-scoreboard players reset #confirmed dl.gate
-scoreboard objectives remove dl.gate
diff --git a/datapacks/dataLib/data/dl_load/function/load/all.mcfunction b/datapacks/dataLib/data/dl_load/function/load/all.mcfunction
index 179a6136..157e6647 100644
--- a/datapacks/dataLib/data/dl_load/function/load/all.mcfunction
+++ b/datapacks/dataLib/data/dl_load/function/load/all.mcfunction
@@ -1,88 +1,22 @@
-# dl_load:load/all
-# Load — entry point called from minecraft:load tag via datalib:load
-#
-# STAGE DEBUG NOTE (v6.0.1)
-# -------------------------------
-# Previously each stage spawned a minecraft:marker entity purely to run
-# 'say' (marker context was used because 'say' has no @a[tag=...] filter
-# and clickEvent/tellraw rendering was historically unreliable during
-# server startup). That pattern summons+kills an entity per stage on
-# every single load/reload — unnecessary entity churn for a line of
-# debug text. tellraw @a[tag=datalib.debug] needs no executing entity
-# and is already gated behind the debug tag, so non-debug players never
-# see this spam either.
-forceload add -30000000 1600
-
-# Stage 0 — Preparing
-tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"Preparing...","color":"gray"}]
-
-execute unless function dl_load:resolve/validate run return 0
-
-# Stage 1 — Starting
-tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"Starting dataLib...","color":"gray"}]
-
-data modify storage datalib:engine _log_add_tmp.level set value "D.L."
-data modify storage datalib:engine _log_add_tmp.message set value "Starting..."
-data modify storage datalib:engine _log_add_tmp.color set value "aqua"
-function datalib:systems/log/add with storage datalib:engine _log_add_tmp
+# dl_load:load/all — full init pipeline (no fork / rt_origin / confirm gates)
 
-# RT Origin — Gate 1: watermark doğrulama (artık resolve/validate içinde çağrılıyor, burada tekrar çağırmaya gerek yok)
-execute unless data storage datalib:engine {global:{rt_origin_verified:1b}} run return run tellraw @s {"text":"Exit code: 1 — rt_origin verification failed","color":"red"}
+tellraw @a ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"Starting dataLib...","color":"gray"}]
 
-# RT Origin — Gate 2: fork check
-# If fork_verified field doesn't exist, open the approval gate (1b=original, 0b=fork approved, either passes)
-execute unless data storage datalib:engine global.fork_verified run return run function dl_load:load/fork
-
-tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"Fork gate passed...","color":"gray"}]
+# forceload classic marker chunk (legacy features)
+forceload add -30000000 1600
 
-# Stage 2 — scoreboards (moved to loader/ — see dl_load:loader/scoreboards)
-tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"Loading scoreboards...","color":"gray"}]
 function dl_load:loader/scoreboards
-
-# Stage 3 — storages (moved to loader/ — see dl_load:loader/storages)
-tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"Loading storages...","color":"gray"}]
 function dl_load:loader/storages
-
-tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"Loading other systems...","color":"gray"}]
-
 function dl_load:load/other
 
-data modify storage datalib:engine global.loaded set value 1b
-
-function dl_load:core/internal/load/version_set
-
-tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"Setting version...","color":"gray"}]
-
-# Lantern Load integration — set pack version in load.status
-# Format: (major * 10000) + (minor * 100) + patch
-# Example: v2.2.6 = 20206
-execute store result score #version_calc dl.tmp run scoreboard players get #dl.major dl.pre_version
-scoreboard players operation #version_calc dl.tmp *= #601 dl.tmp
-execute store result score #temp dl.tmp run scoreboard players get #dl.minor dl.pre_version
-scoreboard players operation #temp dl.tmp *= #100 dl.tmp
-scoreboard players operation #version_calc dl.tmp += #temp dl.tmp
-scoreboard players operation #version_calc dl.tmp += #dl.patch dl.pre_version
-scoreboard players operation #dataLib load.status = #version_calc dl.tmp
-
-execute if score #dl.pre dl.pre_version matches 1.. run tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"Loaded. ","color":"green"},[{"text":"v","color":"aqua"},{"score":{"name":"#dl.major","objective":"dl.pre_version"},"color":"aqua","bold":true},{"text":".","color":"aqua"},{"score":{"name":"#dl.minor","objective":"dl.pre_version"},"color":"aqua","bold":true},{"text":".","color":"aqua"},{"score":{"name":"#dl.patch","objective":"dl.pre_version"},"color":"aqua","bold":true},{"text":"-pre","color":"#ff8800"},{"score":{"name":"#dl.pre","objective":"dl.pre_version"},"color":"#ff8800","bold":true}]]
-execute if score #dl.pre dl.pre_version matches ..0 run tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"Loaded. ","color":"green"},[{"text":"v","color":"aqua"},{"score":{"name":"#dl.major","objective":"dl.pre_version"},"color":"aqua","bold":true},{"text":".","color":"aqua"},{"score":{"name":"#dl.minor","objective":"dl.pre_version"},"color":"aqua","bold":true},{"text":".","color":"aqua"},{"score":{"name":"#dl.patch","objective":"dl.pre_version"},"color":"aqua","bold":true}]]
+# Re-apply config after storages (storages may reset defaults)
+function datalib:config
 
-data modify storage datalib:engine _log_add_tmp.level set value "dataLib"
-data modify storage datalib:engine _log_add_tmp.message set value "Loaded."
-data modify storage datalib:engine _log_add_tmp.color set value "green"
-function datalib:systems/log/add with storage datalib:engine _log_add_tmp
-
-# RT Origin verification (flag already set by validate at start of load)
-execute unless data storage datalib:engine {global:{rt_origin_verified:1b}} run return run tellraw @s {"text":"Exit code: 1 — rt_origin verification failed","color":"red"}
-
-tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"Finalizing...","color":"gray"}]
-
-function dl_load:core/internal/load/finalize
+data modify storage datalib:engine global.loaded set value 1b
+data modify storage datalib:engine global.version set value "v6.0.2"
 
-# Detect datalib_extensions
-tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"Finding datalib_extensions...","color":"gray"}]
+scoreboard players set #runtoolkit.packs.datalib.version datalib.meta 602
 
-execute if score #datalib_extensions.present datalib.meta matches 1.. run tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"Detected datalib_extensions...","color":"gray"}]
+function dl_load:load/post_load
 
-# Debug
-tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"Done!","color":"green"}]
+tellraw @a ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"dataLib v6.0.2 loaded.","color":"green"}]
diff --git a/datapacks/dataLib/data/dl_load/function/load/confirm.mcfunction b/datapacks/dataLib/data/dl_load/function/load/confirm.mcfunction
index a3a63379..0d243b8f 100644
--- a/datapacks/dataLib/data/dl_load/function/load/confirm.mcfunction
+++ b/datapacks/dataLib/data/dl_load/function/load/confirm.mcfunction
@@ -1,111 +1 @@
-# dl_load:load/confirm
-# DL Load Confirmation Gate — Stage 0 dispatcher
-# Execution context: whichever entity/console called dl_load:main
-# (no marker entity is spawned anymore — see dl_load:main header)
-#
-# PURPOSE
-# -------
-# The minecraft:load tag fires on /reload AND on server/world open.
-# If datalib:engine storage already holds live data from a previous session
-# (permission maps, flag tables, wand binds, etc.), overwriting it
-# immediately causes nondeterministic state and silent data loss.
-#
-# This function sets a scoreboard-based pending flag, broadcasts a
-# clickable confirmation prompt via tellraw, and schedules an automatic
-# cancel after 5 minutes.
-#
-# NOTHING in datalib:engine storage is touched here.
-# Storage writes happen only after dl_load:load/yes is called.
-#
-# FLOW
-# ----
-#   dl_load:main (stage0)
-#     └─ dl_load:load/confirm   ← this file
-#         ├─ broadcasts clickable prompt
-#         └─ schedules dl_load:timeout (5m)
-#
-#   Admin: /function dl_load:load/yes  (or clicks [Confirm])
-#     └─ dl_load:load/all → full init pipeline
-#
-#   Admin: /function dl_load:load/no  (or clicks [Cancel])
-#     └─ abort — storage untouched
-#
-#   5 minutes elapse with no response:
-#     └─ dl_load:timeout → dl_load:load/no (auto-abort)
-
-# Create load-gate tracking objective
-# Safe to call even if objective already exists (add is idempotent)
-scoreboard objectives add dl.load dummy
-
-# Ensure load config defaults exist (idempotent, only fills missing keys)
-function datalib:config/load_cfg
-
-# Reset any stale state from a previous incomplete gate cycle
-scoreboard players set #pending dl.load 0
-scoreboard players set #confirmed dl.load 0
-scoreboard players set #cancelled dl.load 0
-
-# Open the gate window
-scoreboard players set #pending dl.load 1
-
-# Broadcast via tellraw — clickable buttons, no marker entity needed.
-tellraw @a ["",{"text":"[DL GATE] ========================================","color":"#555555"}]
-tellraw @a ["",{"text":"[DL GATE] ","color":"#555555"},{"text":"dataLib load is PENDING.","color":"yellow","bold":true}]
-tellraw @a ["",{"text":"[DL GATE] ","color":"#555555"},{"text":"Storage has NOT been modified yet.","color":"gray"}]
-tellraw @a ["",{"text":"[DL GATE] ----------------------------------------","color":"#555555"}]
-tellraw @a ["",{"text":"[DL GATE] ","color":"#555555"},{"text":"[Confirm]","color":"green","bold":true,"underlined":true,"click_event":{"action":"run_command","command":"/function dl_load:load/yes"}},{"text":"   ","color":"gray"},{"text":"[Cancel]","color":"red","bold":true,"underlined":true,"click_event":{"action":"run_command","command":"/function dl_load:load/no"}}]
-tellraw @a ["",{"text":"[DL GATE] ----------------------------------------","color":"#555555"}]
-
-tellraw @a ["",{"text":"[DL GATE] ========================================","color":"#555555"}]
-
-# Schedule auto-cancel using the config value.
-# NOTE: /schedule cannot take a macro argument for its duration — this is
-# a confirmed Minecraft engine limitation (macros are not supported by
-# /schedule as of this version). So instead of a truly dynamic duration,
-# we branch over a fixed set of allowed values from datalib:config/load_cfg.
-# Anything outside this set falls back to the 300s default.
-# 'replace' ensures repeated /reload does not stack multiple timeout schedules
-scoreboard players set #timeout_matched dl.tmp 0
-scoreboard players set #timeout_actual dl.tmp 300
-execute if score #runtoolkit.packs.datalib.config.load.timeout_seconds datalib.meta matches 60 run scoreboard players set #timeout_matched dl.tmp 1
-execute if score #runtoolkit.packs.datalib.config.load.timeout_seconds datalib.meta matches 60 run scoreboard players set #timeout_actual dl.tmp 60
-execute if score #runtoolkit.packs.datalib.config.load.timeout_seconds datalib.meta matches 60 run schedule function dl_load:timeout 60s replace
-execute if score #runtoolkit.packs.datalib.config.load.timeout_seconds datalib.meta matches 120 run scoreboard players set #timeout_matched dl.tmp 1
-execute if score #runtoolkit.packs.datalib.config.load.timeout_seconds datalib.meta matches 120 run scoreboard players set #timeout_actual dl.tmp 120
-execute if score #runtoolkit.packs.datalib.config.load.timeout_seconds datalib.meta matches 120 run schedule function dl_load:timeout 120s replace
-execute if score #runtoolkit.packs.datalib.config.load.timeout_seconds datalib.meta matches 180 run scoreboard players set #timeout_matched dl.tmp 1
-execute if score #runtoolkit.packs.datalib.config.load.timeout_seconds datalib.meta matches 180 run scoreboard players set #timeout_actual dl.tmp 180
-execute if score #runtoolkit.packs.datalib.config.load.timeout_seconds datalib.meta matches 180 run schedule function dl_load:timeout 180s replace
-execute if score #runtoolkit.packs.datalib.config.load.timeout_seconds datalib.meta matches 300 run scoreboard players set #timeout_matched dl.tmp 1
-execute if score #runtoolkit.packs.datalib.config.load.timeout_seconds datalib.meta matches 300 run schedule function dl_load:timeout 300s replace
-execute if score #runtoolkit.packs.datalib.config.load.timeout_seconds datalib.meta matches 600 run scoreboard players set #timeout_matched dl.tmp 1
-execute if score #runtoolkit.packs.datalib.config.load.timeout_seconds datalib.meta matches 600 run scoreboard players set #timeout_actual dl.tmp 600
-execute if score #runtoolkit.packs.datalib.config.load.timeout_seconds datalib.meta matches 600 run schedule function dl_load:timeout 600s replace
-# Fallback: value wasn't one of the allowed presets (whether in-range or not) — #timeout_actual stays 300
-execute if score #timeout_matched dl.tmp matches 0 run schedule function dl_load:timeout 300s replace
-
-# Announce the ACTUAL scheduled duration (#timeout_actual), not the raw
-# config value, so the message can never disagree with what was scheduled.
-# NOTE: a $-prefixed macro line cannot be nested inside 'execute ... run' —
-# it must be a standalone top-level line. We store a suffix flag instead
-# and always emit the same macro tellraw line.
-data modify storage datalib:engine _timeout_tmp.suffix set value "(s)"
-execute if score #timeout_matched dl.tmp matches 0 run data modify storage datalib:engine _timeout_tmp.suffix set value " (invalid config value, using default)"
-execute store result storage datalib:engine _timeout_tmp.seconds int 1 run scoreboard players get #timeout_actual dl.tmp
-tellraw @a ["",{"text":"[DL GATE] ","color":"#555555"},{"text":"Auto-cancel fires in","color":"gray"}," ",{"nbt":"_timeout_tmp.seconds","storage":"datalib:engine","plain":true}," ",{"text":"if no response","color":"gray"},"",{"storage":"datalib:engine","nbt":"_timeout_tmp.suffix","color":"gray","plain":false,"interpret":true},{"text":".","color":"gray"}]
-# ─────────────────────────────────────────────────────────────────
-# SANDBOX MODE — auto-confirm
-# Enable (legacy):  /data modify storage datalib:engine sandbox set value 1b
-# Enable (config):  /scoreboard players set #runtoolkit.packs.datalib.config.load.sandbox_enabled datalib.meta 1
-# Disable:          set either back to 0 / 0b
-# Both are checked — either one enables sandbox mode.
-# Storage/scoreboard values persist across reloads — set once, active until cleared.
-# NOTE: schedule is cleared inside load/yes. Do NOT remove dl.load
-#       objective here — load/yes guard checks #pending dl.load == 1.
-# ─────────────────────────────────────────────────────────────────
-scoreboard players set #sandbox_active dl.tmp 0
-execute if data storage datalib:engine {sandbox:1b} run scoreboard players set #sandbox_active dl.tmp 1
-execute if score #runtoolkit.packs.datalib.config.load.sandbox_enabled datalib.meta matches 1 run scoreboard players set #sandbox_active dl.tmp 1
-execute if score #sandbox_active dl.tmp matches 1 run tellraw @a ["",{"text":"[DL GATE] ","color":"#555555"},{"text":"SANDBOX MODE — auto-confirming load.","color":"yellow"}]
-execute if score #sandbox_active dl.tmp matches 1 run function dl_load:load/yes
-execute if score #sandbox_active dl.tmp matches 1 run return 0
+function dl_load:load/all
diff --git a/datapacks/dataLib/data/dl_load/function/load/force.mcfunction b/datapacks/dataLib/data/dl_load/function/load/force.mcfunction
new file mode 100644
index 00000000..233dfcf8
--- /dev/null
+++ b/datapacks/dataLib/data/dl_load/function/load/force.mcfunction
@@ -0,0 +1,4 @@
+# Force full re-init (explicit data loss of engine flags)
+data remove storage datalib:engine global.loaded
+tellraw @a ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"Force re-init...","color":"yellow"}]
+function dl_load:load/all
diff --git a/datapacks/dataLib/data/dl_load/function/load/fork.mcfunction b/datapacks/dataLib/data/dl_load/function/load/fork.mcfunction
index 8e12d970..6f68028c 100644
--- a/datapacks/dataLib/data/dl_load/function/load/fork.mcfunction
+++ b/datapacks/dataLib/data/dl_load/function/load/fork.mcfunction
@@ -1,29 +1,2 @@
-# dl_load:load/fork
-# Fork confirmation gate — called when fork_verified is not set.
-# Player is prompted to confirm with a click or /yes-/no command.
-#
-# USAGE:
-#   /function dl_load:load/fork
-#
-# CONFIRM:  /function dl_load:load/fork_yes  (or click [Yes])
-# CANCEL:   /function dl_load:load/fork_no   (or click [No])
-
-scoreboard objectives add dl.fork_gate dummy
-
-# Reset any stale state from a previous incomplete gate cycle.
-# Without this, a #pending=1 left over from a prior session/reload
-# (objectives add is idempotent and does NOT reset values) would
-# permanently lock this gate: fork_yes/fork_no both guard on
-# "#pending matches 1", and the early "drop if already open" check
-# below would keep returning before ever re-arming the 30s timeout.
-scoreboard players set #pending dl.fork_gate 0
-scoreboard players set #confirmed dl.fork_gate 0
-
-scoreboard players set #pending dl.fork_gate 1
-
-tellraw @a ["",{"text":"[DL FORK GATE] ","color":"#555555"},{"text":"This copy is not marked as a fork.","color":"yellow"}]
-tellraw @a ["",{"text":"[DL FORK GATE] ","color":"#555555"},{"text":"Do you want to continue?","color":"gray"}]
-tellraw @a ["",{"text":"[DL FORK GATE] ","color":"#555555"},{"text":"[Yes]","color":"green","bold":true,"underlined":true,"click_event":{"action":"run_command","command":"/function dl_load:load/fork_yes"}},{"text":"   ","color":"gray"},{"text":"[No]","color":"red","bold":true,"underlined":true,"click_event":{"action":"run_command","command":"/function dl_load:load/fork_no"}}]
-tellraw @a ["",{"text":"[DL FORK GATE] ","color":"#555555"},{"text":"Auto-cancel fires in 30 seconds.","color":"gray"}]
-
-schedule function dl_load:load/fork_no 30s replace
+# fork gate removed
+function dl_load:load/all
diff --git a/datapacks/dataLib/data/dl_load/function/load/fork_no.mcfunction b/datapacks/dataLib/data/dl_load/function/load/fork_no.mcfunction
index c00708a8..2492cee9 100644
--- a/datapacks/dataLib/data/dl_load/function/load/fork_no.mcfunction
+++ b/datapacks/dataLib/data/dl_load/function/load/fork_no.mcfunction
@@ -1,36 +1 @@
-# dl_load:load/fork_no
-# Fork confirmation gate — /no response or 30s timeout.
-# Runs normal load, fork_verified is not set.
-#
-# USAGE:
-#   /function dl_load:load/fork_no
-
-# Guard: gate must be open
-execute unless score #pending dl.fork_gate matches 1 run return 0
-
-# Guard: already confirmed
-execute if score #confirmed dl.fork_gate matches 1 run return 0
-
-scoreboard players set #pending dl.fork_gate 0
-
-schedule clear dl_load:load/fork_no
-
-# BUGFIX: this was the only path through load/all.mcfunction that never
-# set global.fork_verified. load/all's fork-gate check is
-# "execute unless data storage datalib:engine global.fork_verified run
-# return run function dl_load:load/fork" — it only treats the gate as
-# resolved once the FIELD EXISTS (1b=original, 0b=confirmed fork, per
-# load/all's own comment), not based on which choice was made. Since
-# load/yes always reschedules load/all 1 tick later, leaving the field
-# unset here meant every /no answer led straight back into load/all
-# re-opening the same fork gate again — an infinite confirmation loop,
-# reproduced live: fork_no fired repeatedly every few seconds without
-# the operator doing anything, because load/yes -> load/all -> fork
-# (field still unset) -> wait for input -> fork_no -> load/yes -> ...
-# 1b marks this copy as "not a fork, operator dismissed the prompt" —
-# distinct from fork_yes's 0b ("is a fork, operator confirmed it").
-data modify storage datalib:engine global.fork_verified set value 1b
-
-tellraw @a ["",{"text":"[DL FORK GATE] ","color":"#555555"},{"text":"Cancelled","color":"red"},{"text":" — continuing with normal load.","color":"gray"}]
-
-function dl_load:load/yes
+# no-op
diff --git a/datapacks/dataLib/data/dl_load/function/load/fork_yes.mcfunction b/datapacks/dataLib/data/dl_load/function/load/fork_yes.mcfunction
index 8669ccf4..0d243b8f 100644
--- a/datapacks/dataLib/data/dl_load/function/load/fork_yes.mcfunction
+++ b/datapacks/dataLib/data/dl_load/function/load/fork_yes.mcfunction
@@ -1,39 +1 @@
-# dl_load:load/fork_yes
-# Fork confirmation gate — /yes response.
-# Runs safe_load and sets fork_verified to 0b.
-#
-# USAGE:
-#   /function dl_load:load/fork_yes
-
-# Guard: gate must be open
-execute unless score #pending dl.fork_gate matches 1 run return 0
-
-# Guard: already confirmed
-execute if score #confirmed dl.fork_gate matches 1 run return 0
-
-scoreboard players set #confirmed dl.fork_gate 1
-scoreboard players set #pending dl.fork_gate 0
-
-schedule clear dl_load:load/fork_no
-
-tellraw @a ["",{"text":"[DL FORK GATE] ","color":"#555555"},{"text":"Confirmed","color":"green","bold":true},{"text":" — running safe_load.","color":"gray"}]
-
-# fork_verified = 0b (fork, confirmed by operator)
-data modify storage datalib:engine global.fork_verified set value 0b
-
-function dl_load:safe_load/yes
-
-# ── Extension override dependency ──────────────────────────────────
-# datalib_extensions marks its own presence via
-# #datalib_extensions.present datalib.meta = 1, set on its own
-# #minecraft:load hook (extensions/init). This block does not test
-# function existence directly — Minecraft has no reliable
-# if-function-exists primitive, and a missing function call fails soft
-# rather than tripping an if/unless guard — so presence is inferred
-# from that flag instead.
-#
-# Confirmed-fork builds (this file, fork_yes) hand control to
-# datalib_extensions:extensions/gate when the dependency is present,
-# so override behavior only activates in a build an operator has
-# explicitly acknowledged as a fork.
-execute if score #datalib_extensions.present datalib.meta matches 1 run function datalib_extensions:extensions/gate
+function dl_load:load/all
diff --git a/datapacks/dataLib/data/dl_load/function/load/no.mcfunction b/datapacks/dataLib/data/dl_load/function/load/no.mcfunction
index b9caf50a..6ca73e32 100644
--- a/datapacks/dataLib/data/dl_load/function/load/no.mcfunction
+++ b/datapacks/dataLib/data/dl_load/function/load/no.mcfunction
@@ -1,37 +1 @@
-# dl_load:load/no
-# Admin cancelled (or timeout fired) — DL load is ABORTED.
-#
-# datalib:engine storage is NOT touched at any point.
-# The engine remains uninitialized and fully inert.
-#
-# IDEMPOTENT — safe to call multiple times.
-# The #pending guard ensures this is a no-op if no gate is open.
-#
-# ALSO CALLED BY: dl_load:timeout (auto-cancel after 5 minutes)
-#
-# TO RETRY: run /reload  OR  click the button below / /function dl_load:main
-# (calling dl_load:main directly re-runs stage0 without a full /reload)
-
-# Guard: nothing pending
-execute unless score #pending dl.load matches 1 run return 0
-
-# Close the gate window
-scoreboard players set #cancelled dl.load 1
-scoreboard players set #pending dl.load 0
-scoreboard players set #confirmed dl.load 0
-
-# If admin called /no explicitly, cancel the still-pending timeout
-schedule clear dl_load:timeout
-
-# Announce cancellation via tellraw — no marker entity needed.
-tellraw @a ["",{"text":"[DL GATE] ========================================","color":"#555555"}]
-tellraw @a ["",{"text":"[DL GATE] ","color":"#555555"},{"text":"Load CANCELLED.","color":"red","bold":true},{"text":" datalib:engine storage was NOT modified.","color":"gray"}]
-tellraw @a ["",{"text":"[DL GATE] ","color":"#555555"},{"text":"Engine is NOT running.","color":"gray"}]
-tellraw @a ["",{"text":"[DL GATE] ","color":"#555555"},{"text":"To retry: ","color":"gray"},{"text":"/reload","color":"white","underlined":true,"click_event":{"action":"run_command","command":"/reload"}},{"text":"  or  ","color":"gray"},{"text":"[Retry Load]","color":"green","bold":true,"underlined":true,"click_event":{"action":"run_command","command":"/function dl_load:main"}}]
-tellraw @a ["",{"text":"[DL GATE] ========================================","color":"#555555"}]
-
-# Tear down gate objective
-scoreboard players reset #pending dl.load
-scoreboard players reset #cancelled dl.load
-scoreboard players reset #confirmed dl.load
-scoreboard objectives remove dl.load
+# no-op (load cancel gate removed)
diff --git a/datapacks/dataLib/data/dl_load/function/load/yes.mcfunction b/datapacks/dataLib/data/dl_load/function/load/yes.mcfunction
index e93f0dfb..0d243b8f 100644
--- a/datapacks/dataLib/data/dl_load/function/load/yes.mcfunction
+++ b/datapacks/dataLib/data/dl_load/function/load/yes.mcfunction
@@ -1,45 +1 @@
-# dl_load:load/yes
-# Admin confirmed DL load. Triggers the full initialization pipeline.
-#
-# GUARDS
-# ------
-#   - Gate must be open (#pending dl.load == 1)
-#   - Already-confirmed calls are no-ops (idempotent)
-#   - If called with no gate pending, silently returns 0
-#
-# WHAT HAPPENS
-# ------------
-#   1. Mark confirmed, close the pending window
-#   2. Cancel the 5-minute timeout schedule
-#   3. Tear down the dl.load objective (not needed after this point)
-#   4. Schedule dl_load:load/all at t+1 (clean tick boundary)
-#
-# The 1-tick delay lets the scoreboard objective removal settle before
-# dl_load:loader/scoreboards runs and recreates its own objectives.
-
-# Guard: no gate open
-execute unless score #pending dl.load matches 1 run return 0
-
-# Guard: already confirmed (double-call protection)
-execute if score #confirmed dl.load matches 1 run return 0
-
-# Mark confirmed — close window
-scoreboard players set #confirmed dl.load 1
-scoreboard players set #pending dl.load 0
-
-# Cancel auto-cancel timeout
-schedule clear dl_load:timeout
-
-# Announce via tellraw — no marker entity needed.
-tellraw @a ["",{"text":"[DL GATE] ","color":"#555555"},{"text":"Load CONFIRMED","color":"green","bold":true},{"text":" by operator. Initializing dataLib...","color":"gray"}]
-
-# Tear down gate scoreboard before load pipeline touches scoreboards
-scoreboard players reset #pending dl.load
-scoreboard players reset #confirmed dl.load
-scoreboard players reset #cancelled dl.load
-scoreboard objectives remove dl.load
-
-# Fire the actual load pipeline
-# 1-tick delay gives scoreboard removal a clean tick boundary before
-# dl_load:loader/scoreboards recreates its objectives
-schedule function dl_load:load/all 1t replace
+function dl_load:load/all
diff --git a/datapacks/dataLib/data/dl_load/function/main.mcfunction b/datapacks/dataLib/data/dl_load/function/main.mcfunction
index e3756d31..37860a5b 100644
--- a/datapacks/dataLib/data/dl_load/function/main.mcfunction
+++ b/datapacks/dataLib/data/dl_load/function/main.mcfunction
@@ -1,35 +1,14 @@
-# dl_load:main — Stage 0 Load Entry Point
-#
-# This is the ONLY function registered in the minecraft:load function tag
-# (via datalib:load → dl_load:main).
-# It does NOT load dataLib directly.
-#
-# Instead it delegates straight to the load gate, which broadcasts a
-# clickable confirmation prompt, then returns. Nothing in datalib:engine
-# storage is touched here.
-#
-# v6.0.2: renamed from dl_load:_ to dl_load:main, and dropped the
-# marker-entity + 'say' broadcast pattern entirely.
-#   - The marker/say pattern existed because 'say' has no @a[tag=...]
-#     filter and, historically, tellraw/clickEvent rendering was
-#     considered unreliable at server startup. tellraw @a does not
-#     require an executing entity at all — there is no context reason
-#     left to summon+kill a marker just to print a line.
-#   - Every prompt below is now a clickable tellraw button using the
-#     current run_command click event format: "click_event":
-#     {"action":"run_command","command":"/function ..."}. See
-#     dl_load:load/confirm for the actual button rendering.
-#
-# WHY DEFERRED LOAD (GATE SYSTEM):
-#   - minecraft:load fires on /reload AND on world open.
-#   - If datalib:engine storage contains live data from a prior session
-#     (permissions, flags, wand binds, etc.), any unconditional storage
-#     write causes silent overwrites and nondeterministic engine state.
-#   - The gate requires explicit admin confirmation before any storage
-#     touch.
-#
-# CONFIRMING:  /function dl_load:load/yes  (or click the button)
-# CANCELLING:  /function dl_load:load/no   (or click the button)
-# AUTO-CANCEL: fires after 5 minutes if no response
+# dl_load:main — load entry (no confirmation gate)
+# Only soft-guard: if already loaded, optional reload data-loss warning then continue only via force path.
 
-function dl_load:load/confirm
+function datalib:config
+
+# Archive banner (score-controlled)
+execute if score #runtoolkit.archivedpacks.datalib datalib.meta matches 1 run tellraw @s {"text":"[dataLib] This pack is marked archived (#runtoolkit.archivedpacks.datalib=1).","color":"red"}
+
+# Already loaded → data-loss prevention notice (NOT a hard gate; does not block)
+execute if data storage datalib:engine global{loaded:1b} if data storage datalib:engine config{reload_warn:1b} run tellraw @s ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"Reload: engine already loaded. Live storage kept. To force full re-init: ","color":"yellow"},{"text":"/function dl_load:load/force","color":"aqua","underlined":true,"click_event":{"action":"run_command","command":"/function dl_load:load/force"}}]
+
+execute if data storage datalib:engine global{loaded:1b} run return 0
+
+schedule function dl_load:load/all 31s
\ No newline at end of file
diff --git a/datapacks/dataLib/data/dl_load/function/resolve/dependencies.mcfunction b/datapacks/dataLib/data/dl_load/function/resolve/dependencies.mcfunction
index dc166a14..c113a9b3 100644
--- a/datapacks/dataLib/data/dl_load/function/resolve/dependencies.mcfunction
+++ b/datapacks/dataLib/data/dl_load/function/resolve/dependencies.mcfunction
@@ -1,25 +1,2 @@
-# dl_load:resolve/dependencies
-# Resolves external/internal dependencies dataLib needs before the main
-# load pipeline (dl_load:load/all) runs: origin watermark, fork status,
-# and the optional StringLib companion pack.
-#
-# This does not abort the load on a missing StringLib — it is an
-# optional dependency, so absence only produces a debug-tier warning.
-# rt_origin / fork detection can open the fork confirmation gate via
-# dl_load:core/internal/load/fork_warn, which is a warning tier too —
-# only an explicit version mismatch (resolve/version) aborts load.
-
-# ── Fork / origin detection ──────────────────────────────────────
-# _rt_origin.mcfunction sets rt_origin_verified:1b at load time.
-# Must run BEFORE the check below, otherwise the flag is never set yet
-# on this pass (all.mcfunction calls _rt_origin AFTER validate) and the
-# fork warning fires on every single load.
-function datalib:_rt_origin
-# Absence = file removed or pack is a modified fork.
-# WARN only — load is not aborted, but admins are notified.
-execute unless data storage datalib:engine global{rt_origin_verified:1b} run function dl_load:core/internal/load/fork_warn
-
-# ── StringLib dependency (optional) ──────────────────────────────
-execute unless score #StringLib.Init StringLib matches 1 run tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"⚠ ","color":"yellow"},{"text":"StringLib not initialized — datalib:core/lib/string/* unavailable","color":"yellow"}]
-
-return 1
+# dependencies — StringLib optional warn only
+execute unless score #StringLib.Init StringLib matches 1 run tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"StringLib not initialized (optional).","color":"yellow"}]
diff --git a/datapacks/dataLib/data/dl_load/function/resolve/validate.mcfunction b/datapacks/dataLib/data/dl_load/function/resolve/validate.mcfunction
index 08b12ef7..0a0f9450 100644
--- a/datapacks/dataLib/data/dl_load/function/resolve/validate.mcfunction
+++ b/datapacks/dataLib/data/dl_load/function/resolve/validate.mcfunction
@@ -1,29 +1,3 @@
-# dl_load:resolve/validate
-# Returns 1 → validation passed, load continues.
-# Returns 0 → validation failed, load aborted.
-#
-# v6.0.2: split out of the old monolithic
-# core/internal/load/validate.mcfunction into dl_load:resolve/* —
-# version compatibility and dependency resolution are distinct
-# concerns and are now separately testable/callable:
-#   dl_load:resolve/version       — stale-scoreboard version match
-#   dl_load:resolve/dependencies  — rt_origin/fork + StringLib
-
-# ── Init storage if fresh ────────────────────────────────────────
+# validate — soft only
+function datalib:config
 execute unless data storage datalib:engine global run data modify storage datalib:engine global set value {version:"v6.0.2"}
-data modify storage datalib:engine global.version set value "v6.0.2"
-
-execute unless data storage datalib:engine log_display run data modify storage datalib:engine log_display set value []
-execute unless score #dl.log_count dl.tmp matches 0.. run scoreboard players set #dl.log_count dl.tmp 0
-
-# ── Guard: already loaded ────────────────────────────────────────
-execute if data storage datalib:engine global{loaded:1b} run tellraw @a[tag=datalib.debug] ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"⚠ ","color":"yellow"},{"text":"Already loaded — skipping reload.","color":"yellow"}]
-execute if data storage datalib:engine global{loaded:1b} run return 0
-
-# ── Version resolution ───────────────────────────────────────────
-execute unless function dl_load:resolve/version run return 0
-
-# ── Dependency resolution (fork/origin + StringLib) ──────────────
-function dl_load:resolve/dependencies
-
-return 1
diff --git a/datapacks/dataLib/data/dl_load/function/resolve/version.mcfunction b/datapacks/dataLib/data/dl_load/function/resolve/version.mcfunction
index db287e92..494ff5ab 100644
--- a/datapacks/dataLib/data/dl_load/function/resolve/version.mcfunction
+++ b/datapacks/dataLib/data/dl_load/function/resolve/version.mcfunction
@@ -1,29 +1,7 @@
-# dl_load:resolve/version
-# Resolves whether stale dl.pre_version scores (left over from a
-# previous load pass in the same server session) match this build's
-# expected version. Returns 1 → match / not yet set (proceed).
-# Returns 0 → mismatch (version_warn fired, load aborted upstream).
-#
-# EXPECTED (v6.0.1): major=6 minor=0 patch=2 pre=0 (stable, not a pre-release)
-#
-# BUGFIX (v6.0.1): the previous check compared #dl.pre against
-# "matches 1.." (i.e. "any pre >= 1 counts as mismatch"), which made
-# this objective self-defeating — the pack's own expected pre value
-# is >= 1, so a *correctly* stamped scoreboard from a prior pass in
-# this session would still trip the mismatch flag. This now compares
-# against the exact expected pre value like every other component.
-
+# version stamp
 scoreboard objectives add dl.pre_version dummy
-scoreboard players set #dl.mismatch dl.pre_version 0
-
-# Only meaningful once a previous pass has actually stamped values
-# (#dl.ver_set is set by core/internal/load/version_set).
-execute if score #dl.ver_set dl.pre_version matches 1 run execute unless score #dl.major dl.pre_version matches 6 run scoreboard players set #dl.mismatch dl.pre_version 1
-execute if score #dl.ver_set dl.pre_version matches 1 run execute unless score #dl.minor dl.pre_version matches 0 run scoreboard players set #dl.mismatch dl.pre_version 1
-execute if score #dl.ver_set dl.pre_version matches 1 run execute unless score #dl.patch dl.pre_version matches 2 run scoreboard players set #dl.mismatch dl.pre_version 1
-execute if score #dl.ver_set dl.pre_version matches 1 run execute unless score #dl.pre dl.pre_version matches 0 run scoreboard players set #dl.mismatch dl.pre_version 1
-
-execute if score #dl.mismatch dl.pre_version matches 1 run function dl_load:core/internal/load/version_warn
-execute if score #dl.mismatch dl.pre_version matches 1 run return 0
-
-return 1
+scoreboard players set #dl.major dl.pre_version 6
+scoreboard players set #dl.minor dl.pre_version 0
+scoreboard players set #dl.patch dl.pre_version 2
+scoreboard players set #dl.pre dl.pre_version 0
+scoreboard players set #dl.ver_set dl.pre_version 1
diff --git a/datapacks/dataLib/data/dl_load/function/safe_load/no.mcfunction b/datapacks/dataLib/data/dl_load/function/safe_load/no.mcfunction
deleted file mode 100644
index 11223991..00000000
--- a/datapacks/dataLib/data/dl_load/function/safe_load/no.mcfunction
+++ /dev/null
@@ -1,21 +0,0 @@
-# dl_load:safe_load/no
-# Enhanced load cancellation with detailed logging.
-# Use INSTEAD OF dl_load:load/no for audited environments.
-#
-# USAGE:
-#   /function dl_load:safe_load/no
-
-# Guard: gate must be open or pending
-execute unless score #pending dl.load matches 1 run return 0
-
-# Log via tellraw — no marker entity needed.
-tellraw @a ["",{"text":"[DL SAFE GATE] ","color":"#555555"},{"text":"safe_load/no — load CANCELLED by operator.","color":"red"}]
-tellraw @a ["",{"text":"[DL SAFE GATE] ","color":"#555555"},{"text":"Storage has NOT been modified.","color":"gray"}]
-execute if entity @s[type=minecraft:player] run tellraw @a ["",{"text":"[DL SAFE GATE] ","color":"#555555"},{"text":"Cancelled by a player.","color":"gray"}]
-execute unless entity @s[type=minecraft:player] run tellraw @a ["",{"text":"[DL SAFE GATE] ","color":"#555555"},{"text":"Cancelled by server/console.","color":"gray"}]
-
-# Notify player if applicable
-execute if entity @s[type=minecraft:player] run tellraw @s ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"safe_load cancelled. Storage untouched.","color":"yellow"}]
-
-# Delegate to regular load/no
-function dl_load:load/no
diff --git a/datapacks/dataLib/data/dl_load/function/safe_load/yes.mcfunction b/datapacks/dataLib/data/dl_load/function/safe_load/yes.mcfunction
deleted file mode 100644
index 8b155f10..00000000
--- a/datapacks/dataLib/data/dl_load/function/safe_load/yes.mcfunction
+++ /dev/null
@@ -1,57 +0,0 @@
-# dl_load:safe_load/yes
-# Enhanced load confirmation gate with additional security precautions.
-# Use INSTEAD OF dl_load:load/yes when operating in a security-critical context.
-#
-# PRECAUTIONS (over load/yes):
-#   1. Gate must be open (#pending == 1)
-#   2. Player caller: must have datalib.admin tag
-#   3. Player caller: must have dl.perm_level >= 4 (super-admin)
-#   4. Verifies engine is NOT already loaded
-#   5. Logs all checks to server output via tellraw
-#
-# Non-player callers (server console / other datapacks) are trusted and bypass
-# the player checks — they are already op-gated by the server.
-#
-# USAGE:
-#   /function dl_load:safe_load/yes
-
-# Guard: gate must be open
-execute unless score #pending dl.load matches 1 run return 0
-
-# Guard: already confirmed
-execute if score #confirmed dl.load matches 1 run return 0
-
-# Non-player callers: trusted — delegate directly
-execute unless entity @s[type=minecraft:player] run tellraw @a ["",{"text":"[DL SAFE GATE] ","color":"#555555"},{"text":"Confirmed by server/console","color":"green"},{"text":" — delegating to load/yes.","color":"gray"}]
-execute unless entity @s[type=minecraft:player] run function dl_load:load/yes
-execute unless entity @s[type=minecraft:player] run return 0
-
-# Player checks: datalib.admin tag required
-execute unless entity @s[tag=datalib.admin] run tellraw @s ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"✘ safe_load/yes denied — datalib.admin tag required.","color":"red"}]
-execute unless entity @s[tag=datalib.admin] run return 0
-
-# Player checks: perm_level >= 4 required
-execute unless score @s dl.perm_level matches 4.. run tellraw @s ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"✘ safe_load/yes denied — dl.perm_level >= 4 required.","color":"red"}]
-execute unless score @s dl.perm_level matches 4.. run return 0
-
-# Guard: engine must NOT be already loaded
-execute if data storage datalib:engine global{loaded:1b} run tellraw @s ["",{"text":"[DL] ","color":"#00AAAA","bold":true},{"text":"✘ safe_load/yes denied — engine is already loaded.","color":"red"}]
-execute if data storage datalib:engine global{loaded:1b} run return 0
-
-# All checks passed — announce via tellraw
-tellraw @a ["",{"text":"[DL SAFE GATE] ============================================","color":"#555555"}]
-tellraw @a ["",{"text":"[DL SAFE GATE] ","color":"#555555"},{"text":"safe_load/yes — all security checks PASSED.","color":"green"}]
-tellraw @a ["",{"text":"[DL SAFE GATE]   datalib.admin tag: OK","color":"gray"}]
-tellraw @a ["",{"text":"[DL SAFE GATE]   perm_level >= 4: OK","color":"gray"}]
-tellraw @a ["",{"text":"[DL SAFE GATE]   engine not loaded: OK","color":"gray"}]
-tellraw @a ["",{"text":"[DL SAFE GATE]   Delegating to load/yes...","color":"gray"}]
-tellraw @a ["",{"text":"[DL SAFE GATE] ============================================","color":"#555555"}]
-
-# Delegate to regular load/yes
-function dl_load:load/yes
-
-# Enable sandbox mode
-data modify storage datalib:engine sandbox set value 1b
-
-# Leave players unsafe by default (v6.0.2 default is already 0b)
-data modify storage datalib:engine security set value {trust_players:0b,cmd_min_level:3,sandbox_cmd_min_level:4,admin_min_level:2,admin_can_override:0b,sandbox_allowlist:{}}
diff --git a/datapacks/dataLib/data/dl_load/function/timeout.mcfunction b/datapacks/dataLib/data/dl_load/function/timeout.mcfunction
deleted file mode 100644
index 8f0ba530..00000000
--- a/datapacks/dataLib/data/dl_load/function/timeout.mcfunction
+++ /dev/null
@@ -1,15 +0,0 @@
-# dl_load:timeout
-# Fires 5 minutes after dl_load:load/confirm if no admin response.
-#
-# Uses tellraw @a — no marker entity needed, unlike the old 'say'
-# pattern (say has no @a[tag=...] filter, which was the original
-# reason for the marker-entity workaround).
-#
-# Delegates to dl_load:load/no which is idempotent — if the admin
-# already ran /yes or /no, the #pending guard in load/no returns 0
-# and nothing happens.
-
-tellraw @a ["",{"text":"[DL GATE] ","color":"#555555"},{"text":"Timeout","color":"red","bold":true},{"text":" — no admin response in 5 minutes. Auto-cancelling.","color":"gray"}]
-
-# Delegate to load/no (idempotent — no-op if gate already closed)
-execute if score #pending dl.load matches 1 run function dl_load:load/no
diff --git a/datapacks/dataLib/data/stringlib/function/util/concat.mcfunction b/datapacks/dataLib/data/stringlib/function/util/concat.mcfunction
index 2960dafc..0db6d149 100644
--- a/datapacks/dataLib/data/stringlib/function/util/concat.mcfunction
+++ b/datapacks/dataLib/data/stringlib/function/util/concat.mcfunction
@@ -22,4 +22,3 @@ data modify storage stringlib:temp data.S1 set from storage stringlib:input conc
 data modify storage stringlib:temp data.S2 set from storage stringlib:input concat[0]
 function stringlib:zprivate/concat/combine_small with storage stringlib:temp data
 data remove storage stringlib:temp data
-return 1
\ No newline at end of file
diff --git a/datapacks/dataLib/data/stringlib/function/zprivate/concat/main.mcfunction b/datapacks/dataLib/data/stringlib/function/zprivate/concat/main.mcfunction
index 2b269e82..52d998a8 100644
--- a/datapacks/dataLib/data/stringlib/function/zprivate/concat/main.mcfunction
+++ b/datapacks/dataLib/data/stringlib/function/zprivate/concat/main.mcfunction
@@ -18,4 +18,3 @@ data modify storage stringlib:output concat set from storage stringlib:temp data
 
 # Reset
 data remove storage stringlib:temp data
-return 1