Extend the end-to-end harness (issue #15), harness-only — no server change:
Combat validation
- replayed/out-of-order combat sequence rejected and not routed
- combat hit at a disconnected target rejected
- out-of-interest combat hit rejected and not delivered
NPC authority handoff
- disconnect deterministically hands off to a new owner with a newer epoch
- cell transition hands off scope authority and the previous owner can no longer
submit npcState for the reassigned scope
21/21 pass on real sockets, deterministic across repeated runs.
Add a small injected ServerTuning seam (production defaults unchanged; ServerRuntime
still constructs the server without it) so end-to-end cases can use short timeouts
and a wider local connect budget.
New real-transport acceptance cases:
- impossible movement rejected, position-corrected, and not relayed
- self-targeted combat hit rejected and not routed
- independent populated scopes receive independent NPC authorities
- a stale/wrong NPC authority epoch is rejected over transport
- idle timeout closes a stale active session
- multi-client no-cross-cell-spam scaled to 16 clients (widened local connect budget)
16/16 pass on real sockets, deterministic across repeated runs.
Stand up the real AuthoritativeServer behind the real TCP transport on a
loopback port and drive real SyntheticProtocolClient sockets through it, so the
matrix is exercised over an actual connection rather than in-memory fakes.
Covers the baseline-protocol, TCP-compatibility, and interest-management
sections: welcome->hello->sessionReady handshake, unique/non-spoofable
server-owned ids, malformed and oversized rejection before mutation, rate-limit
tripping, transform/playerState/worldState relay, action events not
replay-cached to late joiners, disconnect/reconnect leaving no stale session,
same-cell relay vs distant interest filtering, multi-client no cross-cell spam,
and handshake-timeout reaping.
The harness runs for real wherever loopback TCP can bind (dev machines, the
self-hosted runner) and skips cleanly otherwise. Wired into a self-hosted CI
job gated by the runtime-policy guard. 60s idle-timeout, 32/64-client load /
packet-loss / reconnect-churn, and GNS sections remain follow-ups.
