# Development

## Server

The dedicated server is a C#/.NET project at `server/CommonwealthOnline.Server.csproj`.

Core files:

- `AuthoritativeServer.cs`: sessions, authoritative gameplay state, security, interest filtering
- `ProtocolCore.cs`: JSON codec, transport policy, snapshot sequencing/envelope
- `ProtocolValidation.cs`: Protocol V2 packet validation
- `Domain.cs`: sessions, bans, NPC authority, world presets
- `TcpTransport.cs`: newline-framed TCP compatibility transport
- `GnsTransport.cs`: C# wrapper over the native GameNetworkingSockets bridge
- `AdminDiscovery.cs`: authenticated localhost admin channel and LAN discovery
- `Program.cs`: CLI, interactive server, management commands and synthetic load command

Build and test:

```bash
cd server
dotnet build CommonwealthOnline.Server.csproj -c Release
dotnet run --project tests/CommonwealthOnline.Server.Tests.csproj -c Release
```

The test harness uses in-memory connections for authoritative behavior and contains no external test-framework package dependency.

## Native GNS bridge

`server/native_transport` remains C++. Keep it transport-only. Do not move validation, identity, interest filtering, NPC authority, combat, world state or caching into the bridge.

The C ABI is the boundary consumed from `GnsTransport.cs`.

## Qt Host

The Qt host remains C++. `ServerProcess` launches the published C# server and communicates through the authenticated localhost admin channel. It must not invoke a scripting runtime.

CMake publishes a self-contained server as part of the Host GUI post-build step.

## Protocol changes

Protocol behavior is intentionally independent from transport. If adding a packet type:

1. Define validation and normalization in C#.
2. Decide its delivery policy in `TransportPolicy`.
3. Default new control/state traffic to reliable/ordered.
4. Use unreliable/sequenced only for latest-wins snapshot families.
5. Add tests before changing the client.

Never cache/replay discrete action events, accept stale NPC authority epochs, accept stale snapshot sequences, or bypass server-owned identity and interest validation.