Production-readiness pass toward 1.0:
- Protocol handshake: JOIN carries kGhostVersion; a mismatched client is
REFUSED by the relay (HELLO session 0) and its poses are never forwarded,
so two builds can never silently corrupt each other's pose stream. The
client surfaces the refusal in the menu and skips refused LAN hosts during
discovery.
- Crash-proofing: every received payload is bounds-checked against its
packet size before parsing (HELLO / PoseChunk / JOIN); both the client
network thread and the relay thread are exception-guarded (a throw logs
and keeps the loop alive instead of hitting std::terminate). The relay no
longer creates client records for unknown-address POSE/LEAVE floods and
enforces a hard client cap (--max-clients, default 64).
- Logging: rate-limited error logging throughout (send failures, resolve
failures, refusals, thread exceptions, client-cap drops). The relay core
uses a build-flag shim (REXLOG in-game, a tiny {} formatter in the
dependency-free standalone), with --verbose join/leave lines for the
server. Game crashes themselves are already handled by the SDK's crash
handlers + file logs; this layer now avoids triggering them and explains
itself when it can't connect.
- Settings persistence: server/room/name/port/rate save into the app's cvar
config on change, so a player's multiplayer setup survives a restart.
- Menu: status now shows protocol refusals and the last error.
Tests updated for the handshake (version-refusal case added); all suites
pass.
7a48eb9f35