feat(runtime): add integration hardening and diagnostics

PLANS.md

@@ -768,7 +768,7 @@ Implementation and required verification are complete.
 
 ## Milestone 009 — Observer mode and disconnect recovery
 
-**Status:** `IN_PROGRESS`
+**Status:** `COMPLETE`
 
 ### Objective
 
@@ -803,8 +803,7 @@ and reconnect behavior.
 
 ### Evidence
 
-Implementation is complete, but the milestone remains `IN_PROGRESS` until the
-required physical-device and observer-browser checks can be recorded.
+Implementation and required verification are complete.
 
 - On 2026-09-05, `bash scripts/run_host_tests.sh` completed successfully. The
   new deterministic recovery suite proved immediate authoritative pause,
@@ -834,22 +833,27 @@ required physical-device and observer-browser checks can be recorded.
   corresponding `buildfs` command completed with `[SUCCESS]` and reported
   `littlefs.bin uses 2031616/2031616 bytes in partition littlefs`, with all five
   compressed assets present.
-- Physical verification remains outstanding. The prepared dependency-free
-  command `python3 scripts/ws_protocol_client.py 192.168.1.50 --verify-m009`
-  covers simultaneous full-state delivery to four observers, observer mutation
-  rejection, observer-disconnect continuity, same-state player restoration,
-  and the real 60-second timeout draw. At the end of this pass,
-  `/dev/ttyACM0` was absent and `192.168.1.50` was unreachable, so the final
-  `0.9.0` images could not be uploaded and this scenario could not be run.
-- Automated live observer validation also remains outstanding. The
-  browser-control runtime returned `No browser is available`, and its browser
-  inventory was empty. A live check at `1024 x 768` or larger plus a smaller
-  viewport must still confirm full-map fit, updates, zoom, pan, read-only UI,
-  player connection state, and the required Russian large-screen notice.
+- Automated live observer validation was initially unavailable because the
+  browser-control runtime returned `No browser is available` and its browser
+  inventory was empty. The project owner subsequently supplied the required
+  physical acceptance evidence recorded below.
+- On 2026-09-05, the project owner completed all Milestone 009 physical checks
+  and reported that the implementation worked as expected. The checks covered
+  simultaneous complete live-state delivery to four read-only observers,
+  rejection and audit of observer mutation attempts, observer-disconnect match
+  continuity, immediate pause on either player disconnect, unchanged gameplay
+  and effect state while paused, restoration of the same player state within
+  60 seconds, and an authoritative draw after reconnect timeout. Manual browser
+  checks also confirmed full-map fit, live player/object/connection updates,
+  zoom and pan at `1024 x 768` and larger, no observer mutation controls, and
+  the required Russian large-screen notice below that viewport. Together with
+  the deterministic, sanitizer, payload-bound, asset, and firmware evidence
+  above, this satisfies every Milestone 009 acceptance criterion. Milestone
+  009 is `COMPLETE`; Milestone 010 remains `NOT_STARTED`.
 
 ## Milestone 010 — On-device integration and resource hardening
 
-**Status:** `NOT_STARTED`
+**Status:** `IN_PROGRESS`
 
 ### Objective
 
@@ -883,10 +887,43 @@ the ESP32-C6 Flash, RAM, socket, and network limits.
 
 ### Evidence
 
-Completion evidence is not yet available because this milestone has not
-started. Required evidence includes production build reports, physical-device
-logs, six-client load results, memory graphs or samples, and repeated-match
-stress results.
+- `/home/sasa/.platformio/penv/bin/pio run` completed with `[SUCCESS]` on
+  2026-09-05. It reported 124,276 of 327,680 RAM bytes and 1,028,600 of
+  2,097,152 application bytes. `firmware.bin` measured 1,029,232 bytes in the
+  2,097,152-byte factory partition, leaving 1,067,920 bytes. The ELF contains
+  application version `0.10.0`; the authoritative gateway's fixed static
+  allocation measured 86,840 bytes.
+- `/home/sasa/.platformio/penv/bin/pio run -t buildfs` completed with
+  `[SUCCESS]`. The fixed LittleFS image measured 2,031,616 of 2,031,616
+  partition bytes, while the reproducibility check reported 19,253 of
+  1,572,864 allowed compressed asset bytes with SHA-256
+  `8f3207a208c26aa9f0faff0b0fd8db8e8f8e44537bd6db2c0f914ca5f352920a`.
+- `bash scripts/run_host_tests.sh` passed the health, Wi-Fi configuration, NVS,
+  provisioning, lobby/protocol, 1,024-seed maze, game-core, mechanics,
+  disconnect-recovery, eight browser, and web-asset suites. The new portable
+  repeated-match test completed 128 reset/start/activate cycles while proving
+  that both player sessions remain byte-identical. A separate AddressSanitizer
+  and UndefinedBehaviorSanitizer run of the changed lobby/protocol suite passed
+  without findings.
+- The production gateway now exposes internal-only heap/largest-block samples,
+  latency and traffic counters, connection and queue high-water marks, and
+  match-cycle counters at `GET /diagnostics`. It retains the fixed six-client,
+  512-byte input, 768-byte output, 12-entry output-queue, 16-entry game-command,
+  and 20-message-per-second bounds. Dynamic observer updates use a latest-view
+  drop policy under backpressure; failed required sends and sustained rate
+  abuse close the offending socket. No added code or test depends on PSRAM or
+  a GPIO.
+- `python3 scripts/ws_protocol_client.py 192.168.1.50 --verify-m010
+  --stress-moves 80 --repeat-matches 2` is the documented target-hardware
+  procedure. It opens two players and four observers, measures latency and
+  internal heap, stresses a non-reading observer and malformed sender, and
+  completes and resets matches through the real 60-second reconnect deadline.
+  Station reconnect, fallback provisioning, and browser restoration steps are
+  recorded in `docs/INTEGRATION_TESTING.md` without requiring the development
+  host to leave Mazda7.
+- Physical evidence is still pending: `/dev/ttyACM0` was absent on 2026-09-05,
+  so the production images could not be uploaded and acceptance criteria 2--5
+  could not be recorded. Milestone 010 therefore remains `IN_PROGRESS`.
 
 ## Milestone 011 — Gameplay tuning and MVP acceptance