feat(runtime): add integration hardening and diagnostics

test/host/test_lobby_protocol.c

@@ -36,8 +36,11 @@ static void test_protocol_schema(void) {
     const char* drop_key = "{\"v\":1,\"type\":\"drop_key\",\"seq\":4,\"payload\":{}}";
     assert(maze32_protocol_parse(drop_key, strlen(drop_key), &message) == MAZE32_PROTOCOL_OK);
     assert(message.type == MAZE32_MESSAGE_DROP_KEY);
+    const char* restart = "{\"v\":1,\"type\":\"restart\",\"seq\":5,\"payload\":{}}";
+    assert(maze32_protocol_parse(restart, strlen(restart), &message) == MAZE32_PROTOCOL_OK);
+    assert(message.type == MAZE32_MESSAGE_RESTART);
     const char* diagonal =
-        "{\"v\":1,\"type\":\"move\",\"seq\":5,\"payload\":{\"direction\":\"northwest\"}}";
+        "{\"v\":1,\"type\":\"move\",\"seq\":6,\"payload\":{\"direction\":\"northwest\"}}";
     assert(maze32_protocol_parse(diagonal, strlen(diagonal), &message) ==
            MAZE32_PROTOCOL_INVALID_PAYLOAD);
 
@@ -109,6 +112,21 @@ static void test_lobby_limits_restoration_and_authority(void) {
     assert(!maze32_lobby_activate_if_due(&lobby, 4999U));
     assert(maze32_lobby_activate_if_due(&lobby, 5000U));
     assert(lobby.phase == MAZE32_LOBBY_ACTIVE);
+    maze32_session_t sessions_before_reset[MAZE32_SESSION_LIMIT];
+    memcpy(sessions_before_reset, lobby.sessions, sizeof(sessions_before_reset));
+    for (uint64_t cycle = 0U; cycle < 128U; ++cycle) {
+        revision = lobby.revision;
+        maze32_lobby_reset_match(&lobby);
+        assert(lobby.phase == MAZE32_LOBBY_WAITING);
+        assert(lobby.countdown_started_ms == 0U && lobby.activation_ms == 0U);
+        assert(lobby.revision == revision + 1U);
+        assert(maze32_lobby_ready(&lobby));
+        assert(memcmp(lobby.sessions, sessions_before_reset, sizeof(sessions_before_reset)) == 0);
+        uint64_t started_ms = 10000U + cycle * 4000U;
+        assert(maze32_lobby_start(&lobby, 10, started_ms) == MAZE32_LOBBY_OK);
+        assert(maze32_lobby_activate_if_due(&lobby, started_ms + MAZE32_COUNTDOWN_DURATION_MS));
+    }
+    puts("lobby repeated-match reset: PASS (128 cycles)");
 }
 
 int main(void) {

test/web/test_player_app.js

@@ -104,3 +104,10 @@ test("observer protocol exposes no mutation control path", () => {
   assert.deepEqual(snapshot.players.map(item => item.cell), [0, 3]);
   assert.equal("self" in snapshot, false);
 });
+
+test("finished matches expose only an owner restart intention", () => {
+  const script = fs.readFileSync(path.join(project, "web/player.js"), "utf8");
+  assert.match(script, /send\("restart", \{\}, byId\("modal-action"\)\)/);
+  assert.match(script, /message\.type === "reset"/);
+  assert.doesNotMatch(script, /restart[^\n]*(position|inventory|result):/);
+});