Pass security, load, soak, and fault-injection gates

[zoeyrose]

Outcome

Establish measured production budgets and show that hostile inputs, sustained load, and infrastructure failures fail safely.

Scope and invariants

• Threat-model QUIC/authentication, Protobuf/content/CEL/Starlark parsing, operator surfaces, resource delivery, persistence/import, privacy, and denial-of-service boundaries.
• Run race tests, fuzz campaigns, connection/auth abuse, slow-client/backpressure, dense maps/combat, AI/event storms, large inventories/content, and high reconnect churn.
• Soak representative worlds for leaks, queue growth, timer/event drift, SQLite WAL/checkpoint behavior, and telemetry cardinality.
• Inject disk full/I/O/corruption, failed migration, content corruption, network loss/reorder, dependency cancellation, device/client disappearance, panic, and unclean restart.
• Define pass/fail thresholds for tick latency, memory, goroutines, queues, bandwidth, storage, recovery time, and data loss.

Acceptance criteria

• Budgets and results are versioned artifacts, not informal observations.
• No test causes partial committed gameplay state, secret disclosure, unbounded label/cardinality growth, deadlock, or unrecoverable database mutation.
• Every discovered limit has enforcement plus an actionable client/operator error.
• At least one extended soak and one disaster-recovery game day pass on production-like topology.
• Open exceptions have owners, expiry, risk acceptance, and block cutover where thresholds are violated.

Dependencies and parallelization

Can build continuously from M2, but final gate requires the whole M5 content/behavior load and production packaging #63.

Licensing and migration rule

Replacement Go code is MIT and independently implemented. Preserve existing gameplay/content design choices and separately licensed data; do not translate GPL runtime source or tests unless an exact contribution has a documented rights-holder MIT grant.