[ovasylenko]

Summary

• add a deterministic, nonce-bound direct-UDP match probe with a standalone two-node CLI
• wire authenticated endpoint and completion evidence through the room-scoped WebSocket control plane
• integrate socket reservation, run/cancel/retry state, and redacted report export into the Tauri/React client
• add protocol bindings, two-process UDP coverage, authenticated server integration coverage, and desktop tests
• upgrade SQLx to 0.8.6 for the Rust 1.78 baseline and make the production Docker build fail closed instead of accepting a stale stub artifact
• document the real two-Windows-machine LAN acceptance loop without claiming FBNeo netplay, STUN, or relay support

Why

This completes the automated Proof-of-Match vertical slice. Two authenticated peers can exchange room-scoped UDP candidates, run the same deterministic 60-frame transcript, compare checksums, and export public-safe evidence. It keeps the latency-sensitive data plane separate from the WebSocket control plane and leaves NAT traversal and real-emulator netplay behind explicit evidence gates.

Validation

• Rust 1.78 workspace formatting, Clippy with warnings denied, and all 78 workspace tests
• PostgreSQL-backed authenticated API/WebSocket lifecycle integration
• real two-process localhost UDP probe with matching 60-frame transcripts
• 7 Tauri command tests
• 26 TypeScript/Vitest tests, formatting, typecheck, and production client build
• production Docker image build, non-root execution, /health, /ready, registration smoke, and clean runtime logs

Boundaries

• no ROMs or emulator binaries are included
• FBNeo continues to report netplay: false
• UDP hole punching, STUN classification, relay fallback, signing, and public release remain deferred
• the next evidence gate is ten attempts across two physical Windows machines using docs/alpha/LAN_TEST.md

Commit

4fe332d feat: add two-node LAN match runner

Fork review

The same commit is available for review in ovasylenko/OpenFight#1:
ovasylenko#1

[ovasylenko]

Superseded by #3, which replays the same tested feature onto the latest OpenCade main while preserving the repository-wide rename and resolving the base conflicts.