feat: ship evidence-backed alpha portfolio and optimize protocol

[ovasylenko]

Summary

Ships the evidence-backed OpenCade opportunity portfolio and hardens the community alpha from discovery through deterministic Proof-of-Play. The changes also optimize the shared protocol/server/relay hot path and make tagged releases fail closed on validation.

This PR intentionally combines the product, protocol, evidence, runtime, release, and documentation changes because they form one end-to-end alpha contract: controller-ready peers use a deterministic no-ROM test profile, negotiate an evidence-gated route, produce privacy-safe match evidence, and can continue through an idempotent receipt/invite flow.

What changed

Deterministic Proof-of-Play

• Adds an original no-ROM libretro test fixture and declarative opencade_test game definition.
• Adds a Windows MSVC build script for the test core and builds/signs it in CI/release workflows.
• Extends the RetroArch adapter to detect, fingerprint, validate, and launch both FBNeo and the deterministic test profile without shell execution.
• Adds controller preflight with deterministic player-slot assignment before the launch barrier opens.

Evidence-backed alpha portfolio

• Adds server-side native route policy based on bounded verified evidence.
• Keeps TCP tunnel promotion disabled by default and fail-closed until minimum evidence qualifies.
• Adds privacy-safe match receipts and a fresh continuation invite, with idempotency per room/user.
• Adds k-anonymous public compatibility cohorts and a short-lived aggregate cache.
• Extends evidence/report contracts with native-route fields and stricter verification.
• Adds a static compatibility publication surface under site/compatibility.
• Documents 20 scored opportunities (all score 20+) and the selected portfolio/ADR.

Protocol and relay performance

• Adds allocation-free BorrowedEnvelope parsing using raw JSON payloads.
• Defers typed payload decoding until dispatch and removes generic Value cloning.
• Splits server WebSocket reads/writes so PostgreSQL authorization latency does not block outbound delivery.
• Uses native UUID keys in the WebSocket hub instead of per-message string conversion.
• Collapses room authorization and peer lookup into one database result.
• Relays reference-counted WebSocket text frames without rebuilding the full string.
• Applies the borrowed decode path to the standalone authenticated relay.
• Adds a reproducible release-mode throughput benchmark.

Measured locally on Apple Silicon with:

cargo run -p opencade-protocol --example throughput --release --locked

Result for envelope decode + typed endpoint payload validation:

• Legacy: 1.16M msg/s, 864 ns/msg
• Borrowed path: 2.53M msg/s, 395 ns/msg
• Improvement: 2.19x throughput, approximately 54% less CPU time/message

Operations and release safety

• Adds tagged-commit validation before the Windows release job.
• Validates SemVer tag/package alignment, Rust/TS tests, formatting, builds, and dependency audits.
• Adds release concurrency protection.
• Adds production configuration for evidence-gated route promotion.
• Updates Docker build inputs, runbook, architecture, implementation status, telemetry docs, and alpha instructions.

Database migration

Migration 009_opportunity_portfolio.sql is additive and idempotent:

• Adds controller readiness/player slot fields to match_preflights.
• Adds match_receipts with room/user foreign keys and idempotency constraint.
• Adds partial/indexed access paths for active lifecycle deadlines and evidence route aggregation.
• Seeds the deterministic opencade_test game/version with ON CONFLICT DO NOTHING.

No tables or columns are dropped or renamed. Existing application versions remain compatible with the expanded schema.

Validation

Executed on the final branch after merging current upstream main:

cargo fmt --all -- --check
cargo clippy --workspace --all-targets --locked -- -D warnings
DATABASE_URL=postgres://... cargo test --workspace --all-targets --locked
pnpm format:check
pnpm typecheck
pnpm test
pnpm build

Results:

• 180 Rust tests passed.
• PostgreSQL API/migration integration flow passed.
• Authenticated loopback WebSocket and relay tests passed.
• Two-process deterministic UDP probe passed.
• 69 TypeScript tests passed.
• Clippy passed with warnings denied.
• TypeScript typechecks and production Vite build passed.
• Working tree and diff checks are clean.

Risk and rollout

Deploy risk score: 8/10 (high)

• Large cross-stack diff: +2, high
• More than 10 files: +2, high
• Additive database migration: +1, medium
• Dependency feature/config changes: +1, medium
• Runtime/release integration changes: +1, medium
• Authentication/room authorization paths touched: +1, medium

Recommended rollout:

1. Merge only after Linux and Windows CI are green.
2. Apply migration 009 before deploying the new server image.
3. Keep OPENCADE_EVIDENCE_TCP_TUNNEL=false initially.
4. Smoke-test /health, /ready, auth, room creation, invite/preflight, and the deterministic test profile.
5. Monitor HTTP p95/error classes, WebSocket connection/queue warnings, room lifecycle reconciliation, and evidence cohort generation.
6. Enable the evidence route only after the configured physical-host evidence threshold qualifies.

Rollback

• Disable evidence route promotion immediately with OPENCADE_EVIDENCE_TCP_TUNNEL=false.
• Redeploy the previous server/client/relay artifacts if runtime metrics regress.
• Leave additive migration 009 in place during application rollback; older code does not depend on removing the new columns/table/indexes.
• Remove the schema additions only in a separate reviewed cleanup migration after confirming no receipts/evidence need preservation.

Review focus

• Route-policy qualification and fail-closed defaults.
• Controller/player-slot launch barrier semantics.
• Receipt idempotency and privacy boundaries.
• Room authorization query and WebSocket queue behavior.
• Windows test-core build/signing paths.
• Public compatibility k-anonymity and cache behavior.