[ovasylenko]

Summary

• add a deterministic, nonce-bound direct-UDP match probe with a standalone two-node CLI
• wire authenticated endpoint and completion evidence through the room-scoped WebSocket control plane
• integrate socket reservation, run/cancel/retry state, and redacted report export into the Tauri/React client
• add protocol bindings, two-process UDP coverage, authenticated server integration coverage, and desktop tests
• upgrade SQLx to 0.8.6 for the Rust 1.78 baseline and make the production Docker build fail closed instead of accepting a stale stub artifact
• document the real two-Windows-machine LAN acceptance loop without claiming FBNeo netplay, STUN, or relay support

Why

This completes the automated Proof-of-Match vertical slice. Two authenticated peers can exchange room-scoped UDP candidates, run the same deterministic 60-frame transcript, compare checksums, and export public-safe evidence. It keeps the latency-sensitive data plane separate from the WebSocket control plane and leaves NAT traversal and real-emulator netplay behind explicit evidence gates.

Validation

• Rust 1.78 workspace formatting, Clippy with warnings denied, and all 78 workspace tests
• PostgreSQL-backed authenticated API/WebSocket lifecycle integration
• real two-process localhost UDP probe with matching 60-frame transcripts
• 7 Tauri command tests
• 26 TypeScript/Vitest tests, formatting, typecheck, and production client build
• production Docker image build, non-root execution, /health, /ready, registration smoke, and clean runtime logs

Boundaries

• no ROMs or emulator binaries are included
• FBNeo continues to report netplay: false
• UDP hole punching, STUN classification, relay fallback, signing, and public release remain deferred
• the next evidence gate is ten attempts across two physical Windows machines using docs/alpha/LAN_TEST.md

Commit and upstream adaptation

• OpenFight feature commit: 4fe332d
• OpenFight CI-race fix/head: 2e5eb44
• OpenCade-compatible upstream PR: fix(networking): tolerate UDP probe startup races Zendevve/OpenCade#3

This PR intentionally stays based on ovasylenko/OpenFight:main. The parent repository has subsequently renamed the project to OpenCade, so its PR uses a separate adapted branch instead of mixing that rename into this fork review.

[ovasylenko]

Superseded by the merged upstream OpenCade PR #3 and the subsequent fast-forward of fork main to upstream commit 1441747. Closing this now-conflicting duplicate; the LAN runner and startup-race fix are present on main.