docs(integration): verify Godot and Linux SpaceGame pilot (#21)

docs/integration/spacegame-pilot.md

@@ -2,20 +2,20 @@
 
 Tracking: Rendezvous #21 and SpaceGame #3.
 
-The first SpaceGame checkpoint proves that the v1 client boundary can establish
+The current SpaceGame checkpoint proves that the v1 client boundary establishes
 authenticated direct LiteNetLib traffic without taking ownership of the game's
-protocol, admission, player identity, entity identity, capacity, or gameplay
-payloads. It does not yet pass the complete consumer-pilot gate. The public
-package restore, actual Godot-process integration, connected fallback transport,
-remote Linux dedicated run, representative external NAT run, and reconnect path
-remain required before #21 can close.
+protocol, admission, player identity, entity identity, capacity, lifecycle, or
+gameplay payloads. Real Godot processes, reconnect, an explicit dedicated
+fallback, and a fresh Linux export now pass. The public package restore and a
+representative external NAT/CGNAT canary remain required before #21 can close.
 
 ## Pinned checkpoint
 
 | Input | Value |
 | --- | --- |
-| Rendezvous source | `7fb85059fb7003ca0984ebd0cc9541218d33ae93` plus the #21 compatibility changes |
-| SpaceGame source | `86424ebde69a7eeae110106ab5f84c68f04af89b` |
+| Rendezvous compatibility source | `ebb5eb617c0bbb170418afab396b68584b7f992e` plus the current #21 configuration/evidence changes |
+| Rendezvous package source | `07004cd75fe172aa5dfdb3edda22fc280a4c4477` |
+| SpaceGame source | `f3f5bc29810c362656cd7143bec1ddc2cfaf9f22` |
 | Client package | `FinalFactory.Rendezvous.Client` `1.0.0` |
 | Contracts package | `FinalFactory.Rendezvous.Contracts` `1.0.0` |
 | LiteNetLib | `2.1.4` |
@@ -45,19 +45,28 @@ out-of-sequence, and over-rate traffic. It assigns a canonical game entity ID
 only after admission. The player ID, entity ID, listing ID, join-attempt ID, and
 LiteNetLib peer ID remain distinct values.
 
-The bounded two-process harness observed:
+The bounded real-process harnesses observed:
 
 - host publication and lease maintenance;
 - browser compatibility filtering and join authorization;
 - typed traversal outcome `Connected`;
 - successful audience-bound game admission;
-- one reliable ordered input and one sequenced state snapshot on the direct
-  gameplay socket;
-- zero SpaceGame gameplay payloads handled by Rendezvous; and
-- successful host deregistration.
+- reliable ordered frame-definition and spawn lifecycle records, reliable
+  ordered input, and sequenced state snapshots on the caller-owned gameplay
+  socket;
+- disconnect and a new authenticated session for the same durable player while
+  LiteNetLib peers and canonical entity IDs change;
+- immediate host lease renewal and successful host deregistration;
+- a fresh optimized Linux export running the host and client in distinct
+  hardened container namespaces; and
+- a forced punch timeout that connects the isolated client to an explicitly
+  advertised, non-loopback Docker-gateway fallback and repeats game admission.
 
-Both Debug and Release builds passed. Both Debug and Release test runs passed 29
-tests with zero failures. The focused formatter, shell checker, clean
+Rendezvous exposes no gameplay relay API; all lifecycle, command, and snapshot
+bytes are sent by SpaceGame through its caller-owned `NetManager`. Both Debug
+and Release builds passed. Both Debug and Release test runs passed 31 tests with
+zero failures. ExportRelease is optimized with debug symbols removed. The
+focused formatter, shell checker, fresh-export provenance gate, clean
 candidate-package restore, and adversarial branch review also passed.
 
 ## Failure evidence
@@ -67,11 +76,11 @@ candidate-package restore, and adversarial branch review also passed.
 | Incompatible protocol | protocol `999` returns no compatible listing and starts no traversal | Proven |
 | Stale/no host presence | typed `NoHostPresence/RendezvousService/HostPresence/Mediation` | Proven |
 | Traversal timeout | non-listening mediator produces typed `PunchTimedOut/LocalTraversal/NatTraversal/NatTraversal` | Proven |
-| Rejected game admission | invalid signature and wrong audience deny gameplay; expiry and replay are regression-tested | Proven at protocol/unit boundary |
+| Rejected game admission | invalid signature denies gameplay in the process matrix; wrong audience, expiry, and replay are regression-tested | Proven |
 | Capacity and duplicate player | game-owned roster rejects both and publishes current capacity | Regression-tested |
-| Configured fallback | policy excludes authorization, compatibility, and capacity failures | Policy only; transport path open |
-| Disconnect | direct session ends and host deregisters | Proven for checkpoint shutdown |
-| Reconnect | a second authenticated session after disconnect | Open |
+| Configured fallback | typed `PunchTimedOut`, explicit non-loopback endpoint, same game admission, direct gameplay | Proven locally and across Linux namespaces |
+| Disconnect | host observes zero active players and final admitted count zero | Proven |
+| Reconnect | same durable player enters a second authenticated session with new peer/entity IDs | Proven |
 
 ## Rendezvous-side compatibility fixes
 
@@ -80,6 +89,8 @@ repository:
 
 - the local production-shaped smoke tenant accepts SpaceGame gameplay protocol
   `2` and the bounded `mode` metadata key;
+- the Compose smoke tenant explicitly allows its private-network service name
+  and enables only the dedicated-endpoint fallback policy;
 - SDK guidance requires games using multiple LiteNetLib QoS channels to set
   `ChannelsCount` before `Start` and states that Rendezvous reserves no gameplay
   channel; and
@@ -90,18 +101,12 @@ Documentation contract tests cover these generic requirements.
 
 ## Remaining acceptance gates
 
-Do not mark #21 passed until all of these have direct evidence:
+Do not mark #21 passed until both remaining external gates have direct evidence:
 
-1. restore the exact immutable `1.0.0` packages from the public Gitea feed;
-2. drive the host and client through actual Godot game processes, not only the
-   console pilot;
-3. implement and exercise the configured dedicated fallback connection with the
-   same game admission and identity rules;
-4. prove disconnect followed by a fresh authenticated reconnect;
-5. run a remote client against a Linux dedicated host and capture normal
-   termination/drain behavior;
-6. run representative external NAT canaries and record the network topology and
-   typed outcome; and
-7. clear the current SpaceGame Linux runtime blocker: its pre-existing ImGui
-   GDExtension native library is absent. A headless process exit code of zero
-   while that load error is present is not runtime proof.
+1. restore the exact immutable `1.0.0` packages from the public Gitea feed; and
+2. run representative external NAT/CGNAT canaries and record the network
+   topology and typed outcome.
+
+SpaceGame #3 remains open independently for the production ENet replacement,
+64/128-player profiles, and SIGTERM/drain/save evidence. The consumer pilot
+does not claim those broader game-migration gates.