docs(integration): record SpaceGame pilot checkpoint (#21)

docs/integration/sdk-seams.md

@@ -70,6 +70,7 @@ thread and do not also call `NetManager.PollEvents()` during that period.
 ```csharp
 RendezvousNetListener networkEvents = new();
 NetManager gameplayNetwork = networkEvents.CreateManager();
+gameplayNetwork.ChannelsCount = 3; // set the game's required count before Start
 if (!gameplayNetwork.Start(gameplayPort))
 {
     throw new InvalidOperationException("Gameplay UDP socket could not start.");
@@ -85,6 +86,10 @@ using RendezvousHostCoordinator host = new(
 host.Poll(); // call each game frame while this coordinator owns polling
 ```
 
+LiteNetLib defaults to one QoS channel. Set `ChannelsCount` before `Start` when
+the game protocol uses additional channels; both peers must configure the same
+count. Rendezvous does not choose, remap, or reserve a gameplay channel.
+
 Register normal game callbacks on `networkEvents.GameplayEvents`. Rendezvous
 reserves only its authenticated direct requests and forwards other callbacks.
 The same socket sends host presence, punches through the mediator, establishes

docs/integration/spacegame-pilot.md

@@ -0,0 +1,107 @@
+# SpaceGame consumer pilot
+
+Tracking: Rendezvous #21 and SpaceGame #3.
+
+The first SpaceGame checkpoint proves that the v1 client boundary can establish
+authenticated direct LiteNetLib traffic without taking ownership of the game's
+protocol, admission, player identity, entity identity, capacity, or gameplay
+payloads. It does not yet pass the complete consumer-pilot gate. The public
+package restore, actual Godot-process integration, connected fallback transport,
+remote Linux dedicated run, representative external NAT run, and reconnect path
+remain required before #21 can close.
+
+## Pinned checkpoint
+
+| Input | Value |
+| --- | --- |
+| Rendezvous source | `7fb85059fb7003ca0984ebd0cc9541218d33ae93` plus the #21 compatibility changes |
+| SpaceGame source | `86424ebde69a7eeae110106ab5f84c68f04af89b` |
+| Client package | `FinalFactory.Rendezvous.Client` `1.0.0` |
+| Contracts package | `FinalFactory.Rendezvous.Contracts` `1.0.0` |
+| LiteNetLib | `2.1.4` |
+| HTTP, UDP, ticket contracts | `1` |
+| SpaceGame gameplay protocol | `2` |
+
+At the checkpoint date, the Final Factory Gitea NuGet service was reachable but
+both `FinalFactory.Rendezvous.*` `1.0.0` registrations returned HTTP 404. The run
+therefore restored locally built candidate packages with the hashes recorded in
+[`spacegame.json`](../evidence/consumers/spacegame.json). This proves candidate
+compatibility, not immutable registry publication. The release package restore
+must be repeated from the public feed.
+
+## Proven local path
+
+The SpaceGame host and client each create one caller-owned `NetManager`, set its
+three gameplay QoS channels before `Start`, and give the same manager and
+`RendezvousNetListener` to the coordinator. Rendezvous authenticates discovery,
+join authorization, host presence, mediation, and connection outcome reporting.
+After traversal, SpaceGame performs a separate audience-bound admission exchange
+on its own reliable command channel. A trusted game-auth boundary mints the
+opaque assertion; the player process never receives the signing key.
+
+The authoritative host rejects expired, replayed, incorrectly signed,
+wrong-listing, duplicate-player, over-capacity, identity-mismatched,
+out-of-sequence, and over-rate traffic. It assigns a canonical game entity ID
+only after admission. The player ID, entity ID, listing ID, join-attempt ID, and
+LiteNetLib peer ID remain distinct values.
+
+The bounded two-process harness observed:
+
+- host publication and lease maintenance;
+- browser compatibility filtering and join authorization;
+- typed traversal outcome `Connected`;
+- successful audience-bound game admission;
+- one reliable ordered input and one sequenced state snapshot on the direct
+  gameplay socket;
+- zero SpaceGame gameplay payloads handled by Rendezvous; and
+- successful host deregistration.
+
+Both Debug and Release builds passed. Both Debug and Release test runs passed 29
+tests with zero failures. The focused formatter, shell checker, clean
+candidate-package restore, and adversarial branch review also passed.
+
+## Failure evidence
+
+| Path | Evidence | Status |
+| --- | --- | --- |
+| Incompatible protocol | protocol `999` returns no compatible listing and starts no traversal | Proven |
+| Stale/no host presence | typed `NoHostPresence/RendezvousService/HostPresence/Mediation` | Proven |
+| Traversal timeout | non-listening mediator produces typed `PunchTimedOut/LocalTraversal/NatTraversal/NatTraversal` | Proven |
+| Rejected game admission | invalid signature and wrong audience deny gameplay; expiry and replay are regression-tested | Proven at protocol/unit boundary |
+| Capacity and duplicate player | game-owned roster rejects both and publishes current capacity | Regression-tested |
+| Configured fallback | policy excludes authorization, compatibility, and capacity failures | Policy only; transport path open |
+| Disconnect | direct session ends and host deregisters | Proven for checkpoint shutdown |
+| Reconnect | a second authenticated session after disconnect | Open |
+
+## Rendezvous-side compatibility fixes
+
+The pilot found generic integration gaps and keeps their fixes in this
+repository:
+
+- the local production-shaped smoke tenant accepts SpaceGame gameplay protocol
+  `2` and the bounded `mode` metadata key;
+- SDK guidance requires games using multiple LiteNetLib QoS channels to set
+  `ChannelsCount` before `Start` and states that Rendezvous reserves no gameplay
+  channel; and
+- the local credential helper rejects any signing-key file with group or other
+  permissions, in addition to its ownership, symlink, and hard-link checks.
+
+Documentation contract tests cover these generic requirements.
+
+## Remaining acceptance gates
+
+Do not mark #21 passed until all of these have direct evidence:
+
+1. restore the exact immutable `1.0.0` packages from the public Gitea feed;
+2. drive the host and client through actual Godot game processes, not only the
+   console pilot;
+3. implement and exercise the configured dedicated fallback connection with the
+   same game admission and identity rules;
+4. prove disconnect followed by a fresh authenticated reconnect;
+5. run a remote client against a Linux dedicated host and capture normal
+   termination/drain behavior;
+6. run representative external NAT canaries and record the network topology and
+   typed outcome; and
+7. clear the current SpaceGame Linux runtime blocker: its pre-existing ImGui
+   GDExtension native library is absent. A headless process exit code of zero
+   while that load error is present is not runtime proof.