fix(m13): Phase 0 hardening — relay crash vectors, smoke orphan, lying tooling

[ksdisch]

Executes Phase 0 of docs/AUDIT-2026-07-09.md (§"Phase 0 — Stop the bleeding"): every finding it names, nothing beyond.

Findings closed

Finding	Fix
F-01 (P0)	A 4-byte null frame no longer kills the relay: frame parsing moved into pure parseClientMsg() (server/relay.ts), which rejects anything that isn't an object with a string type. 6 new Vitest cases incl. the killer frame (TDD: red confirmed first).
F-02 (P0)	'error' listeners on connection sockets, wss, and httpServer — bad frames / TCP resets log instead of crashing. Bind failures still exit nonzero so the platform restarts.
F-20	maxPayload: 4096 (ws default is 100 MiB on a 256 MB VM; legit messages < 200 B).
F-38a	Room-code exhaustion replies server busy instead of throwing inside the message listener.
F-11	smoke:relay no longer orphans the relay or hangs piped callers: detached spawn + process-group SIGTERM on every exit path (incl. fail()'s process.exit via an 'exit' hook), /healthz polling replaces the racy 1200 ms sleep, and a preflight fails loudly if an orphan already holds 3099.
F-10	npm audit 7 advisories (2 critical, 3 high) → 0. ws 8.20.0 → 8.21.0 et al; one in-range npm update tsx (4.21 → 4.23) moved its pinned nested esbuild past GHSA-g7r4-m6w7-qqqr. Lockfile-only.
F-09	protocol-boundary-guard.sh no longer emits "permissionDecision":"allow" — it only injects the reminder context; the permission prompt is back. Verified output is valid JSON.
F-12	.mcp.json playwright MCP pinned to --browser chromium so /verify-planet works in cloud containers (only local Chrome worked before).
F-58	Inline data-URI favicons (🚀 game, ✨ phone) silence the 404 console noise.

The smoke also gained two hostile-frame wire probes: a raw null frame earns an error reply with the relay alive, and an over-limit frame closes its sender with 1009 while the existing room keeps casting — end-to-end proof of F-01/F-02/F-20 against the real server.

Gate (all verified this session)

• npm run typecheck clean
• npx vitest run — 162/162 (156 + 6 new parseClientMsg cases)
• npm run build green (on bumped vite/esbuild)
• npm run smoke:relay | tee /dev/null terminates green — the exact invocation that used to hang forever — and lsof confirms no listener left on 3099
• git status clean (lockfile committed)

Notes

• The audit's "re-run the two-client co-op script" gate line: that run was ad-hoc MCP driving (no committed script). Phase 0 touches no client code, and the ws bump is fully exercised by the smoke (ws client + server over a live socket); build covers the vite/esbuild bumps. Deliberately not re-driven.
• Deliberately not pulled forward: the particle one-liner (Phase 2), test-file typechecking (Phase 4) — per the audit's phasing.
• No collision with open PRs feat(m12): generator spike — grow a playable planet from the pair's rhythm #23/feat(m12): theme grown planets from a pre-baked palette library #24 (they touch Hub.ts/testBridge.ts/planets/).

🤖 Generated with Claude Code