fix(m13): Phase 1 — co-op survives real life (disconnects, ghosts, leaks)

[ksdisch]

Phase 1 of the 2026-07-09 audit fix plan — the disconnect/ghost lifecycle arc. Closes F-05, F-06, F-07, F-08, F-16, F-17, F-18, F-21, F-35, F-36 (+ bounds the rooms map, F-26-adjacent). Follows Phase 0 (#26).

What changed

1. Heartbeat sweep (server/server.ts, F-08/F-26): isAlive/pong + periodic terminate(). A ghost phone (locked on cellular, never FINs) is swept, its slot frees, and the documented same-code manual rejoin actually works; ghost games can no longer grow rooms unboundedly. RELAY_HEARTBEAT_MS env override (default 30s) lets the smoke fast-forward.
2. Scene handler lifecycle (F-05/F-06): Lobby + Planet keep the onMessage unsubscribe and release it on SHUTDOWN; both net clients isolate each handler in its own try/catch. Kills the N+1 re-cast / corrupted solveTimings telemetry on replay and the Lobby stale-handler exception that starved Planet of every later message.
3. Phone knows its socket died (F-07): PhoneNetClient.onClose (fires only post-open, never for a deliberate reconnect) + send() returns a boolean. New disconnected phase: "Connection lost" panel with one-tap Rejoin + "Enter a different code". A solve on a dead link routes there instead of faking "Cast!" and minting stardust.
4. Game surfaces relay loss (F-17) + rejoin restores the indicator (F-16): GameNetClient.onClose (also fires on boot-time failure) → Lobby status line "Relay unreachable — reload to retry"; Planet indicator "● connection lost". phone-joined turns the indicator back green.
5. Protocol commit (F-18/F-35/F-36, all sides in one commit per the boundary rule): server-originated {type:'peer-disconnected', peer} replaces the {type:'error'} + includes('phone') substring hack; dead game-ready/availablePowers deleted (zero producers/consumers); decorative role fields dropped (the audit's "validate-or-drop" — roles are implied by the handshake). No relayForward rule — server-originated, never peer-forwarded.
6. Pure RoomRegistry (F-21): room lifecycle extracted from the connection handler (mirroring relayForward), generic over the member handle, 13 colocated Vitest cases (create/join/occupied/not-found/close cleanup/post-sweep rejoin/room-count bound). Sockets stay in server.ts; error strings byte-identical. Bonus fix that fell out: a phone orphaned by its game leaving is released, so the same socket can join a fresh room (previously stuck 'already in a room' forever).

Gate (all green)

• npm run typecheck clean · npm run test 175/175 (162 → +13 registry) · npm run build clean
• Extended smoke:relay: existing 8 steps + graceful-close → peer-disconnected; ghost (autoPong:false) swept by heartbeat (close 1006, game notified, slot freed); same-code rejoin → cast round-trips — the couch-playtest failure mode, over live sockets
• Two-client co-op, live (repo-pinned Playwright MCP against npm run dev, real Chromium × 2 tabs): join KDSJRR → spellbook → QuickMath solve → freeze cast crossed the wire (lastCastPower, freeze cue) → phone tab closed → game shows red "● phone disconnected" (typed path) → same-code rejoin → "● phone linked" restored (F-16) → Trivia solve → illuminate cast landed (darkZonePresent:false) → relay killed under both clients → phone renders "Connection lost / Rejoin CUMSAF" (F-07) and Planet shows "● connection lost"; a fresh Lobby boot against the dead relay shows "Relay unreachable" (F-17 boot path)

Notes for review

• "Client cases" in the audit's Vitest gate are covered by the live two-client drive + smoke rather than unit tests: both net clients are thin wrappers over browser WebSocket, and the repo convention (CLAUDE.md) keeps browser-API/framework classes out of Vitest. Same substitution style Phase 0 used.
• Implementation order within the PR: the protocol commit (audit item 5) landed before the phone/game UI items (3–4) so the typed peer-disconnected handling was written once, not twice. All six items are in.
• PR #23/#24 ordering (audit coordination note): still unanswered. Phase 1's files (server/*, net/client.ts ×2, Lobby.ts, Planet.ts create-block, protocol.ts, App.tsx) barely overlap the m12 generator branches (Hub.ts/testBridge.ts/planets/); whichever lands second should rebase — expected conflicts: none to trivial.
• Deliberately NOT done (audit's own list): no reconnect framework — manual rejoin post-F-07/F-08 is the design; F-15 (solo indicator) is Phase 2; F-28/F-29 (test typecheck, hook arms for server/) are Phase 4.

🤖 Generated with Claude Code