src/client/HostLobbyModal.ts (1)

638-666: ⚠️ Potential issue | 🟡 Minor

Set lobbyCreatorClientID after joining.

It now stays empty, so lobby-player-view cannot show the host or “you”. Consider setting it from the first client returned in pollPlayers (same as JoinLobbyModal) or from lobby_info.

✅ Suggested fix (pollPlayers)

-      .then((data: GameInfo) => {
-        this.clients = data.clients ?? [];
-      });
+      .then((data: GameInfo) => {
+        this.clients = data.clients ?? [];
+        if (!this.lobbyCreatorClientID && this.clients.length > 0) {
+          this.lobbyCreatorClientID = this.clients[0].clientID;
+        }
+      });

src/server/Worker.ts (1)

1-1: ⚠️ Potential issue | 🟡 Minor

Fix Prettier formatting before merge.

The CI pipeline reports formatting issues in this file. Run npx prettier --write src/server/Worker.ts to fix.

src/server/GameServer.ts (1)

193-211: ⚠️ Potential issue | 🟡 Minor

Rejected clients in joinClient leave unclosed sockets in the websockets Set.

At line 194, client.ws is added to this.websockets before any validation. When the client is rejected (full lobby at line 200, IP limit at line 225), the socket is never closed. While the websockets Set cleanup-in-end() pattern is intentional, rejected clients should still have their socket closed so they know to stop waiting.

The full-lobby path (line 204) sends an error message but doesn't close the socket. The IP-limit path (line 225) doesn't even send a message.

Close sockets for rejected clients

      client.ws.send(
        JSON.stringify({
          type: "error",
          error: "full-lobby",
        } satisfies ServerErrorMessage),
      );
+     client.ws.close(1000, "full-lobby");
      return;
    }

      this.log.warn("cannot add client, already have 3 ips", {
        clientID: client.clientID,
        clientIP: ipAnonymize(client.ip),
      });
+     client.ws.close(1008, "too many connections from same IP");
      return;

src/server/GameServer.ts (2)

217-228: ⚠️ Potential issue | 🟡 Minor

IP-limit rejection silently drops the connection with no error and no socket close.

When the 3-IP limit is hit, the method returns without sending an error message or closing the WebSocket. The socket was already added to this.websockets at line 192, so it will linger until end(). The client has no idea what happened.

Consider sending an error message and closing the socket, similar to the full-lobby path.

Proposed fix

       this.log.warn("cannot add client, already have 3 ips", {
         clientID: client.clientID,
         clientIP: ipAnonymize(client.ip),
       });
+      client.ws.send(
+        JSON.stringify({
+          type: "error",
+          error: "too-many-connections",
+        } satisfies ServerErrorMessage),
+      );
+      client.ws.close(1008, "too many connections from same IP");
       return;

---

194-209: ⚠️ Potential issue | 🟡 Minor

Full-lobby rejection sends error but does not close the socket.

Same pattern as the IP-limit path: after sending the "full-lobby" error on line 202, client.ws stays open and lingers in this.websockets until end(). The client must handle the error and close on its own. Consider closing the socket server-side for a clean lifecycle.

Proposed fix

       client.ws.send(
         JSON.stringify({
           type: "error",
           error: "full-lobby",
         } satisfies ServerErrorMessage),
       );
+      client.ws.close(1000, "full-lobby");
       return;

src/server/GameServer.ts (1)

175-217: ⚠️ Potential issue | 🟠 Major

State is mutated before rejection checks — stale mapping on reject.

Lines 180-181 add the WebSocket to this.websockets and set the persistentIdToClientId mapping before the full-lobby check (line 183) and the IP-limit check (line 206). When either check returns "rejected":

1. persistentIdToClientId maps to a clientID that never enters allClients. A subsequent rejoinClient call will find the stale clientID, look it up in allClients, get undefined, and fail — so the player can't silently reconnect until they do a fresh join (which overwrites the mapping). Not catastrophic, but confusing.
2. The WebSocket sits in this.websockets until end(), taking up memory for the entire game lifetime.

Also, the IP-limit rejection (line 216) sends no error message to the client, unlike the full-lobby path. The client has no idea why the connection went silent.

Proposed fix — move state mutation after all rejection checks

  public joinClient(client: Client): "joined" | "kicked" | "rejected" {
    if (this.kickedPersistentIds.has(client.persistentID)) {
      return "kicked";
    }

-   this.websockets.add(client.ws);
-   this.persistentIdToClientId.set(client.persistentID, client.clientID);
-
    if (
      this.gameConfig.maxPlayers &&
      this.activeClients.length >= this.gameConfig.maxPlayers
    ) {
      this.log.warn(`cannot add client, game full`, {
        clientID: client.clientID,
      });

      client.ws.send(
        JSON.stringify({
          type: "error",
          error: "full-lobby",
        } satisfies ServerErrorMessage),
      );
      return "rejected";
    }

    this.log.info("client joining game", {
      clientID: client.clientID,
      persistentID: client.persistentID,
      clientIP: ipAnonymize(client.ip),
    });

    if (
      this.gameConfig.gameType === GameType.Public &&
      this.activeClients.filter(
        (c) => c.ip === client.ip && c.clientID !== client.clientID,
      ).length >= 3
    ) {
      this.log.warn("cannot add client, already have 3 ips", {
        clientID: client.clientID,
        clientIP: ipAnonymize(client.ip),
      });
+     client.ws.send(
+       JSON.stringify({
+         type: "error",
+         error: "ip-limit",
+       } satisfies ServerErrorMessage),
+     );
      return "rejected";
    }

+   this.websockets.add(client.ws);
+   this.persistentIdToClientId.set(client.persistentID, client.clientID);
+
    if (this.config.env() === GameEnv.Prod) {