fix(products): allow clients to finish manifest loading

[ifBars]

Summary

• keep the existing 15-second client guard for a manifest that never arrives
• extend the host acknowledgement window to 60 seconds so authenticated clients can finish IL2CPP world loading and pre-load custom-product registration
• add a contract test for the host acknowledgement window

Reproduction

In a clean two-peer IL2CPP test with MoreDrugs as the only content mod, the host sent the custom-product manifest and rejected the joining client at 15 seconds. The matching client finished pre-load registration and accepted the manifest roughly half a second after that deadline, leaving it stuck loading and returned to the menu.

After this change, the host accepted the acknowledgement and both peers reached Main in the same lobby.

Validation

• dotnet test S1API.Tests/S1API.Tests.csproj -c MonoMelon --filter FullyQualifiedName~CustomProductManifest --no-restore (27 passed)
• dotnet test S1API.Tests/S1API.Tests.csproj -c Il2CppMelon --filter FullyQualifiedName~CustomProductManifest --no-restore (27 passed)
• clean IL2CPP two-peer multiplayer smoke: host and client reached Main; host saw two FishNet clients; client had a local player

Summary by CodeRabbit

• Bug Fixes
  • Improved custom product manifest loading to prevent clients from being rejected while a manifest is still being delivered.
  • Added separate timing for client and host acknowledgements, allowing up to 60 seconds for host confirmation.
  • Client sessions now correctly reset manifest status when starting or ending, improving reliability across repeated connections.

[coderabbitai]

Warning

Review limit reached

@ifBars, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 49 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0dc4482c-5459-43c3-8cbd-4541f8f215f2

📥 Commits

Reviewing files that changed from the base of the PR and between 2765a2c and 3402cfe.

📒 Files selected for processing (2)

• S1API.Tests/Products/CustomProductManifestRuntimeContractTests.cs
• S1API/Internal/Products/CustomProductManifestRuntime.cs

📝 Walkthrough

Walkthrough

The manifest runtime now uses separate client and host timeouts. Client sessions track manifest receipt and reject only clients that remain waiting without a manifest after the client deadline.

Changes

Manifest handshake lifecycle

Layer / File(s)	Summary
Separate handshake timeouts S1API/Internal/Products/CustomProductManifestRuntime.cs, S1API.Tests/Products/CustomProductManifestClientGateTests.cs	The runtime uses a 15-second client manifest timeout and a 60-second host acknowledgement timeout.
Track client manifest receipt S1API/Internal/Products/CustomProductManifestRuntime.cs	Client sessions clear manifest state at initialization and termination. Manifest receipt sets the active session state.
Gate missing-manifest rejection S1API/Internal/Products/CustomProductManifestRuntime.cs, S1API.Tests/Products/CustomProductManifestRuntimeContractTests.cs	Timeout handling rejects only waiting clients without a received manifest after the client deadline. Tests cover both received and missing manifests.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the primary change: allowing clients to complete custom-product manifest loading.
Description check	✅ Passed	The description explains the outcome, reproduction, implementation intent, and Mono, IL2CPP, and runtime validation results.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ifBars]

@codex review plz

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a8203f2516

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@S1API/Internal/Products/CustomProductManifestRuntime.cs`:
- Line 50: Reset the static _clientManifestReceived flag when RejectClient
terminates the session, ensuring rejection clears the manifest state immediately
rather than relying on EndClientSession; preserve the existing session-rejection
behavior.
- Around line 399-402: Update
CustomProductManifestClientGate.AuthorizePlayerDataRequest so _clientDeadline is
assigned only when the first deferred request starts the wait, preserving the
existing deadline for subsequent requests while authorization remains false.
Ensure repeated deferred calls cannot extend the 15-second timeout, while
retaining the existing deferred-request logging and authorization behavior.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 865b5ca6-c2cd-42df-ba8d-c5a6b31552d8

📥 Commits

Reviewing files that changed from the base of the PR and between f132d81 and 2765a2c.

📒 Files selected for processing (3)

• S1API.Tests/Products/CustomProductManifestClientGateTests.cs
• S1API.Tests/Products/CustomProductManifestRuntimeContractTests.cs
• S1API/Internal/Products/CustomProductManifestRuntime.cs