netcode 1.4.7: missing override and loopback callbacks are refused at setup; the simulator and address_to_string are hardened

A missing callback is refused where it is configured, instead of being called as a null pointer.

A client or server config with override_send_and_receive set and either send_packet_override or receive_packet_override NULL is refused: netcode_client_create and netcode_server_create (and their _dual forms) log the reason and return NULL. This is a behaviour change, and it is the reason for two new create error codes, NETCODE_CLIENT_CREATE_ERROR_MISSING_OVERRIDE_CALLBACK (7) and NETCODE_SERVER_CREATE_ERROR_MISSING_OVERRIDE_CALLBACK (8), reported by netcode_client_create_error and netcode_server_create_error. The receive override is called on the update path with no null check, so a config missing it was a crash on the first update, and a config missing only the send override dropped sends silently; both are now a configuration error the create can name. Both codes are appended; no existing create error code changes value, and an integration that sets both overrides, or neither, sees no change.

netcode_client_connect_loopback and netcode_server_connect_loopback_client refuse the loopback connection, in release builds as well as debug, when send_loopback_packet_callback is unset, and log the reason. The loopback send path is entered only through those two functions, so it is reached only with a callback to call.

The network simulator allocates a packet before it touches its ring slot. If the allocator fails, the simulator logs, drops that packet, and leaves the entry already queued in the slot intact.

netcode_address_to_string states its buffer contract in the public header. NETCODE_MAX_ADDRESS_STRING_LENGTH sits in netcode.h beside NETCODE_MAX_PACKET_SIZE, and the declaration carries the contract: the buffer must be at least that many bytes, the result is null terminated, and a longer address is truncated to fit rather than overflowing. The signature is unchanged, so ports that mirror it are unaffected, and a caller that includes only netcode.h can size the buffer it is required to pass.

Console platforms need an RNG of their own. On __ORBIS__ and __PROSPERO__ the vendored libsodium's randombytes_sysrandom_buf has an empty body and does not write the buffer, and netcode draws every key and nonce from randombytes_buf. sodium/NOTES.md and IMPLEMENTERS.md now say so, for this library and for the ports that mirror it: a console port supplies a system RNG before it ships.

The wire format does not change and no function signature changes. The four code changes are not reachable from unauthenticated network input; the console RNG note is different in kind, because every connect token key is drawn from that RNG, so a console port without a system RNG has predictable keys, which is why the note is in the shipped docs. Integrations that link the library take this release by relinking; a caller that wants the new header constant recompiles against netcode.h. Integrations that vendor the source re-vendor: yojimbo vendors 1.4.5, so its hop to 1.4.7 also carries 1.4.6's slack fix, which is reachable from packet input. The C# port does not yet carry the two new create error codes (netcode.cs#7). The findings come from an outside security review.