v0.3.1

Security

• One network address (IPv4 address or IPv6 /64) may start at most MAX_RUNS_PER_ADDRESS ranked runs per UTC day (75 production, 50 staging), however many guests it creates. Previously one guest could start and abandon runs until the global MAX_RUNS_PER_DAY allowance was gone. Over the share, run start returns 429 address_limit with Retry-After set to the next UTC midnight, and the game plays locally. The address is stored only as an HMAC under the new ADDRESS_KEY secret and pruned by the daily job (D1 migration 0004). Over-share attempts write nothing.
• IPv6 rate-limit keys parse every spelling of an address; IPv4-mapped IPv6 counts as its IPv4 address.
• Deploys require the ADDRESS_KEY secret on each GitHub environment.
• A player starting two runs at once spends one admission slot, not two.
• MAX_RUNS_PER_DAY = 0 pauses ranked play (capacity). A missing or malformed run limit or ADDRESS_KEY fails ranked starts with 500, like a bad VERIFY_INSTRUCTIONS.
• Security docs name the remaining limits: legal-input bots with the start seed, client-claimed platform labels, shared itch browser storage.