Malicious peers

A peer can disconnect, replay a stale command, send malformed or oversized messages, advertise a false identity, or author state that is locally valid but bad for the game. CRDT merge will preserve/converge data; it will not decide whether the author was entitled to create it.

Validate action type, payload size, actor, phase, ownership, turn/version, and resource bounds at the point of authority. Never trust an application-supplied fromPeerId; use transport metadata. In peer mode, surface contested or invalid state and design rules to tolerate it, or move the rule behind an authoritative server.

The relay has no general authentication. A reconnect receives a new connection identity. Do not use relay IDs as durable accounts or as proof of key ownership.