## Fix: players keep getting kicked mid-game (auth cache TTL)
**Root cause**: the auth cache (`AuthCacheService`) has a 10-min TTL but `CreatedAt` was only set when the token was created — never refreshed while the player was actually connected. After ~12 min, the cleanup timer would expire the port entry, fire `OnPortExpired` → return the port to the pool → stop the delta UDP listener → the active player got force-disconnected ("Server shutting down" in the logs).
**What I changed**:
- `AuthCacheService`: added a `_confirmedPorts` set + `ConfirmPort()`. Cleanup now **skips confirmed (actively connected) ports** — as long as the player is connected, the port lease is never cleared.
- `ClientManager`: calls `_authCache.ConfirmPort(deltaPort)` right after `_portPool.ConfirmPort()` when the port matches, so an active session is marked confirmed.
- Port is still properly released on disconnect (existing `RemoveByPort` path untouched).
---
## Change: hide the default UDP port, use last delta port as default
**Why**: the well-known default port (my config: 22023) was getting flooded with garbage UDP. So now the server reserves the **last port** of the delta range as the main listener, so the default game socket is never the obvious 22023, and even if the pool is fully allocated, the server still runs.
**What I changed**:
- `ServerConfig`: new option `ReserveLastDeltaPortAsDefault` (default true).
- `PortPoolService`: `DefaultPort` = last delta port (`DeltaPortEnd`) when enabled; pool excludes it.
- `MatchmakerService`: main UDP listener binds to `DefaultPort` instead of `ListenPort`.
- `GamesController`: fallback port in `GetDeltaPort()` uses `DefaultPort`.
---
## Change: Filtaur-style line-speed UDP packet filter
**What I changed**: new `UdpPacketFilter` in Hazel + hooked into `UdpConnectionListener.ProcessData`. It drops junk at line speed before it reaches the game server:
- size check (min/max length),
- send-option byte check (layer-7),
- per-IP connection burst limit + temporary blacklist (default 30 burst / 60s blacklist).
Only applies to **unknown endpoints** (new connection attempts); established connections are never filtered, so in-game traffic is unaffected. This is the "filtaur" idea — force spammers through overhead and drop bad packets fast so they can't overload the server and drop everyone.
---
## Config (config.json)
Added `"ReserveLastDeltaPortAsDefault": true` under `Server`.
FangkuaiYa