NET milestone: real console->pod mission egg over the wire (+ mission-load crash)

Captured a real mission egg delivered from the SheepShaver console to the
DOSBox pod on TCP 1501, no -egg bypass: 8x ReceiveEggFileMessage chunks,
7514 bytes, reassembled byte-perfect (declared notationFileLength=7514).
The egg is the operator's own mission (BattleTech / cavern / night /
freeforall, pilot "cyd", vehicle madcat). This closes the networking
workstream end to end.

- net-tools/decode_egg.py: reassemble an egg from a captured console->pod
  TCP payload hex dump (skips interleaved StateQuery polls).
- net-tools/captured_cavern_mission.egg: the delivered egg.
- NET-NOTES.md: milestone writeup + the pod's mission-LOAD crash. The pod
  faults loading the mission (page fault, wild ptr 0xFF008B5B, exception
  000E at game 00FF:219D, NetNub Munga exit 14) -- a game-side bug in the
  mission-load path, separate from networking. Leading suspect: RIO was
  disabled for this run and the player vehicle/control setup derefs null.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

emulator/NET-NOTES.md

@@ -340,6 +340,38 @@ with a full RIO+sound boot (`net_full.conf`) so the pod presents its normal
 state (applicationState may change when fully booted). Need the console UI
 readout to know what state it wants before it will send the mission egg.
 
+## EGG DELIVERED OVER THE WIRE (2026-07-05) — headline goal achieved
+
+The real SheepShaver console sent a real mission egg to the real DOSBox pod
+over the emulated network, captured + reassembled byte-perfect:
+- Console -> pod, TCP 1501, **8x ReceiveEggFileMessage chunks** (1040-B
+  NetworkPackets each = 16 hdr + 1024 msg), **7514 bytes total**, declared
+  notationFileLength=7514 (exact match). Reassembled with
+  `net-tools/decode_egg.py`; saved `net-tools/captured_cavern_mission.egg`.
+- The egg is a text NOTATION file (same format as Console.ini). Contents =
+  the operator's actual mission: `[mission] adventure=BattleTech map=cavern
+  scenario=freeforall time=night weather=clear temperature=27 length=120`;
+  `[pilots] pilot=200.0.0.113`; `[200.0.0.113] name=cyd vehicle=madcat
+  experience=veteran badge=VGL dropzone=one color=Grey advancedDamage=1
+  role=Role::Default` + embedded pilot badge bitmaps + ordinal fonts.
+- Confirms the whole decoded protocol end to end: StateQuery/StateResponse
+  poll, then egg chunks, pod ACKs, no `-egg` bypass. **Networking DONE.**
+
+**BUT the pod CRASHES loading the mission** (game-side, NOT network):
+`nn.log` shows `Reference to a page you don't own / PF cr2=FF008B5B /
+Unhandled exception 000E at 00FF:219D ErrCode 0004 / NETNUB Munga exited
+code 14` -- a page fault (wild pointer 0xFF008B5B) in the mission-load path
+right after the egg arrives. Suspects: (a) RIO was DISABLED for this run
+(net_pcap.conf) and the mission sets up the player's vehicle (madcat) /
+controls, which may deref a null RIO/control struct; (b) missing cavern
+content or a pilot-config/badge path bug. Note: cavern/night via `-egg
+test.egg` with RIO ENABLED rendered fine earlier this session, so RIO-off
+is the leading suspect. Real pods run RIO-on headless (no focus stealing),
+so this may not reproduce there. NEXT: retry with RIO enabled + DOSBox
+`priority=highest,highest` (so clicking the console can't starve the RIO's
+ACK deadline during load); if it still faults, disassemble around game
+code 00FF:219D. This joins the Division-renderer/crash workstream.
+
 ## Open questions / notes
 - Exact TCP listen port(s) — not in the source grep; get from NETNUB.EXE
   or a capture at milestone 3.