fix: harden leave room rate limiting

docs/CHANGELOG.md

@@ -8,12 +8,6 @@ All notable changes to the KoalaSync browser extension and relay server.
 
 ### Added
 - **Extension: Privacy title controls** - Advanced users can now disable sending browser tab titles separately from media titles. Media titles can still be sent in full, reduced to detected episode identifiers such as `S01E04`, or hidden entirely. Defaults remain full titles for backwards compatibility.
-
----
-
-## [v2.5.1] — 2026-07-01
-
-### Added
 - **Relay: Cleaner restart handling** — Connected clients are now disconnected explicitly during relay shutdown so reconnects recover more predictably.
 - **Relay: Stronger abuse protection** — Rapid room-leave spam is now rate-limited.
 

docs/PROTOCOL.md

@@ -93,8 +93,7 @@ Behavior:
   falls back to `controlMode: "everyone"`, resets controllers to the new host,
   and broadcasts `control_mode`.
 
-Exceeding the `leave_room` limit is logged and ignored; the socket is not
-disconnected for this specific limit.
+Exceeding the `leave_room` limit is logged and the socket is disconnected.
 
 ## Relayed Room Events
 
@@ -354,7 +353,7 @@ If sender and target are still in the same room, the relay emits:
 - Connections: 10 per IP per minute; excess connections are disconnected.
 - Relayed/events: 50 per socket per 10 seconds; excess disconnects the socket.
 - `get_rooms`: 10 second cooldown per socket plus the event limit.
-- `leave_room`: 10 per socket per minute; excess is ignored.
+- `leave_room`: 10 per socket per minute; excess disconnects the socket.
 - Invalid room passwords: tracked per IP and room. Five recent failures block
   more password attempts for that room until the failure window ages out.
 - HTTP health and admin-metrics endpoints have their own rate limits outside this