Enhance school management and protocol handling by introducing a new worker failure mechanism, ensuring proper cleanup of schools when a worker thread encounters an error. Update the map snapshot protocol to allow larger school data sizes, improving the handling of extensive map layouts. Revise documentation to reflect changes in save intervals and introduce a minimum save interval for better performance. Update tests to validate the new functionalities and ensure robustness in handling large data scenarios.

docs/architecture.md

@@ -97,8 +97,11 @@ cannot land between a mouse-down and a click.
 ## Saves
 
 Each school is a JSON file under `Simulation:SavesDirectory` (`saves/{id}.json` plus `index.json`
-for the next id). The worker writes on create, pause, speed change, shutdown, and on a rare clock
-snapshot (`SaveIntervalSeconds`, 30 by default) — never on every tick. The file also stores the
+for the next id). The worker writes on create, on shutdown, and on a rare clock snapshot
+(`SaveIntervalSeconds`, 30 by default) — never on every tick. Pause and speed changes are written
+too, but coalesced to at most one write per `MinSaveIntervalMilliseconds`: a client can send those
+as fast as the socket allows, and each one is a file write on the school's own thread. Shutdown
+always flushes, so a pause is never lost. The file also stores the
 mod pack ids and the map layout; the catalog is loaded again from `mods/` on start. A missing
 mod folder or a map that no longer validates leaves the file in place and that school unstarted.
 

docs/protocol.md

@@ -248,7 +248,9 @@ Each node:
 
 ## Guarantees and limits
 
-- Frames larger than 8 KiB are refused with close status `1009 MessageTooBig`.
+- **Inbound** frames larger than 8 KiB are refused with close status `1009 MessageTooBig`. That
+  limit is about what the server reads; it does not bound what the server sends. A `MapSnapshot`
+  of a large school legitimately exceeds it, and the server sizes that frame from the message.
 - A malformed frame closes the connection with `1007 InvalidPayloadData`.
 - Unknown message ids are ignored rather than fatal, so new ids can be added without breaking
   older clients within the same protocol version.