2 files changed, 26 insertions, 0 deletions

diff --git a/docs/GAMES.md b/docs/GAMES.md
index bd372b1..6f6d197 100644
--- a/docs/GAMES.md
+++ b/docs/GAMES.md
@@ -182,6 +182,20 @@ database.
 
 ## Wire protocol
 
+The first line after the TLS handshake is always the version handshake:
+
+```
+HELLO <version>
+HELLO <version> latest=<version> url=<download-url>
+```
+
+Client and server must share MAJOR.MINOR; only the patch component may differ.
+Until the handshake succeeds the server answers every other message with
+`ERROR HELLO required`, and the client sends no credentials. A mismatch answers
+`ERROR Version mismatch: ...` and the client disconnects. `latest` and `url`
+drive the "newer version available" notice. The server reads `DOWNLOAD_URL`
+from its environment, falling back to the public site.
+
 Slots keeps its original exchange:
 
 ```
diff --git a/docs/TESTING.md b/docs/TESTING.md
index 1a1d369..23e3a19 100644
--- a/docs/TESTING.md
+++ b/docs/TESTING.md
@@ -180,6 +180,18 @@ Use an 80-column terminal because several output lines are width-sensitive.
    one row with `winnings = 0`, `details.result = "abandoned"` and
    `details.reason = "server_restart"`.
 
+## Manual version handshake check
+
+1. Connect a client and server from the same release: the client connects and
+   the server log shows the `HELLO` exchange.
+2. Connect a 4.x client to a 3.x server (or the reverse): the client must print
+   `Version mismatch: client ..., server ...` and never reach the login prompt.
+3. With a deliberately skew-built server (PATCH differs) the connection is
+   accepted and, when the server's version is newer, the client prints
+   `A newer version is available`.
+4. Before the handshake, `openssl s_client -quiet -connect host:port` followed
+   by `PING` must answer `ERROR HELLO required`.
+
 ## Manual identity / credential checklist
 
 1. Connect through one address, `register` and `login`. `hosts` shows the