v1.4 - Stability audit and Experimental parity

Stability

• Every event handler, command and placeholder now contains exceptions: a bad sprite, bad image or failed MineSkin call logs once at WARNING and the chat message / command proceeds unmodified.
• All sprites.yml reads and writes moved off the server thread (single IO thread, atomic writes). /sprite reload is now async.
• Sprite, sequence and animation maps are immutable snapshots, so chat rendering can never race a reload.
• onDisable now stops the web server, the MineSkin pool, the IO thread and every animated text display with bounded waits. No more leaked threads on reload.
• Animated TextDisplays run on one shared ticker, update only when the frame changes, and no longer persist across restarts.

1.21.11 crash guards

• %headsprites_tab_*% now rewrites <head name=...>, bare <head> and quoted forms, and strips any leftover name-only head tag before TAB sees it.
• sanitizeHeads recurses into hover text.

Ported from Experimental

• Tolerant tag grammar (<head : "x" />), <head_texture:hash>, <head:texture:hash> / <head:name:X> forms.
• Sprite delete (/api/sprite/delete + gallery button in the web UI).
• MineSkin: retries on transient errors, handles immediate skin responses for duplicate uploads, clearer job errors.

Performance

• Head components and texture hashes are computed once per sprite; sequences and animation frames are cached and rebuilt only on change.
• Web UI: request bodies capped at 6 MiB, images rejected above 2048 px before decode, ImageIO disk cache disabled, 4 worker threads.
• MineSkin generation from /sprite generate runs on a bounded pool with one shared HTTP client.

Notes

• Names for new sprites/sequences/animations are restricted to [a-z0-9_-] (max 48 chars). Existing entries load unchanged.
• Default web.token on first run is now generated with SecureRandom.
• Full finding list: AUDIT.md.