Open Tabletop 0.21.1

Upgrade notes

• From 0.21.0, pull the updated image and recreate the app container. No new migration,
  dependency, environment variable or Compose change is required. Existing accounts and
  passwords are unchanged. Earlier versions must also follow the 0.21.0 upgrade instructions.
• Automated checks passed: 933 tests in npm run check and 25 PostgreSQL integration tests.
  Live Dockhand update verification remains pending.

Fixed

• Startup skips all bootstrap administrator settings and password-file access when any user
  exists, so Docker updates that lose the first-boot file no longer block established installs.
  Empty databases retain credential validation and transactional provisioning protection.

Documentation

• Added separate implementation plans for demo-only 15-dice limits and shared roll
  cooldowns, and full-app room worker process isolation. Plans include regression and
  performance gates, ownership/routing safeguards, deployment and rollback. No runtime
  behavior changed; architecture and reference navigation distinguish plans from contracts.

Open Tabletop 0.21.0

Upgrade notes

• From 0.20.0, startup applies additive migration 023_account_recovery.sql using the existing
  migration-role connection. Existing accounts, assets and saved games are preserved; existing
  email addresses are not automatically verified. With automatic migration disabled, apply
  pending numbered migrations using the schema-owner connection before starting this version.
• Back up the database and uploads, restart the server and refresh all browsers. Source installs
  should run npm ci first. SMTP is optional; email recovery requires additional configuration,
  while saved recovery codes work without SMTP. No new service or exposed port is required.
  See 0.21.0 upgrade instructions.
• Includes security fixes for room admission/save ownership, asset serving and action-menu HTML
  injection. Native installer live-distro/reboot acceptance and website publishing/user acceptance
  remain pending; feature-specific user-reported testing is recorded below.

Added

• Native Linux uninstall and confirmed purge modes with offline execution and --dry-run,
  plus reinstall/resume for retained or interrupted installations. Recovery preserves stored
  credentials, uploads and configuration; purge retains database backups and shared dependencies,
  refuses mounted/redirected storage, and removes only the app's PostgreSQL authentication rule.
  Shared installer tests cover both Linux and Proxmox profiles. Live distro/reboot acceptance
  remains pending; no application migration or browser UI change is required.

• Replaced the website header and footer text branding with the existing Open Tabletop
  logo on the landing page and all 17 wiki guides, with accessible names and responsive sizing.

• Captured four gameplay/library screenshots from two dedicated, saved showcase rooms.
  Applied the approved chess hero, responsive cards/dice gallery, and library image in the
  Assets and scenes guide. Recorded capture provenance and chess-model attribution.

• A standalone static website in website/, with the approved landing page, GitHub link,
  inactive public demo label, and 17 linked wiki guides for installation, configuration,
  gameplay, assets, recovery, and maintenance. The wiki has desktop and mobile navigation
  and works without JavaScript. Existing project artwork is reused. Local link/content and
  browser layout tests are provided; see website/README.md for preview and maintenance.
  The game server is unchanged. Publishing and user acceptance remain pending.

• Account security with masked password confirmation at signup and password setting, a dedicated
  in-app password form replacing the native hosting prompt, and current-password verification for
  changes. Password setting remains independent of host approval. Verified-email recovery and ten
  single-use saved recovery codes support passwordless accounts and existing-account password reset.
  Credential changes revoke old sessions/proofs/codes; recovery preserves account ownership and roles.
  Optional TLS SMTP uses Nodemailer; migration 023 and a server restart/client refresh are required.
  See docs/ACCOUNT_SECURITY.md for configuration, behavior and validation status.
  Documented bare-metal and Docker SMTP setup, provider credentials, exact password-file contents,
  restart requirements and recovery smoke tests. User reported feature, layout and SMTP success.

• Contributor guidance in CONTRIBUTING.md and private vulnerability reporting
  instructions in SECURITY.md, using admin@open-tabletop.com.

• A source security audit with isolated reproductions of unauthenticated duplicate-room
  creation/save overwrite, admin-only legacy inline-image script hosting, and an encoded-URL
  bypass of the asset JSON guard. See docs/SECURITY_AUDIT_2026-09-28.md; remediation is recorded under Fixed and in the audit.

• A regular Linux host installer for systemd Debian 12/13, Ubuntu 22.04/24.04/26.04 LTS,
  Fedora and Arch. It shares the Proxmox native deployment flow, adds distro package/cache
  selection and PostgreSQL initialization, and allocates a system account without claiming
  UID 1000. Source revisions/archives, separate database roles, credentials, release switching,
  backup-before-update and readiness checks are retained. Proxmox keeps its existing package
  pins and NFS UID mapping. Command-mocked tests are provided; live distro installation and
  reboot acceptance remain pending. No application migration or browser UI change is required.

• GM-configured piece fog auras, with the approved circle menu entry, room-unit radius and local
  preview. Moving a visible tabletop piece reveals a persistent circular path through map fog;
  hidden pieces pause their auras. Settings survive scene/game saves. Manual fog controls remain
  available; auras neither reveal explicitly hidden objects nor enforce walls or movement rules.
  Restart the server and refresh clients; no migration or new dependency is required.

• Manual map fog for image, procedural and 3D boards, with approved cloud-fog entry, circular Reveal/Cover brushes,
  room-unit radii, session undo, Cover all/Reveal all, and a local player fog preview. GMs see
  translucent coverage; other players see opaque coverage. Exploration is saved with scenes/games
  and survives disabling fog. Painting supports mouse, touch and keyboard through the input router.
  A shared, saved Fog thickness slider grows a closed volume with masked top/bottom caps and
  walls along outer and revealed boundaries, preventing low-angle views under covered areas.
  Thickness edits preserve exploration and join session undo; older height settings carry over. Piece visibility and
  physics stay independent; piece reveal auras are tracked separately above.
  Restart the server and refresh all clients; no database migration or new dependency is needed.

• GM object Hide/Reveal with approved eye-off/eye controls, batch selection actions, ghosted
  GM-only pieces, and Library Spawn hidden. Hidden pieces are omitted from player state
  and object events, remain non-colliding and parked until revealed, and retain visibility in
  saved scenes/games. Deck/dispenser/notecard-stack table outputs inherit concealment.
  Reveal rejects occupied placements; hiding rejects held/edited pieces and visible supports.
  Private hands retain their separate privacy and explicit sharing/play behavior; personal tray
  dice stay visible. Restart the server and refresh all clients; no database migration is needed.

Changed

• Consolidate browser session-token access, lobby/admin JSON requests, and shared button DOM
  creation. Preserve authentication defaults, request errors, icons, button types, accessible
  labels and room-action guards; specialized upload/package/template request behavior remains
  local. Refresh browsers to load the updated modules; no server restart or migration is needed.

Fixed

• Audited all 17 website wiki pages against current documentation, release history and source.
  Corrected Node setup order and grants, Compose environment forwarding and secret permissions,
  native administrator commands, role restrictions, scene/reset consequences and transient state.
  Expanded current deck, notecard, fog and table-tool instructions; distinguish the new
  features from 0.20.0. Added per-page source links and a review record in website/WIKI_AUDIT.md.
  Updated supporting README, gesture, architecture and reference notes. Documentation only.
• Added step-by-step website instructions for double-sided tile uploads, panorama and cubemap
  skyboxes, and saving and applying custom dice textures. No application behavior changed.
• Corrected the website's Assets and Scenes guide against the current table controls and
  handlers: combined Library categories, admin creation on regular tables, Save/Save + Spawn,
  publication, scene save/load, collections, and portable assets. Updated the first-game,
  controls, pieces, saving, and Node.js guides, plus the source README and architecture/reference
  descriptions. This is a documentation correction; application behavior is unchanged.
• Made SMTP setup documentation and configuration examples provider-neutral.
• Landing account header overlap: moved Account security beside Admin in the page header,
  and allowed identity/actions to wrap without overlap on narrow screens.
• README migration and tuning references, test commands and database-test prerequisites;
  added documentation navigation, notecard/concealment/fog summaries, and scoped security guidance.
• Security audit SEC-01: authenticate matchmaking before room allocation, disable public explicit
  room creation, retain unique transport IDs, and use a separate persistent room ID. One local
  writer holds ownership through its final save; failed/unadmitted instances cannot overwrite
  checkpoints. Connection admission rechecks access and preserves revocation/spectator handling.
• Security audit SEC-02/SEC-03: remove the obsolete saveDeck/inline-image writer and serve only
  approved generated raster/GLB asset paths with explicit safe MIME types and response headers.
  Encoded metadata paths, scripts, HTML and malformed URLs are blocked, including existing files.
  Current editor deck/tile saves and normal uploads are retained. Restart the server; no migration
  or dependency change is required. Manual tests reported green by the user on 2026-09-28.
• Render overflow action labels/notes and touch action-sheet names/metadata as plain text,
  preventing stored room or asset names from injecting HTML. Existing classes, icons, accessible
  labels, confirmation and close behavior are retained. Browser regressions cover desktop/touch
  and compact/full modes. Refresh browsers; no server restart or migration is required.
• Make the native installer test fixture resolve Node from the test runner's executable,
  fixing package-setup checks on CI hosts without `/usr/bin/no...

Open Tabletop 0.20.0

Upgrade notes

• From 0.19.0, startup applies additive migration 022_notecard_templates.sql using the existing
  migration-role connection. If automatic migration is disabled, apply pending migrations with
  the schema-owner connection before starting this version.
• Restart the server and refresh all browsers. Source installs should run npm ci first.
  Existing assets and saved games remain compatible; no new service, environment variable or
  exposed port is required. See upgrade instructions.

Added

• Rearranged notecard editor and custom drawing ink. Desktop editing controls sit beside the
  card, with single-row shape and view toolbars using shared compact controls. Phone layouts stack
  the card above placement actions. A native color swatch selects custom drawing ink, and Text
  toggles its settings below Undo/Redo/Clear, returning to the previous drawing tool when closed.
  Restart the server and refresh browsers to enable custom ink validation.
• Restricted private notecard passing. Only Helpers, GMs and room owners can send notecards
  privately; ordinary active players can still receive them. Server checks cover existing cards
  and new template drafts, including role changes during editing. Regular-player editors hide
  the recipient/pass row while keeping hand and table placement available.
• Portrait and landscape notecards. Choose orientation in the private editor with compact
  Tabler controls. Existing ink and text fit proportionally, with Undo/Redo; orientation follows
  templates, hands, private passing, Show, stack entries and saved games. Shared dimensions keep
  meshes, physics and collider diagnostics aligned. Older content defaults to landscape. Restart
  the server and refresh browsers; no database migration is needed for this extension.
• Saveable notecard templates. Save paper, ink and editable text to your account, private by
  default, with optional sharing across the server. Library templates create independent private
  drafts or face-down stacks; owners and site admins can rename, replace, change sharing or delete
  templates. Revision checks prevent stale overwrites, and failed saves/placements preserve drafts.
  Includes a collapsible Notecard Templates section under Boards, Mats & Notecards, using shared Library card styles,
  two desktop columns, always-visible thumbnails, and compact Tabler controls. Migration 022 adds
  template storage; restart the server and refresh browsers after upgrading.
• Editable notecard text boxes. Add up to eight multiline boxes with size, ink color and
  alignment; move them and resize their wrapping width with mouse, touch or keyboard. Text stays
  above ink and remains editable through hands, private passing, Show, stacks and saves. Shared
  Undo/Redo covers ink and text; Eraser/Clear ink preserve text. Includes the approved Tabler
  controls, accessible box selection and an overflow warning that keeps the draft open.
• Notecard paper styles and drawing helpers. Choose blank, ruled, grid or dotted paper in
  ivory, white or pale yellow. Each card retains its paper through hands, private passing,
  Show, stacks and saves; concealed backs remain indistinguishable. Line, rectangle and ellipse
  tools create single undoable strokes, with a Constrain toggle/Shift for 45° lines, squares
  and circles. Eraser/Clear affect ink only. Includes keyboard cursor drawing and the approved
  Tabler icons; older saves default to blank ivory paper.
• Notecard stacks. Spawn 2–16 blank notecards as a finite stack, draw privately to hand or
  editor, return edited artwork to the top, play the top face-down, shuffle, split, and combine
  selected loose notecards/stacks. Contents and order remain server-private and survive saves;
  contained cards count toward the existing 16-notecard room limit. Includes the approved
  Tabler controls, keyboard stack-menu access, focus navigation and accessible hints.
• Drawable notecards. Spawn individual landscape notecards from the Library, privately draw
  with mouse/touch/pen using colors, pen widths, eraser and undo/redo, then place face-up or
  face-down. A single editor reserves each card; concealed artwork stays server-side, and
  committed drawings survive scene/game saves. Cancel or interrupted editing preserves the
  previous artwork. Includes an undoable Clear and spectator-safe public inspection.
• Notecard zoom/pan and private hands. Wheel or pinch to zoom, pan with a tool or two
  fingers, and reset with Fit card. Keep drawings in account-owned hands, reopen/edit them,
  play them face-up/down, or pass them privately to an active player. Reuses hand saves,
  reconnects, reorder and selective Show; failed transfers retain inventory and drafts.
  Drawing controls use the user-approved Tabler icon set with compact-mode labels/tooltips.

Changed

• Rename the two human placard choices to Type 1 and Type 2, preserving saved selections.
• Library exports use a brief bottom-center toast instead of a persistent message above the
  assets. Desktop source and collection filters now share sizing, typography and borders in
  compact/full modes; the tested touch layout is preserved.
• Grouped Library browsing. Six tabs contain collapsible Decks/Tiles, Dice/Objects/Dispensers,
  Boards/Mats/Notecards, Games/Scenes, Skyboxes and collection management. Search still spans
  asset categories, reveals matching collapsed sections and restores their previous state when
  cleared. Select operates across visible sections. The Filters funnel exposes source choices
  and personal collection visibility; Show all/none still leaves Uncollected independent.
  ZIP/JSON importing now opens a separate dialog; exports report status through the shared toast.
  Existing template scope/pagination and server permissions are preserved. The user confirmed
  functional browsing and good mobile layout, then accepted the follow-up toast/desktop filter
  styling and tile classification fix.
• Replace the built-in procedural Marbled finish with Behrtron's CC0 white-marble texture.
  Preserve the supplied 4K source; render with one shared 512px WebP, retain colored dice and
  numbering, and wait for marble loading before generating finish previews. Remove the old
  per-color procedural marble caches.
• Add independent code tuning for built-in coin/coin-stack metallic metalness and roughness
  in PROPS.coin.finishTuning.metallic; dice keep the FINISHES.metallic settings. Other
  selected coin finishes retain their normal response. Tune metallic dice to metalness 0.75
  while coins retain 1.0.

Fixed

• Custom tile assets now appear in the Library's Tiles section. Deck listings include the
  existing tile flag, preserving classification for public and private assets without reimporting.
  Restart the server and refresh browsers; no database migration is needed.
• Stabilize the notecard browser regression by retaining the held mouse button during CDP
  drag moves; assert the first stroke commits before testing zoom/pan. Fixes intermittent CI
  cancellation of the synthetic stroke.
• Restore generated library thumbnails on Safari by accepting PNG canvas-export fallback as
  well as WebP. Covers 3D models/boards, dice, built-in cards and tile sets while retaining
  bounded thumbnail dimensions and rendering-resource cleanup.
• Reduce generated dice textures to 256px on Low/Medium and 512px on High. Share polyhedral
  number masks across ink colors; release replaced/removed dice and inspection previews, including
  their owned canvases and late model loads. Dispose generated dice thumbnails and temporary
  thumbnail canvases; defer dice thumbnails until visible in the library.
• Load bundled and uploaded skyboxes at the selected Low/Medium/High resolution through cached
  WebP derivatives, avoiding full-image download/decode before downscaling on iPad. Ultra preserves
  original sources; legacy URLs retain local downscaling. Release downscaled sky canvases on swap.
  Restart the server and refresh browsers to use the new sky derivative variants. No migration.

Documentation

• Record successful user testing and commit approval for editable notecard text boxes.
• Record successful user testing and commit approval for notecard stacks.
• Require an approved mock-up or example before adding, modifying or removing UI elements;
  document accessibility expectations for keyboard use, focus, accessible labels, hints and touch.
• Record user approval of drawable notecards, zoom/pan, private hands and the compact icon set.
• Require concrete Tabler icon options and user selection during UI work, with compact-mode
  accessibility and shared icon/sprite integration recorded in AGENTS.md.
• Record user-confirmed iPad performance improvement after the dice/sky memory fixes and
  successful library-thumbnail verification after the PNG fallback fix.
• Record successful user-reported 0.19.0 deployment tests on Docker, bare metal and Proxmox,
  along with successful asset-pack uploads.

Open Tabletop 0.19.0

Added

• Asset collections. Site admins can organize mixed custom assets into shared, private or
  published collections, with a searchable bulk chooser and rename/delete controls. Per-account
  local filters support multiple memberships, Uncollected, and Show all / Show none. Collections
  preserve each asset's permissions; deleting a collection keeps its assets, and conflicting
  edits cannot silently overwrite one another.
• Portable assets and collections. Site admins can export custom dice textures, decks/tile
  sets, boards, player mats, skyboxes and 3D models individually or as saved collections in
  .ott.zip packages. Packages preserve original images/GLBs, embedded materials, authored card
  order and geometry, colliders, model transforms, and saved dispenser definitions, including
  separate container models. Imports preview contents and create new private copies with remapped
  references and collection membership; existing assets are never overwritten. Earlier
  .ott.json packages remain importable. Unsupported members reject the whole collection export.
  Live player data and scene ZIP exports are outside this format.
• Private deck browsing. Right-click or long-press a deck to browse one card at a time
  without changing its order. GMs can enable active-player browsing per deck; all decks default
  to GM-only. Take a card into hand, place it face-up/down, or move it to the top/bottom.
  Exclusive expiring sessions prevent conflicting draws, shuffles and combines, and recover
  inventory when placement fails or access changes.
• Spectator mode. Choose More → Spectate / Return to play, or Watch in the lobby. New
  spectators join without a seat; converted players keep their reserved seats, hands and trays.
  Spectators retain camera, chat and authorized inspection, and are skipped by turns/dealing.
  The mode persists per room/account across tabs and reconnects. Rooms support eight playing
  seats and up to 24 total connections.
• GM time-outs. Apply or lift a durable time-out from the member list, with visible status
  and an explanation for the affected player. Time-outs block gameplay and release active grabs
  safely while preserving seats, hands and trays. Camera, chat, authorized inspection and personal
  notes remain available. Returning from spectator mode never lifts a GM time-out.
• Object labels and low-stock warnings. GMs use Labels… in the desktop/touch menu or press
  L over a piece to edit a saved label. Decks, tile decks and finite dispensers can show a gold
  remaining-count label below an explicit full-quantity percentage threshold. Labels follow
  moving objects; unlimited dispensers do not offer stock warnings.
• Shared object highlights. Middle-click an unheld object or choose Highlight from its menu
  to show everyone a pulsing halo for 3.2 seconds. Repeating refreshes the halo; it follows movement
  without changing materials, selection or physics. Held-piece rotation and empty-table pings
  retain their gestures.
• Account placard presets. Settings → Placard offers feminine/masculine bodies, pointed-ear
  and floppy-ear dogs, shorthair/fluffy cats, frog and gecko. Choose solid, gradient, stripes,
  dots, stars or checkerboard with two custom colors and a private live preview. Saved choices
  follow the account across rooms, tabs and reconnects, retaining avatar faces, readable names
  and seat-color outlines.
• Tile sound variants. Three original synthesized tile flips and three box-shake shuffles
  give named tile sets distinct cues. Paper cards keep their existing sounds; mixed selections
  play one flip cue per material. Existing SFX mute/volume controls apply. Include the reproducible
  offline generator and CC0 provenance.

Changed

• Centralize server-side participation checks across table requests, including access rechecks
  after asynchronous reads. Preserve authorized observation, communication, personal notes,
  cleanup and administration while gameplay is restricted.
• Enlarge player placards, improve their texture detail, and raise new avatar uploads to 512×512.
  Existing avatars remain compatible; re-upload to benefit from the higher source resolution.
  Replaced placards dispose their owned rendering resources.
• Move Multi-Select into a floating button above Seat. A click/tap on empty felt without a drag
  exits the mode while retaining the selection; real drags keep it active. Hide Seat and Table
  Actions while the mobile private hand is expanded.
• Improve large-library scrolling with lazy, asynchronously decoded WebP thumbnails, retained
  unchanged asset lists, and batched button measurements. Saved/bundled image previews use bounded
  derivatives across library cards, finish pickers, hands and editor image squares. Original
  files and full tabletop rendering retain their quality; thumbnail caches build on demand.
• Give Collections and library assets one scrolling body with a fixed header and visible
  collection Save/Cancel controls. Use consistent Tabler icons for collections, asset transfers,
  labels, highlights and spectator actions.
• Keep member names/status readable in narrow room docks, with compact moderation controls and
  emphasized Kick/Reject actions. Increase the initial schema-encoding buffer for busy tables
  without changing table capacity.

Fixed

• Store new model-board uploads under /assets/boards/; continue exporting older boards from
  their original /assets/props/ location. Imports use the boards directory, preserving existing
  shared originals and authored model materials.
• Measure hand scroll arrows when the hidden tray opens or resizes, without requiring Rearrange,
  and release observers and pending measurements when rebuilding it.
• Keep object-label rendering/editing idle until room pieces are available, clear stale labels
  on state loss, and resume on hydration.
• Center the masculine placard head around its avatar opening and use a symmetrical outline.

Deployment

• Apply additive migrations 018–021 for time-outs, spectators, collections and account
  placards. Normal startup applies pending migrations using the existing migration role; refresh
  all browsers after restarting the server. With automatic migration disabled, apply the pending
  numbered migrations in order using the schema-owner connection before starting the new server.
  Existing memberships remain unrestricted players, assets begin uncollected, and accounts receive
  the default placard. Existing scenes/game snapshots require no conversion.
• Source installs must install the updated locked dependencies (npm ci); packaged images include
  them. No new services, environment variables or runtime database privileges are required.
• ZIP packages support up to 64 assets, 5,000 cards/tiles, 4,096 images and 512 MiB of original
  files, with a 544 MiB transfer ceiling and 32 MiB per image. Full-size transfers need adequate
  temporary storage and reverse-proxy upload allowances. Transfers are streamed through private
  temporary storage, serialized per server process and validated before transactional imports.
  Image-count and byte-limit failures report distinct errors.

Documentation

• Reconcile the roadmap with completed gameplay, customization, touch and server/client
  refactoring work. Add implementation plans and verification checkpoints for recent features
  and discovery briefs for remaining work.
• Document gesture paths, account/room privacy boundaries, package formats and asset provenance.
  Feature approvals are recorded separately from comprehensive real-device and live multiplayer
  validation; the device checklist remains available for further testing.

Open Tabletop 0.18.0

Added

• Add a local Proxmox VE LXC installer and updater for bare-metal Node.js 26, PostgreSQL 16,
  Redis, non-root systemd operation, optional NFS-backed assets, and fetching a selected Git ref
  directly from the application repository, including the matching in-container installer.

Changed

• Move all six bundled asset trees into public/static_assets/. Centralize their filesystem
  location in STATIC_ASSETS_DIR, shared by HTTP serving, browser fixtures, and collider tools,
  while preserving public URLs and saved references, Mahjong caching, and audio range requests.
• Organize 19 browser modules into public/editor/, public/rendering/, public/ui/, and
  public/table/ by responsibility. Update imports, page scripts, test fixtures, and current
  documentation while preserving module behavior and script loading order.
• Complete the client composition cleanup by moving table-shell controls, personal audio/theme
  settings, dice defaults, piece menus/control hints, and transient visual effects into focused
  modules. Preserve room binding and render order, and add production-join, live-node handoff,
  preference persistence, menu capture, and effect lifecycle regression coverage.
• Extract semantic pointer/keyboard routing and piece-drag state into focused client controllers,
  preserving mode priority, click/deal/dispense behavior, grid/group transforms, touch re-anchoring,
  and release handling. Add routing/gesture regressions and desktop/touch production-bootstrap checks.
• Wait for a new Proxmox LXC's IPv4 address and default route before installing packages,
  rebooting the container once if networking is not ready and failing clearly if it remains offline.
• Split client bootstrap into feature-owned piece, hand, inspection, chat, private notebook,
  scoreboard/room-notes, timer, membership, and library-response bindings. Reuse existing mesh
  and row builders while retaining explicit patch order, replay requests, and session handling;
  add lifecycle/replay and desktop/touch panel regression coverage.
• Extract table/grid presentation, scale and lighting controls, lighting drafts, graphics-quality
  UI, and room-setting bindings into a client controller; isolate skybox loading, resolution,
  and texture cleanup in a separate controller, with unit and desktop/touch component coverage.
• Expand project agent guidance with an existing-code-first feature workflow, architecture and
  privacy boundaries, verification requirements, and preservation of user edits; reconcile the
  DRY cleanup plan with current documentation timing and client progress tracking.
• Extract player presence into a dedicated client controller: seats and camera framing, public
  hand fans, player markers and held-piece labels, roster/turn presentation, avatar controls,
  and player room bindings, with hydration and desktop/touch roster coverage.
• Extract local multi-selection, marquee gestures, highlight rings, batch actions, recoloring,
  and compose/gather planning into a dedicated client controller with selection-rule and
  desktop/touch toolbar coverage, and document its API and ownership boundaries in the client
  reference and architecture guides.
• Extract enlarged-piece and drawn-card inspection, color/team/finish controls, deferred
  double-clicks, and inspection pointer rotation into a dedicated client controller.
• Extract private-hand rendering, Show selection, rearrangement and sorting, collapse persistence,
  card inspection entry, and play/drag gestures into a dedicated client controller.
• Raise the dice tray's invisible collision walls and ceiling to 1.5× their visual-wall height
  while keeping the visible walls unchanged, and collect tray geometry, placement, spawn, recovery,
  and Scoop tuning values in shared knobs.
• Extract personal dice-tray rendering, placement, camera travel, die lookup, and tray actions
  into a dedicated client controller.
• Extract measurement overlay construction, selection, previews, permission checks, drag state,
  room bindings, and measure controls into a dedicated client controller.
• Enable nesting on new unprivileged Proxmox Debian 13 LXCs so the packaged Redis service can
  create its systemd user namespace, fail and retry APT index updates on transient fetch errors,
  and allow retrying the NodeSource key import after a partial installation.
• Move whiteboard mesh, stroke replay, ownership/camera mode, drawing gestures, room messages,
  and controls into a dedicated client controller while keeping table input wiring thin.
• Extract reusable dialog focus, responsive sheet, cluster, drawer, radial-menu, and hold-repeat
  mechanics from the table client into a dedicated UI-surfaces module, with desktop/touch
  component-parity coverage.
• Pin the container's non-root appuser/appgroup identity to UID 100 and GID 101 for stable
  NFS and bind-mount ownership, and document an NFS-backed Portainer/Dockhand assets volume.
• Bring the Portainer/Dockhand stack example into production-config parity with bootstrap
  administrator provisioning, migration and rate-limit controls, session lifetime, trusted-proxy
  settings, named storage that preserves the non-root application user's write access, and
  password-file setup and troubleshooting guidance.
• Move the production Docker image from Node.js 22 to Node.js 24 while retaining the Node.js
  20.9 minimum for direct installations.
• Begin the browser-client decomposition with table feature modules for piece mesh replacement,
  buffered interpolation, safe piece-property access, and local collider diagnostics.
• Extend component parity coverage with real desktop/mobile custom-collider scenes and a shared
  component-state gallery that asserts button, field, dropdown, multiselect, and checkbox states.
• Finish the shared UI migration by replacing legacy button, field, icon, and action-row class
  names in static and generated interfaces with the canonical component classes, then remove the
  compatibility selectors from the stylesheet.
• Standardize action rows, field groups, labels, helper copy, and live status lines with shared
  layout primitives; migrate custom-collider workflows, library save actions, lighting actions,
  and scene naming to those primitives.
• Give every overlay and the native custom-collider dialog one shared modal anatomy for backdrops,
  headers, titles, close actions, bodies, and footers while retaining their feature-specific layouts.
• Unify buttons, text fields, dropdowns, multiselects, and native checkboxes behind shared
  component classes and design tokens, including consistent hover, focus, pressed, disabled, and
  busy states. Migrate the custom collider editor and existing dropdowns to the shared controls.
• Reuse the shared table-piece limit as the default movement-handler group size, keeping movement
  validation aligned with the authoritative piece-capacity policy.
• Share thumbnail-grid rendering and image-shape conversion between the image-deck and
  double-sided-tile library workflows.
• Build server physics and live deck/stack collider updates from the shared renderer-neutral
  collider specification, keeping collision and debug geometry on one set of rules.
• Centralize overlay kinds, measurement settings, room caps, and whiteboard protocol limits so
  browser rendering, server validation, scene restoration, and history retention share one policy.

Fixed

• Prevent a late skybox load from restoring a background after Sky Off or replacing a newer
  resolution choice for the same image; stale callbacks now discard their textures.
• Space scooped dice by their collider size and settle them on the tray floor so they no longer
  spawn overlapping at the center and scatter when physics resolves the collision.
• Keep every Dice Box add-die choice on the same compact grid footprint instead of mixing square
  icon buttons with differently sized model-die buttons.
• Place measurement shapes and labels on the rendered board surface instead of a board-wide
  height, so tall 3D board geometry or custom colliders do not make them float above play.
• Give Save Table a temporary checked icon and label after saving without losing its original icon,
  render the Reset menu divider independently from the danger button, and keep the timer value
  visible in compact UI mode.
• Keep the poker-stack collider regression expectation aligned with the resized poker-chip model.

Open Tabletop 0.17.2

Added

• Draw and edit custom collider outlines directly in the main 3D viewport on top/front/side
  planes, with draggable corners, grid snapping, thickness, point undo, and cancel.
• Automatically split simple concave collider outlines into merged convex physics sections,
  preserving the editable outline and its openings through saved collections and asset layouts.
  Display the generated physics-part count and enforce the existing 16-part budget.
• Save reusable collider collections to an account-backed library with private/public visibility,
  owner/admin editing, geometry previews, and independent copies when inserted into objects or boards.
• Select multiple collider shapes (or select all), then move, rotate, uniformly resize, duplicate,
  delete, or save the group. Keep the existing 16-component limit and undo support.
• Add PostgreSQL migration 017 for persistent collider presets and authenticated library endpoints.
• Add outline-prism components to custom colliders, with clipped corners, triangle/hexagon
  presets, custom convex tracing, and conversion from existing box/flat components.
• Let uploaded GLB board outlines adjust width, depth, and rotation independently of the model,
  with a live tracing overlay and saved fit settings.
• Add a 3D custom collider editor for uploaded objects and GLB boards, with box, sphere,
  cylinder, cone and thin-slab shapes, drag/numeric transforms, duplicate/delete, undo, and
  apply/cancel. Save up to 16 shapes as one compound body that scales with the model.
• Preserve custom collider layouts through library save/edit/clone/load and piece snapshots;
  display all parts in physics diagnostics and account for compound board bounds at placement.
• Add rectangle, circle/oval, hexagon, clipped-corner and custom convex outlines for uploaded
  image and GLB boards, with a top-down tracing preview and matching physics/debug colliders.
• Add image-board thickness and adjustable GLB longest-side sizing; preserve outline and sizing
  through library save, edit, clone and load, and support grid calibration on shaped boards.

Changed

• Replaced built-in coin and token models.
• Scroll custom collider controls independently of the 3D preview and footer, and allow
  the outline editor to collapse while preserving its state during editing.
• Label collider drag and camera controls; use camera/action icons (including hexagon-3d for perspective) and add an undoable
  Clear all shapes button with warning styling.
• Use icon buttons for collider drag modes and adding shapes. Update the 3D preview while
  typing or scrolling numeric transforms, with Shift for fine and Ctrl/Command for coarse steps.
• Remove custom-collider helper text and wrap object scale controls to prevent clipping.

Fixed

• Export collider preset operations through the production database module so library
  requests can list and save collections without returning HTTP 500 errors.
• Place the held-piece drop marker on the board collider directly beneath it, respecting
  raised platforms, openings, board transforms, and the bare table outside the board.
• Keep the clipped-corner amount visible after number inputs receive their stepper wrappers.
• Keep stand/lay-flat self-righting and dragging height independent of custom collider child
  offsets, including single-shape custom layouts, while preserving legacy flat-collider behavior.

Open Tabletop 0.17.0

Added

• Show a bottom-left desktop control guide for hovered and held table pieces and private-hand
  cards, listing the gestures and keyboard actions available in the current context.
• Let custom 3D objects declare an N×N grid footprint so large-base pieces align across multiple
  square cells during live dragging, release, and settle/pin while remaining centered on hexes.
• Add a GM-only, device-local physics diagnostic that draws the current collider around every
  synchronized piece, including live deck and dispenser sizes.
• Add npm run assets:colliders to measure registered bundled GLBs, report suggested collider
  half-extents/scales, and optionally validate authored registry values with --check.
• Let room owners and GMs preview and apply synchronized table lighting with a draggable shaded
  globe, presets, directional and ambient colors/intensities, and shadow softness. Owners can save
  or factory-reset the durable room default, while library scenes may optionally include lighting.
• Let admins attach finite or infinite dispensers to uploaded custom objects, choosing an automatic
  visible stack, a generic container, or a second uploaded model. Custom pieces retain a
  server-authored asset snapshot so matching color/finish variants can be gathered and absorbed
  without allowing ad-hoc dispenser definitions.
• Let uploaded object and custom-dispenser models target one named GLB material for recoloring and
  finishes, preserving all other baked textures; the editor discovers material names from the GLB.
• Cover room entry with a Loading Table screen until synchronized pieces, visual assets, and the
  first complete rendered frame are ready, preventing large tables from visibly popping into place.
• Let uploaded custom 3D objects choose a default shared material during creation and change it
  later from the Inspect panel, while preserving compatible authored GLB texture maps and supplying
  procedural UVs when needed.
• Let built-in pipped GLB dice and modeled dispensers use standard material finishes during Inspect,
  while retaining independently colored pips and named tint slots.

Changed

• Replaced various built-in assets with new/custom built 3D models. Updated credits as needed.
• Preserve authored GLB color and normal maps when tinting built-in pieces and modeled dispensers,
  including chips, coins, chess pieces, and Go bowls.
• Preserve authored color textures, normal maps, and roughness when tinting the built-in pouch's
  bag and drawstring materials on spawned decks.
• Let WASD and the arrow keys pan the desktop camera relative to its current view whenever their
  contextual held-piece or selection action does not apply.
• Recalibrate the bundled chess/checkers and Go boards to their retuned model scales, measured
  collider bounds, and printed playing-grid spacing.
• Increase generated die and board texture resolution and widen the table camera field of view.
• Move the default player-seat camera closer to the table, and let the High graphics tier use
  sharper procedural card art plus larger cached derivatives for uploaded card images.
• Enlarge private-hand cards on touch layouts and reduce the Inspect control's share of each card,
  providing a much larger surface for dragging cards onto the table.

Removed

• Remove the bundled train piece and train dispenser from the built-in object catalog; their
  historical changelog and roadmap entries remain as the record of the earlier feature.

Fixed

• Prevent OrbitControls from throwing when a pointer lifts while an untracked mouse pointer
  remains on the canvas, and prevent a first touch tap from counting as a double-tap soon after
  page load.
• Align the poker-stack collider test with the resized built-in poker-chip model.
• Make small tabletop pieces easier to grab on touch screens with invisible screen-space hit
  padding, keep held pieces visible above the fingertip for precise placement, and keep
  deck/dispenser movement tracking after choosing Move from a long-press menu.
• Align the Go-board calibration regression test with its authored 0.41 × 0.41 cell spacing.
• Load saved card-library preview images from standard-size WebP derivatives instead of the full
  uploaded source files.
• Honor the configured collider primitive for built-in modeled dispensers in both server physics
  and the local collider diagnostic overlay.
• Keep the custom-object library renderable when legacy assets omit optional model metadata.
• Keep both buttons visible on custom-dispenser scale steppers and give library quantity fields
  enough width to display multi-digit values.
• Delete custom dispenser configurations from their library view without deleting the associated
  custom object or its primary 3D model.
• Export the custom-object lookup through the production database facade so saved models and their
  authored dispensers load correctly, omit undefined Three.js material options from previews, and
  decode mixed-back deck entries before using their first card as a thumbnail URL.
• Preserve the remaining inventory of finite dispensers across manual table-state saves and room
  shutdown/re-entry, including gathered stacks above the normal single-spawn limit.
• Keep the WebGL canvas hidden until the synchronized table and player-seat camera are both ready,
  preventing the bootstrap camera angle from flashing during room entry.
• Use center-based escape detection on rectangular tables while retaining footprint-aware checks
  for shaped surfaces, preventing valid edge placements from repeatedly triggering recovery.

Security

• Run the Docker container as a non-root user (appuser) instead of root, limiting the impact if an attacker gains access to the container.

Open Tabletop 0.16.0

Changed

• Replaced 'train_dispenser' model with custom-built one.
• Let every bundled object use the shared matte, satin, glossy, metallic, brushed, pearl,
  translucent, glow, and marbled material system through definition flags in shared/pieces.js,
  with synchronized per-object material overrides available from the inspect panel.
• Replace the bundled coin and Go-bowl meshes with original project models, retune their rendering,
  material-slot, and collider metadata, refine the poker-chip collider, and use the enlarged low-poly
  bag plus its matching collider for the built-in domino, Wordy, and Mahjong inventories.
• Add an admin-triggered, background texture-cache prebuild that generates missing display-sized
  WebP copies for random-name JPG and PNG uploads while preserving every original and library
  reference. Existing derivatives are skipped and live progress is reported in the admin console.
• Reuse immutable card and tile geometry by dimensions during browser hydration instead of
  repeatedly triangulating identical pieces. Cache random-name uploaded assets immutably and
  bundled Mahjong faces for repeat room entries, reducing large double-sided tile load stalls.
  Serve existing uploaded card and tile art through persistent, display-sized WebP derivatives,
  preserving the original files while reducing cold-room transfer and image-decode cost. The
  server runtime minimum is now Node.js 20.9 so this pipeline can use the patched Sharp release;
  the production container already uses Node.js 22.

Fixed

• Recover fallen and perimeter-stranded pieces against the table's actual playable shape and the
  body's current footprint, preventing objects from remaining outside shaped tables or resting on
  the invisible containment-wall ring after a table resize.
• Keep deck-count rendering attached to the current mesh after an open deck rebuilds its visible
  cover, preventing later deals from showing a stale full-height stack that clips through the table.
• Keep the bootstrap table mesh hidden until the joined room's synchronized shape, size, felt,
  rim wood, and grid are applied, preventing a rectangular mahogany flash on refresh or re-entry.

Security

• Recheck live authorization after asynchronous library/member reads before changing the table,
  kicking members, changing roles, or delivering privileged data. Revocation/demotion also
  prevents a pending mat save from spawning onto the table.
• Override transitive qs to 6.16.0 to address GHSA-x5fp-wj9c-mxmx and
  GHSA-4mjr-xmp4-gh2g while retaining the existing Express and body-parser versions.
• Enforce the 250-piece limit at the creation boundary and before hand/dispenser consumption,
  inspected-card placement, and library spawns. Rejected placements preserve inventory; library
  loads recheck capacity after database reads. Existing boards can still be replaced at capacity.
• Reject drag and hand-placement coordinates outside a generous world envelope, including huge
  finite numbers. Check group destinations and derived drag velocities before passing them to physics.
• Bind table and waiting-lobby authorization to the room being joined, preventing a direct
  room-ID join from borrowing membership or owner privileges from another room code.
• Apply room kicks and role changes to every connection for the affected user in that room,
  including connections awaiting reconnection. Roles in other rooms remain unchanged.
• Disconnect matching live sessions after logout, logout-all, site-admin changes, and account
  deletion. Logout targets the current login token; logout-all and admin changes apply across
  devices, tables, editors, and waiting lobbies. Reconnection rechecks current session validity
  and room access, and revoked clients cannot dispatch queued game messages.
• Revalidate connected sessions every 30 seconds to catch session expiry and administrative
  changes made outside the web application, including the admin CLI. Failed authorization
  checks disconnect affected sessions rather than retaining cached privileges.

Internal

• Extract post-step table/tray escape recovery and synchronized transform publication into
  server/game/physics-update.js, leaving TableRoom.update as the explicit coordinator around
  inspection recovery, motion preparation, world stepping, and performance profiling.
• Extract the ordered pre-step physics passes for held-piece servoing, self-righting, snap-pin
  maintenance, and scripted flips into server/game/physics-update.js, leaving recovery,
  simulation stepping, out-of-bounds rescue, and transform publication in TableRoom.update.
• Extract synchronized transform publication, snapped-piece pin/unpin transitions, and snap intent
  checks into server/game/placement-operations.js, preserving the existing TableRoom methods
  and physics-loop ordering.
• Extract deck and finite-dispenser collider rebuilding into
  server/game/collider-maintenance.js, preserving shared card/tile geometry, modeled deck boxes,
  visible stack-height caps, and the existing TableRoom methods.
• Extract authoritative piece creation, complete removal bookkeeping, capped release/snap behavior,
  and deck/dispenser absorption into server/game/piece-lifecycle.js, retaining the existing
  TableRoom API and physics/collider contracts.
• Extract table-deck saving and authorization-safe asset-list delivery into
  server/game/library.js, and membership-list/lobby coordination into
  server/game/member-service.js, retaining the existing room and handler contracts.
• Extract authoritative recoloring and stand-mode policy into server/game/piece-operations.js,
  and dispenser item/inventory behavior into server/game/dispenser-operations.js, while retaining
  the existing room-facing contracts used by handlers and physics.
• Extract measurement-scale snapshots, validated restoration, and board grid calibration into
  server/game/table-scale.js, retaining the room's existing persistence and starter interfaces.
• Extract personal dice-tray physics and lifecycle operations into server/game/trays.js,
  retaining shared geometry, seat ownership, resize repositioning, scene restoration, and
  disconnect cleanup behind the existing room methods.
• Extract physical table floor and containment-ring construction into
  server/game/table-bounds.js, retaining shared shape outlines, live resize cleanup,
  collision behavior, and personal-tray rebuilding.
• Extract starter-game layout orchestration into server/game/starters.js, retaining shared
  starter definitions, injected deck builders, reset ordering, grid calibration, initial dealing,
  and piece-capacity behavior.
• Extract synchronized Colyseus state classes and field declarations into
  server/game/schema.js, preserving defaults, collection types, reflection order, and the
  entry point's deliberate encoder buffer configuration.
• Record the remaining server/client DRY cleanup sequence, scopes, and validation in
  docs/DRY_CLEANUP.md.
• Document the extracted deck builders, inventory metadata, and injected shuffle ownership
  in the reference and architecture guides.
• Extract standard playing-card, domino, letter-bag, and Mahjong inventory builders into
  server/game/deck-builders.js, retaining the shared shuffle routine and existing spawn/starter behavior.
• Document shared table-card placement and the compatibility rules used by both Combine
  and drop-on-deck absorption, including preservation of rejected cards.
• Consolidate hand, deck-draw, inspection, and recovery table-card creation in spawnTableCard.
  Share face visibility and double-sided orientation rules while preserving caller-owned
  capacity checks, inventory handling, positioning, and physics/grid placement.
• Document missing-deck inspection recovery, capacity retries, durable recovery cards,
  and current-turn identity preservation during reconnection.
• Document authorization rechecks across asynchronous library/member operations, protected
  response delivery, and the boundary for already-submitted database writes.
• Document the patched qs override, its advisory coverage, and dependency-audit commands.
• Document table shape and rim-wood restoration from durable room settings without a scene snapshot.
• Document account-deletion ownership release, asset visibility preservation, and database
  rollback behavior in the reference and architecture guides.
• Document shared card-transfer helpers, deck metadata preservation, inspection ordering,
  and Combine compatibility rules in the reference and architecture guides.
• Document the pushed account-hand preservation and durable Save acknowledgment behavior.
• Document empty/hand-only snapshots, pending-turn preservation, and shared reset cleanup
  in the reference and architecture guides.
• Document piece-capacity enforcement, movement safety, and rejected-placement UI recovery
  in the reference and architecture guides.
• Extract hand/dispenser placement handlers and shared piece-capacity/physics-safety helpers, with
  regression tests for full tables, retained inventory, concurrent library loads, and numeric overflow.
• Centralize live authorization and reconnection tracking in server/room-access.js, with
  regression tests for room isolation, multiple tabs, revocation races, and HTTP revocation hooks.
• Record the commit/push, change-summary, and documentation-update workflow in AGENTS.md.
• Update the reference and architecture documentation for the pushed room-authorization and
  access-revocation changes.
• Document the pushed asset-cleanup reference sources, disposal handling, and file-retention rules.
• Extract asset cleanup into server/asset-cleanup.js with temporary-file and PostgreSQL
  regression coverage. File categories use the upload allowlist; database references use the
  existing asset-table registry in a single consistent query.

Fixed

• Apply the same card compatibility rules to drop-on-dec...

Open Tabletop 0.15.0

Added

• Table shapes. The play surface is no longer only a rectangle. In Customize Table pick a
  Shape — Rectangle, Round, Oval, Hex, or Rounded — and the felt, the physics
  rim your pieces bump against, and the grid all take the new outline; round and hex are a single
  Size (depth follows width). It's GM-set and durable: the shape survives a reload and rides
  along in saved scenes. Seats, hand-fans and personal dice trays all carry over to the new shapes
  as-is. Every table also gets a wooden rim around the edge that follows the shape, in five
  woods (Mahogany/Walnut/Birch/Green/Oak) the GM picks in Customize Table and saves with the
  room; and the felt is now a subtle fabric texture that still takes your felt colour.
• Hex grids. The table grid can now be hexagonal, not just square. In Customize
  Table → Grid, set the cell shape to Hex, pick pointy-top or flat-top, and choose a
  hex size — or place a board and use Fit to board to size the hexes to how many go across
  it. Pieces with snap turned on (G) snap to hex centres, and the drawn grid matches;
  switching pointy↔flat reorients both at once. Offset, line colour, height and hide-the-lines
  all work exactly as they do for the square grid. Snapping and the rendered grid run the same
  hex math on client and server, so a piece lands where the grid shows it.
• Multi-select composition — build one thing out of many. With a clump selected, two new
  buttons turn the selection into a construction tool. Combine consolidates loose cards and
  whole decks together into a single face-down deck at the group's centre — the card sitting on
  top of the table ends up on top of the deck — so you can sweep a discard pile back onto its
  deck, merge two decks, or gather scattered cards into one, all in a click. It only combines
  cards and decks that share a back and shape; a mismatched selection greys the button out rather
  than half-doing it. Gather is the same idea for dispensers and their pieces, and reads what
  you've selected: pick two or more like stacks and it merges them into one (the counts add
  up, even past a single stack's normal cap); pick a stack plus a handful of the loose pieces it
  hands out and it pours them back in; pick just the loose pieces — poker chips, coins, trains,
  go stones — with no stack among them and it mints a new dispenser from them. Both buttons
  appear only when the selection can actually be composed, so they stay out of the way until
  they're useful, and they work the same by touch. All of it is one physical move on the server —
  read the pieces, remove them, drop the new combined piece in their place — so it stays in sync
  for everyone with no new bookkeeping.
• Double-sided tiles. A card or deck can be made 2-sided — both faces are real art, and
  flipping turns the tile over between them instead of hiding one. Select a card (or open a
  deck's right-click menu) and hit 2-Sided; the button reads Secret once it's on, to turn
  it back into an ordinary hidden-face card. A 2-sided deck deals its tiles face-down like any
  deck — you see the back, and a flip reveals the front — and the tile keeps both faces the whole
  time, so picking one up shows its front in your hand and playing it back down lands it the way
  you meant. Under the hood a deck's cards can now each carry their own back image (not just
  one shared back for the whole stack), which is what will let a single pile mix tiles with
  different backs. Also on the deck menu: Peek at top card, the same private draw-to-inspect
  you already get by double-clicking a deck.
• Upload your own double-sided tile sets. A new Double-Sided Tiles tab under Add to
  Library builds a set from your images: drop in the fronts (face 1) and, optionally, the
  backs (face 2, one per front in the same order — or leave them off to share one back), an
  optional stack cover, and choose a physical size, thickness, and shape. Save it to your
  library and it spawns as a face-down draw pile of double-sided tiles you flip to turn over — each
  tile keeping its own back, so one pile can mix different backs (a tree back among forageable
  backs) — including when you draw a tile part-way out and drop it back onto the pile. Tuned for
  small tiles out of the box.
• Conceal a tile set in a drawstring pouch. The Double-Sided Tiles tab has a new
  Concealment choice: leave the stack Open, or drop it into a Pouch — a low-poly
  drawstring bag that hides the stack, so shuffling and drawing off the top plays like reaching
  into a bag. The sack body and the drawstring recolor independently (two color pickers appear
  when you pick Pouch), and both come back when you edit the set later. The pouch rests on its flat
  side on the table.
• A tile set's stack cover follows its top tile. An open set no longer shows one frozen cover
  image forever. Its visible top face now tracks the current top tile's own back and repaints
  as the top changes — every draw, shuffle and split — so a pile of tiles that each have a
  different back (the Stardew fish tiles) shows a real card on top instead of a generic
  placeholder. Concealed (non-open) decks never reveal a top this way, and a pouch hides the top
  entirely.
• Player mats — a surface your pieces sit on. A new Player Mats tab under Add to Library
  turns an image into a large, flat, single-faced board that tiles and pieces physically rest
  on — the per-player profession mats a game like Stardew Valley hands out. Upload the art, name
  it, pick a size, and Save (or Save + Spawn); it lands as a big slab you drag in front of
  whichever player you like, and saves to your library to reuse in every room. A mat drags to
  reposition but is otherwise inert — no flip, no take-to-hand, no flinging it across the table —
  and it's heavy and lies flat, so a stack dropped on it settles on top instead of shoving it
  around. It's its own piece (not the table board), so every seat can have one at once.

Open Tabletop 0.14.0

Added

• Dice finishes. A die is no longer just a color — it now carries a surface finish laid over
  that color, chosen from the new Finish button in the dice tray (for every die you own at
  once) or a single die's inspector. Matte, Satin and Glossy walk from flat to a hard
  specular highlight; Metallic turns the die to tinted metal that picks up the room around it,
  keeping the die's own hue in the reflection rather than going chrome. Pearl adds a soft
  clearcoat sheen, and Marbled is a procedural D&D-resin look — domain-warped veins of varying
  thickness whose color adapts to the die, dark veins on a light body and light veins on a dark
  one, so no two faces read the same. Translucent lets a little light through, Glow makes
  the die emit its own color in a dim scene, and Brushed is directional metal. The finish
  rides along with the die everywhere — spawns, recolors and the roll all carry it, and it is
  saved as your per-die default.
• Finishes degrade instead of crashing on low-end phones. The physical, transparent and
  roughness-map shaders behind Brushed, Translucent and Pearl black-screen some Android GPUs, so
  on a phone the renderer quietly substitutes a safe look — Brushed becomes Metallic, Translucent
  becomes Satin, Pearl becomes Glossy — and the picker hides those three options entirely. The
  swap happens at mesh-build time no matter who set the finish, so a die another player made
  Brushed still renders on the phone. Tablets and desktops show the real thing.
• Custom dice textures. Beyond the built-in finishes, a host can upload their own seamless
  image and wear it as a die's surface. Add it under the editor's Add to Library → Dice
  Textures, where it lands in a reusable library alongside decks and skyboxes — so it carries
  across rooms and can be published to the whole table — then reach it from the new Custom
  button, a sparkle-marked menu of its own next to the finishes, on a single die in the inspector
  or across every die in the dice box. The picker shows textures as bare thumbnails (the name is
  the tooltip) so a large collection stays readable. The image wraps the die over triplanar UVs
  like Marbled, and on a d6 the number stays legible on top of the art; because it is a plain
  image map it renders on phones too. The chosen texture rides with the die everywhere and saves
  as your per-die default.
• Pipped d6 dice. Two built-in dice join the numbered set — Rounded Pips and Square
  Pips — real 3D models with recessed dots instead of printed numbers. Add them from the dice
  box's Add menu or the library's built-in Dice tab. They colour exactly like the other dice: the
  body takes your die colour and the pips take your number colour, so a dice set or the inspector
  recolours both at once. Under the hood they are a normal d6 — same size, same physics, read by
  eye like any die — just a different mesh, so they roll in the tray and tumble on the table like
  the rest.