Open Tabletop 0.16.0

Changed

• Replaced 'train_dispenser' model with custom-built one.
• Let every bundled object use the shared matte, satin, glossy, metallic, brushed, pearl,
  translucent, glow, and marbled material system through definition flags in shared/pieces.js,
  with synchronized per-object material overrides available from the inspect panel.
• Replace the bundled coin and Go-bowl meshes with original project models, retune their rendering,
  material-slot, and collider metadata, refine the poker-chip collider, and use the enlarged low-poly
  bag plus its matching collider for the built-in domino, Wordy, and Mahjong inventories.
• Add an admin-triggered, background texture-cache prebuild that generates missing display-sized
  WebP copies for random-name JPG and PNG uploads while preserving every original and library
  reference. Existing derivatives are skipped and live progress is reported in the admin console.
• Reuse immutable card and tile geometry by dimensions during browser hydration instead of
  repeatedly triangulating identical pieces. Cache random-name uploaded assets immutably and
  bundled Mahjong faces for repeat room entries, reducing large double-sided tile load stalls.
  Serve existing uploaded card and tile art through persistent, display-sized WebP derivatives,
  preserving the original files while reducing cold-room transfer and image-decode cost. The
  server runtime minimum is now Node.js 20.9 so this pipeline can use the patched Sharp release;
  the production container already uses Node.js 22.

Fixed

• Recover fallen and perimeter-stranded pieces against the table's actual playable shape and the
  body's current footprint, preventing objects from remaining outside shaped tables or resting on
  the invisible containment-wall ring after a table resize.
• Keep deck-count rendering attached to the current mesh after an open deck rebuilds its visible
  cover, preventing later deals from showing a stale full-height stack that clips through the table.
• Keep the bootstrap table mesh hidden until the joined room's synchronized shape, size, felt,
  rim wood, and grid are applied, preventing a rectangular mahogany flash on refresh or re-entry.

Security

• Recheck live authorization after asynchronous library/member reads before changing the table,
  kicking members, changing roles, or delivering privileged data. Revocation/demotion also
  prevents a pending mat save from spawning onto the table.
• Override transitive qs to 6.16.0 to address GHSA-x5fp-wj9c-mxmx and
  GHSA-4mjr-xmp4-gh2g while retaining the existing Express and body-parser versions.
• Enforce the 250-piece limit at the creation boundary and before hand/dispenser consumption,
  inspected-card placement, and library spawns. Rejected placements preserve inventory; library
  loads recheck capacity after database reads. Existing boards can still be replaced at capacity.
• Reject drag and hand-placement coordinates outside a generous world envelope, including huge
  finite numbers. Check group destinations and derived drag velocities before passing them to physics.
• Bind table and waiting-lobby authorization to the room being joined, preventing a direct
  room-ID join from borrowing membership or owner privileges from another room code.
• Apply room kicks and role changes to every connection for the affected user in that room,
  including connections awaiting reconnection. Roles in other rooms remain unchanged.
• Disconnect matching live sessions after logout, logout-all, site-admin changes, and account
  deletion. Logout targets the current login token; logout-all and admin changes apply across
  devices, tables, editors, and waiting lobbies. Reconnection rechecks current session validity
  and room access, and revoked clients cannot dispatch queued game messages.
• Revalidate connected sessions every 30 seconds to catch session expiry and administrative
  changes made outside the web application, including the admin CLI. Failed authorization
  checks disconnect affected sessions rather than retaining cached privileges.

Internal

• Extract post-step table/tray escape recovery and synchronized transform publication into
  server/game/physics-update.js, leaving TableRoom.update as the explicit coordinator around
  inspection recovery, motion preparation, world stepping, and performance profiling.
• Extract the ordered pre-step physics passes for held-piece servoing, self-righting, snap-pin
  maintenance, and scripted flips into server/game/physics-update.js, leaving recovery,
  simulation stepping, out-of-bounds rescue, and transform publication in TableRoom.update.
• Extract synchronized transform publication, snapped-piece pin/unpin transitions, and snap intent
  checks into server/game/placement-operations.js, preserving the existing TableRoom methods
  and physics-loop ordering.
• Extract deck and finite-dispenser collider rebuilding into
  server/game/collider-maintenance.js, preserving shared card/tile geometry, modeled deck boxes,
  visible stack-height caps, and the existing TableRoom methods.
• Extract authoritative piece creation, complete removal bookkeeping, capped release/snap behavior,
  and deck/dispenser absorption into server/game/piece-lifecycle.js, retaining the existing
  TableRoom API and physics/collider contracts.
• Extract table-deck saving and authorization-safe asset-list delivery into
  server/game/library.js, and membership-list/lobby coordination into
  server/game/member-service.js, retaining the existing room and handler contracts.
• Extract authoritative recoloring and stand-mode policy into server/game/piece-operations.js,
  and dispenser item/inventory behavior into server/game/dispenser-operations.js, while retaining
  the existing room-facing contracts used by handlers and physics.
• Extract measurement-scale snapshots, validated restoration, and board grid calibration into
  server/game/table-scale.js, retaining the room's existing persistence and starter interfaces.
• Extract personal dice-tray physics and lifecycle operations into server/game/trays.js,
  retaining shared geometry, seat ownership, resize repositioning, scene restoration, and
  disconnect cleanup behind the existing room methods.
• Extract physical table floor and containment-ring construction into
  server/game/table-bounds.js, retaining shared shape outlines, live resize cleanup,
  collision behavior, and personal-tray rebuilding.
• Extract starter-game layout orchestration into server/game/starters.js, retaining shared
  starter definitions, injected deck builders, reset ordering, grid calibration, initial dealing,
  and piece-capacity behavior.
• Extract synchronized Colyseus state classes and field declarations into
  server/game/schema.js, preserving defaults, collection types, reflection order, and the
  entry point's deliberate encoder buffer configuration.
• Record the remaining server/client DRY cleanup sequence, scopes, and validation in
  docs/DRY_CLEANUP.md.
• Document the extracted deck builders, inventory metadata, and injected shuffle ownership
  in the reference and architecture guides.
• Extract standard playing-card, domino, letter-bag, and Mahjong inventory builders into
  server/game/deck-builders.js, retaining the shared shuffle routine and existing spawn/starter behavior.
• Document shared table-card placement and the compatibility rules used by both Combine
  and drop-on-deck absorption, including preservation of rejected cards.
• Consolidate hand, deck-draw, inspection, and recovery table-card creation in spawnTableCard.
  Share face visibility and double-sided orientation rules while preserving caller-owned
  capacity checks, inventory handling, positioning, and physics/grid placement.
• Document missing-deck inspection recovery, capacity retries, durable recovery cards,
  and current-turn identity preservation during reconnection.
• Document authorization rechecks across asynchronous library/member operations, protected
  response delivery, and the boundary for already-submitted database writes.
• Document the patched qs override, its advisory coverage, and dependency-audit commands.
• Document table shape and rim-wood restoration from durable room settings without a scene snapshot.
• Document account-deletion ownership release, asset visibility preservation, and database
  rollback behavior in the reference and architecture guides.
• Document shared card-transfer helpers, deck metadata preservation, inspection ordering,
  and Combine compatibility rules in the reference and architecture guides.
• Document the pushed account-hand preservation and durable Save acknowledgment behavior.
• Document empty/hand-only snapshots, pending-turn preservation, and shared reset cleanup
  in the reference and architecture guides.
• Document piece-capacity enforcement, movement safety, and rejected-placement UI recovery
  in the reference and architecture guides.
• Extract hand/dispenser placement handlers and shared piece-capacity/physics-safety helpers, with
  regression tests for full tables, retained inventory, concurrent library loads, and numeric overflow.
• Centralize live authorization and reconnection tracking in server/room-access.js, with
  regression tests for room isolation, multiple tabs, revocation races, and HTTP revocation hooks.
• Record the commit/push, change-summary, and documentation-update workflow in AGENTS.md.
• Update the reference and architecture documentation for the pushed room-authorization and
  access-revocation changes.
• Document the pushed asset-cleanup reference sources, disposal handling, and file-retention rules.
• Extract asset cleanup into server/asset-cleanup.js with temporary-file and PostgreSQL
  regression coverage. File categories use the upload allowlist; database references use the
  existing asset-table registry in a single consistent query.

Fixed

• Apply the same card compatibility rules to drop-on-deck absorption and Combine. Reject
  mismatched geometry, tile types, visibility, snap settings, and normal-card backs without
  consuming the card. Compatible open sets still preserve individual backs.
• Preserve current turn ownership in saves during the player's reconnect window by falling
  back to the retained account identity when their live client is unavailable.
• Recover inspected cards onto the table when their source deck disappears, including on
  disconnect. Preserve card faces and geometry; keep normal fronts private. Full tables retain
  pending cards for retry, and snapshots preserve orphaned inspections across reloads.
• Load saved table shape and rim wood from the room row, preserving non-default choices
  even when no scene snapshot is present. Add PostgreSQL round-trip regression coverage.
• Allow account deletion for owners of every registered library asset category, including
  scenes, skyboxes, dice, and mats. Release ownership within the existing transaction while
  preserving asset records, content, and public/private visibility; failures roll back all changes.
• Preserve double-sided card flags when taking groups, and deck skins, tints, geometry,
  snap behavior, and individual card backs across splits, combinations, and scene saves.
• Keep the top table card on top of a combined deck and restore inspected cards at the
  drawing end in their original order. Inspection returns on disconnect retain per-card backs.
  Combining refuses mixed visibility/snap behavior and decks with active private inspections.
• Preserve all same-account cards across multiple tabs, pending hands, saves, and disconnects.
  Retain hand ownership during reconnection; restore cards with fresh hand IDs to avoid collisions.
  Live hands remain separate per tab; saved/unclaimed cards combine per account for reclamation.
• Acknowledge manual Save only after its database write succeeds; report failures to the caller.
  Serialize room writes in request order with independent snapshots so older background saves
  cannot overwrite newer checkpoints, and allow later saves to recover after a failed write.
• Save hands-only and empty games when a room closes, replacing stale populated snapshots.
  Preserve pending turn ownership when saving a game before its owner returns.
• Clear pending/unclaimed hands, active and pending turns, group drags, and undo bookkeeping
  with table resets, starter changes, and scene loads. Reset invalidates the old checkpoint;
  scene loading replaces it with the loaded scene. Room settings and personal notes remain intact.
• Restore the hand immediately when a card drag ends, including plays rejected at table
  capacity. Rejected plays resend the unchanged private hand so it remains visible and usable.
• Protect referenced mat files, saved room snapshots (including soft-deleted rooms), and private
  deck/hand data from orphan cleanup. Scan drafts, pending inspections, unclaimed hands, live
  reveals, and in-memory saved snapshots as well as synchronized state.
• Retain live-room references across the cleanup database read and through final room-save
  completion. Reference-scan failures abort cleanup; recent files and symlinks are not swept.