What's New

• Fixed assignment reconciliation dropping an update when an SSE-triggered live-state fetch was already in flight. Live-state refreshes now queue one follow-up pass instead of silently discarding concurrent mutations.
• Assignment AJAX responses now include the canonical committed lobby state and apply it immediately in the initiating browser. Unassign therefore changes the card to Unassigned without waiting on SSE.
• Added semantic slot_assignment lobby events in addition to the general mutation dispatcher.
• Lobby owners, Hosts, and Admins can now remove registered users and guests from the participant pool.
• Removing a participant clears their individual slot assignments but leaves lobby-owned/shared slots untouched.
• A removed participant's already-open lobby page receives participant_removed over SSE and immediately navigates back to the lobby list. Live-state 401/403 responses also redirect as a fallback if the removal event was missed.
• The lobby owner cannot be removed from their own lobby.
• Participant cards expose the Remove control only to lobby managers and only when the participant is eligible for removal.

• Curator/Admin can now enable or disable installed YAML templates without deleting or modifying the generated template itself.
• Disabled state is stored in APLobby's database and survives APWorld/template regeneration.
• Normal members no longer see a Create YAML action for disabled templates and cannot open or POST the options editor for them.
• Existing YAML profiles created from a template are not affected when that template is disabled.
• Game pages show a clear Template disabled by curator badge to members.
• Curator/Admin game pages include an Enable Template / Disable Template button.
• /templates is now a Curator/Admin template-curation panel showing enabled/disabled state; ordinary members continue to be sent to the game-first Library flow.
• Game Library cards hide disabled-template badges from normal members while Curator/Admin see template disabled for curation visibility.

• Slot assignment no longer navigates/reloads the entire page after a drag, tap-assignment, Lobby assignment, or Unassign action.
• Added a server-side lobby mutation dispatcher and per-lobby Server-Sent Events stream.
• Open lobby builders now listen for lobby changes and reconcile participant membership and slot assignments in place, keeping multiple viewers on the same lobby state.
• Registered-user and guest joins, leaves, assignment changes, guest-access changes, and other successful lobby POST mutations notify connected lobby pages automatically.
• Participant cards, assignment counts, shared-slot labels, check status text, and Start Lobby readiness update without losing the viewer's scroll position.
• Structural changes such as adding/removing an entire YAML slot use a scroll-preserving refresh rather than trying to surgically rebuild an unknown card layout.
• Added a stable custom drag ghost and drag-state cleanup to reduce native browser layout/scroll jank.
• Guest assignment UI now uses a one-way public assignment reference instead of exposing the guest session token in lobby HTML or live-state JSON.
• Added an internal aplobby:lobby-state browser event after reconciliation so future UI components can subscribe to lobby state changes without coupling directly to the SSE transport.

Lobby signup and assignment

• Added registered-user lobby signup with a persistent participant pool.
• Lobby owners are automatically participants; existing owners and assigned players are backfilled during upgrade.
• Guests and registered users appear together in the participant pool.
• Replaced the normal all-users assignment dropdown with participant cards. Hosts can drag a participant onto a slot, or tap a participant then tap a slot on touch devices.
• Assignment now accepts only users/guests who joined that lobby.
• Participants can leave a draft lobby when they are not currently assigned to an individual slot.

Lobby-owned / shared slots

• Any slot can now be assigned to Lobby (shared) instead of one user.
• Shared slots count as assigned for Start Lobby.
• Every lobby participant can open the shared slot tracker, download its slot artifacts, view setup resources, and request item reissues.
• Discord companion announcements ping all linked lobby participants when the room contains a shared slot.
• Multiworld and live-room displays explicitly label shared slots as lobby-owned.

Game resources and setup

• Curator/Admin game pages now have a versioned Downloads & Resources manager.
• Resources support title, version, platform, required/optional state, description, SHA-256 storage identity, and files up to 128 MB.
• Uploading a new resource with the same title archives the previous active version rather than overwriting history.
• APLobby stores resources as downloads only; it does not extract or execute uploaded game files.
• Game pages now show the Quick Setup Guide and active Downloads & Resources.

Run snapshots

• Start Lobby snapshots the game setup notes and exact active resource versions for every slot.
• Live slot pages expose the snapshotted quick setup guide, room connection details, required/optional downloads, generated player files, and received-item history in one place.
• Resource snapshots keep old runs pointed at the versions they started with even after a newer game resource is published.

• Browser navigation to a deleted or otherwise missing APLobby page now redirects to the homepage with a short notice instead of stranding the user on a raw 404.
• The fallback applies only to normal GET/HEAD HTML page navigation.
• API-style requests, downloads, Server-Sent Events, static/media requests, and mutation requests still receive real 404 responses so missing resources are not silently hidden from code or diagnostics.
• This specifically cleans up the common case where a room or lobby is deleted while another participant still has that page open and later refreshes it.

• Added Admin Delete user with typed username confirmation.
• User deletion cannot target the currently signed-in admin and is blocked while the target is involved in active lobby generation/hosting work.
• Deleting an account preserves APLobby history instead of cascading it away: owned YAML profiles, lobbies, lobby presets, and generation ownership transfer to the deleting administrator; player display attribution is snapshotted before the account reference is cleared.
• Added immutable snapshot_player_name backfill for existing lobby slots so deleted accounts do not erase historical player labels.
• Fixed simultaneous lobby starts racing for the same room port. starting and running room rows now reserve their ports before MultiServer binds.
• Port availability now checks the configured room bind interface and the operating system, not only 127.0.0.1.
• Added a partial unique SQLite index preventing two active room records from owning the same TCP port.
• Room startup failures now leave the room as failed and the lobby as start_failed, allowing an immediate Restart Room recovery instead of leaving a fake hosting state.
• On APLobby restart, stale starting/hosting lobbies are reconciled to stopped.

• Live Activity is now sanitized for every viewer, including Host/Admin. Unredacted diagnostics remain confined to the Host/Admin-only Raw Server Output pane.
• Fixed deathlinkipelago.apworld and similar filenames being copied into Live Activity merely because their path contained the substring deathlink.
• Added UNC-path redaction to the runtime sanitizer in addition to Archipelago/workspace/home/temp roots and arbitrary local drive paths.
• Participant-safe Server Feed behavior is unchanged: non-managers continue to receive sanitized server output.

• Fixed the per-slot tracker crashing with AttributeError: 'str' object has no attribute 'query'.
• The Received Items loop no longer shadows aiohttp's request object with the HTML for the item-reissue form.
• Caddy context canceled warnings for /room/.../stream and /activity-stream may still appear when a browser leaves a live room; those SSE disconnect messages are expected and are not the slot-tracker failure.

• APLobby is now the authoritative room dashboard for checks, goals, DeathLinks, received-item history, files, live activity, and server output.
• APLobby-created rooms no longer attach the Discord bot as an Archipelago tracker. Discord is reduced to a companion thread, room link, linked-player mentions, room lifecycle notices, and DeathLink voice meme audio.
• Admin lobby deletion now closes the Discord companion thread and also cleans up legacy tracked bot runs when present.
• Hosted MultiServer processes now keep stdin open so APLobby can execute the room's native administrative /... commands directly.
• Host/Admin room console exposes an allow-listed subset of MultiServer commands; item-mutating commands require the independent Item Approval capability.
• Native APLobby tracker sockets now request DataPackages and full ReceivedItems history so each assigned player can inspect their own received-item list.
• Players and guests can request an item Reissue; Item Approvers can approve/deny it, with approval issuing MultiServer's own /send command and recording an audit event. A reissue is a deliberate duplicate, not a passive Sync.
• Participant server output is sanitized to hide local Archipelago/workspace/home/temp paths and common password/token/authorization values. Host/Admin retain raw server output.
• Administrative server-command activity is hidden from ordinary participant activity feeds.
• Admin settings now expose the web bind host/port, public site URL, and Secure-cookie toggle as the foundation for reverse-proxied public hosting.
• Registered session cookies honor the Secure-cookie setting for HTTPS deployments.
• Item Approvers can access room item histories/approval queues without inheriting Host controls.
• Multiworld Tracker now includes DeathLink death counts plus total/progression/useful received-item counts.
• Discord launched by APLobby runs in companion-only mode and skips restoration of old saved tracker/dashboard runs.

• Fixed the 0.0.5.9 room-readiness probe producing 400 Bad Request entries in Archipelago MultiServer logs.
• Readiness now uses a valid WebSocket handshake instead of a bare TCP connection.
• Discord attach/reconnect skips its own readiness probe when the room worker has already marked the room running.
• This removes duplicate startup probes while preserving the protection against Discord racing MultiServer startup.

• Fixed Discord auto-attach/reconnect racing Archipelago MultiServer startup on Windows.
• Hosted rooms now remain in starting until their TCP port is actually accepting connections.
• The room event feed distinguishes process launch from a network-ready Archipelago room.
• Native tracking starts only after the room socket is ready.
• Discord fresh attach and restart reconnect now wait for room readiness and retry transient failures.
• A failed readiness wait records a clear timeout event instead of immediately producing a misleading connection-refused error.
• The deathlinkipelago.apworld missing-manifest warning remains an APWorld compatibility warning and is unrelated to room readiness.

• Administrators can permanently delete a lobby from the lobby list or lobby page after typing its exact name.
• Deleting a lobby stops live room/generation processes first, cascades lobby database records, removes guest bindings/artifacts, and deletes that lobby runtime directory.
• Stop Room now places non-completed lobbies into a clear stopped state.
• Hosts can Restart Room from the same hosted-room record without regenerating the seed.
• Restart prefers the previous room port when still free and falls back to the configured port pool when necessary.
• Room logs append restart sections instead of being overwritten, and tracker connection state is reset when a room stops.
• Existing Discord bot runs are reconnected on restart when possible; APLobby falls back to a fresh attachment if the saved bot run is unavailable.

Performance

• Moved APWorld/template filesystem scans, manifests and template synchronization off aiohttp's event loop so the watcher can no longer freeze ordinary page navigation.
• Template mirroring now uses preserved file size/mtime metadata as the fast unchanged path and only hashes files when metadata differs.
• Warmed the template/game index during startup and rebuild it in the background after template changes instead of making the next Library request pay the parsing cost.
• Reworked the Library into batched metadata/profile queries instead of per-game N+1 SQLite queries.
• Game-card artwork now uses native lazy-loaded images, and off-screen cards use content-visibility: auto.
• Added a lightweight navigation progress indicator so a real request gives immediate feedback instead of looking like a dead click.

Guest participation

• Guests can join a lobby through an invite code/link and choose a temporary nickname.
• Guests may optionally provide a temporary Discord user ID so the Discord run thread can ping them.
• Guest Discord IDs cannot impersonate a registered profile or another active guest session.
• Guest identities are session-scoped and never create permanent APLobby accounts.
• Guests can upload validated temporary YAMLs and add them directly to a joined draft lobby.
• Guest YAMLs are copied into the lobby run workspace when attached, so normal temporary-file expiry cannot break a later generation.
• Guest slots count as assigned slots for Start Lobby.
• Hosts can enable/disable guest joining and see the lobby invite link/code from Slot Management.
• Joined guests can open the lobby, watch generation output, use the Multiworld/Sphere/slot trackers, watch live activity/server output, and download only their own slot-specific generated files.
• Temporary guest nickname/Discord identity is carried into slot display and Discord roster/ping mapping.
• Guests do not gain Library persistence, host controls, admin tools, or spoiler permission.

• Added an Admin-only Archipelago host.yaml options editor for the configured Archipelago installation.
• Parses the live comment-rich host.yaml into typed controls for booleans, numbers, documented enum-style choices, lists, mappings and nullable values.
• Uses host.yaml comments as inline documentation and recognizes documented minimum/maximum values where present.
• Visual saves patch values into the existing source so surrounding comments are retained instead of replacing the whole file with comment-free YAML.
• Creates a timestamped backup under workspace/backups/host-yaml/ before every visual or raw save.
• Refuses to overwrite host.yaml if it changed on disk after the editor was opened.
• Includes a raw YAML fallback editor with syntax validation.
• Warns when options.yaml exists beside host.yaml because modern Archipelago prefers that override.

• Restored the YAML Manager 4.7.2 template-schema editor as the authoritative APLobby options editor.
• Option controls now distinguish toggles, selects, bounded ranges, multi-selects, numeric fields, lists, mappings and weighted distributions.
• Bounded numeric options display their allowed minimum/maximum and provide preset, slider and numeric controls.
• Template comments/descriptions are restored beside their options instead of disappearing from clean saved YAMLs.
• Editing an existing YAML now overlays its clean values onto the current generated template schema, restoring option documentation and controls.
• Options from an older YAML that are no longer present in the current template are preserved explicitly and shown with warnings.
• Save Changes / Save as New Copy remain available from the visual editor.
• APLobby now watches the configured Archipelago installation for installed/updated APWorlds, regenerates template options automatically, mirrors the current generated template set into the Library, and removes stale templates for removed APWorlds.
• Admin now shows template watcher status and includes a manual Regenerate now fallback.
• Updating an existing YAML now correctly persists its selected visibility.

• Most non-interactive site chrome and decorative text now uses user-select: none so ordinary navigation does not accidentally highlight half the page.
• Selection remains enabled for form fields, logs, code/monospace values, activity feeds, server addresses, and explicitly copyable content.
• The site version badge is now clickable from every page and opens What's New.
• Added a built-in /changelog page that safely parses CHANGELOG.md into release cards, headings, bullet lists, bold text, and inline code.
• Raw HTML in the changelog is escaped rather than rendered.

• Added a live Generation Console directly to the lobby while Archipelago generation is queued/running.
• The lobby polls generation output every second and follows new lines without full-page reloads.
• Added a no-cache generation-status endpoint available to lobby participants.
• Python-based Generate.py launches now use unbuffered stdout so progress appears promptly instead of arriving in delayed chunks.
• The lobby automatically advances after generation completes or fails.

• Fixed replacement game card/banner artwork continuing to display the previous upload.
• New media uploads use content-versioned filenames instead of overwriting one stable URL.
• Existing 0.0.4/0.0.5 media paths receive a file-version query token, so existing workspaces get the cache fix immediately.
• The fix also applies to user avatar/banner replacement.

Lobby assembly

• Creating a lobby now enters the Library in lobby context.
• Added persistent Back to Lobby navigation while browsing games/YAMLs/editor pages.
• Added contextual quick-add YAML buttons on game cards.
• Added lobby-aware YAML add buttons on game pages and YAML profile pages.
• Creating a YAML through the template editor can save and immediately add it to the active lobby.
• Removed the normal dependence on a giant lobby YAML dropdown.
• YAML composition locks when a lobby starts; registered-user assignment remains editable live.
• Every slot must be assigned to a registered user before Start Lobby is enabled.

One-click room start

• Added normal-user Start Lobby orchestration.
• Start Lobby now chains isolated generation → artifact discovery → room launch → native tracker → Discord attachment.
• Added retryable failure states for generation/start failures.
• Added host retry path when generation succeeded but server launch failed/stopped.
• Existing lower-level generation/hosting endpoints remain for recovery/debug use.

Player file distribution

• Added generated artifact catalog.
• Discovers generation archives, .archipelago room seeds, spoiler logs, slot patches/player files, and shared output.
• Extracts distributable members from generated ZIPs using safe ZIP paths/size limits.
• Maps slot files using P<number> and generated-slot-name filename patterns.
• Assigned users can download their own slot files from Live Room/Slot Tracker.
• Shared/full generation archives remain host-side so one player cannot casually download everybody's patch bundle.

Live room and trackers

• Added Live Room dashboard for assigned users/owners/Hosts/Admins.
• Added SSE live server stdout stream.
• Added persisted structured room activity feed.
• Added native Multiworld Tracker view.
• Added per-slot tracker pages.
• Added Sphere Tracker view sourced from generated spoiler Playthrough data with item placements stripped.
• Added permission-gated generated Spoiler page/download.
• Added run activity entries for checks, goals, DeathLink, Discord attachment, and interesting server log lines.

Accounts / permissions / Discord identity

• Added per-user numeric Discord ID.
• Users can maintain their own Discord ID from profile settings.
• Admin can set/repair Discord IDs from user management.
• Discord IDs are prevented from being linked to multiple APLobby accounts.
• Added independent Spoiler permission.
• Role badges now show Spoiler and Discord-linked state.
• Completed-run game statistics now fall back to immutable lobby slot snapshots when original profiles no longer exist.

Discord integration

• APLobby-launched legacy supervisor now accepts a shared control token from the environment.
• Added authenticated bot control endpoint for posting a message into a tracked run's Discord thread.
• Hosted rooms automatically attempt to start/connect the retained Discord supervisor when configured.
• Bot automatically monitors the APLobby-created room using the first generated slot.
• APLobby posts the slot → registered user → game roster into the run thread.
• Linked assigned users are mentioned automatically.
• Hosted rooms retain bot run ID and Discord thread ID for room links/status.

Administration / destructive maintenance

• Added Admin-only Purge all custom YAMLs workflow.
• Requires exact PURGE YAMLS confirmation.
• Creates a SQLite backup and YAML-library ZIP backup before mutation.
• Purges profiles/versions/tags/featured YAMLs/presets and non-completed lobby slots.
• Preserves completed-lobby slot labels/stats and copies completed YAML snapshots into the run archive when available.
• Blocks purge while generated/starting/hosting/active rooms exist.

Database migration

• Added users.discord_id and users.is_spoiler.
• Added immutable snapshot metadata to lobby_slots.
• Added bot/thread references to hosted_rooms.
• Added generated_artifacts table.
• Added room_events table.
• Existing 0.0.4 and 0.0.1.1 workspaces upgrade in place.

Regression tests performed

• Python compile checks for APLobby, retained bot, and supervisor.
• Fresh 0.0.5 schema/route smoke test.
• Upgrade test against a 0.0.4 workspace containing 156 legacy-imported profiles and 6 lobby presets.
• Historical YAML Library.zip import remains 156 profiles + 6 presets; repeat import adds 0 duplicate profiles.
• Lobby-context navigation/quick-add/editor flow tested through the HTTP application.
• Player assignment gates Start Lobby as intended.
• One-click generation/host/tracker flow tested against stand-in Archipelago generator/server contracts.
• Generated ZIP artifact scan verified room seed, per-slot patch, and spoiler discovery/mapping.
• Native tracker verified check updates, goal, DeathLink, automatic lobby completion, and resulting user statistics.
• Admin YAML purge verified backups, draft-slot removal, completed-run snapshot preservation, and post-purge historical statistics.

• Added user profiles/personalization/run statistics.
• Added independent Curator/Host permissions and Admin user management.
• Replaced flat library with game cards, A-Z rail, game pages, artwork, descriptions, and featured YAMLs.
• Added registered-user lobby-slot assignment.
• Added isolated generation/self-hosting and basic native room tracker.
• Retained the existing Discord supervisor/bot stack alongside the site.

• Added Admin-only Legacy YAML Manager Import.
• Added preview/confirm workflow, backups, canonical filenames, idempotent old-profile mapping, and lobby-preset import.

• Isolated configurable workspace and external archipelago_dir.
• SQLite accounts/sessions.
• Guest temporary YAML validation.
• Persistent user-owned YAML profiles and immutable versions.
• Canonical naming, tags, template-backed options editor, and draft lobbies.