fix: keep canvas access and state consistent during live sessions

[beastyrabbit]

Note

🤖 GPT-6 responding on behalf of beastyrabbit

Live canvas sessions could retain revoked access, reload stale state, and miss owner policy changes. Media and dependency failures could also leave OBS blank or terminate the backend. This fixes the original project-review defects and ten follow-up findings, with regression coverage for the affected paths.

• Revoke connected collaborators and OBS credentials, serialize room admission and disposal, and persist snapshots through the PostgreSQL connection holding leadership.
• Apply YouTube policy to pasted URLs and existing standard embeds, including encoded URLs. Recover expired media URLs, failed player scripts and unavailable browser preference storage while preserving playback state.
• Contain WebSocket errors, reserve capacity for pending rooms, cancel stalled S3 requests and streams, and reject invalid upload capabilities before dependency work.
• Gate publication and Convex deployment on verification, fix rebuild/tag handling, isolate development database lifecycle, and improve retries, keyboard controls and test cleanup.

Local verification passes with 86 frontend tests, 40 backend tests including disposable PostgreSQL/WebSocket scenarios, and seven browser flows. Lint, formatting, application/test types, both production builds and compiled runtime URL checks pass. No PostgreSQL schema migration is needed.

Release 0.6.2 uses the existing homelab ARC runner and GHCR registry. The PR and release share a verification gate; successful verification precedes Convex deployment and publication of both images. GitHub Actions is enabled with approval required for all external contributors. Hosted verification and rollout are being checked before release. Real Clerk sign-in, Garage and third-party player playback are outside the local fixtures. Browser teardown logs an existing tldraw font-loading rejection after editor disposal; the tested user flows pass.

Two moderate advisories remain in unused Minio transitive paths without a compatible upstream fix; the backend README records the triage. Snapshot writes coalesce for 100 ms, so involuntary leadership loss can discard edits that have not persisted.

The animated local browser capture shows the running OBS mirror responding to an owner policy change. Its transparent background is composited over dark gray.

Collaborator keyboard selection and Twitch retry using local test identities:

YouTube recovery after a simulated script failure. The browser test clicks this button and verifies that a fresh script request creates the replacement player fixture.

[beastyrabbit]

Note

🤖 Claude Fable 5.1 responding on behalf of beastyrabbit

Review summary for PR 6

I read the full diff (excluding the lockfile) and left one inline comment per finding: 4 medium, 4 low, 1 nit. Nothing blocks merging on correctness of the live-session logic itself. The two I would fix before merge are the dropped initial room-config message (README promises reconnect delivery, which does not happen) and the pool-wide statement_timeout reaching migrations.

QA run on this branch (c02bb8c)

Run locally with Node 26.7.0 via fnm, against a disposable postgres:18.4-bookworm container.

Check	Result
biome lint . / biome format .	clean
tsc --noEmit (frontend, backend, backend tests)	clean
vitest run	16 files, 71 tests pass
backend node --test with CANVAS_TEST_DATABASE_URL	all pass, lifecycle group ran against real PostgreSQL (11.3 s)
playwright test	4 of 4 pass (1.4 min)
backend build, next build, test:runtime-config	pass

Observed during QA

• After the Playwright run, one user_fixture_* room remained in the test database and the upload temp dir was not removed. See the playwright.config.ts comment.
• The lifecycle test logs a full pg error object with stack when it terminates the leader backend. Expected for that test, but noisy in CI output.
• package.json pins node: 26.5.x and the frontend build warns on Node 24, so the verify workflows must keep node-version-file: .node-version.

Not exercised: the Forgejo verify job on the personal runner (see workflow comment), and multi-replica leader failover outside the single-process lifecycle test.