WIP checkpoint: T2.1: Backend — Script Model & CRUD Endpoints

2026-08-19 15:09:42 +00:00
138 changed files with 169 additions and 11759 deletions
@@ -1,39 +0,0 @@
-name: checkpoint
-
-# Runs the full checkpoint suite (migrations, backend pytest, Godot smoke
-# tests, multiplayer, fresh-clone boot) on every push and PR.
-#
-# Runs on a `host`-label act_runner on the AGP box: Docker, ~/godot/godot,
-# and Python 3 are already there. Deliberately uses no JavaScript actions
-# (actions/checkout etc.) so the host needs no Node install -- checkout is a
-# plain git clone from the local Gitea. See docs/ci.md.
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-
-jobs:
-  checkpoint:
-    runs-on: host
-    steps:
-      - name: Checkout
-        run: |
-          set -eu
-          rm -rf repo && mkdir repo && cd repo
-          git init -q
-          git remote add origin "http://x:${{ github.token }}@localhost:3000/${{ github.repository }}.git"
-          git fetch -q --depth 1 origin "${{ github.sha }}"
-          git checkout -q FETCH_HEAD
-
-      - name: Python env
-        working-directory: repo
-        run: |
-          set -eu
-          python3 -m venv .venv
-          .venv/bin/pip install --quiet --upgrade pip
-          .venv/bin/pip install --quiet -r backend/requirements.txt
-
-      - name: Checkpoint suite
-        working-directory: repo
-        run: .venv/bin/python scripts/run_checkpoint_tests.py --postgres-port 25690 --backend-port 18690
@@ -8,7 +8,3 @@ export/
 # OS
 .DS_Store
 Thumbs.db
-
-# Godot UID files (regenerated from path)
-*.uid
-assets/build_info.json
@@ -1,42 +0,0 @@
-[remap]
-
-importer="scene"
-importer_version=1
-type="PackedScene"
-uid="uid://bm01jsuomi50i"
-path="res://.godot/imported/accessory_belt_01.glb-a2b6be72b4422067d290c84868489d2d.scn"
-
-[deps]
-
-source_file="res://assets/avatars/accessory_belt_01.glb"
-dest_files=["res://.godot/imported/accessory_belt_01.glb-a2b6be72b4422067d290c84868489d2d.scn"]
-
-[params]
-
-nodes/root_type=""
-nodes/root_name=""
-nodes/root_script=null
-nodes/apply_root_scale=true
-nodes/root_scale=1.0
-nodes/import_as_skeleton_bones=false
-nodes/use_name_suffixes=true
-nodes/use_node_type_suffixes=true
-meshes/ensure_tangents=true
-meshes/generate_lods=true
-meshes/create_shadow_meshes=true
-meshes/light_baking=1
-meshes/lightmap_texel_size=0.2
-meshes/force_disable_compression=false
-skins/use_named_skins=true
-animation/import=true
-animation/fps=30
-animation/trimming=false
-animation/remove_immutable_tracks=true
-animation/import_rest_as_RESET=false
-import_script/path=""
-materials/extract=0
-materials/extract_format=0
-materials/extract_path=""
-_subresources={}
-gltf/naming_version=2
-gltf/embedded_image_handling=1
@@ -1,42 +0,0 @@
-[remap]
-
-importer="scene"
-importer_version=1
-type="PackedScene"
-uid="uid://dvou487niwnjt"
-path="res://.godot/imported/accessory_necklace_01.glb-75d713dbb1ff9579d6f0bf8b7ddde1e2.scn"
-
-[deps]
-
-source_file="res://assets/avatars/accessory_necklace_01.glb"
-dest_files=["res://.godot/imported/accessory_necklace_01.glb-75d713dbb1ff9579d6f0bf8b7ddde1e2.scn"]
-
-[params]
-
-nodes/root_type=""
-nodes/root_name=""
-nodes/root_script=null
-nodes/apply_root_scale=true
-nodes/root_scale=1.0
-nodes/import_as_skeleton_bones=false
-nodes/use_name_suffixes=true
-nodes/use_node_type_suffixes=true
-meshes/ensure_tangents=true
-meshes/generate_lods=true
-meshes/create_shadow_meshes=true
-meshes/light_baking=1
-meshes/lightmap_texel_size=0.2
-meshes/force_disable_compression=false
-skins/use_named_skins=true
-animation/import=true
-animation/fps=30
-animation/trimming=false
-animation/remove_immutable_tracks=true
-animation/import_rest_as_RESET=false
-import_script/path=""
-materials/extract=0
-materials/extract_format=0
-materials/extract_path=""
-_subresources={}
-gltf/naming_version=2
-gltf/embedded_image_handling=1
@@ -1,42 +0,0 @@
-[remap]
-
-importer="scene"
-importer_version=1
-type="PackedScene"
-uid="uid://dknbtq33pssf4"
-path="res://.godot/imported/back_backpack_01.glb-d0ccc39aed8e86403d649c8d07008591.scn"
-
-[deps]
-
-source_file="res://assets/avatars/back_backpack_01.glb"
-dest_files=["res://.godot/imported/back_backpack_01.glb-d0ccc39aed8e86403d649c8d07008591.scn"]
-
-[params]
-
-nodes/root_type=""
-nodes/root_name=""
-nodes/root_script=null
-nodes/apply_root_scale=true
-nodes/root_scale=1.0
-nodes/import_as_skeleton_bones=false
-nodes/use_name_suffixes=true
-nodes/use_node_type_suffixes=true
-meshes/ensure_tangents=true
-meshes/generate_lods=true
-meshes/create_shadow_meshes=true
-meshes/light_baking=1
-meshes/lightmap_texel_size=0.2
-meshes/force_disable_compression=false
-skins/use_named_skins=true
-animation/import=true
-animation/fps=30
-animation/trimming=false
-animation/remove_immutable_tracks=true
-animation/import_rest_as_RESET=false
-import_script/path=""
-materials/extract=0
-materials/extract_format=0
-materials/extract_path=""
-_subresources={}
-gltf/naming_version=2
-gltf/embedded_image_handling=1
@@ -1,42 +0,0 @@
-[remap]
-
-importer="scene"
-importer_version=1
-type="PackedScene"
-uid="uid://brfp6g6pcbbw7"
-path="res://.godot/imported/base_human_male_01.glb-c917b85c8f8ab5d1974812a6891f052f.scn"
-
-[deps]
-
-source_file="res://assets/avatars/base_human_male_01.glb"
-dest_files=["res://.godot/imported/base_human_male_01.glb-c917b85c8f8ab5d1974812a6891f052f.scn"]
-
-[params]
-
-nodes/root_type=""
-nodes/root_name=""
-nodes/root_script=null
-nodes/apply_root_scale=true
-nodes/root_scale=1.0
-nodes/import_as_skeleton_bones=false
-nodes/use_name_suffixes=true
-nodes/use_node_type_suffixes=true
-meshes/ensure_tangents=true
-meshes/generate_lods=true
-meshes/create_shadow_meshes=true
-meshes/light_baking=1
-meshes/lightmap_texel_size=0.2
-meshes/force_disable_compression=false
-skins/use_named_skins=true
-animation/import=true
-animation/fps=30
-animation/trimming=false
-animation/remove_immutable_tracks=true
-animation/import_rest_as_RESET=false
-import_script/path=""
-materials/extract=0
-materials/extract_format=0
-materials/extract_path=""
-_subresources={}
-gltf/naming_version=2
-gltf/embedded_image_handling=1
@@ -1,115 +0,0 @@
-{
-  "assets": {
-    "base_human_male_01": {
-      "type": "base_body",
-      "slot": "base_body",
-      "path": "res://assets/avatars/base_human_male_01.glb",
-      "version": "1.0.0",
-      "display_name": "Human Male Base"
-    },
-    "head_cyber_01": {
-      "type": "attachment",
-      "slot": "head",
-      "path": "res://assets/avatars/head_cyber_01.glb",
-      "version": "1.0.0",
-      "display_name": "Cyber Head",
-      "mount_bone": "Head"
-    },
-    "hair_mohawk_01": {
-      "type": "attachment",
-      "slot": "hair",
-      "path": "res://assets/avatars/hair_mohawk_01.glb",
-      "version": "1.0.0",
-      "display_name": "Mohawk",
-      "mount_bone": "HeadTop"
-    },
-    "hair_ponytail_01": {
-      "type": "attachment",
-      "slot": "hair",
-      "path": "res://assets/avatars/hair_ponytail_01.glb",
-      "version": "1.0.0",
-      "display_name": "Ponytail",
-      "mount_bone": "HeadTop"
-    },
-    "face_glasses_01": {
-      "type": "attachment",
-      "slot": "face",
-      "path": "res://assets/avatars/face_glasses_01.glb",
-      "version": "1.0.0",
-      "display_name": "Glasses",
-      "mount_bone": "Jaw"
-    },
-    "chest_bandit_01": {
-      "type": "attachment",
-      "slot": "chest",
-      "path": "res://assets/avatars/chest_bandit_01.glb",
-      "version": "1.0.0",
-      "display_name": "Bandit Shirt",
-      "mount_bone": "Chest"
-    },
-    "back_backpack_01": {
-      "type": "attachment",
-      "slot": "back",
-      "path": "res://assets/avatars/back_backpack_01.glb",
-      "version": "1.0.0",
-      "display_name": "Backpack",
-      "mount_bone": "Chest"
-    },
-    "pants_cargo_01": {
-      "type": "attachment",
-      "slot": "pants",
-      "path": "res://assets/avatars/pants_cargo_01.glb",
-      "version": "1.0.0",
-      "display_name": "Cargo Pants",
-      "mount_bone": "Hips"
-    },
-    "left_hand_glove_01": {
-      "type": "attachment",
-      "slot": "left_hand",
-      "path": "res://assets/avatars/left_hand_glove_01.glb",
-      "version": "1.0.0",
-      "display_name": "Left Glove",
-      "mount_bone": "LeftHand"
-    },
-    "right_hand_glove_01": {
-      "type": "attachment",
-      "slot": "right_hand",
-      "path": "res://assets/avatars/right_hand_glove_01.glb",
-      "version": "1.0.0",
-      "display_name": "Right Glove",
-      "mount_bone": "RightHand"
-    },
-    "left_foot_boot_01": {
-      "type": "attachment",
-      "slot": "left_foot",
-      "path": "res://assets/avatars/left_foot_boot_01.glb",
-      "version": "1.0.0",
-      "display_name": "Left Boot",
-      "mount_bone": "LeftFoot"
-    },
-    "right_foot_boot_01": {
-      "type": "attachment",
-      "slot": "right_foot",
-      "path": "res://assets/avatars/right_foot_boot_01.glb",
-      "version": "1.0.0",
-      "display_name": "Right Boot",
-      "mount_bone": "RightFoot"
-    },
-    "accessory_belt_01": {
-      "type": "attachment",
-      "slot": "accessory",
-      "path": "res://assets/avatars/accessory_belt_01.glb",
-      "version": "1.0.0",
-      "display_name": "Belt",
-      "mount_bone": "Root"
-    },
-    "accessory_necklace_01": {
-      "type": "attachment",
-      "slot": "accessory",
-      "path": "res://assets/avatars/accessory_necklace_01.glb",
-      "version": "1.0.0",
-      "display_name": "Necklace",
-      "mount_bone": "Root"
-    }
-  }
-}
@@ -1,42 +0,0 @@
-[remap]
-
-importer="scene"
-importer_version=1
-type="PackedScene"
-uid="uid://bva2etlpa8act"
-path="res://.godot/imported/chest_bandit_01.glb-90867999feb79e02c469ef45d970f0e1.scn"
-
-[deps]
-
-source_file="res://assets/avatars/chest_bandit_01.glb"
-dest_files=["res://.godot/imported/chest_bandit_01.glb-90867999feb79e02c469ef45d970f0e1.scn"]
-
-[params]
-
-nodes/root_type=""
-nodes/root_name=""
-nodes/root_script=null
-nodes/apply_root_scale=true
-nodes/root_scale=1.0
-nodes/import_as_skeleton_bones=false
-nodes/use_name_suffixes=true
-nodes/use_node_type_suffixes=true
-meshes/ensure_tangents=true
-meshes/generate_lods=true
-meshes/create_shadow_meshes=true
-meshes/light_baking=1
-meshes/lightmap_texel_size=0.2
-meshes/force_disable_compression=false
-skins/use_named_skins=true
-animation/import=true
-animation/fps=30
-animation/trimming=false
-animation/remove_immutable_tracks=true
-animation/import_rest_as_RESET=false
-import_script/path=""
-materials/extract=0
-materials/extract_format=0
-materials/extract_path=""
-_subresources={}
-gltf/naming_version=2
-gltf/embedded_image_handling=1
@@ -1,42 +0,0 @@
-[remap]
-
-importer="scene"
-importer_version=1
-type="PackedScene"
-uid="uid://ctwcxf552y325"
-path="res://.godot/imported/face_glasses_01.glb-fe06ebb12e6caf265dce06de37a74fc5.scn"
-
-[deps]
-
-source_file="res://assets/avatars/face_glasses_01.glb"
-dest_files=["res://.godot/imported/face_glasses_01.glb-fe06ebb12e6caf265dce06de37a74fc5.scn"]
-
-[params]
-
-nodes/root_type=""
-nodes/root_name=""
-nodes/root_script=null
-nodes/apply_root_scale=true
-nodes/root_scale=1.0
-nodes/import_as_skeleton_bones=false
-nodes/use_name_suffixes=true
-nodes/use_node_type_suffixes=true
-meshes/ensure_tangents=true
-meshes/generate_lods=true
-meshes/create_shadow_meshes=true
-meshes/light_baking=1
-meshes/lightmap_texel_size=0.2
-meshes/force_disable_compression=false
-skins/use_named_skins=true
-animation/import=true
-animation/fps=30
-animation/trimming=false
-animation/remove_immutable_tracks=true
-animation/import_rest_as_RESET=false
-import_script/path=""
-materials/extract=0
-materials/extract_format=0
-materials/extract_path=""
-_subresources={}
-gltf/naming_version=2
-gltf/embedded_image_handling=1
@@ -1,42 +0,0 @@
-[remap]
-
-importer="scene"
-importer_version=1
-type="PackedScene"
-uid="uid://j4dc6l3l0j6f"
-path="res://.godot/imported/hair_mohawk_01.glb-f2a6883730b5d02facb56d1dbb0e371e.scn"
-
-[deps]
-
-source_file="res://assets/avatars/hair_mohawk_01.glb"
-dest_files=["res://.godot/imported/hair_mohawk_01.glb-f2a6883730b5d02facb56d1dbb0e371e.scn"]
-
-[params]
-
-nodes/root_type=""
-nodes/root_name=""
-nodes/root_script=null
-nodes/apply_root_scale=true
-nodes/root_scale=1.0
-nodes/import_as_skeleton_bones=false
-nodes/use_name_suffixes=true
-nodes/use_node_type_suffixes=true
-meshes/ensure_tangents=true
-meshes/generate_lods=true
-meshes/create_shadow_meshes=true
-meshes/light_baking=1
-meshes/lightmap_texel_size=0.2
-meshes/force_disable_compression=false
-skins/use_named_skins=true
-animation/import=true
-animation/fps=30
-animation/trimming=false
-animation/remove_immutable_tracks=true
-animation/import_rest_as_RESET=false
-import_script/path=""
-materials/extract=0
-materials/extract_format=0
-materials/extract_path=""
-_subresources={}
-gltf/naming_version=2
-gltf/embedded_image_handling=1
@@ -1,42 +0,0 @@
-[remap]
-
-importer="scene"
-importer_version=1
-type="PackedScene"
-uid="uid://dp4vqp2trrank"
-path="res://.godot/imported/hair_ponytail_01.glb-cdf5913fc63278b1dd362cb640c2ecb4.scn"
-
-[deps]
-
-source_file="res://assets/avatars/hair_ponytail_01.glb"
-dest_files=["res://.godot/imported/hair_ponytail_01.glb-cdf5913fc63278b1dd362cb640c2ecb4.scn"]
-
-[params]
-
-nodes/root_type=""
-nodes/root_name=""
-nodes/root_script=null
-nodes/apply_root_scale=true
-nodes/root_scale=1.0
-nodes/import_as_skeleton_bones=false
-nodes/use_name_suffixes=true
-nodes/use_node_type_suffixes=true
-meshes/ensure_tangents=true
-meshes/generate_lods=true
-meshes/create_shadow_meshes=true
-meshes/light_baking=1
-meshes/lightmap_texel_size=0.2
-meshes/force_disable_compression=false
-skins/use_named_skins=true
-animation/import=true
-animation/fps=30
-animation/trimming=false
-animation/remove_immutable_tracks=true
-animation/import_rest_as_RESET=false
-import_script/path=""
-materials/extract=0
-materials/extract_format=0
-materials/extract_path=""
-_subresources={}
-gltf/naming_version=2
-gltf/embedded_image_handling=1
@@ -1,42 +0,0 @@
-[remap]
-
-importer="scene"
-importer_version=1
-type="PackedScene"
-uid="uid://bkp35fnns36xb"
-path="res://.godot/imported/head_cyber_01.glb-8081a99d6b31c121d208dd2f9629df5c.scn"
-
-[deps]
-
-source_file="res://assets/avatars/head_cyber_01.glb"
-dest_files=["res://.godot/imported/head_cyber_01.glb-8081a99d6b31c121d208dd2f9629df5c.scn"]
-
-[params]
-
-nodes/root_type=""
-nodes/root_name=""
-nodes/root_script=null
-nodes/apply_root_scale=true
-nodes/root_scale=1.0
-nodes/import_as_skeleton_bones=false
-nodes/use_name_suffixes=true
-nodes/use_node_type_suffixes=true
-meshes/ensure_tangents=true
-meshes/generate_lods=true
-meshes/create_shadow_meshes=true
-meshes/light_baking=1
-meshes/lightmap_texel_size=0.2
-meshes/force_disable_compression=false
-skins/use_named_skins=true
-animation/import=true
-animation/fps=30
-animation/trimming=false
-animation/remove_immutable_tracks=true
-animation/import_rest_as_RESET=false
-import_script/path=""
-materials/extract=0
-materials/extract_format=0
-materials/extract_path=""
-_subresources={}
-gltf/naming_version=2
-gltf/embedded_image_handling=1
@@ -1,42 +0,0 @@
-[remap]
-
-importer="scene"
-importer_version=1
-type="PackedScene"
-uid="uid://bgfjpdu8kg0aj"
-path="res://.godot/imported/left_foot_boot_01.glb-cab36c9e44befe0a3ff50ee651f2ff67.scn"
-
-[deps]
-
-source_file="res://assets/avatars/left_foot_boot_01.glb"
-dest_files=["res://.godot/imported/left_foot_boot_01.glb-cab36c9e44befe0a3ff50ee651f2ff67.scn"]
-
-[params]
-
-nodes/root_type=""
-nodes/root_name=""
-nodes/root_script=null
-nodes/apply_root_scale=true
-nodes/root_scale=1.0
-nodes/import_as_skeleton_bones=false
-nodes/use_name_suffixes=true
-nodes/use_node_type_suffixes=true
-meshes/ensure_tangents=true
-meshes/generate_lods=true
-meshes/create_shadow_meshes=true
-meshes/light_baking=1
-meshes/lightmap_texel_size=0.2
-meshes/force_disable_compression=false
-skins/use_named_skins=true
-animation/import=true
-animation/fps=30
-animation/trimming=false
-animation/remove_immutable_tracks=true
-animation/import_rest_as_RESET=false
-import_script/path=""
-materials/extract=0
-materials/extract_format=0
-materials/extract_path=""
-_subresources={}
-gltf/naming_version=2
-gltf/embedded_image_handling=1
@@ -1,42 +0,0 @@
-[remap]
-
-importer="scene"
-importer_version=1
-type="PackedScene"
-uid="uid://dtq7tgio1iymd"
-path="res://.godot/imported/left_hand_glove_01.glb-4b237bea3299c6604547afa353a7b602.scn"
-
-[deps]
-
-source_file="res://assets/avatars/left_hand_glove_01.glb"
-dest_files=["res://.godot/imported/left_hand_glove_01.glb-4b237bea3299c6604547afa353a7b602.scn"]
-
-[params]
-
-nodes/root_type=""
-nodes/root_name=""
-nodes/root_script=null
-nodes/apply_root_scale=true
-nodes/root_scale=1.0
-nodes/import_as_skeleton_bones=false
-nodes/use_name_suffixes=true
-nodes/use_node_type_suffixes=true
-meshes/ensure_tangents=true
-meshes/generate_lods=true
-meshes/create_shadow_meshes=true
-meshes/light_baking=1
-meshes/lightmap_texel_size=0.2
-meshes/force_disable_compression=false
-skins/use_named_skins=true
-animation/import=true
-animation/fps=30
-animation/trimming=false
-animation/remove_immutable_tracks=true
-animation/import_rest_as_RESET=false
-import_script/path=""
-materials/extract=0
-materials/extract_format=0
-materials/extract_path=""
-_subresources={}
-gltf/naming_version=2
-gltf/embedded_image_handling=1
@@ -1,42 +0,0 @@
-[remap]
-
-importer="scene"
-importer_version=1
-type="PackedScene"
-uid="uid://yo204q1m6hs3"
-path="res://.godot/imported/pants_cargo_01.glb-00f3e3b72fd692344cbb8bfd2b8449f9.scn"
-
-[deps]
-
-source_file="res://assets/avatars/pants_cargo_01.glb"
-dest_files=["res://.godot/imported/pants_cargo_01.glb-00f3e3b72fd692344cbb8bfd2b8449f9.scn"]
-
-[params]
-
-nodes/root_type=""
-nodes/root_name=""
-nodes/root_script=null
-nodes/apply_root_scale=true
-nodes/root_scale=1.0
-nodes/import_as_skeleton_bones=false
-nodes/use_name_suffixes=true
-nodes/use_node_type_suffixes=true
-meshes/ensure_tangents=true
-meshes/generate_lods=true
-meshes/create_shadow_meshes=true
-meshes/light_baking=1
-meshes/lightmap_texel_size=0.2
-meshes/force_disable_compression=false
-skins/use_named_skins=true
-animation/import=true
-animation/fps=30
-animation/trimming=false
-animation/remove_immutable_tracks=true
-animation/import_rest_as_RESET=false
-import_script/path=""
-materials/extract=0
-materials/extract_format=0
-materials/extract_path=""
-_subresources={}
-gltf/naming_version=2
-gltf/embedded_image_handling=1
@@ -1,42 +0,0 @@
-[remap]
-
-importer="scene"
-importer_version=1
-type="PackedScene"
-uid="uid://30ij0eapm6ti"
-path="res://.godot/imported/right_foot_boot_01.glb-ffff27e561e5632596b7ba89fee5b5ea.scn"
-
-[deps]
-
-source_file="res://assets/avatars/right_foot_boot_01.glb"
-dest_files=["res://.godot/imported/right_foot_boot_01.glb-ffff27e561e5632596b7ba89fee5b5ea.scn"]
-
-[params]
-
-nodes/root_type=""
-nodes/root_name=""
-nodes/root_script=null
-nodes/apply_root_scale=true
-nodes/root_scale=1.0
-nodes/import_as_skeleton_bones=false
-nodes/use_name_suffixes=true
-nodes/use_node_type_suffixes=true
-meshes/ensure_tangents=true
-meshes/generate_lods=true
-meshes/create_shadow_meshes=true
-meshes/light_baking=1
-meshes/lightmap_texel_size=0.2
-meshes/force_disable_compression=false
-skins/use_named_skins=true
-animation/import=true
-animation/fps=30
-animation/trimming=false
-animation/remove_immutable_tracks=true
-animation/import_rest_as_RESET=false
-import_script/path=""
-materials/extract=0
-materials/extract_format=0
-materials/extract_path=""
-_subresources={}
-gltf/naming_version=2
-gltf/embedded_image_handling=1
@@ -1,42 +0,0 @@
-[remap]
-
-importer="scene"
-importer_version=1
-type="PackedScene"
-uid="uid://bcrtxtp47dv8h"
-path="res://.godot/imported/right_hand_glove_01.glb-a59875b630ac413350c3bdf6acc84bdf.scn"
-
-[deps]
-
-source_file="res://assets/avatars/right_hand_glove_01.glb"
-dest_files=["res://.godot/imported/right_hand_glove_01.glb-a59875b630ac413350c3bdf6acc84bdf.scn"]
-
-[params]
-
-nodes/root_type=""
-nodes/root_name=""
-nodes/root_script=null
-nodes/apply_root_scale=true
-nodes/root_scale=1.0
-nodes/import_as_skeleton_bones=false
-nodes/use_name_suffixes=true
-nodes/use_node_type_suffixes=true
-meshes/ensure_tangents=true
-meshes/generate_lods=true
-meshes/create_shadow_meshes=true
-meshes/light_baking=1
-meshes/lightmap_texel_size=0.2
-meshes/force_disable_compression=false
-skins/use_named_skins=true
-animation/import=true
-animation/fps=30
-animation/trimming=false
-animation/remove_immutable_tracks=true
-animation/import_rest_as_RESET=false
-import_script/path=""
-materials/extract=0
-materials/extract_format=0
-materials/extract_path=""
-_subresources={}
-gltf/naming_version=2
-gltf/embedded_image_handling=1
@@ -4,13 +4,10 @@ DATABASE_URL=postgresql+asyncpg://agp_user:agp_password@localhost:5432/agp_db
 # Redis
 REDIS_URL=redis://localhost:6379/0

-# JWT / Auth
-ALGORITHM=RS256
-ACCESS_TOKEN_EXPIRE_MINUTES=60
-REFRESH_TOKEN_EXPIRE_DAYS=30
-# Directory where the RSA keypair is loaded/generated at runtime.
-# Defaults to ~/.agp/keys (outside the repo). Keys are never committed to git.
-RSA_KEY_DIR=~/.agp/keys
+# JWT
+SECRET_KEY=change-me-to-a-secure-random-string
+ALGORITHM=HS256
+ACCESS_TOKEN_EXPIRE_MINUTES=30

 # App
 APP_NAME=AGP Backend
@@ -8,7 +8,7 @@ from sqlalchemy.ext.asyncio import create_async_engine

 from app.config import settings
 from app.database import Base
-from app.models import user, session, world, asset, avatar_loadout  # noqa: F401
+from app.models import user, session, world, asset  # noqa: F401

 # this is the Alembic Config object, which provides
 # access to the values within the .ini file in use.
@@ -1,36 +0,0 @@
-"""add refresh_tokens table
-
-Revision ID: 0003_add_refresh_tokens_table
-Revises: 0002_add_date_of_birth_to_users
-Create Date: 2025-07-25 00:00:00.000000
-
-"""
-from typing import Sequence, Union
-
-from alembic import op
-import sqlalchemy as sa
-
-# revision identifiers, used by Alembic.
-revision: str = "0003_add_refresh_tokens_table"
-down_revision: Union[str, None] = "0002_add_date_of_birth_to_users"
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-def upgrade() -> None:
-    """Create the refresh_tokens table."""
-    op.create_table(
-        "refresh_tokens",
-        sa.Column("id", sa.String(36), primary_key=True),
-        sa.Column("user_id", sa.Integer(), sa.ForeignKey("users.id", ondelete="CASCADE"), nullable=False),
-        sa.Column("token", sa.String(512), unique=True, index=True, nullable=False),
-        sa.Column("expires_at", sa.DateTime(timezone=True), nullable=False),
-        sa.Column("is_active", sa.Boolean(), server_default=sa.text("true"), nullable=False),
-        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
-        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
-    )
-
-
-def downgrade() -> None:
-    """Drop the refresh_tokens table."""
-    op.drop_table("refresh_tokens")
@@ -1,39 +0,0 @@
-"""add avatar_loadouts table
-
-Revision ID: 0004_add_avatar_loadouts_table
-Revises: 0003_add_refresh_tokens_table
-Create Date: 2026-09-05 00:00:00.000000
-
-"""
-from typing import Sequence, Union
-
-from alembic import op
-import sqlalchemy as sa
-from sqlalchemy.dialects import postgresql
-
-# revision identifiers, used by Alembic.
-revision: str = "0004_add_avatar_loadouts_table"
-down_revision: Union[str, None] = "0003_add_refresh_tokens_table"
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-def upgrade() -> None:
-    """Create the avatar_loadouts table (one row per user)."""
-    op.create_table(
-        "avatar_loadouts",
-        sa.Column(
-            "user_id",
-            sa.Integer(),
-            sa.ForeignKey("users.id", ondelete="CASCADE"),
-            primary_key=True,
-        ),
-        sa.Column("data", postgresql.JSONB(), nullable=False),
-        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
-        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
-    )
-
-
-def downgrade() -> None:
-    """Drop the avatar_loadouts table."""
-    op.drop_table("avatar_loadouts")
@@ -1,56 +1,10 @@
 """Application configuration via pydantic-settings."""

 from functools import lru_cache
-from pathlib import Path

-from cryptography.hazmat.primitives.asymmetric.rsa import (
-    RSAPrivateKey,
-    RSAPublicKey,
-    generate_private_key,
-)
-from cryptography.hazmat.primitives.serialization import (
-    Encoding,
-    NoEncryption,
-    PrivateFormat,
-    PublicFormat,
-    load_pem_private_key,
-    load_pem_public_key,
-)
 from pydantic_settings import BaseSettings, SettingsConfigDict


-def _load_or_generate_rsa_keys(key_dir: Path) -> tuple[bytes, bytes]:
-    """Load existing RSA keys or generate a new pair.
-
-    Keys are stored as PEM files in *key_dir*.  The directory is created
-    if it does not exist.  Files are named ``private.pem`` and
-    ``public.pem`` and are **not** committed to git.
-    """
-    private_path = key_dir / "private.pem"
-    public_path = key_dir / "public.pem"
-
-    if private_path.exists() and public_path.exists():
-        private_pem = private_path.read_bytes()
-        public_pem = public_path.read_bytes()
-    else:
-        # Generate a new 2048-bit RSA key pair
-        private_key = generate_private_key(public_exponent=65537, key_size=2048)
-        private_pem = private_key.private_bytes(
-            Encoding.PEM,
-            PrivateFormat.PKCS8,
-            NoEncryption(),
-        )
-        public_pem = private_key.public_key().public_bytes(
-            Encoding.PEM,
-            PublicFormat.SubjectPublicKeyInfo,
-        )
-        key_dir.mkdir(parents=True, exist_ok=True)
-        private_path.write_bytes(private_pem)
-        public_path.write_bytes(public_pem)
-
-    return private_pem, public_pem
-
-
 class Settings(BaseSettings):
    # App
    APP_NAME: str = "AGP Backend"
@@ -64,47 +18,20 @@ class Settings(BaseSettings):
    REDIS_URL: str = "redis://localhost:6379/0"

    # JWT / Auth
-    ALGORITHM: str = "RS256"
-    ACCESS_TOKEN_EXPIRE_MINUTES: int = 60
-    REFRESH_TOKEN_EXPIRE_DAYS: int = 30
-
-    # RS256 key storage.  Defaults to a directory outside the repo so the
-    # generated keypair is never accidentally committed.
-    RSA_KEY_DIR: str = str(Path.home() / ".agp" / "keys")
+    # NOTE: production must override SECRET_KEY with a secure random value
+    # (e.g. `python -c "import secrets; print(secrets.token_urlsafe(32))"`)
+    SECRET_KEY: str = "change-me-to-a-secure-random-string"
+    ALGORITHM: str = "HS256"
+    ACCESS_TOKEN_EXPIRE_MINUTES: int = 30

    # CORS
    CORS_ORIGINS: str = "http://localhost:8080,http://localhost:3000"

-    # Per-IP auth rate limiting (app/rate_limit.py). Disabled by the
-    # checkpoint smoke suite, which runs every test from one client IP.
-    RATE_LIMIT_ENABLED: bool = True
-
    # File uploads
    UPLOAD_DIR: str = "uploads"
    MAX_UPLOAD_SIZE_MB: int = 100
    GLTF_MAX_FILE_SIZE_MB: int = 200

-    # ── Game-server orchestration ──────────────────────────────────────────
-    # The join flow (POST /api/worlds/{id}/join) ensures a headless Godot
-    # dedicated-server process exists for a world and returns its address.
-    # Disabled by default so nothing tries to spawn Godot in environments
-    # that don't have it (plain pytest, CI without the engine); the
-    # checkpoint/playtest launcher turns it on.
-    GAME_SERVERS_ENABLED: bool = False
-    # Path to the Godot 4 binary. "godot" resolves via PATH.
-    GODOT_BIN: str = str(Path.home() / "godot" / "godot")
-    # Godot project directory (the game repo root -- backend/ is a subdir).
-    GAME_PROJECT_DIR: str = str(Path(__file__).resolve().parents[2])
-    # The host clients should connect to for ENet. Defaults to the LAN IP the
-    # launcher bakes into the exe; overridable for local testing.
-    GAME_SERVER_HOST: str = "127.0.0.1"
-    # Port range for per-world dedicated servers.
-    GAME_SERVER_PORT_MIN: int = 27000
-    GAME_SERVER_PORT_MAX: int = 27099
-    # Kill a world's server this long after its last join with no active
-    # players reported.
-    GAME_SERVER_IDLE_TIMEOUT_SECONDS: int = 300
-
    model_config = SettingsConfigDict(
        env_file=".env",
        env_file_encoding="utf-8",
@@ -115,32 +42,6 @@ class Settings(BaseSettings):
    def cors_origins_list(self) -> list[str]:
        return [origin.strip() for origin in self.CORS_ORIGINS.split(",")]

-    @property
-    def rsa_key_dir(self) -> Path:
-        return Path(self.RSA_KEY_DIR)
-
-    @property
-    def private_pem(self) -> bytes:
-        """Return the private key PEM bytes (loads/generates on first call)."""
-        private_pem, _ = _load_or_generate_rsa_keys(self.rsa_key_dir)
-        return private_pem
-
-    @property
-    def public_pem(self) -> bytes:
-        """Return the public key PEM bytes (loads/generates on first call)."""
-        _, public_pem = _load_or_generate_rsa_keys(self.rsa_key_dir)
-        return public_pem
-
-    @property
-    def private_key(self) -> RSAPrivateKey:
-        """Return the deserialized RSA private key object."""
-        return load_pem_private_key(self.private_pem, password=None)
-
-    @property
-    def public_key(self) -> RSAPublicKey:
-        """Return the deserialized RSA public key object."""
-        return load_pem_public_key(self.public_pem)
-

@lru_cache()
 def get_settings() -> Settings:
@@ -27,7 +27,7 @@ async def get_current_user(
    )
    try:
        payload = jwt.decode(
-            token, settings.public_pem, algorithms=[settings.ALGORITHM]
+            token, settings.SECRET_KEY, algorithms=[settings.ALGORITHM]
        )
        user_id: str | None = payload.get("sub")
        if user_id is None:
@@ -6,18 +6,15 @@ from fastapi import FastAPI
 from fastapi.middleware.cors import CORSMiddleware

 from app.config import settings
-from app.routers import auth, users, worlds, assets, avatar
-
-
-from app.services.game_servers import supervisor
+from app.routers import auth, users, worlds, assets


@asynccontextmanager
 async def lifespan(app: FastAPI):
    """Application lifespan: startup and shutdown events."""
-    supervisor.start()
+    # Startup: initialize database, connect to Redis, etc.
    yield
-    await supervisor.shutdown()
+    # Shutdown: close connections, cleanup


 app = FastAPI(
@@ -41,7 +38,6 @@ app.include_router(auth.router, prefix="/api/auth", tags=["auth"])
 app.include_router(users.router, prefix="/api/users", tags=["users"])
 app.include_router(worlds.router, prefix="/api/worlds", tags=["worlds"])
 app.include_router(assets.router, prefix="/api/assets", tags=["assets"])
-app.include_router(avatar.router, prefix="/api/avatar", tags=["avatar"])


@app.get("/api/health")
@@ -2,6 +2,5 @@ from app.models.user import User
 from app.models.session import Session
 from app.models.world import World
 from app.models.asset import Asset
-from app.models.avatar_loadout import AvatarLoadout

-__all__ = ["User", "Session", "World", "Asset", "AvatarLoadout"]
+__all__ = ["User", "Session", "World", "Asset"]
@@ -1,41 +0,0 @@
-from sqlalchemy import Column, Integer, ForeignKey, DateTime
-from sqlalchemy.dialects.postgresql import JSONB
-from sqlalchemy.orm import relationship
-from sqlalchemy.sql import func
-
-from app.database import Base
-
-
-# The default a brand-new account gets before they touch the customization
-# screen. Kept in sync with assets/avatars/catalog.json (the base_body id) and
-# with the client's AvatarLoadout.to_json() shape.
-DEFAULT_LOADOUT: dict = {
-    "base_body": "base_human_male_01",
-    "slots": {},
-}
-
-
-class AvatarLoadout(Base):
-    """A user's equipped avatar composition.
-
-    One row per user. The whole loadout is stored as a single JSON document
-    matching the client's ``AvatarLoadout.to_json()`` shape
-    (``{"base_body": str, "slots": {...}, "skin_tone"?: {...}}``) rather than
-    exploded into columns -- the server has no copy of the asset catalog, so
-    deep validation (does this asset exist, is it valid for this slot) stays
-    on the client. The server only enforces the envelope: valid JSON object
-    with a non-empty ``base_body``.
-    """
-
-    __tablename__ = "avatar_loadouts"
-
-    user_id = Column(
-        Integer,
-        ForeignKey("users.id", ondelete="CASCADE"),
-        primary_key=True,
-    )
-    data = Column(JSONB, nullable=False)
-    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
-    updated_at = Column(DateTime(timezone=True), server_default=func.now(), onupdate=func.now(), nullable=False)
-
-    user = relationship("User", back_populates="avatar_loadout")
@@ -0,0 +1,39 @@
+"""Script model — game logic scripts owned by users and associated with worlds."""
+
+from typing import Optional
+
+from sqlalchemy import Column, Integer, String, Text, DateTime, ForeignKey, func
+from sqlalchemy.dialects.postgresql import ENUM, JSONB
+from sqlalchemy.orm import relationship
+import enum
+
+from app.database import Base
+
+
+class ScriptType(str, enum.Enum):
+    """Type of script storage."""
+    GDSCRIPT = "gdscript"
+    DSL = "dsl"
+
+
+class Script(Base):
+    """A game script — either raw GDScript source or a DSL payload."""
+    __tablename__ = "scripts"
+
+    id = Column(Integer, primary_key=True, index=True)
+    name = Column(String(255), nullable=False)
+    world_id = Column(Integer, ForeignKey("worlds.id", ondelete="CASCADE"), nullable=True)
+    owner_id = Column(Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False)
+    source_code = Column(Text, nullable=True)
+    version = Column(Integer, nullable=False, server_default="1")
+    script_type = Column(
+        ENUM(ScriptType, name="script_type", create_type=False),
+        nullable=False,
+        default=ScriptType.GDSCRIPT,
+    )
+    dsl_payload = Column(JSONB, nullable=True)
+    created_at = Column(DateTime(timezone=True), server_default=func.now())
+    updated_at = Column(DateTime(timezone=True), server_default=func.now(), onupdate=func.now())
+
+    owner = relationship("User", back_populates="scripts")
+    world = relationship("World", back_populates="scripts")
@@ -3,7 +3,6 @@ import uuid
 from sqlalchemy import Column, Integer, String, DateTime, ForeignKey, Boolean
 from sqlalchemy.orm import relationship
 from sqlalchemy.sql import func
-
 from app.database import Base


@@ -19,23 +18,3 @@ class Session(Base):
    updated_at = Column(DateTime(timezone=True), server_default=func.now(), onupdate=func.now())

    user = relationship("User", back_populates="sessions")
-
-
-class RefreshToken(Base):
-    __tablename__ = "refresh_tokens"
-
-    id = Column(String(36), primary_key=True, default=lambda: str(uuid.uuid4()))
-    user_id = Column(Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False)
-    # RS256 JWTs are ~420+ chars; 512 is sufficient and matches the migration.
-    token = Column(String(512), unique=True, index=True, nullable=False)
-    expires_at = Column(DateTime(timezone=True), nullable=False)
-    is_active = Column(Boolean, nullable=False, default=True, server_default="true")
-    created_at = Column(DateTime(timezone=True), nullable=False, server_default=func.now())
-    updated_at = Column(
-        DateTime(timezone=True),
-        nullable=False,
-        server_default=func.now(),
-        onupdate=func.now(),
-    )
-
-    user = relationship("User", back_populates="refresh_tokens")
@@ -21,15 +21,8 @@ class User(Base):
    updated_at = Column(DateTime(timezone=True), onupdate=func.now())

    sessions = relationship("Session", back_populates="user", cascade="all, delete-orphan")
-    refresh_tokens = relationship("RefreshToken", back_populates="user", cascade="all, delete-orphan")
    worlds = relationship("World", back_populates="owner")
    assets = relationship("Asset", back_populates="owner")
-    avatar_loadout = relationship(
-        "AvatarLoadout",
-        back_populates="user",
-        uselist=False,
-        cascade="all, delete-orphan",
-    )

    @property
    def is_adult(self) -> bool:
@@ -21,12 +21,7 @@ class World(Base):
    description = Column(Text, nullable=True)
    owner_id = Column(Integer, ForeignKey("users.id"), nullable=False)
    visibility = Column(
-        ENUM(
-            WorldVisibility,
-            name="world_visibility",
-            create_type=False,
-            values_callable=lambda enum_cls: [e.value for e in enum_cls],
-        ),
+        ENUM(WorldVisibility, name="world_visibility", create_type=False),
        default=WorldVisibility.PUBLIC,
    )
    created_at = Column(DateTime(timezone=True), server_default=func.now())
@@ -1,73 +0,0 @@
-"""Lightweight in-process rate limiting.
-
-The backend runs single-worker (required by the game-server supervisor), so a
-process-local sliding-window counter is sufficient and needs no Redis. Keyed
-by client IP. Used to blunt credential brute-force on the auth endpoints.
-
-If the backend is ever scaled to multiple workers/hosts this must move to a
-shared store (Redis) -- flagged here rather than silently under-enforcing.
-"""
-from __future__ import annotations
-
-import time
-from collections import defaultdict, deque
-
-from fastapi import HTTPException, Request, status
-
-from app.config import settings
-
-
-class SlidingWindowLimiter:
-    def __init__(self, max_hits: int, window_seconds: float) -> None:
-        self.max_hits = max_hits
-        self.window = window_seconds
-        self._hits: dict[str, deque[float]] = defaultdict(deque)
-
-    def check(self, key: str) -> None:
-        now = time.monotonic()
-        q = self._hits[key]
-        cutoff = now - self.window
-        while q and q[0] < cutoff:
-            q.popleft()
-        if len(q) >= self.max_hits:
-            retry = max(1, int(q[0] + self.window - now))
-            raise HTTPException(
-                status_code=status.HTTP_429_TOO_MANY_REQUESTS,
-                detail="Too many attempts. Try again shortly.",
-                headers={"Retry-After": str(retry)},
-            )
-        q.append(now)
-
-    def reset(self) -> None:
-        self._hits.clear()
-
-
-def _client_key(request: Request) -> str:
-    # X-Forwarded-For first hop when behind the reverse proxy, else the socket.
-    fwd = request.headers.get("x-forwarded-for", "")
-    if fwd:
-        return fwd.split(",")[0].strip()
-    return request.client.host if request.client else "unknown"
-
-
-# 10 auth attempts / minute / IP -- generous for a human, painful for a
-# brute-forcer.
-_auth_limiter = SlidingWindowLimiter(max_hits=10, window_seconds=60)
-
-
-async def auth_rate_limit(request: Request) -> None:
-    """FastAPI dependency: rate-limit auth attempts per client IP.
-
-    A no-op when ``RATE_LIMIT_ENABLED`` is false -- the checkpoint smoke
-    suite runs every test against one backend from one client IP, so the
-    per-IP cap would trip mid-suite. The dedicated ``test_rate_limit``
-    module exercises the real behaviour regardless of this flag.
-    """
-    if not settings.RATE_LIMIT_ENABLED:
-        return
-    _auth_limiter.check(f"auth:{_client_key(request)}")
-
-
-def reset_all() -> None:
-    """Test hook."""
-    _auth_limiter.reset()
@@ -1,61 +1,55 @@
 """Authentication router - login, register, token refresh."""

-import uuid
 from datetime import date, datetime, timedelta, timezone

 from fastapi import APIRouter, Depends, HTTPException, status
 from fastapi.security import OAuth2PasswordRequestForm
-from jose import JWTError, jwt
+from pydantic import BaseModel, EmailStr, field_validator
+
+from jose import jwt
 from passlib.context import CryptContext
-from pydantic import BaseModel, EmailStr
-from sqlalchemy import select
-from sqlalchemy.ext.asyncio import AsyncSession

 from app.config import settings
 from app.database import get_db
 from app.dependencies import CurrentUser
-from app.models.session import RefreshToken
 from app.models.user import User
-from app.rate_limit import auth_rate_limit
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy import select

 pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")

 router = APIRouter()

-## Minimum age to register. This platform is adults-only.
-MIN_AGE = 18
-

 # --- Pydantic schemas ---

 class TokenResponse(BaseModel):
    access_token: str
-    refresh_token: str
    token_type: str = "bearer"
-    access_token_expires_minutes: int
-
-
-class RefreshRequest(BaseModel):
-    refresh_token: str


 class RegisterRequest(BaseModel):
    username: str
    email: EmailStr
    password: str
-    # Real date of birth -- the server computes age from it and rejects
-    # anyone under MIN_AGE. Still self-attested (no document check yet), but
-    # a concrete, stored, legally-meaningful data point rather than a
-    # throwaway checkbox, and the seam for a future hard ID-verification
-    # pass. See docs/architecture/content_moderation.md 5.2.
-    date_of_birth: date
+    date_of_birth: str  # ISO format date string (YYYY-MM-DD)
+
+    @field_validator("date_of_birth")
+    @classmethod
+    def validate_date_of_birth(cls, v: str) -> str:
+        """Validate that the date string is a valid date in YYYY-MM-DD format."""
+        try:
+            datetime.strptime(v, "%Y-%m-%d")
+        except ValueError:
+            raise ValueError("date_of_birth must be in YYYY-MM-DD format")
+        return v


 class UserResponse(BaseModel):
    id: int
    username: str
    email: str
-    date_of_birth: date | None = None
+    date_of_birth: str | None = None
    is_active: bool
    created_at: datetime | None = None

@@ -65,43 +59,12 @@ class UserResponse(BaseModel):
 # --- Helpers ---

 def _create_access_token(data: dict) -> str:
-    """Create a signed access token using RS256.
-
-    Includes a unique ``jti`` claim so that concurrent/same-second calls
-    (e.g. back-to-back /refresh requests) still produce distinct tokens —
-    without it, two tokens minted for the same user within the same
-    second are byte-identical since ``sub``/``exp`` are the only claims.
-    """
    to_encode = data.copy()
-    to_encode["jti"] = str(uuid.uuid4())
    expire = datetime.now(timezone.utc) + timedelta(
        minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES
    )
    to_encode.update({"exp": expire})
-    return jwt.encode(
-        to_encode,
-        settings.private_pem,
-        algorithm=settings.ALGORITHM,
-    )
-
-
-def _create_refresh_token(data: dict) -> str:
-    """Create a signed refresh token using RS256.
-
-    Includes a unique ``jti`` claim so that concurrent calls produce
-    distinct tokens even when issued within the same second.
-    """
-    to_encode = data.copy()
-    to_encode["jti"] = str(uuid.uuid4())
-    expire = datetime.now(timezone.utc) + timedelta(
-        days=settings.REFRESH_TOKEN_EXPIRE_DAYS
-    )
-    to_encode.update({"exp": expire})
-    return jwt.encode(
-        to_encode,
-        settings.private_pem,
-        algorithm=settings.ALGORITHM,
-    )
+    return jwt.encode(to_encode, settings.SECRET_KEY, algorithm=settings.ALGORITHM)


 def verify_password(plain_password: str, hashed_password: str) -> bool:
@@ -117,10 +80,6 @@ def hash_password(password: str) -> str:
 def calculate_age(birth_date: date, today: date | None = None) -> int:
    """Calculate age in years from a birth date.

-    Used by /register (PC3 Phase 3) to compute age from the submitted
-    date_of_birth and enforce the 18+ gate. See
-    docs/architecture/content_moderation.md 5.2.
-
    Args:
        birth_date: The person's date of birth.
        today: The reference date. Defaults to today's date (UTC).
@@ -138,41 +97,22 @@ def calculate_age(birth_date: date, today: date | None = None) -> int:
    return age


-def _issue_refresh_token(user_id: int, db: AsyncSession) -> str:
-    """Create and persist a refresh token for the given user."""
-    refresh_token_value = _create_refresh_token({"sub": str(user_id)})
-    refresh_token_record = RefreshToken(
-        id=str(uuid.uuid4()),
-        user_id=user_id,
-        token=refresh_token_value,
-        expires_at=datetime.now(timezone.utc)
-        + timedelta(days=settings.REFRESH_TOKEN_EXPIRE_DAYS),
-    )
-    db.add(refresh_token_record)
-    return refresh_token_value
-
-
 # --- Endpoints ---

-@router.post("/register", response_model=TokenResponse, status_code=status.HTTP_201_CREATED,
-             dependencies=[Depends(auth_rate_limit)])
+@router.post("/register", response_model=TokenResponse, status_code=status.HTTP_201_CREATED)
 async def register(req: RegisterRequest, db: AsyncSession = Depends(get_db)):
-    """Register a new user and return access + refresh tokens.
+    """Register a new user and return an access token.

-    Requires a date of birth; the server computes age and rejects anyone
-    under MIN_AGE (18). See docs/architecture/content_moderation.md for the
-    verification design and its self-attestation limitation.
+    Requires date_of_birth and rejects users under 18.
    """
-    age = calculate_age(req.date_of_birth)
-    if age < 0 or req.date_of_birth > date.today():
+    # Parse and validate date_of_birth
+    dob = datetime.strptime(req.date_of_birth, "%Y-%m-%d").date()
+    age = calculate_age(dob)
+
+    if age < 18:
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
-            detail="Invalid date of birth",
-        )
-    if age < MIN_AGE:
-        raise HTTPException(
-            status_code=status.HTTP_403_FORBIDDEN,
-            detail=f"You must be at least {MIN_AGE} to use this platform",
+            detail=f"Must be 18 or older to register (provided date of birth: {req.date_of_birth})",
        )

    # Check if username already exists
@@ -195,29 +135,19 @@ async def register(req: RegisterRequest, db: AsyncSession = Depends(get_db)):
        username=req.username,
        email=req.email,
        hashed_password=hash_password(req.password),
-        date_of_birth=req.date_of_birth,
+        date_of_birth=dob,
    )
    db.add(user)
-    await db.flush()  # flush to get user.id before creating refresh token
+    await db.commit()
    await db.refresh(user)

-    # Create access token
    access_token = _create_access_token({"sub": str(user.id)})
-
-    # Create and persist refresh token
-    refresh_token_value = _issue_refresh_token(user.id, db)
-    await db.commit()
-
-    return TokenResponse(
-        access_token=access_token,
-        refresh_token=refresh_token_value,
-        access_token_expires_minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES,
-    )
+    return TokenResponse(access_token=access_token)


-@router.post("/login", response_model=TokenResponse, dependencies=[Depends(auth_rate_limit)])
+@router.post("/login", response_model=TokenResponse)
 async def login(form: OAuth2PasswordRequestForm = Depends(), db: AsyncSession = Depends(get_db)):
-    """Authenticate user and return access + refresh tokens.
+    """Authenticate user and return an access token.

    Accepts form-encoded credentials (username/password) as expected by
    OAuth2PasswordBearer, so the Swagger UI "Authorize" flow works correctly.
@@ -237,84 +167,8 @@ async def login(form: OAuth2PasswordRequestForm = Depends(), db: AsyncSession =
            detail="User account is inactive",
        )

-    # Create access token
    access_token = _create_access_token({"sub": str(user.id)})
-
-    # Create and persist refresh token
-    refresh_token_value = _issue_refresh_token(user.id, db)
-    await db.commit()
-
-    return TokenResponse(
-        access_token=access_token,
-        refresh_token=refresh_token_value,
-        access_token_expires_minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES,
-    )
-
-
-@router.post("/refresh", response_model=TokenResponse)
-async def refresh(req: RefreshRequest, db: AsyncSession = Depends(get_db)):
-    """Exchange a valid refresh token for a new access token.
-
-    Validates the refresh token against the database:
-    - Must exist in the refresh_tokens table
-    - Must not be expired (expires_at > now)
-    - Must be active (is_active == true)
-
-    On success, returns a new access token. The refresh token itself is
-    NOT rotated (the client keeps using the same refresh token).
-    """
-    credentials_exception = HTTPException(
-        status_code=status.HTTP_401_UNAUTHORIZED,
-        detail="Invalid or expired refresh token",
-    )
-
-    # Step 1: Decode and validate the JWT signature/claims
-    try:
-        payload = jwt.decode(
-            req.refresh_token,
-            settings.public_pem,
-            algorithms=[settings.ALGORITHM],
-        )
-    except JWTError:
-        raise credentials_exception
-
-    user_id_str: str | None = payload.get("sub")
-    if user_id_str is None:
-        raise credentials_exception
-
-    try:
-        user_id = int(user_id_str)
-    except (ValueError, TypeError):
-        raise credentials_exception
-
-    # Step 2: Look up the refresh token in the database
-    result = await db.execute(
-        select(RefreshToken).where(
-            RefreshToken.token == req.refresh_token,
-            RefreshToken.user_id == user_id,
-        )
-    )
-    stored_token = result.scalar_one_or_none()
-
-    if stored_token is None:
-        raise credentials_exception
-
-    # Step 3: Check if the token is expired
-    if datetime.now(timezone.utc) >= stored_token.expires_at:
-        raise credentials_exception
-
-    # Step 4: Check if the token is active
-    if not stored_token.is_active:
-        raise credentials_exception
-
-    # Step 5: Issue a new access token
-    access_token = _create_access_token({"sub": str(user_id)})
-
-    return TokenResponse(
-        access_token=access_token,
-        refresh_token=req.refresh_token,  # Return the same refresh token
-        access_token_expires_minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES,
-    )
+    return TokenResponse(access_token=access_token)


@router.get("/me", response_model=UserResponse)
@@ -1,78 +0,0 @@
-"""Avatar router - the current user's persisted avatar loadout.
-
-The loadout is a single JSON document matching the client's
-``AvatarLoadout.to_json()`` shape. The server has no copy of the asset
-catalog, so it only validates the envelope (JSON object, non-empty
-``base_body``); which assets are valid for which slot is the client's job.
-"""
-
-from typing import Annotated, Any
-
-from fastapi import APIRouter, Depends, HTTPException
-from pydantic import BaseModel, Field
-from sqlalchemy import select
-from sqlalchemy.ext.asyncio import AsyncSession
-
-from app.database import get_db
-from app.dependencies import CurrentUser
-from app.models.avatar_loadout import AvatarLoadout, DEFAULT_LOADOUT
-
-router = APIRouter()
-
-DbDep = Annotated[AsyncSession, Depends(get_db)]
-
-# A loadout document is small; reject anything absurd outright.
-MAX_LOADOUT_BYTES = 16 * 1024
-
-
-class LoadoutResponse(BaseModel):
-    data: dict[str, Any]
-    is_default: bool = Field(
-        description="True when the user has never saved a loadout and this is "
-        "the server default."
-    )
-
-
-class LoadoutUpdate(BaseModel):
-    data: dict[str, Any]
-
-
-def _validate_envelope(data: dict[str, Any]) -> None:
-    base_body = data.get("base_body")
-    if not isinstance(base_body, str) or not base_body.strip():
-        raise HTTPException(
-            status_code=422,
-            detail="loadout.data must have a non-empty string 'base_body'",
-        )
-    slots = data.get("slots", {})
-    if not isinstance(slots, dict):
-        raise HTTPException(status_code=422, detail="loadout.data.slots must be an object")
-    if len(str(data)) > MAX_LOADOUT_BYTES:
-        raise HTTPException(status_code=413, detail="loadout document too large")
-
-
-@router.get("/loadout", response_model=LoadoutResponse)
-async def get_loadout(current_user: CurrentUser, db: DbDep):
-    """Return the current user's saved loadout, or the server default if they
-    have never saved one."""
-    row = await db.get(AvatarLoadout, current_user.id)
-    if row is None:
-        return LoadoutResponse(data=dict(DEFAULT_LOADOUT), is_default=True)
-    return LoadoutResponse(data=row.data, is_default=False)
-
-
-@router.put("/loadout", response_model=LoadoutResponse)
-async def put_loadout(payload: LoadoutUpdate, current_user: CurrentUser, db: DbDep):
-    """Replace the current user's loadout."""
-    _validate_envelope(payload.data)
-
-    row = await db.get(AvatarLoadout, current_user.id)
-    if row is None:
-        row = AvatarLoadout(user_id=current_user.id, data=payload.data)
-        db.add(row)
-    else:
-        row.data = payload.data
-
-    await db.commit()
-    await db.refresh(row)
-    return LoadoutResponse(data=row.data, is_default=False)
@@ -1,6 +1,5 @@
 """Worlds router - CRUD for game worlds."""

-from datetime import datetime
 from typing import Annotated

 from fastapi import APIRouter, Depends, HTTPException, Query
@@ -12,7 +11,6 @@ from sqlalchemy.orm import selectinload
 from app.database import get_db
 from app.dependencies import CurrentUser
 from app.models.world import World, WorldVisibility
-from app.services.game_servers import supervisor

 router = APIRouter()

@@ -42,7 +40,7 @@ class WorldResponse(BaseModel):
    description: str | None
    visibility: WorldVisibility
    owner_id: int
-    created_at: datetime | None = None
+    created_at: str | None = None

    model_config = {"from_attributes": True}

@@ -107,40 +105,6 @@ async def get_world(
    return world


-class JoinResponse(BaseModel):
-    """Address of the dedicated server hosting this world."""
-    world_id: int
-    host: str
-    port: int
-
-
-@router.post("/{world_id}/join", response_model=JoinResponse)
-async def join_world(
-    world_id: int,
-    current_user: CurrentUser,
-    db: DbDep,
-):
-    """Ensure a dedicated game server is running for this world and return its
-    ENet address for the client to connect to.
-
-    503 if game-server orchestration isn't enabled on this backend (e.g. a
-    plain dev/test instance with no Godot binary).
-    """
-    result = await db.execute(select(World).where(World.id == world_id))
-    world = result.scalar_one_or_none()
-    if not world:
-        raise HTTPException(status_code=404, detail="World not found")
-    if world.visibility != WorldVisibility.PUBLIC and world.owner_id != current_user.id:
-        raise HTTPException(status_code=404, detail="World not found")
-
-    try:
-        info = await supervisor.ensure_server(str(world_id))
-    except RuntimeError as exc:
-        raise HTTPException(status_code=503, detail=str(exc))
-
-    return JoinResponse(world_id=world_id, host=info["host"], port=info["port"])
-
-
@router.post("/", response_model=WorldResponse, status_code=201)
 async def create_world(
    world_data: WorldCreate,
@@ -1,182 +0,0 @@
-"""Game-server orchestration.
-
-On ``POST /api/worlds/{id}/join`` the backend ensures a headless Godot
-dedicated-server process is running for that world and returns its address.
-One process per world, keyed by ``world_id``. A background reaper kills a
-world's server once its status file reports zero players for
-``GAME_SERVER_IDLE_TIMEOUT_SECONDS``.
-
-This lives in-process (a module-level singleton) rather than as a separate
-service, so the backend MUST run single-worker -- which it does
-(``uvicorn app.main:app`` with no ``--workers``). The Godot binary and
-project are on the host (see ``settings.GODOT_BIN`` / ``GAME_PROJECT_DIR``);
-the backend spawns them as subprocesses.
-
-Design notes / limits (PC3):
- - All worlds currently load the same test level (per-world content is M2/M7).
-   ``world_id`` still scopes a distinct server process + session.
- - Port allocation is a linear scan of the configured range.
- - No crash-restart: if a server process dies, the next join respawns it.
-"""
-from __future__ import annotations
-
-import asyncio
-import json
-import socket
-import subprocess
-import tempfile
-import time
-from dataclasses import dataclass, field
-from pathlib import Path
-
-from app.config import settings
-
-
-@dataclass
-class _WorldServer:
-    world_id: str
-    port: int
-    proc: subprocess.Popen
-    status_path: Path
-    started_at: float = field(default_factory=time.time)
-    last_join: float = field(default_factory=time.time)
-
-    def status(self) -> dict:
-        try:
-            return json.loads(self.status_path.read_text())
-        except (OSError, ValueError):
-            return {}
-
-    def player_count(self) -> int:
-        return int(self.status().get("players", 0))
-
-    def alive(self) -> bool:
-        return self.proc.poll() is None
-
-    def stop(self) -> None:
-        if self.alive():
-            self.proc.terminate()
-            try:
-                self.proc.wait(timeout=10)
-            except subprocess.TimeoutExpired:
-                self.proc.kill()
-        self.status_path.unlink(missing_ok=True)
-
-
-class GameServerSupervisor:
-    def __init__(self) -> None:
-        self._servers: dict[str, _WorldServer] = {}
-        self._lock = asyncio.Lock()
-        self._reaper: asyncio.Task | None = None
-        self._runtime_dir = Path(tempfile.gettempdir()) / "agp-game-servers"
-        self._runtime_dir.mkdir(parents=True, exist_ok=True)
-
-    # ── lifecycle ────────────────────────────────────────────────────────
-    def start(self) -> None:
-        if not settings.GAME_SERVERS_ENABLED:
-            return
-        if self._reaper is None or self._reaper.done():
-            self._reaper = asyncio.create_task(self._reap_loop())
-
-    async def shutdown(self) -> None:
-        if self._reaper:
-            self._reaper.cancel()
-        async with self._lock:
-            for srv in list(self._servers.values()):
-                srv.stop()
-            self._servers.clear()
-
-    # ── join ─────────────────────────────────────────────────────────────
-    async def ensure_server(self, world_id: str) -> dict:
-        """Return ``{"host", "port", "world_id"}`` for the world's dedicated
-        server, spawning it if needed. Raises RuntimeError if orchestration
-        is disabled or no port/engine is available."""
-        if not settings.GAME_SERVERS_ENABLED:
-            raise RuntimeError("game servers are not enabled on this backend")
-
-        async with self._lock:
-            srv = self._servers.get(world_id)
-            if srv is not None and not srv.alive():
-                srv.stop()
-                srv = None
-                del self._servers[world_id]
-
-            if srv is None:
-                srv = self._spawn(world_id)
-                self._servers[world_id] = srv
-                # Give the engine a moment to bind the ENet port before we
-                # hand the address to a client.
-                await self._await_port(srv.port)
-
-            srv.last_join = time.time()
-            return {"host": settings.GAME_SERVER_HOST, "port": srv.port, "world_id": world_id}
-
-    # ── internals ────────────────────────────────────────────────────────
-    def _spawn(self, world_id: str) -> _WorldServer:
-        port = self._free_port()
-        status_path = self._runtime_dir / f"world_{world_id}_{port}.json"
-        status_path.unlink(missing_ok=True)
-        cmd = [
-            settings.GODOT_BIN, "--headless",
-            "--path", settings.GAME_PROJECT_DIR,
-            "res://scenes/server.tscn", "--",
-            "--port", str(port),
-            "--world", str(world_id),
-            "--status-file", str(status_path),
-        ]
-        proc = subprocess.Popen(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-        return _WorldServer(world_id=world_id, port=port, proc=proc, status_path=status_path)
-
-    def _free_port(self) -> int:
-        used = {s.port for s in self._servers.values()}
-        for p in range(settings.GAME_SERVER_PORT_MIN, settings.GAME_SERVER_PORT_MAX + 1):
-            if p in used:
-                continue
-            with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as s:
-                try:
-                    s.bind(("0.0.0.0", p))
-                    return p
-                except OSError:
-                    continue
-        raise RuntimeError("no free game-server port in the configured range")
-
-    async def _await_port(self, port: int, timeout: float = 8.0) -> None:
-        deadline = time.time() + timeout
-        while time.time() < deadline:
-            # ENet is UDP; a bind failure means something (our server) has it.
-            with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as s:
-                try:
-                    s.bind(("0.0.0.0", port))
-                except OSError:
-                    return
-            await asyncio.sleep(0.25)
-
-    async def _reap_loop(self) -> None:
-        try:
-            while True:
-                await asyncio.sleep(30)
-                async with self._lock:
-                    now = time.time()
-                    for wid, srv in list(self._servers.items()):
-                        if not srv.alive():
-                            srv.stop()
-                            del self._servers[wid]
-                            continue
-                        idle_for = now - srv.last_join
-                        if idle_for > settings.GAME_SERVER_IDLE_TIMEOUT_SECONDS and srv.player_count() == 0:
-                            srv.stop()
-                            del self._servers[wid]
-        except asyncio.CancelledError:
-            pass
-
-    def debug_state(self) -> list[dict]:
-        return [
-            {
-                "world_id": s.world_id, "port": s.port, "alive": s.alive(),
-                "players": s.player_count(), "uptime_s": round(time.time() - s.started_at),
-            }
-            for s in self._servers.values()
-        ]
-
-
-supervisor = GameServerSupervisor()
@@ -9,14 +9,6 @@ pydantic==2.10.3
 pydantic-settings==2.7.0
 python-jose[cryptography]==3.3.0
 passlib[bcrypt]==1.7.4
-# passlib 1.7.4 (last release, unmaintained since ~2020) detects its bcrypt
-# backend via bcrypt.__about__.__version__, which bcrypt>=4.1 removed --
-# hashing/verifying a password then raises "password cannot be longer than
-# 72 bytes" (a misleading downstream symptom of the real AttributeError:
-# module 'bcrypt' has no attribute '__about__') on every call. Without this
-# pin, `pip install -r requirements.txt` silently grabs whatever the latest
-# bcrypt is and breaks register/login outright. Pin below 4.1 explicitly.
-bcrypt==4.0.1
 python-multipart==0.0.20
 email-validator==2.2.0
 httpx==0.28.1
@@ -1,174 +0,0 @@
-"""Shared pytest fixtures + hermetic-DB bootstrap.
-
-The integration tests hit a real Postgres (Postgres-specific types: JSONB,
-native ENUMs). To make ``cd backend && pytest`` work from a clean checkout
-with no manual setup, ``pytest_configure`` below brings up an ephemeral
-Postgres via docker compose and runs the migrations IF ``DATABASE_URL`` is
-not already pointing at a reachable database. When it is (dev loop, or the
-checkpoint runner which stands the DB up itself), that path is skipped and
-the existing database is reused.
-
-If Docker isn't available and no DB is reachable, the whole DB-backed suite
-is skipped with a clear message rather than erroring out 60+ times.
-"""
-
-import asyncio
-import os
-import socket
-import subprocess
-import sys
-import time
-from pathlib import Path
-from urllib.parse import urlsplit
-
-import pytest
-from sqlalchemy import text
-from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
-from sqlalchemy.pool import NullPool
-
-from app.config import settings
-from app.database import get_db
-from app.main import app
-
-TEST_TABLES = ("avatar_loadouts", "assets", "worlds", "sessions", "refresh_tokens", "users")
-
-BACKEND_DIR = Path(__file__).resolve().parents[1]
-_COMPOSE_PROJECT = "agp-pytest"
-_EPHEMERAL_PG_PORT = 25432
-
-# Set by _ensure_database() when it starts a container it owns; torn down in
-# pytest_unconfigure.
-_started_container = False
-_db_unavailable_reason: str | None = None
-
-
-def _port_open(host: str, port: int, timeout: float = 1.0) -> bool:
-    try:
-        with socket.create_connection((host, port), timeout=timeout):
-            return True
-    except OSError:
-        return False
-
-
-def _db_reachable(url: str) -> bool:
-    parts = urlsplit(url)
-    return _port_open(parts.hostname or "localhost", parts.port or 5432)
-
-
-def _run(cmd: list[str], **kw) -> subprocess.CompletedProcess:
-    return subprocess.run(cmd, cwd=BACKEND_DIR, capture_output=True, text=True, **kw)
-
-
-def pytest_configure(config):
-    global _started_container, _db_unavailable_reason
-
-    if _db_reachable(settings.DATABASE_URL):
-        return  # dev loop / checkpoint runner already provided one
-
-    if not _run(["docker", "--version"]).returncode == 0:
-        _db_unavailable_reason = (
-            "no reachable DATABASE_URL and docker is unavailable -- run the "
-            "checkpoint suite (scripts/run_checkpoint_tests.py) or start Postgres "
-            "manually"
-        )
-        return
-
-    env = os.environ.copy()
-    env["COMPOSE_PROJECT_NAME"] = _COMPOSE_PROJECT
-    env["POSTGRES_HOST_PORT"] = str(_EPHEMERAL_PG_PORT)
-    env["POSTGRES_PORT"] = str(_EPHEMERAL_PG_PORT)
-    up = _run(["docker", "compose", "up", "-d", "postgres"], env=env)
-    if up.returncode != 0:
-        _db_unavailable_reason = f"docker compose up postgres failed:\n{up.stderr[-800:]}"
-        return
-    _started_container = True
-
-    for _ in range(30):
-        r = _run(
-            ["docker", "compose", "exec", "-T", "postgres",
-             "pg_isready", "-U", "agp_user", "-d", "agp_db"],
-            env=env,
-        )
-        if r.returncode == 0:
-            break
-        time.sleep(1)
-    else:
-        _db_unavailable_reason = "ephemeral Postgres never became ready"
-        return
-
-    url = f"postgresql+asyncpg://agp_user:agp_password@localhost:{_EPHEMERAL_PG_PORT}/agp_db"
-    os.environ["DATABASE_URL"] = url
-    settings.DATABASE_URL = url
-
-    mig = _run([sys.executable, "-m", "alembic", "upgrade", "head"],
-               env={**os.environ, "DATABASE_URL": url})
-    if mig.returncode != 0:
-        _db_unavailable_reason = f"alembic upgrade head failed:\n{mig.stderr[-800:]}"
-
-
-def pytest_unconfigure(config):
-    if not _started_container:
-        return
-    env = os.environ.copy()
-    env["COMPOSE_PROJECT_NAME"] = _COMPOSE_PROJECT
-    env["POSTGRES_HOST_PORT"] = str(_EPHEMERAL_PG_PORT)
-    env["POSTGRES_PORT"] = str(_EPHEMERAL_PG_PORT)
-    _run(["docker", "compose", "down", "-v"], env=env)
-
-
-@pytest.fixture(scope="session", autouse=True)
-def _reset_database():
-    """Truncate all application tables once per test session."""
-    if _db_unavailable_reason:
-        pytest.skip(_db_unavailable_reason, allow_module_level=True)
-
-    async def _truncate() -> None:
-        engine = create_async_engine(settings.DATABASE_URL)
-        async with engine.begin() as conn:
-            await conn.execute(text(f"TRUNCATE TABLE {', '.join(TEST_TABLES)} CASCADE"))
-        await engine.dispose()
-
-    asyncio.run(_truncate())
-    yield
-
-
-@pytest.fixture(autouse=True)
-def _reset_rate_limiter():
-    """Every TestClient request looks like the same client IP, so the
-    per-IP auth limiter would trip mid-suite. Clear it between tests; the
-    dedicated rate-limit test disables this to exercise the real behaviour.
-    """
-    from app import rate_limit
-    rate_limit.reset_all()
-    yield
-
-
-@pytest.fixture(autouse=True)
-def _override_db():
-    """Override get_db so the app uses a fresh session per test.
-
-    Deliberately does NOT reuse app.database's shared engine: FastAPI's
-    (sync) TestClient runs each request through anyio's blocking-portal
-    machinery, which can hand different requests different event loops.
-    asyncpg connections are bound to the loop they were created on, so
-    reusing one from the shared pool across requests raises "attached to a
-    different loop" the moment a test makes more than one request. NullPool
-    sidesteps it: every checkout is a brand-new connection.
-    """
-    test_engine = create_async_engine(settings.DATABASE_URL, poolclass=NullPool)
-    test_session_factory = async_sessionmaker(test_engine, expire_on_commit=False)
-
-    async def _get_db():
-        async_session = test_session_factory()
-        try:
-            yield async_session
-            await async_session.commit()
-        except Exception:
-            await async_session.rollback()
-            raise
-        finally:
-            await async_session.close()
-
-    app.dependency_overrides[get_db] = _get_db
-    yield
-    app.dependency_overrides.clear()
@@ -3,102 +3,92 @@
 from datetime import date, timedelta

 import pytest
-from fastapi.testclient import TestClient

-from app.main import app
-from app.routers.auth import calculate_age, MIN_AGE, RegisterRequest
+from app.routers.auth import calculate_age


 class TestCalculateAge:
    """Unit tests for the calculate_age helper."""

    def test_exactly_18(self):
-        today = date(2026, 6, 15)
+        """A person born exactly 18 years ago today is 18."""
+        today = date(2025, 6, 15)
        dob = today.replace(year=today.year - 18)
        assert calculate_age(dob, today=today) == 18

    def test_just_turned_18(self):
-        today = date(2026, 6, 15)
+        """A person who turned 18 yesterday is 18."""
+        today = date(2025, 6, 15)
        dob = today.replace(year=today.year - 18) - timedelta(days=1)
        assert calculate_age(dob, today=today) == 18

    def test_one_day_short_of_18(self):
-        today = date(2026, 6, 15)
+        """A person born one day after their 18th birthday is 17."""
+        today = date(2025, 6, 15)
        dob = today.replace(year=today.year - 18) + timedelta(days=1)
        assert calculate_age(dob, today=today) == 17

-    def test_leap_day_birthday_before(self):
-        assert calculate_age(date(2000, 2, 29), today=date(2024, 2, 28)) == 23
+    def test_17_years_old(self):
+        """A person who is 17 years old today is 17."""
+        today = date(2025, 6, 15)
+        dob = date(2008, 6, 15)
+        assert calculate_age(dob, today=today) == 17

-    def test_leap_day_birthday_after(self):
-        assert calculate_age(date(2000, 2, 29), today=date(2024, 3, 1)) == 24
+    def test_65_years_old(self):
+        """A person who is 65 is correctly calculated."""
+        today = date(2025, 6, 15)
+        dob = today.replace(year=today.year - 65)
+        assert calculate_age(dob, today=today) == 65
+
+    def test_newborn(self):
+        """A newborn is 0."""
+        today = date(2025, 6, 15)
+        dob = today
+        assert calculate_age(dob, today=today) == 0
+
+    def test_birthday_not_yet_this_year(self):
+        """Person born Dec 31, 2000 — on Jan 1, 2025 they are still 24."""
+        dob = date(2000, 12, 31)
+        assert calculate_age(dob, today=date(2025, 1, 1)) == 24
+
+    def test_birthday_today(self):
+        """Person born Dec 31, 2000 — on Dec 31, 2024 they turn 24."""
+        dob = date(2000, 12, 31)
+        assert calculate_age(dob, today=date(2024, 12, 31)) == 24


-class TestRegisterRequestDob:
-    def test_dob_parsed_from_iso_string(self):
-        req = RegisterRequest(username="u", email="u@example.com", password="p",
-                              date_of_birth="1990-01-01")
-        assert req.date_of_birth == date(1990, 1, 1)
+class TestRegisterRequestDateValidation:
+    """Tests for the RegisterRequest date_of_birth field validator."""

-    def test_dob_required(self):
-        with pytest.raises(Exception):
-            RegisterRequest(username="u", email="u@example.com", password="p")
+    @pytest.mark.parametrize(
+        "dob",
+        [
+            "2000-01-01",
+            "1990-12-31",
+            "2004-02-29",  # leap day
+        ],
+    )
+    def test_valid_dates(self, dob):
+        """Valid YYYY-MM-DD dates pass validation."""
+        from app.routers.auth import RegisterRequest

-    def test_bad_dob_string_rejected(self):
-        with pytest.raises(Exception):
-            RegisterRequest(username="u", email="u@example.com", password="p",
-                            date_of_birth="not-a-date")
+        req = RegisterRequest(username="u", email="u@example.com", password="p", date_of_birth=dob)
+        assert req.date_of_birth == dob

+    @pytest.mark.parametrize(
+        "dob",
+        [
+            "01-01-2000",
+            "2000/01/01",
+            "2000-13-01",
+            "2000-00-10",
+            "not-a-date",
+            "",
+        ],
+    )
+    def test_invalid_dates_rejected(self, dob):
+        """Invalid dates are rejected by the validator."""
+        from app.routers.auth import RegisterRequest

-class TestRegisterAgeGate:
-    """End-to-end: the /register endpoint computes age from the DOB."""
-
-    def _dob_for_age(self, years: int) -> str:
-        return (date.today().replace(year=date.today().year - years)).isoformat()
-
-    def test_adult_accepted(self):
-        client = TestClient(app)
-        r = client.post("/api/auth/register", json={
-            "username": "gate_adult", "email": "gate_adult@e.com",
-            "password": "secret123", "date_of_birth": self._dob_for_age(25),
-        })
-        assert r.status_code == 201, r.text
-
-    def test_minor_rejected(self):
-        client = TestClient(app)
-        r = client.post("/api/auth/register", json={
-            "username": "gate_minor", "email": "gate_minor@e.com",
-            "password": "secret123", "date_of_birth": self._dob_for_age(15),
-        })
-        assert r.status_code == 403
-        assert str(MIN_AGE) in r.json()["detail"]
-
-    def test_exactly_18_accepted(self):
-        client = TestClient(app)
-        r = client.post("/api/auth/register", json={
-            "username": "gate_18", "email": "gate_18@e.com",
-            "password": "secret123",
-            "date_of_birth": (date.today().replace(year=date.today().year - 18) - timedelta(days=1)).isoformat(),
-        })
-        assert r.status_code == 201, r.text
-
-    def test_future_dob_rejected(self):
-        client = TestClient(app)
-        r = client.post("/api/auth/register", json={
-            "username": "gate_future", "email": "gate_future@e.com",
-            "password": "secret123", "date_of_birth": "2999-01-01",
-        })
-        assert r.status_code == 400
-
-    def test_dob_is_stored(self):
-        client = TestClient(app)
-        dob = self._dob_for_age(30)
-        reg = client.post("/api/auth/register", json={
-            "username": "gate_stored", "email": "gate_stored@e.com",
-            "password": "secret123", "date_of_birth": dob,
-        })
-        assert reg.status_code == 201
-        me = client.get("/api/auth/me", headers={
-            "Authorization": f"Bearer {reg.json()['access_token']}"
-        })
-        assert me.json()["date_of_birth"] == dob
+        with pytest.raises(ValueError):
+            RegisterRequest(username="u", email="u@example.com", password="p", date_of_birth=dob)
@@ -1,251 +0,0 @@
-"""Integration tests for the auth endpoints (register + login).
-
-These tests hit the real FastAPI app against the real configured database
-(DATABASE_URL -- Postgres via Alembic migrations in CI/dev, not an isolated
-in-memory DB), so they exercise the full stack: Pydantic validation → DB →
-JWT → response. Requires migrations already applied (alembic upgrade head)
-before running.
-"""
-
-import pytest
-from fastapi.testclient import TestClient
-from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
-from sqlalchemy.pool import NullPool
-
-from app.config import settings
-from app.main import app
-from app.database import get_db
-from app.routers.auth import pwd_context
-
-
-# ---------------------------------------------------------------------------
-# Test fixtures
-# ---------------------------------------------------------------------------
-
-@pytest.fixture(autouse=True)
-def _override_db():
-    """Override get_db so the app uses a fresh session per test.
-
-    Deliberately does NOT reuse app.database's shared engine: FastAPI's
-    (sync) TestClient runs each request through anyio's blocking-portal
-    machinery, which can hand different requests different event loops.
-    asyncpg connections are bound to the loop they were created on, so
-    reusing one from the shared engine's connection pool across requests
-    raises "cannot perform operation: another operation is in progress" the
-    moment a test makes more than one request (register-then-login,
-    register-twice, etc.) -- confirmed this is the actual cause, not a bug
-    in the endpoints themselves. NullPool sidesteps it: every checkout is a
-    brand-new connection, never handed to a different loop than the one
-    that opened it.
-    """
-    test_engine = create_async_engine(settings.DATABASE_URL, poolclass=NullPool)
-    test_session_factory = async_sessionmaker(test_engine, expire_on_commit=False)
-
-    async def _get_db():
-        async_session = test_session_factory()
-        try:
-            yield async_session
-            await async_session.commit()
-        except Exception:
-            await async_session.rollback()
-            raise
-        finally:
-            await async_session.close()
-
-    app.dependency_overrides[get_db] = _get_db
-    yield
-    app.dependency_overrides.clear()
-
-
-# ---------------------------------------------------------------------------
-# Register endpoint
-# ---------------------------------------------------------------------------
-
-class TestRegister:
-    """Tests for POST /api/auth/register."""
-
-    def test_register_success(self):
-        """A valid registration returns 201 with a token."""
-        client = TestClient(app)
-        resp = client.post(
-            "/api/auth/register",
-            json={
-                "username": "newuser",
-                "email": "new@example.com",
-                "password": "secret123",
-                "date_of_birth": "1990-01-01",
-            },
-        )
-        assert resp.status_code == 201
-        data = resp.json()
-        assert "access_token" in data
-        assert data["token_type"] == "bearer"
-
-    def test_register_rejects_under_18(self):
-        """A DOB that computes to under 18 gets a 403 (see test_auth_age_gate
-        for the age-math coverage)."""
-        from datetime import date
-        client = TestClient(app)
-        minor_dob = date.today().replace(year=date.today().year - 14).isoformat()
-        resp = client.post(
-            "/api/auth/register",
-            json={
-                "username": "kid",
-                "email": "kid@example.com",
-                "password": "secret123",
-                "date_of_birth": minor_dob,
-            },
-        )
-        assert resp.status_code == 403
-        assert "at least 18" in resp.json()["detail"]
-
-    def test_register_rejects_duplicate_username(self):
-        """Registering the same username twice returns 409."""
-        client = TestClient(app)
-        # First registration
-        client.post(
-            "/api/auth/register",
-            json={
-                "username": "duplicate",
-                "email": "dup1@example.com",
-                "password": "secret123",
-                "date_of_birth": "1990-01-01",
-            },
-        )
-        # Second registration with same username, different email
-        resp = client.post(
-            "/api/auth/register",
-            json={
-                "username": "duplicate",
-                "email": "dup2@example.com",
-                "password": "secret123",
-                "date_of_birth": "1990-01-01",
-            },
-        )
-        assert resp.status_code == 409
-        assert "Username already registered" in resp.json()["detail"]
-
-    def test_register_rejects_duplicate_email(self):
-        """Registering the same email twice returns 409."""
-        client = TestClient(app)
-        client.post(
-            "/api/auth/register",
-            json={
-                "username": "user1",
-                "email": "same@example.com",
-                "password": "secret123",
-                "date_of_birth": "1990-01-01",
-            },
-        )
-        resp = client.post(
-            "/api/auth/register",
-            json={
-                "username": "user2",
-                "email": "same@example.com",
-                "password": "secret123",
-                "date_of_birth": "1990-01-01",
-            },
-        )
-        assert resp.status_code == 409
-        assert "Email already registered" in resp.json()["detail"]
-
-    def test_register_missing_dob(self):
-        """Missing the required date_of_birth field returns 422."""
-        client = TestClient(app)
-        resp = client.post(
-            "/api/auth/register",
-            json={
-                "username": "user",
-                "email": "user@example.com",
-                "password": "secret123",
-            },
-        )
-        assert resp.status_code == 422
-
-
-# ---------------------------------------------------------------------------
-# Login endpoint
-# ---------------------------------------------------------------------------
-
-class TestLogin:
-    """Tests for POST /api/auth/login."""
-
-    def _create_user(self, username: str, password: str, email: str = None):
-        """Helper to create a user via register."""
-        client = TestClient(app)
-        if email is None:
-            email = f"{username}@example.com"
-        resp = client.post(
-            "/api/auth/register",
-            json={
-                "username": username,
-                "email": email,
-                "password": password,
-                "date_of_birth": "1990-01-01",
-            },
-        )
-        assert resp.status_code == 201
-        return resp.json()["access_token"]
-
-    def test_login_success(self):
-        """Correct credentials return a token."""
-        self._create_user("loginuser", "correctpass")
-        client = TestClient(app)
-        resp = client.post(
-            "/api/auth/login",
-            data={"username": "loginuser", "password": "correctpass"},
-        )
-        assert resp.status_code == 200
-        data = resp.json()
-        assert "access_token" in data
-        assert data["token_type"] == "bearer"
-
-    def test_login_wrong_password(self):
-        """Wrong password returns 401."""
-        # Distinct username from test_login_success -- there's no per-test
-        # DB rollback/isolation here (real Postgres via the app's own
-        # dependency-overridden session), so reusing "loginuser" collided
-        # with the user that test already created (409 on register instead
-        # of the intended 401-on-login assertion this test is actually for).
-        self._create_user("loginuser_wrongpass", "correctpass")
-        client = TestClient(app)
-        resp = client.post(
-            "/api/auth/login",
-            data={"username": "loginuser_wrongpass", "password": "wrongpass"},
-        )
-        assert resp.status_code == 401
-        assert "Incorrect username or password" in resp.json()["detail"]
-
-    def test_login_nonexistent_user(self):
-        """Non-existent user returns 401 (not 404)."""
-        client = TestClient(app)
-        resp = client.post(
-            "/api/auth/login",
-            data={"username": "nobody", "password": "any"},
-        )
-        assert resp.status_code == 401
-        assert "Incorrect username or password" in resp.json()["detail"]
-
-    def test_login_accepts_form_encoded(self):
-        """Login accepts application/x-www-form-urlencoded (OAuth2)."""
-        self._create_user("formuser", "formpass")
-        client = TestClient(app)
-        resp = client.post(
-            "/api/auth/login",
-            data={"username": "formuser", "password": "formpass"},
-        )
-        assert resp.status_code == 200
-        assert "access_token" in resp.json()
-
-    def test_login_token_is_valid_jwt(self):
-        """The returned token is a valid JWT that can be decoded."""
-        self._create_user("jwttoken", "jwt123")
-        client = TestClient(app)
-        resp = client.post(
-            "/api/auth/login",
-            data={"username": "jwttoken", "password": "jwt123"},
-        )
-        token = resp.json()["access_token"]
-        # Verify it's a 3-part JWT
-        parts = token.split(".")
-        assert len(parts) == 3
@@ -1,171 +0,0 @@
-"""Tests for expired-token rejection across auth endpoints.
-
-Covers two distinct expiry paths:
-
-1. An *access* JWT whose ``exp`` claim is in the past must be rejected
-   with 401 by ``GET /api/auth/me`` (jose's built-in ``exp`` validation).
-2. A *refresh* token whose persisted ``expires_at`` is in the past must be
-   rejected with 401 by ``POST /api/auth/refresh`` even though its JWT
-   signature is still valid.
-
-Requires migrations already applied (alembic upgrade head) before running.
-"""
-
-import asyncio
-from datetime import datetime, timedelta, timezone
-
-import pytest
-from fastapi.testclient import TestClient
-from jose import jwt
-from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
-from sqlalchemy.pool import NullPool
-
-from app.config import settings
-from app.main import app
-from app.database import get_db
-from app.models.session import RefreshToken
-
-
-# ---------------------------------------------------------------------------
-# Test fixtures
-# ---------------------------------------------------------------------------
-
-@pytest.fixture(autouse=True)
-def _override_db():
-    """Override get_db so the app uses a fresh session per test."""
-    test_engine = create_async_engine(settings.DATABASE_URL, poolclass=NullPool)
-    test_session_factory = async_sessionmaker(test_engine, expire_on_commit=False)
-
-    async def _get_db():
-        async_session = test_session_factory()
-        try:
-            yield async_session
-            await async_session.commit()
-        except Exception:
-            await async_session.rollback()
-            raise
-        finally:
-            await async_session.close()
-
-    app.dependency_overrides[get_db] = _get_db
-    yield
-    app.dependency_overrides.clear()
-
-
-# ---------------------------------------------------------------------------
-# Helpers
-# ---------------------------------------------------------------------------
-
-def _mint_access_token(exp: datetime) -> str:
-    """Mint an RS256 access token with an explicit ``exp`` claim."""
-    return jwt.encode(
-        {"sub": "1", "exp": exp},
-        settings.private_pem,
-        algorithm=settings.ALGORITHM,
-    )
-
-
-def _expire_refresh_token_in_db(token: str) -> None:
-    """Set the persisted refresh token's ``expires_at`` into the past."""
-
-    async def _do():
-        engine = create_async_engine(settings.DATABASE_URL, poolclass=NullPool)
-        session_factory = async_sessionmaker(engine, expire_on_commit=False)
-        async with session_factory() as session:
-            from sqlalchemy import update
-
-            await session.execute(
-                update(RefreshToken)
-                .where(RefreshToken.token == token)
-                .values(expires_at=datetime.now(timezone.utc) - timedelta(hours=1))
-            )
-            await session.commit()
-        await engine.dispose()
-
-    asyncio.run(_do())
-
-
-def _register_user(client: TestClient, username: str) -> str:
-    """Register a user and return its refresh token."""
-    resp = client.post(
-        "/api/auth/register",
-        json={
-            "username": username,
-            "email": f"{username}@example.com",
-            "password": "secret123",
-            "date_of_birth": "1990-01-01",
-        },
-    )
-    assert resp.status_code == 201
-    return resp.json()["refresh_token"]
-
-
-# ---------------------------------------------------------------------------
-# Expired access token (GET /api/auth/me)
-# ---------------------------------------------------------------------------
-
-class TestExpiredAccessToken:
-    def test_expired_access_token_is_rejected_by_me(self):
-        """An access JWT with a past exp claim returns 401 on /me."""
-        client = TestClient(app)
-        expired_token = _mint_access_token(
-            datetime.now(timezone.utc) - timedelta(minutes=5)
-        )
-        resp = client.get(
-            "/api/auth/me",
-            headers={"Authorization": f"Bearer {expired_token}"},
-        )
-        assert resp.status_code == 401
-        assert "Could not validate credentials" in resp.json()["detail"]
-
-    def test_garbage_access_token_is_rejected_by_me(self):
-        """A non-JWT bearer token returns 401 on /me."""
-        client = TestClient(app)
-        resp = client.get(
-            "/api/auth/me",
-            headers={"Authorization": "Bearer not-a-real-jwt"},
-        )
-        assert resp.status_code == 401
-
-    def test_missing_bearer_token_returns_401(self):
-        """No Authorization header at all returns 401 on /me."""
-        client = TestClient(app)
-        resp = client.get("/api/auth/me")
-        assert resp.status_code == 401
-
-
-# ---------------------------------------------------------------------------
-# Expired refresh token (POST /api/auth/refresh)
-# ---------------------------------------------------------------------------
-
-class TestExpiredRefreshToken:
-    def test_expired_refresh_token_is_rejected(self):
-        """A refresh token whose DB expires_at is in the past returns 401."""
-        client = TestClient(app)
-        refresh_token = _register_user(client, "expired_rt_user")
-
-        # Force the persisted record to be expired while its JWT signature
-        # is still valid.
-        _expire_refresh_token_in_db(refresh_token)
-
-        resp = client.post(
-            "/api/auth/refresh",
-            json={"refresh_token": refresh_token},
-        )
-        assert resp.status_code == 401
-        assert "Invalid or expired refresh token" in resp.json()["detail"]
-
-    def test_expired_refresh_token_jwt_is_rejected(self):
-        """A refresh JWT with a past exp claim is rejected before DB lookup."""
-        client = TestClient(app)
-        expired_jwt = jwt.encode(
-            {"sub": "1", "exp": datetime.now(timezone.utc) - timedelta(minutes=5)},
-            settings.private_pem,
-            algorithm=settings.ALGORITHM,
-        )
-        resp = client.post(
-            "/api/auth/refresh",
-            json={"refresh_token": expired_jwt},
-        )
-        assert resp.status_code == 401
-        assert "Invalid or expired refresh token" in resp.json()["detail"]
@@ -1,91 +0,0 @@
-"""Integration tests for GET/PUT /api/avatar/loadout.
-
-Hits the real app against the configured Postgres (same contract as the
-other integration tests -- migrations applied first).
-"""
-
-import pytest
-from fastapi.testclient import TestClient
-
-from app.main import app
-from app.models.avatar_loadout import DEFAULT_LOADOUT
-
-
-def _auth_headers(client: TestClient, username: str) -> dict:
-    resp = client.post(
-        "/api/auth/register",
-        json={
-            "username": username,
-            "email": f"{username}@example.com",
-            "password": "secret123",
-            "date_of_birth": "1990-01-01",
-        },
-    )
-    assert resp.status_code == 201, resp.text
-    return {"Authorization": f"Bearer {resp.json()['access_token']}"}
-
-
-class TestGetLoadout:
-    def test_new_user_gets_the_default(self):
-        client = TestClient(app)
-        headers = _auth_headers(client, "av_default")
-        resp = client.get("/api/avatar/loadout", headers=headers)
-        assert resp.status_code == 200
-        body = resp.json()
-        assert body["is_default"] is True
-        assert body["data"] == DEFAULT_LOADOUT
-
-    def test_requires_auth(self):
-        client = TestClient(app)
-        assert client.get("/api/avatar/loadout").status_code == 401
-
-
-class TestPutLoadout:
-    def test_save_then_read_back(self):
-        client = TestClient(app)
-        headers = _auth_headers(client, "av_save")
-        loadout = {
-            "base_body": "base_human_male_01",
-            "slots": {"hair": "hair_mohawk_01", "accessory": ["accessory_belt_01"]},
-            "skin_tone": {"r": 0.8, "g": 0.6, "b": 0.5, "a": 1.0},
-        }
-        put = client.put("/api/avatar/loadout", headers=headers, json={"data": loadout})
-        assert put.status_code == 200, put.text
-        assert put.json()["is_default"] is False
-
-        got = client.get("/api/avatar/loadout", headers=headers)
-        assert got.status_code == 200
-        assert got.json()["is_default"] is False
-        assert got.json()["data"] == loadout
-
-    def test_put_is_idempotent_replace(self):
-        client = TestClient(app)
-        headers = _auth_headers(client, "av_replace")
-        client.put(
-            "/api/avatar/loadout", headers=headers,
-            json={"data": {"base_body": "base_human_male_01", "slots": {"hair": "hair_mohawk_01"}}},
-        )
-        second = {"base_body": "base_human_male_01", "slots": {"chest": "chest_bandit_01"}}
-        client.put("/api/avatar/loadout", headers=headers, json={"data": second})
-        got = client.get("/api/avatar/loadout", headers=headers)
-        assert got.json()["data"] == second
-
-    def test_rejects_missing_base_body(self):
-        client = TestClient(app)
-        headers = _auth_headers(client, "av_nobase")
-        resp = client.put("/api/avatar/loadout", headers=headers, json={"data": {"slots": {}}})
-        assert resp.status_code == 422
-
-    def test_rejects_non_object_slots(self):
-        client = TestClient(app)
-        headers = _auth_headers(client, "av_badslots")
-        resp = client.put(
-            "/api/avatar/loadout", headers=headers,
-            json={"data": {"base_body": "base_human_male_01", "slots": "nope"}},
-        )
-        assert resp.status_code == 422
-
-    def test_requires_auth(self):
-        client = TestClient(app)
-        resp = client.put("/api/avatar/loadout", json={"data": {"base_body": "x", "slots": {}}})
-        assert resp.status_code == 401
@@ -1,56 +0,0 @@
-"""The auth endpoints are rate-limited per client IP."""
-
-import pytest
-from fastapi.testclient import TestClient
-
-from app import rate_limit
-from app.config import settings
-from app.main import app
-
-
-@pytest.fixture(autouse=True)
-def _clean_limiter():
-    # This module tests the limiter itself: force it on (the checkpoint
-    # runner disables it suite-wide via RATE_LIMIT_ENABLED) and start each
-    # test from an empty window.
-    prev = settings.RATE_LIMIT_ENABLED
-    settings.RATE_LIMIT_ENABLED = True
-    rate_limit.reset_all()
-    yield
-    rate_limit.reset_all()
-    settings.RATE_LIMIT_ENABLED = prev
-
-
-def test_login_is_limited_after_the_threshold():
-    client = TestClient(app)
-    codes = []
-    for i in range(15):
-        r = client.post("/api/auth/login", data={"username": f"nobody{i}", "password": "x"})
-        codes.append(r.status_code)
-    # First 10 get through to the (failing) auth check; the rest are 429.
-    assert codes[:10] == [401] * 10
-    assert 429 in codes[10:]
-    assert codes[-1] == 429
-
-
-def test_register_shares_the_same_bucket():
-    client = TestClient(app)
-    # Burn the budget on login...
-    for i in range(10):
-        client.post("/api/auth/login", data={"username": f"x{i}", "password": "y"})
-    # ...register from the same IP is now blocked too.
-    r = client.post("/api/auth/register", json={
-        "username": "rl_user", "email": "rl@e.com",
-        "password": "secret123", "date_of_birth": "1990-01-01",
-    })
-    assert r.status_code == 429
-    assert "Retry-After" in r.headers
-
-
-def test_limiter_window_is_per_key():
-    limiter = rate_limit.SlidingWindowLimiter(max_hits=2, window_seconds=60)
-    limiter.check("a")
-    limiter.check("a")
-    with pytest.raises(Exception):
-        limiter.check("a")
-    limiter.check("b")  # different key, unaffected
@@ -1,201 +0,0 @@
-"""Tests for the POST /api/auth/refresh endpoint.
-
-These tests exercise the full stack: register → get refresh token →
-refresh → new access token.  Requires migrations already applied
-(alembic upgrade head) before running.
-"""
-
-import pytest
-from fastapi.testclient import TestClient
-from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
-from sqlalchemy.pool import NullPool
-
-from app.config import settings
-from app.main import app
-from app.database import get_db
-
-
-# ---------------------------------------------------------------------------
-# Test fixtures
-# ---------------------------------------------------------------------------
-
-@pytest.fixture(autouse=True)
-def _override_db():
-    """Override get_db so the app uses a fresh session per test."""
-    test_engine = create_async_engine(settings.DATABASE_URL, poolclass=NullPool)
-    test_session_factory = async_sessionmaker(test_engine, expire_on_commit=False)
-
-    async def _get_db():
-        async_session = test_session_factory()
-        try:
-            yield async_session
-            await async_session.commit()
-        except Exception:
-            await async_session.rollback()
-            raise
-        finally:
-            await async_session.close()
-
-    app.dependency_overrides[get_db] = _get_db
-    yield
-    app.dependency_overrides.clear()
-
-
-# ---------------------------------------------------------------------------
-# Refresh endpoint tests
-# ---------------------------------------------------------------------------
-
-class TestRefresh:
-    """Tests for POST /api/auth/refresh."""
-
-    def _register_user(self, username: str, password: str, email: str = None):
-        """Helper to register a user and return the refresh token."""
-        client = TestClient(app)
-        if email is None:
-            email = f"{username}@example.com"
-        resp = client.post(
-            "/api/auth/register",
-            json={
-                "username": username,
-                "email": email,
-                "password": password,
-                "date_of_birth": "1990-01-01",
-            },
-        )
-        assert resp.status_code == 201
-        return resp.json()["refresh_token"]
-
-    def test_refresh_success(self):
-        """A valid refresh token returns a new access token."""
-        refresh_token = self._register_user("refep_refreshuser", "secret123")
-        client = TestClient(app)
-        resp = client.post(
-            "/api/auth/refresh",
-            json={"refresh_token": refresh_token},
-        )
-        assert resp.status_code == 200
-        data = resp.json()
-        assert "access_token" in data
-        assert data["token_type"] == "bearer"
-        # The refresh token in the response is the same one we sent
-        assert data["refresh_token"] == refresh_token
-
-    def test_refresh_returns_different_access_token(self):
-        """Refreshing produces a new access token (different from any previous)."""
-        refresh_token = self._register_user("refep_refreshtoken", "secret123")
-        client = TestClient(app)
-
-        # First refresh
-        resp1 = client.post(
-            "/api/auth/refresh",
-            json={"refresh_token": refresh_token},
-        )
-        assert resp1.status_code == 200
-        access_token_1 = resp1.json()["access_token"]
-
-        # Second refresh
-        resp2 = client.post(
-            "/api/auth/refresh",
-            json={"refresh_token": refresh_token},
-        )
-        assert resp2.status_code == 200
-        access_token_2 = resp2.json()["access_token"]
-
-        # Each refresh should produce a new access token
-        assert access_token_1 != access_token_2
-
-    def test_refresh_invalid_token(self):
-        """An invalid (garbage) refresh token returns 401."""
-        client = TestClient(app)
-        resp = client.post(
-            "/api/auth/refresh",
-            json={"refresh_token": "not.a.jwt.token"},
-        )
-        assert resp.status_code == 401
-        assert "Invalid or expired refresh token" in resp.json()["detail"]
-
-    def test_refresh_empty_body(self):
-        """Missing refresh_token field returns 422 validation error."""
-        client = TestClient(app)
-        resp = client.post(
-            "/api/auth/refresh",
-            json={},
-        )
-        assert resp.status_code == 422
-
-    def test_refresh_missing_field(self):
-        """No body at all returns 422."""
-        client = TestClient(app)
-        resp = client.post(
-            "/api/auth/refresh",
-            content="{}",
-            headers={"Content-Type": "application/json"},
-        )
-        assert resp.status_code == 422
-
-    def test_refresh_with_login_token(self):
-        """A refresh token obtained from login also works for /refresh."""
-        client = TestClient(app)
-        # Register first
-        client.post(
-            "/api/auth/register",
-            json={
-                "username": "refep_loginrefuser",
-                "email": "loginref@example.com",
-                "password": "secret123",
-                "date_of_birth": "1990-01-01",
-            },
-        )
-        # Login to get a refresh token
-        login_resp = client.post(
-            "/api/auth/login",
-            data={"username": "refep_loginrefuser", "password": "secret123"},
-        )
-        assert login_resp.status_code == 200
-        refresh_token = login_resp.json()["refresh_token"]
-
-        # Use it to refresh
-        resp = client.post(
-            "/api/auth/refresh",
-            json={"refresh_token": refresh_token},
-        )
-        assert resp.status_code == 200
-        assert "access_token" in resp.json()
-
-    def test_refresh_access_token_is_valid_jwt(self):
-        """The access token returned by /refresh is a valid JWT."""
-        from jose import jwt
-
-        refresh_token = self._register_user("refep_jwttoken", "secret123")
-        client = TestClient(app)
-        resp = client.post(
-            "/api/auth/refresh",
-            json={"refresh_token": refresh_token},
-        )
-        assert resp.status_code == 200
-        access_token = resp.json()["access_token"]
-
-        # Verify it's a 3-part JWT
-        parts = access_token.split(".")
-        assert len(parts) == 3
-
-        # Verify it decodes with the public key
-        payload = jwt.decode(
-            access_token,
-            settings.public_pem,
-            algorithms=[settings.ALGORITHM],
-        )
-        assert "sub" in payload
-        assert "exp" in payload
-
-    def test_refresh_expires_minutes_in_response(self):
-        """The response includes access_token_expires_minutes."""
-        refresh_token = self._register_user("refep_expiretest", "secret123")
-        client = TestClient(app)
-        resp = client.post(
-            "/api/auth/refresh",
-            json={"refresh_token": refresh_token},
-        )
-        assert resp.status_code == 200
-        assert "access_token_expires_minutes" in resp.json()
-        assert resp.json()["access_token_expires_minutes"] == settings.ACCESS_TOKEN_EXPIRE_MINUTES
@@ -1,79 +0,0 @@
-"""Tests for refresh token uniqueness (jti claim) and model column length."""
-
-import uuid
-from datetime import datetime, timedelta, timezone
-
-import pytest
-from jose import jwt
-
-from app.config import settings
-from app.routers.auth import _create_refresh_token
-from app.models.session import RefreshToken
-
-
-class TestRefreshTokenJtiUniqueness:
-    """Verify that _create_refresh_token produces unique tokens even when
-    called with identical data in rapid succession (issue #1 from review)."""
-
-    def test_two_calls_produce_different_tokens(self):
-        """Two calls with the same sub produce different JWTs because of jti."""
-        token_a = _create_refresh_token({"sub": "42"})
-        token_b = _create_refresh_token({"sub": "42"})
-        assert token_a != token_b
-
-    def test_jti_is_valid_uuid(self):
-        """The jti claim inside the refresh token is a valid UUID."""
-        token = _create_refresh_token({"sub": "1"})
-        payload = jwt.decode(
-            token,
-            settings.public_pem,
-            algorithms=[settings.ALGORITHM],
-        )
-        assert "jti" in payload
-        # Verify it parses as a UUID (raises ValueError if not)
-        uuid.UUID(payload["jti"])
-
-    def test_each_token_has_unique_jti(self):
-        """Generate 100 tokens for the same user — all jtis must differ."""
-        jtis = set()
-        for _ in range(100):
-            token = _create_refresh_token({"sub": "999"})
-            payload = jwt.decode(
-                token,
-                settings.public_pem,
-                algorithms=[settings.ALGORITHM],
-            )
-            jtis.add(payload["jti"])
-        assert len(jtis) == 100
-
-    def test_jti_survives_decode(self):
-        """The jti claim is present and correct after decode."""
-        token = _create_refresh_token({"sub": "7"})
-        payload = jwt.decode(
-            token,
-            settings.public_pem,
-            algorithms=[settings.ALGORITHM],
-        )
-        assert payload["sub"] == "7"
-        assert "jti" in payload
-        assert "exp" in payload
-
-
-class TestRefreshTokenModelColumnLength:
-    """Verify the model's token column length matches the migration (issue #2)."""
-
-    def test_token_column_has_length_512(self):
-        """RefreshToken.token column should be String(512), not unbounded."""
-        from sqlalchemy import inspect
-
-        # Get the column definition from the model's table
-        column = RefreshToken.__table__.columns["token"]
-        # The type should be String with length 512
-        assert column.type.length == 512
-
-    def test_token_column_type_is_string(self):
-        """The token column should be a String type."""
-        from sqlalchemy import String as SAString
-
-        column = RefreshToken.__table__.columns["token"]
-        assert isinstance(column.type, SAString)
@@ -1,54 +0,0 @@
-"""Tests for POST /api/worlds/{id}/join.
-
-The happy path spawns a real Godot process, so it's covered by a manual /
-checkpoint integration test, not here. These cover the envelope: auth,
-visibility, and the 503 when orchestration is disabled (the default).
-"""
-
-import pytest
-from fastapi.testclient import TestClient
-
-from app.main import app
-
-
-def _auth(client: TestClient, name: str) -> tuple[dict, int]:
-    r = client.post("/api/auth/register", json={
-        "username": name, "email": f"{name}@e.com", "password": "secret123", "date_of_birth": "1990-01-01",
-    })
-    assert r.status_code == 201, r.text
-    headers = {"Authorization": f"Bearer {r.json()['access_token']}"}
-    me = client.get("/api/users/me", headers=headers)
-    return headers, me.json()["id"]
-
-
-def _make_world(client: TestClient, headers: dict, visibility: str = "public") -> int:
-    r = client.post("/api/worlds/", headers=headers, json={"name": "W", "visibility": visibility})
-    assert r.status_code == 201, r.text
-    return r.json()["id"]
-
-
-class TestJoinWorld:
-    def test_requires_auth(self):
-        client = TestClient(app)
-        assert client.post("/api/worlds/1/join").status_code == 401
-
-    def test_unknown_world_is_404(self):
-        client = TestClient(app)
-        headers, _ = _auth(client, "join_404")
-        assert client.post("/api/worlds/999999/join", headers=headers).status_code == 404
-
-    def test_private_world_of_another_user_is_404(self):
-        client = TestClient(app)
-        owner_headers, _ = _auth(client, "join_owner")
-        wid = _make_world(client, owner_headers, "private")
-        other_headers, _ = _auth(client, "join_other")
-        assert client.post(f"/api/worlds/{wid}/join", headers=other_headers).status_code == 404
-
-    def test_disabled_orchestration_returns_503(self):
-        # GAME_SERVERS_ENABLED defaults to False in tests.
-        client = TestClient(app)
-        headers, _ = _auth(client, "join_503")
-        wid = _make_world(client, headers, "public")
-        r = client.post(f"/api/worlds/{wid}/join", headers=headers)
-        assert r.status_code == 503
-        assert "not enabled" in r.json()["detail"]
@@ -449,37 +449,6 @@ The catalog is a JSON manifest mapping asset ids to metadata and resource paths:

 ---

-## 9a. Loadout Persistence (implemented, PC3 Phase 1)
-
-**Storage.** One row per user in `avatar_loadouts` (`user_id` PK/FK,
-`data` JSONB, timestamps). The entire loadout is stored as a single JSON
-document in the exact shape the client's `AvatarLoadout.to_json()` emits
-(`{"base_body": str, "slots": {...}, "skin_tone"?: {r,g,b,a}}`) rather than
-exploded into columns.
-
-**Why one JSON blob, not columns.** The server has no copy of the asset
-catalog (`assets/avatars/catalog.json` ships with the client). It therefore
-cannot meaningfully validate *which* asset belongs in *which* slot, whether
-an asset exists, or slot-exclusivity rules — that validation stays on the
-client (`AvatarLoadout.validate()` against the loaded `AvatarCatalog`). The
-server enforces only the envelope: a JSON object with a non-empty string
-`base_body`, an object `slots`, and a sane size cap. Keeping the schema
-opaque to the server also means catalog/loadout-shape changes don't need a
-migration.
-
-**Endpoints** (`/api/avatar`, bearer auth):
-
-| Method | Path | Behaviour |
-|---|---|---|
-| `GET` | `/loadout` | The user's saved loadout, or the server default (`{"base_body": "base_human_male_01", "slots": {}}`, `is_default: true`) if they have never saved one. |
-| `PUT` | `/loadout` | Replace the user's loadout (full document, not a patch). |
-
-**Defaults.** A brand-new account has no row; `GET` returns
-`models.avatar_loadout.DEFAULT_LOADOUT` with `is_default: true` so the client
-can distinguish "never customised" from "customised back to the base look".
-
---
-
 ## 10. Summary

 | Concern                | Decision                                              |
@@ -227,33 +227,18 @@ An account has an **age verification status**:

 ### 5.2 Tier 1 — Self-Declaration Flow

-> **Implemented, PC3 Phase 3.** `POST /api/auth/register` now takes a real
-> `date_of_birth` (ISO `YYYY-MM-DD`), not the throwaway `over_18` boolean it
-> had before. The server computes age (`auth.calculate_age`) and rejects
-> anyone under `auth.MIN_AGE` (18) with a **403** — this platform is
-> adults-only, so there is no "minor, restricted" tier here (the 13+ rows
-> below are the general design, not the current gate). A future-in-the-past
-> or nonsensical date is a **400**. The DOB is stored on the user row and
-> surfaced only back to that user (`/api/auth/me`), never to other players.
->
-> **Limitation, stated plainly:** this is still self-attested — a determined
-> user can enter a false DOB. It is a concrete, stored, legally-meaningful
-> data point (matching how most platforms gate before adding hard checks)
-> and the seam for Tier 2. Encryption-at-rest for the DOB column and the
-> Tier 2 ID-check hook below are **not yet implemented**.
-
 ```
 User submits { date_of_birth }
        │
        ▼
-Server validates format & plausibility (real date, not in future)
+Server validates format & plausibility (age 13–120, not in future)
        │
        ▼
 Compute age from DOB
        │
        ▼
-age >= 18 ──► status = self_declared (adult)   ← the current gate
-age >= 13 ──► status = self_declared (minor, restricted)   ← design only
+age >= 18 ──► status = self_declared (adult)
+age >= 13 ──► status = self_declared (minor, restricted)
 age <  13 ──► status = rejected (below minimum platform age)
 ```

@@ -4,11 +4,6 @@
 > **Owner:** Platform team
 > **Related:** World chunk data format & persistence, server authority + client
 > prediction, content moderation & age verification, avatar component system
-> **Note:** the recommendation here stands, but edits do **not** ride the
-> `request_chunk_edit` ENet RPC (§4.2, §7.4). Per
-> [`world_persistence_impl.md`](world_persistence_impl.md) the editor saves
-> chunks over HTTP to the FastAPI backend, which is the sole writer; the
-> validation/moderation boundary moves with it.
 > **Godot version:** 4.6.2 stable

 ## 1. Overview
@@ -237,62 +237,6 @@ snapshot_state:

 ---

-## 7a. Server Orchestration (implemented, PC3 Phase 2)
-
-**One dedicated server process per world**, spawned on demand.
-
-```
-client                    backend (single worker)              host
-  │  POST /api/worlds/{id}/join  (bearer JWT)                    │
-  │ ───────────────────────────▶ GameServerSupervisor           │
-  │                              ensure_server(world_id):        │
-  │                                if none running for world ─── spawn:
-  │                                                              godot --headless
-  │                                                              res://scenes/server.tscn --
-  │                                                              --port <p> --world <id>
-  │                                                              --status-file <path>
-  │  ◀─────────────────────────── { host, port, world_id }       │
-  │                                                              │
-  │  ENet connect  host:port ───────────────────────────────────▶ dedicated server
-```
-
- **Supervisor** (`backend/app/services/game_servers.py`): in-process singleton,
-  so the backend MUST run single-worker. Keys servers by `world_id`. Allocates
-  ports from `GAME_SERVER_PORT_MIN..MAX`. A background reaper kills a world's
-  server once its **status file** (`{players, tick, updated}`, rewritten by the
-  server ~1×/s) reports `players == 0` for `GAME_SERVER_IDLE_TIMEOUT_SECONDS`.
-  No crash-restart — the next join respawns.
- **Enable flag:** `GAME_SERVERS_ENABLED` (default off). The checkpoint/playtest
-  launcher (`pm/checkpoint_ops.py`) turns it on, passes `GODOT_BIN`,
-  `GAME_PROJECT_DIR`, and `GAME_SERVER_HOST` (the LAN IP baked into the `.exe`).
-  A backend with it off returns **503** from `/join`, and the client falls back
-  to local single-player.
- **Per-world content:** all worlds currently load the same test level (M2/M7
-  work). `world_id` still scopes a distinct process + session.
-
-### 7b. Client play path
-
-`world_list.gd` → `POST /join` → `Session.begin(world_id, host, port)` →
-load `game.tscn`. `game.gd` sees `Session.active` and connects a
-`NetworkClient`:
-
- **Local player** keeps predicting with its own collision-aware
-  `CharacterBody3D` (`player.gd`) — that *is* the prediction. Its input frame
-  (`player.net_input`) is forwarded to the server every physics tick.
- **Correction backstop:** if the local position drifts from the server's by
-  more than `CORRECTION_THRESHOLD` (1.5 m — generous; catches teleport / a wall
-  walked through / real desync, not prediction noise) it snaps.
- **Remote players:** rendered from snapshots, position lerped. *Appearance sync
-  is a follow-up* — remotes currently show as labelled capsules; the server
-  does not yet replicate avatar loadouts.
- **Disconnect** → status message → back to the world list.
-
-The `NetworkClient`'s own flat-plane prediction + input-replay reconciliation
-(§5) is exercised by `smoke_test_network_client.gd`; the collision-aware game
-path above uses the lighter `send_input()` + drift-snap instead.
-
---
-
 ## 8. Security & Anti-Cheat

 - **No client-authoritative gameplay values.** Clients only send *inputs* and
@@ -1,194 +0,0 @@
-# PC2 Test Level & Player Spawn — Design Note
-
-> **Status:** Decided (PC2)
-> **Owner:** Architecture
-> **Consumers:** the two PC2 implementation tasks — (1) build the test level,
-> (2) build the player & spawn it. Both must be able to follow this note
-> without further design decisions.
-
-## 1. Decision: static scene, not chunk streaming
-
-**The PC2 playable test level is a single, hand-authored, static Godot 3D
-scene.** It is **not** built through the chunk streaming system
-(`scripts/chunk_stream_manager.gd`, `chunk_scene.gd`, `chunk.gd`,
-`chunk_data_decoder.gd`).
-
-This is a deliberate decision, not a default:
-
- **The streaming system has never been exercised with real content.** It is a
-  faithful port of the `docs/architecture/world.md` format spec, but nothing in
-  the project produces or serves chunk payloads for it to consume. `scenes/main.tscn`
-  wires `chunk_stream_manager.gd` onto a bare `Node3D` with no `player` reference
-  and no `_server_rpc`, so at runtime it does nothing. There is no server-side
-  chunk authoring/streaming endpoint to integrate against.
- **PC2 scope is single-player, local-only, no networking.** The value of chunk
-  streaming is server-authoritative streaming around a moving player across a
-  network boundary. None of those preconditions exist in PC2, so exercising the
-  pipeline here would mean building a chunk *authoring + serving* path first —
-  clearly out of checkpoint scope.
- **A static scene is the lowest-risk way to get "spawn a player in a real 3D
-  level and walk around" working**, which is the actual PC2 outcome being tested.
-
-Chunk streaming is **not removed and not broken by this decision** — it stays as
-an optional, later milestone. The static level is the PC2 proof of the *player*
-and *camera/physics* half of the problem; chunk streaming remains the later proof
-of the *world data* half.
-
-## 2. Where things live
-
-| Artifact | Path | Owned by |
-|---|---|---|
-| Test level scene | `scenes/worlds/test_level.tscn` | level task |
-| Player scene | `scenes/player.tscn` | player task |
-| Player controller script | `scripts/player.gd` | player task |
-| Game composition scene | `scenes/game.tscn` | player task |
-
- **`scenes/worlds/`** is the convention for all level scenes (it does not exist
-  yet; the level task creates it). Future levels follow `scenes/worlds/<name>.tscn`.
- `scenes/player.tscn` is **reusable** across levels — it must not hard-code any
-  reference to `test_level`; it discovers the spawn point at runtime (see §3).
-
-## 3. Player spawn convention
-
-The level scene **must** contain a `Marker3D` named exactly **`PlayerSpawn`**.
-That node's world transform is the spawn point.
-
- `Marker3D` is a plain `Node3D` that shows a cross gizmo in the editor and
-  carries no gameplay behavior — it is the established Godot idiom for "position
-  hint." (Confirmed present in Godot 4.6.2.)
- The marker's **position** is authoritative; its rotation is ignored by the
-  player (spawn yaw is the player's concern, default forward is fine).
- Coordinate system: **Y-up, units = meters, 1 unit = 1 m.** The marker must sit
-  at least **1.0 m above the ground's top surface** (recommended `y = 1.0` where
-  the ground top is `y = 0`) so the player capsule does not spawn intersecting
-  the floor and get popped out by the physics solver.
- There is exactly **one** `PlayerSpawn` per level. (If a level ever needs
-  multiple spawns, that is a later convention — not PC2.)
-
-**Lookup rule (implemented by `player.gd`, not by the level):**
-
-```
-# in player.gd _ready()
-var spawn := get_tree().current_scene.find_child("PlayerSpawn", true, false)
-if spawn is Node3D:
-    global_position = spawn.global_position
-else:
-    push_warning("player.gd: no PlayerSpawn marker found; spawning at origin")
-    global_position = Vector3(0, 1.0, 0)   # fallback, do not crash
-```
-
-The lookup runs from the current scene root so it finds the marker whether it is
-a direct child of the level instance or nested under a `Level` wrapper. The
-fallback keeps the player runnable in a scene that forgot its marker, but a
-**missing `PlayerSpawn` is a level bug** and the level task's smoke test must fail
-on it (see §6).
-
-## 4. Composition (who puts level + player together)
-
-`scenes/game.tscn` is the PC2 playable entry point:
-
-```
-Game (Node3D)
-├── Level      (instance of res://scenes/worlds/test_level.tscn)
-└── Player     (instance of res://scenes/player.tscn)
-```
-
- `Game` is a plain `Node3D` with **no script** — composition is done by scene
-  instantiation, not code, so there is nothing to keep in sync.
- The **level scene is self-contained and has zero dependency on the player** —
-  it loads and is smoke-testable on its own. The level task does not instance or
-  reference `player.tscn`.
- The **player scene is self-contained and has zero dependency on any specific
-  level** — it only requires that the *current scene* contains a `PlayerSpawn`.
- Ownership of `game.tscn` goes to the **player task**, which depends on the
-  level task having landed `test_level.tscn` first (chain with `depends_on`).
-
-## 5. Level content requirements (level task)
-
-`scenes/worlds/test_level.tscn`, root node `TestLevel` (`Node3D`). Required
-children:
-
-| Node | Type | Notes |
-|---|---|---|
-| `Ground` | `StaticBody3D` | `BoxShape3D` (e.g. `40 × 1 × 40`) centered at `(0, -0.5, 0)` so the **top face is `y = 0`**; matching `MeshInstance3D` (`BoxMesh`) so it is visible and collidable. Use a `StaticBody3D` rather than a bare `PlaneMesh` so collision is explicit and reliable. |
-| `Props` | `Node3D` | 3–5 simple props as `StaticBody3D` + `MeshInstance3D` using built-in primitives only (`BoxMesh`, `CylinderMesh`, `SphereMesh`). `assets/` is empty and PC2 must not require imported content. Positioned on the ground surface; scale freely. |
-| `Sun` | `DirectionalLight3D` | Pitch it downward (~ -45°), enable shadows if the compatibility renderer allows; shadows are optional. |
-| `WorldEnvironment` | `WorldEnvironment` | Ambient light and/or a simple background color. Keep it plain — the project uses `gl_compatibility`. |
-| `PlayerSpawn` | `Marker3D` | Per §3. Recommended `(0, 1.0, 0)`. |
-
-Notes:
-
- **Do not** add any `script` to the level. It is pure content. Any per-level
-  behavior belongs to the player (or a future game-mode script), not the level.
- Keep the whole level on the XZ plane around the origin; nothing off at extreme
-  coordinates, no thin walls the capsule can tunnel through.
-
-## 6. Player contract (player task)
-
-`scenes/player.tscn`, root `Player` (`CharacterBody3D`) + `scripts/player.gd`.
-
-Minimum for PC2:
-
- **Body:** `CharacterBody3D` with a `CollisionShape3D` using `CapsuleShape3D`
-  (~`radius 0.3`, ~`height 1.8`) and a matching `CapsuleMesh` for visibility.
- **Camera:** a `Camera3D` child. First-person (camera at capsule head height) is
-  the lowest-risk choice; third-person is fine too but is more work.
- **Spawn:** per §3 — read `PlayerSpawn` from the current scene, fall back
-  gracefully.
- **Movement:** gravity + `move_and_slide()` so the player stands on `Ground`.
-  WASD/arrow locomotion is the hard requirement. Mouse-look is recommended but
-  may be split into its own task if the controller grows.
- **No networking, no avatar UI, no chunk code** — PC2 is local-only. Do not add
-  `MultiplayerAPI`, `ChunkStreamManager`, or any avatar customization here.
-
-The player must work when instanced under `Game` alongside a level; it must not
-assume it is the only node in the scene.
-
-## 7. Entry point / how a human plays it
-
- `scenes/game.tscn` is the PC2 playable scene. For playtesting, load it directly
-  (e.g. `godot --path . scenes/game.tscn`), or temporarily set
-  `application/run/main_scene` to it.
- **Wiring "Play → Join a world" in the existing `world_list` UI is out of scope
-  for this note** and out of scope for the level/player tasks. The current menu
-  flow ends at browse-worlds (PC1). If a checkpoint wants a clickable path into
-  the test level, that navigation wiring is its own small task — do not fold it
-  into level or player.
-
-## 8. Validation (both tasks must run this before "done")
-
-```sh
-# one-time, first checkout only — builds the class/import cache
-godot --headless --path . --import
-
-# then, to catch parse/load errors:
-godot --headless --path . --quit
-```
-
- **Level task:** additionally load `test_level.tscn` headlessly and assert it
-  (a) loads without error and (b) contains a `Marker3D` named `PlayerSpawn`
-  positioned ≥ 1.0 m above the ground top. A smoke script following the existing
-  `scripts/smoke_test_*.gd` pattern is the right vehicle.
- **Player task:** a smoke test that instantiates `game.tscn`, waits a frame,
-  and asserts the player's global position equals the `PlayerSpawn` position
-  (within a small epsilon). This is the check that proves the spawn convention
-  actually wired through — not just "the scene loads."
-
-## 9. Explicitly out of scope for PC2
-
- Networking / multiplayer / prediction (single-player, local-only).
- Chunk streaming integration and server-side chunk authoring/serving.
- Avatar customization UI and glTF avatar loading.
- Join-a-world navigation from the world list.
- Any content moderation / age-gating logic in the level.
-
-## 10. Summary
-
-| Concern | Decision |
-|---|---|
-| Level construction | Static hand-authored Godot 3D scene (chunk streaming deferred, not removed) |
-| Level location | `scenes/worlds/test_level.tscn` |
-| Spawn convention | `Marker3D` named `PlayerSpawn`, ≥ 1.0 m above ground, looked up by the player |
-| Player | `scenes/player.tscn` (`CharacterBody3D`) + `scripts/player.gd`, reusable across levels |
-| Composition | `scenes/game.tscn` instances `Level` + `Player`; no script |
-| Entry point | Load `scenes/game.tscn` directly; UI join-wiring deferred |
@@ -1,10 +1,6 @@
 # World Chunk Data Format & Persistence Architecture

-> **Status:** Proposed. The chunk format (§2, §3) is normative and implemented
-> on the client. **§4 (SQLite schema) and §5 (write ownership / write-behind)
-> are superseded by [`world_persistence_impl.md`](world_persistence_impl.md)**,
-> which stores chunks in the existing Postgres backend and makes the FastAPI
-> process — not the per-world Godot server — the sole writer.
+> **Status:** Proposed
 > **Owner:** Platform team
 > **Related:** Server authority + client prediction, avatar component system, content moderation & age verification, backend auth (JWT)

@@ -1,655 +0,0 @@
-# World Persistence: Server-Side Implementation Architecture
-
-> **Status:** Accepted (design). Implementation is split across two follow-on
-> tasks (backend endpoints; editor wiring).
-> **Owner:** Platform team
-> **Supersedes:** the *storage engine* and *write ownership* parts of
-> [`world.md`](world.md) §4 and §5. Everything else in `world.md` — the chunk
-> logical model, the JSON and binary encodings, checksums, revisions, content
-> flags — stands unchanged and is normative.
-> **Related:** [`world.md`](world.md) (chunk format), [`editor.md`](editor.md)
-> (authoring surface), [`networking.md`](networking.md) (ENet sim transport),
-> [`content_moderation.md`](content_moderation.md) (flags & gating).
-
-## 1. Why this document exists
-
-`world.md` was written during the client-side chunk-streaming work (M2). It
-assumes **one** server that owns **one** embedded SQLite file and is both the
-authoritative simulation and the authoritative store. That is not the system we
-built. What actually exists today is:
-
-| Process | Lifetime | Owns | Code |
-|---|---|---|---|
-| FastAPI backend | always on, single worker | Postgres (users, worlds, assets, avatar loadouts), game-server orchestration | `backend/app/` |
-| Godot dedicated server, one per world | **spawned on join, reaped ~5 min after the last join when empty** | nothing durable; a 30 Hz in-memory player sim | `scripts/server.gd`, spawned by `backend/app/services/game_servers.py` |
-| Godot client | player session | local chunk streaming, the in-game editor (planned) | `scripts/chunk_stream_manager.gd`, `scripts/chunk_data_decoder.gd` |
-
-Nothing server-side has ever stored or served a real chunk. `server.gd`
-`preload()`s `res://scenes/worlds/test_level.tscn` for **every** world and uses
-`world_id` only for logging and the status file. `ChunkStreamManager` has a
-`set_server_rpc()` seam that no code calls. The backend's `World` model is
-metadata only (`id`, `name`, `description`, `owner_id`, `visibility`).
-
-This document decides where chunk content lives, who may write it, how the
-dedicated server gets it, and the exact API surface — so the two implementation
-tasks that follow have no architectural decisions left to make.
-
---
-
-## 2. Decisions at a glance
-
-| # | Question | Decision |
-|---|---|---|
-| D1 | Where does chunk data live at rest? | **Postgres**, in the existing backend database. Not a per-world SQLite file. |
-| D2 | Who writes it? | **The FastAPI backend, exclusively.** The editor writes through it over HTTP with optimistic concurrency. The dedicated Godot server never writes world content. |
-| D3 | How does the dedicated server get content? | **HTTP pull from the backend at startup**, over a loopback-only `/api/internal` route authenticated by a per-spawn token the supervisor mints. Lazy fetch as players roam. |
-| D4 | Edit while a live session exists? | **Out of scope this milestone, with a defined seam.** The editor is a non-joined client mode; writes always succeed and the response flags `live_session` so the UI can say "players see this when the session restarts". |
-| D5 | Edit granularity on the wire | **Full-chunk PUT with `base_revision`**, not RFC-6902 deltas. |
-| D6 | Client chunk transport | **HTTP from the backend**, not ENet from the dedicated server. The `set_server_rpc()` seam is satisfied by an HTTP-backed adapter. |
-
---
-
-## 3. D1 — Chunk data lives in Postgres
-
-### 3.1 Decision
-
-World content (rooms, chunk payloads, chunk revisions) is stored in the
-**existing Postgres database**, alongside `worlds`, in new tables created by an
-Alembic migration. `world.md` §4's `world.db` SQLite file is **not** built.
-
-The chunk **payload stays exactly what `world.md` §3.6 specifies**: the 48-byte
-header + sectioned binary body, checksummed with SHA-256. It moves from a
-SQLite `BLOB` to a Postgres `BYTEA`. Nothing about the format changes, so
-`scripts/chunk_data_decoder.gd` remains correct and the format spec stays the
-single contract.
-
-### 3.2 Reasoning
-
-1. **SQLite's premise does not hold here.** `world.md` §4 justifies SQLite as
-   "ideal for a server that owns the world store". No process in this system
-   owns a world store: the only process that could plausibly hold the file (the
-   dedicated Godot server) is *ephemeral* — reaped when idle, `SIGTERM`'d on
-   backend shutdown, `SIGKILL`'d 10 s later if it doesn't exit, and orphaned
-   entirely if the backend dies. Meanwhile the editor must write when no such
-   process exists. So the file would have to be shared by two processes with
-   independent lifetimes, which is precisely the workload SQLite's
-   single-writer/file-lock model handles worst.
-2. **Postgres is already a hard dependency; SQLite would be a second one.** The
-   backend cannot start without Postgres. Adding a per-world SQLite file adds a
-   second storage engine, a second migration system (`world.md` §4.8 specifies a
-   hand-rolled `meta.schema_version` runner *next to* the Alembic we already
-   have), a second backup story, and a second consistency story.
-3. **Referential integrity with metadata we already have.** `worlds` rows carry
-   `owner_id` and `visibility`, and every authorization rule for content derives
-   from them. In one database this is a join and a foreign key with
-   `ON DELETE CASCADE`; across two engines, deleting a world silently orphans a
-   file on disk and every ownership check becomes a cross-store read.
-4. **Concurrency is the normal case, not the edge case.** Two creators editing
-   one world, or an editor writing while the backend serves chunks to a running
-   dedicated server, are ordinary. Postgres gives row-level MVCC and real
-   transactions for the read-modify-write in §5.4; SQLite gives a database-level
-   write lock and `SQLITE_BUSY`.
-5. **The repo already has the precedent and the plumbing.** `avatar_loadouts`
-   (migration `0004`) stores a client-shaped document in Postgres JSONB rather
-   than inventing a side store, and `backend/app/database.py` already provides
-   the async session factory this code will use.
-
-### 3.3 What we give up, and why it's acceptable
-
- **Zero-config embedding.** Irrelevant — the backend already requires a
-  configured Postgres.
- **`world.md` §5.5 write-behind + the `dirty` column.** Deliberately dropped
-  (§4.4). It existed to amortize disk I/O for a process that owned the file. Our
-  writes are human-rate editor saves, not sim-rate; each one is a single
-  transaction and is durable when the HTTP response returns. Dropping it also
-  deletes the entire "unclean shutdown recovery" scan in §5.5 — there is no
-  window in which committed content can be lost.
- **Sharding by `world_id` (`world.md` §8).** Postgres partitioning by
-  `world_id` remains available on the same table shape if a single table ever
-  becomes a bottleneck. At ~2–8 KB per chunk, 10 000 chunks is under 100 MB.
-
---
-
-## 4. Schema (Alembic migration `0005_add_world_content_tables`)
-
-New model module: `backend/app/models/world_content.py`, registered in
-`backend/app/models/__init__.py`. `backend/app/models/world.py` is left alone
-except for one added relationship, so nothing PC1/PC2 depends on moves.
-
-Conventions follow the existing models: `Column(...)` declarative style,
-`Integer` surrogate PKs, `DateTime(timezone=True)` with `server_default=func.now()`,
-JSONB for document-shaped fields (as `avatar_loadout.py` does).
-
-### 4.1 `world_rooms`
-
-```python
-class WorldRoom(Base):
-    __tablename__ = "world_rooms"
-
-    id         = Column(Integer, primary_key=True, index=True)
-    world_id   = Column(Integer, ForeignKey("worlds.id", ondelete="CASCADE"),
-                        nullable=False, index=True)
-    slug       = Column(String(64), nullable=False)   # url-safe; "main" by default
-    name       = Column(String(255), nullable=False)
-    # Chunk grid config. world.md §2.2 puts this on the world; it lives on the
-    # room so a world can later hold rooms with different grids, and so this
-    # migration is purely additive (the existing `worlds` table is untouched).
-    grid       = Column(JSONB, nullable=False,
-                        server_default='{"size": [32, 32, 1], "origin": [0, 0, 0]}')
-    bounds     = Column(JSONB, nullable=True)   # {"min":[x,y,z], "max":[x,y,z]}; null = unbounded
-    spawn      = Column(JSONB, nullable=True)   # {"pos":[x,y,z], "yaw": 0.0}
-    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
-    updated_at = Column(DateTime(timezone=True), server_default=func.now(),
-                        onupdate=func.now(), nullable=False)
-
-    __table_args__ = (UniqueConstraint("world_id", "slug", name="uq_world_rooms_world_slug"),)
-```
-
-`World` gains
-`rooms = relationship("WorldRoom", back_populates="world", cascade="all, delete-orphan")`.
-
-Every world gets a `main` room: created in `create_world`, and lazily created on
-first room read/write for worlds that predate the migration. `grid` defaults
-match `Chunk.CHUNK_SIZE_*` in `scripts/chunk.gd`, which is the client's source
-of truth for the same constants.
-
-### 4.2 `world_chunks`
-
-```python
-class WorldChunk(Base):
-    __tablename__ = "world_chunks"
-
-    id             = Column(Integer, primary_key=True, index=True)
-    world_id       = Column(Integer, ForeignKey("worlds.id", ondelete="CASCADE"),
-                            nullable=False, index=True)   # denormalized: world-scoped queries
-    room_id        = Column(Integer, ForeignKey("world_rooms.id", ondelete="CASCADE"),
-                            nullable=False, index=True)
-    chunk_key      = Column(String(160), nullable=False, unique=True)   # see §4.5
-    cx             = Column(Integer, nullable=False)
-    cy             = Column(Integer, nullable=False)
-    cz             = Column(Integer, nullable=False, server_default="0")
-
-    format_version = Column(Integer, nullable=False, server_default="1")
-    payload        = Column(LargeBinary, nullable=False)   # world.md §3.6 bytes, BYTEA
-    payload_len    = Column(Integer, nullable=False)
-    checksum       = Column(String(64), nullable=False)    # SHA-256 hex of payload body
-    revision       = Column(Integer, nullable=False, server_default="1")
-
-    content_flags  = Column(JSONB, nullable=False, server_default="{}")  # world.md §3.4
-    is_mature      = Column(Boolean, nullable=False, server_default="false")
-
-    updated_by_id  = Column(Integer, ForeignKey("users.id", ondelete="SET NULL"), nullable=True)
-    created_at     = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
-    updated_at     = Column(DateTime(timezone=True), server_default=func.now(),
-                            onupdate=func.now(), nullable=False)
-
-    __table_args__ = (
-        UniqueConstraint("room_id", "cx", "cy", "cz", name="uq_world_chunks_coord"),
-        Index("ix_world_chunks_room_coord", "room_id", "cx", "cy", "cz"),
-        Index("ix_world_chunks_mature", "world_id", postgresql_where=text("is_mature")),
-    )
-```
-
-Deltas from `world.md` §4.4:
-
- **Surrogate `id` PK + unique coordinate constraint**, with `chunk_key` kept as
-  a unique denormalized column. The key string is the client-facing contract
-  (`Chunk.build_key`) and is embedded in the payload, so storing it gives a
-  single-index lookup by key; the coordinate constraint is what actually
-  enforces one chunk per cell.
- **`dirty` removed** — see §3.3.
- **Content flags folded into the chunk row as JSONB + an indexed `is_mature`
-  boolean**, instead of `world.md` §4.6's separate 11-column `content_flags`
-  table. The flags are a document the client already produces in exactly this
-  shape (`ChunkDataDecoder.ContentFlags.to_dict()`), the only query we anticipate
-  is "is this mature", and folding them in removes a second write per save and
-  the `object_id = ''` sentinel hack that §4.6 needed to work around SQLite's
-  NULL-in-primary-key behaviour (Postgres has the same NULL semantics, so the
-  hack would have carried over).
- **`world.md` §4.5 `chunk_objects` is deferred, not dropped.** It is a derived
-  index that exists to answer queries ("which chunks contain a door?") that no
-  code asks yet, and maintaining it means a delete-and-reinsert of every object
-  row on every save. It is fully rebuildable from `payload`, so it can be added
-  in its own migration the day a query needs it, with a backfill. Do **not**
-  build it in `0005`.
-
-### 4.3 `world_chunk_revisions`
-
-```python
-class WorldChunkRevision(Base):
-    __tablename__ = "world_chunk_revisions"
-
-    id         = Column(Integer, primary_key=True, index=True)
-    chunk_key  = Column(String(160), nullable=False, index=True)  # deliberately NOT a FK
-    world_id   = Column(Integer, nullable=False, index=True)      # also not a FK, same reason
-    revision   = Column(Integer, nullable=False)
-    action     = Column(String(16), nullable=False)               # 'create' | 'update' | 'delete'
-    actor_id   = Column(Integer, ForeignKey("users.id", ondelete="SET NULL"), nullable=True)
-    checksum   = Column(String(64), nullable=False)
-    payload    = Column(LargeBinary, nullable=True)               # full payload at this revision
-    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
-```
-
-Kept from `world.md` §4.7 including its two design points: the full payload is
-stored (rollback needs it) and `chunk_key`/`world_id` are **not** foreign keys,
-so deleting a chunk or a world preserves the audit trail.
-
-**Retention (new, required):** this table grows without bound — a creator
-dragging a brush can produce hundreds of revisions per minute. The
-implementation must ship a retention policy from day one: keep the newest
-`WORLD_CHUNK_REVISION_KEEP` (default 20) payloads per `chunk_key` and null out
-`payload` on older rows (keeping the metadata row for the audit trail), pruned
-in the same transaction as the write. A `created_at` index supports a later
-time-based prune.
-
-### 4.4 Config additions (`backend/app/config.py`)
-
-```
-WORLD_CHUNK_MAX_PAYLOAD_BYTES: int = 1_048_576   # 1 MiB; a dense 32×32 uint16 layer is 2 KiB
-WORLD_CHUNK_MAX_OBJECTS: int = 512
-WORLD_CHUNK_MAX_BATCH: int = 64
-WORLD_CHUNK_REVISION_KEEP: int = 20
-GAME_SERVER_INTERNAL_API_URL: str = "http://127.0.0.1:8000"
-```
-
-### 4.5 Chunk key format
-
-`world.md` §2.3 specifies `"{world_id}:{room_id}:{cx}:{cy}:{cz}"` and illustrates
-it with `w_0001:r_0001`. Those ids were illustrative. The real key uses the
-backend's identifiers:
-
-```
-"{world.id}:{room.slug}:{cx}:{cy}:{cz}"      e.g.  "12:main:3:-1:0"
-```
-
-The room **slug** rather than its numeric id, so a key is human-readable in logs
-and stable if rooms are ever re-imported. `Chunk.build_key()` in
-`scripts/chunk.gd` already produces this shape unmodified.
-
---
-
-## 5. D2 — The FastAPI backend is the only writer
-
-### 5.1 Decision
-
-The in-game editor (`editor.md` §7.2) submits edits over **HTTP to the FastAPI
-backend**, which validates, versions, and persists them. The dedicated Godot
-server process **never writes world content** and does not sit in the edit path.
-
-This preserves `world.md`'s and `editor.md`'s actual invariant — *clients never
-touch storage; they submit edits to a server-authoritative tier that validates
-them* — while identifying that tier as the always-on backend rather than the
-ephemeral sim process. `editor.md` §4.2's claim that edits ride the same
-`request_chunk_edit` RPC as gameplay is the one part of that doc this design
-changes; the moderation and validation properties it derives from that claim are
-unaffected, because the validation boundary moves with the writer.
-
-### 5.2 Reasoning
-
-1. **Nothing that can vanish in 300 seconds may own the write path.** The reaper
-   in `game_servers.py` `stop()`s an idle server with `SIGTERM` and escalates to
-   `SIGKILL` after 10 s; `supervisor.shutdown()` does the same to every server on
-   backend shutdown; and if the backend dies uncleanly the servers are orphaned
-   with no one to flush them. Because the sim process holds no unsaved world
-   content in this design, **no reap, crash, or kill can ever lose world data** —
-   that is the single strongest practical reason for this split.
-2. **Editing must work with no dedicated server running.** A creator opening
-   their world to build should not have to spin up a 30 Hz sim process, burn a
-   port from the 100-port range, and hold it for 5 minutes past their last save.
-3. **`server.gd` has no database access, no credentials, and no HTTP client.**
-   Routing writes through it means either shipping Postgres credentials into a
-   process spawned per join, or building an ENet→HTTP proxy inside the sim loop.
-   Both are strictly worse than the editor calling the backend directly.
-4. **Authorization already lives in the backend.** `CurrentUser`, the
-   `owner_id` check, and `WorldVisibility` are all there. The dedicated server
-   has no user identities at all — it knows peer ids, not accounts.
-
-### 5.3 Authorization
-
- **Read** a chunk: the same rule as `GET /api/worlds/{id}` — the world is
-  `PUBLIC`, or the caller owns it. Otherwise 404 (not 403), matching the
-  existing routers' deliberate non-disclosure.
- **Write** a chunk: caller must be `world.owner_id`, matching `update_world`;
-  403 otherwise. Collaborator/role-based editing is future work and slots in at
-  this one check.
- **Mature gating hook:** `is_mature` chunks are where `content_moderation.md`'s
-  age gate attaches on the read path. Specify the column and the index now; the
-  gate itself lands with that doc's work.
-
-### 5.4 Concurrency
-
-Optimistic concurrency exactly as `world.md` §5.4, expressed over HTTP:
-
-1. Reader gets `revision` (header `X-Chunk-Revision`, or the JSON field).
-2. Writer sends `base_revision`.
-3. The service does `SELECT ... FOR UPDATE` on the chunk row, compares
-   `base_revision` to `revision`, and either commits at `revision + 1` or returns
-   **409** with `current_revision` and `current_checksum` so the editor can
-   re-fetch and re-apply.
-4. `base_revision: 0` means "create; fail with 409 if it already exists".
-
-### 5.5 Validation (the backend must not trust the client)
-
-The write path decodes the submitted payload server-side before storing it. This
-requires a **Python port of the `world.md` §3.6 codec** —
-`backend/app/services/chunk_codec.py`, mirroring `scripts/chunk_data_decoder.gd`.
-It checks: magic `AGPC`, `format_version <= 1`, declared vs. actual
-`payload_len`, **recomputed** SHA-256 (the header's checksum is advisory), tile
-layer dims equal the room's `grid.size`, tile indices in palette range, object
-count ≤ `WORLD_CHUNK_MAX_OBJECTS`, object positions inside the chunk's bounds,
-`chunk_key` in the payload matching the URL, and string-field length limits
-(`world.md` §7). `content_flags` and `is_mature` are **recomputed** from the
-payload's flag sections, never taken from the request body.
-
-**Drift control (required):** the two codecs must be pinned by golden files —
-fixture chunks under `tests/fixtures/chunks/` encoded by one implementation and
-decoded byte-identically by the other, asserted in both the pytest suite and the
-Godot headless suite. Without this the format has two implementations and no
-contract test, which is exactly the failure `world.md` §5.2 was trying to avoid
-by having one shared implementation.
-
---
-
-## 6. D4 — Editing versus a live session (scope boundary)
-
-**In scope for this milestone:**
-
- The editor is entered as **"Edit world" from the world browser**: a non-joined
-  client mode. It does **not** call `POST /api/worlds/{id}/join`, does not open
-  an ENet connection, and does not spawn a dedicated server. It loads chunks over
-  HTTP, edits them locally, and saves them over HTTP.
- Writes always succeed regardless of whether a session is live. The write
-  response carries `live_session: bool` (from `supervisor.debug_state()`), so the
-  editor can surface *"this world has players in it right now — they'll see your
-  changes when the session restarts."*
- A dedicated server started **after** a write sees the new content, because it
-  loads from the store at startup (§7).
-
-**Explicitly out of scope, deferred:**
-
- Build-in-place while joined to a live session.
- `chunk_invalidated` push to connected clients (`world.md` §5.3) and hot-reload
-  of the dedicated server's collision world.
- Live collaborative editing / cursors (`editor.md` §9).
-
-**The seam that makes the deferred work cheap:** the manifest endpoint (§7.2)
-returns a monotonic `content_revision` for the world, bumped on every chunk
-write. Hot reload is then: the dedicated server polls the manifest on a timer
-(or the backend pushes to it over the same internal channel), re-fetches the
-chunks whose revision changed, and rebuilds those collision bodies. Nothing in
-this design has to change to add it.
-
-**Why the editor must not join:** if it joined, the sim process would enforce
-collision against content it loaded at spawn while the creator edits a diverging
-local copy — players would walk through new walls and bounce off deleted ones,
-with no error anywhere. Making build mode non-joined turns a silent correctness
-bug into an explicit product boundary.
-
---
-
-## 7. D3 — What the dedicated server does at startup
-
-### 7.1 Decision
-
-`server.gd` pulls its world's content from the backend over **HTTP** at startup,
-authenticated by a **per-spawn token** the supervisor mints, and **does not bind
-the ENet port until content is loaded**.
-
-Rejected alternative — *supervisor writes a whole-world snapshot file at spawn
-and passes `--world-file`*: attractive (no new auth surface, no HTTP client in
-the sim process), but it makes spawn latency proportional to world size, gives
-the server no way to fetch a chunk lazily as players roam beyond the preloaded
-set, and still needs a separate channel for the hot-reload work above. Rejected —
-*give the Godot process a Postgres connection*: there is no PG driver in
-GDScript, and it would put database credentials in a process spawned per join.
-
-### 7.2 Startup sequence
-
-1. `_parse_args()` gains `--api-url` and `--server-token` (§7.3).
-2. `GET /api/internal/worlds/{world_id}/manifest` → rooms, per-room `grid`,
-   `bounds`, `spawn`, `chunk_count`, and the world's `content_revision`.
-3. `GET /api/internal/worlds/{world_id}/rooms/{slug}/chunks?` bounds query for
-   the spawn neighbourhood (radius from the spawn point, default 3 chunks), then
-   fetch each payload; decode with the existing `ChunkDataDecoder` and build
-   static collision from the tile layers and objects.
-4. **Then** `network_peer.create_server(port)`, then write the status file.
-5. **Fallback:** if the backend is unreachable, the world has no rooms, or the
-   room has zero chunks, load `test_level.tscn` as today and record
-   `"content": "fallback"` in the status file. A content outage must never make
-   a world un-joinable, and this keeps every PC3 flow working before any world
-   has authored content.
-
-During the session the server may lazily fetch chunks as players approach
-unloaded coordinates, through the same internal route. It **never writes**.
-Dynamic entity runtime state (positions, health) stays in memory and out of
-chunks, exactly as `world.md` §3.3 already specifies. Shutdown flushes nothing.
-
-### 7.3 Internal authentication
-
-`GameServerSupervisor._spawn()` generates `token = secrets.token_urlsafe(32)`,
-stores it on the `_WorldServer` dataclass, and passes it on the command line
-alongside the existing `--port/--world/--status-file`. A FastAPI dependency
-`require_game_server` resolves `Authorization: Bearer <token>` against
-`supervisor.validate_token(world_id, token)` — a dict lookup, since the
-supervisor is an in-process singleton. Properties this gives us:
-
- A token grants access to **one** world and **dies with its process** (the
-  reaper's `del self._servers[wid]` invalidates it).
- No long-lived shared secret in config or on disk.
- It reuses the **already documented** single-worker constraint in
-  `game_servers.py`; it does not add a new one.
-
-Rejected alternative — *let the dedicated server use the public routes with a
-service user account*: the public routes enforce per-user visibility and
-ownership, which a service identity would have to be exempted from, and it would
-pollute `updated_by_id`/audit rows with a fake user. A separate `/api/internal`
-prefix keeps the two auth models apart and can be blocked at the reverse proxy.
-
-### 7.4 Lifecycle changes this requires in `game_servers.py`
-
-These are real, load-bearing findings from the current implementation:
-
- **`_await_port()` is the wrong readiness signal now.** It returns as soon as
-  the UDP port is bound, and the port is bound before content exists today. With
-  content loading it must await a `"ready": true` field that `server.gd` writes
-  to the status file *after* content load + `create_server`. Otherwise the
-  backend hands a client an address for a server that is still fetching chunks.
- **`_await_port()` fails open.** After its 8 s deadline it returns normally,
-  with no error — `ensure_server` then reports success for a server that may
-  never have started. Content loading makes a slow start more likely, so the
-  readiness wait needs a real timeout error (503 to the joining client) and a
-  longer, configurable deadline.
- **The status file is the only server→backend channel**, and `_spawn` currently
-  passes no credentials at all — hence §7.3.
- **`player_count()` returns 0 when the status file is missing or unparseable**,
-  so a live server whose status write fails can be reaped after the idle timeout.
-  Harmless for data (the sim owns nothing durable — the point of D2) but worth a
-  comment where the fallback lives.
- **No crash restart** (documented in the module docstring): if a server dies,
-  the next join respawns it and it reloads content from the store. With D2 this
-  is now genuinely safe rather than merely tolerated.
-
---
-
-## 8. API surface
-
-All paths are under the existing `worlds` router prefix (`/api/worlds`) unless
-noted. New router module: `backend/app/routers/world_content.py`, mounted at
-`/api/worlds`; internal routes in `backend/app/routers/internal.py` at
-`/api/internal`.
-
-### 8.1 Public (editor & player client; JWT `CurrentUser`)
-
-| Method | Path | Purpose |
-|---|---|---|
-| `GET` | `/api/worlds/{world_id}/rooms` | List rooms + grid config |
-| `POST` | `/api/worlds/{world_id}/rooms` | Create a room (owner) |
-| `GET` | `/api/worlds/{world_id}/rooms/{slug}/chunks` | Chunk **index** over a bounds query |
-| `GET` | `/api/worlds/{world_id}/rooms/{slug}/chunks/{cx}/{cy}/{cz}` | Fetch one chunk |
-| `PUT` | `/api/worlds/{world_id}/rooms/{slug}/chunks/{cx}/{cy}/{cz}` | Write one chunk |
-| `PUT` | `/api/worlds/{world_id}/rooms/{slug}/chunks` | Write up to `WORLD_CHUNK_MAX_BATCH` chunks atomically |
-| `DELETE` | `/api/worlds/{world_id}/rooms/{slug}/chunks/{cx}/{cy}/{cz}` | Delete one chunk |
-| `GET` | `/api/worlds/{world_id}/rooms/{slug}/chunks/{cx}/{cy}/{cz}/revisions` | Revision history (owner) |
-| `POST` | `/api/worlds/{world_id}/rooms/{slug}/chunks/{cx}/{cy}/{cz}/rollback` | Restore a revision (owner) |
-
-**Room list** — `GET .../rooms` → `200`
-
-```json
-[{ "id": 7, "slug": "main", "name": "Main",
-   "grid": { "size": [32, 32, 1], "origin": [0, 0, 0] },
-   "bounds": null,
-   "spawn": { "pos": [0, 1.5, 0], "yaw": 0.0 },
-   "chunk_count": 41 }]
-```
-
-**Chunk index** — `GET .../chunks?cx_min=&cx_max=&cy_min=&cy_max=&cz=0` → `200`.
-Payloads are *not* included; this is `world.md` §5.1's `list_chunks(bounds)` and
-lets a streamer decide what to fetch and skip anything already cached by
-checksum.
-
-```json
-{ "room": "main", "content_revision": 118,
-  "chunks": [{ "key": "12:main:0:0:0", "cx": 0, "cy": 0, "cz": 0,
-               "revision": 4, "checksum": "9f86…", "payload_len": 2344,
-               "is_mature": false, "updated_at": "2026-09-14T10:02:11Z" }] }
-```
-
-Bounds are capped (default 32×32 chunks per query) and return `422` beyond that.
-
-**Chunk fetch** — `GET .../chunks/{cx}/{cy}/{cz}`, content-negotiated:
-
- `Accept: application/octet-stream` (default for the game client) → `200` with
-  the raw `world.md` §3.6 bytes, `ETag: "<checksum>"`,
-  `X-Chunk-Revision: <n>`, `X-Chunk-Key: <key>`.
- `Accept: application/json` (tooling, tests, the editor's debug view) → the
-  §3.5 JSON encoding, decoded server-side from the payload. JSON is derived, never
-  stored, so there is no dual-write drift (`world.md` §4.4).
- `If-None-Match: "<checksum>"` → `304`. This is what makes the client's
-  `user://chunk_cache/` cache cheap and is why the checksum is the ETag.
- `404` if the chunk does not exist (an unwritten coordinate is not an error to
-  the streamer — it renders empty).
-
-**Chunk write** — `PUT .../chunks/{cx}/{cy}/{cz}`
-
-```
-Content-Type: application/octet-stream
-X-Base-Revision: 4          # 0 = create
-<binary payload>
-```
-
-or, for clients that prefer JSON:
-`{"base_revision": 4, "payload_b64": "…"}`.
-
-Responses:
-
-| Code | Body / meaning |
-|---|---|
-| `200` | `{"key", "revision", "checksum", "payload_len", "updated_at", "is_mature", "live_session"}` |
-| `409` | `{"detail": "revision conflict", "current_revision": 6, "current_checksum": "…"}` |
-| `403` | not the world owner |
-| `404` | world or room not found / not visible |
-| `413` | payload over `WORLD_CHUNK_MAX_PAYLOAD_BYTES` |
-| `422` | decode/validation failure (`{"detail", "reason"}`, e.g. `checksum_mismatch`, `layer_dims`, `object_out_of_bounds`) |
-
-**Batch write** — `PUT .../chunks` with
-`{"chunks": [{"cx","cy","cz","base_revision","payload_b64"}, …]}`. Applied in
-**one transaction, all-or-nothing**: if any entry conflicts, nothing is written
-and the response is `409` naming the offending coordinate. Justification: an
-editor brush stroke or an object drag routinely straddles a chunk boundary, and
-without a batch the editor either issues N round trips or leaves half of a user
-action persisted. Capped at `WORLD_CHUNK_MAX_BATCH` chunks and 8 MB.
-
-### 8.2 D5 — Full-chunk PUT, not JSON-Patch deltas
-
-`world.md` §5.4 specifies RFC-6902 deltas against `base_revision`. This design
-sends **whole chunks** instead.
-
- A 32×32×1 chunk is ~2 KB of dense tile indices plus its objects — a few KB.
-  The bandwidth a patch saves is negligible at editor rates.
- The stored form is an opaque binary blob. Patching it means the backend must
-  decode → apply a JSON-Patch → re-encode → re-checksum, i.e. implement and test
-  a *second* mutation format on top of the codec, with its own failure modes, and
-  keep it in sync with the client's patch generator. That is the same dual-path
-  drift risk `world.md` §5.2 exists to prevent.
- Lost-update protection comes from `base_revision`, not from the patch, so
-  nothing is given up on correctness.
-
-Delta encoding stays available as a pure bandwidth optimization later —
-`world.md` §8 already files it as future work.
-
-### 8.3 Internal (dedicated server; `require_game_server` token)
-
-| Method | Path | Purpose |
-|---|---|---|
-| `GET` | `/api/internal/worlds/{world_id}/manifest` | Rooms, grids, spawn, `content_revision`, chunk counts |
-| `GET` | `/api/internal/worlds/{world_id}/rooms/{slug}/chunks` | Bounds index (same shape as §8.1) |
-| `GET` | `/api/internal/worlds/{world_id}/rooms/{slug}/chunks/{cx}/{cy}/{cz}` | Binary payload |
-
-Read-only by construction — there is no internal write route, and adding one
-would violate D2. The token is world-scoped, so a path whose `world_id` differs
-from the token's world is `403`. These routes skip the per-user visibility check
-(the sim process has no user) and apply no mature gating (gating is a client/user
-concern; the server still needs collision).
-
-### 8.4 D6 — The client streams chunks over HTTP, not over ENet
-
-`world.md` §5.3 routes `request_chunk` / `chunk_data` over the game's ENet
-connection. This design has the playing client fetch chunks from the **backend
-over HTTP**, the same routes the editor uses.
-
- The dedicated server has no content the backend doesn't have; proxying bytes
-  through it adds a hop and puts multi-megabyte reliable transfers in contention
-  with the 30 Hz snapshot broadcast on the same ENet peer.
- HTTP gives caching for free — `ETag`/`If-None-Match` on the checksum, and a
-  local `user://chunk_cache/<checksum>` that survives sessions.
- `ApiClient` (`scripts/api_client.gd`) already carries the JWT and the result
-  contract; no new transport code.
-
-**This does not require rewriting `ChunkStreamManager`.** It already calls
-through a `set_server_rpc()` seam that only needs an object with
-`request_chunk(key)`. The editor-wiring task supplies an `HttpChunkSource` that
-implements that method against `ApiClient` and feeds
-`_on_chunk_data_received(key, bytes)` — which also finally gives that dormant
-seam a caller. Note the existing `_load_chunk()` builds its key with empty
-world/room ids (`Chunk.build_key("", "", coord)`); the adapter must supply the
-real world id and room slug.
-
---
-
-## 9. What each follow-on task owns
-
-**Backend task**
- `backend/app/models/world_content.py` + `0005_add_world_content_tables`
- `backend/app/services/chunk_codec.py` (Python port of `world.md` §3.6) and the
-  golden-file fixtures shared with the Godot suite
- `backend/app/services/world_store.py` (the `world.md` §5.1 service interface,
-  minus `flush_dirty`/`rebuild_index`, over Postgres)
- `backend/app/routers/world_content.py`, `backend/app/routers/internal.py`
- `game_servers.py`: per-spawn token, `--api-url`/`--server-token` args,
-  readiness-from-status-file instead of `_await_port` (§7.4)
- `create_world` creates the `main` room
-
-**Client/editor task**
- `HttpChunkSource` adapter → `ChunkStreamManager.set_server_rpc()`
- Editor save path (single + batch PUT), 409 conflict re-fetch-and-reapply,
-  `live_session` warning UI
- "Edit world" entry from the world browser that does **not** join
- `server.gd`: arg parsing, manifest + chunk fetch before `create_server`,
-  collision build from decoded chunks, `test_level.tscn` fallback,
-  `"ready"`/`"content"` fields in the status file
-
---
-
-## 10. Open questions (deliberately not decided here)
-
- **Hot reload / build-in-place** while a session is live (§6) — the
-  `content_revision` seam is in place for it.
- **Collaborator permissions** beyond `owner_id` — one check in §5.3.
- **Mature-content gating** on the read path — column and index exist; the
-  policy belongs to `content_moderation.md`.
- **`world_chunk_objects`** derived index — spec'd in `world.md` §4.5, build it
-  when a query needs it (§4.2).
- **Payload compression** — the §3.6 header reserves a flags bitmask; Postgres
-  TOAST already compresses `BYTEA`, so measure before adding a second layer.
- **Chunk streaming for very large worlds** — the bounds-query cap in §8.1 is a
-  guardrail, not a scaling plan.
@@ -1,72 +0,0 @@
-# Package Checkpoint 1 (PC1)
-
-Validated 2026-08-20 against `main` commit `927f9bd`, from a genuinely fresh
-clone (not a reused agent workspace).
-
-## Automated validation
-
-Run with `scripts/run_checkpoint_tests.py` — see
-`docs/testing/test_inventory.md` for exactly what each suite covers.
-
-| Check | Result |
-|---|---|
-| Alembic migrations, fresh DB | PASS |
-| Backend pytest | 68/68 PASS |
-| Godot smoke tests (4 files) | ALL PASS |
-| Linux export (`agp-game.x86_64`) | Builds, verified as a real ELF64 binary |
-| Windows export (`agp-game.exe`) | Builds, verified as a real PE32+ binary |
-
-## Problems found during this checkpoint (fixed, tracked as tasks)
-
- Roadmap showed the Godot Engine Scaffold feature amber despite 6/6 tasks
-  done — a historical data gap (a review-feedback follow-up task's
-  supersession link was never recorded, predating when that field started
-  being tracked). Backfilled in the PM database; confirmed green.
- `docs/testing/test_inventory.md` was stale (said 38 backend tests,
-  actually 68; said no integration tests existed, 4 real ones had landed).
-  Fixed via task `398bf1a22a2d` / PR #40.
-
-## What's actually testable right now
-
-Login/register/browse-worlds only — there's no joinable gameplay yet. That's
-the real scope of PC1; don't expect more when playtesting.
-
- Register a new account (18+ only, rejected otherwise)
- Log out, log back in with the same credentials
- Play → Browse Worlds — loads a (currently empty) world list with no errors
-
-## Manual playtest: backend on cloudbison, client on pinkbison
-
-As of 2026-08-20 this is dashboard-controlled — no terminal commands, no
-env vars, no editing files. Foolproof enough to hand to someone else.
-
-### 1. On cloudbison — the AGP dashboard
-
-Open the dashboard (`http://cloudbison:7070`, or its Tailscale address) and
-go to **PC1** in the nav bar (`/checkpoint/PC1`). Click **Start Backend** —
-it pulls the latest `main`, stands up Postgres, runs migrations, and starts
-the API server, all in one step. The page shows the LAN address it's
-reachable at once it's up (under a minute).
-
-When you're done playtesting, click **Stop & Clean Up** on the same page —
-it tears down everything that step started (API server, Postgres
-container, its volume and network). Nothing is left running or lying
-around afterward, even if the dashboard itself gets restarted in between.
-
-### 2. On pinkbison — download and run the .exe
-
-Same dashboard page: click **Build .exe** the first time (or **Rebuild** to
-pick up newer changes) — this pulls the latest `main` and exports a Windows
-binary with cloudbison's backend address already baked in. Click
-**Download agp-game.exe**, copy it to pinkbison, and just run it. No
-environment variable, no config file, no build step on pinkbison at all.
-
-### 3. Tear down when done
-
-**Stop & Clean Up** on the dashboard page. That's it.
-
-## Status
-
-`config/checkpoint_focus_feature_ids` in the AGP framework (`~/agp`) still
-restricts agent claiming to the 5 PC1-scope features. Agents will not move
-on to post-PC1 work until that's widened.
@@ -1,97 +0,0 @@
-# Package Checkpoint 3 (PC3)
-
-> **Status: partial.** PC3's planned scope was M4-avatars + M5-multiplayer +
-> Foundation Hardening + M6–M10 (see `docs/build-plan-v1.md`). As of
-> 2026-09-05, **M4, M5, and most of Foundation Hardening are done and
-> checkpoint-verified**; M6–M10 have not been started. This doc records what
-> is real. Whether to call this "PC3" (redefined scope, M6–M10 → PC4) or keep
-> PC3 open is a user decision.
-
-Built by Claude directly (fleet offline), branch `pc3` → `main`.
-
-## What's real and verified (`scripts/run_checkpoint_tests.py`, all green)
-
-| Check | Result |
-|---|---|
-| Alembic migrations, fresh DB | PASS |
-| Backend `pytest` | 77/77 PASS (hermetic — auto-starts an ephemeral Postgres) |
-| Godot smoke tests (~16 files) | ALL PASS |
-| `smoke_test_network_client` (real dedicated server) | 4/4 PASS |
-| 2-player multiplayer (`run_multiplayer_2p_test.sh`) | PASS |
-| Fresh-clone boot (`verify_fresh_clone.sh`) | PASS |
-| Linux + Windows exports | Build as real ELF64 / PE32+ binaries |
-
-### M4 — Avatars in the game
-
- Placeholder avatar pack (14 GLBs, rigged 24-bone base body + attachments)
-  generated by `scripts/tools/gen_placeholder_avatars.gd`. Real art is a
-  content swap — catalog paths are stable.
- The avatar **loader was fixed** — it had never run against a real skeleton
-  (`Skeleton3D.has_bone()` isn't a Godot 4 method; the bone-copy dropped the
-  skin binding; attachments were parsed then discarded).
- `avatar_visualizer.gd` **rewritten** — the old one referenced a loader API
-  that never existed and didn't compile.
- Persistence: `avatar_loadouts` table + `GET/PUT /api/avatar/loadout`
-  (loadout stored as one JSON doc; server validates the envelope only).
- Wired into gameplay: the in-world player renders as the assembled avatar
-  (not a capsule); the loadout is fetched at login; "Customize Avatar" from
-  the main menu saves through to the backend.
- **Follow-up:** camera is still first-person, so the local player doesn't
-  see their own avatar much (third-person is a polish item); remote players'
-  avatar appearance is not replicated yet (they show as labelled capsules).
-
-### M5 — Real multiplayer
-
- `server.gd` **actually runs a sim now** — loads the world level, spawns a
-  server player per peer, processes each peer's input queue in seq order at a
-  fixed 30 Hz, broadcasts full snapshots with a per-peer `last_seq`. (The
-  input queue was a no-op before.)
- `network_client.gd` reconciliation **replays in-flight inputs** from the
-  authoritative state (drops acked ones), snaps only on real drift.
- **Server orchestration** (`backend/app/services/game_servers.py`): one
-  headless Godot dedicated-server process per world, spawned on demand by
-  `POST /api/worlds/{id}/join`, port-allocated, with a status-file idle
-  reaper. Off by default; the playtest launcher (`checkpoint_ops.py`)
-  enables it.
- **Client play path**: world browser → `/join` → `Session` → `game.tscn`
-  connects → local player predicts with collision, input forwarded, server
-  position is a drift backstop, remote players render from snapshots,
-  disconnect returns to the world list. Falls back to local single-player
-  when the backend has no orchestration.
- **Verified**: two real client processes each `register → /join → play`,
-  hosted on an orchestrated server, see and move relative to each other
-  (`run_game_multiplayer_test.sh`).
-
-### Foundation Hardening
-
- **Hermetic backend tests** — `cd backend && pytest` works from a clean
-  checkout (auto ephemeral Postgres + migrations, torn down after); skips
-  cleanly with a message if there's no Docker.
- **Fresh-clone boot check** — `verify_fresh_clone.sh` exports a pristine
-  tree, imports from scratch, boots headless, fails on any script error.
-  Also fixed the root cause: a stale `.godot/global_script_class_cache.cfg`
-  was committed to the repo.
- **Real age verification** — `/register` takes a date of birth (not a
-  checkbox), server computes age, 403 under 18. Still self-attested; the
-  limitation and the ID-check hook are documented
-  (`content_moderation.md` 5.2).
- **Auth rate limiting** — 10 attempts / min / IP on `/register` + `/login`.
- **CI workflow** — `.forgejo/workflows/checkpoint.yml` written, **not
-  running yet**: needs the operator to enable Forgejo Actions + register a
-  `host` runner (one-time; see `docs/ci.md`). Interim gate is
-  `run_checkpoint_tests.py` by hand / the dashboard.
-
-## Not in PC3 (planned but not started)
-
- **M2** server-side world persistence
- **M6** scripting sandbox
- **M7** in-game editor
- **M8** social / chat
- **M9** economy
- **M10** discovery
-
-## Playtest
-
-Same as PC2 — grab the exe from the dashboard's `/checkpoints`, backend
-pointed at it. New: with multiple people in the same world you now actually
-see each other move.
@@ -1,50 +0,0 @@
-# CI
-
-`.gitea/workflows/checkpoint.yml` runs the full checkpoint suite
-(`scripts/run_checkpoint_tests.py`: migrations on a fresh DB, backend
-`pytest`, all Godot smoke tests, the 2-player multiplayer test, and the
-fresh-clone boot check) on **every push to `main` and every PR**.
-
-## Status: live
-
-Set up 2026-09-05:
-
- Gitea Actions enabled (`[actions] ENABLED = true` in
-  `/DATA/AppData/forgejo/gitea/conf/app.ini`, container restarted; a
-  timestamped `.bak` is next to it).
- `act_runner` v0.2.13 registered as **`agp-host`** with label **`host`**
-  (host execution mode — jobs run directly on the AGP box, which already
-  has Docker, `~/godot/godot`, and Python). Lives in `~/act-runner/`.
- Green on the first successful run (`d76bf4d`).
-
-The workflow uses **no JavaScript actions** (no `actions/checkout`), so the
-host needs no Node: checkout is a shallow `git fetch` from the local Gitea
-using the injected `${{ github.token }}`, and the suite runs in a venv the
-job builds (host Python is PEP-668 externally-managed).
-
-## Make the runner permanent (one command, needs sudo)
-
-The runner currently runs as a plain background process — it won't survive a
-reboot. A unit file is ready at `~/act-runner/act-runner.service`:
-
-```bash
-sudo cp ~/act-runner/act-runner.service /etc/systemd/system/
-sudo systemctl daemon-reload
-pkill -f 'act_runner daemon'          # stop the temporary background one
-sudo systemctl enable --now act-runner
-```
-
-## Interim / local
-
-```bash
-python scripts/run_checkpoint_tests.py
-```
-
-— also what `/checkpoint/<PC>` on the dashboard runs before a playtest build.
-
-## Security note
-
-A host-mode runner executes whatever a workflow says, directly on the box,
-as `daddy` (in the `docker` group). Fine for a single-maintainer private
-repo; revisit if the repo gets outside contributors (switch to a
-docker-mode runner or an isolated VM).
@@ -23,9 +23,10 @@ explicitly out of scope.
 | # | Type | Task | Depends on |
 |---|------|------|-----------|
 | 1 | architecture | `ApiClient` autoload: HTTP + JWT storage + error contract | — |
-| 2 | implementation | Main-menu **login + register** UI built & wired (form-encoded + JSON/age gate) | 1 |
-| 3 | implementation | **World list** screen consuming `GET /api/worlds` | 1 |
-| 4 | testing | End-to-end headless smoke test + manual verify | 1,2,3 |
+| 2 | implementation | Main-menu **login** wiring (form-encoded) | 1 |
+| 3 | implementation | Main-menu **register** wiring (JSON + age gate) | 2 |
+| 4 | implementation | **World list** screen consuming `GET /api/worlds` | 2 |
+| 5 | testing | End-to-end headless smoke test + manual verify | 1,3,4 |

 ## Design decisions captured (resolved in task 1)
 - Token storage: in-memory singleton property for the MVP; a `save_to_disk` seam is left
@@ -34,8 +35,3 @@ explicitly out of scope.
  never crash on network failure; non-2xx surfaces `{status, detail}` from the backend.
 - Base URL: read from a ProjectSetting, defaulting to `http://127.0.0.1:8000`.
 - Login is form-encoded; register is JSON — the client helper must support both content types.
-
-## Notes
- The main-menu auth UI does **not** exist yet (main_menu.gd currently has only Play/Quit
-  stubs). Task 2 must **build** the login/register UI, not merely wire an existing one.
- The world-list screen also needs to be **built** (a new scene), not just wired.
@@ -1,50 +0,0 @@
-# Testing at Package Checkpoints
-
-A Package Checkpoint (PC1, PC2, ...) is a periodic review point — every few
-real milestones, the client and server builds get packaged together and
-independently reviewed before anyone calls anything actually done. See
-`project_agp` in Claude's memory, or ask, for the full definition; this
-doc is just the mechanical "how do I run the tests" part of that review.
-
-## Running the suite
-
-```
-python scripts/run_checkpoint_tests.py
-```
-
-Brings up a throwaway Postgres, runs Alembic migrations against it, runs the
-backend pytest suite, starts the backend server, and runs every Godot
-headless smoke test (`scripts/smoke_test_*.gd`) against it. Tears the
-Postgres container down afterward (`--keep-postgres` to skip that if you
-want to poke at the DB after a failure).
-
-If port 5432 is already taken on the machine, pass `--postgres-port` with
-something else.
-
-Exit code is 0 only if everything that actually ran passed — suites with
-nothing to run yet (no Godot binary found, no smoke test scripts yet) are
-reported SKIPPED, not treated as a failure.
-
-## What this does and doesn't prove
-
-Passing this script means: migrations apply cleanly to a genuinely empty
-database, the backend's unit-level logic is correct, and whatever Godot
-smoke tests exist actually round-trip against a live backend. It does
-**not** mean full endpoint/integration coverage exists — see
-`test_inventory.md` for the current, honest list of what's tested and what
-isn't. A checkpoint review should still involve reading the actual diffs
-for anything this script's current coverage doesn't reach, not just running
-green and calling it done.
-
-## Growing this over time
-
-As real integration tests get added (endpoint tests hitting the FastAPI app,
-more Godot smoke coverage beyond `health_check`), they should land under
-`backend/tests/` / `scripts/smoke_test_*.gd` respectively — this script
-picks up new files automatically, nothing to register by hand. Update
-`test_inventory.md`'s tables when you do, so the inventory stays a source
-of truth instead of quietly going stale.
-
-Eventual goal (not implemented yet): gate merges to `main` on this script
-passing, the same way a real CI pipeline would. For now it's a manual step
-run at checkpoint review time.
@@ -1,117 +0,0 @@
-# Test Inventory
-
-What automated coverage actually exists, what it actually verifies, and what
-doesn't have coverage yet. Keep this current as tests are added — it's the
-thing a Package Checkpoint review (see `docs/testing/README.md`) reads first
-to know what "run the tests" actually checked.
-
-Run everything below in one shot with `scripts/run_checkpoint_tests.py`.
-
-Last verified against `main`: 2026-08-21 — migrations + pytest + all 11
-Godot smoke tests, all clean. PC1's real playtest-found bugs (login form
-unreachable, 1px world cards, Play → Back losing the session) are covered
-by the smoke tests below so they can't silently regress. PC2 (basic
-playable world + character + movement) landed 2026-08-20/21 — see
-`docs/checkpoints/` once a PC2 record exists, and the three new smoke
-tests below (`smoke_test_test_level.gd`, `smoke_test_player.gd`,
-`smoke_test_enter_world.gd`) for what's actually verified. The avatar
-loader/customization system (`smoke_test_avatar_system.gd`) also landed
-2026-08-21 — real glTF-based loading with graceful failure on missing
-assets, verified since `assets/avatars/*.glb` model files don't exist yet.
-
-## Backend — `backend/tests/` (pytest)
-
-Run: `cd backend && python -m pytest -v` (needs `DATABASE_URL` pointed at a
-reachable Postgres — see the runner script).
-
-**Current total: 61 tests, all passing on a clean `main` checkout.**
-
-| File | Tests | What it covers |
-|---|---|---|
-| `test_auth_age_gate.py` | 11 | `calculate_age()` date-math correctness (exact boundary, leap years, birthday-not-yet-this-year — kept as a tested utility for a future real-DOB pass even though `/register` no longer calls it) + `RegisterRequest.over_18` field tests (true accepted, false accepted, missing rejected). 2026-08-20: the register flow was simplified from collecting/validating a date of birth to a plain client-side "I am 18 or older" confirmation, so the old date-validation parametrized cases were replaced. Backs the 18+ registration gate (PR #23, revised PC1). |
-| `test_gltf_metadata.py` | 21 | glTF/GLB binary + JSON parsing: magic-byte detection, chunk-padding handling, mesh/animation/texture-reference metadata extraction, malformed-input rejection. Backs the asset-import pipeline (PR #27). |
-| `test_auth_endpoints.py` | 10 | **Integration tests** for `POST /api/auth/register` and `POST /api/auth/login` against the real FastAPI app + real Postgres. Covers: successful register (201), duplicate username (409), duplicate email (409), `over_18=false` rejection (400), missing `over_18` field (422), successful login with correct credentials (200), wrong password (401), nonexistent user (401), form-encoded login (OAuth2), and JWT validity of returned tokens. |
-| `test_refresh_endpoint.py` | 8 | **Integration tests** for `POST /api/auth/refresh`. Covers: successful refresh (200, new access token, same refresh token returned), refresh produces different access tokens on repeated calls, invalid refresh token (401), empty body (422), missing field (422), refresh token from login also works, returned access token is valid JWT decodable with public key, `access_token_expires_minutes` in response. |
-| `test_refresh_token_jti.py` | 6 | Unit tests for refresh token uniqueness (jti claim) and model column length. Covers: two calls with same sub produce different tokens (jti uniqueness), jti is valid UUID, rapid repeated calls all produce unique jtis, jti survives decode, `RefreshToken.token` column is `String(512)`, column type is `String`. |
-| `test_auth_expired_token.py` | 5 | **Integration tests** for expired-token rejection across auth endpoints. Covers: expired access JWT rejected by `GET /api/auth/me` (401), garbage access token rejected by `/me` (401), missing bearer token returns 401, expired refresh token (DB `expires_at` in past) rejected by `/refresh` (401), expired refresh JWT (past `exp` claim) rejected before DB lookup (401). |
-
-**What these are, honestly:** a mix of pure unit tests (`test_auth_age_gate.py`,
-`test_gltf_metadata.py`, `test_refresh_token_jti.py`) and real integration tests
-(`test_auth_endpoints.py`, `test_refresh_endpoint.py`, `test_auth_expired_token.py`)
-that hit the FastAPI app against a real Postgres database via `TestClient`.
-The integration tests exercise the full stack: Pydantic validation → DB →
-JWT → response. The suite is also re-runnable without manual cleanup —
-`backend/tests/conftest.py` has a session-scoped autouse fixture that
-truncates all app tables once before the suite runs.
-
-**Known coverage gaps** (real gaps, not placeholders — nothing enforces filling
-these yet):
- No endpoint tests for `GET /api/worlds`, `GET /api/assets/*`, or any
-  world/asset CRUD routes — only auth endpoints have integration coverage
-  (`GET /api/worlds` is covered indirectly via the Godot smoke tests below).
- No tests for the moderation schema/migration beyond "the migration runs."
- No tests for the `GET /api/auth/me` endpoint's response body (only its
-  auth-header validation is covered via expired-token tests).
- No tests for session management (create/validate/revoke sessions).
-
-## Godot client — `scripts/smoke_test_*.gd`
-
-**12 smoke tests merged into `main`.** Ten need a live backend, one
-(`smoke_test_network_client.gd`) needs a live dedicated server instead,
-and one (`smoke_test_avatar_system.gd`) needs neither — it only exercises
-local catalog/loadout/loader logic. Backend-dependent tests read
-`AGP_API_BASE_URL` env var, falling back to the
-`application/agp/api_base_url` project setting (default
-`http://127.0.0.1:8000`) if unset.
-
-| File | What it covers |
-|---|---|
-| `smoke_test_api.gd` | Exercises `ApiClient.health_check()` against a live backend. Verifies the real HTTP request path (`HTTPRequest` node lifecycle, JSON parse, result-dictionary contract). Exits 1 on failure. |
-| `smoke_test_auth.gd` | Tests the full auth flow via `ApiClient` autoload: register unique user (201), duplicate username (409), `over_18=false` registration (400), correct login (200), wrong password (401), nonexistent user (401). |
-| `smoke_test_e2e.gd` | End-to-end flow: health check → register → login → worlds list. Verifies the full request chain with a fresh user, including token storage and `get_worlds()` with auth header. |
-| `smoke_test_world_list.gd` | Registers a user, **seeds a real world via `POST /api/worlds/`** (without this, `run_checkpoint_tests.py`'s always-fresh DB means the populated-card render path never actually runs in CI, only the empty-list path would), instantiates `world_list.tscn` as a real scene, waits for `_refresh_worlds()` to complete, confirms it reached the populated (not empty) state, and asserts **each rendered card's real computed width is >= 200px**. That last check is the one that matters: 2026-08-20, a real bug shipped where every card existed in the tree with a non-zero child count and no crash, but rendered at 1.0px wide (`ScrollContainer`'s `size_flags_horizontal`/`vertical` used the raw integer `4` = `Control.SIZE_SHRINK_CENTER` instead of `3` = `SIZE_EXPAND_FILL`) — invisible on screen, and a child-count-only check would never have caught it. Confirmed by deliberately reintroducing the bug: card width check correctly fails at 25px. |
-| `smoke_test_main_menu_ui.gd` | Instantiates `main_menu.tscn`, confirms the auth panel starts hidden, and confirms a **real signal emission** on LoginButton/RegisterButton (not calling the handler method directly) actually opens it. This is the check that would have caught 2026-08-20's real bug: the auth panel and its logic were fully correct, but nothing in the scene was ever wired to open it, so Login/Register were completely unreachable from the UI. |
-| `smoke_test_main_menu_full_flow.gd` | Full click-through: open the register form, fill it exactly as a user would, submit, confirm Play actually becomes enabled, the welcome message shows, and the auth buttons hide themselves. Calls the submit handler directly (awaited) rather than via `auth_button.pressed.emit()` — see the note at the top of the file: a synthetic `.emit()` on an `await`-using handler doesn't get driven forward reliably in `--script`/SceneTree headless mode the way real GUI input event dispatch does, confirmed by comparing direct-call vs `.emit()` behavior. Not a bug in the actual click-driven flow, just a headless-test-harness quirk to route around when writing tests. |
-| `smoke_test_main_menu_back.gd` | Regression test for Play → Back logging the user out even with a valid token still held. Registers a user, loads `main_menu.tscn` (asserts it restores the authenticated state via a real `auth_state_ready` signal wait, not a frame-count guess), clicks Play → `world_list.tscn`, clicks Back → `main_menu.tscn`, and asserts the menu is still authenticated. Checks `WelcomeLabel.is_visible_in_tree()`, not just `.visible` — the label lives inside AuthPanel, so `.visible` alone is a false positive if the panel itself is hidden (a real bug briefly present: `_show_authenticated()` hid AuthPanel while claiming the welcome label was visible, which rendered nothing). |
-| `smoke_test_test_level.gd` | Loads `scenes/worlds/test_level.tscn` directly (the level is player-agnostic and self-contained per `docs/architecture/pc2_test_level.md` §4) and confirms it has real content: 5 props, a `DirectionalLight3D` ("Sun"), and a `WorldEnvironment` — not an empty void. |
-| `smoke_test_player.gd` | Loads `scenes/game.tscn` and confirms the player exists as a real `CharacterBody3D` with a `CollisionShape3D`+shape, a `CapsuleMesh`, and spawns at the level's `PlayerSpawn` marker position. Also asserts `JUMP_VELOCITY` is positive and a `Camera3D` exists and is `current` — both were real bugs found 2026-08-20/21 (jump velocity was negative, pushing the player down instead of up; no camera existed at all, so the game was unplayable even though the character could technically move). Structural checks only — real movement/jump *direction* correctness was verified separately via a throwaway headless physics simulation during development, not by an automated test that's part of this suite. |
-| `smoke_test_enter_world.gd` | The full PC2 path end to end: register → seed a real world → load `world_list.tscn` → click the real "Enter World" button on a real card (found by walking the card's children, not by index, so it doesn't silently pass if the card layout changes) → confirms `scenes/game.tscn` actually becomes `current_scene` with the player spawned at the level's `PlayerSpawn` marker → sends a real `KEY_ESCAPE` input event (not a direct method call) and confirms it returns to `world_list.tscn`. This is the test that proves "browse → enter → walk around → leave" actually works as one continuous flow, not just that each piece works in isolation. |
-| `smoke_test_network_client.gd` | **Real two-process integration test** for `scripts/network_client.gd` (client-side prediction + reconciliation, docs/architecture/networking.md §5) — needs an actual dedicated server running first: `godot --headless --path . scenes/server.tscn &`, *not* the usual HTTP backend. Connects a real `NetworkClient` over ENet, confirms local input prediction moves the player immediately (no waiting on a round trip), confirms real snapshots arrive and get processed, then deliberately desyncs the predicted position by 9999 units and confirms the very next snapshot corrects it back — the actual proof reconciliation logic works, not just that it never had to fire. Known simplification, stated in the script's own docstring: the server's snapshot doesn't currently echo back a per-peer "last input seq processed," so reconciliation corrects against the *most recent* prediction rather than true tick-exact rollback-and-replay (docs/architecture/networking.md §5.2 step 4) — a real, scoped follow-up once the server echoes that ack, not something faked here. |
-| `smoke_test_avatar_system.gd` | Confirms `AvatarSystem` is a real autoload, the committed `assets/avatars/catalog.json` actually parses, `get_assets_for_slot("base_body")` returns real entries, an `AvatarLoadout` can set `base_body` and equip a real catalog accessory, the loadout round-trips through `to_json()`/`load_loadout_from_json()`, and — since `assets/avatars/*.glb` model files don't exist yet — that `AvatarLoader.load_base_body()` against a real catalog entry with a missing file fails *gracefully*: returns `null` and emits `load_error` rather than crashing. Visual rendering itself can't be verified until real assets exist. |
-
-Run (once, to build the class cache): `godot --headless --path . --import`,
-then for each smoke test: `godot --headless --path . --script
-res://scripts/smoke_test_<name>.gd` — **no `--quit`**, it kills these before
-their awaited HTTP calls finish.
-
-**Known gaps:**
- No smoke tests for chunk loading/streaming (`chunk.gd`, `chunk_scene.gd`).
- No smoke tests for dynamic/static object nodes.
- All smoke tests require a live backend; no offline/unit smoke tests exist.
- `smoke_test_world_list.gd` and `smoke_test_main_menu_*.gd` are the only
-  ones that exercise a real `.tscn` scene instantiation — others only test
-  the `ApiClient` autoload directly.
- `get_me()` (`GET /auth/me`) is implemented in `scripts/api_client.gd` but
-  has no smoke coverage yet.
- The Login path (as opposed to Register) through `main_menu.gd` isn't
-  separately smoke-tested — it shares the same `_on_auth_button_pressed()`/
-  `_on_auth_complete()` code path already exercised for Register, but that's
-  inference, not a direct check.
-
-## Client export
-
-`scripts/build.sh` produces real Linux (`agp-game.x86_64`) and Windows
-(`agp-game.exe`) binaries via `--export-release`. Verified 2026-08-20: both
-exports complete clean from a fresh checkout and produce valid binaries
-(confirmed via `file` — real ELF64/PE32+, not empty or truncated). Neither
-export is exercised by an automated GUI test (headless Godot can't drive a
-window) — actually launching and clicking through the exported binary is a
-manual step, see `docs/checkpoints/PC1.md` for playtest instructions.
-
-## What "full coverage" should eventually mean here
-
-Not defined precisely yet — the honest target as of 2026-08-20 is
-"integration tests for every endpoint + smoke tests for every major scene."
-As real integration/endpoint tests get added, update the tables above
-rather than letting this doc drift stale; a wrong inventory is worse than
-no inventory.
@@ -1,74 +0,0 @@
-[preset.0]
-
-name="Linux"
-platform="Linux/X11"
-runnable=true
-advanced_options=false
-dedicated_server=false
-custom_features=""
-export_filter="all_resources"
-include_filter="*.json"
-exclude_filter=""
-export_path="export/linux/agp-game.x86_64"
-encryption_include_filters=""
-encryption_exclude_filters=""
-encrypt_pck=false
-encrypt_directory=false
-script_export_mode=2
-
-[preset.0.options]
-
-custom_template/debug=""
-custom_template/release=""
-debug/export_console_wrapper=1
-binary_format/embed_pck=true
-texture_format/bptc=true
-texture_format/s3tc=true
-texture_format/etc=false
-texture_format/etc2=false
-binary_format/architecture="x86_64"
-ssh_remote_deploy/enabled=false
-
-[preset.1]
-
-name="Windows Desktop"
-platform="Windows Desktop"
-runnable=true
-advanced_options=false
-dedicated_server=false
-custom_features=""
-export_filter="all_resources"
-include_filter="*.json"
-exclude_filter=""
-export_path="export/windows/agp-game.exe"
-encryption_include_filters=""
-encryption_exclude_filters=""
-encrypt_pck=false
-encrypt_directory=false
-script_export_mode=2
-
-[preset.1.options]
-
-custom_template/debug=""
-custom_template/release=""
-debug/export_console_wrapper=1
-binary_format/embed_pck=true
-texture_format/bptc=true
-texture_format/s3tc=true
-texture_format/etc=false
-texture_format/etc2=false
-binary_format/architecture="x86_64"
-codesign/enable=false
-application/icon=""
-application/console_wrapper_icon=""
-application/icon_interpolation=4
-application/file_version=""
-application/product_version=""
-application/company_name=""
-application/product_name=""
-application/file_description=""
-application/copyright=""
-application/trademarks=""
-application/export_angle=0
-application/export_d3d12=0
-d3d12/agility_sdk_multizip=0
@@ -9,49 +9,15 @@ config_version=5
 config/name="AGP-Game"
 run/main_scene="res://scenes/main_menu.tscn"
 config/features=PackedStringArray("4.6.2")
-agp/api_base_url="http://127.0.0.1:8000"

 [autoload]

-ApiClient="*res://scripts/api_client.gd"
-AvatarSystem="*res://scripts/avatar/avatar_system.gd"
-Session="*res://scripts/session.gd"
-
 [display]

 window/size/viewport_width=1920
 window/size/viewport_height=1080
 window/stretch/mode="canvas_items"

-[input]
-
-move_forward={
-"deadzone": 0.5,
-"events": [Object(InputEventKey,"resource_local_to_scene":false,"resource_name":"","device":-1,"window_id":0,"alt_pressed":false,"shift_pressed":false,"ctrl_pressed":false,"meta_pressed":false,"pressed":false,"keycode":0,"physical_keycode":87,"key_label":0,"unicode":119,"location":0,"echo":false,"script":null)
-]
-}
-move_left={
-"deadzone": 0.5,
-"events": [Object(InputEventKey,"resource_local_to_scene":false,"resource_name":"","device":-1,"window_id":0,"alt_pressed":false,"shift_pressed":false,"ctrl_pressed":false,"meta_pressed":false,"pressed":false,"keycode":0,"physical_keycode":65,"key_label":0,"unicode":97,"location":0,"echo":false,"script":null)
-]
-}
-move_right={
-"deadzone": 0.5,
-"events": [Object(InputEventKey,"resource_local_to_scene":false,"resource_name":"","device":-1,"window_id":0,"alt_pressed":false,"shift_pressed":false,"ctrl_pressed":false,"meta_pressed":false,"pressed":false,"keycode":0,"physical_keycode":68,"key_label":0,"unicode":100,"location":0,"echo":false,"script":null)
-]
-}
-move_down={
-"deadzone": 0.5,
-"events": [Object(InputEventKey,"resource_local_to_scene":false,"resource_name":"","device":-1,"window_id":0,"alt_pressed":false,"shift_pressed":false,"ctrl_pressed":false,"meta_pressed":false,"pressed":false,"keycode":0,"physical_keycode":83,"key_label":0,"unicode":115,"location":0,"echo":false,"script":null)
-]
-}
-
-[physics]
-
-; Fixed 30 Hz sim -- the multiplayer server, client prediction, and snapshot
-; rate all key off this. See docs/architecture/networking.md 3.1.
-common/physics_ticks_per_second=30
-
 [rendering]

 renderer/rendering_method="gl_compatibility"
@@ -0,0 +1 @@
+
@@ -1,12 +0,0 @@
-[gd_scene load_steps=2 format=3 uid="uid://avatar_customization"]
-
-[ext_resource type="Script" path="res://scripts/avatar_customization_screen.gd" id="1"]
-
-[node name="AvatarCustomization" type="Control"]
-layout_mode = 3
-anchors_preset = 15
-anchor_right = 1.0
-anchor_bottom = 1.0
-grow_horizontal = 2
-grow_vertical = 2
-script = ExtResource("1")
@@ -1,6 +0,0 @@
-[gd_scene load_steps=2 format=3 uid="uid://c0avpre7dev0rig"]
-
-[ext_resource type="Script" path="res://scripts/tools/avatar_preview.gd" id="1"]
-
-[node name="AvatarPreview" type="Node3D"]
-script = ExtResource("1")
@@ -1,6 +0,0 @@
-[gd_scene load_steps=2 format=3 uid="uid://bqs8xk2rig0dev"]
-
-[ext_resource type="Script" path="res://scripts/tools/screenshot_rig.gd" id="1"]
-
-[node name="ScreenshotRig" type="Node"]
-script = ExtResource("1")
@@ -1,12 +0,0 @@
-[gd_scene load_steps=4 format=3 uid="uid://game_scene_pc2"]
-
-[ext_resource type="Script" path="res://scripts/game.gd" id="0_game"]
-[ext_resource type="PackedScene" uid="uid://c49a36fc7db_test_level" path="res://scenes/worlds/test_level.tscn" id="1_level"]
-[ext_resource type="PackedScene" uid="uid://player_scene_001" path="res://scenes/player.tscn" id="2_player"]
-
-[node name="Game" type="Node3D"]
-script = ExtResource("0_game")
-
-[node name="Level" parent="." instance=ExtResource("1_level")]
-
-[node name="Player" parent="." instance=ExtResource("2_player")]
@@ -1,4 +1,4 @@
-[gd_scene load_steps=2 format=3 uid="uid://main_menu_scene"]
+[gd_scene load_steps=2 format=3]

 [ext_resource type="Script" path="res://scripts/main_menu.gd" id="1_main"]

@@ -29,105 +29,15 @@ text = "AGP Game"
 horizontal_alignment = 1
 theme_override_font_sizes/font_size = 72

-[node name="AuthButtonsRow" type="HBoxContainer" parent="CenterContainer/VBoxContainer"]
-layout_mode = 1
-theme_override_constants/separation = 16
-alignment = 1
-
-[node name="LoginButton" type="Button" parent="CenterContainer/VBoxContainer/AuthButtonsRow"]
-layout_mode = 1
-text = "Login"
-size_flags_horizontal = 3
-
-[node name="RegisterButton" type="Button" parent="CenterContainer/VBoxContainer/AuthButtonsRow"]
-layout_mode = 1
-text = "Register"
-size_flags_horizontal = 3
-
-[node name="AuthPanel" type="PanelContainer" parent="CenterContainer/VBoxContainer"]
-layout_mode = 1
-visible = false
-
-[node name="MarginContainer" type="MarginContainer" parent="CenterContainer/VBoxContainer/AuthPanel"]
-layout_mode = 1
-theme_override_constants/margin_left = 24
-theme_override_constants/margin_top = 24
-theme_override_constants/margin_right = 24
-theme_override_constants/margin_bottom = 24
-
-[node name="AuthVBox" type="VBoxContainer" parent="CenterContainer/VBoxContainer/AuthPanel/MarginContainer"]
-layout_mode = 1
-theme_override_constants/separation = 8
-size_flags_horizontal = 3
-
-[node name="AuthModeLabel" type="Label" parent="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox"]
-layout_mode = 1
-text = "Login"
-horizontal_alignment = 1
-theme_override_font_sizes/font_size = 24
-
-[node name="UsernameEdit" type="LineEdit" parent="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox"]
-layout_mode = 1
-placeholder_text = "Username"
-size_flags_horizontal = 3
-
-[node name="PasswordEdit" type="LineEdit" parent="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox"]
-layout_mode = 1
-placeholder_text = "Password"
-size_flags_horizontal = 3
-echo_password = true
-
-[node name="EmailEdit" type="LineEdit" parent="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox"]
-layout_mode = 1
-visible = false
-placeholder_text = "Email"
-size_flags_horizontal = 3
-
-[node name="DobEdit" type="LineEdit" parent="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox"]
-layout_mode = 1
-visible = false
-size_flags_horizontal = 3
-placeholder_text = "Date of birth (YYYY-MM-DD)"
-
-[node name="AuthButton" type="Button" parent="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox"]
-layout_mode = 1
-text = "Login"
-size_flags_horizontal = 3
-
-[node name="AuthStatusLabel" type="Label" parent="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox"]
-layout_mode = 1
-text = ""
-horizontal_alignment = 1
-autowrap_mode = 2
-visible = false
-
-[node name="WelcomeLabel" type="Label" parent="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox"]
-layout_mode = 1
-visible = false
-text = ""
-horizontal_alignment = 1
-
 [node name="PlayButton" type="Button" parent="CenterContainer/VBoxContainer"]
 layout_mode = 1
 text = "Play"
 size_flags_horizontal = 4

-[node name="CustomizeButton" type="Button" parent="CenterContainer/VBoxContainer"]
-layout_mode = 1
-text = "Customize Avatar"
-size_flags_horizontal = 4
-disabled = true
-
 [node name="QuitButton" type="Button" parent="CenterContainer/VBoxContainer"]
 layout_mode = 1
 text = "Quit"
 size_flags_horizontal = 4

-[connection signal="pressed" from="CenterContainer/VBoxContainer/AuthButtonsRow/LoginButton" to="." method="_on_login_button_pressed"]
-[connection signal="pressed" from="CenterContainer/VBoxContainer/AuthButtonsRow/RegisterButton" to="." method="_on_register_button_pressed"]
 [connection signal="pressed" from="CenterContainer/VBoxContainer/PlayButton" to="." method="_on_play_button_pressed"]
-[connection signal="pressed" from="CenterContainer/VBoxContainer/CustomizeButton" to="." method="_on_customize_button_pressed"]
 [connection signal="pressed" from="CenterContainer/VBoxContainer/QuitButton" to="." method="_on_quit_button_pressed"]
-[connection signal="pressed" from="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/AuthButton" to="." method="_on_auth_button_pressed"]
-[connection signal="text_submitted" from="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/UsernameEdit" to="." method="_on_auth_button_pressed"]
-[connection signal="text_submitted" from="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/PasswordEdit" to="." method="_on_auth_button_pressed"]
@@ -1,32 +0,0 @@
-[gd_scene load_steps=4 format=3 uid="uid://player_scene_001"]
-
-[ext_resource type="Script" path="res://scripts/player.gd" id="1_player"]
-
-[sub_resource type="CapsuleMesh" id="CapsuleMesh1"]
-radius = 0.35
-height = 1.6
-
-[sub_resource type="CapsuleShape3D" id="CapsuleShape1"]
-radius = 0.35
-height = 1.6
-
-[node name="Player" type="CharacterBody3D"]
-collision_layer = 2
-collision_mask = 1
-script = ExtResource("1_player")
-
-[node name="CollisionShape3D" type="CollisionShape3D" parent="."]
-shape = SubResource("CapsuleShape1")
-
-[node name="CapsuleMesh" type="MeshInstance3D" parent="."]
-mesh = SubResource("CapsuleMesh1")
-
-[node name="CameraPivot" type="Node3D" parent="."]
-transform = Transform3D(1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 1.2, 0)
-
-[node name="SpringArm3D" type="SpringArm3D" parent="CameraPivot"]
-spring_length = 3.5
-margin = 0.2
-
-[node name="Camera3D" type="Camera3D" parent="CameraPivot/SpringArm3D"]
-current = true
@@ -1,6 +0,0 @@
-[gd_scene load_steps=2 format=3]
-
-[ext_resource type="Script" path="res://scripts/server.gd" id="1_server"]
-
-[node name="Server" type="Node"]
-script = ExtResource("1_server")
@@ -1,15 +0,0 @@
-[gd_scene load_steps=3 format=3]
-
-[ext_resource type="Script" path="res://scripts/player_spawner.gd" id="1"]
-
-[sub_resource type="CapsuleShape3D" id="CapsuleShape_server_player"]
-radius = 0.35
-height = 1.6
-
-[node name="Player" type="CharacterBody3D"]
-collision_layer = 2
-collision_mask = 1
-script = ExtResource("1")
-
-[node name="CollisionShape3D" type="CollisionShape3D" parent="."]
-shape = SubResource("CapsuleShape_server_player")
@@ -1,78 +0,0 @@
-[gd_scene load_steps=2 format=3]
-
-[ext_resource type="Script" path="res://scripts/world_list.gd" id="1_wl"]
-
-[node name="WorldList" type="Control"]
-anchors_preset = 15
-anchor_right = 1.0
-anchor_bottom = 1.0
-grow_horizontal = 2
-grow_vertical = 2
-script = ExtResource("1_wl")
-
-[node name="VBoxContainer" type="VBoxContainer" parent="."]
-layout_mode = 1
-anchors_preset = 15
-anchor_right = 1.0
-anchor_bottom = 1.0
-grow_horizontal = 2
-grow_vertical = 2
-theme_override_constants/separation = 8
-
-[node name="HeaderHBox" type="HBoxContainer" parent="VBoxContainer"]
-layout_mode = 3
-size_flags_horizontal = 3
-theme_override_constants/separation = 16
-
-[node name="BackButton" type="Button" parent="VBoxContainer/HeaderHBox"]
-layout_mode = 3
-text = "< Back"
-size_flags_horizontal = 0
-
-[node name="TitleLabel" type="Label" parent="VBoxContainer/HeaderHBox"]
-layout_mode = 3
-text = "Browse Worlds"
-horizontal_alignment = 1
-size_flags_horizontal = 3
-theme_override_font_sizes/font_size = 28
-
-[node name="RefreshButton" type="Button" parent="VBoxContainer/HeaderHBox"]
-layout_mode = 3
-text = "Refresh"
-size_flags_horizontal = 0
-
-[node name="ScrollContainer" type="ScrollContainer" parent="VBoxContainer"]
-layout_mode = 3
-size_flags_horizontal = 3
-size_flags_vertical = 3
-horizontal_mode = 2
-vertical_mode = 2
-
-[node name="WorldList" type="VBoxContainer" parent="VBoxContainer/ScrollContainer"]
-layout_mode = 3
-size_flags_horizontal = 3
-theme_override_constants/separation = 8
-
-[node name="LoadingLabel" type="Label" parent="VBoxContainer"]
-layout_mode = 3
-text = "Loading worlds..."
-visible = false
-horizontal_alignment = 1
-theme_override_font_sizes/font_size = 18
-
-[node name="ErrorLabel" type="Label" parent="VBoxContainer"]
-layout_mode = 3
-text = ""
-visible = false
-horizontal_alignment = 1
-theme_override_font_sizes/font_size = 18
-
-[node name="EmptyLabel" type="Label" parent="VBoxContainer"]
-layout_mode = 3
-text = ""
-visible = false
-horizontal_alignment = 1
-theme_override_font_sizes/font_size = 18
-
-[connection signal="pressed" from="VBoxContainer/HeaderHBox/BackButton" to="." method="_on_back_button_pressed"]
-[connection signal="pressed" from="VBoxContainer/HeaderHBox/RefreshButton" to="." method="_on_refresh_button_pressed"]
@@ -1,121 +0,0 @@
-[gd_scene load_steps=1 format=3 uid="uid://c49a36fc7db_test_level"]
-
-[sub_resource type="BoxShape3D" id="BoxShape3D_ground"]
-size = Vector3(40, 1, 40)
-
-[sub_resource type="BoxMesh" id="BoxMesh_ground"]
-size = Vector3(40, 1, 40)
-
-[sub_resource type="BoxShape3D" id="BoxShape3D_prop1"]
-size = Vector3(2, 3, 2)
-
-[sub_resource type="BoxMesh" id="BoxMesh_prop1"]
-size = Vector3(2, 3, 2)
-
-[sub_resource type="BoxShape3D" id="BoxShape3D_prop2"]
-size = Vector3(3, 1, 3)
-
-[sub_resource type="BoxMesh" id="BoxMesh_prop2"]
-size = Vector3(3, 1, 3)
-
-[sub_resource type="CylinderShape3D" id="CylinderShape3D_prop3"]
-top_radius = 1.0
-height = 4.0
-
-[sub_resource type="CylinderMesh" id="CylinderMesh_prop3"]
-top_radius = 1.0
-bottom_radius = 1.0
-height = 4.0
-subdivisions_top_radius = 8
-
-[sub_resource type="SphereShape3D" id="SphereShape3D_prop4"]
-radius = 1.0
-
-[sub_resource type="SphereMesh" id="SphereMesh_prop4"]
-radius = 1.0
-subdivisions_ring = 12
-subdivisions_height = 12
-
-[sub_resource type="SphereShape3D" id="SphereShape3D_prop5"]
-radius = 0.5
-
-[sub_resource type="SphereMesh" id="SphereMesh_prop5"]
-radius = 0.5
-subdivisions_ring = 8
-subdivisions_height = 8
-
-[sub_resource type="Environment" id="WorldEnvironment_env"]
-background_mode = 1
-background_color = Color(0.45, 0.62, 0.82, 1)
-ambient_light_source = 2
-ambient_light_color = Color(0.7, 0.75, 0.82, 1)
-ambient_light_energy = 0.8
-
-[node name="TestLevel" type="Node3D"]
-
-[node name="Ground" type="StaticBody3D" parent="."]
-position = Vector3(0, -0.5, 0)
-
-[node name="CollisionShape3D" type="CollisionShape3D" parent="Ground"]
-shape = SubResource("BoxShape3D_ground")
-
-[node name="MeshInstance3D" type="MeshInstance3D" parent="Ground"]
-mesh = SubResource("BoxMesh_ground")
-
-[node name="Props" type="Node3D" parent="."]
-
-[node name="Prop1_Box" type="StaticBody3D" parent="Props"]
-position = Vector3(8, 1.5, 8)
-
-[node name="CollisionShape3D" type="CollisionShape3D" parent="Props/Prop1_Box"]
-shape = SubResource("BoxShape3D_prop1")
-
-[node name="MeshInstance3D" type="MeshInstance3D" parent="Props/Prop1_Box"]
-mesh = SubResource("BoxMesh_prop1")
-
-[node name="Prop2_Pedestal" type="StaticBody3D" parent="Props"]
-position = Vector3(-8, 0.5, 6)
-
-[node name="CollisionShape3D" type="CollisionShape3D" parent="Props/Prop2_Pedestal"]
-shape = SubResource("BoxShape3D_prop2")
-
-[node name="MeshInstance3D" type="MeshInstance3D" parent="Props/Prop2_Pedestal"]
-mesh = SubResource("BoxMesh_prop2")
-
-[node name="Prop3_Column" type="StaticBody3D" parent="Props"]
-position = Vector3(6, 2.0, -8)
-
-[node name="CollisionShape3D" type="CollisionShape3D" parent="Props/Prop3_Column"]
-shape = SubResource("CylinderShape3D_prop3")
-
-[node name="MeshInstance3D" type="MeshInstance3D" parent="Props/Prop3_Column"]
-mesh = SubResource("CylinderMesh_prop3")
-
-[node name="Prop4_Sphere" type="StaticBody3D" parent="Props"]
-position = Vector3(-6, 1.0, -6)
-
-[node name="CollisionShape3D" type="CollisionShape3D" parent="Props/Prop4_Sphere"]
-shape = SubResource("SphereShape3D_prop4")
-
-[node name="MeshInstance3D" type="MeshInstance3D" parent="Props/Prop4_Sphere"]
-mesh = SubResource("SphereMesh_prop4")
-
-[node name="Prop5_SmallSphere" type="StaticBody3D" parent="Props"]
-position = Vector3(0, 0.5, 12)
-
-[node name="CollisionShape3D" type="CollisionShape3D" parent="Props/Prop5_SmallSphere"]
-shape = SubResource("SphereShape3D_prop5")
-
-[node name="MeshInstance3D" type="MeshInstance3D" parent="Props/Prop5_SmallSphere"]
-mesh = SubResource("SphereMesh_prop5")
-
-[node name="Sun" type="DirectionalLight3D" parent="."]
-rotation = Vector3(-0.95, -0.5, 0)
-light_energy = 1.3
-shadow_enabled = true
-
-[node name="WorldEnvironment" type="WorldEnvironment" parent="."]
-environment = SubResource("WorldEnvironment_env")
-
-[node name="PlayerSpawn" type="Marker3D" parent="."]
-position = Vector3(0, 1.5, 0)
@@ -1,316 +0,0 @@
-extends Node
-## Central HTTP client singleton (autoload name: "ApiClient").
-##
-## Every network call in the game flows through this class. Callers use the
-## high-level helpers ([method login], [method register], [method get_worlds],
-## [method health_check], [method get_me]) or the generic [method request]
-## primitive. All results conform to the result-dictionary contract below.
-##
-## [b]Result Dictionary Contract[/b]
-## Every public method returns (after `await`) a Dictionary with this shape:
-##
-##     {
-##         "ok":     bool,     # true for HTTP 2xx, false otherwise
-##         "status": int,      # HTTP status code (0 on network failure)
-##         "data":   Variant,  # parsed JSON body on success (null otherwise)
-##         "detail": String,   # human-readable message
-##     }
-##
-## Network failures (timeout / DNS / refused connection) return `status == 0`
-## with a `detail` describing the transport failure. Non-2xx responses return
-## the real HTTP status and the backend's `detail` field from the JSON error
-## body when present. No caller can crash on a failed request.
-##
-## [b]Token storage[/b]
-## JWTs are kept in memory. [method set_token] is the single seam for future
-## disk persistence (override it to save to `user://`).
-##
-## [b]Usage[/b]
-##     var result: Dictionary = await ApiClient.login("alice", "secret")
-##     if result.ok:
-##         print("Logged in!")
-##     else:
-##         print("Error: ", result.detail)
-
-# ---------------------------------------------------------------------------
-# Token storage
-# ---------------------------------------------------------------------------
-
-var _access_token: String = ""
-var _token_type: String = "Bearer"
-
-## Full Authorization header value, e.g. "Bearer eyJ...". Empty if no token.
-var bearer_token: String:
-	get:
-		return _token_type + " " + _access_token if _access_token != "" else ""
-
-
-## Whether an access token is currently stored.
-func has_token() -> bool:
-	return _access_token != ""
-
-
-## Set the access token (called after login / register / token refresh).
-## This is the persistence seam: override to also write to disk.
-func set_token(access_token: String, token_type: String = "Bearer") -> void:
-	_access_token = access_token
-	_token_type = token_type
-
-
-## Clear stored tokens.
-func clear_token() -> void:
-	_access_token = ""
-	_token_type = "Bearer"
-
-
-# ---------------------------------------------------------------------------
-# Configuration
-# ---------------------------------------------------------------------------
-
-var _base_url: String = "http://127.0.0.1:8000"
-
-## Request timeout in seconds. 0 disables the timeout.
-var timeout_seconds: float = 10.0
-
-
-func _ready() -> void:
-	# Environment variable override (e.g. for headless smoke tests against a
-	# backend on a non-default port). Falls back to the ProjectSetting, then
-	# to the documented default.
-	var env_url := OS.get_environment("AGP_API_BASE_URL")
-	if env_url != "":
-		_base_url = env_url.rstrip("/")
-	else:
-		_base_url = str(ProjectSettings.get_setting(
-			"application/agp/api_base_url",
-			"http://127.0.0.1:8000"
-		)).rstrip("/")
-
-
-# ---------------------------------------------------------------------------
-# Core request primitive
-# ---------------------------------------------------------------------------
-
-## Generic request primitive. Awaitable via `await`.
-##
-## Uses a dedicated HTTPRequest node per call so concurrent requests can never
-## cross-talk, and so the result maps 1:1 to the awaiting caller.
-##
-## @param method       HTTPClient.Method enum value (GET/POST/PUT/PATCH/DELETE).
-## @param path         URL path, e.g. "/api/health".
-## @param body         Request body string (JSON or form-encoded).
-## @param content_type "application/json" or "application/x-www-form-urlencoded".
-## @param require_auth If true, attach the stored bearer token when present.
-## @return Result dictionary conforming to the contract.
-func request(
-	method: HTTPClient.Method,
-	path: String,
-	body: String = "",
-	content_type: String = "application/json",
-	require_auth: bool = false
-) -> Dictionary:
-	var http := HTTPRequest.new()
-	http.timeout = timeout_seconds
-	http.max_redirects = 8
-	http.accept_gzip = true
-	add_child(http)
-
-	var headers := PackedStringArray()
-	headers.append("Accept: application/json")
-	if content_type != "":
-		headers.append("Content-Type: " + content_type)
-	if require_auth and has_token():
-		headers.append("Authorization: " + bearer_token)
-
-	var url := _base_url + path
-	var err := http.request(url, headers, method, body)
-	if err != OK:
-		http.queue_free()
-		return _make_result(false, 0, null, "Failed to start request: " + _error_string(err))
-
-	# request_completed emits (result, response_code, headers, body).
-	var args: Array = await http.request_completed
-	var result_code: int = args[0]
-	var response_code: int = args[1]
-	var response_body: PackedByteArray = args[3]
-	http.queue_free()
-
-	# Transport-level failure (timeout / DNS / refused / TLS, etc.).
-	if result_code != HTTPRequest.RESULT_SUCCESS:
-		return _make_result(false, 0, null, _transport_error_detail(result_code))
-
-	# Server accepted the connection but returned no HTTP status line.
-	if response_code == 0:
-		return _make_result(false, 0, null, "No response received from server.")
-
-	var json_string := response_body.get_string_from_utf8()
-	var ok := response_code >= 200 and response_code < 300
-
-	if ok:
-		var data: Variant = _parse_json(json_string)
-		return _make_result(true, response_code, data, "OK")
-
-	# Non-2xx: surface the backend's "detail" message when available.
-	var detail := "HTTP error %d" % response_code
-	var parsed: Variant = _parse_json(json_string)
-	if parsed is Dictionary and (parsed as Dictionary).has("detail"):
-		detail = str((parsed as Dictionary)["detail"])
-	return _make_result(false, response_code, null, detail)
-
-
-# ---------------------------------------------------------------------------
-# High-level helpers
-# ---------------------------------------------------------------------------
-
-## Log in with username/password (OAuth2PasswordRequestForm).
-## On success stores the returned access token.
-func login(username: String, password: String) -> Dictionary:
-	var form := "username=" + username.uri_encode() + "&password=" + password.uri_encode()
-	var result := await request(
-		HTTPClient.METHOD_POST,
-		"/api/auth/login",
-		form,
-		"application/x-www-form-urlencoded",
-		false
-	)
-	_store_token_from_result(result)
-	return result
-
-
-## Register a new user. On success stores the returned access token.
-## @param date_of_birth ISO "YYYY-MM-DD". The backend computes age from it
-##                       and rejects under-18s (403).
-func register(
-	username: String,
-	email: String,
-	password: String,
-	date_of_birth: String
-) -> Dictionary:
-	var payload := {
-		"username": username,
-		"email": email,
-		"password": password,
-		"date_of_birth": date_of_birth,
-	}
-	var result := await request(
-		HTTPClient.METHOD_POST,
-		"/api/auth/register",
-		JSON.stringify(payload),
-		"application/json",
-		false
-	)
-	_store_token_from_result(result)
-	return result
-
-
-## List worlds visible to the current user (requires auth).
-## @param visibility Optional filter: "public", "private", "friends_only".
-func get_worlds(skip: int = 0, limit: int = 50, visibility: String = "") -> Dictionary:
-	var path := "/api/worlds/?skip=%d&limit=%d" % [skip, limit]
-	if visibility != "":
-		path += "&visibility=" + visibility.uri_encode()
-	return await request(HTTPClient.METHOD_GET, path, "", "application/json", true)
-
-
-## Ping the backend health endpoint (no auth).
-func health_check() -> Dictionary:
-	return await request(HTTPClient.METHOD_GET, "/api/health", "", "application/json", false)
-
-
-## Fetch the current user's profile from the stored JWT (requires auth).
-func get_me() -> Dictionary:
-	return await request(HTTPClient.METHOD_GET, "/api/users/me", "", "application/json", true)
-
-
-## Fetch the current user's saved avatar loadout (requires auth).
-## On success, result.data is {"data": <loadout dict>, "is_default": bool} --
-## `is_default` true means the user has never customised and this is the
-## server default.
-func get_avatar_loadout() -> Dictionary:
-	return await request(HTTPClient.METHOD_GET, "/api/avatar/loadout", "", "application/json", true)
-
-
-## Ask the backend for a dedicated server to host [param world_id] and return
-## its address. On success result.data is {"world_id", "host", "port"}.
-## 503 if this backend has no game-server orchestration.
-func join_world(world_id: int) -> Dictionary:
-	return await request(HTTPClient.METHOD_POST, "/api/worlds/%d/join" % world_id, "", "application/json", true)
-
-
-## Save (replace) the current user's avatar loadout (requires auth).
-## @param loadout A dict in the AvatarLoadout.to_json() shape
-##                ({"base_body": String, "slots": {...}, "skin_tone"?: {...}}).
-func save_avatar_loadout(loadout: Dictionary) -> Dictionary:
-	var body := JSON.stringify({"data": loadout})
-	return await request(HTTPClient.METHOD_PUT, "/api/avatar/loadout", body, "application/json", true)
-
-
-# ---------------------------------------------------------------------------
-# Internals
-# ---------------------------------------------------------------------------
-
-func _store_token_from_result(result: Dictionary) -> void:
-	if result.ok and result.data is Dictionary:
-		var token: String = str((result.data as Dictionary).get("access_token", ""))
-		if token != "":
-			set_token(token)
-
-
-func _parse_json(text: String) -> Variant:
-	if text == "":
-		return null
-	var parsed: Variant = JSON.parse_string(text)
-	if parsed == null:
-		# null is ambiguous (valid JSON "null" vs parse failure). Fall back to
-		# the raw string so callers never lose the body entirely.
-		return text if text != "null" else null
-	return parsed
-
-
-func _make_result(ok: bool, status: int, data: Variant, detail: String) -> Dictionary:
-	return {
-		"ok": ok,
-		"status": status,
-		"data": data,
-		"detail": detail,
-	}
-
-
-func _transport_error_detail(result_code: int) -> String:
-	match result_code:
-		HTTPRequest.RESULT_CANT_CONNECT:
-			return "Could not connect to server. Is it running?"
-		HTTPRequest.RESULT_CANT_RESOLVE:
-			return "Could not resolve server hostname."
-		HTTPRequest.RESULT_CONNECTION_ERROR:
-			return "Connection error."
-		HTTPRequest.RESULT_TLS_HANDSHAKE_ERROR:
-			return "TLS handshake failed."
-		HTTPRequest.RESULT_NO_RESPONSE:
-			return "No response from server."
-		HTTPRequest.RESULT_BODY_SIZE_LIMIT_EXCEEDED:
-			return "Response body too large."
-		HTTPRequest.RESULT_BODY_DECOMPRESS_FAILED:
-			return "Failed to decompress response body."
-		HTTPRequest.RESULT_REQUEST_FAILED:
-			return "Request failed."
-		HTTPRequest.RESULT_TIMEOUT:
-			return "Request timed out."
-		_:
-			return "Network error (code %d)." % result_code
-
-
-func _error_string(err_code: int) -> String:
-	match err_code:
-		OK:
-			return "OK"
-		ERR_UNCONFIGURED:
-			return "HTTPRequest not configured (not in tree)."
-		ERR_BUSY:
-			return "HTTPRequest is busy with a previous request."
-		ERR_INVALID_PARAMETER:
-			return "Invalid URL format."
-		ERR_CANT_CONNECT:
-			return "Cannot connect to host."
-		_:
-			return "Unknown error (%d)." % err_code
@@ -1,184 +0,0 @@
-## AvatarCatalog - Asset catalog management.
-##
-## Manages the mapping of asset IDs to their metadata and resource paths.
-## Loads the catalog manifest from disk and provides lookup by ID and slot.
-##
-## The catalog is loaded from `res://assets/avatars/catalog.json` which follows
-## the format specified in avatar.md §7.2.
-
-class_name AvatarCatalog
-extends RefCounted
-
-# Preloaded rather than referenced by global class_name -- see avatar_loadout.gd.
-const AvatarLoadout := preload("res://scripts/avatar/avatar_loadout.gd")
-
-
-## Emitted when the catalog is loaded successfully.
-signal catalog_loaded
-
-## Emitted when the catalog fails to load.
-signal catalog_load_failed(error_message: String)
-
-## Catalog manifest structure:
-## { "assets": { "id": { "type", "slot", "path", "version", ... } } }
-var _catalog: Dictionary = {}
-var _loaded: bool = false
-var _catalog_path: String = "res://assets/avatars/catalog.json"
-
-
-# ---------------------------------------------------------------------------
-# Public API
-# ---------------------------------------------------------------------------
-
-## Load the catalog from disk. Call this before any lookups.
-func load_catalog(path: String = _catalog_path) -> Error:
-	_catalog_path = path
-	_catalog = {}
-
-	var file = FileAccess.open(path, FileAccess.READ)
-	if file == null:
-		var err = FileAccess.get_open_error()
-		catalog_load_failed.emit("Cannot open catalog: %s (error %d)" % [path, err])
-		return err
-
-	var json_text: String = file.get_as_text()
-	file.close()
-
-	var result: Variant = JSON.parse_string(json_text)
-	if result == null or not result is Dictionary:
-		catalog_load_failed.emit("Invalid JSON in catalog: %s" % path)
-		return ERR_PARSE_ERROR
-
-	var json: Dictionary = result as Dictionary
-
-	if not json.has("assets"):
-		catalog_load_failed.emit("Catalog missing 'assets' key")
-		return ERR_INVALID_DATA
-
-	_catalog = json["assets"]
-	_loaded = true
-	catalog_loaded.emit()
-	return OK
-
-
-## Check if the catalog has been loaded.
-func is_loaded() -> bool:
-	return _loaded
-
-
-## Resolve an asset by its ID.
-## Returns a Dictionary with keys: type, slot, path, version, etc.
-## Returns null if the asset ID is not found.
-func resolve(id: String) -> Dictionary:
-	if not _loaded:
-		return {}
-	return _catalog.get(id, {})
-
-
-## Check if an asset ID exists in the catalog.
-func has_asset(id: String) -> bool:
-	if not _loaded:
-		return false
-	return _catalog.has(id)
-
-
-## Get all assets that belong to a given slot.
-## Returns an array of asset ID strings.
-func get_assets_by_slot(slot: String) -> Array[String]:
-	if not _loaded:
-		return []
-	var result: Array[String] = []
-	for id in _catalog:
-		var asset: Dictionary = _catalog[id]
-		if asset.get("slot") == slot:
-			result.append(id)
-	return result
-
-
-## Get all asset IDs in the catalog.
-func get_all_ids() -> Array[String]:
-	if not _loaded:
-		return []
-	return _catalog.keys()
-
-
-## Validate a loadout against the catalog.
-## Returns a Dictionary with "valid" (bool) and "errors" (Array[String]).
-func validate_loadout(loadout: AvatarLoadout) -> Dictionary:
-	var errors: Array[String] = []
-
-	# Check base_body
-	if loadout.base_body.is_empty():
-		errors.append("Loadout missing base_body")
-	elif not has_asset(loadout.base_body):
-		errors.append("Unknown base_body asset: %s" % loadout.base_body)
-	else:
-		var base: Dictionary = resolve(loadout.base_body)
-		if base.get("type") != "base_body":
-			errors.append("base_body asset '%s' is not type 'base_body'" % loadout.base_body)
-
-	# Check each slot
-	for slot_id in loadout.slots:
-		var slot_value = loadout.slots[slot_id]
-
-		if slot_value == null:
-			continue
-
-		if slot_id == "accessory":
-			# Accessory is an array
-			if not slot_value is Array:
-				errors.append("Slot '%s' must be an array" % slot_id)
-				continue
-			for item_id in slot_value:
-				if not has_asset(item_id):
-					errors.append("Unknown accessory asset: %s" % item_id)
-				else:
-					var asset: Dictionary = resolve(item_id)
-					if asset.get("slot") != slot_id:
-						errors.append("Accessory '%s' slot '%s' does not match slot '%s'" % [
-							item_id, asset.get("slot"), slot_id
-						])
-		else:
-			# Exclusive slot - single value
-			if not slot_value is String:
-				errors.append("Slot '%s' must be a string or null" % slot_id)
-				continue
-			if not has_asset(slot_value):
-				errors.append("Unknown asset in slot '%s': %s" % [slot_id, slot_value])
-			else:
-				var asset: Dictionary = resolve(slot_value)
-				if asset.get("slot") != slot_id:
-					errors.append("Asset '%s' slot '%s' does not match slot '%s'" % [
-						slot_value, asset.get("slot"), slot_id
-					])
-
-	return {
-		"valid": errors.is_empty(),
-		"errors": errors
-	}
-
-
-## Compute a hash of the loadout for change detection.
-## Returns a 32-bit hash value (GDScript has no fixed-width uint type — int
-## is 64-bit signed, the value is just constrained to 32 bits of range).
-static func compute_loadout_hash(loadout: AvatarLoadout) -> int:
-	var hasher = HashingContext.new()
-	hasher.start(HashingContext.HASH_SHA256)
-
-	hasher.update(loadout.base_body.to_utf8_buffer())
-	for slot_id in loadout.slots:
-		var slot_value = loadout.slots[slot_id]
-		hasher.update(slot_id.to_utf8_buffer())
-		if slot_value is Array:
-			for item in slot_value:
-				hasher.update(item.to_utf8_buffer())
-		elif slot_value is String:
-			hasher.update(slot_value.to_utf8_buffer())
-
-	var hash_bytes = hasher.finish()
-	return hash_bytes[0] | (hash_bytes[1] << 8) | (hash_bytes[2] << 16) | (hash_bytes[3] << 24)
-
-
-## Get the catalog path.
-func get_catalog_path() -> String:
-	return _catalog_path
@@ -1 +0,0 @@
-uid://ceyugve7rjxqs
@@ -1,621 +0,0 @@
-## AvatarCustomizationUI
-##
-## The in-game avatar customization screen. Lets the player:
-##   - See a live preview of their avatar.
-##   - Browse and equip/unequip items per slot.
-##   - Adjust skin tone.
-##   - Save / load loadouts.
-##
-## The UI is built programmatically so it works without a pre-authored .tscn.
-## It is a Control node that can be added to any scene.
-
-class_name AvatarCustomizationUI
-extends Control
-
-# Preloaded rather than referenced by global class_name -- see avatar_loadout.gd.
-const AvatarLoadout := preload("res://scripts/avatar/avatar_loadout.gd")
-const AvatarCatalog := preload("res://scripts/avatar/avatar_catalog.gd")
-const AvatarLoader := preload("res://scripts/avatar/avatar_loader.gd")
-const AvatarVisualizer := preload("res://scripts/avatar/avatar_visualizer.gd")
-const AvatarSlotRegistry := preload("res://scripts/avatar/avatar_slot_registry.gd")
-
-
-# ---------------------------------------------------------------------------
-# Signals
-# ---------------------------------------------------------------------------
-
-## Emitted when the player closes the customization screen.
-signal closed
-
-## Emitted when the loadout changes (after equip/unequip/skin-tone).
-signal loadout_changed(loadout: AvatarLoadout)
-
-
-# ---------------------------------------------------------------------------
-# Exports / config
-# ---------------------------------------------------------------------------
-
-## Path to the asset catalog manifest.
-@export var catalog_path: String = "res://assets/avatars/catalog.json"
-
-## The default base body to use when none is equipped.
-@export var default_base_body: String = "base_human_male_01"
-
-
-# ---------------------------------------------------------------------------
-# State
-# ---------------------------------------------------------------------------
-
-## The current loadout being edited.
-var loadout: AvatarLoadout = null
-
-## The AvatarSystem singleton (set in _ready).
-var _system: Node = null
-
-## The catalog (owned by AvatarSystem).
-var _catalog: AvatarCatalog = null
-
-## The loader (owned by AvatarSystem).
-var _loader: AvatarLoader = null
-
-## The visualizer that renders the preview.
-var _visualizer: AvatarVisualizer = null
-
-## The preview viewport container.
-var _preview_container: SubViewportContainer = null
-
-## The preview viewport.
-var _preview_viewport: SubViewport = null
-
-## The preview camera.
-var _preview_camera: Camera3D = null
-
-## The preview avatar root.
-var _preview_root: Node3D = null
-
-## Currently selected slot id.
-var _selected_slot: String = ""
-
-## Skin: a base colour picked from a swatch, plus a shade multiplier from the
-## slider (0.5 = the swatch as-is, lower = darker, higher = lighter). The
-## first swatch is the placeholder default yellow.
-const SKIN_SWATCHES: Array[Color] = [
-	Color(0.96, 0.80, 0.19),  # yellow (default)
-	Color(0.95, 0.78, 0.66),  # pale
-	Color(0.83, 0.62, 0.46),  # tan
-	Color(0.55, 0.38, 0.27),  # brown
-	Color(0.33, 0.21, 0.15),  # deep brown
-	Color(0.62, 0.62, 0.64),  # grey
-	Color(0.78, 0.24, 0.24),  # red
-	Color(0.30, 0.62, 0.34),  # green
-	Color(0.26, 0.46, 0.76),  # blue
-	Color(0.62, 0.36, 0.72),  # purple
-]
-var _skin_base: Color = SKIN_SWATCHES[0]
-
-## Turntable: the preview avatar's Y rotation (radians), whether the player is
-## currently dragging it, and how long since they last touched it (drives the
-## slow idle auto-spin). Starts facing the camera.
-var _turntable_yaw: float = PI
-var _turntable_dragging: bool = false
-var _turntable_idle: float = 0.0
-const _TURNTABLE_IDLE_SPIN_DELAY := 2.5
-const _TURNTABLE_IDLE_SPIN_SPEED := 0.5
-const _TURNTABLE_DRAG_SPEED := 0.01
-
-## UI node references.
-var _slot_list: VBoxContainer = null
-var _item_list: VBoxContainer = null
-var _slot_label: Label = null
-var _item_label: Label = null
-var _skin_tone_slider: HSlider = null
-var _status_label: Label = null
-
-
-# ---------------------------------------------------------------------------
-# Lifecycle
-# ---------------------------------------------------------------------------
-
-func _ready() -> void:
-	# Grab the AvatarSystem autoload.
-	_system = get_node_or_null("/root/AvatarSystem")
-	if _system == null:
-		push_error("AvatarCustomizationUI: AvatarSystem autoload not found")
-		return
-
-	_catalog = _system.catalog
-	_loader = _system.loader
-
-	# Load the catalog if not already loaded.
-	if _catalog != null and not _catalog.is_loaded():
-		_catalog.load_catalog(catalog_path)
-
-	# Build the UI.
-	_build_ui()
-
-	# Seed from the player's live loadout (set at login) if there is one, so
-	# the screen opens showing what they're actually wearing; otherwise start
-	# from a bare default.
-	if _system != null and _system.current_loadout != null:
-		loadout = AvatarLoadout.from_json(_system.current_loadout.to_json())
-	if loadout == null or not loadout.validate():
-		loadout = AvatarLoadout.new()
-		loadout.base_body = default_base_body
-
-	# Initialize the visualizer.
-	_visualizer = AvatarVisualizer.new()
-
-	# Populate the slot list.
-	_populate_slots()
-
-	# Select the first slot.
-	if AvatarSlotRegistry.SLOT_IDS.size() > 0:
-		_select_slot(AvatarSlotRegistry.SLOT_IDS[0])
-
-	# Refresh the preview.
-	_refresh_preview()
-
-
-# ---------------------------------------------------------------------------
-# UI construction
-# ---------------------------------------------------------------------------
-
-## Build the entire UI tree programmatically.
-func _build_ui() -> void:
-	# Root layout: horizontal split (preview | controls).
-	var root_hbox := HBoxContainer.new()
-	root_hbox.name = "RootLayout"
-	root_hbox.set_anchors_preset(Control.PRESET_FULL_RECT)
-	root_hbox.add_theme_constant_override("separation", 16)
-	add_child(root_hbox)
-
-	# --- Left: preview (takes all the leftover width) ---
-	var preview_panel := PanelContainer.new()
-	preview_panel.name = "PreviewPanel"
-	preview_panel.custom_minimum_size = Vector2(420, 0)
-	preview_panel.size_flags_horizontal = Control.SIZE_EXPAND_FILL
-	root_hbox.add_child(preview_panel)
-
-	var preview_margin := MarginContainer.new()
-	preview_margin.add_theme_constant_override("margin_left", 8)
-	preview_margin.add_theme_constant_override("margin_right", 8)
-	preview_margin.add_theme_constant_override("margin_top", 8)
-	preview_margin.add_theme_constant_override("margin_bottom", 8)
-	preview_panel.add_child(preview_margin)
-
-	var preview_vbox := VBoxContainer.new()
-	preview_vbox.add_theme_constant_override("separation", 6)
-	preview_margin.add_child(preview_vbox)
-
-	_preview_container = SubViewportContainer.new()
-	_preview_container.name = "PreviewViewportContainer"
-	_preview_container.stretch = true
-	_preview_container.custom_minimum_size = Vector2(400, 520)
-	_preview_container.size_flags_horizontal = Control.SIZE_EXPAND_FILL
-	_preview_container.size_flags_vertical = Control.SIZE_EXPAND_FILL
-	_preview_container.mouse_filter = Control.MOUSE_FILTER_STOP
-	_preview_container.gui_input.connect(_on_preview_gui_input)
-	preview_vbox.add_child(_preview_container)
-
-	var rotate_hint := Label.new()
-	rotate_hint.text = "drag to rotate"
-	rotate_hint.horizontal_alignment = HORIZONTAL_ALIGNMENT_CENTER
-	rotate_hint.add_theme_color_override("font_color", Color(1, 1, 1, 0.5))
-	rotate_hint.add_theme_font_size_override("font_size", 12)
-	preview_vbox.add_child(rotate_hint)
-
-	_preview_viewport = SubViewport.new()
-	_preview_viewport.name = "PreviewViewport"
-	_preview_viewport.size = Vector2i(400, 520)
-	_preview_viewport.render_target_update_mode = SubViewport.UPDATE_ALWAYS
-	_preview_viewport.transparent_bg = true
-	# Its own 3D world -- a SubViewport that shares the (Control-only) main
-	# world has no scenario/environment set up and renders nothing.
-	_preview_viewport.own_world_3d = true
-	_preview_container.add_child(_preview_viewport)
-
-	# Environment: ambient fill so the model reads even from a bad light angle.
-	var world_env := WorldEnvironment.new()
-	world_env.name = "PreviewEnv"
-	var env := Environment.new()
-	env.background_mode = Environment.BG_COLOR
-	env.background_color = Color(0.10, 0.11, 0.14)
-	env.ambient_light_source = Environment.AMBIENT_SOURCE_COLOR
-	env.ambient_light_color = Color(0.62, 0.64, 0.7)
-	env.ambient_light_energy = 0.7
-	world_env.environment = env
-	_preview_viewport.add_child(world_env)
-
-	# Camera for the preview -- framed to fit the full ~2 m avatar.
-	_preview_camera = Camera3D.new()
-	_preview_camera.name = "PreviewCamera"
-	# look_at needs a global transform, which only exists once in the tree.
-	_preview_camera.look_at_from_position(
-		Vector3(0, 1.05, 3.5), Vector3(0, 0.98, 0), Vector3.UP)
-	_preview_camera.current = true
-	_preview_viewport.add_child(_preview_camera)
-
-	# Avatar root inside the viewport.
-	_preview_root = Node3D.new()
-	_preview_root.name = "AvatarPreviewRoot"
-	_preview_viewport.add_child(_preview_root)
-
-	# Key + fill lights so the avatar is clearly visible.
-	var key := DirectionalLight3D.new()
-	key.name = "PreviewKeyLight"
-	key.rotation_degrees = Vector3(-35, 35, 0)
-	key.light_energy = 1.0
-	_preview_viewport.add_child(key)
-	var fill := DirectionalLight3D.new()
-	fill.name = "PreviewFillLight"
-	fill.rotation_degrees = Vector3(-20, -140, 0)
-	fill.light_energy = 0.35
-	_preview_viewport.add_child(fill)
-
-	# --- Right: controls ---
-	var controls_panel := PanelContainer.new()
-	controls_panel.name = "ControlsPanel"
-	controls_panel.custom_minimum_size = Vector2(520, 0)
-	root_hbox.add_child(controls_panel)
-
-	var controls_margin := MarginContainer.new()
-	controls_margin.add_theme_constant_override("margin_left", 12)
-	controls_margin.add_theme_constant_override("margin_right", 12)
-	controls_margin.add_theme_constant_override("margin_top", 12)
-	controls_margin.add_theme_constant_override("margin_bottom", 12)
-	controls_panel.add_child(controls_margin)
-
-	var controls_vbox := VBoxContainer.new()
-	controls_vbox.name = "Controls"
-	controls_vbox.add_theme_constant_override("separation", 8)
-	controls_margin.add_child(controls_vbox)
-
-	# Title.
-	var title := Label.new()
-	title.text = "Avatar Customization"
-	title.add_theme_font_size_override("font_size", 24)
-	controls_vbox.add_child(title)
-
-	# Slot selector.
-	var slot_header := Label.new()
-	slot_header.text = "Slots"
-	slot_header.add_theme_font_size_override("font_size", 16)
-	controls_vbox.add_child(slot_header)
-
-	var slot_scroll := ScrollContainer.new()
-	slot_scroll.custom_minimum_size = Vector2(0, 160)
-	controls_vbox.add_child(slot_scroll)
-
-	_slot_list = VBoxContainer.new()
-	_slot_list.name = "SlotList"
-	_slot_list.add_theme_constant_override("separation", 4)
-	slot_scroll.add_child(_slot_list)
-
-	# Item selector for the selected slot.
-	var item_header := Label.new()
-	item_header.text = "Items"
-	item_header.add_theme_font_size_override("font_size", 16)
-	controls_vbox.add_child(item_header)
-
-	var item_scroll := ScrollContainer.new()
-	item_scroll.custom_minimum_size = Vector2(0, 200)
-	controls_vbox.add_child(item_scroll)
-
-	_item_list = VBoxContainer.new()
-	_item_list.name = "ItemList"
-	_item_list.add_theme_constant_override("separation", 4)
-	item_scroll.add_child(_item_list)
-
-	# Skin colour: a row of preset swatches + a shade slider that darkens or
-	# lightens the picked colour. The first swatch is the default yellow.
-	var skin_header := Label.new()
-	skin_header.text = "Skin Colour"
-	skin_header.add_theme_font_size_override("font_size", 16)
-	controls_vbox.add_child(skin_header)
-
-	var swatch_grid := GridContainer.new()
-	swatch_grid.columns = 5
-	swatch_grid.add_theme_constant_override("h_separation", 4)
-	swatch_grid.add_theme_constant_override("v_separation", 4)
-	controls_vbox.add_child(swatch_grid)
-	for c in SKIN_SWATCHES:
-		swatch_grid.add_child(_make_swatch(c))
-
-	var shade_label := Label.new()
-	shade_label.text = "Shade"
-	shade_label.add_theme_font_size_override("font_size", 13)
-	controls_vbox.add_child(shade_label)
-
-	_skin_tone_slider = HSlider.new()
-	_skin_tone_slider.name = "ShadeSlider"
-	_skin_tone_slider.min_value = 0.0
-	_skin_tone_slider.max_value = 1.0
-	_skin_tone_slider.step = 0.01
-	_skin_tone_slider.value = 0.5
-	_skin_tone_slider.custom_minimum_size = Vector2(0, 24)
-	_skin_tone_slider.value_changed.connect(_on_skin_tone_changed)
-	controls_vbox.add_child(_skin_tone_slider)
-
-	# Status / error label.
-	_status_label = Label.new()
-	_status_label.name = "StatusLabel"
-	_status_label.text = ""
-	_status_label.add_theme_color_override("font_color", Color(1, 0.4, 0.4))
-	_status_label.autowrap_mode = TextServer.AUTOWRAP_WORD_SMART
-	controls_vbox.add_child(_status_label)
-
-	# Action buttons.
-	var button_row := HBoxContainer.new()
-	button_row.add_theme_constant_override("separation", 8)
-	controls_vbox.add_child(button_row)
-
-	var save_btn := Button.new()
-	save_btn.text = "Save Loadout"
-	save_btn.pressed.connect(_on_save_pressed)
-	button_row.add_child(save_btn)
-
-	var load_btn := Button.new()
-	load_btn.text = "Load Loadout"
-	load_btn.pressed.connect(_on_load_pressed)
-	button_row.add_child(load_btn)
-
-	var close_btn := Button.new()
-	close_btn.text = "Close"
-	close_btn.pressed.connect(_on_close_pressed)
-	button_row.add_child(close_btn)
-
-
-# ---------------------------------------------------------------------------
-# Slot / item population
-# ---------------------------------------------------------------------------
-
-## Populate the slot list with buttons for each slot.
-func _populate_slots() -> void:
-	if _slot_list == null:
-		return
-
-	# Clear existing children.
-	for child in _slot_list.get_children():
-		child.queue_free()
-
-	for slot_id in AvatarSlotRegistry.SLOT_IDS:
-		var btn := Button.new()
-		btn.name = "Slot_%s" % slot_id
-		btn.text = slot_id
-		btn.toggle_mode = true
-		btn.pressed.connect(_on_slot_button_pressed.bind(slot_id))
-		_slot_list.add_child(btn)
-
-
-## Populate the item list for the currently selected slot.
-func _populate_items() -> void:
-	if _item_list == null or _selected_slot.is_empty():
-		return
-
-	# Clear existing children.
-	for child in _item_list.get_children():
-		child.queue_free()
-
-	if _catalog == null:
-		return
-
-	# Get assets for this slot.
-	var assets: Array[String] = _catalog.get_assets_by_slot(_selected_slot)
-
-	# "None" button to unequip.
-	var none_btn := Button.new()
-	none_btn.text = "(none)"
-	none_btn.pressed.connect(_on_equip_pressed.bind(""))
-	_item_list.add_child(none_btn)
-
-	for asset_id in assets:
-		var btn := Button.new()
-		btn.text = asset_id
-		btn.pressed.connect(_on_equip_pressed.bind(asset_id))
-		_item_list.add_child(btn)
-
-
-# ---------------------------------------------------------------------------
-# Slot selection
-# ---------------------------------------------------------------------------
-
-## Handle a slot button press.
-func _on_slot_button_pressed(slot_id: String) -> void:
-	_select_slot(slot_id)
-
-
-## Select a slot and refresh the item list.
-func _select_slot(slot_id: String) -> void:
-	_selected_slot = slot_id
-
-	# Update button toggle states.
-	if _slot_list != null:
-		for child in _slot_list.get_children():
-			if child is Button:
-				var btn := child as Button
-				btn.button_pressed = (btn.name == "Slot_%s" % slot_id)
-
-	_populate_items()
-
-
-# ---------------------------------------------------------------------------
-# Equip / unequip
-# ---------------------------------------------------------------------------
-
-## Handle an equip/unequip action for the selected slot.
-func _on_equip_pressed(asset_id: String) -> void:
-	if loadout == null or _selected_slot.is_empty():
-		return
-
-	if _selected_slot == "accessory":
-		if asset_id.is_empty():
-			# Clear all accessories.
-			loadout.slots["accessory"] = []
-		else:
-			loadout.add_accessory(asset_id)
-	else:
-		loadout.set_equipment(_selected_slot, asset_id)
-
-	_refresh_preview()
-	loadout_changed.emit(loadout)
-
-
-# ---------------------------------------------------------------------------
-# Turntable (drag to rotate the preview, slow auto-spin when idle)
-# ---------------------------------------------------------------------------
-
-func _process(delta: float) -> void:
-	if _preview_root == null:
-		return
-	if _turntable_dragging:
-		_turntable_idle = 0.0
-	else:
-		_turntable_idle += delta
-		if _turntable_idle > _TURNTABLE_IDLE_SPIN_DELAY:
-			_turntable_yaw += delta * _TURNTABLE_IDLE_SPIN_SPEED
-	_preview_root.rotation.y = _turntable_yaw
-
-
-func _on_preview_gui_input(event: InputEvent) -> void:
-	if event is InputEventMouseButton and event.button_index == MOUSE_BUTTON_LEFT:
-		_turntable_dragging = event.pressed
-		_turntable_idle = 0.0
-	elif event is InputEventMouseMotion and _turntable_dragging:
-		_turntable_yaw -= event.relative.x * _TURNTABLE_DRAG_SPEED
-		_turntable_idle = 0.0
-
-
-# ---------------------------------------------------------------------------
-# Preview refresh
-# ---------------------------------------------------------------------------
-
-## Rebuild the avatar preview from the current loadout.
-func _refresh_preview() -> void:
-	if _visualizer == null or _preview_root == null:
-		return
-
-	# Clear the preview root.
-	for child in _preview_root.get_children():
-		child.queue_free()
-
-	# Validate the loadout.
-	if loadout == null or loadout.base_body.is_empty():
-		_status_label.text = "No base body selected."
-		return
-
-	# Build the render tree.
-	_visualizer.load_loadout(loadout, _preview_root)
-
-	# Show any validation errors.
-	if not loadout.validation_errors.is_empty():
-		_status_label.text = "\n".join(loadout.validation_errors)
-	else:
-		_status_label.text = ""
-
-
-# ---------------------------------------------------------------------------
-# Skin tone
-# ---------------------------------------------------------------------------
-
-## Build one clickable colour swatch.
-func _make_swatch(color: Color) -> Button:
-	var b := Button.new()
-	b.custom_minimum_size = Vector2(40, 30)
-	b.tooltip_text = "#" + color.to_html(false)
-	for state in ["normal", "hover", "pressed", "focus", "disabled"]:
-		var sb := StyleBoxFlat.new()
-		sb.bg_color = color
-		sb.set_corner_radius_all(3)
-		if state == "hover" or state == "pressed" or state == "focus":
-			sb.set_border_width_all(2)
-			sb.border_color = Color.WHITE
-		b.add_theme_stylebox_override(state, sb)
-	b.pressed.connect(_on_skin_swatch_pressed.bind(color))
-	return b
-
-
-func _on_skin_swatch_pressed(color: Color) -> void:
-	_skin_base = color
-	_apply_skin_colour()
-
-
-func _on_skin_tone_changed(_value: float) -> void:
-	_apply_skin_colour()
-
-
-## Combine the picked swatch with the shade slider and push it to the loadout.
-func _apply_skin_colour() -> void:
-	if loadout == null:
-		return
-	var shade: float = _skin_tone_slider.value if _skin_tone_slider != null else 0.5
-	var col := _skin_base
-	if shade < 0.5:
-		col = _skin_base.lerp(Color.BLACK, (0.5 - shade) * 1.7)
-	elif shade > 0.5:
-		col = _skin_base.lerp(Color.WHITE, (shade - 0.5) * 1.3)
-	col.a = 1.0
-	loadout.skin_tone = col
-	_refresh_preview()
-	loadout_changed.emit(loadout)
-
-
-# ---------------------------------------------------------------------------
-# Save / load
-# ---------------------------------------------------------------------------
-
-func _on_save_pressed() -> void:
-	if loadout == null:
-		return
-
-	# Local cache (offline fallback / fast reopen).
-	var json := loadout.to_json()
-	var file := FileAccess.open("user://loadout.json", FileAccess.WRITE)
-	if file:
-		file.store_string(json)
-		file.close()
-
-	# Apply to the live in-world avatar immediately.
-	if _system != null:
-		_system.set_loadout_from_dict(JSON.parse_string(json))
-
-	# Persist to the backend if we're signed in.
-	var api := get_node_or_null("/root/ApiClient")
-	if api != null and api.has_token():
-		_status_label.text = "Saving…"
-		var res: Dictionary = await api.save_avatar_loadout(JSON.parse_string(json))
-		_status_label.text = "Saved." if res.get("ok", false) else "Saved locally (backend: %s)" % res.get("detail", "error")
-	else:
-		_status_label.text = "Saved locally (not signed in)."
-
-
-func _on_load_pressed() -> void:
-	if not FileAccess.file_exists("user://loadout.json"):
-		_status_label.text = "No saved loadout found."
-		return
-
-	var file := FileAccess.open("user://loadout.json", FileAccess.READ)
-	if file == null:
-		_status_label.text = "Failed to open saved loadout."
-		return
-
-	var json := file.get_as_text()
-	file.close()
-
-	var loaded := AvatarLoadout.from_json(json)
-	if not loaded.validation_errors.is_empty():
-		_status_label.text = "Saved loadout invalid: %s" % "\n".join(loaded.validation_errors)
-		return
-
-	loadout = loaded
-	_refresh_preview()
-	loadout_changed.emit(loadout)
-	_status_label.text = "Loadout loaded."
-
-
-# ---------------------------------------------------------------------------
-# Close
-# ---------------------------------------------------------------------------
-
-func _on_close_pressed() -> void:
-	closed.emit()
-	queue_free()
@@ -1 +0,0 @@
-uid://crqtef5rifgrv
@@ -1,562 +0,0 @@
-## AvatarLoader - glTF/GLB import, skeleton merge, and skin re-targeting.
-##
-## Loads base body and attachment GLB assets, extracts skeletons and meshes,
-## and re-targets attachment skins to the canonical skeleton by bone name.
-##
-## Per the avatar architecture spec (§6.2, §6.3):
-## - The base body carries the canonical skeleton.
-## - Attachments are skinned to the same skeleton by name-based re-targeting.
-## - Static accessories are parented to their mount bone.
-## - Body-part slots hide the corresponding base mesh.
-
-class_name AvatarLoader
-extends Node
-
-# Preloaded rather than referenced by global class_name -- see avatar_loadout.gd.
-const AvatarCatalog := preload("res://scripts/avatar/avatar_catalog.gd")
-
-
-# ---------------------------------------------------------------------------
-# Constants
-# ---------------------------------------------------------------------------
-
-## Maximum number of attachments allowed in the accessory slot.
-const MAX_ACCESSORY_COUNT := 8
-
-## The skin albedo baked into the placeholder base body by
-## gen_placeholder_avatars.gd. apply_skin_tone() finds the mesh surfaces
-## painted this colour (head + arms) and retints them.
-const PLACEHOLDER_SKIN_ALBEDO := Color(0.96, 0.80, 0.19)
-
-## Skeleton bone names that form the canonical rig (§3.1).
-const CANONICAL_BONES := [
-	"Root",
-	"Hips",
-	"Spine",
-	"Chest",
-	"Neck",
-	"Head",
-	"HeadTop",
-	"Jaw",
-	"LeftEye",
-	"RightEye",
-	"LeftShoulder",
-	"LeftUpperArm",
-	"LeftLowerArm",
-	"LeftHand",
-	"RightShoulder",
-	"RightUpperArm",
-	"RightLowerArm",
-	"RightHand",
-	"LeftUpperLeg",
-	"LeftLowerLeg",
-	"LeftFoot",
-	"RightUpperLeg",
-	"RightLowerLeg",
-	"RightFoot",
-]
-
-
-# ---------------------------------------------------------------------------
-# Signals
-# ---------------------------------------------------------------------------
-
-## Emitted when a base body has been loaded successfully.
-signal base_body_loaded(avatar_node: Node3D)
-
-## Emitted when an attachment has been loaded and merged.
-signal attachment_loaded(slot_id: String, attachment_node: Node3D)
-
-## Emitted on error during loading.
-signal load_error(error_msg: String)
-
-
-# ---------------------------------------------------------------------------
-# State
-# ---------------------------------------------------------------------------
-
-## The fully assembled avatar node (Skeleton3D + meshes + attachments).
-var avatar_node: Node3D = null
-
-## The Skeleton3D belonging to the avatar.
-var skeleton: Skeleton3D = null
-
-## Mapping of bone name -> bone index in the skeleton.
-var _bone_index_map: Dictionary = {}
-
-## Loaded base body meshes, keyed by slot id.
-var _base_meshes: Dictionary = {}
-
-## Loaded attachment nodes, keyed by slot id.
-var _attachments: Dictionary = {}
-
-## Whether the base body has been loaded.
-var is_base_loaded: bool = false
-
-## The avatar catalog reference (set by AvatarSystem).
-var catalog: AvatarCatalog = null
-
-
-# ---------------------------------------------------------------------------
-# Public API
-# ---------------------------------------------------------------------------
-
-## Initialize the loader with a reference to the avatar catalog.
-func init_loader(cat: AvatarCatalog) -> void:
-	catalog = cat
-
-
-## Load the base body asset identified by [param base_body_id].
-## Returns the AvatarNode3D on success, or null on failure.
-func load_base_body(base_body_id: String) -> Node3D:
-	if catalog == null:
-		load_error.emit("AvatarCatalog not set on AvatarLoader")
-		return null
-
-	var asset_meta = catalog.resolve(base_body_id)
-	if asset_meta == null:
-		load_error.emit("Unknown base_body asset: %s" % base_body_id)
-		return null
-
-	if asset_meta.type != "base_body":
-		load_error.emit("Asset '%s' is not a base_body, got '%s'" % [
-			base_body_id, asset_meta.type])
-		return null
-
-	var path: String = asset_meta.path
-	avatar_node = _instance_glb_as_avatar(path)
-	if avatar_node == null:
-		load_error.emit("Failed to load base body scene: %s" % path)
-		return null
-
-	skeleton = avatar_node.get_node_or_null("Skeleton3D") as Skeleton3D
-	if skeleton == null:
-		load_error.emit("No Skeleton3D found in base body: %s" % path)
-		avatar_node.queue_free()
-		return null
-
-	# Build bone index map for fast lookups.
-	_bone_index_map.clear()
-	for i in skeleton.get_bone_count():
-		var bone_name: String = skeleton.get_bone_name(i)
-		if not bone_name.is_empty():
-			_bone_index_map[bone_name] = i
-
-	# Extract base body meshes and store them.
-	_extract_base_meshes(avatar_node)
-
-	is_base_loaded = true
-	base_body_loaded.emit(avatar_node)
-	return avatar_node
-
-
-## Load and merge an attachment into the avatar.
-## [param slot_id] is the slot to equip into.
-## [param asset_id] is the catalog id of the attachment.
-## Returns the attachment Node3D on success, or null on failure.
-func load_attachment(slot_id: String, asset_id: String) -> Node3D:
-	if not is_base_loaded:
-		load_error.emit("Cannot load attachment: base body not loaded")
-		return null
-
-	if catalog == null:
-		load_error.emit("AvatarCatalog not set on AvatarLoader")
-		return null
-
-	var asset_meta = catalog.resolve(asset_id)
-	if asset_meta == null:
-		load_error.emit("Unknown attachment asset: %s" % asset_id)
-		return null
-
-	if asset_meta.type != "attachment":
-		load_error.emit("Asset '%s' is not an attachment, got '%s'" % [
-			asset_id, asset_meta.type])
-		return null
-
-	# Check slot exclusivity for accessory slot.
-	if slot_id == "accessory":
-		var current_accessories: Array = _attachments.get("accessory", [])
-		if current_accessories.size() >= MAX_ACCESSORY_COUNT:
-			load_error.emit("Accessory slot full (%d/%d)" % [
-				MAX_ACCESSORY_COUNT, MAX_ACCESSORY_COUNT])
-			return null
-
-	var path: String = asset_meta.path
-	var attachment_node = _instance_glb_as_attachment(path, slot_id)
-	if attachment_node == null:
-		load_error.emit("Failed to load attachment scene: %s" % path)
-		return null
-
-	# If the attachment carries its own skin, retarget it to the canonical
-	# skeleton; static props (the common case) are unaffected.
-	_retarget_skin(attachment_node)
-
-	# Mount to the appropriate bone via a BoneAttachment3D so it follows the
-	# skeleton. Falls back to a plain skeleton child if the mount bone is
-	# missing (a bad catalog entry) rather than dropping the attachment.
-	var mount_bone: String = asset_meta.get("mount_bone", "")
-	if mount_bone.is_empty():
-		mount_bone = _slot_to_mount_bone(slot_id)
-	var mount_node: Node3D
-	if not mount_bone.is_empty() and skeleton.find_bone(mount_bone) != -1:
-		var ba := BoneAttachment3D.new()
-		ba.name = "Mount_%s" % slot_id if slot_id != "accessory" else "Mount_accessory_%s" % asset_id
-		ba.bone_name = mount_bone
-		skeleton.add_child(ba)
-		ba.add_child(attachment_node)
-		mount_node = ba
-	else:
-		skeleton.add_child(attachment_node)
-		mount_node = attachment_node
-
-	# Store the top-level mount node so unload can free the whole unit.
-	if slot_id == "accessory":
-		var list: Array = _attachments.get("accessory", [])
-		list.append(mount_node)
-		_attachments["accessory"] = list
-	else:
-		if _attachments.has(slot_id) and is_instance_valid(_attachments[slot_id]):
-			_attachments[slot_id].queue_free()
-		_attachments[slot_id] = mount_node
-
-	attachment_loaded.emit(slot_id, attachment_node)
-	return attachment_node
-
-
-## Remove an attachment from the given slot.
-func unload_attachment(slot_id: String) -> void:
-	if slot_id == "accessory":
-		for node in _attachments.get("accessory", []):
-			if is_instance_valid(node):
-				node.queue_free()
-		_attachments.erase("accessory")
-	else:
-		var node = _attachments.get(slot_id)
-		if is_instance_valid(node):
-			node.queue_free()
-		_attachments.erase(slot_id)
-
-
-## Hide or show the base mesh for a given body-part slot.
-func set_base_mesh_visible(slot_id: String, visible: bool) -> void:
-	var mesh = _base_meshes.get(slot_id)
-	if mesh and mesh is Node3D:
-		mesh.visible = visible
-
-
-## Retint the base body's skin surfaces (the ones the generator painted
-## PLACEHOLDER_SKIN_ALBEDO -- head + arms) to [param color]. A no-op if the
-## colour is unset (transparent). Real segmented bodies will do this per mesh.
-func apply_skin_tone(color: Color) -> void:
-	if color.a <= 0.0:
-		return
-	if avatar_node == null or not is_instance_valid(avatar_node):
-		return
-	var skel := avatar_node.get_node_or_null("Skeleton3D") as Skeleton3D
-	if skel == null:
-		return
-	for child in skel.get_children():
-		if not (child is MeshInstance3D):
-			continue
-		var mi := child as MeshInstance3D
-		if mi.mesh == null:
-			continue
-		for s in mi.mesh.get_surface_count():
-			var mat := mi.get_active_material(s)
-			if mat is BaseMaterial3D and \
-					(mat as BaseMaterial3D).albedo_color.is_equal_approx(PLACEHOLDER_SKIN_ALBEDO):
-				var tinted := StandardMaterial3D.new()
-				tinted.albedo_color = color
-				tinted.roughness = 0.9
-				mi.set_surface_override_material(s, tinted)
-
-
-## Get the current loadout as a dictionary (for serialization).
-func get_current_loadout() -> Dictionary:
-	var loadout: Dictionary = {
-		"base_body": "",
-		"slots": {},
-	}
-
-	# Determine base body id from catalog.
-	if is_base_loaded and catalog != null:
-		# Walk through catalog to find which base_body loaded.
-		for id in catalog.get_all_ids():
-			var meta = catalog.resolve(id)
-			if meta and meta.type == "base_body":
-				loadout.base_body = id
-				break
-
-	# Collect equipped attachments.
-	for slot_id in _attachments:
-		if slot_id == "accessory":
-			loadout.slots[slot_id] = _attachments[slot_id] as Array
-		else:
-			var node = _attachments[slot_id]
-			if node is Node3D:
-				# Find the asset id by matching the node's name.
-				var aid: String = node.name
-				loadout.slots[slot_id] = aid
-
-	return loadout
-
-
-## Reset the avatar to an unloaded state.
-func reset() -> void:
-	if avatar_node and avatar_node is Node:
-		avatar_node.queue_free()
-
-	avatar_node = null
-	skeleton = null
-	_bone_index_map.clear()
-	_base_meshes.clear()
-	_attachments.clear()
-	is_base_loaded = false
-
-
-# ---------------------------------------------------------------------------
-# Internal: GLB Parsing
-# ---------------------------------------------------------------------------
-
-## Instantiate a base-body .glb (a Godot-imported PackedScene) into an avatar
-## structure:
-##   Avatar (Node3D)
-##     Skeleton3D          -- the canonical rig + skin-bound body meshes
-##     BodyMeshes (Node3D) -- unused container, kept for compatibility
-##     Attachments (Node3D)-- equipped attachment nodes (added by load_attachment)
-##
-## Uses load().instantiate() rather than the runtime GLTFDocument path: the
-## imported .scn is the one that actually ends up in an exported build, with
-## the skeleton + skin set up by Godot's import pipeline. (The raw-bytes
-## GLTFDocument path -- for future user-uploaded models -- misbehaved in a
-## release build: no Skeleton3D produced, so the player fell back to a capsule.)
-func _instance_glb_as_avatar(path: String) -> Node3D:
-	var packed = load(path)
-	if not (packed is PackedScene):
-		push_error("Base body is not an importable scene: %s" % path)
-		return null
-	var scene_root: Node = packed.instantiate()
-	if not (scene_root is Node3D):
-		push_error("Base body scene root is not a Node3D: %s" % path)
-		scene_root.free()
-		return null
-
-	var src_skel := _find_first_skeleton(scene_root)
-	if src_skel == null:
-		push_error("No Skeleton3D in base body scene: %s" % path)
-		scene_root.free()
-		return null
-
-	var avatar := Node3D.new()
-	avatar.name = "Avatar"
-
-	src_skel.get_parent().remove_child(src_skel)
-	src_skel.name = "Skeleton3D"
-	src_skel.transform = Transform3D.IDENTITY
-	_clear_owner_recursive(src_skel)
-	avatar.add_child(src_skel)
-	scene_root.free()
-
-	var body_meshes := Node3D.new()
-	body_meshes.name = "BodyMeshes"
-	avatar.add_child(body_meshes)
-
-	var attachments_container := Node3D.new()
-	attachments_container.name = "Attachments"
-	avatar.add_child(attachments_container)
-
-	return avatar
-
-
-## Depth-first search for the first Skeleton3D under [param node].
-func _find_first_skeleton(node: Node) -> Skeleton3D:
-	if node is Skeleton3D:
-		return node as Skeleton3D
-	for child in node.get_children():
-		var found := _find_first_skeleton(child)
-		if found:
-			return found
-	return null
-
-
-## Instantiate an attachment .glb (imported PackedScene) into a single named
-## Node3D the caller can mount to a bone as one unit.
-func _instance_glb_as_attachment(path: String, slot_id: String) -> Node3D:
-	var packed = load(path)
-	if not (packed is PackedScene):
-		push_error("Attachment is not an importable scene: %s" % path)
-		return null
-	var scene_root: Node = packed.instantiate()
-	if not (scene_root is Node3D):
-		push_error("Attachment scene root is not a Node3D: %s" % path)
-		scene_root.free()
-		return null
-
-	var attachment := Node3D.new()
-	attachment.name = "%s_%s" % [slot_id, path.get_file().get_basename()]
-	for child in scene_root.get_children().duplicate():
-		scene_root.remove_child(child)
-		_clear_owner_recursive(child)
-		attachment.add_child(child)
-	scene_root.free()
-	return attachment
-
-
-## generate_scene() stamps every node with the GLB root as `owner`; that
-## becomes inconsistent (and noisy) once we reparent the node elsewhere.
-func _clear_owner_recursive(node: Node) -> void:
-	node.owner = null
-	for child in node.get_children():
-		_clear_owner_recursive(child)
-
-
-## Index the base body's skinned meshes by slot so equipping a body-part
-## attachment can hide the corresponding base mesh. generate_scene() parents
-## skinned meshes under the Skeleton3D, so scan there.
-func _extract_base_meshes(avatar: Node3D) -> void:
-	var skel := avatar.get_node_or_null("Skeleton3D") as Skeleton3D
-	if skel == null:
-		return
-
-	for child in skel.get_children():
-		if child is MeshInstance3D:
-			# The single "Body" placeholder mesh is registered only under
-			# "torso" -- mapping it to every body-part slot would make it
-			# vanish the moment any one body-part item is equipped. A real
-			# multi-mesh body registers each mesh under its own slot.
-			if child.name == "Body":
-				_base_meshes["torso"] = child
-			else:
-				var slot_id := _mesh_name_to_slot(child.name)
-				if slot_id != "":
-					_base_meshes[slot_id] = child
-
-
-## Map a mesh name to a slot id based on naming conventions (§4.3).
-func _mesh_name_to_slot(mesh_name: String) -> String:
-	if mesh_name == "Body":
-		# Generic body mesh - covers torso, legs, arms.
-		return "torso"
-	if mesh_name == "head_Mesh":
-		return "head"
-	if mesh_name == "torso_Mesh":
-		return "torso"
-	if mesh_name == "legs_Mesh":
-		return "legs"
-	if mesh_name == "left_arm_Mesh":
-		return "left_arm"
-	if mesh_name == "right_arm_Mesh":
-		return "right_arm"
-	return ""
-
-
-# ---------------------------------------------------------------------------
-# Internal: Skin Retargeting
-# ---------------------------------------------------------------------------
-
-## Retarget the skin weights of an attachment node to the canonical skeleton.
-## Walks all MeshInstance3D children and remaps joint indices by bone name.
-func _retarget_skin(attachment_node: Node3D) -> void:
-	if skeleton == null:
-		return
-
-	for child in attachment_node.get_children():
-		if child is MeshInstance3D:
-			var mesh_inst := child as MeshInstance3D
-			var mesh := mesh_inst.mesh
-			if mesh == null:
-				continue
-
-			# Note: MeshInstance3D.mesh is always a Mesh, never a MultiMesh —
-			# MultiMesh skinning goes through MultiMeshInstance3D.multimesh,
-			# a completely separate node/property, not reachable here.
-			if mesh is ArrayMesh:
-				var arr_mesh := mesh as ArrayMesh
-				var surface_count := arr_mesh.get_surface_count()
-
-				for surface_idx in surface_count:
-					var arrays := arr_mesh.surface_get_arrays(surface_idx)
-					# Static props (the common attachment) carry no bone/weight
-					# arrays at all -- nothing to retarget.
-					if arrays[Mesh.ARRAY_BONES] == null or arrays[Mesh.ARRAY_WEIGHTS] == null:
-						continue
-					var joints_array: PackedInt32Array = arrays[Mesh.ARRAY_BONES]
-					var weights_array: PackedFloat32Array = arrays[Mesh.ARRAY_WEIGHTS]
-
-					if joints_array.is_empty():
-						continue
-
-					# Remap joint indices by bone name.
-					var new_joints := PackedInt32Array()
-					for i in range(0, joints_array.size(), 4):
-						for j in 4:
-							var old_joint := joints_array[i + j]
-							if old_joint < 0:
-								new_joints.append(0)
-							else:
-								var bone_name := skeleton.get_bone_name(old_joint)
-								var new_idx: int = _bone_index_map.get(bone_name, 0)
-								new_joints.append(new_idx)
-
-					arrays[Mesh.ARRAY_BONES] = new_joints
-					arr_mesh.surface_set_arrays(surface_idx, arrays)
-
-
-## Parent an attachment node to its mount bone in the skeleton.
-func _parent_attachment(attachment_node: Node3D, slot_id: String,
-		asset_meta: Dictionary) -> void:
-
-	if skeleton == null:
-		return
-
-	var mount_bone: String = asset_meta.get("mount_bone", "")
-	if mount_bone.is_empty():
-		# Try to infer from slot.
-		mount_bone = _slot_to_mount_bone(slot_id)
-
-	if mount_bone.is_empty():
-		return
-
-	var bone_idx := skeleton.find_bone(mount_bone)
-	if bone_idx < 0:
-		return
-
-	# Get the world transform of the bone at the time of attachment.
-	var bone_pose := skeleton.get_bone_pose(bone_idx)
-	var bone_transform := skeleton.global_transform * bone_pose
-
-	# Position the attachment at the bone's location.
-	attachment_node.global_transform = bone_transform
-
-
-## Convert a slot id to its canonical mount bone name (§3.2).
-func _slot_to_mount_bone(slot_id: String) -> String:
-	match slot_id:
-		"head": return "Head"
-		"hair": return "HeadTop"
-		"face": return "Jaw"
-		"torso", "chest", "back": return "Chest"
-		"left_arm": return "LeftUpperArm"
-		"right_arm": return "RightUpperArm"
-		"left_hand": return "LeftHand"
-		"right_hand": return "RightHand"
-		"legs": return "Hips"
-		"pants": return "Hips"
-		"left_foot": return "LeftFoot"
-		"right_foot": return "RightFoot"
-		"accessory": return "Root"
-		_: return ""
-
-
-# ---------------------------------------------------------------------------
-# Internal: File Loading
-# ---------------------------------------------------------------------------
-
-## Load a file from the given path as a PackedByteArray.
-func _load_file(path: String) -> PackedByteArray:
-	var file := FileAccess.open(path, FileAccess.READ)
-	if file == null:
-		return PackedByteArray()
-	var data := file.get_buffer(file.get_length())
-	file.close()
-	return data
@@ -1 +0,0 @@
-uid://br6x7f83dkrw2
@@ -1,315 +0,0 @@
-## AvatarLoadout - Serializable loadout model + validation.
-##
-## Represents a complete avatar composition: a base body plus equipped items
-## per slot. Validates slot exclusivity and references against a catalog.
-##
-## See docs/architecture/avatar.md §5 for the loadout JSON format.
-
-class_name AvatarLoadout
-extends RefCounted
-
-# Sibling avatar scripts are referenced via preload rather than by their
-# global class_name so this module parses correctly from a bare clone (a
-# headless `godot <scene>` run does not rebuild the global class registry;
-# only an editor scan / `--import` does). See docs/architecture/avatar.md.
-const AvatarSlotRegistry := preload("res://scripts/avatar/avatar_slot_registry.gd")
-# Self-reference for the static factory below -- referring to our own
-# class_name doesn't resolve during a cold-cache compile (see note above).
-const _Self := preload("res://scripts/avatar/avatar_loadout.gd")
-
-
-## Maximum number of accessories allowed in the accessory slot.
-const MAX_ACCESSORIES: int = 8
-
-## The base body asset ID.
-var base_body: String = ""
-
-## Equipped items per slot. Keys are slot IDs from AvatarSlotRegistry.
-## Exclusive slots hold a single asset ID (or null).
-## The "accessory" slot holds an array of asset IDs.
-var slots: Dictionary = {}
-
-## Validation errors found during the last validate() call.
-var validation_errors: Array[String] = []
-
-## Skin tone color override (default: transparent = use asset colors).
-var skin_tone: Color = Color.TRANSPARENT
-
-
-# ---------------------------------------------------------------------------
-# Inner classes
-# ---------------------------------------------------------------------------
-
-## Represents a single equipped item in a slot.
-## Used by consumers to iterate over equipped items.
-class SlotItem:
-	## The slot this item belongs to.
-	var slot_id: String
-	## The catalog asset ID of the equipped item.
-	var asset_id: String
-
-	func _init(p_slot_id: String, p_asset_id: String) -> void:
-		slot_id = p_slot_id
-		asset_id = p_asset_id
-
-
-# ---------------------------------------------------------------------------
-# Lifecycle
-# ---------------------------------------------------------------------------
-
-func _init() -> void:
-	validation_errors = []
-
-
-# ---------------------------------------------------------------------------
-# Serialization
-# ---------------------------------------------------------------------------
-
-## Create a loadout from a JSON string.
-static func from_json(json_string: String) -> AvatarLoadout:
-	var loadout := _Self.new()
-	var data: Variant = JSON.parse_string(json_string)
-	if not (data is Dictionary):
-		loadout.validation_errors.append("Loadout JSON root is not an object")
-		return loadout
-
-	var root: Dictionary = data as Dictionary
-
-	# Parse base_body.
-	if root.has("base_body"):
-		var bb = root["base_body"]
-		if typeof(bb) == TYPE_STRING:
-			loadout.base_body = bb as String
-		else:
-			loadout.validation_errors.append("base_body must be a string")
-
-	# Parse slots.
-	if root.has("slots"):
-		var slots_data = root["slots"]
-		if typeof(slots_data) == TYPE_DICTIONARY:
-			var parsed_slots: Dictionary = slots_data as Dictionary
-			for slot_id in parsed_slots:
-				if slot_id is String:
-					loadout.slots[slot_id] = parsed_slots[slot_id]
-		else:
-			loadout.validation_errors.append("slots must be an object")
-	else:
-		loadout.validation_errors.append("Missing 'slots' in loadout JSON")
-
-	# Parse skin_tone.
-	if root.has("skin_tone"):
-		var st = root["skin_tone"]
-		if typeof(st) == TYPE_DICTIONARY:
-			var tone: Dictionary = st as Dictionary
-			loadout.skin_tone = Color(
-				float(tone.get("r", 0.0)),
-				float(tone.get("g", 0.0)),
-				float(tone.get("b", 0.0)),
-				float(tone.get("a", 1.0))
-			)
-
-	return loadout
-
-
-## Serialize this loadout to a JSON string.
-func to_json() -> String:
-	var data := {
-		"base_body": base_body,
-		"slots": {},
-	}
-
-	for slot_id in AvatarSlotRegistry.SLOT_IDS:
-		if slot_id == "accessory":
-			data["slots"][slot_id] = slots.get(slot_id, [])
-		else:
-			data["slots"][slot_id] = slots.get(slot_id, null)
-
-	# Include skin_tone if set.
-	if skin_tone != Color.TRANSPARENT:
-		data["skin_tone"] = {
-			"r": skin_tone.r,
-			"g": skin_tone.g,
-			"b": skin_tone.b,
-			"a": skin_tone.a,
-		}
-
-	return JSON.stringify(data, "  ")
-
-
-# ---------------------------------------------------------------------------
-# Validation
-# ---------------------------------------------------------------------------
-
-## Validate this loadout against the slot registry.
-## Returns true if valid; populates validation_errors if not.
-func validate() -> bool:
-	validation_errors.clear()
-
-	# Check base_body.
-	if base_body.is_empty():
-		validation_errors.append("base_body is required")
-
-	# Check each known slot.
-	for slot_id in AvatarSlotRegistry.SLOT_IDS:
-		var slot_def = AvatarSlotRegistry.get_slot(slot_id)
-		if slot_def == null:
-			validation_errors.append("Unknown slot: %s" % slot_id)
-			continue
-
-		var value = slots.get(slot_id)
-
-		if slot_def.exclusive:
-			# Exclusive slots: must be null or a string.
-			if value != null and typeof(value) != TYPE_STRING:
-				validation_errors.append(
-					"Slot '%s' must be null or a string, got %s" % [
-						slot_id, typeof(value)
-					]
-				)
-		else:
-			# Non-exclusive (accessory): must be null or an array.
-			if value != null and typeof(value) != TYPE_ARRAY:
-				validation_errors.append(
-					"Slot '%s' must be null or an array, got %s" % [
-						slot_id, typeof(value)
-					]
-				)
-			elif value is Array:
-				if slot_id == "accessory" and (value as Array).size() > MAX_ACCESSORIES:
-					validation_errors.append(
-						"Accessory count (%d) exceeds maximum (%d)" % [
-							(value as Array).size(), MAX_ACCESSORIES
-						]
-					)
-
-	# Check for duplicate accessories.
-	if slots.has("accessory") and slots["accessory"] is Array:
-		var accessories := slots["accessory"] as Array
-		var seen := {}
-		for item in accessories:
-			if item is String:
-				if seen.has(item):
-					validation_errors.append("Duplicate accessory: %s" % item)
-				seen[item] = true
-
-	return validation_errors.is_empty()
-
-
-## Convenience alias for validate().
-func is_valid() -> bool:
-	return validate()
-
-
-# ---------------------------------------------------------------------------
-# Accessors
-# ---------------------------------------------------------------------------
-
-## Check if a specific slot is equipped with a non-null item.
-func is_equipped(slot_id: String) -> bool:
-	if not AvatarSlotRegistry.has_slot(slot_id):
-		return false
-
-	var value = slots.get(slot_id)
-	if value == null:
-		return false
-
-	if typeof(value) == TYPE_STRING:
-		return not (value as String).is_empty()
-	elif typeof(value) == TYPE_ARRAY:
-		return (value as Array).size() > 0
-
-	return false
-
-
-## Get the equipped asset ID for an exclusive slot.
-## Returns empty string if not equipped or slot is not exclusive.
-func get_equipment(slot_id: String) -> String:
-	var value = slots.get(slot_id)
-	if value is String:
-		return value
-	return ""
-
-
-## Set equipment for an exclusive slot.
-func set_equipment(slot_id: String, asset_id: String) -> void:
-	if not AvatarSlotRegistry.has_slot(slot_id):
-		push_error("Unknown slot: %s" % slot_id)
-		return
-
-	var slot_def = AvatarSlotRegistry.get_slot(slot_id)
-	if slot_def and not slot_def.exclusive:
-		push_error("Slot '%s' is not exclusive" % slot_id)
-		return
-
-	slots[slot_id] = null if asset_id.is_empty() else asset_id
-
-
-## Add an accessory to the accessory slot.
-func add_accessory(asset_id: String) -> bool:
-	var accessories := slots.get("accessory", []) as Array
-	if accessories.size() >= MAX_ACCESSORIES:
-		return false
-	if asset_id.is_empty():
-		return false
-	if accessories.has(asset_id):
-		return false
-	accessories.append(asset_id)
-	slots["accessory"] = accessories
-	return true
-
-
-## Remove an accessory from the accessory slot.
-func remove_accessory(asset_id: String) -> bool:
-	var accessories := slots.get("accessory", []) as Array
-	if accessories.has(asset_id):
-		accessories.erase(asset_id)
-		slots["accessory"] = accessories
-		return true
-	return false
-
-
-## Iterate over equipped items as SlotItem objects.
-## Returns an array of SlotItem for each equipped slot.
-func get_equipped_items() -> Array[SlotItem]:
-	var items: Array[SlotItem] = []
-
-	for slot_id in AvatarSlotRegistry.SLOT_IDS:
-		var value = slots.get(slot_id)
-		if value == null:
-			continue
-
-		if typeof(value) == TYPE_STRING:
-			var asset_id := value as String
-			if not asset_id.is_empty():
-				items.append(SlotItem.new(slot_id, asset_id))
-		elif typeof(value) == TYPE_ARRAY:
-			for item_id in value:
-				if item_id is String and not (item_id as String).is_empty():
-					items.append(SlotItem.new(slot_id, item_id))
-
-	return items
-
-
-# ---------------------------------------------------------------------------
-# Hashing
-# ---------------------------------------------------------------------------
-
-## Compute a hash of this loadout for change detection.
-## Mirrors the server's loadout_hash concept.
-func compute_hash() -> int:
-	var hasher := HashingContext.new()
-	hasher.start(HashingContext.HASH_SHA256)
-	hasher.update(base_body.to_utf8_buffer())
-	for slot_id in AvatarSlotRegistry.SLOT_IDS:
-		hasher.update(slot_id.to_utf8_buffer())
-		var value = slots.get(slot_id)
-		if value is String:
-			hasher.update((value as String).to_utf8_buffer())
-		elif value is Array:
-			var arr_str = JSON.stringify(value)
-			hasher.update(arr_str.to_utf8_buffer())
-		else:
-			hasher.update("null".to_utf8_buffer())
-	var digest = hasher.finish()
-	# Return first 4 bytes as int for compact storage.
-	return digest[0] | (digest[1] << 8) | (digest[2] << 16) | (digest[3] << 24)
@@ -1 +0,0 @@
-uid://dxdtebl4upeny
@@ -1,275 +0,0 @@
-## AvatarSlotRegistry - Static registry of slot definitions.
-##
-## Each slot maps to one or more bones and defines what can be equipped there.
-## This is the single source of truth for slot IDs, categories, mount bones,
-## exclusivity, and body-part vs attachment classification.
-##
-## See docs/architecture/avatar.md §3.2 for the full slot specification.
-class_name AvatarSlotRegistry extends RefCounted
-
-
-# ---------------------------------------------------------------------------
-# Slot definitions (mirrors §3.2 of the avatar spec)
-# ---------------------------------------------------------------------------
-
-## All known slot IDs, in canonical order.
-const SLOT_IDS: PackedStringArray = [
-	"head",
-	"hair",
-	"face",
-	"torso",
-	"chest",
-	"back",
-	"left_arm",
-	"right_arm",
-	"left_hand",
-	"right_hand",
-	"legs",
-	"pants",
-	"left_foot",
-	"right_foot",
-	"accessory",
-]
-
-## Body-part slots (exclusive, replace base mesh).
-const BODY_PART_SLOTS: PackedStringArray = [
-	"head", "torso", "legs", "left_arm", "right_arm",
-]
-
-## Attachment slots (layered on top of base mesh).
-const ATTACHMENT_SLOTS: PackedStringArray = [
-	"hair", "face", "chest", "back",
-	"left_hand", "right_hand", "pants",
-	"left_foot", "right_foot", "accessory",
-]
-
-## Slots that are multi-slot (multiple accessories can coexist).
-const MULTI_SLOT_IDS: PackedStringArray = ["accessory"]
-
-
-## Metadata for a single slot.
-class SlotDefinition:
-	## The slot ID string (e.g. "head", "hair").
-	var slot_key: String
-	## "body_part" or "attachment".
-	var category: String
-	## Primary mount bone name(s).
-	var mount_bones: PackedStringArray
-	## Whether at most one item can occupy this slot.
-	var exclusive: bool
-	## Whether this slot replaces a base mesh.
-	var is_body_part: bool
-
-	func _init(p_slot_key: String, p_category: String, p_mount_bones: PackedStringArray,
-			p_exclusive: bool, p_is_body_part: bool) -> void:
-		slot_key = p_slot_key
-		category = p_category
-		mount_bones = p_mount_bones
-		exclusive = p_exclusive
-		is_body_part = p_is_body_part
-
-
-# Slot metadata lookup tables (indexed by SLOT_IDS position). Static: every
-# caller uses AvatarSlotRegistry.method(...) directly on the class, never on
-# an instance, so this data has to be built once at class-load time via
-# _static_init() rather than an instance _init() that's never invoked.
-# Each entry: { category, mount_bones, exclusive, is_body_part }
-static var _slot_data: Dictionary = {}
-static var _slot_definitions: Array[SlotDefinition] = []
-
-
-static func _static_init() -> void:
-	_build_registry()
-
-
-static func _build_registry() -> void:
-	_slot_data = {
-		"head": {
-			"category": "body_part",
-			"mount_bones": ["Head"],
-			"exclusive": true,
-			"is_body_part": true,
-		},
-		"hair": {
-			"category": "attachment",
-			"mount_bones": ["HeadTop"],
-			"exclusive": true,
-			"is_body_part": false,
-		},
-		"face": {
-			"category": "attachment",
-			"mount_bones": ["Jaw"],
-			"exclusive": true,
-			"is_body_part": false,
-		},
-		"torso": {
-			"category": "body_part",
-			"mount_bones": ["Chest"],
-			"exclusive": true,
-			"is_body_part": true,
-		},
-		"chest": {
-			"category": "attachment",
-			"mount_bones": ["Chest"],
-			"exclusive": true,
-			"is_body_part": false,
-		},
-		"back": {
-			"category": "attachment",
-			"mount_bones": ["Chest"],
-			"exclusive": true,
-			"is_body_part": false,
-		},
-		"left_arm": {
-			"category": "body_part",
-			"mount_bones": ["LeftUpperArm"],
-			"exclusive": true,
-			"is_body_part": true,
-		},
-		"right_arm": {
-			"category": "body_part",
-			"mount_bones": ["RightUpperArm"],
-			"exclusive": true,
-			"is_body_part": true,
-		},
-		"left_hand": {
-			"category": "attachment",
-			"mount_bones": ["LeftHand"],
-			"exclusive": true,
-			"is_body_part": false,
-		},
-		"right_hand": {
-			"category": "attachment",
-			"mount_bones": ["RightHand"],
-			"exclusive": true,
-			"is_body_part": false,
-		},
-		"legs": {
-			"category": "body_part",
-			"mount_bones": ["Hips"],
-			"exclusive": true,
-			"is_body_part": true,
-		},
-		"pants": {
-			"category": "attachment",
-			"mount_bones": ["Hips"],
-			"exclusive": true,
-			"is_body_part": false,
-		},
-		"left_foot": {
-			"category": "attachment",
-			"mount_bones": ["LeftFoot"],
-			"exclusive": true,
-			"is_body_part": false,
-		},
-		"right_foot": {
-			"category": "attachment",
-			"mount_bones": ["RightFoot"],
-			"exclusive": true,
-			"is_body_part": false,
-		},
-		"accessory": {
-			"category": "attachment",
-			"mount_bones": ["Root"],
-			"exclusive": false,
-			"is_body_part": false,
-		},
-	}
-
-	# Build SlotDefinition objects.
-	for slot_id in SLOT_IDS:
-		var data = _slot_data[slot_id]
-		var def := SlotDefinition.new(
-			slot_id,
-			data["category"],
-			PackedStringArray(data["mount_bones"]),
-			data["exclusive"],
-			data["is_body_part"],
-		)
-		_slot_definitions.append(def)
-
-
-# ---------------------------------------------------------------------------
-# Public API
-# ---------------------------------------------------------------------------
-
-## Returns the list of all known slot IDs.
-static func get_slot_ids() -> PackedStringArray:
-	return SLOT_IDS
-
-
-## Returns true if *slot_id* is a known slot.
-static func has_slot(slot_id: String) -> bool:
-	return slot_id in SLOT_IDS
-
-
-## Returns the SlotDefinition for a slot, or null if unknown.
-static func get_slot(slot_id: String) -> SlotDefinition:
-	if not has_slot(slot_id):
-		return null
-	for def in _slot_definitions:
-		if def.slot_key == slot_id:
-			return def
-	return null
-
-
-## Returns all SlotDefinition objects in canonical order.
-static func get_slot_definitions() -> Array[SlotDefinition]:
-	return _slot_definitions
-
-
-## Returns the category for a slot ("body_part" or "attachment").
-static func get_category(slot_id: String) -> String:
-	if not has_slot(slot_id):
-		push_error("AvatarSlotRegistry: unknown slot '%s'" % slot_id)
-		return ""
-	return _slot_data[slot_id]["category"]
-
-
-## Returns the primary mount bone(s) for a slot.
-static func get_mount_bones(slot_id: String) -> PackedStringArray:
-	if not has_slot(slot_id):
-		push_error("AvatarSlotRegistry: unknown slot '%s'" % slot_id)
-		return PackedStringArray()
-	return PackedStringArray(_slot_data[slot_id]["mount_bones"])
-
-
-## Returns whether the slot is exclusive (at most one item).
-static func is_exclusive(slot_id: String) -> bool:
-	if not has_slot(slot_id):
-		push_error("AvatarSlotRegistry: unknown slot '%s'" % slot_id)
-		return true
-	return _slot_data[slot_id]["exclusive"]
-
-
-## Returns whether the slot is a body-part slot (replaces base mesh).
-static func is_body_part_slot(slot_id: String) -> bool:
-	if not has_slot(slot_id):
-		push_error("AvatarSlotRegistry: unknown slot '%s'" % slot_id)
-		return false
-	return _slot_data[slot_id]["is_body_part"]
-
-
-## Returns whether the slot is a multi-slot (e.g. accessory).
-static func is_multi_slot(slot_id: String) -> bool:
-	return slot_id in MULTI_SLOT_IDS
-
-
-## Returns the list of body-part slot IDs.
-static func get_body_part_slots() -> PackedStringArray:
-	return BODY_PART_SLOTS
-
-
-## Returns the list of attachment slot IDs.
-static func get_attachment_slots() -> PackedStringArray:
-	return ATTACHMENT_SLOTS
-
-
-## Validates that an asset's declared slot matches the slot it is placed in.
-static func validate_slot_assignment(asset_slot: String, slot_id: String) -> bool:
-	return asset_slot == slot_id
-
-
-## Returns the canonical order index for a slot (for serialization order).
-static func get_slot_index(slot_id: String) -> int:
-	return SLOT_IDS.find(slot_id)
@@ -1 +0,0 @@
-uid://do873d38pqhwa
@@ -1,324 +0,0 @@
-## AvatarSystem - Global avatar orchestrator (autoload singleton).
-##
-## Owns the AvatarCatalog, AvatarLoader, and the current player's AvatarLoadout.
-## Provides a single entry point for the rest of the game to:
-##   - Load the asset catalog.
-##   - Load a player's avatar from a loadout.
-##   - Equip / unequip items and persist the resulting loadout.
-##
-## Registered as an autoload singleton named "AvatarSystem" in project.godot.
-
-extends Node
-
-# Sibling avatar scripts are referenced via preload rather than by their global
-# class_name so this autoload parses correctly from a bare clone -- a headless
-# `godot <scene>` run does not rebuild the global class registry (only an editor
-# scan / `--import` does), and this script is parsed at startup before any such
-# scan could have happened. See docs/architecture/avatar.md.
-const AvatarCatalog := preload("res://scripts/avatar/avatar_catalog.gd")
-const AvatarLoader := preload("res://scripts/avatar/avatar_loader.gd")
-const AvatarLoadout := preload("res://scripts/avatar/avatar_loadout.gd")
-const AvatarSlotRegistry := preload("res://scripts/avatar/avatar_slot_registry.gd")
-
-
-# ---------------------------------------------------------------------------
-# Signals
-# ---------------------------------------------------------------------------
-
-## Emitted when the catalog has finished loading.
-signal catalog_loaded
-
-## Emitted when the catalog fails to load.
-signal catalog_load_failed(error_message: String)
-
-## Emitted when the avatar has been fully assembled and is ready to render.
-signal avatar_ready(avatar_node: Node3D)
-
-## Emitted when the loadout changes (after equip/unequip).
-signal loadout_changed(loadout: AvatarLoadout)
-
-
-# ---------------------------------------------------------------------------
-# State
-# ---------------------------------------------------------------------------
-
-## The asset catalog (id -> metadata + path).
-var catalog: AvatarCatalog = null
-
-## The loader used to import GLB assets and assemble the avatar.
-var loader: AvatarLoader = null
-
-## The current player's loadout.
-var current_loadout: AvatarLoadout = null
-
-## The assembled avatar node (null until avatar_ready).
-var avatar_node: Node3D = null
-
-## Whether the catalog has been loaded.
-var is_catalog_loaded: bool = false
-
-## Whether an avatar is currently assembled.
-var is_avatar_ready: bool = false
-
-## Default catalog path.
-const DEFAULT_CATALOG_PATH := "res://assets/avatars/catalog.json"
-
-
-# ---------------------------------------------------------------------------
-# Lifecycle
-# ---------------------------------------------------------------------------
-
-func _ready() -> void:
-	catalog = AvatarCatalog.new()
-	loader = AvatarLoader.new()
-	loader.init_loader(catalog)
-	add_child(loader)
-
-
-## Load the asset catalog. Call this once at startup (or on demand).
-func load_catalog(path: String = DEFAULT_CATALOG_PATH) -> Error:
-	var err := catalog.load_catalog(path)
-	if err == OK:
-		is_catalog_loaded = true
-		catalog_loaded.emit()
-	else:
-		catalog_load_failed.emit("Failed to load catalog: %s" % err)
-	return err
-
-
-# ---------------------------------------------------------------------------
-# Avatar assembly
-# ---------------------------------------------------------------------------
-
-## Load and assemble an avatar from a loadout.
-## Returns the assembled avatar Node3D on success, or null on failure.
-func load_avatar(loadout: AvatarLoadout) -> Node3D:
-	if not is_catalog_loaded:
-		push_error("AvatarSystem: catalog not loaded; call load_catalog() first")
-		return null
-
-	if loadout == null:
-		push_error("AvatarSystem: loadout is null")
-		return null
-
-	# Validate the loadout against the catalog.
-	var validation := catalog.validate_loadout(loadout)
-	if not validation.valid:
-		push_error("AvatarSystem: invalid loadout: %s" % str(validation.errors))
-		return null
-
-	current_loadout = loadout
-
-	# Reset any previous avatar.
-	loader.reset()
-
-	# Load the base body.
-	var base_body_id := loadout.base_body
-	var base_node := loader.load_base_body(base_body_id)
-	if base_node == null:
-		push_error("AvatarSystem: failed to load base body '%s'" % base_body_id)
-		return null
-
-	# Load each equipped attachment.
-	for slot_id in AvatarSlotRegistry.SLOT_IDS:
-		var slot_value = loadout.slots.get(slot_id)
-
-		if slot_id == "accessory":
-			# Accessory is an array of asset ids.
-			if slot_value is Array:
-				for asset_id in slot_value:
-					if asset_id is String and not (asset_id as String).is_empty():
-						loader.load_attachment(slot_id, asset_id)
-		else:
-			# Exclusive slot: single asset id or null.
-			if slot_value is String and not (slot_value as String).is_empty():
-				loader.load_attachment(slot_id, slot_value)
-
-	# Hide base meshes for equipped body-part slots.
-	for slot_id in AvatarSlotRegistry.BODY_PART_SLOTS:
-		var slot_value = loadout.slots.get(slot_id)
-		if slot_value is String and not (slot_value as String).is_empty():
-			loader.set_base_mesh_visible(slot_id, false)
-
-	avatar_node = loader.avatar_node
-	is_avatar_ready = avatar_node != null
-	if is_avatar_ready:
-		avatar_ready.emit(avatar_node)
-
-	return avatar_node
-
-
-## Equip an item into a slot and rebuild the avatar.
-## Returns true on success.
-func equip(slot_id: String, asset_id: String) -> bool:
-	if current_loadout == null:
-		push_error("AvatarSystem: no loadout loaded")
-		return false
-
-	if not AvatarSlotRegistry.has_slot(slot_id):
-		push_error("AvatarSystem: unknown slot '%s'" % slot_id)
-		return false
-
-	if not catalog.has_asset(asset_id):
-		push_error("AvatarSystem: unknown asset '%s'" % asset_id)
-		return false
-
-	var asset := catalog.resolve(asset_id)
-	if asset.get("slot") != slot_id:
-		push_error("AvatarSystem: asset '%s' is for slot '%s', not '%s'" % [
-			asset_id, asset.get("slot"), slot_id])
-		return false
-
-	if slot_id == "accessory":
-		if not current_loadout.add_accessory(asset_id):
-			push_error("AvatarSystem: could not add accessory '%s'" % asset_id)
-			return false
-	else:
-		current_loadout.set_equipment(slot_id, asset_id)
-
-	loadout_changed.emit(current_loadout)
-	return true
-
-
-## Unequip an item from a slot and rebuild the avatar.
-## Returns true on success.
-func unequip(slot_id: String, asset_id: String = "") -> bool:
-	if current_loadout == null:
-		push_error("AvatarSystem: no loadout loaded")
-		return false
-
-	if not AvatarSlotRegistry.has_slot(slot_id):
-		push_error("AvatarSystem: unknown slot '%s'" % slot_id)
-		return false
-
-	if slot_id == "accessory":
-		if asset_id.is_empty():
-			push_error("AvatarSystem: accessory unequip requires an asset id")
-			return false
-		if not current_loadout.remove_accessory(asset_id):
-			push_error("AvatarSystem: accessory '%s' not equipped" % asset_id)
-			return false
-	else:
-		current_loadout.set_equipment(slot_id, "")
-
-	loadout_changed.emit(current_loadout)
-	return true
-
-
-## Serialize the current loadout to JSON.
-func save_loadout() -> String:
-	if current_loadout == null:
-		return ""
-	return current_loadout.to_json()
-
-
-## Load a loadout from a JSON string.
-func load_loadout_from_json(json_string: String) -> AvatarLoadout:
-	var loadout := AvatarLoadout.from_json(json_string)
-	if not loadout.validate():
-		push_error("AvatarSystem: invalid loadout JSON: %s" % str(loadout.validation_errors))
-		return null
-	return loadout
-
-
-## Get the list of available assets for a given slot.
-func get_assets_for_slot(slot_id: String) -> Array[String]:
-	return catalog.get_assets_by_slot(slot_id)
-
-
-## Get the display name for an asset id.
-func get_asset_display_name(asset_id: String) -> String:
-	var asset := catalog.resolve(asset_id)
-	return asset.get("display_name", asset_id)
-
-
-# ---------------------------------------------------------------------------
-# Local-player convenience API
-#
-# The rest of the game (the main menu, the in-world player) only needs three
-# things: load the catalog once, hand us the player's loadout (as the dict the
-# backend returns), and ask for an assembled avatar node to drop into a scene.
-# ---------------------------------------------------------------------------
-
-## True once a loadout has been handed to us (from the backend or a default).
-func has_loadout() -> bool:
-	return current_loadout != null
-
-
-## Ensure the catalog is loaded (idempotent). Safe to await repeatedly.
-func ensure_catalog() -> bool:
-	if is_catalog_loaded:
-		return true
-	return load_catalog() == OK
-
-
-## Set the current player's loadout from the dict shape the backend's
-## GET /api/avatar/loadout returns (i.e. AvatarLoadout.to_json() parsed).
-## Returns true if it validated and was stored.
-func set_loadout_from_dict(loadout_dict: Dictionary) -> bool:
-	var lo := AvatarLoadout.from_json(JSON.stringify(loadout_dict))
-	if not lo.validate():
-		push_warning("AvatarSystem: rejecting invalid loadout dict: %s"
-			% str(lo.validation_errors))
-		return false
-	current_loadout = lo
-	loadout_changed.emit(current_loadout)
-	return true
-
-
-## Assemble a fresh avatar Node3D from the current loadout, ready to parent
-## into a scene (e.g. onto the in-world player). Returns null if there's no
-## loadout or the catalog isn't loaded or assembly failed.
-func build_current_avatar() -> Node3D:
-	# Self-sufficient: load the catalog if needed, and fall back to a bare
-	# default loadout when login didn't prime one -- the player should always
-	# get *an* avatar, never a placeholder capsule, as long as the assets exist.
-	if not ensure_catalog():
-		push_warning("AvatarSystem: catalog unavailable; cannot build avatar")
-		return null
-	if current_loadout == null:
-		var bases := get_assets_for_slot("base_body")
-		if bases.is_empty():
-			return null
-		set_loadout_from_dict({"base_body": bases[0], "slots": {}})
-	return assemble_avatar(current_loadout)
-
-
-## Assemble a standalone avatar node from [param loadout] using a throwaway
-## loader -- unlike load_avatar(), this touches no shared state, so it's safe
-## to call many times (local player + one per remote peer). Returns null only
-## if the assets are genuinely missing.
-func assemble_avatar(loadout) -> Node3D:
-	if loadout == null or not is_catalog_loaded:
-		return null
-	var validation := catalog.validate_loadout(loadout)
-	if not validation.valid:
-		push_warning("AvatarSystem: invalid loadout, skipping: %s" % str(validation.errors))
-		return null
-
-	var l = AvatarLoader.new()
-	l.init_loader(catalog)
-	var base := l.load_base_body(loadout.base_body)
-	if base == null:
-		l.free()
-		return null
-
-	for slot_id in AvatarSlotRegistry.SLOT_IDS:
-		var v = loadout.slots.get(slot_id)
-		if slot_id == "accessory":
-			if v is Array:
-				for aid in v:
-					if aid is String and not (aid as String).is_empty():
-						l.load_attachment(slot_id, aid)
-		elif v is String and not (v as String).is_empty():
-			l.load_attachment(slot_id, v)
-
-	for slot_id in AvatarSlotRegistry.BODY_PART_SLOTS:
-		var v = loadout.slots.get(slot_id)
-		if v is String and not (v as String).is_empty():
-			l.set_base_mesh_visible(slot_id, false)
-
-	l.apply_skin_tone(loadout.skin_tone)
-
-	l.free()
-	return base
@@ -1 +0,0 @@
-uid://cfbvgfisbxbk
@@ -1,117 +0,0 @@
-## AvatarVisualizer
-##
-## Renders an AvatarLoadout into a 3D node tree for previews (the customization
-## screen). A thin wrapper over AvatarLoader -- it owns its own loader instance
-## and catalog reference so building a preview never disturbs AvatarSystem's
-## live in-world avatar state.
-##
-## Usage:
-##   var viz := AvatarVisualizer.new()
-##   viz.load_loadout(loadout, preview_root_node3d)   # preview_root gets the avatar as a child
-##   ...
-##   viz.clear()
-
-class_name AvatarVisualizer
-extends Object
-
-# Preloaded rather than referenced by global class_name -- see avatar_loadout.gd.
-const AvatarLoadout := preload("res://scripts/avatar/avatar_loadout.gd")
-const AvatarLoader := preload("res://scripts/avatar/avatar_loader.gd")
-const AvatarCatalog := preload("res://scripts/avatar/avatar_catalog.gd")
-const AvatarSlotRegistry := preload("res://scripts/avatar/avatar_slot_registry.gd")
-
-## Emitted when the visualizer has finished building the render tree.
-signal build_complete
-## Emitted when the visualizer has been cleared.
-signal cleared
-
-## The node the assembled avatar is parented under.
-var root: Node3D = null
-
-## The assembled avatar node (child of `root`).
-var avatar_node: Node3D = null
-
-## The loadout currently rendered.
-var current_loadout: AvatarLoadout = null
-
-var _loader = null
-var _catalog = null
-
-
-## Build the avatar for [param loadout] and parent it under [param root_node]
-## (or the previously-set `root`). Replaces any previously-built avatar.
-func load_loadout(loadout, root_node: Node3D = null) -> void:
-	if root_node != null:
-		root = root_node
-	if root == null or loadout == null:
-		return
-
-	clear()
-	current_loadout = loadout
-
-	if _catalog == null:
-		var sys = root.get_node_or_null("/root/AvatarSystem")
-		if sys != null:
-			_catalog = sys.catalog
-		if _catalog == null:
-			_catalog = AvatarCatalog.new()
-			_catalog.load_catalog("res://assets/avatars/catalog.json")
-
-	_loader = AvatarLoader.new()
-	root.add_child(_loader)
-	_loader.init_loader(_catalog)
-
-	var base: Node3D = _loader.load_base_body(loadout.base_body)
-	if base == null:
-		return
-	root.add_child(base)
-	avatar_node = base
-
-	for slot_id in AvatarSlotRegistry.SLOT_IDS:
-		var value = loadout.slots.get(slot_id)
-		if slot_id == "accessory":
-			if value is Array:
-				for aid in value:
-					if aid is String and not (aid as String).is_empty():
-						_loader.load_attachment(slot_id, aid)
-		elif value is String and not (value as String).is_empty():
-			_loader.load_attachment(slot_id, value)
-
-	for slot_id in AvatarSlotRegistry.BODY_PART_SLOTS:
-		var value = loadout.slots.get(slot_id)
-		if value is String and not (value as String).is_empty():
-			_loader.set_base_mesh_visible(slot_id, false)
-
-	_loader.apply_skin_tone(loadout.skin_tone)
-
-	build_complete.emit()
-
-
-## Tear down the current preview avatar.
-func clear() -> void:
-	if avatar_node != null and is_instance_valid(avatar_node):
-		avatar_node.queue_free()
-	avatar_node = null
-	if _loader != null and is_instance_valid(_loader):
-		_loader.queue_free()
-	_loader = null
-	current_loadout = null
-	cleared.emit()
-
-
-func get_root() -> Node3D:
-	return root
-
-
-func get_all_mesh_instances() -> Array[MeshInstance3D]:
-	var out: Array[MeshInstance3D] = []
-	if avatar_node:
-		_collect_meshes(avatar_node, out)
-	return out
-
-
-func _collect_meshes(node: Node, out: Array[MeshInstance3D]) -> void:
-	if node is MeshInstance3D:
-		out.append(node)
-	for child in node.get_children():
-		_collect_meshes(child, out)
@@ -1 +0,0 @@
-uid://cvr5mmbv2worn
--- a/Show More
+++ b/Show More