[AlexGeslani]

Summary

• disable and clear stale lobby controls whenever the socket or room closes
• delete authoritative rooms when a participant disconnects and reset remaining sessions explicitly
• hard-cap rooms and concurrent WebSocket upgrades with fail-closed environment validation
• constrain the production container to 256 MiB and 128 PIDs (host-local Compose config)

Verification

• npm test — 249/249 passing
• docker compose config -q — valid
• focused lifecycle/security tests — 43/43 passing

Review resolution

• resolves the independent Ready-state and unbounded-allocation blockers
• public-host Caddy concern is addressed by the deployed Cloudflare httpHostHeader: stacklogic.game.lan ingress and has already passed a real public WSS handshake plus hostile-Origin rejection