Floating objects and Driftwood cove

Create Driftwood cove from the editor's new-world templates, Save, then Apply and open the shared playtest. Walk along the jetty until the plank's Gently push prompt appears and press Interact (E by default). New coves also have a wider floating deck close enough to board from the jetty. Open the playtest in another browser session to watch the same motion together. New coves also include shore timber on the grass behind and to the right of arrival; walk into its side to move it without pressing Interact. Publish creates a separate shareable room using the accepted source.

For your own scene, enable Atmosphere → Water → Let objects float in this water. Select an independent box and open Floating physics…. Choose its density, grip and bounce, preview, Save and Apply. Lower density floats higher; density above the water's density sinks. Water depth describes the physical volume; it does not excavate a pond bed. These controls support saved Undo/Redo.

Run the editor with npm run dev:editor and use its printed private URL. The packaged authoring CLI also supports template driftwood <name> <document.json>. The focused browser command is npm run test:browser:buoyancy.

#Motion and recovery

World format 27 carries versioned water and rigid-body settings. Real native boxes receive distributed buoyancy, drag and bounded pushes, collide with the authored scene and update canonical presentation. Cosmetic water waves do not change the physical water plane. Density and finish revisions preserve motion; authored position changes reposition the body. Overlapping collision revisions reject before acceptance.

The cooperative relay owns floating motion independently of the elected browser host. It validates push reach and obstruction, persists native checkpoints before acknowledging or broadcasting changes, and returns the existing receipt for a retried interaction. Clients interpolate admitted frames and hold the last state when updates stop. Reconnect, browser-host departure and relay restart preserve accepted motion. Native checkpoints restore exact continued motion; portable format-4 local saves retain active and inactive body poses and velocities.

#Acceptance and limits

Integration verification: 973 native tests passed, 68 skipped. The three floating-object browser journeys pass on physical Intel WebGPU and software WebGPU; both neighboring swimming journeys also pass on physical WebGPU. Production client/server/authoring/engine builds pass; a detached CLI creates, checks, exports, reimports and compiles Driftwood with exact source round-trip. The engine bundle is 0de2477a4e63e087b71f2235331ec7ea8d9110c1e82c518aec7fa143514d3e4a.

Reviewed captures: shared cove, main-thread view, weight controls and water controls.

The feature's native tests cover density-dependent floating/sinking, wall collision, exact checkpoint continuation, malformed ownership, portable saves, place return, revisions, authoring restart/Undo/Redo, publication, server restart, host departure, repeated push receipts and escaped-body recovery. Browser journeys cover creator controls, two travelers using main/Worker graphics, saved weight Apply, a deliberately stalled simulation worker, published pushes, host departure and reconnect. Scratch logs and failure captures are retained under .data/buoyancy/ and test-results/.

Initial checks caught missing identities on new decorative reeds and a stale command-count assertion; both were corrected. Screenshot review replaced the pond's sphere crowns with existing botanical meshes and added shoreline grass. Pointer-lock recentering initially spoiled the camera captures; the journey now uses a relative look input for those captures. Retry verification observes the actual repeated server receipt because the client correctly suppresses duplicate completion callbacks. No runtime acceptance check was relaxed.

This delivery supports independent boxes from 0.2 to 4 metres per side, 32 bodies across the world, one bounded water volume per place and eight distributed buoyancy samples per box. Rotated submerged volumes use an approximation. Dynamic route changes require migration. This is the pinned Rapier adapter; it does not complete the owned replacement physics backend.

Cooperative PostgreSQL rooms now support these bodies through the persistent workflow below. Broader dynamic character/body coupling, ownership transfer between hosts, vehicles/ragdolls, broader collision shapes and sustained performance/ capacity qualification remain full-program work. The final character, environment and arrival art pass remains required; the current character models are unapproved. No numbered roadmap milestone is closed by this feature.

#PostgreSQL persistence

Start a fresh Driftwood cove persistent room with DW_ROOM_TEMPLATE=driftwood, or export an authored world from the editor and select it with DW_WORLD_DOCUMENT. The persistent-room runbook includes local and Coolify configuration. Schema 6 needs a dedicated test database when older retained rooms still use an earlier schema.

Floating pushes commit native state, player revision, receipt and outbox together. Physics time has its own checkpoint revision, saved before broadcast. Graceful restart, an abruptly killed host, lost acknowledgement/retry and forced lease loss preserve accepted motion. The next owner restores the committed native clock; there is no offline catch-up. Surviving bodies retain motion through compatible stopped-room upgrades; deleted or transferred bodies reject pending an explicit recovery mapping. A backup snapshot preserves the same floating revision even when the live room advances after the snapshot cut.

Integration verification: 974 native tests passed, 72 skipped; the separate full PostgreSQL suite passes 70 tests, and the final focused floating/backup suite passes all 6. Type/package-boundary checks, production builds and docker compose -f compose.persistent.yaml config --quiet pass. The production engine is 2f8469f0bf65541c0640b8a4746e7f885b5989702fb8bccb54ea1fd0203c1137. The four new database tests are skipped by the database-free native command and run in the PostgreSQL suite. A terminated broad npm test invocation was not counted; the direct full native runner completed successfully. No production service was deployed.

The final physical-browser journey also starts the packaged runtime from an exported document in an empty database, then verifies pinned restarts. Both physical and software WebGPU pass shared recovery. Run npm run test:browser:persistent-floating for this isolated journey; it requires local PostgreSQL tools and Playwright Chromium.

The physical/software browser journey checks two independent travelers using main-thread and Worker graphics, a real timber push, unchanged traveler identities and page lifetimes through restart and lease-loss recovery, plus rendered world geometry. Reviewed restored cove.

The initial software run received HTTP 503 admission pressure before entering; the exact pressure source was not captured. A subsequent run passed after removal of redundant per-tick scene forks, without concurrent PostgreSQL fault tests. This is functional recovery evidence, not proof that the earlier pressure cannot recur or a capacity qualification. The browser fixture now retains admission health on a 503. No admission threshold or startup deadline was relaxed. Scratch logs live under .data/persistent-floating/.

#Trusted character movement

The trusted floating runbook binds a new Driftwood cove or unbound exported editor world to server-owned character movement. Explicitly authored authority and retained-room authority cannot be overridden. Motor snapshots include the admitted body frame. Prediction and replay use that collision frame independently of visual interpolation, preserving all room-owned body poses/velocities. Push reach uses the server's motor rather than a supplied browser pose. Uncommitted physics steps cannot enter motor snapshots.

Final integration: 977 native tests passed, 73 skipped; 71 PostgreSQL tests passed with NODE_OPTIONS=--max-old-space-size=256 for repeated in-process test fixtures. Server RSS limits remain unchanged. Type/boundary checks, production builds and two-traveler main/Worker browser journeys on physical and software WebGPU pass. Both browser profiles add 75 ms transport delay each way, retain identities through restart/lease loss, and pass the no-protocol-disconnect checks. Reviewed trusted cove. The production engine is 3591cca9d0d3322b3123edcc99c40ed6787980bf8085316d9773cefa885c2671. No production deployment or numbered roadmap closure is claimed.

Native movement checks cover malformed/missing frames, monotonic collision time, body-contact replay, preservation of visual interpolation and exact body ownership. The 150 ms RTT moving-timber fixture gives immediate local movement with a worst correction of 0.1154 m, within its 0.15 m budget; this is a bounded fixture, not a universal latency guarantee. Real PostgreSQL sockets check forged pushes, continued movement on the last committed collision frame during a held save, shared motion, retained identities and duplicate receipts after restart.

Software browser testing exposed input-queue overflow during recovery. The client now shares the server's twelve-frame admission window and waits for acknowledgement credits; a stopped acknowledgement stream still reconnects after two seconds. The room prepares its immutable floating source once per lease, while every SQL save still verifies release, owner/epoch, revision and lease expiry. The writer rejects source changes and stale owners. Local timing snapshots changed from about 97 ms to 14 ms mean storage-transaction time after removing repeated source validation; these snapshots are not a controlled capacity benchmark.

The browser fixture requires no initial reconnects and rejects protocol, input budget and slow-client disconnects throughout recovery. It captures transport close reasons even on failure. Scratch logs and timing snapshots are retained in .data/trusted-floating/. Earlier static regression invocations encountered memory admission pressure when repeatedly creating rooms in one test process; the process exceeded the unchanged 512 MiB RSS admission cap. The full suite passes with the bounded test heap noted above; this does not qualify default-heap long-session behavior. Long-session production memory qualification remains open. Failed test-room teardown now closes rooms even if admission fails.

Character sweeps use the room-owned obstacle frame. Floating-platform riding and contact forces are described below. Vehicles, ragdolls and the owned replacement physics backend remain open. Final character/environment/arrival art remains required and unapproved.

#Riding floating decks

Create a new Driftwood cove, Save and Publish (or Apply for a development playtest). Walk to the end of the jetty and continue onto the wide timber deck. Open the invitation in two browser profiles; stand on opposite sides and press E to push. Both travelers ride the shared movement. Space jumps off; walking over the edge releases support. Existing invitations retain their published geometry; create a new cove to get the wider example deck.

Translation, yaw and gentle roll/pitch carry the character's contact point while the character stays upright and the camera heading remains under player control. Carry sweeps check intervening collision. Jumping, walking off, a steep surface or an obstructed path releases support. A held room frame cannot carry a traveler again. The later contact-force increment below adds walking impulses and rider weight while preserving this support and recovery contract.

The contact is part of motor snapshots and canonical motor support. Native character checkpoint format 5 retains its body identity, local contact point and last admitted body pose; legacy format 4 is still readable. Portable saves and durable traveler poses retain the same contact. Admission and reconnect rebase a saved contact onto the current deck, including a tested five-metre offline drift, and reject an occupied recovery location. Physics motion is still committed before broadcast; prediction/replay cannot modify room-owned bodies.

The native suite verifies translation, rotation, bobbing reversals, jump/step-off, wall obstruction, held-frame behavior, exact native continuation, mixed authored platform/floating saves, malformed contacts and collision-safe recovery. Two independent trusted motors ride a pushed plank with 150 ms round-trip delay: maximum observed correction is 0.1171 m, within the fixture's 0.15 m budget, after approximately 0.94 m of shared travel. This is a bounded functional fixture, not a general latency guarantee.

An initial restart test exposed transient loss of grounding during the first buoyancy reversal. Direct contact with the current admitted body now determines floating support, with a small positive controller clearance. The regression covers all three motor/room-clock phases. The software browser journey initially assumed a negative-Z push; a traveler standing on the other side correctly pushed the deck the other way. The journey now requires the same 15 cm horizontal movement in the actual push direction. No movement or recovery deadline was relaxed. A subsequent fresh trusted-room admission exceeded the unchanged 512 MiB RSS limit with Node's default heap before the second traveler entered. The supervised production launcher now limits V8 old-generation memory to 256 MiB; a real child-process check verifies that policy. The subsequent hardware admission capture contains two travelers at approximately 307 MiB RSS, with admission accepting. This is one functional observation, not a capacity or long-session memory qualification. Scratch evidence, including the failed admission health report, is under .data/floating-riders/.

Final integration passed 987 native tests with 74 skips and 72 real PostgreSQL tests with a 256 MiB test heap. After the mixed-platform save and runtime-launcher fixes, focused verification passed 18 rider/save/prediction checks, 10 watchdog checks and 15 PostgreSQL room checks. On each of physical and software WebGPU, all four editor/relay journeys and both cooperative/trusted persistent-room journeys passed, including main/Worker graphics, shared pushes, reload, graceful restart and forced lease loss. The scene was visually reviewed; the restored shared deck records footing and nearby traveler placement, not final character-art approval. Type/package boundaries and production player/relay/authoring/engine/persistent builds pass; the engine artifact is 3189cc95dd9c81b55ea870ff6fac965ba3da5df148a7a5e63ecfecf8fb71d631. No container deployment or sustained capacity qualification is claimed.

Independent box and body-count limits remain unchanged. The owned replacement physics backend, joints/vehicles, cross-host island handoff, sustained memory/frame-time qualification and the required final character/environment/arrival art pass remain full-program work. No numbered roadmap milestone is closed by riding alone.

#Walking contact and rider weight

In a new Driftwood cove, walk backward from arrival onto the grass, then right toward shore timber. Walk into the middle of its side. A second traveler sees the same movement; Save/Publish keeps the authored density and grip, and room restart keeps the moved body. Existing invitations retain their original geometry. In Floating physics…, density changes the effort needed to move a body; grip changes sliding contact. Standing on a floating deck adds the traveler's weight. The existing three water props, including the wider rideable deck, remain available.

The room queries each capsule against the current body shape and intervening collision, gathers contacts from the same body frame, then applies them in stable actor/body order. Each capsule uses an 80 kg contact mass, an 800 N grounded closing-force cap (200 N without ground support) and bounded tangential friction. Standing loads act vertically at the contact point and share load across simultaneous supports. Contact-driven linear and angular speeds are capped at 12 m/s and 12 rad/s, including eight travelers on a minimum-size box. Capsules remain kinematic; joints, character/character contacts, ragdolls and an owned general physics solver remain separate full-program work.

Trusted rooms derive velocity from validated motor inputs and reject client pose packets. Cooperative rooms use admitted live poses; a sample older than 500 ms cannot continue applying force. Both profiles solve body contact on the server. Client prediction holds the committed body frame, so replay cannot apply a second impulse. Native and PostgreSQL checkpoints preserve the resulting body state; restart does not resume old drive input. Development Apply retains the same source and persistence behavior as existing density/grip editing.

Focused checks cover shape proximity, intervening static and moving barriers, separating movement, mass, grip, simultaneous actors, bad/duplicate input, tiny-body speed budgets, loaded rider continuation and shared trusted motion. Two server-controlled travelers move a 168 kg test body approximately 1.21 m in four seconds; checkpoint restoration continues identically with the same input. A real PostgreSQL/socket check verifies forged-pose rejection, subsequent legitimate walking, committed movement and restart. Initial testing caught sideways loading on tilted decks; weight now acts vertically without braking carried travel. The first browser approach glanced past the timber's corner; the final keyboard journey centers and settles before walking into it, retaining its 0.5 m movement requirement and ten-second deadline. The initial trusted socket fixture attempted to continue after a correctly rejected forged-pose connection; it now verifies the 1008 rejection and reconnects before sending legitimate input.

Broad integration passed 992 native tests with 75 skips and 73 PostgreSQL tests with a 256 MiB test heap. Final force, barrier and local-contact refinements pass 19 focused native checks; the force correction also passes all three trusted PostgreSQL contact/recovery checks. Type/package boundaries and production builds pass. On each of hardware and software WebGPU, five editor/relay journeys and two persistent journeys per authority profile pass: 18 browser journeys cover shared authoring, saved Undo/Redo, simulation-worker recovery, main/Worker rendering, keyboard contact, loaded riders, reload, graceful restart and forced lease loss. Hardware and software views were inspected; the reviewed shore-timber playtest records functional presentation, not final art approval. The production engine artifact is 634c00d5dcf65828ce31b05e76abcc6e5e99b090234f6d456c51058c82c4ef8f. Scratch logs and failure captures are under .data/character-contact/. The required final art pass, full device/frame-time/memory qualification and milestones 0–18 remain open.

#Steering a cedar raft

Choose New world → Cedar crossing in the editor, then Save and Apply for a shared development room, or Publish for an invitation. Walk straight from arrival onto the cedar deck and press E to take the helm. W/S drive forward/reverse and A/D steer; the brass arrow marks the bow. Release the keys to coast. Press E to leave the helm and walk again, or Space to jump off. A friend can board and ride along; only one traveler controls each raft. Rebound keyboard controls, controller and touch input use the same movement axes.

Select the raft and open Floating physics… to tune speed, acceleration and turning. Save/Undo/Redo preserves the settings. Applying settings while travelers are aboard preserves the deck's motion, their footing and the pilot. Moving or resizing occupied geometry still uses the existing collision/revision checks. The original cedar model has beveled planks, fine grain, rope lashings, nails and a brass bow marker; its one box collider covers the deck and flotation logs. Imported raft models must be static and fit the normalized unit collision box. Reviewed shared cedar deck and helm controls. This is a functional presentation review; final character and environment art remain unapproved.

For a fresh PostgreSQL room, set DW_ROOM_TEMPLATE=raft in the existing persistent Docker/Coolify setup. compose.persistent.yaml already forwards this variable. Both cooperative and trusted authority profiles use the template. An existing room retains its pinned release; changing the environment variable does not replace its saved world. To author an independent document:

npm run author -- template raft "Cedar crossing" cedar.json
npm run author -- check cedar.json
npm run author -- export cedar.json cedar-world.json

World format 28 adds the bounded raft.1 settings. The room owns propulsion, exclusive pilot reservations and checkpointed motion. It requires actual deck contact for thrust; a stale carried pose can retain the helm briefly but cannot drive. A reservation expires after sixty seconds of simulation without renewed contact, covering the bounded worker/graphics recovery window. Restart preserves the reservation and never resumes saved throttle. Trusted rooms derive controls from admitted inputs; browser prediction cannot propel the room's bodies. Solo play uses the same drive model locally and includes helm ownership in native worker recovery.

This is a buoyant, upright, single-body vehicle. It does not implement sails, oars, joints, wheeled vehicles, character/character contact, an owned physics backend or cross-host island handoff. The required final character/environment/ arrival art pass and full platform/performance qualification remain open.

Raft acceptance (October 26, 2026): broad integration passed 1,005 native checks, 76 skipped. PostgreSQL coverage totals 74 passing checks across the broad run and an isolated rerun: the first run lost the control test process to SIGKILL after two checks; all eight checks in that file passed in isolation. Production player/relay/authoring/engine builds and type/package boundaries pass. The standalone author bundle creates, validates, exports and compiles raft documents from outside the repository working directory. The final engine artifact is 888d42dc1936a086b42fcc9f0d3e643e56438cbeb7be4a5a26bfd1f7d96af792.

Ten raft browser journeys passed across physical Intel xe-3lpg and SwiftShader: published authoring/Undo/Redo/steering/handoff/jump, cedar model/live tuning/shared worker recovery, solo worker recovery/release, and PostgreSQL restart/lease-loss for both authority profiles. Persistent trusted journeys include 150 ms transport delay. Both main-thread and Worker graphics are exercised. The model contains 2,509 triangles across seven material primitives. Physical and software views were inspected; the linked capture records the shared deck and controls.

Acceptance caught settings edits clearing rider support and a ten-second pilot reservation expiring during a fifteen-second software worker recovery. Settings edits now preserve support, and the final sixty-second reservation passes nine focused native checks plus the unchanged software recovery journey. Propulsion still requires current contact and input; abandoned reservations still expire. All four trusted PostgreSQL floating/raft checks also pass after this correction. A software browser run also lost its GPU process and failed startup; its isolated rerun passed without source changes. The solo fixture initially tried to interact while the recovery menu was open; it now uses the required Return to the world button. Logs and traces are retained under ignored .data/raft/. These are short functional checks, not sustained performance, crash-recovery certification or final art approval. No numbered roadmap milestone is closed.

Reproduce the raft journeys with npm run test:browser:buoyancy -- -g 'raft|solo cedar', npm run test:browser:persistent-raft and npm run test:browser:trusted-raft, using the physical/software graphics environment described in render placement.

#Raising the Alder gate

Choose New world → Alder gate, Preview, Save and Apply. Join the shared room and walk to the end of the jetty. E raises or lowers the iron-bound wooden deck. A friend sees the same motion and can operate it too. Lower it to cross to the lantern terrace. The pivot is on the upper edge of the deck, with clearance from both landings so its thickness can turn freely.

Select the bridge and open Floating physics… → Hinged bridge to adjust its lower/upper angles, turning speed, available torque, local pivot and local unit axis. Preview, Save and Apply; saved Undo/Redo restores the authored settings. Density changes its load. A heavy deck or an obstruction can prevent a weak motor from reaching its target. Speed/torque edits retain the current target and riders; moving the pivot or changing its axis rebuilds the constraint and clears the old support relationship.

For a new PostgreSQL room, DW_ROOM_TEMPLATE=drawbridge selects this scene. DW_ROOM_AUTHORITY=cooperative or trusted selects the movement authority. Existing rooms retain their pinned release. The standalone author CLI supports template drawbridge <name> <new-document.json>; an exported editor document can also be supplied through DW_WORLD_DOCUMENT.

Format 29 adds a world-anchored native revolute joint with bounded motor torque, angular limits and a canonical open/closed target. Frame floating-room.3 carries that target alongside the deck's pose and velocities. Interaction receipts commit the target and native joint state together. Replaying an acknowledged operation returns its receipt without toggling again. Native restore validates anchor/joint ownership and constraint settings before continuing. Ordinary bodies and rafts retain their earlier content and transport profiles when no hinges are present.

This is one constrained deck per fixed world anchor. Body-to-body assemblies, other joint types, wheeled vehicles, breaking joints and cross-host island handoff remain open. It uses the current Rapier adapter; the owned backend and final character/environment/arrival art pass are still required.

Drawbridge acceptance (October 26, 2026): 1,013 native checks covered, 78 skipped, and 76 PostgreSQL checks passed. The serial native run passed 1,011 checks before/after an engine-pinning file exhausted the imposed 256 MiB heap; that file passed all four checks at 1 GiB, covering its two remaining checks. Type/package boundaries and production player/relay/authoring/engine builds pass. The build also needs more than the imposed 256 MiB compiler heap; it passes at 1 GiB. The copied standalone author bundle creates, checks, exports and compiles drawbridge from /tmp. Engine artifact: 8a6cbaa60f915d0d363792d48bc06d340ebef73ae463e3ce72488c078436b934.

Four browser journeys passed: editor Save/Undo/Redo, shared raising/lowering, crossing, live speed Apply and worker recovery on physical Intel xe-3lpg and SwiftShader; packaged PostgreSQL restart and forced lease loss on trusted/physical and cooperative/software paths. Each uses main-thread and Worker graphics. The trusted journey includes 150 ms transport delay. Native checks also cover rider carriage, pivot relocation, first/last hinge catalog changes, exact motion continuation and rotated hinges at distant world coordinates. PostgreSQL receipts prove retry does not toggle twice in either authority profile.

Reviewed shared crossing. The deck has beveled wooden planks, dark nails, hinge straps and brass barrels. Physical/software scene and control captures were inspected. Acceptance exposed insufficient drive force, landing interference during rotation, center-only reach and stale canonical rider support after pivot relocation; these have focused corrections and coverage. The software editor reload now uses the same 30-second initialization allowance as its initial load. The persistent scene-color check runs after lowering the deck, when the landscape is visible rather than a close view of timber. One failed software run also captured a traveler below the jetty; an exact-position native hold and the completed software journeys did not reproduce it, so its cause is unestablished. Follow-through covered 700 native walking approaches, 61 slow approaches to the seam and 100 collision insertion orders without a fall. The extended software and physical-GPU journeys completed four additional round trips per traveler. Type/package boundary checks also pass. The crossing test asserts support during approach, live revision and recovery; a first fall retains its preceding inputs/frames and a native checkpoint.

A controlled 900 ms key-down acknowledgement delay reproduced an under-jetty traveler: the driver walked past the side to x=0.753, then corrected back beneath the boards to approximately [-1.627, -0.286, 3.025]. The hold timer had started only after the key-down acknowledgement. Release is now queued independently on the driver clock, including when that acknowledgement fails. The same delayed approach stays above y=1.404 in both main/Worker graphics. Two timing checks and the complete software and physical-GPU shared drawbridge journeys pass with the injected delay; type/package boundaries pass. This corrects a reproduced test-driver failure mode. The original run lacks the movement history needed to prove its exact cause, which remains a final-qualification limitation. These short functional checks do not qualify sustained performance, all contact/fault cases or final art. No numbered roadmap milestone is closed. Scratch logs and traces are retained under ignored .data/drawbridge/ and .data/jetty/.

Reproduce with npm run test:browser:drawbridge, npm run test:browser:persistent-drawbridge, and npm run test:browser:trusted-drawbridge, using the physical/software graphics environment described in render placement.

#Linking the Willow causeway

Choose New world → Willow causeway, Preview, Save and Apply. The three cedar decks share real body-to-body hinges. Walk onto the middle deck while a second traveler stands on the starting jetty and presses E near the head deck to raise or lower the span. Lower it to cross to the lantern terrace. After a worker recovery, choose Return to the world before walking again.

Select a deck and open Floating physics → Connect to another moving body. Choose its neighbor, then Use the shared midpoint to fit the two local pivots. The local axes must describe the same world direction. Tune the lower/upper bend limits, Preview and Save; Undo/Redo retain the connection. Apply publishes the settings to both travelers. Disconnect before deleting an endpoint; move connected endpoints together. Ordinary selection copying and prefabs remain visual-only and do not copy a dynamic assembly.

For a fresh PostgreSQL room use DW_ROOM_TEMPLATE=causeway; existing pinned rooms keep their source. The standalone authoring tool accepts template causeway <name> <new-document.json>. Exported editor documents also work with DW_WORLD_DOCUMENT. Cooperative and trusted rooms own the entire connected assembly within one place.

The source uses world format 30, compiler linked-body-world.30 and transport floating-room.4. Connections reference stable authored identities; creating a new world remaps both endpoints. Validation rejects missing, self, duplicate or cross-place endpoints, pivots outside the collision boxes, separated pivots and misaligned axes. Native restoration checks endpoint ownership, reference frames, limits, contacts and solver policy. Linked bodies use twelve additional solver iterations; unrelated bodies retain their existing policy. Recovery does not rewrite an already matching native setting, preserving exact snapshot bytes and continuation. Escaped bodies reset their connected component together. Geometry revisions reset the affected component and clear rider support; parameter-only changes preserve its motion.

The deck model uses original beveled cedar planks, iron straps, brass barrels and rivets at both ends. The span has small intentional overlap at directly connected collision boxes, with contacts disabled only for those pairs. The nearby bank rock is moved clear of the span, and planting follows the extended shoreline. Character, environment and arrival art still require the final review requested by the user.

Acceptance · 2026-10-26: the physical and software editor journeys pass connection creation, pivot fitting, shared riding, raising/lowering, saved tuning, reload, Undo/Redo, live Apply, worker recovery and the complete crossing. Packaged cooperative/software and trusted/physical journeys pass two-traveler restart, forced lease loss, identity preservation and crossing; the trusted journey adds 150 ms transport delay. Reviewed captures cover both graphics placements and the narrow controls. The final shoreline cleanup is covered by both editor journeys.

Native integration covers 1,025 passing checks and 80 skips across the broad run, its completed remaining files, and a focused 15-check correction rerun. PostgreSQL integration covers 78 passing checks across the broad run and completed/rechecked files. Both initial long runners ended with SIGTERM, so these are combined results rather than single uninterrupted green runs. The broad native run exposed a runtime-created-body revision regression; revisions now preserve those bodies, and the existing regression passes. Five trusted database checks initially hit pressure-related 503 admission responses during concurrent workloads; the isolated 12-check trusted rerun passes without changing admission limits. This does not qualify sustained capacity or general loading performance.

The three-body lift initially exposed insufficient solver convergence and an intersecting bank rock; the scoped solver policy and clear geometry resolve it. Exact-restore checks caught equal-value setters modifying native snapshot state; those writes are now avoided. The first software crossing after recovery changed heading following a mouse resume; the keyboard journey now resumes with Enter. That run establishes keyboard recovery/crossing, not general pointer-lock timing qualification. Raw failures remain available with the passing results.

Type/boundary checks, production builds and standalone template/check/export/ compile from /tmp pass. Final engine bundle: f161ea5bf68c7dffaabbc2ff2b52e8f96ab86af42b72706b207a48b888ab00e8. Scratch logs and captures are under ignored .data/linked-decks/. Reproduce the browser journeys with npm run test:browser:body-links, npm run test:browser:persistent-body-links and npm run test:browser:trusted-body-links. This adds passive revolute body links; other joint types, broader vehicles, cross-host island transfer and the owned physics backend remain part of the full plan.