Full engine program progress

Objective: build out the full engine plan after the successful beta. The scope remains the engine, authoring environment, multiplayer runtime, assets, operations and extended capabilities in ENGINE_PLAN.md and milestones 0–18 in IMPLEMENTATION_ROADMAP.md. A green beta, a foundation increment or engine version 1 does not complete the full program.

The roadmap is the requirement source: every outcome, artifact, acceptance item and gate must be verified before its milestone is checked here. Unmeasured hardware, unsupported fault cases and absent artifacts count as incomplete. The shipped beta remains on main; development proceeds on codex/engine-foundations until changes are ready to integrate.

Progress reporting: feature implementation is 70/70, 100% feature complete, from the frozen source inventory and six remaining deliverables. This replaces the unsupported earlier overall estimates. Report the exact feature counter at each delivery. Testing, coverage, benchmarks, deployment qualification and final polish are tracked separately and do not reduce this feature percentage. The current character is user-approved. Full release qualification remains open.

#Delivery cadence — user correction

Finish working increments, perform a focused smoke check, then commit and push. Defer exhaustive regression/device testing and minor polish to the qualification pass, with explicit notes in the feature documentation. Do not present deferred checks as passed or spend successive turns expanding diagnostics. AGENTS.md preserves this direction. The full plan remains the objective.

#Current delivery milestone

Dusk identity rename — complete: 5/5 (100%). PR: https://github.com/jasona/dusk-engine/pull/2. Stop here. The engine is Dusk; Darkwind is its reference game. The fixed plan is DUSK_IDENTITY_AND_REFERENCE_GAME_PLAN, with five milestones R1–R5 on codex/dusk-identity. The rename counter is separate from feature implementation (70/70) and the completed polish pass (5/5). Retained identifiers are listed in DUSK_COMPATIBILITY. Progress: R1 identity/documentation, R2 Dusk tooling UI, R3 game presentation boundary and R4 compatible DUSK_ configuration delivered (4/5, 80%). R5 integration and handoff are recorded in RELEASE_CANDIDATE. All five milestones are pushed and the PR to main is open (5/5, 100%). Stop; do not resume the earlier backlog.

#Earlier: polish pass

No active polish milestone: the fixed pass is complete — 5/5 (100%). P1 garden, P2 approved character motion, P3 interiors, P4 cart presentation and P5 HUD/interaction feedback are committed for delivery. The final continuous physical-GPU two-traveler house → garden → cart → house journey passes. Actual screenshots, matching before/after views, character/cart motion clips, run instructions and deferred follow-ups are in TRAVELER_ART. Preview release: lantern-house.1.arrival-10. Feature implementation stays 70/70 (100%).

The user's stopping rule now applies: stop this polish pass. Do not select new art, optimization, diagnostics or tests from historical entries below. Further work requires a new scope decision. Existing broader qualification obligations remain recorded separately; no new full-regression or benchmark pass is claimed.

The prior beta release remains pinned at 0546627, with 4/5 qualification gates closed. Its remaining Docker smoke is awaiting the user's external result; that status is separate from this explicitly authorized polish pass.

First pass results: the complete native run has 1,446 passes, zero failures and 259 environment-dependent skips. Type/boundary/generated-wire checks and the production build pass. All four physical-WebGPU arrival/porch/shared-cart journeys pass on Intel Xe-3LPG. Arrival-7 daylight and edge smoothing are pushed in ece4f1b; screenshots are in TRAVELER_ART. The real 2D editor/publish/two-player/ reload journey now also passes, including authored Wave/Work/Rest actions. Qualification repaired development-room readiness, malformed-peer isolation, structured binary action inputs, local sprite motion stamps, terrain catalog staging, and mouse capture that made overhead action buttons unusable.

The database gate is now closed through the full sweep plus its complete affected-file rerun, as recorded above. The 300-tick 16-player/128-body benchmarks have simulation p95 102.195 ms (reference) and 620.580 ms (owned), both failing the <8/<16 ms target. See ROOM_CAPACITY for scope. These measurements do not close the full-plan performance or device gates.

Qualification groups: integrated native/build; shared browser/persistence and the six new capabilities; performance/capacity; character/environment/interaction polish; container/hosted/device compatibility; final integrated release review. Record pass/fail/blocked results for named checks rather than inventing another percentage. Existing broader gates remain open until their checks actually pass.

All six feature milestones are delivered. Feature implementation: 70/70 (100%). F65 physical/projectile portal crossings, F66 vehicle/passenger room-host transfer, F53 imported/sloping navigation and editor rebake, F13 animation state/blend trees, F69 named 2D action animation and F70 general visual behavior graphs are implemented and pushed to jasona/awaken-engine on codex/engine-foundations. The final graph combines saved event/condition/variable/action nodes with restricted compilation, shared room state and admitted area events. Its actual editor connection/save controls were exercised and visually reviewed. See FEATURE_COMPLETION and the feature documents for explicit bounds and deferred review.

No feature milestone remains in the frozen inventory. The fixed final polish pass is now delivered, as recorded above. Broader release qualification remains separate from feature implementation. Deferred coverage, regressions, performance, container/deployment and device checks remain open. They must not move the feature percentage backward or silently expand the 70-capability denominator.

Collaborative terrain brush saving is included in the repository handoff. Ordinary brushes use per-sample height/surface changes, disjoint saves retain other builders' work, and saved undo preserves unrelated samples. This feature already counts in F57 and must not earn another percentage increase for documentation or a commit. The handoff targets jasona/awaken-engine on codex/engine-foundations; subsequent feature milestones use that same destination.

The completed polish candidate is lantern-house.1.arrival-10. The user explicitly approved the current white-haired fantasy character on October 27. House/keeper/shared travel, planted porch/garden return and real cart driver/passenger checks pass, with reviewed screenshots in TRAVELER_ART. Preserve this approved character direction. Wheel/steering motion, contact refinements and HUD polish are now delivered. Hand/finger/foot IK and broader device review remain follow-ups there.

Weather cycles are also delivered: saved clear/shower durations and smooth fades, editor controls, saved undo/restart, shared room time and the physical-GPU Worker/main two-traveler journey pass. See WEATHER for remaining environmental work; do not repeat passed focused checks without a new reason.

The Node/Chromium replay increment is delivered. Six demonstrated exact-state differences were repaired with fixed-order scalar math in the owned backend. Eleven scenarios now match every step in Node and browser main/Worker execution, including checkpoint exchange in both directions; 52 native checks and two rendered atelier journeys pass. Five database-dependent checks were skipped. Profile darkwind-owned-rigid.8 separates the revised solver from retained engines. See OWNED_PHYSICS for exact scope and evidence.

The first performance increment is delivered: redundant collision geometry and scratch-vector work were removed without changing solver policy or state. Warmed stack p95 fell from 9.904 to 4.950 ms and bridge p95 from 4.072 to 2.105 ms on the recorded Linux machine. Prior per-step hashes remain exact; 52 native and 13 browser checks pass. The reference is still faster; these small scenes do not qualify the full load budget.

The capacity increment is delivered for testing: persistent hosts can opt into sixteen players, source/runtime/checkpoints accept 128 authored bodies, and a full room retains socket headroom for an existing traveler to reconnect. Defaults stay at eight. Both backends consume the larger frame; live sixteen-connection and 128-body PostgreSQL restore checks pass. The integrated CPU workload now runs, but misses the target substantially on both backends. See ROOM_CAPACITY for the short local timing sample and exclusions.

The state-comparison increment reduces the same short workload's simulation p95 from 217.601 to 132.287 ms with Rapier and 680.131 to 594.267 ms with owned physics. Direct column equality and indexed body lookup retain full invariants; forty-two native checks and ten prior per-step replay sequences pass. All sixteen final player poses remain exact, with 128 bodies still active. Both miss the budget. The rendered check also exposed and fixed premature push prompts behind the jetty: ordinary body prompts now require native clear reach. The unchanged physical-GPU shared-push/owner-departure/reload journey passes; its screenshot is in ROOM_CAPACITY.

Prepared component readers reduce the next short sample to 106.976 ms reference / 565.255 ms owned p95. All 128 bodies remain active and all sixteen final poses match the preceding run. Fifty-two native checks pass with one database-dependent skip; ten prior replay sequences and the production build pass. Automatic approval review hit a usage limit before the browser/screenshot check could execute. See ROOM_CAPACITY. The 8 ms target remains unmet. Further small optimizations are deferred at the user's direction; Rapier remains default. Docker execution still needs daemon access. Full-plan percentage remains unmeasured.

#Fixed release-closure workstreams

This October 27 reconciliation replaces choosing work from historical entries. It preserves milestones 0–18 and their named artifacts/acceptance gates. It is not a claim that every requirement has passed, nor a new percentage denominator. New findings belong under the relevant row instead of becoming unrelated campaigns.

Shared-body state comparison is cheaper, and blocked push prompts are fixed. Direct storage-column equality and indexed body lookup preserve full collision invariants while reducing the measured 16/128 CPU cost. Forty-two native checks, ten prior per-step replay sequences, production builds and the physical-GPU multiplayer push/departure/reload journey pass. The browser failure exposed a prompt offered through the jetty; clear native reach now gates that prompt, and the unchanged journey passes. Milestone screenshot. Try the Driftwood cove or npm run physics:room -- --ticks=30. The full load budget still fails; measurements and deferred work remain in ROOM_CAPACITY. Full-plan percentage remains unmeasured.

Larger room and body limits delivered; full-load performance remains open. Persistent hosts accept opt-in DW_ROOM_CAP=16, and authored body source/state supports 128. A seventeenth arrival is refused while an existing player can replace a tab in the full room. 31 focused native checks and two PostgreSQL checks pass; 25 database/browser cases in the native selection were skipped. Both native backends consume complete JSON/binary body frames and restore them. Build and Compose validation pass. npm run physics:room -- --ticks=30 reproduces the integrated CPU gap; the measured high-load scene is not ready for deployment. See ROOM_CAPACITY for measurements and deferred journeys. This increment has no new visual interface to screenshot. Full-plan percentage remains unmeasured.

Owned collision work is faster with unchanged replay. Bounds/support skip unused face data, contacts reuse prepared geometry, and vector math avoids redundant allocation. Warmed stack and bridge p95 roughly halved in the recorded local scenes; the full timing table and reference comparison are in OWNED_PHYSICS. 52 native checks, eleven cross-runtime cases and two rendered journeys pass. Milestone screenshot. Try npm run dev:physics or npm run physics:compare -- --warm. The integrated 16-player/128-body gate and broader replacement qualification remain open. Full-plan percentage remains unmeasured.

Owned physics now replays exactly across Node and Chromium. The eleven-case matrix compares every state hash and exchanges checkpoints between Node and both browser placements. Fixed-order trigonometry repairs the six observed differences; 52 native checks and two physical-GPU atelier journeys pass. Try npm run dev:physics, or run npm run test:physics:replay for the contract. Milestone screenshot. Additional targets, database cases and replacement quality/performance remain open. Character approval is recorded in TRAVELER_ART and the roadmap. Full-plan percentage remains unmeasured.

Shared weather now changes over time. In the editor's Atmosphere → Rain & snow, enable Alternate clear spells and showers, set durations, then Preview, Save and Apply. Two travelers share clear → rain → clear even when one browser's clock is a day wrong. Format 70 retains the schedule and epoch through saved undo and restart. Milestone screenshot. Focused checks pass; PostgreSQL/hosted cycle coverage and broader environmental work stay open in WEATHER. Full-plan percentage remains unmeasured.

Garden vehicle joins the art candidate. The finished cedar/brass cart adds upholstered seats, controls, lanterns and a travelling chest in the garden forecourt. Three native and three focused browser journeys pass, covering the house/story, porch/garden return and shared driver/passenger travel. The boarding screenshot was reviewed. Run npm run dev:art on Node 22 at localhost:5187; the new .data/arrival-art.6 seed and Docker beta's darkwind-arrival-v6 volume retain older saves separately. Character-style approval is pending; art follow-ups and hosted/device acceptance remain recorded. Full-plan percentage remains unmeasured.

Continuous walking through prepared handoffs delivered. Destination collision prediction and a bounded, once-only authoritative movement replay remove the movement hold while transfer/admission finish. Refusal restores the source; a successful arrival retains the movement and viewing direction. Three native/wire checks, two database checks, two real separate-host journeys and the focused physical-GPU refusal/success journey pass; the browser verifies movement during a held transfer, arrival correction under 0.4 m, one socket and one worker. The walking view and arrival were visually reviewed. Code checks and production builds pass. Unsupported/unprepared previews still hold; temporary view resolution, long waits and wider qualification are recorded in ROOM_ROUTING. Run DW_CROSSINGS_DATA_DIR=.data/walking-handoff npm run dev:remote-crossings and walk through the brass arch. Next is the final presentation candidate, with user art approval and full-plan acceptance still open. Full-plan percentage remains unmeasured.

Looking stays responsive during a handoff. Mouse/keyboard look is no longer locked during walking transfer, accepted doorway previews keep updating until source release, and the accumulated turn carries into arrival or source resumption after refusal. The physical-GPU delayed-transfer test passed a refusal followed by successful crossing, retained facing/pitch, one socket and one worker; the waiting view was visually reviewed. Build and code checks pass. Authoritative movement still waits during the transaction; continuous walking remains the active presentation work, with controller/touch, broader qualification and final art still open. Full-plan percentage remains unmeasured.

Whole travelers at the doorway. Animated bodies and attachments now remain one silhouette while overlapping the destination plane; wholly outside travelers disappear. Six geometry checks and the focused physical-GPU image comparison pass, including unchanged scenery clipping and source-wall occlusion. The two-account walking journey passed released/held movement, one socket and worker each, staged native/GPU reuse and reunion; the doorway screenshot was visually reviewed. Type/boundary/wire checks and the production build pass. The older portal gallery's shared-handle census assertion remains a separate qualification follow-up. Next remove the visible frozen-camera handoff pause. Broader qualification and final art approval remain open; full-plan percentage remains unmeasured.

Entry momentum survives the doorway. The source retains velocity from the accepted input boundary, the doorway rotates it, the transfer journal persists it and destination authority restores it. Host collision probes reuse already compiled content while checking current doors/props/rigid bodies. Fourteen native checks plus both-backend door-isolation probes pass; the cross-host test confirms nonzero velocity reaches the first destination motor state with one owner and idempotent retry. The physical-GPU two-account journey passed natural braking on release, continued walking while held, staged native/GPU reuse, one socket and one worker each. The arrival screenshot was reviewed; code checks and the build pass. Run DW_CROSSINGS_DATA_DIR=.data/momentum-room-final npm run dev:remote-crossings. The visible threshold pause, straddling-body clipping, airborne/held-jump behavior, pressure and wider qualification remain recorded; final art is still required. Full-plan percentage remains unmeasured.

Walking crossings retain the public socket again. A bounded transfer hold prevents the movement watchdog from reconnecting while the host intentionally freezes its input boundary; ordinary heartbeats and recovery deadlines remain active. Three real-socket checks cover cancellation, timeout and missing heartbeat behavior. The complete physical-GPU two-player walking journey passed with one connection and one worker per traveler, native/GPU reuse, released/held W and a shared reunion. The arrival screenshot was reviewed. Admission-pressure retries, the remaining server handoff pause/velocity reset, near-plane body clipping, broader qualification and final art remain open. Type/boundary/wire checks and the build pass. Run DW_CROSSINGS_DATA_DIR=.data/continuous-walk-final npm run dev:remote-crossings. Full-plan percentage remains unmeasured.

Prepare while approaching; keep walking after arrival. The destination now stages native collision and graphics while its authorized doorway view is nearby, with the source still rendering. Standing arrivals reuse that collision at the transformed pose. Live two-account checks verified released W stays released and held W continues after arrival, with prepared native/GPU reuse and one simulation worker. The two-traveler arrival was reviewed. The socket-continuity assertion failed (connections 1 → 2); reconnection succeeded and both travelers reunited, so that observed failure remains the next follow-up. Reference doorway clearance was fixed after a live wall collision refusal, with both-backend clearance checks. Focused native/GPU checks, type/boundary/wire checks and the build pass. Run DW_CROSSINGS_DATA_DIR=.data/approach-room-final npm run dev:remote-crossings. Remaining server handoff pause, physics velocity, controller/touch continuity, near-plane body clipping, pressure/fault/device/host checks and final art are recorded in ROOM_ROUTING. Full-plan percentage remains unmeasured.

Walk into another room through its window. Format 69 adds an explicit editor/SDK walking option. Standing travelers enter from the front of the aperture without E; the host freezes their input boundary, transforms position/facing and validates destination collision before the durable transfer. Physical-GPU browser checks crossed both invited travelers and reunited them while retaining workers and public connections; the arrival screenshot was reviewed. A refused second crossing preserved the source; the retry encountered admission pressure, then completed. Aperture/portable-release checks and the host's single-owner/idempotent-arrival check passed. Run DW_CROSSINGS_DATA_DIR=.data/walk-room-final npm run dev:remote-crossings. This is automatic entry, not yet pause-free traversal: approach prewarming, held input/velocity continuity, transformed-pose native reuse, occupied-arrival spacing and wider pressure/fault/device/host qualification remain in ROOM_ROUTING. Final art remains required; full-plan percentage remains unmeasured.

Live destination views through room doorways. Format 68 adds saved editor/SDK window settings. A nearby invited traveler can see public destination travelers through the arch without joining that room or reserving a seat. Two physical-GPU browser sessions showed remote movement, then crossed and reunited while retaining the simulation worker and public socket. Editor preview/save/reload/undo passed after fixing fractional-coordinate input validation; nine remote-actor checks passed, including observer identity and checkpoint isolation. The live doorway screenshot was visually reviewed. Run DW_CROSSINGS_DATA_DIR=.data/live-window-release npm run dev:remote-crossings on port 8799. Updates currently poll once per second; initial GPU preparation can freeze the source, one window is supported per place and crossing still uses E. Seamless walking/camera continuity is next. Wider faults, remote dynamic physics/environment alignment, load/device/physical-host qualification, compact editor layout and final art remain recorded in ROOM_ROUTING. Full-plan percentage remains unmeasured.

Destination graphics prepare before transfer. The live worker now prepares the destination model catalog, surface/text resources and existing within-world portal resources before requesting ownership transfer. Arrival commits those GPU resources with a fresh authoritative scene baseline. Two invited accounts reused staged graphics and reunited; three crossings retained worker, graphics and connection owners. The shared arrival screenshot was visually reviewed. A focused full-catalog browser check rejected invalid refreshed geometry, preserved the accepted scene on rejection/cancellation and released owned buffers/textures. Code checks and the production build passed. One earlier third crossing was refused by destination pressure while preserving the source; a fresh repeat run then passed. Pressure/peak-memory/device/fault qualification remains open. Run DW_CROSSINGS_DATA_DIR=.data/gpu-arrival-rooms npm run dev:remote-crossings on port 8799. Source imagery can freeze during preparation; live remote-room doorway views and seamless crossing presentation are next. Final art and full-plan qualification remain required; full-plan percentage remains unmeasured.

Destination native collision prepares before transfer. The existing worker now loads and builds destination entry physics before the transfer request, then activates it with committed destination progress. A failed preload sends no transfer; a canceled stage releases its content and native scene. Both physics backends passed checkpoint/movement equivalence, single-use/cancellation and changed-residency fallback checks. Physical-GPU acceptance crossed two invited accounts, reunited them and completed three crossings while reusing staged native collision and retaining worker, graphics and socket owners. The shared arrival screenshot was visually reviewed; code checks and the production build passed. Run DW_CROSSINGS_DATA_DIR=.data/staged-arrival-rooms npm run dev:remote-crossings on port 8799 and press E at the doorway. Changed entry poses, route/cargo saves and changed prop geometry still use exact-state preparation; those reuse cases, broader pressure/fault/device/host qualification and final art remain open. Destination GPU staging and seamless doorway views are next. Full-plan percentage remains unmeasured.

Simulation and graphics owners retained across arrivals. The source room now releases its simulation/content inside the running worker; the destination uses that worker and graphics owner, retaining the source image until destination graphics commit. Two invited accounts crossed and reunited, and three consecutive crossings kept one simulation worker, one graphics generation, one public socket and the same traveler. Failed preloading still sent no transfer. The arrival screenshot was visually reviewed. Source-client detachment, type/boundary/wire checks and the production client build passed. Run DW_CROSSINGS_DATA_DIR=.data/retained-arrival-rooms npm run dev:remote-crossings and use E at the doorway on port 8799. Destination native physics still prepares after ownership transfer; precommit staging and seamless destination views are next. Wider faults, long-session memory/load, deployment/device qualification and final art approval remain open. Full-plan percentage remains unmeasured.

Continuous public room connection delivered. Two invited accounts crossed between remote host processes and reunited while each kept one public WebSocket. Three consecutive crossings preserved the original document, traveler and public connection. The milestone screenshot was visually reviewed. Real local JSON/remote binary host checks preserved inventory and rejected another actor's handoff ticket; the page/worker check passed the HTTP-before-socket notification race. Type/boundary/wire checks and the client build passed. Run DW_CROSSINGS_DATA_DIR=.data/continuous-crossing-rooms npm run dev:remote-crossings, open port 8799 and use E at the doorway or Esc → Visit another room. Simulation-worker replacement and destination rendering preparation still interrupt arrival; preserving those and seamless views are next. Wider faults, deployment/device/load qualification and final art approval remain open. Full-plan percentage remains unmeasured.

Shared in-page arrival now passes. Two invited travelers crossed the furnished network-host demo and reunited without another Enter click. Three consecutive crossings kept the original traveler/document, and the shared-arrival screenshot was visually reviewed. Recurring saved-state reads previously revalidated the entire art-bearing world and pushed the hosts past their event-loop admission limit. The live reader now locks and reads only committed mutable state, checking owner, epoch and pinned release. Admission thresholds remain unchanged. Inventory/lease/release-fence tests, the remote three-traveler crossing and account recovery checks passed. The third simultaneous browser context timed out during startup after the successful crossings; an isolated fresh-browser return through the original invitation then passed. Wider graphics/load qualification remains open. Run DW_CROSSINGS_DATA_DIR=.data/shared-arrival-rooms npm run dev:remote-crossings to test the corrected retained engine on port 8799; earlier demo saves remain separate. Continue with transport/worker continuity. Full-plan percentage remains unmeasured; final art approval and qualification remain required.

Preloaded, in-page room arrival delivered for testing. Before moving ownership, the player warms and validates the destination’s entry assets; a failed preload leaves the traveler at the source. A committed crossing now replaces the room inside the current document/canvas and resumes without another Enter click. Three consecutive physical-GPU crossings preserved traveler identity and the document; the arrival screenshot was visually reviewed. A deliberately failed manifest preload sent no transfer, and the subsequent authored crossing passed. Remote-host inventory/source fencing and invited-account/cross-browser tests passed, as did code checks and the client build. At this earlier increment the furnished two-browser reunion did not pass: the destination repeatedly refused admission as resting. The lightweight-snapshot follow-up above resolves that observed refusal with safeguards still enabled. Public WebSocket/worker continuity, seamless views, broader qualification and final art approval remain open. Use DW_CROSSINGS_DATA_DIR=.data/preloaded-crossing-rooms npm run dev:remote-crossings for a fresh current-engine demo on port 8799 without replacing earlier demo saves. Full-plan percentage remains unmeasured.

Network room hosts delivered for testing. npm run dev:remote-crossings opens the furnished account demo on port 8799 with a coordinator and two separately running host processes. Players cross through the same doorway while their room traffic uses authenticated network HTTP/WebSockets. Assignments expire without renewal, hosts validate pinned room/release/engine bindings, and the Compose overlay declares persistent worker engine volumes. The three-traveler network crossing passed in 40.1 seconds; configuration and unrenewed-assignment checks passed, as did code checks, both packaged service builds and Compose validation. The physical-GPU demo crossed two accounts between host A/B, reunited them and followed the original traveler from an old link on a fresh browser; the destination screenshot was visually reviewed. An overlong private socket path found in the first host run was fixed. These services were exercised on one machine; actual multi-machine TLS, Docker execution, partition/restart/restore and load qualification remain recorded in ROOM_ROUTING. Destination preloading and session continuity are next; full-plan percentage remains unmeasured and final art is not approved.

Invited account crossings delivered. npm run dev:account-crossings opens the furnished two-room demo on port 8798 and prints private Rowan/Willow account-file paths. Invited accounts can use the menu or E doorway while retaining their traveler and belongings. Destination membership and session binding commit with ownership; revoked invitations and conflicting destination travelers are refused. Old lobby selections and direct room links follow the same traveler on a fresh browser. Seven PostgreSQL checks, the two-host account journey (26.1 seconds) and type/boundary/wire checks passed. The physical-GPU demo walkthrough crossed two accounts, reunited them, and verified a fresh-browser return; the invitation screen was visually reviewed. The old guest-only host restriction was removed after the live check exposed it; a later test correction supplied the required room passphrase. Remote-machine routing is next. Simultaneous-device races, deployment/restore, seamless views, broader qualification and final art remain open. Full-plan percentage remains unmeasured.

Visual room doorway authoring delivered. Run npm run dev:editor and choose Room doorways… to add a doorway, choose its destination world/room, set position/reach, preview and save. A gold doorway and ring mark the interaction in the scene. Saved edits survive reload, Undo and Redo, including the explicit trusted-authority upgrade. Two focused authoring tests and type/boundary/wire checks passed; the physical-GPU editor journey passed in 4.9 seconds after fixing a disabled-button wiring issue. Editor screenshot visually reviewed. Export to a configured regional room service to use cross-host travel; local editor play does not connect hosts. Account permission mapping is next. Broader deployment/device qualification and final art remain open; full-plan percentage remains unmeasured.

SDK-authored room doorways delivered. npm run dev:crossings now opens the Lantern Road reference arch on port 8796. Press E to visit the next configured room and E again to return; a friend can follow. The host validates actual doorway reach and uses the existing single-owner journal. The SDK format-67 world survives portable compilation/save/reload. Focused SDK, live host refusal/inventory, code checks and the physical-GPU two-player round trip passed (1.9 minutes). Cold-start retry and unnecessary full-world doorway lookups were fixed during that journey. Arrival screenshot reviewed through the demo launcher after framing the spawn. Visual editor controls, account mapping, seamless portal views/preloading, remote machines and wider qualification remain open in ROOM_ROUTING. Full-plan percentage remains unmeasured; final art is not approved.

Guest room-crossing implementation delivered for testing. npm run dev:crossings opens two rooms on port 8796; use Esc → Visit another room. The durable journal moves the same traveler, held items and keepsakes with one active owner; reload recovers a committed crossing after a lost response. Five PostgreSQL checks and a three-traveler/two-host test passed, including stale source-ticket rejection and observer updates. Type/boundary/wire checks passed. The physical-GPU two-player crossing/reload/reunion journey passed in 1.4 minutes; destination screenshot reviewed. Earlier GPU initialization failure and wider acceptance notes remain in ROOM_ROUTING. This menu-based same-release guest increment does not close authored portals, account mapping, remote-machine routing or final art. Full-plan completion remains unmeasured.

Baked navigation and shared gates delivered. npm run dev:navigation opens the Gate Garden on port 5215. Open the gate with E and the watchkeeper finds a route across the baked floor; both players see the same keeper and door state. Geometry edits require rebaking; a closing gate blocks/reverses the current edge without teleporting. Five focused checks passed including PostgreSQL persistence, plus four legacy navigation checks and type/boundary/wire checks. The physical-GPU two-player gate/crossing/reconnect journey passed; screenshot visually reviewed. See bounds, commands and remaining review. Flat primitive floors and box doors are supported; live mesh migration, arbitrary slopes/imported collision, broader replay/load and final art are still open. Overall full-plan percentage remains unmeasured; this is a delivered feature, not final full-plan acceptance.

Durable model/texture imports delivered. Models and images now use the persistent queue with the existing importer bounds, checksums and source/settings identity. Exported model JSON can be previewed, placed, saved and reloaded through Models → Import model. Ten PostgreSQL checks passed, including an actual interrupted model worker, schema upgrade and standalone packaged asset export; code checks passed. Physical-GPU prepared-model save/reload/undo and GLB compatibility passed in 4.1 and 5.8 seconds; saved-model screenshot visually reviewed. See commands and acceptance. Model/texture delivery does not approve final art or close the remaining full-plan gates. Overall percentage remains unmeasured.

Durable prefab builds delivered. A saved request survives worker death and can be reclaimed, repeated submissions keep the original ticket, newer revisions fence old results, and failed replacements preserve the last good build. The packaged CLI exports the accepted artifact as a playable SDK release. Five focused PostgreSQL checks, code checks and Compose validation passed. The exported game passed two-traveler physical-GPU play in 11 seconds; screenshot visually reviewed. See commands, limits and deferred review. The private Docker queue declares its database volume; actual container execution remains unverified. Overall full-plan completion remains unmeasured.

Separate-owner continuous replay delivered. Newly recorded authored-body rooms now retain physics owner IDs and epochs. SQL replay checks fenced saves, advances ownership through cargo transfer, and verifies retry behavior. The live two-rider/observer journey passed with inline, subprocess and local network-service owners; altered epochs were rejected and source room/player rows stayed unchanged. Capture compatibility and type/boundary/wire checks passed. Physical-GPU playback passed in 5.2 seconds and the screenshot was visually reviewed. This screenshot shows native playback; SQL transaction replay is a separate command. See acceptance and deferred work. Full-plan percentage remains unmeasured; no new estimate is inferred from this increment.

Owned sphere-on-stack defect fixed. Per-point penetration, coupled linear/angular displacement correction and articulation-limit projection keep the offset sphere supported and asleep through ten simulated seconds. The old fixture dropped it to the floor within four seconds. Exact continuation from an impact checkpoint passes, as do all 13 owned-physics test files and type/boundary/wire checks. The physical-GPU atelier passed support and save/nudge/restore in 8.7 s; screenshot was visually reviewed. Try npm run dev:physics, study 01 — Balance & weight. Rapier remains the default. See focused acceptance and remaining qualification; no claim of full backend replacement or cross-target replay. Overall full-plan percentage remains unmeasured.

Planted porch and garden delivered for testing. lantern-house.1.arrival-5 adds branched botanical models, grass, flowers, a stepping-stone clearing, garden masonry edges and sky lighting. Existing collider shapes and story identities remain intact. Type/boundary/wire and arrival invariants passed. The physical-GPU journey walked off the porch without a fall/reset, showed two travelers in the garden and returned to the house (29.3 s); the interior/shared movement/keeper journey passed (19.3 s). Porch screenshot and shared garden were visually reviewed. Try npm run dev:art on Node 22 at localhost:5187; the new .data/arrival-art.5 seed retains old worlds. Docker uses a new darkwind-arrival-v5 volume for the changed content. User approval, loading speed, leaf edges and wider GPU performance remain review items. Overall full-plan percentage remains unmeasured.

Integrated release-candidate handoff: packaging delivered; container/hosted acceptance pending. compose.beta.yaml selects the new arrival world and automatically provisions isolated persistent storage; the local override exposes localhost:8789. The runbook gives exact local Docker/Coolify setup and a short multiplayer/restart checklist. Production build, type/boundary/wire checks and Compose validation passed. Two rendered travelers joined the built production runtime, shared a door change, reconnected across a graceful process restart on the same storage, retained the signing key and shared another door change. Post-restart screenshot was visually reviewed. Actual image execution is still unverified because this session cannot access the Docker socket and sudo is prohibited; npm run test:container -- --arrival-art now targets this release on a Docker-enabled machine. Do not repeat the passed host checks or expand diagnostics while waiting for container access. Next acceptance is that container command plus the runbook's hosted two-device check. No production deployment or main merge. Final visual approval, outdoor refinement, owned-backend replacement gates, separate-process/interrupted replay coverage and wider full-plan qualification remain open. Full-plan percentage remains unmeasured; this handoff does not complete milestones 0–18.

Arrival materials and composition delivered for testing. New lantern-house.1.arrival-4 uses directional timber grain, quiet plaster, a deeper oak palette, shadowed warm key lighting, a wall clock, book details and hanging ivy. Its first-time spawn brings the keeper closer in view. Original collision, identities and story interactions are preserved. Code checks and the arrival invariant check passed; the physical-GPU browser journey verified actual first-time spawn, shared entry/movement and keeper dialogue in 16.3s. Arrival screenshot, keeper and shared view were visually reviewed. Try npm run dev:art under Node 22 and open http://localhost:5187/; restart any old art preview first. The isolated seed is .data/arrival-art.4. User visual approval, outdoor atmosphere and wider rendering/performance qualification remain open. Overall full-plan percentage remains unmeasured.

Textured character replacement delivered for testing. The default player and keeper in lantern-house.1.arrival-3 now use an attributed CC0 character adaptation with painted facial detail, layered white hair and textured clothing. It retains the fourteen-joint rig, all five locomotion clips, hand equipment and physical skin binding. Source/build, animation/equipment/arrival checks and code checks pass; the physical-GPU two-traveler room, movement and keeper dialogue journey passed in 19.9s. Keeper screenshot and shared room were visually reviewed. Try npm run dev:art on Node 22, then open http://localhost:5187/ in two browser profiles. The new .data/arrival-art.3 seed preserves earlier art worlds. User approval, environment/arrival refinement, facial/hair/cloth animation and wider qualification remain open; keep the current art milestone active. Art notes and source attribution. Overall full-plan completion percentage remains unmeasured.

Two-traveler shared play verified on the physical GPU. Both independent sessions in one Chromium process enter and operate the pressure gate; the powered 2D hinge journey also passes shared motion and second-player reload. Background player views now use a reduced rendering cadence while keeping simulation and room updates independent; active views retain their normal cadence and scene detail. Code/boundary/wire checks passed. The focused physical-GPU runs passed in 10.6s and 18.0s, with software fallback explicitly refused, on Intel xe-3lpg / Chromium 155 / Node 22.23.4. Shared gate screenshot and powered hinge screenshot were visually reviewed. The SwiftShader run still stalls at the second adapter probe and is not fixed; it is deferred to qualification rather than holding further visible delivery. Background timing, additional devices and broader recovery/performance checks remain unqualified. See render placement. Overall full-plan completion percentage is not measured.

Traveler lifecycle replay delivered for testing. New takes retain the saved starting roster (including offline inventory, keepsakes, gameplay and poses), original committed join requests, and ordered connection boundaries. The temporary ledger recreates late joins, checks saved state when travelers reconnect or replace a tab, retries admissions, and verifies its final shared state against the recording. Native creator admission now uses the correct online/offline traveler set at each recorded event. A guest join/leave/reconnect/tab-replacement journey passed with an offline inventory owner and no source writes; a creator-body journey passed as an offline traveler joined and left. Type/boundary checks and the Chromium lifecycle view passed; the existing travel/return and authored-cargo integration checks also passed. Milestone screenshot. Capture a new take and run DW_REPLAY_DATABASE_URL=<postgres-url> npm run replay:ledger -- <recording.json>; results include joins and travelerArrivals. Older takes do not gain missing admissions or offline state. Remaining review: abrupt departure during a pending transaction, account-link retry histories, long recordings, separate physics owners, interrupted physics spans and full device/backend qualification. Final art remains required. Overall full-plan completion percentage is not measured.

Spawned bodies and creator physics now replay through SQL. New multi-place takes record the initial spawned-body checkpoint/revision and ordered physics saves. Ledger replay restores the native owner, reruns physical interactions and fenced saves, and rebuilds live traveler simulations from recorded inputs for the actual creator collision-admission check. Creator changes use the production preparation and commit path, checking the saved body state and traveler inputs. Focused live journeys passed for creation/removal, a physical interaction with a second traveler present, and two-rider cargo round trips on both Rapier and the owned backend. Exact request/retry comparisons passed and source transaction counts remained unchanged; external execution stayed disabled. Type/boundary checks and the Chromium creator playback passed. Milestone screenshot. Try a newly captured spawned-body take with DW_REPLAY_DATABASE_URL=<postgres-url> npm run replay:ledger -- <recording.json>; physics saves, creator steps and cargo commits now appear in the result. The studio screenshot shows visual playback; SQL replay is a separate command. This still requires continuous physics history and supported initial traveler boundaries. Late joins/reconnects, separate physics-process owners, omitted offline players, same-frame lifecycle transitions and long/mixed histories remain to implement or qualify; final character/environment/arrival art remains open. Overall full-plan completion percentage is not measured.

Authored cargo crossings replay through the actual transaction. New takes preserve the cargo command and its fingerprint, saved starting poses, and checkpoints made during cargo departure, revision freezes and shutdown. The temporary ledger calls transferCargo, compares the committed body checkpoint and every rider pose/revision, checks unchanged rider inventory/gameplay, and retries the request without another crossing. A live journey with two riders, an observer and two canceled attempts passed; the source transaction count stayed unchanged. Type/boundary checks and the Chromium playback journey passed. Milestone screenshot. Try a new authored-cargo recording with DW_REPLAY_DATABASE_URL=<postgres-url> npm run replay:ledger -- <recording.json>; the result now includes cargoTransactions. Separate physics-process owners and spawned-body/program histories remain unsupported here; canceled cargo attempts are reported as skipped. Wider mixed-history and fault testing, spawned coverage and final art remain open. Overall full-plan completion percentage is not measured.

Authored-body physics and sensor decisions replay through SQL. New takes capture the starting native checkpoint and database revision, plus each physics save's order, revisions, room states and sensor traveler inputs. The temporary ledger now restores that baseline, reexecutes native physics, calls the real fenced save, and reruns physical interactions and ordinary actions in the same ordered history. Sensor admissions retain their traveler inputs and rerun stepBehaviors; admissions already committed by a physics save are checked without applying them twice. A live gate interaction followed by a pickup passed with physics saves and exact request retries; a separate door change also passed. A two-traveler sensor journey replayed entry and exit and rejected altered sensor positions. Source transaction counts stayed unchanged. Type/boundary checks and the Chromium door replay journey passed; the studio screenshot shows that take, while SQL replay runs separately through npm run replay:ledger -- <recording.json> with DW_REPLAY_DATABASE_URL set. This path requires a new continuous authored-body recording. Spawned-body/collision-enabled creator programs, cargo transactions and incomplete physics spans remain unsupported; combined sensor/body histories, broader backend/mixed-history/performance qualification and the final art pass remain for review. Overall completion percentage is not measured.

Creator actions and saved jobs replay through the temporary ledger. Newly captured takes retain the host-admitted creator interaction pose. npm run replay:ledger -- <recording.json> now restores the recorded program baseline, reruns supported scripted actions through PlayerLedger.transact, and delivers saved external results through HostedPrograms.step in recorded order. Every program checkpoint, observed room projection, saved player result, request fingerprint and retry is checked; external executors are replaced with rejecting stubs. A live authored lantern replayed its action and saved job result without another execution or source write. A two-traveler native public-program take replayed four alternating touches and its native system steps. An out-of-reach recorded pose was rejected, and result injection against a live ledger was refused. Focused type/boundary checks, existing native recording tests and the Chromium studio journey passed. The studio screenshot shows the same creator take; SQL replay runs separately through the CLI. Sensor admissions, creator rejections without complete transaction inputs, collision-enabled creator worlds, moving-body transactions and cargo remain outside this SQL replay path; older creator takes lack the admitted pose. Broader mixed-history and long-take qualification and the final character/environment/arrival art pass remain open. Overall completion percentage is not measured.

Combat, keepsakes and room systems replay through the actual ledger. npm run replay:ledger -- <recording.json> now interleaves player actions with combat respawns and NPC steps in recorded order. It seeds saved gameplay and existing keepsakes, uses recorded combat timestamps and award identities inside temporary PostgreSQL tables, and compares saved gameplay, keepsakes, shared state and transaction retries. The source ledger rejects these input overrides outside the isolated replay session. Two travelers replayed a full guardian fight (four abilities, one award and a respawn); a second fight preserved the existing keepsake without another grant. Source transaction and award counts stayed unchanged. Focused checks passed: npm run check, PostgreSQL combat/inventory/NPC recording tests, and the Chromium combat replay journey. The studio screenshot shows the combat recording; SQL replay runs separately through the CLI. Creator programs and moving-body/cargo transactions remain outside this path. Ability refusals without captured resolution inputs remain reported as skipped; older takes without system order or player revisions cannot replay systems. Baseline award audit entries are synthetic, preserving owner-visible award data rather than reproducing unavailable audit history. Long recordings, mixed travel/combat, broader qualification and the required final art pass remain for review. Overall completion percentage is not measured.

Periodic player saves replay through the temporary ledger. Trusted-room recordings now retain automatic player checkpoints, including their original request, fingerprint, room state and player boundary. Replay verifies the unchanged player and room fields and carries their revisions forward; the temporary ledger commits and retries those checkpoints. A longer two-traveler journey recorded two periodic saves, replayed four accepted transactions and four retries plus a refusal, and had no recorded room-state gaps. An altered checkpoint was rejected; gameplay-travel and shared-physics regressions passed. The studio screenshot shows the journey and saves. Checkpoints made during cargo handling or disconnect are not yet captured by this path. Gameplay, rewards, creator programs, moving bodies and system transactions remain outside temporary-ledger replay; broader qualification, performance and the final art pass remain open. Overall completion percentage is not measured.

Travel and return replay in the temporary ledger. New recordings retain the engine hash, allowing the isolated ledger to recreate and verify the pinned release. Supported travel and return requests now rerun the actual ledger's destination checks, arrival, commit and retry; a compact two-traveler journey also replayed an out-of-reach refusal and rejected a mismatched engine. The studio screenshot shows the recording used. Older takes may supply DW_REPLAY_ENGINE_HASH when their engine differs from the fallback. Traveler positions used by gateway sensors are recorded; peer identities may be synthesized. Periodic player checkpoints can still introduce unrecorded revision gaps, so longer journeys can fail rather than silently bridge them. Gameplay, rewards, creator programs, moving bodies and system events remain outside this ledger path; broader qualification, performance and the final art pass remain open. Overall completion percentage is not measured.

Rule-rejected actions replay through the temporary ledger. New recordings retain the original request for rule-rejected actions as an attempt, and the isolated ledger reruns supported refusals, checks the recorded reason, and verifies that no durable state or transaction row changed. A live two-player take replayed two exact rejected attempts alongside three accepted transactions and retries; an altered refusal reason was rejected. Older takes also replay supported refusals from normalized proofs. The studio screenshot shows the recording. A rolled-back attempt's fingerprint is computed from the request, not read from a committed ledger row. Rejections without a matching rule proof and gameplay, rewards, creator, moving-body, travel and system transactions remain outside this path; broader qualification, performance and the final art pass remain open. Overall completion percentage is not measured.

Original transaction requests replay in the temporary ledger. New takes retain the original command and the fingerprint stored by the source ledger. Studio replay checks the pair, and npm run replay:ledger -- <recording.json> uses the original command for supported transactions, compares the temporary ledger's fingerprint, and retries it. With DW_REPLAY_DATABASE_URL set, a live two-player take passed three exact requests and retries; the source fingerprints were checked directly and an altered request was rejected. The studio screenshot shows that take. Older recordings still replay from normalized proofs and report zero exact requests; fingerprints are integrity comparisons, not signed attestations. Rejected requests, gameplay, rewards, creator programs, moving bodies, travel and system events remain outside the temporary-ledger path. Wider qualification, long-take performance and the final art pass remain open. Overall completion percentage is not measured.

Ordinary transactions replay through an isolated PostgreSQL ledger. Download a shared-movement recording and run DW_REPLAY_DATABASE_URL='<postgres-url>' npm run replay:ledger -- <recording.json>. The command creates connection-scoped temporary tables, seeds the recorded initial room and player states, reexecutes supported accepted interactions and container transfers through the actual ledger, and retries each transaction. It reports completed transactions, retries, skipped rejected actions and observed shared-state gaps. A live two-player pickup/deposit/withdraw take replayed three commits and three retries, and a stopped source room's transaction count remained unchanged; the studio view shows the recording used for the test. Commands are reconstructed from proofs, so their original request fingerprints are not verified. This first path excludes gameplay, rewards, creator programs, moving bodies, travel and system events; rejected actions are reported but not reexecuted. Full SQL transaction replay, broader qualification, long-take performance and the final art pass remain open. Overall completion percentage is not measured.

NPC decisions consume reconstructed player and room state. Replay now reruns NPC navigation and damage using available reconstructed gameplay states for every traveler and reconstructed shared combat state, then checks both player and room results. A live two-traveler take passed with reconstructed inputs and was reviewed in the studio. Inputs without reconstructed states still fall back to recorded values; wider multiplayer combinations, full SQL transaction replay, long-take performance, qualification and the final art pass remain open. Overall completion percentage is not measured.

Unchanged player state carries across verified actions. Replay can now carry unchanged inventory, gameplay and keepsakes across eligible verified actions when the surrounding player snapshots agree, instead of automatically treating every revision as a gap. A live physical interaction followed by a pickup replayed both inventory and keepsake transitions with no gaps; creator, combat and NPC recordings passed, and the studio view shows the result. Actions without sufficient proof or matching snapshots remain gaps; NPC damage and mixed player changes need wider coverage. Full SQL transaction replay, broader qualification, long-take performance and the final art pass remain open. Overall completion percentage is not measured.

Gameplay and keepsake decisions carry forward. Replay now carries each player's saved gameplay and keepsakes through verified ability, travel, NPC damage and reward transitions, with separate gap counts for revisions it cannot reconstruct. A two-player combat take replayed four gameplay and four keepsake transitions; a live navigation take also passed, and the studio view shows the result. NPC recomputation still uses recorded states for other travelers; unsupported player changes remain gaps. Full SQL transaction replay, broader qualification, long-take performance and the final art pass remain open. Overall completion percentage is not measured.

Player inventory decisions carry forward. Replay now carries each traveler's recorded inventory through verified pickup and container decisions, using saved boundaries and explicitly counting gaps where intervening player revisions lack a reconstructable inventory decision. A live pickup and a two-player pickup/deposit/withdraw recording passed; the studio view shows the pickup and its preceding gap. This covers inventory only; gameplay, rewards and unsupported player revisions remain separate observations. Full SQL transaction replay, broader qualification and the final art pass remain open. The repeated-replay container test ran close to its 90-second timeout, so replay performance needs review. Overall completion percentage is not measured.

Room physics consumes reconstructed authority inputs. Replay now supplies available reconstructed room states and creator component projections to a second physics-owner pass and verifies its results; missing authority inputs still use the recording. A live creator-spawned body take and a door-revision take passed, a deliberately altered authority input was rejected, and the studio view reports the inputs used. This adds a physics pass when reconstructed inputs are available; long-take performance and additional mixed-history cases remain to measure. Full SQL transaction replay, broader qualification and the final art pass remain open. Overall completion percentage is not measured.

Movement runs from reconstructed room state. For movement segments that use a reconstructed shared state, replay now runs a second simulation pass using that state and verifies the final movement checkpoint; uncovered samples use their recorded state. Live physics, creator, combat and NPC takes passed, as did a two-rider cargo round trip on both backends. The studio screenshot reports replayed samples. This adds a second pass for affected segments; long-take performance remains to be measured. Gaps, full SQL transaction replay, broader qualification and the final art pass remain open. Overall completion percentage is not measured.

Creator and system changes advance the room-state cursor. Replay now applies the already reexecuted creator projection to the current room state and recomputes combat respawns and NPC movement from it. Live creator, combat and navigation takes carried their verified transitions without authority gaps, and the creator take was reviewed in the studio. Unrecorded transitions and incomplete creator recordings can still create gaps; SQL transaction reexecution, broader mixed-history qualification and the final art pass remain open. Overall completion percentage is not measured.

A room-state cursor carries replayed actions forward. Replay now runs supported interaction, travel and container decisions again against a shared cursor; verified physical and cargo transitions advance the same cursor, and movement samples are linked to reconstructed states. Unhandled transitions start an explicitly counted authority gap rather than being silently treated as replayed. A live gate-and-pickup take carried two transitions without a gap, rejected a divergent reducer result, and was reviewed in the studio. Creator and system changes still create gaps in this cursor; SQL transaction reexecution, mixed-history qualification and the final art pass remain open. Overall completion percentage is not measured.

Same-frame room ordering recorded. New takes include an order for actions, system changes and creator response observations, so verified transitions in the same frame can be checked in commit order. A focused test rejects inverted same-frame changes, and live room and creator recordings passed; the studio view shows the new counter. That live example has no same-frame changes, so an end-to-end live same-frame case remains to test. Older takes without order metadata remain readable but cannot provide this check. Full SQL transaction replay, broader mixed histories, qualification and the final art pass remain open. Overall completion percentage is not measured.

Room transitions checked against the recorded timeline. Reconstructed shared-state transitions now carry the frame of their verified source, and replay rejects revisions that go backward across distinct frames. The studio reports the checked transitions; a live gate-and-pickup take and a creator-driven take passed, while an inverted-order test was rejected. Transitions in the same frame remain unordered, and gaps are still disclosed rather than reconstructed. Full SQL transaction reexecution, broader mixed histories, qualification and the final art pass remain open. Overall completion percentage is not measured.

Nearby travelers linked to spawned-body replay. The recorder now links eligible nearby travelers' interaction positions to their movement boundaries, and the studio checks those positions when replaying the body interaction. A live two-traveler Rapier take and the studio view passed; changing the recorded peer position was rejected. Peers supported by moving bodies and unavailable movement boundaries remain unlinked; the live check used one peer. Full transaction replay, broader qualification and the final character/environment/arrival art pass remain open. Overall completion percentage is not measured.

Final physics events retained. Recording snapshots now keep ordered physics interactions, revisions, cargo and creator changes that occur after the last simulation step, with a zero-step replay boundary. Authored and multi-place interactions passed focused checks on Rapier and owned backends; a modified target was rejected. A studio replay of a live take shortened at the interaction was visually reviewed, and the live two-way cargo regression passed on both backends. A live recording stopped precisely at a cargo or revision boundary and mixed terminal events still need focused coverage. Full transaction replay, broader qualification and the final character/environment/arrival art pass remain open. Overall completion percentage is not measured.

Spawned-body interactions join room replay. A physical interaction with an authored body under multi-place ownership is recorded with its inputs, checkpoint and shared-state transition; replay reexecutes the interaction and checks it against the accepted action and traveler movement. A live PostgreSQL room and the studio screenshot passed, and a modified target was rejected. The live run used Rapier. Interactions after the final physics step, movement linkage for other travelers near the object, owned-backend live coverage, full transaction reexecution, broader qualification and the final art pass remain open. Overall completion percentage is not measured.

Shared physics replay increment delivered. Trusted room takes now retain bounded spans of committed room-owned physics steps. The studio reexecutes those steps using the recorded backend and reports discontinuities between spans; it does not rerun the transactions that caused them. Focused tests passed on both backends, a PostgreSQL-backed live room recorded and replayed a take and rejected an altered result, and the studio was visually reviewed. Use npm run dev:movement, record in Keep shared movement, finish, and choose Replay in studio; worlds without room-owned physics retain the existing movement-only format. Full ordered room transaction replay, linking recorded traveler contacts to movement, performance, long recordings and broader qualification remain open. The full-plan estimate remains roughly 85%, with substantial uncertainty.

Physical interactions now replay within a physics span. The recorder retains accepted room-body interactions between committed physics steps, and replay reruns the physical interaction and checks its resulting frame before continuing. A live trusted-room gate reversal and focused tests on both backends passed; an altered interaction was rejected. The studio screenshot shows the live take and interaction count. Interactions after the last recorded physics step are not included, and the action inputs are not yet linked to movement or reexecuted SQL transactions. Changes affecting physics configuration can still produce separate spans; full ordered shared-room replay and qualification remain open. Full-plan progress remains approximately 85%, with substantial uncertainty.

Physics-to-action links delivered. Newly recorded physical interactions carry their committed operation identity; replay checks the matching accepted room action, traveler, target and frame ordering before reporting a linked action. A live gate interaction passed and an altered room action was rejected; older takes without operation identities remain replayable. The studio view shows the link. This is a cross-check of recorded actions, not a reexecution of SQL transactions or proof of the interaction pose from movement. Mixed and interrupted histories, full transaction replay and qualification remain open. The approximate full-plan estimate remains 85%, with substantial uncertainty.

Physical interaction positions linked to movement. For an eligible interaction without moving-body support, the recorder saves the admitted movement boundary, and replay checks its place and position against the reexecuted traveler state. A live gate interaction passed; an out-of-range boundary was rejected. The studio screenshot shows the checked position. Supported riders and contacts used by ordinary physics steps are not yet linked, and full ordered room transaction replay and qualification remain open. Approximate full-plan progress remains 85%, with substantial uncertainty.

Traveler contacts linked to replayed movement. Eligible room-physics steps retain each traveler’s movement boundary; replay checks contact position, velocity and grounded state against the reexecuted traveler. The live gate take checked these contacts and rejected an invalid boundary, while both physics backends and the browser studio passed focused checks. The studio screenshot shows the contact count. Travelers supported by moving bodies are excluded for now; complete shared transaction replay, long or mixed recordings, and qualification remain open. Full-plan progress remains approximately 85%, with substantial uncertainty.

Verified physics in the replay world view. The studio now projects reexecuted room-body poses into the world view at traveler movement ticks when the exact physics frame can be matched, falling back to observed poses otherwise. A live gate take verified the presentation inputs, and a Chromium journey opened and scrubbed the world view. The displayed sample can lag between physics steps; moments without a movement tick and full transaction replay remain open. Art is provisional; broader qualification and the final art pass remain required. Full-plan progress remains approximately 85%, with substantial uncertainty.

Movement now links to replayed room-physics frames. Replay matches each traveler movement input to reexecuted physics by authority sequence and checks the complete frame; a live recording passed and an altered input was rejected. The world view uses these exact matching frames, rather than inferring them from host-time proximity. The replay world view was reviewed in Chromium. Frames outside captured physics spans remain observed inputs, and full room transaction replay, wider qualification and final art are still open. Full-plan progress remains approximately 85%, with substantial uncertainty.

Physics continues across ordinary room changes. A physics span can now continue when shared state changes without changing the doors or props that configure room physics, provided the native checkpoint is continuous. A live gate reversal followed by a light pickup replayed without a physics gap; both physics backends and the browser world view passed focused checks. The pickup transaction itself is not fully reexecuted, and physics-configuration changes, cargo, mixed histories and broader qualification remain open. Approximate full-plan progress remains 85%, with substantial uncertainty.

Shared interactions replay in body-enabled rooms. Interaction proofs now retain body membership, so replay can rerun ordinary interaction rules and reconstruct shared state and inventory outcomes even when the room contains moving bodies. A live gate reversal followed by a light pickup passed, reconstructed the pickup room transition, and rejected an altered pickup receipt. The studio screenshot shows the replay and resulting inventory. SQL transaction execution, mixed cargo crossings, other action types and broader qualification remain open. Approximate full-plan progress remains 85%, with substantial uncertainty.

Door physics revisions replay within the room. A recorded change to the room physics configuration can now be applied through the real physics-owner revision path before later simulation steps, instead of always creating a gap. A live 3D room opened its door while a moving body was present, replayed the room and door action without a physics gap, and rejected an altered revision result. The studio screenshot shows the opened door. The revision uses captured shared state; linking that input directly to the action proof, multiple changes between steps, cargo and full transaction replay remain open. The live revision used Rapier; the broader owned-backend and qualification checks remain to do. Full-plan progress remains approximately 85%, with substantial uncertainty.

Physics scene revisions now link to room actions. When the recorded action reducer produces the revision configuration, the replay connects that action to the physics-owner revision and checks identity, ordering and shared state. A live 3D door action passed and an unrelated operation was rejected; the studio screenshot shows the linked change. Unsupported revision sources remain observed inputs, and multiple changes between steps, SQL transaction replay, broader qualification and the final art pass remain open. Approximate full-plan progress remains 85%, with substantial uncertainty.

Ordered room-physics changes. A physics step can now retain an ordered sequence of interactions and scene revisions, so mixed changes between steps replay in the same order rather than automatically splitting the physics span. Focused tests interleaved two interactions and two revisions on both backends, rejected reordered events, and replayed the older format; live door and gate/pickup takes passed. The studio screenshot shows the live door take. Multiple events in a real room, cargo, full SQL transaction replay and broad qualification remain to review. Full-plan progress remains approximately 85%, with substantial uncertainty.

Authored cargo crosses within shared physics replay. A recorded cargo handoff can now be applied in order to the same room-physics owner, using the recorded transaction preparation and checking its resulting checkpoint before continuing. A live crossing with two riders and an observer replayed with no physics gap and rejected an unrelated action; the studio screenshot shows the riders at the destination. The live check used Rapier and authored bodies. Spawned-body ownership, owned-backend live crossings, SQL transaction reexecution, broader qualification and final art remain open. Full-plan progress remains approximately 85%, with substantial uncertainty.

Spawned cargo crosses within shared physics replay. Multi-place spawned-body owners now record and reexecute their committed physics steps and cargo handoffs in the same replay history. A live two-rider round trip passed on both Rapier and owned backends, with both crossings included; the studio screenshot shows the destination. Creator-driven body additions and removals can still split spans; SQL transaction replay, broader qualification and final art remain open. Full-plan progress remains approximately 85%, with substantial uncertainty.

Creator-driven spawned bodies replay in shared physics. The room now records the creator-driven physics preparation in sequence, including its admitted traveler positions and resulting native checkpoint. Replay applies the preparation to the same owner and checks the checkpoint before continuing. A live take raised the stones without a physics gap and rejected an altered checkpoint; the studio screenshot shows the result. The existing two-rider cargo round trip also passed on both backends. Program inputs are recorded observations, not yet linked directly to replayed creator results; removal, longer mixed sessions, full SQL transaction replay and the final art pass remain open. Overall percentage is not measured.

Creator state linked to spawned physics. When a creator response is recorded, the spawned-body preparation now carries the corresponding creator-event ordinal. Replay compares the physics input to the reexecuted creator state before counting the link. A live stone-spawning take passed and a link to the wrong creator event was rejected; the studio screenshot shows the scene. Takes without a complete creator recording retain unlinked physics inputs; removals, broader mixed histories, full SQL transaction replay and the final art pass remain open. Overall percentage is not measured.

Spawned-body removal replays. A take can now retain a final creator physics change even when no further room-physics tick occurs. A live recording raised and rested the stones, replayed both creator-linked changes without a physics gap, and the studio screenshot shows the cleared scene. Focused final-change checks passed on both physics backends. Longer mixed sessions, SQL transaction replay, broader qualification and the final art pass remain open. Overall percentage is not measured.

Rider contacts linked to movement replay. Physics contact samples now include travelers supported by moving bodies, and replay checks their recorded support along with position, velocity and grounded state. A live two-rider spawned-cargo round trip passed on both backends; an altered support was rejected. The studio screenshot shows the take. Action alignment on moving bodies, full SQL transaction replay, broader qualification and the final art pass remain open. Overall percentage is not measured.

Rider alignment replays. Cargo preparation and ordinary actions taken while supported by a moving body now retain the alignment frame; replay reruns the rider carry and compares the resulting movement checkpoint. A live two-rider cargo round trip passed on both backends and rejected an altered alignment frame; a separate live room also replayed an ordinary action taken from a moving deck. The studio screenshot shows the round trip. More complex mixed actions, full SQL transaction replay, broader qualification and the final art pass remain open. Overall percentage is not measured.

Physical actions join the shared room history. Recorded body interactions now carry the room state observed before and after the committed action. Replay links the physical interaction to its accepted action, checks the shared revision and unchanged fields, and joins that transition to the reconstructed room history. A live gate reversal followed by a pickup reconstructed both transitions with no room-state or physics gap; an altered physical transition was rejected. The studio screenshot shows the result. SQL transactions themselves and broader mixed histories remain to qualify; final art remains open. Overall percentage is not measured.

A first powered 2D hinge is implemented in the editor, world format 61 and the shared planar solver. Focused checks pass on both backends, including room-authority continuation and checkpoint restore; the editor controls were visually reviewed. Slow motors now retain their velocity instead of being marked asleep. The browser journey saved and published the mechanism and admitted one player. The second player's simulation and room connection became ready, but graphics creation did not finish before startup timed out; this recurred with worker and main-thread rendering in software Chromium. The two-player visual journey remains unverified; see TILEMAPS.md.

Hinges can now have authored upper and lower travel limits, including powered hinges, through world format 62. Both stops pass focused tests on both backends with checkpoint continuation; room authority and fork continuation also pass. A one-player browser journey authored, published and entered a limited mechanism and the editor was visually reviewed. The earlier same-process browser graphics failure still prevents claiming a two-player visual journey for this specific manual hinge. Unpowered impacts, high loads, hosted play and the final art pass remain for qualification.

Creators can now make a powered hinge switchable by players; the room commits its on/off state and solo saves retain it. World format 63 gates the new behavior. Focused room-checkpoint and solo-save tests pass on both backends, and a browser journey authored, published and switched a motor off with the interaction visible. Two-player rendered observation, concurrent interaction and hosted restart remain to review. See TILEMAPS.md.

The turning garden provides a playable, editable starting world with a reversible gate and collectible light. Creators can choose direction reversal or on/off behavior for player-controlled motors; reversal uses world format 64. Focused tests drove the gate to both stops, restored it while reversing and drove it forward again on both backends; browser tests operated the gate and authored another reversible hinge. The editor control was visually reviewed. Template creation remaps planar-joint references as well as object identities. The unrelated ferry objective no longer appears in worlds without its crate. Its geometric art is provisional, and the two-player software-renderer issue remains open.

Pressure areas can now drive 2D motors in the room, turning one way when occupied and reversing when empty. The garden threshold is an editable example. Format 65 gates the feature; template copying remaps the area reference. Focused tests cover traveler and body occupancy, both physics backends and room checkpoint restoration, and a browser journey created and operated the example. The editor and player views were visually reviewed. The same-browser-process graphics issue, hosted process restart and final art remain open. See TILEMAPS.md.

2D mechanism milestone delivered for early playtesting. Two independent software Chromium processes joined the same garden; the second traveler observed the gate turn as the first entered the pressure area, then saw it reverse after the first left. The shared view was visually reviewed in the milestone screenshot. This does not resolve the earlier same-browser-process graphics startup failure, qualify other devices or verify a hosted process restart. The final character/environment/arrival art pass remains required. The full-plan estimate remains roughly 85%, with substantial uncertainty.

The owned solver now matches persistent contact impulses by nearby physical contact point when a manifold reorders, and applies up to four bounded position-correction passes. In one 240-step stack fixture the top box settled at approximately 3.340 m, compared with 3.276 m before the correction change. Focused owned-physics, body, character, compound, continuous-collision, hinge, vehicle and ragdoll checks passed, and the stack was visually reviewed in the physics lab. The sphere still rolls off the stack; broad stability, performance and backend equivalence remain to qualify. The overall estimate remains approximately 85%, with substantial uncertainty.

Delivered recording workflow; full replay remains open. A first usable movement take is available with npm run dev:movement on port 5214. Join the room, open its printed private editor link, expand Keep shared movement, start a take, walk, then finish it. Choose Replay in studio to open and verify the saved take directly, or download it for later. A two-traveler browser journey verified the direct editor-to-studio handoff; the editor key is not included in the studio URL, and the controls were visually reviewed. A two-traveler socket test and an editor/download/replay browser journey passed; the controls were visually reviewed. Finished takes are retained on the persistent authoring volume across room restart. A sealed take is saved before verification; if verification is interrupted, the editor offers Recover and verify after restart. A live restart test recovered and replayed a sealed creator take and confirmed lease fencing; the recovery control was visually reviewed. On a healthy planned shutdown, the host first saves travelers and then attempts to seal an active take for recovery without waiting for replay. A connected-traveler restart test recovered a creator take. During a take with creator responses, the editor also offers Finish now: it keeps the committed creator prefix and completed job results without waiting for outstanding jobs, marks an incomplete take, and allows a new recording to start. A live room test checked the partial replay and next start; the control was visually reviewed with representative data. Concurrent result timing, long takes and shutdown deadlines remain to qualify. If a creator job is still pending at shutdown, the host can seal a partial take retaining movement, observed room events, committed creator events and completed job results; unfinished job results are absent. If the creator snapshot is unavailable, it falls back to a movement take without creator responses. The editor and replay identify these limitations. A live pending-job restart test recovered and verified the committed creator prefix without rerunning external jobs; the new replay wording still needs visual review. Running takes now save a recoverable checkpoint roughly every 450 host frames without ending the take. If the room stops unexpectedly, Recover and verify can restore the last saved prefix, which is labeled because later activity may be missing. Completed creator results are retained when available; unfinished jobs are marked incomplete. A live pending-job test restored checkpoint bytes after restart and verified the saved prefix without rerunning jobs; the recovery labels were visually reviewed with representative data. This test simulated the interrupted file state rather than killing the host process. Checkpoint I/O, abrupt process death, long takes and storage failures remain to qualify. Failed seals or a stop before the first checkpoint can still leave a take incomplete; long takes and shutdown deadlines remain to qualify. The broader host lifecycle run timed out in the database-loss and storage-failure-during-drain cases. An isolated rerun passed the storage-failure case; database-loss timed out again after 30 seconds but passed a subsequent instrumented rerun in 22 seconds. Its timing remains to qualify. Creators can opt to Continue in a new take when full. The host seals each bounded take and starts the next separately named take before verifying the previous one in a separate process; there can still be an unrecorded gap during the handoff. Continuation stops at the eight-take workspace limit or if the next take cannot start, and the editor shows the reason. New continued takes retain a series identity across room ownership changes. Once two or more takes are verified, choose Replay series in the editor and use Previous take and Next take in the studio. Each take is loaded and checked separately through the open same-origin editor; gaps, removed takes and unfinished takes are disclosed. Download series now packages the verified takes as a single JSON file for later use without the editor. Open it in replay studio and use the same take navigation; each take is independently checked in the browser. Series are limited to eight takes and 128 MiB, with a 16 MiB per-take replay limit. A browser fixture downloaded a synthetic two-take series, closed the editor and replayed both takes; malformed manifest checks passed. Large files, mobile memory use and a live-room series export remain to qualify. A two-traveler test checked ordered saved metadata, an ownership-change test checked persistence, and a browser fixture checked forward/back navigation and the closed-editor message. The browser fixture used sample replay data rather than a live multi-take journey. Takes made before series metadata was added remain individually replayable; reconnecting an open series and live end-to-end series playback remain to qualify. Pending creator jobs can make the preceding take partial. A two-traveler live test checked that the next take starts while the first is verifying and replayed successive takes; the status was visually reviewed with representative data. Sealed takes remain recoverable after interrupted verification. An attempted eight-take run exceeded its 20-second polling window; the full limit, sustained worker resource use, long sessions, chat notice timing, packaged live deployment and restart behavior remain to qualify. Takes now support up to 16,384 combined traveler ticks and finish automatically before their tick, size or action limits; the editor shows usage. Traveler locks are released after the take is sealed, before verification. A two-traveler live test confirmed automatic completion, replay and resumed movement; a 4,100-tick take verified beyond the previous limit, and the editor usage display was visually reviewed. The usable duration varies with traveler count and recorded state size; large response recordings and sustained load still need qualification. Takes with creator programs also finish early near the linked response event, byte or job-result budget, and the editor shows the creator-event count. A live recording with an artificially near-full result budget sealed and replayed successfully; the status was visually reviewed with representative data. Bursts of large responses and many pending jobs still need qualification. They include traveler IDs and names, nearby names, shared item state, private inventory revisions, and private ability state including resources and cooldowns captured for replay. New takes preserve each traveler’s name at first entry; the map, selector, event list and world view use it, with distinct labels for duplicate names and numbered fallbacks for older takes. A live join/reconnect recording verified the saved name, and a representative browser fixture checked labels, duplicates and older-take fallback and was visually reviewed. Name changes during a take remain represented by the first name. The editor can optionally include room chat in a take; it is off by default and the editor states that messages are exported. Opted-in messages appear in the timeline and downloaded result as observed text, not reexecuted transactions. A live two-traveler take recorded both sides of a conversation, a default take omitted chat, and a representative browser check covered scrubbing, literal text and the opt-in control. Chat is capped at 512 messages with an early stop near the limit; large bursts remain to qualify. Players now see an in-game recording indicator on the chat button and in the chat panel while opted-in chat capture is active, including when they join after it starts; older clients receive a room notice in chat. A live two-traveler test checked start, stop, late join and a default-off take, and the chat notice was visually reviewed with representative data. Full mobile layout and reconnect timing remain to qualify. New takes also sample each traveler’s saved inventory revisions and gameplay state at movement-segment start and end, including reconnect and travel boundaries. Replay validates these snapshots and compares matching player revisions with recorded action and NPC inputs; the studio reports the boundary count. Creator-room, travel, NPC-combat and join/reconnect recordings passed; an inconsistent same-revision inventory was rejected, older takes remain compatible, and the summary was visually reviewed with representative data. These are sampled durable states, not reexecution of every player transaction. New takes also capture each acting traveler’s owner-visible inventory, keepsakes and gameplay state after ordinary recorded transactions, including creator actions and declined attempts. The studio lists these snapshots by action and lets the owner jump to their timeline position; matching player revisions are cross-checked with recorded proofs and boundaries. A shared combat test captured an earned keepsake at its action, rejected a conflicting snapshot and replayed an older take; a representative browser fixture checked the display and navigation. Snapshots are observations, not full transaction reexecution. Cargo action snapshots, large action lists, privacy review and full live studio playback remain to qualify. For supported recorded reward actions, replay now reconstructs award eligibility from the verified interaction and ability result, checks the before/after owner-visible keepsakes and marks earned keepsakes on the traveler’s timeline. The random identity and award time are recorded inputs; replay does not issue another award. A shared combat take checked earned and ineligible outcomes, rejected altered award data and replayed older takes; a focused fixture covers an already-owned keepsake. The timeline marker was visually reviewed with representative data. Creator-driven rewards, multiple rewards and full database transaction replay remain to qualify. New boundaries also include owner-visible keepsakes, with same-revision consistency checks; server-only award audit data remains excluded. A shared combat recording captured an earned keepsake, a conflicting same-revision fixture was rejected, and the snapshot panel was visually reviewed with representative data. The studio now lets the owner inspect each selected traveler’s saved inventory, keepsakes and resources at these boundaries and jump to the corresponding timeline position. A creator-room recording verified timeline delivery; a representative browser fixture checked traveler switching and navigation and was visually reviewed. Downloaded room replay results now include these private snapshots. The selected traveler’s latest captured resources now appear while playing or scrubbing, including verified ability, travel and NPC damage results as well as segment boundaries; the display notes that intervening changes may be missing. A live two-traveler NPC-and-ability recording confirmed the event data, and a representative browser fixture checked scrubbing and traveler switching and was visually reviewed. Full live studio combat playback, same-frame ordering for older recordings without player revisions, and mobile layout remain for qualification. The selected traveler’s latest captured inventory is also shown during playback, using verified pickup and chest transfer receipts as well as segment boundaries. A two-traveler pickup/deposit/withdraw recording confirmed the event data, and a representative browser fixture checked scrubbing and traveler switching and was visually reviewed. Unrecorded changes and full live studio playback remain for qualification. The exact interval between saved boundaries and unrecorded player transactions remain to qualify. Takes include an ordered journal of accepted and declined shared actions. For supported actions, new takes link the admitted traveler position to the recorded movement checkpoint sampled before the transaction; the studio reports how many positions it checked. A two-traveler chest browser journey and travel/return recording passed; altered positions were rejected and older takes replay without this check. NPC and combat recording checks also passed. Yaw and floating-support positions remain unlinked. New takes also link other travelers’ positions in supported interaction and travel decisions to their recorded movement when the published pose matches the sampled motion. The studio reports the number checked. A two-traveler chest browser journey rejected an altered peer position and older takes replayed; a two-traveler travel/return recording also passed. The updated summary wording was visually reviewed with representative data. Stale, untracked and floating-support observations, and yaw, remain unlinked. For actions handled by the shared interaction reducer, the take records the authority’s input state and the studio reruns that decision. New takes also reconstruct the resulting shared state for successful non-ability interactions, including pickup and equipment, and compare consecutive action inputs when the room revision is unchanged. A two-traveler pickup/equip/stow journey checked three results and an action link in the studio; an altered pickup result was rejected. New ability takes also record host time and private resource inputs, then reconstruct channel start/completion, combat damage, retaliation and shared results using the same transition as the host. The live transaction checks its saved player result. A two-traveler guardian fight, a studio replay, channel fixtures and altered-result rejection passed. npm run dev:sentinel now prints a private editor link so the fight can be recorded; automatic guardian respawns in non-navigating rooms are now recorded with host time and before/after shared state, replayed against the combat rules, and shown as room events in the studio. A two-traveler defeat-and-return browser journey, altered-time rejection, event-frame projection and older-take compatibility passed. Navigating NPC takes now capture host time, traveler positions and before/after private gameplay state, and rerun navigation, attacks, respawns and resulting shared state. New takes also link eligible NPC traveler inputs to their exact recorded movement checkpoints at the host sampling boundary; the studio reports the number checked. A two-traveler pursuit and attack passed in the studio, including moving travelers; altered positions, NPC and damage states were rejected, and older takes remain compatible. New takes also link ability inputs and NPC damage states that share a durable player revision; the studio reports those checks. A two-traveler attack-then-ability journey rejected a separately consistent but mismatched player state, and older takes still replay. Intervening revisions and other transaction types are not reconstructed. Travelers on floating supports are not yet linked. npm run dev:watch now prints a private editor link for recording. Long NPC takes, navigating respawn combinations and full transaction replay remain open. Intervening unrecorded mutations remain outside this reconstruction. Eligible chest deposits and withdrawals also rerun the authority’s reach, ownership, capacity and item-revision decision and reconstruct the item transfer; the live database update is checked against that result. For new takes, replay also checks the inventory, item ownership, stored revision and chest count against the recorded input state, then reconstructs the entire resulting shared state, including equipment removal. New takes also capture and verify each accepted transfer’s before/after inventory and player revision against the live receipt; the studio reports those receipt checks. Verified non-pickup interactions now retain before/after player inventory receipts as well, connecting pickup, equip, stow and supported ability actions through matching player revisions. The replay timeline can show these captured inventory states. A two-traveler pickup/equip/stow test verified the links, rejected an altered inventory and replayed an older take; a shared combat recording also passed. The inventory display itself is unchanged; full live studio playback and other transaction types remain to qualify. Pickup receipts now also capture the item revision change and before/after player inventory, and replay links pickup and chest receipts that share a player revision. A two-traveler pickup/deposit/withdraw studio journey rejected an independently valid but conflicting item revision; older takes without receipts replay. Ground-item history before the take and intervening inventory transactions are not reconstructed; stale retry with pickup receipts still needs qualification. The studio reports these checks; older takes remain replayable. A two-traveler recording test verified deposit, withdrawal, stale retry, altered inventory and unrelated shared-state rejection, and older-take compatibility; the existing shared-chest regression hit the room-busy guard during admission twice and remains to rerun. Full database transactions and other action kinds are still not replayed. For supported installed programs, a take also captures and verifies program responses and saved job results without rerunning external jobs. A combined server and browser journey passed, including pending-job retry and interrupted-take recovery. New takes deduplicate repeated shared state and cross-check shared and collision snapshots for travelers recorded on the same host frame. A two-traveler browser test confirmed the compact take is smaller than its expanded equivalent and reports the cross-checked frames; a tampered same-frame reference was rejected, a creator-response take passed, and older take profiles still replay. New takes also link observed creator-response batches to the public program state: replay reconstructs that state and compares it with the recorded room state and subsequent traveler input when available. The studio reports how many creator states it checked; older takes replay without those links. A saved-job recording and a two-traveler cargo journey on both physics backends passed, including the studio display and altered-state rejection. New takes also require a single shared state for each recorded room revision across movement, interaction and cargo decision inputs, creator responses and room events; the studio reports reused revision links. Two-traveler NPC and chest journeys rejected conflicting but independently valid state and decision inputs and retained compatibility with older takes; combat, creator, chest and two-backend cargo takes passed. Replay now joins individually verified interaction, transfer, NPC and eligible creator-program transitions into contiguous shared-revision spans, and reports gaps between recorded states in the studio and downloaded result. A focused fixture covers consecutive transitions, missing revisions and conflicting state; a two-traveler recording checks the live action chain. A live creator-job recording also reconstructed a creator transition without rerunning the job; older recordings still replay. Creator transitions are linked only when the immediately preceding shared revision and both program projections match and no other shared fields changed. New recordings also tie an accepted creator interaction to its exact transaction-recorded program event and before/after room states, allowing its room revision to be reconstructed even when the public projection is unchanged. A live creator-job recording verified the link, rejected a different program event and replayed an older take; a focused fixture checked unchanged projections. Broader mixed creator histories and full transaction replay remain to qualify. Replay also carries the earliest program projection across a contiguous batch observed at the same host boundary, so eligible batched updates can join the room history. A focused fixture covers a two-event batch, boundary changes and projection discontinuities; the live creator-room recording still passes. Real multi-event batches, missing earlier states and mixed NPC/creator histories remain to qualify. The summary was visually reviewed with representative data. This does not reconstruct unrecorded transitions or prove full synchronized authoritative room re-execution; changes before the first or after the last recorded state are outside the gap count. New takes also preserve a common host-frame timeline; the studio can play and scrub a top-down map of the travelers, recorded actions and observed committed response events. A two-browser journey and a two-traveler room test passed; the map was visually reviewed. The studio now offers searchable, paginated access to all recorded moments, including those beyond the former 128-marker limit; selecting a traveler’s action also follows them. A browser check with 150 sample actions covered later-page selection, search and empty results; the controls were visually reviewed. Long real recordings and mobile layout remain to qualify. The top-down map now caches path geometry for forward playback and rebuilds it when scrubbing backward, avoiding repeated reconstruction of all movement samples. A 16,000-sample two-traveler browser fixture matched the previous drawing at forward and backward positions, including a rejoin gap, and was visually reviewed; an automated fixture covers path rebuilding. Real long sessions and device performance remain to qualify. The studio also offers a world view using the saved authored scene and reconstructed traveler positions; a browser journey verified opening, scrubbing and closing the view, and the interior camera was visually reviewed. It can follow any recorded traveler and projects the shared state seen during that traveler’s replay, including item and door changes. Linked action and creator-response states now also update the world view at their recorded host frame, even without a following movement tick; projection uses a separate simulation and leaves verified checkpoints unchanged. A two-traveler pickup/equip/stow browser journey, a final-action fixture, and a saved creator-job result at its recorded frame passed. The studio projects event-driven scene changes throughout a long segment instead of stopping after 256 events. Same-frame shared updates are now combined for world projection: the last state at that frame is displayed, while the original recorded events remain in the take. The timeline groups same-frame room observations into a counted moment. A 400-update fixture verified the final state and a later frame without a gap, and the resulting world and timeline were visually reviewed in a browser. Intermediate changes within one frame are not individually visible; events across many distinct frames can still reach the projection budget. To bound bursts, it skips events after 256 changes between movement ticks, marks the gap, and resumes projection after the next tick if the shared 30-second projection budget is not exhausted. A focused simulation fixture with a reduced burst limit checks continued projection and recovery. Event projection now forks the current verified simulation using its compiled world instead of recompiling it each time; a focused fixture checked checkpoint equality, isolation and scene changes. In a local three-fork comparison, the prior checkpoint path took 5.2 seconds and the new path 1.9 seconds; this is not a general performance guarantee. The 30-second scene projection budget remains, and long takes, other world configurations and device performance still need qualification. If the scene size limit is reached, the world view keeps the last reconstructed scene while traveler movement continues and labels the paused world changes. The studio also offers ½×, 1×, 2× and 4× playback speeds. A focused browser fixture checked the speed and fallback behavior, and the controls were visually reviewed; real long takes and mobile layout remain for qualification. Forward playback applies new changes incrementally; backward scrubbing rebuilds the selected frame. Focused fixtures cover both limits; long recordings and other creator-response types need qualification. The world view now uses the same animated traveler rig as play, derives movement poses from each verified simulation, and shows supported equipped items as they are carried or stowed. It now also retains authored patrol characters and their recorded poses, including forward playback and backward scrubbing. This is currently available for compatible imported replay data only: persistent trusted rooms reject patrol worlds, so the shared recording demo cannot yet produce those takes. A focused simulation fixture and browser world-view fixture passed and were visually reviewed; long recordings, patrol conversations, actor limits and device performance remain to qualify. The existing scene budget may limit long recordings, and the view omits patrols beyond the 32-actor render limit with a note. A focused two-traveler recording verified equip/stow, backward scrubbing and visible lantern attachment; a combined equipment-and-reconnect attempt timed out before a replacement connection and remains to review; unsupported attachment models are identified in the view. The movement demo now includes a portable lantern in the Quiet Garden and uses a new room/save, preserving previous demo data. A two-traveler join/reconnect browser journey confirmed walking animation. Jumping, swimming, seated and ragdoll presentation need further visual qualification, and the user-requested final character art pass remains open. An editor replay run hit a canceled result download, and its follow-up timed out while loading the studio; the result URL now stays available longer, but that full journey needs another qualification run. A two-traveler browser journey verified switching viewpoints and both scene histories; a recorded lantern pickup and backward scrub were checked in the browser. Playback now projects recorded spawned rigid-body and shared-platform poses as well as host-owned authored body positions over each traveler’s reconstructed scene without changing the verified simulation. A focused fixture checked stone and lift positions, and a browser world-view fixture was visually reviewed before and after movement; real long recordings and other body configurations remain to qualify. Playback previously added authored-body projection; a focused fixture checks the displayed transform and unchanged checkpoint, and authored-cargo and editor/replay browser journeys passed. The editor journey initially hit a temporary admission-pressure rejection; the player now retries explicitly retryable pressure responses for up to 15 seconds, and the journey passed afterward. Recorded authored ragdoll body poses now drive the replayed physical skin without modifying verified simulation state. A focused joint fixture and existing physical-skin tests passed; a browser world-view fixture was visually reviewed before and after a recorded body-pose change. Real shared ragdoll takes, other poses and device performance still need qualification. Changes not observed in movement ticks and complete synchronized creator/action reconstruction remain open; frames beyond the scene projection budget retain the last reconstructed scene with a notice. Older takes remain verifiable but lack that map. Guests can join, leave and reconnect during a take; each uninterrupted movement segment is verified and the timeline marks the gaps. A live socket and browser journey verified reconnect, same-account tab replacement, rejected altered segments and the selected traveler view. Ordinary portal travel and return-to-entry continue the take as verified segments, with place markers and automatic following in playback. Eligible travel recordings now also rerun the authority’s gateway reach, behavior, sensor and requirement checks and arrival choice, and compare successful arrivals and revisions with the saved receipt. A two-traveler round trip covered acceptance, an out-of-reach rejection and tampered arrival/receipt rejection; its replay was visually reviewed. Arrival collision clearance and full SQL transactions are not replayed, and poses requiring relocated body membership remain observed rather than checked. New takes also reconstruct the room revision produced by accepted travel and return, checking that the rest of the shared room state remains unchanged and joining those transitions into the room history. A two-traveler round trip reconstructed both revisions, rejected an altered result and replayed an older take without recorded room results. Full transaction replay and mixed travel/creator histories remain to qualify. New gameplay-enabled travel and return proofs also reconstruct saved gameplay changes and link matching player revisions; the studio reports the checks. A two-traveler round trip checked both transitions, altered gameplay rejection and compatibility with older takes. A focused rule fixture covers channel cancellation and recovery on return after defeat; those paths still need live-room qualification. The summary was visually reviewed with representative text. A two-traveler browser journey tested a round trip, including the movement demo’s new quiet garden and its creator program. Spawned rigid cargo crossings now retain the take: rider alignment and committed handoffs form separate verified movement segments, and cargo markers identify the observed crossings. A two-rider round trip passed on both physics backends and was visually reviewed in replay. Authored linked cargo now also records two riders and a nearby observer, including cancellations during freeze and preparation with their reasons. A focused live-room and browser journey verified the completed crossing and canceled attempts. Accepted cargo crossings now capture the ledger’s original native checkpoint and committed rider receipt. Replay reruns the production preparation and reconstructs the saved rider poses and revisions, checking them against that receipt. Spawned two-rider round trips passed on both backends, authored linked cargo passed on Rapier, and altered physics and rider results were rejected. The replay studio reports the preparation checks. Accepted cargo crossings now also record their resulting shared state and reconstruct the room revision when the remaining room state is unchanged. Two-rider round trips on both physics backends and an authored cargo handoff joined the room history; an altered room revision was rejected. Older cargo takes without a recorded result remain supported but were not rerun in this check. SQL atomicity, eligibility checks, clearance and alignment boundaries are not reexecuted; disconnects during handoff and other unrecorded mutations need broader qualification. New takes record the host’s known shared state at both the start and finish, and journal changed shared states when the host broadcasts them, including updates between movement ticks. The studio marks these boundaries; they are observed host state, not database transaction replay. A creator-room and two-traveler recording passed, a no-movement fixture rejected a missing finish boundary, and the markers were visually reviewed with representative data. A live creator-room recording checked the initial observation, and a focused fixture projected it in the world view without any movement ticks; the baseline is an observed host state, not a replay of prior history. The studio projects these observations at their recorded frames and labels them as observed; the journal does not reexecute their transactions. A focused fixture checked a final update with no later movement tick and rejected an invalid traveler boundary; a two-traveler live-room recording captured and replayed the published states. The marker was visually reviewed with representative data. The journal is capped at 4,096 observations and the recording finishes early near that limit. Long live-room recordings, scene appearance and unbroadcast changes remain for qualification. Response markers record when the host observed committed events and link observed public program state to replay where available. Complete authoritative transaction replay, fully synchronized room re-execution, complete dynamic scene reconstruction and broader qualification remain unfinished. The earlier 98% estimate is superseded by the revised estimate above.

Historical updates below retain their original percentages; those estimates are superseded by the current estimate.

Dynamic plugin entity lifecycle delivered for early playtest. Spawned entities have declared behaviors, jobs, trusted interactions, graceful removal, fixed boxes, kinematic platforms and room-owned rigid boxes. Creators can now tune an existing rigid prototype in the editor and start a separate shared room from an exported draft; interactions follow the body's current committed position. Travelers can now visit another place while rigid bodies remain in their shared home place. Spawned rigid and fixed boxes and simple authored dynamic boxes can coexist in one shared place, including moving spawned platforms. Next extend the lifecycle to bodies that move between places, while retaining the full engine objective. Authored linked bodies, ragdolls and rafts now coexist with spawned rigid bodies. Spawned-body crossing can stage source and destination native owners and atomically commit the body and riders. The live room can run a multi-place owner behind an internal option, and client simulations can prepare and restore spawned residency. The Stone Passage now offers a playable spawned-body portal crossing; a two-browser run carried a rider and stone to the garden while another traveler observed. Two riders now cross in both directions and rejoin after a room restart in focused socket tests on both physics backends. A browser rider now reconnects on the moved stone; a two-rider visual check and final art remain to review. A two-player bridge action with the editor open succeeded, but slow autosaves under that workload can still delay actions and require performance review. Whole-room/movement recording, scene/program migration, final character/environment/arrival art and thorough qualification remain required. Approximately 98% overall is a rough scope estimate, not passed acceptance of every roadmap gate.

Spawned cargo is in progress. Both physics backends can stage a spawned box and rider across a portal without changing the live scenes, transform their motion, restore the destination checkpoint, reject blocked arrivals and detect stale preparations. A multi-place owner keeps identities through a staged crossing and program removal, and its checkpoint can be saved and restored under a fenced PostgreSQL lease. Ordinary saves reject changes of place. The cargo transaction now commits a spawned body, two riders, receipt and outbox together; focused PostgreSQL tests cover injected rollback, retry, restoration and owner fencing. A live room can now opt into multi-place ownership internally; two browsers created spawned stones, and a separate two-traveler test covered authored-body interaction and restart. Client simulations can now prepare destination collision, appearance and rider support and restore their checkpoint on both physics backends. The live cargo coordinator now freezes, prepares and commits spawned-body crossings; a focused PostgreSQL/socket test crossed one rider and rejoined on both physics backends. Client preparation, commit and admission recovery passed on both backends, and the existing authored-cargo transaction regression passed. Run npm run dev:passage and open http://localhost:5213/ in two browsers. Raise the stones at the lantern, jump on the middle stone and press E at the golden gate to carry it to the garden. A software-rendered two-browser run completed that crossing with one rider and one observer; the scene was visually reviewed. The presentation remains provisional: the nearby portal can fill the view, and final character, environment and arrival art are not approved. A focused PostgreSQL/socket test carried two riders to the garden and back, restarted the room and restored both riders on both physics backends. Gate exits were raised slightly to clear resting floor contact on the owned backend. The adjusted example uses a new room and database, preserving the earlier passage save. A two-browser journey also reloads the rider after crossing and verifies the same traveler and support. A two-rider browser run, broader regressions and performance remain to review. Approximately 98% overall.

Rafts and spawned stones share one room. Run npm run dev:cove for The Stone Cove on port 5212 (.data/stone-cove.1). Raise the stones, walk to the jetty beyond the court, step or jump aboard and press E for a driver or passenger seat. The room owns seat reservations and drives the raft. Both physics backends passed focused helm, seat, driving and checkpoint tests; a two-player browser test observed the helm and movement, and a PostgreSQL/socket test covered shared ownership and restart. The cove was visually reviewed; art remains provisional. Actual browser boarding from shore, passenger riding, disconnections, broader load and final qualification remain to be reviewed. Approximately 98% overall.

A mannequin and spawned stones share one room. Run npm run dev:puppet for The Stone Puppet on port 5211 (.data/stone-puppet.1). Raise the stones at the lantern, then find the mannequin behind the bridge and press E to tip or reset it. Another traveler occupying its standing position blocks a reset. Both physics backends passed focused mixing, reset and checkpoint checks; a two-player browser test observed the tip and a PostgreSQL/socket test verified shared state, restart and idempotent retry. The scene was visually reviewed and its art remains provisional. Review direct browser reset, broader load and the full qualification and final art pass. Approximately 98% overall.

Linked authored stones share a room with spawned bodies. Run npm run dev:links for The Linked Stones on port 5210 (.data/stone-links.1); raise the stones at the lantern and explore the linked pair beyond the right side. Both physics backends pass focused coexistence and checkpoint-restoration checks, and a two-browser run received the linked pair and spawned stones. The scene was visually reviewed; art remains provisional. The bridge action subsequently succeeded for both players with the editor open. Slow autosaves delayed a previous run; in-flight retries are now coalesced, but this does not eliminate the underlying latency. Direct multiplayer manipulation of the pair, load and restart qualification remain open. The existing dev:atelier room is unchanged. Approximately 98% overall.

Shaped and hinged authored bodies share the room. Run npm run dev:atelier for The Stone Atelier on port 5209 (.data/stone-atelier.1). Raise the stones and lift, then approach the little bridge and press E to raise or lower it. A shaped arch and the bridge coexist with spawned rigid and kinematic bodies. Focused checks on both physics engines cover the authored shapes, shared hinge state and checkpoint restoration; PostgreSQL checks cover the bridge action, duplicate requests and stale revisions. A two-browser journey now reaches and operates the bridge, with both travelers receiving its raised state. Earlier attempts exposed a short lease renewal window under load and a route through obstacles; the room now uses a 15-second lease and the journey takes the clear side. A focused stall check confirms the host stops publishing after its confirmed lease expires. Crash recovery may take up to the lease duration. The scene was visually reviewed and remains provisional. Usage and deferred review retain linked bodies, rafts, ragdolls, transfers, qualification and final art. Approximately 98% overall; the full plan remains active.

Moving platforms and rigid bodies share one room. Run npm run dev:lift for The Stone Lift on port 5208 (.data/stone-lift.3). Raise the stones, wall and moving lift at the lantern; try riding the lift or moving a stone onto it. The room owns both the platform and rigid motion, while travelers receive reconciled poses. Both physics backends pass focused checks for a rigid stone lifted by the platform, rider carry during reconciliation, hosted lifecycle and checkpoint restoration. A two-browser journey passes shared movement, restart, removal and response replay. The lift scene was visually reviewed; its art is provisional. Usage and deferred review retain broader riding, latency, transfer, qualification and final art. Approximately 98% overall; the full plan remains active.

Authored-block interaction delivered. In npm run dev:workshop, approach the copper block and press E to push it. The room verifies reach against the current native pose and commits the impulse with the interaction receipt. Focused PostgreSQL checks pass on both physics engines for the push, duplicate requests, stale revisions, out-of-reach requests and checkpoint restoration. A two-browser journey confirms the push moves the shared block, then restarts and replays the response recording. Remaining kinematic/advanced body mixing, transfer, qualification and final art stay open. Approximately 98% overall; the full plan remains active.

Authored and spawned boxes share one room. Run npm run dev:workshop for The Stone Workshop on port 5207 (.data/stone-workshop.1). The copper authored block, spawned stones and fixed wall use one physical authority; walking contact and body-to-body collision move them together. Both physics backends pass focused tests for spawned-to-authored contact, frame reconciliation and checkpoint restoration. A two-browser journey passes shared creation, restart, removal and response replay. The workshop was visually reviewed; its art remains provisional. Usage and deferred review retain advanced body types, transfers, full qualification and final art. Approximately 98% overall; the full plan remains active.

Mixed collision replica correction. Fixed objects in a rigid-enabled room now install and remove their collision in each player's physics scene, including across checkpoint restoration. Previously the authority had the wall but a player's replica could omit it. Focused Rapier and owned checks cover blocking and removal; rigid travel and room checks remain passing. The two-browser journey also passes wall contact, restart, removal and response replay. The Stone Garden's provisional art, remaining body types, body transfer and final qualification are still open. Approximately 98% overall; this correction does not change the estimate.

Mixed spawned rigid and fixed bodies delivered. Run npm run dev:mixed for The Stone Garden on port 5206 (.data/stone-garden.1). Raise the stones and wall together; stones can be pushed against the fixed obstacle, and both travelers see the shared scene. Fixed obstacle membership and rigid checkpoints commit atomically, including fixed-only changes and restart. Both physics backends pass native tests for obstacle admission, contact, removal and restoration. A two-browser journey passes shared creation, restart, removal and response replay. The scene was visually reviewed; art is provisional. Usage and deferred review retain a browser push retest, kinematic/authored mixing, transfer, qualification and final art. Approximately 98% overall; the full plan remains active.

Travel around spawned rigid bodies delivered. Run npm run dev:crossing for The Stone Crossing on port 5205 (.data/stone-crossing.1). Raise the stones, then visit the garden while another traveler pushes one; return to see its current shared position. Native travel and checkpoint restoration pass with both Rapier and owned physics. A two-browser journey passes travel, movement while away, return, restart, removal and response replay. Type/import/generated checks and the client build pass. The garden was visually reviewed; its simple art remains provisional. Usage and deferred review cover mixed body types, body transfer, network qualification and final art. Approximately 98% overall; final qualification and the full plan remain active.

Moving-body interactions and creator settings delivered. Run npm run dev:rolling for The Rolling Stones, release 2 on port 5203 (.data/rolling-stones.2). Move a stone and press E to leave a shared memory; reach uses the host's committed body pose and physics revision, not the spawn pose. In the printed private editor, find ember.prototype, choose Spawned physics, change density, grip or bounce, preview and save. Export the draft, then run npm run dev:rolling -- --draft /path/to/exported-draft.json for a separate room on port 5204. Existing room state and the earlier release 1 database are retained. Six focused PostgreSQL checks pass across Rapier and owned, covering moved-pose reach, stale-revision rejection, restart, and existing spawned behavior/job paths; a focused authoring check covers validation and undo/redo. The two-browser journey passes moving contact, shared interaction, restart, editor save/reload and response replay. The exported-draft launcher starts and shuts down cleanly; client and retained-engine builds and type/import/generated checks pass. The editor dialog was visually reviewed. Usage and deferred review retain authoring a new contract, multi-place/mixed bodies, live revisions, broad network/backup qualification and final art. Approximately 98% overall; the full plan and final qualification remain active.

Shared spawned rigid boxes delivered (release 1). The initial Rolling Stones room used port 5203 and .data/rolling-stones.1; the launcher now starts release 2 as described above. Raise the stones, walk into one to move it, restart to retain its position, and have the other traveler rest the stones. The host commits program lifecycle and native body checkpoints together, saves motion under the room lease, and supplies body poses to client prediction. Two focused PostgreSQL journeys pass across Rapier and owned, including stale-revision rollback, restart and safe removal; two native journeys cover contact and individual membership changes. The two-browser Rapier journey verifies walking contact, both server traveler replicas, restart, removal and exact response replay with three saved results. The client/retained-engine builds, launcher health/shutdown and type/import/generated checks pass; the scene was visually reviewed. Usage and deferred review retain editor/current-pose interactions, multi-place/mixed bodies, live revisions, backup and deployment qualification, and final art. Approximately 98% overall; the full plan and final qualification remain active.

Moving spawned platforms delivered. Run npm run dev:rising for The Rising Steps on port 5202 (.data/rising-steps.1). Raise the stones at the lantern, take a short run-up and jump aboard while they are low, then ride upward. Both travelers see the touch count; another traveler can rest the stones and return the rider to the ground. Native geometry carries the rider and authoritative platform frames support motor corrections. Public targets do not rebuild static geometry; shape changes require a new identity. Two PostgreSQL/native journeys pass on Rapier and owned, including admission, carry, shared poses, ownership, checkpoints, correction, restart, removal and replay. Two fixed-collision and six existing trusted-motion checks pass. The real two-browser journey passes with shared touch, lift, restart, removal and exact exported replay of three saved results with zero external execution. Type/import/generated checks and the production build pass; the ride view was visually reviewed. Usage and deferred review retain rigid bodies, obstacle/crush and edge-jump behavior, disconnected riders, latency, transfer, deployment and final art. Approximately 98% overall; full qualification remains unfinished.

Fixed spawned collision delivered. Run npm run dev:solid for The Solid Steps on port 5201, using .data/solid-steps.1. Raise the stones, walk into them, jump onto the first one and leave a warm memory. A second traveler can rest them, dropping the first traveler safely to the ground. Host placement admission defers occupied spawns while holding live movement; saved offline poses also reserve space. Live native checks supersede stale saved poses. Clients project the same box shape into native physics and rendering; fixed IDs cannot move/resize. Six focused native/PostgreSQL checks pass: two cover physical contact, admission, checkpoint, restart, interaction, removal and replay on Rapier and owned physics; four retain existing behavior/job/farewell coverage. The real two-browser journey passes with standing restart, shared response, removal and exact replay of three saved results with zero external execution. Type/import/generated checks and the production client build pass; contact and homecoming views were visually reviewed. Usage and deferred review retain moving bodies, floating-body coupling, transfer, high-latency qualification, performance, deployment and final art. Approximately 98% overall; the full program remains active.

Graceful spawned removal delivered. Run npm run dev:embers, wake the lights and call them home. Both travelers see Lights welcomed home increase by three; the count survives restart. The owner invokes onDespawn on an isolated draft, consumes queued/farewell events into declared writes and commits those effects with removal. Failed hooks and invalid later writes leave the live owner unchanged. New jobs are rejected during farewell; existing job claims are cleaned up on commit. Release/operator revision 3 uses .data/listening-embers.3 and retains earlier revision adapters/databases. Six focused native/PostgreSQL checks pass, including rollback, fault handling, pending removal, durable count and exact replay. The real two-browser journey passes with the visible count and replay of six saved results with zero external execution. Type/import/generated checks and the production client build pass; the counter UI was visually reviewed. Usage and deferred review preserve large-store draft cost, event routing/backpressure and broader fault/deployment qualification. Physical presence and final art remain unfinished. Approximately 98% overall remains a rough full-plan scope estimate, not completed acceptance.

Live spawned interactions delivered. Run npm run dev:embers; wake the lights, walk to the right of the lantern and approach an ember. At Share your warmth with this ember, press E to grow/shrink that light for both travelers. Release/operator revision 2 uses .data/listening-embers.2, preserving the previous demo database. Host admission checks the actual entity/binding, place and trusted reach; removed identities cannot act on their replacements. Five focused native/PostgreSQL checks pass, including forged pose rejection, wrong-place/private/removed targets, client checkpoint restore, persistence and exact native replay. The real two-browser journey checks touches by both travelers, shared state, restart, removal/respawn, and replay of six saved results with zero external execution. Type/import/generated checks and the production client build pass. Interaction/replay UI were reviewed. Usage and deferred review retain physics, graceful removal, target framing/density, authoring controls and broad qualification. Approximate full-plan progress remains 98%; this ships the interaction increment without claiming the remaining lifecycle and final art gates are complete.

Spawned behavior/job owners delivered. Run npm run dev:embers for The Listening Embers. Wake the lights, wait about two seconds for their individual saved results to make them grow, restart to retain them, then call them home. Permissioned spawn binds native state, execution, outbox and jobs atomically. Deletion removes claims in the same room transaction; the runner aborts vanished owners even at full capacity and ignores late results. Seven focused native/PostgreSQL checks pass, covering binding permissions, restart, pending deletion/late completion and existing dynamic/operator replay paths. The two-browser capture/restart/despawn/respawn journey passes and replays six saved results with zero external executions. Type/import/generated checks, client/retained-engine builds and isolated launcher health/shutdown pass; the visible result and replay were reviewed. Usage and deferred review retain interaction/physics, graceful removal hooks, broad fault/device/backup cases and final art. Approximate full-plan progress remains 98%; lifecycle work stays active until those required capabilities are implemented.

System-owned dynamic entities delivered. Run npm run dev:dynamic for The Drifting Lantern. Touch the lantern to wake three moving lights, restart to retain them, touch again to remove them and touch once more to create fresh identities. The native system declares namespace/capacity permissions; the format-60 release pins its public component, authored asset prototype and transform projection. Clients reconcile creations/updates/deletions through their native ECS renderer. Two focused lifecycle checks pass, including real PostgreSQL persistence, client checkpoint restoration, capability/atomicity checks and exact recording replay. Three existing public-program checks pass. The real two-browser owner journey captures spawn/update/restart/despawn/respawn and replays the exported recording. Type/import/generated checks, client/retained-engine builds and isolated launcher health/shutdown pass. The visible lit/resting scenes were reviewed. Usage and remaining review explicitly retain bound dynamic behaviors/jobs, physics/interaction, broad fault/ device/model qualification and final art. Approximate full-plan progress remains 98%; the larger lifecycle milestone stays active.

Native operator/sensor recording delivered. Run npm run dev:record-native for The Remembering Garden. Start a capture in its printed private editor, touch the shared lantern, then visit the quiet garden to the right of arrival and walk onto/off the golden sensor circle. Finish, download and replay the file. Bundled adapters restore private bindings/components, run native systems in host order and consume saved job results; admitted sensor events share the durable program timeline. Two native PostgreSQL journeys pass, plus the existing portable recording check. Both real browser capture/restart/export/replay journeys pass, including two-player sensor presentation. Eleven existing sensor checks pass. Type/import/generated checks, client/retained-engine builds and isolated launcher health/shutdown pass; the garden and replay result were visually reviewed. Usage and deferred review retain extended fault/device/backup cases and additional historical adapters. This captures response programs and admitted sensor occupancy, not whole-room motion. Approximate full-plan progress remains 98%; final art is not approved.

Hosted response capture/export delivered. Run npm run dev:record, open its printed private editor URL and expand Keep a response replay. Start recording, touch the lantern in the shared room, finish and download the recording, then open it in the replay studio. The owner-only capture survives host restart and reproduces the exact private response checkpoint with zero external executions. One focused PostgreSQL journey covers atomic rollback, pending jobs, missing results and an incomplete journal; one real two-browser journey covers capture, shared response, restart, download and browser replay. Type/import/generated checks, client and retained-engine builds, isolated launcher health and shutdown pass. Both interfaces were visually reviewed. Usage and review notes retain fault/load/backup/device qualification and the explicit unsupported profiles. This records the response runtime; it does not record the whole room's movement, inventory or combat. Approximate full-plan progress remains 98%.

Live hosted program revisions delivered. Run npm run dev:live and open the printed private editor URL. In release.light → Behavior, change package settings, preview, Save changes, then Apply saved revision. The persistent room keeps both travelers and their shared progress. The real browser journey preserves a three-touch counter through editor Apply, continues to four, rejects a structural change, adopts the explicit native v1→v2 counter migration, continues to six and preserves six after host restart. Two focused revision/SQL checks, three existing program checks and three wire checks pass. Type/import/generated checks, client/retained-engine builds and launcher health smoke pass; the visible result was reviewed. The new runnable demo provides an isolated database so older retained engines are not mistaken for the current build. Usage and remaining review retain live fault/device/load qualification, broader scene/program/entity migration, production replay capture and final art. The input protocol is version-pinned; old input content/streams and revision acknowledgements stay fenced.

Browser creator-job replay delivered. Open /diagnostics.html and choose Try the lantern recording, or import a recording from npm run replay:record. The browser restores the world/program checkpoint, follows ordered inputs, consumes saved job results and requires an identical final native checkpoint. Replays never invoke an external executor. Missing results, wrong payloads/bindings, ambiguous request identities and mismatched targets reject. Eleven focused native job checks pass; the real browser plays the sample, rejects missing results, recovers with a valid import and releases its worker. The interface was visually reviewed; client/ retained-engine builds pass. Usage and review notes retain production capture/export, native-program adapters, streamed traces, fault/ device qualification and final art. This adds the supported portable browser flow, not every replay gate in milestones 6/13.

Public plugin state and stopped-room upgrades delivered. npm run dev:public launches The Living Lantern on port 5195. Two travelers see a shared touch counter from a declared native component. Public contracts validate on the host/client, private state stays private, and projections enter native client checkpoints. Explicit component migrations upgrade a stopped room while preserving its counter; missing contracts and pending jobs reject before changing state. Three focused native/database checks, the two-browser upgrade journey, existing upgrade transaction checks and wire checks pass. The shared display was visually reviewed. Type/import/ generated checks and client build pass. Usage and review notes retain uninterrupted upgrades, hosted editor Apply, dynamic-entity projections, field-level network deltas, replay integration, broader qualification and final art. This is a bounded authored-entity profile, not full roadmap 11/13 closure.

Creator async installation delivered. npm run dev:creator launches The Creator Lantern on port 5194. A saved JSON package requests an approved job and lights the object for two players after its saved result; the light survives host restart. The editor imports packages with explicit capability review, Save and Undo/Redo. Operator job grants and exact contracts are checked independently; missing policy rejects. Five focused package/database checks and the real two-browser restart journey pass; the editor installation/Save/Undo journey passes. Type/import/generated checks, client and persistent builds pass. Usage and review notes retain hosted editor Apply/live migration, richer projections, replay-tool wiring, full qualification and final art. This delivers the supported async profile; it does not close all of roadmap 11/13 or claim approved final art.

Durable operator programs delivered. npm run dev:programs launches The Listening Lantern on port 5193 with its own database. One touch starts a saved private coordinator/job; both players receive its light, including after a host restart. Installed program/grant identity is pinned; claims precede execution, results commit before delivery, interrupted claims fail without automatic rerun, and old leases cannot commit late results. Private ticks do not consume public room revisions. Focused PostgreSQL/extension checks and a real two-browser restart journey pass; the new tables are in the backup catalog. Type/import/generated, persistent build and launcher start checks pass. Usage and remaining work retain wider projections, program upgrades, retry UI, retention/capacity/backup qualification and final art. This does not close roadmap 11/13 or claim an approved presentation pass.

Restricted jobs and recorded native replay delivered. npm run demo:restricted-jobs runs a restricted JSON package with explicit job grants, records its typed lookup result and reproduces an identical native checkpoint without repeating external I/O. Source/policy hashes pin its executable revision. Replay checks exact ticks, request identity and binding scope; missing or mismatched records fail explicitly. All 17 focused script/job checks, type/import/generated checks and the client build pass. Contract and remaining implementation retain journal/crash qualification, browser replay wiring and broader qualification. This is a terminal SDK increment; no new browser scene or final art approval is claimed.

Operator plugins and scoped panels delivered. npm run demo:plugins installs an independent SDK package with components, behavior, a native system, typed job, authoring command and panel. Native state survives checkpoints and an explicit component version migration. In the editor, Panel workshop → The garden palette provides finishes through the normal proposal, Save and Undo flow. The real browser journey updates two connected travelers. Three plugin checks and 33 affected behavior/simulation/panel checks pass; type/import/generated checks and client build pass, and the panel was visually reviewed. Usage and remaining implementation retain restricted jobs, durable shared native components/host loading, replay and broader qualification. This delivers an operator installation API, not unrestricted creator JavaScript or full milestone-11/13 acceptance.

Typed asynchronous job API delivered. npm run demo:jobs runs a public-SDK catalog lookup through the native simulation and restores its completed state. Typed requests/results have bounded queues, explicit failure/cancellation, later-tick delivery, atomic hook staging and stale-entity/binding fencing. Queued work is cancelled on recovery without repeating external effects. The six new cases and 22 existing behavior/simulation checks pass, along with type/import/generated checks, the runnable example and client build. Contract and review notes retain creator/plugin integration, durable shared jobs, result-stream replay and broader qualification. This is a trusted engine API increment; it adds no browser scene and does not close roadmap 13 or the final art requirement.

Generated binary room transport delivered. Browser clients, cooperative relay and persistent host negotiate a versioned generated catalog; the router forwards it and JSON remains available via wire=json. Shared input metadata, stable message IDs, field/component dictionaries and bounded readers reject malformed frames. The mixed-encoding room/relay checks and real two-browser interaction/reload pass. A measured 78-message trace used 32.7% fewer raw bytes, with explicit CPU/header tradeoffs; compression and optional presentation quantization remain disabled. Contracts, comparison and deferred review retain full payload/device/network/routing qualification and the remaining envelope and schema-coverage audit. This is a transport increment, not closure of roadmap 6.

Restricted extension installation delivered. npm run dev:extensions launches The Shared Lantern on port 5192. An independent JSON package declares private state, typed settings and bounded capabilities. Two players alternate touches to awaken a shared lantern and unlock a keepsake; progress survives reload. Installation uses revisioned authoring commands with exact undo and an explicit CLI. The response editor selects installed packages and validates settings. Focused native/database, two-browser and editor-form checks pass; type/import, client builds and CLI install pass. Usage and deferred review retain package migrations, broader native/system/panel/async plugin contracts, deployment/device qualification and final art. This completes the restricted installation increment, not all plugin requirements or milestone 11.

Shared NPC encounter delivered. npm run dev:watch launches The Watch Garden on port 5191 in a separate saved room. The guardian notices travelers, follows an authored route around cover, attacks, returns home and respawns. Both players see the same moving target; damage and defeat persist. Focused reducer, checkpoint, PostgreSQL and real two-browser checks pass, including reward/reload. Type/import and client build checks pass; arrival and pursuit were visually reviewed. Usage and deferred review retain flat/static navigation limits, motion/art/signage polish, query/retention budgets, faults and device qualification. This delivers the bounded NPC profile, not full milestone-11 acceptance or final art approval.

Shared target combat delivered. npm run dev:sentinel launches The Sentinel Garden on port 5190 in a separate saved room. Two travelers damage one guardian, receive individual retaliation, claim their own reward and see its finite timed respawn cycle. A downed movement-save blocker and immediate-satchel reward refresh are fixed. Focused pure/PostgreSQL checks, type/import/client build and the real two-browser fight/reload/respawn journey pass; arrival and defeat were visually reviewed. Usage and deferred review retain stationary-target limitations, NPC work, migration, faults and final art. This completes this combat increment, not the full reusable-gameplay milestone.

Trusted resource and ability trial delivered. npm run dev:trial launches The Lantern Trial on port 5189 with its own PostgreSQL and retained engine. Two travelers can gather sparks, manage vitality/focus, recover at a spring, light shared seals and keep a personal reward. Host-checked abilities support costs, windup, cooldown, cancellation, resource damage, downed/revival and saved state. Focused pure/database and two-browser checks pass; the HUD was visually reviewed. Usage and deferred review distinguish this resource-effect trial from unfinished entity combat/NPCs and preserve the final character/environment art pass. Broader qualification remains open; this is a usable increment, not milestone-11 completion.

Public SDK and independent game delivered. npm run dev:meridian launches a two-place cooperative puzzle on port 5188, with a private atelier and separate room storage. Its source uses only packages/sdk, and portable releases pin the SDK/compiler with checked content. Two real players completed the puzzle, unlocked the terrace and reloaded; the editor saved and published a revision. Two native checks, the browser journey, type/import and client/relay builds pass. Usage and review notes retain deployment, API distribution, richer modules and final art approval. This delivers a public content API and second game; it does not complete milestone 11.

#Release-candidate reconciliation — October 26

The older chronological matrix is historical. This bounded source review selected missing implementation; it is not the final requirement-by-requirement acceptance audit. The previous 98% estimate was too optimistic. Do not count tests or bookkeeping as progress, or assume optional enhancements are release blockers.

Order: finish the required SDK/gameplay path, codec path and async/plugin path; resolve any additional explicit implementation gaps found in the full-plan audit; then final art and thorough qualification. Full milestones 0–18 remain scope.

Large retained creator models delivered. Generated/imported models use immutable workspace artifacts while the notebook keeps a compact reference. Review, shared playtesting and explicit Save resolve the same verified content; normal undo and exact retries remain available. Usage and review notes record storage quotas, coordinated backups, archive/cleanup and broader device qualification. Focused delivery evidence is recorded there.

Account-backed authoring roles delivered. Owners can invite player accounts as workspace owners, editors or viewers. PostgreSQL keeps role membership and role events; server writes and undo identity use the authenticated account. Existing workspace keys and deployment-owner recovery remain usable. The native account-role check, both legacy access checks, account-role backup restoration and the real owner/editor/viewer browser journey pass. Type/import, client and relay builds pass; the invitation panel was visually reviewed. Setup and review notes retain coordinated draft/database restoration, in-flight requests, hosted and device qualification, complete auditing and final art approval.

Account-aware regional doorway delivered. Players can sign in, choose an invited room and return to their account traveler without creating a guest first. The gateway checks room membership, retains routed ticket identity and explicitly rejects hosts without account support. Guest matchmaking remains available. Two profile-specific gateway checks, the guest capacity check and the real two-browser inventory/entry/logout journey pass; type/import and regional build checks pass. The doorway was visually reviewed. Usage and remaining review retain production release rollout, simultaneous tabs, accessibility/device checks, account-backed authoring roles and final art approval.

Private player accounts delivered. Invited players can sign in across browsers, return to their saved traveler, or explicitly link an existing guest. PostgreSQL retains exclusive ownership; key replacement, membership revocation and logout invalidate subsequent account admission. The private operator CLI ships in the persistent/regional images, and backups include account ownership. Cooperative/trusted service checks, the operator CLI, two-browser inventory return and an account-inclusive archive restore pass. Type/import, client and account command builds pass; the account screen was visually reviewed. Usage and review notes retain regional selection, live-socket revocation, unified authoring roles, hosted/device qualification and final art approval.

Durable traveler recovery delivered. npm run player:recover lists saved travelers, prepares a private replacement file, and applies it while the room is stopped. The atomic PostgreSQL operation preserves player/inventory/rewards, revokes old keys, fences old owners and retains a retry-safe receipt. The player asks before using a recovery link and keeps existing credentials on cancellation or rejection. Four native/service/CLI checks and the real browser journey pass; the same-tab recovery-link issue found by the browser check is fixed and verified. Type/import, client and control builds pass; the confirmation and returned world were visually reviewed. Operator workflow and review notes retain global accounts, old pinned clients, routed tickets, process-kill and hosted deployment/backup qualification.

Named workspace access delivered. The atelier's People & access panel issues individual owner/editor/viewer keys, changes roles, replaces keys and revokes access. The server enforces save/apply/publish boundaries, binds named members' undo/task acceptance to their identity, and retains hashed membership with a bounded change record. Two native/service checks and the real three-role browser journey pass; editor save/reload and revocation are verified, and the access panel and viewer scene are visually reviewed. Type/import and harness client/engine builds pass. Usage, limits and review notes retain public/global accounts, player recovery, complete mutation attribution, shared-directory coordination and broader crash/deployment/device qualification.

Trusted multiplayer assistant playtests delivered. Two isolated player identities can execute bounded input scripts against the real trusted server and PostgreSQL ledger. Each retains observations and screenshots; movement, place, shared-presence and durable-save assertions determine the recorded result. Six native/tool checks, four local-service checks, the existing cooperative browser journey and the standalone trusted journey pass. Seven gameplay assertions pass and the loaded room was visually reviewed. Type/import checks pass. One combined-run startup timeout remains explicitly unqualified; see usage and review notes.

#Delivered increments and their remaining qualification

Owned rigid-body backend and physics atelier delivered — approximately 94% overall. The new engine-owned implementation runs primitive/convex contacts, friction/bounce, ball/distance constraints, sleep/wake, bounded translation CCD and snapshots without Rapier. npm run dev:physics opens three interactive studies at port 5182 with drop/nudge, pause/single-step, persistent local snapshots and the Rapier reference selector. Four focused native checks, a software-WebGPU browser journey and type/import/package checks pass; desktop/narrow views were reviewed. Owned physics notes record measured solver differences and missing features. This delivers a runnable core, not the production switch.

Owned walking and triangle terrain delivered for early testing — still about 94% overall. Study 04, A path underfoot, adds the existing traveler with WASD, jump/run, steps, a ramp and a moving lift. The new owned capsule controller uses BVH-backed mesh/primitive queries, and its motor/support state survives snapshots. The authored static-scene adapter consumes existing Place/input/state conventions. Four new native checks, four prior rigid-body checks and two software-WebGPU journeys pass; the course/traveler view and packaging are checked. Walking notes retain player/body interaction, extended-system integration, collision edges, movement feel, full comparison/replay and hardware qualification.

Owned hinges, limits and motors delivered for early testing — about 94% overall. Study 05, Weight & intention, provides a loaded drawbridge with raise/lower, an angle target and motor release. The owned solver constrains hinge anchors/axes, enforces angular stops and caps position/velocity motor torque per step. Snapshots retain targets and joint frames. Four new native checks plus the prior eight pass; all three software-WebGPU atelier journeys, type/import and packaging checks pass, and the raised mechanism was visually reviewed. Mechanism notes retain wrap-edge, load/chain/energy, full replay/device qualification and production adapters.

Owned production player integration delivered for early testing — still about 94% overall. Open /?solo=1&physics=owned on the normal player server to walk and jump through the Lantern House with separate local saves. Backend choice survives recovery, reset, travel and live revisions. Doors, authored platforms, route synchronization and exact checkpoint continuation now use the shared simulation interface. Three owned native checks, existing checkpoint/routes/ revision suites, two software-WebGPU player journeys and type/import checks pass; the player view was reviewed. Integration notes record extended-system gaps and deferred qualification. Shared play retains Rapier. The later ragdoll increment below enables Collapse in owned solo mode.

Owned authored bodies and water delivered for early testing — approximately 95% overall. Existing Willow causeway/Alder gate publications now run in owned solo mode: dynamic imported props, powered hinges, linked decks, buoyancy, swimming, pushes, saved body motion and initial rider carrying. Density edits retain motion; geometry edits reset connected assemblies and reject overlap. Three new runtime checks, the existing owned suites and type/import checks pass. The software-WebGPU journey creates/publishes Willow causeway, raises its linked decks, reloads the saved motor target, lowers them and boards the crossing; both views were reviewed. Body integration notes retain rider/contact gaps, hostile-state and full comparison/device qualification. This is a usable owned solo increment; shared rooms still use Rapier.

Owned vehicles and seats delivered for early testing — still approximately 95% overall. Published Alder court now drives and steers with owned suspension and traction; raft worlds use owned water propulsion. Seats share the production boarding/camera contract, and exact recovery retains the driver. Two focused runtime tests, existing owned-body/rigid and native-seat suites, type/import checks and the editor-to-player software-WebGPU cart journey pass; the occupied seat view was reviewed. Vehicle notes record suspension/contact, boarding, shared-authority and art qualification work.

Owned authored and player ragdolls delivered for early testing — still about 95% overall. Published Marionette court supports tipping and resetting the mannequin, while R / Collapse / Get up controls the physical player. Both fallen states survive local reload; exact checkpoints retain articulation and toggle state. Three focused runtime checks, six existing owned suites, type/import checks and the published-player browser journey pass. The restored mannequin render was reviewed; the fallen screenshot is obscured by the pause overlay and needs a clean visual review in the final pass. Ragdoll notes record that limitation, anatomy, live-edit clearance and broader qualification. Existing character models remain unapproved and require the final art pass.

Owned shared relay rooms delivered for early testing — still about 95% overall. npm run dev:owned opens a separate editor/room on 5183/8793. Owned room authority now retains shared props, mannequin modes, vehicle/cargo state and exact recovery. Admission rejects mixed backends, and other travelers block an occupied mannequin reset. Five focused runtime checks, two-client relay host-change/reconnect/restart checks, existing cargo/body/ragdoll checks and type/package checks pass. Shared-room notes retain hosting integration and qualification work. The published two-player browser journey passes tip/reconnect/reset and player collapse/get-up; the fallen view was reviewed. Existing models still need the final art pass.

Owned persistent/trusted hosting delivered for early testing — approximately 96% overall. Backend selection now reaches PostgreSQL room identity, trusted motors, durable admission/travel/cargo, per-place process/network owners and the regional retained-runtime pool. Schema 8 pins backend choice and rejects mixed saves; existing retained-schema guards remain. Five owned database/hosting checks, existing persistent/upgrade checks, three focused routing checks and type/package checks pass. The packaged two-player trusted browser journey passes shared inventory, server-saved movement and reload; the restored view was reviewed. Hosting notes retain upgrade/backup, fault/load and broader browser/device qualification.

Solo/shared rider contact connected — approximately 96% overall. Standing weight and bounded pushes now use the same body-contact policy in solo and shared play. Replicas do not add local body forces. Focused checks cover equal solo/room response, authoritative replica frames, linked-body save/reload and cart driving. The published causeway browser journey and type checks pass; its crossing view was reviewed. Review notes retain crowded decks, clearance, passenger distribution and latency tuning. This closes an integration gap; it does not finish the replacement solver or move the rounded full-program estimate.

Cone/twist joints connected to the player — approximately 96% overall. The owned solver now limits neck, shoulder and hip swing/twist, with free motion inside the limits. Focused angular-stop, two-endpoint, restore and ragdoll checks pass. The owned two-player collapse/reload/get-up browser journey and type checks pass, and the fallen-avatar view was reviewed. Implementation and review notes retain anatomical tuning, editor exposure and extreme-pose qualification.

Compound shape and mass API delivered — approximately 96% overall. Compound collision preserves child gaps, and full inertia/center-of-mass calculations now handle rotated/off-center children and convex hulls. The new Form & balance atelier study can be nudged, saved/restored and compared against Rapier. Focused mass/query/restore checks, eight existing owned suites, type checks and the packaged study browser journey pass; the view was reviewed. General world/editor compound authoring and shared-content integration remain open in the review notes.

Authored compound bodies connected — approximately 96% overall. Box objects now have editable parts and an arch preset, with matching editor/player rendering, real openings, volume-based mass/buoyancy, saved motion and shared cargo. World format 36 carries these definitions in both physics backends. Five focused native checks and existing body/link/buoyancy suites pass. Editor/player views were reviewed; a clean browser reconnect run remains for qualification after assertion corrections and a browser closure. The review notes retain stability tuning, per-part controls, database/device qualification and art work for the later pass.

Continuous motion integrated — approximately 96% overall. Owned physics now handles moving-body pairs, angular casts, moving obstacles and multiple impacts with remaining-frame motion. The new Crossing paths study runs and restores in both backends. Seven focused checks, seven existing integration suites and the packaged study browser journey pass; the rendered view was reviewed. Review notes retain initial-contact/grazing behavior, bounded fallback, joint coupling and full replacement qualification. Roadmap 16's acceptance gate remains open.

First playable 2D tile worlds delivered — approximately 96% overall. New world → The little atlas now supports palette painting, solid-cell collision, overhead rendering, 2D movement, saved undo/redo and publication. Two players can join the published world, share a pickup and reload with retained inventory. Four focused native checks cover both physics backends, collision, live edits and exact checkpoints; four existing integration suites, type/import checks and the packaged two-player browser journey pass. Editor, painter and player views were reviewed. Tilemap notes retain the unfinished tools, art and broader qualification. This is a usable first profile, not completion of roadmap 18.

Layered maps and painting tools delivered — approximately 96% overall. The tile painter now resizes maps, fills connected areas, erases cells, expands the palette and manages four named overlays with order, visibility and collision. All changes retain saved undo/redo and publish into shared play. Seven focused native checks, existing presentation/authoring/merge/undo checks, type/import checks and the expanded two-player browser journey pass; editor and runtime views were reviewed. Tilemap notes retain cropped object positions, touch/accessibility, concurrency and qualification work.

Imported tile/traveler sprites and sheet animation delivered — approximately 97% overall. The painter imports transparent PNG sheets, previews row-major animation, and applies artwork to tile layers or local/remote travelers. Images and animation settings remain in saved worlds and publications. Three new native checks, the seven tilemap checks, sixteen presentation checks, type/import checks and the expanded packaged two-player journey pass. Import and player views were reviewed. Sprite notes retain directional animation, resource/transport qualification and final art. These are working creation capabilities; the roadmap's full acceptance gates remain open.

Free sprite objects and overhead object tools delivered — still approximately 97% overall. Place imported artwork independently of tile cells; select, move, rotate, scale, duplicate and hide it through the ordinary saved object system. The overhead editor now uses matching projection for picking, handles and selection boxes, with pan/zoom and map framing. Two focused native checks and existing handle/marquee/sprite/ECS suites, type/import checks and the packaged two-player browser journey pass; editor/player views were reviewed. Object notes retain rectangular picking, artwork rebinding, object collision, device/recovery qualification and final art. Collision continues to use the painted tiles.

Directional traveler artwork delivered for early testing — still approximately 97% overall. The sprite editor configures four directional rows, an idle frame, walk range and playback rate, with direction/movement preview. Local and remote travelers use displayed movement to face and animate, retaining direction when idle; reduced motion holds the idle frame. Settings use saved/publication world format 41. Three new native checks (including actual simulation-to-presentation movement), existing sprite/free-object suites and type/import checks pass; the editor preview was visually reviewed. The expanded shared-browser animation check is unresolved after stale observations and software-renderer stalls; it remains an explicit qualification item, not a passed gate. Directional notes retain action clips, facing continuity across reload/recovery, sparse samples and final character artwork.

Static 2D object collision delivered for early testing — still approximately 97% overall. Select an object and use 2D collision… to author a rectangle, diamond, triangle, beveled shape or custom convex silhouette. Shapes follow object transforms and participate in continuous collision/sliding in both physics backends. Saved duplication/removal, exact restoration and occupied live-revision rejection have focused native coverage; existing tilemap and undo suites pass. The packaged two-player journey passes authoring, save/undo/redo, publication, collision for both players and position restoration after reload; editor/player views were reviewed. Type/import checks pass. Collision notes retain dynamic bodies/joints, sensors, circle/concave shapes, shared-edit occupancy and broader qualification.

Pushable 2D boxes delivered for early testing — still approximately 97% overall. The silhouette editor now authors moving boxes. Both physics adapters share a planar sweep; published rooms own the movement, replicate it to both players and retain it through reload. Native checks cover saves/checkpoints and room frames; the packaged two-player author/save/undo/redo/publish/push/reload journey passes and its editor/player views were reviewed. Existing tilemap, static-collision, buoyancy-simulation and undo suites pass. See pushable-box notes for fixed-angle limitations, shared walk-to-push, performance and deferred deployment qualification.

2D pressure plates delivered for early testing — still approximately 97% overall. Builders can turn a flat object into a pressure plate, select its box source, choose an appearance response and gate pickups/conversations/gateways. Shared body positions drive occupancy; removing the box restores the appearance and closes the gate. Native save/checkpoint/admission checks and the final packaged two-player author/undo/publish/activate/reload journey pass. Editor and active player views were reviewed. Type/import checks pass. One selected Rapier room-push regression times out on retry and is recorded for qualification; it is not counted as passing. See pressure-plate notes.

Rotating 2D silhouettes and world pins delivered for early testing — still approximately 97% overall. The collision editor authors free/sliding convex bodies and pinned rotating arms. Off-centre pushes create shared spin; pins retain their anchor through saved motion. Nine focused native checks pass, including both backends, exact checkpoint continuation, a thin-wall sweep and convex live additions. Existing box/sensor/static-collision suites pass. The two-player save/undo/publish/spin/reload journey passes; editor/player views were reviewed. Rotating-body notes retain the remaining joint types, shapes, sensor events, numerical and deployment review.

Body-to-body 2D joints delivered for early testing — approximately 97% overall. The editor now authors passive hinges and distance links between moving parts. Joint motion is shared, saved and restored; assembly copies retain internal connections and single-part copies detach. Six focused native checks cover both backends, publication/copying, checkpoint and room continuation. Existing 2D suites and the author/save/undo/publish/two-player/reload browser journey pass; editor/player screenshots and type/import checks are reviewed. Joint notes retain chain/energy/performance qualification, advanced controls, connection art, prefab coverage and deployment review.

Body-triggered 2D script events delivered for early testing — approximately 97% overall. Creators can connect plates to custom sensor responses that receive entered/exited/active plate flags, update private counters and choose a finish. Occupancy and script changes commit together; shared relay reloads retain them. Five native checks, 26 existing behavior/sensor checks, type/import checks and the two-player author/connect/publish/push/reload browser journey pass. Editor/player views were reviewed. Sensor-event notes retain traveler/general-shape detection, broader effects, persistent-service execution, process-restart qualification, copy polish and final art.

Traveler-aware shaped sensors delivered for early testing — approximately 97% overall. Creators can select bodies, travelers or either and draw convex sensor areas, then connect shared script responses, color changes and action gates. This also fixes rejected coordinator sensor commits discovered while walking through the published world. Six focused native checks and type/import checks pass. The body-triggered shared browser journey passes; the traveler journey reaches shared entry successfully, then the browser closes during a screenshot. Reload/exit/disconnect browser checks and shared visual review remain open; the editor view was reviewed. Acceptance and deferred review record these limits and the existing remote-actor fixture mismatch.

Compound 2D bodies delivered for early testing — approximately 97% overall. Creators can author L/T/U silhouettes or 2–8 rectangular solid parts. Openings remain open to travelers, bodies and sensors; the editor and shared player render the same parts. Shape, mass, motion and existing links survive copying and saves. Five new native checks, four existing 2D suites, five authored 3D-compound checks, type/import checks and the author/undo/publish/two-player/push/reload browser journey pass. Editor and shared-player views were reviewed. The room join check exposed and fixed missing compound schema registration during revision recovery. Compound notes retain analytic shapes, richer parts, mass-center accuracy, contact/performance qualification and final art.

Analytic circles and capsules delivered for early testing — approximately 97% overall. The collision editor now authors circular and capsule bodies with matching player silhouettes, analytic contacts/clearance, occupied-volume mass and shared motion. Nine focused native checks cover publication, continuous translation, both backends, revision/checkpoint/save recovery and room authority. Six existing suites and the author/undo/publish/two-player/push/reload browser journey pass; editor and player views were reviewed. Final contact-point and bounds corrections have focused native coverage. Round-body notes retain multi-contact/rotational qualification, richer compound geometry, mobile and deployment checks, and final art.

Mixed shaped compounds delivered for early testing — approximately 97% overall. Creators can combine individually rotated boxes, circles, capsules and convex parts in one shared moving body. Rounded-handle and garden-trowel presets have matching editor/player outlines, with custom part data available. Seven native checks, five existing suites, type/import checks and the author/undo/ publish/two-player/push/reload browser journey pass. Editor and player views were reviewed. Mixed-compound notes retain direct part manipulation, combined budgets, mass-center accuracy, contact/performance and deployment qualification, plus final art.

Analytic sensor areas delivered for early testing — approximately 97% overall. Circle and capsule trigger areas now detect travelers and moving bodies with exact curved boundaries, using existing shared script responses and action gates. Eight focused native checks, type/import checks and the author/undo/ publish/two-player/entry/reload/exit/disconnect browser journey pass. Editor and shared-player views were reviewed. Sensor-area notes retain wider device/deployment qualification and the remaining script/host work.

Sensor puzzle unlocks delivered for early testing — approximately 97% overall. Creators can choose response-controlled pickups, conversations and gateways, with occupied, first-entry latch and three-entry recipes. Shared responses retain a completed puzzle after travelers leave. Six focused native checks, five related suites and type/import checks pass. The editor-to-two-player journey passes authoring, undo/redo, publication, entry, exit, disconnect, unlocked collection and reload; editor and collected-player views were reviewed. Puzzle-response notes preserve solo-save, host execution, richer recipes and qualification work.

Portable solo behavior saves delivered for early testing — approximately 97% overall. Ordinary reloads now preserve partially completed puzzles, latched unlocks, script random state and parked faults together with movement/body progress. Seven focused native checks, four related suites and type/import checks pass. The browser journey completes three visits across separate reloads, collects the unlocked reward and reloads again; the restored view was reviewed. Behavior-save notes retain performance, revision/multi-place combinations and hosted execution work.

Persistent/trusted authored responses delivered for early testing — approximately 98% overall. Hosted rooms now retain script state, sensor puzzle results and fault cursors in PostgreSQL, with atomic body/output commits, idempotent touch receipts, action-lock checks and release-upgrade retention. Five focused database checks plus backup/upgrade suites pass. The packaged trusted two-player journey passes locked collection, entry, host restart, shared reward collection and reload; the restored view was reviewed. Type/import checks pass. Two broader trusted-room cases hit the test process's memory admission limit and remain unverified. Hosted behavior notes retain these and other qualification items. New persistent builds require schema 9; retained engines remain protected from automatic schema changes.

Visual puzzle wiring delivered for early testing — approximately 98% overall. Creators can connect sensor areas, a response object and action unlocks in one visual view without JSON. Existing scripts are preserved unless a recipe is chosen; connection edits save and undo together. Two focused authoring checks, type/import checks and the editor-to-two-player browser journey pass, including reload and shared collection. The wiring and player views were visually reviewed. Wiring notes retain broader review items. The estimate remains approximate; this increment does not close the accumulated acceptance gates or the full 2D physics profile.

Resumable creator tasks delivered for early testing — approximately 98% overall. The atelier's Creator tasks notebook and CLI retain requested scope, source revision, proposed edits, review results/artifact references and acceptance. Saved task proposals flow through existing review, preview, Save and undo. Restart reads the saved-world commit point, and accepted tasks cannot apply twice. Four focused native checks, nine existing undo/HTTP checks and type/import checks pass. The browser journey passes creation, notes, reload, review, Save, accepted record recovery and undo; notebook views were visually reviewed. Task notes retain capacity, process/storage, deployment and broader assistant-interface work. The rough full-plan estimate remains 98%; the acceptance gates are not closed by these increments.

Assistant adapter and observable playtests delivered. The scoped adapter, configurable provider bridge and isolated browser playtests are delivered. External tools can inspect content/schema, create/resume tasks, validate and retain proposals, walk/turn/interact through normal player input, and retain loaded-frame captures and observations without changing the saved world. Notebook results and local run records prevent automatic input replay on retry. Focused native/service and real browser checks pass. See usage, acceptance and remaining work. Approximately 98% overall remains the rough scope estimate.

Model jobs now add a built-in original lantern, operator-approved GLB imports and a configurable model-provider bridge. Source/provenance, bounded importer results and idempotent proposal attachment are retained; the generated lantern has passed the isolated loaded-player visual workflow. Saved content still waits for ordinary editor acceptance. Usage and review limits include compact proposal limits and retained large-artifact references.

The trusted persistent test-host adapter and bounded two-player journey are now delivered (see the current milestone above). Broader hardware/rollout checks and long-lived interactive agent sessions remain recorded in CREATOR_TASKS.md.

Arrival art candidate and shared camera fix delivered — approximately 98% overall remains a rough scope estimate, not passed gates. npm run dev:art opens the new arrival release on port 5187. Remodeled travelers and Elowen, warmer lighting and furnishings are available for review. Occupied arrivals now search for nearby supported clear ground, and close-camera avatars hide until clear. Focused checks and two-player visual review pass; see the acceptance and deferred review record. The required final character/environment/arrival art approval remains open. The candidate is not user-approved; keep it available while implementing the remaining plan rather than spending another increment on speculative art micro-adjustments.

The full plan remains active. The 2D/tilemap and hosted lifecycle profiles still need their recorded final qualification. Broader assistant/creation interfaces remain open as documented in CREATOR_TASKS.md and feature documents. After the art increment, finish remaining implementation against ENGINE_PLAN.md and then run its full acceptance audit. Keep Rapier as the default until the required fixture/replay/controller and performance gates justify replacement. Deferred checks and unapproved art are unfinished work.

Shared player collapse/get-up delivered for early testing — approximately 93% overall. Press R or use Collapse/Get up in the player. The owned motor releases an eleven-body physical traveler, publishes its skin pose to peers, retains the fallen state through reload and recovers to nearby supported, clear ground. Four focused native checks cover checkpoint/portable recovery, blocked clearance, held input, physical projection, trusted input, prediction and durable admission. The two-player software-WebGPU journey and type/import checks pass; packaging and the fallen-avatar view are checked. Usage and deferred review retain immediate transitions, anatomy/art, player occupancy, broader persistence, platform and hardware qualification. This is a usable ragdoll path, not closure of every extended-physics or production gate.

Physical traveler skins delivered for early testing — approximately 92% overall. New world → Traveler practice adds a visible traveler skin driven by fourteen joint bindings to eleven shared physical bodies. The editor’s Physical skeleton panel saves body assignments with undo. The focused software-WebGPU two-player journey passes binding edit/undo, tip, reconnect and reset; the two source/projection/checkpoint checks and type/import checks pass. Client/engine packaging passed in the browser run, and standing/fallen/editor renders were reviewed. Usage and deferred review retain art, anatomy, imported-rig/assembly editing and broader qualification. The subsequent player increment above provides collapse/get-up. The practice figure remains an independently authored prop. Keep its recorded qualification items for the final review pass.

Shared mannequin ragdolls delivered for early testing — approximately 92% overall. New world → Marionette court provides an eleven-part beech mannequin with ten spherical/hinge joints, a saved posed/dynamic mode, shared tipping and obstruction-checked reset. Density edits, saved Undo/Redo, shared Apply, two travelers, reconnect and reset pass the software-WebGPU browser journey. Thirteen focused native/link checks and two cooperative/trusted PostgreSQL recovery/fencing checks pass, along with type/import checks and browser client/engine packaging. Standing/fallen renders and editor artwork are reviewed. Run instructions and review notes preserve the limits and final unapproved art. The subsequent physical-skin increment above supplies the binding; player collapse/get-up remains active. The mannequin is a delivered physics increment, not completion of that larger requirement. Broader hardware, anatomy, impacts and handoff qualification stay in the final review pass.

Shared seats and mounted cameras delivered for early testing — approximately 92% overall. Alder court now has reserved driver/passenger seats, a seated traveler pose and a lowered camera that follows vehicle turns while allowing free look. The editor saves one to four mount positions and eye height. Native checks cover ownership/release, mounting, pose attachments, live-edit conversion and the seated presentation protocol; cooperative/trusted PostgreSQL restores retain both occupants. The software-WebGPU journey passes shared boarding, driving, turning and driver reload with Worker/main-thread players. Type/import checks and browser client/engine packaging pass; editor and seated player captures are reviewed. Usage and deferred review retain wheel/seat/camera polish, broader hardware/replay/handoff qualification and final unapproved art. No full roadmap milestone is claimed. Shared ragdoll work continues in the current milestone above.

Shared ground carts delivered for early testing — approximately 92% overall. New world → Alder court adds an original cedar cart with four ground-contact suspension probes, tire traction, front steering, exclusive driver ownership and a passenger platform. Saved speed/grip edits, Undo/Redo, shared Apply and driver reload pass the software-WebGPU browser journey. Thirteen focused native checks, two PostgreSQL cooperative/trusted restore-and-fence checks, type/import checks and browser-runner client/engine packaging pass. The editor and player visuals are reviewed. DW_ROOM_TEMPLATE=cart selects it for a fresh persistent room. Run instructions and deferred review retain wheel animation, shared arrival spacing, rough-terrain/hardware/long-session qualification and final unapproved art. The bounded ground-driving increment is implemented; continue the remaining vehicle/traversal features without expanding this into a broad regression campaign. No complete roadmap milestone is claimed.

Recursive portal views delivered for early testing — approximately 92% overall. The editor and shared player now render two destination levels, including bounded cycles. Nested windows preserve linear HDR, parent clipping and independent live presentation streams. Residency loads both destinations; authenticated interest checks each gateway and preserves older one-hop clients. The 24 focused native checks, software-WebGPU rendering/recovery gallery, saved editor/shared-player smoke, client/engine packaging and type/import checks pass. The rendered gallery and shared-player captures were visually reviewed. Try Check portal views in /diagnostics.html, or enable windows in two successive authored places and Apply. Usage and deferred review retain physical/mobile/performance qualification, broader recursive travel and recovery matrices, local-avatar visibility in cycles, and final unapproved art. This closes the bounded recursive-view implementation increment, not all advanced traversal or the full roadmap. Continue remaining engine features; do not expand this increment into a broad testing campaign.

Network cargo owners delivered for early testing — approximately 92% overall. The persistent room can send place physics to authenticated worker services through DW_PHYSICS_OWNERS=network. Matching worker executable hashes are checked before world transmission; separate connections retain their fenced owner identities. compose.cargo.yaml packages a fresh Coolify deployment with two private workers, a room coordinator, PostgreSQL and named persistent volumes. The focused network crossing/restart, authentication/compatibility checks, type/import checks, engine packaging and packaged-service socket smoke check pass. Compose validates. Run instructions and deferred review explicitly retain real WAN/proxy deployment, domain-only recovery, broader fault and performance qualification, the existing relay contact/portal-visibility issues and final character/environment/arrival art. No production deployment was performed. The cargo implementation is now available for early testing across the editor, persistent room and network owners; continue the remaining engine capabilities while keeping these qualification items open.

Separate process cargo owners delivered — approximately 91% overall. The persistent runtime can assign each place to its own physics process using DW_PHYSICS_OWNERS=process. Destination preparation precedes an atomic cargo, rider and ownership-epoch commit; stale physics writers are fenced. Replacement processes recover the saved destination after restart. The focused cooperative three-client journey, existing atomic cargo transaction check, type/import checks, engine package and packaged-worker smoke check pass. This is a working local cross-process increment, not remote-machine routing or full failure qualification. Migration 7 needs a new dedicated database alongside retained older engines. Run it and see deferred review items. Network transport is delivered in the latest increment; final art and full-plan qualification remain on the work list.

Editor cargo increment delivered — approximately 90% overall. New world → Lantern passage now supports saved gateway edits, Undo/Redo, shared two-traveler cargo crossings, live body-property edits, destination reload and return. Relay snapshots persist bodies, rider poses and crossing receipts together. Admission restores the accepted scene before initializing graphics once, removing the observed double-bootstrap timeout. The software-WebGPU editor journey and TypeScript/import checks pass; 22 of 23 focused checks pass. One pre-commit disconnect recovery contact failure, portal/deck visibility, wider regression and final hardware retesting are explicitly deferred in the review list. Separate-process handoff is implemented in the latest increment; remote-owner transport, final art and full qualification remain open; this increment is ready for early user testing.

Shared cargo through portals. Carry connected dynamic bodies and their riders between authored places as one authority island. Build a visible two-place cargo crossing with editor setup, destination loading/clearance, transformed poses and velocities, preserved joint identities, and two-traveler presentation. Carry the transfer through cooperative/trusted ownership, durable restart and cross-host fencing: freeze affected interactions while ownership moves, prevent duplicate simulation, and recover a defined surviving owner on failure. Preserve the delivered raft, drawbridge and linked-deck behavior. Keep the full milestones 0–18 scope, including other joint types, the owned physics backend, recursive portals, broader traversal/vehicles, larger domains, performance and memory qualification, other platforms/modes and the required final character/environment/arrival art pass.

Cargo implementation is in progress. Format 31 tracks runtime membership separately from immutable published content. Native/room preparation transfers complete connected assemblies and supported riders; the server-only PostgreSQL transaction commits body ownership and all prepared riders with one receipt/outbox entry, rejects stale owners and prevents ordinary physics saves from relocating cargo. Player simulation now moves collision and ECS/render membership together, snaps transfer baselines instead of interpolating between places, restores portable format-5 saves/native checkpoints and preserves compatible live edits. prepareCargoFrame stages carried motors and streamed destination models while retaining the accepted source; cancellation, stale downloads and failed publication leave it intact. Trusted movement can recover a carried rider against committed membership. 56 focused native/streaming/motion checks pass, alongside the preceding 11 PostgreSQL checks; type/boundary checks pass. Direct transfer checkpoints restore exactly. After a linked-body policy edit, Rapier itself reorders two serialized bookkeeping bytes; portable ownership and 30 subsequent motion batches remain identical, so byte-identical recovery is not claimed for that edit case. Admission and reconnect now publish committed cargo membership with durable poses, validate relocated peer support, and stream incoming models using the compiler world identity. Two returning travelers load only the destination, see one another and survive room restart in both cooperative and trusted modes. This integration passes 35 focused native/network checks and 15 PostgreSQL checks; malformed replacement baselines are rejected before changing accepted state. The persistent-room freeze/prepare/commit protocol now gathers an acknowledged position or trusted input boundary from every nearby traveler, stages native and GPU ownership together, and publishes only after destination readiness. Two riders plus a source observer pass cooperative and trusted journeys for rejected loading, delayed readiness, disconnect before commit and retry, and database commit with lost acknowledgement followed by owner restart. Incoming model catalogs follow runtime membership. 40 focused native/network/presentation/travel tests and 35 PostgreSQL integration/regression tests pass, plus type/boundary checks. Adapter tests are supplemented by the Lantern passage browser journey below. Relay/editor preview transport and gallery integration are implemented in the current increment; opt-in separate-process place owners are implemented; network transport is implemented with real remote-machine qualification still open. The freeze boundary now checkpoints online travelers who stepped off since their last save, while preserving the requirement for offline riders to rejoin. Simultaneous crossing requests adopt the room-selected operation without disconnecting either traveler. All 15 PostgreSQL cargo tests and four cargo wire tests pass, including cooperative/trusted simultaneous requests and stepped-off/offline riders. Same-room owner replacement does not complete cross-host island transfer. Complete those paths and visual acceptance before declaring delivery or raising the estimate. Scratch results are under ignored .data/cargo/.

Lantern passage persistent playtest — approximately 90% overall, unchanged. DW_ROOM_TEMPLATE=cargo creates a morning quay and evening garden connected by a timber/brass portal, with two original cedar decks traveling as one linked assembly. Two actual browsers using Worker and main-thread graphics cross together and retain the destination after room restart. Trusted physical-WebGPU and cooperative software-WebGPU journeys additionally reload a traveler at the destination and carry both decks back; the cooperative physical-WebGPU outbound/restart journey also passes. Browser verification exposed and fixed foreground graphics commit misuse, portal transfer-pool replacement, and an interaction dropped during an automatic movement save. Six focused native/network/presentation/source checks, eleven PostgreSQL cargo checks and type/boundary checks pass after those fixes. The scene is available for a fresh PostgreSQL room; it is now also available in the editor gallery/relay workflow. Run it and see the limits. Reviewed quay capture. The overall cargo milestone remains active until editor/relay integration and separate-owner handoff are verified; final character and environment art remains unapproved.

Linked floating decks are available for testing — approximately 90% of the full program. New world → Willow causeway provides three original cedar decks with body-to-body hinges and a lantern terrace. Two travelers can cross, raise/lower the span and ride its motion. The editor creates/fits connections and retains tuning through Save, Undo/Redo and live Apply. Connected components recover together; native snapshots preserve endpoints and exact continuation. Four browser journeys pass across physical/software authoring and recovery plus packaged trusted/cooperative restart and lease loss. Combined integration covers 1,025 passing native checks with 80 skips and 78 PostgreSQL checks, including completed files after interrupted runners and focused regression/admission reruns. Production builds and standalone authoring pass; final scene captures are reviewed. Usage, acceptance and limitations. General pointer-lock timing and sustained load remain unqualified; final character/environment/arrival art remains required and unapproved. No numbered roadmap milestone is closed.

Drawbridge crossing follow-through: a controlled 900 ms key-down acknowledgement delay reproduced the under-jetty outcome by walking off the side and then back beneath the boards. The test driver now queues key release independently of that acknowledgement. Two timing regressions, focused main/Worker approaches and the complete software/physical-GPU shared crossing journeys pass with the delay injected. The original isolated capture had no movement history, so its exact cause remains unproven; retain that limitation for final qualification and use the first-fall capture if it recurs. Stationary, seam-walking and collision-order grids are already complete. Continue the next visible capability instead of repeating those searches. Overall estimate remains approximately 90%.

Shared jointed drawbridge is available for testing — approximately 90% of the full program. New world → Alder gate adds an original timber deck, fixed revolute hinge and lantern terrace. Travelers can raise/lower the same deck, cross it and ride its motion. Saved settings, Undo/Redo, live speed tuning and pivot relocation preserve or deliberately clear the appropriate state. Cooperative and trusted rooms retain joint targets/native motion across restart, and receipt retries cannot toggle twice. Four browser journeys pass across physical/software editor recovery and packaged trusted/cooperative PostgreSQL restart/lease loss; reviewed captures cover both graphics placements. Integration covers 1,013 native checks with 78 skips, including an isolated four-check engine-pinning rerun after the imposed 256 MiB heap failed; 76 PostgreSQL checks pass. Production builds, type/boundary checks and standalone template/check/export/compile pass. Usage, reviewed capture, acceptance details and limits. A reproduced test-driver overshoot is corrected; the original isolated jetty capture lacks the input history needed to prove its exact cause. Body-to-body assemblies, other joint types, the owned backend and final art remain open. No numbered roadmap milestone is closed.

Steerable shared cedar raft is delivered — approximately 90% of the full program. New world → Cedar crossing provides an original cedar model with planks, lashings and a bow marker. Travelers can board, claim an exclusive helm, drive/reverse/steer, carry a passenger and release or jump off. Saved settings, Undo/Redo, publication and live tuning preserve the authored source and supported riders. Cooperative and trusted rooms own propulsion and preserve pilot reservations through durable restart; recovery never restores throttle. Ten physical/software browser journeys pass across publication, model/live Apply, solo/shared worker recovery, both persistent authority profiles, restart and forced lease loss. Broad integration passed 1,005 native checks with 76 skips; 74 PostgreSQL checks are covered across the broad run and an isolated rerun of a killed test file. A final reservation correction passes nine focused native checks and the software recovery journey: a fifteen-second worker rebuild exposed the old ten-second expiry, so the bounded reservation now covers sixty seconds. Production builds, type/boundary checks and standalone template/check/export/compile pass. Usage, reviewed image, acceptance and limitations. This is a single-body buoyant vehicle, not a completed general vehicle/physics system; no numbered roadmap milestone is closed. Final character/environment/arrival art remains required and unapproved.

Shared character/body contact is delivered — approximately 89% of the full program. Travelers can walk into movable timber, combine pushes and load floating decks with their weight. A fresh Driftwood cove includes shore timber behind and to the right of arrival for a keyboard-only playtest. Authored density and grip affect contact; the room queries actual shapes and intervening static/moving barriers. Trusted rooms use server-derived motion; cooperative samples expire after 500 ms. Checkpoints retain moved bodies, and browser replay cannot apply extra force. Broad integration passed 992 native tests with 75 skips and 73 PostgreSQL tests; final refinements passed 19 focused native checks and three trusted PostgreSQL contact/recovery checks. All 18 hardware/software browser journeys pass across editor/relay and both persistent authority profiles, including loaded riders, contact, worker recovery, reload, restart and lease loss. Contact-enabled 150 ms replay stays within the 15 cm correction budget. Production builds and type/boundary checks pass. Usage, reviewed capture, measured acceptance and limits. Capsules remain kinematic; character/character contacts, joints/vehicles, the owned backend, full performance qualification and final art remain open. No numbered roadmap milestone is closed.

Rideable floating platforms are delivered — approximately 88% of the full program. Two travelers can board the wider deck in a fresh Driftwood cove, ride its translation/rotation, push it, then jump or walk off. Native, portable and durable saves retain the contact, including collision-safe recovery after offline drift. Trusted snapshots and prediction preserve room-owned motion. Final hardware/software browser journeys pass shared authoring/publication, main/Worker play, reload, graceful restart and forced lease loss for cooperative and trusted rooms. Integration passed 987 native tests with 74 skips and 72 PostgreSQL tests; final focused checks passed 18 rider/save/prediction, 10 watchdog and 15 PostgreSQL room checks. A demonstrated fresh-room memory rejection was fixed by bounding the supervised runtime's V8 old generation to 256 MiB while retaining the 512 MiB RSS admission limit. Type/boundary checks and production builds pass. Usage, reviewed capture, acceptance and limits. Sustained capacity qualification, character/body force coupling and final art remain open. No numbered roadmap milestone is closed.

Trusted floating-world play is delivered — approximately 87% of the full program. A new Driftwood cove or unbound exported editor world can use server-owned character movement and validated pushes. Motor snapshots carry the committed floating collision frame; browser prediction/replay cannot move the room's bodies and visual interpolation remains independent. The moving-timber 150 ms RTT fixture gives immediate local movement with a worst correction of 0.1154 m within its 0.15 m budget. Real database/socket checks reject forged reach, preserve committed collision during slow saves and recover push receipts across restart. Browser testing exposed and fixed input-queue overflow: client prediction now respects the server's twelve-frame window and recovers stalled acknowledgements. A prepared immutable writer removes repeated source validation while retaining per-save lease/release fencing. Final verification passes 977 native tests with 73 skips, 71 PostgreSQL tests with a 256 MiB test heap, physical/software main/Worker browser journeys with delayed transport and no protocol disconnects, type/boundary checks and production builds. Earlier repeated-room test processes hit the unchanged 512 MiB RSS cap; default-heap long-session behavior remains unqualified. Usage, reviewed scene, exact acceptance and limits. Riding, contact-force coupling, vehicles, owned physics and final art remain open. No numbered milestone is closed.

Persistent floating worlds are delivered — approximately 86% of the full program. An operator can start Driftwood cove or an exported editor document as a cooperative PostgreSQL room. Floating pushes commit native state with their receipts; physics time advances through separate lease-fenced checkpoints. Two real browser travelers retain identities and moved timber across graceful restart and forced lease loss, with main/Worker graphics on physical and software WebGPU. Native PostgreSQL checks also cover SIGKILL after a committed push, lost acknowledgement/retry, exact backup snapshot continuation and compatible stopped-room upgrades. Final integration passes 974 native tests with 72 skips, 70 PostgreSQL tests, six final focused floating/backup checks, type/boundary checks, production builds and Compose configuration validation. The final hardware journey starts from an exported world through the packaged runtime, then resumes the pinned release. Usage, reviewed capture and acceptance limits. Schema 6 requires a dedicated database alongside older retained builds. Trusted dynamic prediction, body removal/transfer recovery mappings, cross-schema upgrades and capacity qualification remain open. The initial software admission-pressure rejection is retained in the acceptance notes; no limit was relaxed. No numbered roadmap milestone is closed.

Buoyancy and shared floating props are delivered for cooperative relay rooms — approximately 85% of the full program. Driftwood cove offers a wooded pool with three real floating props. Creators can change body density/grip/bounce and water depth/density/resistance through the editor, Save/Undo/Redo, Apply to two travelers and publish a shared room. The server owns floating motion independently of the browser host; native checkpoints, repeated push receipts, relay restart, reconnect and a deliberately stalled simulation worker are verified. Final integration passes 973 native tests with 68 skips, all three floating browser journeys on physical and software WebGPU, both neighboring swimming journeys on physical WebGPU, production builds and the detached packaged CLI round-trip. Reviewed captures, usage and limits are in BUOYANCY.md. PostgreSQL/trusted dynamic rooms, broader physics and final art remain open; no numbered milestone is closed. The rounded estimate remains 85%.

Voxel streamed detail and residency is delivered — approximately 85% of the full program. Format 26 gives each traveler independent nearby detail/collision while a reduced distant model preserves the cave’s shape, openings and finish. Editor distance settings, Dig/Fill, cancelled overview builds, saved Undo/Redo, shared Apply, eviction/revisit, reconnect and publication are verified. The integration suite passes 955 native checks with 68 skips; final heightfield/voxel checks and authoring/shared-room restart pass. Physical and software browser journeys, final heightfield regression, production build and detached CLI pass. The original hollow’s distant model uses 34.7% fewer triangles; the independent travelers each retain 2 of 8 detailed chunks. Usage, reviewed images, acceptance and limits. The 16-chunk cap, larger domains, sustained performance/memory qualification and final art remain open. No numbered milestone is closed.

Voxel surface finishes are delivered: limestone, sandstone and basalt with editable pattern scale, moss and roughness. Finish changes preserve density, mesh bytes, collision and entity identities. Native source/ownership/undo/restart checks, hardware/software browser journeys, shared publication, production build and detached CLI pass. 952 headless checks pass, with 68 skips; three final profile checks pass. The visual pass refined overly broad bands into finer mineral detail. Usage, reviewed captures and limits. Approximate full-program completion remains 84%; no numbered milestone is closed.

In-scene Dig/Fill and cancellable background builds are delivered. Actual triangle picking includes tunnel interiors and foreground occlusion. Hardware/software browser journeys pass source persistence, saved Undo/Redo, two-traveler Apply, reconnect and published passage walking. The editor keeps rendering while a worker reply is held, rejects late replies after cancellation and recovers from worker failure. 949 headless checks pass, with 68 skips; production build and detached CLI checks pass. Desktop/narrow brush controls were visually reviewed. A demonstrated old room-status response overwriting a newer save message was fixed. Usage, acceptance and remaining limits. Approximate full-program completion remains 84%; no numbered milestone is closed.

The Misty uplands workflow has been delivered through authoring, persistence, independent traveler residency, shared edits and eviction/revisit. Its final resource run covers 143 terrain handoffs over 10 minutes 32 seconds at 1080p with six browser isolates sampled. GPU allocations stay constant and retained client memory stays within the recorded ranges; modest positive editor/Worker-player heap drift is reported explicitly. This does not close the full memory or frame-time gates. Keep the no-DevTools-overhead desktop/mobile benchmark, 100-place-crossing CPU/backing/GPU census, terrain transition polish, larger domains and multilevel distant residency on the full-program qualification list. Preserve the required final character/environment/arrival art pass and all remaining milestones 0–18. Follow AGENTS.md.

#Terrain streaming implementation checkpoint · 2026-10-26

Approximately 84%; estimate unchanged. The bounded playable workflow is delivered; extended scope and full performance qualification remain open. Misty uplands adds a 128 × 128 metre authorable landscape. Format-24 source, per-traveler chunk loading, retained collision during preparation, graphics replacement and exact checkpoint residency are implemented. A real browser save failure exposed repeated texture payloads in new-world undo; shared-image replacement records now preserve full artwork within the existing storage budget. Full headless validation passed 932 cases with 68 skips; 14 final focused checks passed. Hardware and software browser journeys passed settings, saved undo/redo, publication and two travelers crossing with main/Worker graphics. Production build and detached packaged CLI checks pass. Current usage, acceptance scope and remaining work.

Retain sustained frame-time/CPU-memory qualification and detail-transition/final-publication polish as open full-program work. Shared sculpt/paint, saved Undo/Redo, eviction/revisit and reconnect now pass with two travelers using different resident chunks and main/Worker graphics. The final hardware run includes 120 terrain handoffs over 10 minutes 27 seconds, with recurring shared edits, constant sampled GPU buffer/texture counts and model allocation, bounded content reservations and no graphics recovery. This does not qualify JavaScript heap/array buffers, desktop/mobile frame time or the separate 100-place-crossing gate. Full headless validation passes 946 checks with 68 skips; the hardware and software shared-edit journeys, production build and standalone saved-document compatibility/export check pass. Initial development-room opening measures 2.9 seconds on hardware and 5.0 seconds on software after removing redundant admission/recompilation; a follow-up fixes repeated atlas validation through LOD wrappers. Its same-workload hardware comparison measures shared Apply at 10.1–11.1 seconds versus 16.1 seconds before, and median terrain handoffs at 1.49 seconds versus 2.05 seconds. The final reported hold remains about 90 ms. These are single local observations, not a frame-time gate. The follow-up passes 16 focused checks, 947 full headless checks (68 skipped), the main/Worker hardware shared-edit journey and production build.

Format-25 distant ground keeps a compact overview resident and atomically hides each part when its detailed chunk is present; exact perimeter geometry and shading attributes are checked during admission. Declared ground uses projected-error LOD with certified boundary edges. Downloads, asset decoding and GPU staging preserve live movement/rendering, followed by a short final frame-drain/publication hold. The missing-ground residency frontier is removed for new/updated streaming patches. Larger-than-16-chunk landscapes, multilevel distant residency, broader device/performance qualification and final art remain open. Cumulative acceptance, retained failures and how to try it. No numbered milestone is closed; the estimate remains approximately 84%.

#Editable voxel ground and shared Stone hollow · 2026-10-25

Approximately 84% of the full plan; rough scope estimate, not audited completion. Creators can dig and fill volumetric stone, preview overhead/front sections, save/reopen and use durable undo/redo. The Stone hollow template provides a rounded limestone passage with lanterns and continuous approach footing. Two travelers can retain their positions through shared Dig/Undo/Redo, then explore the published passage. Versioned source, shared border samples and incremental chunk meshing keep visual/collision geometry consistent.

Verification: 924 headless tests passed, 68 skipped; both voxel browser journeys pass on hardware and software WebGPU; both neighboring heightfield journeys pass on hardware. Focused native checks also cover collision retention during preparation, restart after saved restoration and the final approach geometry. Production build and detached packaged CLI template/check/export/import/check/compile pass. Visual review caught and corrected triangle winding and approach-floor defects. Usage, exact acceptance scope and remaining limits, reviewed shared hollow.

Try New world → Stone hollow → Preview → Save → Publish, or Voxel ground to add/edit a volume. Use a fresh development server for a new world's Apply workflow; an existing room retains its world/release identity. Streaming/LOD, richer voxel tools, performance/device qualification and final art remain open. No numbered milestone is closed.

#Trees, shrubs and a shared wooded riverbank · 2026-10-25

Approximately 83% of the full plan; rough scope estimate, not audited completion. Creators can add seeded alder, silver birch and hazel, adjust species/density/scale, save/reopen, undo/redo and publish a wooded landscape. Generated river water and captured arrival clearings stay open; trunks have native collision. The Winding river template now includes woodland. Shared species meshes and capped placement bound the feature's content.

Verification: 917 headless tests passed, 68 skipped; four hardware browser journeys and two software woodland journeys passed, covering editor persistence and two published travelers with main/Worker graphics. Production build and detached packaged CLI checks pass. Repeated-world history pruning was fixed without increasing budgets. Software initial saves took 6.4–7.4 seconds with a 15-second functional allowance; five-second timing is not qualified. Usage, limits and concise acceptance record, reviewed player view.

Try New world → Winding river → Preview → Save → Publish, or Terrain → Trees & shrubs on an existing patch. Existing invitations keep their original content. Tree wind, expanded species/masks, wider performance qualification, voxel terrain and final character/environment/arrival art remain open. No numbered milestone is closed.

#Seeded river authoring and shared river crossing · 2026-10-25

Approximately 82% of the full plan; rough scope estimate, not audited completion. Creators can generate a winding channel, change seed/bed width/depth/bends/water level, sculpt and paint its banks, and save or undo ground/water/swimming together. The new Winding river template has a visible curve, dry grass and an arrival facing the water. Two published travelers can swim across, reconnect in the channel, and walk up the far bank.

Verification: 912 headless tests passed, 68 skipped; all seven final river checks passed after the source-resolution and standalone-spawn bounds review. Both river browser journeys passed on physical and software WebGPU; both neighboring landscape journeys passed on hardware, including two-traveler Apply. Production build and detached packaged authoring/terrain CLI checks passed. Usage, limits and concise acceptance record, reviewed template.

Try New world → Winding river → Preview → Save → Publish, then open the new invitation in two browser profiles. Use Terrain → Generate a landscape → Winding river to change the course. This is a level river reach; currents, branching/waterfalls, buoyant objects, final art and the remaining full-engine gates stay open. No numbered milestone is closed.

#Shared swimming and a usable pond exit · 2026-10-25

Approximately 81% of the full plan; rough scope estimate, not audited completion. Creators can enable swimming, set depth and pace, save/reopen and undo/redo. Travelers float, swim, see a breaststroke animation, reload in the water and walk out using the new Quiet pond landing. Local and trusted movement share collision rules; cooperative and trusted PostgreSQL host restarts retain swimmers’ saved positions. Existing cosmetic water keeps its behavior.

Verification: 904 cases passed in the full headless run with 68 skipped; its single stale command-count assertion was corrected and passed on rerun. Both explicit persistent-room tests passed. Both swimming browser scenarios passed on hardware and software GPUs, with software regressions for cosmetic-water editing and existing walk/jump animation. Production build and detached packaged CLI template/export/import/check/compile passed. Usage, limits and concise acceptance record documents the measured fixes and shared player view.

Try New world → Quiet pond → Preview → Save → Publish, using a new invitation in two browser profiles. Existing invitations retain their original engine/world. Surface swimming does not close buoyant objects, underwater rendering, rivers, final art or the full roadmap gates. No numbered milestone is closed by this feature.

#Editable shared water and Quiet pond · 2026-10-25

Approximately 80% of the full plan; rough estimate unchanged. Creators can place and tune water, preview/cancel, save/reopen, undo/redo, Apply to two travelers and publish an invitation. Shared room time drives ripples in both graphics placements and portal views. The new Quiet pond template supplies a jetty, banks and shallow collision bed, with animated template preview and a walkable published example. Water does not yet change movement or provide buoyancy.

Verification: 892 headless tests passed, 66 skipped; three explicit room/restart checks passed. All five water browser scenarios passed on hardware and software GPUs; seven neighboring hardware scenarios passed. Two stale integration-test expectations were corrected and rerun, documented alongside the initial presentation-version fix. Type/boundary checks, production build and detached CLI template/export/import/check/compile pass. No acceptance deadline was relaxed.

Try New world → Quiet pond, or Atmosphere → Water in an existing place. Usage, limits and concise acceptance record, published player view, water controls. Swimming, buoyancy, rivers, shoreline effects, final character/environment/arrival art and the full roadmap gates remain required. No numbered milestone is closed by this feature.

#Physical GPU Observatory qualification · 2026-10-25

Approximately 80% of the full plan; rounded estimate unchanged. The ten existing Observatory browser scenarios now pass on the named Arc B390, including rendering/data parity, device reconstruction, worker exceptions/deadlines, cancellation/retry and input/audio API cleanup. The complete renderer scenario also passes on SwiftShader. Separate negative checks on both adapters deliberately omit sRGB decoding and confirm a diagnostic failure with released worker/canvas ownership.

Physical testing exposed an overly strict diagnostic: native sRGB sampling differed from an independently computed linear factor by one RGB output byte. Fixture material-textures.2 now measures eight gray levels spanning the piecewise breakpoint, permits at most one output byte with exact alpha, and retains exact same-path restoration/channel comparisons. Incorrect decoding produces a 34-level error and is rejected. Runtime color/shader code and artwork are unchanged. Type/boundary checks and production build pass.

Acceptance and source hashes, hardware results, physical Observatory, precision contract. The initial interrupted run and measured strict-comparison failure are retained. These are short headless functional checks on one physical workstation; software restoration timing, sustained performance, phones, full engine gates and the final character/environment/arrival art pass remain open. No numbered milestone is closed. Resume the remaining playable environment and full-plan capabilities after this qualification increment.

#Overlapped editor startup and physical GPU reference · 2026-10-25

Approximately 80% of the full plan; rounded estimate unchanged. After the server accepts the editor session, graphics initialization now overlaps document checksum validation, world compilation and scene preparation. The existing graphics queue still admits one allocation at a time. Rejected login starts no GPU work; unvalidated content cannot render; failed/superseded loads and page closure fence late graphics results and UI publication. Three new browser checks exercise those boundaries with held native operations.

One diagnostic SwiftShader observation measured reload readiness at 6.53 seconds, following the previous 8.78-second batched-startup observation. The diagnostic journey completed in 56.8 seconds with its explicitly extended measurement waits. The unchanged five-second software restoration reload assertion still fails; six other final software-browser scenarios pass. These single observations are not a general performance guarantee.

A physical Intel Arc B390 / xe-3lpg is now a named test reference: Linux 7.2.8-9-omarchy, xe kernel driver, Mesa/vulkan-intel 26.2.5, Chromium 141. The explicit hardware mode records the adapter and refuses software fallback; a forced SwiftShader attempt verifies rejection. All 12 hardware-browser checks passed, including the unchanged restoration journey in 19.9 seconds (with its five-second reload check), main/Worker daylight and weather rendering, portals, device reconstruction, editor transactions and failure cleanup. Type/boundary checks and production build pass.

Acceptance and source hashes, hardware results, retained software failure, hardware rain fixture, hardware test mode. This is short headless functional qualification on one workstation; long-session/FPS/battery, other GPUs, mobile and the full-plan gates remain open. No numbered milestone is closed. Use the verified hardware profile to broaden device acceptance while retaining the software timing issue and required final character/environment/arrival art pass.

#Batched graphics startup · 2026-10-25

Approximately 80% of the full plan; rounded estimate unchanged. Rain, foliage, lettering, particle and main shader initialization now begin together. Failure still drains sibling builds before disposing the failed renderer. A native browser fault test rejects rain while holding foliage, verifies that the device stays alive until the held build settles, and then successfully retries.

A current-source restoration trace with two live travelers measured editor reload readiness at 15.47 seconds before / 8.78 seconds after. The shader-module-to-pipeline span fell from 8.04 to 2.79 seconds. These are one local paired observation on SwiftShader, including variable scheduling; they are not a physical-GPU performance guarantee. The diagnostic copy allows a longer wait to collect the trace and complete functional checks. The committed restoration test remains unchanged and still fails its five-second reload gate. No timing gate is closed.

Verification: 25 targeted headless checks passed, type/boundary checks and production build passed, and five of six browser scenarios passed. The sixth is the retained restoration reload failure. Main/Worker weather images (rain, snow and clear) match the previous committed evidence byte for byte; native daylight/weather tests retain portal, disposal and device-reconstruction coverage. Acceptance and exact scope, before, after, browser results including the failure. Continue the loading investigation; final character/environment/arrival art and the full milestones 0–18 gates remain required.

#Shared rain and snow · 2026-10-25

Approximately 80% of the full plan; rounded estimate unchanged. The atmosphere editor now authors rain or snow in a bounded outdoor area, with seed, intensity, wind, placement and size. Soft snow drifts; rain follows the wind and fades near the camera. The independent pool respects quality limits without taking gameplay entities or decorative emitter slots. Preview/cancel, exact percentage display, save/reload, durable undo/redo, two-player Apply and immutable publication are covered. Reduced motion freezes precipitation while daylight continues.

Verification: 885 headless tests passed, 64 skipped; all eight final browser scenarios passed. Six explicit real-room checks cover weather-only and day/night cooperative, PostgreSQL cooperative and trusted-host restart. Native main/Worker tests verify a pinned seeded sample, exact loop/removal/device reconstruction, depth occlusion, portal timing, stable resources and disposal. Weather adds one optional 96 KiB GPU buffer, no textures and one draw, capped at 2048 / 1024 / 512 particles by quality. Production and detached tool qualification are recorded in the acceptance evidence.

Acceptance exposed stale clock samples across the simulation → UI → graphics handoff. Time now travels with its original monotonic sample timestamp and prediction deadline. Renderers use only the remaining receipt budget, never an extra second per hop, and hold their displayed phase without rewinding on pause or expiry. The final two-player weather observations lag room time by approximately 0.29 / 0.63 seconds, and the published traveler by 0.16 seconds, under the existing 1.5-second assertion. The final shared weather journey passed in 56.1 seconds and shared daylight in 57.6 seconds. Earlier clock-lag and cleanup failures are retained; independent test contexts now close concurrently with all closures awaited. These local observations do not close broader loading, physical-device, WAN or long-session gates.

The initial source check also caught a current-scene reader still capped at presentation 13; current scenes now read weather format 14 while older envelopes remain strict. The editor’s balanced quality cap and a misplaced occlusion fixture were corrected in tests. The full failure history and source hashes remain available.

Workflow and limits, acceptance, shared rain, snow, compact controls. Shelter detection, accumulation/wet surfaces, audio, automatic weather transitions/clouds/storms, water/swimming/buoyancy, terrain streaming/LOD and voxels remain open. Final character/environment/arrival art is still required. No numbered milestone is closed. Next prioritize the shared loading and restoration timing gaps before adding further environment complexity.

#Shared day and night · 2026-10-25

Approximately 80% of the full plan. Places now support saved cycles of sunrise, daylight, sunset and moonlight, with adjustable day length, starting hour and direction. Every traveler follows the room clock, including main-thread and Worker graphics; portal destinations use the same clock with their own settings. Local lights retain their authored settings. The atelier supports preview/cancel, save/reopen, durable undo/redo, shared Apply and immutable publication. Time spent away is included when returning.

Verification: 877 headless tests passed, 62 skipped; all nine final browser scenarios passed. Three targeted real-room checks also passed, explicitly running cooperative and trusted PostgreSQL restart cases skipped by the ordinary suite. Native main/Worker rendering checks phase agreement, exact loop/undo/device reconstruction, portal timing and constant GPU resources. The shared browser journey passed in 55.1 seconds under the original 60-second budget, including a browser clock skewed by one day. Production and detached export/import qualification are recorded in the acceptance evidence.

The expanded browser campaign initially attempted an incompatible world replacement; the server correctly rejected it. The test now edits the existing entry place and checks the Apply response and live revision before proceeding. Earlier first-frame clock lag, the incompatible-world failure and an explicitly interrupted fixture correction remain in the record. This does not resolve the previously observed published-restoration reload or terrain timing gaps.

Workflow, acceptance, shared daylight, narrow controls. WAN/host-clock accuracy, physical-device and long-session qualification, weather, water, seasons, custom time curves, terrain streaming/LOD, voxels and final character/environment/arrival art remain open. No numbered milestone is closed.

#Seeded meadow grass · 2026-10-25

Approximately 79% of the full plan; rounded estimate unchanged. Terrain now supports saved grass recipes with seed, coverage, height and view distance. Bent blades move in the wind, follow the mesh triangles and grass material weights, and leave arrival areas clear. The independent instancing pool respects camera, distance and quality budgets without adding physics entities or consuming player slots. Preview/cancel, save/reload, durable undo/redo, two-traveler Apply and immutable publication are covered.

Verification: 871 headless tests passed, 60 skipped; all eight final browser scenarios passed. Main-thread and Worker graphics agree on a pinned placement hash, exact undo/device recovery and bounded resources: one extra buffer, no extra textures, zero owned resources after disposal. The shared browser journey passed in 39.1 seconds under the original 60-second budget. Production and detached tools qualification are recorded in the linked acceptance evidence.

Acceptance found and fixed a streamed-content reader that still rejected world format 19, plus a rare seed whose rounded rotation exceeded one full turn. Both now have regressions. The initial shared failure and an unconfirmed native execution-context loss are retained alongside the final passes. The earlier restoration reload and terrain timing gates are not claimed fixed by this campaign.

Workflow and limits, acceptance, shared grass, narrow controls. Trees, shrubs, species libraries, grass shadows, water/weather/time of day, terrain streaming/LOD, voxels, physical-device/long-session acceptance and the final character/environment/arrival art pass remain open. No numbered milestone is closed.

#Versioned landscape recipes · 2026-10-25

Approximately 79% of the full plan; rounded estimate unchanged. The terrain editor now generates repeatable rolling hills, weathered ridges and dry basins from a saved seed, generator version and relief. Format 3 retains both the recipe and editable baked heights/materials. Generation preserves an arrival clearing and can be cancelled or undone locally; saved patch undo/redo survives restart. CLI generation/regeneration and detached world export use the same implementation. Existing formats and brush semantics remain supported.

Verification: 866 headless tests passed, 60 skipped; 28 focused checks; production build and detached standalone generation → sculpt → regeneration → build → import/check passed. All six final browser scenarios pass, including local recipe workflows, shared Apply/publication with two travelers, and main/Worker graphics. Three fixed recipe hashes agree across Node/main/Worker. Rendering has exact undo/device recovery, a maximum of 23 buffers/5 textures, and zero owned resources after disposal.

The initial campaign exposed a save deadline failure and a shared journey timeout. Authoring now retains two completed terrain compiler states, with source checks before reuse, to avoid repeated before/after compilation during saved inverse validation. Measured warm repeat compilation fell from about 104 ms to 4–5 ms. Timing qualification remains open: the passing shared run reports 60.06 seconds including runner overhead, leaving effectively no margin; the initial failure is retained. The earlier published-restoration reload issue is not claimed fixed.

Workflow, acceptance and retained failures, controls, shared landscape. Rivers, foliage, water/weather/time of day, terrain streaming/LOD, voxels, broader device/long-session gates and the required final character/environment art pass remain open. No numbered milestone is closed.

#Blended terrain painting · 2026-10-25

Approximately 79% of the full plan; rounded estimate unchanged. Terrain now blends grass, earth, stone and sand with adjustable paint strength, source-retaining save/reload, local brush undo and durable patch undo/redo. Painting preserves collision geometry. One shared atlas gives neighboring chunks identical border samples and mip chains. Format 2 adds paint history without changing existing format-1 sources or unpainted models; paint and height undo use independent sample revisions. The standalone tools export a painted world outside the checkout.

Verification: 859 headless tests passed, 60 skipped, production builds and detached CLI import/check passed. Final main-thread and Worker rendering verifies exact undo/recovery pixels, a stable maximum of 23 buffers/5 textures and zero owned resources after disposal. Twelve relevant browser scenarios have passing runs across isolated campaigns, including shared painting/publication, templates, material edits, transform cancellation and shared behavior changes. The browser campaign is not wholly green: a repeated shared journey exceeded its unchanged 60-second total budget after the final published-world gameplay assertions; its isolated pass took 58.6 seconds. Timing qualification remains open.

The checks exposed repeated editor preparation and an oversized sixteen-chunk embedded atlas. Preview now reuses its validated candidate/models and retains an exactly matching installed scene after save. Compiler-only texture reuse keys complete validated data; streamed runtime cancellation is preserved. The atlas respects the existing portable document budget. Existing one-, two-, four- and eight-chunk sample artifacts remain identical after that correction. Workflow, acceptance and retained failures, paint controls.

Terrain LOD/streaming, procedural environments, voxel editing, broader physical-device/long-session acceptance and the final character/environment art pass remain open. The prior restoration reload issue is not claimed fixed. No numbered roadmap milestone is closed.

#Editor reload contention investigation · 2026-10-25

Approximately 79% of the full plan; unchanged. The reproduced restoration failure is now traced through draft loading and native graphics preparation. The draft HTTP request took about 9 ms; the editor eventually became ready at about 11.1 seconds after navigation, with most delay in native graphics startup. In a diagnostic control, suppressing only the two test-player GPU submissions during reload reduced readiness to about 2.7 seconds and passed the original readiness check. That control later hit the unchanged 60-second overall journey budget and is not release acceptance.

Parallel pass initialization, inactive-view cadence, same-origin preparation coordination and scene-specific optional pass preparation did not satisfy the unchanged readiness requirement. Both isolated player contexts report themselves focused; their independent browser profiles also prevent shared Web Locks coordination. All experimental production changes were removed. The original editor/runtime/tests remain as shipped in a6b299d.

Investigation, timings, retained failures and isolated diagnostic reproducer. The evidence supports concurrent software-GPU draw pressure as a contributor, not a diagnosed driver defect or completed fix. Evaluate an explicit workload/quality budget with active-view and physical-device evidence; keep this restoration acceptance gate open. No numbered milestone is closed.

#Terrain editor and shared meadow · 2026-10-25

Approximately 79% of the full plan; rounded estimate unchanged. The atelier now offers an Open meadow template and raise/lower brushes with a height map, keyboard positioning, brush radius/strength, unsaved brush undo and ground preview. Editable documents retain each patch's source alongside server-generated meshes. Saved undo/redo survives reload and server restart, preserves unrelated decoration edits and rejects overlapping patch changes. Generated ground cannot be detached through ordinary object transforms or model edits. Shared Apply and published playtests use the same compiled collision surface.

Verification: 848 headless tests passed, 60 skipped; 15 focused checks, production build and detached standalone meadow creation passed. Type/import checks cover 166 package files. Both new terrain browser journeys and both existing template journeys pass on final source. Desktop and narrow controls were visually reviewed. Two travelers retain identities and safe footing through a sculpted revision and can enter its immutable publication.

The five-scenario browser run is not fully green: published-world restoration misses its unchanged five-second editor-readiness check after reload with two active players. An isolated copy of the preceding commit reproduces the same failure at the same assertion, so it predates this increment; its cause and fix remain open. An earlier template browser-context closure and /tmp engine-copy EIO are also retained in the evidence without claiming that a later pass resolved their causes. Workflow and contract, acceptance and retained failures, terrain controls.

Per-sample collaborative operation submission, streaming chunks, painting, terrain LOD transitions, voxels, procedural environments and long-session/device acceptance remain open. The meadow is an editable starting surface, not the final environment art pass. No numbered milestone is closed; full milestones 0–18 remain the objective. Next investigate the reproduced restoration reload failure without weakening its readiness check, then continue the environmental authoring gates.

#Heightfield terrain foundation · 2026-10-25

Approximately 79% of the full plan; rounded estimate unchanged. A new terrain package owns integer-millimetre heightfield samples, smooth sculpt operations, hash/revision preconditions and bounded saved undo with per-sample conflict checks. Neighboring chunks share border positions, UVs and normals. A retained compiler rebuilds changed geometry and its normal halo while reusing distant model artifacts. The file and standalone CLI export a playable world through the existing validated model/collision pipeline.

Verification: 844 headless tests passed, 60 skipped; 15 focused checks, three browser scenarios and the production build passed. Type/import checks cover 165 package files. Real physics crosses a raised seam, rejects overlapping replacement ground without altering the original checkpoint, and restores accepted terrain collision. Two travelers receive generated terrain revisions, cross a raised chunk boundary, retain safe ground through saved-source undo and enter a published world. Main and Worker rendering both show 19,212 changed pixels after sculpt, exact undo/recovery pixels, a stable maximum of 23 buffers/3 textures across the repeated edits, and zero owned resources after disposal.

A reproduced request-mutation race was fixed by copying the brush request before asynchronous work. Detached compiler tests also exposed a pre-existing external meshoptimizer import in the supposedly standalone author bundle. It is now bundled by package root, with an output audit that cannot be masked by a temporary directory beneath the checkout. The first full /tmp run additionally hit four engine-copy EIO hook failures of undetermined cause; final full acceptance used the established workspace temporary directory, while detached compiler tests still passed under /tmp. Contract and CLI workflow, acceptance evidence.

This is a source/compiler foundation, not completed editor terrain. Editor brushes, a server-managed terrain operation journal, per-chunk streaming, painting, terrain LOD transitions, procedural environments, voxels and long-session/device qualification remain open. The final character/environment/arrival art pass remains open. No numbered milestone is closed; the full milestones 0–18 objective is unchanged.

#Authored skies and horizon light · 2026-10-25

Approximately 79% of the full plan; rounded estimate unchanged. Places can now carry a shaped sky, sun disc/glow and diffuse hemisphere lighting. Atmosphere presets and individual color/light controls support preview, saved undo across restart, shared Apply and immutable publication. Main-thread and Worker renderers use the accepted sky, including destination portal views and graphics recovery. World format 18 and presentation format 11 retain their older readers; worlds without a sky retain their previous background and lighting.

Verification: 836 headless tests passed, 60 skipped; eight browser scenarios and the production build passed. Type/import checks cover 162 package files. Native pixels verify camera translation invariance, view-dependent sun, geometry occlusion, diffuse-light influence, exact device reconstruction and bounded resources through repeated edits. Portal sky interiors differ from the direct reference by at most one channel value, with outside pixels unchanged. Shared main/Worker players retain their identities through publication and recovery. Existing atmosphere preview, conflict/disjoint-merge and two-traveler Apply journeys pass.

Verification corrected a false edit caused by saved JSON key ordering and an outdated authoring-command inventory assertion. An earlier browser runner terminated before completing shared acceptance; the absent worker was confirmed, its orphan test server stopped, and isolated final acceptance passed without attributing the termination to a known cause. Sky contract and editor workflow, acceptance evidence, narrow editor controls.

This is static authored lighting. HDR/specular environment maps, weather, moving time of day, physical-device qualification and the final character/environment/arrival art pass remain open. No numbered milestone is closed; the full milestones 0–18 objective is unchanged.

#Cooperative GPU installation · 2026-10-25

Approximately 79% of the full plan; rounded estimate unchanged. Model vertex/index/detail/tangent/skin buffers and texture mips now install in bounded transfers, yielding between validated batches. Device-global error scopes close before every asynchronous wait, so source and portal jobs cannot capture one another's errors. Recovery cancellation now reaches creation/upload work; interrupted candidates release their leases while accepted resources survive. F2 and exported reports expose accepted-catalog upload counts. Pixels, content identities, scene publication barriers and resource budgets remain unchanged.

Verification: 833 headless tests passed, 60 skipped; 31 focused checks, ten browser scenarios and the production build passed. Type/import checks cover 161 package files. Real main-thread and Worker readback verifies every geometry byte and all ten mips of a 512×512 texture, with cancellation, exact retry, reuse and device retirement. Shared travel, rejected GPU preparation, live Apply, published graphics/simulation recovery, LOD and the complete native renderer probe pass. A verification runner exited with SIGTERM during a published-player run; its worker was confirmed absent, its orphaned server was cleaned up, and only unfinished checks resumed against unchanged source. This is recorded without claiming a cause.

Native observations installed roughly 2.97 MB with 12 yields and 11 timer callbacks in each placement. The observed longest timer gaps were 16.5 ms on main and 16.3 ms in the Worker; these are single observations, not a before/after or hardware performance claim. Contract and observations, acceptance.

Aggregate scheduling, progressive mip/detail delivery, compressed GPU textures, physical-device/long-session qualification and the final character/environment/arrival art pass remain open. No numbered milestone is closed; the full milestones 0–18 objective is unchanged.

#Cooperative asset admission · 2026-10-25

Approximately 79% of the full plan; rounded estimate unchanged. Runtime decompression, canonical mip-byte conversion and mip validation now yield to ordinary tasks at explicit checkpoints. Original pixels and all artifact identities are preserved. Last-owner cancellation stops shared hydration and clears pending yield timers; cancelling one consumer preserves its siblings, and an old rejection cannot clear a newer cooled-unit retry. F2/exported reports expose content work yields.

Verification: 825 headless tests passed, 60 skipped; 42 focused checks, two PostgreSQL authority checks, six browser scenarios and the production build passed. Type/import checks cover 160 package files. Real main-thread and Worker probes verify timer progress, cancellation and exact-artifact retry; shared travel, graphics/simulation recovery, published admission and live editor revisions pass. An initial browser attempt using scheduler continuations starved ordinary timers; that failure is retained, and ordinary task yielding passes the same assertions.

The same benchmark source ran against the previous commit and final implementation. For the 512-pixel noise fixture, the median longest timer gap falls from about 251 to 21 ms, while total elapsed loading rises from about 251 to 400 ms. Artifact hashes and encoded bytes match. This is a local responsiveness/throughput tradeoff, not a four-millisecond hard deadline or an FPS/hardware guarantee. Contract and measurements, acceptance.

Aggregate CPU scheduling, remaining synchronous JSON/geometry work, incremental GPU installation, progressive mip/detail delivery, physical-device qualification and the final character/environment/arrival art pass remain open. No numbered milestone is closed; the full milestones 0–18 objective is unchanged.

#Lossless texture transport · 2026-10-25

Approximately 79% of the full plan; rounded estimate unchanged. New profile-4 manifests can deliver shared texture units as lossless compressed bytes. All original pixels, mip chains, model identities and checkpoint signatures are retained; profiles 1–3 remain readable. The compiler keeps raw JSON if compression would not shrink it. Residency, preload and cooling limits reserve both wire and expanded canonical payloads. F2 and exported reports distinguish those amounts.

Verification: 816 headless tests passed, 60 skipped; 48 focused checks, two real PostgreSQL authority checks, four browser scenarios and the production build passed. Final type/import checks cover 159 package files. Browser journeys include shared main/Worker travel, corrupt speculation and retry, graphics/simulation recovery, published admission and shared editor Apply with older-save restoration. The first failing budget test exposed a sibling-cancellation error masking the original failure; that reporting path is fixed and the failure retained.

Six analytic texture/mip fixtures measure the tradeoff. A 512-pixel repeating pattern shrinks from 1,864,830 to 9,655 bytes; seeded noise shrinks to 1,355,368 bytes. Median transport-plus-semantic-admission CPU rises from about 169 to 177 ms and 181 to 256 ms respectively. These local three-observation results are bandwidth evidence, not network-startup, FPS or physical-device qualification. Contract and measurements, acceptance.

Progressive mip quality, GPU-compressed textures, independently streamed detail, per-frame decoding budgets and the final character/environment/arrival art pass remain open. No numbered milestone is closed; the full milestones 0–18 objective is unchanged.

#Reused immutable model admission · 2026-10-25

Approximately 79% of the full plan; rounded estimate unchanged. Streaming, collision preparation, rendering and animation presentation now preserve the identity of already-admitted immutable models within one worker. Fresh JSON, copies and worker transfers still require complete validation. A private weak registry records only successful reader results. Catalog snapshots own all fresh inputs before awaiting and preserve the original aggregate byte/value/depth limits, including aliases.

Verification: 809 headless tests passed, 60 skipped; 69 focused checks and eight browser scenarios passed; production build/type/import checks passed for 158 package files. The final full suite uses four workers after one default-concurrency run received an unexplained SIGKILL in an HTTP test process; its assertions had reported success, and both its isolated retry and the bounded full run pass. The retained report does not claim the termination cause is solved.

The same catalog benchmark ran against the previous commit and current source with matching model hashes. For the 66,049-vertex / 391,680-index fixture, median fresh preparation falls from about 1,378 ms to 659 ms; repeated admitted preparation falls from about 1,397 ms to 114 ms. These are three-observation local CPU comparisons, not FPS, network or hardware qualification. Contract and measurement scope, acceptance.

First admission and encoded detail size still need optimization. Independently streamed detail, progressive texture quality, physical-device acceptance and the final character/environment/arrival art pass remain open. No numbered milestone is closed; the full milestones 0–18 objective is unchanged.

#Portable precomputed model detail · 2026-10-25

Approximately 79% of the full plan; rounded estimate unchanged. New GLB imports with usable reduced-detail meshes now carry versioned variants built by the isolated compiler process or editor import Worker. Model format 7 binds the variants to the original artifact through a checked base hash. Runtime preparation decodes the stored indices without rerunning simplification; retained formats 1–6 remain readable with their prior fallback. Mirrored instances reverse stored winding, while original geometry, collision and skin validation retain the base-format rules. The packaged compiler and dependency notice travel together outside the checkout.

Verification: 803 headless tests passed, 60 skipped; 65 focused checks and six browser scenarios passed; production build and final type/import checks passed for 158 package files. The original shared editor run completed its assertions but exceeded the overall 60-second allowance during cleanup; its trace is retained, and the three-view journey passes with a 120-second allowance and unchanged individual/runtime deadlines.

The preparation benchmark covers up to 66,049 vertices and 391,680 indices. The largest artifact grows from 11,418,206 to 12,985,283 encoded JSON bytes, including 1,175,040 bytes of stored indices. Its three-observation median preparation cost is about 639 ms with stored variants versus 567 ms with runtime derivation. This is portable precomputation, not a loading-speed improvement; serialization/admission optimization remains needed. Earlier full-geometry double hashing was replaced by a verified base-hash identity. Measurements, contract, acceptance.

Independently streamed/authored variants, progressive texture quality, preparation optimization and physical-device acceptance remain open. The final character/environment/arrival art pass remains open. No numbered milestone is closed; the full milestones 0–18 objective is unchanged.

#Distance-based static model detail · 2026-10-25

Approximately 79% of the full plan; rounded estimate unchanged. Imported static meshes now use seam-aware, border-locked reduced index variants when small and distant. Nearby geometry, traveler rigs and shadow silhouettes keep original detail. Quality presets adjust the projected-error threshold, with hysteresis to reduce transition flicker. Original source artifacts, collision and shared checkpoints retain their identities. Optional variant buffers participate in shared GPU ownership and are trimmed when necessary to preserve the existing model replacement budget.

Verification: 796 headless tests passed, 60 skipped; 28 focused checks and six browser scenarios passed; production build and final type/import checks passed for 157 package files.

The textured native fixture reduces visible triangles from 2,220 to 1,404 at High quality, about 37%, with identical near pixels. At distance, 125 pixels change, three exceed 32 channel values, and RGB RMSE is about 0.241 over 640×400. Worker and main-thread rendering agree. These are fixture measurements, not general asset-quality or frame-rate guarantees. The shared-player journey verifies distant detail, promotion on approach, grounded movement and graphics recovery preserving room identity in both placements. Contract, acceptance, worker approach, main-thread approach.

Generation currently runs during model preparation. Standalone authored/published and independently streamed LOD artifacts, progressive texture quality, large-asset preparation measurements and physical-device qualification remain open. The final character/environment/arrival art pass remains open. No numbered milestone is closed; the full milestones 0–18 objective is unchanged.

#Independent texture delivery · 2026-10-25

Approximately 79% of the full plan; rounded estimate unchanged. Transport profile 3 now separates texture images from imported model downloads and shares each validated image across distinct models. Models reconstruct with their original artifact identities and complete semantic validation. Real older profile 1/2 archives remain readable. Image leases participate in the existing priority queue, cancellation, preload budget and bounded cooling; retiring a model clears its hydrated copy so cooled geometry cannot retain unaccounted image ownership. F2 and reports show decoded texture units and encoded payload bytes.

Verification: 789 headless tests passed, 60 skipped; five browser scenarios passed; production build and final type/import checks passed for 155 package files. The two-player worker/main fixture holds and corrupts a destination image, preserves the playable source, retries, crosses while reusing the shared image, and recovers graphics without another content request. Published-player graphics/simulation recovery and shared editor Apply/old-save migration now use textured models; the portal journey also passes. Acceptance, measured ownership, worker capture, main-thread capture.

The fixture measures 7,990 encoded reserved bytes with three decoded texture units totaling 2,278 bytes. These are small correctness observations, not a production performance result. An interrupted multi-spec test runner produced no result for the unfinished tests; its isolated leftover server was identified and stopped, and those tests passed when run individually. Evidence records the interruption and the capture-only fixture corrections.

Next: progressive texture quality and decoration LOD, plus broader transport/performance qualification. Full mip chains still load before activation, and strict hydration currently copies images into distinct models. Hardware acceptance and the final character/arrival art pass remain open. No numbered milestone is closed; the full milestones 0–18 objective is unchanged.

#Adjacent place preloading and cooling · 2026-10-25

Approximately 79% of the full plan; rounded estimate unchanged. Moving toward an eligible nearby exit now prepares one bounded destination's model payloads in the background. Current collision/interaction models and visible-window requests outrank queued speculative work. Matching pending or ready preloads transfer ownership into travel without another download. Collision, GPU and durable room acceptance retain their separate gates; a failed speculative request leaves the current scene playable.

The player retains recently released decoded units for five seconds within an 8 MiB cooling cache and the existing 32 MiB total encoded reservation budget. Only unowned content can expire or be evicted. Replacement/revision/worker shutdown cancels obsolete work and fences late completion. F2 and report exports expose content reservations, cooling bytes, request reuse and preload status.

Verification: 780 headless tests passed, 60 skipped; five browser scenarios passed; production build and type/import checks passed for 155 package files. The actual two-player worker/main fixture holds and corrupts a speculative download, retries, then crosses without another destination-model request. It measures 9,367 reserved bytes, with 4,446 bytes cooling after travel; these are tiny fixture observations, not a performance qualification. Published-player recovery, shared Apply/offline saves and the comprehensive portal journey still pass. Acceptance, measured ownership, worker arrival, main-thread arrival.

Initial test corrections are retained: the native fixture needed to leave pause, and the browser's walking path intersected a real plinth collider. The corrected path uses a clear corridor; runtime collision behavior is unchanged.

Next: independently streamed textures/decoration quality and broader streaming fault/performance coverage. All structural place definitions remain resident; preloading does not recursively fetch the room graph. Physical-device qualification and the final character/arrival art pass remain open. No numbered milestone is closed; the full milestones 0–18 objective is unchanged.

#Streamed shared editor revisions · 2026-10-25

Approximately 79% of the full plan; rounded estimate unchanged. Development players now pin immutable revision manifests for startup, Apply, reconnect and recovery. Only current-place/visible-window models prepare before the existing shared acceptance barrier. Old saves and native checkpoints reconstruct their retained revision before migrating to the accepted head. Failed/cancelled downloads and rejected GPU candidates preserve the old runtime; adopted content remains alive across a commit-to-resume disconnect.

The revision archive cache bounds four owners and eight responses, coalesces reads and permits retry after a document becomes available. A reproduced asynchronous-abort race is fixed so an old abort cannot unfreeze a newer proposal. Visual inspection also removed an obsolete rejection toast from the next preparation banner.

Verification: 771 headless tests passed, 60 skipped; seven browser scenarios passed; production build and type/import checks passed for 154 package files. The final TypeScript-only initialization adjustment additionally passed seven focused HTTP checks; the final message cleanup passed the focused two-player browser journey. Browser coverage includes corrupt/held model delivery, corrected retry, offline return after 36 revisions, lost-commit reconnect, native checkpoint migration, worker stalls and both portal recovery placements. Acceptance and retained failures, measured requests/portal ownership, clean preparation banner, applied model.

An initial portal retry disconnected before acceptance; diagnostic and final runs pass, but its original cause remains unproven. The three-scene shared-room journey completed assertions but exceeded its initial 60-second test limit during cleanup; its test allowance is now 120 seconds, with assertions/runtime deadlines unchanged. Neither result qualifies hardware or multi-scene performance.

Next: interest-based adjacent preloading, stable loading priorities and bounded cooling. All structural place definitions still load; model payloads are selective. The final character/arrival art pass remains open. No numbered milestone is closed; the full milestones 0–18 objective is unchanged.

#Streamed player startup and recovery · 2026-10-25

Approximately 79% of the full plan. Ordinary, published, direct persistent and regional persistent players now load structural rules first and fetch only current-place/visible-window models. Admission pins the exact manifest; published/persistent manifests bind the accepted document and revision. Graphics become ready only after the selected catalog is installed. Device and simulation recovery reconstruct the accepted residency without fetching the whole authored world. Regional delivery invokes the retained engine's compiler, with bounded archive ownership and response concurrency.

The published two-player fixture verifies no full-world request, no unused-model download and no destination-model download before travel. Corrupt destination bytes preserve the source; retry, both recovery types and return retain player identity in worker and main-thread graphics. Cooperative and trusted PostgreSQL portal journeys verify durable travel, credential-only return, reconnect and both recovery placements. Regional travelers survive an isolated host stall and router restart with injected latency. Editor development rooms retain the existing full-source live-revision path, whose place-interest/apply journey still passes.

Verification: 763 headless tests passed, 60 skipped; 15 PostgreSQL checks and 15 browser scenarios passed. Type/import checks and production builds pass for 154 package files. Acceptance and retained failures, selective-request measurements, cooperative window, trusted window.

An early error-screen assumption was corrected. A large published-scene test first hit startup timeout, then reached its final checks beyond the overall deadline while three GPU scenes were active. The fixture now releases the editor after publication and passes the unchanged two-player assertions/deadlines. Those failures remain recorded; three-scene/hardware performance and the original startup timeout's root cause are not claimed resolved.

Next: integrate streamed manifests with proposed/accepted shared editor revisions and recovery, followed by preload priorities/cooling and broader delivery fault coverage. All structural place definitions still load; selective loading applies to model payloads. The final character/arrival art pass remains open. No numbered milestone is closed; the full milestones 0–18 objective is unchanged.

#Streamed simulation and travel · 2026-10-25

Approximately 78% of the full plan; rounded estimate unchanged. The production simulation now owns model/collision leases for the current place and one visible window destination. Full-release identity and global entities remain stable while distant payloads are absent. Profile 2 content manifests include complete compiled signatures and bounded animation metadata; downloaded clips must agree. Full and streamed simulations produce identical checkpoints after movement and distant animation, and restore each other's checkpoints without a profile migration.

Asynchronous travel prepares downloads before cloning live state. The production player travel controller creates the destination projection from its resident assets, preserves the source through preparation and cancellation, then retires the old place after the existing publication gate. A native browser fixture exercises that controller with real HTTP, Rapier and WebGPU: rejected content leaves the source frame/checkpoint unchanged; held commits do not expose the destination; checkpoint reconstruction and round-trip pixels match; closure releases all content reservations, buffers and textures. The destination screenshot was visually inspected.

Verification: 760 headless tests passed, 59 skipped; two PostgreSQL content checks passed; four browser journeys passed; production build and type/import checks passed (154 package files). Existing two-player portal/recovery and GPU-residency journeys still pass with full-source bootstrap. Acceptance, measured residency/checkpoints, native destination.

Normal player startup still uses full source. The next integration must select streamed content during admission/worker startup and recovery, and handle new manifests during shared revisions. The isolated streamed browser fixture uses a controlled commit gate, not PostgreSQL membership. Regional routing, predictive prefetch/priorities/cooling, physical-device qualification and final character/arrival art remain open. No numbered milestone is closed; the milestones 0–18 objective is unchanged.

#Selective place preparation · 2026-10-25

Approximately 78% of the full plan; rounded estimate unchanged. Structural compilation now validates global identities, gateways, inventory, materials and behavior bindings independently of model payloads. Place preparation admits only the selected dependencies, then produces the existing collision triangles and presentation assets. StreamedWorld owns the layout and selected-place leases; cancellation, closure and failed preparation retire candidate ownership while retaining accepted content.

A real HTTP browser fixture downloads source definitions first, then only the current model. Native Rapier collision measures the expected 0.440000057 m surface, and WebGPU shows seven source draws. Corrupt/cancelled destination downloads preserve the original PNG hash. A prepared destination remains hidden until explicit commit, renders four draws, and a return restores the original image exactly. Closure reaches zero content reservations, GPU buffers and textures. Gallery and annex captures were visually inspected.

Verification: 752 headless tests passed, 59 skipped, two PostgreSQL content checks passed, five browser scenarios passed (the new selective-preparation fixture plus the existing publication/retained-engine journeys and native renderer recovery corpus), and production builds/type checks passed for 153 package files. Golden output from the previous committed compiler matches formats 1–17. The initial full suite caught signed-zero normalization in legacy transforms; preserving their in-memory representation fixed the existing Darkwind projection regression. Acceptance, native measurements, and preparation contract.

All place source definitions remain resident for cross-place validation; model payloads are selective. This is verified in an isolated native fixture. Streamed simulation/checkpoint admission, normal player/worker integration, production travel activation, adjacent preload/cooling and regional delivery remain open. No numbered milestone is closed; the full milestones 0–18 objective and final character/arrival art pass are unchanged.

#Verified content distribution · 2026-10-25

Approximately 78% of the full plan; rounded estimate unchanged. A validated world now has a pinned place-content.1 manifest and separate place/model downloads. The bounded loader verifies transferred bytes and imported-model semantics, fetches only requested place dependencies, shares aliased models, cancels obsolete consumers and fences late completion. Exact content URLs never substitute a newer revision. Relay, development, published invitations and direct PostgreSQL rooms expose the routes through their own content/engine ownership.

Real HTTP tests cover selective requests, published-versus-development isolation, restart, content revision changes, corruption, bounded bursts and complete CPU reconstruction of a fixture. Integration testing caught and fixed a serialization-order mismatch with the room admission fingerprint. The published multiplayer browser journey also exercises the retained production engine's new delivery route.

Verification: 744 headless tests passed, 59 skipped, two additional PostgreSQL delivery tests passed (cooperative and trusted), and three browser scenarios passed. Production client/server/authoring/retained-engine builds and type/import checks passed for 152 package files. Acceptance and evidence, transport and ownership contract.

Normal play still loads the complete world. Partial compiler/simulation admission, collision/GPU readiness, adjacent preload priorities, cooling, regional-doorway delivery and browser streaming-failure journeys remain open. This increment does not change character art or claim player bandwidth savings. No numbered milestone is closed; milestones 0–18 and the deferred final character/arrival art pass remain the objective.

#Shared GPU model residency · 2026-10-25

Approximately 78% of the full plan; rounded estimate unchanged. Source and portal destination views now share validated immutable geometry, tangent/skin influence buffers and material images on one GPU device. Animation palettes and material bindings remain private. The pool accounts for accepted and pending allocations under a 64 MiB unique model-memory budget and 32,768-handle bound, while preserving the existing 32 MiB per-view logical replacement limit. Unvalidated native allocations cannot be reused; failed candidates roll back without destroying accepted siblings. Last-reference retirement, device identity fencing and root-device disposal make ownership explicit.

The native portal fixture measured 2,243,668 unique model bytes versus 3,962,984 logical bytes across two views—about 43% less. It confirms unique native handle counts and unchanged destination pixels after retiring the source catalog. This is a model-memory fixture result, not a total GPU-memory or frame-rate claim. F2/export now expose device model usage, peak/limit and reuse count separately from the current view's logical catalog.

Verification: 730 headless tests passed, 57 skipped, type/import checks passed for 149 package files, and seven browser scenarios passed: the portal gallery and its cancellation/startup handling, shared two-player publication/travel/recovery, the broader native material/skin renderer corpus, and repeated place travel in worker and main-thread placements. The older residency check hit a detached diagnostic-row read; reading the label/value atomically fixed it, with the original failure retained. A new skeletal test mock also needed to support native ArrayBuffer writes. Acceptance, native measurements, gallery, and residency contract.

This removes duplicate GPU allocations before broader preloading. World source, collision compilation and CPU descriptions still load as an embedded whole; network asset streaming and adjacent prefetch remain open. Physical hardware/soak gates and final character/arrival art remain open. No numbered milestone is closed; the full milestones 0–18 objective is unchanged.

#Persistent portal travel and recovery · 2026-10-25

Approximately 78% of the full plan; rounded estimate unchanged. The player portal integration now has two PostgreSQL-backed browser journeys: cooperative and server-authoritative static-world rooms. Each uses one graphics worker and one main-thread renderer, real movement/interaction, durable outgoing/return travel and visible destination travelers. Removing local saves while retaining only the return credential restores the same player in the committed destination. Closing the actual worker socket reconnects with a fresh motion stream. Real device loss and simulation-worker termination reconstruct the window in both placements.

Injected destination shader failure rejects a return crossing without changing the database place; retry succeeds. Each final destination channel retained one 4 MiB allocation and returned every sent buffer. The exported main-thread report has zero source rigs and one destination rig. Both profiles' worker/main screenshots were visually inspected. These are repeatable integration checks, with no runtime or art change in this increment.

Verification: two browser journeys passed, and type/import checks passed for 148 package files. The runner uses a fresh PostgreSQL cluster with fsync and synchronous_commit enabled, retained production engine assets, Node 22 and Chromium/SwiftShader. No additional latency is injected in these portal journeys. The initial attempt contained a test syntax error, corrected before browser execution; its log is retained. Acceptance, measurements, cooperative window, and trusted window.

Run npm run test:browser:persistent -- --portals or npm run test:browser:trusted -- --portals with PostgreSQL binaries and a supported browser installed. This fixture is isolated from normal editor/beta rooms. General destination streaming, physical-device performance, seamless crossings, remaining extended portal capabilities and the final character/arrival art pass remain open. No numbered milestone is closed; the full milestones 0–18 objective is unchanged.

#Shared player portal windows · 2026-10-25

Approximately 78% of the full plan. Authored windows now appear during normal shared play, showing the destination and its travelers in both graphics-worker and main-thread placement. Startup and reconstruction install source/destination graphics before enabling presentation. Independent acknowledged transfers keep destination updates bounded to one 4 MiB buffer, allocated only when a window is needed. Travel and shared revisions stage both views together; failed or cancelled preparation preserves the accepted scene and stream.

The two-player browser journey verifies visible destination travelers, no source-place duplicates, round trips, destination removal/reinstallation, failed destination shader preparation during shared updates and local travel, successful retries, reconnect, and device and simulation recovery in both graphics placements. It uses a real direct worker channel and the main-thread fallback in one room. A main-thread recovery race exposed by that journey was fixed by excluding ordinary drawing during recovery-frame verification and gating early source packets until bootstrap completes. The original failure is preserved in the evidence. The first test attempt also needed to wait for the existing bounded travel preparation rather than assuming it finished within five seconds.

Verification and environment details are recorded in acceptance. The full headless suite passed 719 tests, with 57 skipped; type/import checks passed for 148 package files, and six browser scenarios passed, including the existing shared recovery and native portal diagnostics. Measured transfers show one allocation per destination channel and complete buffer returns at the end of the shared journey. Worker and main-thread screenshots were visually inspected.

To try it after restarting the current development editor server: select a gateway, open Gateway…, enable Show a window into this place, preview and Save, then Start shared room or Apply saved revision. Use two browser profiles and send one traveler to the destination. Existing worlds do not gain windows automatically.

No numbered milestone is closed. Persistent/trusted portal browser journeys, broader destination streaming, physical-device performance, seamless physical crossings, the remaining extended portal requirements and the final character/arrival art pass remain open. The full milestones 0–18 objective is unchanged.

#Live portal destination renderer and projection · 2026-10-25

Approximately 77% of the full plan; rounded estimate unchanged. The destination renderer now stages an exact scene baseline, independently animates traveler rigs and lantern attachments, accepts live updates, repairs missing scene revisions and rejects delayed updates from a retired window. Invalid rig preparation preserves the accepted window and releases candidate resources. A live destination reconstructs pixel-for-pixel after native device loss at the same animation time.

A separate player destination projection reads the canonical entity store and shared immutable asset descriptions. It filters destination geometry, environment, decorations and travelers without another physics world or changes to source projection history. Actual travel selects the next one-hop view; changed source places and retired simulations cannot publish through the old projection.

Verification: 71 focused headless tests passed, type/import checks (148 package files) and four browser scenarios passed. Native evidence includes a visible rig/lantern changing 2,079 pixels, movement, departure, revision-gap repair, stream replacement/discard, failed rig cleanup and live destination device reconstruction. Existing authored preview, Save/undo and two-player shared publication still pass. The rendered traveler was visually inspected. The initial browser fixture used an inventory ID instead of the rig's attachment ID; that failure and its correction are recorded in acceptance, alongside measurements and the rendered fixture.

This step supplies live renderer/projection capabilities; normal player windows are not activated yet. Startup/recovery, acknowledged destination transfers, both player graphics placements, travel and shared-revision transactions remain the next integration work. No numbered milestone is closed. Physical GPU qualification and the final character/arrival art pass remain open.

#Bounded portal destination presence · 2026-10-25

Approximately 77% of the full plan; rounded estimate unchanged. Relay and persistent rooms now filter traveler presence to the current place plus one authored window destination, before encoding each recipient's snapshot. The destination's own window does not recurse. Legacy place-only/whole-room wire shapes remain supported. Persistent clients request the extension only when the session advertises it, preserving the strict hello expected by older retained servers even for format 17.

Destination metadata is owned, bounded and checked against the accepted world. Self must belong to the primary place, sequence regressions reject, and negotiated capability cannot drift within a connection. A live revision now keeps portal-capable connections alive with a fieldless heartbeat while clients install different world graphs, then releases the matching baseline. Interaction authority context remains limited to the action's place. Persistent travel also now resolves an anchored gateway's world-space interaction point instead of treating its local offset as a world coordinate.

Verification: 711 headless tests passed, 57 skipped, type/import checks (148 package files), 16 PostgreSQL-backed persistent/trusted room tests passed, and four distinct browser journeys passed. Real socket tests cover one-hop exclusion, capability rejection, legacy clients, reconnect and a held revision with different accepted world graphs. Database tests cover committed travel, out-of-reach rejection at the misleading local offset, destination peers, reconnect and advertisement fallback. The browser receives the other traveler at the destination while rendering zero traveler rigs in the source room; live publication and forced reconnect retain identities. Existing place-interest and both development-recovery journeys pass.

The first combined browser run correctly rejected creator fixtures replacing the active recovery world's interaction identities. The two creator cases passed when run in separate fresh rooms, as their runbook requires. Early fixture normalization and static-world heartbeat reader failures are retained in acceptance and evidence. See measured subscriptions and the protocol contract.

This completes the transport dependency, not player portal rendering. Destination scene/actor projection, graphics transactions, bounded residency and reconstruction in both graphics placements are next. The cooperative relay still trusts admitted poses; this is not an anti-cheat boundary. No numbered milestone is closed. Physical-device acceptance and the final character/arrival art pass remain open.

#Authored gateway windows and editor composition · 2026-10-25

Approximately 77% of the full plan; rounded estimate unchanged. Gateway controls now compose one upright window into another place. Opening dimensions, offset and facing have an independent destination view frame, with an option to start from the travel arrival. Frame selection positions the editor camera to inspect it. Preview, Save, reload, durable undo/redo and removal preserve the existing authoring workflow. Wide and narrow controls and the rendered preview were visually inspected.

World format 17 and compiler identity portal-window-world.17 carry the bounded source. The aperture follows its anchor and parents while retaining metre dimensions independently of ornament scale. Tilted/inverted frames and a second window reject. View edits preserve travel arrivals, entity identities and simulation state; surface edits retain format 17. Destination assets and source catalogs prepare before preview activation.

Verification: 708 headless tests passed, 56 skipped, type/import checks (148 package files) and five browser cases passed. The authoring journey verifies exact source undo/redo and publication while two travelers remain connected; the existing named-arrival journey verifies position/heading and round trips. Native portal clipping, ownership, device reconstruction and diagnostic failure/cancellation checks also pass. Initial fixture failures and readiness/total-test-budget corrections are retained in the evidence; operation deadlines remain bounded.

Acceptance and source identities, preview, narrow controls, and authoring contract. Restart the original editor server before trying format-17 edits because its backend and retained engine are built at startup.

This increment is editor preview only. Travelers accept the saved world but do not yet render the window or receive people in its destination. Main/worker player integration, bounded destination residency, server-filtered peer interest and coordinated recovery are next. No numbered milestone is closed. Physical-device qualification and the final character/arrival art pass remain open.

#One-level portal rendering foundation · 2026-10-25

Approximately 77% of the full plan. The owned renderer now presents an upright window into a separate destination scene on the same GPU device. Rigid camera mapping, destination clipping, local foreground depth occlusion, near-plane window handling and cached projective sampling are implemented. The destination stays linear HDR until the parent applies tone mapping/bloom. The parent render graph declares its borrowed portal target without reallocating existing targets.

One active destination and one candidate are bounded by existing scene/asset limits, a 20-second preparation deadline and 15-second shader deadlines. Performance/balanced/high color targets admit 65,536 / 131,072 / 262,144 pixels at 15 / 20 / 30 Hz. First visibility and resize refresh immediately; the destination retains a fixed 2048² shadow map. Target replacement has separate 24 MiB graph / 4 MiB output peak bounds. Failed setup/compilation/text rasterization, discard and cancellation preserve the accepted view. Destination text is prepared before commit. Held native work retains its slot until settlement; disposing a borrowed child never destroys the parent device.

Verification: 704 headless tests passed, 56 skipped, type/import checks (146 package files), and six distinct browser scenarios passed across the full renderer/shared-player run and final diagnostic-control follow-up. Native checks cover geometry/particle/text clipping, occlusion, camera movement, close-up coverage, cache/quality gates, partial allocation and text-raster failures, held native cancellation and actual device reconstruction. Two independently rendered camera references agree within one color level in smooth interiors and 0.0751 mean across the sampled region; the initial strict per-pixel comparison found differences concentrated at edges (maximum 11), retained in the evidence. Allocation instrumentation confirms 15 buffers / seven textures for the active two-view fixture, returning to seven/three after removal and zero after disposal. The destination's logical target footprint is 21,897,216 bytes at 640×400. The existing renderer acceptance case runs twice, and the existing two-player surface publication/device-recovery journey passes.

Try Check portal views in the Observatory. Acceptance and source identity, native measurements, gallery, and rendering contract. This is the rendering foundation: authored gateways, editor placement, destination residency/interest and multiplayer destination activation are next. Existing interaction-based travel is unchanged. Physical-device performance, broader graphics capabilities and final character/arrival art remain open; no numbered milestone is closed.

#Visual surface workshop · 2026-10-25

Approximately 76% of the full plan; rounded estimate unchanged. The material dialog now opens a visual node workshop for every existing surface operation. Creators can start from the original surface or a recipe, add nodes, connect typed ports or menus, rename nodes, refine values and use local undo/redo. Compact input cards, routed connections, zoom/fit and a scrollable inspector keep the graph readable; narrow screens retain the action bar. The advanced JSON editor remains available.

The workshop owns an isolated draft and 60 local undo steps. Removal leaves explicit empty connections; it does not silently prune other nodes. Invalid types, missing connections, cycles, disconnected nodes and exceeded budgets cannot reach material preview. Closing or pressing Escape discards the workshop draft. Accepted graphs follow the existing preview, save, durable undo, shared activation and portable-arrangement paths. Node positions and zoom never enter world source; world/compiler/presentation identities are unchanged.

Verification: 697 headless tests passed, 56 skipped, type/import checks (144 package files), and five final browser scenarios passed. A custom eight-node surface survives preview, save, reload and exact world undo/redo. Existing two-player publication, worker device reconstruction and portable arrangement tests also pass. Wide/narrow screenshots were inspected after two layout refinements. The first headless run exposed a watchdog test observing an empty, just-created exit marker; it now waits for the complete marker within the same deadline. Runtime watchdog behavior is unchanged and the initial failure is retained.

Acceptance and source identities, wide workshop, narrow workshop, and authoring contract. Run npm run test:browser:surfaces for the focused browser suite. The graph language remains bounded to surface outputs; general texture/effect nodes, visible portals, physical-device qualification and the final character/arrival art pass remain open. No numbered milestone is closed.

#Saved procedural surfaces and shared activation · 2026-10-25

Approximately 76% of the full plan. The material editor now offers Moss & limestone, Gilded porcelain and Breathing lantern recipes, editable constants and an advanced literal connection editor. Saved objects reference a bounded place catalog. Preview/refinement, durable undo, shared publication, main-thread/worker graphics and device reconstruction retain the same source. Portable arrangements carry used recipes, remap conflicting names and preserve linked copies after recipe edits.

World format 16, presentation envelope 10, and portable arrangement source 3 version these contracts. A place admits 8 recipes / 128 total nodes / 384 weighted operations. All forward pipelines compile before the graphics transaction commits its models, lettering, surface bundle and scene. Native compilation has a 15-second deadline inside the existing 20-second graphics preparation bound. Failed/discarded candidates preserve the accepted image; cancellation retains the native slot until completion. Recipe-only edits leave simulation entities and player state unchanged.

Verification: 690 headless tests passed, 56 skipped, type/import checks (143 package files), three final editor browser journeys, and two native/recovery browser cases passed. The native catalog study verifies imported models, slot isolation, failed/cancelled compilation and identical recovery with 13 buffers / three textures. The shared player uses worker and main graphics placements and reconstructs one recipe / 54 buffers / four textures after worker device loss. Screenshots were inspected at wide and narrow sizes.

Testing exposed and fixed stale shadow-light indices in arrangement previews and JSON-order-sensitive no-op material commands that created unnecessary prefab overrides. A combined native study exceeded its worker deadline and was separated into independent bounded requests. /tmp engine-copy failure and native external-Instance errors are preserved in the evidence; fresh workspace-disk runs passed, without claiming a confirmed root cause for the native error. Acceptance, native measurements, shared recovery, controls, portable preview, and source/ownership contract.

The advanced connection editor is literal source, not a node canvas. General effect/texture nodes, visible portals, physical-device performance, broader driver qualification and the final character/arrival art pass remain open. No numbered milestone is closed.

#Typed surface graph compiler and native study · 2026-10-25

Approximately 75% of the full plan; rounded estimate unchanged. A versioned literal surface graph now validates scalar/vector connections and compiles into the owned renderer's WGSL templates. It supports surface inputs, arithmetic, mixing, noise and cosmetic time, with source-path errors and node-level shader diagnostics. Moss & limestone, Gilded porcelain and Breathing lantern are sample graph data. This is the required compiler foundation; saved per-object materials, shared activation and editor controls are the next integration work.

Admission permits 32 connected nodes, 16 dependency levels and 96 weighted operation units. Unknown fields, cycles, missing or mistyped connections, unused nodes and oversized source reject before GPU compilation. Generated locals never interpolate creator identifiers. All forward pipeline variants compile before activation, using the existing last-good shader controller. A held compile and injected native syntax error both preserve the accepted image. Six repeated replacements retain seven buffers / three textures, and actual device destruction followed by source reconstruction restores the same rendered surface.

Verification: 682 headless tests, type/import checks (142 package files) and the full native browser acceptance case (two complete probe runs) passed. GPU compute readback checks independently expected arithmetic outputs, and a two-hour clock fixture prevents a small intermediate bound from freezing time-driven effects. The initial full suite hit three retained-engine write failures; a focused diagnostic identified EDQUOT under /tmp. The unchanged suite passed with an isolated workspace-disk temporary directory, then removed that directory. Acceptance and limits, native measurements, surface study, and compiler/source contract.

The study currently applies one graph across a diagnostic scene. This does not yet add graph authoring to the material editor or shared worlds. Static admission weights are not measured GPU time, and buffer/texture counts do not measure driver pipeline caches. General texture/effect nodes, visible portals, physical-device qualification and final character/arrival art remain open. No numbered milestone is closed.

#World lettering and shared readable signs · 2026-10-25

Approximately 75% of the full plan. The atelier now offers Signs & lettering: two short lines, placement, height, color, Classic/Simple type, optional dark signboard, fixed direction or camera-facing text, and a reading distance. Preview/discard, Save, durable undo/redo and Apply use the existing authoring workflow. Travelers can pause and choose Read the signs for a semantic reading view. World format 15 and presentation envelope 9 carry lettering without adding canonical entities or simulation state.

The renderer supports 32 signs / 128 Unicode characters each, with fixed atlas cells and at most 8 MiB of active texture storage. Signs test scene depth, use premultiplied alpha and distance fades, and sort by center distance. Native checks verify wall occlusion, back faces, billboards, the maximum atlas, ten add/remove cycles and identical restoration after actual device destruction. A held-upload cancellation test exposed and fixed candidate-resource retention and delayed cleanup crossing a newer revision's barrier. Painting every label at the same scratch origin also removed atlas-position-dependent raster variation without relaxing the original one-channel image tolerance.

Verification: 678 headless tests, type/import checks (138 package files) and five distinct browser cases passed. The two-traveler journey retains identities through live publication and GPU recovery, restoring a 256 KiB sign atlas with 55 buffers / five textures. Both existing shared-revision recovery cases pass. Their three-page software-rendered fixture now uses 960×640 viewports after the initial run completed functional assertions but timed out on its final screenshot. A later combined run reported an invalid native graphics Instance during traveler startup; both lettering journeys passed in a fresh isolated browser. These findings and the failing reports remain recorded, without claiming broad driver or hardware qualification. Acceptance, measurements, shared sign, reading view.

See authoring, ownership and scope. This is bounded planar lettering, not general typography or transparency. Material/effect graphs, textured sprites, visible portals, physical-device measurements and the final character/arrival art pass remain open. No numbered milestone is closed.

#Floating light and bounded particle effects · 2026-10-25

Approximately 74% of the full plan. Atmosphere now includes editable glowing motes and embers, with world-space volumes, drift, lifetime, color, glow, repeatable seeds and explicit quality scaling. Preview, discard, saved undo/redo, export and shared live publication use the existing authoring workflow. World format 14 and presentation envelope 8 carry the new effect contract; particle revisions preserve canonical entities and simulation state.

A fixed CPU pool supports at most 8 emitters / 2048 particles per place, backed by one 65,536-byte GPU storage buffer. Soft additive billboards test scene depth and render into the HDR target before tone mapping. The native study verifies wall occlusion, visible animation, the maximum pool, rejection without losing the accepted image, twelve repeated add/remove cycles, and identical image restoration after actual device destruction. Reduced motion fixes decorative time; quality tiers select stable subsets.

Verification: 674 headless tests, type/import checks (134 package files) and six distinct browser checks passed. The shared journey publishes to two travelers, then changes quality and destroys the graphics device: 144 High / 49 Performance particles, with 54 buffers / four textures retained through recovery and traveler identities preserved. The atelier deliberately previews Balanced density; its 256-particle authoring fixture renders 172. Acceptance, measurements, moonlit preview, narrow controls.

See particle authoring and ownership. No numbered milestone is closed. Compute effects, textured sprites, world text, general transparency, effect graphs, overdraw budgets, measured physical device targets and the final character/art pass remain open.

#Adaptive resolution and aspect-preserving targets · 2026-10-25

Approximately 73% of the full plan. Visual quality now offers optional Automatic, alongside fixed High, Balanced and Performance presets. High remains the default. Automatic measures sustained completed-frame pressure, lowers one resolution tier at a time and restores detail after longer sustained headroom. It ignores inactive/stale/suspended observations and keeps manual overrides fixed. Preferences survive reload; device recovery clears measurements while retaining the selected target. Lighting, scene geometry and simulation stay on their existing paths.

Both target axes now use a common scale when fitting device/dimension caps, fixing projection distortion on wide and tall displays. The main-thread browser fixture confirms an actual 2560×720 target for a 3200×900 viewport. The standard fixture moves from 800×500 to 640×400 under an added 80 ms queue-completion delay; manual Performance reaches 480×300. Across switching, reload and actual GPU device loss, both renderer placements retain 53 buffers and four textures. Estimated frame targets decrease from 21,577,216 to 18,505,216 bytes, with the fixed shadow target preserved. The shared worker journey retains its traveler identity while a second traveler remains connected.

Verification: 670 headless tests, type/import checks and five browser checks passed, including the complete native renderer lifecycle probe, GPU backpressure and independent render-worker regressions. New rate tests exposed and fixed history windows that were too short at very fast sampling and an observation minimum that excluded two-frame-per-second pressure. A final oversized-viewport guard matches the existing viewport contract and passed the full headless suite after the browser run; valid viewport behavior was unchanged. Acceptance and measurements, settings, and policy/runbook.

This is a bounded resolution policy with native acceptance, not a calibrated hardware-tier or production-FPS claim. Queue waits include scheduling; the injected delay is not a performance benchmark. Physical devices, thermal/long-session behavior, dynamic shadow/effect quality, Docker/Coolify and remote CI remain open. Character and shared-arrival art remain in the final pass. No numbered milestone is closed; the full milestones 0–18 scope is unchanged.

#Creator panel workshop and scoped suggestions · 2026-10-25

Approximately 72% of the full plan; rounded estimate unchanged. The atelier now offers Panel workshop… for a selected saved object. Creators can import, edit and download a small declarative interface, preview it in an isolated frame and allow suggestions for that object. The example offers stone/green finishes and a quarter-turn pose. Suggestions enter the existing proposal checker, unsaved scene preview, explicit Save and durable undo flow. Applying an accepted revision updates the shared room without replacing either traveler's identity.

The host owns the selected entity, revision, action values and permission. The frame receives no editor key or saved world. Source permits bounded headings/text/buttons, escaped into engine-generated HTML with a nonce-bearing bridge and restrictive CSP. Its opaque origin cannot read the parent DOM/storage. The host checks the actual source window, session, sequence, rate, action, permission and current binding before producing a strict proposal. Source edits, rebuilding, closing and page teardown revoke grants and remove the old frame. Arbitrary scripts, raw HTML, URLs and CSS are outside the declared format.

Verification: 661 headless tests, type/import checks and five browser cases passed. The two panel journeys cover live shared revisions, grant/revocation, keyboard activation, file import/export, hostile markup, forbidden network/storage/parent access, spoofed messages and stale proposals; the three existing proposal journeys retain conflict, preview and durable undo checks. A strengthened keyboard fixture initially attempted focus before the permission message enabled the button. Its trace confirmed focus remained on the host checkbox; waiting for enabled state and verifying focus fixed the test without changing application code or deadlines. Both strengthened journeys then passed. Acceptance and investigation, workshop, narrow layout, and source/bridge contract.

This completes a scoped editor-panel capability, not milestone 13. General creator UI plugins/gameplay HUDs, asynchronous jobs, the assistant task journal/provenance system, broader device/process-isolation qualification and public untrusted hosting remain open. Character and arrival/camera polish remain in the final pass. The full milestones 0–18 objective is unchanged.

#Restricted custom responses and private fault inspection · 2026-10-25

Approximately 72% of the full plan. Static objects now offer Behavior → Custom response in the atelier. The starting recipe glows on every third touch, with both travelers contributing to a shared counter. Creators can edit bounded JSON, preview the active finish, save/apply it and inspect the live response's fault count and source path. Failed responses leave prior state intact; three faults park the binding, and a source/configuration edit rearms it.

The interpreted language owns its source, accepts only engine-supplied literal capability grants and enforces instruction, data, collection, local and command limits. The existing behavior transaction commits state, appearance, RNG and outbox together. The cooperative relay retains private execution state and sends only public appearance changes. A real socket restart restores the count, and a duplicate intent does not advance it. Generic engine integrations can use the existing hook names; authored shared objects explicitly accept only onInteract.

Verification: 656 headless tests, type/import checks and two multiplayer browser journeys passed. The custom journey proves rejected capabilities, shared counts, state-preserving live color edits, fault parking, authenticated source-path inspection and source repair with both identities retained. The installed Touch glow journey also passed. Its earlier timeout reproduced on committed HEAD; explicit 960×640 traveler viewports reduce software-rendered fixture load while retaining the original deadline and assertions. The two independent authored-world journeys now use separate server fixtures to preserve world identity.

A reproducible local benchmark measured 0.024 ms p95 for the starter interpreter and 7.15 ms p95 for a sixteen-binding relay transaction including source preparation, private snapshot restore and export. The latter has 64 samples and excludes socket traffic/fsync; it is not a production capacity claim. Allocation limits count logical units, not VM heap bytes. The native callback comparison does not qualify general JavaScript isolation. Acceptance and investigations, source editor, private fault inspection, and language/runbook.

Restart the editor server after updating to rebuild its retained engine bundle, then select an object and open Behavior → Custom response. Public untrusted creator hosting remains disabled. Creator UI isolation, async jobs, broader permissioned authoring tools, dynamic trusted/PostgreSQL behaviors and full hostile-content/device/production qualification remain open. No numbered milestone is closed. Character and arrival/camera polish remain in the final pass.

#Touch exploration and safe device handoff · 2026-10-25

Approximately 71% of the full plan. Touch-capable browsers now offer a movement pad, drag-to-look, Jump and Run, with portrait/landscape layouts in the existing brass-and-forest style. Separate fingers can move, look, jump and interact together. A second finger can open menus while movement is held; cancellation, menus, reconnect, blur and rotation release held input. A connected controller can take over, and a fresh touch restores the touch controls after the controller becomes neutral.

The browser-independent adapter feeds the existing semantic action map. The trusted production host acknowledges ordinary inputs and retains authority over movement and inventory. In a two-traveler test with 150 ms added round-trip delay, the peer observed movement and shared pickup ownership; after removing local pose data, PostgreSQL restored the original traveler, inventory and committed position.

Verification: 647 headless checks, type/import checks, 10 browser checks, a strengthened frame-suspension regression and the packaged trusted touch journey passed. Screenshots and bounds checks cover 320×640, 390×844 and 844×390 layouts. Desktop failures were reproduced on the committed baseline: pointer-lock recentering could turn the camera before its event guard ran, and an older cadence fixture withheld the first frame required for admission. The lock request is now guarded; the fixture suspends and cancels frames after admission and still proves movement/look/release without UI callbacks. Acceptance and investigations, phone controls, landscape welcome, and input contract/runbook.

These results qualify browser-emulated touch and the tested native server path. Physical phones/tablets, mobile GPU/thermal performance, Safari/Firefox, actual safe areas, screen readers, longer sessions, Docker/Coolify and remote CI remain unqualified. No numbered milestone is closed. Character redesign and shared-arrival camera/art polish remain in the final pass.

#Prepared room content and measured native capacity · 2026-10-25

Approximately 70% of the full plan. Trusted rooms now compile and retain immutable world content once for their traveler motors. Each traveler still owns separate ECS, native physics, progress, behavior state and input stream. Arrivals, reconnects and motor replacement reuse the prepared content. The existing asynchronous simulation API and save/checkpoint formats remain compatible; no database migration is added.

A reproducible npm run bench:rooms trial packages the production regional gateway and retained trusted engine, starts isolated PostgreSQL, grows to two rooms of eight protocol travelers, records actual CPU/database writes/payload traffic, and reconnects everyone together with 150 ms added round-trip delay. Before sharing, the baseline admitted eleven travelers (3 + 8) and exceeded the unchanged 512 MiB room admission budget. The final trial passed all stages at sixteen (8 + 8), including reconnect, with 487.2 MiB highest sampled room RSS, at least 29.99 acknowledged inputs/second per traveler, and 314.43 ms worst observed p95 acknowledgement latency. All sixteen identities and inventories survived the 1.03-second reconnect, and a seventeenth arrival was refused.

At sixteen travelers before reconnect, a twenty-second phase used 15.25 CPU seconds across gateway/rooms and 0.80 CPU seconds in PostgreSQL, recorded 80 durable autosave receipts, 211,688 WAL bytes, and 7,648,508 received application payload bytes. These are measured local fixture costs, not cloud prices or complete wire/asset traffic. The earlier failed prepared trial exposed a load-bot heartbeat before admission; the real browser already waited correctly. Another trial passed movement and reconnect but lacked complete CPU accounting for an exited database worker. Both reports remain in evidence. Focused tests reproduce the heartbeat issue and verify CPU retention across actual exited child/grandchild processes; neither host budgets nor deadlines were relaxed.

Verification: 644 headless checks, 62 PostgreSQL/socket/recovery checks, type/import checks, regional browser recovery, cooperative lifecycle and the complete trusted exploration/storage/reward journey passed. Real SIGTERM cancellation shut down all owned services and removed the temporary database. Acceptance and investigations, complete final measurement, and trial/API runbook.

This qualifies the bounded native movement/autosave fixture on this machine. Long-soak stability, dense rendered crowds, travel-heavy load, physical-device and WAN qualification, Docker/Coolify execution, cloud cost and remote CI remain open. No numbered milestone is closed. Character and arrival/camera polish remain in the final pass.

#Measured host health and admission pressure · 2026-10-25

Approximately 69% of the full plan; rounded estimate unchanged. Persistent hosts now report bounded event-loop delay, trusted tick cost, dropped catch-up time, durable queue age/wait, acknowledged COMMIT and transaction latency, reconnect observations and process memory. Fixed histograms retain sixty one-second buckets. New arrivals avoid measured pressure; already admitted work and saved returns continue under the normal capacity, lease and durability rules.

Regional operator inspection uses a separate optional bearer secret and returns room/engine identity plus numeric measurements, without player IDs, names, tokens or inventory. Concurrent inspections share a bounded probe pass and never start rooms. Missing observations are not treated as healthy zeroes. Older retained rooms remain available to saved travelers but are excluded from new matching; a new persistent slot requires a health-capable retained runtime. No schema migration or automatic upgrade is added.

Verification: 635 headless checks, 62 PostgreSQL/socket/recovery checks, type/import checks, Compose validation, regional browser recovery, cooperative lifecycle and trusted exploration/reward journeys passed. Native cases use an actual deferred PostgreSQL COMMIT trigger, a held room-row lock and real event-loop stalls. The regional browser captures two rooms' operator metrics while three travelers play; one local two-traveler room averaged 5.21 ms per fixed simulation step, and the other recorded a 421.4 ms timer delay that paused new admission while its player continued. These are fixture measurements, not production capacity or SLO claims.

The first trusted journey timed out at the unchanged five-second sanctuary polling assertion; its immediate diagnostic export already showed sanctuary and both travelers connected, with slow software-rendered frames. An unchanged rerun passed the complete journey. The initial failure remains recorded; no timeout or product deadline was relaxed. Acceptance evidence, captured regional metrics, and operator policy/runbook.

These are soft admission budgets, not hard memory isolation or a complete monitoring system. Historical monitoring, alerts, full support bundles, production load/long-soak measurements, Docker/Coolify execution, remote CI and broader device qualification remain open. The full milestones 0–18 scope stays active; no numbered milestone is closed. Character and shared-arrival camera polish remain deferred as requested.

#Regional room selection and returning journeys · 2026-10-25

Approximately 69% of the full plan. A new green-and-gold doorway selects a compatible persistent room, reserves a seat and starts another bounded room instance when needed. Returning travelers keep their original room, identity, inventory and retained engine. New arrivals use the configured release; an updated deployment never silently replaces an occupied or older room.

One coordinator per region owns a PostgreSQL advisory lock. Private Unix sockets connect it to independently supervised, fenced room processes. Thirty-second single-use tickets bind each WebSocket to its room, traveler, region, release, engine and lease epoch. Admission counts both active players and pending reservations. Occupied rooms cannot be evicted; empty instances can drain after an idle grace. A busy-pool rejection no longer consumes an unused persistent room slot.

Verification: 632 headless checks, 53 PostgreSQL/socket/recovery checks, type/import checks and Compose configuration validation passed. The production regional browser journey places three travelers across two rooms with a two-player cap and 150 ms added round-trip delay. It verifies independent inventory, recovery from an actual SIGSTOP of one room while the other continues, graceful gateway restart with the same pages and identities, and the returning doorway. Standalone cooperative lifecycle and trusted exploration/reward journeys also passed with the updated shared runtime/client. Acceptance evidence, doorway, and run/deploy instructions.

compose.rooms.yaml declares separate persistent database and retained-engine volumes and exposes only the doorway on port 8794. Docker/Coolify execution remains unverified. This is one coordinator per regional address, with explicit bounded slots; automatic geography, cross-region failover, live cross-host transfer, account recovery, full health telemetry and measured production capacity remain open. Older standalone engines need an explicit upgrade before regional admission; no schema migration is added.

The doorway was visually inspected. The recovered scene fixture has coincident traveler spawns and visible camera/avatar overlap; its screenshot proves recovery state, not finished art. Character models and arrival/camera presentation remain in the final polish backlog. No numbered milestone is closed.

#External host watchdog and prediction recovery · 2026-10-25

Approximately 68% of the full plan; rounded estimate unchanged. The persistent bootstrap now monitors the retained runtime from another process. Matching IPC challenges detect a blocked main loop, kill only the owned child and produce a failed exit for the deployment supervisor. An independent eighteen-second stop deadline also handles a runtime stuck inside its shutdown handler. Node installs the responder before the retained entry, so old engine bytes remain unchanged and need no heartbeat API.

The longer browser fault exposed a client bug: sixty unacknowledged inputs exhausted prediction and triggered fatal worker recovery while the server was unavailable. Prediction now pauses at the existing bound and reconnects with the original traveler credential. Old socket callbacks are fenced before retry, including when closing the old connection stalls. Fresh baselines reset the input stream; durable retries keep their original IDs.

Verification: 630 headless checks, 44 PostgreSQL/socket/recovery checks, type/import checks, both lifecycle browser profiles and the full trusted exploration/storage/reward journey passed. Ten native watchdog cases cover startup/play stalls, blocked shutdown, replayed replies, normal exits, child isolation, legacy entry compatibility and observer suspension. Each lifecycle browser run suspends the actual retained runtime with SIGSTOP and requires both travelers to reconnect on a newer ownership epoch without reloading, preserving identity and committed inventory. Observed stall-to-exit times were about 6.94 seconds trusted and 5.91 seconds cooperative, including controller observation; these are local fixture measurements, not production recovery objectives. Acceptance evidence, recovered view, and operator contract.

No schema migration is added. A new bootstrap supervises old retained runtimes, but the prediction fix is packaged client code and requires a new room or explicit engine upgrade. Docker/Coolify execution and automatic restart timing, remote CI, room routing, live cross-host transfer, dynamic simulation persistence and broader device/load qualification remain open. No numbered milestone is closed; final character art remains deferred.

#Graceful host draining and failure recovery · 2026-10-25

Approximately 68% of the full plan. Persistent rooms now announce a reconnect, finish admitted transactions and input boundaries, save final accepted positions, retire ownership and close recoverably. Both authority profiles pause while unavailable and reconnect the same traveler without reloading the page. A lease/storage/simulation failure exits the production process so its configured supervisor can restart it instead of leaving a permanently unhealthy listener.

The host checks a conservative monotonic lease bound before admitting work or publishing state after an event-loop stall. The ten-second drain and fifteen-second process deadlines bound failure handling. A failure during an already-started graceful stop still returns failure. Cooperative presence follows committed interactions only when no newer movement arrived, preventing a final save from rewinding the traveler to stale presence.

Verification: 620 headless checks, 43 PostgreSQL/socket/recovery checks, type/import checks, both lifecycle browser profiles, and the full trusted exploration/reward browser journey passed. The lifecycle journeys add 150 ms round-trip delay and independently verify both travelers' connected state, identity and unchanged page after graceful exit 0 and fatal exit 1. Native cases include shutdown during a gateway commit, a held transaction/deadline, a real PostgreSQL outage, and a process stalled beyond lease expiry. Acceptance evidence, recovered view, and operator contract.

This uses the existing schema 5; saved rooms still need an explicit engine upgrade or a fresh room ID to use the new runtime. It preserves position and the durable ledger, not arbitrary dynamic physics/script state. Live cross-host handoff, room routing, fuller operational telemetry, production recovery objectives, Docker execution, remote CI and broad device/load qualification remain open. No numbered milestone is closed; character model redesign remains reserved for final polish.

#Private keepsakes and trusted reward grants · 2026-10-25

Approximately 67% of the full plan. Lighting or tending the sanctuary beacon in a new trusted room earns An ember of the old light, a private amber keepsake in that traveler's satchel. The card follows the existing warm, restrained interface. Each traveler earns their own; the shared beacon flag does not grant every player a reward.

Format 13 pins bounded action reward definitions. Successful host-verified actions commit the award, player revision, receipt and outbox atomically under the room lease. PostgreSQL schema 5 enforces one grant per actor/definition. A reusable replication projection intersects entity audience with registered component visibility before encoding: the owner receives Keepsake; no client receives AwardAudit; other players receive neither the private entity ID nor its contents. Private fields are separate components, not arbitrary nested-field redaction.

Verification: 620 headless checks, 33 PostgreSQL/socket/recovery checks, type/import checks, and both trusted and cooperative production-browser journeys passed. The trusted browser adds 150 ms round-trip delay and checks the owner card, another player's empty satchel and captured traffic, reload, and simulation-worker recovery. Six application process-kill boundaries plus PostgreSQL stopping immediately before/after commit recover without duplicate grants or premature acknowledgement. Backups restore exact award/audit rows; content upgrades retain earned metadata even after a reward definition is removed. A separate schema-4 fixture proves automatic startup refuses an incompatible schema update. Prior browser timeout/trace-cleanup failures are recorded with the final clean acceptance.

Acceptance evidence, satchel screenshot, and setup and privacy contract. Test this build with a new dedicated schema-5 database and fresh room ID alongside existing rooms; existing saved rooms keep their pinned runtime. Schema-4 backups require their matching earlier tool.

The full milestones 0–18 scope remains active; no numbered milestone is closed. This increment does not qualify arbitrary secret inventory, competitive economies, accounts, dynamic authoritative worlds, cross-host travel, Docker execution, remote CI, load or device coverage. Character model redesign remains deferred to final polish.

#Server-authoritative static-world multiplayer · 2026-10-25

Approximately 66% of the full plan. New opt-in trusted rooms run the production character motor on the server, accept timed input sequences, and predict/reconcile movement in the browser. Server positions govern inventory, chest transfers and gateway reach. The server saves movement independently of browser pose reports. World format 12 pins the authority policy in the immutable content/engine identity.

The two-traveler production browser journey passed with 75 ms added transport delay each way. It exchanges the lantern through the shared chest, rejects a failed graphics preparation, completes house/garden/sanctuary travel, restores server state after reload, and recovers an injected simulation-worker crash. The shared production-motor fixture responds on its first local tick at exactly 150 ms RTT, with a maximum correction under 1 mm in that recorded static collision/jump scenario. This measurement is fixture-specific, not a general WAN or frame-rate guarantee.

The browser acceptance caught and drove fixes for a stream-ordering race during travel and a native-object lifetime race on disconnect. The new stream is announced atomically in its travel receipt, pending transactions retain their locked native motor until release, and closed connections are rechecked after asynchronous reads. Slow ordinary commits no longer stall the input queue: reach is captured at the admitted input boundary, then movement continues while SQL commits. Chest transfers also preserve a neutral keyboard focus while saving instead of moving Enter onto Close. Bounded admission, forged-reach rejection, forbidden client checkpoints, exact retry across reconnect, server-position restoration and self-stream isolation have targeted native/database/socket coverage. See the runbook, acceptance evidence, garden and sanctuary.

Verification: 616 headless tests, 27 database/recovery checks, six focused final-source motor tests, type/import checks, Compose configuration validation, and both production-browser journeys passed. The trusted journey adds 150 ms round-trip transport delay; the cooperative journey retains its original authority profile.

This increment supports static collision only. General private entities/secret fields, competitive reward systems, authoritative dynamic objects/behaviors, cross-host routing, WAN congestion/long-soak measurements and physical-device qualification remain open. Existing public shared item ownership is not presented as private inventory. Docker-host execution and remote CI remain unqualified; the known GitHub billing restriction previously prevented jobs from starting. No numbered milestone is closed. Character redesign remains deferred to the final polish pass.

#Persistent database and engine backup/restore · 2026-10-25

Approximately 65% of the full plan. Operators can now capture one consistent database snapshot together with every retained engine referenced by its published releases, verify the archive, and restore into an empty database/new directory. The production browser journey reconnects both original travelers after the original engine location is made unavailable; their shared lantern remains in its chest and can be withdrawn normally.

The archive uses content-addressed objects, immutable filesystem or signed S3 writes, per-object checksums, a manifest published last, and logical digests for all twelve control tables. Restore verifies the engine files, uses a single SQL transaction and compares the restored rows/room sequences. An incomplete-restore marker blocks startup; backup finish verifies an uncertain final acknowledgement without replaying SQL. Existing databases/directories, corruption, changed engine manifests and incomplete SQL refuse completion.

Verification: 610 headless tests, 21 PostgreSQL/recovery checks, signed S3 wire fixtures, type/import checks, standalone CLI packaging, Compose validation and the production two-traveler restore journey passed. Acceptance evidence, restored chest, and operator instructions. The local production fixture measured about 0.48 seconds to capture/archive and 0.40 seconds to restore and verify database/engine files. These cached same-host measurements exclude WAN transfer, promotion and browser re-admission; they do not establish production RPO/RTO.

The optional Compose maintenance helper is provided, but Docker-host execution and remote S3 provider/account qualification remain open. Backups recover through their recorded snapshot sequence; later transactions require a newer backup or future continuous recovery machinery. Continuous WAL/replication, historical-schema migrations, catalog/retention operations, broader capacity/device qualification and the remaining plan gates stay open. No numbered milestone is closed; final character art remains deferred.

#Persistent release upgrades and recovery storage · 2026-10-25

Approximately 64% of the full plan. Operators can preview a persistent-world upgrade, review every player/item change, stop the room and atomically apply the exact plan. Removing a chest moves its contents to a selected recovery chest. Removing a pickup retains the item's name and equipment definition in a format-11 inventory catalog. Travelers keep their identity and ownership, return to a validated entry, and see “A new chapter.” with Continue your journey when the updated server returns.

The immutable effective release, player/item revisions, recovery transfers, audit plan, receipt and outbox commit together. Live leases, stale snapshots, edited previews, unsafe entry collision, insufficient recovery capacity and incompatible retained engines reject. Exact retries return the original receipt. Prior content and economy history stay retained; code rollback alone does not undo ownership.

Verification: 607 headless tests, 19 PostgreSQL tests, type/import checks, focused native recovery and retained-engine checks passed. Both production-browser journeys passed: ordinary three-place shared play, and the packaged upgrade CLI with two existing travelers, removed chest/pickup recovery, duplicate apply and reloaded inventory. Six upgrade process-kill boundaries preserve exactly one commit. The test-controller teardown leak was corrected and final acceptance exited cleanly. Evidence, upgrade screen, recovery chest, retained satchel item, and operator/playtest instructions.

This is a stopped-room content migration within schema 4 and upgrade policy 1. Earlier persistent databases remain protected; testing alongside them requires a new dedicated database. Seamless activation, database-schema migration, arbitrary state/down-migrations, dynamic persistence, cross-host transfers, object storage and measured recovery objectives remain open. Native tests do not qualify Docker/Coolify or broader device/load behavior. No numbered milestone is closed; character redesign remains reserved for final polish.

#Shared persistent chest · 2026-10-25

Approximately 63% of the full plan. New persistent Lantern House rooms now have an oak, iron and brass chest beside the writing desk. Travelers can leave the keeper’s lantern for one another through a live shared panel. Stored items stay out of the original pickup scene, and the objective distinguishes a stored lantern from one carried by another traveler.

Format 10 and its compiler identity describe bounded containers and collectible names. PostgreSQL migration 3 enforces exactly one item location: world, player or container. Deposits and withdrawals check reach, requirements, capacity, ownership and expected revisions under the fenced room transaction. Receipts and outbox entries commit with the transfer; depositing an equipped item also clears its carried attachment.

Verification: 604 headless engine tests, 15 PostgreSQL tests, type/import checks, and the production-bundle two-traveler browser journey passed. The latter hands the lantern through the chest in both directions, reloads a traveler while the item is stored, then completes garden/sanctuary travel and simulation-worker recovery. Twelve additional process-kill boundaries cover deposit and withdrawal; competing withdrawals, full storage, stale requests, exact lost-receipt retries, room restart and migration protection are verified. Acceptance evidence, chest, panel, and testing instructions.

Use a new dedicated database when testing alongside a pre-storage persistent build. Automatic startup refuses schema changes that would invalidate older retained engines. Existing rooms keep their pinned world and runtime. The completed browser journey uses keyboard controls and bounded key presses; earlier multi-window mouse/camera and delayed-observation failures are recorded in the evidence, not counted as passing runs.

No numbered milestone is closed. Removed-container recovery, coordinated room upgrades, durable dynamic state, object storage, measured restore objectives, broader input/device qualification and Docker-host acceptance remain open. Character redesign remains reserved for final polish.

#Completed-frame entry and headless composition · 2026-10-25

Approximately 62% of the full plan; rounded estimate unchanged. The entry button now waits for an accepted scene baseline and at least one completed GPU frame, as well as simulation/presentation/room readiness. Creating the device or allocating its resources alone no longer enables entry. New fault tests hold the first scene's completion in both main and worker placement, verify that entry remains disabled, then release completion and verify visible world pixels.

The browser and art-review launchers no longer disable Vulkan surface support. An isolated main/worker clear experiment rendered red/green canvases on both Chromium 141 and 155 with surfaces enabled; the old flags failed adapter admission in the Chromium 155 control. Real Chromium 155 first-frame and visible/invisible-canvas checks now pass. This does not qualify Chromium 155 multiplayer: both attempts at the persistent two-traveler journey timed out compiling the second traveler's shaders, including with completed-frame entry enabled. No shader deadline was relaxed and no failing scenario was skipped.

Verification: type/import checks; three targeted Chromium 155 scenarios; five Chromium 141 startup/pixel/restore scenarios; and the complete Chromium 141 persistent multiplayer/recovery journey passed. Evidence and remaining issue. Physical GPU measurements, the Chromium 155 multi-device timeout, Docker-host verification and broader full-plan gates remain open. No numbered roadmap milestone is closed.

#Playable persistent cooperative multiplayer · 2026-10-25

Approximately 62% of the full plan. The opt-in persistent room now connects the existing Lantern House, garden and sanctuary to PostgreSQL. Browser return credentials restore the same traveler, inventory, shared doors/beacon and committed place. A gateway prepares native collision and GPU resources before committing travel; a known refusal keeps the source, while an uncertain outcome recovers from durable state. Existing rooms retain their exact verified engine/client bundle across deployment changes. The beta/editor storage profiles remain available.

A production-bundle browser journey verified two travelers, shared pickup/door/beacon state, place-filtered presence, rejected GPU preparation without a database crossing, reload without local position saves, rendered destination pixels and native-worker recovery without a page reload. The socket/database suite verifies concurrent pickup, server kill after a lost travel reply, exact client retries after a newer baseline, and isolation of an overloaded connection. Unchanged poses no longer consume durable transactions just because PostgreSQL reorders JSON keys.

Verification: 603 headless engine tests passed, plus 11 PostgreSQL/recovery tests passed, the persistent browser journey passed, and both original solo and multiplayer regressions passed. Type/import checks and persistent Compose validation passed. Acceptance evidence, garden, sanctuary, and run/deploy instructions.

No full numbered milestone is closed. This is cooperative browser-owned motion with server-committed interactions, not trusted authoritative physics. Accounts/recovery UI, live upgrades, durable dynamic behaviors, persistent chests/transfers/recovery containers, long soaks, object storage and broader device qualification remain. Character art is still reserved for the final polish pass. Native production startup is verified; local Docker execution remains unavailable, so container/Coolify deployment is not claimed verified. Headless Chromium 155 with this SwiftShader configuration produced blank composited captures despite completed GPU frames; the matching Playwright Chromium 141 rendered correctly and passed acceptance. Physical-GPU/browser qualification remains open.

#PostgreSQL player transactions and recovery foundation · 2026-10-25

Approximately 61% of the full plan; rounded estimate unchanged. The new internal control service pins exact world/engine releases, fences room writers with expiring leases, and commits player pose, exclusive item ownership, retry receipts and publication events in one PostgreSQL transaction. Supported commands join, checkpoint, cross an authored gateway, pick up and drop an item. Successful responses follow synchronous database commit; uncertain responses can be retried without awarding or traveling twice.

Run the service and acceptance suite. Evidence records seven real PostgreSQL tests, twelve worker-kill boundaries across pickup and travel, an abrupt database restart, exact logical backup/restore, authenticated HTTP response timing, compiled production startup/shutdown, type/import checks and the 599-test engine regression. The local recovery fixture lost no acknowledged transaction. Its small-fixture timings are not a production recovery-time claim. Source serialization and temporary-database restart setup failures were corrected and retained in the evidence.

A separate internal Docker Compose configuration declares its persistent database volume. Native execution and Compose validation passed; the Docker runtime smoke check is configured in CI because local daemon access requires credentials unavailable to this process. Existing beta/editor deployment and files were not migrated.

This is a durable server foundation, not a visible browser upgrade yet. The playable relay still writes its existing files. Admission/identity integration, shared room-state migration, gateway commit coordination, containers, rewards, outbox delivery, object storage and production recovery objectives remain open. No numbered milestone is closed; character art remains reserved for final polish.

#Destination readiness and per-place GPU models · 2026-10-25

Approximately 61% of the full plan. Gateways prepare destination collision and GPU models before moving the traveler. A quiet preparation banner keeps the current place visible; a rejected allocation retains it for retry. Only models referenced by the current place, including hidden objects and the traveler rig, remain resident on the GPU. Repeated crossings release retired resources. Live revisions, device recovery and returning to the start use the current place catalog.

Run and try it. Acceptance evidence records 599 passing headless tests, type/import checks and four production browser workflows: worker and main-thread graphics, two-traveler arrival editing, and multiplayer subscriptions/reconnect/handoff. Native staging/cancellation preserves the source, and real GPU allocation faults, held uploads, device loss and repeated crossings are covered. Late reset testing caught and fixed reuse of the initial startup deadline. The evidence also records corrected test fixtures without weakening gameplay reach or readiness checks.

The editor launcher now recognizes its existing authenticated instance on port 5181 and prints its private link without rebuilding or failing on an occupied port. The user's running editor was preserved; restarting its original terminal rebuilds the pinned engine with these changes.

This is GPU residency within the existing world format. Whole-world source models, collision and CPU presentation descriptions still load together; network streaming, prefetch, larger catalog limits, authoritative crossing and durable native player-state transactions remain open. Existing GPU budgets and room limits are unchanged. No numbered milestone is closed; character art remains reserved for final polish.

#Nearby traveler subscriptions across shared places · 2026-10-25

Approximately 60% of the full plan. Each current browser now receives character presence for its current place. Real gateway crossings update membership without reconnecting, departed actors leave the canonical scene, and returning recreates them with bounded entity allocation. The HUD preserves the full room count; F2 distinguishes total players and nearby travelers. Shared chat and gameplay remain connected across places.

The elected browser receives bounded same-place actor context with each interaction, so a host elsewhere still rejects closing a door on a traveler. Optional protocol-4 capability negotiation preserves legacy room views. Full replacement views reject duplicate/regressive delivery while accepting sequence gaps; reconnect starts a fresh sequence domain. Try it and acceptance evidence record 592 headless tests, final packet/type checks, real socket occupancy checks, production browser travel/live-edit/reconnect/handoff, and the connected-place creator regression. A three-player fixture reduces the separated recipient’s serialized presence from 754 to 320 bytes; this is a payload comparison, not a capacity benchmark.

The eight-player limit and trusted cooperative authority remain unchanged. This increment scopes character presence; assets are still preloaded. Adjacent-place subscriptions, authoritative crossing transactions, cross-host travel and the remaining full-plan gates stay open. No numbered milestone is closed; character art remains reserved for final polish.

#Named arrival points and gateway headings · 2026-10-25

Approximately 59% of the full plan; rounded estimate unchanged. Creators can add named landing points, preview their position and direction with gold editor markers, and select them in a gateway. The player arrives with the authored position and heading, so the camera and forward movement agree. Live arrival edits affect subsequent crossings without moving current occupants. Linked points cannot be removed until their gateways choose another arrival; saved Undo/Redo restores exact source across editor reloads.

Try arrival points. Acceptance evidence records 587 passing headless tests, type/import checks, native arrival/checkpoint coverage, the production two-traveler creator journey, and the previous connected-place regression in a separate fresh room. Stable identities, multiple-removal inverses, source format promotion and dependency conflicts are covered. The evidence retains the initial floating-point browser assertion and malformed test fixtures with their corrections. Creator journeys now have separate CI jobs so each owns its world and development room.

World format 9 and compiler arrival-world.9 add bounded named arrival catalogs while preserving historical compiler identities and native checkpoint profile. Creators must place points above clear, solid ground; automatic floor/clearance placement, authoritative crossing transactions, streaming and visual portals remain open. Lightweight reload saves keep position but still use default place facing. No numbered milestone is closed; character art remains reserved for final polish.

#Connected place creation and gateway editing · 2026-10-25

Approximately 59% of the full plan. Creators can now add a named studio and a gateway in each direction, preview/save it, and apply it while travelers remain in the existing world. Each traveler can visit and return independently. Gateway destinations, prompts and local interaction reach are editable. Removing an occupied place safely rejects Apply; after everyone leaves, removal applies, and durable Undo restores the exact place and incoming links across an editor reload.

The new controls use the existing green-and-gold atelier design. The default stone-and-brass gateway is an editable arrangement with a luminous interaction point. Try the capability and acceptance evidence record 583 passing headless tests, type/import checks, isolated production builds and the passing two-traveler browser workflow. Native arrival collision and checkpoint restore, stable command identities and conflict-protected place lifetime edits are covered. The initial browser fixture failure and its approach-to-gateway correction are preserved in the evidence.

World format 8 and compiler gateway-world.8 retain historical compiler identities. Whole-world catalogs are still preloaded: streaming, visual portals, per-place authority, per-gateway arrival poses, cross-host travel and database travel transactions remain open. The creator controls allow up to 32 places within existing content budgets; this is not a measured large-world capacity claim. No numbered milestone is closed; final character art remains deferred.

#Creator-authored shared object behaviors · 2026-10-25

Approximately 58% of the full plan. A creator can now give a static object a Touch glow response, preview its active finish, save it, and apply it to a shared room. Either traveler can toggle the appearance; live color edits retain its current state, removal restores the base finish, and durable Undo restores the binding. Materials keep immutable content hashes and the runtime selects a named variant.

The relay executes the pinned trusted module and persists private execution state, public appearance and duplicate-request receipts together before acknowledgement. Public packets contain only appearance selections; elected browser hosts cannot forge those selections through other gameplay commits. Reach rejection, two-player convergence, host handoff, non-default state across relay restart, native restoration, source edits and undo are verified. Try it and acceptance evidence record 580 passing headless tests, strengthened room checks, type/import checks, isolated production builds and the passing full browser workflow. The evidence also records the corrected browser fixtures and an earlier graphics-recovery rejection that safely retained the old world.

This is one build-pinned module with a 16-static-binding world limit. General server script hosting, uploaded code isolation, async jobs, broader behaviors, structural replication and full lifecycle ingress remain open. Solo lightweight reload saves do not preserve behavior state; native checkpoints and shared-room persistence do. No numbered milestone is closed; final character art remains deferred.

Delivery cadence: complete one usable capability, verify its real user path, commit and push, then report exact test steps and an approximate percentage of the full plan. Keep subsequent work focused on the next usable capability rather than accumulating unfinished layers.

#Trusted behavior transactions in the simulation · 2026-10-25

Approximately 57% of the full plan; rounded estimate unchanged. The optional trusted behavior runtime now executes in the real simulation's behavior phase. Entity-scoped hooks stage state, component changes, random-state advancement, and events into one ECS transaction. Faults discard the staged work; three faults park only the affected binding until its own code/configuration changes. Expected authority rejections do not park valid scripts. Bounded cadence and oldest-tick scheduling avoid starving later entities.

Native checkpoints carry the exact trusted program manifest and custom state catalog. Matching-program restore, explicit state/configuration migrations, code repair, and compatible live-world revision forks preserve the execution state. The real simulation fixture changes an authored object's material through the production presentation projection. API and limits and acceptance evidence record 572 passing headless tests, type/import checks, isolated production builds, and three passing existing browser recovery scenarios. The record preserves an optional-schedule regression and its correction, plus a measured airborne-test handoff race corrected at the worker publication boundary without changing physics assertions or deadlines.

This is the engine portion of the next usable capability. The default player/editor do not load behavior programs yet. Creator controls, a playable browser object, authoritative shared behavior admission/replication, release packaging, full lifecycle ingress, async jobs, and hostile-code isolation remain open. Lightweight player saves do not preserve behavior state. No numbered milestone is closed; the percentage will not increase merely because this foundation has more tests.

#Native simulation recovery without reload · 2026-10-25

Approximately 57% of the full plan. A blocked or faulted simulation can now be replaced from a sealed native checkpoint without reloading the page. Physics, ECS, scheduler and event state restore in the worker; a new presentation channel and verified frame precede Continue. Held input is cleared. The same traveler rejoins the room and receives its authoritative progress, while shared route clocks resume normally. One pending capture, one retained point, two recovery attempts and a 45-second attempt deadline bound the lifecycle.

Development recovery fetches the accepted world and forks an older checkpoint into that compatible source. A worker stalled during preparation returns to the accepted revision and the saved draft can be applied again. Failed validation/recovery preserves the existing durable local save for manual retry. Verification includes 552 headless tests, 15 browser scenarios, type/import checks, isolated production builds and reviewed recovery screens; the idle local editor was refreshed with its saved draft checksum unchanged. A native regression test also caught and corrected shared admission resetting airborne velocity. Testing and limits and acceptance evidence distinguish this from lightweight reload saves and record the native, shared and live-edit fault checks.

Automatic rollback uses the latest sealed in-memory point; local changes after that point may be lost. It does not provide durable native checkpoint storage, arbitrary source/engine migration, a hostile-code sandbox or behavior-level rollback/budgets. Unmeasured hardware, the remaining live-revision fault matrix and all other full-plan gates remain open. No numbered milestone is closed; final character art remains deferred.

#Simulation stall detection and safe shutdown · 2026-10-25

Approximately 56% of the full plan; rounded estimate unchanged. An external main-thread watchdog now probes the simulation independently of animation frames and presentation receipts. Matching replies, one outstanding probe, visibility suspension and observer-resume grace avoid mistaking rendering backpressure or a suspended tab for a blocked worker. Terminal player errors terminate the simulation and fence queued messages, preserving the last accepted save and removing the failed participant from the room.

Try again restores the existing lightweight saved journey. The test guide gives a dedicated npm run test:browser:watchdog command. Acceptance evidence covers a real blocked worker with withheld animation frames, saved quest progress, a responsive worker under presentation backpressure, shared-room continuity/rejoin and graphics failure regressions.

This bounded delivery does not complete automatic native-checkpoint restart, interrupted live-edit recovery, asynchronous job deadlines, trusted behavior lifecycle or any numbered milestone. Character-art replacement remains deferred. Keep subsequent deliveries similarly bounded: finish the selected capability, verify it, push it and report what can be tested before taking on adjacent work.

#Object dialogue and local interaction anchors · 2026-10-25

Approximately 56% of the full plan. A creator can start with a blank studio, add an object and give it dialogue using Add dialogue…. The reading editor includes local offset and reach controls. The point follows object/group translation, rotation and scale; local simulation and multiplayer authority use the same resolved point. Preview/Save/Discard, protected undo, detach and complete group deletion/restoration preserve source identities and ordering.

Format 6 / interaction-world.6 identifies the new semantics so older clients reject them explicitly. Stateless static bindings may be added or removed in a live room without resetting player progress; removing a binding clears an obsolete nearest prompt while open pages can finish. Existing story conditions and effects remain protected. Testing guide and acceptance evidence record 541 full-suite tests, 29 final focused tests, two new browser journeys and three story-dialogue regression journeys, type/import checks, isolated production builds and reviewed screenshots. The idle local editor was refreshed and read-only attachment validation passed with its draft unchanged.

One earlier browser attempt ended with a Playwright internal step error and a participant disconnect during preparation. Trace inspection and added diagnostics did not establish a root cause; subsequent passing runs are scoped acceptance, not a reliability fix. General behavior scripting, dynamic interaction anchors, branching conversations, remaining live-revision fault gates and the rest of milestones 0–18 remain open. No numbered milestone is closed; final character-art replacement remains deferred.

#Dialogue authoring and shared conversations · 2026-10-25

Approximately 55% of the full plan; rounded estimate unchanged. Dialogue… edits existing conversations and notices through prompts, speakers and ordered pages, with a reading preview. Creators refine multiple conversations, Save/Discard, and use persistent Undo/Redo after reload. Object-bound conversations also open from the inspector. Per-conversation conflict keys merge independent changes and protect overlapping saves/undo.

Applying a saved text revision preserves active NPC conversations, patrol phase, player identities and progress. A conversation already open retains its pages; subsequent interactions use the new text. Runtime compatibility still fences interaction topology, reach, conditions and effects. Testing guide and acceptance evidence record 536 full-suite tests, 19 final focused tests, three browser journeys, type/import checks, isolated production builds and reviewed desktop/narrow/player screenshots. The idle local editor was refreshed; read-only validation accepts the new command and its saved draft checksum is unchanged.

Creating/binding new interactions, branching dialogue, general behavior scripting and the remaining milestones 0–18 remain open. No numbered roadmap milestone is closed. Character-art replacement remains deferred to the final polish pass.

#Object material authoring · 2026-10-25

Approximately 55% of the full plan. A selected object now has Material… controls for color/tint, optional roughness/metalness/glow and primitive surface detail, with five editable finishes. Imported model assets and texture maps remain intact; blank overrides keep per-part inherited finishes. The actual viewport previews changes before Save/Discard, and repeated refinement preserves intervening transform adjustments. Persistent undo and shared-room Apply use existing commands and conflict checks. Visual review also corrected Frame selection for imported models whose geometry is offset from their origin.

Testing guide and acceptance evidence cover primitive and imported appearances, exact optional-field restoration, disjoint merge/conflicts, prefab override regression checks, and a two-traveler ferry finish change without a journey reset.

This is single-object material authoring using the current renderer. Per-submaterial/texture editing, material/effect graphs, multiple-selection material operations, physical-device budgets and the rest of milestones 0–18 remain open. No complete roadmap milestone is closed. Final character-art replacement remains deferred.

#Local-light authoring · 2026-10-25

Approximately 54% of the full plan. Local lights… now supports adding, moving, recoloring, changing brightness and removing point lights through a bounded per-place catalog. Creators preview/refine before Save/Discard, recover changes through persistent Undo/Redo, and apply them to connected travelers. Existing story overrides are preserved and identified in the panel.

Light lists and the single shadow source commit atomically. Removing the shadow source returns to sunlight; removing an earlier list entry keeps the intended source. Concurrent edits to the same catalog are fenced; unrelated atmosphere/object edits remain mergeable. Source/API/CLI validation and the command schema expose the same bounded operation. Testing guide and acceptance evidence record the scope.

This uses the existing eight-light renderer and its one shadow source. Spot lights, omnidirectional/multiple local shadows, material/effect tooling, device budgets and the remaining milestones 0–18 stay open. No full roadmap milestone is closed. Character-art replacement remains deferred to the final polish pass.

#Place atmosphere authoring · 2026-10-25

Approximately 53% of the full plan. The atelier now offers Atmosphere… for each place: Quiet morning, Golden hour and After dark presets plus ambient color, mist color/density, sun direction and brightness. Creators preview in the actual scene, refine, Save/Discard, and use persistent Undo/Redo. Applying the saved revision updates connected travelers without resetting their journey.

The file/API/CLI command is set-environment; complete source validation prevents invalid light/fog values from reaching presentation. Property-level merge keys preserve unrelated edits and fence overlapping saves/undo. Testing guide and acceptance record describe the verified scope.

Point-light authoring, material/effect graphs, day/night animation, device budgets and the rest of milestones 0–18 remain open. No complete roadmap milestone is closed. Final character-art work remains deferred.

#Development history compaction · 2026-10-25

Approximately 52% of the full plan, unchanged after this bounded reliability increment. Shared rooms can continue past the former 32-update ceiling. Complete source snapshots compress losslessly, old files upgrade on the next update, and the editor reports retained revisions and storage. Offline saves keep their original source document. Explicit limits are 1,024 revisions and 256 MiB; reaching a limit preserves the active world and existing history.

Acceptance evidence covers 40 live updates and restart, legacy compaction, six injected write-boundary failures, budgets/corruption checks, and the browser returning after 36 updates. Testing and storage policy. This does not close milestone 9 or establish unlimited retention, arbitrary engine migration or full power-loss durability. Final character art remains deferred.

#Reviewable proposals and authoring observations · 2026-10-25

Approximately 52% of the full plan. Review proposal… accepts a file or pasted structured transaction, validates the complete candidate without saving, lists affected source rows, and previews it across places before Save/Discard. Save preserves strict versus explicit disjoint policy and uses durable undo. Revalidation against a newer head is explicit; cancelled, malformed, altered and conflicting proposals retain the saved world.

Protected observations expose hash-bound authored entity pages, summary/catalog metadata, structural command schema and the retained accepted-revision log. Validate-only API/CLI uses the same compiler and serialized merge checks as commit, without persisting a revision. The editor independently verifies the candidate hash. The source and packaged CLI support these operations; the checked-in command schema is an artifact for external tools.

Acceptance evidence records 22 focused headless checks, three browser journeys, type/import checks, production CLI smoke and an inspected review panel. File hashes and modification times prove read-only behavior in an initialized workspace. Try proposal review.

These observations cover authored content and accepted edits, not live simulation inspection or a behavior console. Full assistant integration, roles, durable runtime logs, remaining live-revision retention/fault gates and the rest of milestones 0–18 remain open. No complete roadmap milestone is closed; final character-art work remains deferred.

#New worlds from templates · 2026-10-25

Approximately 51% of the full plan. The atelier now offers New world… with an actual rendered preview of Quiet studio, Lantern house and Garden ferry. Creators name a world, preview it in the atelier, save or discard, then edit and publish it for shared play. Fresh persistent identities and a fresh release identity are prepared once; saved undo/redo restores the previous draft after reload, and concurrent edits fence stale replacements. The source and production authoring CLI expose the same preparation.

Acceptance evidence records 18 focused native/authoring tests, two browser journeys, type/import checks and a packaged CLI build. Tests cover all template spawns, hierarchy remapping, stable command replay, studio floor/wall collision, cancellation, save/reload/undo/redo, ordinary editing, two-player publication and conflict protection. Desktop and narrower picker layouts and the shared studio were visually inspected. Try the template workflow.

The workspace still has one editable draft, with the existing undo budget. Published invitations retain prior worlds. Cross-world migration of an occupied development room is not supported; publish the new world to play it. No full roadmap milestone is closed. Remaining live-revision retention/fault gates, structured patch validation/observations, behavior tooling and the rest of milestones 0–18 remain in scope. Final character-art work remains deferred.

#Delivery cadence and engine pinning · 2026-10-25

The user requested smaller, tangible increments after a prolonged unfinished task. Work now takes one bounded capability through implementation, relevant verification, commit/push and concrete testing instructions before expanding its scope. Unverified code does not increase the progress estimate. Report the approximate full-plan percentage at each completed increment; distinguish visible changes from deployment/reliability changes.

Published invitations now capture their actual player assets and multiplayer relay executable, with dependencies, in the existing persistent data volume. Updating a deployment preserves old invitations, sessions and shared state; new snapshots use the new engine. Missing, damaged or incompatible retained builds fail explicitly. Development publication captures an engine when the editor launcher starts. See engine pinning for testing, deployment and explicit legacy/Node/retention bounds.

Acceptance evidence: 503 full-suite tests and six browser scenarios passed; eight focused tests, a further development-entry browser check, and type/import checks passed after the final legacy-room guard. The idle local editor was refreshed with its saved draft checksum unchanged. The rounded full-plan estimate remains approximately 50%. This is a deployment/reliability improvement, with no character-art change. No full roadmap milestone is closed. Runtime migration/retention tooling and the remaining live-revision fault gates remain open. Character art remains deferred to the final polish pass.

#Published-world archive and draft restoration · 2026-10-25

Approximately 50% of the full plan. Worlds now separates Active invitations and Archived worlds. Archive frees one of 32 active slots while preserving the immutable snapshot, invitation URL, local saves and shared room state; Bring back reverses it. The archive is capped at 128 retained worlds and uses a checksummed, atomic index alongside the snapshots in the existing persistent volume.

Restore draft… previews complete historical world content and saved prefab links without changing the saved draft. Save creates a new monotonically increasing revision; Discard cancels. Durable undo/redo works after reload, operation receipts protect retries, and a whole-world conflict boundary prevents stale restores or inverses from erasing another builder's work. The file/CLI/API path supports the same exclusive replace-content command. Published players stay pinned; applying restored content to a development room remains a separate action.

Acceptance evidence records 500 passing engine tests, six browser scenarios, type/import checks, isolated production builds and an inspected archive dialog. Verification covers archive capacity/reopen, unchanged snapshot bytes and timestamps, corrupt retention metadata, failed disk writes, restore source links, durable history, editor authorization and two connected published players. The local editor was refreshed while idle, retaining its revision and checksum. Testing instructions and remaining bounds are in the published-world guide.

No full roadmap milestone is closed. Permanent deletion/age-based retention, corrupt-draft offline recovery, release annotations, engine-executable pinning and the broader recovery/operations gates remain open. The four-resident-room and 8 MiB undo budgets remain explicit; final character-art work is deferred. Next: engine release pinning and the remaining live-revision retention/fault requirements, while preserving the full milestones 0–18 scope.

#Arrangement membership changes and reversible detach · 2026-10-25

Approximately 49% of the full plan; rounded estimate unchanged. Source updates now prepare additions and removals across linked copies. Surviving members keep their identities and explicit overrides; additions receive fresh IDs once before preview. The draft reports added/removed counts. Removing a locally edited member, changing object/group kind, removing a placed definition or deleting a group with independent children reports a conflict instead of losing work.

Detach this copy stages conversion of the complete selected instance to ordinary objects. Geometry, hierarchy, identities, materials and imported assets stay unchanged; the source remains available for other copies. Discard cancels, saved undo reattaches exact source metadata after reload, and intervening edits by another builder prevent stale reattachment. Source-only updates can be saved without a scene selection. Empty-instance migrations and removal of obsolete deletion overrides have exact undo coverage.

Acceptance evidence records 494 passing engine tests, two distinct browser journeys, a final focused visual follow-up, type/import checks and isolated production builds. Two connected travelers on worker and main-thread renderers receive membership changes, detach and source-only revisions. Screenshot inspection caught blank previews and stale checking text after rejection; the final browser check confirms the saved preview is retained and the result is clearly reported. The idle local editor was refreshed without changing its saved draft.

Rich per-member conflict resolution, member-key rename migrations and fine-grained merge within linked instances remain open. No full roadmap milestone is closed, and character-art refinement remains deferred. Next: release retention/restoration and the remaining editor/live-revision gates, while preserving the full milestones 0–18 scope.

#Linked arrangement library and shared source updates · 2026-10-25

Approximately 49% of the full plan. Arrangements now opens exported prefab files, previews their actual geometry/materials and places copies with fresh identities. Source snapshots and member bindings persist with the saved draft. Local member edits become explicit overrides; replacing a source previews updates across its linked copies while retaining those overrides. Discard, reload and durable undo/redo preserve exact geometry and source metadata.

Acceptance evidence records 489 passing engine tests, six passing browser scenarios, type/import checks and isolated production client/server builds. Two connected travelers on main-thread and worker renderers receive placement, source updates and undo through shared Apply. Browser acceptance exposed a real revision bug: the relay reconstructed documents from geometry and dropped optional source metadata. Serving the complete immutable snapshot fixes the checksum mismatch, with restart coverage. Model-name remapping now reserves all incoming names, preserving unrelated assets. The model empty-state test now owns and restores its fixture instead of assuming earlier journeys left an empty catalog.

The testing guide covers the complete workflow and explicit limits. Concurrent edits within a linked instance currently conflict conservatively; membership migration and browser detach remain open. The local editor was refreshed while idle and its saved revision/checksum stayed unchanged. No numbered milestone is closed, no main merge or Coolify deployment occurred, and final character-art refinement remains deferred.

Delivery rule: finish one bounded capability, verify it, commit and push it, then report what the user can test and the approximate full-plan percentage. A failed check gets a concrete diagnosis and fix before further scope is added. Next: close the linked-instance detach/membership workflow, then continue the remaining editor/live-revision gates and wider roadmap.

#Portable arrangement source and modern prefab compiler · 2026-10-25

Approximately 48% of the full plan; rounded estimate unchanged. Save arrangement… downloads editable source for a saved selection, including complete nested branches and only their referenced model assets. The original world stays unchanged. Capturing a branch from inside another group preserves its world frame; unsupported shear fails explicitly. Appearance/collision are reusable; original gameplay bindings remain in the source world.

Prefab source 2 adds group-member bindings, imported models, root-only instance offsets and model dependency invalidation. The isolated build worker binds its result to the requested compiler profile. Source 1 retains its exact compiler identity and pinned results. Acceptance evidence records 482 passing full-suite tests, six final targeted checks, native checkpoint restoration, isolated worker execution, a real browser download/rebuild journey and an inspected dialog capture. The authoring layer now explicitly depends on the world compiler for complete source validation.

This increment does not finish reusable arrangements: browsing/importing exported files, placing new instances from the editor, and preserving source links plus overrides in saved authoring documents remain next. Export does not attach existing world objects to a live definition. Other roadmap gates and final character-art redesign remain open; no numbered milestone is closed.

#Direct GLB import and atomic catalog preview · 2026-10-25

Approximately 48% of the full plan. Model library → Import GLB now prepares a local source file in a cancellable worker, shows its actual materials, and stages the new model with its first placement. Nothing is uploaded or saved until Save changes. Discard abandons both; durable undo/redo restores the exact catalog, instance identity and prior format after reload. Safe names avoid replacing existing assets.

The editor stages the GPU catalog and proposed scene together, including discard/undo removal. Model-read dependencies protect another builder's uses from catalog undo. Acceptance evidence records 477 full-suite headless passes, eight distinct passing browser scenarios, type/import checks and isolated client/server builds. Real browser coverage includes malformed-file recovery, cancellation, embedded surface textures, and import/apply/undo while two travelers remain connected on worker and main-thread renderers. The initial browser failure exposed missing staged GPU geometry; atomic catalog/scene installation corrected it. An outdated empty-state assertion was updated for the new import button.

The testing guide explains the 8 MiB source, 6 MiB compiled-model, 30-second preparation and 32-model catalog limits. The local editor backend was refreshed while idle; its saved revision/checksum are unchanged. No Coolify deployment or main merge occurred. Next: reusable arrangements/prefab browsing and placement, while retaining the remaining live-revision, release-retention and other roadmap gates. No numbered milestone is closed; final character-art polish remains deferred.

#Imported-model library and placement · 2026-10-25

Approximately 47% of the full plan; rounded estimate unchanged. The atelier now browses and searches imported models in the saved world, shows placement counts, renders original materials in a turnable 3D preview, and reports dimensions. Builders can name, size and stage a solid or decorative instance before saving. Discard, durable undo/redo and exact identities use the existing structural-edit flow.

The model-library guide describes the controls and current import boundary. Acceptance evidence records five distinct passing browser scenarios, four focused authoring/native checks, type/import checks and the isolated production client build. The browser test caught a canvas ownership race during rapid model selection; separate preview surfaces now prevent late disposal from unconfiguring the next renderer. Closing and reopening during preparation is covered.

The library currently uses models already in the world catalog. Next: direct GLB file import through this dialog, with bounded preparation, preview and atomic save/undo. Prefab browsing and the rest of milestones 0–18 remain open; no numbered milestone is closed. Character redesign remains deferred to final polish.

#Box selection and grouped structural edits · 2026-10-25

Approximately 47% of the full plan. The atelier now supports rectangle selection with Select or Q, Shift to add, Ctrl/Command to remove and Alt to select individual children. Escape cancels; an oversized selection preserves the previous selection. Gold selection feedback follows the existing editor palette.

Builders can duplicate or delete complete nested groups and multiple objects in one staged edit, reposition copies before saving, discard the preview, and undo/redo after reload. Copies receive fresh identities and retain appearance and collision; gameplay bindings stay with originals. Shared Apply carries saved copies and removals to connected players.

Acceptance evidence records 474 passing headless tests and 13 distinct passing browser scenarios, including two-player main-thread/worker rendering. Testing instructions cover the visible controls. Parent-relative gameplay bindings, speculative group presence, release retention and other roadmap requirements remain open. No numbered milestone is closed; character redesign remains deferred to final polish.

Delivery cadence: finish one bounded, testable capability, run relevant verification, commit and push it, and report the full-plan estimate plus concrete testing steps before expanding scope. Next visible capability: browsing and placing imported models from the editor asset library.

#Persistent groups and hierarchy · 2026-10-25

Approximately 46% of the full plan. The atelier now saves named, nested object groups. Group creation, world-space transform handles, preserve-position reparenting and ungrouping retain identities and participate in durable undo. Groups survive reload and appear as gold rows in the hierarchy. Parent frames and membership are protected during collaboration without blocking independent property edits.

World format 5 carries local transforms and stable group identities into actual runtime Parent components. Parent-first installation works across ECS batches; editor drawing, native primitive/imported collision, checkpoints and live revision swaps share the hierarchy. The testing guide describes the visible workflow and limits. Acceptance evidence records native, checkpoint, browser and shared-play verification, including the detected and corrected batch-installation failure.

Group duplication/deletion, parent-relative gameplay bindings and speculative group presence remain open, along with marquee selection, release retention and the rest of the roadmap. Character redesign stays in the final polish pass. No numbered milestone is closed. Next: complete marquee selection and grouped structural edits, keeping the remaining live-revision and creator-preview gates in scope.

#Published-world browser · 2026-10-25

Approximately 45% of the full plan; rounded estimate unchanged. The atelier's Worlds dialog lists retained invitations in exact newest-revision order, searches by revision/world, identifies the loaded saved draft, copies links and opens older shared playtests. Unsaved editing remains intact while browsing. Unavailable snapshots have no open action; failed catalog reads can retry without hiding other valid saved worlds.

The protected catalog verifies each snapshot independently from editable-draft storage, performs bounded sequential reads and coalesces concurrent scans. It does not create rooms or rewrite releases. The guide and acceptance evidence cover the API, rendered dialog, old-world multiplayer reopening, corruption isolation and existing publication regressions. The current 32-release/four-resident-room limits stay explicit. Engine pinning, release retention/restoration and the rest of milestone 9 remain open.

Next: persistent object grouping and hierarchy for reusable scene arrangements. Character redesign remains reserved for the final polish pass. All milestones 0–18 remain in scope; none is closed by this increment.

#Durable editor undo · 2026-10-25

Approximately 45% of the full plan. Accepted object/property edits now save their inverse, undo/redo stack transition and request receipt alongside the draft. Reloading the editor or reopening the server restores history. Multi-object transforms, creation and deletion keep exact identities, source ordering and omitted properties. Another builder's independent properties survive undo; overlapping changes fence older entries even after an edit/revert. Shared browser tabs use version/top-entry checks, and lost responses retry the same operation once.

The saved-history guide describes browser identity, durable storage and explicit retention limits. Acceptance evidence records reopen/replay, storage-failure recovery, corrupt/missing metadata, history beyond the merge-lineage window, authenticated HTTP and real browser journeys. The existing data volume retains the history; ordinary model/CLI transactions protect overlapping entries but are not all reversible through this endpoint. Character redesign remains deferred. No numbered milestone is closed.

Next: browse and reopen immutable published world revisions, then continue persistent hierarchy/grouping and the remaining roadmap gates. All milestones 0–18 remain in scope.

#Multi-object transforms in the atelier · 2026-10-25

Approximately 44% of the full plan; rounded estimate unchanged. Builders can add/remove up to 64 objects with Shift/Ctrl/Command-click in the list or viewport, then move, rotate and scale them around one shared centre. Imported models now have selectable bounds and gold selection outlines. Uniform scale is the default; unsupported shearing rejects the whole proposed edit. One save and one session undo cover the selection, including exact original properties and omitted rotations.

The selection guide explains the interaction. Acceptance evidence records geometry/transaction checks, real browser journeys, collaboration conflicts, rendered output and build checks. A linked gameplay member rejects the entire edit; independent collaborator properties merge and undo preserves those changes. Cancel restores an earlier unsaved draft. Returning to the saved transform produces no write.

The existing local editor serves the changes through Vite; no preview process or world was reset. Temporary selection is now usable, while persistent hierarchy/grouping, multi-object structural operations, group presence previews, durable undo and the remainder of milestones 0–18 remain open. No numbered milestone is closed. Next: durable undo history across editor reloads, with collaborator changes protected. Character art redesign stays deferred.

#Shared Apply in the atelier · 2026-10-25

Approximately 44% of the full plan. The atelier now starts a shared development room and applies an exact saved draft to its admitted players. Each player prepares native collision/state, a fresh presentation generation and its GPU catalog before the relay accepts the update. Imported models and solid-object edits become visible together without resetting the travelers. Unsafe overlap rejects the update and keeps the previous room.

The testing guide describes Start shared room → Join → Save → Apply. Main-thread and worker graphics, two-player state retention, collision replacement, rejected proposals and offline-save migration have browser acceptance. Development saves retain their source document so reopening after an update can migrate the old journey. Acceptance evidence records the precise checks, rendered captures and initial failures/corrections. The archive still has a 32-snapshot limit; broader fault combinations and the remainder of milestones 0–18 are open. This is a usable capability, not completion of milestone 9 or the full engine.

#Durable shared revision coordination · 2026-10-25

Approximately 43% of the full plan; rounded estimate unchanged. The development relay now coordinates all admitted connection incarnations through preparation, durable acceptance and application. It pauses gameplay writes and the route clock, aborts before acceptance when a player cannot prepare, and fences failed clients after acceptance. The active document, content hash, authority epoch and shared state commit together. Restart restores the correct document on either side of the decision and retains room sessions and shared state.

Authenticated development Apply/status endpoints now select exact saved drafts independently of published playtests. Acceptance evidence records the full headless suite and focused final checks, including real two-player WebSockets, stale-message rejection, host departure, storage failure and restart recovery. Browser/native/GPU preparation acknowledgements, presentation generation replacement, stale-client recovery and the editor Apply UI are still unfinished. The existing player therefore does not yet expose this feature; published rooms and preview data were not migrated. No numbered milestone is closed.

#Staged simulation revision swaps · 2026-10-25

Approximately 43% of the full plan; rounded estimate unchanged. The simulation can now compile a proposed world without touching the running session, then fork a validated replacement synchronously at a fixed-tick boundary. It captures the latest runtime state at that boundary, including queued input/events, animation phase, remote peers, NPC conversations, route clocks and platform riders. Only changed authored components are replaced.

The native collision candidate is cloned and prepared separately. Static and imported collision changes are queryable before the next character sweep; moving platform state and rider motion remain intact. Unsafe player overlap, incompatible gameplay definitions, missing animation bindings and invalid content reject the proposal while preserving the original runtime. New checkpoints are pinned to the new content.

The runtime contract and acceptance record record 431 full-suite headless passes, 18 final focused guard checks, two multiplayer browser journeys and final type/import/production checks. They also explain the current compatibility boundary. This is the simulation prerequisite, not an exposed live-room Apply feature. No existing beta room or saved draft was migrated. The next step remains the development-room coordinator, graphics readiness/activation barrier and editor Apply/status flow. Published snapshots stay immutable; no whole numbered milestone is closed.

#Remote unsaved transform previews · 2026-10-24

Approximately 43% of the full plan. Builders now see named, mint dashed bounding cages for another editor's unsaved movement, rotation and scaling. Saved geometry and local drafts stay intact. Primitive cages and imported-model cages share the same source transforms; imported bounds include child meshes and bind-pose skin bounds.

Drag proposals are throttled while the pointer is still down. Cancellation restores the previous proposal; invalid values, discard, save, departure and timeout clear or replace it. Both server and receiver fence previews to the exact saved document checksum. Presence remains ephemeral, bounded and independent of world persistence, gameplay simulation and published releases.

The acceptance record records 424 headless passes, four passing collaboration browser journeys, type/import checks and isolated production builds. The isolated editor preview is updated without rewriting its saved draft. No whole numbered milestone is closed. Next: applying saved revisions inside development rooms while retaining unrelated runtime state. Durable undo, release browsing, creator accounts and the deferred character-art redesign also remain open.

#Builder presence and shared selections · 2026-10-24

Approximately 42% of the full plan; rounded estimate unchanged. The atelier now shows active builders, optional display names, their places and selected objects. A mint list edge and inspector notice identify a shared selection and distinguish unsaved editing from simply looking. These are advisory hints; overlapping saves still use the existing revision checks and no absent tab can lock an object.

Presence is bounded to 32 recent sessions, expires after 20 seconds without a heartbeat and stays out of world files, releases and room checkpoints. Per-page identifiers distinguish duplicate tabs; sequence checks reject delayed updates after departures. Hiding/leaving a page withdraws presence, and timeout/rejoin handling clears stale hints. Names are trusted creator display labels, not authenticated identities.

The acceptance record records 420 headless passes, five distinct passing browser journeys across the combined and corrected targeted runs, type/import checks and production builds. The isolated editor preview is updated with its existing draft preserved. No whole numbered milestone is closed. Next: ephemeral remote transform previews so builders can see an in-progress adjustment before it is saved. Live room activation, durable undo, accounts and final character-art rework remain open.

#Saved revision awareness · 2026-10-24

Approximately 42% of the full plan; rounded estimate unchanged. The atelier now notices newer saved drafts without replacing a collaborator's scene, unsaved fields or undo stack. A quiet notice offers Load saved version when there are no unsaved changes; otherwise it explains saving to merge or discarding before loading. Interrupted checks retain the current view and recover the latest saved revision after missed updates.

The authenticated head endpoint returns only revision and checksum. Polling is bounded, skips network checks while hidden or committing, aborts timed-out requests and discards responses from before a local save/reload. The acceptance record records 415 headless passes, five browser journeys, type/import checks and production builds, including late-response races and two-editor recovery. Existing draft and published-room semantics are unchanged.

Next: collaborator presence and selection feedback. Live scene activation, durable undo, accounts and final character-art rework remain open. No whole numbered milestone is closed.

#Collaborative draft saves · 2026-10-24

Approximately 42% of the full plan. Two editor tabs can now save independent properties of the same object and keep both changes. Overlapping properties, object lifetime changes and unavailable history produce explicit conflicts with the local draft preserved. The merged editor uses the existing atelier; this is a collaboration improvement, not a new character-art pass.

Session undo/redo protects intervening work even when an older undo entry precedes a later successful merged save. The protected undo capture shows that refusal. The bounded, checksummed merge journal survives restart without changing the world-document format. Legacy drafts migrate without rewriting their world file. Already-published rooms remain independent of damaged draft metadata.

The acceptance record records the checks, source hashes and browser journeys. The isolated editor preview is updated with its saved draft checksum unchanged; the existing garden room stays available. No whole numbered milestone is closed. Next: revision awareness in the editor so collaborators can see newer saved work before attempting a save. Live presence, durable undo and final character-art rework remain open.

#Direct viewport transform handles · 2026-10-24

Approximately 41% of the full plan; rounded estimate unchanged. The atelier now has labelled move axes, rotation rings and local-scale handles with live rendered previews. The scale controls and rotation rings use the existing quiet palette and inspector. Snap supports 0.25 metres, 15 degrees and 0.1 scale units. Keyboard axis adjustment, W/E/R tool selection, Escape/pointer/focus/resize cancellation and numeric fields remain available. Cancelling restores any draft that existed before the gesture.

Acceptance records 404 headless passes, type/import checks, isolated production builds, three existing editor journeys and two final handle journeys. Tests verify pointer movement/rotation/scaling, snapped fields, exact save/undo/redo/reload, cancellation preserving earlier drafts and gameplay-linked rejection. Independent compiler parity checks cover all imported child meshes. Undo now restores an omitted rotation field exactly. No intermediate drag positions are written to the server; invalid proposals retain their numbers and restore the last valid scene.

The isolated preview is updated, its saved draft checksum is unchanged and the garden room remains healthy. Handles operate on one selected object; grouped/multi-selection editing, plane handles, uniform-scale handles and quaternion-oriented controls remain open. No whole numbered milestone is closed. Next: merge independent authoring edits while preserving explicit conflicts for overlapping edits. Final character-art rework remains deferred.

#Published shared draft playtests · 2026-10-24

Approximately 41% of the full plan. The atelier now turns a saved revision into an immutable shared playtest link. Players load that exact world, including imported models and edited collision, into an isolated multiplayer room with separate local saves and session tokens. Publishing newer edits leaves older sessions pinned. No rebuild is needed for each content revision on an editor-enabled server. The two-player capture shows the authored barrier and another traveler in the published garden.

Acceptance records 397 headless passes, type/import checks, production compilation, editor regression journeys and a complete two-player publication journey. It covers collision before/after deleting the barrier in a second release, host handoff, reload, unchanged older content/saves, invalid links without base-room fallback, publication conflicts, retry identity, corrupted files, storage failures and shared-state restoration after server restart. The original player movement/save journey and two-browser door/chat/handoff regression both pass. The isolated editor preview is updated; its saved draft checksum is unchanged and the existing garden room remains available.

This completes explicit activation into separate release-specific rooms, not in-place hot activation or an entire numbered milestone. World snapshots are pinned; engine executable pinning, release-history browsing, collaborative merging and capacity/device certification remain open. Current bounds are 32 retained releases and four resident playtest rooms, each using the existing eight-player cap. Coolify uses the same origin and existing persistent data volume.

Next: direct transform handles in the editor, followed by the remaining collaborative revision and live-activation work. Final character-art rework remains deferred.

#Reversible browser object editing · 2026-10-24

Approximately 40% of the full plan; rounded estimate unchanged. The atelier now creates solid primitive objects with selectable finishes, duplicates appearance/collision without copying gameplay bindings, and stages deletions for explicit save. Session undo/redo restores exact identities and source order. Newly selected objects remain visible beyond the first page of the list. The rendered result shows two created stone blocks and the selected duplicate.

Acceptance records 393 headless passes, type/import checks, production server compilation and three distinct browser journeys across the combined and final targeted runs. The structural journey verifies creation, duplication, deletion, exact undo/redo, reload, duplicate-name rejection and discard. The isolated editor and garden previews remain healthy; restarting the editor preserved its saved draft checksum. No whole numbered milestone is closed.

Next: explicit draft-to-playtest release activation, so a saved draft can be tested in a separate shared multiplayer room. Draft saves currently do not change the live game. Final character-art rework remains deferred.

#Browser world atelier · 2026-10-24

Approximately 40% of the full plan. The browser atelier now opens a persistent world document, renders the real compiled scene, selects objects from a searchable/paged list or primitive bounds, previews numeric transforms, saves accepted revisions and supports session undo/redo/export. Only edited coordinates are written; object identities and untouched precision remain intact. The captured editor shows an unsaved plinth transform and its selection outline.

The opt-in HTTP endpoint requires a separate creator key and origin checks. It serializes revision/hash-preconditioned commits, fsyncs/renames before acknowledgement, rejects invalid linked-object edits and restores saved documents after reopening. Two browsers cannot silently overwrite one another; a stale save retains local fields for export or explicit discard/reload. Coolify Compose forwards the optional key and retains the document inside its existing /data volume.

Acceptance records 389 headless passes, type/import checks, production client/server builds, Compose validation and both real-browser journeys. The preview is at http://localhost:5181/editor.html, with separate .data/editor-ferry.1 storage and relay 8791; its authenticated tab was opened. Existing beta and garden room data are unchanged. Draft publication/live activation, collaborative merging/presence, durable undo, creator accounts and broader authoring tools remain open. No whole numbered milestone is closed.

Next: object creation/deletion and selection tools, followed by explicit draft-to-playtest release activation. Final character-art rework remains deferred.

#Playable standard-controller input · 2026-10-24

Approximately 39% of the full plan; rounded estimate unchanged. A standard-layout controller can now enter the world, walk and look with analog sticks, jump, interact, run, open the satchel/journal and navigate menus. D-pad navigation uses visible focus and can adjust sliders. The controller guide lives under settings. The same semantic action map feeds simulation and room input; the adapter also accepts independent tile-placement bindings.

Connection, pause, focus loss and context changes require neutral input before rearming. A held menu-confirm cannot become a jump; disconnecting an active controller stops movement and pauses. Keyboard fallback and rebinding remain usable. Acceptance records 385 headless passes, type/import checks and four distinct browser journeys: the controller-driven simulation journey and three existing keyboard/room/profile regressions. Final controller acceptance verifies visible focus and slider adjustment. Physical controller compatibility remains unverified; no hardware support matrix or whole numbered milestone is closed.

Next: a usable browser world-editing flow on the existing authoring API, starting with selecting and editing object transforms. Final character-art rework remains deferred.

#Playable spatial sound · 2026-10-24

Approximately 39% of the full plan. The player now has directional fireplace/water ambience, quiet garden wind, and nearby traveler/NPC footsteps following displayed poses. Escape → Make yourself comfortable → Set your sound provides remembered overall, ambience and effects levels. Sound requires an explicit gesture each visit, rests during pause and releases its graph on disposal. This uses the reusable, bounded spatial audio package.

Acceptance records 380 headless passes, type/import checks, an isolated production client build and two passing browser journeys. Real offline audio samples verify stereo direction, distance falloff, mute/pause/bus silence, voice reuse, invalid-frame atomicity and cleanup. The sound panel was visually inspected. Headphone sound-design review remains open; these procedural loops are functional initial content. No whole numbered milestone is closed. The garden-ferry.4 preview and existing saves remain compatible.

Next playable increment: controller input through the public action map. Final character-art rework remains deferred. Keep the delivery boundary narrow: one playable feature, focused acceptance, commit/push and a percentage report; broaden testing only for a concrete failure or affected contract.

#Playable shared equipment · 2026-10-24

Approximately 38% of the full plan. The garden-ferry.4 preview now has an exclusive traveling lantern pickup, a Carry/Stow choice in the satchel and a visible animated hand attachment for other travelers. Ownership and slot selection use the shared interaction/receipt path and survive handoff, reconnect and relay restart. The reusable equipment contract includes independent compass/scanner content, canonical remote actor projection and bounded game-authored socket geometry.

Acceptance records 376 passing native tests and all five garden journeys across the combined and corrected targeted browser runs, with an actual rendered lantern. The new preview has separate save keys, room data and a declared Coolify volume; older preview data remains retained. Protocol 4 rejects mismatched clients explicitly. Imported equipment meshes, first-person held models, dynamic item lights and trusted server authority remain open. The deferred character redesign is unchanged.

Next: reusable spatial audio, with audible scene emitters and user controls. No whole numbered milestone is closed by this equipment increment.

#Rebindable controls and public input actions · 2026-10-24

Approximately 37% of the full plan. The development player now has a keyboard editor under Escape → Make yourself comfortable → Set your controls. Movement, looking, jumping, running, interaction, journal, satchel and chat can be remapped, with immediate HUD hints, saved preferences and default restoration. Conflicting keys identify their existing owner; invalid storage preserves defaults and failed writes preserve session controls.

The reusable action map owns game-defined axes/buttons and admits keyboard, relative mouse and bounded generic action sources. An independent puzzle definition uses the same API. Chat, menus, focus loss, profile changes and room disconnection clear held input; OS repeat cannot restart movement after these releases. Touch and gamepad adapters remain open.

Acceptance records the final checks and browser journeys. The rounded full-program estimate is unchanged: this completes a user-testable capability within the still-open player-runtime milestone. See the controls panel. The live preview remains garden-ferry.3; this change does not alter world content or save formats.

The following increment delivers that shared equipment path. The final character-art redesign remains deferred.

#Shared scripted garden keeper · 2026-10-24

Approximately 37% of the full plan. Mara now patrols the central garden path, stops for a nearby traveler's conversation, remains stopped while that conversation is open, and resumes afterward. Both browsers render the same clock-driven actor. Conversation ownership survives host handoff; a disconnected speaker's lease expires. The reusable patrol contract uses canonical actor components and has independent engine-zoo content, rather than adding a fake player session.

Acceptance records 363 passing headless tests, five final focused lifecycle checks, type/import validation, production server compilation, Compose validation and all four garden browser journeys. The rendered conversation is captured here. The preview is garden-ferry.3, with separate save keys, room storage and Compose volume; prior preview data remains retained. Scripted patrols are nonblocking and require authored clear paths. Navigation, dynamic avoidance, trusted server AI and the deferred final character redesign remain open.

The following increment delivers the public action map and keyboard rebinding. No full numbered milestone is closed by this NPC increment.

#Playable shared lantern crate · 2026-10-24

Approximately 36% of the full plan. The isolated garden preview now has a complete shared puzzle: push the lantern crate along the west wall to its plinth, light the garden, and retain the result through host departure and rejoining. Both travelers see the accepted position and collision. Competing requests use a step precondition; blocked pushes preserve the previous position. This adds the bounded sliding-prop contract and independent engine-zoo content, rather than a game-only transform trick. Free dynamic bodies and trusted server physics remain open.

The playtest is now garden-ferry.2, with distinct save/session keys, .data/garden-ferry.2 storage and a garden-ferry-v2-room Compose volume. The previous preview data and original beta remain retained. Acceptance records 357 passing full-suite tests, five final focused checks, type/import validation, server compilation, Compose validation and all three browser journeys passing. The combined run exposed an own-capsule obstruction bug; the fix and deliberate contact-push regression are retained in that record. See the lit garden capture and playtest instructions. The rounded overall estimate is unchanged; this is one completed capability within still-open numbered milestones.

Delivery cadence: finish one user-testable capability, run the checks relevant to it, commit/push, and report its result and approximate full-plan percentage. Do not expand diagnostics or benchmarks unless a concrete failure blocks that capability. The following increment delivers that shared NPC patrol/conversation target; public action mapping is next. Character redesign remains deferred to final polish.

#Playable traveler locomotion · 2026-10-24

Approximately 36% of the full plan. Standing ferry riders now remain idle while being carried; walking and airborne poses follow explicit motor-relative locomotion through the relay, canonical remote entities and renderer. Grounding changes use the same timestamped stream as displayed position. A stale stream settles instead of endlessly walking or holding a jump. Reload the isolated preview at http://localhost:5180 to try it with a second traveler.

Acceptance records 352 full-suite headless passes plus the subsequently added version-1 remote-component migration check, all seven remote-actor checks, type/import validation, production server compilation and five real-browser scenarios. The renderer records 29,218 changed pixels for the airborne clip and restores the idle frame exactly. The two-browser ferry journey verifies idle while moving; another journey verifies walking, jumping and landing; existing motion-stall and graphics-recovery scenarios pass. Room protocol 3 explicitly rejects older clients with a reload requirement; room disk format and world content are retained. Presentation format 6 and RemoteActor@2 preserve legacy readers/migration paths. The preview relay was restarted to match its client.

The added airborne clip leaves meshes, materials, joints, resource census and the prior two clips unchanged. This is functional animation work; the required final character redesign remains deferred. The full milestone 0–18 scope remains open, including trusted server physics, general action replication, equipment and broader network/device acceptance.

#Playable garden ferry · 2026-10-24

Approximately 36% of the full plan. The isolated garden ferry playtest adds a visible cooperative crossing: two travelers can board, ride while a menu is open, keep moving through elected-host departure, reload aboard and dismount onto a safe shallow floor. Run npm run dev:ferry and open http://localhost:5180. The original beta world, retained builds, local saves and .data/hearth remain unchanged. A separate Coolify Compose configuration declares its own persistent volume.

The relay owns a persisted route-clock origin; clients apply bounded native motion and preserve rider offsets on admission/reconnect. Acceptance records 349 passing headless tests, type/import checks and the actual two-browser journey. The landing capture shows the new playable environment. Ferry Compose configuration validates; a deployed ferry container and remote CI acceptance are not claimed. This closes one playable slice, not a whole numbered roadmap milestone. General dynamic replication, trustworthy server physics, shaped-network behavior and final visual polish remain open.

#Required final character-art rework — deferred until the final polish pass

• Rework or replace the traveler and NPC models at the end of the engine implementation, before calling the build finished.

User feedback on October 24: the current models are still “really ugly.” The user asked to return to them at the end. Treat every current character model, including the second traveler pass, as temporary and below the required visual standard. Continue engine work now; do not spend the intervening implementation stages making more incremental cosmetic changes to these models.

The final pass must reconsider the character designs and model quality, including proportions, faces, hair, clothing, materials and animation, against the supplied Spawn reference. Replace the current assets if necessary. Review the result in the actual world lighting and shared multiplayer scene, at normal play distance and close up. Passing import, rig and browser checks is technical evidence only; it does not satisfy the visual-quality requirement. See the final polish gate.

#Current room-message admission

The browser now validates every relay envelope before changing room state, including authority snapshots, lifecycle, interactions, receipts and chat. Previously an authority message could publish a malformed door value and advance the epoch without validation; a reproduction against the preceding source records that behavior. Complete envelopes now receive exact-field, identifier, authored-reference and collection checks. Baselines preserve admitted identity and monotonic epoch/revision; current authority snapshots cannot roll back accepted state. Closing or retired socket callbacks cannot revive the connection.

Acceptance records all 344 headless checks, type/import validation and three final-source browser journeys covering doors/chat/handoff, exclusive pickups and shared graphics recovery. Real-socket regressions reject malformed/regressive snapshots without publishing them, ignore old authority, admit a valid successor and reject unavailable interactions normally. The current room protocol documents the implemented wire contract and remaining full-plan requirements. This closes the scoped browser-ingress increment; overall progress remains approximately 35%. Shared platform authority, broader network recovery and the separate remote graphics-recovery failure remain open.

#Current startup failure capture

Multiplayer Enter failures now export the actual failed page's startup stages and DOM error before context teardown. Acceptance holds the second client's real native GPU request and verifies that its report stops at device initialization while the first client remains healthy. Both reports are retained so observer timing cannot be mistaken for failed-client timing. The ordinary door/chat/handoff journey also passes under two-CPU affinity without changing quality or deadlines; this does not reproduce CI or establish hardware equivalence. The next remote run can identify the failed graphics phase. Overall full-plan estimate remains approximately 35%.

That source's completed multiplayer CI passes seven of eight cases, including the deliberate held-startup diagnostic. Ordinary startup succeeds in this run. The remaining failure is shared device recovery: replacement creation reaches catalog restoration about 16.6 seconds after entering the coarse device stage, with no actors/ready stage before the unchanged deadline. The test deliberately holds the native request for about 7.1 seconds of this interval. Adapter, native device, shader compilation, initial upload and catalog subphases remain unmeasured. This test-only commit does not establish a production fix for the previous startup failures. The next renderer investigation must measure those subphases before choosing an optimization.

#Current authored-route player saves

Worlds with authored routes now emit lightweight player-save format 3: the compiled world hash and every persistent route ID/accepted phase accompany player progress. Saved collision is installed before the initial native query update, preventing the first resumed tick from missing the supporting platform. Inactive-place clocks remain parked; stale content and incomplete/invalid phase sets reject. Production worker ready/state messages carry the matched save boundary, and the page preserves older storage generations while writing routed saves separately. Full native checkpoints retain profile 7 and their historical replay fixtures.

Acceptance records all 339 headless checks, unchanged world fingerprints, type/import validation and seven passing final browser scenarios. The production-worker evidence restores a serialized save in a new real worker, validates matched state/save ticks and resumes supported motion. The rendered fixture restores identical platform pixels and retains the original 420-boundary/seven-restore replay. The blocked-rider test initially exposed geometry missing from the first native sweep; the corrected construction order preserves the accepted phase after resume.

This completes authored-route local save continuity, with approximately 35% of the full program complete. Runtime-created platform persistence, shared platform authority/replication, live route revisions and a playable shared-platform journey remain open. Darkwind's shipped content and the deferred final character-art requirement are unchanged.

#Current parallel startup and lifecycle diagnostics

Graphics initialization now runs alongside room admission and simulation restoration. The player can establish its shared session and accept checkpoint/UI state while the GPU is pending, without publishing scene bytes before a single explicit graphics binding. Enter waits for all required readiness signals. Admission failure and the existing 20-second startup deadline dispose the owned workers; a late main-thread renderer is destroyed before catalog installation. Fixed startup timestamps and a capped 16-entry graphics-stage history are available in exported reports.

Acceptance records all 334 headless checks, type/import/content validation, 32 passing scenarios in the 33-case player/multiplayer run, and the passing targeted correction for the remaining fallback buffer-pressure test. That test previously held the first UI-only startup frame and expected a scene allocation; it now holds the first actual transferable scene and preserves the same bounded ownership, detachment, return and movement-catchup assertions. Native startup reports cover held GPU creation in both placements, rejected admission and an admitted room reaching the real startup deadline. The initial failure remains recorded. No production deadline, graphics quality or motion expiry was relaxed.

This completes the scoped startup increment, with approximately 35% of the full plan complete. It removes a verified serial dependency and improves failure diagnosis; remote graphics initialization/recovery and physical-device performance remain open. It does not close a full numbered roadmap milestone.

Source 4f85246 subsequently failed all seven multiplayer CI scenarios at Enter. Its observer reports prove admission/simulation can precede graphics, but do not contain the failing second client's graphics stage. The capture correction above now targets the failed Enter page; observer timing still cannot diagnose the second client. Core/container pass, with the other browser jobs still running at that observation.

#Current direct scene delivery

The player now connects simulation and renderer with a transferred MessagePort. UI state and scene ownership have independent acknowledgement boundaries, so neither consumer can retain the other's delivery. The scene channel owns one reusable 4 MiB buffer and a 20-second receipt deadline. Renderer pause/ready generations force a fresh baseline after device replacement, including when the older device still owns an outstanding packet. Main-thread graphics fallback retains its tested combined path.

Local acceptance records 334 passing headless tests, type/import/content checks and all 28 player/multiplayer browser scenarios. During an actual 1.5-second blocked page task, the render worker admitted 12 scene receipts and observed three GPU completion notifications. A separate native-port hold retained exactly one scene buffer while movement and autosaves advanced; releasing it returned the same allocation. Reports preserve the observed counters, room recovery and GPU accounting. This does not remove main-thread camera/DOM/storage dependencies or establish hardware performance.

The preceding worker source cace981 finished CI with core, container and probe passing, multiplayer failing and the player job cancelled. Its multiplayer failure records two passing scenarios and four failures. Three waits never reach an enabled Enter button; retained diagnostics identify a startup deadline in one, while the shared-recovery panel reports its recovery deadline. The serial-startup investigation identifies simulation module loading delayed behind graphics creation; it does not establish the underlying GPU delay.

Direct-channel source 9af1ebb also has a completed multiplayer CI failure: all seven cases fail at Enter, and every second-page trace lacks a simulation module request. Five retained DOM snapshots explicitly show the startup deadline. Core, container and probe pass; the player job was still running at observation. Startup phase diagnostics and remote recovery acceptance remain necessary; the earlier screenshot delay is not evidence for the cause of these startup failures.

#Current live renderer worker

The development player now runs the owned WebGPU backend, Darkwind catalog and traveler rig in a dedicated render worker. Capability probing happens before transferring the visible canvas; unsupported canvas transfer, worker creation or worker WebGPU falls back to the same main-thread renderer. Two bounded device replacements rebuild inside the same worker/canvas while preserving simulation and room identity. Scene admission returns the existing pooled presentation buffer without waiting for GPU completion. Camera/view updates coalesce, reply generations are fenced, and fatal errors or deadlines terminate the render owner before the saved-journey retry flow.

Local acceptance records 329 passing headless tests, type/import/content checks and all 26 player/multiplayer browser scenarios, including three fallback conditions, held GPU completion, withheld page animation frames, real device loss, worker crash and a real 20-second reply timeout. Bounded runtime reports now observe native GPU events in the active graphics realm and carry both clock origins. Preserved shared-world and recovered-view captures retain the existing presentation. That worker-placement increment still forwarded scenes through the main thread; the direct channel above supersedes that limitation. Physical-GPU acceptance and the earlier remote scheduling failures remain open. This is engine reliability work; character redesign remains deferred to final polish.

The preceding transport source d269c03 finished CI with core, container and probe passing, player 13/14 and multiplayer 4/6. The failures were the post-recovery pixel wait, initial walking observation and shared recovery reaching failed instead of ready. These remain explicit in the worker acceptance record; local worker passes do not prove their root cause or remote resolution.

#Current slow-frame gait correction

A targeted regression reproduces a traveler remaining idle whenever consecutive rendered frames are at least half a second apart. The gait now selects the current movement blend after long gaps and advances one capped stride step. Controlled software-GPU browser coverage observes walking with 650 ms delayed completion, then idle after real keyboard movement stops. The contract-worker retry test now has an overall 240-second CI budget for its two existing 90-second diagnostic runs; production deadlines and per-check acceptance remain unchanged. Source c1549b5 has recorded acceptance: all 298 headless checks, type/import checks and three focused browser scenarios pass. The exported slow-render report records one walking traveler with a 1,240.6 ms completion-notification wait, then zero walking travelers after input stops. The earlier CI walking failure is not yet conclusively attributed to this bug, and physical performance gates remain open.

#Current character art refinement

The second traveler art pass updates the actual shared GLB: shaped facial contours and almond eyes, swept hair, fitted sleeves, folded scarf/collar, boot laces and a shaped satchel with complete straps. Hip-weighted coat hems follow the stride in reviewed poses. The production importer, shared fourteen-joint rig and two existing clips remain the path into the owned renderer. A repeatable review command captures five views and the furnished Hearth study. Recorded acceptance includes all 307 headless checks, type/import checks, all six multiplayer browser scenarios and the complete two-run renderer study. Geometry rises to 28,216 triangles and eleven material draws per playable traveler; final art direction, facial/cloth animation and hardware performance remain open. No full milestone is closed.

#Current input cadence and browser investigation

The release-boundary source 0f6881e has recorded CI failures: the corrected key-release and nameplate tests pass, while player finishes 13/14 and multiplayer 3/6. Core, container and probe finished successfully. The player failure compares 49 versus 53 GPU buffers at the initial allocation assertion, before travel. The multiplayer observations record animation gaps up to 11.86 seconds, multi-second main-thread timer/worker-delivery gaps, and queue notification waits around 12.8 seconds. Shared recovery receives device loss, then exhausts its actual 20-second recovery budget. These timings establish broader scheduling delays; they do not yet identify their cause or justify changing expiry/recovery limits.

The resource census follow-up corrects the obsolete ten-mesh expectation: eleven resident traveler meshes account for 53 buffers and four textures. The full three-place journey passes and retains exactly that census after lighting the beacon. A candidate replay of captured room arrivals produces a stalled pose at the approximate last render time; the retained events do not establish the complete presentation history or root cause. Test-only observations now retain bounded long-task durations, per-queue submission/completion wall times, adapter/CPU information and worker teardown events. No runtime expiry, recovery deadline or graphics quality has changed.

A two-CPU local experiment passes both movement scenarios but finds a previous observer still sending poses after its browser context closes, failing the following scenario's roster check before recovery starts. The delayed-render scenario now verifies departure while the other peer remains connected. A traced repeat passes that departure check, then reports a native page crash before graphics recovery begins; no core dump or kernel OOM entry was found. CI now retains browser-process stderr for failures that prevent in-page diagnostics. These are separate from the earlier CI recovery timeout and are not claimed fixed.

The final ordinary local follow-up passes all three focused multiplayer cases, including actual graphics recovery, with bounded timing records and passing type/import checks. Canonical-platform source 21110c2 independently passes all six multiplayer CI cases, but still records queue notification waits up to 7.45 seconds on its software renderer. Passing functional checks do not establish interactive hardware performance or erase the retained intermittent failures. The resource correction awaits its own remote run; full-plan gates remain open.

The input-cadence source has now completed remote CI: core, container and probe pass, player passes 13/14, and multiplayer passes 2/6. Release trace analysis identifies an invalid measurement from a pre-key-up snapshot across a 545.559 ms command. The browser release check now observes the actual event and subsequent stopped state, with independent native braking coverage. The nameplate visibility path stays inside the room's camera view. Local follow-up acceptance passes three motor tests (including forty release fixtures), two player scenarios, all six multiplayer scenarios, then three final instrumentation scenarios. Bounded event traces now accompany the remaining walking and graphics-loss failures; their cause and remote acceptance remain open. See the measurement follow-up.

The player input refresh is now independent of rendering. A browser regression withholds every animation callback: the old sender stops near Z=4.149 from Z=4.8; the corrected sender continues walking and keyboard look, then releases and pauses correctly while rendered-frame count remains zero. The worker's existing 250 ms input expiry remains intact. Recorded acceptance includes 307 headless checks, all 30 browser scenarios and type/import checks. Multiplayer observation now sustains real motion through the pose-stall/recovery checks, and the controlled GPU hold compares its measured duration against the historical maximum without requiring a new maximum. CI's separate 107-second screenshot operation remains unresolved; these changes do not claim to fix it.

#Current character motor investigation

Canonical platforms now connect the owned adapter to persistent entities, actual rendered transforms, CharacterMotor.platform, pending targets and place departure/return. Creation/removal stage native candidates; target rejection rolls back; active native/ECS disagreement is rejected. Simulation profile 6 adds the KinematicPlatform catalog entry with explicit migration from profiles 1–5. All 426 historical platform-free replay hashes still match after removing only that new catalog entry and envelope version. Recorded acceptance passes the 315-case headless suite, eight final native follow-ups and four browser scenarios, including two complete Observatory runs with visible creation/motion, exact restored pixels and removed platform geometry. Authored paths, lightweight-save persistence, shared authority and the full physics milestone remain open. See the canonical contract.

The owned platform adapter now carries supported riders through translation and yaw, sweeps carry against obstacles, stops a blocked platform, and retains pending motion/support/native bindings in a distinct physics checkpoint profile. Acceptance records all 307 headless checks, type/import checks and two existing-player browser scenarios. Seven focused cases cover motion, departure, obstruction, restore and validation. A comparison probe reduces final axial drift below 0.01 mm in its six owned fixtures; that is not a hardware-wide numerical guarantee. That adapter increment left canonical entities and matching rendered geometry open; the integration above now supplies them. Authored motion, shared authority, pitch/roll and broader collision/loading policies remain open. The production game still has no moving platforms.

The earlier slow-gait source 262bb8f has completed CI: core, container and probe pass. Multiplayer passes five of six scenarios, including deliberately delayed gait, but the ordinary walking observation still misses its expected count. Player passes eleven of thirteen scenarios; the held-completion test incorrectly requires growth in a historical maximum wait, and recovery exceeds its pixel-poll deadline during a screenshot operation. Terminal job results and failure logs are retained. The input/test corrections above address separate findings; remote acceptance and the capture delay remain open.

The motor timing correction sets Rapier's current integration duration before the character sweep. Two regressions fail against the previous ordering and pass after the correction: all sixteen elevator rate transitions preserve clearance, and a restored transition continues through ninety byte-identical native boundaries. Recorded acceptance includes all 300 headless checks, type/import checks and two actual-player browser scenarios; the historical fixed-step replay traces remain unchanged. Its native-only probe records horizontal drift and position-driven vertical lag, motivating the owned carry above. No full milestone is closed, and the retained beta is unchanged.

#Current canonical remote actors

Remote actors now enter the same canonical entity store as the local motor and authored world. Connection-scoped identities, atomic roster reconciliation and incremental projection replace the worker's direct room-to-render actor path. Local checkpoints deliberately preserve their existing session-free boundary; replay fixtures and saved data formats remain unchanged. Source be710c3 has recorded acceptance: local verification passes all five multiplayer browser scenarios, including canonical entity count on arrival/departure. The 297-case headless run has 296 passes and one obsolete live-catalog count; 16 affected follow-ups pass after distinguishing eighteen live contracts from seventeen saved contracts, and twelve validator/relay checks pass after sparse-roster hardening. Authoritative remote physics, animation replication, equipment and full-plan gates remain open.

Shared-traveler CI, source 5035226, passes core, Docker and the player suite. Multiplayer misses its initial walking observation; the contract-worker diagnostic retry exhausts the overall test budget after a 60.4-second first run. Those source-specific failures are retained for follow-up and are not claimed fixed by canonical entity integration.

#Current graphics completion accounting

The development renderer now exposes its existing one-pending-frame bound, completion notification latency, skipped draws and disposal cancellation through graphics diagnostics. Recovery waits only after an actual frame submission, and playtest reports retain up to four incident snapshots across renderer replacement. Source e0ebe28 has recorded acceptance: all 291 headless checks, type/import checks and six focused browser scenarios pass, including delayed completion, shared recovery, visible world pixels and the complete owned-renderer reference run. The initial delayed-completion test attempted to click an export button while pointer lock was active; the final test opens the pause menu before using the inspector. The existing CI screenshot/presentation delay is not yet explained or claimed fixed; full-plan scope remains unchanged.

#Current playable traveler integration

Shared travelers now connect the original rig to the development multiplayer player, with game-owned art configuration, bounded timestamped motion, idle/walk blending, matching nameplates and graphics reconstruction. Protocol 2 stamps valid movement at the relay and rejects forged motion metadata. Presentation format 5 carries those stamps and reserves actor palette costs. The empty-handed playable variant avoids implying quest-lantern ownership. Runtime ebaa4a6 and resource-test correction bb1c155 have recorded acceptance: 291 headless checks plus 14 final-guard follow-ups; the full browser run passes 26/27 with one obsolete resource-count assertion, followed by two passing final-source browser cases covering that correction and real pose-packet stalls. Type/import checks, content validation and server/author builds pass. Canonical remote entities are integrated above; general animation replication, action poses, equipment and the remaining full-plan gates remain open.

Prior traveler-study CI passes core, Docker, player and graphics probes. Its multiplayer recovery case reaches the overall deadline while the final screenshot takes 77.879 seconds after the shared-state assertions. That capture/presentation delay remains unresolved; the actor integration does not alter those deadlines.

#Earlier original traveler study

The original traveler introduced reproducible source geometry, a fourteen-joint rig and idle/walk clips in the furnished Hearth diagnostic. At that source, playable multiplayer avatars were still proxies; the integration above supersedes that limitation. The study checks visible walking deformation and exact restored idle pixels. Shared pose admission also rejects extra fields and copies motion explicitly, closing a reproduced identity-overwrite defect before actor transport was extended. Source 7c95a47 passes all 284 headless checks and five affected browser scenarios, type/import validation, unchanged world fingerprints and production server compilation. The native rendered study records the first character pass. Proportions, gait refinement, replicated animation and all full-plan gates remain open.

#Current animation-state integration

Completed remote CI for 0c627cf passes core, Docker, multiplayer and all graphics-probe tests, verifying the repeated-run budget correction. The player graphics-recovery pixel poll still fails at 60 seconds. The new actor work does not establish a fix for that outstanding presentation/capture issue.

Animation state now advances on simulation ticks, projects rigid/skinned poses through canonical ECS updates and restores through simulation checkpoint profile 5. Clip bindings and a 32-entity limit are enforced at commit/restore; animation-only changes do not recompose spatial transforms. Actual profile-4 migration and continued animation replay are covered. Source e24d554 passes all 281 headless checks, all 26 browser scenarios and type/import validation. The acceptance record retains the initial profile-dependent fixture failures and their versioned corrections; all twelve GPU animation references match exactly. Original playable character art, renderer interpolation and shared actor animation transport remain open, along with all unclosed full-plan gates.

#Current skeletal foundation

The skeletal path adds GLB joint/weight import, inverse binds, owned sampled palettes, versioned presentation and GPU deformation in color and shadow passes. Authored rest palettes survive ECS/checkpoint reconstruction. Nine independent GPU reference comparisons match exactly, including directional and point shadows with broken-deformation controls. Source aabb267 passes all 272 headless checks and a focused committed-source renderer/recovery browser scenario. All 26 browser scenarios pass in the preceding full run; the acceptance record distinguishes that run from the final catalog budgeting and authored rest-palette follow-up. Desktop evidence preserves the furnished Hearth presentation. Animated actor state, shared/replayed animation, original playable characters, blending and attachments remain open; the beta stays unchanged and no full milestone is closed.

Skeletal remote CI passes core, Docker (including skinned import) and multiplayer. Its first full Observatory report passes all nine skeletal references. Two repeated-run browser tests exhaust their overall 120-second budget; trace timing supports allocating the existing 90-second allowance per complete run plus overhead. Only those two overall test budgets change; remote verification is pending. The player recovered-world capture still stalls for roughly 60 seconds and remains unresolved.

#Current animation clip foundation

The animation path adds bounded GLB TRS clip import, an independent artifact reader, STEP/LINEAR/CUBICSPLINE sampling and parent/child model poses. All 256 headless tests and all 26 browser scenarios pass locally; rendered poses match separately authored static references, including reflection, culling and device reconstruction. All three affected renderer/recovery scenarios also pass after the final worker-stage diagnostic instrumentation. The acceptance record distinguishes the full run from that follow-up. The subsequent skeletal foundation is described above. Actor animation state, blending, attachments and playable art integration remain open.

Remote animation CI passes core, Docker and multiplayer. It fails one player recovery pixel poll and one Observatory retry: the new diagnostic identifies device loss delivery as the last model-world stage before the fixed deadline. A player screenshot takes approximately 61 seconds. Neither root cause is proven or fixed by inference from local passes.

#Relay shutdown follow-up

CI for the cutout stage built the production image and passed its model imports, notices, admission and shared-door checks, then failed the clean SIGTERM-exit assertion. A separate reproduction held a large HTTP asset response unread: the old close() remained pending beyond three seconds, while the production watchdog exited with code 1 in CI. The fix fences new work, begins HTTP shutdown immediately, and destroys remaining sockets after a two-second drain. Static streams release their file descriptors when responses close. The Docker smoke now consumes complete asset bodies. Source 54aebb8 passes all 246 headless tests, all four multiplayer browser scenarios, type/import checks and the production server build. A real SIGTERM of the compiled production server with a stalled 32 MiB response exits with code 0 in about two seconds. The follow-up evidence records bounded stalled-download/header/WebSocket cleanup, admission fencing and saved-session preservation; this does not resolve the separate prior graphics-capture stall by inference. Completed remote CI passes core, Docker, player and multiplayer. Two Observatory retry scenarios fail at the 20-second model-world worker deadline; their inner stalled operation is not yet known.

#Current cutout materials and ivy

The masked-material path adds alpha cutoff to imported color/depth and directional/point shadow passes, with linear alpha, factor-only masks, reflected/double-sided geometry and bounded resource ownership. The original ivy planter extends the furnished Hearth study; the default playable world is unchanged. Source d03554a passes all 244 headless checks, including standalone compiler distribution and authored-world checkpoint replay. All 26 browser scenarios pass locally with no skips or retries, including masked color/depth references, both shadow controls, shared/player recovery and the furnished study. The acceptance record preserves the initial shadow-edge comparison failure and the measured boundary criterion. Native study, desktop and narrow captures show the result. Remote follow-up records the original Docker/multiplayer failures and subsequent passing Docker shutdown fix, alongside two unresolved Observatory timeouts. Alpha blending, skeletal animation, live asset activation, physical-device acceptance and the remaining full-plan gates stay open.

#Current surface materials and authored art

The surface-material path adds normal and occlusion maps, bounded portable MikkTSpace generation, reflected tangent frames, and surface resource ownership. The Observatory now ends with an original furnished Hearth study instead of the plinth gallery. Source cdadb44 passes 235 headless tests and all 26 browser scenarios locally, including eight independent lighting references, portable browser/Node tangent compilation, catalog recovery and the authored study. Follow-up CI passed core, Docker, probe and multiplayer jobs but failed a player recovery screenshot poll: the capture took about 75 seconds and the late trace still shows the world. Its stall cause remains unproven. Default Darkwind content remains unchanged; animation, live asset activation and the remaining full-plan requirements are still open.

#Current material texture integration

The material texture path connects embedded PNG/JPEG images to opaque base color, metallic/roughness and emissive maps, including color-space-correct mipmaps, explicit sampler settings, bounded GPU ownership and catalog/device reconstruction. Untextured artifact identities and default Darkwind content remain unchanged. The subsequent surface stage above adds normal/occlusion support; alpha cutoff, streamed residency, production art and animation remain open; no full milestone is closed. Source 99acd34 passes 226 headless tests and all 26 browser scenarios, including texture controls and exact catalog reconstruction. The worker report retains UV, sRGB, material-channel, mip, sampler, catalog and recovery evidence. Source CI passed core and all three browser suites, but Docker acceptance failed because the static server did not serve the bundled codec notices. The surface increment adds exact notice routes and a real HTTP regression test; Docker re-verification remains required.

#Current texture-processing work

The portable texture compiler adds bounded PNG/JPEG decoding, color/data/normal mip generation, independently validated RGBA8 artifacts and an isolated portable CLI. Numeric PNG and progressive JPEG fixtures have independent reference pixels; the browser contract worker compares all six usage/artifact variants with Node. The subsequent material integration above connects GPU sampling and GLB references; the compiler stage itself did not change default game art. Source 099a999 passes 218 headless checks and all ten browser probe cases. The worker report preserves the six matching artifact identities. Texture CI has passed core, Docker and all three browser suites.

#Current authored-model integration

The authored-model path connects world-3 embedded catalogs to persistent placements, expanded ECS draws, static triangle collision, full checkpoints and GPU catalog ownership. The authoring API and portable CLI attach/replace assets atomically. Two actual relay clients verify shared material changes and host handoff in the independent imported world; the worker GPU probe verifies exact frame restore after checkpoint and device reconstruction. Default Darkwind content remains unchanged. Source 12e8701 passes all 207 headless checks. The acceptance record retains the initial browser run (25 of 26 passed; one unexpected browser closure) and three passing fresh-browser repetitions of the interrupted case without code changes. The closure cause remains unproven. The worker report, desktop and narrow captures preserve the imported-world results. Source CI and evidence CI have passed all jobs. No full milestone is closed.

#Current imported-model rendering work

The static model renderer connects validated GLB artifacts to indexed WebGPU geometry, shared mesh instances, reflected winding, colored emission, double-sided surfaces and mesh-specific camera/shadow bounds. Replacement stages bounded resources, retires the prior frame before publication and preserves the accepted model on failure. The Engine Observatory now renders the compiled lantern-plinth fixture and checks exact pixel restoration, rejection, repeated replacement and CPU-artifact reinstallation after actual device loss. Source d92607c passes all 197 headless checks. The acceptance record distinguishes the complete 26-case browser run before final test refinements from the three affected cases passing on clean follow-up d0afaaa. The worker report, desktop, narrow and shared recovery captures retain the results. Follow-up CI passed core, Docker and all three browser jobs. Authored placement and catalog integration are described above. No full milestone is closed.

#Current GLB compiler work

The static GLB importer now produces bounded, content-addressed geometry/material/hierarchy artifacts through an isolated worker and portable CLI. It validates packed/interleaved/sparse data, generates missing flat normals, preserves mirrored transforms and derives conservative bounds independently of rendering. A project-owned lantern-plinth regression fixture and an independent Khronos Box import exercise the path. Clean source 4facc47 passes all 189 headless checks and 26 browser scenarios, with no skips or retries. The compiled fixture preserves 54 emitted vertices, two mesh primitives, three instances and 24 scene triangles. The independent Box import has 24 vertices and 12 triangles; both content identities and CLI output sizes are recorded. Source CI passed core and Docker but failed two browser recovery checks (24 of 26 passed), before the subsequent fault-injector and CI observation/scheduling corrections. The follow-up record retains those failures; corrected source and its evidence commit both passed all CI jobs. The subsequent renderer increment is described above; authored model references, textures, skeletal animation, asset job coordination and the remainder of milestone 7 remain open.

#Current graphics recovery work

The graphics recovery path pauses local controls on device loss, rebuilds the renderer, requests a fresh ECS presentation baseline and waits for a completed frame before offering resume. The existing worker and shared-room identity remain alive. Allocation/preparation has a 20-second deadline and two replacements per session; late candidates cannot reactivate a failed attempt. Clean source e5de328 passes all 178 headless tests and 26 browser scenarios, with no skipped or flaky cases. The waiting screen, restored menu, shared room and capability report retain the evidence. Source CI passed core and Docker, then its browser job reached the 15-minute job deadline after 22 cases (20 passed, two failed). The trace shows a 53-second screenshot operation exceeding a 15-second pixel-check wait and a shared-room recovery timeout; the exact cause of the latter is not established. The fault injector now latches early release intent, CI pixel observations allow 60 seconds, and the three browser files run as independent CI jobs. Runtime recovery remains limited to 20 seconds. The trace and follow-up record preserves these failures and separates the known test race from the unresolved CI timeout cause. All three affected renderer/recovery cases pass locally; follow-up CI subsequently passed core, Docker and all three browser jobs. No full roadmap milestone is closed.

#Current shader activation work

The shader activation path compiles complete shadow/scene/post bundles asynchronously, fences superseded and timed-out revisions, and retains the last valid frame on invalid replacements. Fixed GPU layouts reject incompatible resources before activation. The worker probe verifies five rejection cases, repeated valid replacements and exact restored pixels without replacing existing buffers or textures. Clean source 9b40829 passes all 172 headless tests and 23 browser scenarios, with no skips or retries. The capability report, desktop, narrow preview and player panel retain the evidence. Source CI passed core, Docker, gameplay and actual shader/renderer checks but failed three diagnostic setup/completion waits. Its evidence commit repeated those failures. The follow-up record shows 15-second locator waits expiring during a longer valid workflow; those waits now use the established 90-second workflow budget, while worker deadlines and fault assertions remain unchanged. All three corrected scenarios pass locally. No full milestone is closed.

The visibility source CI passed. Its evidence-only follow-up caught a multiplayer test navigation race: delayed software rendering kept a strafe key held past the door's interaction radius after successful host takeover. The door/handoff fixture now starts the guest within reach, retaining the shared-state and reload assertions. Movement remains independently tested. This correction does not change runtime interaction distance or authority rules.

#Current render graph work

The frame texture graph now drives production shadow, scene and postprocessing passes. It validates dependencies and texture usage before encoding, tracks logical lifetimes and allocation generations, and owns bounded target replacement. Fixed shadow targets survive viewport resize; partial synchronous allocation failures release candidates while retaining the accepted set. Clean source bd0488f passes all 163 headless tests and 23 browser scenarios, including target census, resize generations and all eighteen visibility reference cases. The capability report, desktop, narrow preview and player panel retain the evidence. Source CI and evidence CI passed core, browser and Docker jobs. No complete milestone is closed by this increment.

#Current primitive visibility work

The renderer visibility path now independently culls camera and shadow batches using final animated affine bounds. This preserves off-camera shadow casters and exposes submitted instance/triangle counts while retaining resident scene statistics. All 156 headless tests and 23 browser scenarios pass locally. A final two-scenario run also passes after strengthening traveler clip-boundary coverage and bounding the F2 panel to the viewport. Eighteen rendered reference cases preserve identical pixels, including animation boundaries, off-camera shadows and all three places. Entry-view camera counts fall from 674 to 514, 578 to 338 and 225 to 124 respectively; these are submission counts, not hardware frame-rate claims. Source 07d3c4a and its acceptance record, reference report, desktop, narrow preview and bounded player panel retain the local evidence. These runs preceded the commit; their record distinguishes the complete suite from the two final checks rather than claiming a clean-checkout run. Source CI passed all jobs. No full milestone is closed by this increment.

#Current isolated build-worker work

The build worker now serves the prefab file commands through bounded child processes. Its coordinator admits exact build-request revisions, deduplicates retries, fences superseded results and preserves the last successful artifact. The production bundle runs outside the repository without development dependencies and is included in the Docker image. Clean source 2a24a38 passes all 152 headless tests, including real blocked-child termination, corrupt/oversized replies, out-of-order results and the packaged CLI. Core, actual Docker and browser CI all passed. Evidence commit 5667080 also passed all CI jobs. Local Docker was unavailable because this user cannot access its daemon. The full-Darkwind build benchmark, on benchmark-only follow-up e78f488, measured 490.714 ms median / 531.077 ms p95 across ten process builds after three warmups. All 1,480 authored identities and canonical object data matched, and the 1,481-entity native runtime restored exactly. Artifact size was 1,346,176 bytes, with zero active jobs or pending bytes after cleanup. These are sequential local builds, not concurrent capacity or durable recovery measurements. Durable job control, authenticated publication, build caching and imported-asset processing remain open.

#Current prefab compiler work

The primitive prefab compiler resolves inheritance and explicit instance overrides, retains saved member identities, emits dependency hashes/source mappings and produces standalone world-2 content for the real Simulation. A modular arch/lantern/planter kit exercises two places. Clean source ec34043 passes 144 headless checks and all 23 browser scenarios. Its cumulative-byte-limit follow-up 4224472 passes 145 headless checks and a fresh rendered browser/Node contract check. The desktop preview, narrow preview and final worker report preserve the evidence. The prefab feature ec34043 has passed all CI jobs; byte-limit follow-up 4224472 and evidence commit b3589f0 have also passed all CI jobs. Cached build execution, GLB/textures/audio, general instance transforms, editor linkage and live activation remain open. No complete milestone is closed by this increment.

#Current persistent authoring work

World format 2 and compiler 2 now carry explicit persistent object identities. The authoring API and CLI import existing mappings without replacing IDs and apply atomic rename/move/property/create/delete transactions with revision/hash preconditions. Checkpoint profile 4 explicitly migrates profiles 1–3, preserving modified authored rows and native/spawned state. A shared Node/browser fixture exercises real authoring, compilation and runtime restore. Clean source 382ea48 passes 136 headless checks and all 23 browser scenarios, including the complete Node/worker authoring evidence. The full Darkwind CLI check preserves all 1,480 authored IDs, renames/moves a decorative prop and exactly restores the exported 1,481-entity native runtime. All three CI jobs passed. Live activation, disjoint collaboration/undo, asset imports and all complete milestones remain open.

#Authored-world integration baseline

The foundations branch now installs all 1,480 authored Darkwind objects into the real Simulation ECS alongside the player. The primitive compiler creates immutable source identity/asset catalogs. The production worker projects canonical rows, and an acknowledged channel bounds posted state/presentation frames to one while coalescing pending work. Profile-3 full checkpoints include those entities and the compiled signature; explicit migrations preserve profile-1/profile-2 native/player/spawned state. The replay fixture still covers 426 boundaries and 26 restores.

Clean source cbb9ec34f56b0d5d868dc99c2fdf21d6ff6144ef passed 129 headless tests and all 22 browser scenarios, with no skips or retries. Coverage includes three-place projection parity, shared conditional changes, native migration, renderer dependency rejection, blocked-consumer recovery and raw canvas pixels. The worker report, welcome capture and shared-room capture preserve software-WebGPU evidence. Core and Docker CI passed. Browser CI passed 21 cases and failed the raw-canvas pixel assertion, although its trace frame visibly shows the house. The follow-up samples the composited browser image with DOM UI hidden; delayed-GPU and invisible-canvas controls passed locally. The correction subsequently passed all CI jobs. The preliminary system-Chrome software-rendering failure is retained in the acceptance record rather than counted as a pass. Primitive compilation does not complete the prefab/import/build-job pipeline, identity remapping across source moves, ECS-to-physics live editing, transferable buffer pools or any full milestone below.

The full-world simulation benchmark measured 0.187 ms p95 over 1,800 ticks with all 1,481 entities. Full checkpoint capture/restore measured 36.778 / 315.186 ms p95, with a 950,285-byte JSON envelope. These runs followed local acceptance on clean source. Full checkpoint work exceeds one 30 Hz tick and requires off-frame scheduling and content/state optimization before frequent remote snapshots; lightweight local player saves remain unchanged. No multiplayer-capacity, physical-GPU or recovery-time objective is established.

#Release baseline

The beta at e05b28f438ff13e3fb21088990c10499729fe44d passes core, browser and Docker CI. Coolify uses compose.coolify.yaml, a stable named /data volume, and explicit HTTPS origins for the deployed room. This establishes the beta baseline, not later engine capabilities.

#First foundation increment

Implemented in the real player runtime:

• Compiled phase/dependency scheduler with conflicting-access validation, cadence, structural barriers, exact uint64 ticks, fault parking and per-system timing.
• Declarative component descriptors, generated bounded value validation, stable SHA-256 schema identities and atomic versioned ECS snapshot migration with golden fixtures.
• Bounded ephemeral events with independent cursors, explicit expiry and overflow behavior.
• Import-boundary enforcement in normal checks/builds; canonical entity iteration; restore command invalidation and fixed-clock configuration validation.

The core contract specifies the behavior and its limits. Beta world data and the release fingerprint remain unchanged; no live room migration is required for this increment. Browser and container acceptance must continue to accompany integration.

Foundation source: eb12a561fd52989e9b0c2d919d982c1f869e0c53 (passing CI run). Local verification passed 37 headless checks, type/import checks and production builds. The eight-scenario browser walkthrough passed, followed by a targeted dialogue rerun after the paused-event retirement fix. Core, browser and Docker CI passed on the committed source and the subsequent benchmark documentation commit.

The foundation benchmark records 1,800 measured ticks after 300 warmup ticks, the clean source commit, Node/OS/CPU, and per-system costs. On the recorded Intel Core Ultra X7 358H machine, single-player simulation p95 was 0.0394 ms and p99 0.0608 ms. These measurements do not satisfy the separate 16-player/128-body or hardware-GPU budgets.

#Milestone ledger

The renderer baseline increment adds the Engine Observatory and placement record: actual main-thread/worker rendering, nonblank pixel checks, transfer ownership, resize, explicit device loss, worker stop/restart, cancellation and error recovery. It also releases renderer resources before reporting a graphics failure. The main player retains its current thread placement; physical-device performance and the remaining renderer protocol/resource-graph work are still open.

Renderer source: f54535c36096dc7b1ec34a6e8c38ca6bd3bbc7a1 (CI run). The clean-commit capability report, six browser probe checks, and desktop/narrow layout captures record reproducible software-rendered evidence. Before committing, 37 headless tests and the complete 13-scenario browser suite passed; the added silent-worker timeout check and final probe rerun passed all six probe scenarios. CI covers the complete resulting 14-scenario browser suite plus the expanded Docker diagnostics-asset check.

The renderer source CI passed core, Docker and all six graphics probes, but caught an intermittent lawn-test prompt assumption. The following evidence-only commit passed all three CI jobs. The lawn test now checks the actual raised-floor return position and rejects respawn, rather than requiring a transient portal prompt to remain nearest after key-up; that correction passed three consecutive rendered runs.

The next core increment replaces component maps with dense/sparse membership and schema-derived numeric columns, introduces bounded entity slots and generation retirement, adds component removal tombstones, and publishes restored ECS baselines atomically to independent readers. The player's existing Transform uses the new storage without a save/content migration. Local checks passed 44 headless tests, type/import checks and production builds. The full browser run passed 13 scenarios and reproduced the lawn prompt race above; its corrected collision test then passed three consecutive runs. See core contracts for the exact storage and sequence limits.

Storage source: 39c7ee236764fa554501de707edb5f1782020ee0 (CI run). The clean-source storage benchmark measures 8,192 entities: 128 selected validated updates at 0.1873 ms p95, full canonical query iteration at 0.6754 ms p95, and unchanged 361,600 typed bytes through 12,800 replacements. The simulation benchmark confirms the actual player Transform uses three numeric columns and records 0.0390 ms p95 for the single-player simulation. These isolated measurements do not prove multiplayer/world capacity, whole-process memory stability or a statistically established speedup over earlier runs.

The storage source CI subsequently passed core, browser and Docker. The next increment adds the 17-component catalog and spatial contract: Transform v1→v2 migration, place/parent relationships, quaternion/uint64 schema types, float64 hierarchy composition, projected parent-edit validation and mixed numeric/reference columns. The player now publishes ten-column Transform and five-numeric-column CharacterMotor state, including immediate place changes. Descriptor-only capabilities are identified explicitly in the catalog. Local verification passed 54 headless tests, the complete 14-scenario browser suite, then eight probe scenarios after adding contract-worker error and unsupported-worker cases. The Node and browser worker produce the same complete five-node transform fixture and schema identity. Full physics replay, commit-level relationships and the remaining milestones stay open.

Component source: b7f61fb10bbd4549f9ad96c34d6996f4e34eae4a (passing core, browser and Docker CI). The clean-source browser report, eight probe checks, desktop/narrow screenshots and simulation benchmark preserve its exact evidence. Single-player simulation p95 was 0.0473 ms on the recorded machine; this does not establish larger-world capacity.

The next core increment stages atomic entity/component batches, preserves unaffected handles, validates installed relationships before direct writes or restores, and retains complete named tick/transaction groups for independent readers. The player now publishes pose, motor and place together. Rejected edits preserve state, generations, allocation, cursors and deferred commands. Full physics/resource rollback, durable transaction integration and full-runtime checkpoints remain open; these are bounded in-memory ECS commits. Local validation passed 62 headless tests and 16 browser scenarios, with final targeted checks for player tick/travel metadata, storage and rejection behavior. Browser acceptance now owns a temporary client build and writes new screenshots to test-results rather than replacing historical evidence. See the current contract.

Atomic mutation source: 8752564f3b0872e583eb78c2f07a831b4fe9770f (passing core, browser and Docker CI). The clean-source 16-scenario browser results and capability report passed with zero skipped/flaky cases. The harness preserved all ten existing dist assets byte-for-byte. Single-player simulation measured 0.1137 ms p95; the 8,192-entity storage fixture measured a 128-row atomic update at 1.4495 ms p95. Retained typed allocation stayed unchanged through 12,800 replacements; transaction scratch allocations are explicitly excluded. These results measure the cost of staged validation and publication, not complete multiplayer/world capacity or allocation-free ticks.

The next increment adds complete current-profile simulation checkpoints and exact replay: native physics, controller settings and jump-edge state, accepted input/expiry/facing, ECS, scheduler and retained event state. A candidate restore is validated independently before replacing a live runtime. The same three-case fixture matches Node and Chromium through 346 boundaries and 21 restores, including held jump, stale input, event expiry, doors and place travel. The pinned backend's restored static-parent cache issue is handled inside the adapter using native bindings. Local verification passed 71 headless tests, the complete 17-scenario browser suite, and the new replay-worker deadline test. These checks do not close the full physics, host recovery or cross-device gates.

Checkpoint source: e18fdb7f13351fa9fe50c9a3e4f1d90a4b6b95fe (passing core, browser and Docker CI). The clean-source 18-scenario browser results, six-check capability report, and desktop/narrow captures preserve the complete local acceptance. The Darkwind checkpoint benchmark records 20,277 JSON bytes, including 9,127 native physics bytes, with capture 13.7525 ms p95 and independent restore 21.4626 ms p95 over 30 measured samples. This is a single-runtime measurement including content hashing, not a durable recovery objective or an allocation-free tick budget.

The next increment adds persistent entity allocation: cryptographic UUIDs prepared once at trusted ingress, complete replayable create commands, reserved authored/spawned namespaces and identity invariants installed in the real Simulation. The shared Node/browser fixture exercises exact ticks above 2^53, spawn/update/delete, JSON transport and restored snapshots without regenerating identities. Local validation passed all 78 headless tests, type/import checks, content fingerprints and production client/server compilation. The first browser run passed all ten diagnostics and seven gameplay scenarios but failed one pickup-return visibility wait; an isolated pickup rerun passed. Surviving-context diagnostics now preserve actionable state if the intermittent case recurs. Durable request deduplication, tombstone retention and compiler mappings remain later gates.

Identity source: 3e4607cfbb0a0824a274f83f8a6ece27ce261a57 (passing core, browser and Docker CI). The final clean-source 18-scenario browser results, capability report, and desktop/narrow captures pass. The pickup case also passed three consecutive isolated repeats; its earlier intermittent visibility failure remains unexplained and is retained in the evidence. The single-player benchmark, run after browser acceptance stopped, records 0.1257 ms p95 across 1,800 measured ticks. This is not a multiplayer capacity result or a statistically established comparison with previous machines/runs.

The next increment implements exact uint64 simulation time, decimal-string input sequences, format-2 local saves and explicit full checkpoint profile migration. A preserved profile-1 native checkpoint proves migration at the old safe-integer boundary; the profile-2 Node/browser fixture now covers 426 boundaries and 26 restores, including 2^53 crossing. All 84 headless tests, type/import checks and unchanged world fingerprints passed locally. The first full browser run passed 17 of 19 scenarios, including all replay/diagnostic checks; two save-dependent test setup assumptions were corrected (waiting for the first v2 autosave and installing the large-tick fixture after unload). All three targeted save/lawn browser scenarios then passed. Clean-source full acceptance is recorded below.

Time/migration source: a25e1e7877608a3dd48c8f1100594f4193e9874b (CI run). The clean-source 19 browser scenarios, capability report and desktop/narrow captures passed with no skips or flakes. The single-player benchmark records 0.1239 ms p95 over 1,800 measured ticks. The profile-2 checkpoint benchmark records 20,281 JSON bytes, 19.3396 ms capture p95 and 18.1042 ms restore p95. Both measurements ran after browser acceptance stopped; neither establishes multiplayer capacity, universal determinism or durable recovery objectives.

The preceding evidence-only identity commit later exposed an early-prompt lawn assertion in CI: the interaction prompt was visible at y=0.6506, before reaching the raised floor. The browser test now waits for the actual saved floor position, allows ordinary movement farther inside and still rejects the entrance respawn. The corrected assertion passed three consecutive rendered runs; this is a test-readiness correction, with no collision or movement change.

The renderer now receives a versioned presentation scene through the actual player and worker probe. The beta adapter resolves gameplay-dependent geometry/materials/lights before delivery; structural gaps park updates and request a complete baseline while preserving the last drawable scene. This is the protocol boundary, with ECS journal projection and bounded binary worker transport still open. The 96 headless tests, type/import checks and unchanged content fingerprints pass. The initial rendered run passed all 19 scenarios, including byte-identical frame preservation during the injected structural gap. Clean-source acceptance, including the final allocation optimization and authored-definition reset handling, is recorded below.

The time source later finished CI with a pause/save failure (18 of 19 browser cases passed). The menu appeared before the worker pause boundary; the save could receive the final settled pose afterward. The worker now acknowledges pause immediately and the player saves that accepted transition. The test waits for the actual worker state and deliberately delays pause delivery by 200 ms; three rendered repetitions passed.

Presentation/pause source: b53e3ba719702a2073c947327d4244e00895f013 (CI run). The clean-source 19 browser scenarios and six-check capability report pass with no skips, retries or unexpected results. Preserved desktop, narrow and shared traveler captures retain the existing presentation. Type/import checks, all 96 headless tests, unchanged world hashes and the production server build also pass locally. The prior lawn/evidence source 7c2740a finished all CI jobs successfully.

The next increment adds an ECS presentation consumer and version-2 composed matrix envelopes, with explicit v1 migration. The engine-zoo main/worker path now derives draw records from actual ECS component changes. The shader handles inverse-transpose normals under hierarchical shear. The new probe checks parent edits, eight primitive/material replacements, missing-asset preservation, deletion, journal overflow and exact frame restoration. All 105 headless tests pass, including a no-op/unrelated-component regression and a pinned browser/Node matrix. The initial 19 browser scenarios pass; clean-source acceptance, including the final cache filtering and benchmark tool, is recorded below. Live Darkwind entity migration and bounded production worker transport remain open.

ECS presentation source: 04b2df2af73f2b207aff7e19bae741e8958ee9c9; browser fixture-loader correction: c372760ca3cdb7d9664d6343b7dbbf202166d576 (CI run). The preserved 105 headless results, 19 clean-source browser scenarios, capability report, desktop, narrow and shared-world capture pass. The earlier clean run and source CI stopped at Playwright's direct JSON import requirement; the correction only changes test fixture loading.

The uncontended projection benchmark identifies the next required optimization: at 4,096 primitive entities, a single changed transform still incurs full projection (38.484 ms p95) despite emitting one draw update. An unchanged read costs 0.0767 ms p95. Incremental hierarchy/draw invalidation is required before live-world integration; these synthetic CPU measurements are not GPU frame-time or multiplayer capacity claims. The prior presentation acceptance commit 51f7603 also finished all CI jobs successfully.

The next increment replaces full recomposition for local pose/resource edits with accepted hierarchy and draw caches. Pose changes invalidate affected descendants; mesh/material edits recompose no transforms; topology edits still receive complete forest validation. Owned partial patches retain unchanged records and commit atomically. The new regression coverage compares 240 mixed edit steps with fresh baseline projections and exercises failed publication/repair, no-op validation and non-rendered moving entities. The real worker verifies incremental work counts through hierarchy edits and eight replacement frames. Clean-source acceptance and measurements follow.

Incremental presentation source: c232cafab8b1b26c0e3c643dbb0f53d2634afea0 (CI run). The clean-source 114 headless checks, 19 browser scenarios, worker report, and desktop/narrow/shared-world captures pass. Content fingerprints and production server compilation remain unchanged/passing. The uncontended CPU benchmark records a 4,096-entity single-transform edit at 1.867 ms p95, versus the historical 38.484 ms. Full baselines cost 63.370 ms p95, versus 47.747 ms previously; no whole-frame or multiplayer performance claim follows.

The earlier ECS source c372760 passed all CI jobs. Its evidence-only successor 9abc85d failed one browser startup wait: the first format-2 local save arrived in the browser trace, but its evaluation completed after the runner's 15-second expectation deadline. All other 18 cases passed. The first save currently depends on the animation loop; decoupling that boundary and covering withheld frames is the next reliability correction. This failure is retained rather than treating the earlier green run as proof of every later run.

The player now writes the first nonzero checkpoint and throttled two-second autosaves from accepted worker states, independently of animation-frame delivery. Pause, travel, inventory and door saves remain immediate. Two production-browser regressions withhold every animation frame: both failed on the old runtime, and both new/restored journeys now persist while no frame runs; the tests also check periodic throttling, exact tick advancement, legacy preservation and rendering resumption. The restored-position assertion uses the existing physics precision. Complete committed-source acceptance follows this correction; no renderer timing or recovery milestone is closed by it.

Checkpoint cadence source: 706f8a462deb250fac71ac535eaa3245efdb2ac2 (CI run). The clean-source 21 browser scenarios and 114 headless checks pass, including both withheld-frame regressions, multiplayer handoff, pause/save restoration, legacy migration and graphics lifecycle checks. The record retains the prior failing regression and CI trace timing without claiming a GPU-driver root cause.

npm run bench:mutation -- <output.json> now measures the other half of the ECS integration cost: a two-component motor/pose transaction with all built-in schemas and the actual identity/spatial invariants, compared with an explicit no-invariant cost control. It includes transaction cloning, snapshot validation and journal publication, while excluding physics and presentation. The 1,481-row case approximates the authored Darkwind object count plus one player; it does not migrate the live world. Clean-source results follow before choosing the next mutation optimization.

The clean-source canonical mutation benchmark at 3ae8723 identifies the next integration prerequisite: a two-component commit with the production invariants costs 25.191 ms p95 at 1,481 entities and 73.213 ms p95 at 4,096, versus 0.166/0.835 ms in the diagnostic no-invariant controls. The live Simulation has not been expanded to those populations. Optimize staged validation and snapshot/invariant work while preserving atomic failure and restore semantics before moving authored objects into canonical simulation. See measurement scope and limits.

The next core increment adds scoped read-only candidate views for transactional invariants. Identity validation reads changed IDs only; local pose validation uses affected descendants plus complete ancestor chains. Topology edits and restores still validate the full forest; custom snapshot invariants retain their complete-copy interface. Views expire on success and rejection, and restore publication now also stages its journal reset before swapping state. All 119 headless tests pass, including 600 mixed edits/restores compared with the original full-snapshot rules, descendant composed-bound rejection and callback ownership/lifetime checks. Clean-source browser acceptance and mutation measurements follow.

The pre-cadence-fix renderer source c232caf subsequently failed one CI browser check: the large-uint64 saved tick remained unchanged until a delayed evaluation observed its later value after the ten-second wait. The trace shows eventual tick advancement and no error panel. The accepted-worker-state autosave fix in 706f8a4 is already on this branch; its CI outcome remains to be verified. The other 18 browser cases passed.

Scoped invariant source: 70f7f024204910aca230ac206c814ed6309df9b3 (CI run). The clean-source 119 headless checks and 21 browser scenarios, worker report, unchanged world hashes and production server compilation pass. The clean mutation measurement records 0.121 ms p95 at 1,481 entities and 0.572 ms p95 at 4,096, with identity and spatial validation enabled. These flat-scene results remove the measured integration bottleneck; they do not cover dense hierarchies, topology costs or multiplayer capacity.

The earlier checkpoint fix 706f8a4 finished all CI jobs successfully. Pre-fix evidence source d32ec55 failed the same large-uint64 save wait as c232caf; neither failure is hidden by the later passing source.

Authored platform routes now compile from world format 4 into native kinematic boxes and canonical route time. Loop, ping-pong and one-way paths support waypoint waits, blocked riders, jump release, pause and inactive-place parking. Full checkpoint profile 7 explicitly migrates profiles 1–6; the genuine profile-6 pending-platform fixture and both historical replay traces remain unchanged. The file/API/CLI can author or remove a route while preserving identity. Acceptance records 324 passing headless tests, type/import checks, the real CLI round-trip and two complete Observatory runs in one passing browser scenario: all 420 route boundaries and seven restores match Node exactly, with changed and exactly restored rendered frames. The numeric investigation preserves the initial JavaScript trigonometry differences and their corrections. That increment left shared platform authority, lightweight-save phase persistence, live revision activation and a playable shared platform journey open. Authored-route local phase persistence is implemented in the later route-save increment; the other gates remain open.

The preceding reliability source 9735b99 finished CI with core, container and probe jobs passing, but one of 14 player scenarios and three of six multiplayer scenarios failing. Graphics recovery and stalled movement remain under investigation; the route acceptance does not close those gates.

The live simulation-to-player hop and Observatory render worker now use one reusable 4 MiB presentation buffer with explicit detachment, return acknowledgement, channel epochs and uint64 transfer sequences. Stalled consumers retain one transfer while source edits coalesce through the existing journal/baseline rules. Bounds, stale returns, invalid UTF-8/JSON and resizable buffers reject without releasing current ownership. Acceptance records the 329-test suite, final five ownership checks, 10 probe scenarios, 20 player/multiplayer scenarios and two final source follow-ups; the capability report preserves actual worker detachment and exact rendered recovery. The CPU benchmark records an explicit cost: full-house baseline p95 5.196 ms versus 3.295 ms with structured clone. This is bounded UTF-8 JSON transport, not a compact binary codec or completed live render-worker placement.

Route source 4d3c95c finished CI with core, container, player and probe passing; three of six multiplayer scenarios still failed. Earlier scheduling evidence distinguishes a 64-second screenshot capture after successful shared-recovery assertions from the other walking/scheduling failures. The exact root cause remains open; local transport acceptance does not close remote reliability gates.

All milestones remain open until their full roadmap acceptance is proven.

• 0 · Baselines: tooling, dependency checks and main/worker capability probes exist; complete named desktop/phone measurements, remaining decisions and physical-device acceptance evidence.
• 1 · Core: scheduler, versioned metadata/migrations, events, typed sparse storage, bounded reader journal, initial component catalog and transform hierarchy now extend the beta kernel; current-profile checkpoint/replay evidence is present; spawned-ID allocation and identity replay are implemented; exact uint64 simulation time and explicit migrations are implemented; finish broader mutation/replay coverage and generated protocol integration.
• 2 · Renderer: the owned backend consumes canonical authored-world ECS matrix scenes with tested structural baseline recovery; incremental pose/resource projection and one-frame acknowledged delivery are implemented; camera/shadow primitive frustum culling is implemented; the frame texture graph, bounded static-model replacement and primitive-catalog device recovery are implemented; imported catalog installation/recovery now has independent fixture evidence; pooled UTF-8 presentation transfers are now integrated with the live player and render-worker probe; live renderer-worker placement/fallback is now implemented; direct scene channels now separate renderer and UI-state pressure; complete compact encoding, broader player-content fault coverage and reference-device acceptance.
• 3 · Physics: current native/controller snapshots and a replay fixture are present; authored routes now have scoped native, checkpoint and rendered parity evidence, with lightweight local phase restoration; complete broader slope/platform/CCD coverage, integrated dynamic bodies and the broader numerical contract.
• 4 · Runtime: shared sliding-prop and scripted-NPC fixtures now have playable acceptance; public action mapping, keyboard rebinding, initial spatial audio and standard-controller adaptation now have playable acceptance; complete verified teardown/hot reload/performance lifecycle.
• 5 · Relay multiplayer: timestamped peer motion and bounded renderer interpolation now drive actual rigged travelers; complete per-place/island ownership, structural replication and capacity/backpressure evidence.
• 6 · Recovery: complete deterministic fault harness, real network shaping, join/catchup/compaction, binary codec comparison and stale-owner recovery corpus.
• 7 · Compiler/assets: the primitive compiler publishes immutable identity/asset catalogs into the real runtime; persistent authoring IDs, atomic file/API edits and bounded primitive prefab inheritance/overrides with dependency hashes are implemented; bounded static GLB/material compilation and indexed GPU installation now exist; material textures and rigid TRS clip sampling now have scoped renderer evidence; complete transformed/nested prefab composition, cached dependency compilation, remote asset publication and caching beyond the embedded world-3 catalogs, actor animation integration and coordinated asset jobs.
• 8 · Streaming/durability: connected-place staging/interest, transactional travel/player state, PostgreSQL/outbox, retained engines, shared chests, removed-container recovery, stopped-room upgrades and immutable database/engine backups now have scoped acceptance; complete live/cross-schema upgrades, durable dynamic/time-dependent state, remote-provider qualification, continuous recovery, the broader crash corpus and measured restore objectives.
• 9 · Editor/live revisions: shared file/API/CLI revision transactions and a protected browser transform editor with durable draft saves and retained object/property undo now exist; object creation/duplication/deletion now have reversible browser acceptance; immutable world releases now activate into separate shared playtest rooms; single- and multi-object transform handles now have pointer/keyboard, imported bounds and compiler acceptance; collaborative presence, remote previews, disjoint merges, protected undo and in-place live revisions now have scoped acceptance; durable object/property undo and receipt recovery now have scoped acceptance; persistent static hierarchy/grouping now has scoped acceptance; complete grouped duplication/deletion, parent-relative gameplay, marquee selection, revision retention, engine executable pinning, release retention/restoration and creator-preview audit; published-history browsing now has scoped acceptance.
• 10 · Trusted host: static server simulation, input prediction/reconciliation, authoritative reach/transactions, self motor-stream isolation, 150 ms latency fixtures and durable restart now have scoped acceptance; complete authoritative dynamic state, general private replication/secret fields, competitive rewards, cross-host routing and broader latency/recovery/capacity qualification.
• 11 · SDK/game modules: deliver stable extension contracts, reusable gameplay modules, documentation/migrations and two independent games.
• 12 · Graphics/portals: bounded authored CPU particles/billboards and world lettering now have native occlusion, repeated-edit and recovery acceptance alongside adaptive resolution; lettering also has shared publication, exact undo and semantic reading-view acceptance; the typed surface DAG compiler has native arithmetic, source-diagnostic and replacement acceptance, with saved-world/editor integration still open; complete animation/attachments, lighting/material/effects tools, broader adaptive quality, one-level portals and measured device budgets.
• 13 · Isolation/AI: bounded interpreted object responses, literal engine-owned grants, instruction/logical-allocation limits, atomic rollback, fault parking and private source-path inspection now have scoped acceptance; declarative editor panels now have opaque-frame, scoped-permission and strict-proposal acceptance; complete general creator UI/plugin support, async scheduling, broader hostile-content qualification and optional permissioned authoring tools. Public untrusted hosting remains disabled.
• 14 · Production/version 1: complete input/accessibility, roles/routing, operations, migration/backup drills, long-session capacity and full version-1 acceptance.
• 15 · Environment: implement terrain/voxel editing, seams/collision replacement, persistent undo, procedural environments and bounded long sessions.
• 16 · Owned physics: build and benchmark the owned backend against the shared equivalence/replay/controller suite before replacement.
• 17 · Advanced traversal: complete recursive/physical portals, cross-host transactions, vehicles/riders, ragdolls and buoyancy with recovery evidence.
• 18 · Other platforms/modes: deliver the required additional backend/2D/creation capabilities and verify their lifecycle/network/state contracts.

#Next implementation path

Deliver small, complete capabilities the user can test. The shared garden ferry is the first such increment after the delivery correction. Motor-relative locomotion now has shared-play and recovery acceptance. Shared sliding props now provide a complete lantern puzzle. The shared NPC patrol/conversation fixture is now implemented. Public action mapping, controller input, spatial audio and browser object editing now have focused acceptance. Immutable draft releases now activate into separate shared rooms. Single-object move/rotate/scale handles now have acceptance. Disjoint edits, collaborative presence and shared Apply now have scoped acceptance. Multi-object selection and shared transforms now have scoped acceptance. Durable object/property undo across editor reloads now has scoped acceptance. Published release-history browsing now has scoped acceptance. Persistent static hierarchy/grouping is now implemented. Marquee selection, grouped structural edits, imported-model browsing and source-linked arrangement placement now have scoped acceptance. Linked-instance detach and member additions/removals now have scoped acceptance. Published-world archival and draft restoration now have scoped acceptance. Creator-authored shared Touch glow behaviors now have acceptance. Connected-place creation, gateway editing, named arrivals and shared return trips now have scoped acceptance. Next continue with a bounded user-testable capability from the remaining live-revision and full-roadmap gates. Keep engine behavior reusable across Darkwind and engine-zoo fixtures. Preserve existing CI failures as tracked work; investigate them when they block a capability, without relaxing deadlines or interpreting reruns as root-cause fixes. Character redesign remains deferred to the required final polish pass. The full milestones 0–18 scope is unchanged.

#Delivery correction · 2026-10-24

Approximate full-plan completion remains 35%. Each logical milestone must report its user-testable result and approximate completion. Prioritize a complete playable capability over further diagnostic expansion. Next: a shared moving platform in the garden, including riding with two travelers and host handoff. Character redesign remains reserved for final polish. Existing CI failures remain tracked and only block work they materially affect.

Native graphics initialization now reports the actual adapter, device, shader and catalog stages. The acceptance record records 344 headless passes, type/import checks and focused browser verification, including one unresolved browser crash followed by three passing repetitions. The player CI job is split into two disjoint test-level shards while retaining one worker and existing deadlines; partition evidence and prior CI failures remain available. This is diagnostic progress, not a new playable feature or a closed roadmap milestone.