The First Light is a scoped two-player cooperative beta candidate, built from the engine plan. Shared multiplayer is required and enabled by default. The runtime, relay, three-place journey, original visual treatment and automated checks are implemented. The full creator preview and engine version 1 remain future releases.
Full-plan development is now active. ENGINE_PROGRESS.md tracks the unchanged milestones 0–18 and the development branch; CORE_CONTRACTS.md specifies the first integrated kernel increment. The original beta evidence below remains historical evidence for its recorded source.
The atelier now supports named workspace access: owner, editor and viewer keys, durable membership, immediate request-time revocation, key replacement and identity-bound undo. This is private workspace collaboration; account-backed player and workspace membership are now delivered; see PLAYER_ACCOUNTS.md. Operator traveler recovery now replaces lost credentials for a stopped persistent room while preserving the original traveler and items.
Latest streaming increment: ordinary, published and persistent players now bootstrap and recover through pinned content manifests with selective model/collision residency. Regional delivery uses each room's retained compiler. Published, cooperative/trusted persistent and routed multiplayer browser journeys pass. Editor development rooms now also stream immutable proposed/accepted manifests through shared Apply, rejected-update retry, offline-save migration and native checkpoint recovery. Approaching an eligible exit now speculatively decodes one bounded destination; travel promotes matching requests and the player retains recently released payloads in a five-second, 8 MiB cooling cache. See player streaming acceptance, shared revision contract and streaming ownership. Profile 4 adds lossless texture transport with exact expanded-byte reservations, retaining profiles 1–3 and original texture/model identities. See compression and measured CPU/bandwidth tradeoff. Cooperative asset admission now services ordinary tasks during decompression and mip validation, with shared cancellation and preserved artifact identities.
The development Observatory now includes a refined original rigged traveler, with idle/walk poses and restored-frame checks. The development player now uses an empty-handed variant with bounded shared motion and idle/walk blending, projected from canonical remote session entities. Development relay pose admission also closes an identity-overwrite defect by rejecting extra fields and copying only motion values.
The development branch also provides an opt-in PostgreSQL persistent cooperative room: server-committed inventory and shared interactions, staged gateway travel, browser return credentials, crash/reconnect recovery and retained engine builds. Shared chests, removed-container recovery, stopped-room content upgrades and database/engine backup restoration now have scoped acceptance. An opt-in trusted static-world profile adds server-owned movement and browser prediction. The historical gaps below are superseded where recorded in ENGINE_PROGRESS.md; the full trusted-host gate remains incomplete.
The development branch adds a regional doorway for compatible-room selection, bounded player reservations, private supervised room processes and retained-engine return journeys. Bounded host-health measurements now govern new admission, with authenticated regional operator inspection. Its deployment topology is one coordinator per region; geographic discovery, cross-region failover, live cross-host transfer and measured production capacity remain open.
Current renderer authoring also includes adaptive resolution, bounded floating-light particles, and world lettering. Signs use depth-tested planar text with fixed or camera-facing orientation, a bounded atlas and a semantic reading view. Preview, saved undo and shared revision publication use the same authoring transaction paths. Typed surface recipes now support saved object assignments, a visual node workshop with typed connections and local undo, shared activation, device recovery and portable arrangements. A one-level portal rendering foundation now has native clipping/occlusion, budget, cancellation and device-reconstruction evidence in the Observatory. Format-17 anchored windows now support editor composition, real destination previews, saved undo and shared publication of their source. Server-filtered destination traveler interest now supports one authored hop in relay and persistent rooms, with revision barriers and anchored persistent travel reach. The destination renderer now supports independent live traveler/attachment streams, stale-stream fencing and native reconstruction, with a canonical-store destination projection. Normal shared play now activates these windows in both graphics placements, with independently acknowledged destination transfers, coordinated travel/shared revisions and verified device/simulation recovery. PostgreSQL-backed cooperative and trusted portal journeys now verify durable travel, credential-only reload, socket reconnect, rejected destination preparation and both graphics/simulation recovery placements. Source and portal views now share validated immutable model allocations under one device budget, with independent animation palettes, last-owner retirement and native census/recovery evidence. A place-content distribution foundation now separates verified place/model downloads with bounded ownership and room-pinned HTTP delivery. Structural compilation and selective model/collision preparation now share the existing compiler, with a real HTTP/native-graphics browser fixture for failed/cancelled preparation and explicit staging. Normal-player streaming, shared editor revision replacement, one-destination predictive preloading and bounded CPU cooling are now active. Independent texture transport now shares image downloads across models, validates the reconstructed original artifacts and accounts for separate image leases in preload/cooling budgets. Static imported models now have distance-based geometry detail, with bounded optional index buffers and unchanged near silhouettes/collision. New GLB imports precompute portable variants in the isolated compiler/editor Worker; retained model formats keep their runtime fallback. Immutable model admission now avoids redundant validation/copying inside one worker while retaining fresh-input and aggregate catalog budgets. Progressive mip delivery, compressed variants/streamed decoration quality, remaining portal features, general effects, textured sprites and physical-device acceptance remain open.
Cooperative GPU installation now paces model buffers and texture mips, closes device-global error scopes before yielding, and cancels partial uploads without publishing or leaking them. Accepted scene replacement still uses the existing retirement barrier. Aggregate scheduling, progressive quality and physical-device qualification remain open.
Authored skies add horizon gradients, sun glow and diffuse hemisphere light to the atmosphere editor, shared revisions and published worlds. Main-thread and Worker rendering include destination portal skies and graphics recovery. This is static authored lighting; weather, moving time of day, HDR/specular environment maps and the final art pass remain open.
Heightfield terrain now includes editor sculpt/paint, versioned landscape recipes, saved undo and per-traveler streamed detail. Voxel ground adds editable density, section/in-scene Dig/Fill, continuous stone finishes and format-26 distance loading with retained distant geometry. Both use incremental source compilation, shared Apply, collision retention, saved restoration and standalone CLI export. Larger domains, sustained memory/frame-time qualification and the final character/environment/arrival art pass remain open.
Shared buoyant bodies and cedar rafts now add walking contact, rider weight, exclusive room-owned steering and an authored Cedar crossing template. Cooperative and trusted PostgreSQL rooms retain body motion and pilot reservations across restart; live settings revisions preserve riders. Alder gate adds a modeled shared drawbridge with a fixed revolute joint, saved limits/drive settings, live edits and durable target/receipt recovery. Body-to-body assemblies, other joint types, broader vehicles, cross-host island handoff, the owned physics backend and final character/environment/arrival art remain open.
The matrix below is historical beta/foundation coverage, not the current development checklist. Current creator controls, shared behaviors, recovery work and remaining gates are tracked in ENGINE_PROGRESS.md.
The independent Meridian game and public SDK now provide a portable second-game content path; reusable gameplay modules remain active work.
#Capability matrix
The development player now overlaps room/simulation startup with graphics initialization, delays scene publication until graphics binding, and exports bounded startup/lifecycle timings. Startup acceptance verifies held native GPU requests, late device disposal, rejected admission and the real startup deadline in addition to the existing player/multiplayer paths. Remote CI and hardware acceptance remain open; the full-plan estimate at that historical increment was approximately 35%; use ENGINE_PROGRESS.md for the current estimate.
Authored-route worlds additionally have version-3 lightweight player saves, restoring all route phases and support collision before play resumes. The real simulation-worker boundary and identical rendered restoration are verified. Shared platform authority and runtime-created platform persistence remain open; full checkpoint profile 7 is unchanged.
The browser now admits complete validated room-protocol envelopes, rejects regressive authority/baseline snapshots and ignores closing/retired socket callbacks. Room-ingress acceptance records 344 headless checks and three final-source multiplayer browser journeys. This does not close the broader recovery or trusted-authority gates.
| Plan area | Working in this build | Gate still open |
|---|---|---|
| 0 · Baselines | Pinned dependencies, checks/build/CI, validators and simulation benchmark; development branch adds downloadable main/worker graphics, transfer, resize, device-loss and gesture probes | Named physical desktop/phone measurements; remaining initial decisions and support gate |
| 1 · Core | Generation-safe identities, structural barriers, fixed clock; development branch adds mixed numeric/reference sparse storage, bounded reader ring, scheduler, 19 built-in contracts, transform migration/hierarchy, golden fixtures, expiring events, atomic tick/transaction batches, spatial/identity invariants, recorded persistent spawn IDs full current-profile checkpoint/replay and exact uint64 time with explicit legacy migrations | Broader replay coverage, generated protocol integration |
| 2 · Owned renderer | WebGPU/WGSL PBR, procedural materials, instancing, depth/shadows, HDR tone mapping and bloom; development branch adds OffscreenCanvas support, failure cleanup and matrix scenes with structural baseline recovery and canonical authored-world ECS presentation and bounded pooled worker transfers and live renderer-worker placement with main-thread fallback | Physical-device acceptance, broader transport/performance coverage, animation and advanced graphics; see the development additions below |
| 3 · Physics | Pinned Rapier adapter, capsule motor, acceleration/gravity/jump, wall collision, stairs and safe place setup; development branch adds native/controller checkpoints and exact Node/Chromium fixture replay | Shared moving platforms, broad slope/CCD fixtures, integrated dynamic bodies and broader cross-platform replay contract |
| 4 · Player loop | Simulation worker, walk/look/interaction, focus release, pause, dialogue, satchel/journal, ambience, settings and reports; development adds public action maps and persistent keyboard remapping, with live prompts and release on reconnect, bounded shared sliding props, scripted NPC patrols and shared equipment with animated sockets | Touch/gamepad adapters, general UI bridge, complete hot-reload lifecycle, hardware performance acceptance |
| 5 · Shared room | Signed admission; exact origin/content negotiation; remote avatars/names; shared doors, exclusive lantern, quest flags and chat | Dynamic shared bodies, per-place ownership, measured capacity above two |
| 6 · Recovery | Epoch fencing, host lease, handoff, reconnect baseline, pending intent retry, durable duplicate suppression, malformed-peer isolation | Real packet shaping, long soak, binary codecs, complete compaction/crash corpus |
| 7 · Content | Separate game data and engine packages, primitive authoring helper, validators, primitive compiler with immutable identity/asset catalogs, persistent world-2 IDs and stable fingerprints; authoring API/CLI; bounded primitive prefab inheritance/overrides, dependency hashes and standalone expansion; engine-zoo second fixture | Actor animation integration, complete transformed prefab/import pipeline, live content/state activation, durable asset-job coordination |
| 8 · Places/persistence | Three walkable places; same socket across transitions; atomic fsync-before-ACK shared checkpoint; local position restore | PostgreSQL/outbox, streaming/interest, account inventory, crash injection at every commit boundary |
| 9–18 | Architecture and delivery plan retained; initial revision-checked authoring commands and CLI implemented | Editor/live collaboration, trusted host, SDK hardening, sandbox, deployment/compatibility and extended capability |
No entire roadmap milestone is marked complete. The above testable path is sufficient to begin a private early playtest; it does not change the creator-preview gate requiring milestones 0–9.
#Acceptance evidence
Passed: 17 headless engine/network tests and 7 production-build browser scenarios; TypeScript and content validation pass. Evidence run: October 24, 2026, Node 22.23.4 and Playwright 1.56.1 / Chromium 141 on Linux.
The automated evidence covers generation safety, barriers, reader reset, snapshot isolation, fixed time, content validation/fingerprints, collision/jump/stairs, replay, pause/save, the full authored journey and shared-network behavior. Network checks use independent WebSocket clients and include exclusive pickup, host close, restart recovery, stale epochs, duplicate requests, forbidden origins, malformed envelopes and silent-host lease expiry with pending-action completion.
Browser acceptance builds the production assets and uses independent Chromium contexts against a fresh relay. Scenarios cover shared doors/chat and host handoff; racing pickups and the disconnected holder’s item return; visible remote-avatar movement/removal; startup/walk/pause/reload; keeper dialogue; travel through all three places/beacon/resource counts; and unsupported-GPU/malformed-save recovery. The latest checked results and source identity are recorded in docs/evidence/acceptance.json, source-manifest.json, and headless-tests.tap. Run commands are in the README.
The benchmark records 1,800 measured simulation ticks after warmup with machine/runtime details in headless-benchmark.json. It is a headless single-player CPU measurement, not a GPU frame rate or multiplayer capacity result. Browser acceptance uses software WebGPU; hardware-GPU performance is an explicit human playtest task.
Screenshots in docs/evidence/ are generated from the running build: welcome, active play, keeper conversation, garden, sanctuary, shared room diagnostics and visible travelers. They are implementation evidence, not concept art. The original capture predates repository initialization, so that source manifest supplies SHA-256 file identities. Later builds have Git identities and CI evidence, starting with the verified beta baseline in the program tracker.
#Next priorities after the first playtest
- Measure movement feel, visual readability, frame pacing and reconnect behavior on two real hardware-GPU machines; turn findings into reproducible fixtures.
- Replace proxy characters with an original GLB character/animation pipeline while preserving the warm material/lighting direction. Add material/light reference fixtures and measure the render-worker probe on physical devices.
- Complete movement/platform fixtures and the ownership/recovery fault matrix before adding dynamic props or persistent inventory mechanics.
- Finish the compiler/assets, streaming/persistence and collaborative authoring milestones in the existing roadmap. Keep engine reuse exercised by the independent engine-zoo fixtures.
See the playtest guide for exact launch steps, persistence semantics, two-machine access and known limits, and beta decisions for deliberate architecture simplifications.
#Front-lawn collision patch
The first playtest exposed a visible lawn without collision outside the Lantern House. The lawn now supports the character, and a shallow porch step lets players return on foot. The patch passed all 18 headless tests and two targeted production-browser scenarios (lawn round trip and existing three-place travel). Original baseline evidence above remains attached to its original source manifest; evidence/porch-fix.json records this follow-up. The local room was backed up and explicitly migrated without resetting progress.
Reusable primitive source now has a prefab compiler, JSON kit, inheritance/override diagnostics, persisted instance bindings, standalone expansion CLI and dependency invalidation. Complete asset processing, linked editor commands and live revision activation remain unfinished.
The isolated build worker now handles prefab CLI builds with bounded processes, revision fencing, last-good retention and a production-only authoring bundle. Durable job recovery, multi-coordinator fencing, cached execution and asset import remain open.
Development renderer/content additions now include bounded presentation delivery, visibility culling, an explicit render graph, atomic shader/model replacement, player GPU recovery, embedded GLB catalogs, static triangle collision, three-map PBR materials, normal/occlusion maps masked foliage with matching shadows, and GLB TRS clips with sampled rigid model poses. These are supported by versioned fixtures and scoped software-WebGPU evidence in the progress record; the physical-device gate and all full milestones remain open. The furnished Hearth study is development content rather than a replacement of the deployed playable world.
The development skeletal foundation adds bounded joint/weight import, inverse binds, pose palettes, GPU color/shadow deformation and authored rest-pose checkpoint projection. The later shared traveler integration replaces playable remote proxy characters; full replicated animation remains open.
The development animation-state path advances bounded clip phases at simulation ticks, projects only affected draws and restores through native checkpoint profile 5. Shared traveler locomotion now uses renderer-owned idle/walk blending derived from admitted motion; it does not yet replicate clip state through the room protocol.
Canonical runtime platforms now bind native collision and rendered ECS transforms, publish rider support, retain pending targets, and park/rebuild across place transitions. Full checkpoint profile 6 adds KinematicPlatform with explicit legacy migration. This is a development API and Observatory fixture; lightweight-save persistence and shared platform authority remain open. Authored routes extend it below. See the platform contract.
World format 4 now compiles authored loop, ping-pong and one-way platform routes. Native motion, rider support and canonical route time advance together; blocking, pause and place travel retain the route phase. Profile 7 migrates profiles 1–6 explicitly. The Observatory exercises rendered route restoration and Node/Chromium replay parity. Shared authority, lightweight-save route phases and the playable beta journey remain open; see authored routes.
The live player and render-worker Observatory now transfer presentation bytes through one reusable 4 MiB buffer, with explicit return acknowledgement, channel epochs and stale-return rejection. The development player now owns WebGPU in a dedicated render worker, with main-thread placement fallback before canvas transfer and device replacement within the same worker. A direct MessagePort now separates scene-buffer receipts from UI-state acknowledgements. The payload remains UTF-8 JSON. Compact codecs and broad device acceptance remain open; see transfer ownership and live placement.