# Early cooperative beta implementation decisions

Date: October 24, 2026. Engine 0.1.0. World `darkwind`, release `lantern-house.1`.

These decisions constrain the current test build without replacing the full architecture.

| Area | Implemented contract | Follow-up gate |
| --- | --- | --- |
| Coordinates | Meters, Y up, initial forward −Z; radians; separate local place frames | Imported asset orientation fixtures |
| Content | Versioned typed JSON-compatible world data; authored stable interaction IDs; original primitive kit | Compiler IR, prefab graphs, immutable asset manifests, GLB/animation |
| Fingerprint | SHA-256 over engine version, compiler version and world serialization; numeric authoring precision 0.000001 | Canonical compiler output and migration corpus |
| Core | Generation-checked handles, validated components, deferred structural barriers, bounded independent change readers | Dependency scheduler and broader schema lifecycle |
| Time/physics | 30 Hz fixed simulation in a worker, max five catch-up ticks; Rapier 0.21.0; deterministic replay tested in the pinned Node runtime | Cross-platform numerical contract, slopes/platforms, complete controller snapshots |
| Rendering | Owned TypeScript/WGSL WebGPU main-thread renderer; four primitive batches; shadow, HDR forward PBR and postprocessing; bounded single GPU submission in flight | OffscreenCanvas worker capability probe, culling, resource graph, asset replacement and device-loss recovery |
| Authority | One elected browser owns shared interactions for the whole small room; local player motion is kinematic | Place ownership domains, dynamic shared bodies, trusted host |
| Coordinator | Signed 24-hour admission, exact origin/release/content negotiation, monotonic uint64 epoch/revision strings; six-second host lease | Hysteresis/eligibility policy and real shaped-network matrix |
| Recovery | Baseline on reconnect, host re-election, pending-intent resubmission, receipt cache plus durable per-session high-water mark | Binary deltas/cursors, compaction fault corpus, recovery-time measurements |
| Durability | Bounded full JSON checkpoint, synchronous fsync + atomic rename + directory fsync before ACK; storage failure closes the room | PostgreSQL journal/outbox and crash injection at every commit boundary |
| Inventory | Unique room item owned by a traveler session; 30-second reconnect grace then return to source | Accounts, transferable inventory and economy transactions |
| Travel | Prepare destination collision, replace place atomically; keep the same room socket | Streaming/preload and place-scoped interest filtering |
| Limits | Eight admitted players, sixteen connections, 64 pending intents, 4096 receipts, 128 admission sessions, 64 KiB ingress packet | Measured capacity; current browser evidence is two clients |
| Trust | Authored code and cooperative players are trusted; bounded protocol validation is not authoritative anti-cheat | Sandbox and trusted simulation service before public/adversarial use |

Full precision runtime geometry remains unchanged by fingerprint serialization; micro-unit rounding prevents platform-specific transcendental math from breaking release negotiation. This is not a claim of bitwise cross-browser physics determinism.

A main-thread renderer is the current explicit placement choice. The simulation worker and room heartbeat remain separate from UI focus. A suspended host loses its lease; an acknowledged successor revision cannot be replaced by a stale epoch. A GPU failure offers a clear reload path rather than claiming automatic device reconstruction.