Browser Game Engine Implementation Roadmap

Status: active implementation baseline. Date: October 24, 2026.

This roadmap implements the engine architecture. It targets a reusable engine with a custom renderer and authoring/runtime infrastructure. The work does not depend on existing Darkwind code. Darkwind and a second independent game exercise the engine through its public API.

Milestone completion requires the named artifacts, repeatable tests, and a working demonstration. Passing an earlier milestone does not imply later capability. A scoped cooperative playtest now exercises parts of milestones 0–8. No full milestone below is claimed complete: the current capability matrix records implemented paths, evidence and remaining gates. The full creator preview still requires milestones 0–9.

#Execution rules

1. Implement the smallest complete path through a milestone, including failure handling and measurement. Finish it before broadening features.
2. Freeze externally visible schemas with version numbers and golden fixtures. Internal APIs can evolve while preserving migrations and protocol compatibility.
3. Record acceptance evidence with commit, engine version, fixture version, machine/browser, configuration, and commands. Keep screenshots/video where presentation matters.
4. Tests must exercise behavior or invariants, not simply mirror implementation. Use real rendered clients for presentation and bots for protocol load.
5. Keep game content separate from engine packages. An engine change justified by Darkwind must express a reusable capability.
6. Any scope change updates the architecture, capability matrix, and affected milestones together. A library demo does not replace the custom renderer objective.
7. Assign package ownership before concurrent implementation and stabilize shared contracts before dependent packages diverge.

#Dependency and release map

flowchart LR
  M0[0 Baselines] --> M1[1 Core and schemas]
  M1 --> M2[2 Renderer]
  M1 --> M3[3 Physics and movement]
  M2 --> M4[4 Single place runtime]
  M3 --> M4
  M4 --> M5[5 Relay multiplayer]
  M5 --> M6[6 Recovery and fencing]
  M4 --> M7[7 Content and assets]
  M6 --> M8[8 Streaming and persistence]
  M7 --> M8
  M8 --> M9[9 Editor and live revisions]
  M9 --> PREVIEW[Creator preview]
  M6 --> M10[10 Trusted host]
  M9 --> M11[11 SDK and game modules]
  M9 --> M12[12 Graphics and portals]
  M9 --> M13[13 Isolated creators and AI]
  M10 --> M14[14 Production and compatibility]
  M11 --> M14
  M12 --> M14
  M13 --> M14
  M14 --> V1[Engine version 1]
  V1 --> EXT[15 to 18 Extended capability]

Work can overlap after its inputs are stable. For example, asset importer work can begin while network recovery develops. Integration time remains explicit; milestones are not calendar estimates that can be divided mechanically by headcount.

#Milestone 0 Baselines and decision records

Outcome: reproducible development and measurement conditions, before engine abstractions spread.

Create the workspace tooling, TypeScript configuration, formatting, tests, build pipeline, local browser launch, and dependency policy. Select named desktop and phone reference configurations. Capture GPU/API capabilities and test OffscreenCanvas worker rendering, transfers, pointer lock, resize, and audio activation. Record a main-thread rendering placement where necessary.

Create decision records for coordinate conventions, units, stable IDs, floating-point policy, authority profiles, WebGPU compatibility tiers, physics pin, schema versioning, persistence classes, and trusted-author scope. Define package import boundaries and establish the core dependency rule: simulation cannot import browser presentation.

Artifacts: workspace manifest/lockfile, CI smoke workflow, capability probe, benchmark runner, device matrix, initial decisions, and a minimal render/worker test page.

Acceptance: a fresh checkout builds and runs documented checks; the capability probe reports unsupported configurations honestly; a render worker can stop/restart without leaking ownership of its canvas or buffers; the headless test process imports the core package without DOM shims.

Gate: decide supported preview devices from measured results. Do not promise universal browser support.

#Milestone 1 Core ECS schemas and fixed time

Outcome: a small simulation kernel with explicit identity, mutation, and snapshot contracts.

Implement entity index/generation storage, component registration, sparse-set queries, command-buffer barriers, scheduler dependency order, seeded randomness, event lifetimes, and fixed-step timing. Add canonical serializers and component schema metadata. Implement independent bounded change readers for render, network, and persistence consumers.

Specify durable sequence numbers as unsigned 64-bit values: decimal strings in JSON diagnostics and explicit 64-bit fields in binary. Never rely on JavaScript Number for arbitrary durable sequence precision. Define ID generation and stable iteration order. Add schema hash negotiation fixtures.

Artifacts: packages/schema, core, math, simulation, and testkit; component registry specification; golden serialized snapshots; deterministic scripted fixture.

Acceptance: stale handles cannot mutate replacement entities; structural writes during queries apply only at barriers; a slow change consumer receives a valid reset baseline; the same supported inputs replay to the same canonical simulation state; snapshots round-trip; deleted entities stay deleted; an overload cannot trigger unlimited catch-up.

Gate: finalize mutation and identity contracts before renderer/network packages consume them widely.

#Milestone 2 Custom WebGPU renderer foundation

Outcome: our renderer draws an inspectable scene from the engine's presentation protocol.

Implement device setup, render targets, depth, camera matrices, mesh buffers, primitive geometry, unlit and basic PBR materials, one directional light, basic shadows, frustum culling, instance batching, and resource tracking. Establish linear color, output transform, material defaults, and texture orientation fixtures. Create a small render graph with explicit pass dependencies.

Artifacts: packages/render, render-webgpu, WGSL templates, image fixtures, resource census, and render debug overlay.

Acceptance: reference scenes render correctly on the preview support matrix; resize and resolution changes do not leak targets; repeated material/mesh replacement has stable resource counts; invalid shaders preserve the last working scene; simulated device loss has bounded recovery; structural protocol gaps trigger a new render baseline.

Gate: no Babylon.js/Three.js renderer substitutes for this milestone. Third-party comparisons may help diagnose output, but the shipped path uses the owned backend.

#Milestone 3 Physics adapter and character motor

Outcome: reliable WASD movement and collision through shared simulation code.

Integrate a pinned Rapier WASM build behind the physics interface. Implement character acceleration, gravity, jump, ground detection, step/slope limits, collision sweeps, triggers, and moving-platform support. Keep visible geometry and colliders separate. Add snapshots and restore including controller state.

Artifacts: packages/physics, shared character motor, collider compiler prototype, stairs/slopes/platform fixtures, and physics debug drawing.

Acceptance: the player cannot tunnel through baseline walls at supported speed; floor loading cannot drop the player through the world; stairs and slopes have stable results; repeated restore/replay matches the declared supported determinism contract; a body that sleeps wakes correctly; frame rate does not change movement speed.

Gate: record the numerical contract honestly. If cross-platform replay fails, fix or constrain the supported profile before building reconciliation on it.

#Milestone 4 Complete single place runtime

Outcome: a functioning browser game loop with one authored place.

Compose main-thread input/UI, simulation worker, physics, renderer, camera, animation placeholder, basic interactions, and audio. Add a local development CLI and simple world loader. Include an avatar, door, movable prop, simple scripted NPC, text prompt, and respawn volume. Establish complete startup, pause, focus loss, and teardown lifecycle.

Artifacts: apps/player, tools/cli, initial engine-zoo place, first public action map, and automated walkthrough.

Acceptance: movement remains responsive during UI activity; chat focus and window blur release keys; simulation can be paused while the renderer continues; every worker and event listener tears down cleanly; a scene load error leaves a recoverable UI; the reference scene meets its initial measured budget or has a specific remediation issue.

Gate: the engine has a coherent loop before networking is introduced. The world fixture must be content, not hard-coded engine setup.

#Milestone 5 Browser owned relay multiplayer

Outcome: multiple independent browser clients share one place with explicit ownership.

Implement authenticated room admission, engine/schema negotiation, player lifecycle, ownership domains, relay sequencing, full baseline, structural deltas, latest-wins motion, interpolation, and duplicate input/event handling. Start with JSON envelopes generated/validated from shared schemas. Include ephemeral chat and interaction events.

The first shared interactions are a door and a prop controlled by the place authority. Player avatars remain kinematic owners; shared-body impulses pass through place authority. Add initial queue bounds and ingress processing budgets immediately.

Artifacts: services/relay, packages/net, browser client state machine, protocol document, two-browser demonstration, and bot harness.

Acceptance: two real clients agree on door state and actor lifecycle; a joiner gets a complete baseline; stale/unauthorized writers are rejected; duplicate intents do not repeat an interaction; unknown-entity updates do not create ghosts; a slow client does not cause unbounded relay memory.

Gate: this milestone is not production-safe until milestone 6 proves recovery and fencing.

#Milestone 6 Host migration replay and network failure

Outcome: the relay model survives real browser and network lifecycle failures.

Implement coordinator leases, monotonic epochs, eligibility and hysteresis, graceful/forced handoff, immutable snapshots, join barriers, catchup cursors, resume tokens, tombstones, and periodic content/state head announcements. Define whether each failure pauses, restores, or starts a trusted fallback. Add binary codecs and compare measured traces with JSON.

Exercise both application faults and actual shaped networks. A host continues local simulation during a partition only as provisional local state; it loses publishing authority when its lease expires. Reconnection cannot overwrite the successor's accepted state.

Artifacts: fault-injection network transport, deterministic clock/coordinator harness, protocol golden corpus, recovery traces, bounded queue metrics, and handoff demo.

Acceptance: host tab close, host suspension, abrupt relay restart, stale-owner reconnect, join during checkpoint, disconnect during catchup, and history compaction all converge or fail explicitly; one authority epoch wins; no duplicate avatar/possession; durable and received-only acknowledgments are distinguishable; corrupted envelopes cannot crash the room process.

Gate: do not add persistent economies or multiplayer live editing before these ownership boundaries pass.

#Milestone 7 World compiler and asset pipeline

Outcome: creators can author reusable places and assets through a stable format.

Implement world/place/prefab schemas, override resolution, dependency graphs, script build metadata, canonical IR, source diagnostics, content hashes, and immutable manifests. Import a supported GLB subset with materials and skeletal animation. Build collision proxies and bounds independently of rendering. Add textures, audio, LOD/variant metadata, and asset processing states.

Artifacts: packages/world, assets, services/build-worker, world validator, reproducible build fixtures, model/material/skeleton regression assets, and a basic modular environment kit.

Acceptance: malformed/cyclic prefabs fail with source locations; changing one asset invalidates only its dependents; content hashes include compiler settings/version; imported units and attachments are correct; failed or superseded jobs cannot replace newer assets; a world package includes everything needed to run without the source machine.

Gate: no unbounded user assets in published worlds. Enforce declared import and runtime budgets.

#Milestone 8 Place streaming and durable state

Outcome: several freely walkable places form a persistent world.

Implement place graph, spawn anchors, preloading, place-scoped interest, safe collision readiness, same-host portal transactions, content/state separation, room journal/checkpoints, durable ACKs, player-state transactions, backups, and restore. Connect a tavern, courtyard, and crypt with separate local coordinate frames.

A persistent chest and transferable item test exclusive ownership; a reconnect restores the player's place and inventory. Define the behavior of an empty room and time-dependent state. Add a recovery container policy for removed authored objects.

Artifacts: services/control, PostgreSQL migrations, object-store adapter, snapshot format, transaction outbox, three-place fixture, and backup/restore runbook.

Acceptance: crossing does not reconnect the session; destination assets load before safe release; repeated crossings do not leak resources; crash injection before/after every durable commit and ACK loses no acknowledged transaction; concurrent pickups award one item; restore reconstructs the exact content release plus compatible state; room interest filtering produces no false sequence-gap errors.

Gate: publish measured recovery-point and recovery-time objectives. Initial targets are zero lost acknowledged durable transactions and at most five seconds of recoverable motion rewind after abrupt host loss.

#Milestone 9 Editor collaboration and live revisions

Outcome: a creator can build and revise worlds while players remain in them.

Implement hierarchy, selection, transform gizmos, property inspector, prefab/asset browsers, behavior source panel, console, and revision status. Add authoring transactions, revision preconditions, disjoint merge, conflict reporting, undo/redo, preview locks/presence, and live compilation/activation barriers.

Support file/CLI and browser edits through the same commands. Add read-only entity/schema/log observations and a validate-only structured patch command so external tools can propose changes before the full assistant integration. Add immutable release creation, development versus published routing, engine pinning, and release history. Separate saved, built, and applied states in the UI.

Artifacts: apps/editor, packages/authoring, revision API, command schema, release builder, and collaboration fixture.

Acceptance: two builders edit different properties without loss; conflicting edits report a conflict; undo never erases an unrelated later edit; a broken script/shader/asset keeps the previous valid behavior; changing one prop preserves unrelated NPC state; a missed revision notification heals; a published session stays pinned while development changes.

Release gate for creator preview: milestones 0–9 pass. A developer can create, share, edit, reconnect, and restore a small cooperative world. Authors are trusted. Capacity and supported devices are explicitly published. This is the first usable engine preview, not full Spawn-like parity.

#Milestone 10 Trusted simulation host

Outcome: the same engine supports authoritative persistent gameplay.

Run the simulation package in a headless server process. Implement input admission, movement prediction/reconciliation, authoritative interaction, private state replication, host lifecycle, and room routing. Add trusted transactions for rewards and inventory. The relay profile remains independently tested.

Artifacts: services/sim-host, shared prediction fixtures, authoritative room profile, latency harness, and trust-boundary documentation.

Acceptance: invalid movement and forged rewards fail; a 150 ms RTT test still has immediate local movement with bounded corrections; headless and browser prediction use the same supported movement rules; a client cannot switch its authority profile; service restart recovers durable state; private entities/fields are absent from unauthorized network captures.

Gate: no assumption that deterministic physics alone validates an untrusted client. The host processes inputs and owns the authoritative outcome.

#Milestone 11 Public SDK and reusable game modules

Outcome: games are assembled from stable engine capabilities.

Complete lifecycle hooks, component extensions, resource/health primitives, abilities, interactions, inventory/equipment, NPC perception/navigation, dialogue, quest signals, and spawn policies. Generate SDK documentation and runnable examples from schemas. Build a Darkwind vertical slice and an unrelated cooperative puzzle using those public contracts.

Artifacts: versioned SDK, engine-zoo coverage, two game packages, compatibility tests, and game-author quickstart.

Acceptance: the second game requires no engine internals or Darkwind imports; an engine upgrade migrates old content explicitly; game modules operate in their declared authority profiles; NPC work stays within tick budgets; late join/reconnect reconstructs equipment and relevant game state.

Gate: maintain a narrow engine core. Game rules remain game packages even when the first game requests them.

#Milestone 12 Renderer completion and visible portals

Outcome: the renderer supports the visual range needed for a substantial first release.

Add animation blend trees, morph targets as needed, renderer-side attachments, bounded point/spot lighting, improved shadows, environment lighting, material/effect graph, particles, billboards, world text, postprocessing, adaptive quality, and one-level visible portals. Profile clustered lighting and GPU culling before adoption.

Artifacts: rendering capability matrix, material graph schema/compiler, visual regression scenes, profiler, quality presets, and portal gallery.

Acceptance: attachments do not trail animated bodies; portal clipping/occlusion is correct; expensive material/particle content hits a visible budget rather than hanging the session; shader failure preserves a valid scene; resource use remains bounded across repeated live edits; supported device tiers meet their recorded performance targets.

Gate: advanced visuals cannot quietly change simulation or make headless execution require GPU assets.

#Milestone 13 Creator isolation and AI authoring

Outcome: builders and agents can extend worlds through controlled interfaces.

Complete the restricted behavior runtime after comparing VM/WASM or interpreted alternatives. Add instruction and memory budgets, capability controls, deterministic hooks, async result scheduling, script fault parking, and source-mapped errors. Isolate creator UI. Expose observation and mutation tools, structured patch proposals, isolated previews, playtests, and asset-generation jobs.

Artifacts: VM decision/benchmark, malicious-script fixture corpus, public tool schemas, assistant adapter, task journal, permission UI, and provenance records.

Acceptance: infinite loops, oversized allocation, forbidden imports, arbitrary network access, stale async results, and UI message spoofing cannot escape the declared boundary; partial script writes roll back; an interrupted assistant resumes without duplicate changes; a proposed room edit can be validated and visually inspected before acceptance; generated content cannot grant its own tool permissions.

Gate: public untrusted creator hosting stays disabled until isolation tests pass. AI tools are optional; the engine remains fully usable with ordinary source files and editor commands.

#Milestone 14 Production compatibility and engine version 1

Outcome: the engine is operable, supported, and reusable beyond a developer workstation.

Complete touch/gamepad mappings, accessible UI, audio lifecycle, account/world roles, regional routing, room admission, graceful deployments, backup drills, content/state migrations, monitoring, support bundles, resource quotas, and capacity benchmarks. Finalize release pinning and SDK compatibility policy.

Run long sessions on the named desktop/mobile support matrix. Test delayed networks, multiple tabs, page hiding, reconnect storms, service rollout, and storage outage. Measure cost from actual room CPU, DB write volume, assets, and egress. Set capacity from those results.

Artifacts: operator documentation, deployment templates, dashboards, supported-device matrix, public limits, version 1 SDK/reference, upgrade/rollback tools, two game releases, and acceptance evidence index.

Release gate: all version 1 architecture requirements pass on declared configurations; no unresolved data-loss or authority-conflict defect; reproducible local setup; automated restore; two independent games; live editor; both authority profiles; measured budgets and clear unsupported-device behavior.

#Milestones 15 to 18 Extended capability

These milestones may be subdivided into releases. Their completion is required before claiming the corresponding broad Spawn-like capabilities. Shipping engine version 1 does not automatically complete them.

#Initial implementation backlog

The first implementation session should work through this bounded list. It does not create a finished game or attempt all packages at once.

After this list, review the architecture against actual measurements, record any changed decision, and continue milestones 2–4. Do not introduce accounts, AI generation, terrain, or a general editor before the runtime path works.

#Acceptance evidence catalog

Maintain a machine-readable catalog of fixtures and required assertions. The following cases are mandatory across the relevant release gates.

#Final character-art polish gate

Deferred by user request on October 24 until the final polish pass. The current traveler and NPC models are temporary; the user rejected their appearance, including the second traveler refinement.

• Rework or replace the character models to meet the beauty and polish of the supplied Spawn reference. Revisit proportions, faces, hair, clothing, materials and animation rather than assuming the existing designs should be retained.
• Review the revised characters in actual world lighting, close up and at normal play distance, including shared multiplayer movement.
• Present the new in-world character art for visual review before declaring the build finished. Existing screenshots and green automated tests do not close this gate.

Closed for this build on October 27: the user explicitly selected “Approve the current character” after the revised in-world character was presented. See TRAVELER_ART for the candidate, reviewed shared-play evidence and remaining animation refinements. This approval does not close the other milestones 0–18.

#Effort and replanning

Use the architecture's planning ranges: 40–75 engineering person-weeks for the creator preview, 35–70 additional for engine version 1, and 60–130 additional for extended capability. Integration, performance work, and failure recovery consume real effort; they are included in these ranges rather than assumed free.

Re-estimate after milestone 4 from measured renderer/physics work, after milestone 6 from recovery complexity, and after milestone 9 from creator workflow throughput. Track elapsed effort against complete gates, not files written or features shown in screenshots. A large content library and finished Darkwind game production require a separate budget.

#Decision register

The following decisions are the baseline, with a named point for reconsideration. They are not unanswered questions blocking implementation.