mmorpg

Server-authoritative MMORPG foundation that scales by distributing zone ownership, with deterministic physics and a separate client presentation layer.

The native Rust client now connects to the standalone zone host and renders server-authoritative multiplayer movement through wgpu. The GitHub Pages demo runs the same Rust zone simulation in the page as a local single-player WASM host; in a development setup, browser tabs can instead join a zone host together over WebTransport. The in-memory control plane and fenced runtime establish tested contracts; they are not yet a production distributed fleet. See the architecture capability map for implemented behavior and deployment prerequisites.

Decision history and stable cross-references: MMORPG Decision Atlas. The atlas distinguishes implemented behavior from agreed but unimplemented design.

Authority map

Concern	Authority
Zone-local gameplay rules and interest policy	mmorpg-core
Collision and physical movement	Rapier (rapier3d, embedded in mmorpg-core, #271)
Command/snapshot wire encoding	mmorpg-protocol
Session ticks, reconnects, replay/recovery, WebTransport	game-server
Zone placement, lease fencing, host routing, handoff metadata	mmorpg-control-plane
Durable character records and exclusive character leases	mmorpg-characters (file entries for development/LAN, browser localStorage entries; optional PostgreSQL adapter)
Adapter from a zone simulation into game-server	mmorpg-game-server
Presentation scenery: props, roads, water, relief, terrain grid (clients only)	mmorpg-scenery
Native graphics	mmorpg-client: wgpu/winit adapter over pinned 3d-lab mesh/camera models
Browser graphics	pinned 3d-lab browser renderer
Browser zone host (single-player demo)	mmorpg-wasm: thin wasm-bindgen adapter over mmorpg-core and mmorpg-protocol
Runtime input semantics	input-bindings (browser and native action runtime; browser/native Settings compose character-scoped profiles and explicit conflict repairs, #41)
User-facing settings	settings (shared JSON catalog; browser @moritzbrantner/settings-browser and native settings-core, #41)
Asset normalization/provenance	asset-tooling (future content slice)
Social systems	social-service where its existing authority fits
Runtime/performance evidence	runtime-profiler integration, without moving gameplay truth

The MMO repository composes those foundations. It should not grow substitutes for them.

The rendering and asset adoption record distinguishes active external components, in-house foundations, and unintegrated character capabilities with source-backed evidence.

Distributed shape

                         control plane
                  zone directory / placement
                    leases + fencing epochs
                           /      \
                          /        \
                         v          v
                 zone host A     zone host B
                ┌────────────┐   ┌────────────┐
client ────────▶│ game-server│   │ game-server│◀──────── client
                │ MatchHost  │   │ MatchHost  │
                │ zone 10    │   │ zone 11    │
                └─────┬──────┘   └─────┬──────┘
                      v                v
                 mmorpg-core      mmorpg-core
                      |                |
                      v                v
                Rapier (core)    Rapier (core)

A zone is a single-writer authoritative simulation. A host may own many zones and the fleet may contain many hosts. Cross-zone movement transfers authority at a deterministic boundary using a unique transfer ID plus source/destination lease epochs. Two hosts must never concurrently own the same zone epoch.

This deliberately avoids shared mutable physics across machines. Horizontal scale comes from more zones, more zone hosts, bounded per-zone populations, player-scoped interest projections, and later evidence-driven zone splitting.

Implemented foundation

The workspace provides:

• a stable-Rust workspace and reusable validation workflow;
• a deterministic zone simulation with embedded Rapier physics (capsule units on KinematicCharacterController, #271);
• validated immutable collision content, gravity, and velocity-preserving physical recovery;
• stale-command rejection and bounded per-zone player capacity;
• canonical full-zone snapshots for replay/recovery that reference their immutable content by revision and fingerprint and fail closed on any content mismatch;
• player-scoped interest snapshots with a spatial index for network publication;
• deterministic visibility workloads with wire parity and snapshot-size evidence;
• deterministic Greyhaven combat workloads with AI/physics/publication counters, replay/recovery parity and ratcheted work/byte budgets;
• an explicit game-server::GameSimulation adapter;
• deterministic mapping from ZoneId to game-server::MatchId;
• a provider-neutral in-memory control-plane reference model with heartbeat-gated host placement and fenced, expiring zone leases;
• deterministic host registration/heartbeat expiry, lease renewal/expiry, and a restartable fencing-epoch floor contract;
• idempotent prepare/accept/commit handoff metadata that survives lease renewal and reserves one transfer per entity;
• a fenced runtime interface that rejects expired/stale owners before commands, admission, ticks, or publication in the reference model;
• a runnable multi-zone host with one WebTransport routing surface and separate operational status;
• a deliberately single-player GitHub Pages tech demo that runs the shared zone simulation as a local WASM zone host and renders its player-scoped projections with the pinned 3d-lab renderer;
• local browser-demo character creation with Warden, Ranger, and Arcanist starter classes, male/female presentation variants, stable per-character local identities, and per-character appearance saves;
• facing-relative movement (run, strafe, backpedal) and grounded jumps driven by a const-generated integer trigonometry table;
• units, targeting, free-aim swings (#517) with an integer hit table, death, corpses, respawn, release spirit, out-of-combat regeneration and tapping, driven by queued intents whose refusals are feedback events, never session errors;
• deterministic creature AI (wander, aggro through the interest index, family assist, chase, leash and evade) with a canonical zone RNG, and recovery continuation proven tick by tick mid-chase, mid-swing, after a death and during an evade;

The control-plane implementation in this slice is a reference model, not yet a production distributed consensus system. Host registration is placement eligibility only: a missed heartbeat blocks new assignment to that host but does not revoke an already-issued zone lease. Existing lease deadlines and fencing epochs remain the authority boundary. The model makes ownership, liveness-sensitive placement, epoch fencing and handoff idempotence executable alongside the optional PostgreSQL directory and durable host adapter and any future orchestration infrastructure.

Native multiplayer client

The native client uses wgpu 30.0.1 + winit 0.30.13, shared Rust world geometry, and the existing WebTransport protocol. W/S run and backpedal, A/D strafe relative to a third-person orbit camera (drag to orbit, wheel to zoom), Space jumps (held, it swims up in deep water; X swims down), Shift dodge-rolls (#516), the left mouse button swings where the character faces and hits everything in its arc (#517; a drag still orbits), a right click selects the specific visible creature or NPC, Tab cycles attackable creatures and N cycles NPCs, 1–8 use the class abilities (offensive ones fire where the character faces), a Warden holds Z for the shield guard (move the mouse up or down for the high or low lane; the unit frame shows the zone's guard) (without --class warden|ranger|arcanist the window opens a local character roster with a turntable preview, kept under the platform config directory), B/C/L toggle bags, character and quest log, Escape cancels a cast or closes panels and R releases a dead spirit; the client only sends intent and the GPU renders interpolated player-visible snapshots of players, creatures and NPCs with their facing. An egui interface shows unit/target frames, the action bar with cooldowns, minimap, quest tracker/log, quest and vendor windows, bags, character pane, loot and chat, plus world-space nameplates, NPC quest markers and floating combat text; every control sends an existing command. E opens the selected NPC’s existing quest/vendor context (otherwise it uses the door in reach; Enter chats): Up/Down browses every quest, stock offer and bag slot, 1 accepts/turns in or buys, 2 sells, Left/Right chooses a quest reward, H pages authored dialogue/objectives, and Escape closes the context or cancels an armed click. The zone validates range, quest state and transactions. Multiple client processes can join the same zone.

python3 scripts/smoke-native.py --window

This builds the client and host, creates disposable development TLS credentials, checks server readiness, verifies an actual GPU frame, opens a window for 120 frames, and shuts everything down. Requires Python 3, OpenSSL and a supported graphics backend. Omit --window for the offscreen GPU check.

For persistent interactive play, see native setup and controls. Tauri is a possible future launcher shell; the gameplay window uses a native GPU surface. See the decision.

Start the complete local native development environment with:

./scripts/dev-native.sh

The launcher fetches the latest merged source and fast-forwards safely before building, then watches local Rust, shader, scenery and build-input edits and restarts the host and client. Each restart resets the disposable zone. Local edits and commits are preserved; an update that needs manual integration stops with an explanation. Use --no-update to work offline or intentionally run your current checkout, and --no-watch for a single interactive launch. Requires Python 3 in addition to Cargo, Git, curl and OpenSSL; see native development.

Greyhaven world authoring (Blender)

The standalone HTML editor has been removed. For optional development-only Outpost placement editing, install Blender 5.2.2 LTS and run bash scripts/dev-blender.sh open. Move, add, duplicate or delete houses and decorative props in Blender, then save/close and run bash scripts/dev-blender.sh export. The exporter invokes the existing Rust collision/scenery validator before writing content/greyhaven/outpost-layout.json; rebuild the game to consume the changes. Blender is not a Cargo/Bun or runtime dependency.

See Blender layout authoring for supported objects, coordinate mapping, exact version and limitations. The editable source is the existing repository JSON, not the generated .blend file.

Browser tech demo

web/ is the GitHub Pages client. It runs the shared Rust zone simulation in the page as a local single-player zone host (ADR 0002): the mmorpg-wasm crate compiles mmorpg-core and mmorpg-protocol to WebAssembly and builds the same ZoneSimulation and content revision as mmorpg-zone-host (zone 1, Greyhaven Vale). There is one implementation of the movement and combat rules; the browser owns none.

• Enter World joins the local zone and spawns the selected character; Characters (or Escape) leaves it and removes the unit. The next entry is a new player at the spawn. A projection the strict decoder rejects fails closed: entry is refused, or the page leaves the world, and the reason appears under Enter World.
• Bags (or B) shows 16 projected slots. Select a stack, set its quantity, then choose a destination; only the zone changes the items. Escape closes the panel before leaving the world. Each fresh world entry gets the starter bag; inventory is not saved across entries.
• Character (or C) shows the six equipment slots (main hand, off hand, head, chest, legs, feet) with item names and stats, the Stamina/Strength/Agility/Intellect totals, health and damage range from the received projection. Select an equippable stack in Bags and choose Equip, or choose Unequip in the pane; the zone performs every swap and refusal. Bags and the character pane can be open together.
• The inn east of the spawn plaza is a walk-in building (#158): click its door, or press E (gamepad Start) within 2.5 m with no NPC selected, to open or close it for everyone; the roof and ceiling hide while you are inside. Vendor (or V) trades with Innkeeper Bram Tolliver behind the inn's bar: within 5 m it lists his priced stock with Buy and your bag with each stack's sale value and Sell. Only the zone moves copper and items; opening it closes Bags, Loot and the character pane.
• Right-click (or tap) a visible creature or NPC to select that specific unit (#517: the left mouse button swings). Selection sends the existing zone-validated target intent and never attacks. The closest drawn body under the pointer wins; solid scenery blocks picking hidden units. A camera drag, canceled pointer or click on empty ground does not select. A confirmed quest-NPC or vendor selection opens its existing dialogue or shop, showing reach feedback when needed. Guards and other NPCs remain selectable without invented dialogue.
• Talk (T, or the button in the quest log) opens the dialog of the selected quest NPC, or the nearest quest giver when no NPC is selected: the quests it offers (Accept), quests ready to turn in with their reward choice (Complete quest) and quests still in progress. Talk and Vendor never substitute another NPC for an explicit NPC selection. Quests (or L) shows the log with each objective's progress and Abandon; the HUD tracks every active objective, and ! (available), ? (ready) and grey ? (in progress) float over quest givers. Givers need you within 5 m; only the zone accepts, credits and rewards quests. Start with Marshal Elden Greywatch west of the spawn plaza.

Building the page or the native client first needs the asset-tooling bundles: scripts/fetch-bundles.sh downloads the selected character/equipment downloads of the rolling humanoid-ranger-male release, the rolling kit, prop, animal and sound releases and the immutable greyhaven-inn-v1 inn into the ignored web/public/ (re-running it keeps a download while its release is unchanged; rolling releases are read live and unpinned, so it refreshes them after an upload). Native builds also need scripts/prepare-ranger-native.sh; see the shared Ranger loading path and browser example. Building the page requires the Rust toolchain from rust-toolchain.toml (with the wasm32-unknown-unknown target) and the wasm-bindgen CLI at the crate's exact version: cargo install wasm-bindgen-cli --version =0.2.129 --locked. bun run build and bun run dev first sync browser dependencies from the committed lockfile, then compile the module. bun test also compiles the module before its WASM tests. The generated bindings are ignored build output. After vite build, web/scripts/build-asset-cache.ts writes dist/asset-cache.json (every static file's SHA-256) and the service worker dist/sw.js (#410): on return visits the built page reuses downloaded WASM, chunks and bundle files from Cache Storage while the deployed manifest still names their revision, revalidates pages and the manifest on every navigation, stores a download only when its bytes match, and falls back to the network when storage is unavailable. Open the page with ?reset-cache to drop it. Update the Git checkout explicitly to build newer source; these scripts do not change source revisions or dependency pins.

The standalone host, the native client and the browser's WASM local host share the Rust Greyhaven Vale content (mmorpg_core::greyhaven_vale). Snapshot schema/wire version 15 carries the viewer's own state (with class, resource, cast, cooldowns, auras and melee range), its target's target, cast and auras, the self sheet (bag, equipment, stat totals and the quest log with completed quests and quest-NPC markers), bounded feedback events, heard chat lines and emotes and compact, priority-ordered unit records within a one-datagram byte budget, and command wire version 9 carries Move, Jump, SelectTarget, StartAttack, StopAttack, ReleaseSpirit, MoveItem, death-fenced Loot, UseAbility, CancelCast, ChooseClass, EquipItem, UnequipItem, BuyItem, SellItem, Chat, Emote, AcceptQuest, CompleteQuest and AbandonQuest; v14 and earlier snapshots, v8 and earlier commands and old recovery bundles require an explicit migration decision. See the wire specification.

The opt-in broadleaf comparison shows current and proposed scenery at the same real game camera; default art stays unchanged pending owner feedback.

The browser Warden hotbar uses four owner-approved painted icons from asset-tooling, with build-time content checks and separate gameplay/UI overlays.

The browser also offers the first Battle Royale PvP activity: temporary max-level builds, real hosted MMORPG combat, results and between-life reconfiguration. Pages serves the client; a compatible Battle Royale host runs the match.

Browser online mode

The same page can join a real zone host instead of its local zone, over WebTransport with the game-server session protocol: the browser counterpart of the native client, and the transport swap ADR 0002 kept open. It is a development and self-hosting mode; the GitHub Pages build stays offline.

./scripts/dev-browser-online.sh

The launcher reuses or creates the ECDSA P-256 development certificate under target/dev-tls/ (valid for 10 days; WebTransport certificate hashes allow at most 14), starts mmorpg-zone-host for zone 1 on UDP port 4433 (status on TCP port 8080) and Vite on 127.0.0.1:5173, and prints a URL to open in two tabs of a Chromium-based browser. Ctrl-C stops both processes, --check verifies the setup and exits, and MMORPG_DEV_TRANSPORT_PORT, MMORPG_DEV_STATUS_PORT and MMORPG_DEV_WEB_PORT override the ports. It shares the certificate and ports with ./scripts/dev-native.sh, so run one of them at a time; a native client can join the launcher's zone with the second-player command.

• Selecting a host. ?server=https://<host>:<port>/game/matches/zone-<id>&certHash=<base64 SHA-256 of the DER certificate> joins that host; without certHash the host needs a publicly trusted certificate. A build with VITE_ZONE_SERVER and VITE_ZONE_CERT_HASH offers the same through a Play online checkbox on the character screen, unchecked by default; the default remains the local WASM zone. The address must be a canonical admission route: credentials, queries, fragments and resume routes are refused, and an invalid address disables entry with the reason instead of falling back to the local zone.
• Session. OnlineZoneSource (web/src/world/online-zone-source.ts) reads the welcome (player, tick rate, connection epoch, reconnect token), sends command frames with strictly increasing sequences, reassembles and verifies snapshot frames and fragments per connection (web/src/session/, a port of the pinned SnapshotReassembler), and decodes projections with the same decoder as the local zone. Movement is held intent the page resends every 50 ms, like the native client; a jump or any other discrete intent is resent byte for byte until a projection acknowledges it, and no later command overtakes it meanwhile, so the host's stale-sequence rule cannot drop it unseen.
• Fail closed. Every projection must carry the page's zone, player and the content revision of the scenery the page loaded. A mismatch or a malformed frame leaves the world with the reason under Enter World rather than drawing a different world.
• Interruptions. A lost connection or five seconds without projections triggers one bounded resume with the in-memory token while the last scene stays visible and the top bar shows Reconnecting…; Characters or Escape cancels it. The resume keeps the player and command sequencing, starts stopped until acknowledged, drops intents made meanwhile and resets interpolation for the new connection epoch. A refused or expired resume ends the session; a new player is never substituted. Tokens stay in memory: they never appear in the page URL or the page's messages (a browser's network console may still show a failed resume request).
• Leaving. Characters, Escape or closing the tab ends the session; the host keeps the character for its reconnect grace (five seconds in the launcher), then removes it. Without character storage, sessions remain anonymous and choose class/sex with ChooseClass. With MMORPG_CHARACTER_DIR, the selected character instead claims its durable server record before entering; explicit Characters/Exit commits and releases it. Closing a tab abruptly retains its latest periodic commit. Appearance remains presentation-only.

python3 scripts/smoke-browser-online.py proves it end to end with the production bundle: it starts a real host with a disposable certificate on OS-selected ports, opens two Chromium pages in online mode, runs one character and checks the other page sees it move in its own decoded projections, then closes the running page and checks its unit disappears after the host's one-second grace.

Play together on a local network

On the host computer, use its actual LAN IPv4 address (for example 192.168.1.20):

./scripts/dev-browser-online.sh --lan 192.168.1.20

The launcher runs one authoritative Greyhaven zone host (UDP 4433) and serves the browser game over HTTPS on that LAN interface (TCP 5173). The printed link names the correct LAN WebTransport endpoint and its pinned development certificate hash. Other computers on the same network open that link in a Chromium-based browser; they do not need the Rust toolchain or a copy of the game source. Each player selects Enter World to join the same zone. --check also works with --lan to verify server readiness and the HTTPS page before playing.

The page uses a self-signed development HTTPS certificate. On each device, trust the host's certificate target/dev-tls/cert.pem for this locally controlled server (or explicitly accept the browser's certificate warning where supported) before using the shared link. Never distribute key.pem. The launcher includes the LAN IP in the short-lived certificate's subject alternative names, regenerating the pair if the IP changes. Open firewall access for TCP 5173 (HTTPS page) and UDP 4433 (WebTransport) only to trusted LAN peers; do not forward the ports to the internet. The server has anonymous sessions and no public authentication or production durability.

You can also connect a native client from another LAN computer to this host (or to one running ./scripts/dev-native.sh) by copying only the public certificate cert.pem to that computer and supplying its LAN endpoint:

cargo run --locked -p mmorpg-client -- \
  --url https://192.168.1.20:4433/game/matches/zone-1 \
  --certificate ./cert.pem

For a host-only check without a browser, the native zone host is already available as mmorpg-zone-host; no separate LAN gameplay server is needed. The ordinary ./scripts/dev-browser-online.sh (without --lan) stays bound to loopback and uses HTTP for local development. The GitHub Pages demo remains local single-player.

Scaling model

The first scaling unit is the zone:

1. one zone has one active authority lease;
2. one game-server::MatchRuntime drives that zone;
3. one process can host many zones through MatchHost;
4. more processes add more independent zone capacity;
5. a routing/control-plane layer tells clients and operators which host owns each zone;
6. cross-zone handoff moves player authority only after the destination accepts the transfer.

The initial MAX_PLAYERS_PER_ZONE is a safety bound, not a performance claim. Capacity changes require deterministic workload evidence. Large cities, raids, or crowded world events should eventually be handled by measured spatial/instance partitioning rather than silently increasing one process's bound.

Persistence

The starter progression rules define the shared XP curve and level-difference kill rewards. The zone awards and projects durable XP; the browser displays its XP bar and level-up feedback from that state.

Starter inventory rules define the immutable item catalog and atomic 16-slot bags. Player-owned bags, queued moves and recoverable self sheets are implemented; the browser displays those slots and sends split/move/merge intent through its Bags panel.

Starter loot rules define validated weighted rewards and deterministic rolling. Core generates corpse rewards once, fences claims by owner/death/reach, and atomically credits money and bags with replay/recovery coverage. The browser Loot window displays the complete selected-corpse sheet, sends the fenced claim and shows refusals.

Use lightweight CQRS/CQS at service boundaries: commands mutate authoritative durable state; queries read it. Do not introduce event sourcing by default. Zone hot loops must not synchronously depend on a distributed database. mmorpg-characters is the durable character boundary (#30): a versioned CharacterRecord captured from and admitted into a zone, stored with an exclusive lease held by one zone at one control-plane epoch; every commit names its lease and fails closed once a newer epoch of the zone or a release superseded it. Its development backend is a directory of atomically replaced, OS-locked entry files; the optional PostgreSQL backend follows TECH-002, and development/LAN zone-host admission is available with MMORPG_CHARACTER_DIR. Zone checkpoint storage is a separate upcoming boundary.

The PostgreSQL/S3 host now suspends empty zones and cold-restores them on admission, with a bounded 30-second default grace and frozen gameplay time. Development file hosts and the browser-local host remain resident.

Pinned foundations

• rapier3d: =0.36.1 (crates.io, default features)
• physics-engine: git rev ae64adbdb2d1af74f89f5befe287a8029eeaa072, optional in mmorpg-core behind the test/bench-only physics-ab feature (physics backend A/B); never in production or WASM builds
• game-server: a3cdf8c8bf915167988de2ef5e1f9b39cf847d13
• 3d-lab (three-d-core, three-d-camera, three-d-projective, three-d-animation and the browser @moritzbrantner/three-d-renderer, kept on one commit): 235774615f1367065093deb6988f5217bdf4d7e1
• reusable validation workflow: 45042e56be120b438096e774027637cac0280075

Validation

cargo fmt --all -- --check
cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
cargo test --workspace --all-features --locked
cargo build --workspace --all-features --locked

mmorpg-core, mmorpg-protocol and mmorpg-wasm must keep compiling for WebAssembly:

cargo build -p mmorpg-core -p mmorpg-protocol -p mmorpg-wasm --target wasm32-unknown-unknown --locked

For the browser client, from web/ using the latest Bun (needs the pinned wasm-bindgen CLI above):

bun install --frozen-lockfile
bun test
bun run build

Committed Rust and Bun lockfiles make local and CI resolution reproduce the same dependency graphs. Rust and browser tests both consume fixtures/protocol/player-snapshot-v22.hex, fixtures/protocol/commands-v12.hex and the game-server session frames in fixtures/protocol/session-frames-v3.hex.

The browser's online mode has its own end-to-end check against a real zone host (needs cargo, OpenSSL, a built web/dist and Playwright Chromium, like scripts/smoke-browser.py):

python3 scripts/smoke-browser-online.py

Run a standalone zone host

Do not launch competing processes for the same zones: this binary does not acquire control-plane leases yet.

Provide a TLS certificate and key, then start one process hosting one or more zones:

MMORPG_ZONE_IDS=10,11 \
MMORPG_CERT_PEM=cert.pem \
MMORPG_KEY_PEM=key.pem \
MMORPG_RECOVERY_DIR=recovery/zone-host \
cargo run --locked -p mmorpg-game-server --bin mmorpg-zone-host

The host uses one WebTransport listener (port 4433 by default) and routes sessions under /game/matches/zone-<id>. Operational HTTP status is exposed separately on port 8080:

• /healthz reports process liveness;
• /readyz reports whether at least one hosted zone can accept sessions;
• /status reports host capacity and per-zone readiness;
• /matches/zone-<id>/readyz and /matches/zone-<id>/status expose a single zone's operational projection.

MMORPG_CHARACTER_DIR=target/dev-characters enables unauthenticated development/LAN character claims from both clients. The host owns exclusive character leases and commits outside the tick; a second process cannot open the same local directory. Clients persist globally distinct online IDs for their local roster slots. This mode uses whole-host graceful recovery at MMORPG_RECOVERY_DIR, or by default <character-directory>/zone-recovery, reacquires restored leases before serving, and commits final records from stopped recovery before releasing them. Content or schema incompatibility fails closed; choose an explicit development reset or migration rather than silently discarding saved data. Production authentication, fleet ownership and strong reward journaling remain separate work. See the admission decision.

When MMORPG_RECOVERY_DIR is set, graceful SIGINT/SIGTERM shutdown writes one atomic recovery bundle for the complete configured zone set. Restarting with the same zones restores simulation, command-sequence, and reconnect state, then consumes the old bundle. A missing zone, an extra zone, or corrupt recovery data fails startup closed instead of partially restoring a host. Durable crash recovery remains a separate persistence boundary.

These endpoints consume game-server host state and never mutate or redefine zone gameplay authority. Configuration is explicit through MMORPG_ZONE_IDS, MMORPG_PORT, MMORPG_STATUS_PORT, MMORPG_CERT_PEM, MMORPG_KEY_PEM, MMORPG_RECOVERY_DIR, MMORPG_CHARACTER_DIR, MMORPG_ROUTE_PREFIX, MMORPG_RECONNECT_GRACE_TICKS, and MMORPG_DRAIN_GRACE_MS; recovery is opt-in, while invalid configured values fail startup instead of silently falling back.

The saved grass authoring package freezes accepted Outpost placements and reproduces their exclusion-mask filtering through pinned asset-tooling. Both clients consume its saved selection through shared scenery.

The saved relief authoring package freezes the Outpost heightfield and reproduces its saved flatten coverage through the same pinned producer. Both clients consume the saved result through shared scenery.

See docs/ARCHITECTURE.md and ROADMAP.md.

Mode hosts can seed temporary max-level character builds without exporting arena outcomes to durable characters.

Opt-in dedicated-zone combat is documented in PvP combat. Ordinary Greyhaven play stays safe; the first playable Battle Royale mode remains separate integration work.