Phase 1 / Forge / Tier 0 pre-freeze and C1.1 cost

[guysenpai]

Brief: briefs/m1.1.15.1-tier0-pregate-and-c11-cost.md — Status CLOSED, 2026-08-27, reopened six times on external review before closing (RD-7, RD-9, RD-12, RD-13, RD-14, RD-16).

M1.1.15.1 is the milestone that makes the freeze possible rather than the one that takes it. Six gates, A to F, each stopped for an explicit GO — then six rounds of external review, and what they found is worth more than what the gates delivered.

---

What it delivers

(a) core.ModuleContext, minted with FOUR fields. Each of engine-tier-interfaces.md §0's four removals is absent for a named reason and none by minimalism: registrar and event_bus would be second declarants of acts World already owns (pattern D11); asset_loader would be a tier inversion whose absurdity needs no invariant to see, that module's own init taking a *ModuleContext and so receiving a pointer to itself; frame_allocator has no Tier 0 producer and no consumer. The *World is outside ARCH-030 rather than an exception to it. Pinned by a negative twin with a two-mechanism predicate whose counter-factual changes the object — a refused six-field shape — never its own expected constant.

(b) The Tier 1 allocator and fallibility contract. ARCH-013 forbids an allocator on a Tier 1 interface entry while six PhysicsWorld entries need one, so src/modules/forge/module.zig fronts it. Measured: Forge3DModule holds the one allocator on the physics path, PhysicsWorld holds zero of its nineteen fields as one, and 0 of the adapter's 28 entries take one. Broadphase.update became infallible on an invariant — at most one unconsumed log entry per slot — not on a reservation promise, which is what let the three pose setters collapse to void. step became anyerror!void over eight measured allocation sites with a written failure contract.

(c) M1.D.13 closed, and the C1.1 instrument written. proxyOf went from a linear search to a dense BodyId-keyed index, with an authority statement rather than a second source: bodies[i].proxy is the fact, the index is derived, rebindProxy is the single derivation point. bench/physics_forge_3d_integration.zig is the instrument C1.1 named and that did not exist.

(d)–(e) The M1.1.26 → M1.1.15.2 / M1.1.25 → M1.1.21.1 renames propagated (24 code sites, 17 CLAUDE.md sites), the 27 → 30 count correction, the CLAUDE.md §3.4 patch.

---

C1.1, measured for the first time

1 000 dynamic + 10 000 static at 60 Hz, on 1 000 awake dynamic bodies of 11 000, P = 8 809 retained pairs, 240 frames from frame 31.

Mode	median	p99 (gated)	max	budget	margin on worst p99
ReleaseFast	2.028–2.144 ms	2.113–3.576 ms	2.235–4.589 ms	16.6 ms	4.6×
ReleaseSafe	2.152–2.436 ms	2.253–5.467 ms	2.275–7.873 ms	16.6 ms	3.0×

Zero allocation attempts in steady state in both, where steady state is defined on the scene (pairs and constraints unchanged for thirty frames) and never on the allocator — otherwise the result would be true by choice of window and unable to fail.

Gated on the p99, not the median. A 60 Hz budget is a real-time constraint and a hitch is invisible to a centre. Reported in the other direction too: across five runs per mode on identical code with a bit-identical checksum, the median moves 6 %, the p99 up to 2.4× and the max up to 3.5× — the tail is machine noise, so this gate buys sensitivity and costs stability, and the margin is claimed on the worst p99 observed.

Retention shape (reported). N ×3.72 at a measured-constant P = 2 209 gives frame ×1.14. A Θ(P·N) step 2 would demand 33.1 million extra endpoint resolutions per frame for a measured delta of 70 µs — 2.1 picoseconds each. Refuted by ~470×.

---

The two reopenings, and the finding that outranks the gates

First — F1/F2/F3. entitiesOf returned one entry per body where engine-physics-queries.md §1.11.14 makes deduplication MANDATORY at the tier projecting bodies onto entities, and its comment deferred that obligation to a tier above the interface which receives entities already projected — nothing would ever have deduplicated. A private staging depth of 256 capped four public entries below the caller's own slice. The cause was that no multi-result entry was exercised through the adapter at all, and the sweep produced the number:

	count
behaviour-asserted	9	deinit, step (failure path), addBody, setBodyTransform, getBodyTransform, createShape, createCharacter, resizeCharacter, getCharacterInnerBody
signature / smoke only	8	init, removeBody, setLinearVelocity, addForce, addImpulse, destroyShape, destroyCharacter, setCharacterPosition
never called at all	11	moveKinematic, setAngularVelocity, raycast, raycastAny, raycastAll, shapeCast, overlapShape, overlapAabb, pointQuery, closestPoint, moveCharacter

F1 and F2 were the first two of nineteen. And the classification is what makes that number usable in one direction rather than the other: the four single-result query entries and the mutators passed on their first run, so seventeen entries were correct and unguarded while two were wrong — a family of missing guards, not of missing correctness.

Second — G1/G2. stageBodies said "two of the three callers are frozen as bare u32"; measured, four callers and three bare, the fourth being overlapShape, frozen anyerror!u32, which the code silently made swallow an OutOfMemory its own signature declares transmissible. And the sweep declared closed had been closed on call sites, where the predicate that matters is whether an oracle tells an entry apart from a plausible neighbour: moveKinematic asserted only the pose reached, which setBodyTransform also reaches. Re-counted with the right predicate, three more fell — init, setLinearVelocity, resizeCharacter — plus pointQuery. 28 of 28 now carry a discriminating oracle, with one reservation named and not closed: setAngularVelocity asserts that the orientation changed, not which axis.

Third — H1, and the defect was inside F1's own fix. dedupEntities deduplicates by adjacency, correct only under the entity-major order of query/overlap.zig's collector, and the whole premise was held by a std.debug.assert — which ReleaseFast compiles to nothing. The guard was live in the two matrix cells where a breach costs nothing and absent in the mode the bench runs and a game ships. Fixed on the repository's own precedent (query/root.zig:380 already replaces a release-stripped class assert with an active check, for this reason and in these words): the comparison is active in every mode, and on detection the function stops trusting adjacency and scans what it has written — exact, because everything written before the break was deduplicated over an ordered run. The answer is never wrong even under a violated premise, and the violation is counted because two of three callers have no channel. Counter-factual decisive both ways: the old form gives expected 2, found 3 in ReleaseFast and panics in Debug.

Third round — I1/I2, and both findings were against arbitrations the review had itself validated. raycastAll, overlapAabb and pointQuery were left frozen bare u32 under the argument that their signature did not permit reporting an allocation failure — circular, since the interface is not frozen and this milestone's exit criterion is that the surface be FINAL. engine-tier-interfaces.md §0 forbids the entry that allocates and has no channel, and a u32 truncating in silence is that entry under another return type: all four are now anyerror!u32, the absorbing stageBodies is deleted rather than left unused, and the per-filler routing const disappears with the asymmetry it described. And "the answer is never wrong" was too wide — the H1 guard produced an answer with no duplicate while §1.11.14 makes entity identity the key of ORDER as well as of retention, so the violation path now sorts on query.entityKey, the solver's own key exported for it rather than re-derived, and the n == out.len exit loses its unconditional "exact" label.

Fourth round — J1, on the same claim twice narrowed and still too wide. H1 established the guard, I1 made its answer duplicate-free and ordered, and both leave RETENTION running on the broken order: the sort reorders what was already kept, and with out.len == 2 on a run yielding 5, then 3, then 1 further on, it answers [3, 5] where the canonical subset under the §1.11.14 key is [1, 3]. No pass over what was kept recovers what was never collected. Under violation the answer is now error.UnorderedProjection — distinct from OutOfMemory, because a broken upstream order is not an allocation failure — and it is expressible only because the third round gave those entries their channel. The alternative, collecting exhaustively and then selecting on the key, needs an unbounded collection and would reopen what the third round closed. The sort is deleted, and containsEntity and the pub on query.entityKey go with it: their reason was the violation path.

The question the review left open was measured, not assumed: found < buf.len is not exhaustive on its own — it speaks only of the solver's saturation. It is the refusal that makes it so, since neither loop exit is reachable unless the premise held for the whole run. The label is true as a consequence of J1, and is written that way at the site.

Fifth round — K1, and it closes by abandoning the claim rather than narrowing it again. Five formulations of one guarantee, each just wide enough to cover the previous counter-example: never wrong → no duplicate → duplicate-free and ordered → true unless the premise broke during the run → true for the window. The cause is structural: n == out.len returns before the staging doubles, so with out.len == 2 and an owner sequence [3, 5, 1] the first pass receives [3, 5], finds it ordered — because it is — fills the slice and returns. The 1 never enters an observed buffer, and no wording turns a windowed observation into a statement about what it never saw.

So the adapter guarantees nothing under a violated premise, and says so: it refuses what it observes broken, it counts, and it states that the detection is bounded to the window and is therefore not a proof. The proof goes to OverlapCollector — add retains, finish orders — the only type that observes the whole selection (RD-15). The test attests the limit rather than a guarantee — an internally-ordered window is accepted even when a smaller element followed it — which is what stops a sixth reformulation: re-promising the run means making that test go red first. A counter-factual reversing the owner's sort breaks four tests, so the chain really does rest on that premise.

Sixth round — L1/L2, two text corrections and no functional defect. RD-15's address was wrong: it named OverlapCollector.finish where the replace-worst loop — the one that decides what is RETAINED — is in add. Verified by reading rather than by trusting the report. It matters because RD-15 is a debt left to M1.1.15.2, and a debt exact on the substance and wrong on the address costs whoever picks it up the time to look in the wrong function. Swept across all five mentions, with the one that speaks of the sort left untouched because it is exact. A comment announcing a std.debug.assert that H1 had replaced with the active check was deleted.

And the form was the cause of both: RD-15 lived as a fifty-six-line exposition inside module.zig instead of as a pointer. A debt lives in the plan, in one place, and code points at it — the block is now thirteen lines carrying only what passes the deletion test. Had it been a pointer from the start, L1 would not have been a code finding at all.

Class swept, with the criterion stated — read literally, "an assert guarding another module's contract" sweeps in almost every precondition. 132 production asserts: 15 comptime (every mode), 117 runtime — 43 caller-parameter domain preconditions, 65 local or owned-structure invariants, 9 asserting a shape's class (not in the class: the category is chosen upstream by an exhaustive switch whose net M1.1.11.1 audited, and the caller-supplied-handle path already carries an active probeAdmissible check). One neighbour ruled out with its reason rather than by silence. The H1 class had exactly one member.

And the gap H1 came out of is closed here. One CI cell added, ubuntu-24.04 / ReleaseFast / f32, 12 → 13 — deliberately not an axis: a release-stripped assert is mode-dependent and neither platform- nor precision-dependent, so one cell detects the whole class where completing the axis would cost 50 % of the matrix. The reason is written in ci.yml at the cell, with an explicit instruction not to complete it by symmetry.

---

Findings reported, not worked around

• api.JointDescriptor and api.JointId are declared nowhere (measured), so the adapter presents 28 of 30 frozen entries and the plan line assigning joints to M1.1.15.2 is unrealisable as written.
• An asleep scene allocates where an awake one does not: 11 000 bodies with sleeping enabled allocate 5 280 times over 240 steady-state frames (rigid/contact_constraint.zig:578) against zero awake. C1.1's zero-allocation property is gated in a configuration a shipped game does not run. Mechanism already owned; this is its first measurement.
• Three frozen entries cannot report an allocation failure (raycastAll, overlapAabb, pointQuery, bare u32). Under exhaustion they answer a correct prefix — a degradation, not a designed cap. Whether that should be so is a contract decision for M1.1.15.2 (RD-10).
• Two count discrepancies in the frozen brief, reported with their units rather than reconciled away.

---

Method — the milestone's real subject

Four times, on four different objects, a green count was produced by a predicate weaker than the claim it supported: 28 entries counted as existing when the question was what they answer; four staging callers counted as three, which made an arbitration follow from a false enumeration; 28 entries counted as called when the question was whether their oracles discriminate; and a git ls-remote read after a push, which cannot tell "the ref had already moved" from "it has just moved" — that last one on the review side, retracted on the evidence. Each count was correct for what it measured and useless for what it was used to conclude.

And a fourth shape sits beside it: a claim restated twice, each time narrowed just enough to cover the counter-example in front of it and never re-derived from the contract it cites. "The answer is never wrong" was checked against duplicates, then against order, and never against retention — which §1.11.14 names in the same sentence as the other two. The counter-measure is in the statement: a claim is re-derived from the spec, never from the last counter-example — and, when no component has the data to establish it, it is given up rather than narrowed until it fits, its proof handed to the component that can see it. The fourth formulation was written one round after that pattern was named, which is the fact worth keeping: a rule that has been named does not prevent its own next instance, it only makes it recognisable afterwards. That is why the counter-measure had to become a test asserting the limit rather than a sentence.

Ten instrument defects, and not one was found by a red check pointing at it. Three arrived at Gate E in a bench just written, under a green PASS. A fourth was a cap probe whose 500:1 box hit a documented GJK limit. A fifth was echo "push exit=$?" returning the exit code of the echo. A sixth was an until status == completed loop reading a stale finished run as a re-run's result. A seventh was a mutation string naming a parameter the source does not have. An eighth did not compile, so it measured nothing while reporting exit=1 — which reads exactly like a counter-factual that fired. A ninth was a timeout that does not exist on macOS, whose command failure read as a network failure. A tenth sat on the review side and was retracted on the evidence.

Three rules the milestone leaves behind: a guard must be shown able to fail on the property it claims, not merely to fail — hence the p99 counter-factual injects hitches at the unchanged budget rather than lowering it; a counter-factual must be shown to have RUN, not merely to have been applied; and a probe testing a condition must distinguish the condition is false from I could not test it.

---

Validation

• zig fmt --check — 0 files unformatted
• zig build lint — exit 0, dead-tests conservation OK at 1964
• Suite — 1945 passed + 19 skipped = 1964 collected (macOS, windows-2025 1962); test-forge-3d 580
• Four corners {Debug, ReleaseSafe} × {f32, f64} — exit 0, 0, 0, 0 — plus ReleaseFast/f32, the mode H1 concerns, now a standing CI cell
• zig build forge-determinism at f32 and f64 — exit 0, 0 witnesses regenerated
• Bench gates — both PASS in ReleaseFast and ReleaseSafe
• 28 of 28 adapter entries carry a discriminating oracle; every fix pinned by a counter-factual that fires, each shown to have compiled and run before its verdict was believed
• Language audit (Python, never a grep bracket class) — zero French prose
• Rename residue — zero in src/, tests/, tools/, bench/, build.zig, .github/

Four preconditions left to M1.1.15.2 — and none is a deferred decision

1. WELD_PHYSICS_PROTOCOL_VERSION and the thirty surface guards (§12 disambiguates 30 from 27).
2. api.JointDescriptor and api.JointId, declared nowhere and presumed by its own plan line.
3. syncIn and the authority model — re-scoped out at M1.1.15 because the tick says when a write happened and never who produced it.
4. The Tier 1 physics service with its Etch wrappers, getTriggerOverlaps, and the Forge → Tier 0 bus → EventStore bridge.

What this milestone refused to leave it is a contract decision: the three bare-u32 entries received their error channel here, because the exit criterion is that the surface be FINAL and discovering a contract during the freeze is what M1.1.15's splitting exists to prevent.

Also out of scope, not debt: ModuleContext.frame_allocator; M1.D.12; wiring the adapter into a running engine.

Planned tag: v0.11.16-tier0-pregate. Merge and tag are Guy's.