The Great Registry Refactoring 🛡️

🔪 Splitting the Monolith

The central FFI (Foreign Function Interface) registry was surgically split into four focused, single-responsibility modules:

• geometry.rs: Handles VRAM caching (`CachedMesh`) and dynamic mesh generation (cubes, spheres, cylinders).
• physics.rs: Takes over the PHYSICS_WORLD, managing spatial partitioning, AABB collision detection, and screen-to-world raycasting.
• scene.rs: Manages the retained-mode scene graph (`SceneEntity`, `SceneLight`), handling camera UBO updates and the spawning lifecycle.
• registry.rs: Now acts solely as the high-level orchestrator for window proxies, OS input, and strictly sandboxed file/network I/O.

🧹 FFI Consolidation

Alongside structural modularity came a brutal API cleanup. Redundant FFI functions like registry_read_file and registry_write_file were entirely eliminated. All file I/O operations are now routed through the highly secured fs module using file_read and file_write, which enforce strict path validation and CLI permission checks (--allow-read, --allow-write). The global geometry cache (SENT_MESHES) was successfully removed from the kernel entirely and isolated inside scene.rs.

🔒 A Hardened Sandbox

The refactoring didn't just organize the code; it fundamentally secured it. Texture loading (registry_load_texture) now leverages our unified ffi_safety::validate_fs_path framework before touching the disk. Every OS interaction from a `.nod` script is mathematically bounded and securely routed, cementing KnotenCore's position as a zero-trust, deterministic AI runtime.