[M1-SYS-01] System registry

[offdev]

Roadmap step M1-SYS-01 (system registry, roadmap/M1-heartbeat.md), scope only.

What

Plain registered system functions (FR-1.3: no class, no inheritance) with declared time budgets and declared component I/O:

• src/laige-sim/include/laige/sim/system.h (new):
  • SystemId — dense 32-bit ids from 1, registration order, per-world, deterministic (ARCH-010, the ComponentTypeId precedent);
  • SystemDef — name + SystemFn (void (*)(World&, SystemContext&)) + budgetMs in milliseconds as fpx16_16 (exact, ADR 0002 — keeps the future M1-DET-01 source scan float-free);
  • LAIGE_SYSTEM(Name, budget_ms) — namespace-scope macro: the function declaration + the Name##Def def variable (the PRD Appendix B shape);
  • SystemContext — the per-tick world view; each<T1..TN>(fn, Read/Write tags...) delegates to World::each (definition out-of-line in entity.h where World is complete);
  • Io<T, Access> — the per-component declared I/O tag; a component appears at most once per system (a set, not a multiset) — M1-SYS-02's conflict checks consume the disjoint read/write sets;
  • SystemInfo — the snapshot the scheduler/profiler pull (declaresRead/declaresWrite);
  • kMaxSystems = 256 (engine-level bound, CORE-005).
• World::registerSystem(def, Io<...>...), World::systemCount(), World::system(id) — the World home in entity.h + systems.cpp; the fixed record table is allocated in create() (setup path, like the component registry); the registry travels with the world on move and survives clear().

Validation (normative order — first failure wins)

failure	result	event
moved-from world	InvalidArgument (no warn, the registerComponent precedent)	—
null/empty name	InvalidArgument + warn	system/name_invalid
null run	InvalidArgument + warn	system/run_invalid
budget <= 0	InvalidArgument + warn (the budget must be explicit)	system/budget_invalid
duplicate name	InvalidArgument + warn	system/duplicate
Io<T>: T unregistered in this world	InvalidArgument + warn	system/io_unregistered
same component declared twice (any access)	InvalidArgument + warn	system/io_duplicate
more than kMaxSystems systems	BudgetExhausted + warn	system/budget_exhausted

A non-component T in Io<T, ...> is a compile error (static_assert). Every warn is rate-limited (LOG-004), subsystem system, with stable fields (name, budget_raw, existing_system_id, component_id, systems).

Tests

New SystemRegistry suite — 25 tests, CTest entry system_registry (also in the TSan property list): registration, dense ids, the def value copy, the I/O sets + zero-I/O pack, context delegation (write + read paths through the plain functions), every validation error, the 257-system budget, system() id validation, id stability across two worlds (ARCH-010), move/clear/moved-from-world lifetime, the zero-alloc registration window (test-only operator-new counter, non-sanitizer trees), and the warn-once + rate_limited sink checks.

Verify (local)

• ctest -R system_registry green (25/25, incl. the zero-alloc window); full suite 41/41 on build.
• Full suite 41/41 on build-asan (leak-free), build-tsan, build-clang, build-release, build-shared; zero new warnings under NFR-8.10.
• laige-api.json regenerated (489 symbols); api-real-tree + the api fixture tests green.
• tools/laige-include-lint OK (27 source files, 1/10 vendored deps).

Docs (CORE-006)

• docs/api/system_registry.md (full contract + Performance section), linked from docs/README.md;
• src/laige-sim/README.md status updated (incl. the M1-ECS-06/07 lines);
• Progress Board: M1 7 -> 8 (Total 27 -> 28); Change Log row (this PR); roadmap box checked.

Notes

• SystemDef carries the declared I/O at registration, not in the def: component ids are per-world runtime values and cannot be baked into the compile-time def (documented in the header).
• The traits are in class form (IsIoTag/IsIoComponent): the api scanner parses class template partial specializations; variable templates are an unsupported scanner construct (avoided rather than extending the scanner in this step).
• The LAIGE_SYSTEM expansion ends in ;: the call site (per the PRD sketch) carries no trailing semicolon.