erincatto/box3d: pure C (no C++), MIT-licensed, ID-based handles — verified via gh api rather than assumed, since this shapes the engine.physics P/Invoke binding directly. Same "buy, don't build" call already made for rendering, extended consistently in the scope risk row and M4. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N1qPfzq8TDCUMFMV3UwV5N