FIRST LIGHT

In a brick-breaker, indestructible gold can wall a breakable brick off where no ball will ever reach it. The player gets no crash and no error, just a level that never ends. FIRST LIGHT’s boards are painted in a spreadsheet and edited all the time, so playing all 132 to the end after every change was never going to happen.

So I built a prover. It pads the 13-column board with an open border, flood-fills every empty cell a ball could reach, removes each breakable brick touching that space, and repeats until nothing changes: a peel to a fixpoint. Any breakable brick still standing is sealed, and the test fails. Because the model is ball-only, it also shows that no board needs a power-up to finish, and a second test asserts exactly that.

It is a reachability proof on the grid, not a physics simulation, aimed at the one failure that makes a board unfinishable, and the board file’s own header names it as the contract every board must meet. The build runs it with the rest of the suite every time, though a red suite doesn’t yet stop the build (Case 2).

Debug keys exist only under the dev server: they are derived from the build command, so every distributable is clean by construction. Two checks back that up anyway. A fail-closed one confirms the config still derives the keys that way; the other searches the built bundles’ bytes for a sentinel string before anything is notarized or uploaded.

The Steam upload calls a ship gate that reads the defect tracker before anything is staged. It is scoped per shipment: the game-and-demo upload asks only about game, demo, build and Steam blockers, so a soundtrack bug can’t hold up the game. Open, in-progress and fixed-but-unverified blockers all stop the upload, and an unknown state (an unreadable tracker, an unknown scope) counts as blocked. Its categories come from the tracker’s own legend, so a new one can’t quietly fail open. Shipping over a blocker takes a person typing an explicit override at a terminal; an unattended run aborts.

Static checks can’t see a runtime death. One build passed typecheck, tests, receipts and notarization and still could not start, so the build now launches the packaged macOS app and fails if the front end never reports its version.

Liveness is a handshake too: a build is recorded as live only if its log shows it was sent to Steam, and a doc checker fails when any document disagrees with that record.

The game first shipped on Tauri, Rust plus the system webview, and the webview kept costing time: a cursor workaround because pointer lock didn’t work, a JavaScript-to-Rust handshake just to size the macOS viewport, a WebView2 dependency on Windows, two system renderers that could change under a shipped build, and no route to the Steam Deck, because the Windows webview doesn’t run under Proton.

I ran a branch-only spike. It showed the game running unmodified in Electron, and it listed in writing what it did not prove: achievements, saves, notarization and the Steam overlay. When the old shell later left the ship path, one fail-closed check stayed on purpose: the stager refuses to upload any bundle it can’t positively identify.

The game core imports no renderer and its random numbers are seeded, so bots can play it. The balance sweep plays each of the 132 rounds 100 times independently, with four selectable player models: teleport, follow, a “human” with reaction time and flick error, and aim. It logs 36 fields per run, so a new question becomes a query instead of a fresh simulation. A campaign bot plays rounds 1 through 132 as one player, with lives, score and power-ups carried forward, across ten seeds by default.

A workshop of 37 active tool pages (45 linked, 8 retired) runs on a second dev server. 32 of its 43 modules import the game’s live source rather than snapshots, so those tools can’t fall out of step with the game, and the workshop is typechecked in the build gate. Level art round-trips through Excel, with a lossless round-trip check added after a palette collision silently changed a board.

The voice pipeline is tooled the same way. Its model clips the first or last word of about 40% of renders, so every line is rendered with padding at both ends, the pads are found by paired silences, and the masters are kept: a bad cut means re-trimming, never re-rendering an approved take.