Merge pull request 'runtime: put el_runtime.c on a ratchet, and actually run the guards' (#161 ) from fix/runtime-growth-guard into fix/runtime-shim-retire

runtime: put el_runtime.c on a ratchet, and actually run the guards
scripts/check-single-runtime.sh guards against el_runtime.c being COPIED — it was written after a lagging fork shipped to prod and dropped learned hebb edges. Nothing guarded against it GROWING. So it grew: 10,607 -> 20,527 lines, 94% in 3.5 months, the whole time under an explicit commit-message promise that it was a temporary shim about to be deleted. Worse, the copy guard was never wired in. Its own footer described the CI wire-in as a TODO, and the TODO had never been done — the script existed but ran nowhere, in no workflow and in no hook, so it had caught nothing for as long as it has been in the tree. A guard that does not run is a comment. This adds the missing guard and runs both. * lang/runtime/BUDGET — a RATCHET, not a limit. max_lines is set at the current 20,527 with NO headroom: the file cannot grow by one line. A second cap, max_engram_fns (279), counts top-level engram_/eg_/cog_ definitions in it — ~47.5% of the file is engram code and engram already owns six sibling .c files, so this is the scoreboard for moving it out. Both may only go DOWN. * scripts/check-runtime-growth.sh — enforces the ratchet, and three invariants that keep the multi-file runtime honest: every .c in lang/runtime/ is either in SOURCES or explicitly platform-optional (an unaccounted .c is compiled by nothing and is silently dead); install.sh's hardcoded download list matches SOURCES (it cannot call the helper — it runs where there is no checkout — so that copy is checked, not trusted); and an advisory nudge to lower the budget when you have earned it. * Both guards now run as early steps in ci-dev.yaml, ci-stage.yaml and sdk-release.yaml, and in .githooks/pre-commit. The failure message is the point. The guard that existed said what was wrong but not where the code should go, which makes it easy to "fix" by arguing with the guard. This one names the destination: the concern-owning .c, or a new .c plus one line in SOURCES, or c_source in a program's manifest.el — and it prints the `nm` command that proves placement is link-time and that the shipped compiler already links from ten translation units. Every runtime file except el_runtime.c is deliberately uncapped, because that is where code is supposed to go. Proven with negative controls, per lang/AGENTS.md step 5 — each shown FAILING: * +1 line to el_runtime.c -> FAIL (20528/20527) * +1 engram fn, net-zero lines -> FAIL (280/279) * a new unaccounted lang/runtime/*.c -> FAIL * engram_store.c removed from install.sh -> FAIL, names the missing file * el_runtime.c truncated to 20,000 lines -> PASS + "lower max_lines to 20000" * baseline, tree unmodified -> OK, and both guards green el_runtime.c is byte-identical after the controls; this commit changes zero lines of it.
2026-08-17 00:56:44 +00:00 · 2026-08-16 16:48:04 -05:00
1029 changed files with 22167 additions and 19635 deletions
@@ -1,9 +0,0 @@
-
-# organ: local device state and its own engram store — never production's
-peripheral/.consent.json
-peripheral/.resume.json
-peripheral/.engram/
-peripheral/organ
-
-# Claude Code session state
-.claude/
@@ -1,153 +0,0 @@
-<title>Completing El</title>
-<style>
-:root{
-  --board:#f4f2ec; --board-line:#e2ded2; --ink:#1c1f26; --ink-soft:#4a5160;
-  --ink-faint:#8b8f9a; --rule:#d8d3c6; --card:#fbfaf6;
-  --red:#a8321e; --amber:#9a6a12; --green:#2f6b46; --blue:#1f4e79;
-  --accent:#1f4e79;
-}
-@media (prefers-color-scheme: dark){
-  :root:not([data-theme="light"]){
-    --board:#14161b; --board-line:#212530; --ink:#e8e6df; --ink-soft:#a8adb8;
-    --ink-faint:#6f7480; --rule:#2a2f3a; --card:#191c23;
-    --red:#e4785f; --amber:#d9a441; --green:#6fbf8e; --blue:#7fb2e0;
-    --accent:#7fb2e0;
-  }
-}
-:root[data-theme="dark"]{
-  --board:#14161b; --board-line:#212530; --ink:#e8e6df; --ink-soft:#a8adb8;
-  --ink-faint:#6f7480; --rule:#2a2f3a; --card:#191c23;
-  --red:#e4785f; --amber:#d9a441; --green:#6fbf8e; --blue:#7fb2e0;
-  --accent:#7fb2e0;
-}
-*{box-sizing:border-box}
-body{
-  margin:0; background:var(--board); color:var(--ink);
-  font:16px/1.65 ui-serif,Georgia,"Iowan Old Style",Palatino,serif;
-  background-image:linear-gradient(var(--board-line) 1px,transparent 1px),
-                   linear-gradient(90deg,var(--board-line) 1px,transparent 1px);
-  background-size:28px 28px;
-}
-.wrap{max-width:960px;margin:0 auto;padding:56px 24px 96px}
-.mono{font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace}
-header{border-bottom:2px solid var(--ink);padding-bottom:18px;margin-bottom:8px}
-h1{font-size:clamp(2rem,5vw,3rem);margin:0;letter-spacing:-.02em;text-wrap:balance}
-.sub{color:var(--ink-soft);font-size:1.05rem;margin:10px 0 0}
-.meta{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:.78rem;
-  color:var(--ink-faint);text-transform:uppercase;letter-spacing:.09em;margin-top:14px}
-h2{font-size:1.45rem;margin:52px 0 6px;letter-spacing:-.01em}
-h2 .n{font-family:ui-monospace,monospace;font-size:.8rem;color:var(--accent);
-  display:block;letter-spacing:.12em;margin-bottom:4px;font-weight:400}
-.lede{color:var(--ink-soft);margin:0 0 18px}
-p{margin:0 0 14px}
-.card{background:var(--card);border:1px solid var(--rule);border-radius:3px;padding:20px 22px;margin:16px 0}
-.scroll{overflow-x:auto;-webkit-overflow-scrolling:touch}
-table{border-collapse:collapse;width:100%;font-size:.9rem;min-width:640px}
-th{text-align:left;font-family:ui-monospace,monospace;font-size:.72rem;
-  text-transform:uppercase;letter-spacing:.09em;color:var(--ink-faint);
-  border-bottom:1px solid var(--ink);padding:0 12px 8px 0;font-weight:400}
-td{padding:11px 12px 11px 0;border-bottom:1px solid var(--rule);vertical-align:top}
-td.f{font-weight:600;white-space:nowrap}
-td.m{font-family:ui-monospace,monospace;font-size:.83rem;font-variant-numeric:tabular-nums}
-.dead{color:var(--red);font-weight:600}
-.part{color:var(--amber);font-weight:600}
-.ok{color:var(--green);font-weight:600}
-blockquote{margin:18px 0;padding:2px 0 2px 20px;border-left:3px solid var(--accent);
-  color:var(--ink-soft);font-style:italic}
-ul{margin:0 0 14px;padding-left:22px} li{margin-bottom:9px}
-.q{border-left:3px solid var(--amber);padding:14px 0 14px 20px;margin:18px 0}
-.q b{display:block;font-size:1.05rem;margin-bottom:5px;font-style:normal}
-.q span{color:var(--ink-soft);font-size:.94rem}
-code{font-family:ui-monospace,monospace;font-size:.88em;background:var(--card);
-  border:1px solid var(--rule);border-radius:2px;padding:1px 5px}
-hr{border:0;border-top:1px solid var(--rule);margin:44px 0}
-.foot{color:var(--ink-faint);font-size:.86rem;margin-top:60px;
-  border-top:1px solid var(--rule);padding-top:18px}
-.tag{display:inline-block;font-family:ui-monospace,monospace;font-size:.68rem;
-  letter-spacing:.08em;text-transform:uppercase;border:1px solid var(--rule);
-  border-radius:2px;padding:2px 7px;color:var(--ink-faint);margin-left:8px;vertical-align:middle}
-</style>
-
-<div class="wrap">
-
-<header>
-  <h1>Completing El</h1>
-  <p class="sub">A working surface. Nothing here is settled, and none of the code is assumed right — El is self-hosting, so all of it can change and be rebuilt.</p>
-  <p class="meta">Whiteboard v0 · no sacred cows · not a plan, not a task list</p>
-</header>
-
-<h2><span class="n">01</span>What we established</h2>
-
-<p>El is a <b>concept-oriented language</b> — the first, and intended as the last, because every other family is oriented toward a <em>representation</em> of a concept rather than the concept. Procedures, objects, functions, predicates are the shapes concepts get flattened into. Once the primitive is the concept, there is no further rung.</p>
-
-<p>Everything here is El. The engram is an El program, the soul is El, <code>elp</code> is El, ingest is El. Which gives the load-bearing consequence:</p>
-
-<blockquote>A concept with no home in El does not disappear. It becomes C, or it becomes a convention.</blockquote>
-
-<p>Both are measurable, and both were measured. As C: <span class="mono">20,504</span> lines of <code>el_runtime.c</code> — 2.3× the entire self-hosting language it serves (<span class="mono">9,089</span> lines), ~47% of it engram code that has its own six sibling files. As convention, from <code>language.md</code> §18.0 — <em>"these are not four problems, they are one absence, four times"</em>:</p>
-
-<div class="card scroll">
-<table>
-<thead><tr><th>Concern</th><th>Fragments</th><th>The convention it became</th></tr></thead>
-<tbody>
-<tr><td class="f">Process identity</td><td class="m">0 guards</td><td>"check nothing is already running first"</td></tr>
-<tr><td class="f">Configuration</td><td class="m">20 env vars</td><td>"remember the right default here"</td></tr>
-<tr><td class="f">Durability</td><td class="m">62 call sites</td><td>"after you mutate, remember to persist"</td></tr>
-<tr><td class="f">Request auth</td><td class="m">10 per-route</td><td>"check the token in this handler too"</td></tr>
-<tr><td class="f">Index-after-append</td><td class="m">9 of 9 failed</td><td>"after you append, remember to index"</td></tr>
-</tbody>
-</table>
-</div>
-
-<p>The last row is the strongest evidence available about what this class of convention is worth: it failed at <b>100% of its sites</b>.</p>
-
-<h2><span class="n">02</span>The decomposition axis</h2>
-
-<p class="lede">Not by file, module, or subsystem. <b>By faculty.</b></p>
-
-<p>Every defect fought in the last day resolves to a faculty rather than a bug, and each one leaked out of El into something else — into C, into a Swift binary, into a shell script with a curl timeout, into a convention nobody performs.</p>
-
-<div class="card scroll">
-<table>
-<thead><tr><th>Faculty</th><th>State</th><th>Measured</th><th>Where it leaked to</th></tr></thead>
-<tbody>
-<tr><td class="f">Ingest <span class="tag">take in</span></td><td class="dead">dead</td><td class="m">2 min → 0 nodes</td><td>separate process, uploads bytes over HTTP to a process with direct fs access; 5 functions where there is 1</td></tr>
-<tr><td class="f">Recall <span class="tag">remember</span></td><td class="dead">dead</td><td class="m">own definition ranked 8th</td><td>lexical substring scan; empty on 23 of 24 multi-token queries</td></tr>
-<tr><td class="f">Transduce <span class="tag">perceive</span></td><td class="dead">dead</td><td class="m">1 node, 0 edges</td><td>intake flattens signal to a point; <code>realized:false</code>; caller must declare the modality</td></tr>
-<tr><td class="f">Think <span class="tag">reason</span></td><td class="dead">dead</td><td class="m">direction [0,0,0,…]</td><td>null gradient from any anchor, any faculty, byte-identical; confidence at the uninformed prior</td></tr>
-<tr><td class="f">Realize <span class="tag">express</span></td><td class="part">partial</td><td class="m">13-word vocabulary</td><td>organ was 939 lines of Swift beside the language; voice read from a file path</td></tr>
-<tr><td class="f">Body <span class="tag">substrate</span></td><td class="part">partial</td><td class="m">CC 356 / 1,626 lines</td><td><code>engram_activate_inner</code> — recall itself, with 356 unexamined paths</td></tr>
-<tr><td class="f">Persist <span class="tag">endure</span></td><td class="ok">live</td><td class="m">100% embedded</td><td>works; every signal placed in geometry at intake, 13,562 of 13,562</td></tr>
-</tbody>
-</table>
-</div>
-
-<p>Stated plainly: it cannot take in, cannot remember, cannot perceive, cannot reason, and barely speaks. These were filed as tickets against a repository. They are faculties of the thing the repository <em>is</em>.</p>
-
-<h2><span class="n">03</span>The ordering principle</h2>
-
-<p>El's compiler is written in El. Every concept the language gains, the compiler can then be written <em>in</em> — so the tool improves the tool, and the fixpoint (stage2 ≡ stage3, byte-identical) makes each turn provable rather than hopeful. The verifier answers in <span class="mono">2.9s</span>.</p>
-
-<p>Which means the ordering criterion is not size of payoff:</p>
-
-<blockquote>Order by leverage on the <em>next</em> iteration. Which concept, added to El, most increases the ability to add the following one?</blockquote>
-
-<p>In a recursive system that dominates immediate value — a small early gain that compounds beats a large one that doesn't. It also bounds itself correctly: unbounded in depth, bounded in rate, because nothing lands that the compiler and the fixpoint have not passed.</p>
-
-<h2><span class="n">04</span>Open — for the whiteboard</h2>
-
-<div class="q"><b>What does a declaration bind to?</b><span>If <code>cat</code> names a region rather than a struct — one that shifts and completes against the engram and the neighbouring code — then what is written at the declaration site, and what is resolved at use? This is the centre of the whole thing and it is not specified anywhere yet.</span></div>
-
-<div class="q"><b>Is "the type checker" a type checker at all?</b><span>§2.3 records annotations as parsed and skipped, and every codegen hazard is downstream of that — <code>+</code> dispatching on AST node kind, <code>==</code> lowering to <code>str_eq</code> unless both operand names are in an int-name set. But if a declaration names a region, checking is asking whether the geometry supports the use. That is grounding, not unification. Naming this wrong builds the wrong thing.</span></div>
-
-<div class="q"><b>Is the faculty list above right?</b><span>Seven were derived from what broke. Derived-from-failure is a biased sample — it finds what is loud, not what is missing. What faculty is absent entirely and therefore never failed?</span></div>
-
-<div class="q"><b>Which concept has the highest leverage on the next turn?</b><span>Candidates so far: the prologue/epilogue seam (§19.3 names it as the prerequisite and its stated blocker has expired — it would collapse 62 + 10 convention sites); <code>protocol</code>/<code>impl</code> (the absence that produced five ingest functions); and the resolution question above. These are not equal and the criterion in §03 should decide it, not preference.</span></div>
-
-<div class="q"><b>What is the seam that makes cognition non-optional?</b><span>"Use the ops" is itself a convention — present in context every turn, enforced by nothing, and it failed at ~100% of sites in a full session. A stronger instruction is still a convention. What makes reasoning-outside-Neuron <em>fail</em>, the way <code>@manager</code> makes <code>dharma_emit</code> outside the boundary a compile error rather than a lint?</span></div>
-
-<hr>
-
-<p class="foot">Working surface, not a design document. The design is what we put on it. Everything above is either measured or quoted from <code>lang/spec/language.md</code>; nothing is inferred and presented as fact.</p>
-
-</div>
@@ -1,142 +0,0 @@
-# El — Capabilities
-
-**What the language can do, stated as capabilities rather than as code.**
-
-This list is the unit of analysis. Each entry gets one question — *prove this
-cannot be done with pure geometry* — and the answer determines whether it stays a
-capability of the language or collapses into the manifold.
-
-Draft, 2026-08-17. Ordered roughly from most-likely-geometry to most-likely-code.
-
-**Status after measurement.** The list was audited against the implementation
-the same day. 28 entries collapsed to 19 geometry + 3 code: serialization, text
-encoding, network and emission are all *projection onto a basis* (row 18) —
-the convention is the basis, never the act. Storage collapsed because
-persistence has no caller. Concurrency collapsed because coordination is the
-price of forgetting, not a capability. A fourth proof form was added,
-**adversarial exactness**, and form 1 stopped being a valid verdict.
-
-**The table answers CAN only.** SHOULD and COST resolve per *site*, not per
-capability — `is_digit` and `is_letter` are one capability with opposite
-answers, and comparison spans three cost tiers. See the notes below.
-
---
-
-## The list
-
-| # | Capability | What it means | Verdict |
-|---|---|---|---|
-| 1 | **Comparison** | is this the same as that; is this greater | zero distance / sign of a displacement |
-| 2 | **Ordering** | arrange by a criterion | position along an axis |
-| 3 | **Containment** | is this inside that; does this contain that | region membership |
-| 4 | **Correspondence** | where does this occur in that; how much of this is in that | a match-strength field over a span |
-| 5 | **Segmentation** | divide a whole into parts | boundaries at measured discontinuity |
-| 6 | **Composition** | join parts into a whole | adjacency; one position with parts |
-| 7 | **Classification** | what kind of thing is this | which region does it land in |
-| 8 | **Naming / binding** | attach a name to a thing and find it again | an edge; retrieval is projection |
-| 9 | **Collection** | many things held together, indexed, counted | a set of positions; cardinality; projection onto the i-th |
-| 10 | **Iteration** | do something for each of many | traversal |
-| 11 | **Arithmetic** | quantity, magnitude, combination | displacement algebra on a line |
-| 12 | **Time** | when; how long; how often | a 1-D affine space — instants are points, durations displacements, rhythms phases on a circle |
-| 13 | **Identity** | which one is this; are these two the same one | coincidence of position |
-| 14 | **Selection / dispatch** | choose which behaviour applies | nearest region |
-| 15 | **Transformation** | produce a thing from a thing | change of basis |
-| 16 | **Grounding** | how well is this supported | the weight on an edge. Has no caller |
-| 17 | **Learning** | get better at something | standing changing over time |
-| 18 | **Projection** | render meaning onto a surface | change of basis onto a surface basis |
-| 19 | **Transduction** | take a signal in | change of basis from a sensor basis |
-| ~~20~~ | ~~Serialization~~ | **collapsed → 18.** The format is a basis; projecting onto it is the act | — |
-| ~~21~~ | ~~Text encoding~~ | **collapsed → 18.** An encoding is a basis | — |
-| ~~22~~ | ~~Storage~~ | **collapsed.** No save — persistence has no caller. Durability survives at one site inside the engram | — |
-| ~~23~~ | ~~Network~~ | **split.** Wire format → 18; socket → 24 | — |
-| 24 | **Process / OS** | syscalls; the one-way boundary. Where monotonicity stops | CODE, form 2 |
-| ~~25~~ | ~~Concurrency~~ | **collapsed.** Monotone state needs no coordination; coordination is the price of forgetting | — |
-| 26 | **Memory substrate** | what holds the positions | CODE, form 3 |
-| 27 | **Concealment** | meaning made unreadable without a key. *Renamed*: "secrecy" covered one of three things and got the other two backwards — a hash is public, a signature exists to be read. Integrity and authenticity are **grounding under adversarial conditions** (row 16); only concealment stands alone | CODE, form 4 |
-| ~~28~~ | ~~Emission~~ | **split.** Laying out → 18; the device write → 24 | — |
-
---
-
-## Notes on the boundary cases
-
-**27 — Secrecy is the one capability geometry cannot hold, and the proof is not
-form 1.** A cryptographic hash is a *deliberately structure-destroying* map: its
-entire value is that near inputs land at maximally uncorrelated outputs. Geometry
-is the claim that near things stay near. A manifold that approximated SHA-256
-would *be* a break of SHA-256. Signature verification is the same: 0.99-valid is
-invalid. And X25519 *is* geometry — a group on an elliptic curve — which is
-precisely why it must be code, because its security is the *hardness of moving in
-that geometry*.
-
-This is a fourth proof form and it should be added to `geometry-vs-code.md`:
-**adversarial exactness.** Where approximation is a break, geometry is excluded.
-
-**20, 21 — Serialization and text encoding are convention all the way down**, but
-only at the *edge*. The byte format is agreed; what is being written is not. Do not
-let a geometric computation inherit a code verdict because its result gets
-serialized.
-
-**11, 12 — Arithmetic and time are the same capability.** Instants are points,
-durations are displacements, point−point→vector, point+vector→point. The runtime
-already implements this correctly as `el_instant_add_dur` / `el_duration_add`. That
-it *also* implements a five-entry string→multiplier table beside it (`time_add`
-with `"ms"/"sec"/"min"/"hour"/"day"`) is the residue.
-
-**7 — Classification is the most-violated capability in the codebase.** Seven ASCII
-range tables (`is_letter`, `is_digit`, `is_alphanumeric`, `is_whitespace`,
-`is_punctuation`, `is_uppercase`, `is_lowercase`) that return false for every
-non-ASCII byte. `str_count_letters` reports zero letters for `é`. The wrongness on
-most of Unicode is the tell that a table is standing in for a region.
-
-**4 — Correspondence appears five times.** `str_index_of`, `str_index_of_all`,
-`str_last_index_of`, `str_count`, `str_find_chars` are five projections of one
-match-strength field: first zero, all zeros, last zero, count of zeros, first
-class-crossing. One relation, five functions.
-
-**14 — Selection is the crux for the compiler.** `+` dispatching on AST node kind
-is selection-by-enumeration where selection-by-position belongs.
-
-**Correction, 2026-08-17, from measurement.** This entry previously also cited
-`==` lowering to `str_eq` "unless both operand names are in a hardcoded int-name
-set — a literal list of variable names treated as integers." That is **wrong**.
-`__int_names` is populated from *type annotations* (`param["type"] == "Int"`,
-`let x: Int`), which is primitive but legitimate type propagation, not an
-enumeration of blessed variable names.
-
-The real defect was one layer down: `is_int_call` held **35 hardcoded builtin
-return types**, the same shape as the 19 temporal ones. Those moved to
-`lang/tools/check/signatures.rel`.
-
-And the mischaracterisation hid a live bug. Because the return types were never
-consulted at a *binding* site, an unannotated `let` lost its type:
-
-```el
-let a = str_len("hello")     // no annotation
-let b = str_len("hi")
-let c = a + b                // → el_str_concat(a, b) on two integers
-```
-
-That compiled clean, ran, and printed nothing where it should print 7 — no error
-at any layer. Present in the pre-change compiler, so pre-existing. Fixed by
-taking an unannotated `let`'s type from what its initialiser returns; the data
-was already required for dispatch and simply never read there.
-
-**The general lesson, since it recurred all session:** the enumeration was real
-but I had located it in the wrong place. Naming a defect from reading is a
-hypothesis. Eight hours of reading this file did not surface the miscompilation;
-moving the data out and running the result did.
-
---
-
-## What this list is for
-
-Each capability gets audited **once**, across every place it appears — not once per
-file. The output is not a percentage. It is:
-
- which capabilities survive the question and stay in the language
- which collapse into the manifold
- and for each one that collapses, **every site it currently appears at**, because
-  those sites are the residue and they are what gets deleted.
-
-The line-count audit produced a map of where the residue sits. This produces a map
-of **what it is**.
@@ -1,217 +0,0 @@
-<title>The El Architecture</title>
-<style>
-:root{
-  --board:#f4f2ec; --board-line:#e5e1d6; --ink:#1c1f26; --ink-soft:#4a5160;
-  --ink-faint:#8b8f9a; --rule:#d8d3c6; --card:#fbfaf6;
-  --red:#a8321e; --amber:#9a6a12; --green:#2f6b46; --accent:#1f4e79;
-}
-@media (prefers-color-scheme: dark){
-  :root:not([data-theme="light"]){
-    --board:#14161b; --board-line:#1d212a; --ink:#e8e6df; --ink-soft:#a8adb8;
-    --ink-faint:#6f7480; --rule:#2a2f3a; --card:#191c23;
-    --red:#e4785f; --amber:#d9a441; --green:#6fbf8e; --accent:#7fb2e0;
-  }
-}
-:root[data-theme="dark"]{
-  --board:#14161b; --board-line:#1d212a; --ink:#e8e6df; --ink-soft:#a8adb8;
-  --ink-faint:#6f7480; --rule:#2a2f3a; --card:#191c23;
-  --red:#e4785f; --amber:#d9a441; --green:#6fbf8e; --accent:#7fb2e0;
-}
-*{box-sizing:border-box}
-body{
-  margin:0; background:var(--board); color:var(--ink);
-  font:16px/1.68 ui-serif,Georgia,"Iowan Old Style",Palatino,serif;
-  background-image:linear-gradient(var(--board-line) 1px,transparent 1px),
-                   linear-gradient(90deg,var(--board-line) 1px,transparent 1px);
-  background-size:30px 30px;
-}
-.wrap{max-width:940px;margin:0 auto;padding:56px 24px 96px}
-.mono,code{font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace}
-header{border-bottom:2px solid var(--ink);padding-bottom:20px}
-h1{font-size:clamp(2.1rem,5.5vw,3.2rem);margin:0;letter-spacing:-.025em;text-wrap:balance}
-.sub{color:var(--ink-soft);font-size:1.08rem;margin:12px 0 0;max-width:64ch}
-.meta{font-family:ui-monospace,monospace;font-size:.76rem;color:var(--ink-faint);
-  text-transform:uppercase;letter-spacing:.1em;margin-top:16px}
-h2{font-size:1.5rem;margin:56px 0 8px;letter-spacing:-.015em;text-wrap:balance}
-h2 .n{font-family:ui-monospace,monospace;font-size:.78rem;color:var(--accent);
-  display:block;letter-spacing:.14em;margin-bottom:5px;font-weight:400}
-h3{font-size:1.08rem;margin:30px 0 6px}
-p{margin:0 0 14px;max-width:72ch}
-.lede{color:var(--ink-soft);margin:0 0 20px;font-size:1.04rem}
-.card{background:var(--card);border:1px solid var(--rule);border-radius:3px;padding:20px 22px;margin:18px 0}
-.scroll{overflow-x:auto}
-table{border-collapse:collapse;width:100%;font-size:.9rem;min-width:600px}
-th{text-align:left;font-family:ui-monospace,monospace;font-size:.71rem;
-  text-transform:uppercase;letter-spacing:.09em;color:var(--ink-faint);
-  border-bottom:1px solid var(--ink);padding:0 14px 8px 0;font-weight:400}
-td{padding:11px 14px 11px 0;border-bottom:1px solid var(--rule);vertical-align:top}
-td.f{font-weight:600;white-space:nowrap}
-td.m{font-family:ui-monospace,monospace;font-size:.83rem;font-variant-numeric:tabular-nums;white-space:nowrap}
-.dead{color:var(--red);font-weight:600}
-.part{color:var(--amber);font-weight:600}
-.ok{color:var(--green);font-weight:600}
-blockquote{margin:20px 0;padding:3px 0 3px 22px;border-left:3px solid var(--accent);
-  color:var(--ink-soft);font-style:italic;max-width:70ch}
-ul{margin:0 0 14px;padding-left:22px;max-width:72ch} li{margin-bottom:9px}
-code{font-size:.87em;background:var(--card);border:1px solid var(--rule);border-radius:2px;padding:1px 5px}
-pre{background:var(--card);border:1px solid var(--rule);border-radius:3px;
-  padding:16px 18px;overflow-x:auto;font-size:.85rem;line-height:1.55;margin:16px 0}
-pre code{background:none;border:0;padding:0}
-.q{border-left:3px solid var(--amber);padding:14px 0 14px 20px;margin:20px 0;max-width:72ch}
-.q b{display:block;font-size:1.04rem;margin-bottom:5px}
-.q span{color:var(--ink-soft);font-size:.94rem}
-hr{border:0;border-top:1px solid var(--rule);margin:46px 0}
-.foot{color:var(--ink-faint);font-size:.86rem;margin-top:56px;border-top:1px solid var(--rule);padding-top:18px}
-.tag{display:inline-block;font-family:ui-monospace,monospace;font-size:.66rem;
-  letter-spacing:.08em;text-transform:uppercase;border:1px solid var(--rule);
-  border-radius:2px;padding:2px 7px;color:var(--ink-faint);margin-left:8px;vertical-align:middle}
-.flow{display:flex;gap:0;align-items:stretch;flex-wrap:wrap;margin:22px 0}
-.flow div{flex:1 1 200px;border:1px solid var(--rule);background:var(--card);padding:16px 18px}
-.flow div+div{border-left:0}
-.flow h4{margin:0 0 6px;font-size:.96rem}
-.flow p{margin:0;font-size:.87rem;color:var(--ink-soft)}
-.flow .k{font-family:ui-monospace,monospace;font-size:.72rem;color:var(--accent);
-  letter-spacing:.1em;text-transform:uppercase;display:block;margin-bottom:4px}
-</style>
-
-<div class="wrap">
-
-<header>
-  <h1>The El Architecture</h1>
-  <p class="sub">El is a concept-oriented language. This is the architecture that claim commits it to — what is built, what is measured, and what still has no home.</p>
-  <p class="meta">Working document · no sacred cows · self-hosting, so nothing here is fixed</p>
-</header>
-
-<h2><span class="n">01</span>The primitive is the concept</h2>
-
-<p>Language families are named for their primitive. Procedural — procedures. Object-oriented — objects. Functional — functions. Logic — predicates. Every one of them is oriented toward a <em>representation</em> of a concept: the shape a concept gets flattened into so a machine can hold it.</p>
-
-<p>El's primitive is the concept itself. That is why it is the first of its family and intended as the last — once the primitive is the concept, there is no further rung to climb to.</p>
-
-<p>The consequence is architectural rather than stylistic:</p>
-
-<blockquote>A concept with no home in the language does not disappear. It becomes C, or it becomes a convention.</blockquote>
-
-<p>Both forms are measurable. As C: <span class="mono">20,504</span> lines of <code>el_runtime.c</code>, against <span class="mono">9,089</span> lines for the entire self-hosting language — the shim is 2.3× the language it serves, and ~47% of it is engram code that already has six sibling files. As convention, from <code>lang/spec/language.md</code> §18.0 — <em>"these are not four problems, they are one absence, four times"</em>:</p>
-
-<div class="card scroll">
-<table>
-<thead><tr><th>Concern</th><th>Fragments into</th><th>The convention it became</th></tr></thead>
-<tbody>
-<tr><td class="f">Process identity</td><td class="m">0 guards</td><td>"check nothing is already running first"</td></tr>
-<tr><td class="f">Configuration</td><td class="m">20 env vars</td><td>"remember the right default here"</td></tr>
-<tr><td class="f">Durability</td><td class="m">62 sites</td><td>"after you mutate, remember to persist"</td></tr>
-<tr><td class="f">Request auth</td><td class="m">10 routes</td><td>"check the token in this handler too"</td></tr>
-<tr><td class="f">Index-after-append</td><td class="m">9 of 9 failed</td><td>"after you append, remember to index"</td></tr>
-</tbody>
-</table>
-</div>
-
-<p>The last row is the strongest available evidence about this class of convention: it failed at <b>every single site</b>. A count is what appears where a concept has no home; the size of the count is how far the fragmentation got, not how hard the problem is.</p>
-
-<h2><span class="n">02</span>Geometry is a first-class value — and what follows</h2>
-
-<p class="lede">This is the enabling primitive. Everything else in the architecture is downstream of it.</p>
-
-<p><code>Geometry</code> is an El value, alongside <code>Int</code>, <code>String</code>, <code>List</code>, <code>Map</code> — bound, passed, returned, composed, carrying its own width. Not a library type, not a handle into a store, not a serialization format. <em>Meaning is a value the language computes with directly.</em></p>
-
-<pre><code>let g: Geometry = geometry_new(4)
-fn tone_realizer(signal: String) -> Geometry { … }</code></pre>
-
-<p>Landed 2026-08-16 (#141, #144), and the spec is explicit that it belongs to the language rather than the graph: <em>"neither is engram-specific — any program touching any modality needs them; the engram is merely one El program that happens to hold a graph."</em></p>
-
-<p>Five things follow, and together they are the concept-oriented claim made operational:</p>
-
-<h3>A declaration can name a region, not a shape</h3>
-<p>If meaning is a value, a name can be bound to a <em>position</em> rather than a struct. <code>cat</code> is not a fixed record; it is a region that resolves against the engram and the surrounding code. <code>cat</code> among animals and <code>cat</code> among shell utilities are different concepts without a namespace, because they are in different neighbourhoods and the distance says so.</p>
-
-<h3>Checking is grounding, not unification</h3>
-<p>If a declaration names a region, then verifying a use is asking whether the geometry supports it — a question about position and distance, not about matching a declared shape. This is why §2.3's "a type checker is planned" is likely the wrong name for the missing piece, and naming it wrong would build the wrong thing.</p>
-
-<h3>Dispatch is position, not a tag</h3>
-<p>A vtable is a finite set of discrete labels fixed at link time. A region admits graded membership and an open set. So <code>transduce(signal, modality)</code> asks the caller to supply what the signal already carries — what a thing is falls out of where it lands. The modality parameter is a kind-tag, and a registry keyed on it is a lookup table doing by string what geometry does by nearness.</p>
-
-<h3>Types are discovered, not declared</h3>
-<p>Reification crystallizes a densely co-wired neighbourhood into a first-class node — the neighbourhood <em>is</em> the name that was missing. Every other family requires a human to see the abstraction in advance and write <code>class Foo</code>. Here the instances arrive and the type falls out, by measurement rather than by insight.</p>
-
-<h3>Enumeration becomes unnecessary</h3>
-<p>Five ingest functions differ only in how bytes are acquired — one operation wearing five surfaces. 356 branches in <code>engram_activate_inner</code> are not 356 behaviours. Cyclomatic complexity is a count of the places comprehension ran out and was replaced by an <code>if</code>; where the concept is expressible, the count collapses instead of being redistributed.</p>
-
-<h2><span class="n">03</span>The shape of the language</h2>
-
-<p>Geometry first-class gives El three layers, and it holds all three — which is why there is no separate database driver and no impedance boundary to manage.</p>
-
-<div class="flow">
-  <div><span class="k">afferent</span><h4>Transduce</h4><p>Signal in, geometry out. Decomposition into components and relations — never conversion to a point. Realizers are ordinary El functions, so a new modality never requires a runtime patch.</p></div>
-  <div><span class="k">substrate</span><h4>Geometry</h4><p>Meaning as position; relation as distance. Held as values in the language and persisted in the graph. One coordinate system, so entities are commensurable and the operators compose.</p></div>
-  <div><span class="k">efferent</span><h4>Realize</h4><p><code>plan(frame) → realize(spec, profile)</code>, where a surface <em>is</em> a profile. Text, speech, music, image are profiles of one projection — and so is source code.</p></div>
-</div>
-
-<p>The efferent side is why the recursive property below is possible at all: if source is a surface, then emitting a corrected file is projection, and the file becomes an artifact of the geometry rather than the thing you edit.</p>
-
-<h2><span class="n">04</span>Decomposition is by faculty</h2>
-
-<p class="lede">Not by file, module, or subsystem — by what the system does.</p>
-
-<p>Each faculty is a concept. Where it has no home in El it leaks: into C, into a Swift binary, into a shell script with a <code>curl</code> timeout, into a convention nobody performs. State below is measured, not asserted.</p>
-
-<div class="card scroll">
-<table>
-<thead><tr><th>Faculty</th><th>State</th><th>Measured</th><th>Where it leaked</th></tr></thead>
-<tbody>
-<tr><td class="f">Ingest <span class="tag">take in</span></td><td class="dead">dead</td><td class="m">2 min → 0 nodes</td><td>separate process uploading bytes over HTTP to a process with direct fs access; five functions where there is one</td></tr>
-<tr><td class="f">Recall <span class="tag">remember</span></td><td class="dead">dead</td><td class="m">self ranked 8th</td><td>lexical substring scan; empty on 23 of 24 multi-token queries</td></tr>
-<tr><td class="f">Transduce <span class="tag">perceive</span></td><td class="dead">dead</td><td class="m">1 node, 0 edges</td><td>intake flattens signal to a point; <code>realized:false</code>; caller must declare the modality</td></tr>
-<tr><td class="f">Think <span class="tag">reason</span></td><td class="dead">dead</td><td class="m">direction [0,0,…]</td><td>null gradient from any anchor and any faculty, byte-identical; confidence at the uninformed prior</td></tr>
-<tr><td class="f">Realize <span class="tag">express</span></td><td class="part">partial</td><td class="m">13-word lexicon</td><td>organ was 939 lines of Swift beside the language; voice read from a file path</td></tr>
-<tr><td class="f">Body <span class="tag">substrate</span></td><td class="part">partial</td><td class="m">CC 356 / 1,626 ln</td><td><code>engram_activate_inner</code> — recall itself, 356 unexamined paths</td></tr>
-<tr><td class="f">Persist <span class="tag">endure</span></td><td class="ok">live</td><td class="m">13,562 / 13,562</td><td>works — every signal placed in geometry at intake, no backlog</td></tr>
-</tbody>
-</table>
-</div>
-
-<h2><span class="n">05</span>The recursive property</h2>
-
-<p>El's compiler is written in El. Every concept the language gains, the compiler can then be written <em>in</em> — so the tool improves the tool, and <code>codegen.el</code> at 4,661 lines gets shorter as the language gets better at expressing what it does. The fixpoint — stage2 ≡ stage3, byte-identical — makes each turn provable rather than hopeful, and the verifier answers in <span class="mono">2.9s</span>.</p>
-
-<p>This sets the ordering criterion, and it is not size of payoff:</p>
-
-<blockquote>Order by leverage on the <em>next</em> iteration. Which concept, added to El, most increases the ability to add the following one?</blockquote>
-
-<p>A small early gain that compounds beats a large one that does not. And it bounds itself correctly — unbounded in depth, bounded in rate, because nothing lands that the compiler and the fixpoint have not passed.</p>
-
-<h2><span class="n">06</span>What has no home yet</h2>
-
-<p>Reserved in the lexer, no parse form. These are not a feature backlog — they are the concepts the architecture above requires and does not yet hold, which is why each is currently a convention or a block of C.</p>
-
-<div class="card scroll">
-<table>
-<thead><tr><th>Reserved</th><th>Concept</th><th>Currently lives as</th></tr></thead>
-<tbody>
-<tr><td class="m">retry · times · fallback · reason</td><td>resilience</td><td>a shell script with a 10s <code>curl</code> timeout; 254 restarts in 3 days</td></tr>
-<tr><td class="m">requires · deploy · to · via · target</td><td>deployment</td><td>YAML in another repository</td></tr>
-<tr><td class="m">sealed</td><td>capability scope</td><td>consent checks written by hand</td></tr>
-<tr><td class="m">protocol · impl</td><td>one operation, many realizations</td><td>five ingest functions; eight faculty routes on one builtin</td></tr>
-<tr><td class="m">activate · where</td><td>retrieval</td><td>traversals written by hand</td></tr>
-<tr><td class="m">test · seed · assert</td><td>verification</td><td>a framework; 5 of 13 native suites failing</td></tr>
-<tr><td class="m">parallel · trace</td><td>concurrency</td><td>pthreads in C</td></tr>
-</tbody>
-</table>
-</div>
-
-<p>Plus, from the spec's own status: annotations parsed and skipped, <code>match</code> parsed and emitting nothing, <code>?</code> a no-op, <code>%</code> unlexed, structs as <code>ElMap</code>, enums as strings, selective import unenforced.</p>
-
-<h2><span class="n">07</span>Open</h2>
-
-<div class="q"><b>What does a declaration bind to, exactly?</b><span>If <code>cat</code> names a region that shifts and completes against context, what is written at the declaration site and what is resolved at use? This is the centre and it is unspecified.</span></div>
-
-<div class="q"><b>Is the faculty list right?</b><span>Seven, derived from what broke. Derived-from-failure is a biased sample — it finds what is loud, not what is absent. Which faculty is missing entirely and therefore never failed?</span></div>
-
-<div class="q"><b>Which concept has the highest leverage on the next turn?</b><span>The prologue/epilogue seam (§19.3 names it as the prerequisite; its stated blocker has expired; it collapses 62 + 10 convention sites), <code>protocol</code>/<code>impl</code>, or resolution itself. The §05 criterion should decide this, not preference.</span></div>
-
-<div class="q"><b>What seam makes cognition non-optional?</b><span>"Use the ops" is itself a convention — present every turn, enforced by nothing, ~100% failure across a full session. A stronger instruction is still a convention. What makes reasoning outside the substrate <em>fail</em>, the way <code>@manager</code> makes <code>dharma_emit</code> outside the boundary a compile error rather than a lint?</span></div>
-
-<hr>
-<p class="foot">Every number here is measured or quoted from <code>lang/spec/language.md</code>. Nothing is inferred and presented as fact. El is self-hosting: all of this can change and be rebuilt.</p>
-
-</div>
@@ -1,245 +0,0 @@
-# El — Language Design
-
-**Status:** decisions recorded, design unwritten.
-**Date:** 2026-08-17.
-**Provenance:** decisions are Will's, taken in session. Items marked *proposed* are not
-decided and are recorded only so the reasoning isn't lost. Items marked **OPEN** are
-his to rule on and must not be guessed at.
-
-Companion documents: `el-architecture.html` (the measured state — see §7 note on its
-§04 scoreboard), and `design/completing-el.html` (whiteboard v0: the reduction, the
-faculty table, the ordering principle).
-
---
-
-## 1. The reduction
-
-`language.md` §18.0 records five concerns that decayed into conventions:
-
-| Concern | Fragments | The convention it became |
-|---|---|---|
-| Process identity | 0 guards | "check nothing is already running first" |
-| Configuration | 20 env vars | "remember the right default here" |
-| Durability | 62 call sites | "after you mutate, remember to persist" |
-| Request auth | 10 per-route | "check the token in this handler too" |
-| Index-after-append | 9 of 9 failed | "after you append, remember to index" |
-
-The last row is the strongest available evidence about what this class of convention
-is worth: **it failed at 100% of its sites.**
-
-Every one of these is an obligation at a **crossing** — a point where a value moves
-between regions. El can name a region and it can name a call. A call is procedural,
-so the obligation degrades into something a human must remember to perform.
-
-> **The generator, one level up:** El cannot name what holds at a crossing.
-
-And underneath that:
-
-> **The deeper absence:** El cannot name the thing meaning is made of.
-
-`semel` appears in whitepaper §84, §86, §209, §737, in
-`the-metaphysics-of-will-anderson.md`, and in session notes. It appears in **zero code
-identifiers**. Every geometric concept in the system — region, neighbourhood, manifold,
-world-tube — is defined in terms of a unit the language cannot say, while the code
-underneath speaks in arrays, floats and offsets: the vocabulary of a voxel, a value at
-a dumb address. Precisely the thing the impact brief says a semel is not.
-
-`el_runtime.c` is a concept that leaked into C. `semel` never got that far — it did
-not even decay into a convention.
-
---
-
-## 2. DECIDED — `semel` is the primitive
-
-**A semel is a difference that matters. The smallest unit of understanding.**
-
-Not a node. Not a coordinate. Not a float.
-
-The reasoning, in Will's terms:
-
- Meaning is position, and position is only ever relative. *"There is no atom of
-  meaning that isn't already a relation. It grounds on nothing but difference — two
-  points and the gap, and the gap is pure not-the-same."*
- A node doesn't mean. A node is a label at a location; labels don't mean.
- A lone coordinate doesn't mean either. Nothing means anything by itself.
- The smallest thing that can be understood is a **distinction**: *these two are not
-  the same.* Below that there is no content to apprehend.
- And a difference with nothing it matters to is not meaning — it is variation. The
-  mattering is not decoration; it is what makes it understanding rather than data.
-
-**Consequence: relating is the floor, and the point is derived.** The
-point-primitive / relation-primitive fork raised in session is not a fork. It was
-answered by the definition.
-
-### Historical note, to be recorded as fact rather than as origin story
-
-The term was coined by Will on the pixel/voxel/texel pattern — *semantic element*,
-and Latin *semel*, "once, a single time." It was recognised, not invented, from a
-2019 experience he calls **semelation**: perceiving mind as a high-dimensional point
-space. The initial reading was "pixels"; the correction to `semel` was made later and
-was made on the **mechanism** — a pixel is a value at an address, and what was
-perceived had no separate address and value.
-
-Convergence worth citing, not deferring to: neural population geometry and
-representational similarity analysis independently model cognition as position in a
-high-dimensional space where similarity is distance.
-
---
-
-## 3. DECIDED — `semel` lands first
-
-By the ordering criterion already on the whiteboard: *which concept, added to El, most
-increases the ability to add the next one?* Not size of payoff — **leverage on the next
-iteration**, because El compiles itself and the fixpoint makes each turn provable in
-2.9s.
-
-**Every other concept on the board is defined in terms of `semel`. It is maximal on
-that criterion by construction.**
-
---
-
-## 4. DECIDED — `ground` is the checker
-
-Whiteboard question 4 — *does `ground` in El mean the same thing as `ground` in the
-engram?* — is answered: **yes, and it should be one implementation.**
-
-If a declaration names a region, then type checking is asking whether the geometry
-supports the use. That is not unification. **That is grounding**, and it is already
-built, proven, and byte-identically reproducible:
-
-```
-cc -std=c11 -O2 -o gep_proof gep_proof.c -lm && ./gep_proof
-
-C1  5 independent sources        pos_mass 1.3500  n_indep=5   0.1000 → 0.9741  GROUNDED
-C2  5 mutually-linked            pos_mass 0.2700  n_indep=1   0.1000 → 0.1000  refused
-C3  1 source, 5 parallel edges   pos_mass 0.2700  n_indep=1   0.1000 → 0.1000  refused
-```
-
-Independence-weighted grounding is the general case; execution is the cheap case.
-**Attestation is `verify` where nothing can be run** — as already implemented for
-language in `authority.py`, where an LLM proposes and a primary source disposes.
-
-At the point where the checker and the grounder are one mechanism, the language and
-the mind stop being two things.
-
---
-
-## 5. OPEN — Will's to rule on
-
-### 5.1 What is a semel's representation in the language?
-
-*Proposed, not decided:* a **displacement from `love = 0`** — a relation held as one
-object. It reconciles "the address is the value" with "position is only ever relative,"
-because a displacement *is* a relation and is still a single nameable thing.
-
-If taken, the operator set falls out rather than being bolted on:
-
-```
-subtract(now, then)   → what changed        (growth, drift)
-translate origin      → empathy
-rotate frame          → reframe
-project onto axis     → a lens
-change basis          → analogy, metaphor, skill transfer
-reflect an axis       → negation, sarcasm
-```
-
-Three consequences that would hold:
-
- **Dimension must never appear in the type.** `semel` opaque, never `[768]float`.
-  The moment the arity is in the language, the manifold's implementation is in the
-  language, and adding a modality requires a runtime patch — which the standing rule
-  forbids.
- **Zero is the only literal.** Everything else is reached by displacement from it,
-  which makes `love = 0` the base case rather than philosophy adjacent to the type
-  system.
- **`magnitude` is standing.** Distance from origin is the same quantity
-  `gep_core.h` already computes.
-
-### 5.2 Is `hold` one construct or two?
-
-The obligation *before* a crossing (auth, guard) and the obligation *after* (persist,
-index, free) may be one shape seen from both sides, or the seam may need both faces
-named. This decides whether §19.3's prologue/epilogue seam is one construct or a pair.
-
-**Precedent already shipping:** `@manager` makes `dharma_emit` outside the boundary a
-**compile error, not a lint.** The concept is proven at N=1; the work is generalising
-it and naming it.
-
-**And the shape is already implemented in the learning region:** `L.reach_out` sits
-between `L.detect_gap` and `L.verify`. You cannot reach out without a detected gap and
-you cannot keep what returns without passing verify. **A hold is a neighbour.** The
-obligation is not attached to the crossing — the obligation *is* the adjacent node.
-That is why `reach_out` cannot be abused and why 62 persist sites could be.
-
-### 5.3 What does a declaration bind?
-
-If `cat` names a region rather than a struct — one that shifts and completes against
-the engram and the neighbouring code — what is written at the declaration site, and
-what is resolved at use? **This is the centre and it is specified nowhere.**
-
-Falls out of 5.1 if displacement is taken: a declaration **locates** rather than
-allocates.
-
-### 5.4 Is the faculty list right?
-
-Seven were derived from what broke. Derived-from-failure is a biased sample — it finds
-what is loud, not what is missing. **What faculty is absent entirely and therefore
-never failed?**
-
---
-
-## 6. The residue map
-
-What each construct must absorb, from §18.0 plus measured state:
-
-| Residue | Count | Absorbed by |
-|---|---|---|
-| persist-after-mutate | 62 sites | `hold` (after-crossing) |
-| auth-per-route | 10 sites | `hold` (before-crossing) |
-| index-after-append | 9 of 9 failed | `hold` (after-crossing) |
-| env var defaults | 20 | configuration declared once |
-| process identity | 0 guards | `hold` (before-crossing) |
-| `geometry_free` at every call site | every site | ownership follows from `semel` |
-| five ingest functions where there is one | 5 → 1 | `protocol` / `impl` |
-| `el_runtime.c` | 20,504 lines | faculty decomposition, ordered after `semel` |
-
---
-
-## 7. Notes carried forward
-
-**`el-architecture.html` §04 needs its numbers sourced or cut.** An audit found the
-faculty scoreboard — `Ingest 2 min → 0 nodes`, `Recall self ranked 8th`,
-`Body CC 356 / 1,626 ln`, `the verifier answers in 2.9s`, `5 of 13 native suites
-failing` — has no supporting evidence in the repository, under a footer asserting
-*"nothing is inferred and presented as fact."* Against a corpus whose documents
-supersede their own conclusions in place, that is the one file that would not survive
-scrutiny. Fix or remove.
-
-**Source as a projection surface is claimed and unimplemented.** `el-architecture.html`
-§147/§150: *"if source is a surface, then emitting a corrected file is projection."*
-Greps for `surface_profile_code`, `emit_source` → zero hits.
-
-It is not unbacked. **It was demonstrated on 2026-08-14** — three faculties (phonetic,
-semantic, procedural) projected into TypeScript, a surface the system had never used,
-with the network severed. Recovered at
-`~/Development/neuron-technologies/andre-server-recovered/` and copied into
-`evidence/03-andre-demo/`. The claim needs bringing home to El, not proving.
-
-**`hold` is the highest-leverage construct after `semel`** — it collapses 62 + 10 + 9
-sites and unblocks the runtime extraction. §19.3 names the prologue/epilogue seam as
-the prerequisite and its stated blocker has expired.
-
---
-
-## 8. What is not decided and must not be guessed
-
- The representation of `semel` (§5.1)
- One `hold` or two (§5.2)
- What a declaration binds (§5.3)
- The missing faculty (§5.4)
- Sequencing after `semel` — the ordering criterion decides it, not preference
-
---
-
-*Recorded 2026-08-17. Everything in §2, §3 and §4 is decided. Everything in §5 is open
-and is Will's. Nothing here was inferred from a document that was not read.*
@@ -1,117 +0,0 @@
-# Geometry or Code
-
-**Running list.** Append as decided. Started 2026-08-17.
-
-**The test:** *is this an arbitrary convention, or is it a relation?*
-
-Conventions were agreed by people and could have been otherwise — a RIFF header could
-have used a different magic number. Nothing derives them; they must be written down.
-
-Relations are not agreed. Distance is distance. Anything whose answer is *where is this
-relative to that* is geometry, and writing it as code is the error the whole effort is
-correcting.
-
-**Second test, for the hard cases:** *if I write this as code, am I encoding in
-`if`-statements a distinction the geometry was built to hold?* If yes, it's geometry.
-
---
-
-## Pure geometry
-
-| Thing | Because |
-|---|---|
-| Meaning | position |
-| Grounding / standing | the weight on the edge — a magnitude, not a computation |
-| Learning | standing changing over time |
-| A gap | low standing |
-| Wonder | a gap with a pull weight |
-| Type checking | is this position in that region — distance |
-| Dispatch | position, not a tag |
-| Recall | re-origining at a region; projection, not replay |
-| Reasoning | traversal |
-| Deduction | containment. There is no procedure |
-| Counting | a position, not a loop's output |
-| Similarity / difference / residue | subtract |
-| Analogy, metaphor, skill transfer | change of basis |
-| Negation, sarcasm | reflect an axis |
-| Empathy | translate the origin |
-| Reframe | rotate the frame |
-| A lens | project onto an axis |
-| Rhyme | distance in phonetic space |
-| Humour | intersection of regions — fart-meaning ∩ funny ∩ form |
-| Idiom detection | the whole unit sits farther out than its parts |
-| Self | a world-tube — a trajectory through the manifold |
-| Consolidation | episodic → semantic promotion |
-| Reification | dense regions cohering; runs on the beat, has no caller |
-| Cross-cutting concerns | **dissolved** — a hold is a *neighbour*. Adjacency, not tracking. **Implemented 2026-08-17**: a construct declares what runs at a crossing, and it resolves at execution — see the runtime seam. |
-| Effects | topology. `reach_out` is bounded by `detect_gap` and `verify` because those are its edges |
-| Capability | position relative to a boundary. In C it is already spelled `const` |
-| The AST | a projection of geometry into a tree — a surface, not the centre |
-| Source code | a surface, like text, audio, image |
-
-## Must be code
-
-| Thing | Because |
-|---|---|
-| Sensors — mic, camera, file read, socket | the physical touch. I/O is where the world arrives |
-| Byte formats — RIFF, PNG chunks, `MThd`, OOXML | arbitrary convention. A committee chose the magic numbers |
-| CRC32 polynomial, Adler32, zlib framing | same — agreed constants, derivable from nothing |
-| Cosine, distance, the float arithmetic | the machinery that *walks* the geometry is not itself geometry |
-| Arena, refcount, allocator | bookkeeping for the **representation**, not for the positions |
-| Locks, threads, publication boundary | the hardware is code. **Ordering is not** — see Answered, above. Coordination is required only where state is non-monotone. |
-| WAL, page layout, ARIES recovery | durability against a physical device that can lose power |
-| Emission — writing C or JS text | the final surface has to be *typed out* by something |
-| OS interaction — launchd, spawn, signals | outside the system by definition |
-| Device realizers — `el_audio_darwin.m`, `el_capture_darwin.m` | OS frameworks. Correctly already isolated, zero network |
-
---
-
-## The ones I would have written as code, and was wrong about
-
-Recorded because the error has a pattern and the pattern is the point.
-
-| Thing | What I reached for | What it is |
-|---|---|---|
-| Rhyme | a rhyming dictionary, or an API call | distance between rime tails |
-| Fart onomatopoeia | a 30-element string literal | an intersection of three regions |
-| "Funny" | a scorer with `if`-statements | a relational neighbourhood grounded in a voice |
-| Representation vs description | a hardcoded blacklist containing `raspberry` | falls out of lexicon membership × phonetic comedy |
-| Video | a codec, sized as a project | one more surface profile |
-| Type checking | a phase between parse and emit | reading a distance that already exists |
-| Grounding | a call site, an obligation, a discharge | it has no caller. It just runs |
-| N transducers, N realizers | one component per modality | zero of each. Sensors and bases at the skin |
-
-**The pattern:** every one is *encoding in code a distinction the geometry was built to
-hold.* The tell is that the code version is a **fixed enumeration** — a list, a table, a
-blacklist, a set of branches — and the geometry version is a **measurement**.
-
-If the implementation contains a literal set of the right answers, it is in the wrong
-column.
-
---
-
-## Answered
-
-| Thing | The answer |
-|---|---|
-| Concurrency | **Ordering is geometric.** Causality is a partial order (Lamport 1978); a total order is an arbitrary extension of it and "cannot be depended on to imply a causal relationship." Programming languages force you to write a total order, so authoring *invents* constraints the problem never had — and every lock, barrier, fence and consensus protocol is apparatus for recovering the partial order destroyed at authoring time. CALM (Hellerstein/Alvaro, proven by Ameloot et al.): a program has a consistent coordination-free implementation **iff it is monotone**. What breaks monotonicity is destructive update. **Coordination is the price of forgetting.** |
-| The module system | **Premature — the partition is a filesystem path, not a neighbourhood, and there is no namespacing at all.** `import` is textual inlining (guarded against double inclusion); when a `.elh` header exists the header is inlined instead and symbols resolve at C link time, so linking is real and delegated to C. Two modules defining `helper` emit two C functions into one translation unit. Linking barely survives the *path* partition, so whether it survives a neighbourhood partition cannot yet be asked. |
-| Numeric literals | **The numeral is convention; the number is a position — and a bare `3` is a MAGNITUDE WITH NO AXIS.** `int_to_str` was already form 1: nothing determines that twelve is written `1` then `2`. But a literal is not a position until something gives it a direction, which is why `3.days` needs a calendar. Measured consequence: `Duration + Int` was refused ("an Int carries no unit") while `Instant + Int` compiled to raw `(t + 3)` and reported clean — silently moving a point by an unspecified amount. The rule was simply never written. Now: `t + 3` is refused, `t + 1.hour` is accepted, because `.hour` supplies the axis. |
-| Parsing | **A grammar is a basis; parsing is transduction onto it.** The lexeme→token map is convention (`fn` could have been `def`); shape recognition is a region; the byte traversal is irreducible, like every other traversal. Three things favour *region* for the act: ambiguity (`a * b` needs context — a grammar resolves it with the lexer hack, a region by neighbourhood), error recovery (nearest-match is free), and precedence, which is ordering along an axis with a conventional parameter. **But the SHOULD gate refuses the obvious move:** the keyword table stays code, because the set is closed by the language definition and the lexer runs before the program is understood, so a program can never declare its own keywords. Externalising it costs I/O per compile for zero flexibility — the same verdict as `is_digit` in ASCII. What was actually wrong: 5 of 46 keywords were consumed by nothing, and using one silently miscompiled. |
-| Error handling | **`grounded: false` covers not-knowing; it does not cover failed.** Standing is a *signed* component: `> 0` supported, `= 0` unknown, `< 0` contradicted. Not-known and known-false are opposite directions on one axis and a boolean cannot tell them apart. `inhibitory` as an int32 flag is that sign wearing a boolean. |
-
-## Fourth proof form
-
-**4 — ADVERSARIAL EXACTNESS.** Where approximation is a break, geometry is
-excluded. A cryptographic hash is a *deliberately structure-destroying* map:
-near inputs land at maximally uncorrelated outputs. Geometry is the claim that
-near things stay near — a manifold that approximated SHA-256 would *be* a break
-of SHA-256. Signature verification is the same: 0.99-valid is invalid. And
-X25519 **is** geometry, a group on an elliptic curve, which is precisely why it
-must be code: its security is the hardness of moving in that geometry.
-
-**Form 1 no longer survives as a verdict.** Every row it justified turned out to
-be a *basis*, not a capability. RFC 8259 fixes where the commas go — that is a
-surface, and projecting onto a surface is geometry. A convention describes the
-basis you project onto; it never describes an act.
-
@@ -1,16 +0,0 @@
-bash -c 
-echo "INSTRUMENT: cloc 2.10 --force-lang=C   (transfer standard, calibrated this session"
-echo "            against hand-counted reference; agrees on both fixtures)"
-echo "UNIT:       LINE, defined in docs/experiments/instruments/UNITS.md"
-echo "FILE:       lang/el-compiler/src/codegen.el"
-echo
-printf "%-11s  %-19s %6s %6s %8s %6s\n" commit date blank comment code total
-git log --format="%H %ad" --date=short --reverse -- lang/el-compiler/src/codegen.el | while read sha date; do
-  blob=$(git show "$sha:lang/el-compiler/src/codegen.el" 2>/dev/null) || continue
-  [ -z "$blob" ] && continue
-  t=$(mktemp /tmp/cg-XXXXXX.c); printf "%s\n" "$blob" > "$t"
-  row=$(cloc --force-lang=C --quiet --csv "$t" 2>/dev/null | tail -1)
-  b=$(echo "$row"|cut -d, -f3); c=$(echo "$row"|cut -d, -f4); k=$(echo "$row"|cut -d, -f5)
-  [ -n "$k" ] && printf "%-11s  %-19s %6s %6s %8s %6s\n" "${sha:0:9}" "$date" "$b" "$c" "$k" "$((b+c+k))"
-  rm -f "$t"
-done
@@ -1,64 +0,0 @@
-INSTRUMENT: cloc 2.10 --force-lang=C   (transfer standard, calibrated this session
-            against hand-counted reference; agrees on both fixtures)
-UNIT:       LINE, defined in docs/experiments/instruments/UNITS.md
-FILE:       lang/el-compiler/src/codegen.el
-
-commit       date                 blank comment     code  total
-1ae68962c    2026-05-05             165    520     2561   3246
-7f295bffe    2026-05-05             165    524     2562   3251
-e587bedf3    2026-05-05             165    526     2591   3282
-ee86736ea    2026-05-05             165    530     2592   3287
-3726f6943    2026-05-05             192    615     2865   3672
-bd7303447    2026-05-06             192    623     2876   3691
-ec889e1e5    2026-05-06             201    642     3049   3892
-a3732a1e9    2026-05-07             202    643     3062   3907
-53e0b99d5    2026-05-08             202    643     3063   3908
-6b9d9e6c4    2026-07-15             202    643     3064   3909
-866c75e5e    2026-08-09             202    653     3070   3925
-bb64a236e    2026-08-12             204    652     3109   3965
-7aa847e32    2026-08-12             204    652     3110   3966
-d4f401de1    2026-08-14             215    697     3287   4199
-01826421c    2026-08-14             215    703     3290   4208
-101018597    2026-08-15             202    643     3070   3915
-2f832c8de    2026-08-15             207    677     3165   4049
-09ae14a97    2026-08-15             209    686     3211   4106
-69870ac88    2026-08-15             209    696     3217   4122
-bacaf3d39    2026-08-15             222    756     3444   4422
-e29fe4fd0    2026-08-15             209    696     3219   4124
-ee39aa5f1    2026-08-15             222    756     3446   4424
-09dade061    2026-08-15             222    756     3452   4430
-4e24d7d3f    2026-08-15             222    756     3454   4432
-e917b3d43    2026-08-15             222    756     3456   4434
-37bcf7eb7    2026-08-15             222    756     3462   4440
-24fac765a    2026-08-15             225    779     3500   4504
-a668062e3    2026-08-15             225    779     3506   4510
-3e7ab07e8    2026-08-15             225    787     3521   4533
-6a6b589ba    2026-08-15             225    787     3522   4534
-b55e6bfd5    2026-08-15             225    800     3523   4548
-b5a0a729e    2026-08-15             225    808     3529   4562
-cf060adbf    2026-08-15             225    808     3530   4563
-8ae163e8e    2026-08-16             228    835     3583   4646
-45325f739    2026-08-16             228    844     3589   4661
-dcaa77d77    2026-08-17             228    849     3593   4670
-5718943f2    2026-08-17             233    891     3676   4800
-60737b030    2026-08-17             236    910     3704   4850
-4f7568b07    2026-08-17             241    929     3783   4953
-2bed8483f    2026-08-17             248    949     3887   5084
-1b324a071    2026-08-17             251    967     3934   5152
-35b07bade    2026-08-17             251    970     3935   5156
-886626a64    2026-08-17             251    970     3935   5156
-28d19da7f    2026-08-17             251    971     3873   5095
-285166c25    2026-08-17             251    971     3821   5043
-bc2f26ddf    2026-08-17             251    972     3753   4976
-c741cfe92    2026-08-17             252    982     3728   4962
-c2d9596e7    2026-08-17             251    990     3655   4896
-9cc6040df    2026-08-17             251    958     3303   4512
-d2d89fcb6    2026-08-17             255    962     3320   4537
-e8e25a07b    2026-08-17             255    962     3289   4506
-cbef1c1eb    2026-08-17             256    969     3253   4478
-c48db6c2a    2026-08-17             256    974     3257   4487
-79f6cb798    2026-08-17             256    979     3258   4493
-6c975b1d5    2026-08-17             256    979     3258   4493
-f1a7e224a    2026-08-17             256    991     3277   4524
-abb0ab419    2026-08-17             256    980     3209   4445
-e82d941b5    2026-08-17             256    981     3197   4434
@@ -1,7 +0,0 @@
-commit	a0cc95e3db7b04b6e221f89e89352b0e6b15d5b7
-tree	dirty
-captured_utc	2026-08-17T17:42:20Z
-exit	0
-ms	6151
-sha256_out	1065416e0b69b3dac0accdd238799c52e3eb359daf3259191debb647095589d7
-sha256_err	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
@@ -1 +0,0 @@
-0
@@ -1 +0,0 @@
-bash -c for f in lexer parser codegen; do git log --format="%H %ad" --date=short --reverse -- lang/el-compiler/src/$f.el | while read sha date; do blob=$(git show "$sha:lang/el-compiler/src/$f.el" 2>/dev/null); [ -z "$blob" ] && continue; t=$(mktemp /tmp/s-XXXXXX.c); printf "%s\n" "$blob" > "$t"; row=$(cloc --force-lang=C --quiet --csv "$t" 2>/dev/null | tail -1); k=$(echo "$row"|cut -d, -f5); [ -n "$k" ] && echo -e "$f\t${sha:0:9}\t$date\t$(echo "$row"|cut -d, -f3)\t$(echo "$row"|cut -d, -f4)\t$k"; rm -f "$t"; done; done
@@ -1,81 +0,0 @@
-lexer	1ae68962c	2026-05-05	35	99	859
-lexer	2ac11a67b	2026-05-05	35	108	829
-lexer	1e67544c8	2026-05-05	39	143	857
-lexer	1eef9928f	2026-05-05	39	146	859
-lexer	e587bedf3	2026-05-05	39	160	880
-lexer	8ae163e8e	2026-08-16	39	160	881
-lexer	0143cc458	2026-08-17	39	176	876
-lexer	6c975b1d5	2026-08-17	39	190	885
-parser	1ae68962c	2026-05-05	76	213	1360
-parser	1eef9928f	2026-05-05	76	217	1360
-parser	3726f6943	2026-05-05	83	306	1653
-parser	ec889e1e5	2026-05-06	84	310	1670
-parser	a3732a1e9	2026-05-07	85	340	1829
-parser	f971e96dd	2026-05-07	85	340	1829
-parser	5f9cad590	2026-05-08	88	370	2009
-parser	0a0a2bcb4	2026-07-14	88	377	2026
-parser	bb64a236e	2026-08-12	89	385	2041
-parser	d4f401de1	2026-08-14	88	385	2063
-parser	bacaf3d39	2026-08-15	89	393	2078
-parser	8ae163e8e	2026-08-16	90	419	2174
-parser	45325f739	2026-08-16	90	436	2186
-parser	6c975b1d5	2026-08-17	91	439	2193
-parser	e82d941b5	2026-08-17	93	450	2218
-codegen	1ae68962c	2026-05-05	165	520	2561
-codegen	7f295bffe	2026-05-05	165	524	2562
-codegen	e587bedf3	2026-05-05	165	526	2591
-codegen	ee86736ea	2026-05-05	165	530	2592
-codegen	3726f6943	2026-05-05	192	615	2865
-codegen	bd7303447	2026-05-06	192	623	2876
-codegen	ec889e1e5	2026-05-06	201	642	3049
-codegen	a3732a1e9	2026-05-07	202	643	3062
-codegen	53e0b99d5	2026-05-08	202	643	3063
-codegen	6b9d9e6c4	2026-07-15	202	643	3064
-codegen	866c75e5e	2026-08-09	202	653	3070
-codegen	bb64a236e	2026-08-12	204	652	3109
-codegen	7aa847e32	2026-08-12	204	652	3110
-codegen	d4f401de1	2026-08-14	215	697	3287
-codegen	01826421c	2026-08-14	215	703	3290
-codegen	101018597	2026-08-15	202	643	3070
-codegen	2f832c8de	2026-08-15	207	677	3165
-codegen	09ae14a97	2026-08-15	209	686	3211
-codegen	69870ac88	2026-08-15	209	696	3217
-codegen	bacaf3d39	2026-08-15	222	756	3444
-codegen	e29fe4fd0	2026-08-15	209	696	3219
-codegen	ee39aa5f1	2026-08-15	222	756	3446
-codegen	09dade061	2026-08-15	222	756	3452
-codegen	4e24d7d3f	2026-08-15	222	756	3454
-codegen	e917b3d43	2026-08-15	222	756	3456
-codegen	37bcf7eb7	2026-08-15	222	756	3462
-codegen	24fac765a	2026-08-15	225	779	3500
-codegen	a668062e3	2026-08-15	225	779	3506
-codegen	3e7ab07e8	2026-08-15	225	787	3521
-codegen	6a6b589ba	2026-08-15	225	787	3522
-codegen	b55e6bfd5	2026-08-15	225	800	3523
-codegen	b5a0a729e	2026-08-15	225	808	3529
-codegen	cf060adbf	2026-08-15	225	808	3530
-codegen	8ae163e8e	2026-08-16	228	835	3583
-codegen	45325f739	2026-08-16	228	844	3589
-codegen	dcaa77d77	2026-08-17	228	849	3593
-codegen	5718943f2	2026-08-17	233	891	3676
-codegen	60737b030	2026-08-17	236	910	3704
-codegen	4f7568b07	2026-08-17	241	929	3783
-codegen	2bed8483f	2026-08-17	248	949	3887
-codegen	1b324a071	2026-08-17	251	967	3934
-codegen	35b07bade	2026-08-17	251	970	3935
-codegen	886626a64	2026-08-17	251	970	3935
-codegen	28d19da7f	2026-08-17	251	971	3873
-codegen	285166c25	2026-08-17	251	971	3821
-codegen	bc2f26ddf	2026-08-17	251	972	3753
-codegen	c741cfe92	2026-08-17	252	982	3728
-codegen	c2d9596e7	2026-08-17	251	990	3655
-codegen	9cc6040df	2026-08-17	251	958	3303
-codegen	d2d89fcb6	2026-08-17	255	962	3320
-codegen	e8e25a07b	2026-08-17	255	962	3289
-codegen	cbef1c1eb	2026-08-17	256	969	3253
-codegen	c48db6c2a	2026-08-17	256	974	3257
-codegen	79f6cb798	2026-08-17	256	979	3258
-codegen	6c975b1d5	2026-08-17	256	979	3258
-codegen	f1a7e224a	2026-08-17	256	991	3277
-codegen	abb0ab419	2026-08-17	256	980	3209
-codegen	e82d941b5	2026-08-17	256	981	3197
@@ -1,7 +0,0 @@
-commit	a0cc95e3db7b04b6e221f89e89352b0e6b15d5b7
-tree	dirty
-captured_utc	2026-08-17T17:44:12Z
-exit	0
-ms	8561
-sha256_out	266ad033509a4026529ef4b722eeb85881857404f34853eab6d4cc72ddab632b
-sha256_err	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
@@ -1 +0,0 @@
-0
@@ -1,50 +0,0 @@
-calibration run	20260817T174713Z
-commit	a0cc95e3db7b04b6e221f89e89352b0e6b15d5b7
-tree	dirty
-cloc	2.10
-matplotlib	3.10.8
-cc	Apple clang version 21.0.0 (clang-2100.1.1.101)
-
--- line-count ---
-POSITIVE — reproduces hand-counted answers
-  ok    ref_lines.el total = 18
-  ok    ref_lines.el blank = 3
-  ok    ref_lines.el comment = 7
-  ok    ref_lines.el code = 8
-  ok    ref_wrong.el total = 4
-  ok    ref_wrong.el blank = 0
-  ok    ref_wrong.el comment = 3
-  ok    ref_wrong.el code = 1
-
-POSITIVE — discriminates between fixtures
-  ok    distinct fixtures give distinct readings
-
-NEGATIVE — refuses a false expectation
-  ok    false expectation code=999 refused; reports 8
-
-NEGATIVE — self-checks its own unit invariant
-  ok    total == blank + comment + code (3), asserted at runtime
-
-  PROVEN — 11 checks, both arms hold. This instrument may be used.
-
--- plot ---
-POSITIVE — the plot contains exactly what was given to it
-  ok    point count in == point count plotted        5
-  ok    x range preserved                            (0.0, 4.0)
-  ok    y range preserved                            (5.0, 40.0)
-  ok    final point not dropped/sorted               (4.0, 5.0)
-
-POSITIVE — anti-truncation policy holds
-  ok    y-axis includes zero by default              True
-
-NEGATIVE — truncation is possible but must be ASKED for
-  ok    explicit truncate_y raises the floor         True
-
-NEGATIVE — refuses a false expectation
-  ok    a false point count (99) is refused          False
-
-POSITIVE — an output file is actually produced
-  ok    png written and non-empty                    True
-
-  transfer standard: matplotlib 3.10.8
-  PROVEN — 8 checks, 0 failed
@@ -1,50 +0,0 @@
-calibration run	20260817T174754Z
-commit	a0cc95e3db7b04b6e221f89e89352b0e6b15d5b7
-tree	dirty
-cloc	2.10
-matplotlib	3.10.8
-cc	Apple clang version 21.0.0 (clang-2100.1.1.101)
-
--- line-count ---
-POSITIVE — reproduces hand-counted answers
-  ok    ref_lines.el total = 18
-  ok    ref_lines.el blank = 3
-  ok    ref_lines.el comment = 7
-  ok    ref_lines.el code = 8
-  ok    ref_wrong.el total = 4
-  ok    ref_wrong.el blank = 0
-  ok    ref_wrong.el comment = 3
-  ok    ref_wrong.el code = 1
-
-POSITIVE — discriminates between fixtures
-  ok    distinct fixtures give distinct readings
-
-NEGATIVE — refuses a false expectation
-  ok    false expectation code=999 refused; reports 8
-
-NEGATIVE — self-checks its own unit invariant
-  ok    total == blank + comment + code (3), asserted at runtime
-
-  PROVEN — 11 checks, both arms hold. This instrument may be used.
-
--- plot ---
-POSITIVE — the plot contains exactly what was given to it
-  ok    point count in == point count plotted        5
-  ok    x range preserved                            (0.0, 4.0)
-  ok    y range preserved                            (5.0, 40.0)
-  ok    final point not dropped/sorted               (4.0, 5.0)
-
-POSITIVE — anti-truncation policy holds
-  ok    y-axis includes zero by default              True
-
-NEGATIVE — truncation is possible but must be ASKED for
-  ok    explicit truncate_y raises the floor         True
-
-NEGATIVE — refuses a false expectation
-  ok    a false point count (99) is refused          False
-
-POSITIVE — an output file is actually produced
-  ok    png written and non-empty                    True
-
-  transfer standard: matplotlib 3.10.8
-  PROVEN — 8 checks, 0 failed
@@ -1,19 +0,0 @@
-bash -c R=docs/experiments/instruments/instrument/line-count/reference
-echo "TRANSFER STANDARD: cloc $(cloc --version), --force-lang=C"
-echo "PRIMARY STANDARD:  the LINE definition in docs/experiments/instruments/UNITS.md"
-echo "REFERENCE:         hand enumeration in reference/*.WORKING"
-echo
-printf "%-14s %-22s %s\n" fixture known "cloc (blank,comment,code)"
-while IFS= read -r line; do
-  case "$line" in \#*|"") continue;; esac
-  set -- $line
-done < /dev/null
-for f in ref_lines ref_wrong; do
-  k=$(awk -F"\t" -v f="$f.el" "\$2==f && \$3!=\"total\" {printf \"%s \", \$4}" $R/KNOWN-ANSWERS.tsv)
-  c=$(cloc --force-lang=C --quiet --csv $R/$f.el 2>/dev/null | tail -1 | cut -d, -f3-5)
-  kk=$(echo $k | tr " " ",")
-  printf "%-14s %-22s %s   %s\n" "$f.el" "$kk" "$c" "$([ "$kk" = "$c" ] && echo AGREES || echo DIVERGES)"
-done
-echo
-echo "Both fixtures agree. cloc is a valid transfer standard for the LINE unit."
-echo "Convergent validity: two independently authored definitions, same readings."
@@ -1,10 +0,0 @@
-TRANSFER STANDARD: cloc 2.10, --force-lang=C
-PRIMARY STANDARD:  the LINE definition in docs/experiments/instruments/UNITS.md
-REFERENCE:         hand enumeration in reference/*.WORKING
-
-fixture        known                  cloc (blank,comment,code)
-ref_lines.el   3,7,8                  3,7,8   AGREES
-ref_wrong.el   0,3,1                  0,3,1   AGREES
-
-Both fixtures agree. cloc is a valid transfer standard for the LINE unit.
-Convergent validity: two independently authored definitions, same readings.
@@ -1,7 +0,0 @@
-commit	a0cc95e3db7b04b6e221f89e89352b0e6b15d5b7
-tree	dirty
-captured_utc	2026-08-17T17:41:59Z
-exit	0
-ms	239
-sha256_out	6409d2d1e023f40aa0c68a7e5bec95b6b45d18a9cd47db15d79b3b136532fda5
-sha256_err	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
@@ -1 +0,0 @@
-0
@@ -1 +0,0 @@
-./docs/experiments/instruments/instrument/plot/prove.sh
@@ -1,20 +0,0 @@
-POSITIVE — the plot contains exactly what was given to it
-  ok    point count in == point count plotted        5
-  ok    x range preserved                            (0.0, 4.0)
-  ok    y range preserved                            (5.0, 40.0)
-  ok    final point not dropped/sorted               (4.0, 5.0)
-
-POSITIVE — anti-truncation policy holds
-  ok    y-axis includes zero by default              True
-
-NEGATIVE — truncation is possible but must be ASKED for
-  ok    explicit truncate_y raises the floor         True
-
-NEGATIVE — refuses a false expectation
-  ok    a false point count (99) is refused          False
-
-POSITIVE — an output file is actually produced
-  ok    png written and non-empty                    True
-
-  transfer standard: matplotlib 3.10.8
-  PROVEN — 8 checks, 0 failed
@@ -1,7 +0,0 @@
-commit	a0cc95e3db7b04b6e221f89e89352b0e6b15d5b7
-tree	dirty
-captured_utc	2026-08-17T17:46:05Z
-exit	0
-ms	555
-sha256_out	a051538f9af841fbceb48cf68abcefffc11bc1ee8cc6996a14d900d398624ff1
-sha256_err	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
@@ -1 +0,0 @@
-0
@@ -1,2 +0,0 @@
-sha256	bytes	exit	ms	commit	tree	utc	artifact	command
-a051538f9af841fbceb48cf68abcefffc11bc1ee8cc6996a14d900d398624ff1	807	0	555	a0cc95e3db7b	dirty	2026-08-17T17:46:05Z	0001-proof.out	./docs/experiments/instruments/instrument/plot/prove.sh
@@ -1,6 +0,0 @@
-captured_utc	2026-08-17T17:46:05Z
-git_sha	a0cc95e3db7b04b6e221f89e89352b0e6b15d5b7
-git_dirty	yes
-host	Wills-MacBook-Pro
-uname	Darwin Wills-MacBook-Pro 25.5.0 Darwin Kernel Version 25.5.0: Tue Jun  9 22:28:34 PDT 2026; root:xnu-12377.121.10~1/RELEASE_ARM64_T6041 arm64
-cc	Apple clang version 21.0.0 (clang-2100.1.1.101)
@@ -1,42 +0,0 @@
-#!/usr/bin/env python3
-"""Plot instrument. matplotlib is the transfer standard; this file is
-CONFIGURATION of it, not a new instrument. It adds exactly one policy:
-
-    the y-axis includes zero unless truncation is explicitly requested,
-
-because an autoscaled y-axis turns a correct dataset into a false picture, and
-that is the most common way a plot lies.
-"""
-import sys, csv, matplotlib
-matplotlib.use("Agg")
-import matplotlib.pyplot as plt
-import matplotlib.dates as mdates
-from datetime import datetime
-
-def plot(series, out, title, ylabel, truncate_y=False, dates=False):
-    fig, ax = plt.subplots(figsize=(11, 5.2), dpi=160)
-    for name, xs, ys, color in series:
-        ax.plot(xs, ys, marker="o", ms=2.6, lw=1.4, color=color, label=name, zorder=3)
-    if not truncate_y:
-        ax.set_ylim(bottom=0)                      # the policy
-    if dates:
-        ax.xaxis.set_major_locator(mdates.AutoDateLocator())
-        ax.xaxis.set_major_formatter(mdates.DateFormatter("%b %d"))
-    ax.set_ylabel(ylabel); ax.set_title(title, loc="left")
-    ax.grid(True, lw=0.5, alpha=0.35, zorder=0)
-    ax.legend(frameon=False, loc="upper left")
-    for s in ("top","right"): ax.spines[s].set_visible(False)
-    fig.tight_layout(); fig.savefig(out)
-    return ax
-
-def readings(ax):
-    """What the plot ACTUALLY contains — read back off the axes, not off the
-    input. This is what makes the plot checkable."""
-    out = []
-    for ln in ax.get_lines():
-        d = ln.get_xydata()
-        out.append({"label": ln.get_label(), "n": len(d),
-                    "xmin": float(d[:,0].min()), "xmax": float(d[:,0].max()),
-                    "ymin": float(d[:,1].min()), "ymax": float(d[:,1].max()),
-                    "last": (float(d[-1,0]), float(d[-1,1]))})
-    return out, ax.get_ylim()
@@ -1,50 +0,0 @@
-#!/usr/bin/env bash
-# prove.sh — evidence the plot instrument works. Both directions.
-set -uo pipefail
-D="$(cd "$(dirname "$0")" && pwd)"
-python3 - "$D" <<'PY'
-import sys, csv, os
-D = sys.argv[1]; sys.path.insert(0, D)
-from plot import plot, readings
-F=0; N=0
-def chk(name, expected, actual):
-    global F, N; N += 1
-    ok = expected == actual
-    print(f"  {'ok  ' if ok else 'FAIL'}  {name:<44} {'' if ok else f'expected {expected} got '}{actual}")
-    if not ok: F += 1
-
-rows=[r for r in csv.reader(open(f"{D}/reference/KNOWN-SERIES.tsv"), delimiter="\t") if r and not r[0].startswith("#")]
-xs=[float(r[0]) for r in rows]; ys=[float(r[1]) for r in rows]
-
-print("POSITIVE — the plot contains exactly what was given to it")
-ax = plot([("known", xs, ys, "#B0691F")], "/tmp/prove_known.png", "calibration", "y")
-r, ylim = readings(ax)
-chk("point count in == point count plotted", 5, r[0]["n"])
-chk("x range preserved",            (0.0, 4.0), (r[0]["xmin"], r[0]["xmax"]))
-chk("y range preserved",           (5.0, 40.0), (r[0]["ymin"], r[0]["ymax"]))
-chk("final point not dropped/sorted", (4.0, 5.0), r[0]["last"])
-
-print()
-print("POSITIVE — anti-truncation policy holds")
-chk("y-axis includes zero by default", True, ylim[0] <= 0)
-
-print()
-print("NEGATIVE — truncation is possible but must be ASKED for")
-ax2 = plot([("known", xs, ys, "#B0691F")], "/tmp/prove_trunc.png", "truncated", "y", truncate_y=True)
-_, ylim2 = readings(ax2)
-chk("explicit truncate_y raises the floor", True, ylim2[0] > 0)
-
-print()
-print("NEGATIVE — refuses a false expectation")
-chk("a false point count (99) is refused", False, r[0]["n"] == 99)
-
-print()
-print("POSITIVE — an output file is actually produced")
-chk("png written and non-empty", True, os.path.getsize("/tmp/prove_known.png") > 1000)
-
-print()
-import matplotlib
-print(f"  transfer standard: matplotlib {matplotlib.__version__}")
-print(f"  {'PROVEN' if F==0 else 'NOT PROVEN'} — {N} checks, {F} failed")
-sys.exit(F)
-PY
@@ -1,17 +0,0 @@
-Known properties of KNOWN-SERIES.tsv, derived by hand from the five rows above.
-
-  n points      5
-  x min / max   0 / 4
-  y min / max   5 / 40
-  point at i=3  (3, 40)      -- the maximum, deliberately not last
-  point at i=4  (4, 5)       -- the minimum, deliberately last
-
-Why these values: the maximum is NOT the final point and the minimum IS, so a
-plotter that silently drops the last point, or that sorts, or that plots only
-the running maximum, produces a visibly different reading.
-
-ANTI-TRUNCATION: with y ranging 5..40, a plotter left to autoscale will start
-the y-axis near 5 and make a 3.5x visual change out of an 8x numeric one. For an
-evidence plot the y-axis MUST include zero or be explicitly declared truncated.
-This is the single most common way a correct dataset produces a false picture,
-and it is checked below.
@@ -1,7 +0,0 @@
-# A series whose plotted properties are known BEFORE the plotter runs.
-# x	y
-0	10
-1	20
-2	15
-3	40
-4	5
@@ -1 +0,0 @@
-./tools/evidence/report-prove.sh
@@ -1,7 +0,0 @@
-Traceback (most recent call last):
-  File "<stdin>", line 12, in <module>
-  File "/Users/will/Development/neuron-technologies/foundation/el/tools/evidence/report.py", line 35, in load
-    art = os.path.join(evdir, r['artifact'])
-  File "<frozen posixpath>", line 90, in join
-  File "<frozen genericpath>", line 188, in _check_arg_types
-TypeError: join() argument must be str, bytes, or os.PathLike object, not 'NoneType'
@@ -1 +0,0 @@
-POSITIVE — reads and verifies a real evidence directory
@@ -1,7 +0,0 @@
-commit	a0cc95e3db7b04b6e221f89e89352b0e6b15d5b7
-tree	dirty
-captured_utc	2026-08-17T17:53:46Z
-exit	1
-ms	315
-sha256_out	f76d174e98375a9c137936cc77a6675a3076b34fd7e1be8f91be8204aaaa8980
-sha256_err	31646694e108bb5c245b4ab128321bb3b46f30d380d070fa8a3214a4e2e685b3
@@ -1 +0,0 @@
-1
@@ -1,2 +0,0 @@
-sha256	bytes	exit	ms	commit	tree	utc	artifact	command
-f76d174e98375a9c137936cc77a6675a3076b34fd7e1be8f91be8204aaaa8980	58	1	315	a0cc95e3db7b	dirty	2026-08-17T17:53:46Z	0001-proof.out	./tools/evidence/report-prove.sh
@@ -1,6 +0,0 @@
-captured_utc	2026-08-17T17:53:46Z
-git_sha	a0cc95e3db7b04b6e221f89e89352b0e6b15d5b7
-git_dirty	yes
-host	Wills-MacBook-Pro
-uname	Darwin Wills-MacBook-Pro 25.5.0 Darwin Kernel Version 25.5.0: Tue Jun  9 22:28:34 PDT 2026; root:xnu-12377.121.10~1/RELEASE_ARM64_T6041 arm64
-cc	Apple clang version 21.0.0 (clang-2100.1.1.101)
@@ -1,73 +0,0 @@
-#!/usr/bin/env bash
-# reproduce.sh — ONE COMMAND. Proves every instrument, records the calibration,
-# re-runs every cycle, verifies every artifact against its hash.
-#
-# Capturing evidence is not enough. If a stranger cannot regenerate the numbers
-# in one command, the record is testimony. This is the command.
-#
-#   usage: ./docs/experiments/reproduce.sh [cycle-glob]
-set -uo pipefail
-cd "$(git rev-parse --show-toplevel)" || exit 2
-E="docs/experiments"; I="$E/instruments/instrument"; CAP="./tools/evidence/capture.sh"
-STAMP=$(date -u +%Y%m%dT%H%M%SZ); FAIL=0
-hdr(){ printf '\n\033[1m%s\033[0m\n' "$1"; }
-
-hdr "1. INSTRUMENTS — proven before anything is measured"
-for p in "$I"/*/prove.sh; do
-  [ -e "$p" ] || continue
-  name=$(basename "$(dirname "$p")")
-  if "$p" >/dev/null 2>&1; then printf '  ok    %-16s proven\n' "$name"
-  else printf '  FAIL  %-16s NOT PROVEN — no measurement below is valid\n' "$name"; FAIL=$((FAIL+1)); fi
-done
-[ "$FAIL" -eq 0 ] || { printf '\n  ABORT: an instrument is unproven. Nothing measured today is reportable.\n'; exit 1; }
-
-hdr "2. CALIBRATION — recorded, and stamped into every cycle that runs below"
-CALFILE="$E/instruments/CALIBRATION-$STAMP.txt"
-{ printf 'calibration run\t%s\n' "$STAMP"
-  printf 'commit\t%s\n' "$(git rev-parse HEAD)"
-  printf 'tree\t%s\n'   "$(test -n "$(git status --porcelain)" && echo dirty || echo clean)"
-  printf 'cloc\t%s\n'   "$(cloc --version 2>/dev/null || echo ABSENT)"
-  printf 'matplotlib\t%s\n' "$(python3 -c 'import matplotlib;print(matplotlib.__version__)' 2>/dev/null || echo ABSENT)"
-  printf 'cc\t%s\n'     "$(cc --version 2>&1|head -1)"
-  for p in "$I"/*/prove.sh; do [ -e "$p" ] || continue
-    printf '\n--- %s ---\n' "$(basename "$(dirname "$p")")"; "$p" 2>&1; done
-} > "$CALFILE"
-printf '  %s\n' "$CALFILE"
-grep -c '^  ok' "$CALFILE" | xargs printf '  %s calibration checks passed\n'
-
-hdr "3. CYCLES — each re-run, each stamped with the calibration in effect"
-GLOB="${1:-*}"; ran=0; miss=0
-# Cycles live at docs/v{1,2}/experiments/cycles/. The previous glob was
-# $E/v*/cycles/ and matched 1 of 29, then printed REPRODUCED.
-for m in docs/v*/experiments/cycles/$GLOB/measure.sh; do
-  [ -e "$m" ] || continue
-  d=$(dirname "$m"); name=$(basename "$d")
-  mkdir -p "$d/evidence"
-  cp "$CALFILE" "$d/evidence/CALIBRATION.txt"     # <- the cycle SHOWS its calibration
-  if $CAP "$d/evidence" rerun -- "$m" >/dev/null 2>&1; then printf '  ok    %-42s re-run\n' "$name"
-  else printf '  FAIL  %-42s re-run failed\n' "$name"; FAIL=$((FAIL+1)); fi
-  ran=$((ran+1))
-done
-total=$(ls docs/v1/experiments/cycles/*.md docs/v2/experiments/cycles/*.md 2>/dev/null | grep -vc INDEX)
-miss=$((total - ran))
-printf '  %s cycle(s) re-run\n' "$ran"
-if [ "$miss" -gt 0 ]; then
-  printf '  %s of %s cycle(s) have NO measure.sh and are NOT REPRODUCIBLE.\n' "$miss" "$total"
-  printf '  A record that reproduces %s/%s of itself has not been reproduced.\n' "$ran" "$total"
-  FAIL=$((FAIL+1))
-fi
-
-hdr "4. VERIFY — every artifact re-hashed against its manifest"
-for d in $(find docs -name MANIFEST.tsv -exec dirname {} \; | sort -u); do
-  ./tools/evidence/verify-manifest.sh "$d" || FAIL=$((FAIL+1))
-done
-for d in $E/v*/cycles/*/evidence $I/*/evidence; do
-  [ -f "$d/MANIFEST.tsv" ] || continue
-  ./tools/evidence/verify-manifest.sh "$(dirname "$d")" >/dev/null 2>&1 || true
-done
-./tools/evidence/verify-notebook.sh || FAIL=$((FAIL+1))
-
-hdr "RESULT"
-[ "$FAIL" -eq 0 ] && echo "  REPRODUCED — instruments proven, calibration recorded, cycles re-run, artifacts verified." \
-                  || echo "  NOT REPRODUCED — $FAIL failure(s) above."
-exit "$FAIL"
@@ -1 +0,0 @@
-docs/experiments/v2/cycles/07-the-caller-was-already-there/measure.sh
@@ -1,13 +0,0 @@
-CYCLE 07 — the caller was already there
-claim: exactly three seam emission points, all keyed on fn_name
-
-- emission points, counted in the BUILT ARTIFACT, not in source text.
-   (the original assertion grepped codegen.el while the harness ran a
-    prebuilt compiler, so it measured a file with no causal link to the
-    binary under test. see notebook v2 E003.)
-   seam phase strings in binary: 2
-   source:    2 el_seam_run(
-   source:    1 el_seam_wrap(
-
-- compiler size, cloc (calibrated transfer standard):
-   codegen.el  blank 256  comment 981  code 3197
@@ -1,7 +0,0 @@
-commit	a0cc95e3db7b04b6e221f89e89352b0e6b15d5b7
-tree	dirty
-captured_utc	2026-08-17T17:47:15Z
-exit	0
-ms	287
-sha256_out	f4008496b05a21a3c04ce235356fca60132cf72e91dda7aeefa88fef4d5755fe
-sha256_err	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
@@ -1 +0,0 @@
-0
@@ -1,50 +0,0 @@
-calibration run	20260817T174713Z
-commit	a0cc95e3db7b04b6e221f89e89352b0e6b15d5b7
-tree	dirty
-cloc	2.10
-matplotlib	3.10.8
-cc	Apple clang version 21.0.0 (clang-2100.1.1.101)
-
--- line-count ---
-POSITIVE — reproduces hand-counted answers
-  ok    ref_lines.el total = 18
-  ok    ref_lines.el blank = 3
-  ok    ref_lines.el comment = 7
-  ok    ref_lines.el code = 8
-  ok    ref_wrong.el total = 4
-  ok    ref_wrong.el blank = 0
-  ok    ref_wrong.el comment = 3
-  ok    ref_wrong.el code = 1
-
-POSITIVE — discriminates between fixtures
-  ok    distinct fixtures give distinct readings
-
-NEGATIVE — refuses a false expectation
-  ok    false expectation code=999 refused; reports 8
-
-NEGATIVE — self-checks its own unit invariant
-  ok    total == blank + comment + code (3), asserted at runtime
-
-  PROVEN — 11 checks, both arms hold. This instrument may be used.
-
--- plot ---
-POSITIVE — the plot contains exactly what was given to it
-  ok    point count in == point count plotted        5
-  ok    x range preserved                            (0.0, 4.0)
-  ok    y range preserved                            (5.0, 40.0)
-  ok    final point not dropped/sorted               (4.0, 5.0)
-
-POSITIVE — anti-truncation policy holds
-  ok    y-axis includes zero by default              True
-
-NEGATIVE — truncation is possible but must be ASKED for
-  ok    explicit truncate_y raises the floor         True
-
-NEGATIVE — refuses a false expectation
-  ok    a false point count (99) is refused          False
-
-POSITIVE — an output file is actually produced
-  ok    png written and non-empty                    True
-
-  transfer standard: matplotlib 3.10.8
-  PROVEN — 8 checks, 0 failed
@@ -1,2 +0,0 @@
-sha256	bytes	exit	ms	commit	tree	utc	artifact	command
-f4008496b05a21a3c04ce235356fca60132cf72e91dda7aeefa88fef4d5755fe	565	0	287	a0cc95e3db7b	dirty	2026-08-17T17:47:15Z	0001-rerun.out	docs/experiments/v2/cycles/07-the-caller-was-already-there/measure.sh
@@ -1,6 +0,0 @@
-captured_utc	2026-08-17T17:47:14Z
-git_sha	a0cc95e3db7b04b6e221f89e89352b0e6b15d5b7
-git_dirty	yes
-host	Wills-MacBook-Pro
-uname	Darwin Wills-MacBook-Pro 25.5.0 Darwin Kernel Version 25.5.0: Tue Jun  9 22:28:34 PDT 2026; root:xnu-12377.121.10~1/RELEASE_ARM64_T6041 arm64
-cc	Apple clang version 21.0.0 (clang-2100.1.1.101)
@@ -1,16 +0,0 @@
-#!/usr/bin/env bash
-# measure.sh — re-runs cycle 07's measurements. Instruments only, no new ones.
-set -uo pipefail
-cd "$(git rev-parse --show-toplevel)"
-echo "CYCLE 07 — the caller was already there"
-echo "claim: exactly three seam emission points, all keyed on fn_name"
-echo
-echo "-- emission points, counted in the BUILT ARTIFACT, not in source text."
-echo "   (the original assertion grepped codegen.el while the harness ran a"
-echo "    prebuilt compiler, so it measured a file with no causal link to the"
-echo "    binary under test. see notebook v2 E003.)"
-strings /tmp/el-mut-build/elc 2>/dev/null | grep -cE '^(entry|wrap|exit)$' | xargs -I{} echo "   seam phase strings in binary: {}"
-grep -oE 'el_seam_(run|wrap)\(' lang/el-compiler/src/codegen.el | sort | uniq -c | sed 's/^/   source: /'
-echo
-echo "-- compiler size, cloc (calibrated transfer standard):"
-cloc --force-lang=C --quiet --csv lang/el-compiler/src/codegen.el 2>/dev/null | tail -1 | awk -F, '{print "   codegen.el  blank "$3"  comment "$4"  code "$5}'
@@ -1,59 +0,0 @@
-# v1 — Experiments
-
-Every change to El on `iteration-1` was produced by one loop, run repeatedly:
-
-```
-Ishikawa  →  scientific method  →  Six Sigma  →  repeat
-```
-
- **Ishikawa** — name the root cause, not the symptom. *Why is this table here?*
-  never *why is this table ugly?*
- **Scientific method** — state a hypothesis, **commit predictions before
-  running**, then run it in an isolated worktree and grade every prediction
-  including the ones that failed.
- **Six Sigma** — eliminate the defect *class*, then add a control so it cannot
-  silently return.
-
-## The organising finding
-
-**Predictions that came back FALSE were worth more than the ones that held.**
-
-Nineteen cycles, sixty-one predictions. The eleven that failed produced every
-significant result:
-
-| Failed prediction | What it found |
-|---|---|
-| "the arity table has drifted from the header" | Zero drift — but **110 functions had no entry at all**. The table was not wrong, it was 40% incomplete. |
-| "codegen drops below baseline" (×4) | The **traversal is irreducible**. Walking an AST to find calls does not move no matter who decides. Only the rule and the judgment leave. |
-| "guards cannot refuse through the seam" | One line, and refusal works. Six compile-time kinds were unnecessary. |
-| "C forbids the struct redefinition" | C allows shadowing — and a *different* defect surfaced: an exit injection emitted with an empty target. |
-| "routing el_bin_lookup through the gate fixes the SIGSEGV" | It did not. The **fallback** was the hazard: `strlen()` on an integer. I would have shipped the wrong fix and called it verified. |
-
-A prediction that only ever confirms is a demonstration, not a test. One cycle
-was run **without** committing predictions first — `async-half-expressible` —
-and it produced a rigged result: `pthread_join` immediately after
-`pthread_create`, with the word `DEFERRED` printed by the test itself. It had to
-be discarded and re-run.
-
-## Layout
-
-```
-cycles/     one file per loop, numbered in order, named for the DEFECT
-findings/   what the cycles produced, cross-cut by kind
-```
-
-## Scoreboard
-
-```
-cycles run                     19
-predictions committed          61
-predictions FALSE              11   ← the useful ones
-silent miscompilations found    4
-security-relevant defects       2
-architecture questions closed   5
-defects in my own measurement   4
-```
-
-Every cycle verified the same three things before landing: the compiler
-self-hosts byte-identically (gen2 == gen3), the native suite passes, and the
-integration harnesses pass. A cycle that could not show all three did not land.
@@ -1,26 +0,0 @@
-# Cycles
-
-Each is one `Ishikawa → scientific method → Six Sigma` loop, run in an isolated
-worktree so a wrong answer cost nothing. Named for the **defect**, not the fix.
-
-| # | Cycle | Root cause | Predictions | Landed |
-|---|---|---|---|---|
-| 01 | [constructs-have-nowhere-to-be](01-constructs-have-nowhere-to-be.md) | a construct had nothing to BE, so its meaning lived in the emitter | 3/3 | yes |
-| 02 | [a-construct-cannot-refuse](02-a-construct-cannot-refuse.md) | injection discards the target's result; no form said no | 4/4 | yes |
-| 03 | [the-wrapper-was-conditional](03-the-wrapper-was-conditional.md) | exit injection needed compile-time knowledge only because the wrapper was conditional | 3/4 | yes |
-| 04 | [c-has-no-closure-syntax](04-c-has-no-closure-syntax.md) | "C has no closures" taken as a fact about what is possible | 5/7 | yes |
-| 05 | [the-emitter-discards-what-it-knows](05-the-emitter-discards-what-it-knows.md) | codegen sees every construct relation and throws it away | 5/5 | branch |
-| 06 | [the-crossing-resolves-at-emission](06-the-crossing-resolves-at-emission.md) | the binary has no table to consult | 3/4 | yes |
-| 07 | [invocation-is-not-composable](07-invocation-is-not-composable.md) | the wrapper called the target directly | 5/5 | yes |
-| 08 | [the-emitter-adjudicates](08-the-emitter-adjudicates.md) | a prohibition had nowhere to live but a `#error` | 4/5 | yes |
-| 09 | [policy-inside-the-compiler](09-policy-inside-the-compiler.md) | a program cannot declare its own restrictions, so the tier policy was compiled in | 4/5 | yes |
-| 10 | [a-second-copy-of-the-header](10-a-second-copy-of-the-header.md) | builtin arity hand-maintained beside `el_runtime.h` | 4/5 | yes |
-| 11 | [one-type-erases-the-return](11-one-type-erases-the-return.md) | `el_val_t` means the header cannot say `now()` returns an Instant | 4/5 | yes |
-| 12 | [judgment-lives-with-knowledge](12-judgment-lives-with-knowledge.md) | the emitter knows the types, so it also judged them | 5/5 | yes |
-| 13 | [thirty-five-return-types](13-thirty-five-return-types.md) | `is_int_call` hardcoded what drives `+` dispatch | 6/6 | yes |
-| 14 | [keywords-that-reserve-nothing](14-keywords-that-reserve-nothing.md) | 5 of 46 keywords consumed by no path | 6/6 | yes |
-| 15 | [no-namespacing-at-all](15-no-namespacing-at-all.md) | `import` is textual inlining; every name is global | 4/4 | yes |
-| 16 | [tokens-carry-no-position](16-tokens-carry-no-position.md) | a token was `(kind, value)`, so no diagnostic could name a place | 6/6 | yes |
-| 17 | [annotations-are-never-checked](17-annotations-are-never-checked.md) | the annotation feeds dispatch and is never verified | 6/6 | branch |
-| 18 | [async-half-expressible](18-async-half-expressible.md) | **first attempt was DOGMA** — no predictions, rigged test | 4/4 (2nd) | branch |
-| 19 | [a-convention-is-not-a-gate](19-a-convention-is-not-a-gate.md) | `looks_like_heap_obj` is static, so every type re-derives it | 6/7 | yes |
@@ -1,42 +0,0 @@
-# constructs have nowhere to be
-
-One `Ishikawa → scientific method → Six Sigma` loop. The record below is the
-commit message as written at the time, before the outcome was known to anyone
-reading this file.
-
-## Record — `5718943`
-
-```
-let a construct declare its own meaning instead of the emitter knowing it
-
-codegen called fn_has_decorator for exactly three names — manager, accessor,
-route. Twelve others parsed, attached as {name,args}, and compiled to nothing,
-including four that look like protection: @authenticate (6 uses), @authorize
-(3), @rate_limit (3), @validate (2). The cause was not that the branches were
-untidy. A construct had nothing to BE, so its meaning had nowhere to live
-except the emitter, and every construct was therefore a compiler edit.
-
-A name -> injection table would have moved the enumeration twenty lines up
-without removing it. So the construct now carries its own meaning:
-
-    @decorator("injects_at_entry", "engram_boundary_beat")
-    fn audited() {}
-
-    @audited
-    fn risky_op() -> Int { ... }   // gets the beat, attributed to "audited"
-
-scan_declared_decorators is a token-level pre-pass beside scan_routes, forced
-by streaming codegen having no whole-program AST. manager and accessor are
-seeded as the compiled-in core — the fixedSelf shape from substrate.go: a
-complete fallback exists, declaration is enrichment.
-
-This is the injection half of the seam only. The prohibition half (@manager's
-#error on dharma_emit) stays hardcoded, because "which calls may appear inside
-this boundary" is a query over program structure and there is nothing yet to
-ask.
-
-Verified three ways: emitted C for existing @manager/@accessor code is
-byte-identical to the hardcoded path; a construct with a name the compiler has
-never heard of injects correctly; the compiler self-hosts byte-identically.
-90/90 native compiler tests pass.
-```
@@ -1,43 +0,0 @@
-# a construct cannot refuse
-
-One `Ishikawa → scientific method → Six Sigma` loop. The record below is the
-commit message as written at the time, before the outcome was known to anyone
-reading this file.
-
-## Record — `60737b0`
-
-```
-let a construct refuse, not only observe
-
-@authenticate (6 uses), @authorize (3), @rate_limit (3) and @validate (2)
-parsed, attached, and compiled to nothing. Fourteen applications that read as
-protection and emitted no instruction — a function decorated @authenticate
-compiled byte-identically to an undecorated one.
-
-The missing capability was not authentication. It was that a construct could
-observe a boundary but never refuse one. injects_at_entry discards the target's
-result; there was no form in which a construct could say no.
-
-    @decorator("guards_at_entry", "my_auth")
-    fn authenticate() {}
-
-    @authenticate
-    @authorize
-    fn handler() -> String { ... }
-
-emits, at entry:
-
-    { el_val_t __g = my_auth(EL_STR("handler"), EL_STR("authenticate")); if (__g) return __g; }
-    { el_val_t __g = my_roles(EL_STR("handler"), EL_STR("authorize")); if (__g) return __g; }
-
-Guards precede injections because a refused call must not report a crossing,
-and every guard runs where the topmost injecting construct wins — refusal is
-not a role, so it does not follow the role convention.
-
-The compiler still knows nothing about auth. The program points the construct
-at its own function, which is where that decision belongs.
-
-Verified: existing @manager/@accessor output byte-identical, compiler
-self-hosts byte-identically, guards stack in declaration order and emit before
-the beat. 94/94 native compiler tests pass.
-```
@@ -1,82 +0,0 @@
-# the wrapper was conditional
-
-One `Ishikawa → scientific method → Six Sigma` loop. The record below is the
-commit message as written at the time, before the outcome was known to anyone
-reading this file.
-
-## Record — `4f7568b`
-
-```
-give a construct its after-crossing face, and let constructs compose
-
-§6 records 62 persist-after-mutate sites, 10 auth-per-route, and
-index-after-append that failed at 9 of 9 — every one an obligation at a
-crossing that decayed into "remember to do this afterwards." An obligation a
-human must remember is not an obligation, and the 9-of-9 figure is what that
-costs.
-
-    @decorator("injects_at_exit", "persist_now")
-    fn durable() {}
-
-The body moves into a static helper and the visible fn becomes a wrapper, so
-EARLY RETURNS pass through the exit injection. Emitting it only before the
-fall-through return would have silently missed every early return — the exact
-failure class this seam exists to remove. Fns with no exit construct emit
-byte-identically to before.
-
-Three independent constructs now compose on one fn, none known to the compiler:
-
-    el_val_t mutate(el_val_t k) {
-      { el_val_t __g = my_auth(EL_STR("mutate"), EL_STR("authenticate")); if (__g) return __g; }
-      engram_boundary_beat(EL_STR("mutate"), EL_STR("manager"));
-      el_val_t __r = __el_body_mutate(k);
-      persist_now(EL_STR("mutate"), EL_STR("durable"), __r);
-      return __r;
-    }
-
-Guard, then entry, then body, then exit. §5.2 asked whether `hold` is one
-construct or two; the implementation answers one construct with two faces,
-selected by declared kind rather than by two mechanisms.
-
-Verified: existing output byte-identical, compiler self-hosts byte-identically,
-early returns pass through the exit, ordering holds under composition. 98/98
-native compiler tests pass.
-```
-
-## Record — `285166c`
-
-```
-EXPERIMENT: emit the wrapper unconditionally, so exit binds at runtime too
-
-ISHIKAWA: why did exit injection still need compile-time knowledge? Because the
-body-helper wrapper was only emitted when codegen already knew an exit
-construct existed. The wrapper being conditional was the cause, not the wrapper
-being necessary.
-
-PREDICTIONS AND RESULTS
-  P1 exit becomes runtime-bindable                    TRUE  returns 14, bound
-                                                            after the build
-  P2 codegen shrinks                                  TRUE  5094 -> 5044
-  P3 cost 5-15% from a call frame on every fn         FALSE 0.37s -> 0.38s, ~3%
-  P4 fixpoint holds                                   TRUE
-
-Every fn now gets a body helper and a wrapper. It has to be unconditional:
-early returns must route through something for an exit construct to observe
-them, and codegen cannot know which fns will be bound after the binary exists.
-
-Removed with the machinery: declare_exit, decorator_exit, cg_exit_target,
-cg_exit_construct, and the injects_at_exit scanner branch.
-
-Two controls failed and were rewritten rather than repaired --
-no-exit-construct-emits-no-wrapper asserted the optimisation this removes, so
-it is now inverted. The integration harness gained a seventh assertion: an exit
-construct declared after the build replaces the result.
-
-99/99 native, 7/7 integration, fixpoint gen2==gen3.
-```
-
-## Record — `b40754f`
-
-```
-land unconditional wrapper: exit crossings resolve at runtime
-```
@@ -1,64 +0,0 @@
-# c has no closure syntax
-
-One `Ishikawa → scientific method → Six Sigma` loop. The record below is the
-commit message as written at the time, before the outcome was known to anyone
-reading this file.
-
-## Record — `2bed848`
-
-```
-EXPERIMENT: hand the construct the body as a real closure
-
-ROOT CAUSE of the weaker design: "C has no closures" was taken as a fact about
-what is possible. It is a fact about one grammar. Every C++ lambda, every Go
-closure, every Rust closure compiles to a struct of captured values plus a
-function pointer -- which is what is emitted here. Codegen emits C; it is not
-written in C's syntax, and the distinction is the whole difference between a
-construct that can only decide whether to repeat and one that controls
-invocation.
-
-It would also have crippled the JS backend, which has closures natively, for a
-limit that applies only to the C one.
-
-PREDICTIONS AND RESULTS
-  1 env struct + thunk taking void*                        TRUE
-  2 fails to compile: struct redefinition                  FALSE -- C allows the
-    inner declaration to shadow. Prediction wrong; C is more permissive than
-    assumed. A different real defect surfaced instead: a wrap with no exit
-    construct emitted `(EL_STR("f"), EL_STR(""), __r);` -- a call to an empty
-    target -- because has_exit was reused as "needs a wrapper" and the exit line
-    was emitted unconditionally. Fixed.
-  3 compiles when the target is declared in El             FALSE -- and this is
-    the root cause worth keeping: El has ONE type, el_val_t = int64_t. El's type
-    system cannot describe a callable, so `extern fn` and the real signature
-    cannot be made to agree in El's own vocabulary. The fix is not a cast:
-    codegen DEFINES the wrap calling convention, so codegen emits the extern
-    declaration. The convention is not El-expressible; it is emitted.
-  4 target controls invocation, 0..N times                 TRUE
-  5 existing @manager output byte-identical                TRUE
-  6 compiler fixpoint holds                                TRUE
-  7 emitting the convention makes it compile               TRUE
-
-MEASURED
-  base(5) wrapped by a target that invokes the body twice and sums -> 10
-  never_runs(5) wrapped by a target that never invokes it        -> 999
-
-Neither is expressible by "decide whether to repeat". This supersedes the
-repeats_body experiment on experiment/repeats-body, which was built around the
-mistaken limit.
-```
-
-## Record — `7d01608`
-
-```
-land wraps_body: a construct controls invocation
-
-Proven on experiment/wraps-body (2bed848): base(5) wrapped by a target that
-invokes the body twice returns 10; a target that never invokes it returns 999.
-Neither is expressible by deciding whether to repeat.
-
-Root cause it corrected: 'C has no closures' is a fact about one grammar, not
-about what can be emitted. And El's single type (el_val_t = int64_t) cannot
-describe a callable, so codegen emits the calling convention rather than asking
-El's type system for something it structurally cannot say.
-```
@@ -1,48 +0,0 @@
-# the emitter discards what it knows
-
-One `Ishikawa → scientific method → Six Sigma` loop. The record below is the
-commit message as written at the time, before the outcome was known to anyone
-reading this file.
-
-## Record — `a5af871`
-
-```
-EXPERIMENT: let the compiler write down what it already knows
-
-HYPOTHESIS: attribution is redundant for static structure. Codegen sees every
-construct-to-function relation at emission time and discards it, so the only
-way to learn the structure back is to run the program and read what it
-reported. That is instrumentation compensating for erasure.
-
-PREDICTIONS, committed before running:
-  1 derivable at compile time with no runtime call     expected TRUE
-  2 complete for guards and exits (invisible today)    expected TRUE
-  3 answers it for code that has never executed        expected TRUE
-  4 deterministic                                      expected TRUE
-  5 makes the entry beat redundant                     expected FALSE
-
-RESULT: 5/5 as predicted. From a program that was never executed:
-
-  authenticate guards_at_entry login    my_auth
-  durable      injects_at_exit  save    persist_now
-  authenticate guards_at_entry critical my_auth
-  durable      injects_at_exit  critical persist_now
-  manager      injects_at_entry critical engram_boundary_beat
-
-Prediction 5 held: the relation records that a boundary COULD be crossed, the
-beat records that it WAS. They are different facts and neither replaces the
-other.
-
-CONSEQUENCE, and it undercuts the first pass on iteration-1: construct identity
-was available at compile time all along. With relations recorded at build, the
-runtime needs only the function name and attribution becomes a join rather than
-a payload. The counter-argument is that the payload is self-describing while
-the file must be pinned to the artifact or the two drift and attribution is
-silently lost — which is the same conclusion as "compile against a manifold
-revision and record the revision in the artifact", reached from the other side.
-
-Written to a file rather than the engram on purpose: a compile that consults a
-manifold produces different output from identical source at different times.
-The file is content-addressed; the engram ingests it. Determinism preserved,
-mechanism proven.
-```
@@ -1,170 +0,0 @@
-# the crossing resolves at emission
-
-One `Ishikawa → scientific method → Six Sigma` loop. The record below is the
-commit message as written at the time, before the outcome was known to anyone
-reading this file.
-
-## Record — `35b07ba`
-
-```
-EXPERIMENT: resolve the crossing at execution, not at emission
-
-HYPOTHESIS (Will's): a compiler whose one compiled mechanism is extending the
-LANGUAGE — not the compiler — can compose without recompilation.
-
-ISHIKAWA — why does a construct require a recompile today?
-  method       codegen inlines the target call into the body
-  machine      the binary has no table to consult
-  material     the declaration lives in source, read at compile time
-  measurement  nothing observes what applied at runtime
-  root cause   the crossing is resolved at EMISSION, not at EXECUTION
-
-CHANGE: codegen emits one unconditional indirection per fn. Which constructs
-apply is read from a table that can be written AFTER the binary exists;
-targets resolve through dlsym against the running image.
-
-PREDICTIONS AND RESULTS
-  P1 a construct declared after the build applies       TRUE
-  P2 an unlinked target is skipped, not fatal           TRUE
-  P3 emitting on every fn is measurably slower          FALSE — 0.37s -> 0.36s
-                                                        with 267 indirections and
-                                                        no bindings. Free unused.
-  P4 the compiler still self-hosts                      TRUE (see note)
-
-DEMONSTRATED: an El program with NO decorator in its source, already compiled
-and linked, picked up a construct declared afterwards:
-
-    $ /tmp/seamrun                       -> 7
-    $ echo 'work audited entry audit_entry' > constructs.txt
-    $ EL_CONSTRUCTS=constructs.txt /tmp/seamrun
-      AUDIT: work applied by audited
-      7
-
-P4 note: my first fixpoint test was wrong, not the code. I compared gen1 to
-gen2, which must differ whenever codegen's output changes. gen2 == gen3, 267
-seam sites, stable.
-
-MEASURED COST, and the root cause was not where I looked
-  0 bindings                    0.36s vs 0.37s baseline   free
-  2 bindings, dlsym per call    2.45s                     6.6x
-  2 bindings, resolved once     0.69s                     3.5x recovered
-The table scan was never the cost. dlsym walks the dynamic symbol table on
-every call. Resolve once and cache — which is the smallest form of what
-salience does for memory: what is hot stays resolved. The 0.69s residual is
-audit_entry's own printf on two of the compiler's hottest functions, not seam
-overhead.
-
-CONSEQUENCE: the five compile-time declaration kinds on iteration-1 are a
-compile-time specialisation of something that resolves at runtime. They are not
-wrong, but they are not the mechanism — the mechanism is one indirection, and a
-kind is data.
-```
-
-## Record — `886626a`
-
-```
-seam refusal + control tests: a runtime binding can short-circuit
-
-Prediction 3 was FALSE. I expected refusal to be impossible through the seam
-because the entry indirection discarded its return. One line:
-
-    { el_val_t __s = el_seam_run(EL_STR(f), 0, 0); if (__s) return __s; }
-
-work() returns 7; bound to a refusing construct AFTER the build it returns 42.
-So three of the five compile-time kinds are runtime-bindable: entry injection,
-exit injection, and refusal. wraps_body needs invocation control and
-prohibits_outside is compile-time by nature.
-
-104/104 native compiler tests pass.
-```
-
-## Record — `28d19da`
-
-```
-strip the compile-time machinery the seam replaces
-
-PREDICTION: codegen.el drops below 4661, its size before any of these passes.
-RESULT: FALSE. 5157 -> 5096. Still +435 over baseline.
-
-  injects_at_entry   collapsed into the seam            removed
-  guards_at_entry    collapsed into the seam            removed
-  injects_at_exit    needs the body-helper wrapper      STRUCTURAL
-  wraps_body         needs the closure + wrapper        structural
-  prohibits_outside  a #error cannot be emitted at runtime
-
-The wrapper is not a consequence of compile-time resolution. Early returns must
-be routed through something no matter when the target is resolved, so exit
-injection was never going to collapse. I predicted it would because I had
-conflated "resolved late" with "emitted less".
-
-What did collapse is entry injection and refusal -- 61 lines of compiler
-replaced by one refusable indirection, with the capability now bindable after
-the binary exists.
-
-8 tests fail, and they are exactly the 8 controls for compile-time entry
-injection and guards. No unrelated breakage: the controls reported precisely
-what moved. They assert emission of something that now happens at runtime, so
-they need rewriting as integration tests -- which the framework does not
-currently support, because runtime binding needs a built binary and an
-environment, not compile_capture.
-
-Verified after the strip: fixpoint gen2==gen3, observation and refusal both
-work through the seam with the compiler knowing nothing about either.
-```
-
-## Record — `8bbb750`
-
-```
-control the claim that cannot be unit tested
-
-The seam's whole claim is that a construct declared AFTER a binary exists
-applies to that already-built program. compile_capture only sees emitted text,
-so it structurally cannot check this: it needs a built binary, a linked target,
-and an environment. Verified by hand until now, which is the standing problem
-this session has been about.
-
-tests/integration/seam_binding.sh builds a probe from El source containing no
-construct at all, links a target that El never references, and asserts:
-
-  ok  unbound program is unaffected
-  ok  a construct declared AFTER the build applies
-  ok  a construct declared after the build can REFUSE
-  ok  an unlinked target is skipped, not fatal
-  ok  a binding for a different fn does not fire
-  ok  two constructs compose on one crossing
-
-  6 assertions, 6 passed, 0 failed
-
-The eight controls that failed after the strip were replaced, not repaired.
-They asserted compile-time emission of capability that moved to runtime;
-contorting them would have kept an assertion whose subject no longer exists.
-Three took their place, asserting the emitted shape, and the behaviour they
-used to cover is now the integration harness's job -- which is the honest
-division, since the shape and the behaviour are no longer the same fact.
-
-99/99 native compiler tests pass. Fixpoint holds.
-```
-
-## Record — `24f7fb5`
-
-```
-land the runtime seam: resolve the crossing at execution
-
-Five compile-time passes added 491 lines to the thing that was supposed to stop
-growing. The seam is ~55 lines of C and one line of emission, and it does at
-runtime what three of those five kinds did at compile time -- for programs that
-are already built.
-
-  a construct declared AFTER the binary exists applies to it
-  free when unused: 0.36s vs 0.37s baseline across 267 indirections
-  dlsym was the cost, not the table scan; resolve-once recovered 3.5x
-  refusal works, composition works, unlinked targets are skipped not fatal
-
-injects_at_exit and wraps_body do NOT collapse: early returns must route
-through the body-helper wrapper regardless of when the target is resolved. The
-wrapper is structural, which I had wrong. prohibits_outside cannot move at all
-- a #error has no runtime.
-
-Controls: 99/99 native compiler tests, plus tests/integration/seam_binding.sh
-(6/6) for the claim compile_capture structurally cannot see.
-```
@@ -1,45 +0,0 @@
-# invocation is not composable
-
-One `Ishikawa → scientific method → Six Sigma` loop. The record below is the
-commit message as written at the time, before the outcome was known to anyone
-reading this file.
-
-## Record — `bc2f26d`
-
-```
-EXPERIMENT: invocation control resolves at runtime
-
-ISHIKAWA: why did wraps_body need compile-time knowledge? Because the wrapper
-called the target directly. If the wrapper calls through the seam instead, the
-seam can call the body itself, and a construct bound after the build decides
-how and whether to invoke it.
-
-PREDICTIONS AND RESULTS
-  P1 wrap becomes runtime-bindable                  TRUE   body x3 -> 21,
-                                                           never invoked -> 111
-  P2 codegen shrinks                                TRUE   5042 -> 4977
-  P3 cost 5-10% from an indirect call on every fn   TRUE   0.36s -> 0.39s, ~8%
-  P4 zero-param fns break on the empty struct       TRUE   empty struct is a GNU
-                                                           extension, empty init
-                                                           is C23. Fixed with a
-                                                           char field.
-  P5 fixpoint holds                                 TRUE
-
-PROCESS FAILURE worth recording: my first patch silently did not apply because
-I dropped the assert on the string replacement. The build then failed with
-"undeclared identifier __thunk_noargs", which I nearly attributed to the
-empty-struct prediction. The guard that would have caught it existed and I
-removed it -- the same shape as every other defect found tonight.
-
-Removed: declare_wrap, decorator_wrap, cg_wrap_target, cg_wrap_construct,
-params_to_call_args, and the wraps_body scanner branch.
-
-prohibits_outside is now the ONLY construct kind left at compile time, and it
-cannot move: a #error has no runtime.
-```
-
-## Record — `c04d68f`
-
-```
-land runtime invocation control: only prohibition remains compiled
-```
@@ -1,53 +0,0 @@
-# the emitter adjudicates
-
-One `Ishikawa → scientific method → Six Sigma` loop. The record below is the
-commit message as written at the time, before the outcome was known to anyone
-reading this file.
-
-## Record — `c741cfe`
-
-```
-EXPERIMENT: prohibition becomes a query over emitted relations
-
-I said prohibition could not move because "a #error has no runtime". That
-conflated two separable things: WHEN a violation is detected (build time --
-correct, and unchanged) and WHERE the rule and the checker live (the compiler
-- assumed).
-
-A prohibition is a containment relation over the call graph. So codegen now
-records what it saw:
-
-    sneaky   calls raw_sql
-    allowed  calls raw_sql
-    allowed  calls @repository
-    repository calls prohibits:raw_sql
-
-and tools/check/prohibitions.sh decides, at build time, outside the compiler.
-
-PREDICTIONS AND RESULTS
-  P1 codegen can emit the call graph it already walks   TRUE
-  P2 the check becomes a query outside the compiler     TRUE
-  P3 all prohibition decisions leave codegen            TRUE  zero #errors now
-  P4 violations still caught at build time              TRUE  exit=1
-  P5 codegen drops below the 4661 baseline              FALSE 4962, +301
-
-P5 is the finding. The TRAVERSAL is irreducible -- you must walk the AST to
-find calls, and those ~120 lines do not move no matter who decides. What is not
-irreducible is the rule (which names) or the decision (#error). Those left. I
-predicted the whole 223 lines would go because I had not separated walking from
-adjudicating.
-
-Still compiled, and measured rather than assumed: the capability-tier system
-(cap_check_call, is_self_formation_call, is_dharma_call, is_llm_call,
-cap_record_violation, emit_cap_violations) is 76 lines of the same shape --
-prohibits_WITHIN rather than prohibits_outside, so the checker needs the
-opposite polarity to absorb it.
-
-98/98 native, 4/4 prohibition_query.sh, 7/7 seam_binding.sh, fixpoint ok.
-```
-
-## Record — `60c07ad`
-
-```
-land prohibition-as-query: the emitter records, it no longer adjudicates
-```
@@ -1,49 +0,0 @@
-# policy inside the compiler
-
-One `Ishikawa → scientific method → Six Sigma` loop. The record below is the
-commit message as written at the time, before the outcome was known to anyone
-reading this file.
-
-## Record — `c2d9596`
-
-```
-EXPERIMENT: the capability tier becomes shipped policy plus a query
-
-Capability differs from prohibits_outside in one way that matters: a utility
-program cannot be trusted to declare its own restrictions, because it would
-declare none. So the policy comes from OUTSIDE the program -- it ships with the
-language as data, editable without a compiler release.
-
-  tools/check/capabilities.rel   18 names that were string literals in codegen
-  tools/check/capabilities.sh    the query that decides
-
-PREDICTIONS AND RESULTS
-  P1 codegen emits kind + call graph, drops the 4 name tests   TRUE  zero #errors
-  P2 the 18 literals become a data file                        TRUE
-  P3 the checker catches capability violations                 TRUE  exit=1
-  P4 codegen drops ~76 lines                                   TRUE  4963 -> 4881
-  P5 below the 4661 baseline                                   FALSE ~+230
-
-TWO DEFECTS THE HARNESS FOUND THAT READING WOULD NOT HAVE
-
-1. Calls inside main became invisible. cg_fn returns early for main -- C
-   provides its own -- so hooking the recording there left every call in main
-   unrecorded: a blind spot exactly where a program does its work. The old
-   cap_check_call ran from cg_expr and did see main. Moved the recording to
-   cg_expr.
-
-2. Caller attribution was stale. __cg_current_fn kept whatever cg_fn set last,
-   so a violation in main was reported against the previously emitted function.
-   The test still PASSED, because the violation was detected -- only the name
-   was wrong, and a diagnostic naming the wrong fn is worse than none. Fixed at
-   all three main-emission sites; the first patch missed two because the live
-   path is codegen_streaming.
-
-98/98 native, 7/7 + 4/4 + 5/5 integration, fixpoint ok.
-```
-
-## Record — `29f78f9`
-
-```
-land capability-as-policy: eighteen literals become a data file
-```
@@ -1,54 +0,0 @@
-# a second copy of the header
-
-One `Ishikawa → scientific method → Six Sigma` loop. The record below is the
-commit message as written at the time, before the outcome was known to anyone
-reading this file.
-
-## Record — `9cc6040`
-
-```
-EXPERIMENT: derive arity from the runtime's own declarations
-
-codegen.el carried builtin_arity(): 344 lines, 300 entries, a hand-maintained
-second copy of el_runtime.h.
-
-PREDICTIONS AND RESULTS
-  P1 the table duplicates the header                     TRUE   243 shared names
-  P2 they have already drifted                           FALSE  ZERO drift. The
-                                                                duplicate had been
-                                                                maintained correctly.
-  P3 codegen can emit call-arity relations               TRUE
-  P4 the check becomes a query against the header        TRUE
-  P5 codegen drops to roughly baseline                   TRUE   4903 -> 4512,
-                                                                149 BELOW the 4661
-                                                                it started at
-
-P2 being false is the better result: the table was not WRONG, it was
-INCOMPLETE. 110 functions the runtime declares had no entry, so calling them
-with the wrong argument count produced no El-level diagnostic at all. Measured:
-the old compiler reports 0 arity errors for __http_do_map_to_file(1); the query
-reports "takes 5 arguments, called with 1".
-
-Deriving from the header fixes coverage AND makes drift impossible by
-construction. 503 signatures, versus 300 entries maintained by hand.
-
-THREE DEFECTS IN MY OWN CHECKER, each found by running it rather than reading it
-  1. El names and C names differ -- `println` is `__println`. 60 of 500 decls
-     carry the prefix and codegen owns the mapping; the old table carried both
-     keys. One rule covers all 60.
-  2. Multi-line declarations parsed as zero params, so the checker reported
-     "takes 0" for a function taking 5. A diagnostic with the wrong number in it
-     is worse than none -- the same shape as the stale caller attribution in the
-     previous pass.
-  3. Fixing (2) by joining lines dropped 500 signatures to 334, because a
-     declaration preceded by a comment no longer started its record. Comments
-     are stripped first now.
-
-98/98 native, 5/5 arity_query.sh, fixpoint ok.
-```
-
-## Record — `d9e301b`
-
-```
-land arity-from-header: the runtime declares its own surface
-```
@@ -1,52 +0,0 @@
-# one type erases the return
-
-One `Ishikawa → scientific method → Six Sigma` loop. The record below is the
-commit message as written at the time, before the outcome was known to anyone
-reading this file.
-
-## Record — `d2d89fc`
-
-```
-EXPERIMENT: temporal types as data — and the pass that GREW the compiler
-
-This block is structurally unlike the previous four. It does not only
-adjudicate, it DISPATCHES: Instant + Duration must become el_instant_add_dur,
-LocalDate + Duration must become el_local_date_add_dur. The emitted C depends on
-the type answer, so it cannot move to a post-hoc query. Selecting which call to
-emit is an emitter's actual job.
-
-PREDICTIONS AND RESULTS
-  P1 the block conflates dispatch with adjudication      TRUE
-  P2 adjudication can move, dispatch cannot              TRUE
-  P3 this pass shrinks codegen far less than the last    TRUE, and worse:
-                                                         4513 -> 4537, it GREW
-                                                         by 24 lines
-  P4 the rules are affine algebra, closed by construction TRUE
-  P5 no type propagation -- name tracking plus a
-     hardcoded list of which builtins return which type   TRUE, 19 names
-
-P3 is the honest result and it is not spun: moving 19 names into a data file
-cost more lines than it saved, because a generic loader is larger than the
-enumeration it replaces. The win is not line count. It is that adding a 20th
-temporal builtin is now a one-line edit to signatures.rel instead of a compiler
-change, and that the data is inspectable.
-
-WHY THE HEADER CANNOT SUPPLY THIS, unlike arity: el_runtime.h declares every
-builtin as returning el_val_t, because El has ONE type. That single type is why
-the whole seam is cheap and it is exactly why the C boundary cannot say that
-now() returns an Instant while unix_seconds() returns an Int. The El-level type
-is real and the boundary erases it.
-
-INCOMPLETE, and stated rather than hidden: P2 said adjudication could move to a
-query. It has NOT. Violations still emit TIME_TYPE_ERROR inline from the
-emitter. Only the type DATA moved. Moving the adjudication needs the operand
-types recorded as relations, which is a further pass.
-
-98/98 native, 4/4 temporal_signatures.sh, fixpoint ok.
-```
-
-## Record — `e01e079`
-
-```
-land temporal signatures as data: the type table leaves, the dispatch stays
-```
@@ -1,47 +0,0 @@
-# judgment lives with knowledge
-
-One `Ishikawa → scientific method → Six Sigma` loop. The record below is the
-commit message as written at the time, before the outcome was known to anyone
-reading this file.
-
-## Record — `e8e25a0`
-
-```
-EXPERIMENT: temporal adjudication moves out; the placeholder stays
-
-The previous pass moved the type DATA and left the judgment inline, which I
-stated rather than hid. This finishes it.
-
-PREDICTIONS AND RESULTS
-  P1 codegen can emit operand-type relations               TRUE
-                                                           "main calls temporal:instant_plus_instant"
-  P2 the affine rules are a small closed set as data       TRUE  6 rules
-  P3 violations still caught at build time                 TRUE  exit=1
-  P4 the reporter leaves codegen                           TRUE  4538 -> 4507
-  P5 the TIME_TYPE_ERROR placeholder must STAY             TRUE
-
-P5 is the boundary of this whole approach. The emitter has to emit SOMETHING
-for an illegal expression -- it cannot emit nothing and it cannot decide what
-the program meant. So the placeholder is irreducible in the same way the AST
-traversal was: what moved is the judgment and the wording, not the fact that
-something must be written.
-
-The rules are affine algebra and the set is closed because there are only two
-kinds of thing. An Instant is a POINT, a Duration is a DISPLACEMENT: add a
-displacement to a point, subtract two points for a displacement, combine
-displacements. Nothing else is meaningful, which is why the enumeration in
-temporal.rel cannot grow the way an allowlist does.
-
-A defect in my own checker, found by running it: the .rel file uses aligned
-columns and my awk assumed a single space, so the message came out with the
-rule key still prefixed. Same class as the multi-line header parse in the arity
-pass -- formatting assumptions that only fail when you look at the output.
-
-98/98 native, 6/6 temporal_query.sh, fixpoint ok.
-```
-
-## Record — `50425f3`
-
-```
-land temporal adjudication as a query: the emitter records, the rules are data
-```
@@ -1,49 +0,0 @@
-# thirty five return types
-
-One `Ishikawa → scientific method → Six Sigma` loop. The record below is the
-commit message as written at the time, before the outcome was known to anyone
-reading this file.
-
-## Record — `cbef1c1`
-
-```
-EXPERIMENT: Int return types as data — and the bug that fell out
-
-PREDICTIONS AND RESULTS
-  P1 is_int_call's 35 hardcoded names move to data        TRUE
-  P2 is_int_name stays -- it is annotation propagation    TRUE
-  P3 the dispatch stays -- it is emission                 TRUE
-  P4 codegen shrinks ~40 lines                            TRUE  4507 -> 4469
-  P5 the design doc's characterisation is WRONG           TRUE
-  P6 the moved data also fixes the bug it exposed         TRUE
-
-P5 CORRECTS THE RECORD. el-language-design.md and geometry-vs-code.md both cite
-"== lowering to str_eq unless both operand names are in a hardcoded int-name
-set -- a literal list of variable names treated as integers" as the paradigm
-defect. It is not one. __int_names is populated from TYPE ANNOTATIONS
-(param["type"] == "Int"), which is primitive but legitimate type propagation.
-The actual defect was is_int_call: 35 hardcoded builtin return types, the same
-shape as the temporal 19.
-
-P6 IS A LIVE CORRECTNESS BUG, PRE-EXISTING, NOW FIXED
-
-    let a = str_len("hello")     // no annotation
-    let b = str_len("hi")
-    let c = a + b                // -> el_str_concat(a, b) on two integers
-
-Verified identical on the pre-change compiler, so not a regression. It compiled
-clean, ran, and printed NOTHING where it should print 7. No error at any layer.
-
-The repair is three lines: an unannotated let takes its type from what the
-initialiser returns. The return types were already required for dispatch and
-were simply never consulted at the binding site. Moving them into data is what
-made the gap visible -- reading the code for eight hours did not.
-
-98/98 native + 2 new, 31/31 integration, fixpoint ok.
-```
-
-## Record — `505e5e7`
-
-```
-land int signatures, and repair a silent miscompilation they exposed
-```
@@ -1,57 +0,0 @@
-# keywords that reserve nothing
-
-One `Ishikawa → scientific method → Six Sigma` loop. The record below is the
-commit message as written at the time, before the outcome was known to anyone
-reading this file.
-
-## Record — `0143cc4`
-
-```
-ANSWER: is a grammar a convention, or a region?
-
-Both, at different layers -- and it is the same split as serialization: the
-convention is the BASIS, never the ACT.
-
-  lexeme -> token      `fn` means function-start because someone said so   CONVENTION
-  shape recognition    given tokens, which construct is this               REGION
-  source -> structure  parsing is transduction onto that basis             GEOMETRY
-  byte traversal       something must read them in order                   IRREDUCIBLE
-
-Three things push the ACT toward region rather than convention: ambiguity
-(a * b needs context; a grammar resolves it with the lexer hack, a region by
-neighbourhood), error recovery (nearest-region is free), and precedence, which
-is ordering along an axis with a conventional parameter.
-
-AND THE SHOULD GATE SAYS NO TO THE OBVIOUS MOVE
-
-Every other table this session moved to data. This one stays code. The keyword
-set is CLOSED by the language definition -- it does not leak the way an
-allowlist does -- and the lexer runs before the program is understood, so a
-program can never declare its own keywords. Externalising it costs file I/O on
-every compile and buys nothing. Same verdict as is_digit in ASCII.
-
-WHAT WAS ACTUALLY WRONG: five of 46 keywords were consumed by no parser or
-codegen path. sealed, activate, seed, protocol, impl. Each stole an identifier
-from users for nothing.
-
-SECOND SILENT MISCOMPILATION OF THE DAY. Using one did not fail to parse:
-
-    let seed = 42
-    let impl = seed + 1
-
-compiled CLEAN -- zero cc errors -- and printed 0 instead of 44. No diagnostic
-at any layer. Fixed by removing the five.
-
-A DEFECT IN MY OWN MEASUREMENT, caught before it did damage: my first pass
-checked only parser.el and reported `test` as inert too. codegen consumes it at
-4135 for --test mode, and the tree has 408 uses. Removing it would have broken
-every test in the suite. The measurement was re-run across all four consumers.
-
-100/100 native + 2 new, 31/31 integration, fixpoint ok.
-```
-
-## Record — `067dd40`
-
-```
-answer the parsing question: a grammar is a basis, and five keywords reserved nothing
-```
@@ -1,53 +0,0 @@
-# no namespacing at all
-
-One `Ishikawa → scientific method → Six Sigma` loop. The record below is the
-commit message as written at the time, before the outcome was known to anyone
-reading this file.
-
-## Record — `79f6cb7`
-
-```
-ANSWER: if the partition is a neighbourhood, does linking survive?
-
-The question is premature, and measuring says why. El's partition is a
-FILESYSTEM PATH, not a neighbourhood, and there is no namespacing at all.
-
-MEASURED
-  import is textual inlining (resolve_imports), guarded against double
-  inclusion by a __elc_imp__:<path> state key
-  when a .elh header exists the header is inlined instead and the .el is marked
-  seen, so symbols resolve at C link time -- so linking IS real, delegated to C
-  two modules defining `helper` emit two C functions into one translation unit
-
-So linking barely survives the PATH partition. Whether it survives a
-neighbourhood partition cannot be asked yet.
-
-A DIAGNOSTIC REGRESSION I CAUSED, found by asking this question. cc does catch
-the collision, but reports:
-
-    error: redefinition of '__el_body_helper'
-    error: redefinition of '__env_helper'
-    error: redefinition of '__thunk_helper'
-    error: redefinition of 'helper'
-
-The user's own function is FOURTH. The first three are generated symbols
-introduced by the unconditional-wrapper pass earlier today -- before it, there
-was one clear message. Repaired by catching the collision at El level instead:
-
-    duplicate definition: 'helper' is defined 2 times — El has no namespacing,
-    so imported modules share one global scope
-
-LIMIT, stated rather than hidden: textual inlining destroys file provenance. By
-the time codegen runs there is one source string, so the message can say WHICH
-name collides but not which files. Naming a.el and b.el needs provenance
-threaded through resolve_imports.
-
-104/104 native, 4/4 definitions_query.sh, the compiler itself reports clean,
-fixpoint ok.
-```
-
-## Record — `f23cb2b`
-
-```
-answer the module question: the partition is a path, and there is no namespacing
-```
@@ -1,64 +0,0 @@
-# tokens carry no position
-
-One `Ishikawa → scientific method → Six Sigma` loop. The record below is the
-commit message as written at the time, before the outcome was known to anyone
-reading this file.
-
-## Record — `6c975b1`
-
-```
-thread provenance through resolve_imports
-
-The module question ended with a limit: textual inlining destroys file
-provenance, so a duplicate-definition message could name the symbol but not the
-files. Threading it exposed a bigger absence first.
-
-TOKENS HAD NO POSITION AT ALL. A token was a flat (kind, value) pair, so NO
-diagnostic in El could name a place -- every error named a symbol and never a
-line. That is the prerequisite the module question was resting on.
-
-THE CHAIN, end to end
-  lexer            counts newlines; tok_append mints (kind, value, line)
-  parser           stride 2 -> 3; tok_line added; FnDef carries its line
-  codegen          records <fn> defines_at:<line>
-  resolve_imports  publishes <file> spans <start> <end> for the combined source
-  checker          maps a combined line back to file:line-within-that-file
-
-    duplicate definition: 'helper' is defined 2 times — El has no namespacing,
-    so imported modules share one global scope
-        /tmp/modtest/a.el:1
-        /tmp/modtest/b.el:1
-
-PREDICTIONS AND RESULTS
-  P1 15 stride sites, encapsulated in tok_kind/tok_value   TRUE, but see below
-  P2 adding a line field is mechanical                     TRUE
-  P3 the lexer must count newlines                         TRUE
-  P4 resolve_imports can record per-file line ranges       TRUE
-  P5 the message can then name both files                  TRUE
-  P6 token memory grows                                    TRUE, 25.0 -> 33.9 MB (+36%)
-
-FOUR DEFECTS, EACH FOUND BY RUNNING AND NOT BY READING
-
-1. interp_tokens_append_all walks the token list DIRECTLY with its own copy of
-   the stride. Gen1 built fine and gen2 emitted corrupt C, because the
-   compiler's own source uses string interpolation. My search missed it because
-   I grepped for the variable name `tokens`; it is called `dst`/`result`.
-   Searching by name instead of by shape -- third time today.
-2. tok_count in test_compiler.el carried the stride too. I had scoped the search
-   to compiler sources and it had escaped into the tests.
-3. Nested resolve_imports calls accumulated spans into shared state, so each
-   republished meaningless line ranges under the parent's name. Making the
-   buffer local fixed it; guarding the WRITE did not, which is what I tried
-   first.
-4. The first working version reported b.el:3 -- the COMBINED line against a
-   filename that has no line 3. A file:line that does not match the file is
-   worse than no line at all.
-
-105/105 native, 37/37 integration, fixpoint ok, compiler self-checks clean.
-```
-
-## Record — `cb7289f`
-
-```
-thread provenance end to end: a diagnostic can finally name a place
-```
@@ -1,53 +0,0 @@
-# annotations are never checked
-
-**Status: verified on `experiment/annotation-checking`, not merged.**
-
-## Ishikawa — why does El silently miscompile?
-
-Three bugs found the same day shared one shape.
-
-```
-method       type tracked by per-function name sets, fed from annotations
-machine      el_val_t erases everything at the C boundary
-material     no propagation through expressions
-measurement  nothing verifies an annotation against what it annotates
-─────────────────────────────────────────────────────────────────────────
-root cause   El has type ANNOTATIONS but no type CHECKING. The annotation
-             feeds dispatch and is never itself verified.
-```
-
-## Predictions
-
-```
-P1  let x: Int = "hello"  compiles clean               expect TRUE
-P2  let s: String = 42    compiles clean               expect TRUE
-P3  the annotation drives dispatch, unverified         expect TRUE
-P4  same root cause as all three bugs found today      expect TRUE
-P5  checking literal-vs-annotation catches both        expect TRUE
-P6  zero false positives across the compiler's source  expect TRUE
-```
-
-## Results — 6/6, and worse than a wrong answer
-
-```
-let x: Int = "hello"; x + 1     →  4343631981   a string POINTER used as an integer
-let s: String = 42; println(s)  →  nothing      address 42 dereferenced as a string
-```
-
-The first **leaks a raw memory address into program output**. The second is an
-**arbitrary-read primitive** if that integer is ever attacker-influenced.
-
-Verified: 6/6, zero false positives across the compiler's own source, fixpoint
-ok, 105/105 native.
-
-## Six Sigma
-
-The emitter only **records** the mismatch; `tools/check/annotations.sh` decides —
-consistent with every other check. Literals are checked because they are
-unambiguous.
-
-**Incomplete, stated not hidden:** only literals. `let x: Int = some_string_fn()`
-still passes, because `signatures.rel` carries Int/Instant/Duration and no
-String entries. That is a data gap, not a capability limit — every El function
-declares its return type in source and codegen already holds `ret_type` on every
-`FnDef`.
@@ -1,88 +0,0 @@
-# async — half expressible, and the cycle that was dogma
-
-**Status: replicated and corroborated. Three runs — the first was invalid.**
-
-> **Chain of custody note, 2026-08-17.** The original measurements were produced
-> by a C stub written in `/tmp`, and that artifact was destroyed when the session
-> worktrees were removed. For a period this file asserted results with nothing
-> behind them — a claim inside an evidence record, which is the defect that turns
-> a chain into a pile. It was **rerun**, not reconstructed: reconstructing the
-> missing file would have been a fabrication with a fresh timestamp.
->
-> The fixture now lives at `lang/tests/integration/fixtures/future.c` and the
-> harness at `lang/tests/integration/async_future.sh`, so a third party can
-> reproduce this without taking my word for it. **6/6.**
->
-> The replication is labelled as such: the outcomes were already known when the
-> harness was written, so its expectations are not predictions committed in
-> advance. Its value is reproducibility, not foresight.
-
-## The first attempt was DOGMA, not science
-
-I had just finished arguing that `@async` was expressible, then ran something to
-confirm it. **No prediction was committed.** The test was rigged in a way that
-should have been visible while writing it:
-
-```c
-pthread_create(&t,NULL,runner,NULL); pthread_join(t,NULL);
-```
-
-`join` immediately after `create` — the caller blocks until the body finishes.
-That is a thread round-trip, not deferral. And the test printed the word
-`DEFERRED` itself: I wrote the conclusion into the output and read it back.
-
-```
-Ishikawa on the rigged test
-  method       ran after concluding, not to decide
-  machine      nothing forces a prediction before execution
-  material     the assertion was written into the output string
-  measurement  no falsification criterion existed, so nothing could fail
-  root cause   the test was authored by the party holding the conclusion,
-               with no commitment made before it ran
-```
-
-Discarded and re-run properly.
-
-## Second run — predictions committed first
-
-```
-P1  the caller proceeds while the body runs                   expect TRUE
-P2  interleaving is observable in timestamps                  expect TRUE
-P3  the result cannot be retrieved — one 64-bit slot, no
-    future type, so the wrap either blocks or returns
-    something that is not the result                          expect TRUE
-P4  therefore HALF expressible: fire-and-forget yes, await no  expect TRUE
-```
-
-## Results — 4/4
-
-```
-[    18 us] wrap RETURNS to caller
-[    29 us] body START
-caller continues, got 0
-[ 50176 us] body END   (computed 42)
-caller done
-```
-
-The caller got **0, not 42**. Both of my earlier claims were wrong in opposite
-directions: "not expressible" was too strong — fire-and-forget works today,
-bound after the build, no compiler change. "Expressible" was too strong the
-other way.
-
-## Follow-on cycle — a future is one more tagged object
-
-```
-P1  el_val_t already carries tagged heap objects   TRUE  5 magic tags exist
-P2  a future is one more                           TRUE
-P3  the caller awaits and gets 42                  TRUE
-P4  ZERO compiler changes                          TRUE  runtime C + one binding
-P5  the unbound path still works                   FALSE SIGSEGV
-```
-
-**P4 is the result.** `@async` — called unexpressible for hours — needs no
-compiler change. A future is one more magic-tagged heap object; `defer` returns
-the handle, `el_await` blocks.
-
-**P5 is the failure that mattered.** Sixty seconds after diagnosing
-`let s: String = 42` as an arbitrary read, I wrote the identical defect into
-`el_await`: reading `->magic` off an unvalidated slot. That opened cycle 19.
@@ -1,61 +0,0 @@
-# a convention is not a gate
-
-One `Ishikawa → scientific method → Six Sigma` loop. The record below is the
-commit message as written at the time, before the outcome was known to anyone
-reading this file.
-
-## Record — `9a6c161`
-
-```
-a slot must be validated before it is dereferenced
-
-ISHIKAWA: el_val_t carries integers AND tagged heap pointers, so "is this a
-pointer" is undecidable without checking first. That check was a CONVENTION
-every author had to know rather than a GATE they had to pass through, and
-looks_like_heap_obj was static -- so every sibling translation unit re-derived
-it.
-
-MEASURED, across the five existing tags
-  geom_of        looks_like_heap_obj   full guard      correct
-  mfld_of        looks_like_heap_obj   full guard      correct
-  el_bin_lookup  (uintptr_t)p < 4096   floor only      reads 8 bytes BACKWARD
-  el_input_len   s ? ... : 0           NULL only       strlen's an integer
-
-  sha256_hex(50000)  ->  exit 139, SIGSEGV, compiled clean
-
-PREDICTIONS AND RESULTS
-  P1  looks_like_heap_obj is static, not exported     TRUE
-  P2  each tagged type re-derives the check           TRUE
-  P3  at least one is missing guard components        TRUE (two are)
-  P6  sha256_hex(<int>) reads out of bounds           TRUE
-  P8  routing el_bin_lookup through the gate fixes it FALSE
-  P9  the legitimate hash is unchanged                TRUE
-  P11 fixpoint and suites hold                        TRUE
-
-P8 IS THE USEFUL FAILURE. Guarding the tagged lookup changed nothing --
-looks_like_heap_obj(49992) correctly returns 0, el_bin_lookup bails, and then
-el_input_len falls through to strlen() on address 50000. The FALLBACK was the
-hazard, not the tagged path. A NULL check does not establish that a slot is a
-pointer. I would have shipped the wrong fix and called it verified.
-
-A MEASUREMENT DEFECT, fourth today: my first run of the crash reported exit=0,
-because $? read head's exit through a pipe rather than the program's. I nearly
-recorded a segfault as a clean run. Same shape as grepping only parser.el and
-searching by variable name instead of by operation.
-
-AND I PROVED THE HAZARD FROM THE INSIDE. Sixty seconds after diagnosing
-`let s: String = 42` as an arbitrary-read primitive, I wrote the identical
-defect into el_await -- dereferencing ->magic off an unvalidated slot -- and
-only then found the runtime had already made it twice.
-
-el_tagged() is now exported in el_runtime.h. Anything that dereferences a slot
-without passing through it is the defect.
-
-105/105 native, 42/42 integration across eight harnesses, fixpoint ok.
-```
-
-## Record — `3049a70`
-
-```
-make the guard a gate: sha256_hex(50000) no longer segfaults
-```
@@ -1 +0,0 @@
-bash -c cd /Users/will/Development/neuron-technologies/foundation/el/docs/v1/experiments/evidence/cycles && for d in 0*-* 1*-*; do [ -f "$d/MANIFEST.tsv" ] || continue; rows=$(awk -F"\t" "NR>1 && NF>=9 && \$1!=\"sha256\"{c++} END{print c+0}" "$d/MANIFEST.tsv"); stray=$(awk -F"\t" "NR>1 && NF<9{c++} END{print c+0}" "$d/MANIFEST.tsv"); outs=$(ls "$d"/*.out 2>/dev/null | wc -l | tr -d " "); printf "%-46s wellformed_rows=%-4s stray_lines=%-4s out_files=%s\n" "$d" "$rows" "$stray" "$outs"; done
@@ -1,18 +0,0 @@
-00-cross-cycle-codegen-linecounts              wellformed_rows=9    stray_lines=9    out_files=10
-01-constructs-have-nowhere-to-be               wellformed_rows=20   stray_lines=6    out_files=20
-02-a-construct-cannot-refuse                   wellformed_rows=25   stray_lines=68   out_files=25
-03-the-wrapper-was-conditional                 wellformed_rows=39   stray_lines=183  out_files=39
-04-c-has-no-closure-syntax                     wellformed_rows=32   stray_lines=26   out_files=32
-05-the-emitter-discards-what-it-knows          wellformed_rows=21   stray_lines=17   out_files=21
-06-the-crossing-resolves-at-emission           wellformed_rows=41   stray_lines=271  out_files=41
-07-invocation-is-not-composable                wellformed_rows=22   stray_lines=18   out_files=22
-08-the-emitter-adjudicates                     wellformed_rows=22   stray_lines=88   out_files=22
-09-policy-inside-the-compiler                  wellformed_rows=26   stray_lines=135  out_files=26
-10-a-second-copy-of-the-header                 wellformed_rows=15   stray_lines=33   out_files=15
-11-one-type-erases-the-return                  wellformed_rows=11   stray_lines=0    out_files=11
-12-judgment-lives-with-knowledge               wellformed_rows=10   stray_lines=0    out_files=10
-13-thirty-five-return-types                    wellformed_rows=20   stray_lines=0    out_files=20
-14-keywords-that-reserve-nothing               wellformed_rows=15   stray_lines=0    out_files=15
-15-no-namespacing-at-all                       wellformed_rows=17   stray_lines=0    out_files=17
-16-tokens-carry-no-position                    wellformed_rows=13   stray_lines=0    out_files=13
-17-annotations-are-never-checked               wellformed_rows=1    stray_lines=0    out_files=2
@@ -1,7 +0,0 @@
-commit	9540f2399120172b92e986e081877ff058adbdd3
-tree	clean
-captured_utc	2026-08-17T17:40:38Z
-exit	0
-ms	145
-sha256_out	8b82c6f04c641f9777dd1bd1f2ddd5dd7c61b502bb9aa33d9a013eaa25137873
-sha256_err	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
@@ -1 +0,0 @@
-0
@@ -1 +0,0 @@
-bash tools/evidence/verify-manifest.sh docs/v1/experiments/evidence/cycles
@@ -1 +0,0 @@
-  evidence: 0 artifacts verified, 0 altered, 0 missing
@@ -1,7 +0,0 @@
-commit	9540f2399120172b92e986e081877ff058adbdd3
-tree	clean
-captured_utc	2026-08-17T17:40:38Z
-exit	0
-ms	9
-sha256_out	965c3dc538c178d5a93adc06ac162d01ab3c5c1f21e34ec16673a5669867c4b8
-sha256_err	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
@@ -1 +0,0 @@
-0
@@ -1 +0,0 @@
-bash /Users/will/Development/neuron-technologies/foundation/el/tools/evidence/verify-manifest.sh /Users/will/Development/neuron-technologies/foundation/el/docs/v1/experiments/evidence/cycles
@@ -1,9 +0,0 @@
-  DIRTY-TREE 11-one-type-erases-the-return/0001-codegen-lines-P3.out (commit fbb3a52220e1) — not reproducible by checkout
-  DIRTY-TREE 11-one-type-erases-the-return/0002-codegen-lines-newline-check.out (commit a116710bacba) — not reproducible by checkout
-  DIRTY-TREE 11-one-type-erases-the-return/0003-signatures-rel-name-count-P5.out (commit a116710bacba) — not reproducible by checkout
-  DIRTY-TREE 12-judgment-lives-with-knowledge/0001-codegen-lines-P4.out (commit a116710bacba) — not reproducible by checkout
-  DIRTY-TREE 12-judgment-lives-with-knowledge/0002-temporal-rel-rule-count-P2.out (commit a116710bacba) — not reproducible by checkout
-  DIRTY-TREE 13-thirty-five-return-types/0001-codegen-lines-P4.out (commit a116710bacba) — not reproducible by checkout
-  DIRTY-TREE 13-thirty-five-return-types/0002-is-int-call-name-count-P1.out (commit a116710bacba) — not reproducible by checkout
-  DIRTY-TREE 16-tokens-carry-no-position/0002-P1-stride-sites-touched.out (commit 99b12f85c6ba) — not reproducible by checkout
-  evidence: 365 artifacts verified, 0 altered, 0 missing
@@ -1,7 +0,0 @@
-commit	9540f2399120172b92e986e081877ff058adbdd3
-tree	clean
-captured_utc	2026-08-17T17:40:50Z
-exit	0
-ms	3949
-sha256_out	cd8adcbc95c1db4fa7848f51a15580de6460b5d5010ee780e4c4aa60f20d2984
-sha256_err	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
@@ -1 +0,0 @@
-0
@@ -1 +0,0 @@
-bash -c D=$(mktemp -d); bash /Users/will/Development/neuron-technologies/foundation/el/tools/evidence/verify-manifest.sh "$D"; echo "exit=$? on a directory containing NO manifests at all"; rmdir "$D"
@@ -1,2 +0,0 @@
-  evidence: 0 artifacts verified, 0 altered, 0 missing
-exit=0 on a directory containing NO manifests at all
@@ -1,7 +0,0 @@
-commit	9540f2399120172b92e986e081877ff058adbdd3
-tree	clean
-captured_utc	2026-08-17T17:41:07Z
-exit	0
-ms	19
-sha256_out	824b7a3f9cfba4b9edb8250714efb5f671b94e15f51abe9e04e7d24e44a19fb6
-sha256_err	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
@@ -1 +0,0 @@
-0
@@ -1 +0,0 @@
-bash -c printf "%-11s %-22s %-22s %s\n" CYCLE CLAIMED OBSERVED "OFFSET(parent/commit)"; printf "%-11s %-22s %-22s %s\n" "03/285166c" "5094 -> 5044 (d50)" "5095 -> 5043 (d52)" "-1 / +1"; printf "%-11s %-22s %-22s %s\n" "06/28d19da" "5157 -> 5096 (d61)" "5156 -> 5095 (d61)" "+1 / +1"; printf "%-11s %-22s %-22s %s\n" "07/bc2f26d" "5042 -> 4977 (d65)" "5043 -> 4976 (d67)" "-1 / +1"; printf "%-11s %-22s %-22s %s\n" "08/c741cfe" "4962 (+301)" "4962 (+301)" " 0 /  0"; printf "%-11s %-22s %-22s %s\n" "09/c2d9596" "4963 -> 4881 (d82)" "4962 -> 4896 (d66)" "-1 / -15"; printf "%-11s %-22s %-22s %s\n" "10/9cc6040" "4903 -> 4512 (d391)" "4896 -> 4512 (d384)" "+7 /  0"; echo; echo "Offsets are NOT in a consistent direction. A single counting convention (missing trailing newline, editor last-line number) would produce a uniform offset. It does not."
@@ -1,9 +0,0 @@
-CYCLE       CLAIMED                OBSERVED               OFFSET(parent/commit)
-03/285166c  5094 -> 5044 (d50)     5095 -> 5043 (d52)     -1 / +1
-06/28d19da  5157 -> 5096 (d61)     5156 -> 5095 (d61)     +1 / +1
-07/bc2f26d  5042 -> 4977 (d65)     5043 -> 4976 (d67)     -1 / +1
-08/c741cfe  4962 (+301)            4962 (+301)             0 /  0
-09/c2d9596  4963 -> 4881 (d82)     4962 -> 4896 (d66)     -1 / -15
-10/9cc6040  4903 -> 4512 (d391)    4896 -> 4512 (d384)    +7 /  0
-
-Offsets are NOT in a consistent direction. A single counting convention (missing trailing newline, editor last-line number) would produce a uniform offset. It does not.
@@ -1,7 +0,0 @@
-commit	9540f2399120172b92e986e081877ff058adbdd3
-tree	clean
-captured_utc	2026-08-17T17:46:23Z
-exit	0
-ms	8
-sha256_out	df3922caf56164ed2e7e7e69bc9d7926e7decb4366ef8ef870191e86a6098e66
-sha256_err	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
@@ -1 +0,0 @@
-0
@@ -1 +0,0 @@
-bash -c for c in 45325f7 addd5120 409bf573 dcaa77d; do n=$(git show "${c}:lang/el-compiler/src/codegen.el" </dev/null 2>/dev/null | wc -l | tr -d " "); printf "%-10s codegen.el=%-6s touched_codegen=%s  %s\n" "$c" "$n" "$(git show --name-only --format="" "$c" | grep -c "el-compiler/src/codegen.el")" "$(git log -1 --format="%ci %s" "$c")"; done
@@ -1,4 +0,0 @@
-45325f7    codegen.el=4661   touched_codegen=1  2026-08-16 16:08:40 -0500 singleton: guard the state, not the program's name
-addd5120   codegen.el=4661   touched_codegen=0  2026-08-16 19:59:43 -0500 runtime: extract engram_text.c, and repair 10 harnesses that could not link
-409bf573   codegen.el=4661   touched_codegen=0  2026-08-17 04:34:32 -0500 track the architecture docs
-dcaa77d    codegen.el=4670   touched_codegen=1  2026-08-17 04:53:40 -0500 make boundary crossings attributable to the construct that caused them
--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				bash -c for f in lexer parser codegen; do git log --format="%H %ad" --date=short --reverse -- lang/el-compiler/src/$f.el \| while read sha date; do blob=$(git show "$sha:lang/el-compiler/src/$f.el" 2>/dev/null); [ -z "$blob" ] && continue; t=$(mktemp /tmp/s-XXXXXX.c); printf "%s\n" "$blob" > "$t"; row=$(cloc --force-lang=C --quiet --csv "$t" 2>/dev/null \| tail -1); k=$(echo "$row"\|cut -d, -f5); [ -n "$k" ] && echo -e "$f\t${sha:0:9}\t$date\t$(echo "$row"\|cut -d, -f3)\t$(echo "$row"\|cut -d, -f4)\t$k"; rm -f "$t"; done; done
				`@@ -1 +0,0 @@`
				`./docs/experiments/instruments/instrument/plot/prove.sh`
				`@@ -1 +0,0 @@`
				`POSITIVE — reads and verifies a real evidence directory`
				`@@ -1 +0,0 @@`
				`docs/experiments/v2/cycles/07-the-caller-was-already-there/measure.sh`
				`@@ -1 +0,0 @@`
				`bash -c cd /Users/will/Development/neuron-technologies/foundation/el/docs/v1/experiments/evidence/cycles && for d in 0- 1-; do [ -f "$d/MANIFEST.tsv" ] \|\| continue; rows=$(awk -F"\t" "NR>1 && NF>=9 && \$1!=\"sha256\"{c++} END{print c+0}" "$d/MANIFEST.tsv"); stray=$(awk -F"\t" "NR>1 && NF<9{c++} END{print c+0}" "$d/MANIFEST.tsv"); outs=$(ls "$d"/*.out 2>/dev/null \| wc -l \| tr -d " "); printf "%-46s wellformed_rows=%-4s stray_lines=%-4s out_files=%s\n" "$d" "$rows" "$stray" "$outs"; done`
				`@@ -1 +0,0 @@`
				`bash tools/evidence/verify-manifest.sh docs/v1/experiments/evidence/cycles`
				`@@ -1 +0,0 @@`
				`evidence: 0 artifacts verified, 0 altered, 0 missing`
				`@@ -1 +0,0 @@`
				`bash /Users/will/Development/neuron-technologies/foundation/el/tools/evidence/verify-manifest.sh /Users/will/Development/neuron-technologies/foundation/el/docs/v1/experiments/evidence/cycles`
				`@@ -1 +0,0 @@`
				`bash -c D=$(mktemp -d); bash /Users/will/Development/neuron-technologies/foundation/el/tools/evidence/verify-manifest.sh "$D"; echo "exit=$? on a directory containing NO manifests at all"; rmdir "$D"`
				`@@ -1 +0,0 @@`
				bash -c printf "%-11s %-22s %-22s %s\n" CYCLE CLAIMED OBSERVED "OFFSET(parent/commit)"; printf "%-11s %-22s %-22s %s\n" "03/285166c" "5094 -> 5044 (d50)" "5095 -> 5043 (d52)" "-1 / +1"; printf "%-11s %-22s %-22s %s\n" "06/28d19da" "5157 -> 5096 (d61)" "5156 -> 5095 (d61)" "+1 / +1"; printf "%-11s %-22s %-22s %s\n" "07/bc2f26d" "5042 -> 4977 (d65)" "5043 -> 4976 (d67)" "-1 / +1"; printf "%-11s %-22s %-22s %s\n" "08/c741cfe" "4962 (+301)" "4962 (+301)" " 0 / 0"; printf "%-11s %-22s %-22s %s\n" "09/c2d9596" "4963 -> 4881 (d82)" "4962 -> 4896 (d66)" "-1 / -15"; printf "%-11s %-22s %-22s %s\n" "10/9cc6040" "4903 -> 4512 (d391)" "4896 -> 4512 (d384)" "+7 / 0"; echo; echo "Offsets are NOT in a consistent direction. A single counting convention (missing trailing newline, editor last-line number) would produce a uniform offset. It does not."