runtime: the link set is multi-file — name it once, ship all of it

el_runtime.c was created 2026-05-03 as an explicitly temporary build shim. It
was deleted that afternoon ("runtime is 100% native El") and restored 25 minutes
later "UNTIL the compiler is updated to emit #include el_seed.h". The `until`
never came. 3.5 months on it is 20,527 lines, and nothing was ever set up to
notice — a file scheduled for deletion gets no owner, no budget, no boundary.

What kept it growing is not inertia, it is an instruction. lang/AGENTS.md said
el_runtime.c "is the authoritative single-file link target ... THIS IS WHERE A
NEW C BUILTIN'S IMPLEMENTATION MUST CURRENTLY LIVE TO BE LINKABLE", and made it
step 1 of the add-a-builtin recipe. That is false. Placement is a link-time
concern: builtin_arity maps NAME -> ARITY INT only, the El name is emitted as
the exact C symbol, and `ld` resolves it — the compiler cannot tell which .c a
symbol came from. `nm lang/dist/platform/elc` on the shipped compiler already
shows T _engram_geo_reify_index_new, T _vindex_insert, T _engram_think,
T _engram_reason_abduce: it is linked from ten translation units today. In a
repo where agents write most of the code, a false instruction in the instruction
file is the forcing function. The file grew because the recipe said to grow it.

The multi-file runtime is therefore already real, and the docs and the
distribution never caught up — which left a live, shipped bug:

  * Linking el_runtime.c alone FAILS at `ld` (undefined engram_ground_json,
    engram_activate_inner, eg_find_relation, cog_assert_two_axis, ...) because
    el_runtime.c #includes six engram headers and calls into all six siblings.
  * sdk-release.yaml shipped el_runtime.c/.h + engram_store.c/.h and none of the
    other five required .c files, so downstream consumers of the el-runtime-c
    Artifact Registry package and of install.sh got a lib/ that cannot link.
  * .githooks/pre-commit linked el_runtime.c alone with stderr to /dev/null, so
    it reported all 13 native suites as FAILED with the real ld error invisible.
  * AGENTS.md's self-host recipe compiled el-compiler/runtime/el_runtime.c — a
    path the same file's "DO NOT EDIT" list names as a lagging fork.

The root fix is to stop writing the list down eight times:

  * lang/runtime/SOURCES — the canonical link set, in one place, in link order.
  * scripts/el-runtime-sources.sh — prints it, optionally prefixed; --check
    fails loudly on a missing file, --headers for the shipped headers.
  * Every link line in AGENTS.md, lang/AGENTS.md, DESIGN.md, lang/spec/language.md,
    the three workflows and the pre-commit hook now reads that one list.
  * Adding a concern's .c is one line in SOURCES, so a new builtin no longer has
    to be appended to el_runtime.c just because appending was the cheaper edit.

Distribution: ship the siblings rather than amalgamate. Amalgamation needs a new
tool and contradicts DESIGN.md's compile-once-link-many; the siblings are already
independently authored and independently tested (engram/test/*.sh link subsets
directly), and engram_store.c was already shipped, so this completes a mechanism
that existed rather than inventing one. Source is also a superset: a consumer
that wants one file can concatenate, one that wants separate TUs cannot undo an
amalgamation. el-runtime-c/-h stay for backward compatibility; el-runtime-src is
added carrying the complete set plus SOURCES.

lang/AGENTS.md now points new C builtins at the concern-owning .c and states
plainly that the compiler cannot tell which .c a symbol came from, with the nm
evidence. AGENTS.md's "reconcile which is canonical (verify)" note is resolved:
neither file supersedes the other, the canonical unit is the set.

Verified locally (the bar; not CI):
  * engram/src/server.el compiles and links against the SOURCES set.
  * Compile-once-link-many into libel.a links the same program.
  * elb builds from the corrected recipe.
  * Self-host fixpoint byte-identical (11,110 lines, stage2 == stage3) built
    with the SOURCES-driven link line.
  * pre-commit hook: 0 of 13 native suites passing -> 8 of 13.

The 5 still-failing suites are PRE-EXISTING and untouched here: test_fs
(fs_list_json undeclared), test_state (state_has, state_get_or undeclared),
test_json (json_build_array/json_build_object/json_escape_string undefined),
test_time (now_ns undefined), test_env (1 assertion). Builtins registered in
builtin_arity with no implementation or no declaration anywhere — the same
recipe defect, now visible because the linker error is no longer suppressed.

Not attempted: making elc emit #include el_seed.h and dropping elb's hardcoded
runtime path. That is the correct long-term fix and finishes the 2026-05-03
migration, but it touches codegen and self-hosting and belongs in its own change.

scripts/el-runtime-sources.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# el-runtime-sources.sh — print the canonical El runtime link set.
+#
+# Reads lang/runtime/SOURCES (the single source of truth) and prints one path
+# per line, optionally prefixed with a directory. Use it anywhere a link line
+# would otherwise spell the runtime .c files out longhand:
+#
+#   cc -std=c11 -O2 -I lang/runtime -o app app.c \
+#      $(scripts/el-runtime-sources.sh lang/runtime) \
+#      -lcurl -lssl -lcrypto -lpthread -lm
+#
+# Options:
+#   --headers   print the shipped headers instead of the .c sources
+#   --check     verify every listed file exists; exit non-zero if any is missing
+#
+# WHY: linking el_runtime.c alone has been broken since el_runtime.c started
+# calling into the engram siblings. The list was duplicated across ~8 build
+# paths and drifted. It lives in exactly one place now — see lang/runtime/SOURCES.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+SOURCES="${ROOT}/lang/runtime/SOURCES"
+
+if [ ! -f "$SOURCES" ]; then
+  echo "FATAL: canonical runtime source list missing: $SOURCES" >&2
+  exit 1
+fi
+
+MODE="sources"
+PREFIX=""
+CHECK=0
+
+for arg in "$@"; do
+  case "$arg" in
+    --headers) MODE="headers" ;;
+    --check)   CHECK=1 ;;
+    -*)        echo "el-runtime-sources.sh: unknown option: $arg" >&2; exit 2 ;;
+    *)         PREFIX="${arg%/}/" ;;
+  esac
+done
+
+# Strip comments and blank lines. Order is preserved — it is link order.
+mapfile -t FILES < <(sed -e 's/#.*//' -e 's/[[:space:]]*$//' "$SOURCES" | grep -v '^$')
+
+if [ "${#FILES[@]}" -eq 0 ]; then
+  echo "FATAL: $SOURCES lists no sources" >&2
+  exit 1
+fi
+
+if [ "$MODE" = "headers" ]; then
+  # Every .c's matching .h, plus the headers that carry no .c of their own.
+  HDRS=()
+  for f in "${FILES[@]}"; do
+    h="${f%.c}.h"
+    [ -f "${ROOT}/lang/runtime/${h}" ] && HDRS+=("$h")
+  done
+  # Interface-only headers: no matching .c, but required to compile against.
+  for h in eg_cosine_batch_strategy.h el_native_target.h el_platform_win.h; do
+    [ -f "${ROOT}/lang/runtime/${h}" ] && HDRS+=("$h")
+  done
+  FILES=("${HDRS[@]}")
+fi
+
+RC=0
+for f in "${FILES[@]}"; do
+  if [ "$CHECK" -eq 1 ] && [ ! -f "${ROOT}/lang/runtime/${f}" ]; then
+    echo "MISSING: lang/runtime/${f} (listed in lang/runtime/SOURCES)" >&2
+    RC=1
+  fi
+  printf '%s%s\n' "$PREFIX" "$f"
+done
+
+exit $RC