runtime: publish the vector index instead of guarding it

The crash (SIGTRAP in engram_activate -> eg_vindex_sync -> vindex_insert ->
_realloc) had three read paths mutating five process-global statics.
engram_activate, eg_knn_for_node (whose own comment says "No writes.") and
engram_geo_reify_run_json all called eg_vindex_sync, which frees the index,
reallocs the seen-map and inserts — on a read.

Three moves, in decreasing order of how much they dissolve:

1. Misfiled scratch is not shared state. visited/visit_epoch/visited_cap
   were never owned by the index; they are one traversal's local, hoisted
   into struct VIndex as an allocation optimisation. They want neither a
   lock nor a capability nor a pool — just to go back in the call frame.
   Two concurrent READS stomped each other purely because of this.

2. const IS the capability. Once the scratch leaves the struct, search
   reads and nothing else, so vindex_search takes a const VIndex*. That is
   exactly what a capability-pointer ABI would have bought — a read path
   physically cannot call vindex_insert, enforced by the compiler on every
   future caller — for one qualifier instead of an ABI swept across
   hundreds of builtins.

3. What survives is publication, not ownership. HNSW insert is NOT an
   append: it rewires the neighbour links of already-existing elements and
   reallocs elems[], so the store's append-only property does not transfer
   to the index derived from it. eg_vindex_sync therefore splits into
   eg_vindex_maintain (exclusive, sole mutator) and eg_vindex_view (shared,
   returns const VIndex*). A read path may demand that a current snapshot
   exist — a request to the owner, not a mutation by the reader.

Write-side owner: eg_vindex_note_embedded hooks the embedding-ASSIGNMENT
sites rather than the append sites, because a node with no embedding cannot
be in a vector index — embedding assignment is the event that owns index
membership. One O(log n) insert, no O(node_count) presence scan. This also
retires the "STALENESS (honest tradeoff)" note where a lazily-embedded
older node stayed invisible to route_nearest/autoconnect until a full
rebuild (the embed-gap #20 shape).

Evidence. The existing harness conflated two hazards, which is why fixing
half of it read as failure. Split into four:

  single (3000 vec, ASan+UBSan)          clean  ->  clean
  readers (4 readers, no writer, TSan)   RACE   ->  clean
  unsynchronized (writer+reader, bare)   race   ->  race, expected forever
  published (owner + 4 readers)          n/a    ->  clean, 3000/3000 landed

RESULT: PASS. recall@10 = 0.9365 at ef_search=128 (gate >= 0.90);
determinism byte-identical across two independent builds.

The unsynchronized half is now permanently expected to race, deliberately:
it is the executable proof that the boundary must live above the data
structure, not inside it.

fb32d15's guard is KEPT, correcting this design's own section 5. Measured,
it guards TWO structures and only one was converted here: g->nodes/g->edges
are realloc'd in place (el_runtime.c:7618,7629) and engram_activate_inner's
embed-backfill writes n->emb through exactly such a borrowed pointer.
Deleting the guard reintroduces a measured 11171->9579 edge loss. Its
comment is narrowed to the RAM graph and the deletion precondition named.

That corrects the ordering claim too: the residual is not one ABI that
dissolves everything at once, it is a PROPERTY applied per structure.
Residues evaporate in the order the property is applied, and a residue
whose structure has not been converted must be left standing.

lang/runtime/engram_vindex.c

@@ -74,11 +74,6 @@ struct VIndex {
 
     int      entry;         /* entry-point element index, -1 if empty */
     int      max_level;     /* current top layer */
-
-    /* scratch: version-stamped visited set (O(1) reset). */
-    uint32_t* visited;
-    uint32_t  visit_epoch;
-    size_t    visited_cap;
 };
 
 /* ── small helpers ────────────────────────────────────────────────────────── */
@@ -166,37 +161,63 @@ static Pair heap_pop(Heap* h, int is_max){
     return top;
 }
 
-/* ── visited set ──────────────────────────────────────────────────────────── */
-static int visited_ensure(VIndex* ix){
-    if (ix->visited_cap >= ix->cap && ix->visited) return 0;
-    size_t nc = ix->cap ? ix->cap : 16;
-    uint32_t* nv = (uint32_t*)realloc(ix->visited, nc*sizeof(uint32_t));
-    if (!nv) return -1;
-    if (nc > ix->visited_cap) memset(nv + ix->visited_cap, 0, (nc-ix->visited_cap)*sizeof(uint32_t));
-    ix->visited = nv; ix->visited_cap = nc;
+/* ── visited set — owned by the CALL FRAME, never by the index ──────────────
+ * This buffer is per-TRAVERSAL scratch. It used to live in struct VIndex as an
+ * allocation optimisation, which made every traversal a write to shared state:
+ * two concurrent vindex_search calls stamped each other's epoch and then walked
+ * each other's marks, so even two pure READS corrupted the traversal (measured
+ * 2026-08-16: TSan data race at visited_reset, reached from vindex_search on one
+ * thread and vindex_insert on another; downstream SIGSEGV dereferencing a bogus
+ * element index).
+ *
+ * It is not an ownership problem and it does not want a lock or a capability —
+ * it was simply misfiled. A pure function's scratch belongs to the call. Moving
+ * it here is what lets vindex_search take a `const VIndex*`, which is in turn
+ * what makes "search does not mutate the index" a COMPILE-TIME property instead
+ * of a review comment.
+ *
+ * Cost: one calloc/free of cap*4 bytes per traversal (~55 KB at the live store's
+ * 13,820 elements), against thousands of dim-768 dot products in the same call.
+ * Deliberately NOT __thread: http_worker is a thread per connection, so a
+ * thread-local buffer would retain ~55 KB per connection for the process life. */
+typedef struct {
+    uint32_t* mark;      /* per-element epoch stamp */
+    uint32_t  epoch;     /* current traversal's stamp; 0 == "no traversal yet" */
+    size_t    cap;
+} VVisit;
+
+/* calloc leaves every stamp 0 and epoch 0; the first visit_reset moves to
+ * epoch 1, so no element reads as visited before it is marked. */
+static int visit_init(VVisit* v, size_t cap){
+    size_t nc = cap ? cap : 16;
+    v->mark = (uint32_t*)calloc(nc, sizeof(uint32_t));
+    if (!v->mark) return -1;
+    v->cap = nc; v->epoch = 0;
     return 0;
 }
-static inline void visited_reset(VIndex* ix){
-    if (++ix->visit_epoch == 0){                 /* wrapped: clear all */
-        memset(ix->visited, 0, ix->visited_cap*sizeof(uint32_t));
-        ix->visit_epoch = 1;
+static void visit_dispose(VVisit* v){ free(v->mark); v->mark = NULL; v->cap = 0; }
+static inline void visit_reset(VVisit* v){
+    if (++v->epoch == 0){                        /* wrapped: clear all */
+        memset(v->mark, 0, v->cap*sizeof(uint32_t));
+        v->epoch = 1;
     }
 }
-static inline int is_visited(VIndex* ix, int e){ return ix->visited[e]==ix->visit_epoch; }
-static inline void mark_visited(VIndex* ix, int e){ ix->visited[e]=ix->visit_epoch; }
+static inline int is_visited(const VVisit* v, int e){ return v->mark[e]==v->epoch; }
+static inline void mark_visited(VVisit* v, int e){ v->mark[e]=v->epoch; }
 
 /* ── search one layer (Algorithm 2): best-first, ef-bounded ───────────────── */
 /* Returns results as an unsorted Heap (max-heap on distance, size<=ef). Caller
  * owns res->a. `q` is a normalised query. */
-static int search_layer(VIndex* ix, const float* q, const int* eps, int neps,
+static int search_layer(const VIndex* ix, VVisit* vis, const float* q,
+                        const int* eps, int neps,
                         int ef, int layer, Heap* res /*out, max-heap*/){
     Heap cand = {0,0,0};                          /* min-heap: nearest to expand */
     res->a=NULL; res->n=0; res->cap=0;
-    visited_reset(ix);
+    visit_reset(vis);
     for (int i=0;i<neps;i++){
         int e = eps[i];
-        if (is_visited(ix,e)) continue;
-        mark_visited(ix,e);
+        if (is_visited(vis,e)) continue;
+        mark_visited(vis,e);
         float d = vdist(ix, q, ix->elems[e].vec);
         Pair p = { d, e };
         if (heap_push(&cand,p,0) || heap_push(res,p,1)){ free(cand.a); return -1; }
@@ -212,8 +233,8 @@ static int search_layer(VIndex* ix, const float* q, const int* eps, int neps,
             NeighList* nl = &ce->links[layer];
             for (int i=0;i<nl->count;i++){
                 int e = nl->ids[i];
-                if (is_visited(ix,e)) continue;
-                mark_visited(ix,e);
+                if (is_visited(vis,e)) continue;
+                mark_visited(vis,e);
                 float d = vdist(ix, q, ix->elems[e].vec);
                 if (res->n < ef || d < res->a[0].d){
                     Pair p = { d, e };
@@ -232,7 +253,7 @@ static int search_layer(VIndex* ix, const float* q, const int* eps, int neps,
  * Keep c only if it is nearer to q than to every already-chosen neighbour;
  * backfill from the pruned set (nearest first) to reach M for connectivity.
  * Writes chosen element indices into out[], returns the count. */
-static int select_neighbors(VIndex* ix, const float* q, Pair* W, int nW, int M, int* out){
+static int select_neighbors(const VIndex* ix, const float* q, Pair* W, int nW, int M, int* out){
     (void)q;   /* q's distances are precomputed in W[].d; kept for call-site clarity */
     /* sort W ascending by (dist,elem) — deterministic. */
     for (int i=1;i<nW;i++){                        /* insertion sort (nW small) */
@@ -281,7 +302,7 @@ static int elems_reserve(VIndex* ix){
     Elem* ne = (Elem*)realloc(ix->elems, nc*sizeof(Elem));
     if (!ne) return -1;
     ix->elems = ne; ix->cap = nc;
-    return visited_ensure(ix);
+    return 0;
 }
 
 int vindex_insert(VIndex* ix, uint64_t node_id, const float* vec){
@@ -307,13 +328,19 @@ int vindex_insert(VIndex* ix, uint64_t node_id, const float* vec){
         return 0;
     }
 
+    /* This call frame owns its traversal scratch for the whole insert. ix->cap
+     * already covers `cur` (elems_reserve ran above), so every reachable element
+     * index is in range. */
+    VVisit vis;
+    if (visit_init(&vis, ix->cap)) return -1;
+
     int ep = ix->entry;
     int L = ix->max_level;
     /* greedy descent through layers above `level` to refine the entry point. */
     for (int lc = L; lc > level; lc--){
         Heap r = {0,0,0};
         int eps1[1] = { ep };
-        if (search_layer(ix, el->vec, eps1, 1, 1, lc, &r)){ return -1; }
+        if (search_layer(ix, &vis, el->vec, eps1, 1, 1, lc, &r)){ visit_dispose(&vis); return -1; }
         if (r.n){ ep = r.a[0].e; float bd=r.a[0].d;
             for (int i=1;i<r.n;i++) if (r.a[i].d<bd){bd=r.a[i].d; ep=r.a[i].e;} }
         free(r.a);
@@ -329,7 +356,7 @@ int vindex_insert(VIndex* ix, uint64_t node_id, const float* vec){
     for (int lc = start; lc >= 0; lc--){
         int Mmax = (lc==0) ? ix->M0 : ix->M;
         Heap W = {0,0,0};
-        if (search_layer(ix, el->vec, eps, neps, ix->ef_construction, lc, &W)){ rc=-1; break; }
+        if (search_layer(ix, &vis, el->vec, eps, neps, ix->ef_construction, lc, &W)){ rc=-1; break; }
         int* chosen = (int*)malloc((size_t)(W.n?W.n:1)*sizeof(int));
         if (!chosen){ free(W.a); rc=-1; break; }
         int nc = select_neighbors(ix, el->vec, W.a, W.n, Mmax, chosen);
@@ -357,13 +384,17 @@ int vindex_insert(VIndex* ix, uint64_t node_id, const float* vec){
     }
 done:
     free(eps_owned);
+    visit_dispose(&vis);
     if (rc) return -1;
     if (level > ix->max_level){ ix->max_level = level; ix->entry = cur; }
     return 0;
 }
 
 /* ── search ───────────────────────────────────────────────────────────────── */
-int vindex_search(VIndex* ix, const float* query, int k, int ef_search,
+/* `ix` is const: search is pure with respect to the index. That is enforced by
+ * the compiler, not by convention — it is the whole point of moving the visited
+ * set into the frame below. */
+int vindex_search(const VIndex* ix, const float* query, int k, int ef_search,
                   uint64_t* node_id_out, float* dist_out){
     if (!ix || !query || k <= 0) return -1;
     if (ix->entry < 0) return 0;
@@ -373,11 +404,15 @@ int vindex_search(VIndex* ix, const float* query, int k, int ef_search,
     float* q = vec_normalise_copy(query, ix->dim);
     if (!q) return -1;
 
+    /* This call frame owns its traversal scratch. */
+    VVisit vis;
+    if (visit_init(&vis, ix->cap)){ free(q); return -1; }
+
     int ep = ix->entry;
     for (int lc = ix->max_level; lc > 0; lc--){
         Heap r = {0,0,0};
         int eps[1] = { ep };
-        if (search_layer(ix, q, eps, 1, 1, lc, &r)){ free(q); return -1; }
+        if (search_layer(ix, &vis, q, eps, 1, 1, lc, &r)){ visit_dispose(&vis); free(q); return -1; }
         if (r.n){ int b=r.a[0].e; float bd=r.a[0].d;
             for (int i=1;i<r.n;i++) if (r.a[i].d<bd){bd=r.a[i].d; b=r.a[i].e;}
             ep = b; }
@@ -385,7 +420,8 @@ int vindex_search(VIndex* ix, const float* query, int k, int ef_search,
     }
     Heap res = {0,0,0};
     int eps[1] = { ep };
-    if (search_layer(ix, q, eps, 1, ef_search, 0, &res)){ free(res.a); free(q); return -1; }
+    if (search_layer(ix, &vis, q, eps, 1, ef_search, 0, &res)){ visit_dispose(&vis); free(res.a); free(q); return -1; }
+    visit_dispose(&vis);
     free(q);
 
     /* res is a max-heap of size<=ef; pop into ascending order, keep nearest k. */
@@ -419,7 +455,6 @@ VIndex* vindex_create(int dim, int M, int ef_construction){
     ix->mL = 1.0 / log((double)M > 1.0 ? (double)M : 2.0);
     ix->entry = -1;
     ix->max_level = 0;
-    ix->visit_epoch = 0;
     return ix;
 }
 
@@ -432,7 +467,6 @@ void vindex_free(VIndex* ix){
         free(e->vec);
     }
     free(ix->elems);
-    free(ix->visited);
     free(ix);
 }