make boundary crossings attributable to the construct that caused them

The beat reported which function crossed a boundary, never which decorator
put the beat there. So the graph accumulated boundary events with no
attribution, and no construct could be measured — "is this decorator
earning its keep" stayed an argument instead of a traversal.

engram_boundary_beat now takes the construct and carries it on the bus as
{"construct":"..."}. The injection point, the beat, and the accumulation
already existed; only the attribution was missing.

Also pins a known defect as a test: codegen calls fn_has_decorator for
exactly three names (manager, accessor, route). Twelve others parse, attach,
and compile to nothing — including @authenticate (6 uses), @authorize (3),
@rate_limit (3) and @validate (2), which look like protection and are not.
decorator-authenticate-compiles-to-nothing asserts that @authenticate emits
byte-identical C to no decorator at all, so fixing it will be a visible flip.

Verified: compiler self-hosts byte-identically, 86/86 native compiler tests
pass, emitted C carries the construct for both @manager and @accessor.

lang/runtime/el_runtime.c

@@ -16991,24 +16991,40 @@ void dharma_emit(el_val_t event_type, el_val_t payload) {
     free(b.buf);
 }
 
-/* engram_boundary_beat(op_name) — the decorated-fn boundary AUTO-EMIT (VBD seam).
- * codegen injects a single call to this at the entry of every @manager/@accessor
- * decorated fn, so a decorated op self-reports with ZERO hand-written
- * instrumentation in its body:
+/* engram_boundary_beat(op_name, construct) — decorated-fn boundary AUTO-EMIT
+ * (VBD seam). codegen injects a single call to this at the entry of every
+ * @manager/@accessor decorated fn, so a decorated op self-reports with ZERO
+ * hand-written instrumentation in its body:
  *   (1) afferent counter++            — the boundary was crossed
  *   (2) engram_chrono_tick()          — interoception: the mind senses its own op firing
  *   (3) engram_strengthen(self-anchor)— reinforce the self-activity anchor (an
  *       activation-count/salience bump, NOT a content/edge write — identity
  *       write-protection is untouched)
  *   (4) dharma_emit(neuron.op.<name>) — provenance on the shared bus transport
- *       (same bus the swarm peers field on); bumps _eg_dharma_emits. */
-el_val_t engram_boundary_beat(el_val_t op_name) {
+ *       (same bus the swarm peers field on); bumps _eg_dharma_emits.
+ *
+ * `construct` is the DECORATOR that caused the beat ("manager" / "accessor"),
+ * carried in the payload. Before it, the beat reported which fn crossed a
+ * boundary but never which construct put the beat there — so boundary events
+ * accumulated in the graph with no attribution, and no decorator could ever be
+ * measured. "Is this construct earning its keep" was an argument; with the
+ * attribution it is a traversal. The payload is built here rather than at the
+ * call site so the format has exactly one author.
+ *
+ * The construct name comes from a closed set codegen controls, so the
+ * unescaped snprintf below cannot be injected through. That is NOT true of
+ * dharma_emit generally — its payloads are hand-concatenated at 39 call sites
+ * with no escaping, and a value containing a quote silently corrupts the
+ * event. Fixing that is a separate change; this one does not add to it. */
+el_val_t engram_boundary_beat(el_val_t op_name, el_val_t construct) {
     _eg_aff_boundary_ops++;
     engram_chrono_tick();
     engram_strengthen(EL_STR("kn-efeb4a5b-5aff-4759-8a97-7233099be6ee"));
-    const char* nm = EL_CSTR(op_name); if (!nm) nm = "";
+    const char* nm = EL_CSTR(op_name);   if (!nm) nm = "";
+    const char* ct = EL_CSTR(construct); if (!ct) ct = "";
     char ev[160]; snprintf(ev, sizeof ev, "neuron.op.%s", nm);
-    dharma_emit(el_wrap_str(el_strdup(ev)), EL_STR(""));
+    char pl[192]; snprintf(pl, sizeof pl, "{\"construct\":\"%s\"}", ct);
+    dharma_emit(el_wrap_str(el_strdup(ev)), el_wrap_str(el_strdup(pl)));
     return (el_val_t)0;
 }