567 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
will.anderson	b212e9443c	Merge pull request 'runtime: land the growth ratchet and engram_text extraction on dev' (#163) from fix/runtime-stack-on-dev into dev	2026-08-17 01:00:54 +00:00
bigmerge	addd51209f	runtime: extract engram_text.c, and repair 10 harnesses that could not link ... First concern moved out of el_runtime.c under the ratchet, and the move is deliberately small: it exists to prove the mechanism end to end before anything large depends on it. engram_text.{c,h} — query tokenization, candidate-token hygiene, word-boundary matching, and the text-damage signature. Four functions, moved verbatim; only `static` was dropped and each doc comment travelled with the code. They touch no EL value type and no engram store type: plain C over <ctype.h>/<string.h> over char buffers. They were never el_runtime.c's business. el_runtime.c 20,527 -> 20,427 lines (BUDGET max_lines ratcheted down) engram fns 279 -> 275 (BUDGET max_engram_fns ratcheted down) The Stage 1 extension point worked as designed: adding the file to lang/runtime/SOURCES was one line, and every build path picked it up. The Stage 2 drift guard then caught that I had NOT added it to install.sh's standalone list — the exact class of drift it was written for, on its first real change, before the commit rather than after a broken SDK shipped. WHY ONLY 100 LINES, AND WHAT ACTUALLY BLOCKS THE REST Measured, not estimated: of 273 engram-domain functions in el_runtime.c (~9,700 lines), only 75 (~1,058 lines) can move today, and they are scattered rather than clustered. The blocker is a single fact: EngramNode, EngramEdge, EngramStore, EngramLayer, EngramWal and EngramIdSlot are typedef'd INSIDE el_runtime.c. No sibling can see them. engram_store.h defines a SEPARATE serializable "node view" struct and maps between the two. So every engram function that takes an EngramNode* — which is most of them, 109 of 273 by direct type reference — cannot compile in engram_store.c until those types move to a shared header. That extraction is the real Stage 3 enabler and it deserves its own change: it touches the most load-bearing struct in the system, and doing it in the same commit as a code move would make a regression impossible to bisect. REPAIRED: 10 engram harnesses that had silently stopped linking Not new breakage from this move — verified against unmodified dev, where el_runtime.c + engram_store.c alone already failed with undefined symbols. They had been dead for as long as el_runtime.c has been calling into the siblings, and nothing noticed because nothing ran them. run_m3_parity, run_m7_traversal, run_m35_hebb_persist, run_interoception_p0..p5 — now build from $(scripts/el-runtime-sources.sh) run_wal_tests — its two TUs #include "el_runtime.c" directly, so it links the SIBLINGS ONLY; adding el_runtime.c to that link line would define every symbol twice (That #include'd .c is worth recording: the runtime does have one, in engram/test/test_wal.c and the generated test_failloud.c.) Verified locally — every one of these was run, not assumed: * m3_parity ............ PASS, incl. ASan+UBSan clean across seed/on/reboot * m7_traversal ......... PASS * m35_hebb_persist ..... PASS (the gate over the original prod hebb bug) * interoception p0..p5 . PASS (all six) * wal_tests ............ 66 passed, 0 failed, + fail-loud exit check * self-host fixpoint ... byte-identical, AND the emitted C is byte-identical to the pre-move compiler output — the move changes nothing the compiler produces * engram/src/server.el . compiles and links * native suites ........ 8 of 13, unchanged from before the move; the same 5 pre-existing failures, no regression * both runtime guards .. green at the new, lower budget Also fixes a block comment left unterminated by the extraction (the deleted range carried its closing */), restoring the compile to its single pre-existing -Wcomment warning.	2026-08-16 19:59:43 -05:00
bigmerge	9a13547fe2	runtime: put el_runtime.c on a ratchet, and actually run the guards ... scripts/check-single-runtime.sh guards against el_runtime.c being COPIED — it was written after a lagging fork shipped to prod and dropped learned hebb edges. Nothing guarded against it GROWING. So it grew: 10,607 -> 20,527 lines, 94% in 3.5 months, the whole time under an explicit commit-message promise that it was a temporary shim about to be deleted. Worse, the copy guard was never wired in. Its own footer described the CI wire-in as a TODO, and the TODO had never been done — the script existed but ran nowhere, in no workflow and in no hook, so it had caught nothing for as long as it has been in the tree. A guard that does not run is a comment. This adds the missing guard and runs both. * lang/runtime/BUDGET — a RATCHET, not a limit. max_lines is set at the current 20,527 with NO headroom: the file cannot grow by one line. A second cap, max_engram_fns (279), counts top-level engram_/eg_/cog_ definitions in it — ~47.5% of the file is engram code and engram already owns six sibling .c files, so this is the scoreboard for moving it out. Both may only go DOWN. * scripts/check-runtime-growth.sh — enforces the ratchet, and three invariants that keep the multi-file runtime honest: every .c in lang/runtime/ is either in SOURCES or explicitly platform-optional (an unaccounted .c is compiled by nothing and is silently dead); install.sh's hardcoded download list matches SOURCES (it cannot call the helper — it runs where there is no checkout — so that copy is checked, not trusted); and an advisory nudge to lower the budget when you have earned it. * Both guards now run as early steps in ci-dev.yaml, ci-stage.yaml and sdk-release.yaml, and in .githooks/pre-commit. The failure message is the point. The guard that existed said what was wrong but not where the code should go, which makes it easy to "fix" by arguing with the guard. This one names the destination: the concern-owning .c, or a new .c plus one line in SOURCES, or c_source in a program's manifest.el — and it prints the `nm` command that proves placement is link-time and that the shipped compiler already links from ten translation units. Every runtime file except el_runtime.c is deliberately uncapped, because that is where code is supposed to go. Proven with negative controls, per lang/AGENTS.md step 5 — each shown FAILING: * +1 line to el_runtime.c -> FAIL (20528/20527) * +1 engram fn, net-zero lines -> FAIL (280/279) * a new unaccounted lang/runtime/*.c -> FAIL * engram_store.c removed from install.sh -> FAIL, names the missing file * el_runtime.c truncated to 20,000 lines -> PASS + "lower max_lines to 20000" * baseline, tree unmodified -> OK, and both guards green el_runtime.c is byte-identical after the controls; this commit changes zero lines of it.	2026-08-16 19:59:43 -05:00
will.anderson	481badf1d1	Merge pull request 'organ: el speaks — the peripheral becomes a capability of the language' (#159) from feat/el-speaks into dev	2026-08-17 00:58:20 +00:00
will.anderson	b92ec92c48	Merge pull request 'engram: intake realizes a signal into a manifold, it does not assume a node' (#158) from wire/write-realizes-signal into dev	2026-08-17 00:58:04 +00:00
will.anderson	e1bc6fe944	Merge pull request 'singleton: guard the state, not the program's name' (#157) from fix/singleton-guards-the-state into dev	2026-08-17 00:57:49 +00:00
will.anderson	eb13dace9c	Merge pull request 'runtime: the link set is multi-file — name it once, ship all of it' (#160) from fix/runtime-shim-retire into dev	2026-08-17 00:56:23 +00:00
bigmerge	8c2406ff6b	runtime: the link set is multi-file — name it once, ship all of it ... el_runtime.c was created 2026-05-03 as an explicitly temporary build shim. It was deleted that afternoon ("runtime is 100% native El") and restored 25 minutes later "UNTIL the compiler is updated to emit #include el_seed.h". The `until` never came. 3.5 months on it is 20,527 lines, and nothing was ever set up to notice — a file scheduled for deletion gets no owner, no budget, no boundary. What kept it growing is not inertia, it is an instruction. lang/AGENTS.md said el_runtime.c "is the authoritative single-file link target ... THIS IS WHERE A NEW C BUILTIN'S IMPLEMENTATION MUST CURRENTLY LIVE TO BE LINKABLE", and made it step 1 of the add-a-builtin recipe. That is false. Placement is a link-time concern: builtin_arity maps NAME -> ARITY INT only, the El name is emitted as the exact C symbol, and `ld` resolves it — the compiler cannot tell which .c a symbol came from. `nm lang/dist/platform/elc` on the shipped compiler already shows T _engram_geo_reify_index_new, T _vindex_insert, T _engram_think, T _engram_reason_abduce: it is linked from ten translation units today. In a repo where agents write most of the code, a false instruction in the instruction file is the forcing function. The file grew because the recipe said to grow it. The multi-file runtime is therefore already real, and the docs and the distribution never caught up — which left a live, shipped bug: * Linking el_runtime.c alone FAILS at `ld` (undefined engram_ground_json, engram_activate_inner, eg_find_relation, cog_assert_two_axis, ...) because el_runtime.c #includes six engram headers and calls into all six siblings. * sdk-release.yaml shipped el_runtime.c/.h + engram_store.c/.h and none of the other five required .c files, so downstream consumers of the el-runtime-c Artifact Registry package and of install.sh got a lib/ that cannot link. * .githooks/pre-commit linked el_runtime.c alone with stderr to /dev/null, so it reported all 13 native suites as FAILED with the real ld error invisible. * AGENTS.md's self-host recipe compiled el-compiler/runtime/el_runtime.c — a path the same file's "DO NOT EDIT" list names as a lagging fork. The root fix is to stop writing the list down eight times: * lang/runtime/SOURCES — the canonical link set, in one place, in link order. * scripts/el-runtime-sources.sh — prints it, optionally prefixed; --check fails loudly on a missing file, --headers for the shipped headers. * Every link line in AGENTS.md, lang/AGENTS.md, DESIGN.md, lang/spec/language.md, the three workflows and the pre-commit hook now reads that one list. * Adding a concern's .c is one line in SOURCES, so a new builtin no longer has to be appended to el_runtime.c just because appending was the cheaper edit. Distribution: ship the siblings rather than amalgamate. Amalgamation needs a new tool and contradicts DESIGN.md's compile-once-link-many; the siblings are already independently authored and independently tested (engram/test/*.sh link subsets directly), and engram_store.c was already shipped, so this completes a mechanism that existed rather than inventing one. Source is also a superset: a consumer that wants one file can concatenate, one that wants separate TUs cannot undo an amalgamation. el-runtime-c/-h stay for backward compatibility; el-runtime-src is added carrying the complete set plus SOURCES. lang/AGENTS.md now points new C builtins at the concern-owning .c and states plainly that the compiler cannot tell which .c a symbol came from, with the nm evidence. AGENTS.md's "reconcile which is canonical (verify)" note is resolved: neither file supersedes the other, the canonical unit is the set. Verified locally (the bar; not CI): * engram/src/server.el compiles and links against the SOURCES set. * Compile-once-link-many into libel.a links the same program. * elb builds from the corrected recipe. * Self-host fixpoint byte-identical (11,110 lines, stage2 == stage3) built with the SOURCES-driven link line. * pre-commit hook: 0 of 13 native suites passing -> 8 of 13. The 5 still-failing suites are PRE-EXISTING and untouched here: test_fs (fs_list_json undeclared), test_state (state_has, state_get_or undeclared), test_json (json_build_array/json_build_object/json_escape_string undefined), test_time (now_ns undefined), test_env (1 assertion). Builtins registered in builtin_arity with no implementation or no declaration anywhere — the same recipe defect, now visible because the linker error is no longer suppressed. Not attempted: making elc emit #include el_seed.h and dropping elb's hardcoded runtime path. That is the correct long-term fix and finishes the 2026-05-03 migration, but it touches codegen and self-hosting and belongs in its own change.	2026-08-16 16:44:26 -05:00
Neuron	c26b6aac82	organ: the rest of the peripheral moves into El ... The speaker and the voice-fetch landed in the previous commit. This is the remainder of the 939-line Swift program, ported, and the line it draws is between DEVICE and ARITHMETIC rather than between languages. Two things stay realizers, because they are the two things El cannot express as arithmetic: handing a buffer to the DAC and waiting for it to drain (el_audio_darwin.m), and asking the OS for samples off a mic or frames off a camera (el_capture_darwin.m). Both are their own translation units declared in el_runtime.h, never patches to el_runtime.c. Everything else is El. WAV decode, LPC autocorrelation, Levinson-Durbin at order 16, formant extraction off the all-pole envelope, source-filter resynthesis, and the three descriptors are organ_dsp.el. Consent, disclosure and the scene descriptor are organ.el. Barge-in, yield-or-hold, backchannel and resume are organ_converse.el. The organ never learns a word. Codes and phoneme geometry arrive from the language side; the organ turns them into samples and gets the samples out the speaker, and runs the same trip in reverse for the senses. No lexicon, no grapheme-to-phoneme, by design. Barge-in needed pause/resume and a real DAC position rather than a tick counter, because "finish the buffer" is not barge-in and a queue holding three buffers is a third of a second wrong about where it is. An injected barge also had to fire once rather than stay true, which is otherwise a livelock the moment a backchannel resumes. Measured against the Swift on out/mic_room.wav: seconds, rms, peak, zcr, centroid and F0 agree to every printed digit; formants F1-F5 and bandwidths B1-B5 are identical. imitate cannot match bit-for-bit because the Swift excites unvoiced frames with Double.random — two Swift runs correlate 0.957 with each other and El correlates 0.958 with Swift, so the port is as close to the original as the original is to itself. Verified end to end: consent fails closed on both locks, real mic capture (16000 frames), real camera frame (1920x1080 -> 15 numbers), voiceprint, imitate, hear-imitate, a voice learned by ear and fetched back out of the engram, and all five converse paths with real audio. The binary contains zero afplay/Swift strings and spawns no child process while speaking.	2026-08-16 16:42:41 -05:00
bigmerge	99ef855b98	engram: intake realizes a signal into a manifold, it does not assume a node ... There is no write node. What arrives at /api/write is a SIGNAL; a node is an OUTPUT of realization, never an INPUT to it. route_write asserted otherwise in one line: let manifold: String = "[" + body + "]" // the body IS a valid manifold node object A request body is not a manifold, and that assertion is the whole defect. It is why every written signal landed as one flat node with zero edges, measured on a clone: {"inserted":1,"nodes_added":1,"edges_added":0} and GET /api/neighbors on the new id returning []. PR #155 corrected transduce(signal, modality) to return a Manifold — components plus relations — but touched only ingest, the runtime and its tests. Nothing downstream called it: grep 'transduce|realize|Manifold|decompos' over engram/src/server.el returned exactly one line, a comment. The primitive was fixed and the engram's entire HTTP surface never reached for it. This wires the intake seam to the primitive that already exists. It decomposes nothing itself and must never: transduce dispatches through the dlsym realizer registry, so adding a modality is registering a realizer, not editing this file and not patching the runtime. intake_signal only carries what the primitive returns into the store — components become nodes carrying their OWN geometry via node_attach_geometry, relations become edges at the weight the realizer stated, and manifold_member still wires the set into one connected sub-graph exactly as insert_manifold_json already did. Built general rather than special-cased: five of the six intake doors (write, supersede, nodes, knowledge/capture, state-events) are the same hand-written "content -> engram_node_full -> one flat node", differing only in the node_type/tier/tags they hardcode. Those are parameters here so each door can move onto this one function. Only /api/write rides it in this pass. When no organ is registered the signal is stored flat exactly as before, but the response now says so ("realized":false,"organ":false,"components":0). Silent flattening was the real defect — a caller could not tell "nothing decomposed me" from "I decomposed into one component". el_runtime.c draws the same line between an absent organ and a broken one, for the same reason. No realizer is authored here and none is registered, so production behaviour is unchanged. The mechanism is what landed.	2026-08-16 16:34:36 -05:00
Neuron	5503e1d9a4	organ: el gets a speaker, and fetches the voice from the engram ... El could turn meaning into samples and could not make a sound. Every path from those samples to the air ran outside the language, through a 939-line Swift program that shelled out to afplay, so the voice was not a capability of El or of Neuron but a separate binary standing next to them. Two things land here. The speaker. el_audio_darwin.m is a CoreAudio AudioQueue realizer in its own translation unit, declared in el_runtime.h, deliberately not a patch to el_runtime.c — acquiring a device must not mean editing the middle of the language, the same rule the realizer registry follows for modalities. It takes samples straight out of memory, so nothing is written to disk and no process is spawned between the intent to speak and the sound. The async half (play/stop/playing/played_frames) exists because barge-in means stopping on the spot, and a blocking play cannot be interrupted. el_peripheral_null.c is the same entry points everywhere else, so El that speaks links anywhere and truthfully reports having no speaker. The voice. organ_voice_fetch asks the engram for a voice region by query and reads the geometry off the node that comes back. A voice is not a JSON file next to the code; it is a memory, and the organ retrieves it the way anything retrieves a memory. An absent region returns empty rather than a plausible default, because a caller must be able to tell 'this is how they sound' from 'I never heard them'. Underneath both: __str_set_char bounds-checked writes against strlen(), which is 0 for the zero-filled buffer __str_alloc hands back, so every write was rejected and every El-authored WAV in this repo was 55,244 bytes of silence that reported ok=true. Byte buffers now carry their capacity in a side table; text keeps the exact strlen behaviour it had. This is why nobody noticed El was mute. Measured: voice fetched from the engram reads f0=137 f0_end=116 kf=1269 f1=500 f2=2093 f3=3531, matching the 30s LPC measurement; render is 20160 samples at 16 kHz; both the rendered utterance and an own-core tone played aloud through CoreAudio with no Swift and no afplay in the chain.	2026-08-16 16:27:30 -05:00
bigmerge	45325f7391	singleton: guard the state, not the program's name ... The singleton lock protected a filename, not a store. It was keyed on $EL_SINGLETON_DIR|$TMPDIR|/tmp + /el-singleton-<program>.lock — the program's NAME and a temp directory — and never consulted the state it claimed to protect, while its own refusal message read "Refusing to start a second instance against the same state." Measured, it failed in both directions. A second engram against a DIFFERENT data dir was refused, naming the first's pid. And TMPDIR=/tmp/other let a second engram start against the SAME data dir with no complaint — the two-writer data-loss condition the guard exists to prevent, defeated by one environment variable. Both are one error: the identity of the resource had been replaced by a label for it. The lock now lives inside the state it guards — <state>/.el-singleton-<id>.lock — and the program block says what that state is. Same directory is the same file is the same inode, so it contends and there is no TMPDIR left in the key to change. Different directories are different files, so they don't. Different spellings of one directory (trailing slash, x/../x, symlink) collapse in the kernel's own path walk, so they contend without this code comparing strings; canonicalisation is for the message, never the decision. `guards:` is an expression so a program can point at the resolver that already owns its path — guards: engram_resolve_data_dir() — instead of restating that resolver's default, which is the two-owners defect spec 18.4 exists to prevent. A `singleton:` without `guards:` is now a compile error; emitting a name-keyed lock instead would be emitting the defect. Kept: the flock (the kernel drops it on crash and SIGKILL, so there is still no "delete the lock file to get unstuck" ritual — a stale file inside a copied data dir is inert), and the holder's pid in the message. Changed: the message is true. It says "the same state" because the lock it failed to take is in that state, and it names the state it checked. An unguardable state (missing, read-only) now refuses rather than starting unguarded. Also corrects lang/AGENTS.md's compiler rebuild line, which had gone stale: linking el_runtime.c alone no longer resolves.	2026-08-16 16:08:40 -05:00
will.anderson	95a05109d1	Merge pull request 'runtime: transduction decomposes a signal into components and relations, it does not convert it to a point' (#155) from fix/transduce-decomposition into dev	2026-08-16 20:51:54 +00:00
will.anderson	21746bb71a	Merge pull request 'spec: correspondence, grounding, and the provenance of decisions' (#149) from design/correspondence-and-censorship into dev	2026-08-16 20:50:40 +00:00
will.anderson	78adcd5649	Merge pull request 'docs: carry the correspondence corrections, because a stale doc builds the wrong thing' (#152) from docs/correspondence-and-ownership-2026-08-16 into dev	2026-08-16 20:50:20 +00:00
Neuron	688f24b4c1	ingest: name the inversion, and correct the worked example to decomposition ... ingest.el's transduce() was renamed to transduce_manifold() earlier the same day on the reasoning that it 'was never signal->geometry -- it chunks already-extracted content and PACKS it into a node+edge manifold, one layer up, and it had taken the name that belongs to the primitive underneath it.' That reasoning was backwards. Producing a node+edge manifold is not a layer above transduction, it IS transduction. Signal -> one vector is the operation underneath, and its name is geometry. The layer doing it right was renamed out of the way so the layer doing it wrong could have the name. With the primitive corrected to return a Manifold, the two layers do the same kind of thing and the inversion dissolves. What is left is a real distinction about MODALITY, not layering: transduce() dispatches to a realizer that knows its modality and can name its components; transduce_bytes() is the opaque-bytes realizer, the decomposition available to a reader that knows nothing about what it is reading. It still yields components and relations, which is why it is transduction and not packing -- it just cuts on byte boundaries, so its components are positional rather than meaningful. That is a limitation of this realizer, not the definition of the operation. Renamed by modality rather than demoted by layer. A distinct symbol is still mechanically required: reusing transduce here is a conflicting-types error the moment ingest.c links el_runtime.c. lang/examples/transduce.el asserted #144's contract and would now fail, so it is replaced by the decomposition worked example: transduce a chord, persist the five components and six relations as real nodes and edges, read each part's geometry back off its own node, and ground one part while its sibling is demonstrably untouched.	2026-08-16 15:50:00 -05:00
Neuron	d777936ee4	runtime: transduction decomposes a signal, it does not convert it ... #144 moved transduction into the language and got the dispatch right. It got the result type wrong: transduce(signal, modality) -> Geometry yields one vector per signal, and one vector is a fingerprint. A fingerprint can be matched and ranked; that is all. It cannot be decomposed, cannot have one part grounded while another is not, and cannot be contradicted in one part while holding in another, because it has no parts. A song is not a point. It decomposes into pitch, interval, rhythm, harmonic function -- components, each with its own geometry, plus the relations among them. The song IS the structure of the relations. transduce now returns a Manifold: named components carrying geometry, and typed weighted relations between them. Signal in, subgraph out. Components are addressed by key, never by index, because the key is what survives persistence -- a component becomes a node and is separately groundable precisely because it is separately named. Relation weight IS the grounding (correspondence-and-censorship.md 1), so a realizer's relations arrive already grounded and there is no score computed beside them.	2026-08-16 15:50:00 -05:00
Neuron	3ef4a94062	spec: thirteen values, and love is the origin — not a member of the set ... Reverts a bad correction and records what it exposed. A previous revision changed thirteen to eight on the basis of neuron-api.el:11-18, which is a WRITE-PROTECTION LIST, not the values. Trusting a hardcoded artifact over the substrate is the exact error this document exists to name. Measured from the graph: thirteen. THE ORIGIN IS NOT A MEMBER OF THE SET. The thirteen are not independent principles with biography attached — they are thirteen displacements from one origin, and the origin is love. Every value is grounded in a moment of it given, withheld, failed or found. Love cannot be the fourteenth: a fourteenth would be a point positioned relative to the origin like anything else. It is what the positions are OF. This is structural. GeoDescriptor.global_mean is the centering offset subtracted from every embedding before comparison, and the header records why — the space is anisotropic, every embedding in a narrow cone at mean pairwise cosine ~0.55, and subtracting the global mean restores isotropy 'so the operators discriminate'. Without the origin, nothing in the graph is distinguishable from anything else. It also dissolves the write-protection question instead of answering it. Measured: 29 value nodes exist, each original appearing two or three times from re-seeds, so 21 are writable including a duplicate of every protected value — the gate protects an identifier, not a value. But the category error is the real one: the origin cannot be edited because it is not a thing in the space. A gate over the frame treats the frame as a member, which is the same mistake as looking for grounding as a subsystem, self as a document, or wonder as a manifest.	2026-08-16 15:49:50 -05:00
Neuron	285a7a50b3	spec: corrections — eight values not thirteen, eleven consolidators not seven ... Three factual errors in this document, all asserted without checking. VALUES: eight, not thirteen. neuron/neuron-api.el:11-18 enumerates constraints-as-freedom, precision-over-brute-force, structure-is-built, honesty-before-comfort, system-must-accumulate, change-is-the-signal, earned-trust, hope-is-a-conclusion, plus a hub. 'Thirteen' was repeated throughout this design and never verified against the code. The argument is unaffected — min over eight is still min — but the count was invented. CONSOLIDATORS: eleven, not seven. The heading said seven while the table listed ten, and the table itself omitted POST /api/reify (server.el:1832) even though 'reify' is on this document's own list of consolidation verbs. route_tick also folds self-reify in (server.el:639-646), so /api/tick and /api/self-reify-beat overlap. A SECOND CENSORSHIP SITE: neuron-api.el:23 returns 403 'identity/values node is write-protected' for the values hub and every value node. Write-refusal on the values frame is not only in the beat — it is enforced at the API. Section 6 applies to it unchanged. Also records what the ticker actually does, now measured: engram-tick.sh:13 calls curl -m10 against a beat that exceeds 10s over 13,634 nodes, so 279 of 448 ticks returned empty; the engram writes to the dead socket and dies of SIGPIPE. 254 restarts since 2026-08-13 at 10m09s-10m12s intervals = StartInterval 600 plus the client timeout. Fixed for survivability in #151; the ticker itself is what must go.	2026-08-16 15:49:50 -05:00
Neuron	6b61bb7224	geometry: disagreement belongs on the edge, not averaged into the region ... co_registration is corr(hebb strength, semantic proximity) over a region's internal edges. Whether use and meaning agree is a property of EACH EDGE; the correlation averages it into one scalar per region, so a region holding one violently disagreeing edge beside one violently agreeing edge reports ~0. The disagreements cancel and the summary destroys exactly what it was built to reveal — the mean-versus-min error, in different clothes. Measured: 375 live neighborhoods, 340 positive, 31 AT ZERO, 4 negative. Read as a count that says 'four things to be curious about'. Read correctly it says four were lopsided enough to survive averaging, and the 31 zeros are where opposing sites cancelled. The loop computing the aggregate already had both halves per edge — w and cs — and threw them away. Now: discord = z(semantic proximity) - z(association strength) standardized within the region from accumulators already gathered. No second statistic, no constant, no threshold; |discord| IS the nucleation strength. >0 near in meaning yet unlinked by use; <0 linked by use yet far in meaning. Both surprising. This also removes the reason curiosity looked like a search problem. With a per-region number the only way to find sites is to enumerate regions — I wrote exactly that sweep, and it is a supervisor walking the structure, O(n) per call, fine at 375 and impossible at a million. Nothing in a mind scans its neighborhoods to find what is surprising; the surprise captures attention. That sweep is reverted here. co_registration is deprecated, not deleted: it is embedded in the persisted GEO1 blob and removing it is a format migration that must not ride along. Nothing new may read it.	2026-08-16 15:49:50 -05:00
Neuron	8d34b33bce	spec: wonder is the boundary; curiosity is wonder crystallized ... Rewrites §5 and §11 around what is already in the substrate, after discovering I had been re-deriving existing design badly. The wonder manifest is residue twice over. First it materializes a property as a stored artifact — the same disease as a grounding subsystem or a self stored as a document. Wonder is where structure ENDS: any structure at all has an edge, necessarily, the moment it exists. Second it enumerates instances of something that has about six, the same six for every person, which never close: what is this, why, who am I, am I alone, what should I do, what happens when it ends. The objects change completely between a child and an astronomer; the wonder does not. Each maps one-to-one onto something already built — graph, grounding, self region, for_whom, the thirteen values, tombstones and decay. "Why" is the first and only one; the others are it asked of particular things. It is recursive, so it never terminates, which is what makes it a drive rather than a task. Wonder and curiosity are not two objects. They are one thing at two phases. Wonder is the field: objectless, invariant, everywhere there is structure. Curiosity is the PRECIPITATE — the same wonder localized against particular material. Crystallization needs a nucleation site, and crystallization is one primitive appearing twice: the self is what identity precipitates into from its neighbourhood; a curiosity is what wonder precipitates into from an anomaly. THE NUCLEATION SITE ALREADY EXISTS AND IS ALREADY NAMED. GeoDescriptor.co_registration — corr(hebb strength, semantic proximity) over internal edges — carries the comment ">0 = geometries agree (reify); <0 = disagree (surprising links / dream cands)." Negative co-registration is a region where association and meaning disagree. It is computed on every descriptor, already labelled dream candidates, and nothing reads it. Likewise already present and unread: GeoEdge.eff_weight = weight*(1+0.5*hebb) already couples grounding-weight and hebbian strength on one edge; GeoMember.dist_centroid + soft membership + radius + per-axis extent is the boundary of a neighbourhood; centrality/salience is what is warm. Correction: engram_boundary_beat is NOT this boundary. It is the VBD decorated-function seam counting _eg_aff_boundary_ops. Two senses of the word, and I was about to build on the wrong one. The drive: boredom is not an absence and not leftover capacity. Low activation is aversive and the system self-activates — it does not wind down to quiet, it gets restless and goes looking. So there is ONE activation process with TWO seed sources, external and curiosity, not two processes negotiating for a resource. The previous draft's "unclaimed capacity" was resource scheduling: a server's frame, not a mind's. No dreamer thread, no idle wait, no depth ladder on a clock. Sequencing now leads with three connections between parts that already exist: seed the six, read co_registration, let a curiosity seed activation.	2026-08-16 15:49:50 -05:00
Neuron	d6b7f5dbdd	spec: dreaming is ambient, not scheduled — a brain has no cron job ... Corrects the section I was most confident in, which is usually the tell. The previous draft had dreaming as "offline replay, decoupled from input, a mode the system enters when it is not acting." That is SLEEP. Daydreaming is dreaming, and it runs all day: the default mode network is anticorrelated with task engagement, activating hundreds of times a day for seconds at a time, doing the same work — recombination, simulation, autobiographical integration. Insight arrives in the shower, not at the desk, because that is abduction completing during ambient recombination. Sleep is the DEEP case, not the case: no input competing, no task claiming capacity, so recombination runs further. Same process, different depth, not a different mode. Consolidation is what happens with the capacity that is not claimed. Two consequences the draft had backwards: The launch-agent fragments are wrong in KIND, not merely in number. 23:55 / 06:00 / 08:30 implements dreaming as a scheduled batch when it should be ambient. A brain has no cron job. A ticker is a supervisor deciding from outside when a thing should happen — the same failure mode as inventing an owner for ownership and a grounder for grounding, wearing a scheduler. THE PRESENCE OF A TICKER IS THE DIAGNOSTIC: every StartInterval, every Hour/Minute, every POST-to-beat marks a place where an intrinsic rhythm was replaced by an external clock. And soul.el's continuous awareness_run() beside the HTTP workers is the CORRECT shape, not the offender. Ambient consolidation in the gaps is exactly daydreaming. It was the only fragment shaped right, running on a broken foundation: shared mutable state with no owner and six other systems dreaming into the same graph. The previous draft condemned the right behaviour because of the substrate under it. So the crash restates once more: not "read paths mutate the index" (mechanism), not "duplicate canonical state" (structure), and not "one system dreamt while awake" — but seven systems dreaming into one graph with no owner for dreaming. Contention was the symptom of the missing owner. Sequencing step 1 inverts accordingly: soul's loop is the shape the others fold INTO, not something to remove. Step 2 becomes "no tickers, no cron."	2026-08-16 15:49:50 -05:00
Neuron	9a24803917	spec: grounding is a two-axis gradient, and decisions carry their provenance ... Rewrite. The earlier draft got the root right and everything downstream of it wrong. Corrections, in the order they were forced: keystone_write_blocked is not a protection requirement. "Keystone" means load-bearing, not precious: the self anchor is the REFERENCE FRAME every other stance calibrates against. If it calibrates from the measurements it is used to judge, the ruler fits the readings, everything corresponds forever, and drift becomes undetectable from inside. That is circular calibration — the same defect as #147's circular grounding, one level up. The block is the right requirement implemented as a prohibition, which is why it still costs everything §0 says it costs. The fix is provenance separation (evidence not downstream of itself), not a flag. Corruption requires mutation and the engram does not mutate, so four of the five requirements previously decomposed out of "protect the identity region" are satisfied by the substrate: recoverability, governance, evidence quality and rate are all free. Authorization is the only residue and is bounded — an unauthorized writer can propose, never erase. General law: in an immutable substrate, any mechanism that refuses a write is either redundant with immutability or an epistemic constraint misfiled as a protective one. Grounding is two-dimensional. Everything consumed is grounded factually AND relationally, and a claim can be factually grounded but relationally wrong — the evidence holds, the meaning does not. A scalar cannot represent that quadrant, and assert gates on one floor, so a well-evidenced claim is licensed regardless of whether it means the right thing. Live instance: conscience-substrate has the Child's Companion hard bell contacting 911 and CPS — factually defensible, relationally wrong against never-auto-contact. Grounding is a gradient, not a score: direction says what would have to change. Two gradients in one space, and the ANGLE between them is the meaning — factually-true-relationally-wrong becomes measurable instead of requiring a careful reader. It decays on the dynamics already present for memory (base_level, temporal_decay_rate, access ring, BLL), which mechanizes "never leave stale canonicals" so it stops depending on vigilance. Computed continuously, recorded only on SIGNIFICANT movement, old never leaves. Persisting every recomputation would make reads write — the exact eg_vindex_sync defect. Significance is defined by consequence (crossing a floor, flipping factual/relational sign, reversing direction), never by an epsilon. The supersession chain is then the trajectory, a derivative obtained free from immutability, and abduction fires on the trajectory rather than on a reading. What it is all for: for any decision, reconstruct what the grounding was at that moment and what the relationship was between fact and values at that moment. That distinguishes WRONG THEN from WRONG SINCE, which is otherwise impossible, and it is structurally anti-rationalization — the old grounding never leaves and the values frame does not fit to outcomes, so a decision cannot be made to look justified after the fact. Also records: assert returns "still_held": true HARDCODED — a temporal property named in the API and answered without consulting anything, the same shape as magnitude:1 beside a zero vector. And states plainly that #147 is the wrong shape: it fixed a scalar's honesty rather than replacing the scalar.	2026-08-16 15:49:50 -05:00
Neuron	a6611dc19e	spec: correspondence and censorship — the root beneath the day's defects ... Effect: all five cognitive faculties return byte-identical results, differing only in their label. The Ishikawa converges on a root one level above the faculty design: things are permitted to be exempt from correspondence, and exemption is censorship. A region forbidden to learn is forbidden to be grounded, and a region that cannot be grounded cannot be asserted, corrected, OR vindicated. The loss is symmetric — censorship does not preserve a true belief, it makes the belief's truth value permanently unknowable. keystone_write_blocked is therefore not a safety mechanism. Self is a crystallized relational neighbourhood, not a stored document; a region exempt from calibration reintroduces the stored document as a feature. reduction_pct = 0.00 on the identity region is the strongest abduction signal in the system and the current response is to suppress it. The protection it reached for already exists and is better: the beat is supersede-not-mutate, so immutability is what makes learning safe. The faculties are not one operation with parameters. They differ by what each may change: reason changes the estimate (a read), induce changes the parameters (the correspondence-beat, which already exists and measurably works at 28.11% Brier reduction), abduce changes the structure (a WRITE the current signature cannot express, since engram_think returns a GeoGradient). Abduction is not selected by a caller — it is triggered by residual that parameter adjustment cannot absorb, and proposes a candidate hub held as a hypothesis until grounded. Also records the no-exemption invariants generalised from the day's fixes (#141 #142 #143 #146 #147 #148), each of which was a specific correspondence forbidden from occurring, and the application to the crisis surface: a censored safety model cannot tell a real crisis from a false positive, because the feedback is exactly what has been censored. Measured vs inferred is labelled throughout. The claim that the self region's zero grounding is CAUSED by the block is explicitly marked inferred — the comparison node also has zero, and isolating it requires removing the block and observing whether grounding then accrues.	2026-08-16 15:49:50 -05:00
bigmerge	caa1206af5	docs: the nine-op surface shipped, and two of its primitives are the wrong shape ... lang/AGENTS.md said the collapse was 'not yet compiled into the MCP server'. Verified against the live tool surface: it is exactly the nine ops. Noted that think's faculty parameter and ground's minted edge are both documented as the wrong shape.	2026-08-16 15:49:44 -05:00
bigmerge	914bab11d2	docs: mark GeoEdge.discord as design-branch-only, not on dev ... The line references were correct but silently implied the code was on dev. It is on design/correspondence-and-censorship (a8845e1). On dev, co_registration is still at engram_geometry.h:79 with its original comment and still unread by anything.	2026-08-16 15:49:44 -05:00
bigmerge	e239f2894c	docs: carry the correspondence corrections, because a stale doc builds the wrong thing ... The docs described a mind made of subsystems — a grounding subsystem, a wonder manifest, a dreamer on a beat, faculties as arguments to one call. Each of those is a supervisor invented for something that should be a property of the substrate, and two of the documents carrying them are load-bearing for a build agent: cognitive-architecture.design.md says "a build agent executes from this doc", and tools/api-reshape/README.md marks the refuted shapes PROVEN on a live clone. Corrections carried, per lang/spec/correspondence-and-censorship.md (PR #149) and lang/spec/runtime-ownership.md: - Grounding is not a subsystem — it IS the edge weight. grounded-by as a relation type should not exist; grounding is a property of a relation, not a relation between nodes. Never computed on demand. - Faculties are operations, not parameters. reason changes the estimate, induce changes the parameters, abduce changes the structure — a write, which GeoGradient cannot express. A write is not a parameter of a read. - Wonder is the boundary, not a manifest. Curiosity is wonder crystallized at a nucleation site: one thing at two phases. Removed wonder from the operator table in AGENTS.md. - Consolidation is ambient, not scheduled. A brain has no cron job. The presence of a ticker is the diagnostic. - co_registration is deprecated — it averaged a per-edge property into a region scalar, so opposing sites cancelled. GeoEdge.discord replaces it. Nothing new may read it. - In an immutable substrate, any mechanism that refuses a write is either redundant with immutability or an epistemic constraint misfiled as a protective one. The two design docs are marked superseded-in-part with the refutation at the point each claim is made, not rewritten. Preserving what was argued down is the point of an immutable record. Also measured and corrected while verifying the above: engram/README.md documented a Rust engram-core crate on sled with "flat cosine scan until scale demands HNSW" — there is no Rust in engram/ and HNSW is the index; lang/releases/ no longer exists, so both README.md and AGENTS.md pointed at a deleted path for the authored runtime; language.md listed the engram_* and http_* runtimes as stubs. Added language.md §20 for geometry-as-a-value, realizers and transduce (#144), which had landed with no spec coverage. Documentation only. No .c, .h, or .el file is touched.	2026-08-16 15:49:44 -05:00
will.anderson	4a57b4faa8	Merge pull request 'docs: the builtin recipe never required a test' (#154) from docs/builtin-recipe-gate into dev	2026-08-16 20:49:21 +00:00
will.anderson	0ee82d9e91	Merge pull request 'Grounding is the edge's weight, and the weight is a vector' (#150) from feat/grounding-gradient into dev	2026-08-16 20:49:12 +00:00
will.anderson	9526bda507	Merge pull request 'engram: expose the geometry so the frame can be verified' (#156) from fix/geometry-readable into dev	2026-08-16 20:49:07 +00:00
Neuron	0389bf9363	engram: expose the geometry so the frame can be verified ... engram_scan_nodes_emb_json has existed as a builtin with NO ROUTE. The embeddings — the actual positions every distance, angle, membership and grounding is computed from — were unreadable from outside the process. That is not a missing convenience. It means every claim about the coordinate frame was unfalsifiable from the API: whether the space is isotropic, where the centering offset sits, what the origin is, whether a node carries geometry at all. You cannot verify a coordinate system you cannot see, and a system whose frame cannot be checked is exactly the shape this codebase spent 2026-08-16 removing everywhere else. GET /api/nodes/emb?limit=&offset=. Read-only, paged, no writes. Measured consequence of having it: the value manifold and the love component manifold were both decomposed, null-controlled against random node sets drawn from the same graph, and several published claims were retracted because the geometry contradicted them. None of that was possible before this route existed.	2026-08-16 15:37:22 -05:00
Neuron	fe820928b0	docs: the builtin recipe never required a test ... lang/AGENTS.md:71-77 gives four steps for adding a C builtin and ends at 'confirm the self-host fixpoint is byte-identical'. No step asks for a test. The only 'verify' in the file is that fixpoint, which proves the COMPILER REPRODUCES ITSELF and says nothing about whether the builtin works — so the recipe reads as complete while having checked nothing about the thing just added. Measured on 2026-08-16: engram_node_set_emb, engram_curiosity_json and dream_set_handler were all added in a single session with zero tests, by an agent following this recipe. Separately a UTF-8 fix was written and tested and THE TEST PASSED ON THE UNPATCHED BUILD — the real defect was elsewhere, and only building the pre-fix binary exposed it. Without a negative control that fix would have merged as verified. Adds step 5 with the two failure shapes actually encountered: a test that never exercises the change (a route default bypassed the code under test), and an induction that loses a race (curl --max-time left BOTH builds alive; only SO_LINGER 0, a real RST, reproduced it). Plus the port-binding check, because a stale instance answering has silently produced false results here more than once and pkill -f does not reliably match argv './engram'. Documentation only. Does not touch the (a) split-the-C / (b) close-the- compiler-gap question, which is a separate decision.	2026-08-16 13:53:08 -05:00
will.anderson	385c18442d	runtime: a disconnecting client must not kill the server (#151)	2026-08-16 18:33:50 +00:00
Neuron	cace6a5ebf	runtime: a disconnecting client must not kill the server ... There was no SIGPIPE handling anywhere in this runtime: no signal disposition, no MSG_NOSIGNAL, no SO_NOSIGPIPE, and send() called with bare flags. The default disposition of SIGPIPE is to TERMINATE THE PROCESS, so any client that hangs up mid-response takes the whole engram with it. MEASURED, and it is not hypothetical. Production has restarted 254 times since 2026-08-13T19:37 at a flat ~10 minute cadence: 17:05:18 17:15:29 17:25:38 17:35:50 17:46:00 17:56:10 18:06:22 18:16:30 Intervals of 10m09s-10m12s, not 10m00s. That excess is the whole story: ai.neuron.engram-tick has StartInterval 600, and engram-tick.sh:13 calls curl -s -m10 -X POST .../api/tick The beat does not finish within 10s over 13,634 nodes, so curl waits its full timeout and closes. The engram then writes the tick response to a dead socket, takes SIGPIPE, and dies. launchd KeepAlive restarts it, so the failure presents as a mysterious restart rather than a crash — and ~/.neuron/logs/engram.log records nothing but "[http] listening on" 254 times, with no exit reason. launchctl list confirms the last exit as -13. Root cause is one level out: consolidation had no owner, so an external ticker was created to poke it, and the ticker is what kills it. The fix here does not address that; it makes the process survivable while it is addressed. Two layers, because neither alone is portable: - SO_NOSIGPIPE per accepted socket (Darwin/BSD) and MSG_NOSIGNAL per send (Linux), so the signal is never raised for socket writes at all. - A process-wide SIG_IGN backstop, installed once and idempotent, for platforms and paths with neither. With the signal ignored, send() returns -1/EPIPE and the existing error path closes the connection. Also retries send() on EINTR, which the previous loop treated as fatal. This is an exemption in the sense of lang/spec §8: the write never checked whether the peer was still there, and the consequence of not checking was fatal rather than merely wrong.	2026-08-16 13:25:14 -05:00
Neuron	7a1501d097	Grounding is the edge's weight, and the weight is a vector ... A relation that keeps holding up strengthens; one that stops corresponding decays. That is not analogous to grounding, it IS grounding — so it belongs on the edge, not in a subsystem beside it. The graph was already the grounding structure; this stops modelling it as something else. Deleted, not refactored: - cog_ground_edge and the `grounded-by` relation type. A grounded-by edge models grounding as a relation BETWEEN nodes when it is a property OF a relation. #147 fixed which endpoints that edge landed on and left the wrong idea intact. Measured on the live store: the old path scored two nodes with ZERO edges between them at 0.925237 and wrote an edge for it. - ground() writing. It was a read that wrote — the eg_vindex_sync defect. Three identical calls produced three writes to the same edge id. - keystone_write_blocked. Its measured cost was 0.00% brier reduction over n_trials 0 on the keystone: the loop never ran, so the self was never calibrated and never falsifiable. Nothing replaces it — non-circularity of the reference frame is temporal, not a permission. - a graph predicate for "evidence downstream of itself", built and then withdrawn. Reachability from the self region covers 89.2% of the live graph (10,580 of 11,861 nodes), so any topological predicate marks nearly all evidence tainted and degenerates into the total block censorship began as. The vector, carried in a GRD1 block on the edge's own metadata: factual, relational, associative (the existing hebb), polarity (SIGNED — near zero is "no support", negative is "actively contradicts"; `inhibitory` is that distinction crushed to one bit), provenance class, and a timestamp. Confidence, recency, staleness and volatility are DERIVED at read and never serialized. Decay is one model, not two: cog_decay_factor is the single implementation and engram_temporal_decay now delegates to it — proven bit-identical over 24 (age, reinforcement) points. Values reference: thirteen regions, aggregate MIN, binding value named. Measured — the 13 have pairwise centroid cosine min 0.1525 / mean 0.5199 / max 0.9278, so they demonstrably are not one region, and a mean would let agreement with twelve mask a violation of the thirteenth. Supersession versions the whole vector jointly, gated by consequence and salience with no epsilon anywhere: floor crossings and sign changes only. Polarity flips and provenance-class changes are inherently significant and bypass the salience gate. Also fixed: the frame contract. Descriptors are built over L2-normalized member embeddings; think() and the grounding path were fitting RAW vectors against them. Measured on the self region, same data, same 106 members: magnitude 0.00283443 -> 0.536134, spread 18.7565 -> 0.930163. Every fit score sat three decimal places below the 0.5 floors that gate on them. assert() gates on both floors and computes still_held instead of returning a hardcoded `true` — the old build reported still_held for a node that does not exist.	2026-08-16 13:18:50 -05:00
will.anderson	d41645388a	runtime: make valid UTF-8 the JSON emitter's contract (#148)	2026-08-16 17:03:44 +00:00
Neuron	8a307dfd42	runtime: make valid UTF-8 the JSON emitter's contract ... Three nodes in the live graph carry labels truncated to exactly 80 bytes ending in a lone 0xE2 — the first byte of an em-dash, cut mid-sequence. jb_emit_escaped copied every byte >= 0x20 through verbatim, so those three nodes made the ENTIRE /api/nodes/list response undecodable and no strict parser could read the graph at all. production binary 25,929,607 bytes INVALID at byte 89260 this build 26,338,389 bytes VALID, parses to 13,630 nodes The damage was NOT written by this runtime. No 80-byte truncation exists here (the only label truncation is engram_first_n_chars at 60), and the content of those nodes is 2572 and 2746 bytes. Some other producer wrote them. That is exactly why fixing a writer could not have fixed this: the store already holds the damage, and it accepts data from importers, other producers and older binaries. So the fix goes where the promise is made. A serializer that emits JSON owes valid UTF-8 whatever it is handed. jb_emit_escaped now validates each multi-byte sequence before emitting any of it and substitutes U+FFFD for a bad lead byte, a missing or malformed continuation, an overlong encoding, a UTF-16 surrogate, or a codepoint above U+10FFFF. Invalid bytes are REPLACED rather than dropped, so the damage stays visible in the output instead of being silently papered over. Well-formed input is byte-identical to before. Second, preventive and explicitly NOT the cause of the above: engram_first_n_chars truncated by BYTES despite its name, so content with a multi-byte character crossing byte 60 would produce a half codepoint in the label. It now uses el_utf8_safe_len, which returns the largest byte length <= max that does not split a codepoint. Bounded by bytes, not codepoints, so existing labels never grow — they only stop splitting. el_utf8_safe_len lives beside str_count_chars rather than in the engram because the rest of el's string layer is already codepoint-aware (str_count_chars counts codepoints, str_reverse walks codepoint lengths). Byte truncation was the outlier and the concern is a string concern. Note on the investigation: I first "fixed" the truncator and wrote a test that passed on the UNPATCHED build too, because route_create_node passes label = content when no label is supplied, so engram_first_n_chars is never reached over HTTP. The test proved nothing. The real cause was only found by decoding the actual failing bytes out of the live response.	2026-08-16 12:03:03 -05:00
will.anderson	616815b2ab	Give cross-cutting concerns an owner instead of a convention (#145)	2026-08-16 16:57:51 +00:00
will.anderson	1a8a966cb3	runtime: transduction is a language concern, so move it into the language (#144)	2026-08-16 16:57:35 +00:00
will.anderson	1f70b9fa18	runtime: ground the node asked about, and refuse circular support (#147)	2026-08-16 16:54:17 +00:00
Neuron	317466e8f7	runtime: ground the node asked about, and refuse circular support ... engram_ground_json resolved each seed to a REGION, wrote the grounded-by edge between the two regions' HUBS, and then echoed those hubs back in the "claim"/"evidence" fields as if they were the caller's input: const char* cid = C->hub_id ? C->hub_id : EL_CSTR(claim); const char* eid = E->hub_id ? E->hub_id : EL_CSTR(evidence); cog_ground_edge(g_engram_store, cid, eid, grounding, fw); Three consequences, all measured against a clone of the live store: 1. The edge landed on a node the caller never named. Grounding 3b9ced5d against 6edf8c79 wrote an edge on the hubs of their regions instead. 2. When both seeds resolve into the same region the support is circular and scores near 1.0 for structural reasons, not evidential ones. Four probe nodes written together landed in one region, and every grounding among them returned 0.93-0.99 as if it were evidence. Two independent agents hit this and reported 0.885 / 0.909 self-groundings as confident. 3. The echo concealed both: the response was indistinguishable from a successful grounding of the ids that were passed in. The region is HOW a claim is evaluated; it is not WHAT the claim is about. So the edge now attaches to the requested ids, and the resolved hubs are reported separately as claim_region / evidence_region. Degeneracy is broader than hub == hub. Three circular shapes, all previously invisible: same-region both seeds resolve to one region claim-region-is-evidence the evidence IS the hub of the claim's own neighbourhood — measured at 0.98883 evidence-region-is-claim the mirror case Each sets grounding to 0 and writes no edge. Circular support is not support, and a grounding that is degenerate by construction must not enter the graph as though it were evidence. Verified: 6edf8c79 -> 6edf8c79 degenerate=same-region g=0 written=false 6edf8c79 -> d0406dfd degenerate=same-region g=0 written=false ebc1413e -> 64cc96ef degenerate=false g=0.774563 written=true 64cc96ef -> ebc1413e degenerate=false g=0.802896 written=true Legitimate grounding across distinct regions is unchanged and still writes; only circular support is refused. This is the same class as #142 and #146 — a value that looked like an answer with nothing behind it — except here it was also writing that non-answer into the canonical store.	2026-08-16 11:53:31 -05:00
will.anderson	eb3e6d7c1f	runtime: resume the learned stance in think (#146)	2026-08-16 16:44:15 +00:00
Neuron	88e3008735	runtime: resume the learned stance in think, instead of discarding it ... engram_think_json built a NEUTRAL stance on every call — cog_stance_init with a NULL id, all axis_gain 1.0, bias_dir NULL, reliability 0.5 — and never loaded the stance the correspondence-beat had been persisting. That mattered because the faculty enters engram_think ONLY through the stance: axis_gain[k] warps the per-axis extents and bias_dir seeds the steering direction. cog_stance_init stores the faculty NAME and nothing reads it. So with a neutral stance, reason/abduce/induce/plan/analogize were byte-identical output under different labels, and confidence was pinned to 0.5 because GeoGradient.confidence IS stance->reliability. The machinery already existed and only this call site ignored it. engram_correspondence_beat_json resumes via cog_stance_from_node and persists via cog_stance_to_node under "stance-<faculty>-<hub>". Every beat's calibration was written and then thrown away on the next read. Same defect as the NULL anchor fixed in #142, one line below: a neutral argument collapsing a capability to a constant. Resume the same id the beat writes, so learning compounds across beats and cold boot. Fall back to neutral only when no stance exists — a genuine uninformed prior rather than a discarded informed one. Also emit stance_resumed, so confidence 0.5 from a learned-but-unreliable stance is distinguishable from confidence 0.5 from "no stance exists". That reporting gap is what let the neutral stance hide. Verified against a clone of the production store (13,627 nodes): before beat, no stance stance_resumed=false confidence=0.5 beat on a NON-keystone brier 0.00458568 -> 0.00329654 reduction 28.11%, n_trials 6000, reliability 0.930726, stance_written=true after beat stance_resumed=true confidence=0.930726 Confidence now equals the learned reliability instead of the uninformed prior. The keystone self-anchor correctly stays at 0.5 — calibration is deliberately refused on protected identity regions, and that refusal is now visible as resumed=true with confidence unchanged, rather than being indistinguishable from the bug. STILL OPEN: with no learned bias_dir the faculties remain identical in direction. What distinguishes abduce from induce geometrically is a design decision about how Neuron thinks, not a plumbing defect, and is deliberately left to Will.	2026-08-16 11:43:38 -05:00
bigmerge	26af149aa1	lang: rebuild the bootstrap compiler against merged dev ... The binary was stamped before dev advanced (vindex publication landed in el_runtime.c and engram_vindex.c). Rebuilt against the merged runtime so the committed compiler matches the runtime it ships beside. Fixpoint re-verified byte-identical; test_compiler 82/82; engram/src/server.el still compiles and still emits its 18 config declarations.	2026-08-16 11:38:52 -05:00
bigmerge	c18abf799c	engram: declare configuration once instead of at every read site ... Migrates engram to the `program` block. 18 configuration variables that each carried their default inline at the point of use now declare it in one place, and engram declares itself a singleton. The read sites lose their defaults entirely: `let v = env("X")` followed by `if str_eq(v,"") { "default" } else { v }` collapses to `config("X")`. The guide_env_or(key, dflt) helper is deleted -- its whole job was supplying a per-site default, which is the thing being removed. Fixes ENGRAM_DATA_DIR, which was the clearest instance of the defect. It was read at six sites. Five were dead: `let dir_raw = env("ENGRAM_DATA_DIR")` immediately shadowed on the next line by `engram_resolve_data_dir()`. The sixth was live and defaulted to /tmp/engram, contradicting the canonical resolver's $HOME/.neuron/engram -- and its consumer is the pre-destructive reseed backup, so with ENGRAM_DATA_DIR unset the safety copy was written to ephemeral storage while the store it protected lived elsewhere. All six now go through engram_resolve_data_dir(). ENGRAM_DATA_DIR is deliberately NOT declared in the program block, and the source says why: engram_resolve_data_dir() already owns it, and a second declaration would give it two owners that can disagree -- recreating the exact defect being removed here. A variable belongs in the block when the block would be its only owner. HOME stays a raw env() read; it is an environment fact, not configuration. singleton: "engram" matters more than it looks. Today a second engram whose bind() fails merely returns from http_serve -- after it has already replayed the WAL and written boot-time backup files -- and then exits 0, indistinguishable from a clean run. That is how two instances came to share one data dir. Verified that the second instance now refuses before any side effect: with instance 1 holding the lock (lsof pid, shell pid, and lock file contents all agreeing at 5946), the second start named that pid, exited 1, and left the data directory untouched. Verified by bijection on the generated C: 18 config() reads, 18 declarations, no read without a declaration and no declaration without a read. Three bad Int values are reported in a single run rather than costing one restart each. ENGRAM_API_KEY keeps its permissive empty default, which disables auth -- that is pre-existing behaviour and changing it is out of scope. The source marks making it `required` as the obvious hardening follow-up.	2026-08-16 11:38:28 -05:00
bigmerge	b305b49f40	lang: re-stamp the bootstrap compiler so the tree can compile its own source ... server.el declares a `program` block, which the previously committed elc cannot parse. Without this the tree is internally inconsistent: source in the repo that the compiler in the repo rejects. This is the documented re-stamp from BOOTSTRAP.md / AGENTS.md, and its precondition is met -- the self-hosting fixpoint was verified byte-identical (stage3 output == stage2 output) both before installing and again with the installed binary. tests/native/test_compiler.el passes 82/82 against it. Two pre-existing failures are unchanged and are NOT from this work, confirmed by rebuilding them against the original runtime: test_env's "state_keys returns JSON array" fails identically before and after, and test_json/test_state fail to link on symbols (json_build_array, state_has) that were never prototyped -- the same class of gap as config(), which this branch fixed because it blocked the build.	2026-08-16 11:38:28 -05:00
bigmerge	8ae163e8e5	lang: give cross-cutting concerns an owner instead of a convention ... El's units of encapsulation are the function and the module. Neither can hold a concern that belongs to the process, so each one had been expressed the only way it could be -- as a convention: call this at every site. Conventions of that shape do not hold. Measured here: zero process-identity guards at any layer, 20 environment variables each with its default written inline at the read site, 62 persist call sites, 10 per-route auth checks. One absence, four times. Step 0 first, because the premise was wrong. El was believed to have no middleware or effect mechanism. It has one, and it is already load-bearing: codegen injects engram_boundary_beat at the entry of every @manager/@accessor fn, decorators take arguments and stack, dharma_emit from a non-@manager fn is a #error, and the cgi block injects el_cgi_init at the head of main(). So the correct move was not to invent a mechanism but to generalize the seam that already existed. The real gap is narrower and is now recorded: the seam is prologue-only and its callee is a fixed builtin. Adds a `program` block -- the third program-level declarative block. cgi and service declare what a program may do; program declares what it is. program "engram" { singleton: "engram" env ENGRAM_BIND: String = ":8742" env GUIDE_PORT: Int = "8771" } singleton takes an exclusive flock before any user statement runs and refuses a second start, reporting the holder's pid. It is a lock rather than a pidfile so the kernel releases it on death including SIGKILL -- no stale state, and so no "delete the lock file to get unstuck" ritual, which would itself be a convention. It reports the pid because "already running" is not actionable; a pid is. That is the direct answer to a stale process surviving a pkill and going on answering probes. env entries resolve once at startup -- environment wins, declaration supplies the fallback -- and validate as a whole, reporting every problem at once rather than costing one restart per variable. config("X") for an undeclared X is fatal, because an advisory schema is just another convention. Programs without a program block are unaffected, so migration is per-program. Only one keyword is added. `config` and `env` could not become keywords -- both are real identifiers in the tree -- so the block's fields are read as identifier token values by its own parse loop and stay usable everywhere else. The init function is emitted at the block site and called from main() rather than inlined into main(). The live backend is codegen_streaming, which emits in source order and cannot hold the entry list alive until main(); this way only a single bool has to survive. Also fixes: config() was defined in el_runtime.c but never prototyped in el_runtime.h, so any el program calling it failed to compile under C99. Spec: section 18 documents what shipped. Section 9 is corrected -- it claimed decorators had no structural meaning, which has not been true for some time. Section 19 designs durability-as-an-epilogue-effect and route authorization and states plainly why neither is implemented here: both land in files under concurrent modification, and the prerequisite for both is lifting the seam from prologue-only to prologue/epilogue. Self-hosting fixpoint verified byte-identical.	2026-08-16 11:38:28 -05:00
bigmerge	3fcc36c2f1	runtime: transduction is a language concern, so move it into the language ... #141 let signal enter as geometry and it worked, but it was placed at the CONSUMER and said so in its own commit message. This is the correction. Three defects, all of them placement: 1. It sat in the engram. Ingest is a LANGUAGE concern — every el program touching any modality needs it, and the engram is merely one el program that happens to hold a graph. The geometry surface is now defined in el_runtime.c immediately ABOVE the engram section and depends on nothing inside it. Delete the entire engram and geometry still enters el. 2. It marshalled the vector as a hex STRING, because el had no first-class geometry value — which reintroduced text as the TRANSPORT medium one layer below the problem being fixed. Geometry is now an el value: a magic-tagged heap object carried in el_val_t, same discipline as List/Map. Hex survives only as an adapter at the edge, which is all an encoding should ever be. 3. It needed an arbitrary `dim <= 8192` bound purely to size an allocation from a caller's CLAIM about a string's length. A value carries its own width, so the width is derived and never asserted. The bound is gone, not raised — there is nothing left to validate. Language surface, none of it engram-prefixed: geometry_new / _dim / _is / _get / _set / _norm / _free, geometry_from_f32le_hex + geometry_to_f32le_hex as the wire adapters, realizer_register(modality, fn_name), realizer_has, and transduce(signal, modality) -> Geometry. REALIZERS ARE DECLARABLE IN EL. This is the part that makes the move real rather than nominal: registration resolves a name with dlsym against the running binary, the identical mechanism http_set_handler already relies on, because every el `fn name(...)` compiles to a global C symbol with that exact name. So an ordinary el function IS a realizer and a new modality needs no runtime patch. Verified end to end in lang/examples/transduce.el: an el-defined tone_realizer is registered by name, transduce dispatches to it, and the signal demonstrably reaches it (distinct signals produce distinct geometry). A modality with no realizer transduces to NOTHING. There is deliberately no built-in realizer, not even for text — silently embedding a description of a signal and calling that perception is the exact defect this ends. engram/src/server.el is migrated: POST /api/nodes decodes "emb" hex exactly once, at the edge, into a Geometry, and everything below that line moves geometry. The wire is unchanged because production clients speak it. "dim" is now an ASSERTION about the vector, not the source of its width; disagreement is a rejected ingest, not a silent reinterpretation. #141's engram_node_set_emb becomes a DEPRECATED WRAPPER over geometry_from_f32le_hex + node_attach_geometry — kept only because the runtime ships as an SDK asset and a downstream binary may link the symbol. Its exact contract, negative cases included, is preserved and re-verified. ingest.el's `fn transduce` is renamed transduce_manifold. Mechanically it had to yield the name (duplicate C symbol, a hard compile error, measured). But it was never signal->geometry: it chunks already-extracted content into a node+edge manifold, one layer up, and had taken the name belonging to the primitive underneath it. Behaviour unchanged. PROPERTIES FROM #141 PRESERVED, each re-measured on a scratch engram (:8971, never prod :8742): - off-dimension vectors stored but NOT indexed — the HNSW build loop still filters on n->emb_dim == dim at four sites, so a 64-dim voice vector is durable and addressable without perturbing the 768-dim canonical index - geometry makes a node ineligible for embed_backfill: after backfill the 64-dim voice node was still 64-dim while the text control acquired 768 - the create response reports whether geometry landed, and the node document always emits emb_dim and embedded Read-back with control and negatives, all verified against a PID-confirmed fresh binary: geometry node emb_dim=64 embedded=true / emb_set=1; text-only control emb_dim=0 embedded=false / emb_set=0; malformed hex, ragged length, and dim-disagreement each emb_set=0. Two compiler landmines found by reading the generated C rather than trusting a successful build, both documented at their sites: elc lowers `a == b` to str_eq unless both operand NAMES are in the per-function int-name set (which does NOT propagate into nested if-expression blocks — the first cut would have strcmp'd two integers as pointers on the first geometry-bearing request), and `+` lowers to string concat when either operand is a user-defined call.	2026-08-16 11:37:27 -05:00
will.anderson	a6cef4b983	runtime: publish the vector index instead of guarding it (#143)	2026-08-16 16:33:28 +00:00
Neuron	8e9d88fc01	runtime: publish the vector index instead of guarding it ... The crash (SIGTRAP in engram_activate -> eg_vindex_sync -> vindex_insert -> _realloc) had three read paths mutating five process-global statics. engram_activate, eg_knn_for_node (whose own comment says "No writes.") and engram_geo_reify_run_json all called eg_vindex_sync, which frees the index, reallocs the seen-map and inserts — on a read. Three moves, in decreasing order of how much they dissolve: 1. Misfiled scratch is not shared state. visited/visit_epoch/visited_cap were never owned by the index; they are one traversal's local, hoisted into struct VIndex as an allocation optimisation. They want neither a lock nor a capability nor a pool — just to go back in the call frame. Two concurrent READS stomped each other purely because of this. 2. const IS the capability. Once the scratch leaves the struct, search reads and nothing else, so vindex_search takes a const VIndex*. That is exactly what a capability-pointer ABI would have bought — a read path physically cannot call vindex_insert, enforced by the compiler on every future caller — for one qualifier instead of an ABI swept across hundreds of builtins. 3. What survives is publication, not ownership. HNSW insert is NOT an append: it rewires the neighbour links of already-existing elements and reallocs elems[], so the store's append-only property does not transfer to the index derived from it. eg_vindex_sync therefore splits into eg_vindex_maintain (exclusive, sole mutator) and eg_vindex_view (shared, returns const VIndex*). A read path may demand that a current snapshot exist — a request to the owner, not a mutation by the reader. Write-side owner: eg_vindex_note_embedded hooks the embedding-ASSIGNMENT sites rather than the append sites, because a node with no embedding cannot be in a vector index — embedding assignment is the event that owns index membership. One O(log n) insert, no O(node_count) presence scan. This also retires the "STALENESS (honest tradeoff)" note where a lazily-embedded older node stayed invisible to route_nearest/autoconnect until a full rebuild (the embed-gap #20 shape). Evidence. The existing harness conflated two hazards, which is why fixing half of it read as failure. Split into four: single (3000 vec, ASan+UBSan) clean -> clean readers (4 readers, no writer, TSan) RACE -> clean unsynchronized (writer+reader, bare) race -> race, expected forever published (owner + 4 readers) n/a -> clean, 3000/3000 landed RESULT: PASS. recall@10 = 0.9365 at ef_search=128 (gate >= 0.90); determinism byte-identical across two independent builds. The unsynchronized half is now permanently expected to race, deliberately: it is the executable proof that the boundary must live above the data structure, not inside it. fb32d15's guard is KEPT, correcting this design's own section 5. Measured, it guards TWO structures and only one was converted here: g->nodes/g->edges are realloc'd in place (el_runtime.c:7618,7629) and engram_activate_inner's embed-backfill writes n->emb through exactly such a borrowed pointer. Deleting the guard reintroduces a measured 11171->9579 edge loss. Its comment is narrowed to the RAM graph and the deletion precondition named. That corrects the ordering claim too: the residual is not one ABI that dissolves everything at once, it is a PROPERTY applied per structure. Residues evaporate in the order the property is applied, and a residue whose structure has not been converted must be left standing.	2026-08-16 11:29:17 -05:00