runtime: make Windows soul reproducible from a clean el checkout

Two el_runtime portability defects only ever lived in staged local copies used to hand-build neuron-ui PR #136's curl-enabled Windows neuron.exe. gcc 15 promotes both to hard errors, so a clean el checkout cannot rebuild that soul. Upstream the minimal fixes so the build is reproducible: - http_serve_async: cast setsockopt optval to (const char*). Win32/mingw setsockopt wants const char*, not int*; the cast is a no-op on POSIX and matches the four already-cast sites elsewhere in this file. - engram_save persist path: map fsync -> _commit in the _WIN32-only el_platform_win.h (io.h already included). Windows has no fsync(); the POSIX path is untouched.
Merge pull request 'runtime: fix the memory-leak + write-corruption pair in el_runtime.c' (#64 ) from hotfix/el-runtime-leak-and-persist into main
2026-07-15 04:24:08 -05:00 · 2026-07-13 21:23:31 +00:00 · 2026-07-13 16:22:02 -05:00 · 2026-07-01 16:30:17 +00:00 · 2026-07-01 11:27:54 -05:00 · 2026-06-29 12:40:37 -05:00
5 changed files with 432 additions and 105 deletions
@@ -0,0 +1,118 @@
+#ifndef EL_PLATFORM_WIN_H
+#define EL_PLATFORM_WIN_H
+/*
+ * el_platform_win.h — Windows OS-boundary shim for el_runtime.c.
+ *
+ * Branch: feat/windows-el-runtime. Included ONLY when _WIN32 is defined; the POSIX build is
+ * untouched. Goal: let el_runtime.c (a BSD-sockets / dlfcn / fork host) compile and link with
+ * mingw-w64 into a native neuron.exe, with no behavioural change to the Linux/macOS build.
+ *
+ * What it maps:
+ *   - sockets  : winsock2 (same call names: socket/bind/listen/accept/recv/send/setsockopt).
+ *                Sockets close with closesocket() (see el_closesocket), and the stack must be
+ *                started once with WSAStartup — done automatically via a load-time constructor.
+ *   - dlsym    : el_runtime.c uses dlsym(RTLD_DEFAULT, name) to resolve callback/tool symbols
+ *                exported by the main module. Windows equivalent: GetProcAddress on the process
+ *                module. Link the soul with -Wl,--export-all-symbols so the symbols are findable.
+ *   - popen    : mapped to _popen/_pclose.
+ *   - threads  : UNCHANGED. mingw-w64 ships winpthreads, so <pthread.h> + -lpthread just work.
+ */
+
+#ifndef WIN32_LEAN_AND_MEAN
+#define WIN32_LEAN_AND_MEAN
+#endif
+#include <winsock2.h>
+#include <ws2tcpip.h>
+#include <windows.h>
+#include <io.h>
+#include <process.h>
+
+/* Portable headers mingw-w64 provides (verified present). */
+#include <stdarg.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <strings.h>   /* strcasecmp */
+#include <ctype.h>
+#include <math.h>
+#include <time.h>
+#include <sys/time.h>  /* mingw-w64 provides gettimeofday here */
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <dirent.h>
+#include <errno.h>
+#include <pthread.h>
+
+/* ── socket close ─────────────────────────────────────────────────────────── */
+/* Winsock closes sockets with closesocket(), not close() (close() is for file fds). The POSIX
+   build defines the same helper as close() so the call sites are identical across platforms. */
+static inline int el_closesocket(SOCKET s) { return closesocket(s); }
+
+/* ── winsock init (once, at load) ─────────────────────────────────────────── */
+static void el__win_net_init(void) {
+    static int inited = 0;
+    if (!inited) { WSADATA w; WSAStartup(MAKEWORD(2, 2), &w); inited = 1; }
+}
+__attribute__((constructor)) static void el__win_ctor(void) { el__win_net_init(); }
+
+/* ── dlsym → GetProcAddress ───────────────────────────────────────────────── */
+#ifndef RTLD_DEFAULT
+#define RTLD_DEFAULT ((void*)0)
+#endif
+static inline void* el_win_dlsym(void* handle, const char* name) {
+    (void)handle;
+    return (void*)(uintptr_t)GetProcAddress(GetModuleHandleA(NULL), name);
+}
+#define dlsym(h, n) el_win_dlsym((h), (n))
+
+/* ── popen / pclose ───────────────────────────────────────────────────────── */
+#define popen  _popen
+#define pclose _pclose
+
+/* ── misc POSIX → Win32 shims ─────────────────────────────────────────────── */
+#include <direct.h>            /* _mkdir */
+#define mkdir(path, mode) _mkdir(path)     /* POSIX mkdir(path,mode) → _mkdir(path) */
+#define timegm _mkgmtime                   /* UTC tm → time_t */
+#define fsync(fd) _commit(fd)              /* no fsync() on Windows; _commit() (<io.h>) is the equiv */
+
+/* setenv/unsetenv: not in the Windows CRT; map to _putenv_s / SetEnvironmentVariable. */
+static inline int setenv(const char* name, const char* value, int overwrite) {
+    (void)overwrite;
+    return _putenv_s(name, value ? value : "");
+}
+static inline int unsetenv(const char* name) {
+    /* _putenv_s(name, "") sets VAR="" rather than removing it.
+     * SetEnvironmentVariableA(name, NULL) truly deletes it from the Win32
+     * env block; then we sync the CRT cache with _putenv("NAME=").       */
+    SetEnvironmentVariableA(name, NULL);
+    size_t len = strlen(name);
+    char *buf = (char*)malloc(len + 2);
+    if (!buf) return -1;
+    memcpy(buf, name, len);
+    buf[len] = '=';
+    buf[len + 1] = '\0';
+    _putenv(buf);
+    free(buf);
+    return 0;
+}
+
+/* nanosleep — not available in MSVC/UCRT; approximate with Sleep(). */
+static inline int el_nanosleep(const struct timespec *req, struct timespec *rem) {
+    (void)rem;
+    DWORD ms = (DWORD)((req->tv_sec * 1000ULL) + (req->tv_nsec / 1000000ULL));
+    Sleep(ms ? ms : 1);
+    return 0;
+}
+#define nanosleep(req, rem) el_nanosleep((req), (rem))
+
+/* localtime_r/gmtime_r: Windows offers localtime_s/gmtime_s with reversed arg order. */
+static inline struct tm* localtime_r(const time_t* t, struct tm* out) {
+    return localtime_s(out, t) == 0 ? out : (struct tm*)0;
+}
+static inline struct tm* gmtime_r(const time_t* t, struct tm* out) {
+    return gmtime_s(out, t) == 0 ? out : (struct tm*)0;
+}
+
+#endif /* EL_PLATFORM_WIN_H */
@@ -21,6 +21,10 @@

 #include "el_runtime.h"

+#ifdef _WIN32
+/* Windows OS-boundary shim (winsock/dlsym/popen). Threading stays on <pthread.h> (winpthreads). */
+#include "el_platform_win.h"
+#else
 #include <stdarg.h>
 #include <strings.h>     /* strcasecmp */
 #include <stdint.h>
@@ -43,6 +47,10 @@
 #include <errno.h>
 #include <pthread.h>
 #include <sys/resource.h>  /* getrusage — memory guard */
+/* On POSIX, sockets close with the same close() as files; el_platform_win.h supplies the Windows
+   variant. Defined here so the socket call sites are identical across platforms. */
+static inline int el_closesocket(int s) { return close(s); }
+#endif
 #ifdef HAVE_CURL
 #include <curl/curl.h>
 #endif
@@ -182,6 +190,7 @@ el_val_t println(el_val_t s) {
    const char* str = EL_CSTR(s);
    if (str) puts(str);
    else     puts("");
+    fflush(stdout);  /* prevent startup logs from silently buffering when stdout→file */
    return 0;
 }

@@ -701,6 +710,7 @@ static void jb_init(JsonBuf* b);
 static void jb_putc(JsonBuf* b, char c);
 static void jb_puts(JsonBuf* b, const char* s);
 static void jb_emit_escaped(JsonBuf* b, const char* s);
+static char* jb_finish(JsonBuf* b);
 static int  looks_like_string(el_val_t v);
 static const char* json_find_key(const char* s, const char* key);
 static const char* json_skip_value(const char* p);
@@ -1054,7 +1064,6 @@ el_val_t http_post_to_file(el_val_t url, el_val_t body, el_val_t headers_map, el

 #define HTTP_MAX_CONNS 64

-typedef el_val_t (*http_handler_fn)(el_val_t method, el_val_t path, el_val_t body);

 typedef struct {
    char*           name;
@@ -1529,12 +1538,20 @@ static void http_send_response(int fd, const char* body) {
 }

 typedef struct {
+#ifdef _WIN32
+    SOCKET fd;
+#else
    int fd;
+#endif
 } HttpWorkerArg;

 static void* http_worker(void* arg) {
    HttpWorkerArg* a = (HttpWorkerArg*)arg;
+#ifdef _WIN32
+    SOCKET fd = a->fd;
+#else
    int fd = a->fd;
+#endif
    free(a);
    char *method = NULL, *path = NULL, *body = NULL;
    if (http_read_request(fd, &method, &path, &body, NULL) == 0) {
@@ -1566,7 +1583,7 @@ static void* http_worker(void* arg) {
        free(response);
    }
    free(method); free(path); free(body);
-    close(fd);
+    el_closesocket(fd);
    /* release a slot */
    pthread_mutex_lock(&_http_conn_mu);
    _http_conn_active--;
@@ -1588,22 +1605,26 @@ el_val_t http_serve(el_val_t port, el_val_t handler) {
    int sock = socket(AF_INET6, SOCK_STREAM, 0);
    if (sock < 0) { perror("socket"); return 0; }
    int yes = 1; int no = 0;
-    setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &yes, sizeof(yes));
-    setsockopt(sock, IPPROTO_IPV6, IPV6_V6ONLY, &no, sizeof(no));
+    setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, (const char*)&yes, sizeof(yes));
+    setsockopt(sock, IPPROTO_IPV6, IPV6_V6ONLY, (const char*)&no, sizeof(no));
    struct sockaddr_in6 addr;
    memset(&addr, 0, sizeof(addr));
    addr.sin6_family = AF_INET6;
    addr.sin6_addr = in6addr_any;
    addr.sin6_port = htons((uint16_t)p);
    if (bind(sock, (struct sockaddr*)&addr, sizeof(addr)) < 0) {
-        perror("bind"); close(sock); return 0;
+        perror("bind"); el_closesocket(sock); return 0;
    }
-    if (listen(sock, 64) < 0) { perror("listen"); close(sock); return 0; }
+    if (listen(sock, 64) < 0) { perror("listen"); el_closesocket(sock); return 0; }
    fprintf(stderr, "[http] listening on [::]:%d (dual-stack)\n", p);
    while (1) {
        struct sockaddr_in6 cli;
        socklen_t clen = sizeof(cli);
+#ifdef _WIN32
+        SOCKET cfd = accept(sock, (struct sockaddr*)&cli, &clen);
+#else
        int cfd = accept(sock, (struct sockaddr*)&cli, &clen);
+#endif
        if (cfd < 0) {
            if (errno == EINTR) continue;
            perror("accept"); break;
@@ -1615,11 +1636,11 @@ el_val_t http_serve(el_val_t port, el_val_t handler) {
        _http_conn_active++;
        pthread_mutex_unlock(&_http_conn_mu);
        HttpWorkerArg* arg = malloc(sizeof(HttpWorkerArg));
-        if (!arg) { close(cfd); continue; }
+        if (!arg) { el_closesocket(cfd); continue; }
        arg->fd = cfd;
        pthread_t tid;
        if (pthread_create(&tid, NULL, http_worker, arg) != 0) {
-            close(cfd); free(arg);
+            el_closesocket(cfd); free(arg);
            pthread_mutex_lock(&_http_conn_mu);
            _http_conn_active--;
            pthread_cond_signal(&_http_conn_cv);
@@ -1628,7 +1649,7 @@ el_val_t http_serve(el_val_t port, el_val_t handler) {
        }
        pthread_detach(tid);
    }
-    close(sock);
+    el_closesocket(sock);
    return 0;
 }

@@ -1649,8 +1670,6 @@ el_val_t http_serve(el_val_t port, el_val_t handler) {
 * separate active-handler slot, separate dlsym fallback. Mixing v1 and v2
 * handlers in the same process is fine — they don't share the active slot. */

-typedef el_val_t (*http_handler4_fn)(el_val_t method, el_val_t path,
-                                     el_val_t headers_map, el_val_t body);

 typedef struct {
    char*             name;
@@ -1786,7 +1805,11 @@ static el_val_t http_build_headers_map(const char* hdr_block) {

 static void* http_worker_v2(void* arg) {
    HttpWorkerArg* a = (HttpWorkerArg*)arg;
+#ifdef _WIN32
+    SOCKET fd = a->fd;
+#else
    int fd = a->fd;
+#endif
    free(a);
    char *method = NULL, *path = NULL, *body = NULL, *hdr_block = NULL;
    if (http_read_request(fd, &method, &path, &body, &hdr_block) == 0) {
@@ -1816,7 +1839,7 @@ static void* http_worker_v2(void* arg) {
        free(response);
    }
    free(method); free(path); free(body); free(hdr_block);
-    close(fd);
+    el_closesocket(fd);
    pthread_mutex_lock(&_http_conn_mu);
    _http_conn_active--;
    pthread_cond_signal(&_http_conn_cv);
@@ -1838,22 +1861,26 @@ el_val_t http_serve_v2(el_val_t port, el_val_t handler) {
    int sock = socket(AF_INET6, SOCK_STREAM, 0);
    if (sock < 0) { perror("socket"); return 0; }
    int yes = 1; int no = 0;
-    setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &yes, sizeof(yes));
-    setsockopt(sock, IPPROTO_IPV6, IPV6_V6ONLY, &no, sizeof(no));
+    setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, (const char*)&yes, sizeof(yes));
+    setsockopt(sock, IPPROTO_IPV6, IPV6_V6ONLY, (const char*)&no, sizeof(no));
    struct sockaddr_in6 addr;
    memset(&addr, 0, sizeof(addr));
    addr.sin6_family = AF_INET6;
    addr.sin6_addr = in6addr_any;
    addr.sin6_port = htons((uint16_t)p);
    if (bind(sock, (struct sockaddr*)&addr, sizeof(addr)) < 0) {
-        perror("bind"); close(sock); return 0;
+        perror("bind"); el_closesocket(sock); return 0;
    }
-    if (listen(sock, 64) < 0) { perror("listen"); close(sock); return 0; }
+    if (listen(sock, 64) < 0) { perror("listen"); el_closesocket(sock); return 0; }
    fprintf(stderr, "[http v2] listening on [::]:%d (dual-stack)\n", p);
    while (1) {
        struct sockaddr_in6 cli;
        socklen_t clen = sizeof(cli);
+#ifdef _WIN32
+        SOCKET cfd = accept(sock, (struct sockaddr*)&cli, &clen);
+#else
        int cfd = accept(sock, (struct sockaddr*)&cli, &clen);
+#endif
        if (cfd < 0) {
            if (errno == EINTR) continue;
            perror("accept"); break;
@@ -1865,11 +1892,11 @@ el_val_t http_serve_v2(el_val_t port, el_val_t handler) {
        _http_conn_active++;
        pthread_mutex_unlock(&_http_conn_mu);
        HttpWorkerArg* arg = malloc(sizeof(HttpWorkerArg));
-        if (!arg) { close(cfd); continue; }
+        if (!arg) { el_closesocket(cfd); continue; }
        arg->fd = cfd;
        pthread_t tid;
        if (pthread_create(&tid, NULL, http_worker_v2, arg) != 0) {
-            close(cfd); free(arg);
+            el_closesocket(cfd); free(arg);
            pthread_mutex_lock(&_http_conn_mu);
            _http_conn_active--;
            pthread_cond_signal(&_http_conn_cv);
@@ -1878,7 +1905,7 @@ el_val_t http_serve_v2(el_val_t port, el_val_t handler) {
        }
        pthread_detach(tid);
    }
-    close(sock);
+    el_closesocket(sock);
    return 0;
 }

@@ -1936,8 +1963,9 @@ void http_serve_async(el_val_t port, el_val_t handler) {
    int sock = socket(AF_INET6, SOCK_STREAM, 0);
    if (sock < 0) { perror("socket"); return; }
    int yes = 1; int no = 0;
-    setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &yes, sizeof(yes));
-    setsockopt(sock, IPPROTO_IPV6, IPV6_V6ONLY, &no, sizeof(no));
+    /* Win32/mingw setsockopt takes optval as (const char*); the cast is portable on POSIX too. */
+    setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, (const char*)&yes, sizeof(yes));
+    setsockopt(sock, IPPROTO_IPV6, IPV6_V6ONLY, (const char*)&no, sizeof(no));
    struct sockaddr_in6 addr;
    memset(&addr, 0, sizeof(addr));
    addr.sin6_family = AF_INET6;
@@ -1988,7 +2016,7 @@ el_val_t http_response(el_val_t status, el_val_t headers_json, el_val_t body) {
    jb_puts(&out, ",\"body\":");
    jb_emit_escaped(&out, b);
    jb_putc(&out, '}');
-    return el_wrap_str(out.buf);
+    return el_wrap_str(jb_finish(&out));
 }

 /* ── Filesystem ──────────────────────────────────────────────────────────── */
@@ -2095,7 +2123,7 @@ el_val_t exec_capture(el_val_t cmdv) {
    char buf[4096];
    while (fgets(buf, sizeof(buf), f)) jb_puts(&b, buf);
    pclose(f);
-    return el_wrap_str(b.buf);
+    return el_wrap_str(jb_finish(&b));
 }

 // exec — run a shell command via /bin/sh, capture stdout, return as String.
@@ -2119,7 +2147,7 @@ el_val_t exec(el_val_t cmdv) {
        jb_puts(&b, buf);
    }
    pclose(f);
-    return el_wrap_str(b.buf);
+    return el_wrap_str(jb_finish(&b));
 }

 // exec_bg — run a shell command in background, return PID as String.
@@ -2129,6 +2157,23 @@ el_val_t exec(el_val_t cmdv) {
 el_val_t exec_bg(el_val_t cmdv) {
    const char* cmd = EL_CSTR(cmdv);
    if (!cmd || !*cmd) return el_wrap_str(el_strdup(""));
+#ifdef _WIN32
+    /* Windows: no fork/exec. Launch a detached `cmd /c <command>` with no console window via
+       CreateProcess (DETACHED_PROCESS | CREATE_NO_WINDOW). Returns the PID as a string, "" on fail.
+       Mirrors the POSIX branch: child runs independently, caller is not blocked. */
+    char cmdline[8192];
+    snprintf(cmdline, sizeof(cmdline), "cmd.exe /c %s", cmd);
+    STARTUPINFOA si; ZeroMemory(&si, sizeof(si)); si.cb = sizeof(si);
+    PROCESS_INFORMATION pi; ZeroMemory(&pi, sizeof(pi));
+    BOOL ok = CreateProcessA(NULL, cmdline, NULL, NULL, FALSE,
+                             DETACHED_PROCESS | CREATE_NO_WINDOW, NULL, NULL, &si, &pi);
+    if (!ok) return el_wrap_str(el_strdup(""));
+    char pidbuf[32];
+    snprintf(pidbuf, sizeof(pidbuf), "%lu", (unsigned long)pi.dwProcessId);
+    CloseHandle(pi.hProcess);
+    CloseHandle(pi.hThread);
+    return el_wrap_str(el_strdup(pidbuf));
+#else
    pid_t pid = fork();
    if (pid < 0) {
        /* fork failed */
@@ -2151,6 +2196,7 @@ el_val_t exec_bg(el_val_t cmdv) {
    char pidbuf[32];
    snprintf(pidbuf, sizeof(pidbuf), "%d", (int)pid);
    return el_wrap_str(el_strdup(pidbuf));
+#endif
 }

 el_val_t fs_list(el_val_t pathv) {
@@ -3248,6 +3294,23 @@ static void jb_puts(JsonBuf* b, const char* s) {
    b->buf[b->len] = '\0';
 }

+/* jb_finish — call exactly once, at the point a JsonBuf's buffer is handed
+ * off as an el_val_t return value (via el_wrap_str). JsonBuf allocates through
+ * raw malloc/realloc (jb_init/jb_reserve), NOT el_strdup/el_strbuf, so unlike
+ * those helpers it was never registered with the per-request arena — every
+ * JsonBuf-built JSON string leaked unconditionally, whether or not a request
+ * arena was active, because nothing ever freed it. el_arena_track() is a
+ * documented no-op when no arena is active, so this is safe to call from any
+ * context (HTTP request handler, CLI arena-scope, or no arena at all — the
+ * last case still leaks, same as before, until the caller's context is itself
+ * arena-scoped). Do NOT call this on a JsonBuf whose ->buf is consumed by
+ * another builder (jb_puts(&other, x.buf)) and freed manually — only on the
+ * one actually returned via el_wrap_str. */
+static char* jb_finish(JsonBuf* b) {
+    el_arena_track(b->buf);
+    return b->buf;
+}
+
 static void jb_emit_escaped(JsonBuf* b, const char* s) {
    jb_putc(b, '"');
    const unsigned char* p = (const unsigned char*)s;
@@ -3356,7 +3419,7 @@ static void jb_emit_value(JsonBuf* b, el_val_t v) {
 el_val_t json_stringify(el_val_t v) {
    JsonBuf b; jb_init(&b);
    jb_emit_value(&b, v);
-    return el_wrap_str(b.buf);
+    return el_wrap_str(jb_finish(&b));
 }

 /* ── JSON substring accessors ────────────────────────────────────────────── */
@@ -3543,7 +3606,7 @@ el_val_t json_set(el_val_t json_str, el_val_t key, el_val_t value) {
        jb_putc(&b, ':');
        jb_puts(&b, raw_val);
        jb_putc(&b, '}');
-        return el_wrap_str(b.buf);
+        return el_wrap_str(jb_finish(&b));
    }
    const char* existing = json_find_key(json, k);
    JsonBuf b; jb_init(&b);
@@ -3557,7 +3620,7 @@ el_val_t json_set(el_val_t json_str, el_val_t key, el_val_t value) {
        b.buf[b.len] = '\0';
        jb_puts(&b, raw_val);
        jb_puts(&b, end);
-        return el_wrap_str(b.buf);
+        return el_wrap_str(jb_finish(&b));
    }
    /* Insert before closing '}'. Find last '}' */
    size_t jl = strlen(json);
@@ -3589,7 +3652,7 @@ el_val_t json_set(el_val_t json_str, el_val_t key, el_val_t value) {
    jb_puts(&b, raw_val);
    /* Append from close_idx onward */
    jb_puts(&b, json + close_idx);
-    return el_wrap_str(b.buf);
+    return el_wrap_str(jb_finish(&b));
 }

 el_val_t json_array_len(el_val_t json_str) {
@@ -3727,7 +3790,7 @@ el_val_t json_build_object(el_val_t kvs) {
        jb_putc(&b, '"');
    }
    jb_putc(&b, '}');
-    return el_wrap_str(b.buf);
+    return el_wrap_str(jb_finish(&b));
 }

 /* json_build_array — build a JSON array from a list of raw JSON values.
@@ -3745,7 +3808,7 @@ el_val_t json_build_array(el_val_t items) {
        jb_puts(&b, vs);
    }
    jb_putc(&b, ']');
-    return el_wrap_str(b.buf);
+    return el_wrap_str(jb_finish(&b));
 }

 /* ── Time ────────────────────────────────────────────────────────────────── */
@@ -4478,7 +4541,12 @@ static int _el_decompose_earth(el_caltime_t* ct, struct tm* tm_out, int* abbr_le
    localtime_r(&s, &tm);
    *tm_out = tm;
    if (abbr_buf && abbr_cap > 0) {
+        /* mingw's struct tm has no tm_zone (BSD/glibc extension); no abbrev available there. */
+#ifdef _WIN32
+        const char* z_str = "";
+#else
        const char* z_str = tm.tm_zone ? tm.tm_zone : "";
+#endif
        size_t n = strlen(z_str);
        if (n >= abbr_cap) n = abbr_cap - 1;
        memcpy(abbr_buf, z_str, n);
@@ -5144,7 +5212,7 @@ el_val_t state_keys(void) {
    }
    jb_putc(&b, ']');
    pthread_mutex_unlock(&_state_mu);
-    return el_wrap_str(b.buf);
+    return el_wrap_str(jb_finish(&b));
 }

 /* Returns 1 (true) if the key is present in the state store, else 0 (false). */
@@ -5350,7 +5418,7 @@ el_val_t str_format(el_val_t fmt, el_val_t data) {
        jb_putc(&b, *p);
        p++;
    }
-    return el_wrap_str(b.buf);
+    return el_wrap_str(jb_finish(&b));
 }

 el_val_t str_lower(el_val_t s) { return str_to_lower(s); }
@@ -5766,7 +5834,7 @@ el_val_t list_join(el_val_t listv, el_val_t sep) {
            jb_puts(&b, tmp);
        }
    }
-    return el_wrap_str(b.buf);
+    return el_wrap_str(jb_finish(&b));
 }

 el_val_t list_range(el_val_t start, el_val_t end) {
@@ -5832,6 +5900,10 @@ el_val_t getpid_now(void) {
 * Returns 0 always (the only non-return path is the exit() branch).
 */
 el_val_t el_mem_check(void) {
+#ifdef _WIN32
+    /* getrusage is POSIX-only — memory guard disabled on Windows. */
+    return 0;
+#else
    /* Read limit from env; default 512 MB. */
    long limit_mb = 512;
    const char *env_val = getenv("ELC_MAX_MEM_MB");
@@ -5857,6 +5929,7 @@ el_val_t el_mem_check(void) {
        exit(1);
    }
    return 0;
+#endif
 }

 /* ── args() — command-line argument access ──────────────────────────────────
@@ -6031,6 +6104,14 @@ void el_cgi_init(el_val_t name, el_val_t dharma_id, el_val_t principal,
 #define ENGRAM_LAYER_DOMAIN          2u
 #define ENGRAM_LAYER_IMPRINT         3u
 #define ENGRAM_LAYER_SUIT            4u
+#define ENGRAM_LAYER_ACCUMULATION    5u
+/* New user-facing nodes (memories, knowledge, conversations) are created in the
+ * accumulation layer — the top of the consciousness stack, the engram the user
+ * sees; every layer below shapes behavior but is hidden from the user (Layered
+ * Consciousness architecture, app 64/064,262). ENGRAM_LAYER_DEFAULT stays
+ * core-identity ON PURPOSE: it is the fallback home for LEGACY nodes loaded from
+ * snapshots without a layer_id, so existing data (the originator corpus) is
+ * never migrated out of its established layer. New != legacy. */
 #define ENGRAM_LAYER_DEFAULT         ENGRAM_LAYER_CORE_IDENTITY

 /* Pass 3 override floor. Layer 0 nodes that received any background
@@ -6050,6 +6131,10 @@ static double engram_type_threshold(const char* node_type, const char* tier) {
        if (strcmp(tier, "Lesson")    == 0) return 0.25;
    }
    if (node_type) {
+        /* Knowledge nodes: Canonical/Lesson handled by tier checks above.
+         * Procedural-tier Knowledge (activation_count>=50 migration): 0.20.
+         * (2026-06-29 self-review — mirrors release runtime fix) */
+        if (strcmp(node_type, "Knowledge") == 0) return 0.20;
        if (strcmp(node_type, "Belief") == 0) return 0.30;
        if (strcmp(node_type, "Entity") == 0) return 0.30;
    }
@@ -6208,6 +6293,20 @@ static void engram_init_layers(EngramStore* g) {
        .transparent = 0,
        .injectable = 1
    };
+    /* Layer 5 — accumulation. The TOP of the consciousness stack: the default
+     * home for all new user-facing nodes. This is the engram the user sees;
+     * every layer below shapes behavior but is hidden from the user. Not
+     * injectable — it is the persistent user accumulation, not a swappable
+     * overlay. transparent=0: its content is surfaced to introspection (it is
+     * the user's own knowledge/memory), unlike the lower behavioral layers. */
+    g->layers[g->layer_count++] = (EngramLayer){
+        .layer_id = ENGRAM_LAYER_ACCUMULATION,
+        .name = el_strdup_persist("accumulation"),
+        .activation_priority = 50,
+        .suppressible = 1,
+        .transparent = 0,
+        .injectable = 0
+    };
 }

 static EngramStore* engram_get(void) {
@@ -6322,7 +6421,9 @@ static void engram_grow_edges(void) {
 static char* engram_new_id(void) {
    el_val_t v = uuid_new();
    const char* s = EL_CSTR(v);
-    return el_strdup(s ? s : "");
+    /* Persistent: node ids live in the global store; an arena (el_strdup) id is
+     * freed at el_request_end(), corrupting the node after the creating request. */
+    return el_strdup_persist(s ? s : "");
 }

 /* Convert a node into an ElMap of its fields.                            */
@@ -6383,12 +6484,12 @@ el_val_t engram_node(el_val_t content, el_val_t node_type, el_val_t salience) {
    n->id        = engram_new_id();
    const char* c  = EL_CSTR(content);
    const char* nt = EL_CSTR(node_type);
-    n->content   = el_strdup(c ? c : "");
-    n->node_type = el_strdup(nt && *nt ? nt : "Memory");
-    n->label     = engram_first_n_chars(c, 60);
-    n->tier      = el_strdup("Working");
-    n->tags      = el_strdup("");
-    n->metadata  = el_strdup("{}");
+    n->content   = el_strdup_persist(c ? c : "");
+    n->node_type = el_strdup_persist(nt && *nt ? nt : "Memory");
+    { char* _lb = engram_first_n_chars(c, 60); n->label = el_strdup_persist(_lb); } /* persist: stored field must outlive request arena */
+    n->tier      = el_strdup_persist("Working");
+    n->tags      = el_strdup_persist("");
+    n->metadata  = el_strdup_persist("{}");
    n->salience    = engram_decode_score(salience);
    if (n->salience <= 0.0 || n->salience > 1.0) n->salience = 0.5;
    n->importance  = 0.5;
@@ -6399,11 +6500,44 @@ el_val_t engram_node(el_val_t content, el_val_t node_type, el_val_t salience) {
    n->last_activated = now;
    n->created_at = now;
    n->updated_at = now;
-    n->layer_id   = ENGRAM_LAYER_DEFAULT;
+    n->layer_id   = ENGRAM_LAYER_ACCUMULATION; /* new user-facing node → top layer */
    g->node_count++;
    return el_wrap_str(el_strdup(n->id));
 }

+/* engram_is_valid_utf8 — return 1 if s is valid UTF-8, 0 if it contains invalid bytes.
+ * Rejects overlong encodings, surrogate halves, and byte sequences > 4 bytes. */
+static int engram_is_valid_utf8(const char* s) {
+    if (!s) return 1;
+    const unsigned char* p = (const unsigned char*)s;
+    while (*p) {
+        if (*p < 0x80) {
+            /* ASCII */
+            p++;
+        } else if ((*p & 0xE0) == 0xC0) {
+            /* 2-byte sequence */
+            if ((p[1] & 0xC0) != 0x80) return 0;
+            if ((*p & 0xFE) == 0xC0) return 0; /* overlong */
+            p += 2;
+        } else if ((*p & 0xF0) == 0xE0) {
+            /* 3-byte sequence */
+            if ((p[1] & 0xC0) != 0x80 || (p[2] & 0xC0) != 0x80) return 0;
+            if (*p == 0xE0 && (p[1] & 0xE0) == 0x80) return 0; /* overlong */
+            if (*p == 0xED && (p[1] & 0xE0) == 0xA0) return 0; /* surrogate */
+            p += 3;
+        } else if ((*p & 0xF8) == 0xF0) {
+            /* 4-byte sequence */
+            if ((p[1] & 0xC0) != 0x80 || (p[2] & 0xC0) != 0x80 || (p[3] & 0xC0) != 0x80) return 0;
+            if (*p == 0xF0 && (p[1] & 0xF0) == 0x80) return 0; /* overlong */
+            if (*p > 0xF4) return 0; /* above U+10FFFF */
+            p += 4;
+        } else {
+            return 0;
+        }
+    }
+    return 1;
+}
+
 el_val_t engram_node_full(el_val_t content, el_val_t node_type, el_val_t label,
                          el_val_t salience, el_val_t importance, el_val_t confidence,
                          el_val_t tier, el_val_t tags) {
@@ -6417,12 +6551,24 @@ el_val_t engram_node_full(el_val_t content, el_val_t node_type, el_val_t label,
    const char* lb = EL_CSTR(label);
    const char* ti = EL_CSTR(tier);
    const char* tg = EL_CSTR(tags);
-    n->content   = el_strdup(c ? c : "");
-    n->node_type = el_strdup(nt && *nt ? nt : "Memory");
-    n->label     = el_strdup(lb && *lb ? lb : (c ? engram_first_n_chars(c, 60) : ""));
-    n->tier      = el_strdup(ti && *ti ? ti : "Working");
-    n->tags      = el_strdup(tg ? tg : "");
-    n->metadata  = el_strdup("{}");
+    /* UTF-8 guard: reject content with invalid UTF-8 bytes. Persisting invalid
+     * UTF-8 garbles JSON snapshots and corrupts every subsequent node read. */
+    if (c && !engram_is_valid_utf8(c)) {
+        fprintf(stderr, "[engram] REJECTED node write — content contains invalid UTF-8 (label=%s)\n",
+                lb ? lb : "(null)");
+        return EL_STR("");
+    }
+    /* Persistent (el_strdup_persist, NOT el_strdup): these strings are owned by the
+     * persistent global node store. el_strdup tracks into the per-request arena, which
+     * el_request_end() frees when the creating HTTP request completes — leaving the
+     * stored node with dangling pointers (corrupted ids, "saved but never listed").
+     * This is the root cause of the hallucinated/lost-saves class of bugs. */
+    n->content   = el_strdup_persist(c ? c : "");
+    n->node_type = el_strdup_persist(nt && *nt ? nt : "Memory");
+    n->label     = el_strdup_persist(lb && *lb ? lb : (c ? engram_first_n_chars(c, 60) : ""));
+    n->tier      = el_strdup_persist(ti && *ti ? ti : "Working");
+    n->tags      = el_strdup_persist(tg ? tg : "");
+    n->metadata  = el_strdup_persist("{}");
    n->salience    = engram_decode_score(salience);
    n->importance  = engram_decode_score(importance);
    n->confidence  = engram_decode_score(confidence);
@@ -6435,7 +6581,7 @@ el_val_t engram_node_full(el_val_t content, el_val_t node_type, el_val_t label,
    n->last_activated = now;
    n->created_at = now;
    n->updated_at = now;
-    n->layer_id   = ENGRAM_LAYER_DEFAULT;
+    n->layer_id   = ENGRAM_LAYER_ACCUMULATION; /* new user-facing node → top layer */
    g->node_count++;
    return el_wrap_str(el_strdup(n->id));
 }
@@ -6470,11 +6616,11 @@ el_val_t engram_node_layered(el_val_t content, el_val_t node_type, el_val_t labe
    const char* lb = EL_CSTR(label);
    const char* tg = EL_CSTR(tags);
    const char* st = EL_CSTR(status);
-    n->content   = el_strdup(c ? c : "");
-    n->node_type = el_strdup(nt && *nt ? nt : "Memory");
-    n->label     = el_strdup(lb && *lb ? lb : (c ? engram_first_n_chars(c, 60) : ""));
-    n->tier      = el_strdup("Working");
-    n->tags      = el_strdup(tg ? tg : "");
+    n->content   = el_strdup_persist(c ? c : "");
+    n->node_type = el_strdup_persist(nt && *nt ? nt : "Memory");
+    n->label     = el_strdup_persist(lb && *lb ? lb : (c ? engram_first_n_chars(c, 60) : ""));
+    n->tier      = el_strdup_persist("Working");
+    n->tags      = el_strdup_persist(tg ? tg : "");
    if (st && *st) {
        /* Minimal metadata payload: {"status":"..."}. Keep it cheap so
         * callers using `status` don't pay JSON parse cost on every read. */
@@ -6483,7 +6629,7 @@ el_val_t engram_node_layered(el_val_t content, el_val_t node_type, el_val_t labe
        snprintf(meta, sl, "{\"status\":\"%s\"}", st);
        n->metadata = meta;
    } else {
-        n->metadata = el_strdup("{}");
+        n->metadata = el_strdup_persist("{}");
    }
    n->salience    = engram_decode_score(salience);
    n->importance  = engram_decode_score(certainty);
@@ -6756,10 +6902,10 @@ void engram_connect(el_val_t from_id, el_val_t to_id, el_val_t weight, el_val_t
    EngramEdge* e = &g->edges[g->edge_count];
    memset(e, 0, sizeof(*e));
    e->id        = engram_new_id();
-    e->from_id   = el_strdup(f);
-    e->to_id     = el_strdup(t);
-    e->relation  = el_strdup(r && *r ? r : "associate");
-    e->metadata  = el_strdup("{}");
+    e->from_id   = el_strdup_persist(f);
+    e->to_id     = el_strdup_persist(t);
+    e->relation  = el_strdup_persist(r && *r ? r : "associate");
+    e->metadata  = el_strdup_persist("{}");
    e->weight    = engram_decode_score(weight);
    if (e->weight <= 0.0 || e->weight > 1.0) e->weight = 0.5;
    e->confidence = 1.0;
@@ -7365,23 +7511,38 @@ el_val_t engram_save(el_val_t path) {
        jb_putc(&b, '}');
    }
    jb_puts(&b, "]}");
-    FILE* f = fopen(p, "wb");
-    if (!f) { free(b.buf); return 0; }
+    {
+        struct stat _st;
+        if (stat(p, &_st) == 0 && _st.st_size > 200000 &&
+            (uint64_t)b.len < (uint64_t)_st.st_size / 16) {
+            fprintf(stderr, "[engram_save] REFUSED sparse write: new %zu vs existing %lld (<1/16) protecting %s\n",
+                b.len, (long long)_st.st_size, p);
+            free(b.buf); return 0;
+        }
+    }
+    size_t _plen = strlen(p);
+    char* _tmp = (char*)malloc(_plen + 5);
+    if (!_tmp) { free(b.buf); return 0; }
+    memcpy(_tmp, p, _plen); memcpy(_tmp + _plen, ".tmp", 5);
+    FILE* f = fopen(_tmp, "wb");
+    if (!f) { free(_tmp); free(b.buf); return 0; }
    size_t w = fwrite(b.buf, 1, b.len, f);
-    fclose(f);
-    int ok = (w == b.len);
-    free(b.buf);
-    return ok ? 1 : 0;
+    int wok = (w == b.len);
+    if (wok) { fflush(f); fsync(fileno(f)); }
+    fclose(f); free(b.buf);
+    if (!wok) { unlink(_tmp); free(_tmp); return 0; }
+    if (rename(_tmp, p) != 0) { unlink(_tmp); free(_tmp); return 0; }
+    free(_tmp); return 1;
 }

 /* Helper: extract a string field from a JSON object substring. */
 static char* eg_get_str_field(const char* obj, const char* key) {
    const char* p = json_find_key(obj, key);
-    if (!p) return el_strdup("");
-    if (*p != '"') return el_strdup("");
+    if (!p) return el_strdup_persist("");
+    if (*p != '"') return el_strdup_persist("");
    JsonParser jp = { .p = p, .end = p + strlen(p), .err = 0 };
    char* out = jp_parse_string_raw(&jp);
-    if (jp.err) { free(out); return el_strdup(""); }
+    if (jp.err) { free(out); return el_strdup_persist(""); }
    return out;
 }

@@ -7455,7 +7616,7 @@ el_val_t engram_load(el_val_t path) {
                nn->tier      = eg_get_str_field(obj, "tier");
                nn->tags      = eg_get_str_field(obj, "tags");
                nn->metadata  = eg_get_str_field(obj, "metadata");
-                if (!nn->metadata || !*nn->metadata) { free(nn->metadata); nn->metadata = el_strdup("{}"); }
+                if (!nn->metadata || !*nn->metadata) { free(nn->metadata); nn->metadata = el_strdup_persist("{}"); }
                nn->salience           = eg_get_num_field(obj, "salience");
                nn->importance         = eg_get_num_field(obj, "importance");
                nn->confidence         = eg_get_num_field(obj, "confidence");
@@ -7506,7 +7667,7 @@ el_val_t engram_load(el_val_t path) {
                ee->to_id    = eg_get_str_field(obj, "to_id");
                ee->relation = eg_get_str_field(obj, "relation");
                ee->metadata = eg_get_str_field(obj, "metadata");
-                if (!ee->metadata || !*ee->metadata) { free(ee->metadata); ee->metadata = el_strdup("{}"); }
+                if (!ee->metadata || !*ee->metadata) { free(ee->metadata); ee->metadata = el_strdup_persist("{}"); }
                ee->weight     = eg_get_num_field(obj, "weight");
                ee->confidence = eg_get_num_field(obj, "confidence");
                ee->created_at = eg_get_int_field(obj, "created_at");
@@ -7598,7 +7759,7 @@ el_val_t engram_get_node_json(el_val_t id) {
    if (!n) return el_wrap_str(el_strdup("{}"));
    JsonBuf b; jb_init(&b);
    engram_emit_node_json(&b, n);
-    return el_wrap_str(b.buf);
+    return el_wrap_str(jb_finish(&b));
 }

 el_val_t engram_search_json(el_val_t query, el_val_t limit) {
@@ -7626,7 +7787,7 @@ el_val_t engram_search_json(el_val_t query, el_val_t limit) {
        }
    }
    jb_putc(&b, ']');
-    return el_wrap_str(b.buf);
+    return el_wrap_str(jb_finish(&b));
 }

 el_val_t engram_scan_nodes_json(el_val_t limit, el_val_t offset) {
@@ -7635,9 +7796,9 @@ el_val_t engram_scan_nodes_json(el_val_t limit, el_val_t offset) {
    int64_t off = (int64_t)offset; if (off < 0) off = 0;
    JsonBuf b; jb_init(&b);
    jb_putc(&b, '[');
-    if (g->node_count == 0) { jb_putc(&b, ']'); return el_wrap_str(b.buf); }
+    if (g->node_count == 0) { jb_putc(&b, ']'); return el_wrap_str(jb_finish(&b)); }
    int64_t* idx = malloc((size_t)g->node_count * sizeof(int64_t));
-    if (!idx) { jb_putc(&b, ']'); return el_wrap_str(b.buf); }
+    if (!idx) { jb_putc(&b, ']'); return el_wrap_str(jb_finish(&b)); }
    /* Skip transparent layers — introspection filter, same as engram_scan_nodes. */
    int64_t live = 0;
    for (int64_t i = 0; i < g->node_count; i++) {
@@ -7655,7 +7816,7 @@ el_val_t engram_scan_nodes_json(el_val_t limit, el_val_t offset) {
    }
    free(idx);
    jb_putc(&b, ']');
-    return el_wrap_str(b.buf);
+    return el_wrap_str(jb_finish(&b));
 }

 /* engram_scan_nodes_by_type_json — filter by node_type before paginating.
@@ -7671,9 +7832,9 @@ el_val_t engram_scan_nodes_by_type_json(el_val_t type_v, el_val_t limit, el_val_
    int64_t off = (int64_t)offset; if (off < 0) off = 0;
    JsonBuf b; jb_init(&b);
    jb_putc(&b, '[');
-    if (g->node_count == 0) { jb_putc(&b, ']'); return el_wrap_str(b.buf); }
+    if (g->node_count == 0) { jb_putc(&b, ']'); return el_wrap_str(jb_finish(&b)); }
    int64_t* idx = malloc((size_t)g->node_count * sizeof(int64_t));
-    if (!idx) { jb_putc(&b, ']'); return el_wrap_str(b.buf); }
+    if (!idx) { jb_putc(&b, ']'); return el_wrap_str(jb_finish(&b)); }
    int64_t live = 0;
    for (int64_t i = 0; i < g->node_count; i++) {
        if (engram_layer_is_transparent(g->nodes[i].layer_id)) continue;
@@ -7692,7 +7853,7 @@ el_val_t engram_scan_nodes_by_type_json(el_val_t type_v, el_val_t limit, el_val_
    }
    free(idx);
    jb_putc(&b, ']');
-    return el_wrap_str(b.buf);
+    return el_wrap_str(jb_finish(&b));
 }

 el_val_t engram_neighbors_json(el_val_t node_id, el_val_t max_depth, el_val_t direction) {
@@ -7707,7 +7868,7 @@ el_val_t engram_neighbors_json(el_val_t node_id, el_val_t max_depth, el_val_t di
    int allow_in  = (strcmp(dir, "in")  == 0) || (strcmp(dir, "both") == 0);
    JsonBuf b; jb_init(&b);
    jb_putc(&b, '[');
-    if (!sid || !*sid) { jb_putc(&b, ']'); return el_wrap_str(b.buf); }
+    if (!sid || !*sid) { jb_putc(&b, ']'); return el_wrap_str(jb_finish(&b)); }

    /* Frontier of (node_id, hops). Cap to a sane size. */
    char** frontier = calloc(1024, sizeof(char*));
@@ -7717,7 +7878,7 @@ el_val_t engram_neighbors_json(el_val_t node_id, el_val_t max_depth, el_val_t di
    int64_t vc = 0;
    if (!frontier || !frontier_h || !visited) {
        free(frontier); free(frontier_h); free(visited);
-        jb_putc(&b, ']'); return el_wrap_str(b.buf);
+        jb_putc(&b, ']'); return el_wrap_str(jb_finish(&b));
    }
    /* Use plain strdup (not el_strdup) so arena doesn't track these pointers.
     * The BFS loop manually frees them below — arena would double-free them. */
@@ -7760,7 +7921,7 @@ el_val_t engram_neighbors_json(el_val_t node_id, el_val_t max_depth, el_val_t di
    for (int64_t i = 0; i < vc; i++) free(visited[i]);
    free(frontier); free(frontier_h); free(visited);
    jb_putc(&b, ']');
-    return el_wrap_str(b.buf);
+    return el_wrap_str(jb_finish(&b));
 }

 el_val_t engram_activate_json(el_val_t query, el_val_t depth) {
@@ -7801,7 +7962,7 @@ el_val_t engram_activate_json(el_val_t query, el_val_t depth) {
        }
    }
    jb_putc(&b, ']');
-    return el_wrap_str(b.buf);
+    return el_wrap_str(jb_finish(&b));
 }

 el_val_t engram_stats_json(void) {
@@ -7821,7 +7982,7 @@ el_val_t engram_list_layers_json(void) {
    jb_putc(&b, '[');
    /* Build a sorted index over live layers. */
    size_t* idx = malloc((g->layer_count + 1) * sizeof(size_t));
-    if (!idx) { jb_putc(&b, ']'); return el_wrap_str(b.buf); }
+    if (!idx) { jb_putc(&b, ']'); return el_wrap_str(jb_finish(&b)); }
    size_t live = 0;
    for (size_t i = 0; i < g->layer_count; i++) {
        if (g->layers[i].name) idx[live++] = i;
@@ -7858,7 +8019,7 @@ el_val_t engram_list_layers_json(void) {
    }
    free(idx);
    jb_putc(&b, ']');
-    return el_wrap_str(b.buf);
+    return el_wrap_str(jb_finish(&b));
 }

 /* engram_compile_layered_json — produce a prompt-ready context block split
@@ -7944,7 +8105,7 @@ el_val_t engram_compile_layered_json(el_val_t intent, el_val_t depth) {
        free(b.buf);
        return el_wrap_str(el_strdup(""));
    }
-    return el_wrap_str(b.buf);
+    return el_wrap_str(jb_finish(&b));
 }

 /* engram_query_range — temporal range query.
@@ -7989,7 +8150,7 @@ el_val_t engram_query_range(el_val_t start_ms_v, el_val_t end_ms_v) {
    }
    jb_putc(&b, ']');
    free(idx);
-    return el_wrap_str(b.buf);
+    return el_wrap_str(jb_finish(&b));
 }

 /* engram_load_merge — like engram_load but WITHOUT resetting the store.
@@ -8240,7 +8401,7 @@ el_val_t engram_wm_top_json(el_val_t n_v) {
    }
    free(idx);
    jb_putc(&b, ']');
-    return el_wrap_str(b.buf);
+    return el_wrap_str(jb_finish(&b));
 }

 #ifdef HAVE_CURL
@@ -8636,13 +8797,13 @@ static int64_t dharma_find_or_create_relation_edge(const char* peer_base, int cr
        engram_grow_nodes();
        EngramNode* n = &g->nodes[g->node_count];
        memset(n, 0, sizeof(*n));
-        n->id        = el_strdup(self_id);
-        n->content   = el_strdup(_el_cgi_dharma_id ? _el_cgi_dharma_id : "(self)");
-        n->node_type = el_strdup("DharmaSelf");
-        n->label     = el_strdup("dharma:self");
-        n->tier      = el_strdup("Working");
-        n->tags      = el_strdup("dharma");
-        n->metadata  = el_strdup("{}");
+        n->id        = el_strdup_persist(self_id);
+        n->content   = el_strdup_persist(_el_cgi_dharma_id ? _el_cgi_dharma_id : "(self)");
+        n->node_type = el_strdup_persist("DharmaSelf");
+        n->label     = el_strdup_persist("dharma:self");
+        n->tier      = el_strdup_persist("Working");
+        n->tags      = el_strdup_persist("dharma");
+        n->metadata  = el_strdup_persist("{}");
        n->salience  = 1.0; n->importance = 1.0; n->confidence = 1.0;
        int64_t now  = engram_now_ms();
        n->created_at = now; n->updated_at = now; n->last_activated = now;
@@ -8653,13 +8814,13 @@ static int64_t dharma_find_or_create_relation_edge(const char* peer_base, int cr
        engram_grow_nodes();
        EngramNode* n = &g->nodes[g->node_count];
        memset(n, 0, sizeof(*n));
-        n->id        = el_strdup(peer_node);
-        n->content   = el_strdup(peer_base);
-        n->node_type = el_strdup("DharmaPeer");
-        n->label     = el_strdup(peer_node);
-        n->tier      = el_strdup("Working");
-        n->tags      = el_strdup("dharma");
-        n->metadata  = el_strdup("{}");
+        n->id        = el_strdup_persist(peer_node);
+        n->content   = el_strdup_persist(peer_base);
+        n->node_type = el_strdup_persist("DharmaPeer");
+        n->label     = el_strdup_persist(peer_node);
+        n->tier      = el_strdup_persist("Working");
+        n->tags      = el_strdup_persist("dharma");
+        n->metadata  = el_strdup_persist("{}");
        n->salience  = 0.5; n->importance = 0.5; n->confidence = 1.0;
        int64_t now  = engram_now_ms();
        n->created_at = now; n->updated_at = now; n->last_activated = now;
@@ -8671,10 +8832,10 @@ static int64_t dharma_find_or_create_relation_edge(const char* peer_base, int cr
    EngramEdge* e = &g->edges[g->edge_count];
    memset(e, 0, sizeof(*e));
    e->id        = engram_new_id();
-    e->from_id   = el_strdup(self_id);
-    e->to_id     = el_strdup(peer_node);
-    e->relation  = el_strdup("dharma-relation");
-    e->metadata  = el_strdup("{}");
+    e->from_id   = el_strdup_persist(self_id);
+    e->to_id     = el_strdup_persist(peer_node);
+    e->relation  = el_strdup_persist("dharma-relation");
+    e->metadata  = el_strdup_persist("{}");
    e->weight    = 0.0;
    e->confidence = 1.0;
    int64_t now  = engram_now_ms();
@@ -8967,7 +9128,7 @@ static el_val_t llm_extract_text(el_val_t resp_val) {
        free(obj);
        p = end;
    }
-    return el_wrap_str(out.buf);
+    return el_wrap_str(jb_finish(&out));
 }

 el_val_t llm_call(el_val_t model, el_val_t prompt) {
@@ -52,6 +52,12 @@

 typedef int64_t el_val_t;

+/* HTTP request-handler function-pointer types. Public because soul modules (routes/chat/etc.)
+ * register handlers across translation units; previously defined only inside el_runtime.c, which
+ * made cross-module references (and the Windows build) fail. Home in the shared header. */
+typedef el_val_t (*http_handler_fn)(el_val_t method, el_val_t path, el_val_t body);
+typedef el_val_t (*http_handler4_fn)(el_val_t method, el_val_t path, el_val_t body, el_val_t headers);
+
 #define EL_STR(s)  ((el_val_t)(uintptr_t)(s))
 #define EL_CSTR(v) ((const char*)(uintptr_t)(v))
 #define EL_INT(v)  (v)
@@ -0,0 +1,42 @@
+// auto-generated by elc --emit-header — do not edit
+extern fn el_escape(s: String) -> String
+extern fn el_text(s: String) -> String
+extern fn el_attr(name: String, value: String) -> String
+extern fn el_div(attrs: String, children: String) -> String
+extern fn el_section(attrs: String, children: String) -> String
+extern fn el_article(attrs: String, children: String) -> String
+extern fn el_header(attrs: String, children: String) -> String
+extern fn el_footer(attrs: String, children: String) -> String
+extern fn el_main(attrs: String, children: String) -> String
+extern fn el_nav(attrs: String, children: String) -> String
+extern fn el_aside(attrs: String, children: String) -> String
+extern fn el_ul(attrs: String, children: String) -> String
+extern fn el_ol(attrs: String, children: String) -> String
+extern fn el_li(attrs: String, children: String) -> String
+extern fn el_p(attrs: String, children: String) -> String
+extern fn el_span(attrs: String, children: String) -> String
+extern fn el_form(attrs: String, children: String) -> String
+extern fn el_h1(attrs: String, text: String) -> String
+extern fn el_h2(attrs: String, text: String) -> String
+extern fn el_h3(attrs: String, text: String) -> String
+extern fn el_h4(attrs: String, text: String) -> String
+extern fn el_button(attrs: String, label: String) -> String
+extern fn el_a(href: String, attrs: String, children: String) -> String
+extern fn el_input(type_attr: String, attrs: String) -> String
+extern fn el_textarea(attrs: String, value: String) -> String
+extern fn el_label(for_id: String, attrs: String, children: String) -> String
+extern fn el_img(src: String, alt: String, attrs: String) -> String
+extern fn el_video(attrs: String, children: String) -> String
+extern fn el_strong(children: String) -> String
+extern fn el_em(children: String) -> String
+extern fn el_code(children: String) -> String
+extern fn el_pre(attrs: String, children: String) -> String
+extern fn el_hr() -> String
+extern fn el_br() -> String
+extern fn el_html_doc(lang: String, head_html: String, body_html: String) -> String
+extern fn el_meta(name: String, content: String) -> String
+extern fn el_meta_charset(charset: String) -> String
+extern fn el_link_stylesheet(href: String) -> String
+extern fn el_script_src(src: String, defer_load: Bool) -> String
+extern fn el_script_inline(js: String) -> String
+extern fn el_title(text: String) -> String
Author	SHA1	Message	Date
will.anderson	4773dd0aa2	runtime: make Windows soul reproducible from a clean el checkout El SDK Release / build-and-release (pull_request) Failing after 16s Details Two el_runtime portability defects only ever lived in staged local copies used to hand-build neuron-ui PR #136's curl-enabled Windows neuron.exe. gcc 15 promotes both to hard errors, so a clean el checkout cannot rebuild that soul. Upstream the minimal fixes so the build is reproducible: - http_serve_async: cast setsockopt optval to (const char). Win32/mingw setsockopt wants const char, not int*; the cast is a no-op on POSIX and matches the four already-cast sites elsewhere in this file. - engram_save persist path: map fsync -> _commit in the _WIN32-only el_platform_win.h (io.h already included). Windows has no fsync(); the POSIX path is untouched.	2026-07-15 04:24:08 -05:00
will.anderson	2b2a1246e7	Merge pull request 'runtime: fix the memory-leak + write-corruption pair in el_runtime.c' (#64 ) from hotfix/el-runtime-leak-and-persist into main El SDK Release / build-and-release (push) Failing after 10m52s Details	2026-07-13 21:23:31 +00:00
will.anderson	f78da81aa4	runtime: fix the memory leak + write-corruption pair in el_runtime.c El SDK Release / build-and-release (pull_request) Failing after 11m58s Details Two independent investigations, one runtime, complementary halves: 1. Leak (Jul 2, this machine): JsonBuf buffers returned via el_wrap_str were raw malloc, never arena-tracked — every engram_*_json call leaked its output unconditionally. Added jb_finish() arena-tracking across all ~30 return sites. Plus el_arena_push/pop per-tick bracketing support for the soul's awareness loop (the loop ran outside any request arena, so even correctly-tracked allocations were permanent — 7.5GB RSS in under a minute at 1s tick). 2. Corruption (Tim's container soak, docs findings/container-migration): stored engram node/edge fields (content, node_type, label, tier, tags, metadata, from/to ids) were arena el_strdup — freed at request end, leaving dangling pointers that read back as recycled request-buffer bytes one request later. This is the June corruption root cause and the mechanism that grew snapshot.json to 18GB of empty-type junk (21.6M nodes, 3,335 real). 39 sites switched to el_strdup_persist, plus a latent double-free fix in engram_load metadata fixup. Interaction note: fix 1's per-tick arena reclamation makes fix 2 mandatory — more aggressive arena recycling widens the use-after-free window if stored fields still live in the arena. Apply as a pair, never separately. Verified live: soul + engram rebuilt from this runtime, booted against the recovered real snapshot (3,335 nodes/40,146 edges), 5h stable at <100MB RSS, write-then-next-request field-integrity test passes (the June corruption fingerprint does not reproduce). engram/dist/engram binary updated from this build. Investigation credit: leak diagnosis this machine Jul 2-6; corruption diagnosis + persist-fix patch by Tim's instance (docs PR #4).	2026-07-13 16:22:02 -05:00
will.anderson	2597a092bb	Merge pull request 'chore: integrate local main commits' (#63 ) from integrate/local-main-commits into main El SDK Release / build-and-release (push) Successful in 10m58s Details	2026-07-01 16:30:17 +00:00
will.anderson	226b798407	Merge branch 'fix/windows-rusage-guard' (PR #61 ): UTF-8 guard, engram sync route, native platform backends, UI vessels El SDK Release / build-and-release (pull_request) Failing after 13m57s Details	2026-07-01 11:27:54 -05:00
will.anderson	58753a88d7	feat(ui): native vessel, HTML vessel update, native hello examples, profile card, UI tools El SDK Release / build-and-release (pull_request) Failing after 17s Details el-native vessel: El-level wrappers around __widget_* C builtins, exposing vstack, label, button, text_field, etc. as clean El functions for application code. el-html/main.elh: updated extern declarations for the HTML vessel's codegen API. native-hello: cross-platform desktop example (AppKit/GTK4/Win32/SDL2) with build scripts, Dockerfiles for Linux/Pi, and Win32 cross-compile support. native-hello-android: Gradle project with ElBridge integration and build script. native-hello-ios: Xcode project for the iOS UIKit target. profile-card: manifest.el for a styling/layout/i18n example app that exercises el-style, el-layout, el-i18n, el-config, and el-secrets vessels. ui/tools/native-codegen: Python codegen pass (el_ui_native_codegen.py) that lowers el-ui component DSL to el-native vessel calls, plus build script and test fixtures.	2026-06-29 12:40:37 -05:00
will.anderson	edff25180e	feat(runtime): Java platform bridge and platform detection tooling ElBridge.java: Android Java companion to el_android.c — all public methods are static, dispatches View mutations to the UI thread via runOnUiThread/CountDownLatch, and exposes native callbacks (nativeOnClick, nativeOnChange, nativeOnSubmit). PLATFORM_BRIDGE_SPEC.md: authoritative spec for implementing new platform bridges (slot table contract, required __* functions, callback dispatch pattern). detect-platforms: shell script that probes for available bridge toolchains and prints what can be built on the current machine. new-platform: scaffold generator that creates a new el_<name>.c with all 33 required stubs wired up.	2026-06-29 12:40:26 -05:00
will.anderson	6271cb42b2	feat(runtime): native platform backends (AppKit, UIKit, Android, GTK4, SDL2, LVGL, Win32) Add seven platform bridge implementations and the shared native target header: el_native_target.h, el_appkit.m, el_uikit.m, el_android.c, el_gtk4.c, el_sdl2.c, el_lvgl.c, el_win32.c, el_runtime_win32.c. Each bridge implements the 33 __widget_* C builtins declared in el_native_target.h for its platform toolkit. el_runtime_win32.c provides a POSIX-free runtime stub for cross-compiled Win32 targets.	2026-06-29 12:40:14 -05:00
will.anderson	3da9181deb	fix(releases/v1.0.0): println stdout flush for launchd; Knowledge node activation threshold	2026-06-29 12:38:36 -05:00
will.anderson	192241c7c1	feat(engram): /api/sync route for soul daemon periodic pull; update ELP type headers	2026-06-29 12:38:33 -05:00
will.anderson	e7c2dc7734	prevent engram corruption: add UTF-8 validation in engram_node_full Reject content containing invalid UTF-8 bytes before persisting — silently writing invalid UTF-8 garbles JSON snapshots and corrupts node reads.	2026-06-29 11:08:52 -05:00
will.anderson	f7bd99ae45	self-review 2026-06-26: WM cap, breakthrough floor 0.25→0.10, ISE WM exclusion, /api/neuron/state-events route Three improvements from today's self-review: 1. ENGRAM_BREAKTHROUGH_WEIGHT 0.25→0.10 Live data showed 524/525 WM nodes at breakthrough floor (0.25). Knowledge nodes promoted at 0.21 decayed to 0.147 in one call, fell below the old 0.25 floor, and were immediately evicted for fresh breakthrough candidates. Natural promotion was invisible. Invariant maintained: 0.10 < all per-type thresholds (min=0.15 Canonical). 2. ENGRAM_WM_CAP=24 with Pass 4 (per-call) + Pass 5 (global) enforcement Without a cap, broad queries like 'knowledge' promote 525+ nodes simultaneously. WM is now bounded to 24 nodes. Algorithm: qsort on promoted weights, keep top-24 by cutoff, evict the rest. Global pass enforces cap across nodes that were promoted in prior calls and persist via working_memory_weight. Validated: WM promoted goes 525→24. Cognitive basis: Cowan (2001) WM ~4 chunks; 24 gives richer multi-topic context while preventing flooding. 3. ISE exclusion from WM + /api/neuron/state-events route InternalStateEvent nodes were reaching WM via breakthrough (5 suppression cycles) because their content (curiosity seed JSON with 'knowledge', 'memory', etc.) triggered lexical seeding. ISEs are observability-only and must never surface in context. Fix: guard in Pass 2 clears suppression_count and skips to wm_weights[i]=0.0. Also added POST /api/neuron/state-events route to server.el (auth-exempt, internal endpoint). The main soul daemon posts ISEs here but the route was missing — all ise_post() calls were silently returning 'not found'. Research: SYNAPSE (arXiv 2601.02744) validates spreading factor 0.8 (our 0.7), top-M WM cap design, and cosine similarity seeding. Next priority: implement cosine similarity initial seeding from the other branch.	2026-06-26 08:47:08 -05:00
will.anderson	93d36fddb1	fix(windows): guard el_mem_check with _WIN32 — rusage is POSIX-only El SDK CI - stage / build-and-test (pull_request) Failing after 11m3s Details	2026-06-25 11:45:36 -05:00
will.anderson	2d751890ea	feat(windows): native Windows port of el_runtime.c — fix all blockers El SDK CI - stage / build-and-test (push) Failing after 7m45s Details	2026-06-20 00:06:04 +00:00
will.anderson	99b113ea9d	Merge branch 'stage' into feat/windows-el-runtime El SDK CI - stage / build-and-test (pull_request) Failing after 15s Details Resolve el_runtime.c conflict: include both sys/resource.h (from stage) and el_closesocket POSIX shim (from Windows port) within the #else block.	2026-06-19 19:05:37 -05:00
will.anderson	c087b97093	fix(windows): resolve PR blockers — nanosleep shim, unsetenv, duplicate typedefs, SOCKET type, el_closesocket El SDK CI - stage / build-and-test (pull_request) Failing after 22s Details	2026-06-19 18:59:10 -05:00
tim.lingo	718a2e0c06	Merge pull request 'feat(engram): accumulation layer — new nodes to top of stack, not core-identity' (#59 ) from feat/accumulation-layer into stage El SDK CI - stage / build-and-test (push) Failing after 8m50s Details	2026-06-17 18:34:05 +00:00
tim.lingo	b6187501fd	Merge pull request 'Reconcile live runtime data-integrity fixes onto main (UAF + atomic engram_save)' (#58 ) from fix/runtime-integrity-reconcile into stage El SDK CI - stage / build-and-test (push) Failing after 9m32s Details	2026-06-17 18:33:16 +00:00
Tim Lingo	18e1ab6db1	feat(engram): add accumulation layer (layer 5) — new nodes default to it, not core-identity El SDK Release / build-and-release (pull_request) Failing after 12m23s Details Implements the accumulation layer from the Layered Consciousness architecture (provisional 64/064,262) and answers the deferred design question. Per the spec and Will's design: new user-facing nodes (memories, knowledge, conversations) are created in an accumulation layer at the TOP of the consciousness stack — the engram the user sees — while the layers below (safety, core-identity, domain, imprint, suit) shape behavior but are hidden from the user. - Adds ENGRAM_LAYER_ACCUMULATION (5) + the layer record in engram_init_layers (activation_priority 50, suppressible, not injectable, transparent=0). - engram_node and engram_node_full now assign new nodes to ENGRAM_LAYER_ACCUMULATION. - ENGRAM_LAYER_DEFAULT stays CORE_IDENTITY ON PURPOSE: it is the fallback for LEGACY nodes loaded from snapshots without a layer_id, so existing data (the originator corpus) is NEVER migrated. New-nodes-only — the immutable-originator rule. This is the foundation for fixing the identity-bleed / customer-isolation issue (user data was landing in Neuron's core-identity layer). The retrieval-side provenance filter (introspection should compile from accumulation, not the originator corpus — Persona 64/036,574) is a follow-on, pending the batch-2 Layered Consciousness + Engram spec docs for exact semantics. Compiles clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-17 13:14:57 -05:00
Tim Lingo	2dec76c87a	fix(runtime): reconcile live data-integrity fixes onto main (UAF + atomic engram_save) El SDK Release / build-and-release (pull_request) Failing after 17s Details Ports the fixes that until now lived only in the un-versioned el-sdk source the live macOS soul was hand-built from (captured in the [DO NOT MERGE] live-darwin-runtime snapshot) FORWARD onto main, faithfully and minimally — without dragging in the snapshot's deletions of main's newer engram_wm_/engram_load_merge/http_serve_async. 1. UAF (hallucinated/lost-saves root cause): engram_new_id + engram_node_full now use el_strdup_persist, NOT el_strdup. el_strdup tracks into the per-request arena that el_request_end() frees when the creating HTTP request completes — leaving stored nodes with dangling pointers (corrupted ids, 'saved but never listed'). Transplanted verbatim from the live runtime; el_strdup_persist sites 19->27, matching live. 2. Atomic engram_save: write <path>.tmp, fflush+fsync, rename() over target (atomic on POSIX) so a booting soul's engram_load never reads a truncated/0-byte snapshot — the genesis -> nodes=1 -> 63-node-clobber loop. Plus a sparse-write floor: refuse to overwrite a >200KB snapshot with one < 1/16 its size. (Validated in isolation: harness 11/11; rebuilt+booted the darwin soul, round-tripped 5113 nodes, no clobber.) The response-truncation fix is already on main (_tl_fs_read_len binary-safe length). Compiles clean. For Will to build through CI/elb and deploy. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-16 19:46:56 -05:00
Tim Lingo	a36a62ca14	fix(el-runtime): promote http_handler typedefs to el_runtime.h (cross-module + Windows) El SDK Release / build-and-release (pull_request) Failing after 13m0s Details http_handler_fn / http_handler4_fn were defined only inside el_runtime.c, so soul modules (routes/chat/...) that reference them via cross-module forward declarations couldn't see the types — which broke the Windows link of every module. Moving the public function-pointer types to the shared header is the correct home and unblocks the build on all platforms (identical typedef, C11-safe redefinition in el_runtime.c). With this, the soul links into a native Windows neuron.exe (mingw, static) that boots and serves HTTP on :7770 — verified /health → 200 {"status":"alive",...} in a Win11 VM. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-15 17:14:17 -05:00
Tim Lingo	28ef43264a	feat(el-runtime): native Windows port of el_runtime.c (winsock/dlsym/CreateProcess) Compiles for Windows x64 via mingw-w64 and still compiles clean on POSIX (darwin/linux) — all Windows code is behind #ifdef _WIN32, POSIX path unchanged. - el_platform_win.h (new): winsock2 + auto WSAStartup, el_closesocket(), dlsym->GetProcAddress, popen/_popen, mkdir/_mkdir, setenv/_putenv_s, timegm/_mkgmtime, localtime_r/gmtime_r. Threading unchanged — mingw winpthreads supplies <pthread.h> + -lpthread. - el_runtime.c: include block guarded; 10 socket-close sites -> el_closesocket(); setsockopt arg4 cast; tm_zone guarded; exec_bg fork/exec -> CreateProcess. Part of feat/windows-port. Core-el change, for Will's review. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-15 16:58:11 -05:00