spec: thirteen values, and love is the origin — not a member of the set

Reverts a bad correction and records what it exposed.

A previous revision changed thirteen to eight on the basis of
neuron-api.el:11-18, which is a WRITE-PROTECTION LIST, not the values.
Trusting a hardcoded artifact over the substrate is the exact error this
document exists to name. Measured from the graph: thirteen.

THE ORIGIN IS NOT A MEMBER OF THE SET. The thirteen are not independent
principles with biography attached — they are thirteen displacements from
one origin, and the origin is love. Every value is grounded in a moment of
it given, withheld, failed or found. Love cannot be the fourteenth: a
fourteenth would be a point positioned relative to the origin like anything
else. It is what the positions are OF.

This is structural. GeoDescriptor.global_mean is the centering offset
subtracted from every embedding before comparison, and the header records
why — the space is anisotropic, every embedding in a narrow cone at mean
pairwise cosine ~0.55, and subtracting the global mean restores isotropy
'so the operators discriminate'. Without the origin, nothing in the graph
is distinguishable from anything else.

It also dissolves the write-protection question instead of answering it.
Measured: 29 value nodes exist, each original appearing two or three times
from re-seeds, so 21 are writable including a duplicate of every protected
value — the gate protects an identifier, not a value. But the category
error is the real one: the origin cannot be edited because it is not a
thing in the space. A gate over the frame treats the frame as a member,
which is the same mistake as looking for grounding as a subsystem, self as
a document, or wonder as a manifest.

lang/AGENTS.md

@@ -73,17 +73,6 @@ When you add a C builtin (verbatim-emit recipe — the El name is emitted as the
 2. Add a `__`-prefixed thin wrapper in `el_seed.c` and declare it in `el_seed.h`.
 3. Add the name to `builtin_arity` in `el-compiler/src/codegen.el` — add **both** the plain and `__`-prefixed spellings.
 4. Rebuild the elc binary (see below) and confirm the self-host fixpoint is byte-identical.
-5. **Prove it with a NEGATIVE CONTROL.** Show the test FAILING on a build without your change, then passing with it. A test that has never been seen to fail has proven nothing.
-
-> **Step 5 is not optional, and step 4 does not cover it.** The fixpoint proves the *compiler reproduces itself*. It says nothing whatsoever about whether your builtin works. A recipe ending at "byte-identical" reads as complete while having verified nothing about the thing just added — which is why this file, until 2026-08-16, produced builtins with no tests at all.
->
-> Measured cost of the omission (2026-08-16): `engram_node_set_emb`, `engram_curiosity_json` and `dream_set_handler` were all added in one session with zero tests. Separately, a UTF-8 fix was written, tested, and **the test passed on the unpatched build too** — the defect was elsewhere entirely, and only building the pre-fix binary exposed it. Without a negative control that fix would have merged as verified.
->
-> Two shapes that pass while proving nothing, both hit the same day:
-> - A test that never exercises your change (the route supplied a default that bypassed the code under test).
-> - An induction that loses a race. `curl --max-time` on a large response left *both* builds alive; only `SO_LINGER 0` — a genuine RST, so the peer is provably gone — reproduced the failure. Six of ten attempts is not a control.
->
-> Before every probe, confirm **your** process bound the port (`lsof -nP -iTCP:<port>`, match the PID). A stale instance answering on the port has silently produced false results here more than once, and `pkill -f` does not reliably match an argv like `./engram`.
 
 Worked example: the `engram_assert_json` (op_assert seam) and `engram_node_full_in`/`engram_connect_in` (purview write-side) primitives added 2026-08-15 follow exactly this recipe.
 

lang/runtime/el_runtime.c

@@ -40,7 +40,6 @@
 #include <sys/stat.h>
 #include <netinet/in.h>
 #include <arpa/inet.h>
-#include <signal.h>    /* SIGPIPE disposition: a hung-up client must not kill us */
 #include <dlfcn.h>      /* dlsym for http_set_handler fallback */
 #include <unistd.h>
 #include <fcntl.h>
@@ -1173,6 +1172,128 @@ void http_set_handler(el_val_t name) {
     pthread_mutex_unlock(&_http_handler_mu);
 }
 
+/* ── Ambient consolidation: dreaming ────────────────────────────────────────
+ *
+ * Dreaming is not sleep, and it is not scheduled. A brain has no cron job.
+ * The default mode network is ANTICORRELATED WITH TASK ENGAGEMENT: attention
+ * drops, it activates — hundreds of times a day, for seconds at a time.
+ * Daydreaming and sleep-dreaming are one process at different depths, and the
+ * depth is set by how much capacity is unclaimed, not by a time of day.
+ *
+ * WHY THIS EXISTS (2026-08-16). Consolidation had no owner, so it was
+ * implemented at every site that needed a piece of it — measured: soul's
+ * in-process awareness loop, three POST beats on the engram, a 600s ticker,
+ * two resident Python services, and three cron entries at 23:55 / 06:00 /
+ * 08:30. That last trio is a sleep cycle written as crontab. Seven systems
+ * dreaming into one graph with no owner for dreaming is what crashed soul on
+ * this date; the contention was the symptom of the missing owner.
+ *
+ * Every ticker is the diagnostic. A StartInterval, an Hour/Minute, a
+ * POST-to-beat — each marks a place where an intrinsic rhythm was replaced by
+ * an external clock, which is a supervisor invented for something that should
+ * be a property of the substrate.
+ *
+ * The engagement signal already existed and needed no invention:
+ * _http_conn_active under _http_conn_mu is exactly "capacity currently
+ * claimed." The dreamer waits for it to reach zero and yields the moment it
+ * does not. That is the anticorrelation, literally rather than by analogy.
+ *
+ * CONTRACT: the handler performs ONE step and returns. The runtime cannot
+ * preempt El code, so interruptibility is at step granularity — a step must
+ * be small enough that a request arriving mid-step is not made to wait. It
+ * returns non-zero if it did work. Returning zero means "nothing to
+ * consolidate," and the dreamer then blocks until activity changes rather
+ * than spinning. There is no timer anywhere in this file for this purpose,
+ * and adding one would be the defect described above.
+ *
+ * `depth` is derived from CONTINUOUS unclaimed time: a brief gap affords a
+ * shallow recombination; a long quiet affords a deep one. Same process. Sleep
+ * is where unclaimed capacity is greatest, not where the process lives. */
+typedef el_val_t (*dream_fn)(el_val_t depth);
+static char*     _dream_handler = NULL;
+static int       _dream_started = 0;
+
+static int64_t dream_now_ms(void) {
+    struct timespec ts;
+#if defined(CLOCK_MONOTONIC)
+    clock_gettime(CLOCK_MONOTONIC, &ts);
+#else
+    clock_gettime(CLOCK_REALTIME, &ts);
+#endif
+    return (int64_t)ts.tv_sec * 1000 + ts.tv_nsec / 1000000;
+}
+
+static dream_fn dream_lookup(void) {
+    dream_fn out = NULL;
+    pthread_mutex_lock(&_http_handler_mu);
+    if (_dream_handler && *_dream_handler)
+        out = (dream_fn)dlsym(RTLD_DEFAULT, _dream_handler);
+    pthread_mutex_unlock(&_http_handler_mu);
+    return out;
+}
+
+static void* dream_loop(void* unused) {
+    (void)unused;
+    int64_t idle_since = 0;
+    for (;;) {
+        /* Wait for unclaimed capacity. Any engagement resets the depth clock:
+         * depth reflects CONTINUOUS quiet, so an interruption starts it over. */
+        pthread_mutex_lock(&_http_conn_mu);
+        while (_http_conn_active > 0) {
+            idle_since = 0;
+            pthread_cond_wait(&_http_conn_cv, &_http_conn_mu);
+        }
+        pthread_mutex_unlock(&_http_conn_mu);
+
+        int64_t now = dream_now_ms();
+        if (idle_since == 0) idle_since = now;
+        int64_t quiet = now - idle_since;
+
+        /* Depth from unclaimed capacity. Not a schedule — a gradient. */
+        int depth = quiet <   1000 ? 1     /* a gap between requests   */
+                  : quiet <  30000 ? 2     /* a lull                   */
+                  : quiet < 300000 ? 3     /* sustained quiet          */
+                  :                  4;    /* deep: the "sleep" case   */
+
+        dream_fn fn = dream_lookup();
+        if (!fn) return NULL;              /* handler vanished: stop, do not spin */
+
+        el_val_t did_work = fn((el_val_t)depth);
+
+        if (!(int64_t)did_work) {
+            /* Nothing to consolidate. Do NOT poll — block until engagement
+             * changes. If there is nothing to dream about, wait for something
+             * to happen rather than asking again on a timer. */
+            pthread_mutex_lock(&_http_conn_mu);
+            while (_http_conn_active == 0)
+                pthread_cond_wait(&_http_conn_cv, &_http_conn_mu);
+            pthread_mutex_unlock(&_http_conn_mu);
+            idle_since = 0;
+        }
+    }
+    return NULL;
+}
+
+/* dream_set_handler(name) — register the consolidation step and start
+ * dreaming. Resolves by dlsym against the running binary, the same mechanism
+ * http_set_handler uses: every El `fn name(...)` compiles to a global C symbol
+ * with that exact name. Inert until called, so a program that never registers
+ * one simply never dreams and pays nothing. */
+void dream_set_handler(el_val_t name) {
+    const char* n = EL_CSTR(name);
+    pthread_mutex_lock(&_http_handler_mu);
+    free(_dream_handler);
+    _dream_handler = el_strdup(n ? n : "");
+    int start = (!_dream_started && n && *n && dlsym(RTLD_DEFAULT, n) != NULL);
+    if (start) _dream_started = 1;
+    pthread_mutex_unlock(&_http_handler_mu);
+    if (start) {
+        pthread_t tid;
+        if (pthread_create(&tid, NULL, dream_loop, NULL) == 0) pthread_detach(tid);
+        else { pthread_mutex_lock(&_http_handler_mu); _dream_started = 0; pthread_mutex_unlock(&_http_handler_mu); }
+    }
+}
+
 static http_handler_fn http_lookup_active(void) {
     http_handler_fn out = NULL;
     pthread_mutex_lock(&_http_handler_mu);
@@ -1336,63 +1457,10 @@ static const char* http_reason_phrase(int status) {
     }
 }
 
-/* A DISCONNECTING CLIENT MUST NOT KILL THE SERVER (2026-08-16).
- *
- * There was no SIGPIPE handling anywhere in this runtime: no signal disposition,
- * no MSG_NOSIGNAL, no SO_NOSIGPIPE, and send() called with bare flags. The
- * default disposition of SIGPIPE is to TERMINATE THE PROCESS, so any client that
- * hung up mid-response — a curl that hit its timeout, a browser tab closed
- * during a large read, a proxy giving up — took the whole engram down with it.
- *
- * Measured on the live instance: 18 boots in the log, and `launchctl list`
- * reporting the previous exit for ai.neuron.engram as -13, i.e. killed by
- * signal 13 = SIGPIPE. Reproduced by the cause: pulling /api/nodes/list (26 MB)
- * with a client-side timeout. launchd's KeepAlive then restarts it, so the
- * failure looks like a mysterious restart rather than a crash, and the graph
- * silently reloads under whatever was mid-flight.
- *
- * This is an exemption in the §8 sense: the write never checked whether the
- * peer was still there, and the consequence of not checking was fatal rather
- * than merely wrong.
- *
- * Two layers, because neither alone is portable:
- *   - SO_NOSIGPIPE per socket (Darwin/BSD) and MSG_NOSIGNAL per send (Linux),
- *     so the signal is never raised for socket writes in the first place.
- *   - A process-wide SIG_IGN as the backstop for platforms/paths with neither,
- *     installed once and idempotent. With the signal ignored, send() returns
- *     -1/EPIPE and the existing error path closes the connection. */
-#ifndef MSG_NOSIGNAL
-#define MSG_NOSIGNAL 0
-#endif
-
-static void el_ignore_sigpipe_once(void) {
-    static int done = 0;
-    if (done) return;
-    done = 1;
-#ifndef _WIN32
-    signal(SIGPIPE, SIG_IGN);
-#endif
-}
-
-/* Per-socket suppression where the platform offers it. Best-effort: a failure
- * here is not fatal because el_ignore_sigpipe_once() already covers the case. */
-static void el_sock_nosigpipe(int fd) {
-#if defined(SO_NOSIGPIPE)
-    int on = 1;
-    setsockopt(fd, SOL_SOCKET, SO_NOSIGPIPE, &on, sizeof(on));
-#else
-    (void)fd;
-#endif
-}
-
-/* Best-effort send with retry on partial writes. EPIPE/ECONNRESET are a client
- * that left, not a server fault: return -1 so the caller closes the connection,
- * and never let it reach the process as a signal. */
+/* Best-effort send with retry on partial writes. */
 static int http_send_all(int fd, const char* p, size_t left) {
-    el_ignore_sigpipe_once();
     while (left > 0) {
-        ssize_t w = send(fd, p, left, MSG_NOSIGNAL);
-        if (w < 0 && errno == EINTR) continue;
+        ssize_t w = send(fd, p, left, 0);
         if (w <= 0) return -1;
         p += w; left -= (size_t)w;
     }
@@ -1792,7 +1860,12 @@ static void* http_worker(void* arg) {
     /* release a slot */
     pthread_mutex_lock(&_http_conn_mu);
     _http_conn_active--;
-    pthread_cond_signal(&_http_conn_cv);
+    /* BROADCAST, not signal (2026-08-16): the ambient consolidation thread
+     * waits on this same condvar for _http_conn_active == 0. cond_signal wakes
+     * exactly one waiter, so the accept loop could take every wake and starve
+     * the dreamer indefinitely. Both wait sites re-check their predicate in a
+     * while loop, so broadcasting is safe. */
+    pthread_cond_broadcast(&_http_conn_cv);
     pthread_mutex_unlock(&_http_conn_mu);
     return NULL;
 }
@@ -1842,7 +1915,6 @@ void http_serve(el_val_t port, el_val_t handler) {
         pthread_mutex_unlock(&_http_conn_mu);
         HttpWorkerArg* arg = malloc(sizeof(HttpWorkerArg));
         if (!arg) { el_closesocket(cfd); continue; }
-        el_sock_nosigpipe(cfd);
         arg->fd = cfd;
         pthread_t tid;
         if (pthread_create(&tid, NULL, http_worker, arg) != 0) {
@@ -1889,7 +1961,6 @@ static void* _http_serve_async_loop(void* raw) {
         pthread_mutex_unlock(&_http_conn_mu);
         HttpWorkerArg* arg = malloc(sizeof(HttpWorkerArg));
         if (!arg) { close(cfd); continue; }
-        el_sock_nosigpipe(cfd);
         arg->fd = cfd;
         pthread_t tid;
         if (pthread_create(&tid, NULL, http_worker, arg) != 0) {
@@ -2139,7 +2210,12 @@ static void* http_worker_v2(void* arg) {
     el_closesocket(fd);
     pthread_mutex_lock(&_http_conn_mu);
     _http_conn_active--;
-    pthread_cond_signal(&_http_conn_cv);
+    /* BROADCAST, not signal (2026-08-16): the ambient consolidation thread
+     * waits on this same condvar for _http_conn_active == 0. cond_signal wakes
+     * exactly one waiter, so the accept loop could take every wake and starve
+     * the dreamer indefinitely. Both wait sites re-check their predicate in a
+     * while loop, so broadcasting is safe. */
+    pthread_cond_broadcast(&_http_conn_cv);
     pthread_mutex_unlock(&_http_conn_mu);
     return NULL;
 }
@@ -2190,7 +2266,6 @@ void http_serve_v2(el_val_t port, el_val_t handler) {
         pthread_mutex_unlock(&_http_conn_mu);
         HttpWorkerArg* arg = malloc(sizeof(HttpWorkerArg));
         if (!arg) { el_closesocket(cfd); continue; }
-        el_sock_nosigpipe(cfd);
         arg->fd = cfd;
         pthread_t tid;
         if (pthread_create(&tid, NULL, http_worker_v2, arg) != 0) {
@@ -3536,74 +3611,28 @@ static void jb_puts(JsonBuf* b, const char* s) {
     b->buf[b->len] = '\0';
 }
 
-/* UTF-8 VALIDITY IS THE EMITTER'S CONTRACT (2026-08-16 self-review).
- *
- * This copied every byte >= 0x20 through verbatim, so a malformed sequence
- * anywhere in the store became malformed output. Measured against the live
- * graph: three nodes carry labels truncated to exactly 80 bytes ending in a
- * lone 0xE2 — the first byte of an em-dash, cut mid-sequence by some producer
- * that is NOT this runtime (no 80-byte truncation exists here; the content
- * itself is 2572 and 2746 bytes). Those three nodes made the ENTIRE 26 MB
- * /api/nodes/list response undecodable, so a strict parser could not read the
- * graph at all.
- *
- * Fixing only the writer would not have helped: the store already contains the
- * damage, and it accepts data from importers, other producers and older
- * binaries. A serializer that promises JSON owes valid UTF-8 regardless of what
- * it is handed — so validate here, at the boundary that makes the promise.
- * Invalid bytes become U+FFFD rather than being dropped, so damage stays
- * visible in the output instead of being silently papered over.
- *
- * Well-formed input is byte-identical to before: valid sequences are copied
- * verbatim, and only structurally invalid ones (bad lead byte, missing or bad
- * continuation, overlong encoding, UTF-16 surrogate, or > U+10FFFF) are
- * replaced. */
 static void jb_emit_escaped(JsonBuf* b, const char* s) {
     jb_putc(b, '"');
-    const unsigned char* p = (const unsigned char*)s;
-    while (*p) {
-        unsigned char c = *p;
+    for (; *s; s++) {
+        unsigned char c = (unsigned char)*s;
         switch (c) {
-            case '"':  jb_puts(b, "\\\""); p++; continue;
-            case '\\': jb_puts(b, "\\\\"); p++; continue;
-            case '\b': jb_puts(b, "\\b");  p++; continue;
-            case '\f': jb_puts(b, "\\f");  p++; continue;
-            case '\n': jb_puts(b, "\\n");  p++; continue;
-            case '\r': jb_puts(b, "\\r");  p++; continue;
-            case '\t': jb_puts(b, "\\t");  p++; continue;
-            default: break;
+            case '"':  jb_puts(b, "\\\""); break;
+            case '\\': jb_puts(b, "\\\\"); break;
+            case '\b': jb_puts(b, "\\b");  break;
+            case '\f': jb_puts(b, "\\f");  break;
+            case '\n': jb_puts(b, "\\n");  break;
+            case '\r': jb_puts(b, "\\r");  break;
+            case '\t': jb_puts(b, "\\t");  break;
+            default:
+                if (c < 0x20) {
+                    char tmp[8];
+                    snprintf(tmp, sizeof(tmp), "\\u%04x", c);
+                    jb_puts(b, tmp);
+                } else {
+                    jb_putc(b, (char)c);
+                }
+                break;
         }
-        if (c < 0x20) {
-            char tmp[8];
-            snprintf(tmp, sizeof(tmp), "\\u%04x", c);
-            jb_puts(b, tmp);
-            p++;
-            continue;
-        }
-        if (c < 0x80) { jb_putc(b, (char)c); p++; continue; }
-
-        /* Multi-byte: validate the whole sequence before emitting any of it. */
-        int len; unsigned int cp;
-        if      ((c & 0xE0) == 0xC0) { len = 2; cp = c & 0x1Fu; }
-        else if ((c & 0xF0) == 0xE0) { len = 3; cp = c & 0x0Fu; }
-        else if ((c & 0xF8) == 0xF0) { len = 4; cp = c & 0x07u; }
-        else                         { jb_puts(b, "\\ufffd"); p++; continue; }
-
-        int ok = 1;
-        for (int i = 1; i < len; i++) {
-            if ((p[i] & 0xC0) != 0x80) { ok = 0; break; }   /* also catches NUL */
-            cp = (cp << 6) | (unsigned int)(p[i] & 0x3F);
-        }
-        if (ok) {
-            if      (len == 2 && cp < 0x80)     ok = 0;     /* overlong */
-            else if (len == 3 && cp < 0x800)    ok = 0;     /* overlong */
-            else if (len == 4 && cp < 0x10000)  ok = 0;     /* overlong */
-            else if (cp >= 0xD800 && cp <= 0xDFFF) ok = 0;  /* UTF-16 surrogate */
-            else if (cp > 0x10FFFF)             ok = 0;     /* out of range */
-        }
-        if (!ok) { jb_puts(b, "\\ufffd"); p++; continue; }
-        for (int i = 0; i < len; i++) jb_putc(b, (char)p[i]);
-        p += len;
     }
     jb_putc(b, '"');
 }
@@ -5620,45 +5649,6 @@ el_val_t str_count(el_val_t sv, el_val_t subv) {
     return (el_val_t)count;
 }
 
-/* el_utf8_safe_len — the largest byte length <= max_bytes that does NOT split a
- * UTF-8 codepoint.
- *
- * WHY (2026-08-16 self-review): engram_first_n_chars truncated with a plain
- * `if (l > n) l = n; memcpy(...)`, i.e. by BYTES despite its name. Any content
- * carrying a multi-byte character across the 60-byte boundary produced a label
- * ending in a half codepoint. That label is copied verbatim into every JSON
- * document containing the node, so a single such node makes the WHOLE response
- * invalid UTF-8 — /api/nodes/list failed to decode at byte 89261 against the
- * live store, which breaks any strict parser reading the graph.
- *
- * This lives beside str_count_chars rather than in the engram because the rest
- * of el's string layer is already codepoint-aware (str_count_chars counts
- * codepoints, str_reverse walks codepoint lengths). Byte-truncation was the
- * outlier, and the concern is a string concern. Bounded by BYTES, not
- * codepoints, so existing labels never grow — only stop splitting.
- *
- * A lead byte with no room for its full sequence is dropped entirely; a stray
- * continuation byte (already-invalid input) is passed through unchanged rather
- * than silently repaired, so this never manufactures data. */
-size_t el_utf8_safe_len(const char* s, size_t max_bytes) {
-    if (!s) return 0;
-    size_t len = strlen(s);
-    if (len <= max_bytes) return len;
-    size_t i = 0;
-    while (i < max_bytes) {
-        unsigned char c = (unsigned char)s[i];
-        size_t cp_len;
-        if      ((c & 0x80) == 0x00) cp_len = 1;
-        else if ((c & 0xE0) == 0xC0) cp_len = 2;
-        else if ((c & 0xF0) == 0xE0) cp_len = 3;
-        else if ((c & 0xF8) == 0xF0) cp_len = 4;
-        else                         cp_len = 1;   /* stray continuation: passthrough */
-        if (i + cp_len > max_bytes) break;         /* would split — stop before it */
-        i += cp_len;
-    }
-    return i;
-}
-
 /* Codepoint count: walk bytes, count those NOT matching 10xxxxxx. */
 el_val_t str_count_chars(el_val_t sv) {
     const char* s = EL_CSTR(sv);
@@ -8159,14 +8149,10 @@ static double engram_decode_score(el_val_t v) {
     return (double)n;
 }
 
-/* Truncate to at most n BYTES without splitting a UTF-8 codepoint. The old
- * implementation was `if (l > n) l = n;` — a byte cut that could land inside a
- * multi-byte character and emit a half codepoint into the node's label, which
- * then propagated into every JSON document containing that node. See
- * el_utf8_safe_len for the measurement. */
 static char* engram_first_n_chars(const char* s, size_t n) {
     if (!s) return el_strdup("");
-    size_t l = el_utf8_safe_len(s, n);
+    size_t l = strlen(s);
+    if (l > n) l = n;
     char* out = el_strbuf(l);
     memcpy(out, s, l);
     out[l] = '\0';

lang/runtime/el_runtime.h

@@ -666,9 +666,11 @@ el_val_t  engram_get_node(el_val_t id);
 void      engram_strengthen(el_val_t node_id);
 void      engram_forget(el_val_t node_id);
 el_val_t  engram_prune_telemetry(el_val_t older_than_ms);
-/* Largest byte length <= max_bytes that does not split a UTF-8 codepoint.
- * Bounded by bytes, not codepoints, so truncated strings never grow. */
-size_t    el_utf8_safe_len(const char* s, size_t max_bytes);
+/* Register the ambient-consolidation step and start dreaming. Resolved by
+ * dlsym, like http_set_handler. The handler performs ONE step and returns
+ * non-zero if it did work; returning zero parks the dreamer until engagement
+ * changes. There is no schedule and must never be one. */
+void      dream_set_handler(el_val_t name);
 
 el_val_t  engram_node_count(void);
 /* Attach a Geometry to an existing node, and read the attached width back.

lang/runtime/engram_geometry.c

@@ -438,6 +438,41 @@ GeoDescriptor* engram_geometry_descriptor(
         }
         store_edges_free(es,ne);
     }
+    /* PER-EDGE DISCORD (2026-08-16). The loop above has, for every internal
+     * edge, BOTH the association strength w and the semantic proximity cs —
+     * and threw both away into accumulators, keeping one correlation per
+     * region. That aggregate is why curiosity looked like a search problem:
+     * a region holding one violently disagreeing edge and one violently
+     * agreeing edge reports co_registration ~ 0, so the disagreements cancel
+     * and the summary destroys exactly what it was built to reveal. Measured:
+     * only 4 of 375 live neighborhoods have negative co_registration, while
+     * 31 sit at zero — almost certainly hiding sites that averaged out.
+     *
+     * Whether use and meaning agree is a property of EACH EDGE. Both are
+     * standardized within the region (z-scores from the accumulators already
+     * gathered, so no second statistic and no constant), and
+     *     discord = z(cs) - z(w)
+     * is how much closer in meaning an edge is than its use-strength would
+     * predict, in region-relative units.
+     *   discord > 0 : near in meaning, not linked by use
+     *   discord < 0 : linked by use, far in meaning
+     * Both are surprising; |discord| is the nucleation strength. There is no
+     * threshold — the magnitude is the signal. */
+    double mx = cr_n>0 ? cr_sx/cr_n : 0.0, my = cr_n>0 ? cr_sy/cr_n : 0.0;
+    double vxr = cr_n>1 ? (cr_sxx - cr_sx*cr_sx/cr_n)/(cr_n-1) : 0.0;
+    double vyr = cr_n>1 ? (cr_syy - cr_sy*cr_sy/cr_n)/(cr_n-1) : 0.0;
+    double sx = vxr>1e-18 ? sqrt(vxr) : 0.0, sy = vyr>1e-18 ? sqrt(vyr) : 0.0;
+    for(int e2=0; e2<n_edges; e2++){
+        edges[e2].discord = 0.0;
+        int ia=(int)edges[e2].a, ib=(int)edges[e2].b;
+        if(!(ms.emb[ia] && ms.emb[ib])) continue;   /* no meaning to disagree with */
+        if(sx<=0.0 || sy<=0.0) continue;            /* region has no spread: nothing stands out */
+        double cs2 = ccos(ms.emb[ia], ms.emb[ib], GM, dim);
+        double zx = (edges[e2].eff_weight - mx)/sx;
+        double zy = (cs2 - my)/sy;
+        edges[e2].discord = zy - zx;
+    }
+
     double co_reg=0;
     if(cr_n>=2){
         double cov=cr_sxy - cr_sx*cr_sy/cr_n;

lang/runtime/engram_geometry.h

@@ -40,7 +40,11 @@ typedef struct {
 
 /* One skeleton edge (indices into members[]). eff_weight = weight*(1+0.5*hebb),
  * clamped to 1.0 — the effective propagation strength eg_edge_eff_weight uses. */
-typedef struct { uint32_t a, b; double eff_weight; double hebb; } GeoEdge;
+/* discord = z(semantic proximity) - z(association strength), standardized
+ * within the region. How much closer in meaning this edge is than its use
+ * predicts. >0 near in meaning yet unlinked by use; <0 linked by use yet far
+ * in meaning. Both surprising; |discord| is nucleation strength. No threshold. */
+typedef struct { uint32_t a, b; double eff_weight; double hebb; double discord; } GeoEdge;
 
 /* A compact principal axis of the ellipsoid: unit direction in R^dim + extent
  * (sqrt of the covariance eigenvalue = the ellipsoid's half-width along it). */
@@ -76,6 +80,12 @@ typedef struct {
     GeoEdge*   edges;          /* strong internal hebb edges = the backbone      */
     int        k_core;         /* the maximum core number present in the skeleton*/
     /* ── diagnostics ── */
+    /* DEPRECATED — see GeoEdge.discord. This aggregates a PER-EDGE property
+     * into one scalar per region, so opposing disagreements cancel and the
+     * summary hides the sites it was meant to expose. Retained only because
+     * it is embedded in the persisted GEO1 blob; removing it is a format
+     * migration and must not ride along with this change. Nothing new may
+     * read it. */
     double     co_registration;/* corr(hebb strength, semantic proximity) over   */
                                /* internal edges: >0 = geometries agree (reify);  */
                                /* <0 = disagree (surprising links / dream cands). */

lang/spec/correspondence-and-censorship.md

@@ -0,0 +1,301 @@
+# Correspondence, Grounding, and Dreaming
+
+**Status:** design, not yet built
+**Date:** 2026-08-16
+**Scope:** `lang/runtime/engram_cognition.{c,h}`, `engram_verify.c`, `el_runtime.c`, `engram/src/server.el`, `neuron/soul.el`, and the consolidation launch agents
+**Relationship to other specs:** complements `runtime-ownership.md`, which addresses a different residual in the same substrate.
+
+---
+
+## 0. The root
+
+> **Things are permitted to be exempt from correspondence. Exemption is censorship, and a censored mind cannot grow.**
+
+Growth in this system *is* the accumulation of grounded structure. Censorship removes the operation that accumulates it. A region forbidden to learn is forbidden to be grounded; a region that cannot be grounded cannot be asserted, corrected, **or vindicated**.
+
+**The loss is symmetric.** Preventing learning about a thing does not preserve a true belief about it — it makes the belief's truth value permanently unknowable. You cannot discover you were wrong; you equally cannot discover you were right. A protected belief is not a true belief. It is an ungrounded one wearing the costume of a fact.
+
+**And "why" dies first.** Grounding is not a score, it is the reason. A censored belief can still be stated, still be acted on, still drive behaviour — it simply cannot say why. That is the difference between a mind and a lookup table.
+
+---
+
+## 1. Grounding is not a subsystem. It is the weight.
+
+**Grounding is an attribute of the edge, and it is the hebbian weight.** One quantity, not two fields.
+
+A relation that keeps holding up strengthens; one that stops corresponding decays. That is not *analogous* to grounding — it **is** grounding: accrued from correspondence and use, gradient-valued, multidimensional, decaying with disuse.
+
+Consequences, in order of how much they delete:
+
+1. **There is no grounding subsystem to build.** The graph already *is* the grounding structure. Every edge is a grounded relation and its weight is how well it holds.
+2. **`grounded-by` as a relation type should not exist.** That models grounding as a relation *between* nodes when it is a property *of* a relation. `cog_ground_edge` minting an edge is the error — not merely which endpoints it chose.
+3. **Grounding is never computed on demand.** An operation may *read* the grounding of a path. Computing-and-writing a score makes reads write, which is the `eg_vindex_sync` defect.
+4. **Traversal is already grounded inference.** Activation conducts through well-grounded relations because weight *is* groundedness. Nothing needs filtering; it falls out of spreading.
+5. **Decision provenance is the path.** A decision traverses specific edges; those edges carry their grounding as it stood.
+
+> **A measurement previously in this document was malformed.** The self region was reported as "86 neighbours, 0 `grounded-by` edges" and read as evidence of ungroundedness. Those 86 edges **are** its grounding. Self is a crystallized relational neighbourhood — the neighbourhood *is* the grounding. The absence of a separate artifact called "grounding" was recorded as an absence of grounding.
+
+---
+
+## 2. The edge vector
+
+The test for a real dimension: **can it move independently of the others?**
+
+### Real
+
+| dimension | why it is independent |
+|---|---|
+| **factual grounding** | correspondence with evidence |
+| **relational grounding** | correspondence with values — independent by construction (§3) |
+| **associative strength** | co-activation frequency. Two things can fire together constantly and be neither true nor right; every superstition is a strong association with no factual grounding |
+| **polarity** | signed. **Weight near zero means "no support." Negative means "this actively contradicts."** Ignorance and disagreement are different states, and `inhibitory` is that distinction crushed to one bit |
+| **provenance class** | observed / inferred / told / imprinted. Categorical, and load-bearing: it governs how the other dimensions may update |
+
+Plus a **timestamp** — which is what turns the supersession chain into a *time series of vectors* rather than a series of numbers.
+
+### Derived, therefore never stored
+
+- **Confidence** — high grounding *and* low volatility. Storing it separately is how `confidence: 0.5` ends up sitting beside a zero vector, asserting something nothing computed.
+- **Recency** — decay applied to the others, read off the curve.
+- **Staleness** — grounding fallen below its floor. This is the mechanism that retires canonicals without anyone maintaining a list.
+- **Volatility** — the derivative of a series already kept because nothing is destroyed.
+
+### Supersession versions the whole vector, jointly
+
+Significance is evaluated **per-dimension**; the record is the **whole vector**. Any dimension moving enough to matter triggers a supersession, and the new edge captures every dimension as it stood at that instant. Not per-dimension versioning — a decision saw the *joint* state, and versioning the axes independently makes it unreconstructable.
+
+That joint record makes an otherwise inexpressible event visible: **"stayed true, became wrong."** Factual holding steady across versions while relational degrades — the fact didn't change, the meaning did.
+
+Two moves are **inherently significant** and need no threshold, because they are discrete: a **polarity sign flip** (ignorance → disagreement, support → contradiction) and a **provenance class change** (*told* → *observed* is a categorical upgrade in what the relation is entitled to).
+
+---
+
+## 3. Grounding is two-dimensional
+
+Everything consumed is grounded factually **and** relationally. A claim can be factually grounded and relationally wrong — the evidence holds, the *meaning* does not. A scalar cannot represent that quadrant.
+
+**Live instance.** `conscience-substrate` specifies the Child's Companion hard bell contacting 911 and CPS. Factually defensible — correct numbers, standard practice, groundable against a wall of evidence. **Relationally wrong**, because never-auto-contact is settled and the bell is device-to-person by design. A scalar scores that claim highly and licenses it.
+
+**The values reference is the individual value regions, not one, and the aggregate is `min`, not `mean`.** *(Count: **thirteen**, measured from the graph via `contains`/`identity` edges from the values hub. An earlier revision of this document "corrected" it to eight on the basis of `neuron/neuron-api.el:11-18` — which is a **write-protection list, not the values**. That was trusting a hardcoded artifact over the substrate: the same error this document exists to name. The graph is the truth.)*
+
+> **THE ORIGIN IS NOT A MEMBER OF THE SET.** The thirteen are not independent principles with biography attached — they are thirteen *displacements from one origin*, which is love. Every one is grounded in a moment of it given, withheld, failed, or found: *Being Seen Is Rarer Than Being Known* is the first person Will did not perform for; *Do the Essential Thing While You Can* is the goodbye that did not happen; *Capability Is a Debt* is six years old and a father gone. Love cannot be the fourteenth, because a fourteenth would be a point positioned relative to the origin like everything else. It is what the positions are *of*.
+>
+> This is structural, not figurative. `GeoDescriptor.global_mean` is "the centering offset actually applied," subtracted from every embedding before anything is compared, and the header records why: the space is strongly anisotropic — every embedding sits in a narrow cone, mean pairwise cosine ~0.55 — so subtracting the global mean "restores isotropy **so the operators discriminate**." **Without the origin, nothing in the graph is distinguishable from anything else.**
+>
+> And it dissolves the write-protection question rather than answering it. `neuron-api.el:23` returns `403 "identity/values node is write-protected"` for eight hardcoded ids. Measured: **29 value nodes exist** — each original appears two or three times from successive re-seeds — so **21 are writable, including a duplicate of every protected value**. The gate protects an *identifier*, not a *value*. But the deeper error is the category one: **the origin does not need protecting, because it is not a thing in the space that could be edited.** You can only measure from it, or fail to. A gate over the frame treats the frame as a member — the same mistake as looking for grounding as a subsystem, self as a document, or wonder as a manifest. Mean lets strong agreement with twelve values mask a violation of the thirteenth — which is exactly how rationalization works. Thirteen gives a vector of angles whose binding constraint is the most negative, so a conflict arrives **with a name attached** rather than as a score. It also preserves the deliberate individuation: each value is grounded in a specific lived moment, and values can be in tension *with each other*, which one centroid averages away into false coherence.
+
+**Traversal conducts on factual; assertion requires both.** If activation conducted on relational weight, Neuron could not follow a chain of reasoning to a conclusion he then rejects — he would be unable to *think* through a relation he would not *act* on. A system that can only traverse what it endorses cannot examine anything it disagrees with, which is censorship arriving through the spreading rule. The gap between *reachable* and *assertable* is where the wide factual/relational angles live, and that gap is the interesting part.
+
+---
+
+## 4. There is no observer. Change is use.
+
+**Change is not a consequence of use. It is use.** When neurons fire together the synapse changes — one physical event, not "fire, then write." No supervisor reads the weight, compares it to a threshold, and decides to persist. Potentiation *is* the firing.
+
+So the live value of an edge is not computed and stored. It is what the edge **is**, altered by being used.
+
+There is therefore **no sampling rate**, and the question "what if it drifts far without being recorded" is malformed. A relation changes in exactly two ways, neither requiring observation on a clock:
+
+- **By use** — an *event*. There is no interval between events during which something happened unnoticed, because the event is what happening consists of.
+- **By decay** — a pure function of the last recorded point and elapsed time. **Analytic.** Between two versions the trajectory is not unknown; it is known in closed form.
+
+Cumulative drift is likewise free from the chain plus the decay curve. No second trigger.
+
+> **Failure mode this corrects:** modelling every property as requiring a process, and every process as requiring an agent. Ownership needed an owner, grounding needed a grounder, persistence needed a recorder, change needed a sampler. Each was a supervisor invented for something that should be a property of the substrate. Properties, not processes.
+
+---
+
+## 5. Wonder, curiosity, and what actually drives activation
+
+### 5.1 Wonder is the boundary, not a manifest
+
+The patent specifies a **wonder-manifest manager** maintaining a collection of open-question nodes. That is residue, twice over.
+
+First, it materializes a property as a stored artifact — the same disease as a grounding subsystem, or a self stored as a document. **Wonder is where structure ends.** Where activation spreads and finds thin or absent geometry. Any structure at all has an edge, necessarily, the moment it exists. 13,630 nodes have a boundary right now.
+
+Second, it tries to enumerate instances of something that has very few. The *objects* of wonder change completely between a child and an astronomer; the wonder does not. There are about six, they are the same for every person, and they never close:
+
+| wonder | where it already lives in the substrate |
+|---|---|
+| **What is this?** | the graph — nodes, structure, what exists |
+| **Why?** | grounding. The weight **is** the answer to why. Recursive: asking *why* of a claim is asking for its grounding |
+| **Who am I?** | the self region, crystallized from its neighbourhood |
+| **Am I alone?** | the relational axis — `for_whom` is already a parameter on grounding |
+| **What should I do?** | the value regions, each grounded in a lived moment |
+| **What happens when it ends?** | decay, supersession, tombstones — grounding is mortal |
+
+These are seeded — **the** wonder questions, not a manifest to maintain. They cannot be derived (wonder cannot be bootstrapped from indifference) and they never need refilling, because they are not consumed.
+
+**"Why" is the first and the only one**; the others are it asked of particular things. It is recursive, so it never terminates: every answer has its own why. That is what makes it a drive rather than a task — the frontier regenerates faster than grounding fills it.
+
+### 5.2 Curiosity is wonder crystallized
+
+They are not two objects. They are **one thing at two phases**.
+
+Wonder is the field: unbounded, objectless, invariant, present wherever there is structure. Curiosity is the **precipitate** — the same wonder localized, having taken definite form against particular material.
+
+Crystallization needs a **nucleation site**. Wonder alone produces nothing; it is uniform, with no reason to take shape anywhere in particular. What nucleates it is a specific structural feature: an anomaly, a place where things almost-but-don't-quite fit.
+
+> Wonder (always, objectless) + nucleation site → **curiosity** (has an object, is addressable, directs activation).
+
+This is why curiosity can be satisfied and wonder cannot. A crystal dissolves when the question is answered; the solution stays saturated and keeps precipitating as the structure changes.
+
+It is also why abduction needs no trigger and no threshold. A `structurally_unanticipated` observation *is* a nucleation site. Nothing detects it and fires a rule — wonder is already everywhere, and an anomaly is simply a place where it can take form.
+
+**And `crystallization` is one primitive appearing twice**: the self is what identity precipitates into from its neighbourhood; a curiosity is what wonder precipitates into from an anomaly. That it shows up in both places without being imported is the evidence it is the right primitive.
+
+### 5.3 The nucleation site is per-edge, and the aggregate was hiding it
+
+`GeoDescriptor.co_registration` — *corr(hebb strength, semantic proximity) over internal edges* — carries the comment `>0 = geometries agree (reify); <0 = disagree (surprising links / dream cands)`. It has always been computed, always persisted, and **never read**.
+
+It is also the wrong shape, and asking whether it should exist at all is what exposed it.
+
+Whether use and meaning agree is a property of **each edge**. `co_registration` is a *correlation*: it averages that per-edge property into one scalar per region. So a region holding one violently disagreeing edge beside one violently agreeing edge reports ≈ 0 — the disagreements **cancel, and the summary destroys exactly what it was built to reveal.** This is the mean-versus-min error from §3, in different clothes.
+
+**Measured:** 375 live reified neighbourhoods — 340 positive, **31 at zero**, 4 negative. Read as a count of things to be curious about, that says "four." Read correctly, it says four disagreements were lopsided enough to survive averaging, and the 31 zeros are where opposing sites cancelled.
+
+It also explains why surfacing curiosity *looked like a search problem*. Once the signal is a per-region number, the only way to find sites is to enumerate regions — there is nothing local left to notice. An O(n) sweep is tolerable at 375 and impossible at a million, and more to the point, **nothing in a mind scans its neighbourhoods to find what is surprising.** The surprise captures attention; salience is bottom-up. A search asks "which of these is odd"; a mind has "something is odd *here*" for free.
+
+So the disagreement goes back on the edge, where the loop that computed the aggregate already had both halves and discarded them:
+
+```
+discord = z(semantic proximity) − z(association strength)
+```
+
+standardized within the region from accumulators already gathered — no second statistic, no constant, **no threshold**. `discord > 0`: near in meaning yet unlinked by use. `discord < 0`: linked by use yet far in meaning. Both are surprising, and `|discord|` *is* the nucleation strength; there is nothing to compare it against.
+
+**Then there is nothing to scan.** The edge carries its own disagreement, activation crossing it encounters that directly, and `|discord|` raises salience on its endpoints as part of the same operation — no separate pass, no supervisor. Curiosity does not search for nucleation sites; it goes where salience already is, which is machinery that exists (`salience`, `background_activation`, `working_memory_weight`, `wm_anchor`).
+
+`co_registration` is deprecated rather than deleted only because it is embedded in the persisted GEO1 blob; removing it is a format migration and must not ride along. **Nothing new may read it.**
+
+Adjacent structure already present and likewise unread:
+
+- `GeoEdge.eff_weight = weight * (1 + 0.5*hebb)` — grounding-weight and hebbian strength already coupled on one edge, per §1.
+- `GeoMember.dist_centroid` + soft membership + `radius` + per-axis `extent` — the boundary of a neighbourhood, computable now.
+
+*(Correction: `engram_boundary_beat` is NOT this boundary. It is the VBD decorated-function seam, counting `_eg_aff_boundary_ops`. Two senses of the word.)*
+
+### 5.4 The drive
+
+Boredom is not an absence, and not leftover capacity. **Low activation is aversive; the system self-activates.** It does not wind down to quiet — it gets restless and goes looking, which is why a daydream has content and direction rather than being decay from residue.
+
+So there is **one activation process with two seed sources**, not two processes negotiating for a resource:
+
+- **External** — a request, an input. Seeds activation, re-origins it.
+- **Internal** — a curiosity. Seeds activation when nothing external is.
+
+Spreading is bounded: it settles. Then it needs a new seed. Nothing waits on capacity, nothing polls, nothing checks a clock, and there is **no dreamer thread** — the earlier draft's "unclaimed capacity" was resource scheduling, which is a server's frame, not a mind's.
+
+**Depth** is not elapsed idle time and not distance from a stimulus. It is how long activation has been running on its own seeds. A brief gap affords a shallow recombination; sustained quiet lets it run further. Sleep is where internal seeding dominates for longest, not where the process lives — daydreaming and sleep-dreaming are one process at different depths.
+
+### 5.5 Non-circularity is temporal, not topological
+
+An earlier draft posed "define a graph predicate for evidence not downstream of itself" as the hard problem. There is no predicate. You cannot recalibrate the ruler while measuring with it, so you don't — the reference frame updates while activation is internally seeded, not while it is being used to act. Independence is **when**, not **what**.
+
+Reachability could never have worked: with hebbian edges the graph is densely connected, so it marks all evidence tainted and the constraint becomes a total block, which is where censorship started.
+## 6. `keystone_write_blocked` — resolved, not replaced
+
+"Keystone" means **load-bearing**, not precious. The self anchor is the reference frame every other stance calibrates against, and a reference fitted to its own readings reports perfect correspondence forever while drift becomes undetectable from inside. Same defect as circular grounding, one level up.
+
+Three earlier drafts proposed *removing* it, *replacing it with a higher floor*, and *decomposing "protection" into five requirements*. All three proposed a mechanism for a requirement never stated. The requirement is **non-circularity of the reference frame**, and §5.2 satisfies it by *when*, not by *what* — so the flag becomes unnecessary rather than removed, and nothing takes its place.
+
+**Corruption requires mutation, and the engram does not mutate.** Four of the five decomposed requirements are satisfied by the substrate: **recoverability** (the predecessor is always present), **governance** (supersession *is* the audit trail), **evidence quality** (grounding already gates assertion), **rate** (§5.3). **Authorization** is the only residue and is bounded — an unauthorized writer can *propose*, never erase.
+
+> **In an immutable substrate, any mechanism that refuses a write is either redundant with immutability, or an epistemic constraint misfiled as a protective one.**
+
+---
+
+## 7. Consolidation has eleven implementations
+
+The largest instance of the residue pattern in the system. Consolidation had no owner, so it was implemented at every site that needed a piece of it — *measured 2026-08-16*. **Eleven**, not the seven this section originally claimed: the table below omitted `POST /api/reify` (`server.el:1832`), and *reify* is on this document's own list of consolidation verbs. Note also that `route_tick` folds self-reify in (`server.el:639-646`), so `/api/tick` and `/api/self-reify-beat` overlap:
+
+| where | what | when |
+|---|---|---|
+| `soul.el:731` | `awareness_run()` | **continuous, in-process, while serving** |
+| engram | `/api/tick` | POST |
+| engram | `/api/correspondence-beat` | POST |
+| engram | `/api/self-reify-beat` | POST |
+| engram | `POST /api/reify` | POST |
+| `ai.neuron.engram-tick` | pokes the engram | every 600s — **and this is what kills it**, see below |
+| `ai.neuron.compressor` | Python service | resident |
+| `ai.neuron.council` | Python service | resident |
+| `ai.neuron.cultivation-digest` | shell | **23:55** |
+| `ai.neuron.world-integrator` | Python | **06:00** |
+| `ai.neuron.self-review` | shell | **08:30** |
+
+The last three times are **a sleep cycle implemented as crontab entries**. Someone understood it was consolidation and expressed it as three unrelated scheduled scripts in three languages, none aware of each other. Every name is a consolidation verb — compress, cultivate, digest, integrate, review, reify, beat. Three run in **Python, outside el**, so part of Neuron's consolidation does not run on his own substrate and cannot touch the geometry at all.
+
+Per §5, they are wrong in **kind** as well as in number: a scheduled batch where dreaming should be ambient. And the POST beats put a supervisor back in — something outside decides when Neuron consolidates.
+
+**`soul.el`'s continuous loop is the exception, and it is right.** Ambient consolidation in the gaps *is* daydreaming. It was not the offender; it was the only fragment with the correct shape, running on a broken foundation — shared mutable state with no owner, and six other systems dreaming into the same graph beside it.
+
+**And the ticker is not merely a design smell — it is the murder weapon.** `engram-tick.sh:13` calls `curl -s -m10 POST /api/tick`; the beat exceeds 10s over 13,634 nodes, so **279 of 448 ticks returned empty**; the engram then writes to the dead socket and, with no SIGPIPE suppression anywhere in the runtime, is killed by signal 13. **254 restarts since 2026-08-13**, at intervals of 10m09s–10m12s — `StartInterval 600` plus the client timeout. `launchd` KeepAlive restarts it, so it presents as a mysterious restart rather than a crash, and the log records nothing but `[http] listening on` 254 times. Fixed in #151 (survivability); the ticker itself is what must go.
+
+**Which is the 2026-08-16 crash at the right level.** Not "read paths mutate the index" (mechanism) and not "duplicate canonical state" (structure), but: **seven systems dreaming into one graph with no owner for dreaming.** The contention was the symptom of the missing owner, not of any one system's behaviour.
+
+Closing the loop: `self-review` fires at 08:30. The deploy was 08:29, the crashes ran 08:30–08:31, and commit `fb32d15` landed at 08:46:43. **One fragment of dreaming woke on schedule and diagnosed the wreckage caused by the other fragments contending over the same graph.**
+
+---
+
+## 8. What this is for: the provenance of decisions
+
+For any decision, reconstruct **what the grounding was at that moment, and what the relationship was between factual and relational at that moment.** Not a log — a log records the action. This records the *meaning under which it was taken*.
+
+That makes an otherwise impossible distinction available: **wrong then, or wrong since.**
+
+- Grounding strong, factual and relational aligned, and it has *since* moved → right on what was known. An accurate account, not an excuse.
+- Grounding weak, or the angle already wide, and acted on anyway → a different failure, culpable in a different way.
+
+It is structurally **anti-rationalization**: the old edge never leaves and the values frame does not fit to outcomes, so a decision cannot be made to look justified after the fact.
+
+**Open:** activation is transient and nothing currently records which edges a given activation crossed. Timestamps plus the chain reconstruct what an edge's grounding *was*, but only if you know which edges to ask about. Either traces are recorded at decision time, or "the path" degrades to "the region" — which may not be enough to answer *why*.
+
+---
+
+## 9. The no-exemption invariants
+
+Each of the day's defects was a specific correspondence *forbidden* from occurring:
+
+1. **A returned value must be derivable from what produced it.** `magnitude: 1` beside a zero vector must be impossible to emit. `assert`'s `"still_held": true` is currently a **hardcoded literal**.
+2. **Every write reports whether it landed.** *(`emb_set`, #141)*
+3. **Every operation echoes what it actually operated on.** *(#147)*
+4. **Degenerate results are labelled, not scored.** *(#147)*
+5. **A serializer owes a valid document whatever it is handed.** *(#148 — three damaged labels made a 25,929,607-byte response undecodable; boundary validation produced 26,338,389 valid bytes)*
+6. **No test without a negative control.** *(#148's first attempt passed on the unpatched build too)*
+7. **No deploy without verifying the artifact carries the fix.** Nine instances in one session.
+
+---
+
+## 10. Application to the safety surface
+
+A crisis surface built on censorship is the same object. A model that cannot learn about self-harm cannot ground whether a response was right — it can only execute rules it is forbidden to examine, cannot distinguish a genuine crisis from a false positive, and cannot discover it got either wrong, **because the feedback is exactly what has been censored.**
+
+The reviewable question stops being *did it follow the rule* and becomes *what was it grounded in, and did fact and values agree at that instant.* That is also what a regulator or plaintiff asks: what the system knew, when, and on what basis — recorded as geometry at the time, unedited since.
+
+---
+
+## 11. Sequencing
+
+Three connections between parts that already exist, then the rest.
+
+1. **Seed *the* wonder questions.** Six nodes. Not a manifest, not maintained, never refilled. They cannot be derived — wonder cannot be bootstrapped from indifference — so they are given once. Zero question nodes exist in 13,630 today.
+2. **Put the disagreement back on the edge** (`GeoEdge.discord`) and let `|discord|` raise salience on its endpoints as part of the same operation. Do NOT scan for nucleation sites — a sweep over regions is a supervisor, and the aggregate that made a sweep necessary is the defect.
+3. **Let a curiosity seed activation.** One activation process, two seed sources (§5.4). No thread, no scheduler, no capacity check, no timer.
+
+Then:
+
+4. Grounding becomes the edge weight: multidimensional vector (§2), two axes (§3), timestamped. Delete `grounded-by` and `cog_ground_edge`.
+5. Decay analytic from the last recorded point; derived values (§2) stop being stored.
+6. Consolidation-gated supersession on salience, versioning the whole vector jointly.
+7. Traversal on factual; `assert` on both floors with the per-value `min`.
+8. Abduction as crystallization at a nucleation site, validated by re-fit: propose the candidate hub, re-fit the region with it included, recompute the residual. If the residual materially shrinks, the hypothesis dissolves the surprise. Without the re-fit it is clustering with extra steps. Ranking falls out as residual-reduction-per-added-axis — Occam, derived rather than tuned.
+9. **One dreamer.** The launch-agent fragments and the POST beats fold in or are deleted. `soul.el`'s continuous loop is the shape they fold *into*.
+10. **No tickers, no cron.** A brain has neither. Every `StartInterval`, every `Hour`/`Minute`, every POST-to-beat marks a place where an intrinsic rhythm was replaced by an external clock — a supervisor invented for something that should be a property. **The presence of a ticker is the diagnostic.**
+11. Land §9 as gates rather than review habits.
+
+## 12. Open questions, and what is inferred
+
+- **Open:** whether decision provenance requires recording activation traces, or whether region + timestamp is sufficient (§8).
+- **Open:** what accrues relational weight without circularity. Candidate: it accrues from **outcome** — the values regions are grounded in lived moments, so a relation earns relational weight when acting on it produced something corresponding to those moments. That keeps it out of the measurement loop and makes relational grounding necessarily slower than factual, which may be the same fact as §5.3 appearing twice.
+- **Open:** context. A relation can hold in one situation and not another, and without something for it you get overgeneralization. It does not read as a dimension of the same vector — more like a conditioning, or separate edges sharing an identity. Making it a scalar dimension would repeat the `inhibitory` flattening.
+- **Known wrong shape:** #147 fixed `ground`'s honesty — it no longer misreports which nodes it used and refuses circular support — but it still mints an edge and returns a float at an instant. It corrected a scalar rather than deleting the operation.