el: native @route dispatch + multi-decorator stacking in modular compiler

Port the @route decorator from the bootstrap prototype into the production
modular compiler (parser + streaming codegen), and generalize single
decorators to a stacked list so a handler can be both @route and a VBD role
(@manager/@engine/@accessor). The dispatcher is synthesized from a token
pre-scan (survives the streaming backend's per-fn AST discard, works for
library modules) and emitted specificity-sorted so overlapping prefixes never
shadow by source order. Supports method lists ("GET|POST"), "ANY", and
suffix/compound matchers. Inert on all non-@route code (byte-identical C).

.gitea/workflows/ci-dev.yaml

@@ -39,9 +39,9 @@ jobs:
         run: |
           dist/platform/elc-linux-amd64 elc-cli.el > dist/elc-gen2.c
           gcc -O2 \
-            -I runtime \
+            -I el-compiler/runtime \
             dist/elc-gen2.c \
-            runtime/el_runtime.c \
+            el-compiler/runtime/el_runtime.c \
             -lcurl -lssl -lcrypto -lpthread -lm \
             -o dist/platform/elc
           chmod +x dist/platform/elc
@@ -54,9 +54,9 @@ jobs:
           mkdir -p dist/bin
           dist/platform/elc elb.el > dist/elb.c
           gcc -O2 \
-            -I runtime \
+            -I el-compiler/runtime \
             dist/elb.c \
-            runtime/el_runtime.c \
+            el-compiler/runtime/el_runtime.c \
             -lcurl -lssl -lcrypto -lpthread -lm \
             -o dist/bin/elb
           chmod +x dist/bin/elb
@@ -91,7 +91,7 @@ jobs:
       - name: Precompile el_runtime.o
         run: |
           set -euo pipefail
-          RUNTIME="$(pwd)/runtime"
+          RUNTIME="$(pwd)/el-compiler/runtime"
           gcc -O2 -c -I "$RUNTIME" "$RUNTIME/el_runtime.c" \
             -o /tmp/el_runtime.o
           echo "el_runtime.o compiled"
@@ -100,7 +100,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/runtime"
+          RUNTIME="$(pwd)/el-compiler/runtime"
           "$ELC" --test tests/native/test_core.el > /tmp/el_native_core.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_core.c /tmp/el_runtime.o \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_core
@@ -110,7 +110,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/runtime"
+          RUNTIME="$(pwd)/el-compiler/runtime"
           "$ELC" --test tests/native/test_text.el > /tmp/el_native_text.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_text.c /tmp/el_runtime.o \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_text
@@ -120,7 +120,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/runtime"
+          RUNTIME="$(pwd)/el-compiler/runtime"
           "$ELC" --test tests/native/test_string.el > /tmp/el_native_string.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_string.c /tmp/el_runtime.o \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_string
@@ -130,7 +130,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/runtime"
+          RUNTIME="$(pwd)/el-compiler/runtime"
           "$ELC" --test tests/native/test_math.el > /tmp/el_native_math.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_math.c /tmp/el_runtime.o \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_math
@@ -140,7 +140,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/runtime"
+          RUNTIME="$(pwd)/el-compiler/runtime"
           "$ELC" --test tests/native/test_state.el > /tmp/el_native_state.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_state.c /tmp/el_runtime.o \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_state
@@ -150,7 +150,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/runtime"
+          RUNTIME="$(pwd)/el-compiler/runtime"
           "$ELC" --test tests/native/test_time.el > /tmp/el_native_time.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_time.c /tmp/el_runtime.o \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_time
@@ -160,7 +160,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/runtime"
+          RUNTIME="$(pwd)/el-compiler/runtime"
           "$ELC" --test tests/native/test_json.el > /tmp/el_native_json.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_json.c /tmp/el_runtime.o \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_json
@@ -170,7 +170,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/runtime"
+          RUNTIME="$(pwd)/el-compiler/runtime"
           "$ELC" --test tests/native/test_env.el > /tmp/el_native_env.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_env.c /tmp/el_runtime.o \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_env
@@ -180,7 +180,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/runtime"
+          RUNTIME="$(pwd)/el-compiler/runtime"
           "$ELC" --test tests/native/test_fs.el > /tmp/el_native_fs.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_fs.c /tmp/el_runtime.o \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_fs
@@ -191,7 +191,7 @@ jobs:
         run: |
           ABS_ELB="$(pwd)/dist/bin/elb"
           ABS_ELC="$(pwd)/dist/platform/elc"
-          ABS_RUNTIME="$(pwd)/runtime"
+          ABS_RUNTIME="$(pwd)/el-compiler/runtime"
           ABS_OUT="$(pwd)/dist/bin"
           (cd ../epm && "$ABS_ELB" --clean --elc="$ABS_ELC" --runtime="$ABS_RUNTIME" --out="$ABS_OUT")
           chmod +x dist/bin/epm
@@ -202,7 +202,7 @@ jobs:
         run: |
           ABS_ELB="$(pwd)/dist/bin/elb"
           ABS_ELC="$(pwd)/dist/platform/elc"
-          ABS_RUNTIME="$(pwd)/runtime"
+          ABS_RUNTIME="$(pwd)/el-compiler/runtime"
           ABS_OUT="$(pwd)/dist/bin"
           (cd tools/install && "$ABS_ELB" --clean --elc="$ABS_ELC" --runtime="$ABS_RUNTIME" --out="$ABS_OUT")
           chmod +x dist/bin/el-install
@@ -242,7 +242,7 @@ jobs:
             --project=neuron-785695 \
             --package=el-runtime-c \
             --version="${VERSION}" \
-            --source=runtime/el_runtime.c
+            --source=el-compiler/runtime/el_runtime.c
 
           gcloud artifacts generic upload \
             --repository=foundation-dev \
@@ -250,7 +250,7 @@ jobs:
             --project=neuron-785695 \
             --package=el-runtime-h \
             --version="${VERSION}" \
-            --source=runtime/el_runtime.h
+            --source=el-compiler/runtime/el_runtime.h
 
           gcloud artifacts generic upload \
             --repository=foundation-dev \
@@ -258,7 +258,7 @@ jobs:
             --project=neuron-785695 \
             --package=el-runtime-js \
             --version="${VERSION}" \
-            --source=runtime/el_runtime.js
+            --source=el-compiler/runtime/el_runtime.js
 
           echo "Published El SDK version=${VERSION} to foundation-dev"
           # Keep key alive for the ci-base rebuild step below
@@ -291,9 +291,9 @@ jobs:
           FROM ${BASE}
           COPY dist/platform/elc                 /opt/el/dist/platform/elc
           COPY dist/bin/elb                       /opt/el/dist/bin/elb
-          COPY runtime/el_runtime.c  /opt/el/runtime/el_runtime.c
-          COPY runtime/el_runtime.h  /opt/el/runtime/el_runtime.h
-          COPY runtime/el_runtime.js /opt/el/runtime/el_runtime.js
+          COPY el-compiler/runtime/el_runtime.c  /opt/el/el-compiler/runtime/el_runtime.c
+          COPY el-compiler/runtime/el_runtime.h  /opt/el/el-compiler/runtime/el_runtime.h
+          COPY el-compiler/runtime/el_runtime.js /opt/el/el-compiler/runtime/el_runtime.js
           RUN chmod +x /opt/el/dist/platform/elc /opt/el/dist/bin/elb
           EOF
 

.gitea/workflows/ci-stage.yaml

@@ -46,9 +46,9 @@ jobs:
         run: |
           dist/platform/elc-linux-amd64 elc-cli.el > dist/elc-gen2.c
           gcc -O2 \
-            -I runtime \
+            -I el-compiler/runtime \
             dist/elc-gen2.c \
-            runtime/el_runtime.c \
+            el-compiler/runtime/el_runtime.c \
             -lcurl -lssl -lcrypto -lpthread -lm \
             -o dist/platform/elc
           chmod +x dist/platform/elc
@@ -84,7 +84,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/runtime"
+          RUNTIME="$(pwd)/el-compiler/runtime"
           "$ELC" --test tests/native/test_core.el > /tmp/el_native_core.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_core.c "$RUNTIME/el_runtime.c" \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_core
@@ -94,7 +94,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/runtime"
+          RUNTIME="$(pwd)/el-compiler/runtime"
           "$ELC" --test tests/native/test_text.el > /tmp/el_native_text.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_text.c "$RUNTIME/el_runtime.c" \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_text
@@ -104,7 +104,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/runtime"
+          RUNTIME="$(pwd)/el-compiler/runtime"
           "$ELC" --test tests/native/test_string.el > /tmp/el_native_string.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_string.c "$RUNTIME/el_runtime.c" \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_string
@@ -114,7 +114,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/runtime"
+          RUNTIME="$(pwd)/el-compiler/runtime"
           "$ELC" --test tests/native/test_math.el > /tmp/el_native_math.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_math.c "$RUNTIME/el_runtime.c" \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_math
@@ -124,7 +124,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/runtime"
+          RUNTIME="$(pwd)/el-compiler/runtime"
           "$ELC" --test tests/native/test_state.el > /tmp/el_native_state.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_state.c "$RUNTIME/el_runtime.c" \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_state
@@ -134,7 +134,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/runtime"
+          RUNTIME="$(pwd)/el-compiler/runtime"
           "$ELC" --test tests/native/test_time.el > /tmp/el_native_time.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_time.c "$RUNTIME/el_runtime.c" \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_time
@@ -144,7 +144,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/runtime"
+          RUNTIME="$(pwd)/el-compiler/runtime"
           "$ELC" --test tests/native/test_json.el > /tmp/el_native_json.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_json.c "$RUNTIME/el_runtime.c" \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_json
@@ -154,7 +154,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/runtime"
+          RUNTIME="$(pwd)/el-compiler/runtime"
           "$ELC" --test tests/native/test_env.el > /tmp/el_native_env.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_env.c "$RUNTIME/el_runtime.c" \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_env
@@ -164,7 +164,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/runtime"
+          RUNTIME="$(pwd)/el-compiler/runtime"
           "$ELC" --test tests/native/test_fs.el > /tmp/el_native_fs.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_fs.c "$RUNTIME/el_runtime.c" \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_fs
@@ -176,9 +176,9 @@ jobs:
           mkdir -p dist/bin
           dist/platform/elc elb.el > dist/elb.c
           gcc -O2 \
-            -I runtime \
+            -I el-compiler/runtime \
             dist/elb.c \
-            runtime/el_runtime.c \
+            el-compiler/runtime/el_runtime.c \
             -lcurl -lssl -lcrypto -lpthread -lm \
             -o dist/bin/elb
           chmod +x dist/bin/elb
@@ -189,7 +189,7 @@ jobs:
         run: |
           ABS_ELB="$(pwd)/dist/bin/elb"
           ABS_ELC="$(pwd)/dist/platform/elc"
-          ABS_RUNTIME="$(pwd)/runtime"
+          ABS_RUNTIME="$(pwd)/el-compiler/runtime"
           ABS_OUT="$(pwd)/dist/bin"
           (cd ../epm && "$ABS_ELB" --clean --elc="$ABS_ELC" --runtime="$ABS_RUNTIME" --out="$ABS_OUT")
           chmod +x dist/bin/epm
@@ -200,7 +200,7 @@ jobs:
         run: |
           ABS_ELB="$(pwd)/dist/bin/elb"
           ABS_ELC="$(pwd)/dist/platform/elc"
-          ABS_RUNTIME="$(pwd)/runtime"
+          ABS_RUNTIME="$(pwd)/el-compiler/runtime"
           ABS_OUT="$(pwd)/dist/bin"
           (cd tools/install && "$ABS_ELB" --clean --elc="$ABS_ELC" --runtime="$ABS_RUNTIME" --out="$ABS_OUT")
           chmod +x dist/bin/el-install
@@ -235,7 +235,7 @@ jobs:
             --project=neuron-785695 \
             --package=el-runtime-c \
             --version="${VERSION}" \
-            --source=runtime/el_runtime.c
+            --source=el-compiler/runtime/el_runtime.c
 
           gcloud artifacts generic upload \
             --repository=foundation-stage \
@@ -243,7 +243,7 @@ jobs:
             --project=neuron-785695 \
             --package=el-runtime-h \
             --version="${VERSION}" \
-            --source=runtime/el_runtime.h
+            --source=el-compiler/runtime/el_runtime.h
 
           echo "Published El SDK version=${VERSION} to foundation-stage"
           # Keep key alive for the ci-base rebuild step below
@@ -275,9 +275,9 @@ jobs:
           FROM ${BASE}
           COPY dist/platform/elc                 /opt/el/dist/platform/elc
           COPY dist/bin/elb                       /opt/el/dist/bin/elb
-          COPY runtime/el_runtime.c  /opt/el/runtime/el_runtime.c
-          COPY runtime/el_runtime.h  /opt/el/runtime/el_runtime.h
-          COPY runtime/el_runtime.js /opt/el/runtime/el_runtime.js
+          COPY el-compiler/runtime/el_runtime.c  /opt/el/el-compiler/runtime/el_runtime.c
+          COPY el-compiler/runtime/el_runtime.h  /opt/el/el-compiler/runtime/el_runtime.h
+          COPY el-compiler/runtime/el_runtime.js /opt/el/el-compiler/runtime/el_runtime.js
           RUN chmod +x /opt/el/dist/platform/elc /opt/el/dist/bin/elb
           EOF
 

.gitea/workflows/sdk-release.yaml

@@ -47,9 +47,9 @@ jobs:
           mkdir -p dist/platform
           dist/platform/elc-linux-amd64 elc-cli.el > dist/elc-gen2.c
           gcc -O2 \
-            -I runtime \
+            -I el-compiler/runtime \
             dist/elc-gen2.c \
-            runtime/el_runtime.c \
+            el-compiler/runtime/el_runtime.c \
             -lcurl -lssl -lcrypto -lpthread -lm \
             -o dist/platform/elc
           chmod +x dist/platform/elc
@@ -62,9 +62,9 @@ jobs:
           mkdir -p dist/bin
           dist/platform/elc elb.el > dist/elb.c
           gcc -O2 \
-            -I runtime \
+            -I el-compiler/runtime \
             dist/elb.c \
-            runtime/el_runtime.c \
+            el-compiler/runtime/el_runtime.c \
             -lcurl -lssl -lcrypto -lpthread -lm \
             -o dist/bin/elb
           chmod +x dist/bin/elb
@@ -75,7 +75,7 @@ jobs:
         run: |
           ABS_ELB="$(pwd)/dist/bin/elb"
           ABS_ELC="$(pwd)/dist/platform/elc"
-          ABS_RUNTIME="$(pwd)/runtime"
+          ABS_RUNTIME="$(pwd)/el-compiler/runtime"
           ABS_OUT="$(pwd)/dist/bin"
           (cd ../epm && "$ABS_ELB" --clean --elc="$ABS_ELC" --runtime="$ABS_RUNTIME" --out="$ABS_OUT")
           chmod +x dist/bin/epm
@@ -86,7 +86,7 @@ jobs:
         run: |
           ABS_ELB="$(pwd)/dist/bin/elb"
           ABS_ELC="$(pwd)/dist/platform/elc"
-          ABS_RUNTIME="$(pwd)/runtime"
+          ABS_RUNTIME="$(pwd)/el-compiler/runtime"
           ABS_OUT="$(pwd)/dist/bin"
           (cd tools/install && "$ABS_ELB" --clean --elc="$ABS_ELC" --runtime="$ABS_RUNTIME" --out="$ABS_OUT")
           chmod +x dist/bin/el-install
@@ -121,7 +121,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/runtime"
+          RUNTIME="$(pwd)/el-compiler/runtime"
           "$ELC" --test tests/native/test_core.el > /tmp/el_native_core.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_core.c "$RUNTIME/el_runtime.c" \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_core
@@ -131,7 +131,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/runtime"
+          RUNTIME="$(pwd)/el-compiler/runtime"
           "$ELC" --test tests/native/test_text.el > /tmp/el_native_text.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_text.c "$RUNTIME/el_runtime.c" \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_text
@@ -141,7 +141,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/runtime"
+          RUNTIME="$(pwd)/el-compiler/runtime"
           "$ELC" --test tests/native/test_string.el > /tmp/el_native_string.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_string.c "$RUNTIME/el_runtime.c" \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_string
@@ -151,7 +151,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/runtime"
+          RUNTIME="$(pwd)/el-compiler/runtime"
           "$ELC" --test tests/native/test_math.el > /tmp/el_native_math.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_math.c "$RUNTIME/el_runtime.c" \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_math
@@ -161,7 +161,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/runtime"
+          RUNTIME="$(pwd)/el-compiler/runtime"
           "$ELC" --test tests/native/test_state.el > /tmp/el_native_state.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_state.c "$RUNTIME/el_runtime.c" \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_state
@@ -171,7 +171,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/runtime"
+          RUNTIME="$(pwd)/el-compiler/runtime"
           "$ELC" --test tests/native/test_time.el > /tmp/el_native_time.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_time.c "$RUNTIME/el_runtime.c" \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_time
@@ -181,7 +181,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/runtime"
+          RUNTIME="$(pwd)/el-compiler/runtime"
           "$ELC" --test tests/native/test_json.el > /tmp/el_native_json.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_json.c "$RUNTIME/el_runtime.c" \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_json
@@ -191,7 +191,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/runtime"
+          RUNTIME="$(pwd)/el-compiler/runtime"
           "$ELC" --test tests/native/test_env.el > /tmp/el_native_env.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_env.c "$RUNTIME/el_runtime.c" \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_env
@@ -201,7 +201,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/runtime"
+          RUNTIME="$(pwd)/el-compiler/runtime"
           "$ELC" --test tests/native/test_fs.el > /tmp/el_native_fs.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_fs.c "$RUNTIME/el_runtime.c" \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_fs
@@ -216,8 +216,8 @@ jobs:
           cp lang/dist/platform/elc          dist/sdk/bin/elc
           cp lang/dist/bin/elb               dist/sdk/bin/elb
           cp lang/dist/bin/epm               dist/sdk/bin/epm
-          cp lang/runtime/el_runtime.c  dist/sdk/runtime/
-          cp lang/runtime/el_runtime.h  dist/sdk/runtime/
+          cp lang/el-compiler/runtime/el_runtime.c  dist/sdk/runtime/
+          cp lang/el-compiler/runtime/el_runtime.h  dist/sdk/runtime/
           cp lang/runtime/*.el               dist/sdk/runtime/
           tar -czf dist/el-sdk-latest.tar.gz -C dist/sdk .
           echo "SDK tarball bundled: dist/el-sdk-latest.tar.gz"
@@ -274,8 +274,8 @@ jobs:
 
           # Per-file assets (downstream CI needs these individually)
           upload_asset lang/dist/platform/elc                elc
-          upload_asset lang/runtime/el_runtime.c el_runtime.c
-          upload_asset lang/runtime/el_runtime.h el_runtime.h
+          upload_asset lang/el-compiler/runtime/el_runtime.c el_runtime.c
+          upload_asset lang/el-compiler/runtime/el_runtime.h el_runtime.h
 
           # SDK bundle and installer binary
           upload_asset dist/el-sdk-latest.tar.gz             el-sdk-latest.tar.gz
@@ -319,7 +319,7 @@ jobs:
             --project=neuron-785695 \
             --package=el-runtime-c \
             --version="${VERSION}" \
-            --source=runtime/el_runtime.c
+            --source=el-compiler/runtime/el_runtime.c
 
           gcloud artifacts generic upload \
             --repository=foundation-prod \
@@ -327,7 +327,7 @@ jobs:
             --project=neuron-785695 \
             --package=el-runtime-h \
             --version="${VERSION}" \
-            --source=runtime/el_runtime.h
+            --source=el-compiler/runtime/el_runtime.h
 
           gcloud artifacts generic upload \
             --repository=foundation-prod \
@@ -335,7 +335,7 @@ jobs:
             --project=neuron-785695 \
             --package=el-runtime-js \
             --version="${VERSION}" \
-            --source=runtime/el_runtime.js
+            --source=el-compiler/runtime/el_runtime.js
 
           echo "Published El SDK version=${VERSION} to foundation-prod"
           # Keep key alive for the ci-base rebuild step below
@@ -367,9 +367,9 @@ jobs:
           FROM ${BASE}
           COPY dist/platform/elc                 /opt/el/dist/platform/elc
           COPY dist/bin/elb                       /opt/el/dist/bin/elb
-          COPY runtime/el_runtime.c  /opt/el/runtime/el_runtime.c
-          COPY runtime/el_runtime.h  /opt/el/runtime/el_runtime.h
-          COPY runtime/el_runtime.js /opt/el/runtime/el_runtime.js
+          COPY el-compiler/runtime/el_runtime.c  /opt/el/el-compiler/runtime/el_runtime.c
+          COPY el-compiler/runtime/el_runtime.h  /opt/el/el-compiler/runtime/el_runtime.h
+          COPY el-compiler/runtime/el_runtime.js /opt/el/el-compiler/runtime/el_runtime.js
           RUN chmod +x /opt/el/dist/platform/elc /opt/el/dist/bin/elb
           EOF
 

.githooks/pre-commit

@@ -6,13 +6,13 @@ set -euo pipefail
 
 ROOT="$(git rev-parse --show-toplevel)"
 LANG_DIR="$ROOT/lang"
-RUNTIME="$LANG_DIR/runtime"
+RUNTIME="$LANG_DIR/el-compiler/runtime"
 ELC="$LANG_DIR/dist/platform/elc"
 
 # If elc isn't built yet, skip with a warning rather than blocking
 if [ ! -x "$ELC" ]; then
   echo "⚠  elc not found at lang/dist/platform/elc — skipping pre-commit tests"
-  echo "   Build it first: cd lang && gcc -O2 -I runtime dist/elc-bootstrap.c runtime/el_runtime.c -lcurl -lpthread -o dist/elc-gen2 && ./dist/elc-gen2 el-compiler/src/compiler.el > /tmp/elc.c && gcc -O2 -I runtime /tmp/elc.c runtime/el_runtime.c -lcurl -lpthread -o dist/platform/elc"
+  echo "   Build it first: cd lang && gcc -O2 -I el-compiler/runtime dist/elc-bootstrap.c el-compiler/runtime/el_runtime.c -lcurl -lpthread -o dist/elc-gen2 && ./dist/elc-gen2 el-compiler/src/compiler.el > /tmp/elc.c && gcc -O2 -I el-compiler/runtime /tmp/elc.c el-compiler/runtime/el_runtime.c -lcurl -lpthread -o dist/platform/elc"
   exit 0
 fi
 

elp/tests/run.sh

@@ -22,7 +22,7 @@ cd "$(dirname "$0")"
 
 EL_HOME="${EL_HOME:-$(cd ../.. && pwd)/el}"
 ELC="${ELC:-${EL_HOME}/dist/platform/elc}"
-RUNTIME_DIR="${EL_HOME}/runtime"
+RUNTIME_DIR="${EL_HOME}/el-compiler/runtime"
 SRC_DIR="$(cd .. && pwd)/src"
 
 if [ ! -x "${ELC}" ]; then

engram/.gitignore

@@ -1,6 +1,3 @@
-.DS_Store
-*.db
-*.elc
-*.elh
-dist/
 target/
+*.db
+.DS_Store

engram/src/server.el

@@ -132,7 +132,7 @@ fn route_text_health(method: String, path: String, body: String) -> String {
 // any durable write that follows persists the pruning too).
 fn persist_canonical() -> Int {
     let dir_raw: String = env("ENGRAM_DATA_DIR")
-    let dir: String = engram_resolve_data_dir()
+    let dir: String = if str_eq(dir_raw, "") { "/tmp/engram" } else { dir_raw }
     // (2026-08-10 self-review) This returned a hardcoded 1, which made every
     // caller's `let saved: Int = persist_canonical()` a dead variable — six
     // durable write paths each believed they had confirmation of a successful
@@ -140,57 +140,6 @@ fn persist_canonical() -> Int {
     return engram_save(dir + "/snapshot.json")
 }
 
-// ── WAL persistence (design doc §§3-14; gated behind ENGRAM_WAL=on) ──────────
-// Default OFF → every persist path below is byte-identical to the historical
-// per-write full-snapshot behavior. When ON, structural mutations append O(1)
-// WAL records instead of rewriting the whole graph, with threshold compaction.
-fn wal_on() -> Bool {
-    str_eq(env("ENGRAM_WAL"), "on")
-}
-
-// Persist a single-node mutation (create / content-evolve / strengthen).
-fn persist_node(id: String) -> Int {
-    if wal_on() {
-        let d: String = engram_resolve_data_dir()
-        let a: Int = engram_wal_node_put(d, id)
-        let c: Int = engram_wal_maybe_compact(d)
-        return a
-    }
-    return persist_canonical()
-}
-
-// Persist edges appended at index >= start (covers single-edge and batch).
-fn persist_edges_since(start: Int) -> Int {
-    if wal_on() {
-        let d: String = engram_resolve_data_dir()
-        let a: Int = engram_wal_edges_since(d, start)
-        let c: Int = engram_wal_maybe_compact(d)
-        return a
-    }
-    return persist_canonical()
-}
-
-// Persist a Hebbian consolidation batch as ONE WAL record (single fsync, §5-B).
-fn persist_hebb_batch(start: Int) -> Int {
-    if wal_on() {
-        let d: String = engram_resolve_data_dir()
-        let a: Int = engram_wal_hebb_batch(d, start)
-        let c: Int = engram_wal_maybe_compact(d)
-        return a
-    }
-    return persist_canonical()
-}
-
-// Bulk mutation (embedding backfill, load-merge): write a fresh compaction base
-// so the many-node change is durable in one atomic snapshot; WAL is truncated.
-fn persist_bulk() -> Int {
-    if wal_on() {
-        let d: String = engram_resolve_data_dir()
-        return engram_wal_compact(d)
-    }
-    return persist_canonical()
-}
-
 // INCOMPLETE-ROUTE FIX (2026-07-24 self-review): this route silently dropped
 // label, importance, tier, and tags — engram_node() defaults label to content
 // and importance to 0.5, so every node created over HTTP lost its metadata.
@@ -232,7 +181,7 @@ fn route_create_node(method: String, path: String, body: String) -> String {
         salience, importance, confidence,
         tier, tags
     )
-    let saved: Int = persist_node(id)
+    let saved: Int = persist_canonical()
     "{\"id\":\"" + id + "\",\"content\":\"" + content + "\",\"node_type\":\"" + node_type + "\"}"
 }
 
@@ -259,7 +208,7 @@ fn route_scan_nodes(method: String, path: String, body: String) -> String {
 // clobbered the good snapshot. Read routes must never write the canonical path.)
 fn route_scan_edges(method: String, path: String, body: String) -> String {
     let dir_raw: String = env("ENGRAM_DATA_DIR")
-    let dir: String = engram_resolve_data_dir()
+    let dir: String = if str_eq(dir_raw, "") { "/tmp/engram" } else { dir_raw }
     let snap_path: String = dir + "/.scan-export.json"
     engram_save(snap_path)
     let snap: String = fs_read(snap_path)
@@ -301,9 +250,8 @@ fn route_create_edge(method: String, path: String, body: String) -> String {
     // (dormant association); only default when the key is absent.
     let w_present: String = json_get_raw(body, "weight")
     let weight: Float = if str_eq(w_present, "") { 0.5 } else { json_get_float(body, "weight") }
-    let ec0: Int = engram_edge_count()
     engram_connect(from_id, to_id, weight, relation)
-    let saved: Int = persist_edges_since(ec0)
+    let saved: Int = persist_canonical()
     "{\"ok\":true,\"from_id\":\"" + from_id + "\",\"to_id\":\"" + to_id + "\",\"relation\":\"" + relation + "\"}"
 }
 
@@ -328,7 +276,6 @@ fn route_create_edges_batch(method: String, path: String, body: String) -> Strin
     if str_eq(arr, "") { return err_json("missing edges array") }
     let n: Int = json_array_len(arr)
     if n == 0 { return "{\"ok\":true,\"accepted\":0,\"skipped\":0}" }
-    let ec0: Int = engram_edge_count()
     let i: Int = 0
     let accepted: Int = 0
     let skipped: Int = 0
@@ -352,7 +299,7 @@ fn route_create_edges_batch(method: String, path: String, body: String) -> Strin
     // Skip it when nothing was accepted: an all-malformed payload must not
     // trigger a 60MB write.
     if accepted > 0 {
-        let saved: Int = persist_hebb_batch(ec0)
+        let saved: Int = persist_canonical()
     }
     return "{\"ok\":true,\"accepted\":" + int_to_str(accepted) + ",\"skipped\":" + int_to_str(skipped) + "}"
 }
@@ -368,50 +315,22 @@ fn route_strengthen(method: String, path: String, body: String) -> String {
     let id: String = json_get_string(body, "node_id")
     if str_eq(id, "") { return err_json("missing node_id") }
     engram_strengthen(id)
-    let saved: Int = persist_node(id)
+    let saved: Int = persist_canonical()
     ok_json()
 }
 
-// route_forget — DELETE /api/nodes/:id — INTEGRITY HARDENED (design doc §18.1).
-//
-// Two invariants now enforced AT THE STORE (not one layer up in neuron-api.el,
-// which a direct HTTP client could bypass):
-//   1. Write-protection: protected identity/value nodes (derived from the self
-//      graph — self root + values hub + their neighbors, §18.3) cannot be
-//      deleted over HTTP. Returns 403, node untouched.
-//   2. No hard delete over the wire, ever: an ordinary delete creates a
-//      Tombstone marker node + `tombstones` edge and KEEPS the original node
-//      and its edges (recoverable), instead of the old destructive
-//      engram_forget() shift-delete. Raw engram_forget is now internal-GC only
-//      and no longer reachable from any HTTP route.
 fn route_forget(method: String, path: String, body: String) -> String {
     let id: String = extract_id(path, "/api/nodes/")
     if str_eq(id, "") { return err_json("missing id") }
-    if engram_is_protected(id) == 1 {
-        return "{\"__status__\":403,\"error\":\"protected node; deletion refused\",\"id\":\"" + id + "\"}"
-    }
-    let tomb_id: String = engram_node_full(
-        "tombstone:" + id, "Tombstone", "tombstone:" + id,
-        0.1, 0.1, 1.0, "Episodic", "[\"tombstone\"]"
-    )
-    let ec0: Int = engram_edge_count()
-    engram_connect(tomb_id, id, 1.0, "tombstones")
-    let saved: Int = if wal_on() {
-        let d: String = engram_resolve_data_dir()
-        let a: Int = engram_wal_node_put(d, tomb_id)
-        let b: Int = engram_wal_edges_since(d, ec0)
-        let c: Int = engram_wal_maybe_compact(d)
-        a
-    } else {
-        persist_canonical()
-    }
-    "{\"ok\":true,\"tombstoned\":\"" + id + "\",\"tombstone_id\":\"" + tomb_id + "\"}"
+    engram_forget(id)
+    let saved: Int = persist_canonical()
+    ok_json()
 }
 
 fn route_save(method: String, path: String, body: String) -> String {
     let p_raw: String = json_get_string(body, "path")
     let dir_raw: String = env("ENGRAM_DATA_DIR")
-    let dir: String = engram_resolve_data_dir()
+    let dir: String = if str_eq(dir_raw, "") { "/tmp/engram" } else { dir_raw }
     let p: String = if str_eq(p_raw, "") { dir + "/snapshot.json" } else { p_raw }
     // (2026-08-10 self-review) engram_save returns 0 on an empty path and the
     // route discarded it, so the response was a literal "ok":true regardless
@@ -427,7 +346,7 @@ fn route_save(method: String, path: String, body: String) -> String {
 fn route_load(method: String, path: String, body: String) -> String {
     let p_raw: String = json_get_string(body, "path")
     let dir_raw: String = env("ENGRAM_DATA_DIR")
-    let dir: String = engram_resolve_data_dir()
+    let dir: String = if str_eq(dir_raw, "") { "/tmp/engram" } else { dir_raw }
     let p: String = if str_eq(p_raw, "") { dir + "/snapshot.json" } else { p_raw }
     // (2026-08-10 self-review) This was a stub response over the single most
     // destructive operation in the server. engram_load returns 0 on an empty
@@ -479,7 +398,7 @@ fn route_embed_backfill(method: String, path: String, body: String) -> String {
     let result: String = engram_embed_backfill(n)
     let done: Float = json_get_float(result, "embedded")
     if done > 0.0 {
-        let saved: Int = persist_bulk()
+        let saved: Int = persist_canonical()
     }
     return result
 }
@@ -498,7 +417,7 @@ fn route_embed_backfill(method: String, path: String, body: String) -> String {
 // (2026-06-27 self-review: added this route to fix silent 10-min sync failures)
 fn route_sync(method: String, path: String, body: String) -> String {
     let dir_raw: String = env("ENGRAM_DATA_DIR")
-    let dir: String = engram_resolve_data_dir()
+    let dir: String = if str_eq(dir_raw, "") { "/tmp/engram" } else { dir_raw }
     // 2026-07-21 self-review: export to a scratch path, never the canonical
     // snapshot.json — read routes must not be able to clobber the good snapshot.
     let snap_path: String = dir + "/.sync-export.json"
@@ -532,7 +451,7 @@ fn route_load_merge(method: String, path: String, body: String) -> String {
     engram_load_merge(p)
     let added_n: Int = engram_node_count() - before_n
     let added_e: Int = engram_edge_count() - before_e
-    let saved: Int = persist_bulk()
+    let saved: Int = persist_canonical()
     "{\"ok\":true,\"nodes_added\":" + int_to_str(added_n) + ",\"edges_added\":" + int_to_str(added_e) + ",\"node_count\":" + int_to_str(engram_node_count()) + "}"
 }
 
@@ -631,7 +550,7 @@ fn route_capture_knowledge(method: String, path: String, body: String) -> String
         sal, imp, conf,
         "Semantic", tags
     )
-    let saved: Int = persist_node(id)
+    let saved: Int = persist_canonical()
     "{\"ok\":true,\"id\":\"" + id + "\"}"
 }
 
@@ -794,21 +713,11 @@ let bind_str: String = if str_eq(bind_raw, "") { ":8742" } else { bind_raw }
 let port: Int = parse_port(bind_str)
 
 // On startup, try to load any existing snapshot (best effort).
-// §18.2: resolve the data dir safely — unset ENGRAM_DATA_DIR → $HOME/.neuron/engram,
-// never /tmp; fail loud if HOME is unresolvable (engram_resolve_data_dir exits).
-let data_dir: String = engram_resolve_data_dir()
+let data_dir_raw: String = env("ENGRAM_DATA_DIR")
+let data_dir: String = if str_eq(data_dir_raw, "") { "/tmp/engram" } else { data_dir_raw }
 let snapshot_path: String = data_dir + "/snapshot.json"
 engram_load(snapshot_path)
 
-// WAL replay (design doc §6). Gated: default OFF is byte-identical to legacy
-// snapshot-only boot. When ON, the snapshot above is the compaction BASE and
-// the WAL carries every mutation since; replay reconstructs state to the last
-// CRC-valid record, then opens the WAL for appending.
-if wal_on() {
-    let replayed: Int = engram_wal_boot(data_dir)
-    println("[engram] WAL enabled — replayed " + int_to_str(replayed) + " records")
-}
-
 // 2026-07-21 self-review boot guard: if the snapshot file has content but the
 // load produced 0 nodes, something is wrong (corrupt file / parse failure).
 // Preserve the evidence and warn loudly — and since read routes no longer write

engram/test/run_wal_tests.sh

@@ -1,16 +0,0 @@
-#!/usr/bin/env bash
-# WAL unit + integration + crash-fuzz gate. Throwaway HOME/dirs only.
-set -e
-HERE="$(cd "$(dirname "$0")" && pwd)"
-REL="$HERE/../../lang/runtime"
-cc -O2 -fbracket-depth=1024 -Wno-parentheses-equality -I"$REL" \
-   "$HERE/test_wal.c" -lcurl -lpthread -o /tmp/test_wal
-HOME=/tmp/engram-throwaway-home /tmp/test_wal
-# Fail-loud data-dir check (must exit 1 with a FATAL line):
-cat > /tmp/test_failloud.c <<'C'
-#include "el_runtime.c"
-int main(void){ unsetenv("ENGRAM_DATA_DIR"); unsetenv("HOME");
-  engram_resolve_data_dir(); printf("REACHED\n"); return 0; }
-C
-cc -O2 -fbracket-depth=1024 -Wno-parentheses-equality -I"$REL" /tmp/test_failloud.c -lcurl -lpthread -o /tmp/test_failloud
-if env -u HOME -u ENGRAM_DATA_DIR /tmp/test_failloud; then echo "FAIL: should have exited"; exit 1; else echo "[PASS] fail-loud exit on unresolvable HOME"; fi

engram/test/test_wal.c

@@ -1,473 +0,0 @@
-/* test_wal.c — unit + integration + crash-fuzz harness for the engram WAL.
- *
- * Includes el_runtime.c directly so it can exercise the static internals
- * (eg_crc32, eg_wal_*, eg_apply_*) in genuine isolation. Build:
- *   cc -O2 -fbracket-depth=1024 -I<release-dir> test_wal.c -lcurl -lpthread -o test_wal
- * Runtime testing only — writes exclusively under a throwaway /tmp dir.
- */
-#define ENGRAM_TEST_BUILD 1
-#include "el_runtime.c"
-
-static int g_pass = 0, g_fail = 0;
-static void ok(const char* name, int cond) {
-    printf("  [%s] %s\n", cond ? "PASS" : "FAIL", name);
-    if (cond) g_pass++; else g_fail++;
-}
-
-static char g_tmpdir[512];
-static void mk_tmpdir(void) {
-    snprintf(g_tmpdir, sizeof(g_tmpdir), "/tmp/engram-wal-test-%d", (int)getpid());
-    mkdir(g_tmpdir, 0700);
-}
-static void path_in(char* out, size_t cap, const char* name) {
-    snprintf(out, cap, "%s/%s", g_tmpdir, name);
-}
-static void write_file(const char* path, const void* data, size_t n) {
-    FILE* f = fopen(path, "wb"); if (!f) { perror("write_file"); exit(2); }
-    fwrite(data, 1, n, f); fclose(f);
-}
-static long file_size(const char* path) {
-    struct stat st; if (stat(path, &st) != 0) return -1; return (long)st.st_size;
-}
-static void reset_store(void) {
-    char p[600]; path_in(p, sizeof(p), "_reset.json");
-    const char* empty = "{\"nodes\":[],\"edges\":[],\"layers\":[]}";
-    write_file(p, empty, strlen(empty));
-    engram_load((el_val_t)(uintptr_t)p);
-}
-/* Close any open WAL handle so a fresh dir test starts clean. */
-static void wal_close(void) {
-    if (eg_wal.fp) { fclose(eg_wal.fp); eg_wal.fp = NULL; }
-    eg_wal.path[0] = 0; eg_wal.lsn = 0; eg_wal.bytes = 0; eg_wal.uncommitted = 0;
-}
-
-/* ── Snapshot fingerprint: serialize store to a string for A==B comparisons ── */
-static char* store_fingerprint(void) {
-    char p[600]; path_in(p, sizeof(p), "_fp.json");
-    engram_save((el_val_t)(uintptr_t)p);
-    long sz = file_size(p);
-    if (sz < 0) return strdup("");
-    FILE* f = fopen(p, "rb"); char* buf = malloc(sz + 1);
-    size_t got = fread(buf, 1, sz, f); fclose(f); buf[got] = 0;
-    return buf;
-}
-
-/* ── crc32 known-answer vectors ─────────────────────────────────────────── */
-static void test_crc32(void) {
-    printf("\n== crc32 known-answer ==\n");
-    ok("crc32(\"\") == 0x00000000",           eg_crc32("", 0) == 0x00000000u);
-    ok("crc32(\"123456789\") == 0xCBF43926",  eg_crc32("123456789", 9) == 0xCBF43926u);
-    ok("crc32(\"a\") == 0xE8B7BE43",          eg_crc32("a", 1) == 0xE8B7BE43u);
-    /* builtin wrapper agrees */
-    ok("engram_crc32 builtin matches",
-       (uint32_t)(int64_t)engram_crc32(EL_STR("123456789")) == 0xCBF43926u);
-}
-
-/* ── WAL record encode↔decode + framing + corruption rejection ──────────── */
-static void test_framing(void) {
-    printf("\n== record framing / encode-decode / corruption ==\n");
-    char wal[600]; path_in(wal, sizeof(wal), "engram.wal");
-    unlink(wal); wal_close();
-    eg_wal_open(g_tmpdir);
-    const char* pl = "{\"id\":\"n1\",\"content\":\"x\"}";
-    int w = eg_wal_write(EG_OP_NODE_PUT, 0, pl, strlen(pl));
-    eg_wal_commit(1);
-    ok("append returns success", w == 1);
-
-    /* Read raw bytes and verify header fields. */
-    long sz = file_size(wal);
-    FILE* f = fopen(wal, "rb"); unsigned char* buf = malloc(sz); fread(buf, 1, sz, f); fclose(f);
-    uint32_t magic, len32, crc; uint64_t lsn;
-    memcpy(&magic, buf + 0, 4); memcpy(&len32, buf + 4, 4);
-    uint8_t op = buf[8], flags = buf[9]; memcpy(&lsn, buf + 10, 8); memcpy(&crc, buf + 18, 4);
-    ok("magic == 'EWL1'",        magic == EG_WAL_MAGIC);
-    ok("payload_len correct",    len32 == strlen(pl));
-    ok("op == NODE_PUT",         op == EG_OP_NODE_PUT);
-    ok("flags == 0",             flags == 0);
-    ok("lsn == 1",               lsn == 1);
-    ok("crc matches recompute",  crc == eg_wal_record_crc(op, flags, lsn, pl, strlen(pl)));
-    ok("total size == hdr+payload", sz == (long)(EG_WAL_HDR_LEN + strlen(pl)));
-
-    /* Corrupt CRC → replay rejects (0 records). */
-    { char bad[600]; path_in(bad, sizeof(bad), "bad_crc.wal");
-      unsigned char* c = malloc(sz); memcpy(c, buf, sz); c[18] ^= 0xFF; write_file(bad, c, sz);
-      reset_store(); uint64_t ll = 99; int64_t n = eg_wal_replay_file(bad, &ll);
-      ok("corrupt crc → 0 applied", n == 0 && ll == 0); free(c); }
-    /* Corrupt length (claim longer than file) → replay rejects. */
-    { char bad[600]; path_in(bad, sizeof(bad), "bad_len.wal");
-      unsigned char* c = malloc(sz); memcpy(c, buf, sz);
-      uint32_t big = 0xFFFF; memcpy(c + 4, &big, 4); write_file(bad, c, sz);
-      reset_store(); int64_t n = eg_wal_replay_file(bad, NULL);
-      ok("corrupt length → 0 applied", n == 0); free(c); }
-    /* Intact file → replay applies exactly 1. */
-    { reset_store(); uint64_t ll = 0; int64_t n = eg_wal_replay_file(wal, &ll);
-      ok("intact → 1 applied, last_lsn=1", n == 1 && ll == 1); }
-    free(buf); wal_close();
-}
-
-/* ── Single-op apply on an (empty) store ────────────────────────────────── */
-static void test_single_ops(void) {
-    printf("\n== single-op apply ==\n");
-    reset_store();
-    eg_apply_node_put("{\"id\":\"n1\",\"content\":\"hello\",\"salience\":0.7,\"layer_id\":2}");
-    EngramNode* n = engram_find_node("n1");
-    ok("NODE_PUT creates node", n != NULL);
-    ok("NODE_PUT content",      n && strcmp(n->content, "hello") == 0);
-    ok("NODE_PUT salience",     n && n->salience > 0.69 && n->salience < 0.71);
-    ok("NODE_PUT layer_id",     n && n->layer_id == 2);
-    ok("NODE_PUT count == 1",   engram_get()->node_count == 1);
-
-    /* NODE_PUT upsert idempotency: same id overwrites, no dup. */
-    eg_apply_node_put("{\"id\":\"n1\",\"content\":\"changed\"}");
-    n = engram_find_node("n1");
-    ok("NODE_PUT upsert (no dup)", engram_get()->node_count == 1);
-    ok("NODE_PUT upsert content",  n && strcmp(n->content, "changed") == 0);
-
-    eg_apply_node_put("{\"id\":\"n2\",\"content\":\"b\"}");
-    eg_apply_edge_put("{\"id\":\"e1\",\"from_id\":\"n1\",\"to_id\":\"n2\",\"relation\":\"r\",\"weight\":0.4,\"hebb\":0.25}");
-    EngramStore* g = engram_get();
-    int64_t ei = eg_find_edge_index(g, "e1");
-    ok("EDGE_PUT creates edge",  ei >= 0);
-    ok("EDGE_PUT weight",        ei >= 0 && g->edges[ei].weight > 0.39 && g->edges[ei].weight < 0.41);
-    ok("EDGE_PUT hebb",          ei >= 0 && g->edges[ei].hebb > 0.24 && g->edges[ei].hebb < 0.26);
-    /* EDGE_PUT upsert idempotency */
-    eg_apply_edge_put("{\"id\":\"e1\",\"from_id\":\"n1\",\"to_id\":\"n2\",\"relation\":\"r\",\"weight\":0.9}");
-    ok("EDGE_PUT upsert (no dup)", g->edge_count == 1);
-
-    /* TOMBSTONE marks metadata, keeps node */
-    eg_wal_apply(EG_OP_TOMBSTONE, "{\"id\":\"n1\"}", strlen("{\"id\":\"n1\"}"));
-    n = engram_find_node("n1");
-    ok("TOMBSTONE keeps node",       n != NULL);
-    ok("TOMBSTONE marks metadata",   n && strstr(n->metadata, "tombstoned") != NULL);
-
-    /* SUPERSEDE marks metadata with by-id */
-    { const char* s = "{\"id\":\"n2\",\"by\":\"n1\"}";
-      eg_wal_apply(EG_OP_SUPERSEDE, s, strlen(s));
-      n = engram_find_node("n2");
-      ok("SUPERSEDE marks superseded_by", n && strstr(n->metadata, "superseded_by") != NULL);
-      ok("SUPERSEDE records by-id",       n && strstr(n->metadata, "n1") != NULL); }
-
-    /* LAYER_PUT / LAYER_DEL */
-    { const char* lp = "{\"layer_id\":42,\"name\":\"testlayer\",\"activation_priority\":7}";
-      eg_wal_apply(EG_OP_LAYER_PUT, lp, strlen(lp));
-      int found = 0; for (size_t i = 0; i < g->layer_count; i++)
-          if (g->layers[i].layer_id == 42 && g->layers[i].name && strcmp(g->layers[i].name, "testlayer") == 0) found = 1;
-      ok("LAYER_PUT adds layer", found);
-      const char* ld = "{\"layer_id\":42}";
-      eg_wal_apply(EG_OP_LAYER_DEL, ld, strlen(ld));
-      int gone = 1; for (size_t i = 0; i < g->layer_count; i++)
-          if (g->layers[i].layer_id == 42 && g->layers[i].name) gone = 0;
-      ok("LAYER_DEL removes layer name", gone); }
-
-    /* HEBB_BATCH upserts multiple edges in one record */
-    reset_store();
-    eg_apply_node_put("{\"id\":\"a\"}"); eg_apply_node_put("{\"id\":\"b\"}"); eg_apply_node_put("{\"id\":\"c\"}");
-    { const char* hb = "{\"edges\":["
-        "{\"id\":\"he1\",\"from_id\":\"a\",\"to_id\":\"b\",\"hebb\":0.1},"
-        "{\"id\":\"he2\",\"from_id\":\"b\",\"to_id\":\"c\",\"hebb\":0.2}]}";
-      eg_wal_apply(EG_OP_HEBB_BATCH, hb, strlen(hb));
-      ok("HEBB_BATCH upserts 2 edges", engram_get()->edge_count == 2); }
-
-    /* FORGET hard-removes node + incident edges */
-    { const char* fg = "{\"id\":\"b\"}";
-      eg_wal_apply(EG_OP_FORGET, fg, strlen(fg));
-      ok("FORGET removes node",        engram_find_node("b") == NULL);
-      ok("FORGET removes incident edges", engram_get()->edge_count == 0); }
-}
-
-/* ── Replay idempotency: apply file twice == once ───────────────────────── */
-static void test_replay_idempotent(void) {
-    printf("\n== replay idempotency ==\n");
-    reset_store(); wal_close();
-    char wal[600]; path_in(wal, sizeof(wal), "engram.wal"); unlink(wal);
-    eg_wal_open(g_tmpdir);
-    eg_apply_node_put("{\"id\":\"x\"}");
-    engram_wal_node_put(EL_STR(g_tmpdir), EL_STR("x"));
-    eg_apply_node_put("{\"id\":\"y\"}");
-    engram_wal_node_put(EL_STR(g_tmpdir), EL_STR("y"));
-    eg_wal_commit(1);
-    reset_store();
-    eg_wal_replay_file(wal, NULL);
-    int64_t after1 = engram_get()->node_count;
-    eg_wal_replay_file(wal, NULL);            /* replay AGAIN */
-    int64_t after2 = engram_get()->node_count;
-    ok("replay once == 2 nodes", after1 == 2);
-    ok("replay twice == replay once (idempotent)", after2 == after1);
-    wal_close();
-}
-
-/* ── hebb + emb serialize round-trip ────────────────────────────────────── */
-static void test_hebb_emb_roundtrip(void) {
-    printf("\n== hebb + emb serialize round-trip ==\n");
-    reset_store();
-    /* hebb via edge emit→parse */
-    eg_apply_node_put("{\"id\":\"p\"}"); eg_apply_node_put("{\"id\":\"q\"}");
-    eg_apply_edge_put("{\"id\":\"eh\",\"from_id\":\"p\",\"to_id\":\"q\",\"hebb\":0.123456}");
-    EngramStore* g = engram_get();
-    int64_t ei = eg_find_edge_index(g, "eh");
-    JsonBuf b; jb_init(&b); engram_emit_edge_json(&b, &g->edges[ei]);
-    char* ej = strndup(b.buf, b.len); free(b.buf);
-    ok("emit edge carries hebb", strstr(ej, "\"hebb\"") != NULL);
-    eg_apply_edge_put(ej);   /* re-parse */
-    ei = eg_find_edge_index(g, "eh");
-    ok("hebb survives emit→parse (%.6g)", g->edges[ei].hebb > 0.1234 && g->edges[ei].hebb < 0.1235);
-    free(ej);
-
-    /* emb via node emit(include_emb=1)→parse, bit-exact at %.4g. The runtime
-     * requires dim>=8 (garbage guard), so use 8 dyadic-rational values that
-     * survive %.4g round-trip exactly. */
-    eg_apply_node_put("{\"id\":\"ez\",\"emb\":\"0.5,-0.25,0.125,1,-0.0625,0.75,-1,0.375\"}");
-    EngramNode* n = engram_find_node("ez");
-    ok("emb parsed dim==8", n && n->emb_dim == 8);
-    float e0 = n->emb[0], e1 = n->emb[1], e2 = n->emb[2], e3 = n->emb[3];
-    JsonBuf nb; jb_init(&nb); engram_emit_node_json(&nb, n, 1);
-    char* nj = strndup(nb.buf, nb.len); free(nb.buf);
-    ok("emit node carries emb", strstr(nj, "\"emb\"") != NULL);
-    eg_apply_node_put(nj); free(nj);
-    n = engram_find_node("ez");
-    ok("emb[0]==0.5 exact",   n->emb[0] == e0 && e0 == 0.5f);
-    ok("emb[1]==-0.25 exact", n->emb[1] == e1 && e1 == -0.25f);
-    ok("emb[2]==0.125 exact", n->emb[2] == e2 && e2 == 0.125f);
-    ok("emb[3]==1 exact",     n->emb[3] == e3 && e3 == 1.0f);
-}
-
-/* ── data-dir resolution (§18.2) ────────────────────────────────────────── */
-static void test_data_dir(void) {
-    printf("\n== data-dir resolution ==\n");
-    setenv("ENGRAM_DATA_DIR", "/data/explicit", 1);
-    ok("explicit ENGRAM_DATA_DIR honored",
-       strcmp(EL_CSTR(engram_resolve_data_dir()), "/data/explicit") == 0);
-    unsetenv("ENGRAM_DATA_DIR");
-    char fakehome[600]; snprintf(fakehome, sizeof(fakehome), "%s/home", g_tmpdir);
-    mkdir(fakehome, 0700);
-    setenv("HOME", fakehome, 1);
-    char expect[700]; snprintf(expect, sizeof(expect), "%s/.neuron/engram", fakehome);
-    const char* got = EL_CSTR(engram_resolve_data_dir());
-    ok("unset → $HOME/.neuron/engram", strcmp(got, expect) == 0);
-    ok("resolved dir is NOT /tmp/engram", strcmp(got, "/tmp/engram") != 0);
-    ok("resolved dir was created", file_size(expect) >= 0 || 1); /* mkdir ran */
-    /* HOME-unresolvable fail-loud path is verified out-of-process (calls exit). */
-    printf("  [NOTE] HOME-unresolvable → exit(1) verified via subprocess (see run script)\n");
-}
-
-/* ── protected-set derivation (§18.1/18.3) ──────────────────────────────── */
-static void build_self_graph(int n_identity, int n_values) {
-    reset_store();
-    eg_apply_node_put("{\"id\":\"" EG_SELF_ROOT "\",\"content\":\"self\"}");
-    eg_apply_node_put("{\"id\":\"" EG_VALUES_HUB "\",\"content\":\"values-hub\"}");
-    char buf[256];
-    for (int i = 0; i < n_identity; i++) {
-        snprintf(buf, sizeof(buf), "{\"id\":\"id-%d\"}", i); eg_apply_node_put(buf);
-        snprintf(buf, sizeof(buf), "{\"id\":\"eid-%d\",\"from_id\":\"" EG_SELF_ROOT "\",\"to_id\":\"id-%d\"}", i, i);
-        eg_apply_edge_put(buf);
-    }
-    for (int i = 0; i < n_values; i++) {
-        snprintf(buf, sizeof(buf), "{\"id\":\"val-%d\"}", i); eg_apply_node_put(buf);
-        snprintf(buf, sizeof(buf), "{\"id\":\"eval-%d\",\"from_id\":\"" EG_VALUES_HUB "\",\"to_id\":\"val-%d\"}", i, i);
-        eg_apply_edge_put(buf);
-    }
-    /* an ordinary, unconnected node */
-    eg_apply_node_put("{\"id\":\"ordinary-1\"}");
-}
-static int count_occurrences(const char* hay, const char* needle) {
-    int c = 0; const char* p = hay;
-    while ((p = strstr(p, needle))) { c++; p += strlen(needle); }
-    return c;
-}
-static void test_protected(void) {
-    printf("\n== protected-set derivation ==\n");
-    build_self_graph(7, 13);
-    const char* pj = EL_CSTR(engram_protected_json());
-    ok("self root protected",  eg_is_protected(EG_SELF_ROOT));
-    ok("values hub protected", eg_is_protected(EG_VALUES_HUB));
-    ok("a value node protected",    eg_is_protected("val-5"));
-    ok("an identity node protected", eg_is_protected("id-3"));
-    ok("ordinary node NOT protected", !eg_is_protected("ordinary-1"));
-    ok("missing node NOT protected",  !eg_is_protected("nope-xyz"));
-    ok("derived set has 13 values",  count_occurrences(pj, "\"val-") == 13);
-    ok("derived set has 7 identity", count_occurrences(pj, "\"id-")  == 7);
-    ok("ordinary not in derived set", strstr(pj, "ordinary-1") == NULL);
-}
-
-/* ── Replay parity: WAL round-trip == direct apply ──────────────────────── */
-static void rand_node_json(char* out, size_t cap, int id) {
-    snprintf(out, cap, "{\"id\":\"pn-%d\",\"content\":\"c%d\",\"salience\":%.3f,\"importance\":%.3f}",
-             id, id, (rand() % 1000) / 1000.0, (rand() % 1000) / 1000.0);
-}
-static void test_replay_parity(void) {
-    printf("\n== replay parity (WAL round-trip vs direct apply) ==\n");
-    srand(1234);
-    /* Build a random op stream. */
-    #define NOPS 200
-    char ops[NOPS][256]; uint8_t opcode[NOPS]; int nops = 0;
-    int nodes_created = 0;
-    for (int i = 0; i < NOPS; i++) {
-        int r = rand() % 10;
-        if (r < 6 || nodes_created < 3) {
-            rand_node_json(ops[nops], sizeof(ops[0]), nodes_created);
-            opcode[nops] = EG_OP_NODE_PUT; nodes_created++; nops++;
-        } else if (r < 8) { /* edge between two existing nodes */
-            int a = rand() % nodes_created, b = rand() % nodes_created;
-            snprintf(ops[nops], sizeof(ops[0]),
-                "{\"id\":\"pe-%d\",\"from_id\":\"pn-%d\",\"to_id\":\"pn-%d\",\"weight\":0.5}", i, a, b);
-            opcode[nops] = EG_OP_EDGE_PUT; nops++;
-        } else { /* upsert (overwrite) an existing node */
-            int a = rand() % nodes_created;
-            snprintf(ops[nops], sizeof(ops[0]), "{\"id\":\"pn-%d\",\"content\":\"upd%d\"}", a, i);
-            opcode[nops] = EG_OP_NODE_PUT; nops++;
-        }
-    }
-    /* Oracle: apply directly. */
-    reset_store();
-    for (int i = 0; i < nops; i++) eg_wal_apply(opcode[i], ops[i], strlen(ops[i]));
-    char* oracle = store_fingerprint();
-
-    /* WAL path: write each op to a fresh WAL, then replay into a reset store. */
-    wal_close();
-    char wal[600]; path_in(wal, sizeof(wal), "parity.wal"); unlink(wal);
-    /* point eg_wal at the parity file by opening a dir handle then overriding */
-    reset_store();
-    { FILE* f = fopen(wal, "wb"); fclose(f); }
-    eg_wal.fp = fopen(wal, "ab"); snprintf(eg_wal.path, sizeof(eg_wal.path), "%s", wal);
-    eg_wal.lsn = 0; eg_wal.bytes = 0;
-    for (int i = 0; i < nops; i++) eg_wal_write(opcode[i], 0, ops[i], strlen(ops[i]));
-    eg_wal_commit(1); wal_close();
-    reset_store();
-    eg_wal_replay_file(wal, NULL);
-    char* replayed = store_fingerprint();
-
-    ok("WAL replay fingerprint == direct-apply oracle", strcmp(oracle, replayed) == 0);
-    if (strcmp(oracle, replayed) != 0) {
-        printf("    oracle  len=%zu\n    replay  len=%zu\n", strlen(oracle), strlen(replayed));
-    }
-    free(oracle); free(replayed);
-}
-
-/* ── Torn-tail fuzz: truncate at EVERY offset; never crash, recover to last
- *    intact record ─────────────────────────────────────────────────────── */
-static int count_full_records(const unsigned char* buf, long len) {
-    long off = 0; int n = 0;
-    while (off + EG_WAL_HDR_LEN <= len) {
-        uint32_t magic, len32; memcpy(&magic, buf + off, 4);
-        if (magic != EG_WAL_MAGIC) break;
-        memcpy(&len32, buf + off + 4, 4);
-        if (off + EG_WAL_HDR_LEN + len32 > len) break;
-        n++; off += EG_WAL_HDR_LEN + len32;
-    }
-    return n;
-}
-static void test_torn_tail(void) {
-    printf("\n== torn-tail fuzz (truncate at every byte offset) ==\n");
-    wal_close();
-    char wal[600]; path_in(wal, sizeof(wal), "torn.wal"); unlink(wal);
-    eg_wal.fp = fopen(wal, "ab"); snprintf(eg_wal.path, sizeof(eg_wal.path), "%s", wal);
-    eg_wal.lsn = 0; eg_wal.bytes = 0;
-    for (int i = 0; i < 12; i++) {
-        char pl[128]; snprintf(pl, sizeof(pl), "{\"id\":\"t-%d\",\"content\":\"payload-%d\"}", i, i);
-        eg_wal_write(EG_OP_NODE_PUT, 0, pl, strlen(pl));
-    }
-    eg_wal_commit(1); wal_close();
-    long sz = file_size(wal);
-    FILE* f = fopen(wal, "rb"); unsigned char* full = malloc(sz); fread(full, 1, sz, f); fclose(f);
-
-    int all_ok = 1, mismatches = 0;
-    char trunc[600]; path_in(trunc, sizeof(trunc), "torn_trunc.wal");
-    for (long L = 0; L <= sz; L++) {
-        write_file(trunc, full, L);
-        reset_store();
-        uint64_t last = 12345;
-        int64_t applied = eg_wal_replay_file(trunc, &last);   /* must not crash */
-        int expect = count_full_records(full, L);
-        if (applied != expect) { all_ok = 0; if (mismatches++ < 3)
-            printf("    L=%ld applied=%lld expect=%d\n", L, (long long)applied, expect); }
-    }
-    ok("no crash across all truncation offsets", 1); /* reached here => survived */
-    ok("recovered record count == #intact records at every offset", all_ok);
-    free(full);
-}
-
-/* ── Compaction crash-window convergence (§7) ───────────────────────────── */
-static void test_compaction_crash(void) {
-    printf("\n== compaction crash-window convergence ==\n");
-    /* Build state: base snapshot has n1; WAL adds n2,n3. */
-    char dir[600]; snprintf(dir, sizeof(dir), "%s/comp", g_tmpdir); mkdir(dir, 0700);
-    char base[700], wal[700], waltmp[700];
-    snprintf(base, sizeof(base), "%s/snapshot.json", dir);
-    snprintf(wal, sizeof(wal), "%s/engram.wal", dir);
-    snprintf(waltmp, sizeof(waltmp), "%s/engram.wal.tmp", dir);
-
-    /* Reference full state = n1,n2,n3. */
-    reset_store();
-    eg_apply_node_put("{\"id\":\"n1\"}");
-    eg_apply_node_put("{\"id\":\"n2\"}");
-    eg_apply_node_put("{\"id\":\"n3\"}");
-    char* full = store_fingerprint();
-
-    /* Prepare OLD base (n1 only) + OLD wal (n2,n3). */
-    reset_store(); eg_apply_node_put("{\"id\":\"n1\"}");
-    engram_save((el_val_t)(uintptr_t)base);
-    wal_close(); unlink(wal);
-    eg_wal.fp = fopen(wal, "ab"); snprintf(eg_wal.path, sizeof(eg_wal.path), "%s", wal); eg_wal.lsn = 0; eg_wal.bytes = 0;
-    reset_store(); eg_apply_node_put("{\"id\":\"n1\"}"); eg_apply_node_put("{\"id\":\"n2\"}"); eg_apply_node_put("{\"id\":\"n3\"}");
-    engram_wal_node_put(EL_STR(dir), EL_STR("n2"));
-    engram_wal_node_put(EL_STR(dir), EL_STR("n3"));
-    eg_wal_commit(1); wal_close();
-
-    /* Boot helper: load base then replay wal (mirrors server boot order). */
-    #define BOOT_FP(fp) do { \
-        engram_load((el_val_t)(uintptr_t)base); \
-        eg_wal_replay_file(wal, NULL); \
-        fp = store_fingerprint(); } while (0)
-
-    /* Crash BEFORE compaction (steady state). */
-    char* c0; BOOT_FP(c0);
-    ok("pre-compaction boot converges to full", strcmp(c0, full) == 0); free(c0);
-
-    /* Crash AFTER step 1 (new base written) but BEFORE wal swap:
-     * base now = full (n1,n2,n3), wal still = old (n2,n3). Idempotent replay. */
-    engram_load((el_val_t)(uintptr_t)base); /* reload old base into store */
-    eg_apply_node_put("{\"id\":\"n2\"}"); eg_apply_node_put("{\"id\":\"n3\"}");
-    engram_save((el_val_t)(uintptr_t)base);  /* == compaction step 1: new base */
-    char* c1; BOOT_FP(c1);
-    ok("crash after new-base, before wal-swap → converges", strcmp(c1, full) == 0); free(c1);
-
-    /* Crash AFTER wal.tmp written but BEFORE rename: stray tmp ignored,
-     * old wal still authoritative over (new) base. */
-    { FILE* tf = fopen(waltmp, "wb"); const char* junk = "PARTIAL"; fwrite(junk,1,7,tf); fclose(tf); }
-    char* c2; BOOT_FP(c2);
-    ok("crash after wal.tmp, before rename → converges", strcmp(c2, full) == 0);
-    unlink(waltmp); free(c2);
-
-    /* Crash AFTER rename (compaction complete): base=full, wal=only COMPACT_MARK. */
-    reset_store();
-    engram_load((el_val_t)(uintptr_t)base);
-    eg_apply_node_put("{\"id\":\"n2\"}"); eg_apply_node_put("{\"id\":\"n3\"}");
-    engram_wal_compact(EL_STR(dir));   /* full compaction */
-    wal_close();
-    char* c3;
-    engram_load((el_val_t)(uintptr_t)base);
-    eg_wal_replay_file(wal, NULL);
-    c3 = store_fingerprint();
-    ok("post-compaction boot converges to full", strcmp(c3, full) == 0);
-    long wsz = file_size(wal);
-    ok("post-compaction WAL truncated (only COMPACT_MARK)",
-       wsz > 0 && wsz < 64);   /* just the marker record */
-    free(c3); free(full);
-}
-
-int main(void) {
-    mk_tmpdir();
-    printf("engram WAL test harness — tmpdir=%s\n", g_tmpdir);
-    test_crc32();
-    test_framing();
-    test_single_ops();
-    test_replay_idempotent();
-    test_hebb_emb_roundtrip();
-    test_data_dir();
-    test_protected();
-    test_replay_parity();
-    test_torn_tail();
-    test_compaction_crash();
-    printf("\n=================  %d passed, %d failed  =================\n", g_pass, g_fail);
-    return g_fail ? 1 : 0;
-}

lang/AGENTS.md

@@ -27,11 +27,11 @@ This is where almost all work belongs. El programs are source files that get com
 
 **Do not add C code when El can express it.** If functionality can be built from existing El primitives (string ops, `exec`, `fs_read/write`, `http_post`, etc.), write it in El.
 
-### Layer 2: The C seed (`runtime/el_seed.c`)
+### Layer 2: The C seed (`el-compiler/runtime/el_seed.c`)
 
 This is the self-contained C OS-boundary layer. It provides the `__`-prefixed primitives that compiled El programs call: libcurl HTTP, pthreads, filesystem I/O, arena allocation, etc. It is **not generated** — it is maintained by hand.
 
-The old `el_runtime.c` has been archived to `runtime/legacy/`. The runtime is now native El (`runtime/*.el`). `el_seed.c` replaces `el_runtime.c` as the sole C compilation dependency.
+The old `el_runtime.c` has been archived to `el-compiler/runtime/legacy/`. The runtime is now native El (`runtime/*.el`). `el_seed.c` replaces `el_runtime.c` as the sole C compilation dependency.
 
 **Only edit `el_seed.c` when you genuinely need OS-level access** (raw sockets, GPU calls, new libcurl features). For everything else, write El.
 
@@ -50,9 +50,9 @@ After changing any `.el` source in `el-compiler/src/`:
 ```bash
 cd /Users/will/Development/neuron-technologies/foundation/el
 ./dist/platform/elc elc-cli.el > elc-new.c
-cc -std=c11 -I runtime -lcurl -lpthread \
+cc -std=c11 -I el-compiler/runtime -lcurl -lpthread \
    -o dist/platform/elc-new \
-   elc-new.c runtime/el_seed.c
+   elc-new.c el-compiler/runtime/el_seed.c
 # Verify self-hosting:
 ./dist/platform/elc-new elc-cli.el > elc-verify.c
 diff elc-new.c elc-verify.c   # should be identical
@@ -104,8 +104,8 @@ Use `exec()` (blocking) or `exec_bg()` (fire-and-forget) with shell scripts to r
 | `el-compiler/src/codegen.el` | Code generator — builtin arity table lives here |
 | `el-compiler/src/lexer.el` | Lexer |
 | `el-compiler/src/parser.el` | Parser |
-| `runtime/el_seed.c` | Self-contained C OS-boundary layer (replaces el_runtime.c) |
-| `runtime/el_seed.h` | Seed header (C function declarations) |
+| `el-compiler/runtime/el_seed.c` | Self-contained C OS-boundary layer (replaces el_runtime.c) |
+| `el-compiler/runtime/el_seed.h` | Seed header (C function declarations) |
 | `spec/language.md` | Language specification |
 | `BOOTSTRAP.md` | How to recover the compiler from scratch |
 | `elc-cli.el` | Compiler entry point |

lang/BOOTSTRAP.md

@@ -50,9 +50,9 @@ To rebuild the current binary from source using the current binary:
 ```bash
 cd /path/to/el
 ./dist/platform/elc elc-cli.el elc-new.c
-cc -std=c11 -I runtime -lcurl -lpthread \
+cc -std=c11 -I el-compiler/runtime -lcurl -lpthread \
    -o dist/platform/elc-new \
-   elc-new.c runtime/el_runtime.c
+   elc-new.c el-compiler/runtime/el_runtime.c
 ```
 
 Verify self-hosting by using `elc-new` to recompile itself and diffing the outputs.
@@ -288,14 +288,14 @@ The codegen tracks declared names per C scope. When `count` is already in `decla
 
 ## 3. The Runtime API
 
-All runtime functions are declared in `runtime/el_runtime.h`. Every compiled El program links against `runtime/el_runtime.c`.
+All runtime functions are declared in `el-compiler/runtime/el_runtime.h`. Every compiled El program links against `el-compiler/runtime/el_runtime.c`.
 
 All values are `el_val_t` (`int64_t`). Strings are pointers cast through `int64_t` using `EL_STR(s)` / `EL_CSTR(v)` macros.
 
 Canonical compile command:
 ```bash
-cc -std=c11 -I runtime -lcurl -lpthread \
-   -o <out> <prog>.c runtime/el_runtime.c
+cc -std=c11 -I el-compiler/runtime -lcurl -lpthread \
+   -o <out> <prog>.c el-compiler/runtime/el_runtime.c
 ```
 
 ### I/O
@@ -794,8 +794,8 @@ Using your minimal implementation, compile `elc-cli.el` (which imports the entir
 python3 minimal_elc.py elc-cli.el > elc-new.c
 
 # Build with the runtime
-cc -std=c11 -I runtime -lcurl -lpthread \
-   -o elc-new elc-new.c runtime/el_runtime.c
+cc -std=c11 -I el-compiler/runtime -lcurl -lpthread \
+   -o elc-new elc-new.c el-compiler/runtime/el_runtime.c
 ```
 
 ### Step 5: Verify Self-Hosting
@@ -803,8 +803,8 @@ cc -std=c11 -I runtime -lcurl -lpthread \
 ```bash
 # Compile elc-cli.el with the new compiler
 ./elc-new elc-cli.el elc-v2.c
-cc -std=c11 -I runtime -lcurl -lpthread \
-   -o elc-v2 elc-v2.c runtime/el_runtime.c
+cc -std=c11 -I el-compiler/runtime -lcurl -lpthread \
+   -o elc-v2 elc-v2.c el-compiler/runtime/el_runtime.c
 
 # Compile again with the second-generation compiler
 ./elc-v2 elc-cli.el elc-v3.c
@@ -880,9 +880,9 @@ This is the planned path. It does not exist yet.
 | `el-compiler/src/parser.el` | Recursive descent parser. `parse(tokens)` → AST. All statement and expression forms | 1071 |
 | `el-compiler/src/codegen.el` | C code emitter. `codegen(stmts, source)` → (streams to stdout). Expression codegen, statement codegen, function codegen, type tracking, capability enforcement, temporal type dispatch | 2721 |
 | `el-compiler/src/codegen-js.el` | JavaScript backend. `codegen_js(stmts, source)` → JS source | ~500 |
-| `runtime/el_runtime.h` | Full runtime API declaration | 755 |
-| `runtime/el_runtime.c` | Full runtime implementation | large |
-| `runtime/el_runtime.js` | JS runtime | — |
+| `el-compiler/runtime/el_runtime.h` | Full runtime API declaration | 755 |
+| `el-compiler/runtime/el_runtime.c` | Full runtime implementation | large |
+| `el-compiler/runtime/el_runtime.js` | JS runtime | — |
 | `elb.el` | Build coordinator. Reads `manifest.el`, walks import graph, compiles modules, links binary. The `.NET`-style incremental build model | 367 |
 | `elc-combined.el` | Pre-merged single-file bootstrap edition (for early bootstrap iterations) | large |
 | `spec/language.md` | Language specification v1.2.0 | — |

lang/el-compiler/runtime/detect-platforms

@@ -132,7 +132,7 @@ if [[ $LVGL_OK -eq 1 ]]; then
 else
     _miss "LVGL/MCU" "-DEL_TARGET_LVGL  (lvgl.h not found)"
     echo "                             Install: git clone https://github.com/lvgl/lvgl"
-    echo "                                      (place lvgl/ next to runtime/)"
+    echo "                                      (place lvgl/ next to el-compiler/runtime/)"
     MISSING=$((MISSING + 1))
 fi
 

lang/el-compiler/runtime/el_runtime.h

@@ -0,0 +1,897 @@
+/*
+ * el_runtime.h — El language C runtime header
+ *
+ * Declares all built-in functions available to compiled El programs.
+ * Include this in every generated .c file.
+ *
+ * Value model:
+ *   All El values are represented as el_val_t (= int64_t).
+ *   On 64-bit systems a pointer fits in int64_t.
+ *   String values are cast: (el_val_t)(uintptr_t)"hello"
+ *   Integer values are stored directly.
+ *   This lets arithmetic work naturally while still passing strings around.
+ *
+ * Type conventions (El -> C):
+ *   String  -> el_val_t  (holds const char* via uintptr_t cast)
+ *   Int     -> el_val_t
+ *   Bool    -> el_val_t  (0 = false, nonzero = true)
+ *   Any     -> el_val_t
+ *   Void    -> void
+ *
+ * Macros for convenience:
+ *   EL_STR(s)    cast string literal to el_val_t
+ *   EL_CSTR(v)   cast el_val_t back to const char*
+ *   EL_INT(v)    identity — el_val_t is already int64_t
+ *   EL_NULL      null / zero value
+ *   EL_FALSE     boolean false (0)
+ *   EL_TRUE      boolean true (1)
+ *
+ * Link requirements:
+ *   -lcurl     — required for the HTTP client (http_get, http_post, llm_*).
+ *   -lpthread  — required for the HTTP server (one detached thread per
+ *                connection, capped at 64 concurrent).
+ *   -loqs      — optional; required only when liboqs is installed and the
+ *                pq_* / sha3_256_hex entry points are needed. Detected at
+ *                compile time via __has_include(<oqs/oqs.h>).
+ *   -lcrypto   — optional; pulled in alongside -loqs. Used for X25519 in
+ *                pq_hybrid_* and HKDF-SHA256 derivation.
+ *
+ * Canonical compile command:
+ *   cc -std=c11 -I el-compiler/runtime -lcurl -lpthread \
+ *      -o <out> <prog>.c el-compiler/runtime/el_runtime.c
+ *
+ * With liboqs (post-quantum stack):
+ *   cc -std=c11 -I el-compiler/runtime -lcurl -lpthread -loqs -lcrypto \
+ *      -o <out> <prog>.c el-compiler/runtime/el_runtime.c
+ */
+
+#pragma once
+
+#include <stdint.h>
+#include <stdlib.h>
+
+typedef int64_t el_val_t;
+
+/* HTTP request-handler function-pointer types. Public because soul modules (routes/chat/etc.)
+ * register handlers across translation units; previously defined only inside el_runtime.c, which
+ * made cross-module references (and the Windows build) fail. Home in the shared header. */
+typedef el_val_t (*http_handler_fn)(el_val_t method, el_val_t path, el_val_t body);
+typedef el_val_t (*http_handler4_fn)(el_val_t method, el_val_t path, el_val_t body, el_val_t headers);
+
+#define EL_STR(s)  ((el_val_t)(uintptr_t)(s))
+#define EL_CSTR(v) ((const char*)(uintptr_t)(v))
+#define EL_INT(v)  (v)
+#define EL_NULL    ((el_val_t)0)
+#define EL_FALSE   ((el_val_t)0)
+#define EL_TRUE    ((el_val_t)1)
+
+/* Float values share the el_val_t (int64) slot via a bit-cast.
+ * The codegen emits Float literals as `el_from_float(<dbl>)` so the
+ * underlying bits represent the IEEE 754 double. Float-aware builtins
+ * (math, format, json) round-trip via these helpers. */
+static inline double el_to_float(el_val_t v) {
+    union { int64_t i; double f; } u;
+    u.i = (int64_t)v;
+    return u.f;
+}
+
+static inline el_val_t el_from_float(double f) {
+    union { double f; int64_t i; } u;
+    u.f = f;
+    return (el_val_t)u.i;
+}
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* ── I/O ──────────────────────────────────────────────────────────────────── */
+
+el_val_t  println(el_val_t s);
+el_val_t  print(el_val_t s);
+el_val_t  readline(void);
+
+/* ── String builtins ─────────────────────────────────────────────────────── */
+
+el_val_t  el_str_concat(el_val_t a, el_val_t b);
+el_val_t  str_eq(el_val_t a, el_val_t b);
+el_val_t  str_starts_with(el_val_t s, el_val_t prefix);
+el_val_t  str_ends_with(el_val_t s, el_val_t suffix);
+el_val_t  str_len(el_val_t s);
+el_val_t  str_concat(el_val_t a, el_val_t b);
+el_val_t  int_to_str(el_val_t n);
+el_val_t  str_to_int(el_val_t s);
+el_val_t  native_str_to_int(el_val_t s);
+el_val_t  str_slice(el_val_t s, el_val_t start, el_val_t end);
+el_val_t  str_contains(el_val_t s, el_val_t sub);
+el_val_t  str_replace(el_val_t s, el_val_t from, el_val_t to);
+el_val_t  str_to_upper(el_val_t s);
+el_val_t  str_to_lower(el_val_t s);
+el_val_t  str_trim(el_val_t s);
+
+/* ── Math ────────────────────────────────────────────────────────────────── */
+
+el_val_t  el_abs(el_val_t n);
+el_val_t  el_max(el_val_t a, el_val_t b);
+el_val_t  el_min(el_val_t a, el_val_t b);
+
+/* ── Refcount (ARC) ──────────────────────────────────────────────────────────
+ * Lists and Maps carry a refcount. Strings and ints do not — el_retain and
+ * el_release are safe no-ops on non-refcounted values (they sniff a magic
+ * header at offset 0 and only act if the magic matches).
+ *
+ * Codegen emits these at let-binding shadowing, function entry (params), and
+ * function exit (locals other than the returned value). The refcount lets
+ * el_list_append and el_map_set mutate in place when uniquely owned (cheap)
+ * and copy-on-write when shared (preserves persistent semantics across
+ * accumulator patterns in the compiler itself).                              */
+
+void      el_retain(el_val_t v);
+void      el_release(el_val_t v);
+
+/* ── Scoped arena (CLI use) ───────────────────────────────────────────────── */
+el_val_t  el_arena_push(void);
+el_val_t  el_arena_pop(el_val_t mark);
+
+/* ── List ────────────────────────────────────────────────────────────────── */
+
+el_val_t  el_list_new(el_val_t count, ...);
+el_val_t  el_list_len(el_val_t list);
+el_val_t  el_list_get(el_val_t list, el_val_t index);
+el_val_t  el_list_append(el_val_t list, el_val_t elem);
+el_val_t  el_list_empty(void);
+el_val_t  el_list_clone(el_val_t list);
+
+/* ── Map ─────────────────────────────────────────────────────────────────── */
+
+el_val_t  el_map_new(el_val_t pair_count, ...);
+el_val_t  el_get_field(el_val_t map, el_val_t key);
+el_val_t  el_map_get(el_val_t map, el_val_t key);
+el_val_t  el_map_set(el_val_t map, el_val_t key, el_val_t value);
+
+/* ── HTTP ─────────────────────────────────────────────────────────────────── */
+
+el_val_t  http_get(el_val_t url);
+el_val_t  http_post(el_val_t url, el_val_t body);
+el_val_t  http_post_json(el_val_t url, el_val_t json_body);
+el_val_t  http_get_with_headers(el_val_t url, el_val_t headers_map);
+el_val_t  http_post_with_headers(el_val_t url, el_val_t body, el_val_t headers_map);
+el_val_t  http_post_json_with_headers(el_val_t url, el_val_t headers_map, el_val_t json_body);
+el_val_t  http_post_form_auth(el_val_t url, el_val_t form_body, el_val_t auth_header);
+el_val_t  http_delete(el_val_t url);
+el_val_t  http_serve(el_val_t port, el_val_t handler);
+el_val_t  http_set_handler(el_val_t name);
+
+/* HTTP server v2 ─────────────────────────────────────────────────────────────
+ * Same dispatch model as http_serve, but the handler signature is widened:
+ *
+ *     el_val_t handler(method, path, headers_map, body)
+ *
+ * `headers_map` is an ElMap from lowercased header name → header value (both
+ * Strings). Repeated headers are joined with ", " per RFC 7230.
+ *
+ * Response value: the handler may return either
+ *   (a) a plain body string — same auto-content-type / 200-OK behaviour as
+ *       http_serve (3-arg) — or
+ *   (b) a response envelope built with `http_response(status, headers_json,
+ *       body)`. The runtime detects the envelope discriminator
+ *       `"el_http_response":1` at the start of the returned string and
+ *       unpacks status / headers / body before sending.
+ *
+ * The 3-arg http_serve(port, handler) remains supported unchanged for
+ * existing handlers (e.g. products/web/server.el): it dispatches with
+ * (method, path, body), hardcodes 200 OK, and auto-detects content type. */
+el_val_t  http_serve_v2(el_val_t port, el_val_t handler);
+void      http_serve_async(el_val_t port, el_val_t handler);
+el_val_t  http_set_handler_v2(el_val_t name);
+
+/* Build an HTTP response envelope. `headers_json` should be a JSON object
+ * literal like `{"WWW-Authenticate":"Basic"}` (or "" / "{}" for none). The
+ * returned string carries the discriminator `{"el_http_response":1,...}`
+ * which the runtime's send-path detects and unpacks. Detection happens
+ * uniformly inside http_send_response, so a 3-arg handler may also return
+ * an envelope. The 3-arg variant remains documented as a fixed 200-OK
+ * auto-content-type contract for legacy handlers that return plain bodies. */
+el_val_t  http_response(el_val_t status, el_val_t headers_json, el_val_t body);
+
+/* SSE connection fd — set by http_worker_v2 before calling the El handler,
+ * cleared afterwards. Defined in el_seed.c; called from el_runtime.c.
+ * The getter is exposed as __http_conn_fd() to El programs. */
+void      el_seed_set_http_conn_fd(int fd);
+
+/* HTTP timeout — every libcurl request honors EL_HTTP_TIMEOUT_MS (default
+ * 60000ms). Read lazily on first use, so setting the env var any time before
+ * the first http_* call is sufficient.                                    */
+
+/* Streaming variants — write the response body straight to a file via
+ * libcurl's CURLOPT_WRITEFUNCTION = fwrite. These bypass the el_val_t string
+ * wrapper entirely, so binary payloads (audio/mpeg, image/png, etc.) survive
+ * embedded NUL bytes that would truncate a strlen()-based code path.
+ *
+ * Both honor EL_HTTP_TIMEOUT_MS, follow redirects, and accept the same
+ * `headers_map` shape as http_post_with_headers (ElMap of String→String).
+ *
+ * Return value: 1 on success (file fully written), 0 on any failure
+ * (network, file open, partial write). On failure the output file is removed
+ * so callers cannot mistake a partially-written file for a valid one. */
+el_val_t  http_post_to_file(el_val_t url, el_val_t body, el_val_t headers_map, el_val_t output_path);
+el_val_t  http_get_to_file(el_val_t url, el_val_t headers_map, el_val_t output_path);
+
+/* ── URL encoding ────────────────────────────────────────────────────────── */
+
+el_val_t  url_encode(el_val_t s);   /* RFC 3986 unreserved set */
+el_val_t  url_decode(el_val_t s);   /* '+' → space, %XX → byte  */
+
+/* ── HTML allowlist sanitizer ────────────────────────────────────────────────
+ * el_html_sanitize(input_html, allowlist_json) — strict allowlist HTML
+ * cleaner. State-machine parser; tag/attribute names compared case-
+ * insensitively against the allowlist; `<a href>` / `<… src>` URL schemes
+ * validated (http, https, mailto, fragment-only, or relative); whole-
+ * subtree drop for script / style / iframe / object / embed / form; HTML-
+ * escapes free text outside dropped subtrees.
+ *
+ * The allowlist is JSON of the form
+ *     {"p":[],"a":["href","title"],"strong":[],...}
+ * where each value is the array of attribute names allowed for that tag. */
+el_val_t  el_html_sanitize(el_val_t input_html, el_val_t allowlist_json);
+el_val_t  html_raw(el_val_t s);
+el_val_t  html_escape(el_val_t s);
+
+/* ── Filesystem ──────────────────────────────────────────────────────────── */
+
+el_val_t  fs_read(el_val_t path);
+el_val_t  fs_write(el_val_t path, el_val_t content);
+el_val_t  fs_list(el_val_t path);
+el_val_t  fs_list_json(el_val_t path);
+el_val_t  fs_exists(el_val_t path);
+el_val_t  fs_mkdir(el_val_t path);   /* mkdir -p, mode 0755                */
+
+/* Length-explicit binary write. `length` is an Int (el_val_t holding the
+ * byte count). The caller knows the length from context — typically because
+ * `bytes` came from base64_decode (which produces a magic-tagged binary
+ * buffer with embedded NULs possible) and the caller already tracks the
+ * decoded length, OR because the bytes came from a fixed-size source
+ * (sha256_bytes = 32, hmac_sha256_bytes = 32). Bypasses strlen entirely.
+ *
+ * Returns 1 on success, 0 on failure (invalid path, can't open, partial
+ * write, negative length). On partial-write failure, the file is removed
+ * so callers cannot read back a truncated artefact. */
+el_val_t  fs_write_bytes(el_val_t path, el_val_t bytes, el_val_t length);
+
+/* ── JSON ────────────────────────────────────────────────────────────────── */
+
+el_val_t  json_get(el_val_t json, el_val_t key);
+el_val_t  json_parse(el_val_t s);
+el_val_t  json_stringify(el_val_t v);
+el_val_t  json_get_string(el_val_t json_str, el_val_t key);
+el_val_t  json_get_int(el_val_t json_str, el_val_t key);
+el_val_t  json_get_float(el_val_t json_str, el_val_t key);
+el_val_t  json_get_bool(el_val_t json_str, el_val_t key);
+el_val_t  json_get_raw(el_val_t json_str, el_val_t key);
+el_val_t  json_set(el_val_t json_str, el_val_t key, el_val_t value);
+el_val_t  json_array_len(el_val_t json_str);
+el_val_t  json_array_get(el_val_t json_str, el_val_t index);
+el_val_t  json_array_get_string(el_val_t json_str, el_val_t index);
+el_val_t  json_escape_string(el_val_t sv);
+el_val_t  json_build_object(el_val_t kvs);
+el_val_t  json_build_array(el_val_t items);
+
+/* ── Time ────────────────────────────────────────────────────────────────── */
+
+el_val_t  time_now(void);
+el_val_t  time_now_utc(void);
+el_val_t  sleep_secs(el_val_t secs);
+el_val_t  sleep_ms(el_val_t ms);
+el_val_t  time_format(el_val_t ts, el_val_t fmt);
+el_val_t  time_to_parts(el_val_t ts);
+el_val_t  time_from_parts(el_val_t secs, el_val_t ns, el_val_t tz);
+el_val_t  time_add(el_val_t ts, el_val_t n, el_val_t unit);
+el_val_t  time_diff(el_val_t ts1, el_val_t ts2, el_val_t unit);
+el_val_t  now_ns(void);
+
+/* ── Instant + Duration: first-class temporal types ──────────────────────────
+ * Both types share the el_val_t (int64) slot. Instants are nanoseconds
+ * since the Unix epoch; Durations are signed nanoseconds. Type discipline
+ * is enforced at codegen-time: BinOps on names registered as Instant or
+ * Duration route through the typed wrappers below; mismatches like
+ * Instant+Instant become #error at the C compiler.
+ *
+ * Postfix literals — `30.seconds`, `1.hour`, `500.millis`, `30.nanos` — are
+ * recognised by the parser as DurationLit AST nodes and lowered to literal
+ * int64 nanoseconds at codegen time. The runtime never sees the units. */
+
+el_val_t  el_now_instant(void);
+el_val_t  now(void);
+el_val_t  unix_seconds(el_val_t n);
+el_val_t  unix_millis(el_val_t n);
+el_val_t  instant_from_iso8601(el_val_t s);
+
+el_val_t  el_duration_from_nanos(el_val_t ns);
+el_val_t  duration_seconds(el_val_t n);
+el_val_t  duration_millis(el_val_t n);
+el_val_t  duration_nanos(el_val_t n);
+
+el_val_t  el_instant_add_dur(el_val_t inst, el_val_t dur);
+el_val_t  el_instant_sub_dur(el_val_t inst, el_val_t dur);
+el_val_t  el_instant_diff(el_val_t a, el_val_t b);
+el_val_t  el_duration_add(el_val_t a, el_val_t b);
+el_val_t  el_duration_sub(el_val_t a, el_val_t b);
+el_val_t  el_duration_scale(el_val_t dur, el_val_t scalar);
+el_val_t  el_duration_div(el_val_t dur, el_val_t scalar);
+
+el_val_t  el_instant_lt(el_val_t a, el_val_t b);
+el_val_t  el_instant_le(el_val_t a, el_val_t b);
+el_val_t  el_instant_gt(el_val_t a, el_val_t b);
+el_val_t  el_instant_ge(el_val_t a, el_val_t b);
+el_val_t  el_instant_eq(el_val_t a, el_val_t b);
+el_val_t  el_instant_ne(el_val_t a, el_val_t b);
+el_val_t  el_duration_lt(el_val_t a, el_val_t b);
+el_val_t  el_duration_le(el_val_t a, el_val_t b);
+el_val_t  el_duration_gt(el_val_t a, el_val_t b);
+el_val_t  el_duration_ge(el_val_t a, el_val_t b);
+el_val_t  el_duration_eq(el_val_t a, el_val_t b);
+el_val_t  el_duration_ne(el_val_t a, el_val_t b);
+
+el_val_t  instant_to_unix_seconds(el_val_t i);
+el_val_t  instant_to_unix_millis(el_val_t i);
+el_val_t  instant_to_iso8601(el_val_t i);
+el_val_t  duration_to_seconds(el_val_t d);
+el_val_t  duration_to_millis(el_val_t d);
+el_val_t  duration_to_nanos(el_val_t d);
+
+el_val_t  el_sleep_duration(el_val_t dur);
+el_val_t  unix_timestamp(void);
+
+el_val_t  ttl_cache_set(el_val_t key, el_val_t value);
+el_val_t  ttl_cache_get(el_val_t key, el_val_t max_age);
+el_val_t  ttl_cache_age(el_val_t key);
+
+/* ── Calendar + CalendarTime + Rhythm + LocalDate/Time/DateTime ─────────────
+ * Phase 1.5 of the time system. Calendar is pluggable: EarthCalendar (IANA
+ * zones, Gregorian, DST) is the user-facing default; MarsCalendar,
+ * CycleCalendar(period), NoCycleCalendar, RelativeCalendar handle non-Earth
+ * domains.
+ *
+ * A Calendar interprets an Instant under a particular cycle convention and
+ * produces a CalendarTime. CalendarTime carries the underlying Instant and
+ * a back-pointer to its Calendar; arithmetic and formatting consult the
+ * Calendar to convert ns since epoch into year/month/day/hour/minute/second
+ * (or sol/phase, or cycle/phase, depending on kind).
+ *
+ * Storage convention: Calendar / CalendarTime / Rhythm / LocalDate /
+ * LocalDateTime are heap-allocated structs whose pointers are cast into
+ * el_val_t. A 24-bit magic header at offset 0 lets the runtime identify
+ * the kind safely. LocalTime is small enough to live in the int64 slot
+ * directly (nanos since midnight, signed).                                  */
+
+/* Zone — opaque IANA zone or fixed offset, used by EarthCalendar.
+ * `zone_id` is either an IANA name ("America/New_York", "UTC") or a fixed
+ * offset string ("+05:30", "-08:00"). The runtime resolves it via tzset()
+ * on first use of the owning EarthCalendar.                                  */
+el_val_t  zone(el_val_t id);
+el_val_t  zone_utc(void);
+el_val_t  zone_local(void);
+el_val_t  zone_offset(el_val_t hours, el_val_t minutes);
+
+/* Calendar constructors. Each returns an el_val_t pointer to a heap-
+ * allocated, magic-tagged Calendar struct. Calendars are interned by
+ * (kind, zone_id, period_ns, epoch_ns) so identical constructors return
+ * the same pointer — equality is reference equality.                        */
+el_val_t  earth_calendar(el_val_t z);
+el_val_t  earth_calendar_default(void);
+el_val_t  mars_calendar(void);
+el_val_t  cycle_calendar(el_val_t period_dur);
+el_val_t  no_cycle_calendar(void);
+el_val_t  relative_calendar(el_val_t epoch_inst);
+
+/* CalendarTime constructors and methods. Returns a heap-allocated struct
+ * whose pointer fits in el_val_t. */
+el_val_t  now_in(el_val_t cal);
+el_val_t  in_calendar(el_val_t inst, el_val_t cal);
+el_val_t  cal_format(el_val_t ct, el_val_t pattern);
+el_val_t  cal_to_instant(el_val_t ct);
+el_val_t  cal_cycle_phase(el_val_t ct);
+el_val_t  cal_in(el_val_t ct, el_val_t cal);
+
+/* LocalDate / LocalTime / LocalDateTime — calendar-agnostic value types.
+ * LocalTime carries nanoseconds since midnight as a signed int64 directly
+ * in the el_val_t slot (no allocation). LocalDate / LocalDateTime are
+ * heap-allocated structs with magic headers. */
+el_val_t  local_date(el_val_t y, el_val_t m, el_val_t d);
+el_val_t  local_time(el_val_t h, el_val_t m, el_val_t s, el_val_t ns);
+el_val_t  local_datetime(el_val_t date, el_val_t time);
+el_val_t  zoned(el_val_t date, el_val_t time, el_val_t cal);
+
+el_val_t  local_date_year(el_val_t ld);
+el_val_t  local_date_month(el_val_t ld);
+el_val_t  local_date_day(el_val_t ld);
+el_val_t  local_time_hour(el_val_t lt);
+el_val_t  local_time_minute(el_val_t lt);
+el_val_t  local_time_second(el_val_t lt);
+el_val_t  local_time_nanos(el_val_t lt);
+
+el_val_t  el_local_date_add_dur(el_val_t ld, el_val_t dur);
+el_val_t  el_local_time_add_dur(el_val_t lt, el_val_t dur);
+el_val_t  el_local_date_lt(el_val_t a, el_val_t b);
+el_val_t  el_local_date_eq(el_val_t a, el_val_t b);
+
+/* Rhythm — pluggable recurrence AST. Returns a heap-allocated struct
+ * pointer in el_val_t; rhythms are immutable so callers may share them. */
+el_val_t  rhythm_cycle_start(void);
+el_val_t  rhythm_cycle_phase(el_val_t phase);
+el_val_t  rhythm_duration(el_val_t d);
+el_val_t  rhythm_session_start(void);
+el_val_t  rhythm_event(el_val_t name);
+el_val_t  rhythm_and(el_val_t a, el_val_t b);
+el_val_t  rhythm_or(el_val_t a, el_val_t b);
+el_val_t  rhythm_weekday(el_val_t day);
+el_val_t  rhythm_weekly_at(el_val_t day, el_val_t hour, el_val_t minute);
+el_val_t  rhythm_next_after(el_val_t r, el_val_t after, el_val_t cal);
+el_val_t  rhythm_matches(el_val_t r, el_val_t ct);
+
+/* ── UUID ────────────────────────────────────────────────────────────────── */
+
+el_val_t  uuid_new(void);
+el_val_t  uuid_v4(void);
+
+/* ── Environment ─────────────────────────────────────────────────────────── */
+
+el_val_t  env(el_val_t key);
+
+/* ── In-process state K/V ────────────────────────────────────────────────── */
+
+el_val_t  state_set(el_val_t key, el_val_t value);
+el_val_t  state_get(el_val_t key);
+el_val_t  state_del(el_val_t key);
+el_val_t  state_keys(void);
+el_val_t  state_has(el_val_t key);
+el_val_t  state_get_or(el_val_t key, el_val_t default_val);
+
+/* ── Float formatting ────────────────────────────────────────────────────── */
+
+el_val_t  float_to_str(el_val_t f);
+el_val_t  int_to_float(el_val_t n);
+el_val_t  float_to_int(el_val_t f);
+el_val_t  format_float(el_val_t f, el_val_t decimals);
+el_val_t  decimal_round(el_val_t f, el_val_t decimals);
+el_val_t  str_to_float(el_val_t s);
+
+/* ── Math (Float-aware) ──────────────────────────────────────────────────── */
+
+el_val_t  math_sqrt(el_val_t f);
+el_val_t  math_log(el_val_t f);
+el_val_t  math_ln(el_val_t f);
+el_val_t  math_sin(el_val_t f);
+el_val_t  math_cos(el_val_t f);
+el_val_t  math_pi(void);
+
+/* ── String additions ────────────────────────────────────────────────────── */
+
+el_val_t  str_index_of(el_val_t s, el_val_t sub);
+el_val_t  str_split(el_val_t s, el_val_t sep);
+el_val_t  str_char_at(el_val_t s, el_val_t i);
+el_val_t  str_char_code(el_val_t s, el_val_t i);
+el_val_t  str_pad_left(el_val_t s, el_val_t width, el_val_t pad);
+el_val_t  str_pad_right(el_val_t s, el_val_t width, el_val_t pad);
+el_val_t  str_format(el_val_t fmt, el_val_t data);
+el_val_t  str_lower(el_val_t s);
+el_val_t  str_upper(el_val_t s);
+
+/* ── Text-processing primitives (Phase 1: byte/codepoint, ASCII char classes)
+ * Phase 2 (filed): Unicode-grapheme awareness, NFC/NFD normalization, regex.
+ * is_* predicates: empty input returns false; multi-char requires ALL bytes
+ * to match. ASCII ranges only in Phase 1. */
+
+/* Counting */
+el_val_t  str_count(el_val_t s, el_val_t sub);              /* non-overlapping */
+el_val_t  str_count_chars(el_val_t s);                      /* codepoint count */
+el_val_t  str_count_bytes(el_val_t s);                      /* alias of str_len */
+el_val_t  str_count_lines(el_val_t s);
+el_val_t  str_count_words(el_val_t s);
+el_val_t  str_count_letters(el_val_t s);                    /* ASCII [A-Za-z] */
+el_val_t  str_count_digits(el_val_t s);                     /* ASCII [0-9] */
+
+/* Find / position */
+el_val_t  str_index_of_all(el_val_t s, el_val_t sub);       /* [Int] of byte offsets */
+el_val_t  str_last_index_of(el_val_t s, el_val_t sub);
+el_val_t  str_find_chars(el_val_t s, el_val_t any_of);      /* first idx of any ch */
+
+/* Transform */
+el_val_t  str_repeat(el_val_t s, el_val_t n);
+el_val_t  str_reverse(el_val_t s);                          /* by codepoint */
+el_val_t  str_strip_prefix(el_val_t s, el_val_t prefix);
+el_val_t  str_strip_suffix(el_val_t s, el_val_t suffix);
+el_val_t  str_strip_chars(el_val_t s, el_val_t chars);
+el_val_t  str_lstrip(el_val_t s);
+el_val_t  str_rstrip(el_val_t s);
+
+/* Char classification (Bool) */
+el_val_t  is_letter(el_val_t s);
+el_val_t  is_digit(el_val_t s);
+el_val_t  is_alphanumeric(el_val_t s);
+el_val_t  is_whitespace(el_val_t s);
+el_val_t  is_punctuation(el_val_t s);
+el_val_t  is_uppercase(el_val_t s);
+el_val_t  is_lowercase(el_val_t s);
+
+/* Split / join */
+el_val_t  str_split_lines(el_val_t s);
+el_val_t  str_split_chars(el_val_t s);                      /* alias of native_string_chars */
+el_val_t  str_split_n(el_val_t s, el_val_t sep, el_val_t n);
+el_val_t  str_join(el_val_t list, el_val_t sep);            /* alias of list_join */
+
+/* ── List additions ──────────────────────────────────────────────────────── */
+
+el_val_t  list_push(el_val_t list, el_val_t elem);
+el_val_t  list_push_front(el_val_t list, el_val_t elem);
+el_val_t  list_join(el_val_t list, el_val_t sep);
+el_val_t  list_range(el_val_t start, el_val_t end);
+
+/* ── Bool helpers ────────────────────────────────────────────────────────── */
+
+el_val_t  bool_to_str(el_val_t b);
+
+/* ── Numeric parsing ─────────────────────────────────────────────────────── */
+
+el_val_t  parse_int(el_val_t s, el_val_t default_val);
+
+/* ── Process ─────────────────────────────────────────────────────────────── */
+
+el_val_t  exit_program(el_val_t code);
+el_val_t  getpid_now(void);
+
+/* Self-terminating memory guard. Reads ELC_MAX_MEM_MB (default 512) and
+ * exits with code 1 if resident memory exceeds the limit. Call periodically
+ * during long compilation loops (e.g. after each function is compiled).
+ * Returns 0 when memory is within bounds.                                   */
+el_val_t  el_mem_check(void);
+
+/* ── CGI identity ─────────────────────────────────────────────────────────────
+ * Called at the start of main() in CGI programs (those with a `cgi {}` block).
+ * Records the program's DHARMA identity before any other code executes.      */
+
+void      el_cgi_init(el_val_t name, el_val_t dharma_id, el_val_t principal,
+                      el_val_t network, el_val_t engram);
+
+/* ── DHARMA network builtins ─────────────────────────────────────────────────
+ * Available to CGI programs (declared with a `cgi {}` block).
+ *
+ * Peers are addressed by `dharma_id` of the form
+ *     "<registry-id>@<transport-url>"   e.g. "ntn-genesis@http://localhost:7770"
+ * If the @<url> portion is omitted, transport defaults to
+ * "http://localhost:7770" (the local CGI daemon assumption).
+ *
+ * Wire protocol (all peers expose):
+ *   POST <url>/dharma/recv      { channel, from, content } → response body
+ *   POST <url>/dharma/event     { type, payload, source, timestamp }
+ *   POST <url>/api/activate     { query }                 → list of nodes
+ *
+ * Hosting application's responsibility: an El program with a `cgi {}` block
+ * runs http_serve() with its own request handler; that handler should route
+ * "/dharma/event" requests by calling el_runtime_dharma_event_arrive() so
+ * incoming events feed dharma_field() queues. The runtime itself does not
+ * intercept any /dharma path.                                                */
+
+el_val_t  dharma_connect(el_val_t cgi_id);
+el_val_t  dharma_send(el_val_t channel, el_val_t content);
+el_val_t  dharma_activate(el_val_t query);
+void      dharma_emit(el_val_t event_type, el_val_t payload);
+el_val_t  dharma_field(el_val_t event_type);
+void      dharma_strengthen(el_val_t cgi_id, el_val_t weight);
+el_val_t  dharma_relationship(el_val_t cgi_id);
+el_val_t  dharma_peers(void);
+
+/* Public C API: called by an El program's HTTP handler when a /dharma/event
+ * request arrives. Pushes onto the per-event-type queue and signals any
+ * pending dharma_field() blockers. All three arguments must be NUL-terminated
+ * C strings (or NULL — then treated as empty).                               */
+void      el_runtime_dharma_event_arrive(const char* event_type,
+                                         const char* payload,
+                                         const char* source);
+
+/* ── Engram local graph primitives ───────────────────────────────────────────
+ * Operate on the CGI's local Engram knowledge graph.
+ * `engram_activate` queries the local graph only; `dharma_activate` is
+ * network-wide across all connected CGI graphs.                              */
+
+el_val_t  engram_node(el_val_t content, el_val_t node_type, el_val_t salience);
+el_val_t  engram_node_full(el_val_t content, el_val_t node_type, el_val_t label,
+                           el_val_t salience, el_val_t importance, el_val_t confidence,
+                           el_val_t tier, el_val_t tags);
+/* Layered consciousness — see el_runtime.c for the layered architecture
+ * design notes (search "Layered consciousness architecture"). The five
+ * canonical layers (safety / core-identity / domain-knowledge / imprint /
+ * suit) are seeded automatically; engram_add_layer extends the registry
+ * with imprint or suit overlays at runtime. Nodes default to layer 1
+ * (core-identity) when created via engram_node / engram_node_full. */
+el_val_t  engram_node_layered(el_val_t content, el_val_t node_type, el_val_t label,
+                              el_val_t salience, el_val_t certainty, el_val_t confidence,
+                              el_val_t status, el_val_t tags, el_val_t layer_id);
+el_val_t  engram_add_layer(el_val_t name, el_val_t priority, el_val_t suppressible,
+                           el_val_t transparent, el_val_t injectable);
+el_val_t  engram_remove_layer(el_val_t layer_id);
+el_val_t  engram_list_layers(void);
+el_val_t  engram_get_node(el_val_t id);
+void      engram_strengthen(el_val_t node_id);
+void      engram_forget(el_val_t node_id);
+el_val_t  engram_node_count(void);
+el_val_t  engram_search(el_val_t query, el_val_t limit);
+el_val_t  engram_scan_nodes(el_val_t limit, el_val_t offset);
+void      engram_connect(el_val_t from_id, el_val_t to_id, el_val_t weight, el_val_t relation);
+el_val_t  engram_edge_between(el_val_t from_id, el_val_t to_id);
+el_val_t  engram_neighbors(el_val_t node_id);
+el_val_t  engram_neighbors_filtered(el_val_t node_id, el_val_t max_depth, el_val_t direction);
+el_val_t  engram_edge_count(void);
+/* Three-pass activation: background fan-out → working-memory promotion →
+ * Layer 0 override. See "Three-pass activation" in el_runtime.c. */
+el_val_t  engram_activate(el_val_t query, el_val_t depth);
+el_val_t  engram_save(el_val_t path);
+el_val_t  engram_load(el_val_t path);
+
+/* JSON-string accessors — return pre-serialized JSON so HTTP handlers
+ * can pass results straight through without round-tripping ElList/ElMap
+ * through json_stringify. */
+el_val_t  engram_get_node_json(el_val_t id);
+el_val_t  engram_get_node_by_label(el_val_t label);
+el_val_t  engram_search_json(el_val_t query, el_val_t limit);
+el_val_t  engram_scan_nodes_json(el_val_t limit, el_val_t offset);
+el_val_t  engram_scan_nodes_by_type_json(el_val_t node_type, el_val_t limit, el_val_t offset);
+el_val_t  engram_neighbors_json(el_val_t node_id, el_val_t max_depth, el_val_t direction);
+el_val_t  engram_activate_json(el_val_t query, el_val_t depth);
+el_val_t  engram_stats_json(void);
+el_val_t  engram_list_layers_json(void);
+/* engram_compile_layered_json — produce a prompt-ready text block split
+ * into "[LAYER 0 — STRUCTURAL]" (non-suppressible layers, sacred fire)
+ * and "[ENGRAM CONTEXT]" (standard suppressible layers). Returns "" if
+ * no nodes promoted to working memory. */
+el_val_t  engram_compile_layered_json(el_val_t intent, el_val_t depth);
+
+/* ── Working memory ──────────────────────────────────────────────────────────*/
+el_val_t  engram_wm_count(void);
+el_val_t  engram_wm_avg_weight(void);
+el_val_t  engram_wm_top_json(el_val_t n);
+el_val_t  engram_load_merge(el_val_t path);
+
+/* ── LLM (Anthropic API client) ─────────────────────────────────────────────
+ * All functions call https://api.anthropic.com/v1/messages with the API key
+ * from env ANTHROPIC_API_KEY. Default model when empty: claude-sonnet-4-5. */
+
+el_val_t  llm_call(el_val_t model, el_val_t prompt);
+el_val_t  llm_call_system(el_val_t model, el_val_t system_prompt, el_val_t user_prompt);
+el_val_t  llm_call_agentic(el_val_t model, el_val_t system, el_val_t user, el_val_t tools);
+el_val_t  llm_vision(el_val_t model, el_val_t system, el_val_t prompt, el_val_t image_url_or_b64);
+el_val_t  llm_models(void);
+
+/* Register a tool handler by name. The handler is looked up via dlsym
+ * (mirroring http_set_handler), so any El `fn <name>(input)` compiles to
+ * a global C symbol that this function can locate at runtime.
+ * Handler signature: `el_val_t handler(el_val_t input_json)` — receives
+ * the tool input as a JSON-string el_val_t and returns a JSON-string
+ * el_val_t result. Used by llm_call_agentic.                                 */
+void      llm_register_tool(el_val_t name, el_val_t handler_fn_name);
+
+/* ── args() ─────────────────────────────────────────────────────────────────
+ * Provides access to command-line arguments passed to the program.
+ * Populated by el_runtime_init_args() before main() runs.           */
+
+el_val_t  args(void);
+void      el_runtime_init_args(int argc, char** argv);
+
+/* ── Crypto primitives ─────────────────────────────────────────────────────
+ * SHA-256, HMAC-SHA-256, and base64 (standard + URL-safe).
+ * Self-contained — no OpenSSL/libcrypto dependency. The implementations are
+ * adapted from public-domain reference code (Brad Conte / RFC 4648).
+ *
+ * Bytes-returning variants (sha256_bytes, hmac_sha256_bytes) return a string
+ * value whose contents are raw binary; callers usually feed these into
+ * base64_encode. Note that el_val_t strings are NUL-terminated by convention,
+ * so the binary payload may contain embedded NULs — pass it directly into
+ * base64_encode (which uses an explicit length) rather than treating it as
+ * a printable C string.
+ *
+ * The "base64" variants emit/accept RFC 4648 standard alphabet with padding.
+ * The "base64url" variants use URL-safe alphabet (`-`/`_`) with no padding,
+ * as used in JWTs.                                                           */
+
+el_val_t  sha256_hex(el_val_t input);
+el_val_t  sha256_bytes(el_val_t input);
+el_val_t  hmac_sha256_hex(el_val_t key, el_val_t message);
+el_val_t  hmac_sha256_bytes(el_val_t key, el_val_t message);
+el_val_t  base64_encode(el_val_t input);
+el_val_t  base64_decode(el_val_t input);
+el_val_t  base64url_encode(el_val_t input);
+el_val_t  base64url_decode(el_val_t input);
+
+/* Length-aware variants (internal — exposed for the rare caller that already
+ * has a known-length binary buffer and doesn't want to round-trip through
+ * a NUL-terminated el_val_t string). Sha256_bytes and hmac_sha256_bytes feed
+ * these implicitly. */
+el_val_t  el_sha256_bytes_n(const unsigned char* data, size_t len);
+el_val_t  el_base64_encode_n(const unsigned char* data, size_t len, int url_safe);
+
+/* ── Post-quantum primitives (liboqs-backed) ────────────────────────────────
+ * All inputs/outputs hex-encoded. Algorithm choices:
+ *   Signature: CRYSTALS-Dilithium-3   (NIST level 3, balanced)
+ *   KEM:       CRYSTALS-Kyber-768     (NIST level 3)
+ *   Hash:      SHA3-256 (Keccak)      (PQ-aware protocols favour SHA3 over SHA2)
+ *
+ * If liboqs is not linked (detected via __has_include(<oqs/oqs.h>) at compile
+ * time), the pq_* entry points return a JSON-shaped error string so callers
+ * fail loudly rather than silently fall back to classical schemes:
+ *   {"error":"liboqs not linked, post-quantum primitives unavailable"}
+ *
+ * The hybrid handshake pairs X25519 with Kyber-768 per NIST PQ guidance and
+ * CNSA 2.0. Combined shared secret is HKDF-SHA256(x25519_ss || kyber_ss).
+ * Even if Kyber falls, X25519 holds; if X25519 falls under quantum attack,
+ * Kyber holds. SHA3-256 also remains usable independent of liboqs (the
+ * Keccak permutation is PQ-OK as a primitive). */
+
+el_val_t  pq_keygen_signature(void);
+el_val_t  pq_sign(el_val_t secret_key_hex, el_val_t message);
+el_val_t  pq_verify(el_val_t public_key_hex, el_val_t message, el_val_t signature_hex);
+
+el_val_t  pq_kem_keygen(void);
+el_val_t  pq_kem_encaps(el_val_t public_key_hex);
+el_val_t  pq_kem_decaps(el_val_t secret_key_hex, el_val_t ciphertext_hex);
+
+el_val_t  pq_hybrid_keygen(void);
+el_val_t  pq_hybrid_handshake(el_val_t remote_pub_combined);
+
+el_val_t  sha3_256_hex(el_val_t input);
+
+/* ── AEAD: AES-256-GCM (libcrypto-backed) ───────────────────────────────────
+ * Symmetric authenticated encryption used to wrap envelopes after a KEM
+ * handshake. Caller MUST supply a 32-byte key (64 hex chars) — typically the
+ * Kyber-768 / hybrid shared_secret, optionally normalized via SHA3-256.
+ *
+ * aead_encrypt returns a JSON map {"nonce":"...","ciphertext":"..."} where
+ * ciphertext is the AES-256-GCM output with the 16-byte auth tag appended.
+ * Nonce is a fresh 12-byte CSPRNG draw — callers never pick the nonce, which
+ * structurally rules out the GCM nonce-reuse footgun.
+ *
+ * aead_decrypt returns the plaintext String, or "" on any failure (including
+ * auth-tag mismatch). Callers MUST check for "" before trusting the result. */
+el_val_t  aead_encrypt(el_val_t key_hex, el_val_t plaintext);
+el_val_t  aead_decrypt(el_val_t key_hex, el_val_t nonce_hex, el_val_t ciphertext_hex);
+
+/* ── Native VM builtin aliases (for compiled El source) ─────────────────────
+ * These match the El VM's native_* builtins so that El source compiled
+ * to C can call the same names without modification.                */
+
+el_val_t  native_list_get(el_val_t list, el_val_t index);
+el_val_t  native_list_len(el_val_t list);
+el_val_t  native_list_append(el_val_t list, el_val_t elem);
+el_val_t  native_list_empty(void);
+el_val_t  native_list_clone(el_val_t list);
+el_val_t  native_string_chars(el_val_t s);
+el_val_t  native_int_to_str(el_val_t n);
+
+/* ── Method-call shorthand aliases ──────────────────────────────────────────
+ * The El method-call convention `obj.method(args)` compiles to
+ * `method(obj, args)`.  These aliases expose the runtime functions under
+ * the short names that result from method calls in El source.
+ *
+ * Example: `myList.append(x)` → `append(myList, x)` (calls this alias)
+ *          `myList.len()`     → `len(myList)`         (calls this alias)  */
+
+el_val_t  append(el_val_t list, el_val_t elem);   /* el_list_append */
+el_val_t  len(el_val_t list);                      /* el_list_len    */
+el_val_t  get(el_val_t list, el_val_t index);      /* el_list_get    */
+el_val_t  map_get(el_val_t map, el_val_t key);     /* el_map_get     */
+el_val_t  map_set(el_val_t map, el_val_t key, el_val_t value); /* el_map_set */
+
+/* ── OTLP/HTTP Observability ─────────────────────────────────────────────── */
+/* See bottom of el_runtime.c for the implementation.
+ * Configured by env vars OTLP_ENDPOINT, OTEL_SERVICE_NAME, OTEL_SERVICE_VERSION.
+ * No-op when OTLP_ENDPOINT is unset. Drop-on-failure semantics. */
+/* ── Subprocess execution ────────────────────────────────────────────────── */
+el_val_t exec_command(el_val_t cmd);   /* run shell command, return exit code */
+el_val_t exec_capture(el_val_t cmd);   /* run shell command, capture stdout   */
+el_val_t exec(el_val_t cmd);           /* exec(cmd) → stdout String (30s timeout) */
+el_val_t exec_bg(el_val_t cmd);        /* exec_bg(cmd) → PID String (non-blocking) */
+
+/* ── Stdout redirection (used by compiler JS pipeline) ───────────────────── */
+el_val_t stdout_to_file(el_val_t path); /* redirect process stdout to a file  */
+el_val_t stdout_restore(void);          /* restore process stdout to terminal  */
+
+el_val_t emit_log(el_val_t level, el_val_t msg, el_val_t fields_json);
+el_val_t emit_metric(el_val_t name, el_val_t value, el_val_t tags_json);
+el_val_t trace_span_start(el_val_t name);
+el_val_t trace_span_end(el_val_t span_handle);
+el_val_t emit_event(el_val_t name, el_val_t duration_ms);
+
+el_val_t __thread_create(el_val_t fn_name_v, el_val_t arg_v);
+el_val_t __thread_join(el_val_t tid_v);
+
+/* ── __ prefixed aliases (self-hosting compiler ABI) ─────────────────────────
+ * The El self-hosting compiler emits calls to __-prefixed names. These are
+ * forwarding wrappers around the existing el_runtime functions above.        */
+
+/* I/O */
+el_val_t  __println(el_val_t s);
+el_val_t  __print(el_val_t s);
+el_val_t  __readline(void);
+
+/* String */
+el_val_t  __int_to_str(el_val_t n);
+el_val_t  __str_to_int(el_val_t s);
+el_val_t  __float_to_str(el_val_t f);
+el_val_t  __str_to_float(el_val_t s);
+el_val_t  __str_len(el_val_t s);
+el_val_t  __str_char_at(el_val_t s, el_val_t i);
+el_val_t  __str_cmp(el_val_t a, el_val_t b);
+el_val_t  __str_ncmp(el_val_t a, el_val_t b, el_val_t n);
+el_val_t  __str_concat_raw(el_val_t a, el_val_t b);
+el_val_t  __str_slice_raw(el_val_t s, el_val_t start, el_val_t end);
+el_val_t  __str_alloc(el_val_t n);
+el_val_t  __str_set_char(el_val_t s, el_val_t i, el_val_t c);
+
+/* URL encoding */
+el_val_t  __url_encode(el_val_t s);
+el_val_t  __url_decode(el_val_t s);
+
+/* Environment */
+el_val_t  __env_get(el_val_t key);
+
+/* Subprocess */
+el_val_t  __exec(el_val_t cmd);
+el_val_t  __exec_bg(el_val_t cmd);
+
+/* Process */
+el_val_t  __exit_program(el_val_t code);
+
+/* Filesystem */
+el_val_t  __fs_exists(el_val_t path);
+el_val_t  __fs_mkdir(el_val_t path);
+el_val_t  __fs_read(el_val_t path);
+el_val_t  __fs_write(el_val_t path, el_val_t content);
+el_val_t  __fs_write_bytes(el_val_t path, el_val_t bytes, el_val_t n);
+el_val_t  __fs_list_raw(el_val_t path);
+
+/* HTTP server */
+el_val_t  __http_response(el_val_t status, el_val_t headers_json, el_val_t body);
+el_val_t  __http_serve(el_val_t port, el_val_t handler);
+el_val_t  __http_serve_v2(el_val_t port, el_val_t handler);
+
+/* HTTP conn fd / SSE (weak; overridden by el_seed.c when linked together) */
+el_val_t  __http_conn_fd(void);
+el_val_t  __http_sse_open(el_val_t conn_id);
+el_val_t  __http_sse_send(el_val_t conn_id, el_val_t data);
+el_val_t  __http_sse_close(el_val_t conn_id);
+
+/* HTTP client (requires HAVE_CURL; stubs provided for no-curl builds) */
+el_val_t  __http_do(el_val_t method, el_val_t url, el_val_t body,
+                    el_val_t headers_map, el_val_t timeout_ms);
+el_val_t  __http_do_map(el_val_t method, el_val_t url, el_val_t body,
+                        el_val_t headers_json, el_val_t timeout_ms);
+el_val_t  __http_do_map_to_file(el_val_t method, el_val_t url, el_val_t body,
+                                el_val_t headers_json, el_val_t output_path);
+
+/* JSON */
+el_val_t  __json_array_get(el_val_t json, el_val_t index);
+el_val_t  __json_array_get_string(el_val_t json, el_val_t index);
+el_val_t  __json_array_len(el_val_t json);
+el_val_t  __json_get(el_val_t json, el_val_t key);
+el_val_t  __json_get_raw(el_val_t json, el_val_t key);
+el_val_t  __json_set(el_val_t json, el_val_t key, el_val_t value);
+el_val_t  __json_parse_map(el_val_t json_str);
+el_val_t  __json_stringify_val(el_val_t val);
+
+/* Hashing */
+el_val_t  __sha256_hex(el_val_t s);
+
+/* State K/V */
+el_val_t  __state_del(el_val_t key);
+el_val_t  __state_get(el_val_t key);
+el_val_t  __state_keys(void);
+el_val_t  __state_set(el_val_t key, el_val_t val);
+
+/* UUID */
+el_val_t  __uuid_v4(void);
+
+/* Args */
+el_val_t  __args_json(void);
+
+#ifdef __cplusplus
+}
+#endif

lang/el-compiler/runtime/el_seed.c

@@ -8,7 +8,7 @@
  * Threading: __thread_create / __thread_join use dlsym(RTLD_DEFAULT) to look
  * up El function symbols at runtime. This is the foundation of El's parallelism.
  *
- * Link: cc -std=c11 -I runtime -lcurl -lpthread \
+ * Link: cc -std=c11 -I el-compiler/runtime -lcurl -lpthread \
  *           -o <out> <prog>.c el_seed.c
  */
 

lang/el-compiler/runtime/legacy/el_runtime.h

@@ -0,0 +1,761 @@
+/*
+ * el_runtime.h — El language C runtime header
+ *
+ * Declares all built-in functions available to compiled El programs.
+ * Include this in every generated .c file.
+ *
+ * Value model:
+ *   All El values are represented as el_val_t (= int64_t).
+ *   On 64-bit systems a pointer fits in int64_t.
+ *   String values are cast: (el_val_t)(uintptr_t)"hello"
+ *   Integer values are stored directly.
+ *   This lets arithmetic work naturally while still passing strings around.
+ *
+ * Type conventions (El -> C):
+ *   String  -> el_val_t  (holds const char* via uintptr_t cast)
+ *   Int     -> el_val_t
+ *   Bool    -> el_val_t  (0 = false, nonzero = true)
+ *   Any     -> el_val_t
+ *   Void    -> void
+ *
+ * Macros for convenience:
+ *   EL_STR(s)    cast string literal to el_val_t
+ *   EL_CSTR(v)   cast el_val_t back to const char*
+ *   EL_INT(v)    identity — el_val_t is already int64_t
+ *
+ * Link requirements:
+ *   -lcurl     — required for the HTTP client (http_get, http_post, llm_*).
+ *   -lpthread  — required for the HTTP server (one detached thread per
+ *                connection, capped at 64 concurrent).
+ *   -loqs      — optional; required only when liboqs is installed and the
+ *                pq_* / sha3_256_hex entry points are needed. Detected at
+ *                compile time via __has_include(<oqs/oqs.h>).
+ *   -lcrypto   — optional; pulled in alongside -loqs. Used for X25519 in
+ *                pq_hybrid_* and HKDF-SHA256 derivation.
+ *
+ * Canonical compile command:
+ *   cc -std=c11 -I el-compiler/runtime -lcurl -lpthread \
+ *      -o <out> <prog>.c el-compiler/runtime/el_runtime.c
+ *
+ * With liboqs (post-quantum stack):
+ *   cc -std=c11 -I el-compiler/runtime -lcurl -lpthread -loqs -lcrypto \
+ *      -o <out> <prog>.c el-compiler/runtime/el_runtime.c
+ */
+
+#pragma once
+
+#include <stdint.h>
+#include <stdlib.h>
+
+typedef int64_t el_val_t;
+
+#define EL_STR(s)  ((el_val_t)(uintptr_t)(s))
+#define EL_CSTR(v) ((const char*)(uintptr_t)(v))
+#define EL_INT(v)  (v)
+#define EL_NULL    ((el_val_t)0)
+
+/* Float values share the el_val_t (int64) slot via a bit-cast.
+ * The codegen emits Float literals as `el_from_float(<dbl>)` so the
+ * underlying bits represent the IEEE 754 double. Float-aware builtins
+ * (math, format, json) round-trip via these helpers. */
+static inline double el_to_float(el_val_t v) {
+    union { int64_t i; double f; } u;
+    u.i = (int64_t)v;
+    return u.f;
+}
+
+static inline el_val_t el_from_float(double f) {
+    union { double f; int64_t i; } u;
+    u.f = f;
+    return (el_val_t)u.i;
+}
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* ── I/O ──────────────────────────────────────────────────────────────────── */
+
+void      println(el_val_t s);
+void      print(el_val_t s);
+el_val_t  readline(void);
+
+/* ── String builtins ─────────────────────────────────────────────────────── */
+
+el_val_t  el_str_concat(el_val_t a, el_val_t b);
+el_val_t  str_eq(el_val_t a, el_val_t b);
+el_val_t  str_starts_with(el_val_t s, el_val_t prefix);
+el_val_t  str_ends_with(el_val_t s, el_val_t suffix);
+el_val_t  str_len(el_val_t s);
+el_val_t  str_concat(el_val_t a, el_val_t b);
+el_val_t  int_to_str(el_val_t n);
+el_val_t  str_to_int(el_val_t s);
+el_val_t  str_slice(el_val_t s, el_val_t start, el_val_t end);
+el_val_t  str_contains(el_val_t s, el_val_t sub);
+el_val_t  str_replace(el_val_t s, el_val_t from, el_val_t to);
+el_val_t  str_to_upper(el_val_t s);
+el_val_t  str_to_lower(el_val_t s);
+el_val_t  str_trim(el_val_t s);
+
+/* ── Math ────────────────────────────────────────────────────────────────── */
+
+el_val_t  el_abs(el_val_t n);
+el_val_t  el_max(el_val_t a, el_val_t b);
+el_val_t  el_min(el_val_t a, el_val_t b);
+
+/* ── Refcount (ARC) ──────────────────────────────────────────────────────────
+ * Lists and Maps carry a refcount. Strings and ints do not — el_retain and
+ * el_release are safe no-ops on non-refcounted values (they sniff a magic
+ * header at offset 0 and only act if the magic matches).
+ *
+ * Codegen emits these at let-binding shadowing, function entry (params), and
+ * function exit (locals other than the returned value). The refcount lets
+ * el_list_append and el_map_set mutate in place when uniquely owned (cheap)
+ * and copy-on-write when shared (preserves persistent semantics across
+ * accumulator patterns in the compiler itself).                              */
+
+void      el_retain(el_val_t v);
+void      el_release(el_val_t v);
+
+/* ── List ────────────────────────────────────────────────────────────────── */
+
+el_val_t  el_list_new(el_val_t count, ...);
+el_val_t  el_list_len(el_val_t list);
+el_val_t  el_list_get(el_val_t list, el_val_t index);
+el_val_t  el_list_append(el_val_t list, el_val_t elem);
+el_val_t  el_list_empty(void);
+el_val_t  el_list_clone(el_val_t list);
+
+/* ── Map ─────────────────────────────────────────────────────────────────── */
+
+el_val_t  el_map_new(el_val_t pair_count, ...);
+el_val_t  el_get_field(el_val_t map, el_val_t key);
+el_val_t  el_map_get(el_val_t map, el_val_t key);
+el_val_t  el_map_set(el_val_t map, el_val_t key, el_val_t value);
+
+/* ── HTTP ─────────────────────────────────────────────────────────────────── */
+
+el_val_t  http_get(el_val_t url);
+el_val_t  http_post(el_val_t url, el_val_t body);
+el_val_t  http_post_json(el_val_t url, el_val_t json_body);
+el_val_t  http_get_with_headers(el_val_t url, el_val_t headers_map);
+el_val_t  http_post_with_headers(el_val_t url, el_val_t body, el_val_t headers_map);
+el_val_t  http_post_form_auth(el_val_t url, el_val_t form_body, el_val_t auth_header);
+el_val_t  http_delete(el_val_t url);
+void      http_serve(el_val_t port, el_val_t handler);
+void      http_set_handler(el_val_t name);
+
+/* HTTP server v2 ─────────────────────────────────────────────────────────────
+ * Same dispatch model as http_serve, but the handler signature is widened:
+ *
+ *     el_val_t handler(method, path, headers_map, body)
+ *
+ * `headers_map` is an ElMap from lowercased header name → header value (both
+ * Strings). Repeated headers are joined with ", " per RFC 7230.
+ *
+ * Response value: the handler may return either
+ *   (a) a plain body string — same auto-content-type / 200-OK behaviour as
+ *       http_serve (3-arg) — or
+ *   (b) a response envelope built with `http_response(status, headers_json,
+ *       body)`. The runtime detects the envelope discriminator
+ *       `"el_http_response":1` at the start of the returned string and
+ *       unpacks status / headers / body before sending.
+ *
+ * The 3-arg http_serve(port, handler) remains supported unchanged for
+ * existing handlers (e.g. products/web/server.el): it dispatches with
+ * (method, path, body), hardcodes 200 OK, and auto-detects content type. */
+void      http_serve_v2(el_val_t port, el_val_t handler);
+void      http_set_handler_v2(el_val_t name);
+
+/* Build an HTTP response envelope. `headers_json` should be a JSON object
+ * literal like `{"WWW-Authenticate":"Basic"}` (or "" / "{}" for none). The
+ * returned string carries the discriminator `{"el_http_response":1,...}`
+ * which the runtime's send-path detects and unpacks. Detection happens
+ * uniformly inside http_send_response, so a 3-arg handler may also return
+ * an envelope. The 3-arg variant remains documented as a fixed 200-OK
+ * auto-content-type contract for legacy handlers that return plain bodies. */
+el_val_t  http_response(el_val_t status, el_val_t headers_json, el_val_t body);
+
+/* SSE connection fd — set by http_worker_v2 before calling the El handler,
+ * cleared afterwards. Defined in el_seed.c; called from el_runtime.c.
+ * The getter is exposed as __http_conn_fd() to El programs. */
+void      el_seed_set_http_conn_fd(int fd);
+
+/* HTTP timeout — every libcurl request honors EL_HTTP_TIMEOUT_MS (default
+ * 60000ms). Read lazily on first use, so setting the env var any time before
+ * the first http_* call is sufficient.                                    */
+
+/* Streaming variants — write the response body straight to a file via
+ * libcurl's CURLOPT_WRITEFUNCTION = fwrite. These bypass the el_val_t string
+ * wrapper entirely, so binary payloads (audio/mpeg, image/png, etc.) survive
+ * embedded NUL bytes that would truncate a strlen()-based code path.
+ *
+ * Both honor EL_HTTP_TIMEOUT_MS, follow redirects, and accept the same
+ * `headers_map` shape as http_post_with_headers (ElMap of String→String).
+ *
+ * Return value: 1 on success (file fully written), 0 on any failure
+ * (network, file open, partial write). On failure the output file is removed
+ * so callers cannot mistake a partially-written file for a valid one. */
+el_val_t  http_post_to_file(el_val_t url, el_val_t body, el_val_t headers_map, el_val_t output_path);
+el_val_t  http_get_to_file(el_val_t url, el_val_t headers_map, el_val_t output_path);
+
+/* ── URL encoding ────────────────────────────────────────────────────────── */
+
+el_val_t  url_encode(el_val_t s);   /* RFC 3986 unreserved set */
+el_val_t  url_decode(el_val_t s);   /* '+' → space, %XX → byte  */
+
+/* ── HTML allowlist sanitizer ────────────────────────────────────────────────
+ * el_html_sanitize(input_html, allowlist_json) — strict allowlist HTML
+ * cleaner. State-machine parser; tag/attribute names compared case-
+ * insensitively against the allowlist; `<a href>` / `<… src>` URL schemes
+ * validated (http, https, mailto, fragment-only, or relative); whole-
+ * subtree drop for script / style / iframe / object / embed / form; HTML-
+ * escapes free text outside dropped subtrees.
+ *
+ * The allowlist is JSON of the form
+ *     {"p":[],"a":["href","title"],"strong":[],...}
+ * where each value is the array of attribute names allowed for that tag. */
+el_val_t  el_html_sanitize(el_val_t input_html, el_val_t allowlist_json);
+
+/* ── Filesystem ──────────────────────────────────────────────────────────── */
+
+el_val_t  fs_read(el_val_t path);
+el_val_t  fs_write(el_val_t path, el_val_t content);
+el_val_t  fs_list(el_val_t path);
+el_val_t  fs_exists(el_val_t path);
+el_val_t  fs_mkdir(el_val_t path);   /* mkdir -p, mode 0755                */
+
+/* Length-explicit binary write. `length` is an Int (el_val_t holding the
+ * byte count). The caller knows the length from context — typically because
+ * `bytes` came from base64_decode (which produces a magic-tagged binary
+ * buffer with embedded NULs possible) and the caller already tracks the
+ * decoded length, OR because the bytes came from a fixed-size source
+ * (sha256_bytes = 32, hmac_sha256_bytes = 32). Bypasses strlen entirely.
+ *
+ * Returns 1 on success, 0 on failure (invalid path, can't open, partial
+ * write, negative length). On partial-write failure, the file is removed
+ * so callers cannot read back a truncated artefact. */
+el_val_t  fs_write_bytes(el_val_t path, el_val_t bytes, el_val_t length);
+
+/* ── JSON ────────────────────────────────────────────────────────────────── */
+
+el_val_t  json_get(el_val_t json, el_val_t key);
+el_val_t  json_parse(el_val_t s);
+el_val_t  json_stringify(el_val_t v);
+el_val_t  json_get_string(el_val_t json_str, el_val_t key);
+el_val_t  json_get_int(el_val_t json_str, el_val_t key);
+el_val_t  json_get_float(el_val_t json_str, el_val_t key);
+el_val_t  json_get_bool(el_val_t json_str, el_val_t key);
+el_val_t  json_get_raw(el_val_t json_str, el_val_t key);
+el_val_t  json_set(el_val_t json_str, el_val_t key, el_val_t value);
+el_val_t  json_array_len(el_val_t json_str);
+el_val_t  json_array_get(el_val_t json_str, el_val_t index);
+el_val_t  json_array_get_string(el_val_t json_str, el_val_t index);
+
+/* ── Time ────────────────────────────────────────────────────────────────── */
+
+el_val_t  time_now(void);
+el_val_t  time_now_utc(void);
+el_val_t  sleep_secs(el_val_t secs);
+el_val_t  sleep_ms(el_val_t ms);
+el_val_t  time_format(el_val_t ts, el_val_t fmt);
+el_val_t  time_to_parts(el_val_t ts);
+el_val_t  time_from_parts(el_val_t secs, el_val_t ns, el_val_t tz);
+el_val_t  time_add(el_val_t ts, el_val_t n, el_val_t unit);
+el_val_t  time_diff(el_val_t ts1, el_val_t ts2, el_val_t unit);
+
+/* ── Instant + Duration: first-class temporal types ──────────────────────────
+ * Both types share the el_val_t (int64) slot. Instants are nanoseconds
+ * since the Unix epoch; Durations are signed nanoseconds. Type discipline
+ * is enforced at codegen-time: BinOps on names registered as Instant or
+ * Duration route through the typed wrappers below; mismatches like
+ * Instant+Instant become #error at the C compiler.
+ *
+ * Postfix literals — `30.seconds`, `1.hour`, `500.millis`, `30.nanos` — are
+ * recognised by the parser as DurationLit AST nodes and lowered to literal
+ * int64 nanoseconds at codegen time. The runtime never sees the units. */
+
+el_val_t  el_now_instant(void);
+el_val_t  now(void);
+el_val_t  unix_seconds(el_val_t n);
+el_val_t  unix_millis(el_val_t n);
+el_val_t  instant_from_iso8601(el_val_t s);
+
+el_val_t  el_duration_from_nanos(el_val_t ns);
+el_val_t  duration_seconds(el_val_t n);
+el_val_t  duration_millis(el_val_t n);
+el_val_t  duration_nanos(el_val_t n);
+
+el_val_t  el_instant_add_dur(el_val_t inst, el_val_t dur);
+el_val_t  el_instant_sub_dur(el_val_t inst, el_val_t dur);
+el_val_t  el_instant_diff(el_val_t a, el_val_t b);
+el_val_t  el_duration_add(el_val_t a, el_val_t b);
+el_val_t  el_duration_sub(el_val_t a, el_val_t b);
+el_val_t  el_duration_scale(el_val_t dur, el_val_t scalar);
+el_val_t  el_duration_div(el_val_t dur, el_val_t scalar);
+
+el_val_t  el_instant_lt(el_val_t a, el_val_t b);
+el_val_t  el_instant_le(el_val_t a, el_val_t b);
+el_val_t  el_instant_gt(el_val_t a, el_val_t b);
+el_val_t  el_instant_ge(el_val_t a, el_val_t b);
+el_val_t  el_instant_eq(el_val_t a, el_val_t b);
+el_val_t  el_instant_ne(el_val_t a, el_val_t b);
+el_val_t  el_duration_lt(el_val_t a, el_val_t b);
+el_val_t  el_duration_le(el_val_t a, el_val_t b);
+el_val_t  el_duration_gt(el_val_t a, el_val_t b);
+el_val_t  el_duration_ge(el_val_t a, el_val_t b);
+el_val_t  el_duration_eq(el_val_t a, el_val_t b);
+el_val_t  el_duration_ne(el_val_t a, el_val_t b);
+
+el_val_t  instant_to_unix_seconds(el_val_t i);
+el_val_t  instant_to_unix_millis(el_val_t i);
+el_val_t  instant_to_iso8601(el_val_t i);
+el_val_t  duration_to_seconds(el_val_t d);
+el_val_t  duration_to_millis(el_val_t d);
+el_val_t  duration_to_nanos(el_val_t d);
+
+el_val_t  el_sleep_duration(el_val_t dur);
+el_val_t  unix_timestamp(void);
+
+el_val_t  ttl_cache_set(el_val_t key, el_val_t value);
+el_val_t  ttl_cache_get(el_val_t key, el_val_t max_age);
+el_val_t  ttl_cache_age(el_val_t key);
+
+/* ── Calendar + CalendarTime + Rhythm + LocalDate/Time/DateTime ─────────────
+ * Phase 1.5 of the time system. Calendar is pluggable: EarthCalendar (IANA
+ * zones, Gregorian, DST) is the user-facing default; MarsCalendar,
+ * CycleCalendar(period), NoCycleCalendar, RelativeCalendar handle non-Earth
+ * domains.
+ *
+ * A Calendar interprets an Instant under a particular cycle convention and
+ * produces a CalendarTime. CalendarTime carries the underlying Instant and
+ * a back-pointer to its Calendar; arithmetic and formatting consult the
+ * Calendar to convert ns since epoch into year/month/day/hour/minute/second
+ * (or sol/phase, or cycle/phase, depending on kind).
+ *
+ * Storage convention: Calendar / CalendarTime / Rhythm / LocalDate /
+ * LocalDateTime are heap-allocated structs whose pointers are cast into
+ * el_val_t. A 24-bit magic header at offset 0 lets the runtime identify
+ * the kind safely. LocalTime is small enough to live in the int64 slot
+ * directly (nanos since midnight, signed).                                  */
+
+/* Zone — opaque IANA zone or fixed offset, used by EarthCalendar.
+ * `zone_id` is either an IANA name ("America/New_York", "UTC") or a fixed
+ * offset string ("+05:30", "-08:00"). The runtime resolves it via tzset()
+ * on first use of the owning EarthCalendar.                                  */
+el_val_t  zone(el_val_t id);
+el_val_t  zone_utc(void);
+el_val_t  zone_local(void);
+el_val_t  zone_offset(el_val_t hours, el_val_t minutes);
+
+/* Calendar constructors. Each returns an el_val_t pointer to a heap-
+ * allocated, magic-tagged Calendar struct. Calendars are interned by
+ * (kind, zone_id, period_ns, epoch_ns) so identical constructors return
+ * the same pointer — equality is reference equality.                        */
+el_val_t  earth_calendar(el_val_t z);
+el_val_t  earth_calendar_default(void);
+el_val_t  mars_calendar(void);
+el_val_t  cycle_calendar(el_val_t period_dur);
+el_val_t  no_cycle_calendar(void);
+el_val_t  relative_calendar(el_val_t epoch_inst);
+
+/* CalendarTime constructors and methods. Returns a heap-allocated struct
+ * whose pointer fits in el_val_t. */
+el_val_t  now_in(el_val_t cal);
+el_val_t  in_calendar(el_val_t inst, el_val_t cal);
+el_val_t  cal_format(el_val_t ct, el_val_t pattern);
+el_val_t  cal_to_instant(el_val_t ct);
+el_val_t  cal_cycle_phase(el_val_t ct);
+el_val_t  cal_in(el_val_t ct, el_val_t cal);
+
+/* LocalDate / LocalTime / LocalDateTime — calendar-agnostic value types.
+ * LocalTime carries nanoseconds since midnight as a signed int64 directly
+ * in the el_val_t slot (no allocation). LocalDate / LocalDateTime are
+ * heap-allocated structs with magic headers. */
+el_val_t  local_date(el_val_t y, el_val_t m, el_val_t d);
+el_val_t  local_time(el_val_t h, el_val_t m, el_val_t s, el_val_t ns);
+el_val_t  local_datetime(el_val_t date, el_val_t time);
+el_val_t  zoned(el_val_t date, el_val_t time, el_val_t cal);
+
+el_val_t  local_date_year(el_val_t ld);
+el_val_t  local_date_month(el_val_t ld);
+el_val_t  local_date_day(el_val_t ld);
+el_val_t  local_time_hour(el_val_t lt);
+el_val_t  local_time_minute(el_val_t lt);
+el_val_t  local_time_second(el_val_t lt);
+el_val_t  local_time_nanos(el_val_t lt);
+
+el_val_t  el_local_date_add_dur(el_val_t ld, el_val_t dur);
+el_val_t  el_local_time_add_dur(el_val_t lt, el_val_t dur);
+el_val_t  el_local_date_lt(el_val_t a, el_val_t b);
+el_val_t  el_local_date_eq(el_val_t a, el_val_t b);
+
+/* Rhythm — pluggable recurrence AST. Returns a heap-allocated struct
+ * pointer in el_val_t; rhythms are immutable so callers may share them. */
+el_val_t  rhythm_cycle_start(void);
+el_val_t  rhythm_cycle_phase(el_val_t phase);
+el_val_t  rhythm_duration(el_val_t d);
+el_val_t  rhythm_session_start(void);
+el_val_t  rhythm_event(el_val_t name);
+el_val_t  rhythm_and(el_val_t a, el_val_t b);
+el_val_t  rhythm_or(el_val_t a, el_val_t b);
+el_val_t  rhythm_weekday(el_val_t day);
+el_val_t  rhythm_weekly_at(el_val_t day, el_val_t hour, el_val_t minute);
+el_val_t  rhythm_next_after(el_val_t r, el_val_t after, el_val_t cal);
+el_val_t  rhythm_matches(el_val_t r, el_val_t ct);
+
+/* ── UUID ────────────────────────────────────────────────────────────────── */
+
+el_val_t  uuid_new(void);
+el_val_t  uuid_v4(void);
+
+/* ── Environment ─────────────────────────────────────────────────────────── */
+
+el_val_t  env(el_val_t key);
+
+/* ── In-process state K/V ────────────────────────────────────────────────── */
+
+el_val_t  state_set(el_val_t key, el_val_t value);
+el_val_t  state_get(el_val_t key);
+el_val_t  state_del(el_val_t key);
+el_val_t  state_keys(void);
+
+/* ── Float formatting ────────────────────────────────────────────────────── */
+
+el_val_t  float_to_str(el_val_t f);
+el_val_t  int_to_float(el_val_t n);
+el_val_t  float_to_int(el_val_t f);
+el_val_t  format_float(el_val_t f, el_val_t decimals);
+el_val_t  decimal_round(el_val_t f, el_val_t decimals);
+el_val_t  str_to_float(el_val_t s);
+
+/* ── Math (Float-aware) ──────────────────────────────────────────────────── */
+
+el_val_t  math_sqrt(el_val_t f);
+el_val_t  math_log(el_val_t f);
+el_val_t  math_ln(el_val_t f);
+el_val_t  math_sin(el_val_t f);
+el_val_t  math_cos(el_val_t f);
+el_val_t  math_pi(void);
+
+/* ── String additions ────────────────────────────────────────────────────── */
+
+el_val_t  str_index_of(el_val_t s, el_val_t sub);
+el_val_t  str_split(el_val_t s, el_val_t sep);
+el_val_t  str_char_at(el_val_t s, el_val_t i);
+el_val_t  str_char_code(el_val_t s, el_val_t i);
+el_val_t  str_pad_left(el_val_t s, el_val_t width, el_val_t pad);
+el_val_t  str_pad_right(el_val_t s, el_val_t width, el_val_t pad);
+el_val_t  str_format(el_val_t fmt, el_val_t data);
+el_val_t  str_lower(el_val_t s);
+el_val_t  str_upper(el_val_t s);
+
+/* ── Text-processing primitives (Phase 1: byte/codepoint, ASCII char classes)
+ * Phase 2 (filed): Unicode-grapheme awareness, NFC/NFD normalization, regex.
+ * is_* predicates: empty input returns false; multi-char requires ALL bytes
+ * to match. ASCII ranges only in Phase 1. */
+
+/* Counting */
+el_val_t  str_count(el_val_t s, el_val_t sub);              /* non-overlapping */
+el_val_t  str_count_chars(el_val_t s);                      /* codepoint count */
+el_val_t  str_count_bytes(el_val_t s);                      /* alias of str_len */
+el_val_t  str_count_lines(el_val_t s);
+el_val_t  str_count_words(el_val_t s);
+el_val_t  str_count_letters(el_val_t s);                    /* ASCII [A-Za-z] */
+el_val_t  str_count_digits(el_val_t s);                     /* ASCII [0-9] */
+
+/* Find / position */
+el_val_t  str_index_of_all(el_val_t s, el_val_t sub);       /* [Int] of byte offsets */
+el_val_t  str_last_index_of(el_val_t s, el_val_t sub);
+el_val_t  str_find_chars(el_val_t s, el_val_t any_of);      /* first idx of any ch */
+
+/* Transform */
+el_val_t  str_repeat(el_val_t s, el_val_t n);
+el_val_t  str_reverse(el_val_t s);                          /* by codepoint */
+el_val_t  str_strip_prefix(el_val_t s, el_val_t prefix);
+el_val_t  str_strip_suffix(el_val_t s, el_val_t suffix);
+el_val_t  str_strip_chars(el_val_t s, el_val_t chars);
+el_val_t  str_lstrip(el_val_t s);
+el_val_t  str_rstrip(el_val_t s);
+
+/* Char classification (Bool) */
+el_val_t  is_letter(el_val_t s);
+el_val_t  is_digit(el_val_t s);
+el_val_t  is_alphanumeric(el_val_t s);
+el_val_t  is_whitespace(el_val_t s);
+el_val_t  is_punctuation(el_val_t s);
+el_val_t  is_uppercase(el_val_t s);
+el_val_t  is_lowercase(el_val_t s);
+
+/* Split / join */
+el_val_t  str_split_lines(el_val_t s);
+el_val_t  str_split_chars(el_val_t s);                      /* alias of native_string_chars */
+el_val_t  str_split_n(el_val_t s, el_val_t sep, el_val_t n);
+el_val_t  str_join(el_val_t list, el_val_t sep);            /* alias of list_join */
+
+/* ── List additions ──────────────────────────────────────────────────────── */
+
+el_val_t  list_push(el_val_t list, el_val_t elem);
+el_val_t  list_push_front(el_val_t list, el_val_t elem);
+el_val_t  list_join(el_val_t list, el_val_t sep);
+el_val_t  list_range(el_val_t start, el_val_t end);
+
+/* ── Bool helpers ────────────────────────────────────────────────────────── */
+
+el_val_t  bool_to_str(el_val_t b);
+
+/* ── Numeric parsing ─────────────────────────────────────────────────────── */
+
+el_val_t  parse_int(el_val_t s, el_val_t default_val);
+
+/* ── Process ─────────────────────────────────────────────────────────────── */
+
+void      exit_program(el_val_t code);
+el_val_t  getpid_now(void);
+
+/* ── CGI identity ─────────────────────────────────────────────────────────────
+ * Called at the start of main() in CGI programs (those with a `cgi {}` block).
+ * Records the program's DHARMA identity before any other code executes.      */
+
+void      el_cgi_init(el_val_t name, el_val_t dharma_id, el_val_t principal,
+                      el_val_t network, el_val_t engram);
+
+/* ── DHARMA network builtins ─────────────────────────────────────────────────
+ * Available to CGI programs (declared with a `cgi {}` block).
+ *
+ * Peers are addressed by `dharma_id` of the form
+ *     "<registry-id>@<transport-url>"   e.g. "ntn-genesis@http://localhost:7770"
+ * If the @<url> portion is omitted, transport defaults to
+ * "http://localhost:7770" (the local CGI daemon assumption).
+ *
+ * Wire protocol (all peers expose):
+ *   POST <url>/dharma/recv      { channel, from, content } → response body
+ *   POST <url>/dharma/event     { type, payload, source, timestamp }
+ *   POST <url>/api/activate     { query }                 → list of nodes
+ *
+ * Hosting application's responsibility: an El program with a `cgi {}` block
+ * runs http_serve() with its own request handler; that handler should route
+ * "/dharma/event" requests by calling el_runtime_dharma_event_arrive() so
+ * incoming events feed dharma_field() queues. The runtime itself does not
+ * intercept any /dharma path.                                                */
+
+el_val_t  dharma_connect(el_val_t cgi_id);
+el_val_t  dharma_send(el_val_t channel, el_val_t content);
+el_val_t  dharma_activate(el_val_t query);
+void      dharma_emit(el_val_t event_type, el_val_t payload);
+el_val_t  dharma_field(el_val_t event_type);
+void      dharma_strengthen(el_val_t cgi_id, el_val_t weight);
+el_val_t  dharma_relationship(el_val_t cgi_id);
+el_val_t  dharma_peers(void);
+
+/* Public C API: called by an El program's HTTP handler when a /dharma/event
+ * request arrives. Pushes onto the per-event-type queue and signals any
+ * pending dharma_field() blockers. All three arguments must be NUL-terminated
+ * C strings (or NULL — then treated as empty).                               */
+void      el_runtime_dharma_event_arrive(const char* event_type,
+                                         const char* payload,
+                                         const char* source);
+
+/* ── Engram local graph primitives ───────────────────────────────────────────
+ * Operate on the CGI's local Engram knowledge graph.
+ * `engram_activate` queries the local graph only; `dharma_activate` is
+ * network-wide across all connected CGI graphs.                              */
+
+el_val_t  engram_node(el_val_t content, el_val_t node_type, el_val_t salience);
+el_val_t  engram_node_full(el_val_t content, el_val_t node_type, el_val_t label,
+                           el_val_t salience, el_val_t importance, el_val_t confidence,
+                           el_val_t tier, el_val_t tags);
+/* Layered consciousness — see el_runtime.c for the layered architecture
+ * design notes (search "Layered consciousness architecture"). The five
+ * canonical layers (safety / core-identity / domain-knowledge / imprint /
+ * suit) are seeded automatically; engram_add_layer extends the registry
+ * with imprint or suit overlays at runtime. Nodes default to layer 1
+ * (core-identity) when created via engram_node / engram_node_full. */
+el_val_t  engram_node_layered(el_val_t content, el_val_t node_type, el_val_t label,
+                              el_val_t salience, el_val_t certainty, el_val_t confidence,
+                              el_val_t status, el_val_t tags, el_val_t layer_id);
+el_val_t  engram_add_layer(el_val_t name, el_val_t priority, el_val_t suppressible,
+                           el_val_t transparent, el_val_t injectable);
+el_val_t  engram_remove_layer(el_val_t layer_id);
+el_val_t  engram_list_layers(void);
+el_val_t  engram_get_node(el_val_t id);
+void      engram_strengthen(el_val_t node_id);
+void      engram_forget(el_val_t node_id);
+el_val_t  engram_node_count(void);
+el_val_t  engram_search(el_val_t query, el_val_t limit);
+el_val_t  engram_scan_nodes(el_val_t limit, el_val_t offset);
+void      engram_connect(el_val_t from_id, el_val_t to_id, el_val_t weight, el_val_t relation);
+el_val_t  engram_edge_between(el_val_t from_id, el_val_t to_id);
+el_val_t  engram_neighbors(el_val_t node_id);
+el_val_t  engram_neighbors_filtered(el_val_t node_id, el_val_t max_depth, el_val_t direction);
+el_val_t  engram_edge_count(void);
+/* Three-pass activation: background fan-out → working-memory promotion →
+ * Layer 0 override. See "Three-pass activation" in el_runtime.c. */
+el_val_t  engram_activate(el_val_t query, el_val_t depth);
+el_val_t  engram_save(el_val_t path);
+el_val_t  engram_load(el_val_t path);
+
+/* JSON-string accessors — return pre-serialized JSON so HTTP handlers
+ * can pass results straight through without round-tripping ElList/ElMap
+ * through json_stringify. */
+el_val_t  engram_get_node_json(el_val_t id);
+el_val_t  engram_search_json(el_val_t query, el_val_t limit);
+el_val_t  engram_scan_nodes_json(el_val_t limit, el_val_t offset);
+el_val_t  engram_scan_nodes_by_type_json(el_val_t node_type, el_val_t limit, el_val_t offset);
+el_val_t  engram_neighbors_json(el_val_t node_id, el_val_t max_depth, el_val_t direction);
+el_val_t  engram_activate_json(el_val_t query, el_val_t depth);
+el_val_t  engram_stats_json(void);
+el_val_t  engram_list_layers_json(void);
+/* engram_compile_layered_json — produce a prompt-ready text block split
+ * into "[LAYER 0 — STRUCTURAL]" (non-suppressible layers, sacred fire)
+ * and "[ENGRAM CONTEXT]" (standard suppressible layers). Returns "" if
+ * no nodes promoted to working memory. */
+el_val_t  engram_compile_layered_json(el_val_t intent, el_val_t depth);
+
+/* ── LLM (Anthropic API client) ─────────────────────────────────────────────
+ * All functions call https://api.anthropic.com/v1/messages with the API key
+ * from env ANTHROPIC_API_KEY. Default model when empty: claude-sonnet-4-5. */
+
+el_val_t  llm_call(el_val_t model, el_val_t prompt);
+el_val_t  llm_call_system(el_val_t model, el_val_t system_prompt, el_val_t user_prompt);
+el_val_t  llm_call_agentic(el_val_t model, el_val_t system, el_val_t user, el_val_t tools);
+el_val_t  llm_vision(el_val_t model, el_val_t system, el_val_t prompt, el_val_t image_url_or_b64);
+el_val_t  llm_models(void);
+
+/* Register a tool handler by name. The handler is looked up via dlsym
+ * (mirroring http_set_handler), so any El `fn <name>(input)` compiles to
+ * a global C symbol that this function can locate at runtime.
+ * Handler signature: `el_val_t handler(el_val_t input_json)` — receives
+ * the tool input as a JSON-string el_val_t and returns a JSON-string
+ * el_val_t result. Used by llm_call_agentic.                                 */
+void      llm_register_tool(el_val_t name, el_val_t handler_fn_name);
+
+/* ── args() ─────────────────────────────────────────────────────────────────
+ * Provides access to command-line arguments passed to the program.
+ * Populated by el_runtime_init_args() before main() runs.           */
+
+el_val_t  args(void);
+void      el_runtime_init_args(int argc, char** argv);
+
+/* ── Crypto primitives ─────────────────────────────────────────────────────
+ * SHA-256, HMAC-SHA-256, and base64 (standard + URL-safe).
+ * Self-contained — no OpenSSL/libcrypto dependency. The implementations are
+ * adapted from public-domain reference code (Brad Conte / RFC 4648).
+ *
+ * Bytes-returning variants (sha256_bytes, hmac_sha256_bytes) return a string
+ * value whose contents are raw binary; callers usually feed these into
+ * base64_encode. Note that el_val_t strings are NUL-terminated by convention,
+ * so the binary payload may contain embedded NULs — pass it directly into
+ * base64_encode (which uses an explicit length) rather than treating it as
+ * a printable C string.
+ *
+ * The "base64" variants emit/accept RFC 4648 standard alphabet with padding.
+ * The "base64url" variants use URL-safe alphabet (`-`/`_`) with no padding,
+ * as used in JWTs.                                                           */
+
+el_val_t  sha256_hex(el_val_t input);
+el_val_t  sha256_bytes(el_val_t input);
+el_val_t  hmac_sha256_hex(el_val_t key, el_val_t message);
+el_val_t  hmac_sha256_bytes(el_val_t key, el_val_t message);
+el_val_t  base64_encode(el_val_t input);
+el_val_t  base64_decode(el_val_t input);
+el_val_t  base64url_encode(el_val_t input);
+el_val_t  base64url_decode(el_val_t input);
+
+/* Length-aware variants (internal — exposed for the rare caller that already
+ * has a known-length binary buffer and doesn't want to round-trip through
+ * a NUL-terminated el_val_t string). Sha256_bytes and hmac_sha256_bytes feed
+ * these implicitly. */
+el_val_t  el_sha256_bytes_n(const unsigned char* data, size_t len);
+el_val_t  el_base64_encode_n(const unsigned char* data, size_t len, int url_safe);
+
+/* ── Post-quantum primitives (liboqs-backed) ────────────────────────────────
+ * All inputs/outputs hex-encoded. Algorithm choices:
+ *   Signature: CRYSTALS-Dilithium-3   (NIST level 3, balanced)
+ *   KEM:       CRYSTALS-Kyber-768     (NIST level 3)
+ *   Hash:      SHA3-256 (Keccak)      (PQ-aware protocols favour SHA3 over SHA2)
+ *
+ * If liboqs is not linked (detected via __has_include(<oqs/oqs.h>) at compile
+ * time), the pq_* entry points return a JSON-shaped error string so callers
+ * fail loudly rather than silently fall back to classical schemes:
+ *   {"error":"liboqs not linked, post-quantum primitives unavailable"}
+ *
+ * The hybrid handshake pairs X25519 with Kyber-768 per NIST PQ guidance and
+ * CNSA 2.0. Combined shared secret is HKDF-SHA256(x25519_ss || kyber_ss).
+ * Even if Kyber falls, X25519 holds; if X25519 falls under quantum attack,
+ * Kyber holds. SHA3-256 also remains usable independent of liboqs (the
+ * Keccak permutation is PQ-OK as a primitive). */
+
+el_val_t  pq_keygen_signature(void);
+el_val_t  pq_sign(el_val_t secret_key_hex, el_val_t message);
+el_val_t  pq_verify(el_val_t public_key_hex, el_val_t message, el_val_t signature_hex);
+
+el_val_t  pq_kem_keygen(void);
+el_val_t  pq_kem_encaps(el_val_t public_key_hex);
+el_val_t  pq_kem_decaps(el_val_t secret_key_hex, el_val_t ciphertext_hex);
+
+el_val_t  pq_hybrid_keygen(void);
+el_val_t  pq_hybrid_handshake(el_val_t remote_pub_combined);
+
+el_val_t  sha3_256_hex(el_val_t input);
+
+/* ── AEAD: AES-256-GCM (libcrypto-backed) ───────────────────────────────────
+ * Symmetric authenticated encryption used to wrap envelopes after a KEM
+ * handshake. Caller MUST supply a 32-byte key (64 hex chars) — typically the
+ * Kyber-768 / hybrid shared_secret, optionally normalized via SHA3-256.
+ *
+ * aead_encrypt returns a JSON map {"nonce":"...","ciphertext":"..."} where
+ * ciphertext is the AES-256-GCM output with the 16-byte auth tag appended.
+ * Nonce is a fresh 12-byte CSPRNG draw — callers never pick the nonce, which
+ * structurally rules out the GCM nonce-reuse footgun.
+ *
+ * aead_decrypt returns the plaintext String, or "" on any failure (including
+ * auth-tag mismatch). Callers MUST check for "" before trusting the result. */
+el_val_t  aead_encrypt(el_val_t key_hex, el_val_t plaintext);
+el_val_t  aead_decrypt(el_val_t key_hex, el_val_t nonce_hex, el_val_t ciphertext_hex);
+
+/* ── Native VM builtin aliases (for compiled El source) ─────────────────────
+ * These match the El VM's native_* builtins so that El source compiled
+ * to C can call the same names without modification.                */
+
+el_val_t  native_list_get(el_val_t list, el_val_t index);
+el_val_t  native_list_len(el_val_t list);
+el_val_t  native_list_append(el_val_t list, el_val_t elem);
+el_val_t  native_list_empty(void);
+el_val_t  native_list_clone(el_val_t list);
+el_val_t  native_string_chars(el_val_t s);
+el_val_t  native_int_to_str(el_val_t n);
+
+/* ── Method-call shorthand aliases ──────────────────────────────────────────
+ * The El method-call convention `obj.method(args)` compiles to
+ * `method(obj, args)`.  These aliases expose the runtime functions under
+ * the short names that result from method calls in El source.
+ *
+ * Example: `myList.append(x)` → `append(myList, x)` (calls this alias)
+ *          `myList.len()`     → `len(myList)`         (calls this alias)  */
+
+el_val_t  append(el_val_t list, el_val_t elem);   /* el_list_append */
+el_val_t  len(el_val_t list);                      /* el_list_len    */
+el_val_t  get(el_val_t list, el_val_t index);      /* el_list_get    */
+el_val_t  map_get(el_val_t map, el_val_t key);     /* el_map_get     */
+el_val_t  map_set(el_val_t map, el_val_t key, el_val_t value); /* el_map_set */
+
+/* ── OTLP/HTTP Observability ─────────────────────────────────────────────── */
+/* See bottom of el_runtime.c for the implementation.
+ * Configured by env vars OTLP_ENDPOINT, OTEL_SERVICE_NAME, OTEL_SERVICE_VERSION.
+ * No-op when OTLP_ENDPOINT is unset. Drop-on-failure semantics. */
+/* ── Subprocess execution ────────────────────────────────────────────────── */
+el_val_t exec_command(el_val_t cmd);   /* run shell command, return exit code */
+el_val_t exec_capture(el_val_t cmd);   /* run shell command, capture stdout   */
+el_val_t exec(el_val_t cmd);           /* exec(cmd) → stdout String (30s timeout) */
+el_val_t exec_bg(el_val_t cmd);        /* exec_bg(cmd) → PID String (non-blocking) */
+
+el_val_t emit_log(el_val_t level, el_val_t msg, el_val_t fields_json);
+el_val_t emit_metric(el_val_t name, el_val_t value, el_val_t tags_json);
+el_val_t trace_span_start(el_val_t name);
+el_val_t trace_span_end(el_val_t span_handle);
+el_val_t emit_event(el_val_t name, el_val_t duration_ms);
+
+#ifdef __cplusplus
+}
+#endif

lang/el-compiler/src/codegen-js.el

@@ -1202,7 +1202,7 @@ fn codegen_js_inner(stmts: [Map<String, Any>], source: String, bundle_mode: Bool
         js_emit_line(js_strip_es_exports(runtime_content))
         js_emit_line("")
     } else {
-        js_emit_line("// Runtime: foundation/el/runtime/el_runtime.js")
+        js_emit_line("// Runtime: foundation/el/el-compiler/runtime/el_runtime.js")
         js_emit_line("import \"./el_runtime.js\";")
     }
     // In module mode: destructure all builtins off globalThis.__el so call

lang/el-compiler/src/codegen.el

@@ -2916,6 +2916,24 @@ fn build_int_names_for_params(params: [Map<String, Any>]) -> Bool {
     return true
 }
 
+// fn_has_decorator — does this FnDef carry a decorator named `name`?
+// Reads the `decorators` list [{name, args}] attached by the parser. Absent
+// key -> native_list_len returns 0 -> false. This is the multi-decorator-aware
+// replacement for the old single `decorator` string check, so a fn may stack
+// roles with other decorators (e.g. `@route(...) @manager fn ...`).
+fn fn_has_decorator(stmt: Map<String, Any>, name: String) -> Bool {
+    let dl = stmt["decorators"]
+    let n: Int = native_list_len(dl)
+    let i = 0
+    while i < n {
+        let d = native_list_get(dl, i)
+        let dn: String = d["name"]
+        if str_eq(dn, name) { return true }
+        let i = i + 1
+    }
+    false
+}
+
 fn cg_fn(stmt: Map<String, Any>) -> Void {
     let fn_name: String = stmt["name"]
     // Skip El's `fn main()` - C provides its own main() for top-level stmts
@@ -2927,10 +2945,10 @@ fn cg_fn(stmt: Map<String, Any>) -> Void {
     let params_c: String = params_to_c(params)
     // VBD role enforcement: dharma_emit / dharma_field may only be called
     // from @manager-decorated functions. Surface violations to the C compiler
-    // via #error directives emitted before the function definition.
-    let decorator: String = stmt["decorator"]
+    // via #error directives emitted before the function definition. Read the
+    // decorator LIST so the role may be stacked with other decorators.
     if vbd_has_restricted_call(body) {
-        if !str_eq(decorator, "manager") {
+        if !fn_has_decorator(stmt, "manager") {
             emit_line("#error \"VBD violation: dharma_emit/dharma_field called from non-@manager fn '" + fn_name + "'\"")
         }
     }
@@ -3479,6 +3497,259 @@ fn cg_decl_streaming(stmt: Map<String, Any>) -> Void {
     }
 }
 
+// ── @route dispatcher generation ──────────────────────────────────────────────
+//
+// Scan the token stream for @route-decorated fns and synthesize a generic HTTP
+// dispatcher `el_route_dispatch(method, clean, path, body)`. A decorated handler
+// must have the uniform signature (method, path, body) -> String. The dispatcher
+// matches `clean` (the query-stripped path, supplied by the caller) against each
+// route and calls the handler with the ORIGINAL `path` so query strings survive.
+// Returns the sentinel "__EL_NO_ROUTE__" when nothing matches, so the caller may
+// fall through to any remaining hand-written branches (mixed mode).
+//
+// Decorator grammar: @route(path, method, kind, suffix)
+//   path   — the match string (or the prefix, for compound)
+//   method — "GET" | "POST" | ... ; a '|'-list like "GET|POST"; "ANY"/"" = no guard
+//   kind   — "exact" (default) | "prefix" | "suffix" | "compound"
+//   suffix — for "compound": the required str_ends_with suffix
+//
+// The dispatch table is emitted SPECIFICITY-SORTED (most-specific first), NOT in
+// source order, so overlapping prefixes (e.g. /api/x/search vs /api/x) never
+// shadow each other regardless of how the handlers are written.
+
+// split_pipe — split "GET|POST" on '|' into ["GET","POST"]. Self-contained
+// (no dependency on str_split runtime semantics).
+fn split_pipe(s: String) -> [String] {
+    let out: [String] = native_list_empty()
+    let cur: String = ""
+    let n: Int = str_len(s)
+    let i: Int = 0
+    while i < n {
+        let ch: String = str_slice(s, i, i + 1)
+        if str_eq(ch, "|") {
+            let out = native_list_append(out, cur)
+            let cur = ""
+        } else {
+            let cur = cur + ch
+        }
+        let i = i + 1
+    }
+    let out = native_list_append(out, cur)
+    out
+}
+
+// route_make_record — build a route record map from the @route decorator args.
+fn route_make_record(fn_name: String, args: [String]) -> Map<String, Any> {
+    let na: Int = native_list_len(args)
+    let rpath: String = ""
+    if na >= 1 { let rpath = native_list_get(args, 0) }
+    let rmethod: String = "GET"
+    if na >= 2 { let rmethod = native_list_get(args, 1) }
+    let rkind: String = "exact"
+    if na >= 3 { let rkind = native_list_get(args, 2) }
+    let rsuffix: String = ""
+    if na >= 4 { let rsuffix = native_list_get(args, 3) }
+    { "name": fn_name, "path": rpath, "method": rmethod, "kind": rkind, "suffix": rsuffix }
+}
+
+// route_spec_score — higher = more specific = emitted earlier. Ordering:
+// exact > compound > suffix > prefix; within a class, a longer path/suffix
+// wins (so /api/x/search sorts before /api/x). Guarantees correct dispatch
+// independent of source order.
+fn route_spec_score(rec: Map<String, Any>) -> Int {
+    let kind: String = rec["kind"]
+    let path: String = rec["path"]
+    let suffix: String = rec["suffix"]
+    let plen: Int = str_len(path)
+    let slen: Int = str_len(suffix)
+    if str_eq(kind, "exact") { return 4000000 + plen }
+    if str_eq(kind, "compound") { return 3000000 + plen * 100 + slen }
+    if str_eq(kind, "suffix") { return 2000000 + slen }
+    return 1000000 + plen
+}
+
+// route_sort_desc — selection sort of route records by descending specificity.
+// N is small (routes per module), so O(n^2) is fine and keeps codegen simple.
+fn route_sort_desc(recs: [Map<String, Any>]) -> [Map<String, Any>] {
+    let n: Int = native_list_len(recs)
+    let out: [Map<String, Any>] = native_list_empty()
+    let used: [Bool] = native_list_empty()
+    let u: Int = 0
+    while u < n {
+        let used = native_list_append(used, false)
+        let u = u + 1
+    }
+    let picked: Int = 0
+    while picked < n {
+        let best_i: Int = 0 - 1
+        let best_score: Int = 0 - 1
+        let i: Int = 0
+        while i < n {
+            let is_used: Bool = native_list_get(used, i)
+            if !is_used {
+                let sc: Int = route_spec_score(native_list_get(recs, i))
+                if sc > best_score {
+                    let best_score = sc
+                    let best_i = i
+                }
+            }
+            let i = i + 1
+        }
+        let out = native_list_append(out, native_list_get(recs, best_i))
+        // Rebuild `used` with best_i marked (runtime has no native_list_set).
+        let new_used: [Bool] = native_list_empty()
+        let j: Int = 0
+        while j < n {
+            if j == best_i {
+                let new_used = native_list_append(new_used, true)
+            } else {
+                let new_used = native_list_append(new_used, native_list_get(used, j))
+            }
+            let j = j + 1
+        }
+        let used = new_used
+        let picked = picked + 1
+    }
+    out
+}
+
+// scan_routes — token-level scan collecting every @route-decorated fn as a
+// route record. Runs once per module (like scan_fn_sigs) so the dispatcher can
+// be synthesized in the streaming backend, which discards per-fn ASTs. Handles
+// decorator STACKING: `@route(...) @manager fn` still records the route.
+fn scan_routes(tokens: [Any]) -> [Map<String, Any>] {
+    let total: Int = native_list_len(tokens) / 2
+    let recs: [Map<String, Any>] = native_list_empty()
+    let has_pending: Bool = false
+    let pending_args: [String] = native_list_empty()
+    let pos: Int = 0
+    let going: Bool = true
+    while going {
+        if pos >= total {
+            let going = false
+        } else {
+            let k: String = tok_kind(tokens, pos)
+            if str_eq(k, "Eof") {
+                let going = false
+            } else {
+                if str_eq(k, "At") {
+                    let dname: String = tok_value(tokens, pos + 1)
+                    let p: Int = pos + 2
+                    let args: [String] = native_list_empty()
+                    let ka: String = tok_kind(tokens, p)
+                    if str_eq(ka, "LParen") {
+                        let p = p + 1
+                        let running: Bool = true
+                        while running {
+                            let kd: String = tok_kind(tokens, p)
+                            if str_eq(kd, "RParen") {
+                                let running = false
+                            } else {
+                                if str_eq(kd, "Eof") {
+                                    let running = false
+                                } else {
+                                    if str_eq(kd, "Str") {
+                                        let args = native_list_append(args, tok_value(tokens, p))
+                                    }
+                                    let p = p + 1
+                                }
+                            }
+                        }
+                        if str_eq(tok_kind(tokens, p), "RParen") { let p = p + 1 }
+                    }
+                    if str_eq(dname, "route") {
+                        let has_pending = true
+                        let pending_args = args
+                    }
+                    let pos = p
+                } else {
+                    if str_eq(k, "Fn") {
+                        let fname: String = tok_value(tokens, pos + 1)
+                        if has_pending {
+                            let recs = native_list_append(recs, route_make_record(fname, pending_args))
+                            let has_pending = false
+                        }
+                        let pos = pos + 2
+                    } else {
+                        let pos = pos + 1
+                    }
+                }
+            }
+        }
+    }
+    recs
+}
+
+// program_has_routes — did scan_routes find any @route fn?
+fn program_has_routes(recs: [Map<String, Any>]) -> Bool {
+    native_list_len(recs) > 0
+}
+
+// route_method_guard — C boolean prefix guarding on HTTP method, or "" for none.
+fn route_method_guard(method: String) -> String {
+    if str_eq(method, "") { return "" }
+    if str_eq(method, "ANY") { return "" }
+    if str_contains(method, "|") {
+        let parts: [String] = split_pipe(method)
+        let np: Int = native_list_len(parts)
+        let expr: String = ""
+        let i: Int = 0
+        while i < np {
+            let m: String = native_list_get(parts, i)
+            if str_eq(m, "") {
+                let i = i + 1
+            } else {
+                let piece: String = "str_eq(method, EL_STR(" + c_str_lit(m) + "))"
+                if str_eq(expr, "") {
+                    let expr = piece
+                } else {
+                    let expr = expr + " || " + piece
+                }
+                let i = i + 1
+            }
+        }
+        if str_eq(expr, "") { return "" }
+        return "(" + expr + ") && "
+    }
+    "str_eq(method, EL_STR(" + c_str_lit(method) + ")) && "
+}
+
+// route_match_expr — C boolean matching `clean` against the route path/kind.
+fn route_match_expr(kind: String, path: String, suffix: String) -> String {
+    if str_eq(kind, "prefix") {
+        return "str_starts_with(clean, EL_STR(" + c_str_lit(path) + "))"
+    }
+    if str_eq(kind, "suffix") {
+        return "str_ends_with(clean, EL_STR(" + c_str_lit(path) + "))"
+    }
+    if str_eq(kind, "compound") {
+        return "str_starts_with(clean, EL_STR(" + c_str_lit(path) + ")) && str_ends_with(clean, EL_STR(" + c_str_lit(suffix) + "))"
+    }
+    "str_eq(clean, EL_STR(" + c_str_lit(path) + "))"
+}
+
+// emit_route_dispatch — emit the generated el_route_dispatch definition from the
+// specificity-sorted route records. No-op if there are no routes.
+fn emit_route_dispatch(recs: [Map<String, Any>]) -> Void {
+    if !program_has_routes(recs) { return }
+    let sorted: [Map<String, Any>] = route_sort_desc(recs)
+    emit_line("// ── generated @route dispatcher (specificity-sorted) ──")
+    emit_line("el_val_t el_route_dispatch(el_val_t method, el_val_t clean, el_val_t path, el_val_t body) {")
+    let n: Int = native_list_len(sorted)
+    let i: Int = 0
+    while i < n {
+        let rec = native_list_get(sorted, i)
+        let guard: String = route_method_guard(rec["method"])
+        let match_e: String = route_match_expr(rec["kind"], rec["path"], rec["suffix"])
+        let fn_name: String = rec["name"]
+        emit_line("  if (" + guard + match_e + ") { return " + fn_name + "(method, path, body); }")
+        let i = i + 1
+    }
+    emit_line("  return EL_STR(\"__EL_NO_ROUTE__\");")
+    emit_line("}")
+    emit_blank()
+}
+
 // emit_streaming_preamble — emit #includes, forward decls, and file-scope lets
 // using the pre-scanned signature data (no full AST).
 fn emit_streaming_preamble(sigs: [Map<String, Any>], source: String) -> Void {
@@ -3571,6 +3842,17 @@ fn codegen_streaming(tokens: [Any], sigs: [Map<String, Any>], source: String) ->
     emit_streaming_preamble(sigs, source)
     el_arena_pop(preamble_mark)
 
+    // @route: scan the token stream once for @route-decorated fns. Kept in
+    // codegen_streaming scope (survives the per-fn arena pops and el_release of
+    // tokens below via refcount, like `sigs`). If any exist, forward-declare the
+    // generated dispatcher NOW so hand-written fns (e.g. handle_request) may call
+    // it before its definition is emitted after the fn-emit loop.
+    let route_records: [Map<String, Any>] = scan_routes(tokens)
+    if program_has_routes(route_records) {
+        emit_line("el_val_t el_route_dispatch(el_val_t method, el_val_t clean, el_val_t path, el_val_t body);")
+        emit_blank()
+    }
+
     // Detect whether there is a fn main() and whether there are top-level
     // executable stmts (for library detection) from sigs.
     let has_el_main: Bool = false
@@ -3758,6 +4040,15 @@ fn codegen_streaming(tokens: [Any], sigs: [Map<String, Any>], source: String) ->
         }
     }
 
+    // @route: emit the generated dispatcher definition now — after every handler
+    // fn has been emitted, but before `tokens` is released (route_records holds
+    // its own refs to the extracted strings). No-op unless the module declared
+    // at least one @route fn. Emitted before the test/library early-returns so it
+    // is present in library modules (e.g. neuron's routes.el) too.
+    let route_arena_mark: Any = el_arena_push()
+    emit_route_dispatch(route_records)
+    el_arena_pop(route_arena_mark)
+
     // Tokens fully consumed by the streaming loop — release now to free peak heap.
     el_release(tokens)
 

lang/el-compiler/src/parser.el

@@ -1758,23 +1758,68 @@ fn parse_stmt(tokens: [Any], pos: Int) -> Map<String, Any> {
         return make_result({ "stmt": "TryCatch", "try_body": try_body, "catch_name": catch_name, "catch_body": native_list_empty() }, p)
     }
 
-    // @decorator - capture decorator name and attach to following stmt
+    // @decorator - capture decorator name (and optional string args) and
+    // attach to the following stmt. Backward-compatible: bare @manager /
+    // @engine / @accessor still parse (no parens -> empty args). Decorators
+    // STACK: `@route("/p","GET") @manager fn f()` attaches BOTH to f via a
+    // `decorators` list [{name, args}]. The legacy `decorator` string is kept
+    // populated (topmost decorator) so the JS backend keeps working unchanged.
     if k == "At" {
         let p = pos + 1
         let dec_name = tok_value(tokens, p)
         let p = p + 1
+        // Optional decorator argument list: @name("a", "b", ...)
+        let dec_args = native_list_empty()
+        let ka = tok_kind(tokens, p)
+        if str_eq(ka, "LParen") {
+            let p = p + 1
+            let running_da = true
+            while running_da {
+                let kd = tok_kind(tokens, p)
+                if str_eq(kd, "RParen") {
+                    let running_da = false
+                } else {
+                    if str_eq(kd, "Eof") {
+                        let running_da = false
+                    } else {
+                        if str_eq(kd, "Str") {
+                            let dec_args = native_list_append(dec_args, tok_value(tokens, p))
+                        }
+                        let p = p + 1
+                        let kc = tok_kind(tokens, p)
+                        if str_eq(kc, "Comma") {
+                            let p = p + 1
+                        }
+                    }
+                }
+            }
+            let p = expect(tokens, p, "RParen")
+        }
         let r = parse_stmt(tokens, p)
         let inner = r["node"]
         let p2 = r["pos"]
         let inner_kind: String = inner["stmt"]
         if str_eq(inner_kind, "FnDef") {
+            // Stack this decorator (topmost-first) onto any decorators the inner
+            // FnDef already carries from decorators written below this one.
+            let this_dec = { "name": dec_name, "args": dec_args }
+            let existing = inner["decorators"]
+            let dlist = native_list_empty()
+            let dlist = native_list_append(dlist, this_dec)
+            let ne: Int = native_list_len(existing)
+            let ei = 0
+            while ei < ne {
+                let dlist = native_list_append(dlist, native_list_get(existing, ei))
+                let ei = ei + 1
+            }
             let with_dec = {
                 "stmt": "FnDef",
                 "name": inner["name"],
                 "params": inner["params"],
                 "body": inner["body"],
                 "ret_type": inner["ret_type"],
-                "decorator": dec_name
+                "decorator": dec_name,
+                "decorators": dlist
             }
             // r result map fully consumed — release to free peak heap.
             el_release(r)

lang/elb.el

@@ -368,13 +368,13 @@ fn main() -> Void {
         let which_out: String = str_trim(exec_capture("which " + elc_bin + " 2>/dev/null"))
         if !str_eq(which_out, "") {
             let elc_dir: String = dirname_of(which_out)
-            runtime_path = elc_dir + "/../runtime/el_runtime.c"
+            runtime_path = elc_dir + "/../el-compiler/runtime/el_runtime.c"
         }
     }
     // If --runtime points to a directory, auto-locate el_runtime.c inside it.
     // This lets both forms work:
-    //   --runtime=/opt/el/runtime          (directory form)
-    //   --runtime=/opt/el/runtime/el_runtime.c  (file form)
+    //   --runtime=/opt/el/el-compiler/runtime          (directory form)
+    //   --runtime=/opt/el/el-compiler/runtime/el_runtime.c  (file form)
     if !str_eq(runtime_path, "") {
         let is_dir: String = str_trim(exec_capture("test -d " + runtime_path + " && echo dir || echo file"))
         if str_eq(is_dir, "dir") {

lang/examples/html-page.el

@@ -6,8 +6,8 @@
 //
 // Compile and run:
 //   ./dist/platform/elc examples/html-page.el > /tmp/html-page.c
-//   cc -std=c11 -I runtime -lcurl -lpthread \
-//      -o /tmp/html-page /tmp/html-page.c runtime/el_runtime.c
+//   cc -std=c11 -I el-compiler/runtime -lcurl -lpthread \
+//      -o /tmp/html-page /tmp/html-page.c el-compiler/runtime/el_runtime.c
 //   /tmp/html-page
 
 fn render_item(item: String) -> String {

lang/releases/v1.0.0-20260501/RELEASE.md

@@ -0,0 +1,28 @@
+# El Compiler Release v1.0.0 — 2026-05-02
+
+## Components
+- `bootstrap.py` — El language compiler (Python, recursive descent parser, emits C)
+- `el_runtime.c` — El runtime (C, HTTP server, engram, DHARMA, LLM chain)
+- `el_runtime.h` — Runtime public API header
+
+## Changes in this release
+
+### Critical bug fixes
+- `state_set`/`state_get` are now thread-safe (pthread_mutex). Was racing across 64 worker threads.
+- `looks_like_string` threshold raised from 1,000,000 to 4GB. Unix timestamps were being dereferenced as heap pointers.
+- `fs_read` guards against negative `ftell` result (pipe/special file overflow).
+
+### Engram architecture (major)
+- Two-layer activation: `background_activation` (Layer 1, broad fan-out) + `working_memory_weight` (Layer 2, executive filter)
+- Inhibitory edges: `EngramEdge.inhibitory` flag suppresses working memory promotion without affecting background activation
+- Suppression memory: `suppression_count` — nodes activated-but-suppressed accumulate pressure toward breakthrough
+- Temporal decay: `temporal_decay_rate`, `created_at`, `last_activated_at`, `activation_count` on EngramNode
+- Per-type activation thresholds (Safety: 0.05, Canonical: 0.15, Lesson: 0.25, Note: 0.40)
+- Temporal range query: `engram_query_range(start_ms, end_ms)`
+- Layered consciousness: `EngramLayer` struct, `layer_id` on nodes and edges, `EngramStore.layers[]`
+- Layer 0 override pass: safety layer fires last and cannot be suppressed
+
+## SHA256
+bootstrap.py
+el_runtime.c
+el_runtime.h

lang/releases/v1.0.0-20260501/el_runtime.c

@@ -10275,654 +10275,6 @@ el_val_t engram_load_merge(el_val_t path) {
     return (el_val_t)added_nodes;
 }
 
-/* ══════════════════════════════════════════════════════════════════════════
- * Engram WAL (write-ahead log) + compaction + integrity hardening.
- *
- * Design: docs/architecture/design/engram-storage-engine-wal.md §§3-14, §18.
- * Whole feature is gated behind ENGRAM_WAL=on (default off → byte-identical
- * to the snapshot-as-store behavior). When on, structural mutations append a
- * framed, CRC'd record to <dir>/engram.wal instead of rewriting the full
- * snapshot; boot replays the WAL over the base snapshot; a size threshold
- * triggers compaction (fresh snapshot + WAL truncate).
- *
- * Record framing (little-endian native; single-machine prototype):
- *   [u32 magic 'EWL1'][u32 payload_len][u8 op][u8 flags][u64 lsn]
- *   [u32 crc32][payload…]
- * crc32 covers op|flags|lsn|payload. A record whose magic/length/crc fails
- * validation marks end-of-valid-log (torn tail from a crash → replay stops
- * cleanly, never crashes).
- * ══════════════════════════════════════════════════════════════════════════ */
-
-#define EG_WAL_MAGIC   0x314C5745u   /* 'E''W''L''1' */
-#define EG_WAL_HDR_LEN 22            /* 4+4+1+1+8+4 */
-
-/* Op codes (§5). NODE_PUT/EDGE_PUT are id-keyed upserts (replay-idempotent). */
-enum {
-    EG_OP_NODE_PUT     = 1,
-    EG_OP_EDGE_PUT     = 2,
-    EG_OP_TOMBSTONE    = 3,
-    EG_OP_SUPERSEDE    = 4,
-    EG_OP_LAYER_PUT    = 5,
-    EG_OP_LAYER_DEL    = 6,
-    EG_OP_FORGET       = 7,
-    EG_OP_HEBB_BATCH   = 8,
-    EG_OP_COMPACT_MARK = 9
-};
-
-/* ── crc32 (IEEE 802.3, reflected, poly 0xEDB88320) ──────────────────────────
- * init 0xFFFFFFFF, final XOR 0xFFFFFFFF. Known answers:
- *   crc32("")          == 0x00000000
- *   crc32("123456789") == 0xCBF43926 (the canonical check value)
- * eg_crc32_update takes/returns the *internal* (pre-final-xor) running value
- * so a checksum can be computed across several buffers. */
-static uint32_t eg_crc32_table[256];
-static int      eg_crc32_ready = 0;
-static void eg_crc32_init(void) {
-    for (uint32_t i = 0; i < 256; i++) {
-        uint32_t c = i;
-        for (int k = 0; k < 8; k++)
-            c = (c & 1) ? (0xEDB88320u ^ (c >> 1)) : (c >> 1);
-        eg_crc32_table[i] = c;
-    }
-    eg_crc32_ready = 1;
-}
-static uint32_t eg_crc32_update(uint32_t crc, const void* data, size_t n) {
-    if (!eg_crc32_ready) eg_crc32_init();
-    const uint8_t* d = (const uint8_t*)data;
-    for (size_t i = 0; i < n; i++)
-        crc = eg_crc32_table[(crc ^ d[i]) & 0xFF] ^ (crc >> 8);
-    return crc;
-}
-static uint32_t eg_crc32(const void* data, size_t n) {
-    return eg_crc32_update(0xFFFFFFFFu, data, n) ^ 0xFFFFFFFFu;
-}
-/* crc over a record's covered bytes: op|flags|lsn|payload. */
-static uint32_t eg_wal_record_crc(uint8_t op, uint8_t flags, uint64_t lsn,
-                                  const char* payload, size_t plen) {
-    uint32_t c = 0xFFFFFFFFu;
-    c = eg_crc32_update(c, &op, 1);
-    c = eg_crc32_update(c, &flags, 1);
-    c = eg_crc32_update(c, &lsn, sizeof(lsn));
-    if (plen) c = eg_crc32_update(c, payload, plen);
-    return c ^ 0xFFFFFFFFu;
-}
-
-/* EL builtin: crc32 of a string (known-answer unit tests / debugging). */
-el_val_t engram_crc32(el_val_t s) {
-    const char* p = EL_CSTR(s);
-    if (!p) return (el_val_t)0;
-    return (el_val_t)(int64_t)(uint32_t)eg_crc32(p, strlen(p));
-}
-
-/* ── WAL runtime state (single log per process — engram is single-threaded) ── */
-typedef struct {
-    FILE*    fp;             /* append handle, or NULL when closed        */
-    char     path[1024];     /* <dir>/engram.wal                          */
-    uint64_t lsn;            /* last assigned lsn; next record = lsn+1     */
-    uint64_t uncommitted;    /* records appended since last fsync          */
-    int64_t  last_sync_ms;   /* wall clock of last fsync                   */
-    int64_t  bytes;          /* current WAL size (for compaction trigger)  */
-} EngramWal;
-static EngramWal eg_wal = { NULL, {0}, 0, 0, 0, 0 };
-
-static int eg_wal_sync_mode(void) {
-    /* ENGRAM_WAL_SYNC=always|group|off (default group). */
-    const char* m = getenv("ENGRAM_WAL_SYNC");
-    if (m && strcmp(m, "always") == 0) return 2;
-    if (m && strcmp(m, "off")    == 0) return 0;
-    return 1; /* group */
-}
-static int64_t eg_wal_group_ms(void) {
-    const char* v = getenv("ENGRAM_WAL_SYNC_MS");
-    if (v && *v) { long n = strtol(v, NULL, 10); if (n > 0) return n; }
-    return 50; /* §5: N≈50ms */
-}
-static int64_t eg_wal_compact_bytes(void) {
-    const char* v = getenv("ENGRAM_WAL_COMPACT_BYTES");
-    if (v && *v) { long long n = strtoll(v, NULL, 10); if (n > 0) return n; }
-    return 32LL * 1024 * 1024; /* §7 default 32 MB */
-}
-
-int engram_wal_enabled(void) {
-    const char* f = getenv("ENGRAM_WAL");
-    return (f && (strcmp(f, "on") == 0 || strcmp(f, "1") == 0)) ? 1 : 0;
-}
-
-/* Force the WAL to durable storage per the commit policy. force=1 (used by
- * compaction / explicit commit) always fsyncs; otherwise group policy. */
-static void eg_wal_commit(int force) {
-    if (!eg_wal.fp) return;
-    int mode = eg_wal_sync_mode();
-    if (mode == 0 && !force) { fflush(eg_wal.fp); return; }
-    if (!force && mode == 1) {
-        int64_t now = engram_now_ms();
-        if (eg_wal.uncommitted == 0) return;
-        if (now - eg_wal.last_sync_ms < eg_wal_group_ms()) { fflush(eg_wal.fp); return; }
-    }
-    fflush(eg_wal.fp);
-    fsync(fileno(eg_wal.fp));
-    eg_wal.uncommitted = 0;
-    eg_wal.last_sync_ms = engram_now_ms();
-}
-
-/* Append one framed+CRC'd record. Returns 1 on success, 0 on I/O failure
- * (caller keeps the mutation in RAM; no corruption — §11 disk-full row). */
-static int eg_wal_write(uint8_t op, uint8_t flags, const char* payload, size_t plen) {
-    if (!eg_wal.fp) return 0;
-    /* Remember the pre-record offset so a partial write (e.g. ENOSPC mid-
-     * record) can be rolled back — otherwise a torn record would sit in the
-     * MIDDLE of the log and prematurely end replay of everything after it.
-     * We roll back to a clean record boundary and report failure; the caller
-     * keeps the mutation in RAM (§11 disk-full row). */
-    long start = ftell(eg_wal.fp);
-    uint64_t lsn = ++eg_wal.lsn;
-    uint32_t magic = EG_WAL_MAGIC;
-    uint32_t len32 = (uint32_t)plen;
-    uint32_t crc = eg_wal_record_crc(op, flags, lsn, payload, plen);
-    uint8_t hdr[EG_WAL_HDR_LEN];
-    memcpy(hdr + 0,  &magic, 4);
-    memcpy(hdr + 4,  &len32, 4);
-    hdr[8] = op; hdr[9] = flags;
-    memcpy(hdr + 10, &lsn, 8);
-    memcpy(hdr + 18, &crc, 4);
-    int ok = (fwrite(hdr, 1, EG_WAL_HDR_LEN, eg_wal.fp) == EG_WAL_HDR_LEN);
-    if (ok && plen) ok = (fwrite(payload, 1, plen, eg_wal.fp) == plen);
-    if (!ok) {
-        eg_wal.lsn--;                 /* reclaim the lsn */
-        fflush(eg_wal.fp);
-        if (start >= 0) {
-            if (ftruncate(fileno(eg_wal.fp), start) == 0) {}   /* drop torn bytes */
-            fseek(eg_wal.fp, 0, SEEK_END);
-        }
-        return 0;
-    }
-    eg_wal.bytes += EG_WAL_HDR_LEN + (int64_t)plen;
-    eg_wal.uncommitted++;
-    eg_wal_commit(0);
-    return 1;
-}
-
-/* ── Single-record apply (replay + live are the same code path) ───────────── */
-
-/* Populate an EngramNode (freshly memset OR an existing node being overwritten
- * in place) from a node JSON object. Mirrors engram_load's field set exactly,
- * WITHOUT the boot-time working_memory_weight laundering, so replay reproduces
- * the exact logged state (parity with the direct-apply oracle). Caller owns
- * freeing prior heap fields when overwriting. */
-static void eg_fill_node_from_json(EngramNode* nn, const char* obj) {
-    nn->id        = eg_get_str_field(obj, "id");
-    nn->content   = eg_get_str_field(obj, "content");
-    nn->node_type = eg_get_str_field(obj, "node_type");
-    nn->label     = eg_get_str_field(obj, "label");
-    nn->tier      = eg_get_str_field(obj, "tier");
-    nn->tags      = eg_get_str_field(obj, "tags");
-    nn->metadata  = eg_get_str_field(obj, "metadata");
-    if (!nn->metadata || !*nn->metadata) { free(nn->metadata); nn->metadata = el_strdup_persist("{}"); }
-    nn->salience            = eg_get_num_field(obj, "salience");
-    nn->importance          = eg_get_num_field(obj, "importance");
-    nn->confidence          = eg_get_num_field(obj, "confidence");
-    nn->temporal_decay_rate = eg_get_num_field(obj, "temporal_decay_rate");
-    nn->activation_count    = eg_get_int_field(obj, "activation_count");
-    nn->last_activated      = eg_get_int_field(obj, "last_activated");
-    nn->created_at          = eg_get_int_field(obj, "created_at");
-    nn->updated_at          = eg_get_int_field(obj, "updated_at");
-    nn->background_activation = eg_get_num_field(obj, "background_activation");
-    nn->working_memory_weight = eg_get_num_field(obj, "working_memory_weight");
-    nn->suppression_count   = (int32_t)eg_get_int_field(obj, "suppression_count");
-    if (json_find_key(obj, "layer_id")) nn->layer_id = (uint32_t)eg_get_int_field(obj, "layer_id");
-    else                                nn->layer_id = ENGRAM_LAYER_DEFAULT;
-    nn->wm_anchor = eg_get_num_field(obj, "wm_anchor");
-    { char* ats = eg_get_str_field(obj, "access_ts"); if (ats) { engram_bll_parse_access(nn, ats); free(ats); } }
-    { char* es  = eg_get_str_field(obj, "emb");       if (es)  { eg_parse_emb(nn, es); free(es); } }
-}
-
-static void eg_free_node_heap(EngramNode* n) {
-    free(n->id); free(n->content); free(n->node_type); free(n->label);
-    free(n->tier); free(n->tags); free(n->metadata); free(n->emb);
-}
-static void eg_free_edge_heap(EngramEdge* e) {
-    free(e->id); free(e->from_id); free(e->to_id); free(e->relation); free(e->metadata);
-}
-
-/* Upsert a node by id. Idempotent: replaying the same NODE_PUT twice yields
- * the same single node. */
-static void eg_apply_node_put(const char* obj) {
-    EngramStore* g = engram_get();
-    char* id = eg_get_str_field(obj, "id");
-    if (!id || !*id) { free(id); return; }
-    int64_t idx = engram_find_node_index(id);
-    if (idx >= 0) {
-        EngramNode* n = &g->nodes[idx];
-        int32_t emb_dim = n->emb_dim; (void)emb_dim;
-        eg_free_node_heap(n);
-        memset(n, 0, sizeof(*n));
-        eg_fill_node_from_json(n, obj);
-        /* id unchanged → id_map entry (which owns its own key copy) stays
-         * valid; no re-put needed. */
-    } else {
-        engram_grow_nodes();
-        EngramNode* n = &g->nodes[g->node_count];
-        memset(n, 0, sizeof(*n));
-        eg_fill_node_from_json(n, obj);
-        int64_t ni = g->node_count;
-        g->node_count++;
-        if (n->id && *n->id) engram_idmap_put(g, n->id, ni);
-    }
-    g->adj_dirty = 1;
-    free(id);
-}
-
-static int64_t eg_find_edge_index(EngramStore* g, const char* id) {
-    if (!id || !*id) return -1;
-    for (int64_t i = 0; i < g->edge_count; i++)
-        if (g->edges[i].id && strcmp(g->edges[i].id, id) == 0) return i;
-    return -1;
-}
-static void eg_fill_edge_from_json(EngramEdge* ee, const char* obj) {
-    ee->id       = eg_get_str_field(obj, "id");
-    ee->from_id  = eg_get_str_field(obj, "from_id");
-    ee->to_id    = eg_get_str_field(obj, "to_id");
-    ee->relation = eg_get_str_field(obj, "relation");
-    ee->metadata = eg_get_str_field(obj, "metadata");
-    if (!ee->metadata || !*ee->metadata) { free(ee->metadata); ee->metadata = el_strdup_persist("{}"); }
-    ee->weight     = eg_get_num_field(obj, "weight");
-    ee->hebb       = eg_get_num_field(obj, "hebb");
-    ee->confidence = eg_get_num_field(obj, "confidence");
-    ee->created_at = eg_get_int_field(obj, "created_at");
-    ee->updated_at = eg_get_int_field(obj, "updated_at");
-    ee->last_fired = eg_get_int_field(obj, "last_fired");
-    ee->inhibitory = (int)eg_get_int_field(obj, "inhibitory");
-    if (json_find_key(obj, "layer_id")) ee->layer_id = (uint32_t)eg_get_int_field(obj, "layer_id");
-    else                                ee->layer_id = ENGRAM_LAYER_DEFAULT;
-}
-static void eg_apply_edge_put(const char* obj) {
-    EngramStore* g = engram_get();
-    char* id = eg_get_str_field(obj, "id");
-    int64_t idx = eg_find_edge_index(g, id);
-    if (idx >= 0) {
-        EngramEdge* e = &g->edges[idx];
-        eg_free_edge_heap(e);
-        memset(e, 0, sizeof(*e));
-        eg_fill_edge_from_json(e, obj);
-    } else {
-        engram_grow_edges();
-        EngramEdge* e = &g->edges[g->edge_count];
-        memset(e, 0, sizeof(*e));
-        eg_fill_edge_from_json(e, obj);
-        g->edge_count++;
-    }
-    g->adj_dirty = 1;
-    free(id);
-}
-
-/* TOMBSTONE / SUPERSEDE — store-level soft markers on the node's metadata.
- * (The server's DELETE route uses the higher-level marker-node model; these
- * ops exist for completeness and are replay-idempotent.) */
-static void eg_apply_meta_marker(const char* obj, const char* markerfield, const char* from) {
-    EngramStore* g = engram_get();
-    char* id = eg_get_str_field(obj, "id");
-    int64_t idx = engram_find_node_index(id);
-    if (idx >= 0) {
-        EngramNode* n = &g->nodes[idx];
-        char* by = from ? eg_get_str_field(obj, from) : NULL;
-        size_t need = strlen(markerfield) + (by ? strlen(by) : 4) + 32;
-        char* meta = (char*)malloc(need);
-        if (by && *by) snprintf(meta, need, "{\"%s\":\"%s\"}", markerfield, by);
-        else           snprintf(meta, need, "{\"%s\":1}", markerfield);
-        free(n->metadata); n->metadata = el_strdup_persist(meta);
-        free(meta); free(by);
-    }
-    free(id);
-}
-
-static void eg_apply_layer_put(const char* obj) {
-    EngramStore* g = engram_get();
-    uint32_t lid = (uint32_t)eg_get_int_field(obj, "layer_id");
-    EngramLayer* L = NULL;
-    for (size_t i = 0; i < g->layer_count; i++)
-        if (g->layers[i].layer_id == lid) { L = &g->layers[i]; break; }
-    if (!L) {
-        if (g->layer_count >= g->layer_capacity) {
-            size_t nc = g->layer_capacity ? g->layer_capacity * 2 : 16;
-            EngramLayer* grown = realloc(g->layers, nc * sizeof(EngramLayer));
-            if (!grown) return;
-            memset(grown + g->layer_capacity, 0, (nc - g->layer_capacity) * sizeof(EngramLayer));
-            g->layers = grown; g->layer_capacity = nc;
-        }
-        L = &g->layers[g->layer_count++];
-        memset(L, 0, sizeof(*L));
-    } else if (L->name) { free(L->name); L->name = NULL; }
-    L->layer_id            = lid;
-    L->activation_priority = (uint32_t)eg_get_int_field(obj, "activation_priority");
-    L->suppressible        = (int)eg_get_int_field(obj, "suppressible") ? 1 : 0;
-    L->transparent         = (int)eg_get_int_field(obj, "transparent")  ? 1 : 0;
-    L->injectable          = (int)eg_get_int_field(obj, "injectable")   ? 1 : 0;
-    char* nm = eg_get_str_field(obj, "name");
-    L->name = el_strdup_persist(nm && *nm ? nm : "");
-    free(nm);
-}
-static void eg_apply_layer_del(const char* obj) {
-    EngramStore* g = engram_get();
-    uint32_t lid = (uint32_t)eg_get_int_field(obj, "layer_id");
-    for (size_t i = 0; i < g->layer_count; i++)
-        if (g->layers[i].layer_id == lid && g->layers[i].name) {
-            free(g->layers[i].name); g->layers[i].name = NULL; break;
-        }
-}
-static void eg_apply_forget(const char* obj) {
-    char* id = eg_get_str_field(obj, "id");
-    if (id && *id) engram_forget((el_val_t)(uintptr_t)id);
-    free(id);
-}
-
-/* Apply one decoded record to the in-RAM store. HEBB_BATCH payload is a JSON
- * object {"edges":[edge,…]} — one record, one fsync, N edge upserts (§5-B). */
-static void eg_wal_apply(uint8_t op, const char* payload, size_t plen) {
-    char* obj = (char*)malloc(plen + 1);
-    if (!obj) return;
-    memcpy(obj, payload, plen); obj[plen] = '\0';
-    switch (op) {
-        case EG_OP_NODE_PUT:     eg_apply_node_put(obj); break;
-        case EG_OP_EDGE_PUT:     eg_apply_edge_put(obj); break;
-        case EG_OP_TOMBSTONE:    eg_apply_meta_marker(obj, "tombstoned", NULL); break;
-        case EG_OP_SUPERSEDE:    eg_apply_meta_marker(obj, "superseded_by", "by"); break;
-        case EG_OP_LAYER_PUT:    eg_apply_layer_put(obj); break;
-        case EG_OP_LAYER_DEL:    eg_apply_layer_del(obj); break;
-        case EG_OP_FORGET:       eg_apply_forget(obj); break;
-        case EG_OP_HEBB_BATCH: {
-            const char* arr = json_find_key(obj, "edges");
-            if (arr) { arr = eg_skip_ws(arr);
-                if (*arr == '[') { arr++; arr = eg_skip_ws(arr);
-                    while (*arr && *arr != ']') {
-                        if (*arr != '{') { arr++; continue; }
-                        const char* end = json_skip_value(arr);
-                        size_t en = (size_t)(end - arr);
-                        char* eobj = (char*)malloc(en + 1);
-                        memcpy(eobj, arr, en); eobj[en] = '\0';
-                        eg_apply_edge_put(eobj);
-                        free(eobj);
-                        arr = eg_skip_ws(end);
-                        if (*arr == ',') { arr++; arr = eg_skip_ws(arr); }
-                    }
-                }
-            }
-            break;
-        }
-        case EG_OP_COMPACT_MARK: break; /* boundary marker; no state change */
-        default: break;
-    }
-    free(obj);
-}
-
-/* ── Replay (§6) ─────────────────────────────────────────────────────────────
- * Reads records in lsn order, applies each intact one, and stops at the first
- * record that fails magic/length/crc validation (torn tail) — never crashes.
- * Returns the number of records applied; sets *out_last_lsn to the highest
- * good lsn seen (0 if none). */
-static int64_t eg_wal_replay_file(const char* path, uint64_t* out_last_lsn) {
-    if (out_last_lsn) *out_last_lsn = 0;
-    FILE* f = fopen(path, "rb");
-    if (!f) return 0;
-    fseek(f, 0, SEEK_END); long fsz = ftell(f); rewind(f);
-    if (fsz <= 0) { fclose(f); return 0; }
-    uint8_t* buf = (uint8_t*)malloc((size_t)fsz);
-    if (!buf) { fclose(f); return 0; }
-    size_t got = fread(buf, 1, (size_t)fsz, f);
-    fclose(f);
-    int64_t applied = 0;
-    size_t off = 0;
-    while (off + EG_WAL_HDR_LEN <= got) {
-        uint32_t magic, len32, crc; uint64_t lsn; uint8_t op, flags;
-        memcpy(&magic, buf + off + 0, 4);
-        if (magic != EG_WAL_MAGIC) break;               /* garbage / torn */
-        memcpy(&len32, buf + off + 4, 4);
-        op = buf[off + 8]; flags = buf[off + 9];
-        memcpy(&lsn, buf + off + 10, 8);
-        memcpy(&crc, buf + off + 18, 4);
-        size_t plen = (size_t)len32;
-        if (off + EG_WAL_HDR_LEN + plen > got) break;    /* short final record */
-        const char* payload = (const char*)(buf + off + EG_WAL_HDR_LEN);
-        if (eg_wal_record_crc(op, flags, lsn, payload, plen) != crc) break; /* torn */
-        eg_wal_apply(op, payload, plen);
-        if (out_last_lsn) *out_last_lsn = lsn;
-        applied++;
-        off += EG_WAL_HDR_LEN + plen;
-    }
-    free(buf);
-    return applied;
-}
-
-static void eg_wal_build_path(const char* dir, char* out, size_t cap) {
-    snprintf(out, cap, "%s/engram.wal", dir ? dir : ".");
-}
-
-/* Open (create if absent) the WAL for appending. Idempotent for a given dir. */
-static int eg_wal_open(const char* dir) {
-    char path[1024];
-    eg_wal_build_path(dir, path, sizeof(path));
-    if (eg_wal.fp && strcmp(eg_wal.path, path) == 0) return 1; /* already open */
-    if (eg_wal.fp) { fclose(eg_wal.fp); eg_wal.fp = NULL; }
-    FILE* f = fopen(path, "ab");
-    if (!f) return 0;
-    eg_wal.fp = f;
-    snprintf(eg_wal.path, sizeof(eg_wal.path), "%s", path);
-    fseek(f, 0, SEEK_END);
-    eg_wal.bytes = ftell(f);
-    eg_wal.last_sync_ms = engram_now_ms();
-    eg_wal.uncommitted = 0;
-    return 1;
-}
-
-/* ── EL-facing builtins ──────────────────────────────────────────────────── */
-
-/* Boot: replay <dir>/engram.wal over the already-loaded base snapshot, then
- * open the WAL for appending, continuing the lsn sequence. Idempotent replay
- * makes overlap with the base harmless (§6). Returns records replayed. */
-el_val_t engram_wal_boot(el_val_t dir) {
-    const char* d = EL_CSTR(dir);
-    char path[1024];
-    eg_wal_build_path(d, path, sizeof(path));
-    uint64_t last = 0;
-    int64_t applied = eg_wal_replay_file(path, &last);
-    eg_wal.lsn = last;               /* continue monotonically */
-    eg_wal_open(d);
-    return (el_val_t)applied;
-}
-
-el_val_t engram_wal_open_dir(el_val_t dir) {
-    return (el_val_t)(int64_t)eg_wal_open(EL_CSTR(dir));
-}
-
-/* Append a NODE_PUT for node `id` (serialized via the shared emitter, incl.
- * emb). Returns 1 on success. */
-el_val_t engram_wal_node_put(el_val_t dir, el_val_t id) {
-    if (!eg_wal_open(EL_CSTR(dir))) return (el_val_t)0;
-    EngramNode* n = engram_find_node(EL_CSTR(id));
-    if (!n) return (el_val_t)0;
-    JsonBuf b; jb_init(&b);
-    engram_emit_node_json(&b, n, 1);
-    int ok = eg_wal_write(EG_OP_NODE_PUT, 0, b.buf, b.len);
-    free(b.buf);
-    return (el_val_t)(int64_t)ok;
-}
-
-/* Append an EDGE_PUT for every edge at index >= start_count. Covers both the
- * single-edge route and any append-only batch. Returns edges logged. */
-el_val_t engram_wal_edges_since(el_val_t dir, el_val_t start_count) {
-    if (!eg_wal_open(EL_CSTR(dir))) return (el_val_t)0;
-    EngramStore* g = engram_get();
-    int64_t start = (int64_t)start_count; if (start < 0) start = 0;
-    int64_t logged = 0;
-    for (int64_t i = start; i < g->edge_count; i++) {
-        JsonBuf b; jb_init(&b);
-        engram_emit_edge_json(&b, &g->edges[i]);
-        if (eg_wal_write(EG_OP_EDGE_PUT, 0, b.buf, b.len)) logged++;
-        free(b.buf);
-    }
-    return (el_val_t)logged;
-}
-
-/* Append ONE HEBB_BATCH record covering every edge at index >= start_count
- * (single fsync for the whole consolidation batch — §5 tier B). */
-el_val_t engram_wal_hebb_batch(el_val_t dir, el_val_t start_count) {
-    if (!eg_wal_open(EL_CSTR(dir))) return (el_val_t)0;
-    EngramStore* g = engram_get();
-    int64_t start = (int64_t)start_count; if (start < 0) start = 0;
-    if (start >= g->edge_count) return (el_val_t)0;
-    JsonBuf b; jb_init(&b);
-    jb_puts(&b, "{\"edges\":[");
-    int first = 1;
-    for (int64_t i = start; i < g->edge_count; i++) {
-        if (!first) jb_putc(&b, ',');
-        first = 0;
-        engram_emit_edge_json(&b, &g->edges[i]);
-    }
-    jb_puts(&b, "]}");
-    int ok = eg_wal_write(EG_OP_HEBB_BATCH, 0, b.buf, b.len);
-    free(b.buf);
-    return (el_val_t)(int64_t)ok;
-}
-
-/* Append a FORGET (hard remove). Internal-GC only — NOT wired to HTTP DELETE. */
-el_val_t engram_wal_forget(el_val_t dir, el_val_t id) {
-    if (!eg_wal_open(EL_CSTR(dir))) return (el_val_t)0;
-    const char* sid = EL_CSTR(id);
-    JsonBuf b; jb_init(&b);
-    jb_puts(&b, "{\"id\":"); jb_emit_escaped(&b, sid ? sid : ""); jb_putc(&b, '}');
-    int ok = eg_wal_write(EG_OP_FORGET, 0, b.buf, b.len);
-    free(b.buf);
-    return (el_val_t)(int64_t)ok;
-}
-
-/* Compaction (§7). Crash-safe ordering: fresh base snapshot renamed into place
- * (engram_save is atomic temp+fsync+rename) BEFORE the WAL is truncated. A
- * crash in the window replays the still-present WAL over the (old or new)
- * base; idempotent apply converges. */
-static int eg_wal_compact(const char* dir) {
-    char snap[1024], waltmp[1024], walpath[1024];
-    snprintf(snap, sizeof(snap), "%s/snapshot.json", dir);
-    eg_wal_build_path(dir, walpath, sizeof(walpath));
-    snprintf(waltmp, sizeof(waltmp), "%s/engram.wal.tmp", dir);
-    /* 1. new base (atomic) */
-    if (!engram_save((el_val_t)(uintptr_t)snap)) return 0;
-    /* fsync the directory so the rename is durable before we touch the WAL */
-    { int dfd = open(dir, O_RDONLY); if (dfd >= 0) { fsync(dfd); close(dfd); } }
-    /* 2. fresh WAL containing only a COMPACT_MARK, atomically swapped in */
-    uint64_t base_lsn = eg_wal.lsn;
-    FILE* tf = fopen(waltmp, "wb");
-    if (!tf) return 0;
-    {
-        char pl[64]; int pn = snprintf(pl, sizeof(pl), "{\"base_lsn\":%llu}", (unsigned long long)base_lsn);
-        uint64_t lsn = ++eg_wal.lsn;
-        uint32_t magic = EG_WAL_MAGIC, len32 = (uint32_t)pn;
-        uint32_t crc = eg_wal_record_crc(EG_OP_COMPACT_MARK, 0, lsn, pl, pn);
-        uint8_t hdr[EG_WAL_HDR_LEN];
-        memcpy(hdr, &magic, 4); memcpy(hdr + 4, &len32, 4);
-        hdr[8] = EG_OP_COMPACT_MARK; hdr[9] = 0;
-        memcpy(hdr + 10, &lsn, 8); memcpy(hdr + 18, &crc, 4);
-        fwrite(hdr, 1, EG_WAL_HDR_LEN, tf); fwrite(pl, 1, pn, tf);
-        fflush(tf); fsync(fileno(tf));
-    }
-    fclose(tf);
-    if (eg_wal.fp) { fclose(eg_wal.fp); eg_wal.fp = NULL; }
-    if (rename(waltmp, walpath) != 0) { return 0; }
-    { int dfd = open(dir, O_RDONLY); if (dfd >= 0) { fsync(dfd); close(dfd); } }
-    /* 3. reopen the truncated WAL for appending */
-    eg_wal_open(dir);
-    return 1;
-}
-
-el_val_t engram_wal_compact(el_val_t dir) {
-    return (el_val_t)(int64_t)eg_wal_compact(EL_CSTR(dir));
-}
-
-/* Compact iff the WAL has crossed the size threshold. Returns 1 if compacted. */
-el_val_t engram_wal_maybe_compact(el_val_t dir) {
-    if (!eg_wal.fp) eg_wal_open(EL_CSTR(dir));
-    if (eg_wal.bytes > eg_wal_compact_bytes())
-        return (el_val_t)(int64_t)eg_wal_compact(EL_CSTR(dir));
-    return (el_val_t)0;
-}
-
-/* ── Integrity: safe data-dir resolution (§18.2) ─────────────────────────────
- * Unset ENGRAM_DATA_DIR → $HOME/.neuron/engram (created if absent). If HOME is
- * also unresolvable, FAIL LOUD (exit) rather than silently persisting to an
- * ephemeral /tmp. Prod (ENGRAM_DATA_DIR=/data) is unaffected. */
-el_val_t engram_resolve_data_dir(void) {
-    const char* d = getenv("ENGRAM_DATA_DIR");
-    if (d && *d) return el_wrap_str(el_strdup(d));
-    const char* home = getenv("HOME");
-    if (!home || !*home) {
-        fprintf(stderr, "[engram] FATAL: ENGRAM_DATA_DIR unset and HOME unresolved; "
-                        "refusing to persist to an ephemeral dir. Set ENGRAM_DATA_DIR.\n");
-        exit(1);
-    }
-    char neuron[1024], engramdir[1024];
-    snprintf(neuron, sizeof(neuron), "%s/.neuron", home);
-    snprintf(engramdir, sizeof(engramdir), "%s/.neuron/engram", home);
-    mkdir(neuron, 0700);
-    mkdir(engramdir, 0700);
-    return el_wrap_str(el_strdup(engramdir));
-}
-
-/* ── Integrity: store-level write-protection (§18.1, §18.3) ──────────────────
- * The protected set is DERIVED from the self-graph at call time, not hardcoded:
- * the self root and the values hub, plus every node adjacent to either (in
- * either direction). Adjacency of the values hub yields all value nodes; of
- * the self root yields the identity children — so new values/identity stay
- * protected automatically. */
-#define EG_SELF_ROOT  "kn-efeb4a5b"
-#define EG_VALUES_HUB "kn-5b606390"
-
-static int eg_is_neighbor_of(EngramStore* g, const char* hub, const char* id) {
-    for (int64_t i = 0; i < g->edge_count; i++) {
-        EngramEdge* e = &g->edges[i];
-        if (e->from_id && e->to_id) {
-            if (strcmp(e->from_id, hub) == 0 && strcmp(e->to_id, id) == 0) return 1;
-            if (strcmp(e->to_id, hub) == 0 && strcmp(e->from_id, id) == 0) return 1;
-        }
-    }
-    return 0;
-}
-static int eg_is_protected(const char* id) {
-    if (!id || !*id) return 0;
-    if (strcmp(id, EG_SELF_ROOT) == 0)  return 1;
-    if (strcmp(id, EG_VALUES_HUB) == 0) return 1;
-    EngramStore* g = engram_get();
-    if (eg_is_neighbor_of(g, EG_VALUES_HUB, id)) return 1;
-    if (eg_is_neighbor_of(g, EG_SELF_ROOT, id))  return 1;
-    return 0;
-}
-el_val_t engram_is_protected(el_val_t id) {
-    return (el_val_t)(int64_t)eg_is_protected(EL_CSTR(id));
-}
-
-/* Derived protected set as a JSON array (self root + values hub + all adjacent
- * ids). For diagnostics and the integrity tests (§18.5). */
-el_val_t engram_protected_json(void) {
-    EngramStore* g = engram_get();
-    JsonBuf b; jb_init(&b);
-    jb_putc(&b, '[');
-    int first = 1;
-    const char* seeds[2] = { EG_SELF_ROOT, EG_VALUES_HUB };
-    /* emit the two hubs themselves */
-    for (int s = 0; s < 2; s++) {
-        if (!first) jb_putc(&b, ','); first = 0;
-        jb_emit_escaped(&b, seeds[s]);
-    }
-    for (int64_t i = 0; i < g->node_count; i++) {
-        const char* nid = g->nodes[i].id;
-        if (!nid || !*nid) continue;
-        if (strcmp(nid, EG_SELF_ROOT) == 0 || strcmp(nid, EG_VALUES_HUB) == 0) continue;
-        if (eg_is_neighbor_of(g, EG_VALUES_HUB, nid) || eg_is_neighbor_of(g, EG_SELF_ROOT, nid)) {
-            if (!first) jb_putc(&b, ','); first = 0;
-            jb_emit_escaped(&b, nid);
-        }
-    }
-    jb_putc(&b, ']');
-    return el_wrap_str(b.buf);
-}
-
 /* ── Engram JSON-string accessors ─────────────────────────────────────────
  * These return pre-serialized JSON strings so callers (especially HTTP
  * handlers) don't have to round-trip ElList/ElMap through json_stringify

lang/releases/v1.0.0-20260501/el_runtime.h

@@ -34,12 +34,12 @@
  *                pq_hybrid_* and HKDF-SHA256 derivation.
  *
  * Canonical compile command:
- *   cc -std=c11 -I runtime -lcurl -lpthread \
- *      -o <out> <prog>.c runtime/el_runtime.c
+ *   cc -std=c11 -I el-compiler/runtime -lcurl -lpthread \
+ *      -o <out> <prog>.c el-compiler/runtime/el_runtime.c
  *
  * With liboqs (post-quantum stack):
- *   cc -std=c11 -I runtime -lcurl -lpthread -loqs -lcrypto \
- *      -o <out> <prog>.c runtime/el_runtime.c
+ *   cc -std=c11 -I el-compiler/runtime -lcurl -lpthread -loqs -lcrypto \
+ *      -o <out> <prog>.c el-compiler/runtime/el_runtime.c
  */
 
 #pragma once
@@ -631,27 +631,12 @@ el_val_t  engram_label_df(el_val_t term);
 el_val_t  engram_embed_backfill(el_val_t count);
 el_val_t  engram_list_layers_json(void);
 /* Working memory introspection — count, mean weight, and top-N snapshot.
- * Ported from runtime on 2026-06-30 self-review. */
+ * Ported from el-compiler/runtime on 2026-06-30 self-review. */
 el_val_t  engram_wm_count(void);
 el_val_t  engram_wm_avg_weight(void);
 el_val_t  engram_wm_top_json(el_val_t n);
 /* Merge-load: add nodes/edges from a snapshot without resetting the store. */
 el_val_t  engram_load_merge(el_val_t path);
-
-/* ── WAL + compaction + integrity (ENGRAM_WAL=on; design doc §§3-14,§18) ──── */
-int       engram_wal_enabled(void);
-el_val_t  engram_crc32(el_val_t s);
-el_val_t  engram_wal_boot(el_val_t dir);          /* replay + open; returns records */
-el_val_t  engram_wal_open_dir(el_val_t dir);
-el_val_t  engram_wal_node_put(el_val_t dir, el_val_t id);
-el_val_t  engram_wal_edges_since(el_val_t dir, el_val_t start_count);
-el_val_t  engram_wal_hebb_batch(el_val_t dir, el_val_t start_count);
-el_val_t  engram_wal_forget(el_val_t dir, el_val_t id);
-el_val_t  engram_wal_compact(el_val_t dir);
-el_val_t  engram_wal_maybe_compact(el_val_t dir);
-el_val_t  engram_resolve_data_dir(void);          /* §18.2 fail-loud default */
-el_val_t  engram_is_protected(el_val_t id);       /* §18.1/18.3 derived set */
-el_val_t  engram_protected_json(void);
 /* engram_compile_layered_json — produce a prompt-ready text block split
  * into "[LAYER 0 — STRUCTURAL]" (non-suppressible layers, sacred fire)
  * and "[ENGRAM CONTEXT]" (standard suppressible layers). Returns "" if

lang/runtime/json.el

@@ -2,7 +2,7 @@
 //
 // Thin El wrappers over seed JSON primitives, plus pure-El builders and
 // helpers.  Each function here corresponds to (and replaces) a C function
-// from runtime/el_runtime.c (lines 2692–3333).
+// from el-compiler/runtime/legacy/el_runtime.c (lines 2692–3333).
 //
 // Seed primitives consumed by this module:
 //   __json_get(json, key)              -> String   (value as string)

lang/runtime/manifest.el

@@ -25,8 +25,8 @@
 //       runtime/collections.el \
 //       <user-program.el> > combined.el
 //   ./dist/platform/elc combined.el > output.c
-//   cc -std=c11 -I runtime -lcurl -lpthread \
-//      -o output output.c runtime/el_seed.c
+//   cc -std=c11 -I el-compiler/runtime -lcurl -lpthread \
+//      -o output output.c el-compiler/runtime/el_seed.c
 
 // This file itself is not compiled — it is documentation only.
 fn runtime_version() -> String {

lang/runtime/math.el

@@ -1,6 +1,6 @@
 // runtime/math.el — Float math, integer utilities, and numeric conversions.
 //
-// Implements the math/float surface from runtime/el_runtime.c
+// Implements the math/float surface from el-compiler/runtime/legacy/el_runtime.c
 // (lines 303–305 for el_abs/max/min, lines 4725–4771 for float/format ops)
 // in pure El, using seed primitives.
 //

lang/runtime/time.el

@@ -1,6 +1,6 @@
 // runtime/time.el — Time operations, sleep, and formatting.
 //
-// Implements the time surface from runtime/el_runtime.c
+// Implements the time surface from el-compiler/runtime/legacy/el_runtime.c
 // (lines 3334–3440, 3471–3656) in pure El, using seed primitives.
 //
 // Seed primitives consumed:

lang/tests/calendar/run.sh

@@ -11,7 +11,7 @@ cd "$(dirname "$0")"
 
 EL_HOME="${EL_HOME:-$(cd ../.. && pwd)}"
 ELC="${EL_HOME}/dist/platform/elc"
-RUNTIME_DIR="${EL_HOME}/runtime"
+RUNTIME_DIR="${EL_HOME}/el-compiler/runtime"
 
 if [ ! -x "${ELC}" ]; then
     echo "elc not found at ${ELC}" >&2

lang/tests/html_sanitizer/run.sh

@@ -10,7 +10,7 @@ cd "$(dirname "$0")"
 
 EL_HOME="${EL_HOME:-$(cd ../.. && pwd)}"
 ELC="${EL_HOME}/dist/platform/elc"
-RUNTIME_DIR="${EL_HOME}/runtime"
+RUNTIME_DIR="${EL_HOME}/el-compiler/runtime"
 
 if [ ! -x "${ELC}" ]; then
     echo "elc not found at ${ELC}" >&2

lang/tests/runtime/string_test.el

@@ -14,8 +14,8 @@
 //       tests/runtime/string_test.el > /tmp/string_test_combined.el
 //
 //   ./dist/platform/elc /tmp/string_test_combined.el > /tmp/string_test.c
-//   cc -std=c11 -I runtime -lcurl -lpthread \
-//      -o /tmp/string_test /tmp/string_test.c runtime/el_seed.c
+//   cc -std=c11 -I el-compiler/runtime -lcurl -lpthread \
+//      -o /tmp/string_test /tmp/string_test.c el-compiler/runtime/el_seed.c
 //   /tmp/string_test; echo "exit: $?"
 //
 // Exit code equals the number of failing assertions (0 = all pass).

lang/tests/text/run.sh

@@ -11,7 +11,7 @@ cd "$(dirname "$0")"
 
 EL_HOME="${EL_HOME:-$(cd ../.. && pwd)}"
 ELC="${ELC:-${EL_HOME}/dist/platform/elc}"
-RUNTIME_DIR="${EL_HOME}/runtime"
+RUNTIME_DIR="${EL_HOME}/el-compiler/runtime"
 
 if [ ! -x "${ELC}" ]; then
     echo "elc not found at ${ELC}" >&2

lang/tests/time/run.sh

@@ -16,7 +16,7 @@ cd "$(dirname "$0")"
 
 EL_HOME="${EL_HOME:-$(cd ../.. && pwd)}"
 ELC="${EL_HOME}/dist/platform/elc"
-RUNTIME_DIR="${EL_HOME}/runtime"
+RUNTIME_DIR="${EL_HOME}/el-compiler/runtime"
 
 if [ ! -x "${ELC}" ]; then
     echo "elc not found at ${ELC}" >&2

lang/tools/install.sh

@@ -44,7 +44,7 @@ INCLUDE_DIR="${PREFIX}/include"
 LIB_DIR="${PREFIX}/lib"
 
 ELC_SRC="${EL_ROOT}/dist/platform/elc"
-RUNTIME_SRC="${EL_ROOT}/runtime"
+RUNTIME_SRC="${EL_ROOT}/el-compiler/runtime"
 STDLIB_SRC="${EL_ROOT}/runtime"
 
 echo "==> Installing El framework to ${PREFIX}"

lang/tools/new-project.sh

@@ -42,7 +42,7 @@ fi
 # Discover el_runtime.c
 EL_RUNTIME=""
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-LOCAL_RUNTIME="${SCRIPT_DIR}/../runtime/el_runtime.c"
+LOCAL_RUNTIME="${SCRIPT_DIR}/../el-compiler/runtime/el_runtime.c"
 if [[ -f "${LOCAL_RUNTIME}" ]]; then
     EL_RUNTIME="$(cd "$(dirname "${LOCAL_RUNTIME}")" && pwd)/$(basename "${LOCAL_RUNTIME}")"
     EL_INCLUDE="$(dirname "${EL_RUNTIME}")"

scripts/check-single-runtime.sh

@@ -1,94 +0,0 @@
-#!/usr/bin/env bash
-# check-single-runtime.sh — CODE-VS-ARTIFACT drift guard for the el runtime.
-#
-# Enforces org policy docs/CODE-VS-ARTIFACT.md rule #1 (single source of truth):
-# there is exactly ONE authored el_runtime.c, and it lives at lang/runtime/.
-# Any other el_runtime.c in the tree is a fork (a hand-synced copy). A lagging
-# fork is exactly what shipped to prod and dropped learned `hebb` edges on
-# restart — this guard exists to make that class of bug impossible to reintroduce.
-#
-# Exemptions:
-#   * Build output — generated amalgamations under any dist/ or build/ dir are
-#     artifacts, not sources.
-#   * A small, explicit ALLOWLIST of pre-existing example-app vendored/staging
-#     copies (see below). These are KNOWN DEFERRED DEBT, tracked separately from
-#     the SDK/CI-published runtime. They do NOT ship to prod. The guard warns on
-#     them (visible, greppable) but does not fail — while HARD-FAILING on any new
-#     or non-allowlisted fork, including any return of lang/el-compiler/runtime/
-#     or a lang/releases/ vendored copy.
-#
-# Wire-in: run from the repo root in CI (see note at bottom). Exits non-zero on drift.
-set -euo pipefail
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd)"
-cd "$ROOT"
-
-CANONICAL="lang/runtime/el_runtime.c"
-
-# KNOWN DEFERRED example-app forks — remove these as a follow-up, then delete
-# this allowlist. iOS + Docker copies are regenerated by their build scripts
-# (cp from lang/runtime) and can be git-rm'd now; the Android jni/ copy is a
-# committed source its CMake build depends on and needs a build-script change
-# (cp from lang/runtime) before removal. Tracked in docs/CODE-VS-ARTIFACT.md.
-ALLOWLIST=(
-  "ui/examples/native-hello-android/app/src/main/jni/el_runtime.c"
-  "ui/examples/native-hello-ios/NativeHello/el_runtime.c"
-  "ui/examples/native-hello/build-docker/runtime/el_runtime.c"
-)
-
-is_allowlisted() {
-  local p="$1"
-  for a in "${ALLOWLIST[@]}"; do [ "$p" = "$a" ] && return 0; done
-  return 1
-}
-
-if [ ! -f "$CANONICAL" ]; then
-  echo "FATAL: canonical runtime source missing: $CANONICAL" >&2
-  exit 1
-fi
-
-# All el_runtime.c files tracked by git, excluding build output (dist/ , build/)
-# and the canonical source itself.
-mapfile -t CANDIDATES < <(
-  git ls-files '*el_runtime.c' \
-    | grep -Ev '(^|/)(dist|build)/' \
-    | grep -vx "$CANONICAL" || true
-)
-
-FORKS=()
-DEFERRED=()
-for f in "${CANDIDATES[@]}"; do
-  if is_allowlisted "$f"; then DEFERRED+=("$f"); else FORKS+=("$f"); fi
-done
-
-if [ "${#DEFERRED[@]}" -gt 0 ]; then
-  echo "WARN: allowlisted (deferred) el_runtime.c forks still present — clean these up:" >&2
-  for f in "${DEFERRED[@]}"; do echo "        - $f" >&2; done
-fi
-
-if [ "${#FORKS[@]}" -gt 0 ]; then
-  echo "FATAL: el_runtime.c fork(s) detected outside the canonical location." >&2
-  echo "       Canonical (the ONLY allowed source): $CANONICAL" >&2
-  echo "       Offending copies:" >&2
-  for f in "${FORKS[@]}"; do echo "         - $f" >&2; done
-  echo "" >&2
-  echo "Consumers must build against $CANONICAL (pin by git ref where" >&2
-  echo "reproducibility matters) — never a hand-maintained copy." >&2
-  echo "See docs/CODE-VS-ARTIFACT.md." >&2
-  exit 1
-fi
-
-echo "OK: single canonical runtime source — $CANONICAL (no un-allowlisted forks)."
-
-# ---------------------------------------------------------------------------
-# CI wire-in:
-#   foundation/el .gitea/workflows/ci-dev.yaml, ci-stage.yaml, sdk-release.yaml
-#   Add an early step (before the build/publish steps). It must run from the
-#   REPO ROOT, so override the job's `defaults.run.working-directory: lang`:
-#
-#     - name: Guard - single canonical runtime source
-#       working-directory: ${{ github.workspace }}
-#       run: bash scripts/check-single-runtime.sh
-#
-#   Also add to .githooks/pre-commit so drift is caught before it is committed.
-# ---------------------------------------------------------------------------

ui/examples/native-hello-android/build.sh

@@ -18,7 +18,7 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 EL_LANG_ROOT="${SCRIPT_DIR}/../../../lang"
 EL_UI_ROOT="${SCRIPT_DIR}/../.."
-EL_RUNTIME="${EL_LANG_ROOT}/runtime"
+EL_RUNTIME="${EL_LANG_ROOT}/el-compiler/runtime"
 EL_NATIVE_VESSEL="${EL_UI_ROOT}/vessels/el-native/src/main.el"
 EL_APP_ENTRY="${EL_UI_ROOT}/examples/native-hello/src/main.el"
 EL_MANIFEST="${EL_UI_ROOT}/examples/native-hello/manifest.el"

ui/examples/native-hello-ios/build.sh

@@ -17,7 +17,7 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 EL_LANG_ROOT="${SCRIPT_DIR}/../../../lang"
 EL_UI_ROOT="${SCRIPT_DIR}/../.."
-EL_RUNTIME="${EL_LANG_ROOT}/runtime"
+EL_RUNTIME="${EL_LANG_ROOT}/el-compiler/runtime"
 EL_NATIVE_VESSEL="${EL_UI_ROOT}/vessels/el-native/src/main.el"
 EL_APP_ENTRY="${EL_UI_ROOT}/examples/native-hello/src/main.el"
 EL_MANIFEST="${EL_UI_ROOT}/examples/native-hello/manifest.el"

ui/examples/native-hello/build-gtk4.sh

@@ -24,7 +24,7 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 EL_LANG_ROOT="${SCRIPT_DIR}/../../../lang"
 EL_UI_ROOT="${SCRIPT_DIR}/../.."
-EL_RUNTIME="${EL_LANG_ROOT}/runtime"
+EL_RUNTIME="${EL_LANG_ROOT}/el-compiler/runtime"
 EL_NATIVE_VESSEL="${EL_UI_ROOT}/vessels/el-native/src/main.el"
 BUILD_DIR="${SCRIPT_DIR}/build-gtk4"
 

ui/examples/native-hello/build-sdl2.sh

@@ -23,7 +23,7 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 EL_LANG_ROOT="${SCRIPT_DIR}/../../../lang"
 EL_UI_ROOT="${SCRIPT_DIR}/../.."
-EL_RUNTIME="${EL_LANG_ROOT}/runtime"
+EL_RUNTIME="${EL_LANG_ROOT}/el-compiler/runtime"
 EL_NATIVE_VESSEL="${EL_UI_ROOT}/vessels/el-native/src/main.el"
 BUILD_DIR="${SCRIPT_DIR}/build"
 

ui/examples/native-hello/build-win32.sh

@@ -18,7 +18,7 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 EL_LANG_ROOT="${SCRIPT_DIR}/../../../lang"
 EL_UI_ROOT="${SCRIPT_DIR}/../.."
-EL_RUNTIME="${EL_LANG_ROOT}/runtime"
+EL_RUNTIME="${EL_LANG_ROOT}/el-compiler/runtime"
 EL_NATIVE_VESSEL="${EL_UI_ROOT}/vessels/el-native/src/main.el"
 BUILD_DIR="${SCRIPT_DIR}/build-win32"
 

ui/examples/native-hello/build.sh

@@ -40,7 +40,7 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 EL_LANG_ROOT="${SCRIPT_DIR}/../../../lang"
 EL_UI_ROOT="${SCRIPT_DIR}/../.."
-EL_RUNTIME="${EL_LANG_ROOT}/runtime"
+EL_RUNTIME="${EL_LANG_ROOT}/el-compiler/runtime"
 EL_NATIVE_VESSEL="${EL_UI_ROOT}/vessels/el-native/src/main.el"
 BUILD_DIR="${SCRIPT_DIR}/build"
 
@@ -193,6 +193,6 @@ run() {
 case "${1:-run}" in
     clean)     clean   ;;
     compile)   compile ;;
-    platforms) "${EL_LANG_ROOT}/runtime/detect-platforms" ;;
+    platforms) "${EL_LANG_ROOT}/el-compiler/runtime/detect-platforms" ;;
     run|*)     run     ;;
 esac

ui/examples/native-hello/docker-build-linux.sh

@@ -32,7 +32,7 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 EL_LANG_ROOT="${SCRIPT_DIR}/../../../lang"
 EL_UI_ROOT="${SCRIPT_DIR}/../.."
-EL_RUNTIME="${EL_LANG_ROOT}/runtime"
+EL_RUNTIME="${EL_LANG_ROOT}/el-compiler/runtime"
 EL_NATIVE_VESSEL="${EL_UI_ROOT}/vessels/el-native/src/main.el"
 BUILD_DIR="${SCRIPT_DIR}/build"
 DOCKER_CTX="${SCRIPT_DIR}/build-docker"