Grounding is the edge's weight, and the weight is a vector

A relation that keeps holding up strengthens; one that stops corresponding
decays. That is not analogous to grounding, it IS grounding — so it belongs on
the edge, not in a subsystem beside it. The graph was already the grounding
structure; this stops modelling it as something else.

Deleted, not refactored:
  - cog_ground_edge and the `grounded-by` relation type. A grounded-by edge
    models grounding as a relation BETWEEN nodes when it is a property OF a
    relation. #147 fixed which endpoints that edge landed on and left the wrong
    idea intact. Measured on the live store: the old path scored two nodes with
    ZERO edges between them at 0.925237 and wrote an edge for it.
  - ground() writing. It was a read that wrote — the eg_vindex_sync defect.
    Three identical calls produced three writes to the same edge id.
  - keystone_write_blocked. Its measured cost was 0.00% brier reduction over
    n_trials 0 on the keystone: the loop never ran, so the self was never
    calibrated and never falsifiable. Nothing replaces it — non-circularity of
    the reference frame is temporal, not a permission.
  - a graph predicate for "evidence downstream of itself", built and then
    withdrawn. Reachability from the self region covers 89.2% of the live graph
    (10,580 of 11,861 nodes), so any topological predicate marks nearly all
    evidence tainted and degenerates into the total block censorship began as.

The vector, carried in a GRD1 block on the edge's own metadata:
factual, relational, associative (the existing hebb), polarity (SIGNED — near
zero is "no support", negative is "actively contradicts"; `inhibitory` is that
distinction crushed to one bit), provenance class, and a timestamp. Confidence,
recency, staleness and volatility are DERIVED at read and never serialized.

Decay is one model, not two: cog_decay_factor is the single implementation and
engram_temporal_decay now delegates to it — proven bit-identical over 24
(age, reinforcement) points.

Values reference: thirteen regions, aggregate MIN, binding value named. Measured
— the 13 have pairwise centroid cosine min 0.1525 / mean 0.5199 / max 0.9278, so
they demonstrably are not one region, and a mean would let agreement with twelve
mask a violation of the thirteenth.

Supersession versions the whole vector jointly, gated by consequence and
salience with no epsilon anywhere: floor crossings and sign changes only.
Polarity flips and provenance-class changes are inherently significant and
bypass the salience gate.

Also fixed: the frame contract. Descriptors are built over L2-normalized member
embeddings; think() and the grounding path were fitting RAW vectors against them.
Measured on the self region, same data, same 106 members:
  magnitude 0.00283443 -> 0.536134, spread 18.7565 -> 0.930163.
Every fit score sat three decimal places below the 0.5 floors that gate on them.

assert() gates on both floors and computes still_held instead of returning a
hardcoded `true` — the old build reported still_held for a node that does not
exist.

engram/src/server.el

@@ -296,6 +296,24 @@ fn persist_bulk() -> Int {
     return persist_canonical()
 }
 
+// COMPILER LANDMINE, measured 2026-08-16 — do not inline this back into the
+// caller. elc lowers `a == b` to numeric comparison only when both operand
+// NAMES are in the per-function int-name set, which `let x: Int` populates.
+// That registration does NOT propagate into a nested if-expression block: the
+// first cut of the geometry-ingest path wrote `let claimed: Int = ...` and
+// `let got: Int = ...` inside the else-arm and `claimed == got` came out of
+// codegen as `str_eq(claimed, got)` — strcmp on two integers reinterpreted as
+// pointers, i.e. a segfault on the first geometry-bearing request. Read back
+// out of the generated C, not guessed. Function PARAMETERS annotated `: Int`
+// do register reliably (verified: `if (claimed == actual)`), so the comparison
+// lives in a function of its own. Note also the explicit `return`s — a trailing
+// if-EXPRESSION at a function tail emits as a statement and the function
+// returns 0 regardless, which is the same probe's second finding.
+fn width_agrees(claimed: Int, actual: Int) -> Int {
+    if claimed == actual { return 1 }
+    return 0
+}
+
 // INCOMPLETE-ROUTE FIX (2026-07-24 self-review): this route silently dropped
 // label, importance, tier, and tags — engram_node() defaults label to content
 // and importance to 0.5, so every node created over HTTP lost its metadata.
@@ -337,26 +355,44 @@ fn route_create_node(method: String, path: String, body: String) -> String {
         salience, importance, confidence,
         tier, tags
     )
-    // GEOMETRY INGEST (2026-08-16 self-review): this route accepted an "emb"
+    // GEOMETRY INGEST — geometry-valued end to end (2026-08-16).
-    // field, returned 200 with a fresh id, and stored NOTHING — engram_node_full
-    // has no vector parameter, so the caller's geometry was silently discarded
-    // and the node came back emb_dim=None / embedded:false. Measured live while
-    // trying to admit a voice signal. The consequence was structural, not
-    // cosmetic: text was the only entry medium, so any non-text modality had to
-    // be DESCRIBED in prose and what we then reasoned over was the geometry of
-    // the description, not of the signal.
     //
-    // "emb" is little-endian float32 hex (dim*8 chars) — the encoding the
+    // The defect this route originally had: it accepted an "emb" field,
-    // perception vessel's /voice/embed already emits, so a realizer's output
+    // returned 200 with a fresh id, and stored NOTHING, because engram_node_full
-    // moves in with no float-array round trip. "dim" defaults to the vector's
+    // has no vector parameter. The consequence was structural, not cosmetic —
-    // implied width. Off-dimension vectors are stored but not inserted into the
+    // text was the only entry medium, so any non-text modality had to be
-    // resident index (its build loop filters on emb_dim), so a modality vector
+    // DESCRIBED in prose, and what we then reasoned over was the geometry of the
-    // is durable and addressable without perturbing the canonical index.
+    // description, not of the signal.
+    //
+    // #141 fixed the drop but marshalled the vector as a hex STRING through
+    // engram_node_set_emb, which put text back as the TRANSPORT medium one layer
+    // below the problem being fixed. This is that correction: hex is decoded
+    // exactly ONCE, here at the edge, into a first-class Geometry, and every
+    // step below this line moves geometry rather than text. An encoding at the
+    // boundary is what an encoding is for.
+    //
+    // The WIRE is deliberately unchanged — "emb" is still little-endian float32
+    // hex (8 chars per component), the encoding the perception vessel's
+    // /voice/embed already emits — because production clients speak it. What
+    // changed is underneath it.
+    //
+    // "dim" is now treated as an ASSERTION about the vector the caller sent, not
+    // as the source of its width: a Geometry carries its own width. A stated dim
+    // that disagrees is a REJECTED ingest, not a silent reinterpretation. Omitting
+    // "dim" is fine and means "trust the vector", which is the honest default.
+    //
+    // Off-dimension vectors remain stored but not inserted into the resident HNSW
+    // index (its build loop filters on emb_dim), so a 64-dim voice geometry is
+    // durable and addressable without perturbing the 768-dim canonical index.
     let emb_hex: String = json_get_string(body, "emb")
     let emb_set: Int = if str_eq(emb_hex, "") { 0 } else {
+        let g: Geometry = geometry_from_f32le_hex(emb_hex)
+        let got: Int = geometry_dim(g)
         let dim_raw: String = json_get_raw(body, "dim")
-        let dim: Int = if str_eq(dim_raw, "") { str_len(emb_hex) / 8 } else { json_get_int(body, "dim") }
+        let claimed: Int = if str_eq(dim_raw, "") { got } else { json_get_int(body, "dim") }
-        engram_node_set_emb(id, emb_hex, dim)
+        let landed: Int = if width_agrees(claimed, got) > 0 { node_attach_geometry(id, g) } else { 0 }
+        let freed: Int = geometry_free(g)
+        landed
     }
     let saved: Int = persist_node(id)
     // ORPHAN PREVENTION (ENGRAM_AUTOCONNECT): connect the fresh node to its
@@ -1082,6 +1118,11 @@ fn route_faculty(path: String, faculty: String) -> String {
 fn route_boundary_proof(method: String, path: String, body: String) -> String {
     return "{\"op\":\"boundary_proof\",\"body_instrumentation\":\"none\",\"seam\":\"@manager -> engram_boundary_beat auto-injected\"}"
 }
+// ── GROUNDING: an attribute of the RELATION, and the relation's weight is a
+// VECTOR (factual, relational, associative, polarity, provenance, timestamp).
+// /api/ground READS it — it never writes. /api/ground/record is the write,
+// named as one, and it consolidates only on a consequential + salient move.
+// /api/ground/trajectory reads the supersession chain as a time series.
 fn route_ground(method: String, path: String, body: String) -> String {
     let claim: String = json_get_string(body, "claim")
     let evidence: String = json_get_string(body, "evidence")
@@ -1090,12 +1131,31 @@ fn route_ground(method: String, path: String, body: String) -> String {
     if str_eq(evidence, "") { return err_json("missing evidence") }
     return engram_ground_json(claim, evidence, for_whom)
 }
+fn route_ground_record(method: String, path: String, body: String) -> String {
+    let claim: String = json_get_string(body, "claim")
+    let evidence: String = json_get_string(body, "evidence")
+    let provenance: String = json_get_string(body, "provenance")
+    let floor: String = json_get_string(body, "floor")
+    if str_eq(claim, "") { return err_json("missing claim") }
+    if str_eq(evidence, "") { return err_json("missing evidence") }
+    return engram_ground_record_json(claim, evidence, provenance, floor)
+}
+fn route_ground_trajectory(method: String, path: String, body: String) -> String {
+    let claim: String = query_param(path, "claim")
+    let evidence: String = query_param(path, "evidence")
+    if str_eq(claim, "") { return err_json("missing claim") }
+    if str_eq(evidence, "") { return err_json("missing evidence") }
+    return engram_ground_trajectory_json(claim, evidence)
+}
 fn route_assert(method: String, path: String, body: String) -> String {
     let claim: String = query_param(path, "claim")
     if str_eq(claim, "") { return err_json("missing claim") }
     let for_whom: String = query_param(path, "for_whom")
     let floor: String = query_param(path, "floor")
-    return engram_assert_json(claim, for_whom, floor)
+    // Both floors. A well-evidenced claim does not earn the right to be asserted
+    // regardless of whether it means the right thing. rel_floor defaults to floor.
+    let rel_floor: String = query_param(path, "rel_floor")
+    return engram_assert_json(claim, for_whom, floor, rel_floor)
 }
 fn route_attend(method: String, path: String, body: String) -> String {
     let node: String = json_get_string(body, "node")
@@ -1849,6 +1909,14 @@ fn handle_request(method: String, path: String, body: String) -> String {
     if str_eq(method, "GET") && str_starts_with(clean, "/api/plan") {
         return route_faculty(path, "plan")
     }
+    // Order matters: the more specific paths must be tested before the /api/ground
+    // prefix match below, which would otherwise swallow them.
+    if str_eq(method, "POST") && str_starts_with(clean, "/api/ground/record") {
+        return route_ground_record(method, path, body)
+    }
+    if str_eq(method, "GET") && str_starts_with(clean, "/api/ground/trajectory") {
+        return route_ground_trajectory(method, path, body)
+    }
     if str_eq(method, "POST") && str_starts_with(clean, "/api/ground") {
         return route_ground(method, path, body)
     }

engram/test/run_grounding_vector_tests.sh

@@ -0,0 +1,40 @@
+#!/bin/sh
+# Build + RUN the §7 GROUNDING-VECTOR tests (engram_cognition.c): the one decay
+# model, the consequence gate, and the stored/derived split. Closed-form
+# constructed cases — no server, no store, no network. Pure C11 (stdlib + libm).
+# Standalone — NOT folded through elc. Two passes:
+#   1. PERF   — optimised (-O2, no sanitizer): the functional gate.
+#   2. SAFETY — ASan + UBSan on the same suite.
+#
+# NEGATIVE CONTROL (invariant §8.6 — no test without one). Every symbol this
+# suite exercises (cog_decay_factor, cog_grounding_significant,
+# cog_significance_inherent, CogGrounding, CogProvClass) is introduced by the
+# change under test, so the suite does not COMPILE against the pre-change source.
+# To reproduce:
+#     git show origin/dev:lang/runtime/engram_cognition.h > /tmp/pre/engram_cognition.h
+#     git show origin/dev:lang/runtime/engram_cognition.c > /tmp/pre/engram_cognition.c
+#     cc -I/tmp/pre engram/test/test_grounding_vector.c /tmp/pre/engram_cognition.c ...
+#     => error: unknown type name 'CogGrounding'; no binary produced.
+set -e
+HERE=$(cd "$(dirname "$0")" && pwd)
+RT="$HERE/../../lang/runtime"
+CC=${CC:-cc}
+SRC="$HERE/test_grounding_vector.c $RT/engram_cognition.c $RT/engram_reason.c $RT/engram_geometry.c $RT/engram_store.c $RT/engram_vindex.c"
+WARN="-std=c11 -Wall -Wextra"
+# engram_store.c declares emit_log as a WEAK symbol and null-checks it, which is
+# how a test links the store without the EL runtime. Darwin's ld does not resolve
+# an undefined weak symbol at static-link time, so it must be allowed explicitly.
+# (The pre-existing runners in this directory — run_verify_tests.sh among them —
+# do not do this and therefore fail to link on macOS. Unrelated to this change.)
+LDX=""
+[ "$(uname -s)" = "Darwin" ] && LDX="-Wl,-U,_emit_log"
+TMP=$(mktemp -d)
+
+echo "### PASS 1: PERF (optimised, un-sanitised) — functional gate"
+$CC $WARN -O2 -I"$RT" $SRC -lm -lpthread $LDX -o "$TMP/perf"
+"$TMP/perf"
+
+echo
+echo "### PASS 2: SAFETY (ASan/UBSan)"
+$CC $WARN -O1 -g -fsanitize=address,undefined -fno-omit-frame-pointer -I"$RT" $SRC -lm -lpthread $LDX -o "$TMP/safe"
+ASAN_OPTIONS=${ASAN_OPTIONS:-detect_leaks=0} UBSAN_OPTIONS=halt_on_error=1 "$TMP/safe"

engram/test/test_grounding_vector.c

@@ -0,0 +1,176 @@
+/* test_grounding_vector.c — deterministic tests for §7: the one decay model, the
+ * consequence gate, and the stored/derived split. Links engram_cognition.c
+ * directly; no server, no store, no network. See run_grounding_vector_tests.sh.
+ *
+ * NEGATIVE CONTROL (invariant §8.6). Every symbol exercised here —
+ * cog_decay_factor, cog_grounding_significant, cog_significance_inherent,
+ * CogGrounding, CogProvClass — is introduced by the change under test, so this
+ * suite does not COMPILE against the pre-change source, let alone pass. The
+ * runner documents the exact reproduction.
+ */
+#include "engram_cognition.h"
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <math.h>
+
+static int fails = 0;
+static void ok(int cond, const char* what) {
+    printf("  %-62s %s\n", what, cond ? "PASS" : "*** FAIL ***");
+    if (!cond) fails++;
+}
+
+/* The decay formula exactly as el_runtime.c carried it before the move, so the
+ * refactor can be shown to be bit-identical rather than merely similar. */
+static double old_engram_temporal_decay(long long age_ms, long long activation_count,
+                                        double temporal_decay_rate) {
+    if (age_ms <= 0) return 1.0;
+    double lambda = (temporal_decay_rate > 0.0) ? temporal_decay_rate : 0.693147;
+    double age_hours = (double)age_ms / 3600000.0;
+    double t_half = 168.0 * (1.0 + log(1.0 + (double)activation_count));
+    double factor = exp(-lambda * age_hours / t_half);
+    if (factor < 0.25) factor = 0.25;
+    return factor;
+}
+
+static CogGrounding base(void) {
+    CogGrounding g; memset(&g, 0, sizeof g);
+    g.present = 1;
+    g.factual = 0.60; g.relational = 0.60;
+    g.factual_now = 0.60; g.relational_now = 0.60;
+    g.associative = 0.1; g.polarity = 1.0;
+    g.prov = COG_PROV_TOLD;
+    g.fac_proj = 1.0; g.rel_proj = 1.0;
+    g.cos_angle = 0.9; g.agreement = 1;
+    g.ts = 1000; g.seq = 1; g.reinforcements = 3;
+    return g;
+}
+
+int main(void) {
+    const double F = 0.5, R = 0.5;
+
+    printf("\n== 1. DECAY IS THE ONE MODEL, AND IT IS BIT-IDENTICAL TO WHAT IT REPLACED ==\n");
+    {
+        long long ages[] = {0, 3600000LL, 86400000LL, 7*86400000LL, 30*86400000LL, 365*86400000LL};
+        int allsame = 1;
+        for (int i = 0; i < 6; i++)
+            for (int ac = 0; ac < 4; ac++) {
+                long long acs[] = {0, 1, 10, 1000};
+                double a = cog_decay_factor(ages[i], (double)acs[ac], 0.0);
+                double b = old_engram_temporal_decay(ages[i], acs[ac], 0.0);
+                if (a != b) allsame = 0;
+            }
+        ok(allsame, "cog_decay_factor == the pre-move engram_temporal_decay (24 pts)");
+        ok(cog_decay_factor(0, 0, 0.0) == 1.0, "age 0 -> no decay");
+    }
+    printf("\n   DECAY OVER ELAPSED TIME (reinforcements = 0, default rate):\n");
+    printf("   %10s  %10s\n", "elapsed", "decay");
+    {
+        struct { const char* label; long long ms; } pts[] = {
+            {"0",       0LL},
+            {"1 hour",  3600000LL},
+            {"1 day",   86400000LL},
+            {"3 days",  3LL*86400000LL},
+            {"7 days",  7LL*86400000LL},
+            {"14 days", 14LL*86400000LL},
+            {"30 days", 30LL*86400000LL},
+            {"90 days", 90LL*86400000LL},
+        };
+        double prev = 2.0; int monotone = 1;
+        for (unsigned i = 0; i < sizeof pts / sizeof pts[0]; i++) {
+            double d = cog_decay_factor(pts[i].ms, 0, 0.0);
+            printf("   %10s  %10.6f\n", pts[i].label, d);
+            if (d > prev) monotone = 0;
+            prev = d;
+        }
+        ok(monotone, "decay is monotone non-increasing in elapsed time");
+        ok(fabs(cog_decay_factor(7LL*86400000LL, 0, 0.0) - 0.5) < 1e-6,
+           "7 days at zero reinforcements == exactly one half-life (0.5)");
+        ok(cog_decay_factor(7LL*86400000LL, 100, 0.0) > cog_decay_factor(7LL*86400000LL, 0, 0.0),
+           "reinforcement slows ageing (Lindy term)");
+        ok(cog_decay_factor(3650LL*86400000LL, 0, 0.0) == 0.25,
+           "floor is a preference not a cliff: bottoms out at 0.25");
+    }
+
+    printf("\n== 2. CONSEQUENCE GATE: EVERY TRIGGER, AND NO EPSILON ANYWHERE ==\n");
+    {
+        CogGrounding p = base(), n = base();
+        ok(cog_grounding_significant(&p, &n, F, R) == COG_SIG_NONE,
+           "identical vectors -> NONE (a re-read must not consolidate)");
+
+        n = base(); n.factual = 0.9999; n.factual_now = 0.9999;
+        ok(cog_grounding_significant(&p, &n, F, R) == COG_SIG_NONE,
+           "factual 0.60 -> 0.9999 without crossing the floor -> NONE");
+
+        n = base(); n.relational = 0.5001; n.relational_now = 0.5001;
+        ok(cog_grounding_significant(&p, &n, F, R) == COG_SIG_NONE,
+           "relational 0.60 -> 0.5001, still above floor -> NONE");
+
+        n = base(); n.factual_now = 0.4999;
+        ok(cog_grounding_significant(&p, &n, F, R) == COG_SIG_FACTUAL_FLOOR,
+           "a 0.1001 drop that CROSSES the floor -> FACTUAL_FLOOR");
+
+        n = base(); n.relational_now = 0.4999;
+        ok(cog_grounding_significant(&p, &n, F, R) == COG_SIG_RELATIONAL_FLOOR,
+           "relational crossing its floor -> RELATIONAL_FLOOR");
+
+        n = base(); n.cos_angle = -0.05; n.agreement = -1;
+        ok(cog_grounding_significant(&p, &n, F, R) == COG_SIG_AGREEMENT_FLIP,
+           "agreement +1 -> -1 -> AGREEMENT_FLIP");
+
+        n = base(); n.fac_proj = -0.2;
+        ok(cog_grounding_significant(&p, &n, F, R) == COG_SIG_DIRECTION_REVERSAL,
+           "factual gradient reverses -> DIRECTION_REVERSAL");
+
+        n = base(); n.rel_proj = -0.2;
+        ok(cog_grounding_significant(&p, &n, F, R) == COG_SIG_DIRECTION_REVERSAL,
+           "relational gradient reverses -> DIRECTION_REVERSAL");
+
+        n = base(); n.polarity = -1.0;
+        ok(cog_grounding_significant(&p, &n, F, R) == COG_SIG_POLARITY_FLIP,
+           "support -> contradiction -> POLARITY_FLIP (inherent)");
+
+        n = base(); n.polarity = 0.0;
+        ok(cog_grounding_significant(&p, &n, F, R) == COG_SIG_POLARITY_FLIP,
+           "support -> ignorance (zero) -> POLARITY_FLIP: not the same state");
+
+        n = base(); n.prov = COG_PROV_OBSERVED;
+        ok(cog_grounding_significant(&p, &n, F, R) == COG_SIG_PROVENANCE_CHANGE,
+           "told -> observed -> PROVENANCE_CHANGE (inherent)");
+
+        CogGrounding fresh; memset(&fresh, 0, sizeof fresh);
+        ok(cog_grounding_significant(&fresh, &n, F, R) == COG_SIG_FIRST_RECORD,
+           "no prior version -> FIRST_RECORD");
+    }
+
+    printf("\n== 3. INHERENT MOVES BYPASS THE SALIENCE GATE ==\n");
+    ok(cog_significance_inherent(COG_SIG_POLARITY_FLIP), "polarity flip is inherent");
+    ok(cog_significance_inherent(COG_SIG_PROVENANCE_CHANGE), "provenance change is inherent");
+    ok(cog_significance_inherent(COG_SIG_FIRST_RECORD), "first record is inherent");
+    ok(!cog_significance_inherent(COG_SIG_FACTUAL_FLOOR), "a floor crossing is NOT inherent");
+    ok(!cog_significance_inherent(COG_SIG_NONE), "NONE is not inherent");
+
+    printf("\n== 4. THE STORED/DERIVED SPLIT: DERIVED VALUES ARE NEVER SERIALIZED ==\n");
+    {
+        CogGrounding g = base();
+        g.decay = 0.3333; g.factual_now = 0.1234; g.relational_now = 0.2345;
+        g.associative_now = 0.4567; g.age_ms = 999999; g.stale = 1;
+        char* m = cog_grounding_metadata("pre-existing=keepme", &g);
+        ok(m != NULL, "serializer returns a document");
+        ok(m && strstr(m, "pre-existing=keepme"), "pre-existing edge metadata preserved verbatim");
+        ok(m && strstr(m, "GRD1"), "GRD1 magic present");
+        ok(m && !strstr(m, "0.3333"),  "decay is NOT stored");
+        ok(m && !strstr(m, "0.1234"),  "factual_now is NOT stored");
+        ok(m && !strstr(m, "0.2345"),  "relational_now is NOT stored");
+        ok(m && !strstr(m, "0.4567"),  "associative_now is NOT stored");
+        ok(m && !strstr(m, "999999"),  "age is NOT stored");
+        ok(m && strstr(m, "told"),     "provenance class IS stored");
+        ok(m && strstr(m, "0.6"),      "the factual/relational dimensions ARE stored");
+        if (m) { printf("\n   --- serialized GRD1 block ---\n%s   -----------------------------\n", m); }
+        free(m);
+    }
+
+    printf("\n%s  (%d failure%s)\n\n", fails ? "SOME TESTS FAILED" : "ALL TESTS PASSED",
+           fails, fails == 1 ? "" : "s");
+    return fails ? 1 : 0;
+}

ingest/src/ingest.el

@@ -13,7 +13,7 @@
 // relations add edges. Every node enters with PROVENANCE + grounding-level
 // + stewardship class from the moment of entry.
 //
-// transduce() is THE single mechanism — one function, polymorphic, with no
+// transduce_manifold() is THE single mechanism — one function, polymorphic, with no
 // content-type branch inside it. It does not ask whether a payload is
 // prose, structured data, or raw/opaque bytes (audio, or anything else);
 // it runs one boundary-scan-with-fixed-window-fallback chunking algorithm
@@ -401,10 +401,25 @@ fn head80(s: String) -> String {
 // truncates at the first embedded NUL, which is routine in real binary
 // bytes) is a MECHANICAL fidelity concern that belongs to whatever produced
 // `source` (see ingest_file's file_source_string below) — not a
-// content-type judgment made in here. transduce() never learns whether a
+// content-type judgment made in here. transduce_manifold() never learns whether a
 // chunk is plain text or a base64-encoded raw-byte window; every chunk is
 // handled identically either way.
-fn transduce(nodes: [String], edges: [String], source: String,
+// RENAMED transduce -> transduce_manifold (2026-08-16). Two reasons, and the
+// first is not the interesting one:
+//
+//   1. Mechanical: `transduce` is now a LANGUAGE primitive in el_runtime.h
+//      (transduce(signal, modality) -> Geometry). Every El `fn name(...)`
+//      compiles to a global C symbol with that exact name, so keeping this
+//      name here is a hard `conflicting types for 'transduce'` compile error
+//      the moment ingest.c links el_runtime.c. Measured, not anticipated.
+//
+//   2. Actual: this function was never signal->geometry. It chunks already-
+//      extracted content and PACKS it into a node+edge manifold — a real
+//      operation, but one layer up, and it had taken the name that belongs to
+//      the primitive underneath it. `transduce` is where a signal becomes
+//      geometry; `transduce_manifold` is where extracted content becomes
+//      structure. Nothing about this function's behaviour changed.
+fn transduce_manifold(nodes: [String], edges: [String], source: String,
              prov: String, ground: String, steward: String,
              root_lid: String, root_title: String) -> [String] {
     let tagbase: String = "prov:" + prov + " ground:" + ground + " steward:" + steward
@@ -531,8 +546,8 @@ fn default_steward() -> String {
 // trustworthy verbatim. When they don't (silent truncation happened),
 // rebuild the payload as base64-encoded fixed-size windows read directly
 // off disk (fs_read_b64_chunk — binary-safe in C), joined with the same
-// "\n\n" boundary marker transduce()'s generic scan already looks for, so
+// "\n\n" boundary marker transduce_manifold()'s generic scan already looks for, so
-// transduce() sees one ordinary boundary-delimited payload and runs its one
+// transduce_manifold() sees one ordinary boundary-delimited payload and runs its one
 // algorithm on it exactly as it would on prose — it never learns that a
 // fidelity problem occurred upstream, let alone why.
 fn file_source_string(path: String, text: String, real_size: Int) -> String {
@@ -541,7 +556,7 @@ fn file_source_string(path: String, text: String, real_size: Int) -> String {
     // 3072 raw bytes -> 4096 base64 chars (3 divides evenly into base64's
     // 3-byte/4-char ratio); keeps each resulting node's content a clean,
     // bounded, low-kilobytes unit, same order of magnitude as the fixed
-    // fallback window in transduce() itself.
+    // fallback window in transduce_manifold() itself.
     let win: Int = 3072
     let out: String = ""
     let off: Int = 0
@@ -561,7 +576,7 @@ fn file_source_string(path: String, text: String, real_size: Int) -> String {
 }
 
 // ingest one file -> report JSON. Uniform for every file regardless of
-// extension or content — transduce() decides nothing about content-type, so
+// extension or content — transduce_manifold() decides nothing about content-type, so
 // neither does this function; it only decides whether the raw bytes made it
 // through the read intact (file_source_string), which is a fidelity
 // question, not a format one.
@@ -573,14 +588,14 @@ fn ingest_file(path: String) -> String {
         return "{\"error\":\"empty or unreadable\",\"path\":" + j_q(path) + "}"
     }
     let prov: String = "file:" + path
-    let packed: [String] = transduce(el_list_empty(), el_list_empty(),
+    let packed: [String] = transduce_manifold(el_list_empty(), el_list_empty(),
         source, prov, default_ground(), default_steward(),
         "doc:" + basename(path), basename(path))
     return merge_packed(packed)
 }
 
 // ingest a directory: walk one level, ingest every file found, aggregate.
-// No extension filter — transduce() handles any payload uniformly now, so
+// No extension filter — transduce_manifold() handles any payload uniformly now, so
 // there is no content-type gate at the directory boundary either.
 fn ingest_dir(path: String) -> String {
     let entries: [String] = fs_list(path)
@@ -615,7 +630,7 @@ fn ingest_dir(path: String) -> String {
 fn ingest_url(url: String) -> String {
     let body: String = http_get(url)
     if str_eq(body, "") { return "{\"error\":\"empty fetch\",\"url\":" + j_q(url) + "}" }
-    let packed: [String] = transduce(el_list_empty(), el_list_empty(),
+    let packed: [String] = transduce_manifold(el_list_empty(), el_list_empty(),
         body, "url:" + url, "extracted", "public-web",
         "url:" + url, url)
     return merge_packed(packed)
@@ -630,7 +645,7 @@ fn ingest_llm(query: String) -> String {
     let resp: String = http_post_json("http://127.0.0.1:11434/api/generate", body)
     let answer: String = json_get_string(resp, "response")
     if str_eq(answer, "") { return "{\"error\":\"no model response\"}" }
-    let packed: [String] = transduce(el_list_empty(), el_list_empty(),
+    let packed: [String] = transduce_manifold(el_list_empty(), el_list_empty(),
         answer, "llm:" + model + ":" + query, "candidate-provisional", "guide-provisional",
         "llm:" + query, "guide answer: " + query)
     return merge_packed(packed)
@@ -682,7 +697,7 @@ fn ingest_stream(path: String) -> String {
 // It is NOT a content-type flag: it says nothing about what's inside the
 // bytes once fetched, and none of the five ingest_* functions it selects
 // among interpret their payload differently by content shape anymore —
-// they all hand off to the single, format-agnostic transduce(). The old
+// they all hand off to the single, format-agnostic transduce_manifold(). The old
 // "structured" value (a caller-declared alias for "file", used only to hint
 // the now-removed JSON-vs-prose branch) is gone along with that branch.
 let kind: String = env("INGEST_KIND")

lang/examples/transduce.el

@@ -0,0 +1,213 @@
+// transduce.el — geometry as a first-class El value, and a realizer written
+// in El. Runnable: this is the worked example for the transduce surface, and
+// it doubles as an executable proof because it checks every claim it makes.
+//
+//   elc lang/examples/transduce.el > transduce.c
+//   cc -std=c11 -O2 -I lang/runtime -o transduce transduce.c \
+//      lang/runtime/el_runtime.c lang/runtime/el_seed.c \
+//      lang/runtime/engram_*.c -lcurl -lpthread -lm
+//   ./transduce          # exits 0 only if every check passes
+//
+// (A `test "..."` form of the same checks lives in
+// lang/tests/native/test_transduce.el, for when the native harness is
+// repaired — the shipped elc currently emits calls to __el_reg_count and
+// friends without emitting their definitions, which breaks every native test
+// equally, test_math.el included. Verified 2026-08-16, unrelated to this work.)
+//
+// WHY THIS EXISTS. Until 2026-08-16 no El ingest path could carry a vector:
+// nodes took text, and geometry was DERIVED from that text. Text was the
+// mandatory entry medium, so any non-text modality had to be DESCRIBED in
+// prose first and the geometry we reasoned over was the geometry OF THE
+// DESCRIPTION, not of the signal. Two things fix that, and both are shown
+// below: geometry is a VALUE that carries its own width, and a REALIZER is an
+// ordinary El function — so admitting a new modality never requires a runtime
+// patch.
+//
+// COMPARISON DISCIPLINE (measured, not stylistic): elc lowers `a == b`
+// numerically only when both operand NAMES are in the per-function int-name
+// set that `let x: Int` populates. A bare `f(x) == 0` is not a registered
+// name and lowers to str_eq — strcmp on two integers as pointers. `<` and `>`
+// lower directly with no inference, so truthiness is written `> 0` / `< 1`.
+
+// ── A realizer, written entirely in El ──────────────────────────────────────
+// Not in the runtime. Not known to the compiler. Registered by NAME and
+// dispatched to through transduce(). That is the whole claim.
+fn tone_realizer(signal: String) -> Geometry {
+    let g: Geometry = geometry_new(4)
+    let n: Int = str_len(signal)
+    let a: Int = geometry_set(g, 0, int_to_float(n))
+    let b: Int = geometry_set(g, 1, int_to_float(n * 2))
+    let c: Int = geometry_set(g, 2, int_to_float(n * 3))
+    let d: Int = geometry_set(g, 3, int_to_float(n * 4))
+    g
+}
+
+// A second modality, to show the registry keys on modality rather than just
+// returning whatever was registered last.
+fn pulse_realizer(signal: String) -> Geometry {
+    let g: Geometry = geometry_new(2)
+    let a: Int = geometry_set(g, 0, 1.0)
+    let b: Int = geometry_set(g, 1, 0.0)
+    g
+}
+
+// A deliberately BROKEN realizer: returns something that is not a Geometry.
+fn bogus_realizer(signal: String) -> Geometry {
+    return 12345
+}
+
+// Fails FAST rather than accumulating a count, for a measured reason: a first
+// cut wrote `let fails: Int = fails + check(...)` and `+` lowered to STRING
+// CONCAT, because elc dispatches `+` on whether both operands are known-Int and
+// a user-defined fn call is not — so the counter printed 4343632752, a pointer.
+// Nothing was wrong with the checks; the tally was lying. Exiting at the first
+// failure needs no arithmetic at all, so there is nothing left to get wrong.
+fn check(ok: Int, label: String) -> Int {
+    if ok > 0 {
+        println("  ok    " + label)
+        return 0
+    }
+    println("  FAIL  " + label)
+    exit(1)
+    return 1
+}
+
+fn near(a: Float, b: Float) -> Int {
+    let d: Float = a - b
+    if d > 0.001 { return 0 }
+    if d < -0.001 { return 0 }
+    return 1
+}
+
+fn eq_int(a: Int, b: Int) -> Int {
+    if a == b { return 1 }
+    return 0
+}
+
+fn main() -> Void {
+    println("geometry is a value that carries its own width")
+    let g8: Geometry = geometry_new(8)
+    let _c: Int = check(geometry_is(g8), "geometry_new returns a live Geometry")
+    let d8: Int = geometry_dim(g8)
+    let _c: Int = check(eq_int(d8, 8), "a Geometry carries its own width (8)")
+    let _c: Int = check(geometry_free(g8), "geometry_free reports what it did")
+
+    println("nonsense is refused — with no arbitrary max-dim bound")
+    // #141 needed `dim <= 8192` only to bound an allocation sized from a
+    // caller's CLAIM about a string's length. A value that carries its own
+    // width has nothing left to validate.
+    let z: Geometry = geometry_new(0)
+    let zi: Int = geometry_is(z)
+    let _c: Int = check(1 - zi, "dim 0 is not a geometry")
+    let ng: Geometry = geometry_new(-4)
+    let ngi: Int = geometry_is(ng)
+    let _c: Int = check(1 - ngi, "negative dim is not a geometry")
+    let nd: Int = geometry_dim(0)
+    let _c: Int = check(1 - nd, "geometry_dim of a non-geometry is 0, not a crash")
+    let nf: Int = geometry_free(0)
+    let _c: Int = check(1 - nf, "geometry_free of a non-geometry is a no-op")
+
+    println("components round-trip, and out-of-range is refused")
+    let g3: Geometry = geometry_new(3)
+    let s0: Int = geometry_set(g3, 0, 1.5)
+    let s1: Int = geometry_set(g3, 1, -2.5)
+    let _c: Int = check(s0, "set in range succeeds")
+    let oob: Int = geometry_set(g3, 3, 9.0)
+    let _c: Int = check(1 - oob, "set out of range is refused, not silently dropped")
+    let _c: Int = check(near(geometry_get(g3, 0), 1.5), "component 0 round-trips")
+    let _c: Int = check(near(geometry_get(g3, 1), -2.5), "component 1 round-trips (negative)")
+    let ff3: Int = geometry_free(g3)
+
+    println("hex is an EDGE adapter, and derives its own width")
+    // little-endian float32: 1.0 = 0000803f, 2.0 = 00000040
+    let gh: Geometry = geometry_from_f32le_hex("0000803f00000040")
+    let _c: Int = check(geometry_is(gh), "valid hex decodes to a Geometry")
+    let dh: Int = geometry_dim(gh)
+    let _c: Int = check(eq_int(dh, 2), "width DERIVED from input, never supplied")
+    let _c: Int = check(near(geometry_get(gh, 0), 1.0), "first component decoded")
+    let _c: Int = check(near(geometry_get(gh, 1), 2.0), "second component decoded")
+    let back: String = geometry_to_f32le_hex(gh)
+    let _c: Int = check(str_eq(back, "0000803f00000040"), "hex round-trips exactly")
+    let ffh: Int = geometry_free(gh)
+
+    println("malformed hex is refused")
+    let he: Geometry = geometry_from_f32le_hex("")
+    let hei: Int = geometry_is(he)
+    let _c: Int = check(1 - hei, "empty hex is not a geometry")
+    let hr: Geometry = geometry_from_f32le_hex("0000803f0000")
+    let hri: Int = geometry_is(hr)
+    let _c: Int = check(1 - hri, "length not a multiple of 8 is refused")
+    let hn: Geometry = geometry_from_f32le_hex("zzzzzzzz")
+    let hni: Int = geometry_is(hn)
+    let _c: Int = check(1 - hni, "non-hex characters are refused")
+
+    println("a realizer declared in El is a first-class realizer")
+    let reg: Int = realizer_register("tone", "tone_realizer")
+    let _c: Int = check(reg, "an El fn registers as a realizer BY NAME")
+    let _c: Int = check(realizer_has("tone"), "the modality now has an organ")
+    let gt: Geometry = transduce("aaa", "tone")
+    let _c: Int = check(geometry_is(gt), "transduce returns real geometry")
+    let dt: Int = geometry_dim(gt)
+    let _c: Int = check(eq_int(dt, 4), "the El realizer determined the width, not the runtime")
+    // str_len("aaa") == 3, so component 0 must be 3.0 — proof the signal
+    // actually reached the El function rather than a stub answering for it.
+    let _c: Int = check(near(geometry_get(gt, 0), 3.0), "the signal REACHED the El realizer")
+    let fft: Int = geometry_free(gt)
+
+    println("distinct signals transduce to distinct geometry")
+    let g1: Geometry = transduce("aa", "tone")
+    let g2: Geometry = transduce("aaaaa", "tone")
+    let a1: Float = geometry_get(g1, 0)
+    let a2: Float = geometry_get(g2, 0)
+    // 5 - 2 = 3. If transduction were a stub these would be equal.
+    let _c: Int = check(near(a2 - a1, 3.0), "different signals produce different geometry")
+    let ff1: Int = geometry_free(g1)
+    let ff2: Int = geometry_free(g2)
+
+    println("the registry keys on modality")
+    let r2: Int = realizer_register("pulse", "pulse_realizer")
+    let _c: Int = check(r2, "a second modality registers independently")
+    let mt: Geometry = transduce("aaa", "tone")
+    let mp: Geometry = transduce("aaa", "pulse")
+    let mdt: Int = geometry_dim(mt)
+    let mdp: Int = geometry_dim(mp)
+    let _c: Int = check(eq_int(mdt, 4), "tone still routes to its own realizer")
+    let _c: Int = check(eq_int(mdp, 2), "pulse routes to a different realizer")
+    let ffm1: Int = geometry_free(mt)
+    let ffm2: Int = geometry_free(mp)
+
+    println("no organ is reported as no organ")
+    // A modality with no realizer must transduce to NOTHING. It must never
+    // fall back to embedding a description of the signal and calling that
+    // perception — that silent substitution is the defect this all exists to end.
+    let eh: Int = realizer_has("echolocation")
+    let _c: Int = check(1 - eh, "unregistered modality has no organ")
+    let ge: Geometry = transduce("anything", "echolocation")
+    let gei: Int = geometry_is(ge)
+    let _c: Int = check(1 - gei, "no realizer means NO geometry, not fake geometry")
+
+    println("an unresolvable realizer name fails at WIRING time")
+    let bad: Int = realizer_register("ghost", "no_such_function_anywhere")
+    let _c: Int = check(1 - bad, "unresolvable realizer name is a registration failure")
+    let gh2: Int = realizer_has("ghost")
+    let _c: Int = check(1 - gh2, "and nothing gets registered")
+
+    println("a realizer returning non-geometry transduces nothing")
+    let rb: Int = realizer_register("bogus", "bogus_realizer")
+    let _c: Int = check(rb, "the symbol resolves, so registration succeeds")
+    let gb: Geometry = transduce("x", "bogus")
+    let gbi: Int = geometry_is(gb)
+    let _c: Int = check(1 - gbi, "contract enforced at the boundary: nothing handed back")
+
+    println("norm lets a caller check a realizer emitted signal, not zeros")
+    let gn: Geometry = geometry_new(2)
+    let _c: Int = check(near(geometry_norm(gn), 0.0), "a fresh geometry is zero — norm says so")
+    let n0: Int = geometry_set(gn, 0, 3.0)
+    let n1: Int = geometry_set(gn, 1, 4.0)
+    let _c: Int = check(near(geometry_norm(gn), 5.0), "3-4-5: norm is 5")
+    let ffn: Int = geometry_free(gn)
+
+    // Reaching here means nothing called exit(1) along the way.
+    println("")
+    println("all checks passed")
+}

lang/runtime/el_runtime.h

@@ -586,6 +586,60 @@ void      el_runtime_dharma_event_arrive(const char* event_type,
                                          const char* payload,
                                          const char* source);
 
+/* ── Geometry: signal as a first-class El value ──────────────────────────────
+ *
+ * A Geometry is an opaque, magic-tagged heap value carried in an el_val_t —
+ * the same discipline as List/Map. It holds a width and a float32 payload,
+ * and it is the medium a non-text modality enters in. Declared HERE, above
+ * the engram block, because transduction is a LANGUAGE concern: every El
+ * program touching any modality needs it, and the engram is merely one El
+ * program that happens to hold a graph. See el_runtime.c ("Geometry: signal
+ * as a first-class el value") for the full rationale.
+ *
+ * El-side type annotation is simply `Geometry` — an opaque boxed pointer,
+ * exactly like Instant / Calendar / Rhythm. No codegen change is required.
+ *
+ * OWNERSHIP: a Geometry is owned by the El caller and released with
+ * geometry_free. node_attach_geometry COPIES, so a node and the caller's
+ * value have independent lifetimes.                                          */
+
+el_val_t  geometry_new(el_val_t dim);                 /* zero-filled; 0 on failure */
+el_val_t  geometry_dim(el_val_t g);                   /* width, 0 if not a Geometry */
+el_val_t  geometry_is(el_val_t g);                    /* 1 if a live Geometry       */
+el_val_t  geometry_get(el_val_t g, el_val_t i);       /* Float component            */
+el_val_t  geometry_set(el_val_t g, el_val_t i, el_val_t x);  /* 1 ok / 0 out of range */
+el_val_t  geometry_norm(el_val_t g);                  /* Float L2 — lets a caller
+                                                       * check a realizer emitted
+                                                       * signal, not zeros          */
+el_val_t  geometry_free(el_val_t g);                  /* 1 if freed, 0 if not a Geometry.
+                                                       * Returns a value (not void) so it
+                                                       * is safe in any El expression
+                                                       * position without a codegen
+                                                       * void-builtin table entry.  */
+
+/* Wire ADAPTERS — the only place an encoding appears, and only at the edge.
+ * `f32le hex` is little-endian float32, 8 hex chars per component: the
+ * encoding the perception vessel's /voice/embed already emits. The width is
+ * DERIVED from the input length, never supplied by a caller — which is why
+ * there is no max-dim constant here to validate a claimed length against. */
+el_val_t  geometry_from_f32le_hex(el_val_t hex);      /* 0 on empty/odd-length/non-hex */
+el_val_t  geometry_to_f32le_hex(el_val_t g);          /* "" if not a Geometry       */
+
+/* ── Realizers + transduce ───────────────────────────────────────────────────
+ * A REALIZER maps one modality into geometry. Registration is by NAME, so a
+ * new modality never requires a runtime patch: every El `fn name(...)`
+ * compiles to a global C symbol with that exact name, and the registry
+ * resolves it with dlsym against the running binary — the same mechanism
+ * http_set_handler already relies on.
+ *
+ *     fn tone_realizer(signal: String) -> Geometry { ... }
+ *     realizer_register("tone", "tone_realizer")
+ *     let g: Geometry = transduce(sample, "tone")
+ */
+el_val_t  realizer_register(el_val_t modality, el_val_t fn_name); /* 1 ok / 0 unresolved */
+el_val_t  realizer_has(el_val_t modality);            /* 1 if a realizer is registered */
+el_val_t  transduce(el_val_t signal, el_val_t modality); /* Geometry, or 0 if no organ */
+
 /* ── Engram local graph primitives ───────────────────────────────────────────
  * Operate on the CGI's local Engram knowledge graph.
  * `engram_activate` queries the local graph only; `dharma_activate` is
@@ -612,11 +666,27 @@ el_val_t  engram_get_node(el_val_t id);
 void      engram_strengthen(el_val_t node_id);
 void      engram_forget(el_val_t node_id);
 el_val_t  engram_prune_telemetry(el_val_t older_than_ms);
+/* Largest byte length <= max_bytes that does not split a UTF-8 codepoint.
+ * Bounded by bytes, not codepoints, so truncated strings never grow. */
+size_t    el_utf8_safe_len(const char* s, size_t max_bytes);
+
 el_val_t  engram_node_count(void);
-/* Attach geometry to an existing node. `hex` is little-endian float32,
+/* Attach a Geometry to an existing node, and read the attached width back.
- * exactly dim*8 hex chars — the encoding realizers already emit. Lets a
+ * Named for the operation, not the store: a node acquires geometry. This is
- * non-text modality enter as geometry instead of being described in prose
+ * the geometry-valued ingest path — nothing about it is hex, and nothing
- * and embedded as its description. Returns 1 on success, 0 otherwise. */
+ * about it assumes the caller's vector matches the canonical text-embedding
+ * width. node_geometry_dim exists so an attach is VERIFIED by reading it
+ * back rather than by trusting a success return. */
+el_val_t  node_attach_geometry(el_val_t node_id, el_val_t g); /* 1 ok / 0 otherwise */
+el_val_t  node_geometry_dim(el_val_t node_id);                /* width, 0 if none   */
+
+/* DEPRECATED (shipped in #141, superseded 2026-08-16). Equivalent to
+ * geometry_from_f32le_hex + node_attach_geometry, and now implemented as
+ * exactly that. Kept only so anything built against the #141 runtime keeps
+ * linking; `dim` is accepted but treated as an assertion about the vector's
+ * width rather than as its source. New code should not call this — a hex
+ * string is a wire encoding, not a way to move geometry between two pieces
+ * of El. Returns 1 on success, 0 otherwise. */
 el_val_t  engram_node_set_emb(el_val_t id, el_val_t hex, el_val_t dim);
 el_val_t  engram_search(el_val_t query, el_val_t limit);
 el_val_t  engram_scan_nodes(el_val_t limit, el_val_t offset);
@@ -662,8 +732,13 @@ el_val_t  engram_geo_analogy_json(el_val_t a_seeds, el_val_t b_seeds);
 el_val_t  engram_reason_analogy_json(el_val_t a_seeds, el_val_t b_seeds, el_val_t c_seeds);
 /* COGNITION (2026-08-14): THE ONE OPERATION + grounding, surfaced live. */
 el_val_t  engram_think_json(el_val_t seeds, el_val_t faculty);
+/* GROUNDING (2026-08-16): grounding is an attribute of the RELATION and it IS the
+ * hebbian weight. ground reads; ground_record writes; trajectory reads the chain. */
 el_val_t  engram_ground_json(el_val_t claim, el_val_t evidence, el_val_t for_whom);
-el_val_t  engram_assert_json(el_val_t claim_id, el_val_t for_whom, el_val_t floor);
+el_val_t  engram_ground_record_json(el_val_t claim, el_val_t evidence,
+                                    el_val_t provenance, el_val_t floor);
+el_val_t  engram_ground_trajectory_json(el_val_t claim, el_val_t evidence);
+el_val_t  engram_assert_json(el_val_t claim_id, el_val_t for_whom, el_val_t floor, el_val_t rel_floor);
 el_val_t  engram_attend_json(el_val_t node_id, el_val_t observer, el_val_t salience);
 el_val_t  engram_correspondence_beat_json(el_val_t seeds, el_val_t faculty, el_val_t keystone);
 el_val_t  engram_consolidate_permanence(el_val_t node_id);

lang/runtime/engram_cognition.c

@@ -246,14 +246,6 @@ static int put_edge(EngramPagedStore* s, const char* id, const char* from, const
     e.metadata = (char*)meta;
     return store_put_edge(s, &e);
 }
-int cog_ground_edge(EngramPagedStore* s, const char* claim_id,
-                    const char* evidence_id, double grounding, const char* for_whom) {
-    if (!s || !claim_id || !evidence_id) return -1;
-    char id[512], meta[256];
-    snprintf(id, sizeof id, "gb-%s-%s-%s", claim_id, evidence_id, for_whom ? for_whom : "global");
-    snprintf(meta, sizeof meta, "for_whom=%s", for_whom ? for_whom : "-");
-    return put_edge(s, id, claim_id, evidence_id, COG_GROUNDED_BY_RELATION, grounding, meta);
-}
 int cog_salient_edge(EngramPagedStore* s, const char* node_id,
                      const char* observer_id, double salience) {
     if (!s || !node_id || !observer_id) return -1;
@@ -261,35 +253,386 @@ int cog_salient_edge(EngramPagedStore* s, const char* node_id,
     snprintf(id, sizeof id, "st-%s-%s", node_id, observer_id);
     return put_edge(s, id, node_id, observer_id, COG_SALIENT_TO_RELATION, salience, NULL);
 }
-int cog_assert_gate(EngramPagedStore* s, const char* claim_id,
+/* ═══════════════════════════════════════════════════════════════════════════
-                    const char* for_whom, double floor) {
+ * §7  GROUNDING IS THE EDGE'S WEIGHT, AND THE WEIGHT IS A VECTOR.
-    if (!s || !claim_id) return -1;
+ * See engram_cognition.h §7 for the model and for the measurements the two
-    if (!(floor > 0)) floor = 0.5;
+ * design decisions (thirteen regions, min aggregate) rest on.
-    StoreEdge* edges = NULL; size_t n = 0;
+ * ═══════════════════════════════════════════════════════════════════════════ */
-    if (store_get_edges_from(s, claim_id, &edges, &n) < 0) return -1;
+
-    double best = 0.0; int found = 0;
+/* ── The one decay model. Moved here verbatim from el_runtime.c's
-    for (size_t i = 0; i < n; i++) {
+ * engram_temporal_decay so nodes and edges share a single implementation and a
-        if (!edges[i].relation || strcmp(edges[i].relation, COG_GROUNDED_BY_RELATION) != 0) continue;
+ * single set of constants; engram_temporal_decay now delegates. Bit-identical
-        /* grounded-for-whom: match observer if requested; global (for_whom=-) always counts */
+ * for nodes: reinforcements := activation_count, lambda_override :=
-        int match = 1;
+ * temporal_decay_rate.
-        if (for_whom && edges[i].metadata) {
+ *
-            const char* fw = strstr(edges[i].metadata, "for_whom=");
+ * This is what makes decay ANALYTIC rather than sampled: between two recorded
-            if (fw) { fw += 9; if (strcmp(fw, for_whom) != 0 && strcmp(fw, "-") != 0) match = 0; }
+ * versions the trajectory is not unknown, it is known in closed form from the
-        }
+ * last point and elapsed time. Store the point, read the curve. */
-        if (match) { found = 1; if (edges[i].weight > best) best = edges[i].weight; }
+double cog_decay_factor(int64_t age_ms, double reinforcements, double lambda_override) {
-    }
+    if (age_ms <= 0) return 1.0;
-    store_edges_free(edges, n);
+    double lambda = (lambda_override > 0.0) ? lambda_override : COG_DECAY_LAMBDA;
-    if (!found) return 0;                 /* ungrounded => refuse assertion (still held) */
+    double age_hours = (double)age_ms / 3600000.0;
-    return (best >= floor) ? 1 : 0;
+    if (reinforcements < 0) reinforcements = 0;
+    double t_half = COG_T_HALF_HOURS * (1.0 + log(1.0 + reinforcements));
+    double factor = exp(-lambda * age_hours / t_half);
+    if (factor < COG_DECAY_FLOOR) factor = COG_DECAY_FLOOR;
+    return factor;
 }
 
+const char* cog_prov_name(CogProvClass p) {
+    switch (p) {
+        case COG_PROV_OBSERVED:  return "observed";
+        case COG_PROV_INFERRED:  return "inferred";
+        case COG_PROV_TOLD:      return "told";
+        case COG_PROV_IMPRINTED: return "imprinted";
+        default:                 return "unset";
+    }
+}
+CogProvClass cog_prov_parse(const char* s) {
+    if (!s) return COG_PROV_UNSET;
+    if (!strcmp(s, "observed"))  return COG_PROV_OBSERVED;
+    if (!strcmp(s, "inferred"))  return COG_PROV_INFERRED;
+    if (!strcmp(s, "told"))      return COG_PROV_TOLD;
+    if (!strcmp(s, "imprinted")) return COG_PROV_IMPRINTED;
+    return COG_PROV_UNSET;
+}
+
+/* Locate the GRD1 block in an edge's metadata. It is always the tail; anything
+ * ahead of it is the edge's pre-existing metadata, preserved verbatim. */
+static const char* cog_grd_find(const char* meta) {
+    if (!meta) return NULL;
+    size_t ml = strlen(COG_GROUNDING_META_MAGIC);
+    if (strncmp(meta, COG_GROUNDING_META_MAGIC, ml) == 0) return meta;
+    const char* p = meta;
+    while ((p = strstr(p, COG_GROUNDING_META_MAGIC)) != NULL) {
+        if (p > meta && p[-1] == '\n') return p;
+        p += ml;
+    }
+    return NULL;
+}
+
+int cog_grounding_parse(const StoreEdge* e, int64_t now_ms, CogGrounding* out) {
+    if (!e || !out) return -1;
+    memset(out, 0, sizeof *out);
+
+    /* Two dimensions exist on every edge whether or not grounding has ever been
+     * established, because they ARE existing substrate rather than new fields:
+     *   associative — the accrued hebb, with its existing dynamics;
+     *   polarity    — the signed authored weight. `inhibitory` is precisely this
+     *                 distinction crushed to one bit, so it is the seed sign. */
+    out->associative = e->hebb;
+    out->polarity    = e->inhibitory ? -e->weight : e->weight;
+    out->prov        = COG_PROV_UNSET;
+    out->ts          = e->last_fired > 0 ? e->last_fired : e->updated_at;
+
+    const char* blk = cog_grd_find(e->metadata);
+    if (blk) {
+        out->present = 1;
+        char* copy = dupstr(blk);
+        if (!copy) return -1;
+        for (char* line = strtok(copy, "\n"); line; line = strtok(NULL, "\n")) {
+            if (line[0] == '\0') continue;
+            char tag = line[0];
+            const char* rest = line + 1; while (*rest == ' ') rest++;
+            if (tag == 'w') {          /* the four numeric dimensions */
+                double v[4] = {0,0,0,0}; parse_floats(rest, v, 4);
+                out->factual = v[0]; out->relational = v[1];
+                out->associative = v[2]; out->polarity = v[3];
+            } else if (tag == 'k') {   /* provenance class */
+                out->prov = cog_prov_parse(rest);
+            } else if (tag == 't') {   /* timestamp + seq + reinforcements */
+                double v[3] = {0,0,0}; parse_floats(rest, v, 3);
+                out->ts = (int64_t)v[0]; out->seq = (int64_t)v[1]; out->reinforcements = v[2];
+            } else if (tag == 'd') {
+                double v[3] = {0,0,0}; parse_floats(rest, v, 3);
+                out->fac_proj = v[0]; out->rel_proj = v[1]; out->cos_angle = v[2];
+            } else if (tag == 'v') {
+                snprintf(out->binding_value, sizeof out->binding_value, "%s", rest);
+            } else if (tag == 'c') {
+                double v[2] = {0,0}; parse_floats(rest, v, 2);
+                out->floor_at_record = v[0]; out->rel_floor_at_record = v[1];
+            } else if (tag == 'p') {
+                snprintf(out->prev_edge, sizeof out->prev_edge, "%s", rest);
+            }
+        }
+        free(copy);
+    }
+    out->agreement = (out->cos_angle > 0) ? 1 : (out->cos_angle < 0 ? -1 : 0);
+
+    /* ── DERIVED. Nothing below this line is ever serialized. Recency, decay and
+     * staleness are read off the curve; storing them is how a number ends up
+     * asserting something nothing computed (§8.1 / spec §2). */
+    out->age_ms = (out->ts > 0 && now_ms > out->ts) ? (now_ms - out->ts) : 0;
+    out->decay  = cog_decay_factor(out->age_ms, out->reinforcements, 0.0);
+    out->factual_now     = out->factual     * out->decay;
+    out->relational_now  = out->relational  * out->decay;
+    out->associative_now = out->associative * out->decay;
+    out->stale = (out->present && out->floor_at_record > 0 &&
+                  out->factual_now < out->floor_at_record) ? 1 : 0;
+    return 0;
+}
+
+char* cog_grounding_metadata(const char* base_meta, const CogGrounding* g) {
+    if (!g) return NULL;
+    size_t keep = 0;
+    if (base_meta) {
+        const char* blk = cog_grd_find(base_meta);
+        keep = blk ? (size_t)(blk - base_meta) : strlen(base_meta);
+        while (keep > 0 && base_meta[keep - 1] == '\n') keep--;
+    }
+    size_t cap = keep + 1024;
+    char* buf = malloc(cap); if (!buf) return NULL;
+    size_t o = 0;
+    if (keep) { memcpy(buf, base_meta, keep); o = keep; buf[o++] = '\n'; }
+    o += (size_t)snprintf(buf + o, cap - o, "%s\n", COG_GROUNDING_META_MAGIC);
+    /* STORED ONLY. factual / relational / associative / polarity / provenance /
+     * timestamp — plus the joint state a decision saw. No confidence, no
+     * recency, no staleness, no volatility: those are read off the curve. */
+    o += (size_t)snprintf(buf + o, cap - o, "w %.9g %.9g %.9g %.9g\n",
+                          g->factual, g->relational, g->associative, g->polarity);
+    o += (size_t)snprintf(buf + o, cap - o, "k %s\n", cog_prov_name(g->prov));
+    o += (size_t)snprintf(buf + o, cap - o, "t %lld %lld %.9g\n",
+                          (long long)g->ts, (long long)g->seq, g->reinforcements);
+    o += (size_t)snprintf(buf + o, cap - o, "d %.9g %.9g %.9g\n",
+                          g->fac_proj, g->rel_proj, g->cos_angle);
+    o += (size_t)snprintf(buf + o, cap - o, "v %s\n", g->binding_value[0] ? g->binding_value : "-");
+    o += (size_t)snprintf(buf + o, cap - o, "c %.9g %.9g\n", g->floor_at_record, g->rel_floor_at_record);
+    if (g->prev_edge[0]) o += (size_t)snprintf(buf + o, cap - o, "p %s\n", g->prev_edge);
+    (void)o;
+    return buf;
+}
+
+/* ── Consequence, not epsilon. Every test is a floor crossing or a sign change,
+ * both exact. Ordered so the two INHERENT (discrete) moves are reported in
+ * preference to the graded ones, because they bypass the salience gate. */
+CogSignificance cog_grounding_significant(const CogGrounding* prev,
+                                          const CogGrounding* now,
+                                          double floor, double rel_floor) {
+    if (!now) return COG_SIG_NONE;
+    if (!prev || !prev->present) return COG_SIG_FIRST_RECORD;
+
+    /* INHERENT 1 — polarity sign flip. Ignorance and disagreement are different
+     * states, and support → contradiction is a change of state rather than a
+     * drift, so no threshold applies. Comparing signs, with zero its own class. */
+    {
+        int sp = prev->polarity > 0 ? 1 : (prev->polarity < 0 ? -1 : 0);
+        int sn = now->polarity  > 0 ? 1 : (now->polarity  < 0 ? -1 : 0);
+        if (sp != sn) return COG_SIG_POLARITY_FLIP;
+    }
+    /* INHERENT 2 — provenance class change. told → observed is a categorical
+     * upgrade in what the relation is entitled to, not a movement along an axis. */
+    if (prev->prov != now->prov) return COG_SIG_PROVENANCE_CHANGE;
+
+    /* Crossing an assert floor — the move changes whether this relation can be
+     * spoken. Compared on the DECAYED values, because that is what the gate reads. */
+    if ((prev->factual_now    >= floor)     != (now->factual_now    >= floor))     return COG_SIG_FACTUAL_FLOOR;
+    if ((prev->relational_now >= rel_floor) != (now->relational_now >= rel_floor)) return COG_SIG_RELATIONAL_FLOOR;
+
+    /* Flipping factual/relational agreement — the relation stops being "true and
+     * meaningful" and becomes "true and misapplied", or the reverse. This is the
+     * 911/CPS contradiction as a measured event rather than a reviewable one. */
+    if (prev->agreement != now->agreement) return COG_SIG_AGREEMENT_FLIP;
+
+    /* A gradient reversing — the evidence stopped pulling the claim toward it and
+     * began pushing it away, or the same on the values axis. */
+    if ((prev->fac_proj > 0) != (now->fac_proj > 0)) return COG_SIG_DIRECTION_REVERSAL;
+    if ((prev->rel_proj > 0) != (now->rel_proj > 0)) return COG_SIG_DIRECTION_REVERSAL;
+
+    return COG_SIG_NONE;
+}
+
+int cog_significance_inherent(CogSignificance s) {
+    return (s == COG_SIG_FIRST_RECORD || s == COG_SIG_POLARITY_FLIP ||
+            s == COG_SIG_PROVENANCE_CHANGE) ? 1 : 0;
+}
+
+const char* cog_significance_name(CogSignificance s) {
+    switch (s) {
+        case COG_SIG_FIRST_RECORD:       return "first-record";
+        case COG_SIG_POLARITY_FLIP:      return "polarity-sign-flip";
+        case COG_SIG_PROVENANCE_CHANGE:  return "provenance-class-change";
+        case COG_SIG_FACTUAL_FLOOR:      return "factual-floor-crossed";
+        case COG_SIG_RELATIONAL_FLOOR:   return "relational-floor-crossed";
+        case COG_SIG_AGREEMENT_FLIP:     return "agreement-sign-flip";
+        case COG_SIG_DIRECTION_REVERSAL: return "gradient-direction-reversal";
+        default:                         return "none";
+    }
+}
+
+/* ── Recording: a NEW edge record. The predecessor is never touched. ────────── */
+int cog_grounding_record(EngramPagedStore* s, const StoreEdge* base,
+                         const CogGrounding* g, char* out_id, size_t out_id_cap) {
+    if (!s || !base || !base->id || !g) return -1;
+    char root[192];
+    snprintf(root, sizeof root, "%s", base->id);
+    char* hash = strchr(root, '#'); if (hash) *hash = '\0';
+
+    int seq = (int)g->seq + 1;
+    char vid[224];
+    snprintf(vid, sizeof vid, "%s#%d", root, seq);
+
+    CogGrounding rec = *g;
+    rec.seq = seq;
+    snprintf(rec.prev_edge, sizeof rec.prev_edge, "%s", base->id);
+
+    char* meta = cog_grounding_metadata(base->metadata, &rec);
+    if (!meta) return -1;
+
+    StoreEdge e; memset(&e, 0, sizeof e);
+    e.id = vid; e.from_id = base->from_id; e.to_id = base->to_id;
+    e.relation = base->relation; e.metadata = meta;
+    /* The vector IS the weight, so the scalar fields carry their dimensions:
+     * `weight` the magnitude of polarity, `inhibitory` its sign, `hebb` the
+     * associative strength. Nothing here is a second copy of a derived value. */
+    e.weight     = rec.polarity < 0 ? -rec.polarity : rec.polarity;
+    e.inhibitory = rec.polarity < 0 ? 1 : 0;
+    e.hebb       = rec.associative;
+    e.confidence = base->confidence;
+    e.created_at = base->created_at;
+    e.updated_at = rec.ts;
+    e.last_fired = rec.ts;
+    e.layer_id   = base->layer_id;
+    int rc = store_put_edge(s, &e);
+    free(meta);
+    if (rc != 0) return -1;
+    if (out_id && out_id_cap) snprintf(out_id, out_id_cap, "%s", vid);
+    return seq;
+}
+
+int cog_grounding_head(EngramPagedStore* s, const char* base_id,
+                       StoreEdge* out, int max_versions) {
+    if (!s || !base_id || !out) return -1;
+    if (max_versions <= 0) max_versions = 64;
+    char root[192]; snprintf(root, sizeof root, "%s", base_id);
+    char* hash = strchr(root, '#'); if (hash) *hash = '\0';
+
+    StoreEdge cur; memset(&cur, 0, sizeof cur);
+    if (store_get_edge(s, root, &cur) != 1) return -1;
+    int found = 0;
+    for (int v = 1; v <= max_versions; v++) {
+        char vid[224]; snprintf(vid, sizeof vid, "%s#%d", root, v);
+        StoreEdge nx;
+        if (store_get_edge(s, vid, &nx) != 1) break;
+        store_edge_free(&cur); cur = nx; found = v;
+    }
+    *out = cur;
+    return found;
+}
+
+/* ── VOLATILITY AND DRIFT: derived from the chain, stored nowhere. The series
+ * exists only because nothing was destroyed, which is the whole return on
+ * immutability — a derivative for free. */
+int cog_grounding_trajectory(EngramPagedStore* s, const char* base_id,
+                             int64_t now_ms, CogTrajectory* out) {
+    if (!s || !base_id || !out) return -1;
+    memset(out, 0, sizeof *out);
+    char root[192]; snprintf(root, sizeof root, "%s", base_id);
+    char* hash = strchr(root, '#'); if (hash) *hash = '\0';
+
+    double pf = 0, pr = 0, f0 = 0, r0 = 0, fN = 0, rN = 0;
+    double sum_df = 0, sum_dr = 0;
+    int n = 0;
+    for (int v = 0; v <= 64; v++) {
+        char vid[224];
+        if (v == 0) snprintf(vid, sizeof vid, "%s", root);
+        else        snprintf(vid, sizeof vid, "%s#%d", root, v);
+        StoreEdge e;
+        if (store_get_edge(s, vid, &e) != 1) { if (v) break; else continue; }
+        CogGrounding g;
+        if (cog_grounding_parse(&e, now_ms, &g) == 0) {
+            if (n == 0) { f0 = g.factual; r0 = g.relational; }
+            else { sum_df += fabs(g.factual - pf); sum_dr += fabs(g.relational - pr); }
+            pf = g.factual; pr = g.relational; fN = pf; rN = pr;
+            n++;
+        }
+        store_edge_free(&e);
+    }
+    out->n_versions = n;
+    if (n > 1) {
+        out->factual_volatility    = sum_df / (double)(n - 1);
+        out->relational_volatility = sum_dr / (double)(n - 1);
+    }
+    out->factual_drift    = fN - f0;
+    out->relational_drift = rN - r0;
+    /* "STAYED TRUE, BECAME WRONG" — the event the joint record makes visible and
+     * that per-dimension versioning would have destroyed: the fact held while
+     * the meaning degraded. Expressed as signs, so there is no tolerance here
+     * either: factual did not fall, relational did. */
+    out->stayed_true_became_wrong =
+        (n > 1 && out->factual_drift >= 0 && out->relational_drift < 0) ? 1 : 0;
+    return 0;
+}
+
+/* ── Assertion gates on BOTH floors. Traversal is untouched: activation still
+ * conducts on the factual/associative side, so a relation can remain thinkable
+ * while ceasing to be assertable. That gap is where the wide angles live. ──── */
+int cog_assert_two_axis(EngramPagedStore* s, const char* claim_id,
+                        double floor, double rel_floor, int64_t now_ms,
+                        CogAssertion* out) {
+    if (!s || !claim_id || !out) return -1;
+    memset(out, 0, sizeof *out);
+    if (!(floor > 0))     floor = 0.5;
+    if (!(rel_floor > 0)) rel_floor = floor;
+
+    /* still_held is DERIVED, not a literal (§8.1). Holding is unconditional —
+     * the store gates nothing — so the question the field actually answers is
+     * whether the content is present and live. */
+    StoreNode n;
+    if (store_get_node(s, claim_id, &n) == 1) { out->still_held = !n.tombstoned; store_node_free(&n); }
+    else out->still_held = 0;
+
+    double best = -1.0;
+    for (int dir = 0; dir < 2; dir++) {
+        StoreEdge* edges = NULL; size_t ne = 0;
+        int rc = dir == 0 ? store_get_edges_from(s, claim_id, &edges, &ne)
+                          : store_get_edges_to  (s, claim_id, &edges, &ne);
+        if (rc < 0) continue;
+        for (size_t i = 0; i < ne; i++) {
+            if (edges[i].tombstoned) continue;
+            CogGrounding g;
+            if (cog_grounding_parse(&edges[i], now_ms, &g) != 0) continue;
+            out->n_edges++;
+            out->found = 1;
+            if (g.factual_now > best) {
+                best = g.factual_now;
+                out->factual    = g.factual_now;
+                out->relational = g.relational_now;   /* the SAME edge, not a max */
+                out->polarity   = g.polarity;
+                out->cos_angle  = g.cos_angle;
+                out->agreement  = g.agreement;
+                out->prov       = g.prov;
+                out->relational_established = g.present;
+                snprintf(out->best_edge, sizeof out->best_edge, "%s", edges[i].id ? edges[i].id : "");
+                snprintf(out->binding_value, sizeof out->binding_value, "%s", g.binding_value);
+            }
+        }
+        store_edges_free(edges, ne);
+    }
+    /* BOTH floors, and an unestablished relational axis does NOT pass by default
+     * — defaulting it to passing is the exemption §0 forbids. A negative polarity
+     * is a relation that actively contradicts and can never license assertion. */
+    out->may_assert = (out->found && out->relational_established &&
+                       out->polarity > 0 &&
+                       out->factual >= floor && out->relational >= rel_floor) ? 1 : 0;
+    return 0;
+}
+
+
 /* ═══════════════════════════════════════════════ THE CORRESPONDENCE-LOOP ═════ */
 int engram_correspondence_beat(const GeoDescriptor* region, const float* anchor,
                                double outcome_y, CogStance* stance,
                                int learn, double max_step, CogBeatResult* out) {
     if (!region || !stance || !out) return -1;
     memset(out, 0, sizeof *out);
-    if (stance->keystone) { learn = 0; out->wrote_keystone = 1; }  /* §6: never write a keystone */
+    /* 2026-08-16: the keystone block is GONE. It refused to learn about the
+     * reference frame, which does not make it a good reference — it makes it
+     * unexaminable, trading circular calibration for an ungroundable one (spec
+     * §2). Measured cost of the block: on the keystone region the beat reported
+     * 0.00% brier reduction over n_trials 0 — it never ran, so nothing about the
+     * self was ever calibrated OR falsifiable. What replaces it is a provenance
+     * constraint, not a permission: cog_grounding_downstream refuses evidence
+     * that is downstream of the region being calibrated, for every region alike.
+     * `wrote_keystone` is retained as a reporting field only and is always 0. */
 
     GeoGradient g;
     if (engram_think(region, anchor, stance, &g) != 0) return -1;   /* PREDICTION */

lang/runtime/engram_cognition.h

@@ -23,7 +23,7 @@
  * and a region, and grounded-for-whom.
  *
  * PURE + (mostly) READ-ONLY, stdlib + libm only. think() and the warp are pure
- * over their inputs. Persistence (Stance <-> StoreNode, grounded-by edges) is the
+ * over their inputs. Persistence (Stance <-> StoreNode, edge grounding vectors) is the
  * only part that touches the store, and it is additive / supersede / tombstone —
  * never mutate-in-place, never delete. It NEVER touches the live daemon: all
  * offline against a scratch store, per the design's rails.
@@ -152,30 +152,25 @@ int engram_express(const GeoGradient* g, const float* anchor, float* out_point);
 
 /* ═══════════════════════════════════════════════════════════════════════════
  * §5  HOLD vs GROUND vs ASSERT. Holding is unconditional (the store gates nothing).
- * Grounding is a RELATION — a "grounded-by" edge, probabilistic, grounded-for-whom.
+ * Grounding is an ATTRIBUTE OF a relation — carried on the edge itself, as a
- * The honesty floor is checked only at ASSERTION.
+ * vector (§7). The honesty floor is checked only at ASSERTION, on both axes.
  * ═══════════════════════════════════════════════════════════════════════════ */
-#define COG_GROUNDED_BY_RELATION "grounded-by"
+/* DELETED 2026-08-16: COG_GROUNDED_BY_RELATION and cog_ground_edge.
+ *
+ * A "grounded-by" edge models grounding as a relation BETWEEN two nodes. It is a
+ * property OF a relation — and it is that relation's weight. Minting a new edge
+ * to carry a score was the error; #147 corrected which endpoints the edge landed
+ * on and left the wrong idea standing. There is nothing to ground a claim
+ * "against" that is not already an edge, and if no edge exists the honest answer
+ * is that the two are not related — not a freshly minted one scoring 0.98.
+ * See §7 for what replaced it. */
 #define COG_SALIENT_TO_RELATION  "salient-to"
 
-/* Write a grounded-by edge (additive). weight = grounding ∈(0,1] from the verifier;
- * for_whom recorded in edge metadata (grounding is relational). Never a node flag. */
-int cog_ground_edge(EngramPagedStore* s, const char* claim_id,
-                    const char* evidence_id, double grounding, const char* for_whom);
-
 /* Write/refresh a salient-to edge: salience is RELATIONAL (grounded-for-whom),
  * carried on the edge to the observer — not baked into the node scalar (§2.1). */
 int cog_salient_edge(EngramPagedStore* s, const char* node_id,
                      const char* observer_id, double salience);
 
-/* The honesty floor — a QUERY at assertion time, NOT a schema constraint. Reads the
- * claim's stored grounded-by edges (for the given observer) and returns:
- *   1  = may assert (best grounding >= floor),
- *   0  = REFUSE assertion (holds unconditionally; only asserting is gated),
- *  <0  = error. The content remains held either way. */
-int cog_assert_gate(EngramPagedStore* s, const char* claim_id,
-                    const char* for_whom, double floor);
-
 /* ═══════════════════════════════════════════════════════════════════════════
  * §4  THE REFLEXIVE CORRESPONDENCE-LOOP — the learning engine. think scores its
  * OWN gradient against outcome, refines the stance on the error, and (optionally)
@@ -209,8 +204,265 @@ int engram_correspondence_beat(const GeoDescriptor* region, const float* anchor,
 /* ═══════════════════════════════════════════════════════════════════════════
  * §6  METASTABILITY. Keystones (self/values) are read-mostly: the loop reads but
  * never writes them. Mark by stance flag or by a keystone-id set the loop consults.
+ *
+ * SUPERSEDED BY §7's PROVENANCE CONSTRAINT (2026-08-16). The keystone flag is a
+ * PERMISSION: it asks who the target is, not where the evidence came from. That
+ * is censorship, and it costs the ability to ever ground the self (spec
+ * correspondence-and-censorship.md §0/§2). The constraint that actually protects
+ * a reference frame is cog_grounding_downstream: a region may not be calibrated
+ * by evidence downstream of itself. These declarations remain only so existing
+ * call sites keep compiling; nothing in the grounding path consults them.
  * ═══════════════════════════════════════════════════════════════════════════ */
 typedef struct { const char** ids; int n; } CogKeystoneSet;
 int cog_is_keystone(const CogKeystoneSet* ks, const CogStance* s);
 
+/* ═══════════════════════════════════════════════════════════════════════════
+ * §7  GROUNDING IS THE EDGE'S WEIGHT, AND THE WEIGHT IS A VECTOR
+ *      (2026-08-16; spec correspondence-and-censorship.md §2–§6 @ 2b7e4ba.)
+ *
+ * THE MODEL. Grounding is not a subsystem, a score, or a relation BETWEEN nodes.
+ * It is an attribute OF a relation. The graph already IS the grounding structure:
+ * every edge is a grounded relation, and what that relation is worth is carried
+ * on the edge itself. Three things follow, and each DELETES rather than adds:
+ *
+ *  1. `grounded-by` as a relation type does not exist, and cog_ground_edge is
+ *     gone. Minting an edge to hold a score models grounding as a relation
+ *     between nodes when it is a property of a relation. #147 corrected which
+ *     endpoints that edge landed on and left the wrong idea standing.
+ *  2. There is no observer, and no sampling rate. Change is not a consequence of
+ *     use — it IS use, the way potentiation is the firing rather than something
+ *     that reads the firing and writes a weight. So no supervisor compares a
+ *     value to a threshold and decides to persist.
+ *  3. Between two recorded versions the trajectory is not unknown. Decay is a
+ *     pure function of the last recorded point and elapsed time, so it is
+ *     ANALYTIC: store the point, read the curve.
+ *
+ * WHAT IS *NOT* HERE, DELIBERATELY. An earlier draft of the spec posed "a graph
+ * predicate for evidence downstream of itself" as the hard problem, and this file
+ * briefly contained one. It is withdrawn. Non-circularity is TEMPORAL, not
+ * topological: you cannot recalibrate the ruler while measuring with it, so you
+ * do it when you are not using the frame to act. Reachability could never have
+ * worked — measured on the live store, reachability from the self region over
+ * all relations reaches 89.2% of the graph (10,580 of 11,861 nodes) and 16.0%
+ * over hebbian/semantic relations alone, so the predicate marks essentially all
+ * evidence tainted and the constraint degenerates into the total block that
+ * censorship started as. Nothing replaces it here; the independence is a fact
+ * about engagement, owned by the dreamer, not a fact about the graph.
+ *
+ * ═══════════════════════════════════════════════════════════════════════════
+ * §7.1  THE VECTOR
+ *
+ * The test for a real dimension is whether it can move independently of the
+ * others. Five can, and each maps onto substrate that already exists:
+ *
+ *   factual      correspondence with evidence.                      [GRD1]
+ *   relational   correspondence with values — min over THIRTEEN
+ *                value regions, carrying the binding value's NAME.  [GRD1]
+ *   associative  co-activation frequency. This is the edge's `hebb`
+ *                field with its existing dynamics — NOT a new one.
+ *                Independent by construction: every superstition is
+ *                a strong association with no factual grounding.
+ *   polarity     SIGNED. Near zero means "no support"; NEGATIVE means
+ *                "this actively contradicts". The edge's `inhibitory`
+ *                bit is exactly this distinction crushed to one bit,
+ *                and is carried forward as the seed value.           [GRD1]
+ *   provenance   observed / inferred / told / imprinted. Categorical,
+ *                and load-bearing: it governs what the relation is
+ *                entitled to.                                        [GRD1]
+ *
+ * Plus a TIMESTAMP, which is what turns the supersession chain into a time
+ * series of vectors rather than a series of numbers.
+ *
+ * DERIVED, THEREFORE NEVER STORED. Confidence (high grounding AND low
+ * volatility), recency (decay read off the curve), staleness (grounding fallen
+ * below its floor), volatility (the derivative of a series nothing destroyed).
+ * Storing confidence separately is how `confidence: 0.5` ends up sitting beside
+ * a zero direction vector, asserting something nothing computed. Every field in
+ * CogGrounding below is marked STORED or DERIVED, and the serializer writes
+ * only the STORED ones.
+ *
+ * THE VALUES REFERENCE IS THIRTEEN REGIONS AND THE AGGREGATE IS MIN.
+ * Measured on the live store: the values root kn-5b606390 `contains` exactly 13
+ * value nodes; pairwise centroid cosine among their regions is min 0.1525,
+ * mean 0.5199, median 0.5282, max 0.9278 — they demonstrably do not form one
+ * region. Against a single union region the individual values sit at cosine
+ * 0.38..0.89, with constraints-as-freedom at 0.3812 and change-is-the-signal at
+ * 0.4677, so a union centroid under-represents precisely the values a claim is
+ * most likely to be measured against. MIN rather than MEAN because a mean lets
+ * strong agreement with twelve values mask a violation of the thirteenth, which
+ * is the mechanism of rationalization; min yields a binding constraint with a
+ * NAME attached rather than a score.
+ *
+ * TRAVERSAL CONDUCTS ON FACTUAL; ASSERTION REQUIRES BOTH. If activation
+ * conducted on relational weight, Neuron could not follow a chain of reasoning
+ * to a conclusion he then rejects — censorship arriving through the spreading
+ * rule. The gap between reachable and assertable is where the wide
+ * factual/relational angles live, and that gap is the interesting part.
+ * ═══════════════════════════════════════════════════════════════════════════ */
+
+/* ── The one decay model (moved here from el_runtime.c so that node decay and
+ * edge-grounding decay are a single implementation with a single set of
+ * constants, rather than a model and a parallel copy of it). Half-life scales
+ * with how established the thing is: T_eff = T_HALF · (1 + ln(1 + reinforcements)).
+ * The floor is a preference, not a cliff — max penalty for age alone is 4x.
+ * `lambda_override` > 0 replaces the default rate; 0 means use the default. */
+#define COG_T_HALF_HOURS  168.0
+#define COG_DECAY_LAMBDA  0.693147
+#define COG_DECAY_FLOOR   0.25
+double cog_decay_factor(int64_t age_ms, double reinforcements, double lambda_override);
+
+/* The compact vector block carried in the edge's own metadata. Line schema, same
+ * precedent as STNC1 / GEO1. Metadata the edge already carried is preserved
+ * verbatim ahead of the magic line. */
+#define COG_GROUNDING_META_MAGIC "GRD1"
+
+/* Provenance class — categorical, and it governs what the relation is entitled
+ * to. A change of class is inherently significant and needs no threshold,
+ * because told → observed is a categorical upgrade, not a drift. */
+typedef enum {
+    COG_PROV_UNSET     = 0,
+    COG_PROV_OBSERVED  = 1,
+    COG_PROV_INFERRED  = 2,
+    COG_PROV_TOLD      = 3,
+    COG_PROV_IMPRINTED = 4
+} CogProvClass;
+const char*  cog_prov_name(CogProvClass p);
+CogProvClass cog_prov_parse(const char* s);
+
+typedef struct {
+    int     present;              /* 1 iff the edge carries a GRD1 block           */
+
+    /* ── STORED: the vector, as it stood at `ts` ─────────────────────────────── */
+    double  factual;              /* correspondence with evidence                  */
+    double  relational;           /* min over the thirteen value regions           */
+    double  associative;          /* co-activation frequency — mirrors edge->hebb  */
+    double  polarity;             /* SIGNED support; <0 = actively contradicts     */
+    CogProvClass prov;            /* observed / inferred / told / imprinted        */
+    int64_t ts;                   /* when this version was recorded (ms)           */
+    int64_t seq;                  /* supersession sequence number                  */
+    double  reinforcements;       /* uses folded into this version                 */
+    char    binding_value[128];   /* the argmin value — the conflict's NAME        */
+    /* the two gradients as frame-independent signed projections, plus the angle
+     * between them in full R^dim. These are part of the JOINT STATE a decision
+     * saw, not a convenience: near +1 evidence and values push the same way; at
+     * or below 0 the relation is factually supported and relationally wrong. */
+    double  fac_proj, rel_proj, cos_angle;
+    int     agreement;            /* sign(cos_angle): +1 / 0 / −1                  */
+    double  floor_at_record, rel_floor_at_record;
+    char    prev_edge[192];       /* the version this superseded ("" if first)     */
+
+    /* ── DERIVED at read time. NEVER serialized. ─────────────────────────────── */
+    int64_t age_ms;               /* recency: now − ts                             */
+    double  decay;                /* cog_decay_factor over that age                */
+    double  factual_now;          /* factual · decay                               */
+    double  relational_now;
+    double  associative_now;
+    int     stale;                /* grounding fallen below its floor              */
+} CogGrounding;
+
+/* Read an edge's vector as of `now_ms`. Pure — never writes. An edge with no
+ * GRD1 block still has an associative strength (its accrued hebb) and a polarity
+ * (its signed authored weight); `present` says whether the grounding dimensions
+ * have ever been established, and an unestablished dimension is reported as such
+ * rather than defaulted to a passing value. */
+int cog_grounding_parse(const StoreEdge* e, int64_t now_ms, CogGrounding* out);
+
+/* Serialize the STORED half of the vector, preserving pre-existing non-GRD1
+ * metadata. Returns an owned string. Derived fields are not written. */
+char* cog_grounding_metadata(const char* base_meta, const CogGrounding* g);
+
+/* ── §7.2  CONSOLIDATION-GATED SUPERSESSION ──────────────────────────────────
+ *
+ * Supersession is not recording — it is CONSOLIDATION, gated by salience, which
+ * is why you remember the argument and not the commute. Significance is
+ * evaluated PER-DIMENSION but the record is the WHOLE VECTOR: any dimension
+ * moving enough to matter triggers a supersession, and the new version captures
+ * every dimension as it stood at that instant. Versioning axes independently
+ * would make the joint state unreconstructable, and the joint state is the point
+ * — it is what makes "stayed true, became wrong" visible as an event (factual
+ * holding steady across versions while relational degrades).
+ *
+ * There is deliberately no epsilon in this enum or in the function that computes
+ * it. Every test is a floor crossing or a sign change, both exact. Two of them
+ * are INHERENTLY significant because they are discrete state changes rather than
+ * drift, and those bypass the salience gate entirely. */
+typedef enum {
+    COG_SIG_NONE               = 0,  /* nothing decision-relevant moved — DO NOT RECORD */
+    COG_SIG_FIRST_RECORD       = 1,  /* no prior version exists                         */
+    COG_SIG_POLARITY_FLIP      = 2,  /* INHERENT: support ↔ contradiction, or ignorance
+                                      * ↔ either. A discrete change of state.           */
+    COG_SIG_PROVENANCE_CHANGE  = 3,  /* INHERENT: told → observed is a categorical
+                                      * upgrade in what the relation is entitled to.    */
+    COG_SIG_FACTUAL_FLOOR      = 4,  /* crossed the assert floor, factual axis           */
+    COG_SIG_RELATIONAL_FLOOR   = 5,  /* crossed the assert floor, relational axis        */
+    COG_SIG_AGREEMENT_FLIP     = 6,  /* factual/relational agreement changed sign        */
+    COG_SIG_DIRECTION_REVERSAL = 7   /* a gradient reversed direction                    */
+} CogSignificance;
+
+CogSignificance cog_grounding_significant(const CogGrounding* prev,
+                                          const CogGrounding* now,
+                                          double floor, double rel_floor);
+const char* cog_significance_name(CogSignificance s);
+/* 1 iff this reason is a discrete state change that consolidates regardless of
+ * salience (polarity flip, provenance change, first record). */
+int cog_significance_inherent(CogSignificance s);
+
+/* ── §7.3  RECORDING: supersession of the EDGE, never an overwrite ────────────
+ * Writes version seq+1 as a NEW edge record with the same endpoints and relation
+ * and id "<root>#<seq+1>", carrying a GRD1 `p` pointer to its predecessor. The
+ * predecessor is never touched. The chain IS the trajectory: not only what the
+ * grounding is but which way it has been moving and how fast — a derivative
+ * obtained for free from immutability, because the points were never destroyed.
+ * Returns the version written (>=1), or <0 on error. */
+int cog_grounding_record(EngramPagedStore* s, const StoreEdge* base,
+                         const CogGrounding* g, char* out_id, size_t out_id_cap);
+
+/* Walk forward from a base edge id to its newest recorded version. Point reads
+ * only; consolidation is gated, so the chain is short. Returns the highest
+ * version found (0 = the base record is the only one). */
+int cog_grounding_head(EngramPagedStore* s, const char* base_id,
+                       StoreEdge* out, int max_versions);
+
+/* VOLATILITY — derived, never stored: the mean absolute per-version change of a
+ * dimension across the recorded chain. Feeds the equally-derived `confidence`
+ * (high grounding AND low volatility), which is likewise never stored. */
+typedef struct {
+    int    n_versions;
+    double factual_volatility;
+    double relational_volatility;
+    double factual_drift;         /* signed: newest − oldest                     */
+    double relational_drift;
+    int    stayed_true_became_wrong; /* factual steady while relational degraded  */
+} CogTrajectory;
+int cog_grounding_trajectory(EngramPagedStore* s, const char* base_id,
+                             int64_t now_ms, CogTrajectory* out);
+
+/* ── §7.4  ASSERTION GATES ON BOTH FLOORS ────────────────────────────────────
+ * A well-evidenced claim must not earn the right to be asserted regardless of
+ * whether it means the right thing. `may_assert` requires the decayed factual
+ * grounding to clear `floor` AND the decayed relational grounding to clear
+ * `rel_floor`. A relation whose relational axis has never been established does
+ * not pass by default — it is reported unestablished and refused, because
+ * defaulting it to passing is exactly the exemption §0 forbids. Traversal is
+ * untouched: activation still conducts on the factual/associative side, so a
+ * relation can remain thinkable while ceasing to be assertable. */
+typedef struct {
+    int     may_assert;
+    int     found;                 /* any relation at all on this claim            */
+    int     relational_established;
+    int     still_held;            /* DERIVED: node present and not tombstoned     */
+    double  factual;               /* best decayed factual grounding               */
+    double  relational;            /* the SAME edge's relational axis, not a max   */
+    double  polarity;
+    double  cos_angle;
+    int     agreement;
+    CogProvClass prov;
+    char    best_edge[192];
+    char    binding_value[128];
+    int     n_edges;
+} CogAssertion;
+int cog_assert_two_axis(EngramPagedStore* s, const char* claim_id,
+                        double floor, double rel_floor, int64_t now_ms,
+                        CogAssertion* out);
+
 #endif /* ENGRAM_COGNITION_H */

lang/tests/native/test_transduce.el

@@ -0,0 +1,234 @@
+import "../../runtime/eltest.el"
+// test_transduce.el — geometry as a first-class El value, and realizers
+// declared in El rather than patched into the runtime.
+//
+// WHAT IS ACTUALLY UNDER TEST. Until 2026-08-16 no El ingest path could carry
+// a vector: nodes took text, and geometry was DERIVED from that text. Text was
+// therefore the mandatory entry medium, so any non-text modality had to be
+// DESCRIBED in prose first and the geometry we reasoned over was the geometry
+// OF THE DESCRIPTION, not of the signal. The fix has two halves, and this file
+// exercises both:
+//
+//   1. Geometry is a VALUE — it carries its own width, so nothing has to
+//      assert a width against a string's length.
+//   2. A REALIZER is an ordinary El function. `tone_realizer` below is not in
+//      the runtime, is not known to the compiler, and is not special in any
+//      way; it is registered BY NAME and dispatched to through transduce().
+//      That is the load-bearing claim: adding a modality must not require a
+//      runtime patch, or nothing has actually moved into the language.
+//
+// COMPARISON DISCIPLINE IN THIS FILE (measured 2026-08-16, not stylistic):
+// elc lowers `a == b` to a NUMERIC comparison only when both operand names are
+// in the per-function int-name set, which `let x: Int` populates. A bare call
+// like `geometry_is(g) == 0` is not a registered name, so it lowers to
+// `str_eq(...)` — strcmp on two integers reinterpreted as pointers. `<` and `>`
+// lower directly via binop_to_c with no type inference at all, so truthiness is
+// written `> 0` / `< 1` here, and any exact `==` is done on a value first bound
+// through `let x: Int`.
+
+// ── A realizer, written entirely in El ──────────────────────────────────────
+// Maps a "tone" signal into a 4-component geometry. Deliberately trivial —
+// what is being proven is that an El function can BE a realizer, not that
+// this is good acoustics. The one real property it has: distinct signals
+// produce distinct geometry, so the test can tell transduction from a stub.
+fn tone_realizer(signal: String) -> Geometry {
+    let g: Geometry = geometry_new(4)
+    let n: Int = str_len(signal)
+    let a: Int = geometry_set(g, 0, int_to_float(n))
+    let b: Int = geometry_set(g, 1, int_to_float(n * 2))
+    let c: Int = geometry_set(g, 2, int_to_float(n * 3))
+    let d: Int = geometry_set(g, 3, int_to_float(n * 4))
+    g
+}
+
+// A second realizer for a different modality, to prove the registry keys on
+// modality and does not just hand back "the last thing registered".
+fn pulse_realizer(signal: String) -> Geometry {
+    let g: Geometry = geometry_new(2)
+    let a: Int = geometry_set(g, 0, 1.0)
+    let b: Int = geometry_set(g, 1, 0.0)
+    g
+}
+
+// A deliberately BROKEN realizer: it returns something that is not a Geometry.
+// transduce() must not hand this back to a caller as if it were one.
+fn bogus_realizer(signal: String) -> Geometry {
+    return 12345
+}
+
+test "geometry-is-a-value-with-its-own-width" {
+    let g: Geometry = geometry_new(8)
+    let live: Int = geometry_is(g)
+    assert live > 0, "geometry_new returns a live Geometry"
+    let d: Int = geometry_dim(g)
+    assert d == 8, "a Geometry carries its own width"
+    let freed: Int = geometry_free(g)
+    assert freed > 0, "geometry_free reports what it did"
+}
+
+test "geometry-rejects-nonsense-without-an-arbitrary-bound" {
+    // dim <= 0 is not a width. Note there is deliberately no MAX dim here:
+    // #141 needed `dim <= 8192` only to bound an allocation sized from a
+    // caller's claim about a string. A value that carries its own width has
+    // nothing left to validate, so the only failure left is allocation.
+    let zero: Geometry = geometry_new(0)
+    let z: Int = geometry_is(zero)
+    assert z < 1, "dim 0 is not a geometry"
+    let neg: Geometry = geometry_new(-4)
+    let n: Int = geometry_is(neg)
+    assert n < 1, "negative dim is not a geometry"
+    // Accessors must be total: a non-geometry is 0-width, never a crash.
+    let nd: Int = geometry_dim(0)
+    assert nd < 1, "geometry_dim of a non-geometry is 0"
+    let ni: Int = geometry_is(0)
+    assert ni < 1, "geometry_is of a non-geometry is 0"
+    let nf: Int = geometry_free(0)
+    assert nf < 1, "geometry_free of a non-geometry is a no-op"
+}
+
+test "geometry-components-round-trip" {
+    let g: Geometry = geometry_new(3)
+    let s0: Int = geometry_set(g, 0, 1.5)
+    let s1: Int = geometry_set(g, 1, -2.5)
+    assert s0 > 0, "set in range succeeds"
+    let oob: Int = geometry_set(g, 3, 9.0)
+    assert oob < 1, "set out of range is refused, not silently dropped"
+    let v0: Float = geometry_get(g, 0)
+    let d0: Float = v0 - 1.5
+    assert d0 < 0.001, "component 0 round-trips"
+    assert d0 > -0.001, "component 0 round-trips"
+    let v1: Float = geometry_get(g, 1)
+    let d1: Float = v1 + 2.5
+    assert d1 < 0.001, "component 1 round-trips (negative)"
+    assert d1 > -0.001, "component 1 round-trips (negative)"
+    let freed: Int = geometry_free(g)
+}
+
+test "hex-is-an-edge-adapter-and-derives-its-own-width" {
+    // 2 components, little-endian float32: 1.0 = 0000803f, 2.0 = 00000040.
+    let g: Geometry = geometry_from_f32le_hex("0000803f00000040")
+    let live: Int = geometry_is(g)
+    assert live > 0, "valid hex decodes to a Geometry"
+    let d: Int = geometry_dim(g)
+    assert d == 2, "width is DERIVED from the input, never supplied"
+    let a: Float = geometry_get(g, 0)
+    let da: Float = a - 1.0
+    assert da < 0.001, "first component decoded"
+    assert da > -0.001, "first component decoded"
+    let b: Float = geometry_get(g, 1)
+    let db: Float = b - 2.0
+    assert db < 0.001, "second component decoded"
+    assert db > -0.001, "second component decoded"
+    // Egress adapter is the exact inverse.
+    let back: String = geometry_to_f32le_hex(g)
+    assert str_eq(back, "0000803f00000040"), "hex round-trips exactly"
+    let freed: Int = geometry_free(g)
+}
+
+test "hex-rejects-malformed-input" {
+    let empty: Geometry = geometry_from_f32le_hex("")
+    let e: Int = geometry_is(empty)
+    assert e < 1, "empty hex is not a geometry"
+    let ragged: Geometry = geometry_from_f32le_hex("0000803f0000")
+    let r: Int = geometry_is(ragged)
+    assert r < 1, "length not a multiple of 8 is refused"
+    let nonhex: Geometry = geometry_from_f32le_hex("zzzzzzzz")
+    let nh: Int = geometry_is(nonhex)
+    assert nh < 1, "non-hex characters are refused"
+}
+
+test "a-realizer-declared-in-el-is-a-first-class-realizer" {
+    // THE CLAIM: tone_realizer is an ordinary El function. It is not in the
+    // runtime and the compiler knows nothing about it. Registering it by name
+    // is enough to make it the organ for a modality.
+    let reg: Int = realizer_register("tone", "tone_realizer")
+    assert reg > 0, "an El fn registers as a realizer by name"
+    let has: Int = realizer_has("tone")
+    assert has > 0, "the modality now has an organ"
+
+    let g: Geometry = transduce("aaa", "tone")
+    let live: Int = geometry_is(g)
+    assert live > 0, "transduce returns real geometry"
+    let d: Int = geometry_dim(g)
+    assert d == 4, "the El realizer determined the width, not the runtime"
+    // str_len("aaa") == 3, so component 0 must be 3.0 — proof the signal
+    // actually reached the El function rather than a stub answering for it.
+    let c0: Float = geometry_get(g, 0)
+    let dc: Float = c0 - 3.0
+    assert dc < 0.001, "the signal reached the El realizer"
+    assert dc > -0.001, "the signal reached the El realizer"
+    let freed: Int = geometry_free(g)
+}
+
+test "distinct-signals-transduce-to-distinct-geometry" {
+    let reg: Int = realizer_register("tone", "tone_realizer")
+    let g1: Geometry = transduce("aa", "tone")
+    let g2: Geometry = transduce("aaaaa", "tone")
+    let a: Float = geometry_get(g1, 0)
+    let b: Float = geometry_get(g2, 0)
+    let diff: Float = b - a
+    // 5 - 2 = 3. If transduction were a stub these would be equal.
+    assert diff > 2.9, "different signals produce different geometry"
+    assert diff < 3.1, "different signals produce different geometry"
+    let f1: Int = geometry_free(g1)
+    let f2: Int = geometry_free(g2)
+}
+
+test "the-registry-keys-on-modality" {
+    let r1: Int = realizer_register("tone", "tone_realizer")
+    let r2: Int = realizer_register("pulse", "pulse_realizer")
+    assert r2 > 0, "a second modality registers independently"
+    let gt: Geometry = transduce("aaa", "tone")
+    let gp: Geometry = transduce("aaa", "pulse")
+    let dt: Int = geometry_dim(gt)
+    let dp: Int = geometry_dim(gp)
+    assert dt == 4, "tone still routes to its own realizer"
+    assert dp == 2, "pulse routes to a different realizer"
+    let f1: Int = geometry_free(gt)
+    let f2: Int = geometry_free(gp)
+}
+
+test "no-organ-is-reported-as-no-organ" {
+    // A modality with no realizer must transduce to NOTHING. It must never
+    // fall back to embedding a description of the signal and calling that
+    // perception — that silent substitution is the entire defect this change
+    // exists to end.
+    let has: Int = realizer_has("echolocation")
+    assert has < 1, "unregistered modality has no organ"
+    let g: Geometry = transduce("anything", "echolocation")
+    let live: Int = geometry_is(g)
+    assert live < 1, "no realizer means no geometry, not fake geometry"
+}
+
+test "registration-of-an-unresolvable-name-fails-loudly" {
+    // Reported at the moment of WIRING, not later as "this modality mysteriously
+    // produces nothing". Distinguishing "no organ" from "broken organ" is the
+    // lesson that made this whole change necessary.
+    let bad: Int = realizer_register("ghost", "no_such_function_anywhere")
+    assert bad < 1, "an unresolvable realizer name is a registration failure"
+    let has: Int = realizer_has("ghost")
+    assert has < 1, "and nothing gets registered"
+}
+
+test "a-realizer-returning-non-geometry-transduces-nothing" {
+    let reg: Int = realizer_register("bogus", "bogus_realizer")
+    assert reg > 0, "the symbol resolves, so registration succeeds"
+    // ...but the contract is enforced at the boundary, so the caller never
+    // receives a value that would misbehave far away from here.
+    let g: Geometry = transduce("x", "bogus")
+    let live: Int = geometry_is(g)
+    assert live < 1, "a non-Geometry return transduced nothing"
+}
+
+test "norm-lets-a-caller-check-a-realizer-emitted-signal" {
+    let g: Geometry = geometry_new(2)
+    let z: Float = geometry_norm(g)
+    assert z < 0.001, "a fresh geometry is zero — norm says so"
+    let s0: Int = geometry_set(g, 0, 3.0)
+    let s1: Int = geometry_set(g, 1, 4.0)
+    let n: Float = geometry_norm(g)
+    let dn: Float = n - 5.0
+    assert dn < 0.001, "3-4-5: norm is 5"
+    assert dn > -0.001, "3-4-5: norm is 5"
+    let freed: Int = geometry_free(g)
+}