fix(engram): atomic engram_save (tmp+fsync+rename) + sparse-write anti-clobber floor

Kills the engram-clobber loop at its source. engram_save did a bare fopen("wb")
that truncates snapshot.json to 0 bytes before the 47MB write — a booting soul's
engram_load could read that empty window -> genesis -> nodes=1 -> a 63-node save
overwrote the populated file. Two guards:
 1. Atomic write: serialize to <path>.tmp, fflush+fsync, rename() over target
    (atomic on POSIX) — no reader ever sees a truncated/0-byte snapshot.
 2. Sparse-write floor: refuse to overwrite a >200KB snapshot with one < 1/16 its
    size — a partial load can never clobber a healthy graph, whatever the cause.

Validated in isolation: standalone clang harness 11/11; rebuilt the darwin soul
(scripts/build-soul-darwin.sh) and booted it on an isolated port against a golden
copy — loaded 5113 nodes and round-tripped the full 47MB snapshot, no .tmp leftover,
live ~/.neuron untouched. Adds scripts/build-soul-darwin.sh (local elb replacement).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci-dev.yaml

@@ -22,7 +22,10 @@ jobs:
       - name: Install build dependencies
         run: |
           apt-get update -qq
-          apt-get install -y gcc libcurl4-openssl-dev
+          apt-get install -y gcc libcurl4-openssl-dev apt-transport-https ca-certificates
+          echo "deb [trusted=yes] https://packages.cloud.google.com/apt cloud-sdk main" \
+            > /etc/apt/sources.list.d/google-cloud-sdk.list
+          apt-get update -qq && apt-get install -y google-cloud-cli
 
       # Seed: use the committed linux-amd64 binary as the bootstrap
       - name: Bootstrap from committed linux binary (seed)
@@ -84,13 +87,22 @@ jobs:
           bash tests/html_sanitizer/run.sh
 
       # Native El test suites (elc --test, compile-link-run)
+      # el_runtime.c is precompiled to .o once and reused by all 8 modules.
+      - name: Precompile el_runtime.o
+        run: |
+          set -euo pipefail
+          RUNTIME="$(pwd)/el-compiler/runtime"
+          gcc -O2 -c -I "$RUNTIME" "$RUNTIME/el_runtime.c" \
+            -o /tmp/el_runtime.o
+          echo "el_runtime.o compiled"
+
       - name: Run tests - native (core)
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
           RUNTIME="$(pwd)/el-compiler/runtime"
           "$ELC" --test tests/native/test_core.el > /tmp/el_native_core.c
-          gcc -O2 -I "$RUNTIME" /tmp/el_native_core.c "$RUNTIME/el_runtime.c" \
+          gcc -O2 -I "$RUNTIME" /tmp/el_native_core.c /tmp/el_runtime.o \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_core
           /tmp/el_native_core
 
@@ -100,7 +112,7 @@ jobs:
           ELC="$(pwd)/dist/platform/elc"
           RUNTIME="$(pwd)/el-compiler/runtime"
           "$ELC" --test tests/native/test_text.el > /tmp/el_native_text.c
-          gcc -O2 -I "$RUNTIME" /tmp/el_native_text.c "$RUNTIME/el_runtime.c" \
+          gcc -O2 -I "$RUNTIME" /tmp/el_native_text.c /tmp/el_runtime.o \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_text
           /tmp/el_native_text
 
@@ -110,7 +122,7 @@ jobs:
           ELC="$(pwd)/dist/platform/elc"
           RUNTIME="$(pwd)/el-compiler/runtime"
           "$ELC" --test tests/native/test_string.el > /tmp/el_native_string.c
-          gcc -O2 -I "$RUNTIME" /tmp/el_native_string.c "$RUNTIME/el_runtime.c" \
+          gcc -O2 -I "$RUNTIME" /tmp/el_native_string.c /tmp/el_runtime.o \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_string
           /tmp/el_native_string
 
@@ -120,7 +132,7 @@ jobs:
           ELC="$(pwd)/dist/platform/elc"
           RUNTIME="$(pwd)/el-compiler/runtime"
           "$ELC" --test tests/native/test_math.el > /tmp/el_native_math.c
-          gcc -O2 -I "$RUNTIME" /tmp/el_native_math.c "$RUNTIME/el_runtime.c" \
+          gcc -O2 -I "$RUNTIME" /tmp/el_native_math.c /tmp/el_runtime.o \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_math
           /tmp/el_native_math
 
@@ -130,7 +142,7 @@ jobs:
           ELC="$(pwd)/dist/platform/elc"
           RUNTIME="$(pwd)/el-compiler/runtime"
           "$ELC" --test tests/native/test_state.el > /tmp/el_native_state.c
-          gcc -O2 -I "$RUNTIME" /tmp/el_native_state.c "$RUNTIME/el_runtime.c" \
+          gcc -O2 -I "$RUNTIME" /tmp/el_native_state.c /tmp/el_runtime.o \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_state
           /tmp/el_native_state
 
@@ -140,7 +152,7 @@ jobs:
           ELC="$(pwd)/dist/platform/elc"
           RUNTIME="$(pwd)/el-compiler/runtime"
           "$ELC" --test tests/native/test_time.el > /tmp/el_native_time.c
-          gcc -O2 -I "$RUNTIME" /tmp/el_native_time.c "$RUNTIME/el_runtime.c" \
+          gcc -O2 -I "$RUNTIME" /tmp/el_native_time.c /tmp/el_runtime.o \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_time
           /tmp/el_native_time
 
@@ -150,7 +162,7 @@ jobs:
           ELC="$(pwd)/dist/platform/elc"
           RUNTIME="$(pwd)/el-compiler/runtime"
           "$ELC" --test tests/native/test_json.el > /tmp/el_native_json.c
-          gcc -O2 -I "$RUNTIME" /tmp/el_native_json.c "$RUNTIME/el_runtime.c" \
+          gcc -O2 -I "$RUNTIME" /tmp/el_native_json.c /tmp/el_runtime.o \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_json
           /tmp/el_native_json
 
@@ -160,7 +172,7 @@ jobs:
           ELC="$(pwd)/dist/platform/elc"
           RUNTIME="$(pwd)/el-compiler/runtime"
           "$ELC" --test tests/native/test_env.el > /tmp/el_native_env.c
-          gcc -O2 -I "$RUNTIME" /tmp/el_native_env.c "$RUNTIME/el_runtime.c" \
+          gcc -O2 -I "$RUNTIME" /tmp/el_native_env.c /tmp/el_runtime.o \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_env
           /tmp/el_native_env
 
@@ -170,7 +182,7 @@ jobs:
           ELC="$(pwd)/dist/platform/elc"
           RUNTIME="$(pwd)/el-compiler/runtime"
           "$ELC" --test tests/native/test_fs.el > /tmp/el_native_fs.c
-          gcc -O2 -I "$RUNTIME" /tmp/el_native_fs.c "$RUNTIME/el_runtime.c" \
+          gcc -O2 -I "$RUNTIME" /tmp/el_native_fs.c /tmp/el_runtime.o \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_fs
           /tmp/el_native_fs
 
@@ -203,9 +215,6 @@ jobs:
           GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
         run: |
           echo "${GCP_SA_KEY}" > /tmp/gcp-key.json
-          apt-get install -y -qq apt-transport-https ca-certificates curl
-          echo "deb [trusted=yes] https://packages.cloud.google.com/apt cloud-sdk main" > /etc/apt/sources.list.d/google-cloud-sdk.list
-          apt-get update -qq && apt-get install -y google-cloud-cli
           gcloud auth activate-service-account --key-file=/tmp/gcp-key.json
           gcloud config set project neuron-785695
 
@@ -272,8 +281,9 @@ jobs:
           gcloud config set project neuron-785695
           gcloud auth configure-docker us-central1-docker.pkg.dev --quiet
 
-          # Pull existing ci-base:dev (system deps stay cached in the base layer)
-          docker pull "${CI_BASE}:dev" || docker pull "${CI_BASE}:latest"
+          # Pull existing ci-base:dev (or fall back to :latest on first run)
+          BASE_TAG="dev"
+          docker pull "${CI_BASE}:dev" || { docker pull "${CI_BASE}:latest" && BASE_TAG="latest"; }
 
           # Inline Dockerfile — only replaces the El SDK layer
           cat > /tmp/Dockerfile.ci-base-patch << 'EOF'
@@ -288,7 +298,7 @@ jobs:
           EOF
 
           docker build \
-            --build-arg BASE="${CI_BASE}:dev" \
+            --build-arg BASE="${CI_BASE}:${BASE_TAG}" \
             --build-arg BUILDKIT_INLINE_CACHE=1 \
             -f /tmp/Dockerfile.ci-base-patch \
             -t "${CI_BASE}:dev" \

elp/src/language-profile.elh

@@ -1,46 +1,46 @@
-// auto-generated by elc --emit-header - do not edit
-extern fn lang_profile(code: String, word_order: String, morph_type: String, has_case: String, has_gender: String, script_dir: String, agreement: String, null_subject: String) -> Any
-extern fn lang_get(profile: Any, key: String) -> String
-extern fn lang_profile_en() -> Any
-extern fn lang_profile_ja() -> Any
-extern fn lang_profile_ar() -> Any
-extern fn lang_profile_zh() -> Any
-extern fn lang_profile_de() -> Any
-extern fn lang_profile_es() -> Any
-extern fn lang_profile_fi() -> Any
-extern fn lang_profile_sw() -> Any
-extern fn lang_profile_hi() -> Any
-extern fn lang_profile_ru() -> Any
-extern fn lang_profile_fr() -> Any
-extern fn lang_profile_la() -> Any
-extern fn lang_profile_he() -> Any
-extern fn lang_profile_sa() -> Any
-extern fn lang_profile_got() -> Any
-extern fn lang_profile_non() -> Any
-extern fn lang_profile_enm() -> Any
-extern fn lang_profile_pi() -> Any
-extern fn lang_profile_grc() -> Any
-extern fn lang_profile_ang() -> Any
-extern fn lang_profile_fro() -> Any
-extern fn lang_profile_goh() -> Any
-extern fn lang_profile_sga() -> Any
-extern fn lang_profile_txb() -> Any
-extern fn lang_profile_peo() -> Any
-extern fn lang_profile_akk() -> Any
-extern fn lang_profile_uga() -> Any
-extern fn lang_profile_egy() -> Any
-extern fn lang_profile_sux() -> Any
-extern fn lang_profile_gez() -> Any
-extern fn lang_profile_cop() -> Any
-extern fn lang_from_code(code: String) -> Any
-extern fn lang_default() -> Any
-extern fn lang_is_isolating(profile: Any) -> Bool
-extern fn lang_is_agglutinative(profile: Any) -> Bool
-extern fn lang_is_fusional(profile: Any) -> Bool
-extern fn lang_is_polysynthetic(profile: Any) -> Bool
-extern fn lang_is_rtl(profile: Any) -> Bool
-extern fn lang_has_null_subject(profile: Any) -> Bool
-extern fn lang_has_case(profile: Any) -> Bool
-extern fn lang_has_gender(profile: Any) -> Bool
-extern fn lang_word_order(profile: Any) -> String
-extern fn lang_code(profile: Any) -> String
+// auto-generated by elc --emit-header — do not edit
+extern fn lang_profile(code: String, word_order: String, morph_type: String, has_case: String, has_gender: String, script_dir: String, agreement: String, null_subject: String) -> [String]
+extern fn lang_get(profile: [String], key: String) -> String
+extern fn lang_profile_en() -> [String]
+extern fn lang_profile_ja() -> [String]
+extern fn lang_profile_ar() -> [String]
+extern fn lang_profile_zh() -> [String]
+extern fn lang_profile_de() -> [String]
+extern fn lang_profile_es() -> [String]
+extern fn lang_profile_fi() -> [String]
+extern fn lang_profile_sw() -> [String]
+extern fn lang_profile_hi() -> [String]
+extern fn lang_profile_ru() -> [String]
+extern fn lang_profile_fr() -> [String]
+extern fn lang_profile_la() -> [String]
+extern fn lang_profile_he() -> [String]
+extern fn lang_profile_sa() -> [String]
+extern fn lang_profile_got() -> [String]
+extern fn lang_profile_non() -> [String]
+extern fn lang_profile_enm() -> [String]
+extern fn lang_profile_pi() -> [String]
+extern fn lang_profile_grc() -> [String]
+extern fn lang_profile_ang() -> [String]
+extern fn lang_profile_fro() -> [String]
+extern fn lang_profile_goh() -> [String]
+extern fn lang_profile_sga() -> [String]
+extern fn lang_profile_txb() -> [String]
+extern fn lang_profile_peo() -> [String]
+extern fn lang_profile_akk() -> [String]
+extern fn lang_profile_uga() -> [String]
+extern fn lang_profile_egy() -> [String]
+extern fn lang_profile_sux() -> [String]
+extern fn lang_profile_gez() -> [String]
+extern fn lang_profile_cop() -> [String]
+extern fn lang_from_code(code: String) -> [String]
+extern fn lang_default() -> [String]
+extern fn lang_is_isolating(profile: [String]) -> Bool
+extern fn lang_is_agglutinative(profile: [String]) -> Bool
+extern fn lang_is_fusional(profile: [String]) -> Bool
+extern fn lang_is_polysynthetic(profile: [String]) -> Bool
+extern fn lang_is_rtl(profile: [String]) -> Bool
+extern fn lang_has_null_subject(profile: [String]) -> Bool
+extern fn lang_has_case(profile: [String]) -> Bool
+extern fn lang_has_gender(profile: [String]) -> Bool
+extern fn lang_word_order(profile: [String]) -> String
+extern fn lang_code(profile: [String]) -> String

elp/src/morphology-akk.el

@@ -56,6 +56,7 @@
 
 // ── String helpers ─────────────────────────────────────────────────────────────
 
+import "morphology.el"
 fn akk_str_ends(s: String, suf: String) -> Bool {
     return str_ends_with(s, suf)
 }

elp/src/morphology-akk.elh

@@ -1,4 +1,4 @@
-// auto-generated by elc --emit-header - do not edit
+// auto-generated by elc --emit-header — do not edit
 extern fn akk_str_ends(s: String, suf: String) -> Bool
 extern fn akk_str_len(s: String) -> Int
 extern fn akk_str_drop_last(s: String, n: Int) -> String

elp/src/morphology-ang.el

@@ -36,6 +36,7 @@
 
 // ── String helpers ─────────────────────────────────────────────────────────────
 
+import "morphology.el"
 fn ang_str_ends(s: String, suf: String) -> Bool {
     return str_ends_with(s, suf)
 }

elp/src/morphology-ang.elh

@@ -1,4 +1,4 @@
-// auto-generated by elc --emit-header - do not edit
+// auto-generated by elc --emit-header — do not edit
 extern fn ang_str_ends(s: String, suf: String) -> Bool
 extern fn ang_str_drop_last(s: String, n: Int) -> String
 extern fn ang_str_last_char(s: String) -> String

elp/src/morphology-ar.el

@@ -21,6 +21,7 @@
 
 // ── String helpers ────────────────────────────────────────────────────────────
 
+import "morphology.el"
 fn ar_str_ends(s: String, suf: String) -> Bool {
     return str_ends_with(s, suf)
 }

elp/src/morphology-ar.elh

@@ -1,4 +1,4 @@
-// auto-generated by elc --emit-header - do not edit
+// auto-generated by elc --emit-header — do not edit
 extern fn ar_str_ends(s: String, suf: String) -> Bool
 extern fn ar_str_len(s: String) -> Int
 extern fn ar_str_drop_last(s: String, n: Int) -> String

elp/src/morphology-cop.el

@@ -54,6 +54,7 @@
 
 // ── String helpers ──────────────────────────────────────────────────────────────
 
+import "morphology.el"
 fn cop_str_ends(s: String, suf: String) -> Bool {
     return str_ends_with(s, suf)
 }

elp/src/morphology-cop.elh

@@ -1,4 +1,4 @@
-// auto-generated by elc --emit-header - do not edit
+// auto-generated by elc --emit-header — do not edit
 extern fn cop_str_ends(s: String, suf: String) -> Bool
 extern fn cop_str_len(s: String) -> Int
 extern fn cop_drop(s: String, n: Int) -> String

elp/src/morphology-de.el

@@ -26,6 +26,7 @@
 //  Dat:    dem     der     dem     den
 //  Gen:    des     der     des     der
 
+import "morphology.el"
 fn de_article_def(gender: String, gram_case: String, number: String) -> String {
     if str_eq(number, "pl") {
         if str_eq(gram_case, "nom") { return "die" }

elp/src/morphology-de.elh

@@ -1,4 +1,4 @@
-// auto-generated by elc --emit-header - do not edit
+// auto-generated by elc --emit-header — do not edit
 extern fn de_article_def(gender: String, gram_case: String, number: String) -> String
 extern fn de_article_indef(gender: String, gram_case: String, number: String) -> String
 extern fn de_article(gender: String, gram_case: String, number: String, definite: String) -> String

elp/src/morphology-egy.el

@@ -52,6 +52,7 @@
 
 // ── String helpers ──────────────────────────────────────────────────────────────
 
+import "morphology.el"
 fn egy_str_ends(s: String, suf: String) -> Bool {
     return str_ends_with(s, suf)
 }

elp/src/morphology-egy.elh

@@ -1,4 +1,4 @@
-// auto-generated by elc --emit-header - do not edit
+// auto-generated by elc --emit-header — do not edit
 extern fn egy_str_ends(s: String, suf: String) -> Bool
 extern fn egy_str_len(s: String) -> Int
 extern fn egy_drop(s: String, n: Int) -> String

elp/src/morphology-enm.el

@@ -31,6 +31,7 @@
 
 // ── String helpers ─────────────────────────────────────────────────────────────
 
+import "morphology.el"
 fn enm_str_ends(s: String, suf: String) -> Bool {
     return str_ends_with(s, suf)
 }

elp/src/morphology-enm.elh

@@ -1,4 +1,4 @@
-// auto-generated by elc --emit-header - do not edit
+// auto-generated by elc --emit-header — do not edit
 extern fn enm_str_ends(s: String, suf: String) -> Bool
 extern fn enm_drop(s: String, n: Int) -> String
 extern fn enm_first_char(s: String) -> String

elp/src/morphology-es.el

@@ -12,6 +12,7 @@
 
 // ── String helpers (local, matching morphology.el conventions) ────────────────
 
+import "morphology.el"
 fn es_str_ends(s: String, suf: String) -> Bool {
     return str_ends_with(s, suf)
 }

elp/src/morphology-es.elh

@@ -1,4 +1,4 @@
-// auto-generated by elc --emit-header - do not edit
+// auto-generated by elc --emit-header — do not edit
 extern fn es_str_ends(s: String, suf: String) -> Bool
 extern fn es_str_drop_last(s: String, n: Int) -> String
 extern fn es_str_last_char(s: String) -> String

elp/src/morphology-fi.el

@@ -25,6 +25,7 @@
 // If only neutral vowels are found, default to "front" (the conservative choice
 // for borrowed words and those without clear back vowels).
 
+import "morphology.el"
 fn fi_harmony(word: String) -> String {
     let n: Int = str_len(word)
     let i: Int = n - 1

elp/src/morphology-fi.elh

@@ -1,11 +1,11 @@
-// auto-generated by elc --emit-header - do not edit
+// auto-generated by elc --emit-header — do not edit
 extern fn fi_harmony(word: String) -> String
 extern fn fi_suffix(base: String, harmony: String) -> String
 extern fn fi_noun_case(stem: String, gram_case: String, number: String, harmony: String) -> String
 extern fn fi_str_last_char(s: String) -> String
 extern fn fi_apply_case(noun: String, gram_case: String, number: String) -> String
 extern fn fi_verb_stem(dict_form: String) -> String
-extern fn fi_irregular_verb(dict_form: String) -> Any
+extern fn fi_irregular_verb(dict_form: String) -> [String]
 extern fn fi_present_ending(stem: String, person: String, number: String, harmony: String) -> String
 extern fn fi_past_stem(stem: String) -> String
 extern fn fi_past_ending(stem: String, person: String, number: String, harmony: String) -> String
@@ -14,4 +14,4 @@ extern fn fi_negative(verb: String, person: String, number: String) -> String
 extern fn fi_conjugate(verb: String, tense: String, person: String, number: String) -> String
 extern fn fi_question_suffix(harmony: String) -> String
 extern fn fi_make_question(verb_form: String, harmony: String) -> String
-extern fn fi_full_paradigm(noun: String) -> Any
+extern fn fi_full_paradigm(noun: String) -> [String]

elp/src/morphology-fr.el

@@ -19,6 +19,7 @@
 
 // ── String helpers (local, matching morphology.el conventions) ────────────────
 
+import "morphology.el"
 fn fr_str_ends(s: String, suf: String) -> Bool {
     return str_ends_with(s, suf)
 }

elp/src/morphology-fr.elh

@@ -1,4 +1,4 @@
-// auto-generated by elc --emit-header - do not edit
+// auto-generated by elc --emit-header — do not edit
 extern fn fr_str_ends(s: String, suf: String) -> Bool
 extern fn fr_str_drop_last(s: String, n: Int) -> String
 extern fn fr_str_last_char(s: String) -> String

elp/src/morphology-fro.el

@@ -53,6 +53,7 @@
 
 // ── String helpers ─────────────────────────────────────────────────────────────
 
+import "morphology.el"
 fn fro_str_ends(s: String, suf: String) -> Bool {
     return str_ends_with(s, suf)
 }

elp/src/morphology-fro.elh

@@ -1,4 +1,4 @@
-// auto-generated by elc --emit-header - do not edit
+// auto-generated by elc --emit-header — do not edit
 extern fn fro_str_ends(s: String, suf: String) -> Bool
 extern fn fro_drop(s: String, n: Int) -> String
 extern fn fro_slot(person: String, number: String) -> Int

elp/src/morphology-gez.el

@@ -64,6 +64,7 @@
 
 // ── String helpers ─────────────────────────────────────────────────────────────
 
+import "morphology.el"
 fn gez_str_ends(s: String, suf: String) -> Bool {
     return str_ends_with(s, suf)
 }

elp/src/morphology-gez.elh

@@ -1,4 +1,4 @@
-// auto-generated by elc --emit-header - do not edit
+// auto-generated by elc --emit-header — do not edit
 extern fn gez_str_ends(s: String, suf: String) -> Bool
 extern fn gez_str_len(s: String) -> Int
 extern fn gez_str_drop_last(s: String, n: Int) -> String

elp/src/morphology-goh.el

@@ -48,6 +48,7 @@
 
 // ── String helpers ─────────────────────────────────────────────────────────────
 
+import "morphology.el"
 fn goh_str_ends(s: String, suf: String) -> Bool {
     return str_ends_with(s, suf)
 }

elp/src/morphology-goh.elh

@@ -1,4 +1,4 @@
-// auto-generated by elc --emit-header - do not edit
+// auto-generated by elc --emit-header — do not edit
 extern fn goh_str_ends(s: String, suf: String) -> Bool
 extern fn goh_drop(s: String, n: Int) -> String
 extern fn goh_slot(person: String, number: String) -> Int

elp/src/morphology-got.el

@@ -49,6 +49,7 @@
 
 // ── String helpers ─────────────────────────────────────────────────────────────
 
+import "morphology.el"
 fn got_str_ends(s: String, suf: String) -> Bool {
     return str_ends_with(s, suf)
 }

elp/src/morphology-got.elh

@@ -1,4 +1,4 @@
-// auto-generated by elc --emit-header - do not edit
+// auto-generated by elc --emit-header — do not edit
 extern fn got_str_ends(s: String, suf: String) -> Bool
 extern fn got_str_drop_last(s: String, n: Int) -> String
 extern fn got_slot(person: String, number: String) -> Int

elp/src/morphology-grc.el

@@ -31,6 +31,7 @@
 
 // ── String helpers ─────────────────────────────────────────────────────────────
 
+import "morphology.el"
 fn grc_str_ends(s: String, suf: String) -> Bool {
     return str_ends_with(s, suf)
 }

elp/src/morphology-grc.elh

@@ -1,4 +1,4 @@
-// auto-generated by elc --emit-header - do not edit
+// auto-generated by elc --emit-header — do not edit
 extern fn grc_str_ends(s: String, suf: String) -> Bool
 extern fn grc_str_drop_last(s: String, n: Int) -> String
 extern fn grc_str_last_char(s: String) -> String

elp/src/morphology-he.el

@@ -51,6 +51,7 @@
 
 // ── String helpers ─────────────────────────────────────────────────────────────
 
+import "morphology.el"
 fn he_str_ends(s: String, suf: String) -> Bool {
     return str_ends_with(s, suf)
 }

elp/src/morphology-he.elh

@@ -1,4 +1,4 @@
-// auto-generated by elc --emit-header - do not edit
+// auto-generated by elc --emit-header — do not edit
 extern fn he_str_ends(s: String, suf: String) -> Bool
 extern fn he_str_len(s: String) -> Int
 extern fn he_str_drop_last(s: String, n: Int) -> String

elp/src/morphology-hi.el

@@ -24,6 +24,7 @@
 
 // ── String helpers ────────────────────────────────────────────────────────────
 
+import "morphology.el"
 fn hi_str_ends(s: String, suf: String) -> Bool {
     return str_ends_with(s, suf)
 }

elp/src/morphology-hi.elh

@@ -1,4 +1,4 @@
-// auto-generated by elc --emit-header - do not edit
+// auto-generated by elc --emit-header — do not edit
 extern fn hi_str_ends(s: String, suf: String) -> Bool
 extern fn hi_str_drop_last(s: String, n: Int) -> String
 extern fn hi_str_last_char(s: String) -> String

elp/src/morphology-ja.el

@@ -23,6 +23,7 @@
 // Note: this is a heuristic classifier for romanized input.  For production use
 // with native kana/kanji forms, the dictionary form (辞書形) must be consulted.
 
+import "morphology.el"
 fn ja_verb_group(dict_form: String) -> String {
     // Irregular verbs (exact match on dictionary form)
     if str_eq(dict_form, "する")  { return "irregular" }

elp/src/morphology-ja.elh

@@ -1,4 +1,4 @@
-// auto-generated by elc --emit-header - do not edit
+// auto-generated by elc --emit-header — do not edit
 extern fn ja_verb_group(dict_form: String) -> String
 extern fn ja_ichidan_stem(dict_form: String) -> String
 extern fn ja_godan_stem_change(dict_form: String, row: String) -> String

elp/src/morphology-la.el

@@ -25,6 +25,7 @@
 
 // ── String helpers ─────────────────────────────────────────────────────────────
 
+import "morphology.el"
 fn la_str_ends(s: String, suf: String) -> Bool {
     return str_ends_with(s, suf)
 }

elp/src/morphology-la.elh

@@ -1,4 +1,4 @@
-// auto-generated by elc --emit-header - do not edit
+// auto-generated by elc --emit-header — do not edit
 extern fn la_str_ends(s: String, suf: String) -> Bool
 extern fn la_str_drop_last(s: String, n: Int) -> String
 extern fn la_str_last_char(s: String) -> String

elp/src/morphology-non.el

@@ -27,6 +27,7 @@
 
 // ── String helpers ─────────────────────────────────────────────────────────────
 
+import "morphology.el"
 fn non_str_ends(s: String, suf: String) -> Bool {
     return str_ends_with(s, suf)
 }

elp/src/morphology-non.elh

@@ -1,4 +1,4 @@
-// auto-generated by elc --emit-header - do not edit
+// auto-generated by elc --emit-header — do not edit
 extern fn non_str_ends(s: String, suf: String) -> Bool
 extern fn non_drop(s: String, n: Int) -> String
 extern fn non_last(s: String) -> String

elp/src/morphology-peo.el

@@ -31,6 +31,7 @@
 
 // ── String helpers ─────────────────────────────────────────────────────────────
 
+import "morphology.el"
 fn peo_drop(s: String, n: Int) -> String {
     let len: Int = str_len(s)
     if n >= len { return "" }

elp/src/morphology-peo.elh

@@ -1,4 +1,4 @@
-// auto-generated by elc --emit-header - do not edit
+// auto-generated by elc --emit-header — do not edit
 extern fn peo_drop(s: String, n: Int) -> String
 extern fn peo_ends(s: String, suf: String) -> Bool
 extern fn peo_slot(person: String, number: String) -> Int

elp/src/morphology-pi.el

@@ -30,6 +30,7 @@
 
 // ── String helpers ─────────────────────────────────────────────────────────────
 
+import "morphology.el"
 fn pi_str_ends(s: String, suf: String) -> Bool {
     return str_ends_with(s, suf)
 }

elp/src/morphology-pi.elh

@@ -1,4 +1,4 @@
-// auto-generated by elc --emit-header - do not edit
+// auto-generated by elc --emit-header — do not edit
 extern fn pi_str_ends(s: String, suf: String) -> Bool
 extern fn pi_drop(s: String, n: Int) -> String
 extern fn pi_last_char(s: String) -> String

elp/src/morphology-ru.el

@@ -35,6 +35,7 @@
 // The heuristic returns the most probable gender.  Caller should override
 // for known exceptions (путь, рубль are masc despite -ь).
 
+import "morphology.el"
 fn ru_gender(noun: String) -> String {
     let n: Int = str_len(noun)
     if n == 0 { return "m" }

elp/src/morphology-ru.elh

@@ -1,4 +1,4 @@
-// auto-generated by elc --emit-header - do not edit
+// auto-generated by elc --emit-header — do not edit
 extern fn ru_gender(noun: String) -> String
 extern fn ru_stem_type(noun: String, gender: String) -> String
 extern fn ru_noun_case(noun: String, gender: String, gram_case: String, number: String) -> String

elp/src/morphology-sa.el

@@ -42,6 +42,7 @@
 
 // ── String helpers ─────────────────────────────────────────────────────────────
 
+import "morphology.el"
 fn sa_str_ends(s: String, suf: String) -> Bool {
     return str_ends_with(s, suf)
 }

elp/src/morphology-sa.elh

@@ -1,4 +1,4 @@
-// auto-generated by elc --emit-header - do not edit
+// auto-generated by elc --emit-header — do not edit
 extern fn sa_str_ends(s: String, suf: String) -> Bool
 extern fn sa_str_drop_last(s: String, n: Int) -> String
 extern fn sa_slot(person: String, number: String) -> Int

elp/src/morphology-sga.el

@@ -31,6 +31,7 @@
 
 // ── String helpers ─────────────────────────────────────────────────────────────
 
+import "morphology.el"
 fn sga_drop(s: String, n: Int) -> String {
     let len: Int = str_len(s)
     if n >= len { return "" }

elp/src/morphology-sga.elh

@@ -1,4 +1,4 @@
-// auto-generated by elc --emit-header - do not edit
+// auto-generated by elc --emit-header — do not edit
 extern fn sga_drop(s: String, n: Int) -> String
 extern fn sga_first(s: String) -> String
 extern fn sga_rest(s: String) -> String

elp/src/morphology-sux.el

@@ -53,6 +53,7 @@
 
 // ── String helpers ─────────────────────────────────────────────────────────────
 
+import "morphology.el"
 fn sux_str_ends(s: String, suf: String) -> Bool {
     return str_ends_with(s, suf)
 }

elp/src/morphology-sux.elh

@@ -1,4 +1,4 @@
-// auto-generated by elc --emit-header - do not edit
+// auto-generated by elc --emit-header — do not edit
 extern fn sux_str_ends(s: String, suf: String) -> Bool
 extern fn sux_str_drop_last(s: String, n: Int) -> String
 extern fn sux_str_last_char(s: String) -> String

elp/src/morphology-sw.el

@@ -24,6 +24,7 @@
 
 // ── String helpers ────────────────────────────────────────────────────────────
 
+import "morphology.el"
 fn sw_str_ends(s: String, suf: String) -> Bool {
     return str_ends_with(s, suf)
 }

elp/src/morphology-sw.elh

@@ -1,4 +1,4 @@
-// auto-generated by elc --emit-header - do not edit
+// auto-generated by elc --emit-header — do not edit
 extern fn sw_str_ends(s: String, suf: String) -> Bool
 extern fn sw_str_drop_last(s: String, n: Int) -> String
 extern fn sw_str_first_char(s: String) -> String

elp/src/morphology-txb.el

@@ -30,6 +30,7 @@
 
 // ── String helpers ─────────────────────────────────────────────────────────────
 
+import "morphology.el"
 fn txb_drop(s: String, n: Int) -> String {
     let len: Int = str_len(s)
     if n >= len { return "" }

elp/src/morphology-txb.elh

@@ -1,4 +1,4 @@
-// auto-generated by elc --emit-header - do not edit
+// auto-generated by elc --emit-header — do not edit
 extern fn txb_drop(s: String, n: Int) -> String
 extern fn txb_ends(s: String, suf: String) -> Bool
 extern fn txb_slot(person: String, number: String) -> Int

elp/src/morphology-uga.el

@@ -48,6 +48,7 @@
 
 // ── String helpers ─────────────────────────────────────────────────────────────
 
+import "morphology.el"
 fn uga_str_ends(s: String, suf: String) -> Bool {
     return str_ends_with(s, suf)
 }

elp/src/morphology-uga.elh

@@ -1,4 +1,4 @@
-// auto-generated by elc --emit-header - do not edit
+// auto-generated by elc --emit-header — do not edit
 extern fn uga_str_ends(s: String, suf: String) -> Bool
 extern fn uga_str_len(s: String) -> Int
 extern fn uga_str_drop_last(s: String, n: Int) -> String

elp/src/morphology.el

@@ -33,6 +33,17 @@
 
 // ── String helpers ────────────────────────────────────────────────────────────
 
+import "language-profile.el"
+import "morphology-es.el"
+import "morphology-fr.el"
+import "morphology-de.el"
+import "morphology-ru.el"
+import "morphology-fi.el"
+import "morphology-ar.el"
+import "morphology-hi.el"
+import "morphology-sw.el"
+import "morphology-la.el"
+import "morphology-ja.el"
 fn str_ends(s: String, suf: String) -> Bool {
     return str_ends_with(s, suf)
 }

elp/src/morphology.elh

@@ -1,4 +1,4 @@
-// auto-generated by elc --emit-header - do not edit
+// auto-generated by elc --emit-header — do not edit
 extern fn str_ends(s: String, suf: String) -> Bool
 extern fn str_last_char(s: String) -> String
 extern fn str_last2(s: String) -> String
@@ -8,7 +8,7 @@ extern fn is_vowel(c: String) -> Bool
 extern fn morph_apply_suffix(base: String, suffix: String) -> String
 extern fn en_irregular_plural(word: String) -> String
 extern fn en_irregular_singular(word: String) -> String
-extern fn en_irregular_verb(base: String) -> Any
+extern fn en_irregular_verb(base: String) -> [String]
 extern fn en_verb_3sg(base: String) -> String
 extern fn en_should_double_final(base: String) -> Bool
 extern fn en_verb_past(base: String) -> String
@@ -16,10 +16,10 @@ extern fn en_verb_gerund(base: String) -> String
 extern fn en_pluralize_regular(singular: String) -> String
 extern fn en_verb_form(base: String, tense: String, person: String, number: String) -> String
 extern fn agree_determiner(det: String, noun: String) -> String
-extern fn morph_pluralize(noun: String, profile: Any) -> String
+extern fn morph_pluralize(noun: String, profile: [String]) -> String
 extern fn morph_map_canonical(verb: String, code: String) -> String
-extern fn morph_conjugate(verb: String, tense: String, person: String, number: String, profile: Any) -> String
-extern fn morph_inflect(word: String, features: String, profile: Any) -> String
+extern fn morph_conjugate(verb: String, tense: String, person: String, number: String, profile: [String]) -> String
+extern fn morph_inflect(word: String, features: String, profile: [String]) -> String
 extern fn pluralize(singular: String) -> String
 extern fn singularize(plural: String) -> String
 extern fn verb_form(base: String, tense: String, person: String, number: String) -> String

elp/src/vocabulary.elh

@@ -1,20 +1,20 @@
-// auto-generated by elc --emit-header - do not edit
-extern fn lex_word(entry: Any) -> String
-extern fn lex_pos(entry: Any) -> String
-extern fn lex_form(entry: Any, idx: Int) -> String
-extern fn lex_class(entry: Any) -> String
-extern fn make_entry(word: String, pos: String, f0: String, f1: String, f2: String, f3: String, f4: String, cls: String) -> Any
-extern fn make_entry2(word: String, pos: String, f0: String, f1: String, cls: String) -> Any
-extern fn make_entry3(word: String, pos: String, f0: String, f1: String, f2: String, cls: String) -> Any
-extern fn make_entry1(word: String, pos: String, f0: String, cls: String) -> Any
-extern fn build_vocab() -> Any
-extern fn get_vocab() -> Any
-extern fn vocab_lookup(word: String, lang_code: String) -> Any
-extern fn vocab_lookup_en(word: String) -> Any
+// auto-generated by elc --emit-header — do not edit
+extern fn lex_word(entry: [String]) -> String
+extern fn lex_pos(entry: [String]) -> String
+extern fn lex_form(entry: [String], idx: Int) -> String
+extern fn lex_class(entry: [String]) -> String
+extern fn make_entry(word: String, pos: String, f0: String, f1: String, f2: String, f3: String, f4: String, cls: String) -> [String]
+extern fn make_entry2(word: String, pos: String, f0: String, f1: String, cls: String) -> [String]
+extern fn make_entry3(word: String, pos: String, f0: String, f1: String, f2: String, cls: String) -> [String]
+extern fn make_entry1(word: String, pos: String, f0: String, cls: String) -> [String]
+extern fn build_vocab() -> [[String]]
+extern fn get_vocab() -> [[String]]
+extern fn vocab_lookup(word: String, lang_code: String) -> [String]
+extern fn vocab_lookup_en(word: String) -> [String]
 extern fn vocab_synonym(word: String, lang_register: String, lang_code: String) -> String
-extern fn vocab_by_pos(pos: String) -> Any
-extern fn vocab_by_class(cls: String) -> Any
-extern fn entry_found(entry: Any) -> Bool
-extern fn entry_word(entry: Any) -> String
-extern fn entry_pos(entry: Any) -> String
-extern fn entry_form(entry: Any, n: Int) -> String
+extern fn vocab_by_pos(pos: String) -> [[String]]
+extern fn vocab_by_class(cls: String) -> [[String]]
+extern fn entry_found(entry: [String]) -> Bool
+extern fn entry_word(entry: [String]) -> String
+extern fn entry_pos(entry: [String]) -> String
+extern fn entry_form(entry: [String], n: Int) -> String

lang/el-compiler/runtime/el_runtime.c

@@ -1475,10 +1475,13 @@ static void http_send_response(int fd, const char* body) {
     }
 
     const char* eff_body = is_envelope ? env_body : body;
-    /* Use the real byte count from fs_read if available (handles binary files
-     * with embedded null bytes — PNG, WOFF2, etc.). Fall back to strlen for
-     * normal text/JSON responses where _tl_fs_read_len is 0. */
-    size_t blen = (_tl_fs_read_len > 0) ? _tl_fs_read_len : strlen(eff_body);
+    /* Use max(strlen, fs_read_len). fs_read_len is the real byte count for binary
+     * files (strlen stops at embedded NULs — PNG, WOFF2). strlen is correct AND larger
+     * when a handler WRAPS fs_read output in a longer text/JSON response (e.g.
+     * /api/safety-contact returns {"configured":...,"contact": <file>}); using
+     * fs_read_len alone truncated those responses to the file's length. */
+    size_t _blen_s = strlen(eff_body);
+    size_t blen = (_tl_fs_read_len > _blen_s) ? _tl_fs_read_len : _blen_s;
     _tl_fs_read_len = 0;  /* consume — one-shot per response */
     int head_only = _tl_http_head_only;
 
@@ -1552,7 +1555,8 @@ static void* http_worker(void* arg) {
             /* Copy response out BEFORE arena teardown.
              * For binary files, _tl_fs_read_len holds the real byte count —
              * use memcpy instead of strdup so null bytes are preserved. */
-            size_t rlen = _tl_fs_read_len > 0 ? _tl_fs_read_len : (rs ? strlen(rs) : 0);
+            size_t _rlen_s = rs ? strlen(rs) : 0;
+            size_t rlen = (_tl_fs_read_len > _rlen_s) ? _tl_fs_read_len : _rlen_s;
             response = malloc(rlen + 1);
             if (response && rs) { memcpy(response, rs, rlen); response[rlen] = '\0'; }
             else if (response) { response[0] = '\0'; }
@@ -1799,7 +1803,8 @@ static void* http_worker_v2(void* arg) {
             el_val_t hmap = http_build_headers_map(hdr_block ? hdr_block : "");
             el_val_t r = h(EL_STR(dispatch_method), EL_STR(path), hmap, EL_STR(body));
             const char* rs = EL_CSTR(r);
-            size_t rlen = _tl_fs_read_len > 0 ? _tl_fs_read_len : (rs ? strlen(rs) : 0);
+            size_t _rlen_s = rs ? strlen(rs) : 0;
+            size_t rlen = (_tl_fs_read_len > _rlen_s) ? _tl_fs_read_len : _rlen_s;
             response = malloc(rlen + 1);
             if (response && rs) { memcpy(response, rs, rlen); response[rlen] = '\0'; }
             else if (response) { response[0] = '\0'; }
@@ -3173,23 +3178,49 @@ static void jb_puts(JsonBuf* b, const char* s) {
 
 static void jb_emit_escaped(JsonBuf* b, const char* s) {
     jb_putc(b, '"');
-    for (; *s; s++) {
-        unsigned char c = (unsigned char)*s;
+    const unsigned char* p = (const unsigned char*)s;
+    while (*p) {
+        unsigned char c = *p;
         switch (c) {
-            case '"':  jb_puts(b, "\\\""); break;
-            case '\\': jb_puts(b, "\\\\"); break;
-            case '\b': jb_puts(b, "\\b");  break;
-            case '\f': jb_puts(b, "\\f");  break;
-            case '\n': jb_puts(b, "\\n");  break;
-            case '\r': jb_puts(b, "\\r");  break;
-            case '\t': jb_puts(b, "\\t");  break;
+            case '"':  jb_puts(b, "\\\""); p++; break;
+            case '\\': jb_puts(b, "\\\\"); p++; break;
+            case '\b': jb_puts(b, "\\b");  p++; break;
+            case '\f': jb_puts(b, "\\f");  p++; break;
+            case '\n': jb_puts(b, "\\n");  p++; break;
+            case '\r': jb_puts(b, "\\r");  p++; break;
+            case '\t': jb_puts(b, "\\t");  p++; break;
             default:
                 if (c < 0x20) {
                     char tmp[8];
                     snprintf(tmp, sizeof(tmp), "\\u%04x", c);
                     jb_puts(b, tmp);
-                } else {
+                    p++;
+                } else if (c < 0x80) {
                     jb_putc(b, (char)c);
+                    p++;
+                } else {
+                    /* Multi-byte UTF-8: validate sequence, pass through if valid,
+                     * escape as \u00xx if the start byte is invalid/orphaned. */
+                    int seq_len = 0;
+                    if      ((c & 0xE0) == 0xC0) seq_len = 2;
+                    else if ((c & 0xF0) == 0xE0) seq_len = 3;
+                    else if ((c & 0xF8) == 0xF0) seq_len = 4;
+                    if (seq_len >= 2) {
+                        int valid = 1;
+                        for (int i = 1; i < seq_len; i++) {
+                            if ((p[i] & 0xC0) != 0x80) { valid = 0; break; }
+                        }
+                        if (valid) {
+                            for (int i = 0; i < seq_len; i++) jb_putc(b, (char)p[i]);
+                            p += seq_len;
+                            break;
+                        }
+                    }
+                    /* Invalid start byte or truncated sequence — escape it */
+                    char tmp[8];
+                    snprintf(tmp, sizeof(tmp), "\\u%04x", c);
+                    jb_puts(b, tmp);
+                    p++;
                 }
                 break;
         }
@@ -6219,7 +6250,9 @@ static void engram_grow_edges(void) {
 static char* engram_new_id(void) {
     el_val_t v = uuid_new();
     const char* s = EL_CSTR(v);
-    return el_strdup(s ? s : "");
+    /* Persistent: node ids live in the global store; an arena (el_strdup) id is
+     * freed at el_request_end(), corrupting the node after the creating request. */
+    return el_strdup_persist(s ? s : "");
 }
 
 /* Convert a node into an ElMap of its fields.                            */
@@ -6314,12 +6347,17 @@ el_val_t engram_node_full(el_val_t content, el_val_t node_type, el_val_t label,
     const char* lb = EL_CSTR(label);
     const char* ti = EL_CSTR(tier);
     const char* tg = EL_CSTR(tags);
-    n->content   = el_strdup(c ? c : "");
-    n->node_type = el_strdup(nt && *nt ? nt : "Memory");
-    n->label     = el_strdup(lb && *lb ? lb : (c ? engram_first_n_chars(c, 60) : ""));
-    n->tier      = el_strdup(ti && *ti ? ti : "Working");
-    n->tags      = el_strdup(tg ? tg : "");
-    n->metadata  = el_strdup("{}");
+    /* Persistent (el_strdup_persist, NOT el_strdup): these strings are owned by the
+     * persistent global node store. el_strdup tracks into the per-request arena, which
+     * el_request_end() frees when the creating HTTP request completes — leaving the
+     * stored node with dangling pointers (corrupted ids, "saved but never listed").
+     * This is the root cause of the hallucinated/lost-saves class of bugs. */
+    n->content   = el_strdup_persist(c ? c : "");
+    n->node_type = el_strdup_persist(nt && *nt ? nt : "Memory");
+    n->label     = el_strdup_persist(lb && *lb ? lb : (c ? engram_first_n_chars(c, 60) : ""));
+    n->tier      = el_strdup_persist(ti && *ti ? ti : "Working");
+    n->tags      = el_strdup_persist(tg ? tg : "");
+    n->metadata  = el_strdup_persist("{}");
     n->salience    = engram_decode_score(salience);
     n->importance  = engram_decode_score(importance);
     n->confidence  = engram_decode_score(confidence);
@@ -7262,13 +7300,48 @@ el_val_t engram_save(el_val_t path) {
         jb_putc(&b, '}');
     }
     jb_puts(&b, "]}");
-    FILE* f = fopen(p, "wb");
-    if (!f) { free(b.buf); return 0; }
+
+    /* --- Anti-clobber sparse-write floor (NTN engram clobber fix) ---------
+     * Refuse to overwrite an existing populated snapshot with a drastically
+     * smaller one. A bad boot that loaded only ~63 identity nodes must never
+     * be able to clobber a healthy 5000+ node snapshot, regardless of the
+     * upstream cause (genesis fallback, partial load, etc.). */
+    {
+        struct stat _st;
+        if (stat(p, &_st) == 0 && _st.st_size > 200000 &&
+            (uint64_t)b.len < (uint64_t)_st.st_size / 16) {
+            fprintf(stderr,
+                "[engram_save] REFUSED sparse write: new %zu bytes vs existing "
+                "%lld bytes (< 1/16) — protecting snapshot %s\n",
+                b.len, (long long)_st.st_size, p);
+            free(b.buf);
+            return 0;
+        }
+    }
+
+    /* --- Atomic write: tmp + fsync + rename ------------------------------
+     * Write to a sibling temp file, fsync it durable, then rename() over the
+     * target. rename() is atomic on POSIX, so a concurrent reader (a booting
+     * soul's engram_load) never observes a truncated or 0-byte snapshot —
+     * which was the root of the genesis/clobber loop. */
+    size_t _plen = strlen(p);
+    char* _tmp = (char*)malloc(_plen + 5);
+    if (!_tmp) { free(b.buf); return 0; }
+    memcpy(_tmp, p, _plen);
+    memcpy(_tmp + _plen, ".tmp", 5); /* includes NUL */
+
+    FILE* f = fopen(_tmp, "wb");
+    if (!f) { free(_tmp); free(b.buf); return 0; }
     size_t w = fwrite(b.buf, 1, b.len, f);
+    int wok = (w == b.len);
+    if (wok) { fflush(f); fsync(fileno(f)); }
     fclose(f);
-    int ok = (w == b.len);
     free(b.buf);
-    return ok ? 1 : 0;
+
+    if (!wok) { unlink(_tmp); free(_tmp); return 0; }
+    if (rename(_tmp, p) != 0) { unlink(_tmp); free(_tmp); return 0; }
+    free(_tmp);
+    return 1;
 }
 
 /* Helper: extract a string field from a JSON object substring. */

lang/elb.el

@@ -305,7 +305,14 @@ fn link_binary(c_files: [String], out_bin: String, runtime_path: String, out_dir
     // prefix and add it if present (no-op on Linux where libssl is in /usr/lib).
     let ossl_lib_flag: String = "$(brew --prefix openssl 2>/dev/null | xargs -I{} printf -- '-L{}/lib' 2>/dev/null || true)"
     let ossl_inc_flag: String = "$(brew --prefix openssl 2>/dev/null | xargs -I{} printf -- '-I{}/include' 2>/dev/null || true)"
-    let parts = native_list_append(parts, "cc -O2 " + bracket_flag + " " + ossl_inc_flag + " -I " + dirname_of(runtime_path) + " -I " + out_dir)
+    // Force-include the C-level master declarations header so every translation
+    // unit sees all cross-module function signatures. Handles packages (like ELP)
+    // where modules call each other without explicit El import statements.
+    // The header is generated by elb --gen-decls or manually placed in out_dir.
+    let master_decls: String = out_dir + "/elp-c-decls.h"
+    let has_master: String = str_trim(exec_capture("test -f " + master_decls + " && echo yes || echo no"))
+    let include_flag: String = if str_eq(has_master, "yes") { "-include " + master_decls } else { "" }
+    let parts = native_list_append(parts, "cc -O2 " + bracket_flag + " " + ossl_inc_flag + " " + include_flag + " -I " + dirname_of(runtime_path) + " -I " + out_dir)
     let i = 0
     while i < n {
         let f: String = native_list_get(c_files, i)

lang/runtime/engram.el

@@ -6,15 +6,55 @@
 //
 // Dependencies: runtime/string.el, runtime/json.el
 
+// --- Validation (defense in depth) ---
+// el_val_t is an untyped machine word, so a wrong TYPE can't be caught here — but a
+// wrong VALUE can (a tier in the node_type slot, an empty/garbage string, an int, a
+// path, a model name, a cgi id). Reject loudly instead of silently writing junk.
+
+fn engram_valid_node_type(t: String) -> Bool {
+    return str_eq(t, "Memory") || str_eq(t, "Knowledge") || str_eq(t, "Belief")
+        || str_eq(t, "Project") || str_eq(t, "Tag") || str_eq(t, "BacklogItem")
+        || str_eq(t, "Artifact") || str_eq(t, "Conversation") || str_eq(t, "ExecutionContext")
+        || str_eq(t, "InternalStateEvent") || str_eq(t, "Self") || str_eq(t, "Entity")
+        || str_eq(t, "Process") || str_eq(t, "ConfigEntry") || str_eq(t, "Concept") || str_eq(t, "Imprint")
+        || str_eq(t, "SessionSummary")
+}
+
+fn engram_valid_tier(t: String) -> Bool {
+    return str_eq(t, "Semantic") || str_eq(t, "Episodic") || str_eq(t, "Working")
+        || str_eq(t, "Procedural") || str_eq(t, "Canonical") || str_eq(t, "Note") || str_eq(t, "Lesson")
+}
+
 // --- Node creation ---
 
 fn engram_node(content: String, node_type: String, salience: Float) -> String {
+    if !engram_valid_node_type(node_type) {
+        __println("[engram] REJECTED node write — invalid node_type '" + node_type + "'")
+        return ""
+    }
     return __engram_node(content, node_type, salience)
 }
 
-fn engram_node_full(content: String, nt: String, sal: Float, imp: Float,
-                    source: String, lang: String, ts: Int, tags: String) -> String {
-    return __engram_node_full(content, nt, sal, imp, source, lang, ts, tags)
+// Signature MUST match the C primitive __engram_node_full exactly (el_seed.h):
+//   (content, node_type, label, salience, importance, confidence, tier, tags)
+// The previous wrapper declared a stale 8-arg schema with wrong names AND types
+// (sal:Float at the label slot, ts:Int at the tier slot). Because el_val_t is an
+// untyped machine word, the EL compiler coerced caller args to those wrong param
+// types and then forwarded them BY POSITION into the C function — so tier received
+// an int, importance/confidence received strings, label received a float, etc.
+// That is the field-corruption bug. Match the contract 1:1 — no coercion, no reorder.
+fn engram_node_full(content: String, node_type: String, label: String,
+                    salience: Float, importance: Float, confidence: Float,
+                    tier: String, tags: String) -> String {
+    if !engram_valid_node_type(node_type) {
+        __println("[engram] REJECTED node write — invalid node_type '" + node_type + "' (label=" + label + ")")
+        return ""
+    }
+    if !engram_valid_tier(tier) {
+        __println("[engram] REJECTED node write — invalid tier '" + tier + "' (node_type=" + node_type + ", label=" + label + ")")
+        return ""
+    }
+    return __engram_node_full(content, node_type, label, salience, importance, confidence, tier, tags)
 }
 
 // --- Node retrieval ---

scripts/build-soul-darwin.sh

@@ -0,0 +1,21 @@
+#!/bin/sh
+# build-soul-darwin.sh — replicate `elb` on macOS/arm64 with clang.
+# Proven 2026-06-16: produces a Mach-O arm64 soul that boots and serves :7770.
+# The official builder `elb` ships Linux-only (CI); this lets us build + test the
+# darwin soul locally (e.g. to validate the atomic engram_save fix in isolation).
+#
+# Usage: scripts/build-soul-darwin.sh <path-to-neuron/dist> [output-binary]
+set -e
+DIST="${1:?usage: build-soul-darwin.sh <neuron/dist dir> [out]}"
+OUT="${2:-./neuron}"
+RT="$(cd "$(dirname "$0")/.." && pwd)/lang/el-compiler/runtime"
+B="$(mktemp -d)"
+# elc-generated dist modules use C89-style implicit cross-module declarations that
+# Apple clang rejects as errors by default; resolve at link, so downgrade them.
+CFLAGS="-Wno-implicit-function-declaration -Wno-implicit-int -Wno-int-conversion -I$B -I$DIST -I$RT"
+cp "$RT/el_runtime.h" "$B/"
+clang -c $CFLAGS "$RT/el_runtime.c" -o "$B/el_runtime.o"
+for c in "$DIST"/*.c; do clang -c $CFLAGS "$c" -o "$B/$(basename "$c" .c).o"; done
+# NOTE: link *.o once — do not also list el_runtime.o separately (duplicate symbols).
+clang "$B"/*.o -o "$OUT" -lcurl -lm
+echo "built $OUT"