ingest: name the inversion, and correct the worked example to decomposition

ingest.el's transduce() was renamed to transduce_manifold() earlier the same
day on the reasoning that it 'was never signal->geometry -- it chunks
already-extracted content and PACKS it into a node+edge manifold, one layer up,
and it had taken the name that belongs to the primitive underneath it.'

That reasoning was backwards. Producing a node+edge manifold is not a layer
above transduction, it IS transduction. Signal -> one vector is the operation
underneath, and its name is geometry. The layer doing it right was renamed out
of the way so the layer doing it wrong could have the name.

With the primitive corrected to return a Manifold, the two layers do the same
kind of thing and the inversion dissolves. What is left is a real distinction
about MODALITY, not layering: transduce() dispatches to a realizer that knows
its modality and can name its components; transduce_bytes() is the
opaque-bytes realizer, the decomposition available to a reader that knows
nothing about what it is reading. It still yields components and relations,
which is why it is transduction and not packing -- it just cuts on byte
boundaries, so its components are positional rather than meaningful. That is a
limitation of this realizer, not the definition of the operation.

Renamed by modality rather than demoted by layer. A distinct symbol is still
mechanically required: reusing transduce here is a conflicting-types error the
moment ingest.c links el_runtime.c.

lang/examples/transduce.el asserted #144's contract and would now fail, so it
is replaced by the decomposition worked example: transduce a chord, persist the
five components and six relations as real nodes and edges, read each part's
geometry back off its own node, and ground one part while its sibling is
demonstrably untouched.

engram/src/server.el

@@ -10,10 +10,60 @@
 //   cc -std=c11 -O2 -lcurl -lpthread -o engram server.c el_runtime.c
 //   ./engram
 //
-// Configuration via environment:
+// Configuration is DECLARED, not scattered. See the `program` block below:
-//   ENGRAM_BIND       — host:port (default :8742)
+// every knob's type and default lives there and nowhere else, is resolved from
-//   ENGRAM_API_KEY    — bearer auth (optional)
+// the environment (env wins, declaration is the fallback) and validated before
-//   ENGRAM_DATA_DIR   — snapshot location (default ~/.neuron/engram)
+// any statement of this file runs. Read one with config("NAME") -> String.
+//
+// The one deliberate exception is ENGRAM_DATA_DIR — see the note in the block.
+
+// ── Program declaration (cross-cutting concerns) ──────────────────────────────
+//
+// singleton: two engram processes against one data dir is data loss, not a
+// warning. The runtime takes an exclusive flock at startup and a second start
+// is refused loudly with the holder's pid.
+//
+// NOT declared here, on purpose: ENGRAM_DATA_DIR. Its resolution is owned by
+// engram_resolve_data_dir() (el_runtime.c), which defaults to $HOME/.neuron/engram
+// and fails LOUD rather than silently persisting to an ephemeral directory.
+// Declaring a default for it here as well would put the data dir's fallback in
+// two places — which is precisely the defect this migration removes (until
+// 2026-08-15 the reseed backup path carried its own "/tmp/engram" default that
+// disagreed with the resolver, so the pre-destructive safety copy landed in /tmp).
+// HOME is likewise not declared: it is a genuine environment read, not a knob.
+program "engram" {
+    singleton: "engram"
+
+    // ── Core server ──
+    env ENGRAM_BIND: String = ":8742"
+    // Default "" leaves auth DISABLED (check_auth_ok short-circuits to true on an
+    // empty key). That is the pre-existing behaviour and is deliberately preserved
+    // here; making this `required` is the obvious hardening follow-up, but it is a
+    // behaviour change and out of scope for this migration.
+    env ENGRAM_API_KEY: String = ""
+
+    // ── Feature flags (bool-ish Strings; the predicate fns below own truthiness) ──
+    env ENGRAM_STORE: String = "off"
+    env ENGRAM_WAL: String = "off"
+    env ENGRAM_AUTOCONNECT: String = "off"
+    env ENGRAM_ISE_OFFGRAPH: String = "off"
+
+    // ── ISE telemetry ──
+    env ENGRAM_ISE_RETENTION_MS: Int = "172800000"
+
+    // ── Guide (local Qwen3 via llama-server) ──
+    env GUIDE_ENABLE: String = "off"
+    env GUIDE_TIER_FORCE: String = ""
+    env GUIDE_CACHE_DIR: String = ""
+    env GUIDE_RAM_GB_4B: Int = "16"
+    env GUIDE_RAM_GB_1P7B: Int = "8"
+    env GUIDE_BACKEND: String = "llama-server"
+    env GUIDE_HOST: String = "127.0.0.1"
+    env GUIDE_PORT: Int = "8771"
+    env GUIDE_LLAMA_SERVER_BIN: String = "llama-server"
+    env GUIDE_NGL: Int = "99"
+    env GUIDE_CTX: Int = "4096"
+}
 
 // ── Helpers ───────────────────────────────────────────────────────────────────
 
@@ -133,7 +183,7 @@ fn route_text_health(method: String, path: String, body: String) -> String {
 // engram_store_enabled() in el_runtime.c EXACTLY (1 / on / true). Default off →
 // every persistence path below is byte-for-byte the historical snapshot behavior.
 fn store_on() -> Bool {
-    let v: String = env("ENGRAM_STORE")
+    let v: String = config("ENGRAM_STORE")
     if str_eq(v, "1") { return true }
     if str_eq(v, "on") { return true }
     if str_eq(v, "true") { return true }
@@ -162,7 +212,6 @@ fn persist_canonical() -> Int {
     if store_on() {
         return engram_store_checkpoint()
     }
-    let dir_raw: String = env("ENGRAM_DATA_DIR")
     let dir: String = engram_resolve_data_dir()
     // (2026-08-10 self-review) This returned a hardcoded 1, which made every
     // caller's `let saved: Int = persist_canonical()` a dead variable — six
@@ -176,7 +225,7 @@ fn persist_canonical() -> Int {
 // per-write full-snapshot behavior. When ON, structural mutations append O(1)
 // WAL records instead of rewriting the whole graph, with threshold compaction.
 fn wal_on() -> Bool {
-    str_eq(env("ENGRAM_WAL"), "on")
+    str_eq(config("ENGRAM_WAL"), "on")
 }
 
 // autoconnect_on — ENGRAM_AUTOCONNECT. Will's rule: "we shouldn't be inserting
@@ -184,7 +233,7 @@ fn wal_on() -> Bool {
 // edge (kNN over embeddings) so no content node enters the graph edgeless.
 // Default OFF -> byte-identical to prior behavior (node created, no auto edges).
 fn autoconnect_on() -> Bool {
-    let v: String = env("ENGRAM_AUTOCONNECT")
+    let v: String = config("ENGRAM_AUTOCONNECT")
     if str_eq(v, "1") { return true }
     if str_eq(v, "on") { return true }
     if str_eq(v, "true") { return true }
@@ -197,7 +246,7 @@ fn autoconnect_on() -> Bool {
 // separate state-event log tier instead of the node graph. Default OFF -> ISEs
 // remain graph nodes exactly as before (with 48h prune).
 fn ise_offgraph_on() -> Bool {
-    let v: String = env("ENGRAM_ISE_OFFGRAPH")
+    let v: String = config("ENGRAM_ISE_OFFGRAPH")
     if str_eq(v, "1") { return true }
     if str_eq(v, "on") { return true }
     if str_eq(v, "true") { return true }
@@ -247,6 +296,24 @@ fn persist_bulk() -> Int {
     return persist_canonical()
 }
 
+// COMPILER LANDMINE, measured 2026-08-16 — do not inline this back into the
+// caller. elc lowers `a == b` to numeric comparison only when both operand
+// NAMES are in the per-function int-name set, which `let x: Int` populates.
+// That registration does NOT propagate into a nested if-expression block: the
+// first cut of the geometry-ingest path wrote `let claimed: Int = ...` and
+// `let got: Int = ...` inside the else-arm and `claimed == got` came out of
+// codegen as `str_eq(claimed, got)` — strcmp on two integers reinterpreted as
+// pointers, i.e. a segfault on the first geometry-bearing request. Read back
+// out of the generated C, not guessed. Function PARAMETERS annotated `: Int`
+// do register reliably (verified: `if (claimed == actual)`), so the comparison
+// lives in a function of its own. Note also the explicit `return`s — a trailing
+// if-EXPRESSION at a function tail emits as a statement and the function
+// returns 0 regardless, which is the same probe's second finding.
+fn width_agrees(claimed: Int, actual: Int) -> Int {
+    if claimed == actual { return 1 }
+    return 0
+}
+
 // INCOMPLETE-ROUTE FIX (2026-07-24 self-review): this route silently dropped
 // label, importance, tier, and tags — engram_node() defaults label to content
 // and importance to 0.5, so every node created over HTTP lost its metadata.
@@ -288,26 +355,44 @@ fn route_create_node(method: String, path: String, body: String) -> String {
         salience, importance, confidence,
         tier, tags
     )
-    // GEOMETRY INGEST (2026-08-16 self-review): this route accepted an "emb"
+    // GEOMETRY INGEST — geometry-valued end to end (2026-08-16).
-    // field, returned 200 with a fresh id, and stored NOTHING — engram_node_full
-    // has no vector parameter, so the caller's geometry was silently discarded
-    // and the node came back emb_dim=None / embedded:false. Measured live while
-    // trying to admit a voice signal. The consequence was structural, not
-    // cosmetic: text was the only entry medium, so any non-text modality had to
-    // be DESCRIBED in prose and what we then reasoned over was the geometry of
-    // the description, not of the signal.
     //
-    // "emb" is little-endian float32 hex (dim*8 chars) — the encoding the
+    // The defect this route originally had: it accepted an "emb" field,
-    // perception vessel's /voice/embed already emits, so a realizer's output
+    // returned 200 with a fresh id, and stored NOTHING, because engram_node_full
-    // moves in with no float-array round trip. "dim" defaults to the vector's
+    // has no vector parameter. The consequence was structural, not cosmetic —
-    // implied width. Off-dimension vectors are stored but not inserted into the
+    // text was the only entry medium, so any non-text modality had to be
-    // resident index (its build loop filters on emb_dim), so a modality vector
+    // DESCRIBED in prose, and what we then reasoned over was the geometry of the
-    // is durable and addressable without perturbing the canonical index.
+    // description, not of the signal.
+    //
+    // #141 fixed the drop but marshalled the vector as a hex STRING through
+    // engram_node_set_emb, which put text back as the TRANSPORT medium one layer
+    // below the problem being fixed. This is that correction: hex is decoded
+    // exactly ONCE, here at the edge, into a first-class Geometry, and every
+    // step below this line moves geometry rather than text. An encoding at the
+    // boundary is what an encoding is for.
+    //
+    // The WIRE is deliberately unchanged — "emb" is still little-endian float32
+    // hex (8 chars per component), the encoding the perception vessel's
+    // /voice/embed already emits — because production clients speak it. What
+    // changed is underneath it.
+    //
+    // "dim" is now treated as an ASSERTION about the vector the caller sent, not
+    // as the source of its width: a Geometry carries its own width. A stated dim
+    // that disagrees is a REJECTED ingest, not a silent reinterpretation. Omitting
+    // "dim" is fine and means "trust the vector", which is the honest default.
+    //
+    // Off-dimension vectors remain stored but not inserted into the resident HNSW
+    // index (its build loop filters on emb_dim), so a 64-dim voice geometry is
+    // durable and addressable without perturbing the 768-dim canonical index.
     let emb_hex: String = json_get_string(body, "emb")
     let emb_set: Int = if str_eq(emb_hex, "") { 0 } else {
+        let g: Geometry = geometry_from_f32le_hex(emb_hex)
+        let got: Int = geometry_dim(g)
         let dim_raw: String = json_get_raw(body, "dim")
-        let dim: Int = if str_eq(dim_raw, "") { str_len(emb_hex) / 8 } else { json_get_int(body, "dim") }
+        let claimed: Int = if str_eq(dim_raw, "") { got } else { json_get_int(body, "dim") }
-        engram_node_set_emb(id, emb_hex, dim)
+        let landed: Int = if width_agrees(claimed, got) > 0 { node_attach_geometry(id, g) } else { 0 }
+        let freed: Int = geometry_free(g)
+        landed
     }
     let saved: Int = persist_node(id)
     // ORPHAN PREVENTION (ENGRAM_AUTOCONNECT): connect the fresh node to its
@@ -358,7 +443,6 @@ fn route_scan_nodes(method: String, path: String, body: String) -> String {
 // process ever booted with a partial/empty store, the first read request
 // clobbered the good snapshot. Read routes must never write the canonical path.)
 fn route_scan_edges(method: String, path: String, body: String) -> String {
-    let dir_raw: String = env("ENGRAM_DATA_DIR")
     let dir: String = engram_resolve_data_dir()
     let snap_path: String = dir + "/.scan-export.json"
     engram_save(snap_path)
@@ -519,7 +603,6 @@ fn route_forget(method: String, path: String, body: String) -> String {
 
 fn route_save(method: String, path: String, body: String) -> String {
     let p_raw: String = json_get_string(body, "path")
-    let dir_raw: String = env("ENGRAM_DATA_DIR")
     let dir: String = engram_resolve_data_dir()
     let p: String = if str_eq(p_raw, "") { dir + "/snapshot.json" } else { p_raw }
     // (2026-08-10 self-review) engram_save returns 0 on an empty path and the
@@ -603,7 +686,6 @@ fn route_drift(method: String, path: String, body: String) -> String {
 
 fn route_load(method: String, path: String, body: String) -> String {
     let p_raw: String = json_get_string(body, "path")
-    let dir_raw: String = env("ENGRAM_DATA_DIR")
     let dir: String = engram_resolve_data_dir()
     let p: String = if str_eq(p_raw, "") { dir + "/snapshot.json" } else { p_raw }
     // (2026-08-10 self-review) This was a stub response over the single most
@@ -674,7 +756,6 @@ fn route_embed_backfill(method: String, path: String, body: String) -> String {
 // (it skips nodes already present by ID). Auth-exempt: same-host internal call.
 // (2026-06-27 self-review: added this route to fix silent 10-min sync failures)
 fn route_sync(method: String, path: String, body: String) -> String {
-    let dir_raw: String = env("ENGRAM_DATA_DIR")
     let dir: String = engram_resolve_data_dir()
     // 2026-07-21 self-review: export to a scratch path, never the canonical
     // snapshot.json — read routes must not be able to clobber the good snapshot.
@@ -750,8 +831,12 @@ fn route_reseed_nodes(method: String, path: String, body: String) -> String {
     if str_eq(p, "") { return err_json("path is required") }
     if str_eq(fs_read(p), "") { return err_json("file missing or empty") }
 
-    let dir_raw: String = env("ENGRAM_DATA_DIR")
+    // (2026-08-15) This site carried its own "/tmp/engram" fallback, which
-    let dir: String = if str_eq(dir_raw, "") { "/tmp/engram" } else { dir_raw }
+    // DISAGREED with engram_resolve_data_dir() ($HOME/.neuron/engram, fail-loud).
+    // The consumer is the pre-destructive backup below, so with ENGRAM_DATA_DIR
+    // unset the safety copy taken before a reseed landed in an ephemeral /tmp
+    // while the store it was protecting lived elsewhere. One owner, one answer.
+    let dir: String = engram_resolve_data_dir()
     let backup: String = dir + "/.reseed-backup.json"
 
     let replace_raw: String = json_get_raw(body, "replace")
@@ -843,8 +928,7 @@ fn route_emit_ise(method: String, path: String, body: String) -> String {
         sal, imp, conf,
         "Episodic", "[\"internal-state\",\"InternalStateEvent\"]"
     )
-    let ret_raw: String = env("ENGRAM_ISE_RETENTION_MS")
+    let ret_ms: Int = str_to_int(config("ENGRAM_ISE_RETENTION_MS"))
-    let ret_ms: Int = if str_eq(ret_raw, "") { 172800000 } else { str_to_int(ret_raw) }
     let pruned: Int = engram_prune_telemetry(ret_ms)
     "{\"ok\":true,\"id\":\"" + id + "\",\"pruned\":" + int_to_str(pruned) + "}"
 }
@@ -1093,14 +1177,12 @@ fn route_correspondence_beat(method: String, path: String, body: String) -> Stri
 // turns native thinking ON: the response carries reasoning_content (the thinking)
 // alongside content (the answer).
 
-fn guide_env_or(key: String, dflt: String) -> String {
+// (2026-08-15) guide_env_or(key, dflt) lived here. Its whole job was supplying a
-    let v: String = env(key)
+// per-call-site default, which is now the program block's job — every GUIDE_* knob
-    if str_eq(v, "") { return dflt }
+// is declared once at the top of this file and read straight through config().
-    return v
-}
 
 fn guide_enabled() -> Bool {
-    let v: String = env("GUIDE_ENABLE")
+    let v: String = config("GUIDE_ENABLE")
     if str_eq(v, "1") { return true }
     if str_eq(v, "on") { return true }
     if str_eq(v, "true") { return true }
@@ -1145,15 +1227,15 @@ fn guide_probe_metal() -> Bool {
 
 // ── 2. Tier selection (config-driven thresholds, spec-autoselected) ────────────
 fn guide_threshold_4b() -> Int {
-    return str_to_int(guide_env_or("GUIDE_RAM_GB_4B", "16"))
+    return str_to_int(config("GUIDE_RAM_GB_4B"))
 }
 fn guide_threshold_1p7b() -> Int {
-    return str_to_int(guide_env_or("GUIDE_RAM_GB_1P7B", "8"))
+    return str_to_int(config("GUIDE_RAM_GB_1P7B"))
 }
 
 // GUIDE_TIER_FORCE overrides the spec autoselect (used to prove cheaply on 0.6b).
 fn guide_select_tier(ram_gb: Int) -> String {
-    let forced: String = env("GUIDE_TIER_FORCE")
+    let forced: String = config("GUIDE_TIER_FORCE")
     if !str_eq(forced, "") { return forced }
     if ram_gb >= guide_threshold_4b() { return "4b" }
     if ram_gb >= guide_threshold_1p7b() { return "1.7b" }
@@ -1173,8 +1255,10 @@ fn guide_file(tier: String) -> String {
 }
 
 fn guide_cache_dir() -> String {
-    let c: String = env("GUIDE_CACHE_DIR")
+    let c: String = config("GUIDE_CACHE_DIR")
     if !str_eq(c, "") { return c }
+    // HOME stays a raw env() read: it is the ambient environment, not a knob of
+    // this program, and it is deliberately absent from the program block.
     let home: String = env("HOME")
     if !str_eq(home, "") { return home + "/.neuron/guide/models" }
     return engram_resolve_data_dir() + "/guide-models"
@@ -1215,9 +1299,9 @@ fn guide_fetch(tier: String) -> Bool {
 }
 
 // ── 4/5. Backend abstraction + BIND as an engageable interlocutor ──────────────
-fn guide_backend() -> String { return guide_env_or("GUIDE_BACKEND", "llama-server") }
+fn guide_backend() -> String { return config("GUIDE_BACKEND") }
-fn guide_host() -> String    { return guide_env_or("GUIDE_HOST", "127.0.0.1") }
+fn guide_host() -> String    { return config("GUIDE_HOST") }
-fn guide_port() -> String    { return guide_env_or("GUIDE_PORT", "8771") }
+fn guide_port() -> String    { return config("GUIDE_PORT") }
 fn guide_base_url() -> String { return "http://" + guide_host() + ":" + guide_port() }
 
 // guide_healthy — is the guide present and answering? llama-server's /health
@@ -1235,9 +1319,9 @@ fn guide_healthy() -> Bool {
 fn guide_load(tier: String) -> Bool {
     if guide_healthy() { return true }
     let path: String = guide_model_path(tier)
-    let bin: String  = guide_env_or("GUIDE_LLAMA_SERVER_BIN", "llama-server")
+    let bin: String  = config("GUIDE_LLAMA_SERVER_BIN")
-    let ngl: String  = guide_env_or("GUIDE_NGL", "99")
+    let ngl: String  = config("GUIDE_NGL")
-    let ctx: String  = guide_env_or("GUIDE_CTX", "4096")
+    let ctx: String  = config("GUIDE_CTX")
     let logf: String = guide_cache_dir() + "/llama-server." + guide_port() + ".log"
     let cmd: String = bin + " -m '" + path + "' --host " + guide_host() + " --port " + guide_port() + " -c " + ctx + " -ngl " + ngl + " --jinja >> '" + logf + "' 2>&1"
     let pid: String = exec_bg(cmd)
@@ -1633,7 +1717,7 @@ fn route_supersede(method: String, path: String, body: String) -> String {
 // ── Auth ──────────────────────────────────────────────────────────────────────
 
 fn check_auth_ok(method: String, body: String) -> Bool {
-    let key: String = env("ENGRAM_API_KEY")
+    let key: String = config("ENGRAM_API_KEY")
     if str_eq(key, "") { return true }
     // Read-only methods don't require auth. Until http_serve surfaces
     // request headers we can't accept a Bearer token cleanly; mutating
@@ -1896,8 +1980,7 @@ fn handle_request(method: String, path: String, body: String) -> String {
 
 // ── Entry ─────────────────────────────────────────────────────────────────────
 
-let bind_raw: String = env("ENGRAM_BIND")
+let bind_str: String = config("ENGRAM_BIND")
-let bind_str: String = if str_eq(bind_raw, "") { ":8742" } else { bind_raw }
 let port: Int = parse_port(bind_str)
 
 // On startup, try to load any existing snapshot (best effort).

engram/test/run_vindex_concurrency_tests.sh

@@ -0,0 +1,107 @@
+#!/usr/bin/env bash
+# run_vindex_concurrency_tests.sh — regression harness for the 2026-08-16 soul crash.
+#
+# Four halves. The SET is the point: it separates two hazards the original two-half
+# version conflated, and which have fixes in different files.
+#
+#   1. single          ASan+UBSan, one thread. MUST be clean. Hard failure.
+#
+#   2. readers         TSan, N readers, NO writer. Hazard (a): the visited set used
+#                      to live on the index, so two pure READS stamped each other's
+#                      epoch. Fixed in engram_vindex.c (frame-owned VVisit +
+#                      `const VIndex*` search). MUST be clean. Hard failure.
+#
+#   3. unsynchronized  TSan, writer + reader on a BARE index. Hazard (b): in-place
+#                      HNSW insert rewires existing elements' neighbour lists and
+#                      reallocs elems[]. EXPECTED TO RACE, PERMANENTLY. This is not
+#                      a bug to fix inside engram_vindex.c — it is the executable
+#                      proof that a publication boundary must exist above it.
+#                      Not a failure. If it ever goes CLEAN, the test stopped
+#                      interleaving and half 4 is no longer meaningful either.
+#
+#   4. published       TSan, owner + N readers through a publication boundary
+#                      (rwlock: readers shared, owner exclusive) mirroring
+#                      eg_vindex_view / eg_vindex_maintain in lang/runtime/el_runtime.c.
+#                      MUST be clean, and all inserts must land. Hard failure.
+#
+# See test_vindex_concurrency.c for the full story (SIGSEGV at ASCII address
+# "gramNode", heap corruption in xzm_realloc, etc).
+#
+# usage: run_vindex_concurrency_tests.sh
+set -uo pipefail
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+RUNTIME="$(cd "$HERE/../../lang/runtime" && pwd)"
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+
+SRC="$HERE/test_vindex_concurrency.c"
+VINDEX="$RUNTIME/engram_vindex.c"
+
+fail=0
+
+echo "== [1/4] single-threaded control under AddressSanitizer =="
+cc -std=c11 -g -O1 -fsanitize=address,undefined -fno-omit-frame-pointer \
+   -I"$RUNTIME" -o "$WORK/single" "$SRC" "$VINDEX" -lm || { echo "BUILD FAILED"; exit 2; }
+if ASAN_OPTIONS=detect_leaks=0 "$WORK/single" single; then
+  echo "   -> OK"
+else
+  echo "   -> FAIL: the single-threaded control must always be clean."
+  echo "      If this fails the bug is NOT (only) concurrency — look for a real"
+  echo "      out-of-bounds or lifetime error in engram_vindex.c."
+  fail=1
+fi
+
+cc -std=c11 -g -O1 -fsanitize=thread -fno-omit-frame-pointer \
+   -I"$RUNTIME" -o "$WORK/conc" "$SRC" "$VINDEX" -lm || { echo "BUILD FAILED"; exit 2; }
+
+# run_tsan <mode> <logfile>; echoes nothing, sets $tsan_raced
+run_tsan() {
+  TSAN_OPTIONS="halt_on_error=0" "$WORK/conc" "$1" >"$2" 2>&1
+  tsan_rc=$?
+  if grep -q "ThreadSanitizer: data race" "$2"; then tsan_raced=1; else tsan_raced=0; fi
+}
+
+echo
+echo "== [2/4] concurrent READERS, no writer (visited-set gate) =="
+run_tsan readers "$WORK/readers.log"
+if [ "$tsan_raced" = "1" ]; then
+  echo "   -> REGRESSION: two concurrent reads still race."
+  grep -m1 -A6 "ThreadSanitizer: data race" "$WORK/readers.log" | sed 's/^/      /'
+  echo "      The visited set was supposed to be owned by the call frame."
+  fail=1
+else
+  echo "   -> clean (concurrent reads are safe)"
+fi
+
+echo
+echo "== [3/4] writer+reader on a BARE index (expected-race probe) =="
+run_tsan unsynchronized "$WORK/unsync.log"
+if [ "$tsan_raced" = "1" ]; then
+  echo "   -> RACE DETECTED, as expected:"
+  grep -m1 -A4 "ThreadSanitizer: data race" "$WORK/unsync.log" | sed 's/^/      /'
+  echo "      In-place HNSW insert mutates existing elements. Not fixable inside"
+  echo "      engram_vindex.c — this is why the publication boundary exists."
+else
+  echo "   -> NOTE: no race reported. The probe did not interleave; half 4's"
+  echo "      clean result proves less than it should. Investigate."
+fi
+
+echo
+echo "== [4/4] owner+readers through the publication boundary (boundary gate) =="
+run_tsan published "$WORK/pub.log"
+if [ "$tsan_raced" = "1" ]; then
+  echo "   -> REGRESSION: the publication boundary did not serialize the owner."
+  grep -m1 -A6 "ThreadSanitizer: data race" "$WORK/pub.log" | sed 's/^/      /'
+  fail=1
+elif [ "$tsan_rc" != "0" ]; then
+  echo "   -> FAIL: boundary clean under TSan but the run failed:"
+  tail -3 "$WORK/pub.log" | sed 's/^/      /'
+  fail=1
+else
+  echo "   -> clean (readers project concurrently; the owner's inserts all landed)"
+fi
+
+echo
+[ "$fail" -eq 0 ] && echo "RESULT: PASS" || echo "RESULT: FAIL"
+exit "$fail"

engram/test/test_vindex_concurrency.c

@@ -0,0 +1,251 @@
+/* test_vindex_concurrency.c — regression test for the 2026-08-16 soul crash.
+ *
+ * WHAT BROKE: the soul daemon crash-looped (5 crashes in ~100s) with SIGSEGV in
+ * search_layer <- vindex_insert <- eg_vindex_sync, a SIGABRT, and a fault inside
+ * xzm_realloc's own freelist — i.e. heap corruption. The SIGSEGV address
+ * 0x65646f4e6d617267 is little-endian ASCII "gramNode": string bytes being
+ * dereferenced as an Elem vector pointer.
+ *
+ * ROOT CAUSE: VIndex owns its traversal scratch (visited[] + visit_epoch), and
+ * search_layer mutates it via visited_reset(). So the index is unsafe for ANY
+ * concurrent use — including two concurrent READS. soul.el starts http_serve_async
+ * (a thread per connection) and then runs awareness_run() on the main thread, which
+ * reaches the same global index through engram_activate; nothing serialized them.
+ *
+ * Neither hnswlib nor FAISS puts the visited set on the index: hnswlib checks one
+ * out of a VisitedListPool per query, FAISS uses a thread_local VisitedTable.
+ *
+ * THE ORIGINAL `concurrent` HALF CONFLATED TWO DISTINCT HAZARDS (2026-08-16). It ran
+ * a writer against a reader on one bare index, so it could not tell apart:
+ *
+ *   (a) READ/READ corruption — two searches stamping each other's visited epoch.
+ *       A defect INSIDE engram_vindex.c, fixable there, and now fixed: the visited
+ *       set moved to the call frame and vindex_search takes a `const VIndex*`.
+ *
+ *   (b) WRITE/READ corruption — vindex_insert rewires the neighbour lists of
+ *       EXISTING elements and reallocs elems[], so an insert is a mutation of the
+ *       whole structure. This is NOT fixable inside engram_vindex.c at any price:
+ *       it is inherent to in-place HNSW. It requires a publication boundary ABOVE
+ *       the data structure (el_runtime.c: eg_vindex_view / eg_vindex_maintain).
+ *
+ * Conflating them made the suite unfailable-then-unpassable: fixing (a) left (b)
+ * still racing, which reads as "the fix did not work" when in fact a different,
+ * correctly-located fix is what (b) needs. So the halves are now separate:
+ *
+ *   single          N clustered vectors, ONE thread, ASan. The CONTROL. Must always
+ *                   be clean. When this passes and a concurrent half fails, the defect
+ *                   is concurrency, not an out-of-bounds/logic error in the graph code.
+ *                   (On 2026-08-16 this control cleared all 13,820 real dim-768 store
+ *                   vectors under ASan, which DISPROVED an inspection-derived hypothesis
+ *                   about an out-of-bounds reverse-link write at engram_vindex.c:340.)
+ *
+ *   readers         N reader threads, NO writer, one shared index, TSan. This is
+ *                   hazard (a) in isolation. It RACED before the visited set moved off
+ *                   the index struct and must be CLEAN now. Hard gate.
+ *
+ *   unsynchronized  writer + reader on a bare index, TSan. Hazard (b) in isolation.
+ *                   EXPECTED TO RACE, permanently — it is the executable proof that
+ *                   the index cannot be made safe from the inside, and therefore that
+ *                   the publication boundary in el_runtime.c has to exist. If this
+ *                   ever goes clean, the test stopped interleaving; do not celebrate.
+ *
+ *   published       writer + readers through a publication boundary that mirrors
+ *                   eg_vindex_view / eg_vindex_maintain (rwlock: readers shared,
+ *                   the single owner exclusive), TSan. Must be CLEAN. Hard gate.
+ *                   This is what proves the shape of the runtime fix, in the same
+ *                   process, rather than asserting it.
+ *
+ * Absence of a crash does NOT mean absence of a race — always read the sanitizer
+ * verdict, never just the exit code.
+ *
+ * Build/run: engram/test/run_vindex_concurrency_tests.sh
+ */
+#include "engram_vindex.h"
+
+#include <pthread.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdint.h>
+
+#define DIM   128
+#define NVEC  3000
+#define SEED_N 50
+
+static VIndex* g_ix;
+static float*  g_vecs;
+
+/* Deterministic filler. Real embeddings are strongly correlated, not uniform noise;
+ * clustering keeps many candidates near-equidistant, which exercises the diversity
+ * heuristic and the visited set far harder than random vectors do. */
+static void fill_vectors(void) {
+    g_vecs = (float*)malloc((size_t)NVEC * DIM * sizeof(float));
+    if (!g_vecs) { fprintf(stderr, "OOM\n"); exit(1); }
+    for (int i = 0; i < NVEC; i++) {
+        int cluster = i % 8;
+        for (int d = 0; d < DIM; d++)
+            g_vecs[(size_t)i * DIM + d] =
+                (float)(((d + cluster * 7) % 13) / 13.0) +
+                (float)(((i * 2654435761u + (unsigned)d) % 97) / 9700.0);
+    }
+}
+
+static void* writer_fn(void* arg) {
+    (void)arg;
+    for (int i = SEED_N; i < NVEC; i++)
+        (void)vindex_insert(g_ix, (uint64_t)i, g_vecs + (size_t)i * DIM);
+    return NULL;
+}
+
+static void* reader_fn(void* arg) {
+    (void)arg;
+    uint64_t ids[8]; float ds[8];
+    for (int i = 0; i < 20000; i++)
+        (void)vindex_search(g_ix, g_vecs + (size_t)(i % NVEC) * DIM, 8, 0, ids, ds);
+    return NULL;
+}
+
+static int run_single(void) {
+    printf("[single] inserting %d vectors on one thread (ASan control)\n", NVEC);
+    g_ix = vindex_create(DIM, 0, 0);
+    if (!g_ix) { fprintf(stderr, "[single] vindex_create failed\n"); return 1; }
+    for (int i = 0; i < NVEC; i++) {
+        if (vindex_insert(g_ix, (uint64_t)i, g_vecs + (size_t)i * DIM) != 0) {
+            fprintf(stderr, "[single] insert %d failed\n", i); return 1;
+        }
+    }
+    if (vindex_size(g_ix) != (size_t)NVEC) {
+        fprintf(stderr, "[single] size %zu != %d\n", vindex_size(g_ix), NVEC); return 1;
+    }
+    uint64_t ids[16]; float ds[16];
+    for (int q = 0; q < 200; q++) {
+        int k = vindex_search(g_ix, g_vecs + (size_t)((q * 7) % NVEC) * DIM, 16, 0, ids, ds);
+        if (k < 0) { fprintf(stderr, "[single] search failed at q=%d\n", q); return 1; }
+    }
+    vindex_free(g_ix); g_ix = NULL;
+    printf("[single] PASS — no memory error (this must ALWAYS pass)\n");
+    return 0;
+}
+
+/* Hazard (b) in isolation: writer + reader on a BARE index, no boundary. */
+static int run_unsynchronized(void) {
+    printf("[unsynchronized] 1 writer + 1 reader on a BARE index (TSan probe)\n");
+    printf("[unsynchronized] a race here is EXPECTED and PERMANENT — in-place HNSW\n");
+    printf("[unsynchronized] insert rewires existing elements. This is the proof that\n");
+    printf("[unsynchronized] the publication boundary must live ABOVE engram_vindex.c.\n");
+    g_ix = vindex_create(DIM, 0, 0);
+    if (!g_ix) { fprintf(stderr, "[unsynchronized] vindex_create failed\n"); return 1; }
+    for (int i = 0; i < SEED_N; i++)
+        (void)vindex_insert(g_ix, (uint64_t)i, g_vecs + (size_t)i * DIM);
+
+    pthread_t w, r;
+    if (pthread_create(&w, NULL, writer_fn, NULL) ||
+        pthread_create(&r, NULL, reader_fn, NULL)) {
+        fprintf(stderr, "[unsynchronized] pthread_create failed\n"); return 1;
+    }
+    pthread_join(w, NULL);
+    pthread_join(r, NULL);
+    vindex_free(g_ix); g_ix = NULL;
+    printf("[unsynchronized] completed — CHECK THE SANITIZER VERDICT, not this line.\n");
+    return 0;
+}
+
+/* ── hazard (a) in isolation: concurrent READS only ───────────────────────────
+ * This is what the frame-owned visited set fixes. Before that change, two
+ * vindex_search calls on one index wrote each other's epoch stamp; TSan reported
+ * the race at visited_reset and the traversal then walked bogus element indices. */
+#define NREADERS 4
+
+static int run_readers(void) {
+    printf("[readers] %d concurrent readers, NO writer, one shared index (TSan)\n", NREADERS);
+    printf("[readers] this is the visited-set regression gate — must be CLEAN.\n");
+    g_ix = vindex_create(DIM, 0, 0);
+    if (!g_ix) { fprintf(stderr, "[readers] vindex_create failed\n"); return 1; }
+    for (int i = 0; i < NVEC; i++)
+        (void)vindex_insert(g_ix, (uint64_t)i, g_vecs + (size_t)i * DIM);
+
+    pthread_t t[NREADERS];
+    for (int i = 0; i < NREADERS; i++)
+        if (pthread_create(&t[i], NULL, reader_fn, NULL)) {
+            fprintf(stderr, "[readers] pthread_create failed\n"); return 1;
+        }
+    for (int i = 0; i < NREADERS; i++) pthread_join(t[i], NULL);
+    vindex_free(g_ix); g_ix = NULL;
+    printf("[readers] completed — CHECK THE SANITIZER VERDICT, not this line.\n");
+    return 0;
+}
+
+/* ── the publication boundary, mirroring el_runtime.c ─────────────────────────
+ * Readers take the boundary SHARED and hold it across the whole search; the one
+ * owner takes it EXCLUSIVE to extend. Same shape as eg_vindex_view /
+ * eg_vindex_maintain. Note the reader's index pointer is `const VIndex*` — the
+ * compiler, not this comment, is what stops a reader inserting. */
+static pthread_rwlock_t g_pub = PTHREAD_RWLOCK_INITIALIZER;
+
+static void* pub_writer_fn(void* arg) {
+    (void)arg;
+    for (int i = SEED_N; i < NVEC; i++) {
+        pthread_rwlock_wrlock(&g_pub);
+        (void)vindex_insert(g_ix, (uint64_t)i, g_vecs + (size_t)i * DIM);
+        pthread_rwlock_unlock(&g_pub);
+    }
+    return NULL;
+}
+
+static void* pub_reader_fn(void* arg) {
+    (void)arg;
+    uint64_t ids[8]; float ds[8];
+    for (int i = 0; i < 5000; i++) {
+        pthread_rwlock_rdlock(&g_pub);
+        const VIndex* view = g_ix;                 /* immutable view */
+        (void)vindex_search(view, g_vecs + (size_t)(i % NVEC) * DIM, 8, 0, ids, ds);
+        pthread_rwlock_unlock(&g_pub);
+    }
+    return NULL;
+}
+
+static int run_published(void) {
+    printf("[published] 1 owner + %d readers through a publication boundary (TSan)\n", NREADERS);
+    printf("[published] this is the eg_vindex_view/eg_vindex_maintain gate — must be CLEAN.\n");
+    g_ix = vindex_create(DIM, 0, 0);
+    if (!g_ix) { fprintf(stderr, "[published] vindex_create failed\n"); return 1; }
+    for (int i = 0; i < SEED_N; i++)
+        (void)vindex_insert(g_ix, (uint64_t)i, g_vecs + (size_t)i * DIM);
+
+    pthread_t w, r[NREADERS];
+    if (pthread_create(&w, NULL, pub_writer_fn, NULL)) {
+        fprintf(stderr, "[published] pthread_create failed\n"); return 1;
+    }
+    for (int i = 0; i < NREADERS; i++)
+        if (pthread_create(&r[i], NULL, pub_reader_fn, NULL)) {
+            fprintf(stderr, "[published] pthread_create failed\n"); return 1;
+        }
+    pthread_join(w, NULL);
+    for (int i = 0; i < NREADERS; i++) pthread_join(r[i], NULL);
+    if (vindex_size(g_ix) != (size_t)NVEC) {
+        fprintf(stderr, "[published] size %zu != %d — the owner lost inserts\n",
+                vindex_size(g_ix), NVEC);
+        vindex_free(g_ix); g_ix = NULL; return 1;
+    }
+    vindex_free(g_ix); g_ix = NULL;
+    printf("[published] all %d inserts landed; CHECK THE SANITIZER VERDICT too.\n", NVEC);
+    return 0;
+}
+
+int main(int argc, char** argv) {
+    const char* mode = (argc > 1) ? argv[1] : "single";
+    fill_vectors();
+    int rc;
+    if      (!strcmp(mode, "single"))         rc = run_single();
+    else if (!strcmp(mode, "readers"))        rc = run_readers();
+    else if (!strcmp(mode, "unsynchronized")) rc = run_unsynchronized();
+    else if (!strcmp(mode, "published"))      rc = run_published();
+    /* back-compat: the pre-split name meant the bare writer+reader probe. */
+    else if (!strcmp(mode, "concurrent"))     rc = run_unsynchronized();
+    else {
+        fprintf(stderr, "usage: %s [single|readers|unsynchronized|published]\n", argv[0]);
+        rc = 2;
+    }
+    free(g_vecs);
+    return rc;
+}

ingest/src/ingest.el

@@ -13,7 +13,7 @@
 // relations add edges. Every node enters with PROVENANCE + grounding-level
 // + stewardship class from the moment of entry.
 //
-// transduce() is THE single mechanism — one function, polymorphic, with no
+// transduce_bytes() is THE single mechanism — one function, polymorphic, with no
 // content-type branch inside it. It does not ask whether a payload is
 // prose, structured data, or raw/opaque bytes (audio, or anything else);
 // it runs one boundary-scan-with-fixed-window-fallback chunking algorithm
@@ -401,10 +401,54 @@ fn head80(s: String) -> String {
 // truncates at the first embedded NUL, which is routine in real binary
 // bytes) is a MECHANICAL fidelity concern that belongs to whatever produced
 // `source` (see ingest_file's file_source_string below) — not a
-// content-type judgment made in here. transduce() never learns whether a
+// content-type judgment made in here. transduce_bytes() never learns whether a
 // chunk is plain text or a base64-encoded raw-byte window; every chunk is
 // handled identically either way.
-fn transduce(nodes: [String], edges: [String], source: String,
+// NAMING, CORRECTED 2026-08-16 (second pass). This function was renamed
+// `transduce` -> `transduce_bytes` earlier the same day, on the reasoning
+// that it "was never signal->geometry — it chunks already-extracted content
+// and PACKS it into a node+edge manifold, one layer up, and it had taken the
+// name that belongs to the primitive underneath it."
+//
+// THAT REASONING WAS BACKWARDS, and it is worth recording why rather than
+// quietly re-renaming. Producing a node+edge manifold is not a layer above
+// transduction — it IS transduction. Transduction is not conversion. When you
+// take in music you do not store the song as one discrete geometry; you break
+// it into its component parts and store the geometry of each along with the
+// relations between them. The song is the structure of those relations.
+// Signal -> one vector is the operation UNDERNEATH transduction, and its name
+// is encoding, or geometry. So the layer that was doing it right got renamed
+// out of the way so the layer doing it wrong could have the name.
+//
+// The primitive has since been corrected: `transduce(signal, modality)` now
+// returns a Manifold — components plus relations — not a Geometry
+// (el_runtime.c, "Manifold"). The two layers are therefore doing the SAME KIND
+// of thing, and the inversion dissolves rather than needing to be re-argued.
+//
+// What is left is a real distinction, and it is about MODALITY, not layering:
+//
+//   * `transduce(signal, modality)` dispatches to a realizer that KNOWS the
+//     modality and can name its components — for audio: pitch, interval,
+//     rhythm, harmonic function.
+//   * `transduce_bytes` below is the OPAQUE-BYTES realizer: the decomposition
+//     available to a reader that knows nothing about what it is reading. It
+//     still yields components and relations (chunk nodes; contains / precedes
+//     / section_of edges), which is why it is transduction and not packing. It
+//     just cuts on the only structure visible without understanding — byte
+//     boundaries — so its components are positional rather than meaningful.
+//     That is a LIMITATION of this realizer, not the definition of the
+//     operation.
+//
+// The name is suffixed by its modality, not demoted to a lesser layer. Keeping
+// a distinct symbol is also still mechanically required: every El `fn name`
+// compiles to a global C symbol, so reusing `transduce` here is a hard
+// `conflicting types` error the moment ingest.c links el_runtime.c.
+//
+// WHERE THIS SHOULD GO: this function should become a registered realizer
+// returning a real Manifold, so ingest rides the same primitive as every other
+// modality instead of carrying a parallel implementation. Not done here.
+// Nothing about this function's behaviour changed in this pass.
+fn transduce_bytes(nodes: [String], edges: [String], source: String,
              prov: String, ground: String, steward: String,
              root_lid: String, root_title: String) -> [String] {
     let tagbase: String = "prov:" + prov + " ground:" + ground + " steward:" + steward
@@ -531,8 +575,8 @@ fn default_steward() -> String {
 // trustworthy verbatim. When they don't (silent truncation happened),
 // rebuild the payload as base64-encoded fixed-size windows read directly
 // off disk (fs_read_b64_chunk — binary-safe in C), joined with the same
-// "\n\n" boundary marker transduce()'s generic scan already looks for, so
+// "\n\n" boundary marker transduce_bytes()'s generic scan already looks for, so
-// transduce() sees one ordinary boundary-delimited payload and runs its one
+// transduce_bytes() sees one ordinary boundary-delimited payload and runs its one
 // algorithm on it exactly as it would on prose — it never learns that a
 // fidelity problem occurred upstream, let alone why.
 fn file_source_string(path: String, text: String, real_size: Int) -> String {
@@ -541,7 +585,7 @@ fn file_source_string(path: String, text: String, real_size: Int) -> String {
     // 3072 raw bytes -> 4096 base64 chars (3 divides evenly into base64's
     // 3-byte/4-char ratio); keeps each resulting node's content a clean,
     // bounded, low-kilobytes unit, same order of magnitude as the fixed
-    // fallback window in transduce() itself.
+    // fallback window in transduce_bytes() itself.
     let win: Int = 3072
     let out: String = ""
     let off: Int = 0
@@ -561,7 +605,7 @@ fn file_source_string(path: String, text: String, real_size: Int) -> String {
 }
 
 // ingest one file -> report JSON. Uniform for every file regardless of
-// extension or content — transduce() decides nothing about content-type, so
+// extension or content — transduce_bytes() decides nothing about content-type, so
 // neither does this function; it only decides whether the raw bytes made it
 // through the read intact (file_source_string), which is a fidelity
 // question, not a format one.
@@ -573,14 +617,14 @@ fn ingest_file(path: String) -> String {
         return "{\"error\":\"empty or unreadable\",\"path\":" + j_q(path) + "}"
     }
     let prov: String = "file:" + path
-    let packed: [String] = transduce(el_list_empty(), el_list_empty(),
+    let packed: [String] = transduce_bytes(el_list_empty(), el_list_empty(),
         source, prov, default_ground(), default_steward(),
         "doc:" + basename(path), basename(path))
     return merge_packed(packed)
 }
 
 // ingest a directory: walk one level, ingest every file found, aggregate.
-// No extension filter — transduce() handles any payload uniformly now, so
+// No extension filter — transduce_bytes() handles any payload uniformly now, so
 // there is no content-type gate at the directory boundary either.
 fn ingest_dir(path: String) -> String {
     let entries: [String] = fs_list(path)
@@ -615,7 +659,7 @@ fn ingest_dir(path: String) -> String {
 fn ingest_url(url: String) -> String {
     let body: String = http_get(url)
     if str_eq(body, "") { return "{\"error\":\"empty fetch\",\"url\":" + j_q(url) + "}" }
-    let packed: [String] = transduce(el_list_empty(), el_list_empty(),
+    let packed: [String] = transduce_bytes(el_list_empty(), el_list_empty(),
         body, "url:" + url, "extracted", "public-web",
         "url:" + url, url)
     return merge_packed(packed)
@@ -630,7 +674,7 @@ fn ingest_llm(query: String) -> String {
     let resp: String = http_post_json("http://127.0.0.1:11434/api/generate", body)
     let answer: String = json_get_string(resp, "response")
     if str_eq(answer, "") { return "{\"error\":\"no model response\"}" }
-    let packed: [String] = transduce(el_list_empty(), el_list_empty(),
+    let packed: [String] = transduce_bytes(el_list_empty(), el_list_empty(),
         answer, "llm:" + model + ":" + query, "candidate-provisional", "guide-provisional",
         "llm:" + query, "guide answer: " + query)
     return merge_packed(packed)
@@ -682,7 +726,7 @@ fn ingest_stream(path: String) -> String {
 // It is NOT a content-type flag: it says nothing about what's inside the
 // bytes once fetched, and none of the five ingest_* functions it selects
 // among interpret their payload differently by content shape anymore —
-// they all hand off to the single, format-agnostic transduce(). The old
+// they all hand off to the single, format-agnostic transduce_bytes(). The old
 // "structured" value (a caller-declared alias for "file", used only to hint
 // the now-removed JSON-vs-prose branch) is gone along with that branch.
 let kind: String = env("INGEST_KIND")

lang/el-compiler/src/codegen.el

@@ -3265,6 +3265,7 @@ fn is_top_level_decl(stmt: Map<String, Any>) -> Bool {
     if kind == "EnumDef" { return true }
     if kind == "Import"  { return true }
     if kind == "CgiBlock" { return true }
+    if kind == "ProgramBlock" { return true }
     if kind == "ExternFn" { return true }
     false
 }
@@ -3277,6 +3278,55 @@ fn cgi_arg(value: String, has_value: Bool) -> String {
     return "EL_NULL"
 }
 
+// -- Program block: cross-cutting concerns injected at the process boundary ----
+//
+// emit_program_init — emit the `static void __el_program_init(void)` that
+// carries a program's declared cross-cutting concerns. Called from main()
+// BEFORE any user statement runs, so the guarantees hold for the whole process
+// rather than depending on each call site remembering to ask for them.
+//
+// This is emitted at the point the `program` block is encountered, not buffered
+// until main(). The streaming backend emits in source order and cannot hold a
+// declaration's entry list alive until main(); emitting a named function here
+// and calling it from main() means only a single bool has to survive.
+//
+// Order matters and is deliberate:
+//   1. singleton FIRST — if another instance already holds the lock, refuse and
+//      exit before touching configuration, ports, or any data directory.
+//   2. config declarations — resolve env-or-default, one declaration per entry.
+//   3. validate LAST — report EVERY missing/ill-typed entry at once, then exit.
+fn el_bool_arg(b: Bool) -> String {
+    if b { return "EL_INT(1)" }
+    return "EL_INT(0)"
+}
+
+fn emit_program_init(stmt: Map<String, Any>) -> Void {
+    let pname: String = stmt["name"]
+    emit_line("static void __el_program_init(void) {")
+    let has_singleton: Bool = stmt["has_singleton"]
+    if has_singleton {
+        let sid: String = stmt["singleton"]
+        emit_line("  el_singleton_acquire(EL_STR(" + c_str_lit(sid) + "));")
+    }
+    let entries = stmt["entries"]
+    let n: Int = native_list_len(entries)
+    let i = 0
+    while i < n {
+        let e = native_list_get(entries, i)
+        let ename: String = e["name"]
+        let etype: String = e["etype"]
+        let edefault: String = e["default"]
+        let has_default: Bool = e["has_default"]
+        let erequired: Bool = e["required"]
+        let arg_def: String = cgi_arg(edefault, has_default)
+        emit_line("  el_config_declare(EL_STR(" + c_str_lit(ename) + "), EL_STR(" + c_str_lit(etype) + "), " + arg_def + ", " + el_bool_arg(has_default) + ", " + el_bool_arg(erequired) + ");")
+        let i = i + 1
+    }
+    emit_line("  el_config_validate(EL_STR(" + c_str_lit(pname) + "));")
+    emit_line("}")
+    emit_blank()
+}
+
 // -- VBD role enforcement ------------------------------------------------------
 //
 // Scan a function body for direct calls to DHARMA-restricted builtins
@@ -3599,6 +3649,20 @@ fn codegen(stmts: [Map<String, Any>], source: String) -> String {
         }
     }
 
+    // Program block: emit the cross-cutting init function before the user's
+    // functions so main() can call it (see emit_program_init).
+    let prog_have: Bool = false
+    let i = 0
+    while i < n {
+        let stmt = native_list_get(stmts, i)
+        let sk4: String = stmt["stmt"]
+        if str_eq(sk4, "ProgramBlock") {
+            emit_program_init(stmt)
+            let prog_have = true
+        }
+        let i = i + 1
+    }
+
     // Function definitions
     let i = 0
     while i < n {
@@ -3617,6 +3681,9 @@ fn codegen(stmts: [Map<String, Any>], source: String) -> String {
     // with the C-side parameters when fn main()'s body is folded in below.
     emit_line("int main(int _argc, char** _argv) {")
     emit_line("  el_runtime_init_args(_argc, _argv);")
+    if prog_have {
+        emit_line("  __el_program_init();")
+    }
     if cgi_count >= 1 {
         let cname: String = cgi_block["name"]
         let cdid: String = cgi_block["dharma_id"]
@@ -4210,6 +4277,7 @@ fn codegen_streaming(tokens: [Any], sigs: [Map<String, Any>], source: String) ->
     // Fix: copy the values out BEFORE the release (strings, so no dangling reference)
     // and emit from these. No search, so the failure mode is removed rather than moved.
     let cgi_have: Bool = false
+    let prog_have: Bool = false
     let cgi_name_v: String = ""
     let cgi_did_v: String = ""
     let cgi_prin_v: String = ""
@@ -4331,6 +4399,14 @@ fn codegen_streaming(tokens: [Any], sigs: [Map<String, Any>], source: String) ->
                             // These are no-ops in codegen (forward decls already emitted)
                             // — except a CgiBlock, whose declared identity must survive
                             // this release to be emitted as a compiled constant.
+                            // A ProgramBlock's cross-cutting declarations are
+                            // emitted HERE, as a named init function, because the
+                            // streaming backend cannot hold the entry list alive
+                            // until main(). Only the bool survives.
+                            if str_eq(sk, "ProgramBlock") {
+                                emit_program_init(stmt)
+                                let prog_have = true
+                            }
                             if str_eq(sk, "CgiBlock") {
                                 let cgi_have = true
                                 let cgi_name_v = stmt["name"]
@@ -4477,6 +4553,13 @@ fn codegen_streaming(tokens: [Any], sigs: [Map<String, Any>], source: String) ->
     let kind2: String = state_get("__program_kind")
     emit_line("int main(int _argc, char** _argv) {")
     emit_line("  el_runtime_init_args(_argc, _argv);")
+    // Cross-cutting concerns declared by a `program` block run BEFORE anything
+    // else — a singleton violation must refuse the start before this process
+    // touches a port or a data directory, and configuration must be validated
+    // before the first read of it rather than at each read site.
+    if prog_have {
+        emit_line("  __el_program_init();")
+    }
 
     // cgi init if needed
     let ns2: Int = native_list_len(sigs)

lang/el-compiler/src/lexer.el

@@ -184,6 +184,7 @@ fn keyword_kind(word: String) -> String {
     if word == "false" { return "Bool" }
     if word == "cgi" { return "Cgi" }
     if word == "service" { return "Service" }
+    if word == "program" { return "Program" }
     if word == "manager" { return "Manager" }
     if word == "engine" { return "Engine" }
     if word == "accessor" { return "Accessor" }

lang/el-compiler/src/parser.el

@@ -1967,6 +1967,113 @@ fn parse_stmt(tokens: [Any], pos: Int) -> Map<String, Any> {
         }, p)
     }
 
+    // program block: program "name" { singleton: "id", env NAME: Type = "default", ... }
+    //
+    // The program block is El's declaration surface for CROSS-CUTTING CONCERNS —
+    // properties of the whole process rather than of any one function, which
+    // otherwise degrade into "remember to call this at every site" conventions.
+    //
+    //   singleton: "id"    — process identity. The runtime takes an exclusive
+    //                        lock at startup; a SECOND start is refused, loudly,
+    //                        instead of two processes sharing one data dir.
+    //   env NAME: T = "d"  — one configuration entry. Its type and its default
+    //                        are declared ONCE, here, and resolved+validated
+    //                        before main() body runs.
+    //   env NAME: T required
+    //                      — no default; the program refuses to start unless the
+    //                        variable is set.
+    //
+    // Both compile into calls injected at the head of main() — the same boundary
+    // seam `cgi` already uses (codegen.el emit_program_init). No call site in the
+    // program body has to remember anything, which is the whole point.
+    if k == "Program" {
+        let p = pos + 1
+        let name = tok_value(tokens, p)
+        let p = p + 1
+        let p = expect(tokens, p, "LBrace")
+        let singleton = ""
+        let has_singleton = false
+        let entries = native_list_empty()
+        // Entry-scratch declared at loop-body level (not inside the branch) so
+        // that inner `let` forms compile to assignment rather than a C-scoped
+        // redeclaration — the same idiom the service block above relies on.
+        let ename = ""
+        let etype = ""
+        let edefault = ""
+        let has_default = false
+        let erequired = false
+        let fname = ""
+        let fval = ""
+        let running = true
+        while running {
+            let k2 = tok_kind(tokens, p)
+            if k2 == "RBrace" {
+                let running = false
+            } else {
+                if k2 == "Eof" {
+                    let running = false
+                } else {
+                    let fname = tok_value(tokens, p)
+                    let p = p + 1
+                    if str_eq(fname, "env") {
+                        // env NAME: Type [= "default"] [required]
+                        let ename = tok_value(tokens, p)
+                        let p = p + 1
+                        let p = expect(tokens, p, "Colon")
+                        let etype = tok_value(tokens, p)
+                        let p = p + 1
+                        let edefault = ""
+                        let has_default = false
+                        let erequired = false
+                        let k3 = tok_kind(tokens, p)
+                        if str_eq(k3, "Eq") {
+                            let p = p + 1
+                            let edefault = tok_value(tokens, p)
+                            let has_default = true
+                            let p = p + 1
+                        }
+                        let k4 = tok_kind(tokens, p)
+                        if str_eq(k4, "Ident") {
+                            let w = tok_value(tokens, p)
+                            if str_eq(w, "required") {
+                                let erequired = true
+                                let p = p + 1
+                            }
+                        }
+                        let entries = native_list_append(entries, {
+                            "name": ename,
+                            "etype": etype,
+                            "default": edefault,
+                            "has_default": has_default,
+                            "required": erequired
+                        })
+                    } else {
+                        // scalar field: `name: "value"`
+                        let p = expect(tokens, p, "Colon")
+                        let fval = tok_value(tokens, p)
+                        let p = p + 1
+                        if str_eq(fname, "singleton") {
+                            let singleton = fval
+                            let has_singleton = true
+                        }
+                    }
+                    let k5 = tok_kind(tokens, p)
+                    if k5 == "Comma" {
+                        let p = p + 1
+                    }
+                }
+            }
+        }
+        let p = expect(tokens, p, "RBrace")
+        return make_result({
+            "stmt": "ProgramBlock",
+            "name": name,
+            "singleton": singleton,
+            "has_singleton": has_singleton,
+            "entries": entries
+        }, p)
+    }
+
     // assert <cond_expr> [ , <msg_expr> ]
     // The message is optional — if the next token after the condition is not a
     // Comma, emit an empty string placeholder so the test still works.
@@ -2419,6 +2526,7 @@ fn scan_params_c(tokens: [Any], pos: Int) -> Map<String, Any> {
 //   toplevel_let:  { "kind": "toplevel_let", "name": String, "ltype": String }
 //   cgi_block:     { "kind": "cgi_block",  "name": String }
 //   service_block: { "kind": "service_block", "name": String }
+//   program_block: { "kind": "program_block", "name": String }
 //
 // Import/TypeDef/EnumDef nodes are skipped (codegen treats them as no-ops).
 //
@@ -2546,13 +2654,28 @@ fn scan_fn_sigs(tokens: [Any]) -> [Map<String, Any>] {
                         "name": name
                     })
                     let pos = p
+                } else {
+                // --- program block ---
+                if str_eq(k, "Program") {
+                    let p: Int = pos + 1
+                    let name: String = tok_value(tokens, p)
+                    let p = p + 1
+                    let k2: String = tok_kind(tokens, p)
+                    if str_eq(k2, "LBrace") {
+                        let p = skip_to_rbrace(tokens, p)
+                    }
+                    let sigs = native_list_append(sigs, {
+                        "kind": "program_block",
+                        "name": name
+                    })
+                    let pos = p
                 } else {
                     // Import, Type, Enum, From, or any other token.
                     // Skip ahead to the next statement boundary.
                     let p: Int = pos + 1
                     let p = skip_expr_to_stmt_boundary(tokens, p)
                     let pos = p
-                }}}}}
+                }}}}}}
             }
         }
     }

lang/examples/transduce.el

@@ -0,0 +1,228 @@
+// transduce.el — transduction decomposes a signal into components and the
+// relations between them. Runnable: this is the worked example for the
+// transduce surface, and it exits non-zero if any claim in it stops being true.
+//
+//   elc lang/examples/transduce.el > transduce.c
+//   cc -std=c11 -O2 -I lang/runtime -o transduce transduce.c \
+//        lang/runtime/el_runtime.c lang/runtime/el_seed.c \
+//        lang/runtime/engram_store.c lang/runtime/engram_vindex.c \
+//        lang/runtime/engram_cognition.c lang/runtime/engram_geometry.c \
+//        lang/runtime/engram_reason.c lang/runtime/engram_verify.c \
+//        -lcurl -lpthread -lm
+//   ./transduce          # exits 0 only if every check passes
+//
+// It writes to an IN-MEMORY engram (leave ENGRAM_STORE unset) and contacts no
+// server. The same claims are asserted by the native harness in
+// lang/tests/native/test_transduce.el.
+//
+// WHAT CHANGED, AND WHY IT MATTERS. #144 shipped
+// `transduce(signal, modality) -> Geometry`: one vector per signal. That made
+// transduction a CONVERSION — take a thing, encode it, store a position — and
+// what a conversion returns is a fingerprint. A fingerprint can be matched and
+// ranked, and that is all it can ever do. It cannot be decomposed, cannot have
+// one part grounded while another is not, and cannot be contradicted in one
+// part while holding in another, because it has no parts.
+//
+// A song is not a point. It decomposes into pitch, interval, rhythm, harmonic
+// function — components, each with its own geometry, plus the relations among
+// them. THE SONG IS THE STRUCTURE OF THE RELATIONS. transduce now returns a
+// Manifold, and a realizer's job is to say what its modality's components ARE.
+
+fn check(ok: Int, label: String) -> Int {
+    if ok > 0 {
+        println("  ok    " + label)
+        return 0
+    }
+    println("  FAIL  " + label)
+    exit(1)
+    return 1
+}
+
+fn near(a: Float, b: Float) -> Int {
+    let d: Float = a - b
+    if d > 0.001 { return 0 }
+    if d < -0.001 { return 0 }
+    return 1
+}
+
+fn eq_int(a: Int, b: Int) -> Int {
+    if a == b { return 1 }
+    return 0
+}
+
+// ── A DECOMPOSING realizer, written entirely in El ──────────────────────────
+// "tone" signals are note letters, e.g. "CEG". This does NOT return one vector
+// for the chord. It returns the PARTS — one component per note, one per
+// interval between adjacent notes — and the relations that make those parts a
+// chord rather than an unordered bag of pitches.
+//
+// The interval is deliberately a COMPONENT, not a field on a note. An interval
+// is a thing with its own geometry belonging to neither endpoint; modelling it
+// as an attribute of one of them is the same collapse, one level down.
+fn tone_realizer(signal: String) -> Manifold {
+    let m: Manifold = manifold_new()
+    let n: Int = str_len(signal)
+    let i: Int = 0
+    while i < n {
+        let code: Int = str_char_code(signal, i)
+        let g: Geometry = geometry_new(2)
+        let s0: Int = geometry_set(g, 0, int_to_float(code))
+        let s1: Int = geometry_set(g, 1, int_to_float(i))
+        let idx: Int = manifold_add(m, "note:" + int_to_str(i), "pitch", g)
+        let f: Int = geometry_free(g)
+        i = i + 1
+    }
+    let j: Int = 1
+    while j < n {
+        let a: Int = str_char_code(signal, j - 1)
+        let b: Int = str_char_code(signal, j)
+        let lo: String = "note:" + int_to_str(j - 1)
+        let hi: String = "note:" + int_to_str(j)
+        let key: String = "interval:" + int_to_str(j - 1) + "-" + int_to_str(j)
+        let g: Geometry = geometry_new(1)
+        let s: Int = geometry_set(g, 0, int_to_float(b - a))
+        let idx: Int = manifold_add(m, key, "interval", g)
+        let f: Int = geometry_free(g)
+        let e1: Int = manifold_relate(m, key, "spans", lo, 0.9)
+        let e2: Int = manifold_relate(m, key, "spans", hi, 0.9)
+        let e3: Int = manifold_relate(m, lo, "sounds_before", hi, 0.8)
+        j = j + 1
+    }
+    m
+}
+
+// #144's contract, kept as a control: one vector for the whole signal.
+fn fingerprint_realizer(signal: String) -> Geometry {
+    let g: Geometry = geometry_new(4)
+    let n: Int = str_len(signal)
+    let a: Int = geometry_set(g, 0, int_to_float(n))
+    g
+}
+
+fn main() -> Void {
+    println("a realizer declared in El is a first-class realizer")
+    let reg: Int = realizer_register("tone", "tone_realizer")
+    let _c: Int = check(reg, "an El fn registers as a realizer by name")
+    let _c: Int = check(realizer_has("tone"), "the modality now has an organ")
+
+    println("transduction decomposes a signal into parts")
+    let m: Manifold = transduce("CEG", "tone")
+    let _c: Int = check(manifold_is(m), "transduce returns a real Manifold")
+    let sz: Int = manifold_size(m)
+    let _c: Int = check(eq_int(sz, 5), "three notes and two intervals are five parts")
+    let rc: Int = manifold_rel_count(m)
+    let _c: Int = check(eq_int(rc, 6), "and they stand in six stated relations")
+
+    println("every part is addressable BY KEY, which is what survives persistence")
+    let i_c: Int = manifold_index_of(m, "note:0")
+    let _c: Int = check(1 - eq_int(i_c, -1), "the first note is addressable on its own")
+    let i_iv: Int = manifold_index_of(m, "interval:0-1")
+    let _c: Int = check(1 - eq_int(i_iv, -1), "so is the interval between the first two")
+    let miss: Int = manifold_index_of(m, "never_added")
+    let _c: Int = check(eq_int(miss, -1), "an unknown key is -1, not component 0")
+
+    println("parts carry their own geometry, and may differ in width")
+    let gn: Geometry = manifold_geometry(m, i_c)
+    let _c: Int = check(eq_int(geometry_dim(gn), 2), "a note component is 2 wide")
+    let _c: Int = check(near(geometry_get(gn, 0), 67.0), "and it is C — the signal reached the realizer")
+    let gi: Geometry = manifold_geometry(m, i_iv)
+    let _c: Int = check(eq_int(geometry_dim(gi), 1), "an interval component is 1 wide")
+    // A single vector per signal cannot represent parts of unequal width at all.
+    let _c: Int = check(near(geometry_get(gi, 0), 2.0), "C to E is two semitones")
+    let f1: Int = geometry_free(gn)
+    let f2: Int = geometry_free(gi)
+
+    println("the relations are content no single part carries")
+    // That "2" above is not a property of C and not a property of E. It exists
+    // only BETWEEN them, so a representation with no relations cannot hold it.
+    let spans: Int = 0
+    let k: Int = 0
+    while k < rc {
+        if str_eq(manifold_rel_name(m, k), "spans") {
+            if str_eq(manifold_rel_from(m, k), "interval:0-1") { spans = spans + 1 }
+        }
+        k = k + 1
+    }
+    let _c: Int = check(eq_int(spans, 2), "the interval is wired to both notes it spans")
+
+    println("relation weight IS the grounding (correspondence-and-censorship §1)")
+    let wk: Int = 0
+    let found: Int = 0
+    while wk < rc {
+        if str_eq(manifold_rel_name(m, wk), "sounds_before") {
+            if near(manifold_rel_weight(m, wk), 0.8) > 0 { found = 1 }
+        }
+        wk = wk + 1
+    }
+    let _c: Int = check(found, "the ordering relation carries the weight its realizer stated")
+
+    println("the decomposition persists as real, separately addressable nodes")
+    let ids: [String] = el_list_empty()
+    let n0: Int = engram_node_count()
+    let e0: Int = engram_edge_count()
+    let pi: Int = 0
+    while pi < sz {
+        let key: String = manifold_key(m, pi)
+        let g: Geometry = manifold_geometry(m, pi)
+        let id: String = engram_node("component " + key, "Concept", 0.6)
+        let att: Int = node_attach_geometry(id, g)
+        ids = el_list_append(ids, id)
+        let ff: Int = geometry_free(g)
+        pi = pi + 1
+    }
+    let ri: Int = 0
+    while ri < rc {
+        let fi: Int = manifold_index_of(m, manifold_rel_from(m, ri))
+        let ti: Int = manifold_index_of(m, manifold_rel_to(m, ri))
+        engram_connect(el_list_get(ids, fi), el_list_get(ids, ti),
+                       manifold_rel_weight(m, ri), manifold_rel_name(m, ri))
+        ri = ri + 1
+    }
+    let _c: Int = check(eq_int(engram_node_count() - n0, 5), "one signal became five nodes")
+    let _c: Int = check(eq_int(engram_edge_count() - e0, 6), "and six edges between them")
+
+    println("each part's geometry is independently readable back off its node")
+    let id_c: String = el_list_get(ids, manifold_index_of(m, "note:0"))
+    let id_iv: String = el_list_get(ids, manifold_index_of(m, "interval:0-1"))
+    let _c: Int = check(eq_int(node_geometry_dim(id_c), 2), "note:0 node carries a 2-wide geometry")
+    let _c: Int = check(eq_int(node_geometry_dim(id_iv), 1), "interval:0-1 node carries a 1-wide one")
+
+    println("one part can be grounded without touching its siblings")
+    let ear: String = engram_node("evidence: heard a C in the recording", "Memory", 0.7)
+    engram_connect(ear, id_c, 0.95, "corroborates")
+    let _c: Int = check(engram_edge_between(ear, id_c), "evidence attaches to note:0 specifically")
+    let id_g: String = el_list_get(ids, manifold_index_of(m, "note:2"))
+    let _c: Int = check(1 - engram_edge_between(ear, id_g), "and NOT to note:2 — the sibling is untouched")
+    // This is the whole gain, and it is impossible with a fingerprint: with one
+    // node per signal, "the C is corroborated" and "the G is not" have the same
+    // grounding target and cannot both be recorded.
+    let _c: Int = check(eq_int(node_geometry_dim(id_g), 2), "note:2 geometry is intact regardless")
+
+    println("a fingerprint realizer transduces NOTHING")
+    // #144's contract exactly: signal in, one Geometry out. It resolves, so the
+    // organ is present — but it does not decompose, so it does not transduce.
+    // "No organ" and "an organ that only fingerprints" must not look alike.
+    let rf: Int = realizer_register("fingerprint", "fingerprint_realizer")
+    let _c: Int = check(rf, "the symbol resolves, so registration succeeds")
+    let mf: Manifold = transduce("x", "fingerprint")
+    let _c: Int = check(1 - manifold_is(mf), "a single vector is not a transduction")
+
+    println("the one-part case is a size-one manifold, not a bare vector")
+    let g1: Geometry = geometry_new(3)
+    let s1: Int = geometry_set(g1, 0, 5.0)
+    let ms: Manifold = manifold_single("level", "scalar", g1)
+    let _c: Int = check(manifold_is(ms), "manifold_single yields a real Manifold")
+    let _c: Int = check(eq_int(manifold_size(ms), 1), "of size one — visibly degenerate, not hidden")
+    let fg: Int = geometry_free(g1)
+    let fs: Int = manifold_free(ms)
+
+    println("no organ is still reported as no organ")
+    let me: Manifold = transduce("anything", "echolocation")
+    let _c: Int = check(1 - manifold_is(me), "no realizer means no manifold, not a fake one")
+
+    let fm: Int = manifold_free(m)
+
+    // Reaching here means nothing called exit(1) along the way.
+    println("")
+    println("all checks passed")
+}

lang/runtime/el_runtime.h

@@ -586,6 +586,110 @@ void      el_runtime_dharma_event_arrive(const char* event_type,
                                          const char* payload,
                                          const char* source);
 
+/* ── Geometry: signal as a first-class El value ──────────────────────────────
+ *
+ * A Geometry is an opaque, magic-tagged heap value carried in an el_val_t —
+ * the same discipline as List/Map. It holds a width and a float32 payload,
+ * and it is the medium a non-text modality enters in. Declared HERE, above
+ * the engram block, because transduction is a LANGUAGE concern: every El
+ * program touching any modality needs it, and the engram is merely one El
+ * program that happens to hold a graph. See el_runtime.c ("Geometry: signal
+ * as a first-class el value") for the full rationale.
+ *
+ * El-side type annotation is simply `Geometry` — an opaque boxed pointer,
+ * exactly like Instant / Calendar / Rhythm. No codegen change is required.
+ *
+ * OWNERSHIP: a Geometry is owned by the El caller and released with
+ * geometry_free. node_attach_geometry COPIES, so a node and the caller's
+ * value have independent lifetimes.                                          */
+
+el_val_t  geometry_new(el_val_t dim);                 /* zero-filled; 0 on failure */
+el_val_t  geometry_dim(el_val_t g);                   /* width, 0 if not a Geometry */
+el_val_t  geometry_is(el_val_t g);                    /* 1 if a live Geometry       */
+el_val_t  geometry_get(el_val_t g, el_val_t i);       /* Float component            */
+el_val_t  geometry_set(el_val_t g, el_val_t i, el_val_t x);  /* 1 ok / 0 out of range */
+el_val_t  geometry_norm(el_val_t g);                  /* Float L2 — lets a caller
+                                                       * check a realizer emitted
+                                                       * signal, not zeros          */
+el_val_t  geometry_free(el_val_t g);                  /* 1 if freed, 0 if not a Geometry.
+                                                       * Returns a value (not void) so it
+                                                       * is safe in any El expression
+                                                       * position without a codegen
+                                                       * void-builtin table entry.  */
+
+/* Wire ADAPTERS — the only place an encoding appears, and only at the edge.
+ * `f32le hex` is little-endian float32, 8 hex chars per component: the
+ * encoding the perception vessel's /voice/embed already emits. The width is
+ * DERIVED from the input length, never supplied by a caller — which is why
+ * there is no max-dim constant here to validate a claimed length against. */
+el_val_t  geometry_from_f32le_hex(el_val_t hex);      /* 0 on empty/odd-length/non-hex */
+el_val_t  geometry_to_f32le_hex(el_val_t g);          /* "" if not a Geometry       */
+
+/* ── Manifold: the result of a transduction ──────────────────────────────────
+ * A transduced signal is a SUBGRAPH — named components, each with its own
+ * geometry, plus typed weighted relations among them — not a single vector.
+ * One vector is a fingerprint: matchable, rankable, and nothing else. A song
+ * decomposes into pitch, interval, rhythm, harmonic function; the song IS the
+ * structure of those relations, and collapsing it to a point discards exactly
+ * what made it reasonable-about. See el_runtime.c ("Manifold") for the full
+ * rationale, the key-addressing rule, and the ownership contract.
+ *
+ * Components are addressed BY KEY, never by index, because the key is what
+ * survives persistence: a component becomes a node, and it is separately
+ * groundable precisely because it is separately named. Relation weight IS the
+ * grounding (correspondence-and-censorship.md §1) — one quantity, no separate
+ * score, nothing computed on read.
+ *
+ * OWNERSHIP: a Manifold is owned by the El caller and released with
+ * manifold_free, which also releases every component's geometry. manifold_add
+ * COPIES the geometry it is given and manifold_geometry RETURNS a copy, so no
+ * component's vector is ever aliased in either direction.                     */
+el_val_t  manifold_new(void);                          /* empty; 0 on failure       */
+el_val_t  manifold_is(el_val_t m);                     /* 1 if a live Manifold      */
+el_val_t  manifold_add(el_val_t m, el_val_t key, el_val_t role, el_val_t g);
+                                        /* component index, or -1 on empty/duplicate
+                                         * key or a value that is not a Geometry   */
+el_val_t  manifold_relate(el_val_t m, el_val_t from, el_val_t rel,
+                          el_val_t to, el_val_t weight);
+                                        /* 1 ok / 0 if either endpoint is unknown —
+                                         * an unresolvable edge is REFUSED, never
+                                         * silently dropped                        */
+el_val_t  manifold_size(el_val_t m);                   /* component count           */
+el_val_t  manifold_rel_count(el_val_t m);              /* relation count            */
+el_val_t  manifold_index_of(el_val_t m, el_val_t key); /* index by key, or -1       */
+el_val_t  manifold_key(el_val_t m, el_val_t i);        /* "" if out of range        */
+el_val_t  manifold_role(el_val_t m, el_val_t i);       /* "" if out of range        */
+el_val_t  manifold_geometry(el_val_t m, el_val_t i);   /* a COPY the caller frees   */
+el_val_t  manifold_rel_from(el_val_t m, el_val_t j);   /* source component key      */
+el_val_t  manifold_rel_name(el_val_t m, el_val_t j);   /* relation name             */
+el_val_t  manifold_rel_to(el_val_t m, el_val_t j);     /* target component key      */
+el_val_t  manifold_rel_weight(el_val_t m, el_val_t j); /* Float — the grounding     */
+el_val_t  manifold_single(el_val_t key, el_val_t role, el_val_t g);
+                                        /* the degenerate one-part case, expressible
+                                         * but visibly a size-1 manifold rather than
+                                         * a parallel path back to a bare vector   */
+el_val_t  manifold_free(el_val_t m);                   /* 1 if freed, 0 otherwise   */
+
+/* ── Realizers + transduce ───────────────────────────────────────────────────
+ * A REALIZER DECOMPOSES one modality into components and relations. It does
+ * not encode a signal to a point; that operation is one layer below and is
+ * called geometry. Registration is by NAME, so a new modality never requires a
+ * runtime patch: every El `fn name(...)` compiles to a global C symbol with
+ * that exact name, and the registry resolves it with dlsym against the running
+ * binary — the same mechanism http_set_handler already relies on.
+ *
+ *     fn tone_realizer(signal: String) -> Manifold { ... }
+ *     realizer_register("tone", "tone_realizer")
+ *     let m: Manifold = transduce(sample, "tone")
+ *
+ * SUPERSEDES #144's `transduce -> Geometry`. A realizer that still returns a
+ * bare Geometry now transduces NOTHING (transduce returns 0), deliberately: an
+ * organ that only fingerprints must not be indistinguishable from a working
+ * one. A modality with genuinely one part says so with manifold_single.      */
+el_val_t  realizer_register(el_val_t modality, el_val_t fn_name); /* 1 ok / 0 unresolved */
+el_val_t  realizer_has(el_val_t modality);            /* 1 if a realizer is registered */
+el_val_t  transduce(el_val_t signal, el_val_t modality); /* Manifold, or 0 if no organ */
+
 /* ── Engram local graph primitives ───────────────────────────────────────────
  * Operate on the CGI's local Engram knowledge graph.
  * `engram_activate` queries the local graph only; `dharma_activate` is
@@ -612,11 +716,27 @@ el_val_t  engram_get_node(el_val_t id);
 void      engram_strengthen(el_val_t node_id);
 void      engram_forget(el_val_t node_id);
 el_val_t  engram_prune_telemetry(el_val_t older_than_ms);
+/* Largest byte length <= max_bytes that does not split a UTF-8 codepoint.
+ * Bounded by bytes, not codepoints, so truncated strings never grow. */
+size_t    el_utf8_safe_len(const char* s, size_t max_bytes);
+
 el_val_t  engram_node_count(void);
-/* Attach geometry to an existing node. `hex` is little-endian float32,
+/* Attach a Geometry to an existing node, and read the attached width back.
- * exactly dim*8 hex chars — the encoding realizers already emit. Lets a
+ * Named for the operation, not the store: a node acquires geometry. This is
- * non-text modality enter as geometry instead of being described in prose
+ * the geometry-valued ingest path — nothing about it is hex, and nothing
- * and embedded as its description. Returns 1 on success, 0 otherwise. */
+ * about it assumes the caller's vector matches the canonical text-embedding
+ * width. node_geometry_dim exists so an attach is VERIFIED by reading it
+ * back rather than by trusting a success return. */
+el_val_t  node_attach_geometry(el_val_t node_id, el_val_t g); /* 1 ok / 0 otherwise */
+el_val_t  node_geometry_dim(el_val_t node_id);                /* width, 0 if none   */
+
+/* DEPRECATED (shipped in #141, superseded 2026-08-16). Equivalent to
+ * geometry_from_f32le_hex + node_attach_geometry, and now implemented as
+ * exactly that. Kept only so anything built against the #141 runtime keeps
+ * linking; `dim` is accepted but treated as an assertion about the vector's
+ * width rather than as its source. New code should not call this — a hex
+ * string is a wire encoding, not a way to move geometry between two pieces
+ * of El. Returns 1 on success, 0 otherwise. */
 el_val_t  engram_node_set_emb(el_val_t id, el_val_t hex, el_val_t dim);
 el_val_t  engram_search(el_val_t query, el_val_t limit);
 el_val_t  engram_scan_nodes(el_val_t limit, el_val_t offset);
@@ -957,6 +1077,22 @@ el_val_t  __url_decode(el_val_t s);
 /* Environment */
 el_val_t  __env_get(el_val_t key);
 
+/* Cross-cutting concerns declared by a `program` block (spec §18).
+ * All three are COMPILER-INJECTED at the head of main() — they are not meant to
+ * be written by hand, which is the point: the guarantee cannot be forgotten at a
+ * call site because there is no call site. */
+el_val_t  el_singleton_acquire(el_val_t id);                    /* §18.1 process identity */
+el_val_t  el_config_declare(el_val_t name, el_val_t type,
+                            el_val_t deflt, el_val_t has_default,
+                            el_val_t required);                 /* §18.2 config schema    */
+el_val_t  el_config_validate(el_val_t program_name);            /* §18.2 startup validate */
+
+/* config(key) — the READ side, and the only one programs write by hand. With a
+ * schema declared it is a validated lookup; without one it degrades to getenv.
+ * (Defined in el_runtime.c but previously never prototyped here, so any program
+ * calling it failed to compile under -Werror=implicit-function-declaration.) */
+el_val_t  config(el_val_t key);
+
 /* Subprocess */
 el_val_t  __exec(el_val_t cmd);
 el_val_t  __exec_bg(el_val_t cmd);

lang/runtime/engram_geometry.c

@@ -222,7 +222,7 @@ static double eff_w(double weight, double hebb){
 }
 
 GeoDescriptor* engram_geometry_descriptor(
-    EngramPagedStore* store, VIndex* vindex,
+    EngramPagedStore* store, const VIndex* vindex,
     char** vids, int n_vids,
     const char* const* seed_ids, size_t n_seeds,
     const GeoParams* params,
@@ -1401,7 +1401,7 @@ static double geo_weighted_degree(EngramPagedStore* st, const char* id, double e
     return deg;
 }
 
-int engram_geo_reify_store(EngramPagedStore* store, VIndex* vindex,
+int engram_geo_reify_store(EngramPagedStore* store, const VIndex* vindex,
                            char** vids, int n_vids,
                            const GeoReifyParams* params){
     if(!store) return -1;

lang/runtime/engram_geometry.h

@@ -150,7 +150,7 @@ void engram_geo_mean_free(GeoMeanCache* c);
  * Returns a malloc'd descriptor (free with engram_geo_free), or NULL on error
  * (no seeds resolvable, OOM). */
 GeoDescriptor* engram_geometry_descriptor(
-    EngramPagedStore* store, VIndex* vindex,
+    EngramPagedStore* store, const VIndex* vindex,
     char** vids, int n_vids,
     const char* const* seed_ids, size_t n_seeds,
     const GeoParams* params,
@@ -375,7 +375,7 @@ void engram_geo_reify_default_params(GeoReifyParams* p);
  * neighborhood (+ member edges), superseding any prior same-hub record with
  * provenance. Read-then-write over `store`. Returns #neighborhoods persisted, or <0.
  * Skips existing Neighborhood/GeoMeanFrame nodes when detecting (idempotent re-reify). */
-int engram_geo_reify_store(EngramPagedStore* store, VIndex* vindex,
+int engram_geo_reify_store(EngramPagedStore* store, const VIndex* vindex,
                            char** vids, int n_vids,
                            const GeoReifyParams* params);
 

lang/runtime/engram_vindex.c

@@ -74,11 +74,6 @@ struct VIndex {
 
     int      entry;         /* entry-point element index, -1 if empty */
     int      max_level;     /* current top layer */
-
-    /* scratch: version-stamped visited set (O(1) reset). */
-    uint32_t* visited;
-    uint32_t  visit_epoch;
-    size_t    visited_cap;
 };
 
 /* ── small helpers ────────────────────────────────────────────────────────── */
@@ -166,37 +161,63 @@ static Pair heap_pop(Heap* h, int is_max){
     return top;
 }
 
-/* ── visited set ──────────────────────────────────────────────────────────── */
+/* ── visited set — owned by the CALL FRAME, never by the index ──────────────
-static int visited_ensure(VIndex* ix){
+ * This buffer is per-TRAVERSAL scratch. It used to live in struct VIndex as an
-    if (ix->visited_cap >= ix->cap && ix->visited) return 0;
+ * allocation optimisation, which made every traversal a write to shared state:
-    size_t nc = ix->cap ? ix->cap : 16;
+ * two concurrent vindex_search calls stamped each other's epoch and then walked
-    uint32_t* nv = (uint32_t*)realloc(ix->visited, nc*sizeof(uint32_t));
+ * each other's marks, so even two pure READS corrupted the traversal (measured
-    if (!nv) return -1;
+ * 2026-08-16: TSan data race at visited_reset, reached from vindex_search on one
-    if (nc > ix->visited_cap) memset(nv + ix->visited_cap, 0, (nc-ix->visited_cap)*sizeof(uint32_t));
+ * thread and vindex_insert on another; downstream SIGSEGV dereferencing a bogus
-    ix->visited = nv; ix->visited_cap = nc;
+ * element index).
+ *
+ * It is not an ownership problem and it does not want a lock or a capability —
+ * it was simply misfiled. A pure function's scratch belongs to the call. Moving
+ * it here is what lets vindex_search take a `const VIndex*`, which is in turn
+ * what makes "search does not mutate the index" a COMPILE-TIME property instead
+ * of a review comment.
+ *
+ * Cost: one calloc/free of cap*4 bytes per traversal (~55 KB at the live store's
+ * 13,820 elements), against thousands of dim-768 dot products in the same call.
+ * Deliberately NOT __thread: http_worker is a thread per connection, so a
+ * thread-local buffer would retain ~55 KB per connection for the process life. */
+typedef struct {
+    uint32_t* mark;      /* per-element epoch stamp */
+    uint32_t  epoch;     /* current traversal's stamp; 0 == "no traversal yet" */
+    size_t    cap;
+} VVisit;
+
+/* calloc leaves every stamp 0 and epoch 0; the first visit_reset moves to
+ * epoch 1, so no element reads as visited before it is marked. */
+static int visit_init(VVisit* v, size_t cap){
+    size_t nc = cap ? cap : 16;
+    v->mark = (uint32_t*)calloc(nc, sizeof(uint32_t));
+    if (!v->mark) return -1;
+    v->cap = nc; v->epoch = 0;
     return 0;
 }
-static inline void visited_reset(VIndex* ix){
+static void visit_dispose(VVisit* v){ free(v->mark); v->mark = NULL; v->cap = 0; }
-    if (++ix->visit_epoch == 0){                 /* wrapped: clear all */
+static inline void visit_reset(VVisit* v){
-        memset(ix->visited, 0, ix->visited_cap*sizeof(uint32_t));
+    if (++v->epoch == 0){                        /* wrapped: clear all */
-        ix->visit_epoch = 1;
+        memset(v->mark, 0, v->cap*sizeof(uint32_t));
+        v->epoch = 1;
     }
 }
-static inline int is_visited(VIndex* ix, int e){ return ix->visited[e]==ix->visit_epoch; }
+static inline int is_visited(const VVisit* v, int e){ return v->mark[e]==v->epoch; }
-static inline void mark_visited(VIndex* ix, int e){ ix->visited[e]=ix->visit_epoch; }
+static inline void mark_visited(VVisit* v, int e){ v->mark[e]=v->epoch; }
 
 /* ── search one layer (Algorithm 2): best-first, ef-bounded ───────────────── */
 /* Returns results as an unsorted Heap (max-heap on distance, size<=ef). Caller
  * owns res->a. `q` is a normalised query. */
-static int search_layer(VIndex* ix, const float* q, const int* eps, int neps,
+static int search_layer(const VIndex* ix, VVisit* vis, const float* q,
+                        const int* eps, int neps,
                         int ef, int layer, Heap* res /*out, max-heap*/){
     Heap cand = {0,0,0};                          /* min-heap: nearest to expand */
     res->a=NULL; res->n=0; res->cap=0;
-    visited_reset(ix);
+    visit_reset(vis);
     for (int i=0;i<neps;i++){
         int e = eps[i];
-        if (is_visited(ix,e)) continue;
+        if (is_visited(vis,e)) continue;
-        mark_visited(ix,e);
+        mark_visited(vis,e);
         float d = vdist(ix, q, ix->elems[e].vec);
         Pair p = { d, e };
         if (heap_push(&cand,p,0) || heap_push(res,p,1)){ free(cand.a); return -1; }
@@ -212,8 +233,8 @@ static int search_layer(VIndex* ix, const float* q, const int* eps, int neps,
             NeighList* nl = &ce->links[layer];
             for (int i=0;i<nl->count;i++){
                 int e = nl->ids[i];
-                if (is_visited(ix,e)) continue;
+                if (is_visited(vis,e)) continue;
-                mark_visited(ix,e);
+                mark_visited(vis,e);
                 float d = vdist(ix, q, ix->elems[e].vec);
                 if (res->n < ef || d < res->a[0].d){
                     Pair p = { d, e };
@@ -232,7 +253,7 @@ static int search_layer(VIndex* ix, const float* q, const int* eps, int neps,
  * Keep c only if it is nearer to q than to every already-chosen neighbour;
  * backfill from the pruned set (nearest first) to reach M for connectivity.
  * Writes chosen element indices into out[], returns the count. */
-static int select_neighbors(VIndex* ix, const float* q, Pair* W, int nW, int M, int* out){
+static int select_neighbors(const VIndex* ix, const float* q, Pair* W, int nW, int M, int* out){
     (void)q;   /* q's distances are precomputed in W[].d; kept for call-site clarity */
     /* sort W ascending by (dist,elem) — deterministic. */
     for (int i=1;i<nW;i++){                        /* insertion sort (nW small) */
@@ -281,7 +302,7 @@ static int elems_reserve(VIndex* ix){
     Elem* ne = (Elem*)realloc(ix->elems, nc*sizeof(Elem));
     if (!ne) return -1;
     ix->elems = ne; ix->cap = nc;
-    return visited_ensure(ix);
+    return 0;
 }
 
 int vindex_insert(VIndex* ix, uint64_t node_id, const float* vec){
@@ -307,13 +328,19 @@ int vindex_insert(VIndex* ix, uint64_t node_id, const float* vec){
         return 0;
     }
 
+    /* This call frame owns its traversal scratch for the whole insert. ix->cap
+     * already covers `cur` (elems_reserve ran above), so every reachable element
+     * index is in range. */
+    VVisit vis;
+    if (visit_init(&vis, ix->cap)) return -1;
+
     int ep = ix->entry;
     int L = ix->max_level;
     /* greedy descent through layers above `level` to refine the entry point. */
     for (int lc = L; lc > level; lc--){
         Heap r = {0,0,0};
         int eps1[1] = { ep };
-        if (search_layer(ix, el->vec, eps1, 1, 1, lc, &r)){ return -1; }
+        if (search_layer(ix, &vis, el->vec, eps1, 1, 1, lc, &r)){ visit_dispose(&vis); return -1; }
         if (r.n){ ep = r.a[0].e; float bd=r.a[0].d;
             for (int i=1;i<r.n;i++) if (r.a[i].d<bd){bd=r.a[i].d; ep=r.a[i].e;} }
         free(r.a);
@@ -329,7 +356,7 @@ int vindex_insert(VIndex* ix, uint64_t node_id, const float* vec){
     for (int lc = start; lc >= 0; lc--){
         int Mmax = (lc==0) ? ix->M0 : ix->M;
         Heap W = {0,0,0};
-        if (search_layer(ix, el->vec, eps, neps, ix->ef_construction, lc, &W)){ rc=-1; break; }
+        if (search_layer(ix, &vis, el->vec, eps, neps, ix->ef_construction, lc, &W)){ rc=-1; break; }
         int* chosen = (int*)malloc((size_t)(W.n?W.n:1)*sizeof(int));
         if (!chosen){ free(W.a); rc=-1; break; }
         int nc = select_neighbors(ix, el->vec, W.a, W.n, Mmax, chosen);
@@ -357,13 +384,17 @@ int vindex_insert(VIndex* ix, uint64_t node_id, const float* vec){
     }
 done:
     free(eps_owned);
+    visit_dispose(&vis);
     if (rc) return -1;
     if (level > ix->max_level){ ix->max_level = level; ix->entry = cur; }
     return 0;
 }
 
 /* ── search ───────────────────────────────────────────────────────────────── */
-int vindex_search(VIndex* ix, const float* query, int k, int ef_search,
+/* `ix` is const: search is pure with respect to the index. That is enforced by
+ * the compiler, not by convention — it is the whole point of moving the visited
+ * set into the frame below. */
+int vindex_search(const VIndex* ix, const float* query, int k, int ef_search,
                   uint64_t* node_id_out, float* dist_out){
     if (!ix || !query || k <= 0) return -1;
     if (ix->entry < 0) return 0;
@@ -373,11 +404,15 @@ int vindex_search(VIndex* ix, const float* query, int k, int ef_search,
     float* q = vec_normalise_copy(query, ix->dim);
     if (!q) return -1;
 
+    /* This call frame owns its traversal scratch. */
+    VVisit vis;
+    if (visit_init(&vis, ix->cap)){ free(q); return -1; }
+
     int ep = ix->entry;
     for (int lc = ix->max_level; lc > 0; lc--){
         Heap r = {0,0,0};
         int eps[1] = { ep };
-        if (search_layer(ix, q, eps, 1, 1, lc, &r)){ free(q); return -1; }
+        if (search_layer(ix, &vis, q, eps, 1, 1, lc, &r)){ visit_dispose(&vis); free(q); return -1; }
         if (r.n){ int b=r.a[0].e; float bd=r.a[0].d;
             for (int i=1;i<r.n;i++) if (r.a[i].d<bd){bd=r.a[i].d; b=r.a[i].e;}
             ep = b; }
@@ -385,7 +420,8 @@ int vindex_search(VIndex* ix, const float* query, int k, int ef_search,
     }
     Heap res = {0,0,0};
     int eps[1] = { ep };
-    if (search_layer(ix, q, eps, 1, ef_search, 0, &res)){ free(res.a); free(q); return -1; }
+    if (search_layer(ix, &vis, q, eps, 1, ef_search, 0, &res)){ visit_dispose(&vis); free(res.a); free(q); return -1; }
+    visit_dispose(&vis);
     free(q);
 
     /* res is a max-heap of size<=ef; pop into ascending order, keep nearest k. */
@@ -419,7 +455,6 @@ VIndex* vindex_create(int dim, int M, int ef_construction){
     ix->mL = 1.0 / log((double)M > 1.0 ? (double)M : 2.0);
     ix->entry = -1;
     ix->max_level = 0;
-    ix->visit_epoch = 0;
     return ix;
 }
 
@@ -432,7 +467,6 @@ void vindex_free(VIndex* ix){
         free(e->vec);
     }
     free(ix->elems);
-    free(ix->visited);
     free(ix);
 }
 

lang/runtime/engram_vindex.h

@@ -53,8 +53,15 @@ int vindex_insert(VIndex* idx, uint64_t node_id, const float* vec);
  * first (ascending distance). Either out array may be NULL to skip it.
  *   ef_search — search-time candidate width; larger == higher recall, slower.
  *               Pass <=0 for VINDEX_DEFAULT_EF_SEARCH. Internally clamped to >=k.
- * Returns the number of results written, or <0 on error. */
+ * Returns the number of results written, or <0 on error.
-int vindex_search(VIndex* idx, const float* query, int k, int ef_search,
+ *
+ * `idx` is const BY CONTRACT AND BY TYPE: search does not mutate the index. The
+ * traversal's visited set is owned by the call frame, so N threads may search one
+ * index concurrently. Concurrent search against a vindex_insert on the same index
+ * is still unsafe — insert rewires existing elements' neighbour lists and reallocs
+ * elems[] — so the index's owner must not extend a published index under a live
+ * reader. See eg_vindex_view / eg_vindex_maintain in el_runtime.c. */
+int vindex_search(const VIndex* idx, const float* query, int k, int ef_search,
                   uint64_t* node_id_out, float* dist_out);
 
 /* Number of vectors currently indexed. */

lang/spec/language.md

@@ -29,6 +29,8 @@ This section is the **single source of truth** for what works and what is planne
 - Lexer: keywords, identifiers, integer/float/string/bool literals, operators below.
 - Parser: `let`, `return`, `fn`, `type`, `enum`, `import`, `from … import`, `while`, `for`, `if/else if/else`, `match`, `@decorator`, array/map literals, all listed operators, function calls, field access, index access, unary `!`/`-`, postfix `?`.
 - Codegen: function definitions, top-level `main()`, all expression forms above, control flow, decorator-as-AST-attachment.
+- Boundary seam: decorator arguments and stacking; VBD role enforcement via `#error`; `engram_boundary_beat` auto-emit at `@manager`/`@accessor` entry; `@route` dispatch tables (Section 9).
+- Program-level declarative blocks: `cgi`, `service`, and `program` — the last carrying process identity and configuration (Section 18).
 - C runtime: I/O, string operations, integer math, lists, maps, filesystem, command-line args, basic `json_get` substring lookup.
 
 ### Planned (in flight)
@@ -37,7 +39,7 @@ This section is the **single source of truth** for what works and what is planne
 - **Match codegen.** Currently parsed; codegen does not emit. Adding `({ ... })` statement-expression emission.
 - **`?` propagation.** Currently no-op. Adding nil-propagation semantics.
 - **`cgi` block parsing.** Currently lexed (`cgi` is a keyword) but not parsed as a statement. Adding `parse_cgi_block` and codegen of `el_cgi_init` at the head of `main()`.
-- **VBD role enforcement.** `@manager`/`@engine`/`@accessor` are accepted as decorators but not enforced. Adding compile-time check that `dharma_emit`/`dharma_field` only appear inside `@manager` functions.
+- **Boundary epilogues.** The decorator seam injects a prologue only. Adding prologue/epilogue wrapping, the prerequisite for durability-as-an-effect (Section 19.1).
 - **`vessel` keyword.** Replaces `package` in manifests. Adding to lexer.
 - **Real `engram_*` runtime.** Currently stub. Adding in-process graph store with spreading activation, Hebbian strengthening, and disk persistence — see Section 16.4.
 - **Real `dharma_*` runtime.** Currently stub. Adding network transport, channel registry, identity resolution.
@@ -96,8 +98,10 @@ The following words are reserved and cannot be used as identifiers. Each row not
 | `while` | yes | Loop |
 | `import` / `from` / `as` | yes | Module import |
 | `true` / `false` | yes | Bool literals |
-| `cgi` | planned | Top-level CGI declaration block |
+| `cgi` | yes | Top-level CGI declaration block |
-| `manager` / `engine` / `accessor` | as decorators | VBD role marker on `fn` (enforcement planned) |
+| `service` | yes | Top-level capability-bounded declaration block |
+| `program` | yes | Top-level cross-cutting declaration block (Section 18) |
+| `manager` / `engine` / `accessor` | as decorators | VBD role marker on `fn`; enforcement and boundary auto-emit are live (Section 9) |
 | `vessel` | planned | Manifest declaration (replaces `package`) |
 | `activate` / `where` | planned | Spreading-activation construct |
 | `sealed` | planned | Capability scope block |
@@ -446,9 +450,21 @@ Parsed. The module name is recorded; the brace-list is consumed. Both forms prod
 fn handle(channel: String, msg: String) -> Void { … }
 ```
 
-The `@` token followed by an identifier attaches a decorator name to the next `FnDef`. Decorators with structural meaning today: none. Planned enforcement (Section 16.2): VBD roles `@manager`, `@engine`, `@accessor`.
+The `@` token followed by an identifier attaches a decorator to the next `FnDef`.
 
-Non-VBD decorators are accepted and ignored.
+**Decorators take arguments and they stack.** `@route("/p", "GET") @manager fn f()` attaches both to `f` as a `decorators` list of `{name, args}` records, topmost-first. Arguments are string literals only.
+
+**Decorators have structural meaning today.** This is El's function-level boundary seam — the mechanism by which a cross-cutting concern is handled *at the boundary* rather than by a convention repeated at every call site:
+
+| Decorator | Structural effect |
+|---|---|
+| `@manager` | Permits calls to `dharma_emit` / `dharma_field`. Calling either from a non-`@manager` fn emits a `#error` into the generated C — a compile-time failure, not a lint. |
+| `@manager`, `@accessor` | Codegen injects one call to `engram_boundary_beat(<fn name>)` at function entry. The decorated op self-reports (chrono tick, afferent counter, self-activity strengthen, dharma bus event) with **zero** hand-written instrumentation in its body. |
+| `@route(path, method, …)` | Records a route into a generated dispatch table. |
+
+Decorators with no registered meaning are accepted and ignored.
+
+**Limits of the seam, as it stands.** The injection is a *prologue only* — there is no epilogue, no wrapping of the call, and no way for a decorator to run code after the body returns. The injected callee is a fixed builtin chosen by the compiler, not derived from the decorator name or its arguments. Section 19 depends on lifting exactly these two limits.
 
 ---
 
@@ -1088,4 +1104,152 @@ The next minor version closes the implementation gaps named in this document. Tr
 
 ---
 
+## 18. The Program Block — cross-cutting concerns [implemented]
+
+### 18.0 Why this exists
+
+A cross-cutting concern is one that belongs to the *process*, not to any function in it: only one of me may run; this is what my configuration is; every mutation must be durable; every request must be authorized.
+
+El's units of encapsulation are the function and the module. Neither can hold a concern like that. So each one had been expressed the only way it could be — as a **convention**: *call this at every site.* Conventions of that shape do not hold. They are not enforced by anything, they are invisible in review, and they fail silently at the one site somebody forgot.
+
+Measured in this codebase before this section existed:
+
+| Concern | State | What the convention was |
+|---|---|---|
+| process identity | **zero** guards anywhere — no pidfile, no lock, no already-running check, at any layer | "check nothing is already running first" |
+| configuration | **20** distinct environment variables in one program, each with its default written inline at the read site | "remember the right default here" |
+| durability | **62** `persist_*` / `engram_save` / `wal_*` / `checkpoint` call sites | "after you mutate, remember to persist" |
+| request auth | **10** per-route `_auth` checks | "check the token in this handler too" |
+
+These are not four problems. They are one absence, four times.
+
+That the convention form fails is observed, not predicted. Process identity failed three times in a single day: twice, two engram processes ran simultaneously against the same data directory; twice, a stale binary held a port and answered probes while a fresh build was believed to be under test, because `pkill -f` had silently failed to match its argv — which nearly produced a false "the fix does not work" conclusion. Configuration failed structurally: `ENGRAM_DATA_DIR` was read at six sites, five of them dead bindings, and the sixth defaulted to `/tmp/engram` — contradicting the canonical resolver's `$HOME/.neuron/engram` and landing a pre-destructive safety backup on ephemeral storage.
+
+The `program` block is where a concern of this shape is declared once and enforced by the compiler at the process boundary.
+
+### 18.1 Syntax
+
+```
+program "engram" {
+    singleton: "engram"
+    env ENGRAM_BIND:    String = ":8742"
+    env GUIDE_PORT:     Int    = "8771"
+    env ENGRAM_API_KEY: String required
+}
+```
+
+At most one `program` block per program. It composes with `cgi` and `service` — those declare what a program *may do*; `program` declares what a program *is*.
+
+Grammar:
+
+```ebnf
+program_block = "program" string "{" { program_field } "}" ;
+program_field = singleton_field | env_field ;
+singleton_field = "singleton" ":" string [ "," ] ;
+env_field       = "env" ident ":" type
+                  [ "=" string ] [ "required" ] [ "," ] ;
+```
+
+`singleton` and `env` are **not** reserved words. They are read as identifier token values by the block's own parse loop, so they remain usable as ordinary identifiers everywhere else. `program` is the only keyword this section adds.
+
+### 18.2 Process identity — `singleton`
+
+`singleton: "id"` compiles to an `el_singleton_acquire("id")` call injected as the **first statement of `main()`**, before any user statement runs.
+
+The runtime takes an exclusive non-blocking `flock` on `<dir>/el-singleton-<id>.lock`, where `<dir>` is `$EL_SINGLETON_DIR`, else `$TMPDIR`, else `/tmp`. On success it writes its pid and holds the descriptor open for the life of the process. On contention it **refuses to start**: it reports the holder's pid, names the lock file, and exits 1.
+
+Two properties are deliberate:
+
+- **It is a lock, not a pidfile.** The kernel releases an `flock` when the owning process dies — including on `SIGKILL` and on crash. There is therefore no stale-lock state, and so no "delete the lock file to get unstuck" recovery ritual. Such a ritual would itself be a convention, which is the thing this section exists to remove.
+- **It reports the holder's pid.** "Already running" is not actionable. A pid is. This is the direct answer to the observed failure where a stale process survived a `pkill` and went on answering probes.
+
+Refusal is loud and total. It is not a warning, and the program does not continue degraded. This matters more than it looks: today a second engram whose `bind()` fails merely *returns* from `http_serve` — after it has already replayed the WAL and written boot-time backup files — and then exits **0**, indistinguishable from a clean run. `singleton` refuses before the first side effect.
+
+### 18.3 Configuration — `env`
+
+Each `env` entry declares one configuration variable: its name, its type (`Int` or `String`), and either a default or `required`.
+
+Resolution happens once, at startup, in declaration order: **the environment wins; the declaration supplies the fallback.** Then `el_config_validate` checks the whole schema and reports *every* problem at once before exiting — a startup that fails one variable at a time costs one restart per variable.
+
+Values are read with `config("NAME")`, which returns a `String`.
+
+The enforcement that makes the declaration real: **once a program block exists, `config("X")` for an undeclared `X` is a fatal error.** Without that, the schema would be advisory, and an advisory schema is just another convention. Programs with no `program` block are unaffected — `config()` falls back to a plain environment read, so migration is incremental and per-program.
+
+The point is not that configuration is now centralized. It is that **a default is no longer a decision made at a read site.** A read site cannot disagree with another read site about what a variable means, because a read site no longer says.
+
+### 18.4 What is deliberately not declared here
+
+Some values look like configuration and are not. `ENGRAM_DATA_DIR` already has a single owner — `engram_resolve_data_dir()`, which resolves it, creates the directory, and fails loud rather than silently persisting to an ephemeral path. Declaring it in the `program` block as well would give it two owners that can disagree, recreating the precise defect this section removes.
+
+The rule: **a variable belongs in the program block when the block would be its only owner.** If a resolver already owns it, leave it there.
+
+`HOME` is likewise not configuration. It is an environment fact, and stays a raw `env()` read.
+
+---
+
+## 19. Boundary Effects — durability and request authorization [design only, not implemented]
+
+Sections 19.1 and 19.2 specify the two remaining concerns from the table in 18.0. Both are **designed and deliberately unimplemented.** The reason is stated in 19.3 and it is not difficulty.
+
+### 19.1 Durability as an epilogue effect
+
+**The defect.** 62 call sites carry the convention *"after you mutate, remember to persist."* This is structurally the same defect as the index bug being fixed elsewhere in this tree — *"after you append, remember to index"* — which failed at **9 of 9** sites. A convention that failed at 100% of its sites is the strongest available evidence about what this class of convention is worth.
+
+**Why the existing seam cannot express it.** §9's injection is a prologue. Durability is inherently an *epilogue*: persist after the mutation succeeds, and not at all if it threw. The seam has no epilogue.
+
+**Design.** Extend the decorator seam from prologue-only to prologue/epilogue, then declare durability as an effect on the mutating function:
+
+```
+@durable("engram")
+fn engram_write_node(id: String, body: String) -> Bool { … }
+```
+
+Codegen wraps rather than prefixes:
+
+```c
+el_val_t engram_write_node(el_val_t id, el_val_t body) {
+    el_effect_enter(EL_STR("durable"), EL_STR("engram"));
+    el_val_t __r = /* original body */;
+    el_effect_exit(EL_STR("durable"), EL_STR("engram"), __r);
+    return __r;
+}
+```
+
+`el_effect_exit` is where the persist happens, and it is the only place it happens. Two properties follow that the 62 hand-written sites cannot have:
+
+- **Coalescing.** The epilogue is a single choke point, so N mutations inside one request can produce one fsync instead of N. The hand-written form cannot coalesce, because no site knows about the others.
+- **Failure is not silent.** A persist that fails inside `el_effect_exit` can force the mutation's return value to failure. A forgotten `persist_*` call cannot fail — it simply does not happen, which is exactly why the defect is invisible.
+
+**Enforcement, and this is the part that actually fixes it.** Mirroring §9's `#error` for `dharma_emit`: a function that calls a mutating primitive without carrying `@durable` is a **compile error**. Otherwise this is a 63rd thing to remember rather than a replacement for 62.
+
+### 19.2 Request authorization as a route effect
+
+**The defect.** 10 per-route `_auth` checks. The HTTP layer has no concept of authorization, so a new route is unauthenticated by default and silently so — the failure mode is a route that forgot, and nothing anywhere reports it.
+
+**Design.** Authorization becomes an argument to the `@route` decorator, which already takes arguments and already builds a dispatch table:
+
+```
+@route("/api/write", "POST", auth: "required")
+fn route_write(body: String) -> String { … }
+```
+
+The generated dispatcher performs the check **before** dispatch, so an unauthorized request never reaches the handler and the handler contains no auth code at all.
+
+The default must be `required`. A route that says nothing gets authorization; opening one up takes an explicit `auth: "public"`. Defaulting to public preserves the current failure mode exactly — forgetting stays silent — and a default that preserves the defect is not a fix.
+
+Route inventory falls out for free: the dispatch table already exists, so the compiler can emit the full route/auth matrix and make "which routes are public" a fact that is read rather than audited.
+
+### 19.3 Why these are not implemented
+
+Not difficulty — **collision**. Both land squarely in regions two other agents hold right now:
+
+- **Durability** requires changing the mutation and persist paths in `lang/runtime/el_runtime.c` and `engram/src/server.el` — the same files and the same read/write paths being restructured by concurrent work on VIndex read-path mutation and memory ownership, and on geometry-as-an-el-value and `transduce`.
+- **Request auth** requires changing route dispatch in `engram/src/server.el`, which the geometry/`transduce` work is actively reshaping.
+
+Implementing either now would mean editing files under concurrent modification and resolving conflicts in exactly the paths whose correctness is currently under repair. The designs are recorded here so the work is not lost, and so that whoever lands them does so against a settled tree.
+
+The prerequisite for 19.1 is the same in both cases: **lift the §9 seam from prologue-only to prologue/epilogue.** That change is independent of both collisions and can land first.
+
+---
+
 End of specification.

lang/spec/runtime-ownership.md

@@ -0,0 +1,180 @@
+# El Runtime — Ownership and Capability ABI
+
+**Status:** §0–§2 verified. §3 re-derived and **built** for the vector index (2026-08-16); not yet applied to the resident RAM graph.
+**Date:** 2026-08-16
+**Scope:** `lang/runtime/` — every El program (soul, engram, cgi-studio vessels) inherits this by rebuild. Nothing in this document is a change to any El *program*.
+
+**Note on §1's line numbers:** they were read against a checkout that has since shifted by ~135 lines. Verified positions as of `a67452f` are in §2a.
+
+---
+
+## 0. The residual
+
+> **Builtins own memory and reach process state directly.**
+
+That is the residual — the generator. Everything below labelled a "residue" is a deposit left by it. The distinction matters because we have spent significant effort removing deposits, and deposits regenerate.
+
+A residue is fixed. A residual is eliminated. Fixing residues while the residual stands produces exactly the pattern observed on 2026-08-15/16: a run of individually-correct patches, each verified, followed by a new defect of the same shape in a different file.
+
+---
+
+## 1. The residues, measured
+
+Each of these is a distinct merged or proposed fix. Each addresses one deposit. None addresses the residual.
+
+| residue | location | fix that was applied or proposed |
+|---|---|---|
+| `state_get` leaked its return value per call — 15 MB over 200k calls | builtin | el #140 (merged) |
+| VIndex freed under a concurrent reader | `el_runtime.c:9424` | `fb32d15` guard (merged 08:46:43) |
+| `_eg_vindex_seen` realloc'd on a read path | `el_runtime.c:9412` | same guard |
+| `vindex_insert` on a read path | `el_runtime.c:9434`, `9450` | same guard |
+| shared `visited` / epoch scratch stomped by concurrent searches | `engram_vindex.c:79–81`, `169–186`, `195` | proposed: move to per-search frame |
+| nine append sites, none indexing → lazily-embedded nodes invisible | `el_runtime.c:7806, 7988, 8148, 8224, 11526, 11731, 12050, 15295, 15312` | "embed-gap #20", patched by making the *read* path catch up (`9439` comment) |
+
+**Measured:** all file/line references above, read 2026-08-16. Crash frames `engram_activate → eg_vindex_sync → vindex_insert → _realloc → _xzm_xzone_malloc_freelist_outlined` are accounted for by rows 2–4.
+
+**Inferred, not yet verified:** that the nine append sites do not share a single commit point. This needs one pass before Change C is sized.
+
+---
+
+## 2. Why these are one defect
+
+`eg_vindex_sync` (`el_runtime.c:9419`) has exactly three callers, and **all three are reads**:
+
+- `engram_activate` — `9802`
+- `eg_knn_for_node` — `13075` (its own header comment states *"No writes."*)
+- `engram_geo_reify_run_json` — `13285`
+
+It mutates five process-global statics (`9400–9404`): `_eg_vindex`, `_eg_vindex_dim`, `_eg_vindex_built_nc`, `_eg_vindex_seen`, `_eg_vindex_seen_cap`.
+
+Reads mutate because index maintenance was never given an owner on the write side. It got bolted onto reads, because a builtin *could* reach the globals — nothing prevented it. Likewise `state_get` leaked because a builtin *owned* the value it returned; nothing prevented that either.
+
+The store is architecturally append-only and superseding. A read path that mutates contradicts that directly. The contradiction is expressible only because the ABI permits it.
+
+---
+
+## 2a. Verified positions and the fact §1 missed
+
+Read directly at `a67452f`, 2026-08-16. §1's line numbers predate a ~135-line shift; these are current.
+
+| thing | §1 said | actually |
+|---|---|---|
+| five process-global statics | 9400–9404 | **9535–9539** |
+| `eg_vindex_seen_ensure` realloc | 9412 | **9547** |
+| `eg_vindex_sync` | 9419 | **9554** |
+| `vindex_free` on a read path | 9424 | **9559** |
+| `vindex_insert` on a read path | 9434 / 9450 | **9569** (build) / **9585** (incremental) |
+| caller: `engram_activate_inner` | 9802 | **9939** |
+| caller: `eg_knn_for_node` | 13075 | **13212** |
+| caller: `engram_geo_reify_run_json` | 13285 | **13422** |
+| `fb32d15` guard | — | lock **1602**, depth **1631**, `eg_guard_enter` **1636**, `http_worker` acquire **1687**, `engram_activate` wrapper **14097** |
+| VIndex scratch fields | 79–81 | **79–81** ✓ |
+| `search_layer` race site | 195 | **195** ✓ |
+
+**The structural fact §1 and §3 both missed:** *the index does not inherit the store's append-only property.* `vindex_insert` rewires the `NeighList` links of already-existing elements and reallocs `elems[]` — so extending the index mutates the whole structure, not just its tail. This is why "make reads pure" is necessary but **not sufficient**, and why §3 needed a publication boundary rather than only a capability split. It is reproduced as a standing test (`unsynchronized` half, §5).
+
+---
+
+## 3. The change
+
+*(Re-derived 2026-08-16. The previous §3 — a runtime context struct carrying read/write **capability pointers** to every builtin — was written in mutable-store, C-ownership terms. It asked "who is permitted to mutate the shared thing?", which presupposes a shared mutable thing. The engram is immutable and recall is projection; what does not mutate needs no ownership discipline. So the question is not answered, it is dissolved. The implemented change is below.)*
+
+### 3.1 Three moves, in decreasing order of how much they dissolve
+
+**(1) Misfiled scratch is not shared state.** `visited` / `visit_epoch` were never conceptually owned by the index — they are one traversal's local, hoisted into `struct VIndex` as an allocation optimisation. Nothing about them is derived geometry. They want neither a lock nor a capability nor a checkout pool: a pure function's scratch belongs to its call frame, and the fix is to put it back there. This is not "the capability model applied by hand to one global"; it is the deletion of a false ownership claim.
+
+**(2) `const` is the capability, and immutability hands it over for free.** Once the scratch leaves the struct, `search_layer` reads the index and nothing else — so `vindex_search` can take a `const VIndex*`. That is *precisely* the teeth old-§3 wanted from capability pointers: a read path physically cannot call `vindex_insert`, and it is a **compile error**, not a review comment. It costs one qualifier rather than a new ABI swept across hundreds of builtins. The compiler enforces it on every future caller for the same reason.
+
+> The capability type was already in the language. It is spelled `const`.
+
+**(3) What remains is a publication problem, not an ownership problem.** With scratch in the frame and reads const, one hazard survives, and it is real: **HNSW insert is not an append.** `vindex_insert` rewires the `NeighList` links of *already-existing* elements and reallocs `elems[]`. The store's append-only property does **not** transfer to the index derived from it. So a reader projecting against the index while its owner extends it is unsafe no matter how pure search is.
+
+Immutability answers this too, and the answer is publication:
+
+- **`eg_vindex_maintain`** — the sole mutator. Takes the boundary exclusively; never runs beside a reader.
+- **`eg_vindex_view`** — returns a `const VIndex*` with the boundary held for read. N readers project concurrently; none can mutate.
+
+A read path may **demand that a current snapshot exist** — that is a request to the owner, not a mutation by the reader. What it may not do is mutate the geometry it is projecting against. `view` / `maintain` is exactly that split, and it is why this replaces `eg_vindex_sync` rather than wrapping it.
+
+**Write-side owner.** Index membership is owned by the event *"an embedding became present on this ordinal"* — not by node append, since a node without an embedding cannot be in a vector index at all. `eg_vindex_note_embedded` hooks the embedding-assignment sites: one O(log n) insert, no O(node_count) presence scan. This also retires the "STALENESS (honest tradeoff)" note in the old `eg_vindex_sync`, where a lazily-embedded *older* node stayed invisible to `route_nearest` / autoconnect until the next full rebuild.
+
+### 3.2 What this does not claim
+
+The **resident RAM graph** (`g->nodes` / `g->edges`) is a *separate* residue of the same residual and is untouched by this change. It is realloc'd in place (`el_runtime.c:7618`, `7629`), so an awareness-thread reader holding `EngramNode* n = &g->nodes[i]` across a concurrent append holds a dangling pointer — and `engram_activate_inner`'s embed-backfill writes `n->emb` through exactly such a pointer. It wants the same publication treatment the index just received. Until that lands, the `fb32d15` guard stays (see §5).
+
+---
+
+## 4. Why this is not a large change
+
+The old §4 argued that El owning its compiler makes a capability-ABI sweep mechanical, since `elc` generates every builtin call site. That argument was load-bearing only for the ABI, and the ABI is gone.
+
+The constraint now travels with the **type of the thing**, not the shape of every call site — so no sweep is needed at all. Measured extent of the implemented change: two qualifiers (`const VIndex*` on `vindex_search`, propagated to `engram_geometry_descriptor` and `engram_geo_reify_store`), one struct field group relocated to a call frame, one rwlock, and three read call sites converted from `eg_vindex_sync` to `view`/`release`.
+
+The payoff of owning the language is unchanged and is now *cheaper*: introduced once, enforced by the compiler on every future builtin, cannot subsequently be forgotten. Contrast the current state, where the same discipline was maintained by hand across hundreds of builtins and demonstrably failed at least six times.
+
+---
+
+## 5. What this deletes
+
+**Deleted (done, 2026-08-16):**
+
+- `eg_vindex_sync` — the function itself. Not renamed: split into `eg_vindex_maintain` (mutating, exclusive, sole owner) and `eg_vindex_view` (const, shared). A name that meant "read paths repair the index" had to stop existing.
+- `VIndex::visited` / `visit_epoch` / `visited_cap` — the struct fields, `visited_ensure`, its call from `elems_reserve`, `ix->visit_epoch = 0` in `vindex_create`, and `free(ix->visited)` in `vindex_free`.
+- The **proposed** per-search scratch *struct on the index* (a checkout pool / `VisitedListPool`) — never built. The buffer is a plain frame local; a pool is machinery for an ownership question that no longer exists.
+- The **proposed** reader-view / owner-handle split for VIndex specifically — superseded. `const` already is the reader view.
+- `EXPECT_RACE` in `run_vindex_concurrency_tests.sh` — a knob that let a known defect ride as "expected". Replaced by four halves with real verdicts.
+
+**NOT deleted — the design doc was wrong about this one:**
+
+- `fb32d15` (`eg_guard_enter` / `engram_req_lock` / `_eg_req_depth`). §5 originally called for its removal as "a lock protecting a mutation that ceases to exist." **Measured, it guards two things, and only one of them ceases to exist.** Its own comment names both: the RAM graph *and* `_eg_vindex`. The vindex justification is retired; the RAM-graph justification is independently load-bearing (§3.2), and removing the guard reintroduces the measured 11171→9579 edge-loss defect from 2026-08-14. Its comment has been narrowed to state the RAM graph only. **Precondition for deleting it:** the resident graph gets the same publication boundary the index just got.
+- el #140's hand-patch. Left in place — the leak stops being *expressible* only under the abandoned capability-ABI §3, which is not what was built.
+
+**Ordering consequence (revised):** the original ordering claim — "the residual lands first, the residues evaporate rather than get fixed" — did not survive contact. The residual here is not a single ABI that dissolves everything at once; it is a *property* (derived state is published, never edited) applied per structure. The index now has it. The RAM graph does not yet. Residues evaporate **per structure, in the order the property is applied**, and a residue whose structure has not been converted must be left standing, not deleted on the strength of the plan.
+
+---
+
+## 6. Sequencing
+
+1. **Read** how builtins are declared and dispatched, to confirm the call sites are compiler-generated in one place. *(This determines whether §4 holds. If dispatch is scattered, re-size before proceeding.)*
+2. Introduce the context type and capability types.
+3. Codegen emits the context at every builtin call site.
+4. Mechanical sweep of builtin signatures.
+5. Move index maintenance behind the write capability; the three read callers take the read capability.
+6. Delete the residue-fixes listed in §5.
+7. **One** build of soul from el dev — which resolves the `state_get` leak and the crash together, rather than deploying a leak fix that reintroduces the crash.
+
+---
+
+## 7. Open questions
+
+**Answered 2026-08-16:**
+
+- ~~Do the nine append sites share a commit point?~~ **Moot.** The question was mis-aimed: node append is not the event that owns index membership, because a node without an embedding cannot be in a vector index. The five *embedding-assignment* sites are the real owner points (`el_runtime.c:7091, 9839, 13362, 15002`, plus snapshot-restore at `7951`), and three of them carry the ordinal directly — which is all `eg_vindex_note_embedded` needs. The other two run before the node is resident, where the cold build picks it up.
+- ~~Does anything outside `lang/runtime/` construct a second `VIndex`?~~ **No.** Swept: the only constructors outside the runtime are `engram/test/*` and `lang/runtime/vindex_bench.c`, all single-threaded and index-private. Inside the runtime, `engram_self_reify_beat_json` builds a **private** index deliberately and never touches the shared boundary — that was already correct and is unchanged.
+- ~~Does the HTTP worker pool contend on the same globals?~~ **Yes, and it was never the whole story.** Workers serialize against each other on `engram_req_lock`, but the awareness main thread does not take it at all — that is the gap `fb32d15` closed. Now verified independent of that guard: the index boundary is its own rwlock, so worker/awareness contention on `_eg_vindex` is handled whether or not the request lock is held.
+
+**Still open:**
+
+- The resident RAM graph wants the same publication boundary (§3.2). Until it has one, `fb32d15` cannot be deleted.
+- `eg_vindex_view` holds the boundary for read across `engram_geo_reify_store`, which is a long pass. Correct, but it stalls the owner for that duration. If reify latency becomes a problem the answer is a refcounted snapshot, not a shorter lock.
+
+---
+
+## 7a. Evidence (measured 2026-08-16, `engram/test/run_vindex_concurrency_tests.sh`)
+
+| half | before | after |
+|---|---|---|
+| `single` — 3000 vectors, 1 thread, ASan+UBSan | clean | clean |
+| `readers` — 4 readers, no writer, TSan | **race** at `engram_vindex.c:195` (`visited_reset` ← `vindex_search`) | **clean** |
+| `unsynchronized` — writer+reader, bare index, TSan | race | **race, expected and permanent** — now the proof the boundary must exist |
+| `published` — owner + 4 readers through the boundary, TSan | *(did not exist)* | **clean**, all 3000 inserts landed |
+
+No recall regression: `recall@10 = 0.9365` at `ef_search=128` (gate ≥ 0.90); the determinism test still yields byte-identical results across two independent builds.
+
+Builds locally: all seven engram runtime translation units compile `-Wall -Wextra` clean, and the full engram binary links (`engram/dist/engram.c` + runtime, arm64). The one pre-existing `-Wcomment` warning in `el_runtime.c` is present at `a67452f` too.
+
+---
+
+## 8. What this document is not
+
+It is not an argument for a memory model in general, a garbage collector, process isolation between soul and engram, or a client/server split of the store. Each of those was considered and each addresses mutation that this change removes. They are answers to a question that stops being asked.

lang/tests/native/test_transduce.el

@@ -0,0 +1,534 @@
+import "../../runtime/eltest.el"
+// test_transduce.el — transduction produces a SUBGRAPH, not a point.
+//
+// WHAT IS ACTUALLY UNDER TEST. #144 moved transduction into the language and
+// got the dispatch right: realizers declared in El, resolved by name, no
+// runtime patch per modality. It got the RESULT TYPE wrong —
+// `transduce(signal, modality) -> Geometry`, one vector per signal.
+//
+// One vector is a FINGERPRINT. It can be matched and it can be ranked, and
+// that is the whole of what it can ever do. It cannot be decomposed, cannot
+// have one part grounded while another is not, and cannot be contradicted in
+// one part while holding in another — because it has no parts. Treating
+// transduction as a CONVERSION (signal in, position out) is the premise this
+// file exists to falsify.
+//
+// A song is not a point. It decomposes into pitch, interval, rhythm, harmonic
+// function — components, each with its own geometry, plus the relations among
+// them. THE SONG IS THE STRUCTURE OF THE RELATIONS. So transduction yields a
+// Manifold: named components carrying geometry, and typed weighted relations
+// between them.
+//
+// The geometry tests below are UNCHANGED from #144 and still pass, which is
+// the point: Geometry was never wrong, it was misplaced. A vector is the right
+// representation for a COMPONENT. It was only ever wrong as the representation
+// of a whole transduced signal.
+//
+// COMPARISON DISCIPLINE IN THIS FILE (measured 2026-08-16, not stylistic):
+// elc lowers `a == b` to a NUMERIC comparison only when both operand names are
+// in the per-function int-name set, which `let x: Int` populates. A bare call
+// like `manifold_size(m) == 5` is not a registered name, so it lowers to
+// `str_eq(...)` — strcmp on two integers reinterpreted as pointers. `<` and `>`
+// lower directly via binop_to_c with no type inference at all, so truthiness is
+// written `> 0` / `< 1` here, and any exact `==` is done on a value first bound
+// through `let x: Int`.
+//
+// ONE FURTHER RULE, measured while writing this file: that int-name set LEAKS
+// ACROSS `test` BLOCKS. Binding `dn` as a Float in one test and as an Int in
+// another silently demoted the Int comparison to str_eq and failed an
+// assertion that was arithmetically true. Every Int-bound name compared with
+// `==` here is therefore spelled UNIQUELY across the whole file (note_dim,
+// iv_dim, ...), rather than reusing a short name per test.
+
+// ── A DECOMPOSING realizer, written entirely in El ──────────────────────────
+// "tone" signals are note letters, e.g. "CEG". This realizer does NOT return
+// one vector for the chord. It returns the PARTS — one component per note, one
+// per interval between adjacent notes — and the relations that make those
+// parts a chord rather than an unordered bag of pitches.
+//
+// The interval is deliberately a COMPONENT, not an attribute of a note. An
+// interval is a thing with its own geometry that belongs to neither endpoint;
+// modelling it as a field on a note is exactly the collapse this change
+// rejects, one level down.
+fn tone_realizer(signal: String) -> Manifold {
+    let m: Manifold = manifold_new()
+    let n: Int = str_len(signal)
+
+    let i: Int = 0
+    while i < n {
+        let code: Int = str_char_code(signal, i)
+        let g: Geometry = geometry_new(2)
+        let s0: Int = geometry_set(g, 0, int_to_float(code))
+        let s1: Int = geometry_set(g, 1, int_to_float(i))
+        let idx: Int = manifold_add(m, "note:" + int_to_str(i), "pitch", g)
+        let f: Int = geometry_free(g)
+        i = i + 1
+    }
+
+    let j: Int = 1
+    while j < n {
+        let a: Int = str_char_code(signal, j - 1)
+        let b: Int = str_char_code(signal, j)
+        let lo: String = "note:" + int_to_str(j - 1)
+        let hi: String = "note:" + int_to_str(j)
+        let key: String = "interval:" + int_to_str(j - 1) + "-" + int_to_str(j)
+        let g: Geometry = geometry_new(1)
+        let s: Int = geometry_set(g, 0, int_to_float(b - a))
+        let idx: Int = manifold_add(m, key, "interval", g)
+        let f: Int = geometry_free(g)
+        let e1: Int = manifold_relate(m, key, "spans", lo, 0.9)
+        let e2: Int = manifold_relate(m, key, "spans", hi, 0.9)
+        let e3: Int = manifold_relate(m, lo, "sounds_before", hi, 0.8)
+        j = j + 1
+    }
+    m
+}
+
+// A second realizer for a different modality, to prove the registry keys on
+// modality and does not just hand back "the last thing registered". Its
+// decomposition has a DIFFERENT shape — two components, one relation — so a
+// test can tell the two organs apart by structure alone.
+fn pulse_realizer(signal: String) -> Manifold {
+    let m: Manifold = manifold_new()
+    let ga: Geometry = geometry_new(1)
+    let sa: Int = geometry_set(ga, 0, 1.0)
+    let ia: Int = manifold_add(m, "onset", "event", ga)
+    let fa: Int = geometry_free(ga)
+    let gb: Geometry = geometry_new(1)
+    let sb: Int = geometry_set(gb, 0, 0.0)
+    let ib: Int = manifold_add(m, "decay", "envelope", gb)
+    let fb: Int = geometry_free(gb)
+    let e: Int = manifold_relate(m, "onset", "decays_into", "decay", 0.7)
+    m
+}
+
+// #144's ACTUAL CONTRACT, preserved verbatim as a control: a realizer that
+// returns one vector for the whole signal. This is not a strawman — it is what
+// the merged primitive asked realizers to be. It must now transduce NOTHING.
+fn fingerprint_realizer(signal: String) -> Geometry {
+    let g: Geometry = geometry_new(4)
+    let n: Int = str_len(signal)
+    let a: Int = geometry_set(g, 0, int_to_float(n))
+    let b: Int = geometry_set(g, 1, int_to_float(n * 2))
+    g
+}
+
+// A realizer returning something that is not a value at all.
+fn bogus_realizer(signal: String) -> Manifold {
+    return 12345
+}
+
+// ═══════════════════════════════════════════════════════════════════════════
+// Geometry — unchanged from #144. A vector is the right representation for a
+// COMPONENT; it was only ever wrong as the representation of a whole signal.
+// ═══════════════════════════════════════════════════════════════════════════
+
+test "geometry-is-a-value-with-its-own-width" {
+    let g: Geometry = geometry_new(8)
+    let live: Int = geometry_is(g)
+    assert live > 0, "geometry_new returns a live Geometry"
+    let d: Int = geometry_dim(g)
+    assert d == 8, "a Geometry carries its own width"
+    let freed: Int = geometry_free(g)
+    assert freed > 0, "geometry_free reports what it did"
+}
+
+test "geometry-rejects-nonsense-without-an-arbitrary-bound" {
+    let zero: Geometry = geometry_new(0)
+    let z: Int = geometry_is(zero)
+    assert z < 1, "dim 0 is not a geometry"
+    let neg: Geometry = geometry_new(-4)
+    let n: Int = geometry_is(neg)
+    assert n < 1, "negative dim is not a geometry"
+    let nd: Int = geometry_dim(0)
+    assert nd < 1, "geometry_dim of a non-geometry is 0"
+    let ni: Int = geometry_is(0)
+    assert ni < 1, "geometry_is of a non-geometry is 0"
+    let nf: Int = geometry_free(0)
+    assert nf < 1, "geometry_free of a non-geometry is a no-op"
+}
+
+test "geometry-components-round-trip" {
+    let g: Geometry = geometry_new(3)
+    let s0: Int = geometry_set(g, 0, 1.5)
+    let s1: Int = geometry_set(g, 1, -2.5)
+    assert s0 > 0, "set in range succeeds"
+    let oob: Int = geometry_set(g, 3, 9.0)
+    assert oob < 1, "set out of range is refused, not silently dropped"
+    let v0: Float = geometry_get(g, 0)
+    let d0: Float = v0 - 1.5
+    assert d0 < 0.001, "component 0 round-trips"
+    assert d0 > -0.001, "component 0 round-trips"
+    let v1: Float = geometry_get(g, 1)
+    let d1: Float = v1 + 2.5
+    assert d1 < 0.001, "component 1 round-trips (negative)"
+    assert d1 > -0.001, "component 1 round-trips (negative)"
+    let freed: Int = geometry_free(g)
+}
+
+test "hex-is-an-edge-adapter-and-derives-its-own-width" {
+    let g: Geometry = geometry_from_f32le_hex("0000803f00000040")
+    let live: Int = geometry_is(g)
+    assert live > 0, "valid hex decodes to a Geometry"
+    let hex_dim: Int = geometry_dim(g)
+    assert hex_dim == 2, "width is DERIVED from the input, never supplied"
+    let back: String = geometry_to_f32le_hex(g)
+    assert str_eq(back, "0000803f00000040"), "hex round-trips exactly"
+    let freed: Int = geometry_free(g)
+}
+
+test "hex-rejects-malformed-input" {
+    let empty: Geometry = geometry_from_f32le_hex("")
+    let e: Int = geometry_is(empty)
+    assert e < 1, "empty hex is not a geometry"
+    let ragged: Geometry = geometry_from_f32le_hex("0000803f0000")
+    let r: Int = geometry_is(ragged)
+    assert r < 1, "length not a multiple of 8 is refused"
+    let nonhex: Geometry = geometry_from_f32le_hex("zzzzzzzz")
+    let nh: Int = geometry_is(nonhex)
+    assert nh < 1, "non-hex characters are refused"
+}
+
+test "norm-lets-a-caller-check-a-realizer-emitted-signal" {
+    let g: Geometry = geometry_new(2)
+    let z: Float = geometry_norm(g)
+    assert z < 0.001, "a fresh geometry is zero — norm says so"
+    let s0: Int = geometry_set(g, 0, 3.0)
+    let s1: Int = geometry_set(g, 1, 4.0)
+    let nrm: Float = geometry_norm(g)
+    let dnorm: Float = nrm - 5.0
+    assert dnorm < 0.001, "3-4-5: norm is 5"
+    assert dnorm > -0.001, "3-4-5: norm is 5"
+    let freed: Int = geometry_free(g)
+}
+
+// ═══════════════════════════════════════════════════════════════════════════
+// Manifold — the corrected result of a transduction
+// ═══════════════════════════════════════════════════════════════════════════
+
+test "a-manifold-is-a-value-that-holds-parts-and-relations" {
+    let m: Manifold = manifold_new()
+    let live: Int = manifold_is(m)
+    assert live > 0, "manifold_new returns a live Manifold"
+    let fresh_sz: Int = manifold_size(m)
+    assert fresh_sz == 0, "a fresh manifold has no components"
+    let fresh_rc: Int = manifold_rel_count(m)
+    assert fresh_rc == 0, "a fresh manifold has no relations"
+    let freed: Int = manifold_free(m)
+    assert freed > 0, "manifold_free reports what it did"
+}
+
+test "manifold-accessors-are-total" {
+    let ni2: Int = manifold_is(0)
+    assert ni2 < 1, "manifold_is of a non-manifold is 0"
+    let ns: Int = manifold_size(0)
+    assert ns < 1, "manifold_size of a non-manifold is 0"
+    let nf2: Int = manifold_free(0)
+    assert nf2 < 1, "manifold_free of a non-manifold is a no-op"
+    let k: String = manifold_key(0, 0)
+    assert str_eq(k, ""), "manifold_key of a non-manifold is empty, never a crash"
+}
+
+test "components-are-addressed-by-key-not-by-index" {
+    // The key is what survives persistence: a component becomes a node, and it
+    // is separately groundable precisely because it is separately NAMED.
+    let m: Manifold = manifold_new()
+    let g: Geometry = geometry_new(1)
+    let s: Int = geometry_set(g, 0, 7.0)
+    let first_idx: Int = manifold_add(m, "rhythm", "temporal", g)
+    assert first_idx == 0, "the first component is index 0"
+    let found_idx: Int = manifold_index_of(m, "rhythm")
+    assert found_idx == 0, "a component is found by its key"
+    let missing: Int = manifold_index_of(m, "never_added")
+    assert missing < 0, "an unknown key resolves to -1, not to component 0"
+    let role: String = manifold_role(m, 0)
+    assert str_eq(role, "temporal"), "a component carries what KIND of part it is"
+    let f: Int = geometry_free(g)
+    let fm: Int = manifold_free(m)
+}
+
+test "a-duplicate-key-is-refused-because-addressing-must-be-unambiguous" {
+    let m: Manifold = manifold_new()
+    let g: Geometry = geometry_new(1)
+    let ok_idx: Int = manifold_add(m, "pitch", "spectral", g)
+    assert ok_idx == 0, "first add succeeds"
+    let dup: Int = manifold_add(m, "pitch", "spectral", g)
+    assert dup < 0, "two components answering to one name is not an addressing scheme"
+    let dup_sz: Int = manifold_size(m)
+    assert dup_sz == 1, "and the duplicate did not land"
+    let f: Int = geometry_free(g)
+    let fm: Int = manifold_free(m)
+}
+
+test "a-part-with-no-geometry-is-not-a-part" {
+    let m: Manifold = manifold_new()
+    let bad: Int = manifold_add(m, "ghost", "none", 0)
+    assert bad < 0, "a non-Geometry is refused as a component"
+    let empty_key: Int = manifold_add(m, "", "none", geometry_new(1))
+    assert empty_key < 0, "an unaddressable component is refused"
+    let none_sz: Int = manifold_size(m)
+    assert none_sz < 1, "nothing landed"
+    let fm: Int = manifold_free(m)
+}
+
+test "an-edge-to-a-nonexistent-endpoint-is-refused-not-dropped" {
+    // A decomposition that silently loses edges is indistinguishable from one
+    // that never had them.
+    let m: Manifold = manifold_new()
+    let g: Geometry = geometry_new(1)
+    let a: Int = manifold_add(m, "here", "part", g)
+    let dangling: Int = manifold_relate(m, "here", "points_at", "nowhere", 0.5)
+    assert dangling < 1, "an edge to an unknown target is refused"
+    let backwards: Int = manifold_relate(m, "nowhere", "points_at", "here", 0.5)
+    assert backwards < 1, "an edge from an unknown source is refused"
+    let dang_rc: Int = manifold_rel_count(m)
+    assert dang_rc < 1, "and no relation was recorded"
+    let f: Int = geometry_free(g)
+    let fm: Int = manifold_free(m)
+}
+
+test "a-component-owns-its-geometry-independently-of-the-caller" {
+    // manifold_add COPIES. Freeing the caller's vector must not disturb the
+    // component, or a decomposition would be unusable the moment it was built.
+    let m: Manifold = manifold_new()
+    let g: Geometry = geometry_new(2)
+    let s0: Int = geometry_set(g, 0, 42.0)
+    let idx: Int = manifold_add(m, "part", "kind", g)
+    let freed: Int = geometry_free(g)
+    assert freed > 0, "the caller freed its own vector"
+    let back: Geometry = manifold_geometry(m, 0)
+    let live: Int = geometry_is(back)
+    assert live > 0, "the component still has geometry"
+    let v: Float = geometry_get(back, 0)
+    let dv: Float = v - 42.0
+    assert dv < 0.001, "and it is the right geometry"
+    assert dv > -0.001, "and it is the right geometry"
+    let fb: Int = geometry_free(back)
+    let fm: Int = manifold_free(m)
+}
+
+// ═══════════════════════════════════════════════════════════════════════════
+// transduce — signal in, SUBGRAPH out
+// ═══════════════════════════════════════════════════════════════════════════
+
+test "a-realizer-declared-in-el-is-a-first-class-realizer" {
+    // THE CLAIM, unchanged from #144: tone_realizer is an ordinary El function.
+    // It is not in the runtime and the compiler knows nothing about it.
+    // Registering it by name is enough to make it the organ for a modality.
+    let reg: Int = realizer_register("tone", "tone_realizer")
+    assert reg > 0, "an El fn registers as a realizer by name"
+    let has: Int = realizer_has("tone")
+    assert has > 0, "the modality now has an organ"
+
+    let m: Manifold = transduce("CEG", "tone")
+    let live: Int = manifold_is(m)
+    assert live > 0, "transduce returns a real Manifold"
+    let fm: Int = manifold_free(m)
+}
+
+test "transduction-decomposes-a-signal-into-parts" {
+    // THE CENTRAL CLAIM. "CEG" is three notes. What comes back is not one
+    // vector standing for a chord — it is five addressable parts (three notes,
+    // two intervals) and six relations. A fingerprint has one part by
+    // construction and could not express this at any width.
+    let reg: Int = realizer_register("tone", "tone_realizer")
+    let m: Manifold = transduce("CEG", "tone")
+
+    let ceg_sz: Int = manifold_size(m)
+    assert ceg_sz == 5, "three notes and two intervals are five distinct parts"
+    let ceg_rc: Int = manifold_rel_count(m)
+    assert ceg_rc == 6, "and the parts stand in six stated relations"
+
+    // Every part is independently addressable BY NAME.
+    let n0: Int = manifold_index_of(m, "note:0")
+    assert n0 > -1, "the first note is addressable on its own"
+    let n2: Int = manifold_index_of(m, "note:2")
+    assert n2 > -1, "so is the third"
+    let iv: Int = manifold_index_of(m, "interval:0-1")
+    assert iv > -1, "so is the interval between the first two"
+
+    let fm: Int = manifold_free(m)
+}
+
+test "each-part-carries-its-own-geometry" {
+    let reg: Int = realizer_register("tone", "tone_realizer")
+    let m: Manifold = transduce("CEG", "tone")
+
+    // 'C' is 67. The note component's geometry is the note's, not the chord's.
+    let note_i: Int = manifold_index_of(m, "note:0")
+    let gn: Geometry = manifold_geometry(m, note_i)
+    let note_dim: Int = geometry_dim(gn)
+    assert note_dim == 2, "a note component has the width its realizer gave it"
+    let pitch: Float = geometry_get(gn, 0)
+    let dpitch: Float = pitch - 67.0
+    assert dpitch < 0.001, "and it is C, so the signal reached the El realizer"
+    assert dpitch > -0.001, "and it is C, so the signal reached the El realizer"
+
+    // Parts may have DIFFERENT widths. A single vector per signal cannot
+    // represent parts of unequal dimensionality at all.
+    let iv_i: Int = manifold_index_of(m, "interval:0-1")
+    let gi: Geometry = manifold_geometry(m, iv_i)
+    let iv_dim: Int = geometry_dim(gi)
+    assert iv_dim == 1, "an interval component has its own, different width"
+
+    let f1: Int = geometry_free(gn)
+    let f2: Int = geometry_free(gi)
+    let fm: Int = manifold_free(m)
+}
+
+test "the-relations-are-content-no-single-part-carries" {
+    // THE POINT OF THE WHOLE CHANGE. C->E is two semitones. That "2" is not a
+    // property of C and not a property of E; it exists only BETWEEN them. A
+    // representation with no relations cannot hold it, which is why collapsing
+    // a signal to one vector does not merely lose resolution — it loses a
+    // category of content.
+    let reg: Int = realizer_register("tone", "tone_realizer")
+    let m: Manifold = transduce("CEG", "tone")
+
+    let step_i: Int = manifold_index_of(m, "interval:0-1")
+    let gi: Geometry = manifold_geometry(m, step_i)
+    let step: Float = geometry_get(gi, 0)
+    let dstep: Float = step - 2.0
+    assert dstep < 0.001, "C to E is two semitones"
+    assert dstep > -0.001, "C to E is two semitones"
+
+    // And the interval is WIRED to both endpoints, so the structure says which
+    // two things it is the interval between.
+    let spans: Int = 0
+    let span_rc: Int = manifold_rel_count(m)
+    let k: Int = 0
+    while k < span_rc {
+        let rn: String = manifold_rel_name(m, k)
+        let rf: String = manifold_rel_from(m, k)
+        if str_eq(rn, "spans") {
+            if str_eq(rf, "interval:0-1") { spans = spans + 1 }
+        }
+        k = k + 1
+    }
+    assert spans == 2, "the interval is related to both notes it spans"
+
+    let fg: Int = geometry_free(gi)
+    let fm: Int = manifold_free(m)
+}
+
+test "relation-weight-is-the-grounding-carried-on-the-edge" {
+    // correspondence-and-censorship.md §1: grounding is an attribute of the
+    // edge and it IS the weight — one quantity, not a score computed beside
+    // it. A realizer states a relation and its weight is the claim.
+    let reg: Int = realizer_register("tone", "tone_realizer")
+    let m: Manifold = transduce("CE", "tone")
+
+    let ce_rc: Int = manifold_rel_count(m)
+    assert ce_rc == 3, "one interval yields two spans and one ordering"
+
+    let found_w: Int = 0
+    let k: Int = 0
+    while k < ce_rc {
+        let rn: String = manifold_rel_name(m, k)
+        if str_eq(rn, "sounds_before") {
+            let w: Float = manifold_rel_weight(m, k)
+            let dw: Float = w - 0.8
+            if dw < 0.001 { if dw > -0.001 { found_w = found_w + 1 } }
+        }
+        k = k + 1
+    }
+    assert found_w == 1, "the ordering relation carries the weight its realizer stated"
+
+    let fm: Int = manifold_free(m)
+}
+
+test "distinct-signals-decompose-differently" {
+    let reg: Int = realizer_register("tone", "tone_realizer")
+    let m2: Manifold = transduce("CE", "tone")
+    let m3: Manifold = transduce("CEG", "tone")
+    let two_sz: Int = manifold_size(m2)
+    let three_sz: Int = manifold_size(m3)
+    assert two_sz == 3, "two notes decompose into two notes and one interval"
+    assert three_sz == 5, "three notes decompose into three notes and two intervals"
+    // Structure differs, not just position: fingerprints of a two-note and a
+    // three-note signal have identical shape and differ only numerically.
+    let two_rc: Int = manifold_rel_count(m2)
+    let three_rc: Int = manifold_rel_count(m3)
+    assert two_rc < three_rc, "and the relational structure itself differs"
+    let f2: Int = manifold_free(m2)
+    let f3: Int = manifold_free(m3)
+}
+
+test "the-registry-keys-on-modality" {
+    let r1: Int = realizer_register("tone", "tone_realizer")
+    let rp: Int = realizer_register("pulse", "pulse_realizer")
+    assert rp > 0, "a second modality registers independently"
+    let mt: Manifold = transduce("CEG", "tone")
+    let mp: Manifold = transduce("CEG", "pulse")
+    let tone_sz: Int = manifold_size(mt)
+    let pulse_sz: Int = manifold_size(mp)
+    assert tone_sz == 5, "tone still routes to its own realizer"
+    assert pulse_sz == 2, "pulse routes to a different realizer, with its own decomposition"
+    let onset: Int = manifold_index_of(mp, "onset")
+    assert onset > -1, "and to that realizer's own component vocabulary"
+    let f1: Int = manifold_free(mt)
+    let f2: Int = manifold_free(mp)
+}
+
+test "no-organ-is-reported-as-no-organ" {
+    // A modality with no realizer must transduce to NOTHING. It must never
+    // fall back to embedding a description of the signal and calling that
+    // perception — that silent substitution is the original defect.
+    let has: Int = realizer_has("echolocation")
+    assert has < 1, "unregistered modality has no organ"
+    let m: Manifold = transduce("anything", "echolocation")
+    let live: Int = manifold_is(m)
+    assert live < 1, "no realizer means no manifold, not a fake one"
+}
+
+test "registration-of-an-unresolvable-name-fails-loudly" {
+    let bad: Int = realizer_register("ghost", "no_such_function_anywhere")
+    assert bad < 1, "an unresolvable realizer name is a registration failure"
+    let has: Int = realizer_has("ghost")
+    assert has < 1, "and nothing gets registered"
+}
+
+test "a-fingerprint-realizer-transduces-nothing" {
+    // THE SUPERSESSION OF #144, asserted directly. fingerprint_realizer is
+    // exactly what the merged primitive asked a realizer to be: signal in, one
+    // Geometry out. It resolves, so registration succeeds — the organ is
+    // present. But it does not decompose, so it does not transduce.
+    //
+    // This is a deliberate hard failure. "No organ" and "an organ that only
+    // fingerprints" must not be indistinguishable, which is the same
+    // distinction realizer_register already draws between an absent and a
+    // broken organ. A modality with genuinely one part says so with
+    // manifold_single, and is then visibly a size-1 manifold.
+    let reg: Int = realizer_register("fingerprint", "fingerprint_realizer")
+    assert reg > 0, "the symbol resolves, so registration succeeds"
+    let m: Manifold = transduce("x", "fingerprint")
+    let live: Int = manifold_is(m)
+    assert live < 1, "a single vector is not a transduction"
+}
+
+test "a-realizer-returning-nonsense-transduces-nothing" {
+    let reg: Int = realizer_register("bogus", "bogus_realizer")
+    assert reg > 0, "the symbol resolves, so registration succeeds"
+    let m: Manifold = transduce("x", "bogus")
+    let live: Int = manifold_is(m)
+    assert live < 1, "a non-Manifold return transduced nothing"
+}
+
+test "the-one-part-case-is-a-size-one-manifold-not-a-bare-vector" {
+    // Some modalities really do have one part. That is a manifold of size 1 —
+    // a special case of decomposition, not a parallel path back to a
+    // fingerprint. Anything reading it still asks manifold_size and still gets
+    // a real answer, and a second part can be added later without changing the
+    // type of the thing.
+    let g: Geometry = geometry_new(3)
+    let s: Int = geometry_set(g, 0, 5.0)
+    let m: Manifold = manifold_single("level", "scalar", g)
+    let live: Int = manifold_is(m)
+    assert live > 0, "manifold_single yields a real Manifold"
+    let one_sz: Int = manifold_size(m)
+    assert one_sz == 1, "of size one — visibly degenerate, not hidden"
+    let idx: Int = manifold_index_of(m, "level")
+    assert idx == 0, "and its one part is still addressable by name"
+    let f: Int = geometry_free(g)
+    let fm: Int = manifold_free(m)
+}