fix(engram): tokenized + ranked lexical search, not whole-query Ctrl-F

engram search/activate/goal-bias matched the ENTIRE raw query string as a
single case-insensitive substring (istr_contains(field, q)). Multi-word
queries like "windows msi signing" only matched a node containing that exact
contiguous run, so real multi-word queries returned ZERO on a graph saturated
with the answer. This is Ctrl-F, not search — and search is the core of the
engram being useful.

Fix: split the query on whitespace into distinct tokens; a node matches if it
contains ANY token in content/label/tags. Rank by distinct tokens matched
(desc) then salience (desc). istr_contains is kept unchanged as the per-token
primitive. Single-token queries are a strict special case (score 0 or 1) so
the many single-word callers do not regress.

Sites changed (all in el_runtime.c):
- new helpers engram_tokenize_query / engram_node_match_score / engram_rank_cmp
- engram_search           (internal el_val_t path)
- engram_search_json      (HTTP /api/search path)
- engram_activate seed loop (HTTP /api/activate path; seed activation scaled
  by token coverage so full-query matches seed more strongly)
- engram_goal_bias overlap bonus upgraded to graded token coverage

Proof (6591-node snapshot copy, rebuilt binary on :8799, POST JSON path):
  windows msi signing  0 -> 20   Will Anderson  0 -> 20
  windows msi          0 -> 20   tokenized search fix  0 -> 20
Single-word parity preserved (VBD/volatility/elc capped at limit; unkey = all
matching nodes). Top hits are relevant (e.g. "Will Anderson" surfaces the
Project Design and VBD whitepapers).

Note: GET ?q=a%20b still returns 0 because query_param (server.el) does not
URL-decode — a separate EL-layer bug; the soul's POST-JSON path is fixed here.

engram/src/server.el

@@ -50,12 +50,8 @@ fn query_param(path: String, key: String) -> String {
     if pos < 0 { return "" }
     let after: String = str_slice(qs, pos + str_len(needle), str_len(qs))
     let amp: Int = str_index_of(after, "&")
-    // SPEC-SEARCH-UPGRADE 2026-07-14: URL-decode the extracted value (%XX and
-    // '+' were previously passed through literally, so an encoded multi-word
-    // query arrived as junk tokens — pre-existing GET-path defect, masked
-    // until search could actually rank multi-word queries).
-    if amp < 0 { return url_decode(after) }
-    url_decode(str_slice(after, 0, amp))
+    if amp < 0 { return after }
+    str_slice(after, 0, amp)
 }
 
 fn query_int(path: String, key: String, default_val: Int) -> Int {

lang/el-compiler/runtime/el_runtime.c

@@ -82,14 +82,8 @@ static _Thread_local ElArena _tl_arena = {NULL, 0, 0};
 static _Thread_local int     _tl_arena_active = 0;
 
 /* Binary-safe fs_read length — set by fs_read, consumed by http_send_response.
- * Allows serving PNGs and other binary files without strlen truncation.
- * PAIRED with the buffer pointer it describes: the length may only be applied
- * to the exact buffer fs_read returned. Without the pairing, any handler that
- * fs_read a file and then WRAPPED it into a larger response had that response
- * truncated to the file's length (Content-Length lied AND the send stopped
- * short) — the safety-contact onboarding trap, 2026-07-17. */
-static _Thread_local size_t      _tl_fs_read_len  = 0;
-static _Thread_local const char* _tl_fs_read_buf  = NULL;
+ * Allows serving PNGs and other binary files without strlen truncation. */
+static _Thread_local size_t  _tl_fs_read_len  = 0;
 
 static void el_arena_track(char* p) {
     if (!_tl_arena_active || !p) return;
@@ -107,8 +101,6 @@ static void el_arena_track(char* p) {
 void el_request_start(void) {
     _tl_arena.count  = 0;
     _tl_arena_active = 1;
-    _tl_fs_read_len  = 0;     /* never let a previous request's file length */
-    _tl_fs_read_buf  = NULL;  /* leak into this response's byte accounting  */
 }
 
 /* Called by http_worker after the El handler returns and the response is sent.
@@ -1492,14 +1484,11 @@ static void http_send_response(int fd, const char* body) {
     }
 
     const char* eff_body = is_envelope ? env_body : body;
-    /* Use the real byte count from fs_read ONLY when this body IS the exact
-     * buffer fs_read returned (binary files with embedded null bytes — PNG,
-     * WOFF2, etc.). Any other body — wrapped, enveloped, or derived — must be
-     * measured with strlen, or it is truncated/over-read to the file's size. */
-    size_t blen = (_tl_fs_read_len > 0 && eff_body == _tl_fs_read_buf)
-                      ? _tl_fs_read_len : strlen(eff_body);
+    /* Use the real byte count from fs_read if available (handles binary files
+     * with embedded null bytes — PNG, WOFF2, etc.). Fall back to strlen for
+     * normal text/JSON responses where _tl_fs_read_len is 0. */
+    size_t blen = (_tl_fs_read_len > 0) ? _tl_fs_read_len : strlen(eff_body);
     _tl_fs_read_len = 0;  /* consume — one-shot per response */
-    _tl_fs_read_buf = NULL;
     int head_only = _tl_http_head_only;
 
     JsonBuf hdrs; jb_init(&hdrs);
@@ -1579,22 +1568,11 @@ static void* http_worker(void* arg) {
             const char* rs = EL_CSTR(r);
             /* Copy response out BEFORE arena teardown.
              * For binary files, _tl_fs_read_len holds the real byte count —
-             * use memcpy instead of strdup so null bytes are preserved.
-             * The stored length applies ONLY when the response IS the exact
-             * fs_read buffer; a wrapped/derived response must use strlen or
-             * it gets truncated (or over-read) to the file's length. */
-            size_t rlen;
-            if (_tl_fs_read_len > 0 && rs && rs == _tl_fs_read_buf) {
-                rlen = _tl_fs_read_len;   /* raw file bytes — binary-safe */
-            } else {
-                rlen = rs ? strlen(rs) : 0;
-                _tl_fs_read_len = 0;      /* hint doesn't describe this body */
-                _tl_fs_read_buf = NULL;
-            }
+             * use memcpy instead of strdup so null bytes are preserved. */
+            size_t rlen = _tl_fs_read_len > 0 ? _tl_fs_read_len : (rs ? strlen(rs) : 0);
             response = malloc(rlen + 1);
             if (response && rs) { memcpy(response, rs, rlen); response[rlen] = '\0'; }
             else if (response) { response[0] = '\0'; }
-            if (_tl_fs_read_len > 0) _tl_fs_read_buf = response; /* hint follows the copy */
         } else {
             response = el_strdup_persist("el-runtime: no http handler registered");
         }
@@ -1844,20 +1822,10 @@ static void* http_worker_v2(void* arg) {
             el_val_t hmap = http_build_headers_map(hdr_block ? hdr_block : "");
             el_val_t r = h(EL_STR(dispatch_method), EL_STR(path), hmap, EL_STR(body));
             const char* rs = EL_CSTR(r);
-            /* Same pairing rule as the v1 worker: the fs_read length is only
-             * trustworthy for the exact buffer fs_read returned. */
-            size_t rlen;
-            if (_tl_fs_read_len > 0 && rs && rs == _tl_fs_read_buf) {
-                rlen = _tl_fs_read_len;   /* raw file bytes — binary-safe */
-            } else {
-                rlen = rs ? strlen(rs) : 0;
-                _tl_fs_read_len = 0;      /* hint doesn't describe this body */
-                _tl_fs_read_buf = NULL;
-            }
+            size_t rlen = _tl_fs_read_len > 0 ? _tl_fs_read_len : (rs ? strlen(rs) : 0);
             response = malloc(rlen + 1);
             if (response && rs) { memcpy(response, rs, rlen); response[rlen] = '\0'; }
             else if (response) { response[0] = '\0'; }
-            if (_tl_fs_read_len > 0) _tl_fs_read_buf = response; /* hint follows the copy */
             el_release(hmap);
         } else {
             response = el_strdup_persist(
@@ -2055,7 +2023,6 @@ el_val_t http_response(el_val_t status, el_val_t headers_json, el_val_t body) {
 el_val_t fs_read(el_val_t pathv) {
     const char* path = EL_CSTR(pathv);
     _tl_fs_read_len = 0;
-    _tl_fs_read_buf = NULL;
     if (!path) return el_wrap_str(el_strdup(""));
     FILE* f = fopen(path, "rb");
     if (!f) return el_wrap_str(el_strdup(""));
@@ -2067,7 +2034,6 @@ el_val_t fs_read(el_val_t pathv) {
     size_t got = fread(buf, 1, (size_t)sz, f);
     buf[got] = '\0';
     _tl_fs_read_len = got;   /* store real byte count for binary-safe send */
-    _tl_fs_read_buf = buf;   /* ...valid ONLY for this exact buffer */
     fclose(f);
     return el_wrap_str(buf);
 }
@@ -3610,10 +3576,8 @@ el_val_t json_get_raw(el_val_t json_str, el_val_t key) {
     const char* k    = EL_CSTR(key);
     const char* p = json_find_key(json, k);
     /* Clear fs_read binary-length hint — result is a fresh null-terminated
-     * string, not the raw file bytes, so Content-Length must use strlen.
-     * (Kept although the pointer pairing now makes this redundant.) */
+     * string, not the raw file bytes, so Content-Length must use strlen. */
     _tl_fs_read_len = 0;
-    _tl_fs_read_buf = NULL;
     if (!p) return el_wrap_str(el_strdup(""));
     const char* end = json_skip_value(p);
     size_t n = (size_t)(end - p);
@@ -6862,116 +6826,75 @@ static int istr_contains(const char* hay, const char* needle) {
     return 0;
 }
 
-/* ---- SPEC-SEARCH-UPGRADE-OURS-2026-07-14: ranked search (BM25 + recency) ----
- * Replaces first-N-in-storage-order substring matching (measured 13% hit@5 on
- * the 15-query pinned eval; ranked model measured 93% offline). Deterministic,
- * local, transparent — no model call on the hot path. Multi-word queries score
- * per-token (rare+concentrated terms weigh most); ties break newest-first so
- * fresh memories stop losing to storage order. The transparent-layer identity
- * filter is preserved unchanged: hidden self layers stay invisible here and
- * surface only via engram_activate — the legitimate path. */
+/* ── Tokenized query matching ───────────────────────────────────────────
+ * The engram query surface (search / activate / goal-bias) historically
+ * matched the ENTIRE raw query string as a single case-insensitive
+ * substring via istr_contains(field, q). That is Ctrl-F, not search:
+ * a multi-word query like "windows msi signing" only matched a node whose
+ * text contained that exact contiguous run, so real multi-word queries
+ * returned zero. istr_contains stays as the per-TOKEN primitive; these
+ * helpers split the query on whitespace and match ANY token, then rank by
+ * how many DISTINCT tokens a node covers. Single-token queries are a strict
+ * special case (score is 0 or 1) so single-word callers never regress. */
+#define ENGRAM_MAX_QTOKENS 32
+#define ENGRAM_QTOK_LEN    256
 
-#define ENGRAM_BM25_MAX_QTOK 16
-#define ENGRAM_BM25_TOKLEN   48
-
-static int engram_tok_next(const char** ps, char* out, int cap) {
-    const char* s = *ps;
-    while (*s && !isalnum((unsigned char)*s)) s++;
-    if (!*s) { *ps = s; return 0; }
+/* Split q on whitespace into up to ENGRAM_MAX_QTOKENS distinct
+ * (case-insensitive) tokens. Returns the token count. Over-long tokens are
+ * truncated to ENGRAM_QTOK_LEN-1; over-count tokens are ignored. */
+static int engram_tokenize_query(const char* q,
+                                 char toks[][ENGRAM_QTOK_LEN], int maxtok) {
     int n = 0;
-    while (*s && isalnum((unsigned char)*s)) {
-        if (n < cap - 1) out[n++] = (char)tolower((unsigned char)*s);
-        s++;
+    if (!q) return 0;
+    const char* p = q;
+    while (*p && n < maxtok) {
+        while (*p && isspace((unsigned char)*p)) p++;
+        if (!*p) break;
+        char buf[ENGRAM_QTOK_LEN];
+        size_t tl = 0;
+        while (*p && !isspace((unsigned char)*p)) {
+            if (tl < sizeof(buf) - 1) buf[tl++] = *p;
+            p++;
+        }
+        buf[tl] = '\0';
+        if (tl == 0) continue;
+        int dup = 0;
+        for (int s = 0; s < n; s++) {
+            if (strcasecmp(toks[s], buf) == 0) { dup = 1; break; }
+        }
+        if (dup) continue;
+        memcpy(toks[n], buf, tl + 1);
+        n++;
     }
-    out[n] = 0; *ps = s; return 1;
+    return n;
 }
 
-static void engram_field_stats(const char* field,
-                               char qtok[][ENGRAM_BM25_TOKLEN], int nq,
-                               int64_t* tf, int64_t* doclen) {
-    if (!field) return;
-    char buf[ENGRAM_BM25_TOKLEN];
-    const char* p = field;
-    while (engram_tok_next(&p, buf, sizeof buf)) {
-        (*doclen)++;
-        for (int t = 0; t < nq; t++)
-            if (strcmp(buf, qtok[t]) == 0) tf[t]++;
+/* Count how many of the ntok distinct query tokens appear (case-insensitive)
+ * in the node's content, label, or tags. 0 == no match. */
+static int engram_node_match_score(const EngramNode* n,
+                                   char toks[][ENGRAM_QTOK_LEN], int ntok) {
+    int score = 0;
+    for (int t = 0; t < ntok; t++) {
+        if (istr_contains(n->content, toks[t]) ||
+            istr_contains(n->label,   toks[t]) ||
+            istr_contains(n->tags,    toks[t]))
+            score++;
     }
+    return score;
 }
 
-typedef struct { double score; int64_t created; int64_t idx; } EngramHit;
-
-static int engram_hit_cmp(const void* a, const void* b) {
-    const EngramHit* x = (const EngramHit*)a;
-    const EngramHit* y = (const EngramHit*)b;
-    if (x->score != y->score) return (x->score < y->score) ? 1 : -1;
-    if (x->created != y->created) return (x->created < y->created) ? 1 : -1;
+/* Rank entry: distinct-token match count (primary, desc) then salience
+ * (tiebreak, desc). */
+typedef struct { int64_t idx; int score; double salience; } EngramRankEntry;
+static int engram_rank_cmp(const void* a, const void* b) {
+    const EngramRankEntry* ea = (const EngramRankEntry*)a;
+    const EngramRankEntry* eb = (const EngramRankEntry*)b;
+    if (ea->score != eb->score) return eb->score - ea->score;      /* desc */
+    if (ea->salience < eb->salience) return 1;
+    if (ea->salience > eb->salience) return -1;
     return 0;
 }
 
-/* Scores every visible node against the query; writes ranked hits into `out`
- * (caller allocates g->node_count entries). Returns min(hits, lim). */
-static int64_t engram_search_ranked(EngramStore* g, const char* q, int64_t lim,
-                                    EngramHit* out) {
-    char qtok[ENGRAM_BM25_MAX_QTOK][ENGRAM_BM25_TOKLEN];
-    int nq = 0;
-    {
-        const char* p = q; char buf[ENGRAM_BM25_TOKLEN];
-        while (nq < ENGRAM_BM25_MAX_QTOK && engram_tok_next(&p, buf, sizeof buf)) {
-            int dup = 0;
-            for (int t = 0; t < nq; t++)
-                if (strcmp(qtok[t], buf) == 0) { dup = 1; break; }
-            if (!dup) { strcpy(qtok[nq], buf); nq++; }
-        }
-    }
-    if (nq == 0) return 0;
-
-    int64_t N = g->node_count;
-    int64_t* tfm  = (int64_t*)calloc((size_t)(N * nq), sizeof(int64_t));
-    int64_t* dlen = (int64_t*)calloc((size_t)N, sizeof(int64_t));
-    if (!tfm || !dlen) { free(tfm); free(dlen); return 0; }
-    int64_t df[ENGRAM_BM25_MAX_QTOK] = {0};
-    double total_len = 0.0; int64_t live = 0;
-    for (int64_t i = 0; i < N; i++) {
-        EngramNode* n = &g->nodes[i];
-        if (engram_layer_is_transparent(n->layer_id)) continue;
-        live++;
-        int64_t* tf = &tfm[i * nq];
-        engram_field_stats(n->content, qtok, nq, tf, &dlen[i]);
-        engram_field_stats(n->label,   qtok, nq, tf, &dlen[i]);
-        engram_field_stats(n->tags,    qtok, nq, tf, &dlen[i]);
-        total_len += (double)dlen[i];
-        for (int t = 0; t < nq; t++) if (tf[t] > 0) df[t]++;
-    }
-    double avg = (live > 0) ? total_len / (double)live : 1.0;
-    if (avg <= 0.0) avg = 1.0;
-    const double k1 = 1.2, b = 0.75;
-    int64_t nhits = 0;
-    for (int64_t i = 0; i < N; i++) {
-        EngramNode* n = &g->nodes[i];
-        if (engram_layer_is_transparent(n->layer_id)) continue;
-        int64_t* tf = &tfm[i * nq];
-        double s = 0.0;
-        for (int t = 0; t < nq; t++) {
-            if (tf[t] == 0) continue;
-            double idf = log(((double)live - (double)df[t] + 0.5) /
-                             ((double)df[t] + 0.5) + 1.0);
-            double tfd = (double)tf[t];
-            s += idf * (tfd * (k1 + 1.0)) /
-                 (tfd + k1 * (1.0 - b + b * (double)dlen[i] / avg));
-        }
-        if (s > 0.0) {
-            out[nhits].score = s;
-            out[nhits].created = n->created_at;
-            out[nhits].idx = i;
-            nhits++;
-        }
-    }
-    free(tfm); free(dlen);
-    qsort(out, (size_t)nhits, sizeof(EngramHit), engram_hit_cmp);
-    return (nhits < lim) ? nhits : lim;
-}
-
 el_val_t engram_search(el_val_t query, el_val_t limit) {
     EngramStore* g = engram_get();
     const char* q = EL_CSTR(query);
@@ -6979,12 +6902,33 @@ el_val_t engram_search(el_val_t query, el_val_t limit) {
     if (lim <= 0) lim = 100;
     el_val_t lst = el_list_empty();
     if (!q || !*q) return lst;
-    if (g->node_count == 0) return lst;
-    EngramHit* hits = (EngramHit*)malloc((size_t)g->node_count * sizeof(EngramHit));
+    char toks[ENGRAM_MAX_QTOKENS][ENGRAM_QTOK_LEN];
+    int ntok = engram_tokenize_query(q, toks, ENGRAM_MAX_QTOKENS);
+    if (ntok == 0) return lst;
+    EngramRankEntry* hits = malloc((size_t)g->node_count * sizeof(EngramRankEntry));
     if (!hits) return lst;
-    int64_t k = engram_search_ranked(g, q, lim, hits);
-    for (int64_t i = 0; i < k; i++)
-        lst = el_list_append(lst, engram_node_to_map(&g->nodes[hits[i].idx]));
+    int64_t nhits = 0;
+    for (int64_t i = 0; i < g->node_count; i++) {
+        EngramNode* n = &g->nodes[i];
+        /* Filter transparent layers: nodes whose layer is `transparent=1`
+         * shape output but are invisible to introspection ("what do you
+         * know about yourself"). They still surface via engram_activate
+         * + engram_compile_layered_json — that's the legitimate path. */
+        if (engram_layer_is_transparent(n->layer_id)) continue;
+        int sc = engram_node_match_score(n, toks, ntok);
+        if (sc > 0) {
+            hits[nhits].idx      = i;
+            hits[nhits].score    = sc;
+            hits[nhits].salience = n->salience;
+            nhits++;
+        }
+    }
+    /* Rank by distinct tokens matched (desc) then salience (desc), then cap. */
+    qsort(hits, (size_t)nhits, sizeof(EngramRankEntry), engram_rank_cmp);
+    int64_t end = nhits < lim ? nhits : lim;
+    for (int64_t k = 0; k < end; k++) {
+        lst = el_list_append(lst, engram_node_to_map(&g->nodes[hits[k].idx]));
+    }
     free(hits);
     return lst;
 }
@@ -7262,10 +7206,14 @@ static double engram_temporal_proximity_bonus(int64_t node_created,
 static double engram_goal_bias(const EngramNode* n, const char* query) {
     if (!query || !*query) return 1.0;
     double bias = 1.0;
-    /* Direct lexical overlap: node content/label/tags share text with query. */
-    if (istr_contains(n->content, query) || istr_contains(n->label, query) ||
-        istr_contains(n->tags, query)) {
-        bias += 0.5;
+    /* Direct lexical overlap, graded by token coverage: a node covering all
+     * query tokens gets the full +0.5; partial coverage gets a proportional
+     * share. Single-token queries → full +0.5 on match, identical to before. */
+    {
+        char toks[ENGRAM_MAX_QTOKENS][ENGRAM_QTOK_LEN];
+        int ntok = engram_tokenize_query(query, toks, ENGRAM_MAX_QTOKENS);
+        int sc   = engram_node_match_score(n, toks, ntok);
+        if (sc > 0 && ntok > 0) bias += 0.5 * ((double)sc / (double)ntok);
     }
     /* Node-type resonance with query intent. */
     int technical_query = istr_contains(query, "code")         ||
@@ -7331,14 +7279,21 @@ el_val_t engram_activate(el_val_t query, el_val_t depth) {
     if (!seeds) {
         free(best_bg); free(best_hops); free(reached); return out;
     }
+    /* Tokenize once: a node seeds if it matches ANY query token, and its seed
+     * activation is scaled by token coverage (fraction of distinct query
+     * tokens it contains) so a node matching all words seeds more strongly
+     * than one matching a single word. Single-word queries → coverage 1.0,
+     * identical to the prior whole-query behavior. */
+    char toks[ENGRAM_MAX_QTOKENS][ENGRAM_QTOK_LEN];
+    int ntok = engram_tokenize_query(q, toks, ENGRAM_MAX_QTOKENS);
     for (int64_t i = 0; i < g->node_count; i++) {
         EngramNode* n = &g->nodes[i];
-        if (istr_contains(n->content, q) ||
-            istr_contains(n->label,   q) ||
-            istr_contains(n->tags,    q)) {
+        int sc = engram_node_match_score(n, toks, ntok);
+        if (sc > 0) {
             double tdecay = engram_temporal_decay(n, now_ms);
             double dampen = engram_activation_dampen(n);
-            double act    = n->salience * tdecay * dampen;
+            double cover  = ntok > 0 ? (double)sc / (double)ntok : 1.0;
+            double act    = n->salience * tdecay * dampen * cover;
             seeds[seed_count].idx        = i;
             seeds[seed_count].act        = act;
             seeds[seed_count].created_at = n->created_at;
@@ -7899,42 +7854,45 @@ el_val_t engram_get_node_json(el_val_t id) {
     return el_wrap_str(jb_finish(&b));
 }
 
-/* Look up a node by exact label; returns its JSON or {}. Ported from the
- * v1.0.0 release runtime — needed by soul.el session continuity
- * (conv_history_load / session_summary_write / emit_session_start_event). */
-el_val_t engram_get_node_by_label(el_val_t label) {
-    const char* lbl = EL_CSTR(label);
-    if (!lbl || !*lbl) return el_wrap_str(el_strdup(""));
-    EngramStore* g = engram_get();
-    for (int64_t i = 0; i < g->node_count; i++) {
-        EngramNode* n = &g->nodes[i];
-        if (n->label && strcmp(n->label, lbl) == 0) {
-            JsonBuf b; jb_init(&b);
-            engram_emit_node_json(&b, n);
-            return el_wrap_str(b.buf);
-        }
-    }
-    return el_wrap_str(el_strdup(""));
-}
-
 el_val_t engram_search_json(el_val_t query, el_val_t limit) {
-    /* SPEC-SEARCH-UPGRADE 2026-07-14: same ranked BM25+recency core as
-     * engram_search; transparent-layer identity filter enforced inside it. */
     EngramStore* g = engram_get();
     const char* q = EL_CSTR(query);
     int64_t lim = (int64_t)limit;
     if (lim <= 0) lim = 100;
     JsonBuf b; jb_init(&b);
     jb_putc(&b, '[');
-    if (q && *q && g->node_count > 0) {
-        EngramHit* hits = (EngramHit*)malloc((size_t)g->node_count * sizeof(EngramHit));
-        if (hits) {
-            int64_t k = engram_search_ranked(g, q, lim, hits);
-            for (int64_t i = 0; i < k; i++) {
-                if (i) jb_putc(&b, ',');
-                engram_emit_node_json(&b, &g->nodes[hits[i].idx]);
+    int first = 1;
+    if (q && *q) {
+        char toks[ENGRAM_MAX_QTOKENS][ENGRAM_QTOK_LEN];
+        int ntok = engram_tokenize_query(q, toks, ENGRAM_MAX_QTOKENS);
+        if (ntok > 0) {
+            EngramRankEntry* hits =
+                malloc((size_t)g->node_count * sizeof(EngramRankEntry));
+            if (hits) {
+                int64_t nhits = 0;
+                for (int64_t i = 0; i < g->node_count; i++) {
+                    EngramNode* n = &g->nodes[i];
+                    /* Filter transparent layers — same as engram_search. */
+                    if (engram_layer_is_transparent(n->layer_id)) continue;
+                    int sc = engram_node_match_score(n, toks, ntok);
+                    if (sc > 0) {
+                        hits[nhits].idx      = i;
+                        hits[nhits].score    = sc;
+                        hits[nhits].salience = n->salience;
+                        nhits++;
+                    }
+                }
+                /* Rank by distinct tokens matched (desc) then salience (desc). */
+                qsort(hits, (size_t)nhits, sizeof(EngramRankEntry),
+                      engram_rank_cmp);
+                int64_t end = nhits < lim ? nhits : lim;
+                for (int64_t k = 0; k < end; k++) {
+                    if (!first) jb_putc(&b, ',');
+                    engram_emit_node_json(&b, &g->nodes[hits[k].idx]);
+                    first = 0;
+                }
+                free(hits);
             }
-            free(hits);
         }
     }
     jb_putc(&b, ']');

lang/el-compiler/src/parser.el

@@ -23,10 +23,29 @@ fn tok_at(tokens: [Any], pos: Int) -> Map<String, Any> {
 }
 
 fn tok_kind(tokens: [Any], pos: Int) -> String {
+    // Out-of-range reads must report the Eof sentinel so every `== "Eof"`
+    // termination guard in the parser fires. Without this, reading past the
+    // single trailing Eof token returns runtime null (el_list_get OOB -> 0),
+    // which matches no delimiter, letting inner parse loops append AST nodes
+    // forever on malformed input -> unbounded allocation -> OOM.
+    let n: Int = native_list_len(tokens) / 2
+    if pos < 0 {
+        return "Eof"
+    }
+    if pos >= n {
+        return "Eof"
+    }
     native_list_get(tokens, pos * 2)
 }
 
 fn tok_value(tokens: [Any], pos: Int) -> String {
+    let n: Int = native_list_len(tokens) / 2
+    if pos < 0 {
+        return ""
+    }
+    if pos >= n {
+        return ""
+    }
     native_list_get(tokens, pos * 2 + 1)
 }
 
@@ -35,7 +54,12 @@ fn expect(tokens: [Any], pos: Int, kind: String) -> Int {
     if k == kind {
         return pos + 1
     }
-    // On mismatch just advance; error recovery is best-effort
+    // On mismatch, error recovery is best-effort. But never step PAST the Eof
+    // sentinel: once at Eof a mismatch means the input ended early, and
+    // advancing would run the cursor off the token list.
+    if k == "Eof" {
+        return pos
+    }
     pos + 1
 }