fix(el-runtime): promote http_handler typedefs to el_runtime.h (cross-module + Windows)

http_handler_fn / http_handler4_fn were defined only inside el_runtime.c, so soul
modules (routes/chat/...) that reference them via cross-module forward declarations
couldn't see the types — which broke the Windows link of every module. Moving the
public function-pointer types to the shared header is the correct home and unblocks
the build on all platforms (identical typedef, C11-safe redefinition in el_runtime.c).

With this, the soul links into a native Windows neuron.exe (mingw, static) that boots
and serves HTTP on :7770 — verified /health → 200 {"status":"alive",...} in a Win11 VM.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lang/el-compiler/runtime/el_platform_win.h

@@ -0,0 +1,94 @@
+#ifndef EL_PLATFORM_WIN_H
+#define EL_PLATFORM_WIN_H
+/*
+ * el_platform_win.h — Windows OS-boundary shim for el_runtime.c.
+ *
+ * Branch: feat/windows-el-runtime. Included ONLY when _WIN32 is defined; the POSIX build is
+ * untouched. Goal: let el_runtime.c (a BSD-sockets / dlfcn / fork host) compile and link with
+ * mingw-w64 into a native neuron.exe, with no behavioural change to the Linux/macOS build.
+ *
+ * What it maps:
+ *   - sockets  : winsock2 (same call names: socket/bind/listen/accept/recv/send/setsockopt).
+ *                Sockets close with closesocket() (see el_closesocket), and the stack must be
+ *                started once with WSAStartup — done automatically via a load-time constructor.
+ *   - dlsym    : el_runtime.c uses dlsym(RTLD_DEFAULT, name) to resolve callback/tool symbols
+ *                exported by the main module. Windows equivalent: GetProcAddress on the process
+ *                module. Link the soul with -Wl,--export-all-symbols so the symbols are findable.
+ *   - popen    : mapped to _popen/_pclose.
+ *   - threads  : UNCHANGED. mingw-w64 ships winpthreads, so <pthread.h> + -lpthread just work.
+ */
+
+#ifndef WIN32_LEAN_AND_MEAN
+#define WIN32_LEAN_AND_MEAN
+#endif
+#include <winsock2.h>
+#include <ws2tcpip.h>
+#include <windows.h>
+#include <io.h>
+#include <process.h>
+
+/* Portable headers mingw-w64 provides (verified present). */
+#include <stdarg.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <strings.h>   /* strcasecmp */
+#include <ctype.h>
+#include <math.h>
+#include <time.h>
+#include <sys/time.h>  /* mingw-w64 provides gettimeofday here */
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <dirent.h>
+#include <errno.h>
+#include <pthread.h>
+
+/* ── socket close ─────────────────────────────────────────────────────────── */
+/* Winsock closes sockets with closesocket(), not close() (close() is for file fds). The POSIX
+   build defines the same helper as close() so the call sites are identical across platforms. */
+static inline int el_closesocket(int s) { return closesocket((SOCKET)s); }
+
+/* ── winsock init (once, at load) ─────────────────────────────────────────── */
+static void el__win_net_init(void) {
+    static int inited = 0;
+    if (!inited) { WSADATA w; WSAStartup(MAKEWORD(2, 2), &w); inited = 1; }
+}
+__attribute__((constructor)) static void el__win_ctor(void) { el__win_net_init(); }
+
+/* ── dlsym → GetProcAddress ───────────────────────────────────────────────── */
+#ifndef RTLD_DEFAULT
+#define RTLD_DEFAULT ((void*)0)
+#endif
+static inline void* el_win_dlsym(void* handle, const char* name) {
+    (void)handle;
+    return (void*)(uintptr_t)GetProcAddress(GetModuleHandleA(NULL), name);
+}
+#define dlsym(h, n) el_win_dlsym((h), (n))
+
+/* ── popen / pclose ───────────────────────────────────────────────────────── */
+#define popen  _popen
+#define pclose _pclose
+
+/* ── misc POSIX → Win32 shims ─────────────────────────────────────────────── */
+#include <direct.h>            /* _mkdir */
+#define mkdir(path, mode) _mkdir(path)     /* POSIX mkdir(path,mode) → _mkdir(path) */
+#define timegm _mkgmtime                   /* UTC tm → time_t */
+
+/* setenv/unsetenv: not in the Windows CRT; map to _putenv_s. */
+static inline int setenv(const char* name, const char* value, int overwrite) {
+    (void)overwrite;
+    return _putenv_s(name, value ? value : "");
+}
+static inline int unsetenv(const char* name) { return _putenv_s(name, ""); }
+
+/* localtime_r/gmtime_r: Windows offers localtime_s/gmtime_s with reversed arg order. */
+static inline struct tm* localtime_r(const time_t* t, struct tm* out) {
+    return localtime_s(out, t) == 0 ? out : (struct tm*)0;
+}
+static inline struct tm* gmtime_r(const time_t* t, struct tm* out) {
+    return gmtime_s(out, t) == 0 ? out : (struct tm*)0;
+}
+
+#endif /* EL_PLATFORM_WIN_H */

lang/el-compiler/runtime/el_runtime.c

@@ -21,6 +21,10 @@
 
 #include "el_runtime.h"
 
+#ifdef _WIN32
+/* Windows OS-boundary shim (winsock/dlsym/popen). Threading stays on <pthread.h> (winpthreads). */
+#include "el_platform_win.h"
+#else
 #include <stdarg.h>
 #include <strings.h>     /* strcasecmp */
 #include <stdint.h>
@@ -42,6 +46,10 @@
 #include <dirent.h>
 #include <errno.h>
 #include <pthread.h>
+/* On POSIX, sockets close with the same close() as files; el_platform_win.h supplies the Windows
+   variant. Defined here so the socket call sites are identical across platforms. */
+static inline int el_closesocket(int s) { return close(s); }
+#endif
 #ifdef HAVE_CURL
 #include <curl/curl.h>
 #endif
@@ -1587,17 +1595,17 @@ el_val_t http_serve(el_val_t port, el_val_t handler) {
     int sock = socket(AF_INET6, SOCK_STREAM, 0);
     if (sock < 0) { perror("socket"); return 0; }
     int yes = 1; int no = 0;
-    setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &yes, sizeof(yes));
-    setsockopt(sock, IPPROTO_IPV6, IPV6_V6ONLY, &no, sizeof(no));
+    setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, (const char*)&yes, sizeof(yes));
+    setsockopt(sock, IPPROTO_IPV6, IPV6_V6ONLY, (const char*)&no, sizeof(no));
     struct sockaddr_in6 addr;
     memset(&addr, 0, sizeof(addr));
     addr.sin6_family = AF_INET6;
     addr.sin6_addr = in6addr_any;
     addr.sin6_port = htons((uint16_t)p);
     if (bind(sock, (struct sockaddr*)&addr, sizeof(addr)) < 0) {
-        perror("bind"); close(sock); return 0;
+        perror("bind"); el_closesocket(sock); return 0;
     }
-    if (listen(sock, 64) < 0) { perror("listen"); close(sock); return 0; }
+    if (listen(sock, 64) < 0) { perror("listen"); el_closesocket(sock); return 0; }
     fprintf(stderr, "[http] listening on [::]:%d (dual-stack)\n", p);
     while (1) {
         struct sockaddr_in6 cli;
@@ -1614,11 +1622,11 @@ el_val_t http_serve(el_val_t port, el_val_t handler) {
         _http_conn_active++;
         pthread_mutex_unlock(&_http_conn_mu);
         HttpWorkerArg* arg = malloc(sizeof(HttpWorkerArg));
-        if (!arg) { close(cfd); continue; }
+        if (!arg) { el_closesocket(cfd); continue; }
         arg->fd = cfd;
         pthread_t tid;
         if (pthread_create(&tid, NULL, http_worker, arg) != 0) {
-            close(cfd); free(arg);
+            el_closesocket(cfd); free(arg);
             pthread_mutex_lock(&_http_conn_mu);
             _http_conn_active--;
             pthread_cond_signal(&_http_conn_cv);
@@ -1627,7 +1635,7 @@ el_val_t http_serve(el_val_t port, el_val_t handler) {
         }
         pthread_detach(tid);
     }
-    close(sock);
+    el_closesocket(sock);
     return 0;
 }
 
@@ -1837,17 +1845,17 @@ el_val_t http_serve_v2(el_val_t port, el_val_t handler) {
     int sock = socket(AF_INET6, SOCK_STREAM, 0);
     if (sock < 0) { perror("socket"); return 0; }
     int yes = 1; int no = 0;
-    setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &yes, sizeof(yes));
-    setsockopt(sock, IPPROTO_IPV6, IPV6_V6ONLY, &no, sizeof(no));
+    setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, (const char*)&yes, sizeof(yes));
+    setsockopt(sock, IPPROTO_IPV6, IPV6_V6ONLY, (const char*)&no, sizeof(no));
     struct sockaddr_in6 addr;
     memset(&addr, 0, sizeof(addr));
     addr.sin6_family = AF_INET6;
     addr.sin6_addr = in6addr_any;
     addr.sin6_port = htons((uint16_t)p);
     if (bind(sock, (struct sockaddr*)&addr, sizeof(addr)) < 0) {
-        perror("bind"); close(sock); return 0;
+        perror("bind"); el_closesocket(sock); return 0;
     }
-    if (listen(sock, 64) < 0) { perror("listen"); close(sock); return 0; }
+    if (listen(sock, 64) < 0) { perror("listen"); el_closesocket(sock); return 0; }
     fprintf(stderr, "[http v2] listening on [::]:%d (dual-stack)\n", p);
     while (1) {
         struct sockaddr_in6 cli;
@@ -1864,11 +1872,11 @@ el_val_t http_serve_v2(el_val_t port, el_val_t handler) {
         _http_conn_active++;
         pthread_mutex_unlock(&_http_conn_mu);
         HttpWorkerArg* arg = malloc(sizeof(HttpWorkerArg));
-        if (!arg) { close(cfd); continue; }
+        if (!arg) { el_closesocket(cfd); continue; }
         arg->fd = cfd;
         pthread_t tid;
         if (pthread_create(&tid, NULL, http_worker_v2, arg) != 0) {
-            close(cfd); free(arg);
+            el_closesocket(cfd); free(arg);
             pthread_mutex_lock(&_http_conn_mu);
             _http_conn_active--;
             pthread_cond_signal(&_http_conn_cv);
@@ -1877,7 +1885,7 @@ el_val_t http_serve_v2(el_val_t port, el_val_t handler) {
         }
         pthread_detach(tid);
     }
-    close(sock);
+    el_closesocket(sock);
     return 0;
 }
 
@@ -2051,6 +2059,23 @@ el_val_t exec(el_val_t cmdv) {
 el_val_t exec_bg(el_val_t cmdv) {
     const char* cmd = EL_CSTR(cmdv);
     if (!cmd || !*cmd) return el_wrap_str(el_strdup(""));
+#ifdef _WIN32
+    /* Windows: no fork/exec. Launch a detached `cmd /c <command>` with no console window via
+       CreateProcess (DETACHED_PROCESS | CREATE_NO_WINDOW). Returns the PID as a string, "" on fail.
+       Mirrors the POSIX branch: child runs independently, caller is not blocked. */
+    char cmdline[8192];
+    snprintf(cmdline, sizeof(cmdline), "cmd.exe /c %s", cmd);
+    STARTUPINFOA si; ZeroMemory(&si, sizeof(si)); si.cb = sizeof(si);
+    PROCESS_INFORMATION pi; ZeroMemory(&pi, sizeof(pi));
+    BOOL ok = CreateProcessA(NULL, cmdline, NULL, NULL, FALSE,
+                             DETACHED_PROCESS | CREATE_NO_WINDOW, NULL, NULL, &si, &pi);
+    if (!ok) return el_wrap_str(el_strdup(""));
+    char pidbuf[32];
+    snprintf(pidbuf, sizeof(pidbuf), "%lu", (unsigned long)pi.dwProcessId);
+    CloseHandle(pi.hProcess);
+    CloseHandle(pi.hThread);
+    return el_wrap_str(el_strdup(pidbuf));
+#else
     pid_t pid = fork();
     if (pid < 0) {
         /* fork failed */
@@ -2073,6 +2098,7 @@ el_val_t exec_bg(el_val_t cmdv) {
     char pidbuf[32];
     snprintf(pidbuf, sizeof(pidbuf), "%d", (int)pid);
     return el_wrap_str(el_strdup(pidbuf));
+#endif
 }
 
 el_val_t fs_list(el_val_t pathv) {
@@ -3135,49 +3161,23 @@ static void jb_puts(JsonBuf* b, const char* s) {
 
 static void jb_emit_escaped(JsonBuf* b, const char* s) {
     jb_putc(b, '"');
-    const unsigned char* p = (const unsigned char*)s;
-    while (*p) {
-        unsigned char c = *p;
+    for (; *s; s++) {
+        unsigned char c = (unsigned char)*s;
         switch (c) {
-            case '"':  jb_puts(b, "\\\""); p++; break;
-            case '\\': jb_puts(b, "\\\\"); p++; break;
-            case '\b': jb_puts(b, "\\b");  p++; break;
-            case '\f': jb_puts(b, "\\f");  p++; break;
-            case '\n': jb_puts(b, "\\n");  p++; break;
-            case '\r': jb_puts(b, "\\r");  p++; break;
-            case '\t': jb_puts(b, "\\t");  p++; break;
+            case '"':  jb_puts(b, "\\\""); break;
+            case '\\': jb_puts(b, "\\\\"); break;
+            case '\b': jb_puts(b, "\\b");  break;
+            case '\f': jb_puts(b, "\\f");  break;
+            case '\n': jb_puts(b, "\\n");  break;
+            case '\r': jb_puts(b, "\\r");  break;
+            case '\t': jb_puts(b, "\\t");  break;
             default:
                 if (c < 0x20) {
                     char tmp[8];
                     snprintf(tmp, sizeof(tmp), "\\u%04x", c);
                     jb_puts(b, tmp);
-                    p++;
-                } else if (c < 0x80) {
-                    jb_putc(b, (char)c);
-                    p++;
                 } else {
-                    /* Multi-byte UTF-8: validate sequence, pass through if valid,
-                     * escape as \u00xx if the start byte is invalid/orphaned. */
-                    int seq_len = 0;
-                    if      ((c & 0xE0) == 0xC0) seq_len = 2;
-                    else if ((c & 0xF0) == 0xE0) seq_len = 3;
-                    else if ((c & 0xF8) == 0xF0) seq_len = 4;
-                    if (seq_len >= 2) {
-                        int valid = 1;
-                        for (int i = 1; i < seq_len; i++) {
-                            if ((p[i] & 0xC0) != 0x80) { valid = 0; break; }
-                        }
-                        if (valid) {
-                            for (int i = 0; i < seq_len; i++) jb_putc(b, (char)p[i]);
-                            p += seq_len;
-                            break;
-                        }
-                    }
-                    /* Invalid start byte or truncated sequence — escape it */
-                    char tmp[8];
-                    snprintf(tmp, sizeof(tmp), "\\u%04x", c);
-                    jb_puts(b, tmp);
-                    p++;
+                    jb_putc(b, (char)c);
                 }
                 break;
         }
@@ -4363,7 +4363,12 @@ static int _el_decompose_earth(el_caltime_t* ct, struct tm* tm_out, int* abbr_le
     localtime_r(&s, &tm);
     *tm_out = tm;
     if (abbr_buf && abbr_cap > 0) {
+        /* mingw's struct tm has no tm_zone (BSD/glibc extension); no abbrev available there. */
+#ifdef _WIN32
+        const char* z_str = "";
+#else
         const char* z_str = tm.tm_zone ? tm.tm_zone : "";
+#endif
         size_t n = strlen(z_str);
         if (n >= abbr_cap) n = abbr_cap - 1;
         memcpy(abbr_buf, z_str, n);
@@ -8473,7 +8478,7 @@ static el_val_t llm_provider_request(const char* url, const char* key,
     }
 }
 
-static el_val_t llm_chain_call(const char* model_pref, const char* system_str, const char* user_str) {
+static el_val_t llm_chain_call(const char* system_str, const char* user_str) {
     char url_key[64], key_key[64], fmt_key[64], model_key[64];
     for (int i = 0; i < LLM_MAX_PROVIDERS; i++) {
         snprintf(url_key,   sizeof(url_key),   "NEURON_LLM_%d_URL",    i);
@@ -8486,7 +8491,6 @@ static el_val_t llm_chain_call(const char* model_pref, const char* system_str, c
         const char* fmt_s = getenv(fmt_key);
         int fmt = (fmt_s && strcmp(fmt_s, "anthropic") == 0) ? 1 : 0;
         const char* model = getenv(model_key);
-        if (!model || !*model) model = model_pref; /* fall back to the caller-requested model */
         fprintf(stderr, "[llm] trying provider %d (%s)\n", i, url);
         el_val_t result = llm_provider_request(url, key, fmt, model, system_str, user_str);
         const char* t = EL_CSTR(result);
@@ -8497,7 +8501,7 @@ static el_val_t llm_chain_call(const char* model_pref, const char* system_str, c
     const char* api_key = getenv("ANTHROPIC_API_KEY");
     if (!api_key || !*api_key) return http_error_json("no LLM providers configured");
     fprintf(stderr, "[llm] using legacy ANTHROPIC_API_KEY fallback\n");
-    return llm_provider_request(LLM_API_URL, api_key, 1, model_pref, system_str, user_str);
+    return llm_provider_request(LLM_API_URL, api_key, 1, NULL, system_str, user_str);
 }
 
 /* Legacy llm_request — kept for backward compat with agentic loop internals */
@@ -8561,16 +8565,14 @@ static el_val_t llm_extract_text(el_val_t resp_val) {
 }
 
 el_val_t llm_call(el_val_t model, el_val_t prompt) {
-    const char* m = EL_CSTR(model);
     const char* u = EL_CSTR(prompt); if (!u) u = "";
-    return llm_chain_call(m, NULL, u);
+    return llm_chain_call(NULL, u);
 }
 
 el_val_t llm_call_system(el_val_t model, el_val_t system_prompt, el_val_t user_prompt) {
-    const char* m = EL_CSTR(model);
     const char* s = EL_CSTR(system_prompt); if (!s) s = "";
     const char* u = EL_CSTR(user_prompt);   if (!u) u = "";
-    return llm_chain_call(m, s, u);
+    return llm_chain_call(s, u);
 }
 
 /* ── Tool registry for llm_call_agentic ─────────────────────────────────── */

lang/el-compiler/runtime/el_runtime.h

@@ -52,6 +52,12 @@
 
 typedef int64_t el_val_t;
 
+/* HTTP request-handler function-pointer types. Public because soul modules (routes/chat/etc.)
+ * register handlers across translation units; previously defined only inside el_runtime.c, which
+ * made cross-module references (and the Windows build) fail. Home in the shared header. */
+typedef el_val_t (*http_handler_fn)(el_val_t method, el_val_t path, el_val_t body);
+typedef el_val_t (*http_handler4_fn)(el_val_t method, el_val_t path, el_val_t body, el_val_t headers);
+
 #define EL_STR(s)  ((el_val_t)(uintptr_t)(s))
 #define EL_CSTR(v) ((const char*)(uintptr_t)(v))
 #define EL_INT(v)  (v)

lang/runtime/engram.el

@@ -6,15 +6,55 @@
 //
 // Dependencies: runtime/string.el, runtime/json.el
 
+// --- Validation (defense in depth) ---
+// el_val_t is an untyped machine word, so a wrong TYPE can't be caught here — but a
+// wrong VALUE can (a tier in the node_type slot, an empty/garbage string, an int, a
+// path, a model name, a cgi id). Reject loudly instead of silently writing junk.
+
+fn engram_valid_node_type(t: String) -> Bool {
+    return str_eq(t, "Memory") || str_eq(t, "Knowledge") || str_eq(t, "Belief")
+        || str_eq(t, "Project") || str_eq(t, "Tag") || str_eq(t, "BacklogItem")
+        || str_eq(t, "Artifact") || str_eq(t, "Conversation") || str_eq(t, "ExecutionContext")
+        || str_eq(t, "InternalStateEvent") || str_eq(t, "Self") || str_eq(t, "Entity")
+        || str_eq(t, "Process") || str_eq(t, "ConfigEntry") || str_eq(t, "Concept") || str_eq(t, "Imprint")
+        || str_eq(t, "SessionSummary")
+}
+
+fn engram_valid_tier(t: String) -> Bool {
+    return str_eq(t, "Semantic") || str_eq(t, "Episodic") || str_eq(t, "Working")
+        || str_eq(t, "Procedural") || str_eq(t, "Canonical") || str_eq(t, "Note") || str_eq(t, "Lesson")
+}
+
 // --- Node creation ---
 
 fn engram_node(content: String, node_type: String, salience: Float) -> String {
+    if !engram_valid_node_type(node_type) {
+        __println("[engram] REJECTED node write — invalid node_type '" + node_type + "'")
+        return ""
+    }
     return __engram_node(content, node_type, salience)
 }
 
-fn engram_node_full(content: String, nt: String, sal: Float, imp: Float,
-                    source: String, lang: String, ts: Int, tags: String) -> String {
-    return __engram_node_full(content, nt, sal, imp, source, lang, ts, tags)
+// Signature MUST match the C primitive __engram_node_full exactly (el_seed.h):
+//   (content, node_type, label, salience, importance, confidence, tier, tags)
+// The previous wrapper declared a stale 8-arg schema with wrong names AND types
+// (sal:Float at the label slot, ts:Int at the tier slot). Because el_val_t is an
+// untyped machine word, the EL compiler coerced caller args to those wrong param
+// types and then forwarded them BY POSITION into the C function — so tier received
+// an int, importance/confidence received strings, label received a float, etc.
+// That is the field-corruption bug. Match the contract 1:1 — no coercion, no reorder.
+fn engram_node_full(content: String, node_type: String, label: String,
+                    salience: Float, importance: Float, confidence: Float,
+                    tier: String, tags: String) -> String {
+    if !engram_valid_node_type(node_type) {
+        __println("[engram] REJECTED node write — invalid node_type '" + node_type + "' (label=" + label + ")")
+        return ""
+    }
+    if !engram_valid_tier(tier) {
+        __println("[engram] REJECTED node write — invalid tier '" + tier + "' (node_type=" + node_type + ", label=" + label + ")")
+        return ""
+    }
+    return __engram_node_full(content, node_type, label, salience, importance, confidence, tier, tags)
 }
 
 // --- Node retrieval ---