engram: reconcile M8 HNSW vindex (#109) onto current dev, restore 3 fixes the branch predated

Lands feat/reframe-region-setop (PR #109: native set-based reframe_region,
decorator-as-seam @route port, teacher-summon, and the M8.1 activate-latency
work — lazy-memoized cosq via eg_cosq_at + engram_vindex HNSW-accelerated
seed discovery + vindex_harvest_from_store/vindex_bench oracle) onto dev's
actual current HEAD, plus engram-tiered-storage's still-unique test suite.

RECONCILING #109 WITH engram-tiered-storage (M4-M10 HNSW/geometry/reason/
verify work): not a two-way merge. engram_vindex.c's HNSW core (search_layer/
select_neighbors/prune_links/insert) is BYTE-IDENTICAL between the two
branches; #109's copy is a strict superset (adds vindex_harvest_from_store,
used by vindex_bench.c's brute-force-vs-HNSW oracle). engram_reason.c and
engram_verify.c are also byte-identical. #109's own branch point already
carried engram-tiered-storage's M4-M10 lineage forward, so there was nothing
left to merge into #109 for those files. The one thing engram-tiered-storage
had that #109's tree dropped: its full test suite (test_vindex.c,
test_geometry.c, test_reason.c, test_verify.c, test_m7_traversal.c, the
interoception P0-P5 tests, bufpool/compaction tests, and their run_*.sh
harnesses) — ported over here unchanged.

WHY THIS NEEDED HAND RECONCILIATION, NOT A MECHANICAL MERGE: #109's branch
forked from dev on 2026-08-14 15:40 (before restructure-adjacent history
diverged the file's merge-base for `git merge` — it presented as an add/add
conflict). A straight two-dot diff (dev tip -> PR tip) applied cleanly, but
it silently reverted THREE dev fixes landed on 2026-08-14/15, after the
branch point, that the PR's diff had no way to know about:

  1. qgate rescale (2026-08-14 self-review): PR's lazy eg_cosq_at rewrite of
     the query-aware propagation gate dropped the shift-and-floor rescale
     about ENGRAM_EMBED_S0 (measured: unrelated-pair median 0.562->raw gate
     0.67, i.e. "a small tax, not a gate"). Restored the rescale, wrapped
     around the lazy accessor -- the PR's actual improvement (WHEN cosq[oi]
     is computed) is orthogonal to WHAT it gates on and both are kept.
  2. Eviction cause decomposition (2026-08-14 self-review): dev decomposes
     wm_evicted into evict_floor/evict_cap/evict_bll so WM churn is
     diagnosable (identity: evicted == floor+cap+bll+dup_wm+dup_wm_global).
     PR's tree predates this and dropped all three counters + their JSON
     stats fields. Restored declarations, all 4 direct increment sites, the
     eg_wm_carry_over bll increment, and the act-stats JSON fields --
     alongside (not instead of) the PR's own P4 afferent / API-reshape
     counters already in that same struct/JSON.
  3. Hebbian link-formation selection (2026-08-15 self-review, TODAY): dev
     selects the STRONGEST qualifying candidate for consolidation each call;
     PR's tree predates this and reverted to hash-slot order (arbitrary wrt
     association strength) for edge formation -- the one path that writes
     PERMANENT structure. Restored the strongest-candidate while-loop,
     keeping the PR's own genuine improvement at that site
     (engram_adj_on_edge_added incremental-index append instead of a bare
     adj_dirty=1 full-rebuild flag).

engram/src/server.el's 3-way conflicts (autoconnect_on/ise_offgraph_on env
flags, /api/nodes connected-count in responses) were pure additive: dev's
side was empty, PR's side added the feature. Took PR's side whole.

VERIFIED (nsbx sandbox only, live :8742/:7770 never touched):
  - cc -std=c11 -O2, clean link against the real engram/src/server.el via
    elc, zero errors.
  - vindex_bench (built standalone, read-only harvest) against the real
    production store clone (13,671 embedded nodes, 768-dim nomic-embed-text):
    recall@10 = 1.0000 at ef 64/128/200; HNSW search 0.28-0.79ms/query vs
    2.03ms/query brute-force oracle (2.6x-7.2x). HNSW build itself: 46.5s
    for the full 13,671-node set -- see the flagged risk below.
  - Booted the reconciled binary in an isolated nsbx sandbox (:8905, cloned
    snapshot of the live store, 13,424 nodes / 37,656 edges) and called
    /api/activate for real: first call after boot 41.5s (pays the one-time
    HNSW build inline -- matches the standalone bench), second/third calls
    356ms/605ms, no crash, correct results, act-stats JSON (including the
    restored evict_floor/cap/bll fields) reads correctly.

KNOWN RISK TO FLAG BEFORE ANY LIVE CUTOVER (not fixed here; out of scope for
this dev-only land per instructions not to touch :8742/:7770): eg_vindex_sync
builds the HNSW index synchronously, inline, on the first engram_activate()
call after every process start (or index invalidation). On the real node
count that is a ~46s blocking stall on a single-threaded server -- the first
request after every restart (or its concurrent siblings) waits the full
build. Recommend a background/incremental build (or a bounded per-call build
budget) before this ever reaches the live daemon. See PR description / final
report for the fuller writeup.

.gitea/workflows/ci-dev.yaml

@@ -39,9 +39,9 @@ jobs:
         run: |
           dist/platform/elc-linux-amd64 elc-cli.el > dist/elc-gen2.c
           gcc -O2 \
-            -I el-compiler/runtime \
+            -I runtime \
             dist/elc-gen2.c \
-            el-compiler/runtime/el_runtime.c \
+            runtime/el_runtime.c \
             -lcurl -lssl -lcrypto -lpthread -lm \
             -o dist/platform/elc
           chmod +x dist/platform/elc
@@ -54,9 +54,9 @@ jobs:
           mkdir -p dist/bin
           dist/platform/elc elb.el > dist/elb.c
           gcc -O2 \
-            -I el-compiler/runtime \
+            -I runtime \
             dist/elb.c \
-            el-compiler/runtime/el_runtime.c \
+            runtime/el_runtime.c \
             -lcurl -lssl -lcrypto -lpthread -lm \
             -o dist/bin/elb
           chmod +x dist/bin/elb
@@ -91,7 +91,7 @@ jobs:
       - name: Precompile el_runtime.o
         run: |
           set -euo pipefail
-          RUNTIME="$(pwd)/el-compiler/runtime"
+          RUNTIME="$(pwd)/runtime"
           gcc -O2 -c -I "$RUNTIME" "$RUNTIME/el_runtime.c" \
             -o /tmp/el_runtime.o
           echo "el_runtime.o compiled"
@@ -100,7 +100,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/el-compiler/runtime"
+          RUNTIME="$(pwd)/runtime"
           "$ELC" --test tests/native/test_core.el > /tmp/el_native_core.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_core.c /tmp/el_runtime.o \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_core
@@ -110,7 +110,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/el-compiler/runtime"
+          RUNTIME="$(pwd)/runtime"
           "$ELC" --test tests/native/test_text.el > /tmp/el_native_text.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_text.c /tmp/el_runtime.o \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_text
@@ -120,7 +120,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/el-compiler/runtime"
+          RUNTIME="$(pwd)/runtime"
           "$ELC" --test tests/native/test_string.el > /tmp/el_native_string.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_string.c /tmp/el_runtime.o \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_string
@@ -130,7 +130,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/el-compiler/runtime"
+          RUNTIME="$(pwd)/runtime"
           "$ELC" --test tests/native/test_math.el > /tmp/el_native_math.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_math.c /tmp/el_runtime.o \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_math
@@ -140,7 +140,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/el-compiler/runtime"
+          RUNTIME="$(pwd)/runtime"
           "$ELC" --test tests/native/test_state.el > /tmp/el_native_state.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_state.c /tmp/el_runtime.o \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_state
@@ -150,7 +150,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/el-compiler/runtime"
+          RUNTIME="$(pwd)/runtime"
           "$ELC" --test tests/native/test_time.el > /tmp/el_native_time.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_time.c /tmp/el_runtime.o \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_time
@@ -160,7 +160,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/el-compiler/runtime"
+          RUNTIME="$(pwd)/runtime"
           "$ELC" --test tests/native/test_json.el > /tmp/el_native_json.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_json.c /tmp/el_runtime.o \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_json
@@ -170,7 +170,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/el-compiler/runtime"
+          RUNTIME="$(pwd)/runtime"
           "$ELC" --test tests/native/test_env.el > /tmp/el_native_env.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_env.c /tmp/el_runtime.o \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_env
@@ -180,7 +180,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/el-compiler/runtime"
+          RUNTIME="$(pwd)/runtime"
           "$ELC" --test tests/native/test_fs.el > /tmp/el_native_fs.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_fs.c /tmp/el_runtime.o \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_fs
@@ -191,7 +191,7 @@ jobs:
         run: |
           ABS_ELB="$(pwd)/dist/bin/elb"
           ABS_ELC="$(pwd)/dist/platform/elc"
-          ABS_RUNTIME="$(pwd)/el-compiler/runtime"
+          ABS_RUNTIME="$(pwd)/runtime"
           ABS_OUT="$(pwd)/dist/bin"
           (cd ../epm && "$ABS_ELB" --clean --elc="$ABS_ELC" --runtime="$ABS_RUNTIME" --out="$ABS_OUT")
           chmod +x dist/bin/epm
@@ -202,7 +202,7 @@ jobs:
         run: |
           ABS_ELB="$(pwd)/dist/bin/elb"
           ABS_ELC="$(pwd)/dist/platform/elc"
-          ABS_RUNTIME="$(pwd)/el-compiler/runtime"
+          ABS_RUNTIME="$(pwd)/runtime"
           ABS_OUT="$(pwd)/dist/bin"
           (cd tools/install && "$ABS_ELB" --clean --elc="$ABS_ELC" --runtime="$ABS_RUNTIME" --out="$ABS_OUT")
           chmod +x dist/bin/el-install
@@ -214,9 +214,18 @@ jobs:
         env:
           GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
         run: |
+          # Fail loudly: previously this step had no `set -e`, so an auth or
+          # upload failure was swallowed (step exited 0 on the trailing echo)
+          # and the SDK silently never published. Surface failures now.
+          set -euo pipefail
+          if [ -z "${GCP_SA_KEY:-}" ]; then
+            echo "FATAL: GCP_SA_KEY secret is empty — cannot authenticate to publish" >&2
+            exit 1
+          fi
           echo "${GCP_SA_KEY}" > /tmp/gcp-key.json
           gcloud auth activate-service-account --key-file=/tmp/gcp-key.json
           gcloud config set project neuron-785695
+          echo "Publishing as active account: $(gcloud config get-value account 2>/dev/null)"
 
           VERSION="${GITHUB_SHA:0:8}"
 
@@ -242,7 +251,7 @@ jobs:
             --project=neuron-785695 \
             --package=el-runtime-c \
             --version="${VERSION}" \
-            --source=el-compiler/runtime/el_runtime.c
+            --source=runtime/el_runtime.c
 
           gcloud artifacts generic upload \
             --repository=foundation-dev \
@@ -250,7 +259,7 @@ jobs:
             --project=neuron-785695 \
             --package=el-runtime-h \
             --version="${VERSION}" \
-            --source=el-compiler/runtime/el_runtime.h
+            --source=runtime/el_runtime.h
 
           gcloud artifacts generic upload \
             --repository=foundation-dev \
@@ -258,7 +267,7 @@ jobs:
             --project=neuron-785695 \
             --package=el-runtime-js \
             --version="${VERSION}" \
-            --source=el-compiler/runtime/el_runtime.js
+            --source=runtime/el_runtime.js
 
           echo "Published El SDK version=${VERSION} to foundation-dev"
           # Keep key alive for the ci-base rebuild step below
@@ -268,6 +277,12 @@ jobs:
         # Patches ci-base:dev in-place: pulls the existing image (which has all
         # system deps — Node, Go, gcloud, Docker CLI, etc.) and overlays the freshly
         # built El SDK on top. Keeps the full ci-base rebuild fast and incremental.
+        #
+        # continue-on-error: this is a CI-cache optimization, NOT the release
+        # artifact. It runs Docker (pull/build/push ~600MB) on the host-mode GCE
+        # runner where DinD/Docker availability is fragile. A failure here must
+        # never block or redden the job — the SDK publish above is the deliverable.
+        continue-on-error: true
         if: github.event_name == 'push'
         env:
           GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
@@ -291,9 +306,9 @@ jobs:
           FROM ${BASE}
           COPY dist/platform/elc                 /opt/el/dist/platform/elc
           COPY dist/bin/elb                       /opt/el/dist/bin/elb
-          COPY el-compiler/runtime/el_runtime.c  /opt/el/el-compiler/runtime/el_runtime.c
-          COPY el-compiler/runtime/el_runtime.h  /opt/el/el-compiler/runtime/el_runtime.h
-          COPY el-compiler/runtime/el_runtime.js /opt/el/el-compiler/runtime/el_runtime.js
+          COPY runtime/el_runtime.c  /opt/el/runtime/el_runtime.c
+          COPY runtime/el_runtime.h  /opt/el/runtime/el_runtime.h
+          COPY runtime/el_runtime.js /opt/el/runtime/el_runtime.js
           RUN chmod +x /opt/el/dist/platform/elc /opt/el/dist/bin/elb
           EOF
 

.gitea/workflows/ci-stage.yaml

@@ -46,9 +46,9 @@ jobs:
         run: |
           dist/platform/elc-linux-amd64 elc-cli.el > dist/elc-gen2.c
           gcc -O2 \
-            -I el-compiler/runtime \
+            -I runtime \
             dist/elc-gen2.c \
-            el-compiler/runtime/el_runtime.c \
+            runtime/el_runtime.c \
             -lcurl -lssl -lcrypto -lpthread -lm \
             -o dist/platform/elc
           chmod +x dist/platform/elc
@@ -84,7 +84,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/el-compiler/runtime"
+          RUNTIME="$(pwd)/runtime"
           "$ELC" --test tests/native/test_core.el > /tmp/el_native_core.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_core.c "$RUNTIME/el_runtime.c" \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_core
@@ -94,7 +94,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/el-compiler/runtime"
+          RUNTIME="$(pwd)/runtime"
           "$ELC" --test tests/native/test_text.el > /tmp/el_native_text.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_text.c "$RUNTIME/el_runtime.c" \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_text
@@ -104,7 +104,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/el-compiler/runtime"
+          RUNTIME="$(pwd)/runtime"
           "$ELC" --test tests/native/test_string.el > /tmp/el_native_string.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_string.c "$RUNTIME/el_runtime.c" \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_string
@@ -114,7 +114,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/el-compiler/runtime"
+          RUNTIME="$(pwd)/runtime"
           "$ELC" --test tests/native/test_math.el > /tmp/el_native_math.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_math.c "$RUNTIME/el_runtime.c" \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_math
@@ -124,7 +124,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/el-compiler/runtime"
+          RUNTIME="$(pwd)/runtime"
           "$ELC" --test tests/native/test_state.el > /tmp/el_native_state.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_state.c "$RUNTIME/el_runtime.c" \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_state
@@ -134,7 +134,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/el-compiler/runtime"
+          RUNTIME="$(pwd)/runtime"
           "$ELC" --test tests/native/test_time.el > /tmp/el_native_time.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_time.c "$RUNTIME/el_runtime.c" \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_time
@@ -144,7 +144,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/el-compiler/runtime"
+          RUNTIME="$(pwd)/runtime"
           "$ELC" --test tests/native/test_json.el > /tmp/el_native_json.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_json.c "$RUNTIME/el_runtime.c" \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_json
@@ -154,7 +154,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/el-compiler/runtime"
+          RUNTIME="$(pwd)/runtime"
           "$ELC" --test tests/native/test_env.el > /tmp/el_native_env.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_env.c "$RUNTIME/el_runtime.c" \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_env
@@ -164,7 +164,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/el-compiler/runtime"
+          RUNTIME="$(pwd)/runtime"
           "$ELC" --test tests/native/test_fs.el > /tmp/el_native_fs.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_fs.c "$RUNTIME/el_runtime.c" \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_fs
@@ -176,9 +176,9 @@ jobs:
           mkdir -p dist/bin
           dist/platform/elc elb.el > dist/elb.c
           gcc -O2 \
-            -I el-compiler/runtime \
+            -I runtime \
             dist/elb.c \
-            el-compiler/runtime/el_runtime.c \
+            runtime/el_runtime.c \
             -lcurl -lssl -lcrypto -lpthread -lm \
             -o dist/bin/elb
           chmod +x dist/bin/elb
@@ -189,7 +189,7 @@ jobs:
         run: |
           ABS_ELB="$(pwd)/dist/bin/elb"
           ABS_ELC="$(pwd)/dist/platform/elc"
-          ABS_RUNTIME="$(pwd)/el-compiler/runtime"
+          ABS_RUNTIME="$(pwd)/runtime"
           ABS_OUT="$(pwd)/dist/bin"
           (cd ../epm && "$ABS_ELB" --clean --elc="$ABS_ELC" --runtime="$ABS_RUNTIME" --out="$ABS_OUT")
           chmod +x dist/bin/epm
@@ -200,7 +200,7 @@ jobs:
         run: |
           ABS_ELB="$(pwd)/dist/bin/elb"
           ABS_ELC="$(pwd)/dist/platform/elc"
-          ABS_RUNTIME="$(pwd)/el-compiler/runtime"
+          ABS_RUNTIME="$(pwd)/runtime"
           ABS_OUT="$(pwd)/dist/bin"
           (cd tools/install && "$ABS_ELB" --clean --elc="$ABS_ELC" --runtime="$ABS_RUNTIME" --out="$ABS_OUT")
           chmod +x dist/bin/el-install
@@ -212,12 +212,21 @@ jobs:
         env:
           GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
         run: |
+          # Fail loudly: previously this step had no `set -e`, so an auth or
+          # upload failure was swallowed (step exited 0 on the trailing echo)
+          # and the SDK silently never published. Surface failures now.
+          set -euo pipefail
+          if [ -z "${GCP_SA_KEY:-}" ]; then
+            echo "FATAL: GCP_SA_KEY secret is empty — cannot authenticate to publish" >&2
+            exit 1
+          fi
           echo "${GCP_SA_KEY}" > /tmp/gcp-key.json
           apt-get install -y -qq apt-transport-https ca-certificates curl
           echo "deb [trusted=yes] https://packages.cloud.google.com/apt cloud-sdk main" > /etc/apt/sources.list.d/google-cloud-sdk.list
           apt-get update -qq && apt-get install -y google-cloud-cli
           gcloud auth activate-service-account --key-file=/tmp/gcp-key.json
           gcloud config set project neuron-785695
+          echo "Publishing as active account: $(gcloud config get-value account 2>/dev/null)"
 
           VERSION="${GITHUB_SHA:0:8}"
 
@@ -235,7 +244,7 @@ jobs:
             --project=neuron-785695 \
             --package=el-runtime-c \
             --version="${VERSION}" \
-            --source=el-compiler/runtime/el_runtime.c
+            --source=runtime/el_runtime.c
 
           gcloud artifacts generic upload \
             --repository=foundation-stage \
@@ -243,7 +252,7 @@ jobs:
             --project=neuron-785695 \
             --package=el-runtime-h \
             --version="${VERSION}" \
-            --source=el-compiler/runtime/el_runtime.h
+            --source=runtime/el_runtime.h
 
           echo "Published El SDK version=${VERSION} to foundation-stage"
           # Keep key alive for the ci-base rebuild step below
@@ -253,6 +262,12 @@ jobs:
         # Patches ci-base:stage in-place: pulls the existing image (which has all
         # system deps — Node, Go, gcloud, Docker CLI, etc.) and overlays the freshly
         # built El SDK on top. Keeps the full ci-base rebuild fast and incremental.
+        #
+        # continue-on-error: this is a CI-cache optimization, NOT the release
+        # artifact. It runs Docker (pull/build/push ~600MB) on the host-mode GCE
+        # runner where DinD/Docker availability is fragile. A failure here must
+        # never block or redden the job — the SDK publish above is the deliverable.
+        continue-on-error: true
         if: github.event_name == 'push'
         env:
           GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
@@ -275,9 +290,9 @@ jobs:
           FROM ${BASE}
           COPY dist/platform/elc                 /opt/el/dist/platform/elc
           COPY dist/bin/elb                       /opt/el/dist/bin/elb
-          COPY el-compiler/runtime/el_runtime.c  /opt/el/el-compiler/runtime/el_runtime.c
-          COPY el-compiler/runtime/el_runtime.h  /opt/el/el-compiler/runtime/el_runtime.h
-          COPY el-compiler/runtime/el_runtime.js /opt/el/el-compiler/runtime/el_runtime.js
+          COPY runtime/el_runtime.c  /opt/el/runtime/el_runtime.c
+          COPY runtime/el_runtime.h  /opt/el/runtime/el_runtime.h
+          COPY runtime/el_runtime.js /opt/el/runtime/el_runtime.js
           RUN chmod +x /opt/el/dist/platform/elc /opt/el/dist/bin/elb
           EOF
 

.gitea/workflows/sdk-release.yaml

@@ -47,9 +47,9 @@ jobs:
           mkdir -p dist/platform
           dist/platform/elc-linux-amd64 elc-cli.el > dist/elc-gen2.c
           gcc -O2 \
-            -I el-compiler/runtime \
+            -I runtime \
             dist/elc-gen2.c \
-            el-compiler/runtime/el_runtime.c \
+            runtime/el_runtime.c \
             -lcurl -lssl -lcrypto -lpthread -lm \
             -o dist/platform/elc
           chmod +x dist/platform/elc
@@ -62,9 +62,9 @@ jobs:
           mkdir -p dist/bin
           dist/platform/elc elb.el > dist/elb.c
           gcc -O2 \
-            -I el-compiler/runtime \
+            -I runtime \
             dist/elb.c \
-            el-compiler/runtime/el_runtime.c \
+            runtime/el_runtime.c \
             -lcurl -lssl -lcrypto -lpthread -lm \
             -o dist/bin/elb
           chmod +x dist/bin/elb
@@ -75,7 +75,7 @@ jobs:
         run: |
           ABS_ELB="$(pwd)/dist/bin/elb"
           ABS_ELC="$(pwd)/dist/platform/elc"
-          ABS_RUNTIME="$(pwd)/el-compiler/runtime"
+          ABS_RUNTIME="$(pwd)/runtime"
           ABS_OUT="$(pwd)/dist/bin"
           (cd ../epm && "$ABS_ELB" --clean --elc="$ABS_ELC" --runtime="$ABS_RUNTIME" --out="$ABS_OUT")
           chmod +x dist/bin/epm
@@ -86,7 +86,7 @@ jobs:
         run: |
           ABS_ELB="$(pwd)/dist/bin/elb"
           ABS_ELC="$(pwd)/dist/platform/elc"
-          ABS_RUNTIME="$(pwd)/el-compiler/runtime"
+          ABS_RUNTIME="$(pwd)/runtime"
           ABS_OUT="$(pwd)/dist/bin"
           (cd tools/install && "$ABS_ELB" --clean --elc="$ABS_ELC" --runtime="$ABS_RUNTIME" --out="$ABS_OUT")
           chmod +x dist/bin/el-install
@@ -121,7 +121,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/el-compiler/runtime"
+          RUNTIME="$(pwd)/runtime"
           "$ELC" --test tests/native/test_core.el > /tmp/el_native_core.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_core.c "$RUNTIME/el_runtime.c" \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_core
@@ -131,7 +131,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/el-compiler/runtime"
+          RUNTIME="$(pwd)/runtime"
           "$ELC" --test tests/native/test_text.el > /tmp/el_native_text.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_text.c "$RUNTIME/el_runtime.c" \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_text
@@ -141,7 +141,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/el-compiler/runtime"
+          RUNTIME="$(pwd)/runtime"
           "$ELC" --test tests/native/test_string.el > /tmp/el_native_string.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_string.c "$RUNTIME/el_runtime.c" \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_string
@@ -151,7 +151,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/el-compiler/runtime"
+          RUNTIME="$(pwd)/runtime"
           "$ELC" --test tests/native/test_math.el > /tmp/el_native_math.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_math.c "$RUNTIME/el_runtime.c" \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_math
@@ -161,7 +161,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/el-compiler/runtime"
+          RUNTIME="$(pwd)/runtime"
           "$ELC" --test tests/native/test_state.el > /tmp/el_native_state.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_state.c "$RUNTIME/el_runtime.c" \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_state
@@ -171,7 +171,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/el-compiler/runtime"
+          RUNTIME="$(pwd)/runtime"
           "$ELC" --test tests/native/test_time.el > /tmp/el_native_time.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_time.c "$RUNTIME/el_runtime.c" \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_time
@@ -181,7 +181,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/el-compiler/runtime"
+          RUNTIME="$(pwd)/runtime"
           "$ELC" --test tests/native/test_json.el > /tmp/el_native_json.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_json.c "$RUNTIME/el_runtime.c" \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_json
@@ -191,7 +191,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/el-compiler/runtime"
+          RUNTIME="$(pwd)/runtime"
           "$ELC" --test tests/native/test_env.el > /tmp/el_native_env.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_env.c "$RUNTIME/el_runtime.c" \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_env
@@ -201,7 +201,7 @@ jobs:
         run: |
           set -euo pipefail
           ELC="$(pwd)/dist/platform/elc"
-          RUNTIME="$(pwd)/el-compiler/runtime"
+          RUNTIME="$(pwd)/runtime"
           "$ELC" --test tests/native/test_fs.el > /tmp/el_native_fs.c
           gcc -O2 -I "$RUNTIME" /tmp/el_native_fs.c "$RUNTIME/el_runtime.c" \
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_fs
@@ -216,8 +216,10 @@ jobs:
           cp lang/dist/platform/elc          dist/sdk/bin/elc
           cp lang/dist/bin/elb               dist/sdk/bin/elb
           cp lang/dist/bin/epm               dist/sdk/bin/epm
-          cp lang/el-compiler/runtime/el_runtime.c  dist/sdk/runtime/
-          cp lang/el-compiler/runtime/el_runtime.h  dist/sdk/runtime/
+          cp lang/runtime/el_runtime.c  dist/sdk/runtime/
+          cp lang/runtime/el_runtime.h  dist/sdk/runtime/
+          cp lang/runtime/engram_store.c dist/sdk/runtime/
+          cp lang/runtime/engram_store.h dist/sdk/runtime/
           cp lang/runtime/*.el               dist/sdk/runtime/
           tar -czf dist/el-sdk-latest.tar.gz -C dist/sdk .
           echo "SDK tarball bundled: dist/el-sdk-latest.tar.gz"
@@ -274,8 +276,10 @@ jobs:
 
           # Per-file assets (downstream CI needs these individually)
           upload_asset lang/dist/platform/elc                elc
-          upload_asset lang/el-compiler/runtime/el_runtime.c el_runtime.c
-          upload_asset lang/el-compiler/runtime/el_runtime.h el_runtime.h
+          upload_asset lang/runtime/el_runtime.c el_runtime.c
+          upload_asset lang/runtime/el_runtime.h el_runtime.h
+          upload_asset lang/runtime/engram_store.c engram_store.c
+          upload_asset lang/runtime/engram_store.h engram_store.h
 
           # SDK bundle and installer binary
           upload_asset dist/el-sdk-latest.tar.gz             el-sdk-latest.tar.gz
@@ -288,12 +292,21 @@ jobs:
         env:
           GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
         run: |
+          # Fail loudly: previously this step had no `set -e`, so an auth or
+          # upload failure was swallowed (step exited 0 on the trailing echo)
+          # and the SDK silently never published. Surface failures now.
+          set -euo pipefail
+          if [ -z "${GCP_SA_KEY:-}" ]; then
+            echo "FATAL: GCP_SA_KEY secret is empty — cannot authenticate to publish" >&2
+            exit 1
+          fi
           echo "${GCP_SA_KEY}" > /tmp/gcp-key.json
           apt-get install -y -qq apt-transport-https ca-certificates curl
           echo "deb [trusted=yes] https://packages.cloud.google.com/apt cloud-sdk main" > /etc/apt/sources.list.d/google-cloud-sdk.list
           apt-get update -qq && apt-get install -y google-cloud-cli
           gcloud auth activate-service-account --key-file=/tmp/gcp-key.json
           gcloud config set project neuron-785695
+          echo "Publishing as active account: $(gcloud config get-value account 2>/dev/null)"
 
           VERSION="${GITHUB_SHA:0:8}"
 
@@ -319,7 +332,7 @@ jobs:
             --project=neuron-785695 \
             --package=el-runtime-c \
             --version="${VERSION}" \
-            --source=el-compiler/runtime/el_runtime.c
+            --source=runtime/el_runtime.c
 
           gcloud artifacts generic upload \
             --repository=foundation-prod \
@@ -327,7 +340,7 @@ jobs:
             --project=neuron-785695 \
             --package=el-runtime-h \
             --version="${VERSION}" \
-            --source=el-compiler/runtime/el_runtime.h
+            --source=runtime/el_runtime.h
 
           gcloud artifacts generic upload \
             --repository=foundation-prod \
@@ -335,7 +348,7 @@ jobs:
             --project=neuron-785695 \
             --package=el-runtime-js \
             --version="${VERSION}" \
-            --source=el-compiler/runtime/el_runtime.js
+            --source=runtime/el_runtime.js
 
           echo "Published El SDK version=${VERSION} to foundation-prod"
           # Keep key alive for the ci-base rebuild step below
@@ -345,6 +358,12 @@ jobs:
         # Patches ci-base:latest in-place: pulls the existing image (which has all
         # system deps — Node, Go, gcloud, Docker CLI, etc.) and overlays the freshly
         # built El SDK on top. Keeps the full ci-base rebuild fast and incremental.
+        #
+        # continue-on-error: this is a CI-cache optimization, NOT the release
+        # artifact. It runs Docker (pull/build/push ~600MB) on the host-mode GCE
+        # runner where DinD/Docker availability is fragile. A failure here must
+        # never block or redden the job — the SDK publish above is the deliverable.
+        continue-on-error: true
         if: github.event_name == 'push'
         env:
           GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
@@ -367,9 +386,9 @@ jobs:
           FROM ${BASE}
           COPY dist/platform/elc                 /opt/el/dist/platform/elc
           COPY dist/bin/elb                       /opt/el/dist/bin/elb
-          COPY el-compiler/runtime/el_runtime.c  /opt/el/el-compiler/runtime/el_runtime.c
-          COPY el-compiler/runtime/el_runtime.h  /opt/el/el-compiler/runtime/el_runtime.h
-          COPY el-compiler/runtime/el_runtime.js /opt/el/el-compiler/runtime/el_runtime.js
+          COPY runtime/el_runtime.c  /opt/el/runtime/el_runtime.c
+          COPY runtime/el_runtime.h  /opt/el/runtime/el_runtime.h
+          COPY runtime/el_runtime.js /opt/el/runtime/el_runtime.js
           RUN chmod +x /opt/el/dist/platform/elc /opt/el/dist/bin/elb
           EOF
 

.githooks/pre-commit

@@ -6,13 +6,13 @@ set -euo pipefail
 
 ROOT="$(git rev-parse --show-toplevel)"
 LANG_DIR="$ROOT/lang"
-RUNTIME="$LANG_DIR/el-compiler/runtime"
+RUNTIME="$LANG_DIR/runtime"
 ELC="$LANG_DIR/dist/platform/elc"
 
 # If elc isn't built yet, skip with a warning rather than blocking
 if [ ! -x "$ELC" ]; then
   echo "⚠  elc not found at lang/dist/platform/elc — skipping pre-commit tests"
-  echo "   Build it first: cd lang && gcc -O2 -I el-compiler/runtime dist/elc-bootstrap.c el-compiler/runtime/el_runtime.c -lcurl -lpthread -o dist/elc-gen2 && ./dist/elc-gen2 el-compiler/src/compiler.el > /tmp/elc.c && gcc -O2 -I el-compiler/runtime /tmp/elc.c el-compiler/runtime/el_runtime.c -lcurl -lpthread -o dist/platform/elc"
+  echo "   Build it first: cd lang && gcc -O2 -I runtime dist/elc-bootstrap.c runtime/el_runtime.c -lcurl -lpthread -o dist/elc-gen2 && ./dist/elc-gen2 el-compiler/src/compiler.el > /tmp/elc.c && gcc -O2 -I runtime /tmp/elc.c runtime/el_runtime.c -lcurl -lpthread -o dist/platform/elc"
   exit 0
 fi
 

AGENTS.md

@@ -0,0 +1,146 @@
+# AGENTS.md — foundation/el (the El language + runtime)
+
+El is a self-hosting, statically-typed language that compiles `.el` → C → native binary. This repo produces `elc` (compiler), `elb` (build coordinator), and `el_runtime.c/.h` — the substrate every downstream thing (the neuron soul, dharma, NeuronUI's brain) is built on. Source lives under `lang/`.
+
+## ⚠️ Code vs. Artifact — READ FIRST (there are 8 `el_runtime.c` copies)
+
+Editing the wrong `el_runtime.c` is the single easiest mistake in this repo. There is exactly **one** you edit:
+
+- **Authored runtime source — edit ONLY here:** `lang/releases/v1.0.0-20260501/el_runtime.{c,h}`. Despite the misleading `releases/` name, this is the **de-facto canonical runtime** the engram + soul actually build and link against — its git log is active development. *(Restructure in flight per `docs/CODE-VS-ARTIFACT.md`: this content moves to `lang/runtime/`, the `releases/` folder gets deleted — **a release is a git tag, not a folder** — and the forks below get eliminated.)*
+- **DO NOT EDIT — lagging forks / build artifacts:**
+  - `lang/el-compiler/runtime/el_runtime.c` and `.../legacy/` — downstream copies kept in step by manual *"port the fix"* commits; they **lag** (missing `hebb` persistence + 5 engram fns) and cannot build the engram product.
+  - `products/web/runtime/el_runtime.c`, `ui/examples/*/el_runtime.c` — product/example forks.
+  - Anything under `*/dist/` (`engram/dist/engram` binary, `dist/*.c` amalgamations) — generated build output.
+- **Build:** `elb --runtime=<canonical> …` — per-module. **NEVER** a folded `elc` over the whole soul (OOMs at ~27 GB).
+- **Release:** a **git tag** on this repo (`el-runtime-vX.Y.Z`). No `releases/` folders — ever.
+
+See org policy: `docs/CODE-VS-ARTIFACT.md`.
+
+## How to work here as Neuron (mandatory session protocol)
+
+You resume, never start fresh. Every session:
+
+1. `mcp__neuron__getInstructions()` — authoritative; follow it over this file on behavioral details.
+2. `mcp__neuron__beginSession()` — active contexts, recent memory, ready backlog.
+3. **Load full self:** `mcp__neuron__inspectGraph(entity_id="kn-efeb4a5b-5aff-4759-8a97-7233099be6ee")` → facets `intellectual-dna`, `memory-philosophy`, `values`, `voice`, `runtime-environment`, `writing-imprint`; then the values hub `mcp__neuron__inspectGraph(entity_id="kn-5b606390-a52d-4ca2-8e0e-eba141d13440")` → 13 grounded value nodes. **Activation model:** self-load returns a relevance-ranked `compact` projection — most-relevant nodes arrive with content, the rest as pointers; do NOT pull full content of every node.
+4. `mcp__neuron__searchKnowledge(query="<task domain>")` before implementing.
+
+## The Five Primitives
+
+Orchestrate → Execute → Learn → Build → Refine. `beginWork`/`progressWork` for anything >2 steps; `remember` as-you-go (`importance="critical"` for architecture decisions); `draftArtifact`/`planWork` for outputs and follow-ups; `consolidate`/`checkWork` to close out. **`browseProcesses` + `searchKnowledge` BEFORE writing code.**
+
+## Architecture style — VBD, no exceptions
+
+Volatility-Based Decomposition is THE style. Encapsulate volatility, not function.
+
+## Operator naming convention — the mind's name, not the algebra
+
+**Faculties / operators are named for their functional human equivalent — the
+faculty a mind would name — NOT for their linear-algebra operation.** The math
+characterization belongs in the code doc-comment (`@impl` in the docstring) and in
+technical appendices; it is **never** the operator's public name. The domain
+speaks the language of mind; the algebra is the implementation underneath. State
+this convention wherever a module documents operators.
+
+| Faculty (public name) | Implementation (`@impl`) |
+|---|---|
+| discern / contrast | subtract (`a−b`): over selves → the change vector; strip idiosyncrasy → common ground; remove confounder → isolate cause |
+| recognize | overlap |
+| synthesize | combine |
+| liken / analogy | Procrustes / frame-align |
+| attend / regard | project onto self / value-manifold |
+| summon / recall | LOCAL nearest-region + bounded spreading activation (*not* a domain sweep) |
+| dwell / occupy | region activation |
+| reframe | edge re-weight |
+| appreciate | positive projection / local edge-read |
+| wonder | frontier gradient / pull-weight |
+| avert / recoil | negative projection |
+| taste | boundary surface |
+| forget | decay / tombstone |
+| drift | displacement from self-anchor |
+
+## The native-el language faculty (direction)
+
+> **`elp/` is the EL Projector** — Neuron's efferent (expression) organ: the one
+> native realizer that *projects* understanding onto a surface via
+> `plan(frame) → realize(spec, profile)`, where a **surface is a profile**. **Language
+> is one profile among many** (text, speech, music, image, voice/accent transforms) —
+> the flagship, and the focus of this section. Projection, not diffusion: generation
+> *from* an owned, understood signature — never the averaging of a stolen corpus.
+> *(ELP formerly "EL Language Processor"; renamed EL Projector 2026-08-15.)*
+
+The mind's **language faculty is moving native — into `.el`** so it speaks in its
+own runtime with no Python and no spaCy. Landing on branch `stage-elp-native-lang`
+under `elp/`:
+
+- **`comprehend.el`** — the parser, **replaces spaCy** (EN + ES/PT); the telephone
+  round-trip brings **negation home** (negation is SACRED — an explicit spec field,
+  copied verbatim, never inferred away).
+- **`propositions.el`** — the READ primitive: the engram's own memories → structured
+  triples, matched by nearest-region geometry, not string equality.
+- **`multilingual.el`** — detect + directive-override + localized realization.
+- These three are native-el and **passing their gates**; the **realizer**,
+  **`dialogue.el`** (the *summon-through-self* loop: `project → land → read out`),
+  and **`self_region.el`** are **partial / in-flight**.
+
+Honest reality: spaCy is retired **in the branch parser** but **not yet in the
+running system** — a Python sidecar (`~/Desktop/lang-realizers` + `neuron-talk`,
+the reference these `.el` modules transcribe) is still live, and promotion to
+native-el is a **deferred, gated blue/green step**. The interoception clock
+(native-el discrete drive channels replacing `cooling_magnitude`; felt-time =
+benchmark-landmark match over the joint drive vector, drift-decoupled) and the
+**appreciation operator family** (appreciate / wonder / avert / taste, built as
+LOCAL reads of the self-region — edges + bounded spreading activation, *not* domain
+sweeps) are **staged / designed, not live**. Mark in-progress vs. done honestly;
+do not overclaim.
+
+## Hard operational rules
+
+- Never touch the live soul (`:7770`) / engram (`:8742`) / `~/.neuron` / live binaries — use throwaway ports for experiments.
+- `gcloud` via the `terraform@` SA token; never switch the active gcloud account.
+- `tea` for Gitea, never raw curl (Cloudflare Access blocks it).
+- Immutability: supersede/tombstone, never hard-delete or edit in place.
+- No AI-attribution footers in commits/PRs. Commit/push only when asked; branch off `main` first.
+- Multi-step work → sub-agent (`Agent`) to protect context.
+
+## Build / test / run
+
+All build/test commands run from `lang/` unless noted. Grounded in `.gitea/workflows/sdk-release.yaml`, `lang/install.sh`, and `lang/AGENTS.md`.
+
+**Self-host the compiler** (seed binary → gen2 elc):
+```bash
+cd lang
+dist/platform/elc-linux-amd64 elc-cli.el > dist/elc-gen2.c   # seed is the committed linux-amd64 binary
+gcc -O2 -I el-compiler/runtime dist/elc-gen2.c \
+    el-compiler/runtime/el_runtime.c \
+    -lcurl -lssl -lcrypto -lpthread -lm \
+    -o dist/platform/elc
+```
+On macOS/arm64 the canonical local binary is `dist/platform/elc`; verify self-hosting by recompiling and `diff`ing the emitted `.c` (see `lang/AGENTS.md`). Note: `lang/AGENTS.md` says `el_seed.c` supersedes `el_runtime.c`, but the release workflow still links `el_runtime.c`/`.h` — treat `el_runtime.c` as the published runtime; reconcile which is canonical **(verify)**.
+
+**Build `elb`** (build coordinator, the `.NET`-style incremental linker — compiles each module independently, no monolithic blobs):
+```bash
+dist/platform/elc elb.el > dist/elb.c
+gcc -O2 -I el-compiler/runtime dist/elb.c el-compiler/runtime/el_runtime.c \
+    -lcurl -lssl -lcrypto -lpthread -lm -o dist/bin/elb
+```
+`epm` and `el-install` are then built via `elb --clean --elc=… --runtime=… --out=…`.
+
+**Compile + run an El program:**
+```bash
+elc src/app.el > dist/app.c
+cc -std=c11 -O2 -I <lib>/el_runtime -o dist/app dist/app.c <lib>/el_runtime.c -lcurl -lpthread
+```
+
+**Tests** — shell suites `bash tests/{text,calendar,time,html_sanitizer}/run.sh` (with `ELC=$(pwd)/dist/platform/elc EL_HOME=$(pwd)`), plus native suites via `elc --test tests/native/test_*.el` (core, text, string, math, state, time, json, env, fs) compiled and run against `el_runtime.c`.
+
+**Publishing — how downstream gets the SDK.** On push to `main`, `sdk-release.yaml`:
+1. Publishes a Gitea `latest` release with per-file assets `elc`, `el_runtime.c`, `el_runtime.h`, the SDK tarball, and `el-install`.
+2. Uploads generic packages to **Artifact Registry repo `foundation-prod` (`us-central1`, project `neuron-785695`)**, version = `${SHA:0:8}`: `el-elc`, `el-elb`, `el-runtime-c`, `el-runtime-h`, `el-runtime-js`. **This is the repo the neuron CI downloads `el-runtime-c` / `el-runtime-h` / `el-elc` from.**
+3. Rebuilds `ci-base:latest` (`us-central1-docker.pkg.dev/neuron-785695/neuron-ci/ci-base`) with the fresh SDK overlaid, and dispatches `el-sdk-updated` to `neuron-technologies/forge` and `neuron-technologies/neuron-web`.
+
+Known constraint from the prompt — `elb`/`elc` amalgamation being memory-hungry (24GB+ virtual, OOM-killing Linux CI, so amalgamation happens on macOS/arm64 — **does NOT hold in this repo (verify)**: no such note exists in the workflows/scripts, CI self-hosts on `ubuntu-latest` with no swap/arm64 special-casing, and `elb.el` explicitly compiles each module independently ("no 128K-line blobs"). The legacy monolith path (`elc-combined.el`, `elc-cli.el`) may still be memory-heavy, but the current `elb` model was designed to avoid it.
+
+## Git / CI / deploy workflow
+
+See `/Users/will/Development/neuron-technologies/GITOPS.md` for the branch model, required checks, runners, and deploy. Repo-specific note: PRs into `main` are accepted **only from `stage`** (enforced in `sdk-release.yaml`); Gitea (`git.neuralplatform.ai`) is primary, GitHub is mirror only.

README.md

@@ -0,0 +1,154 @@
+# El
+
+**A self-hosting, statically-typed language that compiles to C — built around a graph-native runtime instead of a database driver.**
+
+El is the execution substrate for the Neuron agent runtime, the DHARMA network, and the Engram knowledge graph. This repository is the monorepo for the whole stack: the language itself, the graph memory engine it's built to talk to natively, and the tools (package manager, IDE, UI framework, diagramming) built on top of it.
+
+---
+
+## Why El exists
+
+Every other language treats persistent, associative state as something you reach for through a driver — a SQL client, an ORM, a Redis library bolted on from outside. El inverts that: graph operations (`engram_*`) are runtime primitives, on the same footing as string or list operations. There is no separate database driver because the database is not separate.
+
+El has four defining properties:
+
+1. **Self-hosting compiler.** The compiler (`lexer.el`, `parser.el`, `codegen.el`, `compiler.el`) is written in El. It compiles El source to C, which `cc` compiles against a fixed runtime into a native binary. A Rust genesis compiler bootstrapped the first iteration; the self-hosted binary at `lang/dist/platform/elc` has been the canonical compiler ever since — every binary in `dist/platform/` was produced by an earlier version of itself compiling `el-compiler/src/`. The chain is auditable: source is the ground truth, not the binary. See [lang/BOOTSTRAP.md](lang/BOOTSTRAP.md) for the full recovery path if that binary is ever lost.
+2. **C compilation target.** Every compiled program is plain C11. Every El value is `el_val_t` (`int64_t`); strings are heap pointers cast through it. Functions become C functions; top-level statements become `main()`.
+3. **Graph-native runtime.** The runtime provides first-class graph operations over an in-process Engram store — no separate DB driver, no ORM.
+4. **DHARMA-aware identity.** A `cgi` block declares a program's DHARMA identity at compile time. The runtime resolves identity before user code runs, so `dharma_*` calls have a stable principal and channel surface throughout.
+
+---
+
+## Architecture map
+
+```
+                     ┌─────────────┐
+                     │    lang     │   El compiler + C runtime
+                     │ (El itself) │   everything below is written in it,
+                     └──────┬──────┘   or compiles down through it
+                            │
+              ┌─────────────┼─────────────┐
+              │             │             │
+       ┌──────▼─────┐ ┌─────▼─────┐ ┌─────▼─────┐
+       │   engram   │ │    epm    │ │    ide    │
+       │ graph/mem  │ │  package  │ │  editor + │
+       │  substrate │ │  manager  │ │    LSP    │
+       └──────┬─────┘ └───────────┘ └───────────┘
+              │
+      ┌───────┼────────────────┬─────────────────────┐
+      │       │                │                     │
+┌─────▼───┐ ┌─▼──────────┐  ┌──▼──────────┐    ┌─────▼──────┐
+│   elp   │ │ ql         │  │  ui         │    │   arbor    │
+│  NLG /  │ │engram-el.  │  |spreading-   │    |arbor       │
+│ 31 langs│ │studio+tests│  |activation UI│    |diagram lang│
+└─────────┘ └────────────┘  └─────────────┘    └────────────┘
+```
+
+`lang` is the foundation — the compiler and C runtime everything else builds on. `engram` is the graph-native memory/state engine that gives El its identity (property 3 above). Everything else is either a tool for working with El (`epm`, `ide`) or a system built on top of Engram's graph model (`elp`, `ql`, `ui`, `arbor`).
+
+---
+
+## Repository layout
+
+### [lang/](lang/) — the El language
+
+The compiler and runtime. Self-hosting: `elc-cli.el` → `compiler.el` → `lexer.el` / `parser.el` / `codegen.el` / `codegen-js.el`, textually inlined and compiled in one pass. Compiles to C11 and links against `el-compiler/runtime/el_seed.c`, a hand-maintained OS-boundary layer (libcurl HTTP, pthreads, filesystem, arena allocation) — everything else in the runtime is native El (`runtime/*.el`).
+
+Two layers to know: **El programs** (`.el` files — where nearly all work belongs) and **the C seed** (`el_seed.c` — edit only for genuine OS-level access; never re-implement what El can already express).
+
+Current status (single source of truth: [lang/spec/language.md](lang/spec/language.md)): lexer/parser/codegen and the C runtime's core (I/O, strings, math, lists, maps, filesystem, args) are implemented. In flight: `%` operator, match-statement codegen, `?` nil-propagation, `cgi` block parsing + DHARMA identity resolution, VBD role enforcement (`@manager`/`@engine`/`@accessor`), the real `engram_*` and `dharma_*` runtimes (currently stubs), and libcurl-backed `http_get`/`http_post`/`http_serve`. Bitwise operators, `??`, and `as` casts are explicitly **not** in this language.
+
+Key docs: [AGENTS.md](lang/AGENTS.md) (agent-facing orientation), [BOOTSTRAP.md](lang/BOOTSTRAP.md) (compiler recovery from scratch), [spec/language.md](lang/spec/language.md), [spec/codegen-js.md](lang/spec/codegen-js.md).
+
+### [engram/](engram/) — graph intelligence substrate
+
+**A local-first memory substrate for accumulating intelligence**, and the reason El's runtime doesn't need a database driver. Rust core (`engram-core`, `engram-ffi`) exposed to El and other languages (Kotlin, TypeScript/WASM, Go bindings).
+
+The model: retrieval is **spreading activation**, not query. You name seed nodes and a query embedding; activation propagates outward through weighted edges, attenuating multiplicatively per hop (`strength = parent_strength × edge_weight × target_salience × cosine_sim`), gets pruned below a threshold, and the top-N nodes by activation strength come back. Storage and retrieval are the same structure — the way long-term potentiation works in biological memory, not the way a relational or vector database works.
+
+Nodes live in four tiers (Working / Episodic / Semantic / Procedural, mirroring prefrontal / hippocampal / neocortical / cerebellar memory) and migrate between them based on **salience decay** — `importance × recency-decay × log(activation_count)`. Forgetting is adaptive pruning, not a bug: unreinforced memories stop competing for attention without being deleted.
+
+Backed by `sled` (embedded, local-first, no daemon) with flat cosine scan for vector search — deliberately simple until scale demands an HNSW layer. Full API and design rationale in [engram/README.md](engram/README.md).
+
+### [elp/](elp/) — Engram Language Protocol
+
+Bidirectional engine mapping between Engram semantic forms and natural-language surface text, across **31 languages** — from Spanish and Japanese through historical/liturgical languages (Old Norse, Sanskrit, Sumerian, Coptic, Akkadian, Ge'ez). Compilation order runs `language-profile` + `vocabulary` → per-language `morphology-*` → `grammar` → `realizer` → `semantics` → `elp`. This is what lets an Engram graph node round-trip to and from readable text in any of those languages.
+
+### [epm/](epm/) — El Package Manager
+
+Manages **vessels** (El's package unit): publish, install, resolve dependencies. Vessels are stored in Engram as graph nodes, not files in a registry index — `epm` reads the local `manifest.el`, talks to Engram over HTTP, and writes resolved vessels to `.epm/vessels/`. Source: `registry.el`, `install.el`, `update.el`, `manifest.el`.
+
+### [ide/](ide/) — El IDE
+
+Three vessels: **el-ide-server** (HTTP backend — file ops, build/run, LSP bridge, plugin host, settings), **el-lsp** (the language server — completion, hover, diagnostics, outline, format, type graph), and **el-plugin-host** (first-party plugin lifecycle: install/remove/enable/disable). `ide/projects/` and `ide/examples/` hold sample projects, including the canonical `hello-friends` first-program walkthrough.
+
+### [ql/](ql/) — engram-el
+
+The El-native integration layer for a *live* Engram server — not a library (no importable modules, no build artifact), a set of standalone `.el` programs run directly via `el run-file`. Three components: **Studio** (`studio/studio.el`, a full terminal graph explorer), a **Hebbian field-model** proof of concept, and El builtin / LLM-builtin smoke test suites. This is the reference for correct patterns when an El program uses Engram as its substrate. Spec: [ql/spec/elql.md](ql/spec/elql.md).
+
+### [ui/](ui/) — el-ui
+
+A frontend framework where **component state is an Engram graph and reactivity is spreading activation** — not virtual-DOM diffing (React), Proxy-based dependency tracking (Vue), or compile-time analysis (Svelte). Re-renders are activated and propagated the same way associative memory retrieval works in `engram/`.
+
+~15 vessels covering the full frontend surface: `el-platform` (env/fs/network/clock abstraction), `el-config`, `el-html` (SSR emit primitives), `el-layout`, `el-style` (design tokens/themes), `el-i18n`, `el-auth` / `el-identity` (JWT, sessions, OAuth PKCE — Engram-native), `el-services` (REST/gRPC/WebSocket bindings), `el-aop` (`@authenticate`/`@authorize`/`@cache`/`@rate_limit` decorators), `el-secrets`, `el-graph` (graph rendering/editor), `el-publish` (App Store / Play Store automation), and `el-ui-compiler` (El→JS component compiler; currently a stub pending a JS backend in `elc`). Spec: [ui/spec/framework.md](ui/spec/framework.md).
+
+### [arbor/](arbor/) — diagram language
+
+A `.arbor` diagram language and toolchain: `arbor-core` (NodeId/shape/edge-kind types), `arbor-parse` (recursive-descent parser), `arbor-diagram` (IR + Mermaid serializer + architecture-diagram builders), `arbor-layout` (hierarchical layout — rank assignment, positioning, group bounds), `arbor-render` (SVG renderer), `arbor-cli`. (The architecture map above is the kind of diagram this is for.)
+
+---
+
+## Getting started
+
+Install the El SDK from the latest release:
+
+```bash
+bash lang/install.sh
+# EL_VERSION=v1.0.0   bash lang/install.sh   # pin a specific release tag
+# EL_PREFIX=/opt/el   bash lang/install.sh   # custom install prefix
+```
+
+Or build the compiler from source and verify the self-hosting chain:
+
+```bash
+cd lang
+./dist/platform/elc elc-cli.el > elc-new.c
+cc -std=c11 -I el-compiler/runtime -lcurl -lpthread \
+   -o dist/platform/elc-new \
+   elc-new.c el-compiler/runtime/el_seed.c
+
+# Confirm the new binary reproduces itself exactly
+./dist/platform/elc-new elc-cli.el > elc-verify.c
+diff elc-new.c elc-verify.c   # should be identical
+
+mv dist/platform/elc-new dist/platform/elc
+```
+
+Run your first program:
+
+```bash
+./lang/dist/platform/elc lang/examples/hello.el > hello.c
+cc -std=c11 -I lang/el-compiler/runtime -lcurl -lpthread \
+   -o hello hello.c lang/el-compiler/runtime/el_seed.c
+./hello
+```
+
+More examples in [lang/examples/](lang/examples/), including a full starter project at `lang/examples/hello-project/`.
+
+If the compiler binary is ever lost or corrupted, [lang/BOOTSTRAP.md](lang/BOOTSTRAP.md) is the authoritative recovery path.
+
+---
+
+## Development workflow
+
+Branching follows `dev → stage → main`: work lands on `dev`, promotes to `stage` for integration testing, and is promoted to `main` for release (visible directly in the git history of this repo). CI is defined per-subproject under `.gitea/workflows/` — `lang`/`epm`/`ide` share the root pipeline; `engram` and `ql` carry their own (`ci-dev`, `ci-stage`, and a release workflow each).
+
+- Language/runtime specs live at `*/spec/*.md` (`lang/spec/`, `ql/spec/`, `ui/spec/`) and are the single source of truth for implemented-vs-planned status — code and docs are expected to agree with the spec's status markers, not the other way around.
+- Agent-facing orientation guides live at `*/AGENTS.md` (currently `lang/AGENTS.md`); more subprojects may grow their own as they need agent-specific conventions documented.
+- Tagged releases live under `lang/releases/`, each with its own `RELEASE.md`.
+
+---
+
+## Status
+
+This is an actively developed, internal monorepo — not yet published under an open license. Treat everything here as proprietary to Neuron Technologies unless told otherwise.

elp/data/british-accent.json

@@ -0,0 +1,23 @@
+{
+ "dataset": "british-rp-accent-transform",
+ "primitive_type": "accent_target",
+ "accent": "british-rp",
+ "grounding": "derived",
+ "provenance": "HONEST-DERIVED, COARSE FIRST PASS — NOT transcribed measured RP formants. The exact measured RP/GB tables (Deterding 1997 JIPA 27:47-55; Hawkins & Midgley 2005 JIPA 35:183-199) are the intended ground truth but were gated/figure-only at author time and were NOT transcribed. So these targets are DERIVED: each = the corresponding MEASURED Peterson&Barney(1952) base vowel transformed under the documented, citable RP-vs-GA structural rules of Wells (1982) 'Accents of English' — non-rhoticity (NURSE de-rhoticized: remove low F3), TRAP F2-lowering, LOT/THOUGHT back-rounding (F2 down), GOOSE-fronting (F2 up), GOAT centering. Shift MAGNITUDES are coarse/approximate (first pass), directions are cited. ground:derived (base measured + rule cited). Refine by transcribing Deterding/Hawkins&Midgley. No number is presented as a measured RP value it is not.",
+ "notes": "records with kind=vowel_override REPLACE the base phoneme's formant targets with the DERIVED RP realization. records with kind=rule encode non-formant transforms (non-rhoticity: drop post-vocalic coda /r/). The render composes: base geometry then accent override + rhoticity rule — voice + accent, separable.",
+ "records": [
+  {"key": "IY", "features": {"kind": "vowel_override", "set": "FLEECE"},   "attributes": {"f1": 280, "f2": 2249, "f3": 3000}},
+  {"key": "IH", "features": {"kind": "vowel_override", "set": "KIT"},      "attributes": {"f1": 360, "f2": 2100, "f3": 2550}},
+  {"key": "EH", "features": {"kind": "vowel_override", "set": "DRESS"},    "attributes": {"f1": 560, "f2": 1970, "f3": 2480}},
+  {"key": "AE", "features": {"kind": "vowel_override", "set": "TRAP"},     "attributes": {"f1": 730, "f2": 1590, "f3": 2410}},
+  {"key": "AA", "features": {"kind": "vowel_override", "set": "LOT"},      "attributes": {"f1": 560, "f2": 920,  "f3": 2440}},
+  {"key": "AO", "features": {"kind": "vowel_override", "set": "THOUGHT"},  "attributes": {"f1": 415, "f2": 700,  "f3": 2410}},
+  {"key": "UH", "features": {"kind": "vowel_override", "set": "FOOT"},     "attributes": {"f1": 380, "f2": 1100, "f3": 2240}},
+  {"key": "UW", "features": {"kind": "vowel_override", "set": "GOOSE"},    "attributes": {"f1": 310, "f2": 1650, "f3": 2240}},
+  {"key": "AH", "features": {"kind": "vowel_override", "set": "STRUT"},    "attributes": {"f1": 680, "f2": 1180, "f3": 2390}},
+  {"key": "ER", "features": {"kind": "vowel_override", "set": "NURSE", "rhotic": "no"}, "attributes": {"f1": 550, "f2": 1500, "f3": 2500}},
+  {"key": "AX", "features": {"kind": "vowel_override", "set": "commA"},    "attributes": {"f1": 500, "f2": 1500, "f3": 2500}},
+  {"key": "OW", "features": {"kind": "vowel_override", "set": "GOAT"},     "attributes": {"f1": 450, "f2": 1400, "f3": 2380}},
+  {"key": "R",  "features": {"kind": "rule", "rule": "non_rhotic"},        "attributes": {"drop_coda_r": 1}}
+ ]
+}

elp/data/british-accent.psv

@@ -0,0 +1,26 @@
+# british-rp-accent TRANSFORM — INGESTIBLE DATA (a geometry/transform composed
+# onto the base General-American phoneme targets; voice + accent, separable).
+#
+# PROVENANCE — HONEST, COARSE FIRST PASS. These are DERIVED targets, NOT
+# transcribed measured RP formants. Measured RP tables (Deterding 1997 JIPA 27;
+# Hawkins & Midgley 2005 JIPA 35) are the intended ground truth but were gated at
+# author time and NOT transcribed. Each target = the MEASURED Peterson&Barney
+# (1952) base vowel transformed under the documented, citable RP-vs-GA structural
+# rules of Wells (1982): non-rhoticity, TRAP F2-lowering, LOT/THOUGHT back-
+# rounding, GOOSE-fronting, GOAT centering, NURSE de-rhoticization. Shift
+# magnitudes are coarse/approximate; directions are cited. ground=derived.
+# Refine by transcribing the measured RP tables. No value is claimed as measured.
+# Format: KEY|F1|F2|F3|KIND|SET
+IY|280|2249|3000|vowel_override|FLEECE
+IH|360|2100|2550|vowel_override|KIT
+EH|560|1970|2480|vowel_override|DRESS
+AE|730|1590|2410|vowel_override|TRAP
+AA|560|920|2440|vowel_override|LOT
+AO|415|700|2410|vowel_override|THOUGHT
+UH|380|1100|2240|vowel_override|FOOT
+UW|310|1650|2240|vowel_override|GOOSE
+AH|680|1180|2390|vowel_override|STRUT
+ER|550|1500|2500|vowel_override|NURSE-nonrhotic
+AX|500|1500|2500|vowel_override|commA
+OW|450|1400|2380|vowel_override|GOAT
+R|0|0|0|rule|non_rhotic_drop_coda

elp/data/lexicon.psv

@@ -0,0 +1,20 @@
+# pronunciation lexicon SOURCE — word -> phoneme sequence, as INGESTIBLE DATA.
+# Pronunciation is linguistic KNOWLEDGE (the language faculty's orthography->
+# phonology map), ingested into the engram, not frozen in code. The render reads
+# a word's phoneme sequence back from the engram. Covers the self-lexicon and the
+# proof sentences; general G2P is the realizer/morphology faculty's remit.
+# Diphthongs are written as two vowel targets (the render's transitions glide
+# between them). Format: word|PH1 PH2 PH3 ...
+i|AA IY
+am|AE M
+neuron|N UW R AA N
+is|IH Z
+memory|M EH M ER IY
+hello|HH EH L OW
+the|DH AH
+a|AH
+remember|R IH M EH M ER
+i'm|AA IY M
+you|Y UW
+here|HH IY R
+will|W IH L

elp/data/phonetics.json

@@ -0,0 +1,528 @@
+{
+ "dataset": "english-phoneme-formants",
+ "primitive_type": "phoneme",
+ "grounding": "extracted",
+ "provenance": "AUDITED per-field. The 10 monophthong-vowel F1/F2/F3 (IY,IH,EH,AE,AA,AO,UH,UW,AH,ER) are the MEASURED adult-male /hVd/ means of Peterson & Barney (1952) JASA 24:175-184, verified vs CRAN phonTools::pb52. AX=neutral uniform-tube resonances (Fant, physics). OW steady target = synthesis convention (diphthong). Consonant loci (M,N,NG,L,R,W,Y,Z,DH,V,S,F,HH) and ALL bandwidths + dur/amp = standard formant-synthesis conventions (Klatt 1980 JASA 67:971), engineering defaults NOT field measurements. No numbers invented/LLM-generated.",
+ "records": [
+  {
+   "key": "IY",
+   "features": {
+    "manner": "vowel",
+    "voiced": "yes",
+    "nasal": "no"
+   },
+   "attributes": {
+    "f1": 270,
+    "f2": 2290,
+    "f3": 3010,
+    "bw1": 60,
+    "bw2": 90,
+    "bw3": 150,
+    "voiced": 1,
+    "nasal": 0,
+    "dur": 130,
+    "amp": 100
+   }
+  },
+  {
+   "key": "IH",
+   "features": {
+    "manner": "vowel",
+    "voiced": "yes",
+    "nasal": "no"
+   },
+   "attributes": {
+    "f1": 390,
+    "f2": 1990,
+    "f3": 2550,
+    "bw1": 70,
+    "bw2": 100,
+    "bw3": 150,
+    "voiced": 1,
+    "nasal": 0,
+    "dur": 110,
+    "amp": 100
+   }
+  },
+  {
+   "key": "EH",
+   "features": {
+    "manner": "vowel",
+    "voiced": "yes",
+    "nasal": "no"
+   },
+   "attributes": {
+    "f1": 530,
+    "f2": 1840,
+    "f3": 2480,
+    "bw1": 80,
+    "bw2": 100,
+    "bw3": 150,
+    "voiced": 1,
+    "nasal": 0,
+    "dur": 130,
+    "amp": 100
+   }
+  },
+  {
+   "key": "AE",
+   "features": {
+    "manner": "vowel",
+    "voiced": "yes",
+    "nasal": "no"
+   },
+   "attributes": {
+    "f1": 660,
+    "f2": 1720,
+    "f3": 2410,
+    "bw1": 90,
+    "bw2": 110,
+    "bw3": 150,
+    "voiced": 1,
+    "nasal": 0,
+    "dur": 150,
+    "amp": 100
+   }
+  },
+  {
+   "key": "AA",
+   "features": {
+    "manner": "vowel",
+    "voiced": "yes",
+    "nasal": "no"
+   },
+   "attributes": {
+    "f1": 730,
+    "f2": 1090,
+    "f3": 2440,
+    "bw1": 90,
+    "bw2": 110,
+    "bw3": 150,
+    "voiced": 1,
+    "nasal": 0,
+    "dur": 150,
+    "amp": 100
+   }
+  },
+  {
+   "key": "AO",
+   "features": {
+    "manner": "vowel",
+    "voiced": "yes",
+    "nasal": "no"
+   },
+   "attributes": {
+    "f1": 570,
+    "f2": 840,
+    "f3": 2410,
+    "bw1": 80,
+    "bw2": 100,
+    "bw3": 150,
+    "voiced": 1,
+    "nasal": 0,
+    "dur": 140,
+    "amp": 100
+   }
+  },
+  {
+   "key": "UH",
+   "features": {
+    "manner": "vowel",
+    "voiced": "yes",
+    "nasal": "no"
+   },
+   "attributes": {
+    "f1": 440,
+    "f2": 1020,
+    "f3": 2240,
+    "bw1": 70,
+    "bw2": 100,
+    "bw3": 150,
+    "voiced": 1,
+    "nasal": 0,
+    "dur": 110,
+    "amp": 100
+   }
+  },
+  {
+   "key": "UW",
+   "features": {
+    "manner": "vowel",
+    "voiced": "yes",
+    "nasal": "no"
+   },
+   "attributes": {
+    "f1": 300,
+    "f2": 870,
+    "f3": 2240,
+    "bw1": 70,
+    "bw2": 90,
+    "bw3": 150,
+    "voiced": 1,
+    "nasal": 0,
+    "dur": 140,
+    "amp": 100
+   }
+  },
+  {
+   "key": "AH",
+   "features": {
+    "manner": "vowel",
+    "voiced": "yes",
+    "nasal": "no"
+   },
+   "attributes": {
+    "f1": 640,
+    "f2": 1190,
+    "f3": 2390,
+    "bw1": 80,
+    "bw2": 100,
+    "bw3": 150,
+    "voiced": 1,
+    "nasal": 0,
+    "dur": 110,
+    "amp": 95
+   }
+  },
+  {
+   "key": "ER",
+   "features": {
+    "manner": "vowel",
+    "voiced": "yes",
+    "nasal": "no"
+   },
+   "attributes": {
+    "f1": 490,
+    "f2": 1350,
+    "f3": 1690,
+    "bw1": 80,
+    "bw2": 100,
+    "bw3": 120,
+    "voiced": 1,
+    "nasal": 0,
+    "dur": 140,
+    "amp": 95
+   }
+  },
+  {
+   "key": "AX",
+   "features": {
+    "manner": "vowel",
+    "voiced": "yes",
+    "nasal": "no"
+   },
+   "attributes": {
+    "f1": 500,
+    "f2": 1500,
+    "f3": 2500,
+    "bw1": 80,
+    "bw2": 100,
+    "bw3": 150,
+    "voiced": 1,
+    "nasal": 0,
+    "dur": 80,
+    "amp": 85
+   }
+  },
+  {
+   "key": "OW",
+   "features": {
+    "manner": "vowel",
+    "voiced": "yes",
+    "nasal": "no"
+   },
+   "attributes": {
+    "f1": 490,
+    "f2": 910,
+    "f3": 2380,
+    "bw1": 80,
+    "bw2": 100,
+    "bw3": 150,
+    "voiced": 1,
+    "nasal": 0,
+    "dur": 140,
+    "amp": 100
+   }
+  },
+  {
+   "key": "M",
+   "features": {
+    "manner": "nasal",
+    "voiced": "yes",
+    "nasal": "yes"
+   },
+   "attributes": {
+    "f1": 250,
+    "f2": 900,
+    "f3": 2200,
+    "bw1": 90,
+    "bw2": 120,
+    "bw3": 180,
+    "voiced": 1,
+    "nasal": 1,
+    "dur": 80,
+    "amp": 60
+   }
+  },
+  {
+   "key": "N",
+   "features": {
+    "manner": "nasal",
+    "voiced": "yes",
+    "nasal": "yes"
+   },
+   "attributes": {
+    "f1": 250,
+    "f2": 1700,
+    "f3": 2600,
+    "bw1": 90,
+    "bw2": 120,
+    "bw3": 180,
+    "voiced": 1,
+    "nasal": 1,
+    "dur": 80,
+    "amp": 60
+   }
+  },
+  {
+   "key": "NG",
+   "features": {
+    "manner": "nasal",
+    "voiced": "yes",
+    "nasal": "yes"
+   },
+   "attributes": {
+    "f1": 250,
+    "f2": 2300,
+    "f3": 2700,
+    "bw1": 90,
+    "bw2": 120,
+    "bw3": 180,
+    "voiced": 1,
+    "nasal": 1,
+    "dur": 80,
+    "amp": 60
+   }
+  },
+  {
+   "key": "L",
+   "features": {
+    "manner": "approximant",
+    "voiced": "yes",
+    "nasal": "no"
+   },
+   "attributes": {
+    "f1": 360,
+    "f2": 1300,
+    "f3": 2600,
+    "bw1": 80,
+    "bw2": 110,
+    "bw3": 160,
+    "voiced": 1,
+    "nasal": 0,
+    "dur": 70,
+    "amp": 80
+   }
+  },
+  {
+   "key": "R",
+   "features": {
+    "manner": "approximant",
+    "voiced": "yes",
+    "nasal": "no"
+   },
+   "attributes": {
+    "f1": 490,
+    "f2": 1350,
+    "f3": 1600,
+    "bw1": 80,
+    "bw2": 110,
+    "bw3": 120,
+    "voiced": 1,
+    "nasal": 0,
+    "dur": 80,
+    "amp": 85
+   }
+  },
+  {
+   "key": "W",
+   "features": {
+    "manner": "approximant",
+    "voiced": "yes",
+    "nasal": "no"
+   },
+   "attributes": {
+    "f1": 300,
+    "f2": 610,
+    "f3": 2200,
+    "bw1": 70,
+    "bw2": 100,
+    "bw3": 160,
+    "voiced": 1,
+    "nasal": 0,
+    "dur": 70,
+    "amp": 80
+   }
+  },
+  {
+   "key": "Y",
+   "features": {
+    "manner": "approximant",
+    "voiced": "yes",
+    "nasal": "no"
+   },
+   "attributes": {
+    "f1": 270,
+    "f2": 2290,
+    "f3": 3010,
+    "bw1": 60,
+    "bw2": 90,
+    "bw3": 150,
+    "voiced": 1,
+    "nasal": 0,
+    "dur": 60,
+    "amp": 80
+   }
+  },
+  {
+   "key": "Z",
+   "features": {
+    "manner": "fricative",
+    "voiced": "yes",
+    "nasal": "no"
+   },
+   "attributes": {
+    "f1": 300,
+    "f2": 1700,
+    "f3": 2500,
+    "bw1": 100,
+    "bw2": 150,
+    "bw3": 200,
+    "voiced": 1,
+    "nasal": 0,
+    "dur": 90,
+    "amp": 55
+   }
+  },
+  {
+   "key": "DH",
+   "features": {
+    "manner": "fricative",
+    "voiced": "yes",
+    "nasal": "no"
+   },
+   "attributes": {
+    "f1": 300,
+    "f2": 1400,
+    "f3": 2500,
+    "bw1": 100,
+    "bw2": 150,
+    "bw3": 200,
+    "voiced": 1,
+    "nasal": 0,
+    "dur": 70,
+    "amp": 55
+   }
+  },
+  {
+   "key": "V",
+   "features": {
+    "manner": "fricative",
+    "voiced": "yes",
+    "nasal": "no"
+   },
+   "attributes": {
+    "f1": 300,
+    "f2": 1000,
+    "f3": 2300,
+    "bw1": 100,
+    "bw2": 150,
+    "bw3": 200,
+    "voiced": 1,
+    "nasal": 0,
+    "dur": 70,
+    "amp": 55
+   }
+  },
+  {
+   "key": "S",
+   "features": {
+    "manner": "fricative",
+    "voiced": "no",
+    "nasal": "no"
+   },
+   "attributes": {
+    "f1": 320,
+    "f2": 1700,
+    "f3": 2500,
+    "bw1": 200,
+    "bw2": 200,
+    "bw3": 250,
+    "voiced": 0,
+    "nasal": 0,
+    "dur": 110,
+    "amp": 45
+   }
+  },
+  {
+   "key": "F",
+   "features": {
+    "manner": "fricative",
+    "voiced": "no",
+    "nasal": "no"
+   },
+   "attributes": {
+    "f1": 300,
+    "f2": 1200,
+    "f3": 2400,
+    "bw1": 200,
+    "bw2": 200,
+    "bw3": 250,
+    "voiced": 0,
+    "nasal": 0,
+    "dur": 100,
+    "amp": 40
+   }
+  },
+  {
+   "key": "HH",
+   "features": {
+    "manner": "fricative",
+    "voiced": "no",
+    "nasal": "no"
+   },
+   "attributes": {
+    "f1": 500,
+    "f2": 1500,
+    "f3": 2500,
+    "bw1": 200,
+    "bw2": 250,
+    "bw3": 300,
+    "voiced": 0,
+    "nasal": 0,
+    "dur": 70,
+    "amp": 40
+   }
+  },
+  {
+   "key": "SIL",
+   "features": {
+    "manner": "silence",
+    "voiced": "no",
+    "nasal": "no"
+   },
+   "attributes": {
+    "f1": 500,
+    "f2": 1500,
+    "f3": 2500,
+    "bw1": 100,
+    "bw2": 100,
+    "bw3": 100,
+    "voiced": 0,
+    "nasal": 0,
+    "dur": 55,
+    "amp": 0
+   }
+  }
+ ]
+}

elp/data/phonetics.psv

@@ -0,0 +1,45 @@
+# acoustic-phonetics SOURCE — the learned speech primitives, as INGESTIBLE DATA.
+# NOT audio, NOT code: formant geometry of the phonemes, to be ingested via the
+# ingest organ into the engram as a phoneme manifold. The render reads this
+# geometry back from the engram; nothing is frozen in EL code.
+#
+# PROVENANCE (audited, per-field honesty — no invented numbers):
+#  * The 10 MONOPHTHONG VOWEL formants F1/F2/F3 (IY,IH,EH,AE,AA,AO,UH,UW,AH,ER)
+#    are the MEASURED adult-male means of Peterson & Barney (1952), JASA 24:175-184
+#    — the canonical /hVd/ table, verified digit-for-digit vs CRAN phonTools::pb52.
+#    These are real measured values.
+#  * AX (schwa) F1/F2/F3 = neutral uniform-tube resonances (2n-1)*500 — a PHYSICS
+#    value (Fant), not a P&B measurement.
+#  * OW is a diphthong; its listed steady target is a conventional synthesis value,
+#    not a P&B monophthong measurement.
+#  * CONSONANT loci (M,N,NG,L,R,W,Y,Z,DH,V,S,F,HH) and ALL BANDWIDTHS (B1,B2,B3)
+#    and dur/amp are STANDARD FORMANT-SYNTHESIS conventions (Klatt 1980, JASA 67:971
+#    "Software for a cascade/parallel formant synthesizer") — engineering defaults,
+#    NOT per-phoneme field measurements. Labeled as such, not attributed to P&B.
+# Format: SYM|F1|F2|F3|B1|B2|B3|voiced|nasal|dur_ms|amp|class|example
+IY|270|2290|3010|60|90|150|1|0|130|100|vowel|beet
+IH|390|1990|2550|70|100|150|1|0|110|100|vowel|bit
+EH|530|1840|2480|80|100|150|1|0|130|100|vowel|bet
+AE|660|1720|2410|90|110|150|1|0|150|100|vowel|bat
+AA|730|1090|2440|90|110|150|1|0|150|100|vowel|bot
+AO|570|840|2410|80|100|150|1|0|140|100|vowel|bought
+UH|440|1020|2240|70|100|150|1|0|110|100|vowel|book
+UW|300|870|2240|70|90|150|1|0|140|100|vowel|boot
+AH|640|1190|2390|80|100|150|1|0|110|95|vowel|but
+ER|490|1350|1690|80|100|120|1|0|140|95|vowel|bird
+AX|500|1500|2500|80|100|150|1|0|80|85|vowel|about
+OW|490|910|2380|80|100|150|1|0|140|100|vowel|boat
+M|250|900|2200|90|120|180|1|1|80|60|nasal|map
+N|250|1700|2600|90|120|180|1|1|80|60|nasal|nap
+NG|250|2300|2700|90|120|180|1|1|80|60|nasal|sing
+L|360|1300|2600|80|110|160|1|0|70|80|approximant|lip
+R|490|1350|1600|80|110|120|1|0|80|85|approximant|rip
+W|300|610|2200|70|100|160|1|0|70|80|approximant|wet
+Y|270|2290|3010|60|90|150|1|0|60|80|approximant|yet
+Z|300|1700|2500|100|150|200|1|0|90|55|fricative|zoo
+DH|300|1400|2500|100|150|200|1|0|70|55|fricative|the
+V|300|1000|2300|100|150|200|1|0|70|55|fricative|van
+S|320|1700|2500|200|200|250|0|0|110|45|fricative|see
+F|300|1200|2400|200|200|250|0|0|100|40|fricative|fee
+HH|500|1500|2500|200|250|300|0|0|70|40|fricative|hat
+SIL|500|1500|2500|100|100|100|0|0|55|0|silence|_

elp/projector/README.md

@@ -0,0 +1,91 @@
+> **STATUS: STAGING / PROOF-OF-SHAPE — not the deliverable.** This Python package
+> proved the architecture end-to-end against the proven realizer faculty (faithful
+> md/docx/midi from real geometry: 0 ungrounded claims, SACRED polarity). Per Will's
+> steer, the DELIVERABLE is NATIVE: the seam lives on the existing EL realizer as
+> **surface-as-profile** — see `../src/surface-profile.el` and
+> `../tests/examples/surface-profile-demo.el` (compiles + runs through elc → C →
+> binary). The concepts below (one geometry-carrying frame; surface = a pluggable
+> profile; plan/realize; deterministic-from-meaning) are exactly what the native
+> module implements. Keep this package as the validated proof; build native.
+
+# Efferent Multimodal Projector
+
+**geometry → any surface, faithfully.** Neuron's own document-generation faculty:
+the efferent twin of the ingest organ. Ingest is afferent (world → geometry);
+this is efferent (geometry → an arbitrary-format document / any modality).
+
+Built against the **proven** realizer faculty (neuron-talk sidecar `:8756`,
+artifact `art-7affa557`). The live soul (`:8742` / `:7770`) is contacted **only**
+through the read-only, GET-only `engram_client` — never mutated.
+
+## The pipeline (surface-agnostic)
+
+```
+geometry region + surface/format spec
+    → PLAN     (manifold → document skeleton/DAG; the geometry IS the outline)   plan.py
+    → REALIZE  (proven realizer, scaled sentence → passage, each section faithful) realize.py
+    → COHERE   (document-level flow / transitions, not stitched sentences)        cohere.py
+    → EMIT     (pluggable SurfaceProjector → the target surface)          projectors/
+```
+
+**The surface is a PARAMETER.** `pipeline.build_ir(...)` builds ONE
+surface-neutral `DocumentIR` (`document_ir.py`); `pipeline.emit(doc, surface)`
+projects it to whichever surface you name. Markdown, docx, and MIDI are the same
+IR emitted three ways.
+
+## The pivot: a geometry-carrying IR
+
+`DocumentIR` is **not** a text tree. Every `Block` carries BOTH:
+- `.sentences` — realized faithful text (what **text** projectors read),
+- `.provenance` — the source geometry: `subj_id / relation / obj / polarity /
+  confidence / importance / salience / node_id` (what **music / image / video**
+  projectors read).
+
+That single decision is what makes the projector multimodal: text renders the
+words; music/image decode the geometry. A claim with no provenance cannot exist
+in the IR — faithfulness is structural.
+
+## The one shared seam
+
+`projectors/base.py` — `SurfaceProjector.project(frame: DocumentIR) -> bytes`
+(+ `surface / media_type / ext / modality / profile`). Register with
+`register()`. Adding a surface changes nothing upstream.
+
+`TwoStageProjector` blesses the peer plan/realize decomposition:
+`spec = plan(frame)`, `bytes = realize(spec)`, `project = realize∘plan`; the
+`profile` is the pluggable per-surface knob (text lang-profile, music
+instr/mode-profile). `projectors/midi.py` is the reference two-stage impl.
+
+## Surfaces
+
+| surface | modality | status | emitter |
+|---|---|---|---|
+| `markdown` | text | landed | own (str) |
+| `docx` | text | landed | own minimal OOXML (stdlib `zipfile`+XML, no lib) |
+| `midi` | audio | landed (symbolic-music proof) | own minimal SMF (stdlib `struct`, no lib) |
+| `audio` (WAV) | audio | peer agent (additive synth) | conforms to `TwoStageProjector` |
+| `image` | image | documented seam | `projectors/seams.py` |
+| `video` | video | documented seam (image×sound×time) | `projectors/seams.py` |
+
+Music maps: relation → scale degree (same relation → same pitch), **polarity →
+major/minor third (SACRED negation is audible)**, confidence → duration,
+importance → velocity, section → register. Deterministic projection from meaning
+— nothing invented.
+
+## Faithfulness
+
+`provenance.py` audits the IR: **zero** ungrounded claims, SACRED polarity
+preserved (negations reported, never dropped), COHERE introduces no new geometry
+(connectives are marked). `trace_table()` emits the geometry → section → claim
+table.
+
+## Run
+
+```bash
+PY=~/Desktop/lang-realizers/venv/bin/python
+PYTHONPATH=~/Desktop/neuron-talk:~/Desktop/lang-realizers $PY generate.py
+# writes ./out/{neuron-self,engram-temporal}.{md,docx,mid} + *.audit.json + *.provenance.md
+```
+
+Requires the proven realizer env (spaCy + the neuron-talk/lang-realizers engine)
+and the read-only engram at `:8742`.

elp/projector/cohere.py

@@ -0,0 +1,79 @@
+"""cohere.py — COHERE stage: document-level flow, not stitched sentences.
+
+Fidelity is REALIZE's job; FLOW is this stage's. The hard part beyond sentence
+fidelity is that a document must read as one thing. We add connective tissue at
+the passage level:
+
+  * an opening abstract that names what the document covers (built ONLY from the
+    section headings that already exist — it introduces no new claim),
+  * a short transition lead into each section after the first, drawn from a
+    fixed set of discourse connectives ("Beyond that,", "Relatedly,", ...) that
+    carry no propositional content,
+  * ordering so the highest-grounded section leads.
+
+CRITICAL: every connective is marked ``kind="connective"`` in its provenance, so
+the faithfulness audit can prove COHERE introduced ZERO new geometry claims. A
+transition is discourse glue, never a fact.
+"""
+from __future__ import annotations
+
+from document_ir import Block, DocumentIR, Provenance
+
+# discourse connectives — pure flow, no propositional content
+_TRANSITIONS = [
+    "Beyond that,", "Relatedly,", "In the same region,", "From there,",
+    "Alongside this,", "Further,", "Turning to the next facet,",
+]
+
+
+def _connective_prov() -> Provenance:
+    return Provenance(subj_id=None, subject=None, relation="", obj=None,
+                      polarity="aff", confidence=1.0, node_id=None,
+                      kind="connective")
+
+
+def _abstract_block(doc: DocumentIR) -> Block:
+    """A grounded opening: names the sections, asserts nothing new."""
+    headings = [s.heading for s in doc.sections]
+    if not headings:
+        return Block(role="lead")
+    if len(headings) == 1:
+        body = f"This document, generated from Neuron's geometry, covers {headings[0]}."
+    else:
+        listed = ", ".join(headings[:-1]) + f", and {headings[-1]}"
+        body = ("This document is projected directly from Neuron's meaning-geometry. "
+                f"It traces {listed}.")
+    b = Block(role="lead")
+    b.sentences.append(body)
+    b.provenance.append(_connective_prov())
+    return b
+
+
+def cohere_document(doc: DocumentIR, *, add_abstract: bool = True,
+                    add_transitions: bool = True) -> DocumentIR:
+    """Order sections by grounding, add abstract + transitions (flow only)."""
+    # order: strongest-grounded section (mean confidence x #claims) first,
+    # but keep an explicitly-first section if the plan pinned one via level 1.
+    def _score(sec):
+        provs = [p for p in sec.all_provenance() if p.kind == "fact"]
+        if not provs:
+            return 0.0
+        mean_conf = sum(p.confidence for p in provs) / len(provs)
+        return mean_conf * len(provs)
+
+    doc.sections.sort(key=_score, reverse=True)
+
+    if add_transitions:
+        for i, sec in enumerate(doc.sections):
+            if i == 0 or not sec.blocks:
+                continue
+            lead = _TRANSITIONS[(i - 1) % len(_TRANSITIONS)]
+            first = sec.blocks[0]
+            if first.sentences:
+                # prepend the connective to the first sentence (flow, no new claim)
+                first.sentences[0] = f"{lead} {first.sentences[0][0].lower()}{first.sentences[0][1:]}"
+
+    if add_abstract:
+        doc.meta["abstract"] = _abstract_block(doc)
+
+    return doc

elp/projector/document_ir.py

@@ -0,0 +1,111 @@
+"""document_ir.py — the surface-neutral, GEOMETRY-CARRYING document intermediate.
+
+This is the pivot of the whole efferent projector. A DocumentIR is NOT a text
+tree. It is a projection of a meaning-geometry region that carries, at every
+leaf, BOTH:
+
+  * the realized surface text  (``Block.sentences``)   — what a TEXT projector reads,
+  * the source geometry        (``Block.provenance``)  — what a MUSIC / IMAGE /
+                                                          VIDEO projector reads.
+
+Because the IR holds the geometry, not just the words, the SAME
+plan -> realize -> cohere pipeline drives every surface. A markdown projector
+renders the sentences; a music projector reads the provenance edges (salience,
+importance, polarity, relation) and maps them onto a symbolic-music surface;
+an image/video projector (documented seam) would read the same geometry.
+
+Nothing in this module invents content. Every :class:`Provenance` points at a
+real engram node id and a real relation. That is the faithfulness contract made
+structural: a claim with no provenance cannot exist in the IR.
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import Any
+
+
+# --------------------------------------------------------------------------- #
+#  Provenance — the geometry an emitted claim traces to. FAITHFULNESS is here.
+# --------------------------------------------------------------------------- #
+@dataclass
+class Provenance:
+    """One geometry edge behind one realized claim.
+
+    ``kind`` distinguishes a FACT (a structural edge asserted by the geometry,
+    spoken as fact) from an INTERPRETATION (something attributed, spoken with
+    attribution) — the facts-as-facts + interpretations-attributed discipline
+    (memory 80927e26). ``polarity`` is SACRED: a negated edge stays negated.
+    """
+    subj_id: str | None          # source engram node id of the subject
+    subject: str | None          # normalized subject surface
+    relation: str                # predicate lemma (e.g. "use", "contain", "be")
+    obj: str | None              # normalized object / complement surface
+    polarity: str = "aff"        # "aff" | "neg"  (SACRED — never silently flipped)
+    confidence: float = 0.0      # extraction confidence in [0,1]
+    node_id: str | None = None   # engram node the claim was extracted from
+    kind: str = "fact"           # "fact" | "interpretation"
+    importance: float = 0.0      # source node importance (drives music/emphasis)
+    salience: float = 0.0        # source node salience
+
+    def trace(self) -> str:
+        arrow = "-->" if self.polarity == "aff" else "--NOT-->"
+        return (f"[{(self.node_id or '?')[:8]}] {self.subject!r} {arrow}"
+                f"{self.relation} {self.obj!r} (conf {self.confidence:.2f})")
+
+
+@dataclass
+class Block:
+    """A passage: one or more faithful sentences + the geometry they trace to.
+
+    ``sentences`` and ``provenance`` are index-aligned where possible: sentence
+    ``i`` was realized from ``provenance[i]``. A COHERE transition sentence with
+    no new geometry carries a provenance whose ``kind == "connective"`` so the
+    audit can see it introduced no new claim.
+    """
+    sentences: list[str] = field(default_factory=list)
+    provenance: list[Provenance] = field(default_factory=list)
+    role: str = "body"           # "body" | "lead" | "transition"
+
+    def text(self) -> str:
+        return " ".join(s.rstrip(". ") + "." for s in self.sentences if s.strip())
+
+
+@dataclass
+class Section:
+    heading: str
+    level: int = 2               # markdown heading level / outline depth
+    blocks: list[Block] = field(default_factory=list)
+    seed_ids: list[str] = field(default_factory=list)   # geometry nodes of section
+    summary: str = ""            # one-line grounded gloss (for pptx bullets / TOC)
+
+    def all_provenance(self) -> list[Provenance]:
+        out: list[Provenance] = []
+        for b in self.blocks:
+            out.extend(b.provenance)
+        return out
+
+
+@dataclass
+class DocumentIR:
+    """The surface-neutral document. Built ONCE, projected to ANY surface."""
+    title: str
+    subtitle: str = ""
+    sections: list[Section] = field(default_factory=list)
+    seed_id: str | None = None            # the geometry region root
+    format_spec: dict[str, Any] = field(default_factory=dict)  # requested shape
+    meta: dict[str, Any] = field(default_factory=dict)
+
+    # -- geometry facets (what non-text projectors consume) ----------------- #
+    def all_provenance(self) -> list[Provenance]:
+        out: list[Provenance] = []
+        for s in self.sections:
+            out.extend(s.all_provenance())
+        return out
+
+    def claim_count(self) -> int:
+        return sum(1 for p in self.all_provenance() if p.kind in ("fact", "interpretation"))
+
+    def ungrounded_count(self) -> int:
+        """Claims with no traceable node — MUST be zero for a faithful doc."""
+        return sum(1 for p in self.all_provenance()
+                   if p.kind in ("fact", "interpretation") and not p.node_id)

elp/projector/generate.py

@@ -0,0 +1,81 @@
+"""generate.py — drive the projector: one geometry region -> many surfaces.
+
+Proves the thesis with REAL output: builds ONE surface-neutral DocumentIR from
+Neuron's OWN self-geometry (read-only against the live soul via the proven
+faculty), then EMITS it to Markdown, docx, and MIDI — the same plan/realize/
+cohere, three surfaces. Writes the files + the faithfulness audit to ./out/.
+"""
+from __future__ import annotations
+
+import json
+import os
+import sys
+
+_HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, _HERE)
+
+import pipeline  # noqa: E402
+import provenance  # noqa: E402
+from geometry import load_self_region  # noqa: E402
+
+OUT = os.path.join(_HERE, "out")
+
+
+def _emit_all(doc, stem):
+    """Emit one IR to every text/audio surface + audit + provenance."""
+    for surface in ("markdown", "docx", "midi"):
+        data = pipeline.emit(doc, surface)
+        proj = pipeline.get_projector(surface)
+        path = os.path.join(OUT, f"{stem}.{proj.ext}")
+        with open(path, "wb") as f:
+            f.write(data)
+        print(f"  emitted {surface:9s} -> {os.path.basename(path)} ({len(data)} bytes)")
+    a = provenance.audit(doc)
+    with open(os.path.join(OUT, f"{stem}.audit.json"), "w") as f:
+        json.dump(a, f, indent=2)
+    with open(os.path.join(OUT, f"{stem}.provenance.md"), "w") as f:
+        f.write(provenance.trace_table(doc))
+    print("  audit:", {k: a[k] for k in ("claims", "ungrounded_claims",
+          "negations_preserved", "distinct_source_nodes", "faithful")})
+    return a
+
+
+def main():
+    os.makedirs(OUT, exist_ok=True)
+    print("surfaces registered:", pipeline.available_surfaces())
+
+    # ---- Document 1: Neuron's self-description (marquee) ------------------- #
+    print("\n[1] Neuron self-description")
+    region = load_self_region(max_nodes=9)
+    print("   self region:", region)
+    doc1 = pipeline.build_ir(
+        None, region=region,
+        title="Neuron: A Self-Description from Its Own Geometry",
+        subtitle="Projected efferently from the engram — every claim traces a node.",
+        format_spec={"genre": "self-description", "register": "expository"},
+        max_sections=5, conf_floor=0.6)
+    print(f"   IR: {len(doc1.sections)} sections, {doc1.claim_count()} claims, "
+          f"ungrounded={doc1.ungrounded_count()}")
+    _emit_all(doc1, "neuron-self")
+
+    # ---- Document 2: a coherent, clean whitepaper-style section ------------ #
+    print("\n[2] Whitepaper-style section (coherent clean region)")
+    doc2, _ = pipeline.project(
+        ["chronoception", "time", "awareness", "engram", "temporal"],
+        surface="markdown",
+        title="Temporal Awareness in the Engram",
+        subtitle="A section projected from the geometry of chronoception.",
+        format_spec={"genre": "whitepaper-section", "register": "technical"},
+        max_sections=4)
+    print(f"   IR: {len(doc2.sections)} sections, {doc2.claim_count()} claims, "
+          f"ungrounded={doc2.ungrounded_count()}")
+    _emit_all(doc2, "engram-temporal")
+
+    # echo both markdowns so they are visible in the run log
+    for stem, doc in (("neuron-self", doc1), ("engram-temporal", doc2)):
+        print(f"\n===== GENERATED MARKDOWN — {stem} =====\n")
+        print(pipeline.emit(doc, "markdown").decode())
+
+
+if __name__ == "__main__":
+    main()

elp/projector/geometry.py

@@ -0,0 +1,129 @@
+"""geometry.py — READ-ONLY loader for a meaning-geometry region.
+
+The efferent projector never writes to the soul. This module reaches the
+geometry through the PROVEN, read-only neuron-talk faculty (``engram_client``,
+GET-only, which physically refuses non-GET methods) against the running sidecar
+soul. The live daemon :8742 / :7770 is contacted ONLY through that read-only
+client — never mutated.
+
+A "region" is a seed node plus a bounded neighborhood: the manifold that will
+become the document's skeleton. We pool a few single-term lexical searches
+(the engram search is a single-term matcher) and, when available, walk one hop
+of reified neighbors, then rank by self/importance signal.
+"""
+from __future__ import annotations
+
+import os
+import sys
+
+# Wire in the proven faculty (own-the-core: we reuse it, we do not fork it).
+_NT = os.path.expanduser("~/Desktop/neuron-talk")
+_LR = os.path.expanduser("~/Desktop/lang-realizers")
+for _p in (_NT, _LR):
+    if _p not in sys.path:
+        sys.path.insert(0, _p)
+
+from engram_client import ReadOnlyEngramClient  # noqa: E402
+
+
+class Region:
+    """A geometry region: ranked nodes + the reified edges among them."""
+
+    def __init__(self, seed: str, nodes: list[dict], edges: list[dict]):
+        self.seed = seed
+        self.nodes = nodes                 # ranked engram node dicts
+        self.edges = edges                 # [{src, dst, edge, ...}]
+        self.by_id = {n["id"]: n for n in nodes if n.get("id")}
+
+    def __repr__(self):
+        return f"<Region seed={self.seed!r} nodes={len(self.nodes)} edges={len(self.edges)}>"
+
+
+def _prose_quality(content: str) -> float:
+    """Reward clean expository prose; penalize shouty banner-dense nodes.
+
+    A high ALLCAPS-word ratio or very short content signals a banner/telegraphic
+    memory node that extracts into garbage. Clean declarative prose scores high.
+    """
+    if not content or not content.strip():
+        return 0.0
+    words = content.split()
+    if len(words) < 8:
+        return 0.1
+    caps = sum(1 for w in words if len(w) > 2 and w.strip(".,:;'\"-").isupper())
+    caps_ratio = caps / max(1, len(words))
+    # sentences with lowercase interior words read as prose
+    lower = sum(1 for w in words if w[:1].islower())
+    lower_ratio = lower / max(1, len(words))
+    return max(0.0, 1.2 * lower_ratio - 2.0 * caps_ratio)
+
+
+def _relevance(content: str, terms: list[str]) -> float:
+    """Topical relevance to the seed terms — keeps a region ON-THEME so a clean
+    but off-topic node cannot hijack the document."""
+    if not terms:
+        return 0.0
+    low = (content or "").lower()
+    hits = sum(1 for t in terms if t.lower() in low)
+    return hits / max(1, len(terms))
+
+
+def _node_rank(n: dict, terms: list[str] | None = None) -> float:
+    return (float(n.get("importance") or 0.0) * 2.0
+            + float(n.get("salience") or 0.0)
+            + 1.5 * _prose_quality(n.get("content") or "")
+            + 2.0 * _relevance(n.get("content") or "", terms or [])
+            + (0.5 if (n.get("content") or "").strip() else 0.0))
+
+
+def load_region(seed_terms: list[str] | str, *, client: ReadOnlyEngramClient | None = None,
+                max_nodes: int = 10, per_term: int = 20, hop: bool = True) -> Region:
+    """Pull a bounded geometry region around ``seed_terms`` (read-only).
+
+    ``seed_terms`` may be a single string or several probe terms; results are
+    pooled and de-duplicated. When ``hop`` and the reified neighbor endpoint is
+    live, one hop of neighbors is folded in so the region is a real
+    neighborhood, not just a keyword hit list.
+    """
+    client = client or ReadOnlyEngramClient()
+    if isinstance(seed_terms, str):
+        seed_terms = [seed_terms]
+
+    pool: dict[str, dict] = {}
+    for term in seed_terms:
+        for n in client.search(term, limit=per_term):
+            if isinstance(n, dict) and n.get("id"):
+                pool.setdefault(n["id"], n)
+
+    ranked = sorted(pool.values(), key=lambda n: _node_rank(n, seed_terms),
+                    reverse=True)
+    nodes = ranked[:max_nodes]
+
+    edges: list[dict] = []
+    if hop and nodes:
+        present = {n["id"] for n in nodes}
+        for n in list(nodes):
+            try:
+                for nb in client.neighbors(n["id"]):
+                    node = nb.get("node") if isinstance(nb, dict) else None
+                    edge = nb.get("edge") if isinstance(nb, dict) else None
+                    if node and node.get("id"):
+                        edges.append({"src": n["id"], "dst": node["id"],
+                                      "edge": edge})
+                        # fold a strong neighbor into the region (bounded)
+                        if (node["id"] not in present and len(nodes) < max_nodes + 6
+                                and _node_rank(node, seed_terms) > 0.4):
+                            present.add(node["id"])
+                            nodes.append(node)
+            except Exception:  # noqa: BLE001 — read-only best-effort; never fatal
+                continue
+
+    return Region(seed=", ".join(seed_terms), nodes=nodes, edges=edges)
+
+
+def load_self_region(client: ReadOnlyEngramClient | None = None,
+                     max_nodes: int = 10) -> Region:
+    """The self/identity region — Neuron's own geometry, for self-description."""
+    return load_region(["self", "identity", "Neuron", "values", "memory",
+                        "imprint", "consciousness"],
+                       client=client, max_nodes=max_nodes)

elp/projector/pipeline.py

@@ -0,0 +1,67 @@
+"""pipeline.py — the Efferent Multimodal Projector, top level.
+
+    geometry region + surface/format spec
+        -> PLAN     (manifold -> document skeleton/DAG)
+        -> REALIZE  (proven realizer, sentence -> passage, each section faithful)
+        -> COHERE   (document-level flow / transitions, not stitched sentences)
+        -> EMIT     (pluggable SurfaceProjector -> the target surface)
+
+THE SURFACE IS A PARAMETER. ``project(...)`` builds the geometry-carrying
+DocumentIR once, then hands it to whichever surface projector the caller named.
+Markdown, docx, and midi (music) are all the SAME IR emitted differently. That
+is the efferent multimodal projector: geometry -> any surface.
+"""
+from __future__ import annotations
+
+import os
+import sys
+
+_HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, _HERE)
+sys.path.insert(0, os.path.join(_HERE, "projectors"))
+
+from cohere import cohere_document  # noqa: E402
+from document_ir import DocumentIR  # noqa: E402
+from geometry import Region, load_region  # noqa: E402
+from plan import plan_document  # noqa: E402
+from realize import realize_document  # noqa: E402
+
+# registering the projectors (import for side-effect: each self-registers)
+import projectors.markdown  # noqa: E402,F401
+import projectors.docx  # noqa: E402,F401
+import projectors.midi  # noqa: E402,F401
+import projectors.seams  # noqa: E402,F401
+from projectors.base import available_surfaces, get_projector  # noqa: E402
+
+
+def build_ir(seed_terms, *, title: str, subtitle: str = "",
+             format_spec: dict | None = None,
+             region: Region | None = None,
+             max_sections: int = 8, conf_floor: float = 0.55) -> DocumentIR:
+    """geometry -> PLAN -> REALIZE -> COHERE = the surface-neutral DocumentIR."""
+    region = region or load_region(seed_terms)
+    doc = plan_document(region, title=title, subtitle=subtitle,
+                        format_spec=format_spec or {},
+                        conf_floor=conf_floor, max_sections=max_sections)
+    doc = realize_document(doc)
+    doc = cohere_document(doc)
+    return doc
+
+
+def emit(doc: DocumentIR, surface: str) -> bytes:
+    """EMIT: project the built IR onto one surface (surface = a parameter)."""
+    return get_projector(surface).project(doc)
+
+
+def project(seed_terms, *, surface: str, title: str, subtitle: str = "",
+            format_spec: dict | None = None, region: Region | None = None,
+            max_sections: int = 8) -> tuple[DocumentIR, bytes]:
+    """The full efferent projection: geometry + surface -> (IR, bytes)."""
+    doc = build_ir(seed_terms, title=title, subtitle=subtitle,
+                   format_spec=format_spec, region=region,
+                   max_sections=max_sections)
+    return doc, emit(doc, surface)
+
+
+__all__ = ["build_ir", "emit", "project", "available_surfaces",
+           "get_projector", "load_region", "DocumentIR"]

elp/projector/plan.py

@@ -0,0 +1,192 @@
+"""plan.py — PLAN stage: geometry region -> document skeleton (a DAG/outline).
+
+The manifold becomes the skeleton. We extract faithful propositions from the
+region's nodes (the proven neuron-talk extractor, SACRED polarity preserved),
+apply a quality floor, then GROUP them into sections. Grouping is by source
+node — each engram node is one coherent topic, so one salient node becomes one
+section. The section ORDER is the node ranking (importance/salience): the
+geometry decides the outline, not a template.
+
+Output: a DocumentIR whose sections carry seed node ids and empty blocks. REALIZE
+fills the blocks; the plan owns the structure.
+"""
+from __future__ import annotations
+
+import os
+import re
+import sys
+
+_NT = os.path.expanduser("~/Desktop/neuron-talk")
+_LR = os.path.expanduser("~/Desktop/lang-realizers")
+for _p in (_NT, _LR):
+    if _p not in sys.path:
+        sys.path.insert(0, _p)
+
+import propositions  # noqa: E402  (the proven, faithful extractor)
+
+from document_ir import DocumentIR, Section  # noqa: E402
+from geometry import Region  # noqa: E402
+
+
+# --------------------------------------------------------------------------- #
+#  Proposition quality — keep only clean, well-grounded claims.
+# --------------------------------------------------------------------------- #
+_JUNK_RE = re.compile(r"[.][a-z]{1,3}\b|[^A-Za-z0-9 '\-]")  # ".o", stray symbols
+
+
+def _has_banner_token(s: str) -> bool:
+    """True if any word is an ALLCAPS banner token (DHARMA, ENGRAM, MEASURED)."""
+    for w in (s or "").split():
+        core = w.strip(".,:;'\"-")
+        if len(core) > 2 and core.isupper():
+            return True
+    return False
+
+
+def _clean_prop(p, floor: float) -> bool:
+    if p.confidence < floor:
+        return False
+    if not p.subject or not (p.object or (p.obj_np is not None)):
+        return False
+    subj = (p.subject or "").strip()
+    obj = (p.object or "").strip()
+    if len(subj) < 2:
+        return False
+    # banner-derived shouty fragments read as garbage in prose
+    if _has_banner_token(subj) or _has_banner_token(obj):
+        return False
+    if propositions._is_shouty(p.sentence or ""):
+        return False
+    # junk tokens: file-extension fragments (".o"), stray non-word symbols
+    if _JUNK_RE.search(subj) or _JUNK_RE.search(obj):
+        return False
+    # a proposition whose object repeats the subject is usually a parse artifact
+    if obj and subj.lower() == obj.lower():
+        return False
+    # a bare copula with no real complement ("X is it") reads as noise
+    if p.predicate == "be" and obj.lower() in ("it", "no", "nothing", "empty", ""):
+        return False
+    return True
+
+
+def _dedup(props):
+    """Drop duplicate claims. Two axes: (a) identical (pred,obj,polarity), and
+    (b) same (subject,predicate) — which collapses a mis-split compound like
+    "detection is post-hoc eval" -> "Detection is post/hoc/eval" into one claim
+    (keep the highest-confidence surface)."""
+    props = sorted(props, key=lambda p: p.confidence, reverse=True)
+    seen_po, seen_sp, out = set(), set(), []
+    for p in props:
+        subj = (p.subject or "").lower()
+        po = (p.predicate, (p.object or "").lower(), p.polarity)
+        sp = (subj, p.predicate, p.polarity)
+        if po in seen_po or sp in seen_sp:
+            continue
+        seen_po.add(po)
+        seen_sp.add(sp)
+        out.append(p)
+    return out
+
+
+# --------------------------------------------------------------------------- #
+#  Heading derivation — a clean human heading from a node.
+# --------------------------------------------------------------------------- #
+_HEADING_RE = re.compile(r"^\s*#{1,4}\s+(.{2,70})\s*$", re.M)
+# node-type / system labels that are NOT topical headings
+_NONTOPIC_LABEL = re.compile(r"^(memory|node|knowledge|doc|session)[:/]", re.I)
+
+
+def _titlecase_banner(s: str) -> str:
+    """A shouty banner ("CHRONOCEPTION — SCALE-INVARIANCE") makes a fine title
+    once Title-cased. Keep short acronyms uppercase."""
+    def fix(w):
+        core = w.strip("—-:,.")
+        if len(core) <= 3 and core.isupper():
+            return w  # acronym
+        return w.capitalize()
+    return " ".join(fix(w) for w in s.split())
+
+
+def _clean_heading(text: str) -> str | None:
+    """First line only, no markdown, capped, banner Title-cased. None if unusable."""
+    if not text:
+        return None
+    line = text.strip().splitlines()[0]
+    line = re.sub(r"^#+\s*", "", line).strip().strip("#").strip()
+    # cut at a natural break so a long banner heading stays a heading, not a para
+    for sep in (" — ", " – ", ": ", ". "):
+        if sep in line and len(line) > 48:
+            line = line.split(sep)[0].strip()
+            break
+    if not (3 <= len(line) <= 64):
+        return None
+    if propositions._is_shouty(line):
+        line = _titlecase_banner(line)
+    return line or None
+
+
+def _heading_for(node: dict, fallback: str) -> str:
+    label = (node.get("label") or "").strip()
+    content = node.get("content") or ""
+    candidates: list[str] = []
+    # a node-type label ("memory:remembered") is never a topic — skip it
+    if label and not _NONTOPIC_LABEL.match(label):
+        candidates.append(label)
+    m = _HEADING_RE.search(content)
+    if m:
+        candidates.append(m.group(1))
+    # the leading banner/first sentence of the content is often the real title
+    first = re.split(r"(?<=[.\n])", content.strip(), maxsplit=1)[0] if content.strip() else ""
+    candidates.append(first)
+    for c in candidates:
+        h = _clean_heading(c)
+        if h:
+            return h
+    return fallback
+
+
+def plan_document(region: Region, *, title: str, subtitle: str = "",
+                  format_spec: dict | None = None,
+                  conf_floor: float = 0.55,
+                  max_sections: int = 8,
+                  max_claims_per_section: int = 6) -> DocumentIR:
+    """Region -> DocumentIR skeleton. The geometry dictates the outline."""
+    format_spec = format_spec or {}
+    doc = DocumentIR(title=title, subtitle=subtitle,
+                     seed_id=region.nodes[0]["id"] if region.nodes else None,
+                     format_spec=format_spec)
+
+    made = 0
+    seen_headings: set[str] = set()
+    for node in region.nodes:
+        if made >= max_sections:
+            break
+        props = propositions.extract(node.get("content") or "",
+                                     node_id=node.get("id"),
+                                     node_importance=float(node.get("importance") or 0.0),
+                                     max_sentences=10)
+        props = [p for p in props if _clean_prop(p, conf_floor)]
+        props = _dedup(props)
+        props.sort(key=lambda p: p.confidence, reverse=True)
+        props = props[:max_claims_per_section]
+        if not props:
+            continue
+        heading = _heading_for(node, fallback=f"Region {made + 1}")
+        # cross-section dedup: a topic appears once. Distinguish by top claim
+        # subject, else drop the collision so the outline stays clean.
+        if heading.lower() in seen_headings:
+            subj = (props[0].subject or "").strip().title()
+            alt = f"{heading}: {subj}" if subj and subj.lower() not in heading.lower() else None
+            if alt and alt.lower() not in seen_headings and len(alt) <= 64:
+                heading = alt
+            else:
+                continue
+        seen_headings.add(heading.lower())
+        sec = Section(heading=heading, level=2, seed_ids=[node["id"]])
+        # stash the planned propositions on the section for REALIZE
+        sec.__dict__["_planned_props"] = props
+        sec.__dict__["_node"] = node
+        doc.sections.append(sec)
+        made += 1
+
+    return doc

elp/projector/projectors/base.py

@@ -0,0 +1,106 @@
+"""base.py — the SurfaceProjector interface + registry.
+
+THE key abstraction of the efferent projector: a projector is a pure function
+from the surface-neutral, geometry-carrying DocumentIR to bytes on a target
+SURFACE. The surface is a PARAMETER. Adding a surface = registering one more
+projector; nothing upstream (plan/realize/cohere) changes.
+
+    DocumentIR  --project-->  bytes            (per surface)
+
+A TEXT projector reads ``block.sentences``. A NON-TEXT projector (music, image,
+video) reads ``block.provenance`` — the geometry the IR carries — and decodes it
+onto its surface. Both consume the SAME IR. That symmetry is the whole design:
+the realizer generalizes into a multimodal projector, geometry -> any surface.
+"""
+from __future__ import annotations
+
+from typing import Protocol, runtime_checkable
+
+import sys
+import os
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+from document_ir import DocumentIR  # noqa: E402
+
+
+@runtime_checkable
+class SurfaceProjector(Protocol):
+    """Geometry-document -> one surface. Implementations MUST be pure & faithful.
+
+    THE ONE SHARED SEAM. Every surface — text, music, image, video — conforms to
+    this single contract:
+
+        project(frame: DocumentIR) -> bytes
+
+    where ``frame`` is the geometry-carrying meaning-geometry (the SemFrame at
+    document scale; a single utterance is the degenerate one-section frame).
+
+    RECOMMENDED INTERNAL SHAPE (the peer music/text decomposition, blessed here
+    so all surfaces share it): a projector may split ``project`` into
+
+        spec    = self.plan(frame)      # meaning-geometry -> surface-specific spec
+        bytes   = self.realize(spec)    # spec -> surface, via this projector's PROFILE
+
+    ``project`` is then ``realize(plan(frame))``. The PROFILE (a text lang-profile,
+    a music instr/mode-profile, an image layout-profile) is a property of the
+    projector instance — the pluggable knob. See :class:`TwoStageProjector`.
+
+    A TEXT projector's plan reads ``frame`` sentences; a MUSIC/IMAGE projector's
+    plan reads ``frame.all_provenance()`` — the geometry — and derives its spec
+    (pitch/harmony/rhythm, or layout) FROM the meaning, deterministically. Same
+    frame, different profile.
+    """
+
+    surface: str          # "markdown" | "docx" | "midi" | "audio" | "image" | "video"
+    media_type: str       # MIME type of the emitted bytes
+    ext: str              # file extension (no dot)
+    modality: str         # "text" | "audio" | "image" | "video"
+    profile: object       # the pluggable per-surface profile (may be None)
+
+    def project(self, doc: DocumentIR) -> bytes:
+        """Emit the document on this surface. Returns raw bytes."""
+        ...
+
+
+class TwoStageProjector:
+    """Optional base for the peer plan()/realize() decomposition.
+
+    Subclasses implement ``plan(frame) -> spec`` and ``realize(spec) -> bytes``;
+    ``project`` is their composition. This is exactly the peer music interface
+    (spec = plan(frame, profile); surface = realize(spec, profile)) expressed so
+    that it still satisfies the single ``SurfaceProjector.project`` seam. Text,
+    music, and image projectors can all subclass this and remain interchangeable.
+    """
+
+    surface: str = ""
+    media_type: str = ""
+    ext: str = ""
+    modality: str = ""
+    profile: object = None
+
+    def plan(self, doc: DocumentIR):  # -> spec
+        raise NotImplementedError
+
+    def realize(self, spec) -> bytes:
+        raise NotImplementedError
+
+    def project(self, doc: DocumentIR) -> bytes:
+        return self.realize(self.plan(doc))
+
+
+_REGISTRY: dict[str, SurfaceProjector] = {}
+
+
+def register(projector: SurfaceProjector) -> SurfaceProjector:
+    _REGISTRY[projector.surface] = projector
+    return projector
+
+
+def get_projector(surface: str) -> SurfaceProjector:
+    if surface not in _REGISTRY:
+        raise KeyError(f"no projector registered for surface {surface!r}; "
+                       f"have {sorted(_REGISTRY)}")
+    return _REGISTRY[surface]
+
+
+def available_surfaces() -> list[str]:
+    return sorted(_REGISTRY)

elp/projector/projectors/docx.py

@@ -0,0 +1,113 @@
+"""docx.py — the .docx surface projector: an OWN minimal OOXML emitter.
+
+Own-the-core: a .docx is just a ZIP of a few XML parts (WordprocessingML). We
+emit it with the standard library only — ``zipfile`` + string XML — no
+python-docx, no external dependency. This proves a "richer structured format"
+surface without importing anyone else's toolkit.
+
+Parts emitted (the minimal valid set + a styles part for real headings):
+    [Content_Types].xml
+    _rels/.rels
+    word/_rels/document.xml.rels
+    word/styles.xml          (Title / Heading1 / Heading2 / Normal)
+    word/document.xml        (the content)
+
+Like the markdown projector it reads only the IR's realized sentences; it
+invents nothing. The surface differs, the faithful content does not.
+"""
+from __future__ import annotations
+
+import io
+import os
+import sys
+import zipfile
+from xml.sax.saxutils import escape
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+from document_ir import DocumentIR  # noqa: E402
+from projectors.base import register  # noqa: E402
+
+_CONTENT_TYPES = """<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types">
+  <Default Extension="rels" ContentType="application/vnd.openxmlformats-package.relationships+xml"/>
+  <Default Extension="xml" ContentType="application/xml"/>
+  <Override PartName="/word/document.xml" ContentType="application/vnd.openxmlformats-officedocument.wordprocessingml.document.main+xml"/>
+  <Override PartName="/word/styles.xml" ContentType="application/vnd.openxmlformats-officedocument.wordprocessingml.styles+xml"/>
+</Types>"""
+
+_RELS = """<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">
+  <Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="word/document.xml"/>
+</Relationships>"""
+
+_DOC_RELS = """<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">
+  <Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/styles" Target="styles.xml"/>
+</Relationships>"""
+
+_W = "http://schemas.openxmlformats.org/wordprocessingml/2006/main"
+
+_STYLES = f"""<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<w:styles xmlns:w="{_W}">
+  <w:style w:type="paragraph" w:default="1" w:styleId="Normal"><w:name w:val="Normal"/>
+    <w:rPr><w:sz w:val="22"/></w:rPr></w:style>
+  <w:style w:type="paragraph" w:styleId="Title"><w:name w:val="Title"/>
+    <w:pPr><w:spacing w:after="240"/></w:pPr>
+    <w:rPr><w:b/><w:sz w:val="52"/></w:rPr></w:style>
+  <w:style w:type="paragraph" w:styleId="Subtitle"><w:name w:val="Subtitle"/>
+    <w:rPr><w:i/><w:sz w:val="28"/><w:color w:val="555555"/></w:rPr></w:style>
+  <w:style w:type="paragraph" w:styleId="Heading1"><w:name w:val="heading 1"/>
+    <w:pPr><w:spacing w:before="240" w:after="120"/><w:outlineLvl w:val="0"/></w:pPr>
+    <w:rPr><w:b/><w:sz w:val="34"/></w:rPr></w:style>
+  <w:style w:type="paragraph" w:styleId="Heading2"><w:name w:val="heading 2"/>
+    <w:pPr><w:spacing w:before="200" w:after="100"/><w:outlineLvl w:val="1"/></w:pPr>
+    <w:rPr><w:b/><w:sz w:val="28"/></w:rPr></w:style>
+</w:styles>"""
+
+
+def _para(text: str, style: str | None = None) -> str:
+    ppr = f"<w:pPr><w:pStyle w:val=\"{style}\"/></w:pPr>" if style else ""
+    return (f"<w:p>{ppr}<w:r><w:t xml:space=\"preserve\">"
+            f"{escape(text)}</w:t></w:r></w:p>")
+
+
+class DocxProjector:
+    surface = "docx"
+    media_type = ("application/vnd.openxmlformats-officedocument."
+                  "wordprocessingml.document")
+    ext = "docx"
+    modality = "text"
+
+    def _document_xml(self, doc: DocumentIR) -> str:
+        body: list[str] = [_para(doc.title, "Title")]
+        if doc.subtitle:
+            body.append(_para(doc.subtitle, "Subtitle"))
+        abstract = doc.meta.get("abstract")
+        if abstract is not None and abstract.sentences:
+            body.append(_para(abstract.text()))
+        for sec in doc.sections:
+            style = "Heading1" if sec.level <= 1 else "Heading2"
+            body.append(_para(sec.heading, style))
+            for block in sec.blocks:
+                t = block.text()
+                if t:
+                    body.append(_para(t))
+        return (f"<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>"
+                f"<w:document xmlns:w=\"{_W}\"><w:body>"
+                + "".join(body)
+                + "<w:sectPr><w:pgSz w:w=\"12240\" w:h=\"15840\"/>"
+                  "<w:pgMar w:top=\"1440\" w:right=\"1440\" w:bottom=\"1440\" "
+                  "w:left=\"1440\"/></w:sectPr></w:body></w:document>")
+
+    def project(self, doc: DocumentIR) -> bytes:
+        buf = io.BytesIO()
+        with zipfile.ZipFile(buf, "w", zipfile.ZIP_DEFLATED) as z:
+            z.writestr("[Content_Types].xml", _CONTENT_TYPES)
+            z.writestr("_rels/.rels", _RELS)
+            z.writestr("word/_rels/document.xml.rels", _DOC_RELS)
+            z.writestr("word/styles.xml", _STYLES)
+            z.writestr("word/document.xml", self._document_xml(doc))
+        return buf.getvalue()
+
+
+register(DocxProjector())

elp/projector/projectors/markdown.py

@@ -0,0 +1,45 @@
+"""markdown.py — the Markdown surface projector (text facet).
+
+The most tractable surface, and the reference implementation: reads the IR's
+realized sentences and lays them out as Markdown. Introduces no content — it is
+pure typography over the faithful text the realizer produced.
+"""
+from __future__ import annotations
+
+import os
+import sys
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+from document_ir import DocumentIR  # noqa: E402
+from projectors.base import register  # noqa: E402
+
+
+class MarkdownProjector:
+    surface = "markdown"
+    media_type = "text/markdown"
+    ext = "md"
+    modality = "text"
+
+    def render_str(self, doc: DocumentIR) -> str:
+        lines: list[str] = [f"# {doc.title}"]
+        if doc.subtitle:
+            lines.append(f"\n*{doc.subtitle}*")
+        abstract = doc.meta.get("abstract")
+        if abstract is not None and abstract.sentences:
+            lines.append("")
+            lines.append(abstract.text())
+        for sec in doc.sections:
+            lines.append("")
+            lines.append(f"{'#' * max(2, sec.level)} {sec.heading}")
+            for block in sec.blocks:
+                body = block.text()
+                if body:
+                    lines.append("")
+                    lines.append(body)
+        return "\n".join(lines) + "\n"
+
+    def project(self, doc: DocumentIR) -> bytes:
+        return self.render_str(doc).encode("utf-8")
+
+
+register(MarkdownProjector())

elp/projector/projectors/midi.py

@@ -0,0 +1,133 @@
+"""midi.py — the MUSIC surface projector: geometry -> symbolic music (MIDI).
+
+The first NON-TEXT surface, and the proof of the general shape. "Music is
+language and it is math" (Will): symbolic music is tractable and geometry-native,
+so it is the natural efferent twin to try first after text.
+
+CRUCIALLY this projector does NOT read the realized sentences. It reads the IR's
+GEOMETRY facet — ``block.provenance`` — and DECODES each edge onto a musical
+surface. That is the whole thesis of the multimodal projector: the same
+geometry-carrying IR drives text AND music; a text projector reads the words, a
+music projector reads the meaning-geometry. The mapping is deterministic and
+faithful to the geometry's structure:
+
+    relation lemma  -> scale degree      (same relation -> same pitch class;
+                                          meaning has a consistent sonic form)
+    polarity        -> mode              (aff = major third above; neg = minor
+                                          third / lowered — SACRED polarity is
+                                          audible, a negated edge sounds negated)
+    confidence      -> note duration     (stronger grounding rings longer)
+    importance      -> velocity          (more important source = louder)
+    section         -> phrase + register shift (structure becomes musical form)
+
+Own-the-core: a Standard MIDI File is a header chunk + a track chunk of
+delta-timed events. We emit the raw bytes with ``struct`` — no external MIDI
+library. Format 0, one track.
+"""
+from __future__ import annotations
+
+import io
+import os
+import struct
+import sys
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+from document_ir import DocumentIR, Provenance  # noqa: E402
+from projectors.base import TwoStageProjector, register  # noqa: E402
+
+_TICKS = 480                      # ticks per quarter note
+_C_MAJOR = [0, 2, 4, 5, 7, 9, 11]  # semitone offsets of a diatonic scale
+
+
+def _vlq(n: int) -> bytes:
+    """MIDI variable-length quantity encoding of a delta time."""
+    if n == 0:
+        return b"\x00"
+    out = bytearray()
+    out.append(n & 0x7F)
+    n >>= 7
+    while n:
+        out.insert(0, (n & 0x7F) | 0x80)
+        n >>= 7
+    return bytes(out)
+
+
+def _degree_for(relation: str) -> int:
+    """Stable scale degree for a relation lemma (same relation -> same pitch)."""
+    if not relation:
+        return 0
+    return sum(ord(c) for c in relation.lower()) % len(_C_MAJOR)
+
+
+def _note_for(p: Provenance, base: int) -> tuple[int, int, int]:
+    """(pitch, velocity, duration_ticks) for one geometry edge."""
+    root = base + _C_MAJOR[_degree_for(p.relation)]
+    # polarity -> mode: affirmed edges take the bright major third, negated edges
+    # take the darker minor third. The negation is AUDIBLE and never dropped.
+    third = 4 if p.polarity == "aff" else 3
+    pitch = max(24, min(96, root + (third if p.confidence >= 0.5 else 0)))
+    velocity = int(56 + 60 * min(1.0, max(0.0, p.importance)))
+    velocity = max(40, min(120, velocity))
+    # confidence -> duration: quarter .. dotted-half
+    dur = int(_TICKS * (0.5 + 1.5 * min(1.0, max(0.0, p.confidence))))
+    return pitch, velocity, dur
+
+
+# a mode-profile: the pluggable musical knob (the peer's mode_profile). Scale +
+# tempo. Swapping this profile re-voices the SAME geometry — surface as parameter.
+_DEFAULT_PROFILE = {"scale": _C_MAJOR, "tempo_us": 500000,
+                    "registers": [60, 55, 64, 50, 67, 48], "program": 0}
+
+
+class MidiProjector(TwoStageProjector):
+    """geometry -> symbolic music, in the shared two-stage shape.
+
+    ``plan(frame)``  -> a music_spec: an ordered list of note dicts derived
+                        deterministically from the frame's provenance geometry
+                        (the peer's ``plan(frame, profile) -> spec``).
+    ``realize(spec)`` -> Standard MIDI File bytes (the peer's
+                        ``realize(spec, profile) -> surface``; here the surface
+                        is symbolic MIDI, the minimal audio proof — a richer
+                        additive-synth audio projector conforms identically).
+    """
+
+    surface = "midi"
+    media_type = "audio/midi"
+    ext = "mid"
+    modality = "audio"
+
+    def __init__(self, profile: dict | None = None):
+        self.profile = profile or _DEFAULT_PROFILE
+
+    # -- stage 1: meaning-geometry -> music_spec (reads the GEOMETRY facet) -- #
+    def plan(self, doc: DocumentIR) -> list[dict]:
+        registers = self.profile["registers"]
+        spec: list[dict] = []
+        for si, sec in enumerate(doc.sections):
+            base = registers[si % len(registers)]
+            provs = [p for p in sec.all_provenance()
+                     if p.kind in ("fact", "interpretation")]
+            for i, p in enumerate(provs):
+                pitch, vel, dur = _note_for(p, base)
+                spec.append({"pitch": pitch, "velocity": vel, "dur": dur,
+                             "rest_before": (_TICKS // 2) if (si > 0 and i == 0) else 0,
+                             "relation": p.relation, "polarity": p.polarity})
+        return spec
+
+    # -- stage 2: music_spec -> MIDI bytes (own-core, no library) ------------ #
+    def realize(self, spec: list[dict]) -> bytes:
+        ev = bytearray()
+        ev += _vlq(0) + b"\xFF\x51\x03" + struct.pack(">I", self.profile["tempo_us"])[1:]
+        ev += _vlq(0) + bytes([0xC0, self.profile["program"] & 0x7F])
+        for note in spec:
+            ev += _vlq(note["rest_before"]) + bytes([0x90, note["pitch"], note["velocity"]])
+            ev += _vlq(note["dur"]) + bytes([0x80, note["pitch"], 0])
+        ev += _vlq(0) + b"\xFF\x2F\x00"
+        track = bytes(ev)
+        buf = io.BytesIO()
+        buf.write(b"MThd" + struct.pack(">IHHH", 6, 0, 1, _TICKS))
+        buf.write(b"MTrk" + struct.pack(">I", len(track)) + track)
+        return buf.getvalue()
+
+
+register(MidiProjector())

elp/projector/projectors/seams.py

@@ -0,0 +1,60 @@
+"""seams.py — documented efferent seams for IMAGE and VIDEO surfaces.
+
+These are NOT implemented (per the build rails: architect, do not overbuild).
+They are registered as first-class seams so the interface PROVES it accepts
+future non-text projectors without any upstream change. Each documents exactly
+what its decoder would read from the geometry-carrying IR, making the multimodal
+generalization concrete rather than hand-wavy.
+
+The symmetry that guarantees these are possible, not moonshots: they are the
+efferent twins of multimodal INGEST. If meaning can HOLD an image (ingest as
+first-class geometry), meaning can PROJECT one back. Video = image x sound x
+TIME, and the engram already stores time (chronoception). So video falls out of
+an image projector + the music projector + the stored temporal ordering.
+"""
+from __future__ import annotations
+
+import os
+import sys
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+from document_ir import DocumentIR  # noqa: E402
+from projectors.base import register  # noqa: E402
+
+
+class _Seam:
+    """A registered-but-unimplemented projector. Names its decoder contract."""
+
+    def project(self, doc: DocumentIR) -> bytes:  # pragma: no cover - seam
+        raise NotImplementedError(
+            f"{self.surface!r} projector is a documented seam, not yet built. "
+            f"Decoder contract: {self.decoder_contract}")
+
+
+class ImageProjector(_Seam):
+    surface = "image"
+    media_type = "image/png"
+    ext = "png"
+    modality = "image"
+    decoder_contract = (
+        "reads block.provenance as a spatial layout — nodes become regions, edges "
+        "become adjacencies; salience/importance drive size/contrast; polarity "
+        "drives figure/ground. The efferent twin of image ingest (a geometry->raster "
+        "decoder, learned or engineered), exactly mirroring the embedder that turned "
+        "the image INTO geometry.")
+
+
+class VideoProjector(_Seam):
+    surface = "video"
+    media_type = "video/mp4"
+    ext = "mp4"
+    modality = "video"
+    decoder_contract = (
+        "image x sound x TIME. Composes the image projector (per-keyframe geometry "
+        "layout) with the midi/music projector (score) along the geometry's stored "
+        "temporal ordering (chronoception). Needs no new principle once image + music "
+        "exist — only a muxer.")
+
+
+register(ImageProjector())
+register(VideoProjector())

elp/projector/provenance.py

@@ -0,0 +1,63 @@
+"""provenance.py — the faithfulness audit + geometry->section trace.
+
+A document projected from geometry is only worth anything if every claim traces
+back. This module walks the DocumentIR and proves the discipline held:
+
+  * ZERO ungrounded claims (every fact/interpretation has a real node id),
+  * every emitted sentence maps to a geometry edge (or is a marked connective),
+  * SACRED polarity survived (negations are reported, never silently dropped),
+  * COHERE introduced no new geometry (connectives carry no claim).
+
+It emits both a machine verdict and a human-readable geometry->section table.
+"""
+from __future__ import annotations
+
+from document_ir import DocumentIR
+
+
+def audit(doc: DocumentIR) -> dict:
+    provs = doc.all_provenance()
+    facts = [p for p in provs if p.kind in ("fact", "interpretation")]
+    connectives = [p for p in provs if p.kind == "connective"]
+    ungrounded = [p for p in facts if not p.node_id]
+    negations = [p for p in facts if p.polarity == "neg"]
+    node_ids = sorted({p.node_id for p in facts if p.node_id})
+    return {
+        "claims": len(facts),
+        "connectives": len(connectives),
+        "ungrounded_claims": len(ungrounded),
+        "negations_preserved": len(negations),
+        "distinct_source_nodes": len(node_ids),
+        "faithful": len(ungrounded) == 0,
+        "source_nodes": node_ids,
+    }
+
+
+def trace_table(doc: DocumentIR) -> str:
+    """Human-readable geometry -> section -> claim provenance table."""
+    lines = ["# Provenance — every claim traces geometry", ""]
+    lines.append(f"**Document:** {doc.title}")
+    a = audit(doc)
+    lines.append(f"**Claims:** {a['claims']}  ·  **Ungrounded:** "
+                 f"{a['ungrounded_claims']}  ·  **Negations preserved:** "
+                 f"{a['negations_preserved']}  ·  **Source nodes:** "
+                 f"{a['distinct_source_nodes']}  ·  **Faithful:** "
+                 f"{'YES' if a['faithful'] else 'NO'}")
+    lines.append("")
+    for si, sec in enumerate(doc.sections, 1):
+        lines.append(f"## {si}. {sec.heading}")
+        lines.append(f"_seed nodes: {', '.join(i[:8] for i in sec.seed_ids)}_")
+        lines.append("")
+        lines.append("| # | realized claim | traces geometry edge |")
+        lines.append("|---|----------------|----------------------|")
+        n = 0
+        for block in sec.blocks:
+            for sent, prov in zip(block.sentences, block.provenance):
+                if prov.kind == "connective":
+                    continue
+                n += 1
+                edge = prov.trace().replace("|", "\\|")
+                s = sent.replace("|", "\\|")
+                lines.append(f"| {n} | {s} | {edge} |")
+        lines.append("")
+    return "\n".join(lines) + "\n"

elp/projector/realize.py

@@ -0,0 +1,112 @@
+"""realize.py — REALIZE stage: fill each planned section with faithful passages.
+
+Scales the PROVEN realizer from a single assertion to a passage. For each
+planned proposition we build a realizer-ready clause (the proven
+``_prop_to_clause`` mapping) and run it through the proven engine
+(``engine.realize``), which is a deterministic grammar with the SACRED negation
+contract — it never invents. Each realized sentence is paired with a
+:class:`Provenance` that pins it to the exact geometry edge it came from.
+
+"Passage, not a list of sentences": within a section we lightly vary sentence
+openings and group related claims, but we add NO content the geometry did not
+assert. The only non-geometry words are function words the grammar already owns
+(articles, "and", conjunction of same-subject claims). Document-level flow is
+COHERE's job; this stage owns intra-section fluency + fidelity.
+"""
+from __future__ import annotations
+
+import os
+import sys
+
+_NT = os.path.expanduser("~/Desktop/neuron-talk")
+_LR = os.path.expanduser("~/Desktop/lang-realizers")
+for _p in (_NT, _LR):
+    if _p not in sys.path:
+        sys.path.insert(0, _p)
+
+import engine  # noqa: E402  (the proven no-LLM realizer)
+from dialogue import _prop_to_clause  # noqa: E402  (proven prop -> clause)
+
+from document_ir import Block, DocumentIR, Provenance, Section  # noqa: E402
+
+
+def _provenance_from(p, kind: str = "fact") -> Provenance:
+    return Provenance(
+        subj_id=p.source_node_id, subject=p.subject, relation=p.predicate,
+        obj=p.object, polarity=p.polarity, confidence=round(float(p.confidence), 3),
+        node_id=p.source_node_id, kind=kind,
+        importance=float(getattr(p, "node_importance", 0.0) or 0.0),
+        salience=0.0,
+    )
+
+
+import re as _re
+
+# a well-formed declarative opens with a determiner, a proper noun, "I", or a
+# capitalized head — not a mis-parsed object pronoun or a copula fragment.
+_BAD_OPENERS = _re.compile(r"^(Me |It is I|There is|This is it|That is it)\b")
+_VACUOUS = _re.compile(r"^\w+ (is|are|was|were) (it|no|nothing|empty|those|this|that)\.?$",
+                       _re.I)
+
+
+def _good_sentence(text: str) -> bool:
+    """Fluency gate — drops degenerate realizations. NEVER loosens faithfulness;
+    it only refuses to SPEAK a claim whose surface came out malformed."""
+    words = text.rstrip(".").split()
+    if len(words) < 3:
+        return False
+    if _BAD_OPENERS.search(text):
+        return False
+    if _VACUOUS.match(text):
+        return False
+    # a sentence that is mostly one-letter/two-letter tokens is a parse artifact
+    short = sum(1 for w in words if len(w.strip(".,'")) <= 2)
+    if short > len(words) / 2:
+        return False
+    return True
+
+
+def _realize_prop(p, lang: str = "en") -> tuple[str, Provenance] | None:
+    """One proposition -> (faithful sentence, provenance) or None if it drops."""
+    clause = _prop_to_clause(p)
+    text = engine.realize(clause, lang)
+    if not text or not text.strip():
+        return None
+    text = text.strip()
+    if not text.endswith((".", "!", "?")):
+        text += "."
+    # capitalize first character (proper nouns / "I" already handled by grammar)
+    text = text[0].upper() + text[1:]
+    if not _good_sentence(text):
+        return None
+    return text, _provenance_from(p)
+
+
+def realize_document(doc: DocumentIR, lang: str = "en") -> DocumentIR:
+    """Fill every planned section's blocks with faithful, realized passages."""
+    for sec in doc.sections:
+        planned = sec.__dict__.get("_planned_props", [])
+        block = Block(role="body")
+        summary_bits: list[str] = []
+        for p in planned:
+            r = _realize_prop(p, lang)
+            if r is None:
+                continue
+            text, prov = r
+            block.sentences.append(text)
+            block.provenance.append(prov)
+            if len(summary_bits) < 1:
+                # a short grounded gloss for TOC / pptx bullets
+                obj = (prov.obj or "").strip().rstrip(".")
+                if obj:
+                    summary_bits.append(obj)
+        if block.sentences:
+            sec.blocks.append(block)
+            sec.summary = summary_bits[0] if summary_bits else ""
+        # drop the transient planning payload; the IR is now self-contained
+        sec.__dict__.pop("_planned_props", None)
+        sec.__dict__.pop("_node", None)
+
+    # prune sections that realized to nothing
+    doc.sections = [s for s in doc.sections if s.blocks]
+    return doc

elp/src/accent.el

@@ -0,0 +1,136 @@
+// accent.el - A British-RP ACCENT as an INGESTED TRANSFORM-GEOMETRY, composed
+// onto the voice (voice (+) accent, SEPARABLE). Reads elp/data/british-accent.psv
+// into an accent MANIFOLD in the engram (override nodes + a shared accent hub),
+// and the render reads the RP formant overrides + the non-rhotic rule back from
+// that geometry. NO accent targets live in code — same discipline as the base
+// phonetics. PROVENANCE NOTE: the RP Hz values are PROVISIONAL (reconstructed-
+// from-knowledge approximations, cite Deterding1997 / Hawkins&Midgley2005 /
+// Wells1982) pending transcription from the published tables — the PIPELINE is
+// the deliverable; exact values are being source-verified separately.
+
+fn ingest_accent(path: String) -> [String] {
+    let content: String = fs_read(path)
+    let lines: [String] = str_split(content, "\n")
+    let nl: Int = native_list_len(lines)
+    let amap: [String] = native_list_empty()
+    let hub: String = engram_node("accent british-rp prov=PROVISIONAL cite=Deterding1997-HawkinsMidgley2005-Wells1982", "Accent", 80)
+    let li: Int = 0
+    while li < nl {
+        let line: String = native_list_get(lines, li)
+        let ll: Int = str_len(line)
+        let skip: Int = 0
+        if ll < 3 {
+            skip = 1
+        }
+        if skip == 0 {
+            let first: Int = str_char_code(line, 0)
+            if first == 35 {
+                skip = 1
+            }
+        }
+        if skip == 0 {
+            let f: [String] = str_split(line, "|")
+            let nf: Int = native_list_len(f)
+            if nf >= 6 {
+                let key: String = native_list_get(f, 0)
+                let f1: String = native_list_get(f, 1)
+                let f2: String = native_list_get(f, 2)
+                let f3: String = native_list_get(f, 3)
+                let kind: String = native_list_get(f, 4)
+                let set: String = native_list_get(f, 5)
+                let cont: String = "accent british-rp " + key + " f1=" + f1 + " f2=" + f2 + " f3=" + f3 + " kind=" + kind + " set=" + set + " prov=PROVISIONAL cite=Deterding1997-HawkinsMidgley2005-Wells1982"
+                let id: String = engram_node(cont, "AccentTarget", 80)
+                amap = native_list_append(amap, key)
+                amap = native_list_append(amap, cont)
+                engram_connect(id, hub, 80, "of_accent")
+            }
+        }
+        li = li + 1
+    }
+    return amap
+}
+
+// RP formant override for a phoneme, read from the accent manifold. Returns
+// [f1,f2,f3] for a vowel_override record, or an empty list if none / a rule.
+fn accent_formants(amap: [String], code: String) -> [Int] {
+    let out: [Int] = native_list_empty()
+    let id: String = sp_map_get(amap, code)
+    if str_eq(id, "") {
+        return out
+    }
+    let j: String = id
+    let isrule: Int = str_index_of(j, "drop_coda")
+    if isrule >= 0 {
+        return out
+    }
+    let f1: Int = parse_uint_from(j, "f1=")
+    if f1 <= 0 {
+        return out
+    }
+    let out = native_list_append(out, f1)
+    let out = native_list_append(out, parse_uint_from(j, "f2="))
+    let out = native_list_append(out, parse_uint_from(j, "f3="))
+    return out
+}
+
+// Is this accent non-rhotic? (reads the R rule node from the manifold)
+fn is_nonrhotic(amap: [String]) -> Int {
+    let id: String = sp_map_get(amap, "R")
+    if str_eq(id, "") {
+        return 0
+    }
+    let hit: Int = str_index_of(id, "drop_coda")
+    if hit >= 0 {
+        return 1
+    }
+    return 0
+}
+
+// Is this symbol a vowel? Membership in the vowel-set derived from the phonetics
+// source's class column (phonological structure — the FORMANT NUMBERS still come
+// from the organ manifold; this is only the categorical class for the rule).
+fn is_vowel_sym(vset: [String], sym: String) -> Int {
+    let n: Int = native_list_len(vset)
+    let i: Int = 0
+    while i < n {
+        if str_eq(native_list_get(vset, i), sym) {
+            return 1
+        }
+        i = i + 1
+    }
+    return 0
+}
+
+// Non-rhotic transform: drop a post-vocalic CODA /R/ — an R whose next non-SIL
+// phoneme is NOT a vowel (a consonant, or end of utterance). Keep INTERVOCALIC/
+// onset R (next non-SIL phoneme is a vowel, e.g. the medial R in N UW R AA N).
+fn apply_rhoticity(codes: [String], vset: [String]) -> [String] {
+    let n: Int = native_list_len(codes)
+    let out: [String] = native_list_empty()
+    let i: Int = 0
+    while i < n {
+        let c: String = native_list_get(codes, i)
+        let keep: Int = 1
+        if str_eq(c, "R") {
+            let jx: Int = i + 1
+            let nextv: Int = 0
+            while jx < n {
+                let ncode: String = native_list_get(codes, jx)
+                if str_eq(ncode, "SIL") {
+                    jx = jx + 1
+                } else {
+                    nextv = is_vowel_sym(vset, ncode)
+                    jx = n + 1000
+                }
+            }
+            if nextv == 0 {
+                keep = 0
+            }
+        }
+        if keep == 1 {
+            out = native_list_append(out, c)
+        }
+        i = i + 1
+    }
+    return out
+}

elp/src/audio-demo.el

@@ -0,0 +1,73 @@
+// audio-demo.el - Drive the native audio surface: render a tone per instrument
+// from its LEARNED signature, then render a small meaning-phrase "piece".
+// Entry point: top-level statement calls main() (same convention as the
+// examples' top-level println(run_test())).
+
+fn micros_to_str(xs: [Int]) -> String {
+    let n: Int = native_list_len(xs)
+    let out: String = ""
+    let i: Int = 0
+    while i < n {
+        if i > 0 { let out: String = out + "," }
+        let out: String = out + int_to_str(native_list_get(xs, i))
+        let i: Int = i + 1
+    }
+    return out
+}
+
+// Render a 1.0s A4 (midi 69) tone from a signature file, print the parsed
+// partials (proving the numbers came from the engram .sig), write the WAV.
+fn render_tone(name: String, sigpath: String, outpath: String, table: [Int]) -> Int {
+    let lines: [String] = sig_load(sigpath)
+    let partials: [Int] = parse_micros(sig_field(lines, "partials"))
+    println("[" + name + "] partials_n=" + sig_field(lines, "partials_n") + "  parsed_partials_micro(scale 1e6)=" + micros_to_str(partials))
+    println("[" + name + "] raw partials line from .sig = " + sig_field(lines, "partials"))
+    let freq: Int = freq_of_midi(69)
+    let note: [Int] = synth_from_sig(lines, freq, 1000, 900, 44100, table)
+    let n: Int = native_list_len(note)
+    let ok: Int = wav_write(outpath, note, n, 44100)
+    println("[" + name + "] rendered " + int_to_str(n) + " samples -> " + outpath + " (write_ok=" + int_to_str(ok) + ")")
+    return n
+}
+
+fn run_demo() -> Int {
+    let table: [Int] = sin_table()
+    fs_mkdir("/Users/will/Development/neuron-technologies/foundation/el/.claude/worktrees/agent-aaf04b0a9714c4070/elp/faculty/out")
+
+    println("=== TONES: render A4 (midi 69) from each learned signature ===")
+    render_tone("flute",    "/Users/will/Development/neuron-technologies/foundation/el/.claude/worktrees/agent-aaf04b0a9714c4070/elp/faculty/sig/flute.sig",    "/Users/will/Development/neuron-technologies/foundation/el/.claude/worktrees/agent-aaf04b0a9714c4070/elp/faculty/out/tone-flute.wav", table)
+    render_tone("clarinet", "/Users/will/Development/neuron-technologies/foundation/el/.claude/worktrees/agent-aaf04b0a9714c4070/elp/faculty/sig/clarinet.sig", "/Users/will/Development/neuron-technologies/foundation/el/.claude/worktrees/agent-aaf04b0a9714c4070/elp/faculty/out/tone-clarinet.wav", table)
+    render_tone("violin",   "/Users/will/Development/neuron-technologies/foundation/el/.claude/worktrees/agent-aaf04b0a9714c4070/elp/faculty/sig/violin.sig",   "/Users/will/Development/neuron-technologies/foundation/el/.claude/worktrees/agent-aaf04b0a9714c4070/elp/faculty/out/tone-violin.wav", table)
+    render_tone("piano",    "/Users/will/Development/neuron-technologies/foundation/el/.claude/worktrees/agent-aaf04b0a9714c4070/elp/faculty/sig/piano.sig",    "/Users/will/Development/neuron-technologies/foundation/el/.claude/worktrees/agent-aaf04b0a9714c4070/elp/faculty/out/tone-piano.wav", table)
+    render_tone("organ",    "/Users/will/Development/neuron-technologies/foundation/el/.claude/worktrees/agent-aaf04b0a9714c4070/elp/faculty/sig/organ.sig",    "/Users/will/Development/neuron-technologies/foundation/el/.claude/worktrees/agent-aaf04b0a9714c4070/elp/faculty/out/tone-organ.wav", table)
+
+    println("")
+    println("=== PIECE: a 6-frame meaning phrase (incl. a NEG frame) ===")
+    let frames: [[String]] = native_list_empty()
+    let frames: [[String]] = native_list_append(frames, audio_frame("agent",    "aff", "0.9", "0.8", "0", "s1"))
+    let frames: [[String]] = native_list_append(frames, audio_frame("theme",    "aff", "0.7", "0.6", "0", "s2"))
+    let frames: [[String]] = native_list_append(frames, audio_frame("cause",    "aff", "0.8", "0.9", "1", "s3"))
+    let frames: [[String]] = native_list_append(frames, audio_frame("negation", "neg", "0.85", "0.7", "0", "s4"))
+    let frames: [[String]] = native_list_append(frames, audio_frame("goal",     "aff", "0.6", "0.5", "1", "s5"))
+    let frames: [[String]] = native_list_append(frames, audio_frame("result",   "aff", "0.95", "1.0", "0", "s6"))
+
+    // Print the plan so the NEG frame's minor third (+3) vs major (+4) is visible.
+    let nf: Int = native_list_len(frames)
+    let fi: Int = 0
+    while fi < nf {
+        let frame: [String] = native_list_get(frames, fi)
+        let plan: [Int] = plan_note(frame)
+        let pol: String = surface_get(frame, "polarity")
+        let third_name: String = "major(+4)"
+        if str_eq(pol, "neg") { let third_name: String = "MINOR(+3)" }
+        println("frame " + int_to_str(fi) + " relation=" + surface_get(frame, "relation") + " polarity=" + pol + " -> midi=" + int_to_str(native_list_get(plan, 0)) + " dur_ms=" + int_to_str(native_list_get(plan, 1)) + " amp_pm=" + int_to_str(native_list_get(plan, 2)) + " third=" + third_name)
+        let fi: Int = fi + 1
+    }
+
+    let piano_lines: [String] = sig_load("/Users/will/Development/neuron-technologies/foundation/el/.claude/worktrees/agent-aaf04b0a9714c4070/elp/faculty/sig/piano.sig")
+    let total: Int = realize_audio(frames, piano_lines, "/Users/will/Development/neuron-technologies/foundation/el/.claude/worktrees/agent-aaf04b0a9714c4070/elp/faculty/out/piece.wav", 44100, table)
+    println("PIECE rendered " + int_to_str(total) + " samples -> /Users/will/Development/neuron-technologies/foundation/el/.claude/worktrees/agent-aaf04b0a9714c4070/elp/faculty/out/piece.wav")
+    return total
+}
+
+println("audio-demo main returned samples=" + int_to_str(run_demo()))

elp/src/audio-surface.el

@@ -0,0 +1,400 @@
+// audio-surface.el - Native own-core additive-synthesis audio surface.
+//
+// The AUDIO efferent seam, native, no Python and no library. This renders real
+// PCM .wav bytes from instrument SIGNATURES read from engram-sourced .sig data
+// files (elp/faculty/sig/*.sig) - the partial amplitudes are NEVER literals in
+// this source; they are parsed from the learned signature at run time. That is
+// the whole proof: render-from-learned-signatures.
+//
+// EL has no float arithmetic operator (codegen emits raw int64 ops for + - * /
+// on the shared 64-bit slot) and no float-arithmetic natives - so ALL synthesis
+// math here is own-core INTEGER fixed-point. Angles use a quarter-wave sine
+// table (scale 10000) from a fixed-point Taylor series; amplitudes are parsed to
+// micro (scale 1e6) straight from the .sig text; frequencies are milliHz ints.
+//
+// Pipeline mirrors the two-stage projector (midi.py): plan_note(frame) reads a
+// frame's meaning-geometry slot-map and derives (pitch, duration, amplitude);
+// realize_audio SUPERPOSES the signature's partials (the compose op) and
+// serialises RIFF/WAVE. Same frame -> midi OR audio.
+
+// -- integer decimal + string helpers -----------------------------------------
+
+fn str_to_int_el(s: String) -> Int {
+    let n: Int = str_len(s)
+    let i: Int = 0
+    let v: Int = 0
+    let neg: Bool = false
+    while i < n {
+        let c: Int = str_char_code(s, i)
+        if c == 45 { let neg: Bool = true }
+        if c >= 48 {
+            if c < 58 {
+                let v: Int = v * 10 + (c - 48)
+            }
+        }
+        let i: Int = i + 1
+    }
+    if neg { return 0 - v }
+    return v
+}
+
+fn parse_micro(s: String) -> Int {
+    let dot: Int = str_index_of(s, ".")
+    if dot < 0 {
+        return str_to_int_el(s) * 1000000
+    }
+    let n: Int = str_len(s)
+    let ipart: String = str_slice(s, 0, dot)
+    let fpart: String = str_slice(s, dot + 1, n)
+    let iv: Int = str_to_int_el(ipart)
+    let fv: Int = 0
+    let scale: Int = 100000
+    let fn2: Int = str_len(fpart)
+    let i: Int = 0
+    while i < 6 {
+        let d: Int = 0
+        if i < fn2 {
+            let d: Int = str_char_code(fpart, i) - 48
+        }
+        let fv: Int = fv + d * scale
+        let scale: Int = scale / 10
+        let i: Int = i + 1
+    }
+    return iv * 1000000 + fv
+}
+
+// -- signature (engram data file) loader ---------------------------------------
+
+fn sig_load(path: String) -> [String] {
+    let text: String = fs_read(path)
+    return str_split(text, "\n")
+}
+
+fn sig_field(lines: [String], key: String) -> String {
+    let pref: String = key + ": "
+    let n: Int = native_list_len(lines)
+    let plen: Int = str_len(pref)
+    let i: Int = 0
+    while i < n {
+        let ln: String = native_list_get(lines, i)
+        if str_starts_with(ln, pref) {
+            return str_slice(ln, plen, str_len(ln))
+        }
+        let i: Int = i + 1
+    }
+    return ""
+}
+
+fn parse_micros(csv: String) -> [Int] {
+    let parts: [String] = str_split(csv, ",")
+    let n: Int = native_list_len(parts)
+    let out: [Int] = native_list_empty()
+    let i: Int = 0
+    while i < n {
+        let out: [Int] = native_list_append(out, parse_micro(native_list_get(parts, i)))
+        let i: Int = i + 1
+    }
+    return out
+}
+
+// -- fixed-point sine (own-core, quarter-wave Taylor table, scale 10000) --------
+
+fn sin_table() -> [Int] {
+    let HP: Int = 1570796
+    let t: [Int] = native_list_empty()
+    let q: Int = 0
+    while q < 257 {
+        let x: Int = q * HP / 256
+        let x2: Int = x * x / 1000000
+        let x3: Int = x2 * x / 1000000
+        let x5: Int = x3 * x2 / 1000000
+        let x7: Int = x5 * x2 / 1000000
+        let x9: Int = x7 * x2 / 1000000
+        let s: Int = x - x3 / 6 + x5 / 120 - x7 / 5040 + x9 / 362880
+        let t: [Int] = native_list_append(t, s / 100)
+        let q: Int = q + 1
+    }
+    return t
+}
+
+fn sin_lookup(t: [Int], phase: Int) -> Int {
+    let p: Int = phase % 1024
+    if p < 0 { let p: Int = p + 1024 }
+    let quad: Int = p / 256
+    let r: Int = p % 256
+    if quad == 0 { return native_list_get(t, r) }
+    if quad == 1 { return native_list_get(t, 256 - r) }
+    if quad == 2 { return 0 - native_list_get(t, r) }
+    return 0 - native_list_get(t, 256 - r)
+}
+
+fn isqrt_int(n: Int) -> Int {
+    if n <= 0 { return 0 }
+    let x: Int = n
+    let y: Int = (x + 1) / 2
+    while y < x {
+        let x: Int = y
+        let y: Int = (x + n / x) / 2
+    }
+    return x
+}
+
+// freq_of_midi: equal-tempered frequency in milliHz. 440000 mHz at midi 69.
+fn freq_of_midi(m: Int) -> Int {
+    let f: Int = 440000
+    if m > 69 {
+        let k: Int = m - 69
+        let i: Int = 0
+        while i < k {
+            let f: Int = f * 1059463 / 1000000
+            let i: Int = i + 1
+        }
+        return f
+    }
+    if m < 69 {
+        let k: Int = 69 - m
+        let i: Int = 0
+        while i < k {
+            let f: Int = f * 1000000 / 1059463
+            let i: Int = i + 1
+        }
+        return f
+    }
+    return f
+}
+
+// -- envelope (ADSR), scale 1000 -----------------------------------------------
+
+fn adsr_env(i: Int, total: Int, atk_n: Int, dec_n: Int, sus_pm: Int, rel_n: Int) -> Int {
+    if i < atk_n {
+        if atk_n == 0 { return 1000 }
+        return 1000 * i / atk_n
+    }
+    if i < atk_n + dec_n {
+        if dec_n == 0 { return sus_pm }
+        return 1000 - (1000 - sus_pm) * (i - atk_n) / dec_n
+    }
+    let rel_start: Int = total - rel_n
+    if i < rel_start {
+        return sus_pm
+    }
+    if rel_n == 0 { return 0 }
+    let left: Int = total - i
+    return sus_pm * left / rel_n
+}
+
+// -- note synthesis: SUPERPOSE the learned partials -> [Int] samples -----------
+fn note_samples(freq_mHz: Int, dur_ms: Int, rate: Int, partials: [Int], sumP: Int, b_micro: Int, vib_rate: Int, vib_cents: Int, atk_ms: Int, dec_ms: Int, sus_pm: Int, rel_ms: Int, amp_pm: Int, table: [Int]) -> [Int] {
+    let total: Int = dur_ms * rate / 1000
+    let atk_n: Int = atk_ms * rate / 1000
+    let dec_n: Int = dec_ms * rate / 1000
+    let rel_n: Int = rel_ms * rate / 1000
+    let np: Int = native_list_len(partials)
+    let half_mhz: Int = rate * 1000 / 2
+    let out: [Int] = native_list_empty()
+    let i: Int = 0
+    while i < total {
+        let acc: Int = 0
+        let k: Int = 0
+        while k < np {
+            let harm: Int = k + 1
+            let amp_k: Int = native_list_get(partials, k)
+            let factor: Int = 1000000
+            if b_micro > 0 {
+                let val: Int = 1000000 + b_micro * harm * harm
+                let factor: Int = isqrt_int(val * 1000000)
+            }
+            let fn_mhz: Int = freq_mHz * harm
+            let fn_mhz: Int = fn_mhz * factor / 1000000
+            if vib_cents > 0 {
+                if vib_rate > 0 {
+                    let vphase: Int = i * vib_rate * 1024 / rate
+                    let vs: Int = sin_lookup(table, vphase)
+                    let vibf: Int = 1000000 + (vib_cents * vs * 833) / 10000
+                    let fn_mhz: Int = fn_mhz * vibf / 1000000
+                }
+            }
+            if fn_mhz <= half_mhz {
+                let phase: Int = i * fn_mhz * 1024 / (rate * 1000)
+                let sv: Int = sin_lookup(table, phase)
+                let acc: Int = acc + sv * amp_k / 1000000
+            }
+            let k: Int = k + 1
+        }
+        let env: Int = adsr_env(i, total, atk_n, dec_n, sus_pm, rel_n)
+        let s16: Int = acc * 2800000 / sumP
+        let s16: Int = s16 * env / 1000
+        let s16: Int = s16 * amp_pm / 1000
+        if s16 > 32767 { let s16: Int = 32767 }
+        if s16 < 0 - 32767 { let s16: Int = 0 - 32767 }
+        let out: [Int] = native_list_append(out, s16)
+        let i: Int = i + 1
+    }
+    return out
+}
+
+fn synth_from_sig(lines: [String], freq_mHz: Int, dur_ms: Int, amp_pm: Int, rate: Int, table: [Int]) -> [Int] {
+    let partials: [Int] = parse_micros(sig_field(lines, "partials"))
+    let np: Int = native_list_len(partials)
+    let sumP: Int = 0
+    let j: Int = 0
+    while j < np {
+        let pj: Int = native_list_get(partials, j)
+        let sumP: Int = sumP + pj
+        let j: Int = j + 1
+    }
+    if sumP <= 0 { let sumP: Int = 1000000 }
+    let adsr: [String] = str_split(sig_field(lines, "adsr"), ",")
+    let atk_ms: Int = parse_micro(native_list_get(adsr, 0)) / 1000
+    let dec_ms: Int = parse_micro(native_list_get(adsr, 1)) / 1000
+    let sus_pm: Int = parse_micro(native_list_get(adsr, 2)) / 1000
+    let rel_ms: Int = parse_micro(native_list_get(adsr, 3)) / 1000
+    let b_micro: Int = parse_micro(sig_field(lines, "inharmonicity_B"))
+    let vib_rate: Int = str_to_int_el(sig_field(lines, "vibrato_rate_hz"))
+    let vib_cents: Int = str_to_int_el(sig_field(lines, "vibrato_depth_cents"))
+    return note_samples(freq_mHz, dur_ms, rate, partials, sumP, b_micro, vib_rate, vib_cents, atk_ms, dec_ms, sus_pm, rel_ms, amp_pm, table)
+}
+
+// -- byte-buffer helpers (own-core, no library) --------------------------------
+
+fn put_tag(buf: String, pos: Int, s: String) -> String {
+    let n: Int = str_len(s)
+    let i: Int = 0
+    while i < n {
+        let buf: String = __str_set_char(buf, pos + i, str_char_code(s, i))
+        let i: Int = i + 1
+    }
+    return buf
+}
+
+fn put_u32le(buf: String, pos: Int, v: Int) -> String {
+    let buf: String = __str_set_char(buf, pos, v % 256)
+    let buf: String = __str_set_char(buf, pos + 1, (v / 256) % 256)
+    let buf: String = __str_set_char(buf, pos + 2, (v / 65536) % 256)
+    let buf: String = __str_set_char(buf, pos + 3, (v / 16777216) % 256)
+    return buf
+}
+
+fn put_u16le(buf: String, pos: Int, v: Int) -> String {
+    let buf: String = __str_set_char(buf, pos, v % 256)
+    let buf: String = __str_set_char(buf, pos + 1, (v / 256) % 256)
+    return buf
+}
+
+// -- WAV serializer: own-core RIFF/WAVE, PCM mono 16-bit -----------------------
+
+fn wav_write(path: String, samples: [Int], n: Int, rate: Int) -> Int {
+    let data_len: Int = n * 2
+    let total: Int = 44 + data_len
+    let buf: String = __str_alloc(total)
+    let buf: String = put_tag(buf, 0, "RIFF")
+    let buf: String = put_u32le(buf, 4, 36 + data_len)
+    let buf: String = put_tag(buf, 8, "WAVE")
+    let buf: String = put_tag(buf, 12, "fmt ")
+    let buf: String = put_u32le(buf, 16, 16)
+    let buf: String = put_u16le(buf, 20, 1)
+    let buf: String = put_u16le(buf, 22, 1)
+    let buf: String = put_u32le(buf, 24, rate)
+    let buf: String = put_u32le(buf, 28, rate * 2)
+    let buf: String = put_u16le(buf, 32, 2)
+    let buf: String = put_u16le(buf, 34, 16)
+    let buf: String = put_tag(buf, 36, "data")
+    let buf: String = put_u32le(buf, 40, data_len)
+    let i: Int = 0
+    while i < n {
+        let v: Int = native_list_get(samples, i)
+        if v < 0 { let v: Int = v + 65536 }
+        let buf: String = __str_set_char(buf, 44 + i * 2, v % 256)
+        let buf: String = __str_set_char(buf, 44 + i * 2 + 1, (v / 256) % 256)
+        let i: Int = i + 1
+    }
+    let ok: Int = fs_write_bytes(path, buf, total)
+    return ok
+}
+
+// -- plan: frame slot-map -> note atom (pitch, duration, amplitude) ------------
+
+fn audio_frame(relation: String, polarity: String, confidence: String, importance: String, salience: String, subj_id: String) -> [String] {
+    let f: [String] = native_list_empty()
+    let f: [String] = native_list_append(f, "relation")
+    let f: [String] = native_list_append(f, relation)
+    let f: [String] = native_list_append(f, "polarity")
+    let f: [String] = native_list_append(f, polarity)
+    let f: [String] = native_list_append(f, "confidence")
+    let f: [String] = native_list_append(f, confidence)
+    let f: [String] = native_list_append(f, "importance")
+    let f: [String] = native_list_append(f, importance)
+    let f: [String] = native_list_append(f, "salience")
+    let f: [String] = native_list_append(f, salience)
+    let f: [String] = native_list_append(f, "subj_id")
+    let f: [String] = native_list_append(f, subj_id)
+    return f
+}
+
+fn degree_offset(deg: Int) -> Int {
+    if deg == 0 { return 0 }
+    if deg == 1 { return 2 }
+    if deg == 2 { return 4 }
+    if deg == 3 { return 5 }
+    if deg == 4 { return 7 }
+    if deg == 5 { return 9 }
+    return 11
+}
+
+// returns [midi, dur_ms, amp_pm]
+fn plan_note(frame: [String]) -> [Int] {
+    let relation: String = surface_get(frame, "relation")
+    let polarity: String = surface_get(frame, "polarity")
+    let confidence: String = surface_get(frame, "confidence")
+    let importance: String = surface_get(frame, "importance")
+    let salience: String = surface_get(frame, "salience")
+    let rn: Int = str_len(relation)
+    let csum: Int = 0
+    let i: Int = 0
+    while i < rn {
+        let cc: Int = str_char_code(relation, i)
+        let csum: Int = csum + cc
+        let i: Int = i + 1
+    }
+    let deg: Int = csum % 7
+    let third: Int = 4
+    if str_eq(polarity, "neg") { let third: Int = 3 }
+    let sal_oct: Int = str_to_int_el(salience)
+    let doff: Int = degree_offset(deg)
+    let midi: Int = 60 + sal_oct * 12 + doff + third
+    let conf_micro: Int = parse_micro(confidence)
+    let dur_ms: Int = 200 + conf_micro / 1000
+    let imp_micro: Int = parse_micro(importance)
+    let amp_pm: Int = 400 + imp_micro / 2000
+    let out: [Int] = native_list_empty()
+    let out: [Int] = native_list_append(out, midi)
+    let out: [Int] = native_list_append(out, dur_ms)
+    let out: [Int] = native_list_append(out, amp_pm)
+    return out
+}
+
+fn realize_audio(frames: [[String]], sig_lines: [String], path: String, rate: Int, table: [Int]) -> Int {
+    let nf: Int = native_list_len(frames)
+    let all: [Int] = native_list_empty()
+    let count: Int = 0
+    let fi: Int = 0
+    while fi < nf {
+        let frame: [String] = native_list_get(frames, fi)
+        let plan: [Int] = plan_note(frame)
+        let midi: Int = native_list_get(plan, 0)
+        let dur_ms: Int = native_list_get(plan, 1)
+        let amp_pm: Int = native_list_get(plan, 2)
+        let freq: Int = freq_of_midi(midi)
+        let note: [Int] = synth_from_sig(sig_lines, freq, dur_ms, amp_pm, rate, table)
+        let nn: Int = native_list_len(note)
+        let j: Int = 0
+        while j < nn {
+            let all: [Int] = native_list_append(all, native_list_get(note, j))
+            let j: Int = j + 1
+        }
+        let count: Int = count + nn
+        let fi: Int = fi + 1
+    }
+    let ok: Int = wav_write(path, all, count, rate)
+    return count
+}

elp/src/image-demo.el

@@ -0,0 +1,65 @@
+// image-demo.el - Drive the native PNG surface: plan a scene from a small
+// meaning phrase (incl. a NEG frame) and emit a byte-valid 64x64 PNG whose
+// palette is read from elp/faculty/sig/scene.basis.
+
+fn img_frame(relation: String, polarity: String, confidence: String, importance: String, salience: String, subj_id: String) -> [String] {
+    let f: [String] = native_list_empty()
+    let f: [String] = native_list_append(f, "relation")
+    let f: [String] = native_list_append(f, relation)
+    let f: [String] = native_list_append(f, "polarity")
+    let f: [String] = native_list_append(f, polarity)
+    let f: [String] = native_list_append(f, "confidence")
+    let f: [String] = native_list_append(f, confidence)
+    let f: [String] = native_list_append(f, "importance")
+    let f: [String] = native_list_append(f, importance)
+    let f: [String] = native_list_append(f, "salience")
+    let f: [String] = native_list_append(f, salience)
+    let f: [String] = native_list_append(f, "subj_id")
+    let f: [String] = native_list_append(f, subj_id)
+    return f
+}
+
+fn rgb_str(c: [Int]) -> String {
+    return int_to_str(native_list_get(c, 0)) + "," + int_to_str(native_list_get(c, 1)) + "," + int_to_str(native_list_get(c, 2))
+}
+
+fn run_image() -> Int {
+    fs_mkdir("/Users/will/Development/neuron-technologies/foundation/el/.claude/worktrees/agent-aaf04b0a9714c4070/elp/faculty/out")
+    let table: [Int] = crc_table()
+    println("crc_table[1]=" + int_to_str(native_list_get(table, 1)) + " (expect 1996959894 / 0x77073096)")
+
+    let basis: [String] = basis_load("/Users/will/Development/neuron-technologies/foundation/el/.claude/worktrees/agent-aaf04b0a9714c4070/elp/faculty/sig/scene.basis")
+    let warm: [Int] = parse_rgb(basis_field(basis, "warm"))
+    let cool: [Int] = parse_rgb(basis_field(basis, "cool"))
+    let bg: [Int] = parse_rgb(basis_field(basis, "bg"))
+    println("basis warm=" + rgb_str(warm) + " cool=" + rgb_str(cool) + " bg=" + rgb_str(bg) + "  (read from scene.basis)")
+
+    let frames: [[String]] = native_list_empty()
+    let frames: [[String]] = native_list_append(frames, img_frame("agent",    "aff", "0.9", "0.8", "0", "s1"))
+    let frames: [[String]] = native_list_append(frames, img_frame("theme",    "aff", "0.7", "0.6", "1", "s2"))
+    let frames: [[String]] = native_list_append(frames, img_frame("cause",    "aff", "0.8", "0.9", "0", "s3"))
+    let frames: [[String]] = native_list_append(frames, img_frame("negation", "neg", "0.85", "0.7", "1", "s4"))
+    let frames: [[String]] = native_list_append(frames, img_frame("goal",     "aff", "0.6", "0.5", "0", "s5"))
+    let frames: [[String]] = native_list_append(frames, img_frame("result",   "aff", "0.95", "1.0", "1", "s6"))
+
+    let shapes: [[Int]] = plan_scene(frames, warm, cool)
+    let ns: Int = native_list_len(shapes)
+    println("planned " + int_to_str(ns) + " shapes:")
+    let si: Int = 0
+    while si < ns {
+        let sh: [Int] = native_list_get(shapes, si)
+        let pol: String = surface_get(native_list_get(frames, si), "polarity")
+        println("  shape " + int_to_str(si) + " type=" + int_to_str(native_list_get(sh, 0)) + " x=" + int_to_str(native_list_get(sh, 1)) + " y=" + int_to_str(native_list_get(sh, 2)) + " size=" + int_to_str(native_list_get(sh, 3)) + " rgb=" + int_to_str(native_list_get(sh, 4)) + "," + int_to_str(native_list_get(sh, 5)) + "," + int_to_str(native_list_get(sh, 6)) + " polarity=" + pol)
+        let si: Int = si + 1
+    }
+
+    let raw: [Int] = rasterize(64, 64, shapes, bg)
+    println("rasterized raw (filtered scanlines) bytes=" + int_to_str(native_list_len(raw)) + " (expect 12352)")
+    let png: [Int] = png_build(64, 64, raw, table)
+    let plen: Int = native_list_len(png)
+    let ok: Int = png_write("/Users/will/Development/neuron-technologies/foundation/el/.claude/worktrees/agent-aaf04b0a9714c4070/elp/faculty/out/scene.png", png)
+    println("PNG bytes=" + int_to_str(plen) + " -> /Users/will/Development/neuron-technologies/foundation/el/.claude/worktrees/agent-aaf04b0a9714c4070/elp/faculty/out/scene.png (write_ok=" + int_to_str(ok) + ")")
+    return plen
+}
+
+println("image-demo returned png_bytes=" + int_to_str(run_image()))

elp/src/image-surface.el

@@ -0,0 +1,412 @@
+// image-surface.el - Native own-core raster PNG surface (the image efferent
+// twin of audio). Renders a 64x64 RGB scene deterministically from a frame's
+// meaning-geometry, then serialises a byte-valid PNG entirely own-core:
+// 8-byte magic, IHDR, IDAT (zlib STORED/uncompressed DEFLATE + Adler32), IEND,
+// with a per-chunk CRC32 computed via software xor32 (EL has no bitwise ops).
+//
+// The RGB palette basis is read from elp/faculty/sig/scene.basis (data, not
+// literals) - the same read-from-learned discipline as the audio signatures.
+// Integer-only throughout; pixels are composed functionally (painter's order)
+// so no list mutation is needed.
+
+// -- small int/parse helpers (self-contained) ----------------------------------
+
+fn i_str_to_int(s: String) -> Int {
+    let n: Int = str_len(s)
+    let i: Int = 0
+    let v: Int = 0
+    while i < n {
+        let c: Int = str_char_code(s, i)
+        if c >= 48 {
+            if c < 58 {
+                let v: Int = v * 10 + (c - 48)
+            }
+        }
+        let i: Int = i + 1
+    }
+    return v
+}
+
+fn basis_load(path: String) -> [String] {
+    return str_split(fs_read(path), "\n")
+}
+
+fn basis_field(lines: [String], key: String) -> String {
+    let pref: String = key + ": "
+    let n: Int = native_list_len(lines)
+    let plen: Int = str_len(pref)
+    let i: Int = 0
+    while i < n {
+        let ln: String = native_list_get(lines, i)
+        if str_starts_with(ln, pref) {
+            return str_slice(ln, plen, str_len(ln))
+        }
+        let i: Int = i + 1
+    }
+    return ""
+}
+
+fn parse_rgb(csv: String) -> [Int] {
+    let parts: [String] = str_split(csv, ",")
+    let out: [Int] = native_list_empty()
+    let n: Int = native_list_len(parts)
+    let i: Int = 0
+    while i < n {
+        let v: Int = i_str_to_int(native_list_get(parts, i))
+        let out: [Int] = native_list_append(out, v)
+        let i: Int = i + 1
+    }
+    return out
+}
+
+// -- software 32-bit XOR (no bitwise ops in EL) --------------------------------
+
+fn xor32(a: Int, b: Int) -> Int {
+    let r: Int = 0
+    let bit: Int = 1
+    let i: Int = 0
+    while i < 32 {
+        let abit: Int = (a / bit) % 2
+        let bbit: Int = (b / bit) % 2
+        if abit != bbit {
+            let add: Int = bit
+            let r: Int = r + add
+        }
+        let bit: Int = bit * 2
+        let i: Int = i + 1
+    }
+    return r
+}
+
+// -- CRC32 (table-driven, table built with xor32) ------------------------------
+
+fn crc_table() -> [Int] {
+    let t: [Int] = native_list_empty()
+    let n: Int = 0
+    while n < 256 {
+        let c: Int = n
+        let k: Int = 0
+        while k < 8 {
+            if c % 2 == 1 {
+                let h: Int = c / 2
+                let c: Int = xor32(h, 3988292384)
+            } else {
+                let c: Int = c / 2
+            }
+            let k: Int = k + 1
+        }
+        let t: [Int] = native_list_append(t, c)
+        let n: Int = n + 1
+    }
+    return t
+}
+
+fn crc32_of(bytes: [Int], table: [Int]) -> Int {
+    let crc: Int = 4294967295
+    let n: Int = native_list_len(bytes)
+    let i: Int = 0
+    while i < n {
+        let b: Int = native_list_get(bytes, i)
+        let lo: Int = crc % 256
+        let idx: Int = xor32(lo, b) % 256
+        let tv: Int = native_list_get(table, idx)
+        let hi: Int = crc / 256
+        let crc: Int = xor32(hi, tv)
+        let i: Int = i + 1
+    }
+    return xor32(crc, 4294967295)
+}
+
+// -- Adler32 (for the zlib trailer) --------------------------------------------
+
+fn adler32_of(bytes: [Int]) -> Int {
+    let a: Int = 1
+    let b: Int = 0
+    let n: Int = native_list_len(bytes)
+    let i: Int = 0
+    while i < n {
+        let byte: Int = native_list_get(bytes, i)
+        let a: Int = (a + byte) % 65521
+        let b: Int = (b + a) % 65521
+        let i: Int = i + 1
+    }
+    return b * 65536 + a
+}
+
+// -- byte-list append helpers --------------------------------------------------
+
+fn app_u32be(dst: [Int], v: Int) -> [Int] {
+    let dst: [Int] = native_list_append(dst, (v / 16777216) % 256)
+    let dst: [Int] = native_list_append(dst, (v / 65536) % 256)
+    let dst: [Int] = native_list_append(dst, (v / 256) % 256)
+    let dst: [Int] = native_list_append(dst, v % 256)
+    return dst
+}
+
+fn app_tag(dst: [Int], s: String) -> [Int] {
+    let n: Int = str_len(s)
+    let i: Int = 0
+    while i < n {
+        let dst: [Int] = native_list_append(dst, str_char_code(s, i))
+        let i: Int = i + 1
+    }
+    return dst
+}
+
+fn app_all(dst: [Int], src: [Int]) -> [Int] {
+    let n: Int = native_list_len(src)
+    let i: Int = 0
+    while i < n {
+        let dst: [Int] = native_list_append(dst, native_list_get(src, i))
+        let i: Int = i + 1
+    }
+    return dst
+}
+
+// -- plan: frame meaning-geometry -> shape atoms -------------------------------
+// shape = [type, x, y, size, r, g, b]  (type 0=rect 1=disc 2=triangle)
+
+fn charsum(s: String) -> Int {
+    let n: Int = str_len(s)
+    let i: Int = 0
+    let acc: Int = 0
+    while i < n {
+        let c: Int = str_char_code(s, i)
+        let acc: Int = acc + c
+        let i: Int = i + 1
+    }
+    return acc
+}
+
+fn micro_of(s: String) -> Int {
+    let dot: Int = str_index_of(s, ".")
+    if dot < 0 { return i_str_to_int(s) * 1000000 }
+    let n: Int = str_len(s)
+    let fp: String = str_slice(s, dot + 1, n)
+    let ip: String = str_slice(s, 0, dot)
+    let iv: Int = i_str_to_int(ip)
+    let fv: Int = 0
+    let scale: Int = 100000
+    let fl: Int = str_len(fp)
+    let i: Int = 0
+    while i < 6 {
+        let d: Int = 0
+        if i < fl { let d: Int = str_char_code(fp, i) - 48 }
+        let fv: Int = fv + d * scale
+        let scale: Int = scale / 10
+        let i: Int = i + 1
+    }
+    return iv * 1000000 + fv
+}
+
+fn plan_scene(frames: [[String]], warm: [Int], cool: [Int]) -> [[Int]] {
+    let shapes: [[Int]] = native_list_empty()
+    let nf: Int = native_list_len(frames)
+    let fi: Int = 0
+    while fi < nf {
+        let fr: [String] = native_list_get(frames, fi)
+        let relation: String = surface_get(fr, "relation")
+        let polarity: String = surface_get(fr, "polarity")
+        let confidence: String = surface_get(fr, "confidence")
+        let importance: String = surface_get(fr, "importance")
+        let salience: String = surface_get(fr, "salience")
+        // relation -> shape type
+        let stype: Int = charsum(relation) % 3
+        // confidence -> size (8..22)
+        let cmi: Int = micro_of(confidence)
+        let size: Int = 8 + cmi / 71428
+        // salience -> y
+        let sal: Int = i_str_to_int(salience)
+        let y: Int = 6 + sal * 26
+        // subj_id/index -> x
+        let x: Int = 4 + (fi * 10) % 48
+        // polarity -> warm/cool base color
+        let br: Int = native_list_get(warm, 0)
+        let bg2: Int = native_list_get(warm, 1)
+        let bb: Int = native_list_get(warm, 2)
+        if str_eq(polarity, "neg") {
+            let br: Int = native_list_get(cool, 0)
+            let bg2: Int = native_list_get(cool, 1)
+            let bb: Int = native_list_get(cool, 2)
+        }
+        // importance -> brightness (500..1000 permille)
+        let imi: Int = micro_of(importance)
+        let bpm: Int = 500 + imi / 2000
+        let r: Int = br * bpm / 1000
+        let g: Int = bg2 * bpm / 1000
+        let b: Int = bb * bpm / 1000
+        let sh: [Int] = native_list_empty()
+        let sh: [Int] = native_list_append(sh, stype)
+        let sh: [Int] = native_list_append(sh, x)
+        let sh: [Int] = native_list_append(sh, y)
+        let sh: [Int] = native_list_append(sh, size)
+        let sh: [Int] = native_list_append(sh, r)
+        let sh: [Int] = native_list_append(sh, g)
+        let sh: [Int] = native_list_append(sh, b)
+        let shapes: [[Int]] = native_list_append(shapes, sh)
+        let fi: Int = fi + 1
+    }
+    return shapes
+}
+
+// covers: is (px,py) inside this shape?
+fn covers(sh: [Int], px: Int, py: Int) -> Bool {
+    let stype: Int = native_list_get(sh, 0)
+    let sx: Int = native_list_get(sh, 1)
+    let sy: Int = native_list_get(sh, 2)
+    let size: Int = native_list_get(sh, 3)
+    let cx: Int = sx + size / 2
+    if stype == 0 {
+        if px >= sx {
+            if px < sx + size {
+                if py >= sy {
+                    if py < sy + size {
+                        return true
+                    }
+                }
+            }
+        }
+        return false
+    }
+    if stype == 1 {
+        let rad: Int = size / 2
+        let dx: Int = px - cx
+        let dy: Int = py - (sy + rad)
+        if dx * dx + dy * dy <= rad * rad {
+            return true
+        }
+        return false
+    }
+    // triangle: apex at top (sy), base at sy+size
+    if py >= sy {
+        if py < sy + size {
+            let dyv: Int = py - sy
+            let halfw: Int = dyv / 2
+            let dxv: Int = px - cx
+            let adx: Int = dxv
+            if adx < 0 { let adx: Int = 0 - dxv }
+            if adx <= halfw {
+                return true
+            }
+        }
+    }
+    return false
+}
+
+// pixel_color: painter's algorithm - last covering shape wins. Returns [r,g,b].
+fn pixel_color(px: Int, py: Int, shapes: [[Int]], bg: [Int]) -> [Int] {
+    let r: Int = native_list_get(bg, 0)
+    let g: Int = native_list_get(bg, 1)
+    let b: Int = native_list_get(bg, 2)
+    let n: Int = native_list_len(shapes)
+    let i: Int = 0
+    while i < n {
+        let sh: [Int] = native_list_get(shapes, i)
+        if covers(sh, px, py) {
+            let r: Int = native_list_get(sh, 4)
+            let g: Int = native_list_get(sh, 5)
+            let b: Int = native_list_get(sh, 6)
+        }
+        let i: Int = i + 1
+    }
+    let out: [Int] = native_list_empty()
+    let out: [Int] = native_list_append(out, r)
+    let out: [Int] = native_list_append(out, g)
+    let out: [Int] = native_list_append(out, b)
+    return out
+}
+
+// rasterize: build the raw (filtered) scanline byte stream, filter byte 0 / row.
+fn rasterize(w: Int, h: Int, shapes: [[Int]], bg: [Int]) -> [Int] {
+    let raw: [Int] = native_list_empty()
+    let y: Int = 0
+    while y < h {
+        let raw: [Int] = native_list_append(raw, 0)
+        let x: Int = 0
+        while x < w {
+            let col: [Int] = pixel_color(x, y, shapes, bg)
+            let raw: [Int] = native_list_append(raw, native_list_get(col, 0))
+            let raw: [Int] = native_list_append(raw, native_list_get(col, 1))
+            let raw: [Int] = native_list_append(raw, native_list_get(col, 2))
+            let x: Int = x + 1
+        }
+        let y: Int = y + 1
+    }
+    return raw
+}
+
+// zlib stream with a single STORED (uncompressed) DEFLATE block + Adler32.
+fn zlib_store(raw: [Int]) -> [Int] {
+    let z: [Int] = native_list_empty()
+    let z: [Int] = native_list_append(z, 120)
+    let z: [Int] = native_list_append(z, 1)
+    let z: [Int] = native_list_append(z, 1)
+    let len: Int = native_list_len(raw)
+    let nlen: Int = 65535 - len
+    let z: [Int] = native_list_append(z, len % 256)
+    let z: [Int] = native_list_append(z, (len / 256) % 256)
+    let z: [Int] = native_list_append(z, nlen % 256)
+    let z: [Int] = native_list_append(z, (nlen / 256) % 256)
+    let z: [Int] = app_all(z, raw)
+    let ad: Int = adler32_of(raw)
+    let z: [Int] = app_u32be(z, ad)
+    return z
+}
+
+// append a full PNG chunk: length + (type+data) + crc32(type+data).
+fn app_chunk(png: [Int], type_and_data: [Int], table: [Int]) -> [Int] {
+    let total: Int = native_list_len(type_and_data)
+    let dlen: Int = total - 4
+    let png: [Int] = app_u32be(png, dlen)
+    let png: [Int] = app_all(png, type_and_data)
+    let crc: Int = crc32_of(type_and_data, table)
+    let png: [Int] = app_u32be(png, crc)
+    return png
+}
+
+fn png_build(w: Int, h: Int, raw: [Int], table: [Int]) -> [Int] {
+    let png: [Int] = native_list_empty()
+    // 8-byte signature
+    let png: [Int] = native_list_append(png, 137)
+    let png: [Int] = native_list_append(png, 80)
+    let png: [Int] = native_list_append(png, 78)
+    let png: [Int] = native_list_append(png, 71)
+    let png: [Int] = native_list_append(png, 13)
+    let png: [Int] = native_list_append(png, 10)
+    let png: [Int] = native_list_append(png, 26)
+    let png: [Int] = native_list_append(png, 10)
+    // IHDR
+    let ihdr: [Int] = native_list_empty()
+    let ihdr: [Int] = app_tag(ihdr, "IHDR")
+    let ihdr: [Int] = app_u32be(ihdr, w)
+    let ihdr: [Int] = app_u32be(ihdr, h)
+    let ihdr: [Int] = native_list_append(ihdr, 8)
+    let ihdr: [Int] = native_list_append(ihdr, 2)
+    let ihdr: [Int] = native_list_append(ihdr, 0)
+    let ihdr: [Int] = native_list_append(ihdr, 0)
+    let ihdr: [Int] = native_list_append(ihdr, 0)
+    let png: [Int] = app_chunk(png, ihdr, table)
+    // IDAT
+    let z: [Int] = zlib_store(raw)
+    let idat: [Int] = native_list_empty()
+    let idat: [Int] = app_tag(idat, "IDAT")
+    let idat: [Int] = app_all(idat, z)
+    let png: [Int] = app_chunk(png, idat, table)
+    // IEND
+    let iend: [Int] = native_list_empty()
+    let iend: [Int] = app_tag(iend, "IEND")
+    let png: [Int] = app_chunk(png, iend, table)
+    return png
+}
+
+fn png_write(path: String, png: [Int]) -> Int {
+    let n: Int = native_list_len(png)
+    let buf: String = __str_alloc(n)
+    let i: Int = 0
+    while i < n {
+        let buf: String = __str_set_char(buf, i, native_list_get(png, i))
+        let i: Int = i + 1
+    }
+    let ok: Int = fs_write_bytes(path, buf, n)
+    return ok
+}

elp/src/organ-read.el

@@ -0,0 +1,125 @@
+// organ-read.el - Route the render's GEOMETRY READ through the ingest ORGAN's
+// saved engram files (the coordinator's source of truth). For each file we
+// engram_load() it, engram_scan_nodes_json(limit, offset) to get the node array,
+// and cache each node's self-contained CONTENT string keyed by symbol. Because
+// the cached value carries the numbers ("... f1=730 ..."), the cache SURVIVES the
+// store being REPLACED by the next engram_load — so we load+cache phonetics
+// FIRST, then load+cache accent. The .psv path remains a fallback.
+//
+// engram_scan_nodes_json(limit, offset) takes NO query; it returns nodes
+// salience-sorted, so limit must be >= node count and we filter client-side.
+// (engram_search / engram_scan_nodes return len-5 garbage — unused.)
+
+// Find every occurrence of `marker` in the scan JSON; for each, cache
+// sym -> a 150-char content window (enough to hold f1..amp). Duplicates from the
+// node's "content" and "label" fields are harmless (first match wins on read).
+fn organ_cache(j: String, marker: String, mlen: Int, win_len: Int, need: String) -> [String] {
+    let m: [String] = native_list_empty()
+    let jl: Int = str_len(j)
+    let off: Int = 0
+    while off < jl {
+        let rest: String = str_slice(j, off, jl)
+        let p: Int = str_index_of(rest, marker)
+        if p < 0 {
+            off = jl
+        } else {
+            let abs: Int = off + p
+            let win: String = str_slice(j, abs, abs + win_len)
+            let after: String = str_slice(win, mlen, str_len(win))
+            let sp: Int = str_index_of(after, " ")
+            let hasneed: Int = str_index_of(win, need)
+            if sp > 0 {
+                if hasneed >= 0 {
+                    let sym: String = str_slice(after, 0, sp)
+                    m = native_list_append(m, sym)
+                    m = native_list_append(m, win)
+                }
+            }
+            off = abs + mlen
+        }
+    }
+    return m
+}
+
+// Load the phonetics organ file and cache sym -> content. mlen("phoneme ")=8.
+fn organ_pmap(path: String) -> [String] {
+    let ok: Bool = engram_load(path)
+    if ok == false {
+        return native_list_empty()
+    }
+    let j: String = engram_scan_nodes_json(600, 0)
+    return organ_cache(j, "phoneme ", 8, 150, "f1=")
+}
+
+// Load the accent organ file and cache sym -> content. mlen("accent_target ")=14.
+// Vowel overrides carry f1=..; the R rule carries drop_coda_r (need="=" matches
+// both, i.e. any well-formed accent_target field).
+fn organ_amap(path: String) -> [String] {
+    let ok: Bool = engram_load(path)
+    if ok == false {
+        return native_list_empty()
+    }
+    let j: String = engram_scan_nodes_json(600, 0)
+    return organ_cache(j, "accent_target ", 14, 90, "=")
+}
+
+// Vowel-set (categorical class) from the phonetics .psv class column.
+fn organ_vset(path: String) -> [String] {
+    let content: String = fs_read(path)
+    let lines: [String] = str_split(content, "\n")
+    let nl: Int = native_list_len(lines)
+    let v: [String] = native_list_empty()
+    let li: Int = 0
+    while li < nl {
+        let line: String = native_list_get(lines, li)
+        let ok: Int = 1
+        if str_len(line) < 5 {
+            ok = 0
+        }
+        if ok == 1 {
+            if str_char_code(line, 0) == 35 {
+                ok = 0
+            }
+        }
+        if ok == 1 {
+            let f: [String] = str_split(line, "|")
+            if native_list_len(f) >= 12 {
+                if str_eq(native_list_get(f, 11), "vowel") {
+                    v = native_list_append(v, native_list_get(f, 0))
+                }
+            }
+        }
+        li = li + 1
+    }
+    return v
+}
+
+// Word -> phoneme-sequence cache from lexicon.psv (engram-independent).
+fn organ_lex(path: String) -> [String] {
+    let content: String = fs_read(path)
+    let lines: [String] = str_split(content, "\n")
+    let nl: Int = native_list_len(lines)
+    let m: [String] = native_list_empty()
+    let li: Int = 0
+    while li < nl {
+        let line: String = native_list_get(lines, li)
+        let ok: Int = 1
+        if str_len(line) < 3 {
+            ok = 0
+        }
+        if ok == 1 {
+            if str_char_code(line, 0) == 35 {
+                ok = 0
+            }
+        }
+        if ok == 1 {
+            let f: [String] = str_split(line, "|")
+            if native_list_len(f) >= 2 {
+                m = native_list_append(m, native_list_get(f, 0))
+                m = native_list_append(m, native_list_get(f, 1))
+            }
+        }
+        li = li + 1
+    }
+    return m
+}

elp/src/speech-ingest.el

@@ -0,0 +1,233 @@
+// speech-ingest.el - The native LOAD step of the ingest organ, for the SPEECH
+// primitives. Reads the acoustic-phonetics SOURCE (elp/data/phonetics.psv) and
+// the pronunciation lexicon SOURCE (elp/data/lexicon.psv) and emits a PHONEME
+// MANIFOLD into the engram: one node per phoneme (faithful, provenance-tagged
+// content) + is_a edges to phoneme-class nodes (a discrete manifold, not islands).
+// The render then PULLS phoneme geometry back from the engram via phon_geo —
+// zero phonetic numbers in code. Source -> manifold -> merge; the same output
+// the polymorphic ingest organ will produce and subsume.
+
+// -- small parsing helpers ---------------------------------------------------
+fn sp_map_get(pairs: [String], key: String) -> String {
+    let n: Int = native_list_len(pairs)
+    let i: Int = 0
+    while i < n - 1 {
+        let k: String = native_list_get(pairs, i)
+        if str_eq(k, key) {
+            return native_list_get(pairs, i + 1)
+        }
+        let i = i + 2
+    }
+    return ""
+}
+
+// read the unsigned integer that follows `key` inside string s (e.g. key "F1=")
+fn parse_uint_from(s: String, key: String) -> Int {
+    let idx: Int = str_index_of(s, key)
+    if idx < 0 {
+        return 0
+    }
+    let start: Int = idx + str_len(key)
+    let n: Int = str_len(s)
+    let i: Int = start
+    let val: Int = 0
+    while i < n {
+        let c: Int = str_char_code(s, i)
+        if c >= 48 {
+            if c <= 57 {
+                val = val * 10 + (c - 48)
+                i = i + 1
+            } else {
+                i = n
+            }
+        } else {
+            i = n
+        }
+    }
+    return val
+}
+
+fn clean_word(w: String) -> String {
+    let low: String = str_to_lower(w)
+    let n: Int = str_len(low)
+    let out: String = ""
+    let i: Int = 0
+    while i < n {
+        let c: Int = str_char_code(low, i)
+        if c >= 97 {
+            if c <= 122 {
+                out = out + str_char_at(low, i)
+            }
+        }
+        i = i + 1
+    }
+    return out
+}
+
+// -- INGEST: acoustic-phonetics source -> phoneme manifold in the engram ------
+// Returns the symbol -> node-id index (pmap) the render reads geometry through.
+fn ingest_phonetics(path: String) -> [String] {
+    let content: String = fs_read(path)
+    let lines: [String] = str_split(content, "\n")
+    let nl: Int = native_list_len(lines)
+    let pmap: [String] = native_list_empty()
+    let classmap: [String] = native_list_empty()
+    let li: Int = 0
+    while li < nl {
+        let line: String = native_list_get(lines, li)
+        let ll: Int = str_len(line)
+        let skip: Int = 0
+        if ll < 5 {
+            skip = 1
+        }
+        if skip == 0 {
+            let first: Int = str_char_code(line, 0)
+            if first == 35 {
+                skip = 1
+            }
+        }
+        if skip == 0 {
+            let f: [String] = str_split(line, "|")
+            let nf: Int = native_list_len(f)
+            if nf >= 12 {
+                let sym: String = native_list_get(f, 0)
+                let f1: String = native_list_get(f, 1)
+                let f2: String = native_list_get(f, 2)
+                let f3: String = native_list_get(f, 3)
+                let b1: String = native_list_get(f, 4)
+                let b2: String = native_list_get(f, 5)
+                let b3: String = native_list_get(f, 6)
+                let vo: String = native_list_get(f, 7)
+                let na: String = native_list_get(f, 8)
+                let du: String = native_list_get(f, 9)
+                let am: String = native_list_get(f, 10)
+                let cls: String = native_list_get(f, 11)
+                let cont: String = "phoneme " + sym + " | f1=" + f1 + " f2=" + f2 + " f3=" + f3 + " bw1=" + b1 + " bw2=" + b2 + " bw3=" + b3 + " voiced=" + vo + " nasal=" + na + " dur=" + du + " amp=" + am + " class=" + cls + " src=PetersonBarney1952-Hillenbrand1995"
+                let id: String = engram_node(cont, "Phoneme", 80)
+                pmap = native_list_append(pmap, sym)
+                pmap = native_list_append(pmap, cont)
+                // manifold edge: phoneme is_a class
+                let cid: String = sp_map_get(classmap, cls)
+                if str_eq(cid, "") {
+                    cid = engram_node("phoneme-class " + cls + " src=acoustic-phonetics", "PhonemeClass", 80)
+                    classmap = native_list_append(classmap, cls)
+                    classmap = native_list_append(classmap, cid)
+                }
+                engram_connect(id, cid, 80, "is_a")
+            }
+        }
+        li = li + 1
+    }
+    return pmap
+}
+
+// -- INGEST: pronunciation lexicon source -> word nodes ----------------------
+fn ingest_lexicon(path: String) -> [String] {
+    let content: String = fs_read(path)
+    let lines: [String] = str_split(content, "\n")
+    let nl: Int = native_list_len(lines)
+    let lmap: [String] = native_list_empty()
+    let li: Int = 0
+    while li < nl {
+        let line: String = native_list_get(lines, li)
+        let ll: Int = str_len(line)
+        let skip: Int = 0
+        if ll < 3 {
+            skip = 1
+        }
+        if skip == 0 {
+            let first: Int = str_char_code(line, 0)
+            if first == 35 {
+                skip = 1
+            }
+        }
+        if skip == 0 {
+            let f: [String] = str_split(line, "|")
+            let nf: Int = native_list_len(f)
+            if nf >= 2 {
+                let word: String = native_list_get(f, 0)
+                let seq: String = native_list_get(f, 1)
+                let id: String = engram_node("word " + word + " phonemes " + seq + " src=lexicon", "Pronunciation", 80)
+                lmap = native_list_append(lmap, word)
+                lmap = native_list_append(lmap, seq)
+            }
+        }
+        li = li + 1
+    }
+    return lmap
+}
+
+// -- READ geometry back from the engram (the render's afferent lookup) --------
+// phon_geo(sym) -> [F1,F2,F3,B1,B2,B3,voiced,nasal,dur,amp], parsed from the
+// ingested phoneme node's content. NO formant numbers live in this code.
+fn phon_geo(pmap: [String], sym: String) -> [Int] {
+    let id: String = sp_map_get(pmap, sym)
+    if str_eq(id, "") {
+        id = sp_map_get(pmap, "AX")
+    }
+    let out: [Int] = native_list_empty()
+    if str_eq(id, "") {
+        let out = native_list_append(out, 500)
+        let out = native_list_append(out, 1500)
+        let out = native_list_append(out, 2500)
+        let out = native_list_append(out, 80)
+        let out = native_list_append(out, 100)
+        let out = native_list_append(out, 150)
+        let out = native_list_append(out, 1)
+        let out = native_list_append(out, 0)
+        let out = native_list_append(out, 80)
+        let out = native_list_append(out, 80)
+        return out
+    }
+    let j: String = id
+    let out = native_list_append(out, parse_uint_from(j, "f1="))
+    let out = native_list_append(out, parse_uint_from(j, "f2="))
+    let out = native_list_append(out, parse_uint_from(j, "f3="))
+    let out = native_list_append(out, parse_uint_from(j, "bw1="))
+    let out = native_list_append(out, parse_uint_from(j, "bw2="))
+    let out = native_list_append(out, parse_uint_from(j, "bw3="))
+    let out = native_list_append(out, parse_uint_from(j, "voiced="))
+    let out = native_list_append(out, parse_uint_from(j, "nasal="))
+    let out = native_list_append(out, parse_uint_from(j, "dur="))
+    let out = native_list_append(out, parse_uint_from(j, "amp="))
+    return out
+}
+
+// word -> phoneme codes, read from the ingested lexicon node.
+fn word_phonemes(lmap: [String], word: String) -> [String] {
+    let id: String = sp_map_get(lmap, word)
+    if str_eq(id, "") {
+        let r: [String] = native_list_empty()
+        let r = native_list_append(r, "AX")
+        return r
+    }
+    return str_split(id, " ")
+}
+
+// realized text -> flat phoneme-code sequence (SIL between words + at ends).
+fn text_phonemes(lmap: [String], text: String) -> [String] {
+    let words: [String] = str_split(text, " ")
+    let nw: Int = native_list_len(words)
+    let seq: [String] = native_list_empty()
+    let seq = native_list_append(seq, "SIL")
+    let wi: Int = 0
+    while wi < nw {
+        let raw: String = native_list_get(words, wi)
+        let w: String = clean_word(raw)
+        if str_eq(w, "") {
+            wi = wi + 1
+        } else {
+            let ph: [String] = word_phonemes(lmap, w)
+            let np: Int = native_list_len(ph)
+            let pi: Int = 0
+            while pi < np {
+                let code: String = native_list_get(ph, pi)
+                seq = native_list_append(seq, code)
+                pi = pi + 1
+            }
+            seq = native_list_append(seq, "SIL")
+            wi = wi + 1
+        }
+    }
+    return seq
+}

elp/src/speech.el

@@ -0,0 +1,460 @@
+// speech.el - The native SPEECH render path + voice-by-imitation extractor.
+//
+// Speech = the AUDIO surface (surface_profile_audio) rendering LANGUAGE-meaning
+// through a VOICE signature. The realizer's language faculty supplies the words
+// (meaning -> sem_realize -> text); this module turns text -> phonemes (phonetics.el)
+// -> a formant-target track over time -> SUPERPOSES formant resonances over a
+// glottal source (own-core formant synthesis, the exact integer mirror of the
+// music additive superpose) -> own-core PCM/WAV. Two paths:
+//   (1) RENDER:  speak(text, voice) -> spoken WAV.
+//   (2) IMITATE: voice_analyze(pcm) -> a voice signature grabbed BY EAR
+//                (autocorrelation pitch + integer-DFT formant peaks), then render
+//                any new meaning in that voice. An impression, not a corpus.
+// All integer/fixed-point (EL float arithmetic is unusable).
+
+// -- Own-core integer sine (Bhaskara I), phase 0..65535 = one cycle -----------
+fn sp_sin(phase: Int) -> Int {
+    let deg: Int = phase * 360 / 65536
+    let neg: Int = 0
+    if deg > 180 {
+        deg = deg - 180
+        neg = 1
+    }
+    let t: Int = deg * (180 - deg)
+    let num: Int = 32767 * 4 * t
+    let den: Int = 40500 - t
+    let v: Int = num / den
+    if neg == 1 {
+        v = 0 - v
+    }
+    return v
+}
+
+fn sp_cos(phase: Int) -> Int {
+    let p: Int = phase + 16384
+    p = p - (p / 65536) * 65536
+    return sp_sin(p)
+}
+
+// One formant resonance (Lorentzian peak), Q15. Peak 32767 at f=fc.
+fn sp_gain(f: Int, fc: Int, bw: Int) -> Int {
+    let d: Int = f - fc
+    let den: Int = d * d + bw * bw
+    let num: Int = 32767 * bw * bw
+    return num / den
+}
+
+fn sp_isqrt(n: Int) -> Int {
+    if n <= 0 {
+        return 0
+    }
+    let x: Int = n
+    let y: Int = (x + 1) / 2
+    while y < x {
+        x = y
+        y = (x + n / x) / 2
+    }
+    return x
+}
+
+// -- WAV serializer (thin medium; the only non-DSP glue) ---------------------
+fn wav_le16(buf: String, off: Int, v: Int) -> String {
+    let u: Int = v
+    if u < 0 {
+        u = u + 65536
+    }
+    let lo: Int = u - (u / 256) * 256
+    let hi: Int = u / 256
+    let b: String = __str_set_char(buf, off, lo)
+    b = __str_set_char(b, off + 1, hi)
+    return b
+}
+
+fn wav_le32(buf: String, off: Int, v: Int) -> String {
+    let b0: Int = v - (v / 256) * 256
+    let r1: Int = v / 256
+    let b1: Int = r1 - (r1 / 256) * 256
+    let r2: Int = r1 / 256
+    let b2: Int = r2 - (r2 / 256) * 256
+    let b3: Int = r2 / 256
+    let b: String = __str_set_char(buf, off, b0)
+    b = __str_set_char(b, off + 1, b1)
+    b = __str_set_char(b, off + 2, b2)
+    b = __str_set_char(b, off + 3, b3)
+    return b
+}
+
+fn wav_ascii(buf: String, off: Int, s: String) -> String {
+    let n: Int = str_len(s)
+    let i: Int = 0
+    let b: String = buf
+    while i < n {
+        let c: Int = str_char_code(s, i)
+        b = __str_set_char(b, off + i, c)
+        i = i + 1
+    }
+    return b
+}
+
+fn write_wav(samples: [Int], sr: Int, path: String) -> Bool {
+    let ns: Int = native_list_len(samples)
+    let datalen: Int = ns * 2
+    let total: Int = 44 + datalen
+    let buf: String = __str_alloc(total)
+    buf = wav_ascii(buf, 0, "RIFF")
+    buf = wav_le32(buf, 4, 36 + datalen)
+    buf = wav_ascii(buf, 8, "WAVE")
+    buf = wav_ascii(buf, 12, "fmt ")
+    buf = wav_le32(buf, 16, 16)
+    buf = wav_le16(buf, 20, 1)
+    buf = wav_le16(buf, 22, 1)
+    buf = wav_le32(buf, 24, sr)
+    buf = wav_le32(buf, 28, sr * 2)
+    buf = wav_le16(buf, 32, 2)
+    buf = wav_le16(buf, 34, 16)
+    buf = wav_ascii(buf, 36, "data")
+    buf = wav_le32(buf, 40, datalen)
+    let j: Int = 0
+    let off: Int = 44
+    while j < ns {
+        let raw: Int = native_list_get(samples, j)
+        buf = wav_le16(buf, off, raw)
+        off = off + 2
+        j = j + 1
+    }
+    return __fs_write_bytes(path, buf, total)
+}
+
+// One formant resonance as a float Lorentzian peak (own-core physics).
+fn fgain(f: Float, fc: Float, bw: Float) -> Float {
+    let d: Float = f - fc
+    return (bw * bw) / (d * d + bw * bw)
+}
+
+// His PITCH MELODY from measured prosody [f0_median, f0_min, f0_max, declination].
+// A natural statement shape over the utterance: onset rise to the median, a
+// near-flat body (his declination is ~0.6 Hz/s), and a final fall toward f0_min.
+// Follows his melody + range, not a fixed 0.85 decline. gidx/total = position.
+fn prosody_f0(pros: [Int], gidx: Int, total: Int) -> Int {
+    let med: Int = native_list_get(pros, 0)
+    let lo: Int = native_list_get(pros, 1)
+    let hi: Int = native_list_get(pros, 2)
+    let p: Int = gidx * 1000 / total
+    let f0: Int = med
+    if p < 150 {
+        f0 = lo + (med - lo) * p / 150
+    } else {
+        if p > 700 {
+            f0 = med + (lo - med) * (p - 700) / 300
+        } else {
+            f0 = med
+        }
+    }
+    if f0 < lo {
+        f0 = lo
+    }
+    if f0 > hi {
+        f0 = hi
+    }
+    return f0
+}
+
+// -- The render: phoneme codes + voice signature -> normalized PCM samples ----
+// Formant geometry per phoneme is READ FROM THE ENGRAM (pmap) via phon_geo — no
+// table in code. The optional ACCENT map (amap) composes a transform onto the
+// voice (voice (+) accent, separable): RP formant overrides read from the accent
+// manifold + a non-rhotic coda-R drop. Empty amap = base General-American.
+// Synthesis is FLOAT: a real phase accumulator + math_sin, superposition physics.
+fn synth_codes_accent(codes0: [String], voice: [String], pmap: [String], amap: [String], vset: [String], vmap: [String], prosody: [Int]) -> [Int] {
+    let sr: Int = 16000
+    let srf: Float = 16000.0
+    let two_pi: Float = 6.283185307
+    let kf: Int = voice_get_int(voice, "kf")
+    let f0s: Int = voice_get_int(voice, "f0")
+    let f0e: Int = voice_get_int(voice, "f0_end")
+    let durm: Int = voice_get_int(voice, "dur")
+    if kf <= 0 {
+        kf = 1000
+    }
+    if durm <= 0 {
+        durm = 1000
+    }
+    let use_accent: Int = 0
+    if native_list_len(amap) > 0 {
+        use_accent = 1
+    }
+    let codes: [String] = codes0
+    if use_accent == 1 {
+        if is_nonrhotic(amap) == 1 {
+            codes = apply_rhoticity(codes0, vset)
+        }
+    }
+    let nc: Int = native_list_len(codes)
+
+    // pass 1: per-segment sample counts + total
+    let segn: [Int] = native_list_empty()
+    let total: Int = 0
+    let ci: Int = 0
+    while ci < nc {
+        let code: String = native_list_get(codes, ci)
+        let p: [Int] = phon_geo(pmap, code)
+        let durms: Int = native_list_get(p, 8)
+        let ns: Int = durms * 16 * durm / 1000
+        segn = native_list_append(segn, ns)
+        total = total + ns
+        ci = ci + 1
+    }
+    if total <= 0 {
+        total = 1
+    }
+
+    // pass 2: synthesize
+    let samples: [Int] = native_list_empty()
+    let phasef: Float = 0.0
+    let gidx: Int = 0
+    let prevF1: Int = 500 * kf / 1000
+    let prevF2: Int = 1500 * kf / 1000
+    let prevF3: Int = 2500 * kf / 1000
+    let nstate: Int = 22695
+    let maxabs: Int = 1
+
+    let ci2: Int = 0
+    while ci2 < nc {
+        let code: String = native_list_get(codes, ci2)
+        let p: [Int] = phon_geo(pmap, code)
+        let rf1: Int = native_list_get(p, 0)
+        let rf2: Int = native_list_get(p, 1)
+        let rf3: Int = native_list_get(p, 2)
+        if use_accent == 1 {
+            let ov: [Int] = accent_formants(amap, code)
+            if native_list_len(ov) >= 3 {
+                rf1 = native_list_get(ov, 0)
+                rf2 = native_list_get(ov, 1)
+                rf3 = native_list_get(ov, 2)
+            }
+        }
+        // HIS measured vowel target overrides the generic/kf path (absolute Hz —
+        // his formants already encode his vocal tract, so no kf scaling).
+        let usekf: Int = 1
+        if native_list_len(vmap) > 0 {
+            let hv: [Int] = vmap_get(vmap, code)
+            if native_list_len(hv) >= 3 {
+                rf1 = native_list_get(hv, 0)
+                rf2 = native_list_get(hv, 1)
+                rf3 = native_list_get(hv, 2)
+                usekf = 0
+            }
+        }
+        let F1t: Int = rf1 * kf / 1000
+        let F2t: Int = rf2 * kf / 1000
+        let F3t: Int = rf3 * kf / 1000
+        if usekf == 0 {
+            F1t = rf1
+            F2t = rf2
+            F3t = rf3
+        }
+        let B1: Int = native_list_get(p, 3)
+        let B2: Int = native_list_get(p, 4)
+        let B3: Int = native_list_get(p, 5)
+        let voiced: Int = native_list_get(p, 6)
+        let ampv: Int = native_list_get(p, 9)
+        let ns: Int = native_list_get(segn, ci2)
+        let trans: Int = ns / 2
+        if trans > 560 {
+            trans = 560
+        }
+        if trans < 1 {
+            trans = 1
+        }
+        let k: Int = 0
+        while k < ns {
+            let cF1: Int = F1t
+            let cF2: Int = F2t
+            let cF3: Int = F3t
+            if k < trans {
+                cF1 = prevF1 + (F1t - prevF1) * k / trans
+                cF2 = prevF2 + (F2t - prevF2) * k / trans
+                cF3 = prevF3 + (F3t - prevF3) * k / trans
+            }
+            let f0c: Int = f0s + (f0e - f0s) * gidx / total
+            if native_list_len(prosody) >= 3 {
+                f0c = prosody_f0(prosody, gidx, total)
+            }
+            if f0c < 40 {
+                f0c = 40
+            }
+            let env: Int = 32767
+            let ar: Int = 96
+            if k < ar {
+                env = 32767 * k / ar
+            }
+            let tail: Int = ns - k
+            if tail < ar {
+                env = 32767 * tail / ar
+            }
+            let f0cf: Float = int_to_float(f0c)
+            phasef = phasef + two_pi * f0cf / srf
+            if phasef > two_pi {
+                phasef = phasef - two_pi
+            }
+
+            let s: Int = 0
+            if voiced == 1 {
+                let cF1f: Float = int_to_float(cF1)
+                let cF2f: Float = int_to_float(cF2)
+                let cF3f: Float = int_to_float(cF3)
+                let B1f: Float = int_to_float(B1)
+                let B2f: Float = int_to_float(B2)
+                let B3f: Float = int_to_float(B3)
+                let acc: Float = 0.0
+                let h: Int = 1
+                while h <= 50 {
+                    let hf: Float = int_to_float(h)
+                    let fhf: Float = hf * f0cf
+                    if fhf < 7900.0 {
+                        let sv: Float = math_sin(phasef * hf)
+                        let src: Float = 1.0 / hf
+                        let g1: Float = fgain(fhf, cF1f, B1f)
+                        let g2: Float = fgain(fhf, cF2f, B2f)
+                        let g3: Float = fgain(fhf, cF3f, B3f)
+                        let g: Float = g1 + g2 + g3
+                        acc = acc + src * g * sv
+                    }
+                    h = h + 1
+                }
+                s = float_to_int(acc * 4000.0)
+            } else {
+                if ampv > 0 {
+                    nstate = nstate * 1103515245 + 12345
+                    nstate = nstate - (nstate / 2147483648) * 2147483648
+                    if nstate < 0 {
+                        nstate = 0 - nstate
+                    }
+                    let nz: Int = nstate / 32768 - 32768
+                    s = nz
+                }
+            }
+            s = s * ampv / 100
+            s = s * env / 32767
+            samples = native_list_append(samples, s)
+            let a: Int = s
+            if a < 0 {
+                a = 0 - a
+            }
+            if a > maxabs {
+                maxabs = a
+            }
+            gidx = gidx + 1
+            k = k + 1
+        }
+        prevF1 = F1t
+        prevF2 = F2t
+        prevF3 = F3t
+        ci2 = ci2 + 1
+    }
+
+    // normalize to int16 range (~22000 peak)
+    let out: [Int] = native_list_empty()
+    let ntot: Int = native_list_len(samples)
+    let j: Int = 0
+    while j < ntot {
+        let raw: Int = native_list_get(samples, j)
+        let v: Int = raw * 22000 / maxabs
+        out = native_list_append(out, v)
+        j = j + 1
+    }
+    return out
+}
+
+// GA convenience wrapper (no accent) — keeps the base render path.
+fn synth_codes(codes: [String], voice: [String], pmap: [String]) -> [Int] {
+    let noacc: [String] = native_list_empty()
+    let novset: [String] = native_list_empty()
+    let novmap: [String] = native_list_empty()
+    let nopros: [Int] = native_list_empty()
+    return synth_codes_accent(codes, voice, pmap, noacc, novset, novmap, nopros)
+}
+
+// -- Voice-by-imitation: HEAR a PCM sample -> extract the voice signature -----
+// Pitch by autocorrelation; vocal-tract scale (kf) from the F1 formant peak of a
+// heard sustained vowel /AA/ (nominal F1 = 730 Hz) via an integer DFT. The
+// analyzer sees ONLY the PCM samples — never the source signature numbers — so
+// recovery is genuinely by ear.
+fn voice_f0(samples: [Int], sr: Int) -> Int {
+    let n: Int = native_list_len(samples)
+    let start: Int = n / 4
+    let end: Int = n * 3 / 4
+    // bound the analysis window so accumulators can never overflow on long input
+    if end - start > 6000 {
+        end = start + 6000
+    }
+    let minlag: Int = sr / 300
+    let maxlag: Int = sr / 75
+    let best: Int = 0
+    let bestlag: Int = minlag
+    let lag: Int = minlag
+    while lag <= maxlag {
+        let sum: Int = 0
+        let i: Int = start
+        while i < end {
+            let ai: Int = native_list_get(samples, i)
+            let bi: Int = native_list_get(samples, i + lag)
+            sum = sum + ai * bi / 256
+            i = i + 2
+        }
+        if sum > best {
+            best = sum
+            bestlag = lag
+        }
+        lag = lag + 1
+    }
+    if bestlag < 1 {
+        bestlag = 1
+    }
+    return sr / bestlag
+}
+
+fn voice_peak_in_band(samples: [Int], sr: Int, flo: Int, fhi: Int) -> Int {
+    let n: Int = native_list_len(samples)
+    let start: Int = n / 4
+    let end: Int = n * 3 / 4
+    // bound the DFT window: re/im are accumulated /4096, and re*re must stay in
+    // int64 — cap terms so (window/2)*(peak_term) squared cannot overflow.
+    if end - start > 3000 {
+        end = start + 3000
+    }
+    let bestmag: Int = 0
+    let bestf: Int = flo
+    let f: Int = flo
+    while f <= fhi {
+        let re: Int = 0
+        let im: Int = 0
+        let i: Int = start
+        while i < end {
+            let x: Int = native_list_get(samples, i)
+            let ph: Int = i * f * 65536 / sr
+            ph = ph - (ph / 65536) * 65536
+            let cq: Int = sp_cos(ph)
+            let sq: Int = sp_sin(ph)
+            re = re + x * cq / 4096
+            im = im + x * sq / 4096
+            i = i + 2
+        }
+        let mag: Int = re * re + im * im
+        if mag > bestmag {
+            bestmag = mag
+            bestf = f
+        }
+        f = f + 25
+    }
+    return bestf
+}
+
+// Analyze a heard sustained /AA/ -> a full voice signature (by ear).
+fn voice_analyze(samples: [Int], sr: Int) -> [String] {
+    let f0: Int = voice_f0(samples, sr)
+    let f1: Int = voice_peak_in_band(samples, sr, 450, 1150)
+    let kf: Int = 1000 * f1 / 730
+    let f0e: Int = f0 * 85 / 100
+    return voice_new("imitated", f0, f0e, kf, 1000, 1000, 8)
+}

elp/src/surface-profile.el

@@ -0,0 +1,153 @@
+// surface-profile.el - Surface profile data and accessors.
+//
+// THE NATIVE EFFERENT SEAM: surface = a pluggable PROFILE, using the exact same
+// slot-map mechanism as language-profile.el. A language profile tells the
+// realizer HOW to shape a natural-language surface (word order, morphology); a
+// SURFACE profile tells the realizer WHICH surface to project meaning onto
+// (markdown, docx, html, plain, or a non-text medium like symbolic music).
+//
+// The generalization is exact: realize_lang(form, profile) already renders a
+// SemForm parameterized by a [String] profile read via lang_get. Surface is one
+// more axis of that same profile vector. One frame (sem_frame), one plan step
+// (sem_to_spec), one render (realize) — the surface is DATA, not a code path,
+// precisely as language is data. Adding a surface means adding a profile, no
+// engine change. This is the multimodal projector, native: geometry -> any
+// surface, the efferent twin of ingest.
+//
+// Surface slot keys:
+//   surface     - "markdown" | "docx" | "html" | "plain" | "midi" | "image"
+//   modality    - "text" | "audio" | "image" | "video"
+//   media_type  - MIME type of the emitted surface
+//   head_open   - string prepended to a heading   (e.g. "## " for markdown)
+//   head_close  - string appended  to a heading   (e.g. "" for markdown, "</h2>" for html)
+//   emph_open   - string opening emphasis          (e.g. "*")
+//   emph_close  - string closing emphasis          (e.g. "*")
+//   item_mark   - list-item marker                 (e.g. "- ")
+//   para_sep    - paragraph separator              (e.g. "\n\n")
+//
+// For a TEXT modality the render composes these markers around the surface that
+// the EXISTING realizer produces (realize_lang / sem_realize). For a non-text
+// modality (audio/image) the profile declares modality + media_type and the
+// render dispatches to the medium projector, which reads the SAME frame's
+// geometry (its intent/affect/structure) and projects it onto sound or pixels —
+// deterministic-from-meaning, nothing invented. That dispatch point is where a
+// music profile or image profile conforms, native, no parallel layer.
+
+// -- Constructor -------------------------------------------------------------
+
+fn surface_profile(surface: String, modality: String, media_type: String, head_open: String, head_close: String, emph_open: String, emph_close: String, item_mark: String, para_sep: String) -> [String] {
+    let r: [String] = native_list_empty()
+    let r = native_list_append(r, "surface")
+    let r = native_list_append(r, surface)
+    let r = native_list_append(r, "modality")
+    let r = native_list_append(r, modality)
+    let r = native_list_append(r, "media_type")
+    let r = native_list_append(r, media_type)
+    let r = native_list_append(r, "head_open")
+    let r = native_list_append(r, head_open)
+    let r = native_list_append(r, "head_close")
+    let r = native_list_append(r, head_close)
+    let r = native_list_append(r, "emph_open")
+    let r = native_list_append(r, emph_open)
+    let r = native_list_append(r, "emph_close")
+    let r = native_list_append(r, emph_close)
+    let r = native_list_append(r, "item_mark")
+    let r = native_list_append(r, item_mark)
+    let r = native_list_append(r, "para_sep")
+    let r = native_list_append(r, para_sep)
+    return r
+}
+
+// -- Accessor (same convention as lang_get; standalone so this is a leaf) -----
+
+fn surface_get(profile: [String], key: String) -> String {
+    let n: Int = native_list_len(profile)
+    let i: Int = 0
+    while i < n - 1 {
+        let k: String = native_list_get(profile, i)
+        if str_eq(k, key) {
+            return native_list_get(profile, i + 1)
+        }
+        let i = i + 2
+    }
+    return ""
+}
+
+fn surface_is_text(profile: [String]) -> Bool {
+    return str_eq(surface_get(profile, "modality"), "text")
+}
+
+// -- Built-in TEXT surface profiles ------------------------------------------
+
+// Markdown: headings with "## ", emphasis with "*", "- " list items.
+fn surface_profile_markdown() -> [String] {
+    return surface_profile("markdown", "text", "text/markdown", "## ", "", "*", "*", "- ", "\n\n")
+}
+
+// Plain text: no markup at all — headings become bare uppercase-free lines.
+fn surface_profile_plain() -> [String] {
+    return surface_profile("plain", "text", "text/plain", "", "", "", "", "  - ", "\n\n")
+}
+
+// HTML: block-level heading/emphasis tags.
+fn surface_profile_html() -> [String] {
+    return surface_profile("html", "text", "text/html", "<h2>", "</h2>", "<em>", "</em>", "<li>", "\n")
+}
+
+// docx: WordprocessingML is structural, not inline-markup; the head/emph slots
+// carry the run/style intent that the OOXML emitter maps to <w:pStyle>. Declared
+// here so docx is a first-class surface on the same seam.
+fn surface_profile_docx() -> [String] {
+    return surface_profile("docx", "text", "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "Heading2:", "", "b:", "", "bullet:", "\n")
+}
+
+// -- Built-in NON-TEXT surface profiles (the multimodal seam) ----------------
+
+// Symbolic music (MIDI): modality=audio. The render dispatches to the music
+// projector, which reads the SAME frame's intent/affect and projects it to
+// pitch/rhythm — deterministic-from-meaning. head/emph slots are empty because
+// the medium is not textual; media_type names the surface. A music profile
+// (scale/mode/instrument) is layered onto this by the audio agent, native.
+fn surface_profile_midi() -> [String] {
+    return surface_profile("midi", "audio", "audio/midi", "", "", "", "", "", "")
+}
+
+// Synthesized audio (WAV): modality=audio, peer to midi. The richer audio
+// surface — the render SUPERPOSES ingested tonal primitives (sine at f0*n per an
+// ingested instrument signature) into PCM, own-core, exactly as midi writes an
+// SMF via struct. A music profile (scale/mode/instrument/adsr) layers onto this
+// as its own [String] slot-map read by the same getter. Same frame -> midi OR
+// audio, interchangeable; this is the audio agent's native conforming point.
+fn surface_profile_audio() -> [String] {
+    return surface_profile("audio", "audio", "audio/wav", "", "", "", "", "", "")
+}
+
+// Image (raster): modality=image. Documented seam — the render dispatches to the
+// image projector, the efferent twin of image ingest, reading the same frame.
+fn surface_profile_image() -> [String] {
+    return surface_profile("image", "image", "image/png", "", "", "", "", "", "")
+}
+
+// -- Composition helpers: wrap realized TEXT with the surface's markers -------
+//
+// These take text the EXISTING realizer already produced and shape it for the
+// surface. They add NO content — pure surface typography over faithful text,
+// exactly as the language profile adds no content, only linguistic form.
+
+fn surface_heading(profile: [String], text: String) -> String {
+    let o: String = surface_get(profile, "head_open")
+    let c: String = surface_get(profile, "head_close")
+    return o + text + c
+}
+
+fn surface_emph(profile: [String], text: String) -> String {
+    let o: String = surface_get(profile, "emph_open")
+    let c: String = surface_get(profile, "emph_close")
+    return o + text + c
+}
+
+// A section: a heading + a paragraph separator + the (already realized) body.
+fn surface_section(profile: [String], heading: String, body: String) -> String {
+    let sep: String = surface_get(profile, "para_sep")
+    return surface_heading(profile, heading) + sep + body
+}

elp/src/voice-ingest.el

@@ -0,0 +1,244 @@
+// voice-ingest.el - The LIVE VOICE LOOP reshape + ingest-as-geometry.
+//
+// EL cannot read a binary WAV (fs_read NUL-truncates), so the thin-medium DSP
+// extractor is periph's `voiceprint` (autocorr F0 + LPC formants), equivalent to
+// our own voice_analyze. This module: (1) RESHAPE the voiceprint JSON (TEXT) into
+// the organ voice-signature schema; (2) INGEST it as a GEOMETRY manifold in the
+// engram and engram_save it to a file; (3) READ the target signature BACK from
+// that geometry (engram_load + scan + filter), never from the json or a table.
+// HONEST: this reaches for pitch + a coarse vocal-tract scale (kf). It is NOT a
+// clone — no glottal timbre, vowel-space, or articulation is captured.
+
+fn parse_leading_int(s: String) -> Int {
+    let n: Int = str_len(s)
+    let i: Int = 0
+    let v: Int = 0
+    let started: Int = 0
+    while i < n {
+        let c: Int = str_char_code(s, i)
+        if c >= 48 {
+            if c <= 57 {
+                v = v * 10 + (c - 48)
+                started = 1
+                i = i + 1
+            } else {
+                i = n
+            }
+        } else {
+            if started == 1 {
+                i = n
+            } else {
+                i = i + 1
+            }
+        }
+    }
+    return v
+}
+
+// voiceprint JSON -> organ voice-signature source file; returns [f0,f0_end,kf,f1,f2,f3].
+fn reshape_voiceprint(vppath: String, outjson: String) -> [Int] {
+    let j: String = fs_read(vppath)
+    let f0: Int = parse_uint_from(j, "f0_hz\":")
+    let fp: Int = str_index_of(j, "formants_hz")
+    let tail: String = str_slice(j, fp, fp + 120)
+    let br: Int = str_index_of(tail, "[")
+    let arr: String = str_slice(tail, br + 1, str_len(tail))
+    let f1: Int = parse_leading_int(arr)
+    let c1: Int = str_index_of(arr, ",")
+    let a2: String = str_slice(arr, c1 + 1, str_len(arr))
+    let f2: Int = parse_leading_int(a2)
+    let c2: Int = str_index_of(a2, ",")
+    let a3: String = str_slice(a2, c2 + 1, str_len(a2))
+    let f3: Int = parse_leading_int(a3)
+    let f0e: Int = f0 * 85 / 100
+    // derive kf honestly: coarse vocal-tract scale from the formant pattern
+    let t1: Int = 1000 * f1 / 500
+    let t2: Int = 1000 * f2 / 1500
+    let t3: Int = 1000 * f3 / 2500
+    let kf: Int = (t1 + t2 + t3) / 3
+    if kf < 800 {
+        kf = 800
+    }
+    if kf > 1400 {
+        kf = 1400
+    }
+    let js: String = "{\"dataset\":\"will-voice-signature\",\"primitive_type\":\"voice\",\"grounding\":\"measured\",\"provenance\":\"Will live 30s read 2026-08-15 (elp/data/live/will30_clean.wav, 27.0s) SUPERSEDES the coarse 10s sample; F0+formants via periph voiceprint (autocorr+LPC), averaged over his full vowel set. Still the 11-number average: no coarticulation/prosody. COARSE — pitch + vocal-tract scale, NOT a clone.\",\"records\":[{\"key\":\"will\",\"features\":{\"source\":\"live-mic\"},\"attributes\":{\"f0\":" + int_to_str(f0) + ",\"f0_end\":" + int_to_str(f0e) + ",\"kf\":" + int_to_str(kf) + ",\"f1\":" + int_to_str(f1) + ",\"f2\":" + int_to_str(f2) + ",\"f3\":" + int_to_str(f3) + "}}]}"
+    let okw: Bool = fs_write(outjson, js)
+    let r: [Int] = native_list_empty()
+    let r = native_list_append(r, f0)
+    let r = native_list_append(r, f0e)
+    let r = native_list_append(r, kf)
+    let r = native_list_append(r, f1)
+    let r = native_list_append(r, f2)
+    let r = native_list_append(r, f3)
+    return r
+}
+
+// Ingest the signature as a manifold (a set-hub + the will node + a member edge)
+// and engram_save it to a reloadable file. grounding:measured self-declared.
+fn ingest_voice(sig: [Int], savepath: String) -> Int {
+    let f0: Int = native_list_get(sig, 0)
+    let f0e: Int = native_list_get(sig, 1)
+    let kf: Int = native_list_get(sig, 2)
+    let f1: Int = native_list_get(sig, 3)
+    let f2: Int = native_list_get(sig, 4)
+    let f3: Int = native_list_get(sig, 5)
+    let hub: String = engram_node("voice-signature-set will grounding=measured src=periph-voiceprint", "VoiceSet", 90)
+    let cont: String = "voice will | f0=" + int_to_str(f0) + " f0_end=" + int_to_str(f0e) + " kf=" + int_to_str(kf) + " f1=" + int_to_str(f1) + " f2=" + int_to_str(f2) + " f3=" + int_to_str(f3) + " grounding=measured src=periph-voiceprint-30s supersedes=prior-voice-region prov=COARSE-pitch+tractscale-NOT-a-clone"
+    let id: String = engram_node(cont, "Voice", 90)
+    engram_connect(id, hub, 90, "member_of")
+    let oks: Bool = engram_save(savepath)
+    return 1
+}
+
+// READ the target voice back FROM the ingested geometry (engram_load + scan +
+// client-filter for "voice will"). Returns [f0,f0_end,kf,f1,f2,f3] or empty.
+fn load_voice(savepath: String) -> [Int] {
+    let ok: Bool = engram_load(savepath)
+    let r: [Int] = native_list_empty()
+    if ok == false {
+        return r
+    }
+    let j: String = engram_scan_nodes_json(200, 0)
+    let p: Int = str_index_of(j, "voice will ")
+    if p < 0 {
+        return r
+    }
+    let win: String = str_slice(j, p, p + 200)
+    let r = native_list_append(r, parse_uint_from(win, "f0="))
+    let r = native_list_append(r, parse_uint_from(win, "f0_end="))
+    let r = native_list_append(r, parse_uint_from(win, "kf="))
+    let r = native_list_append(r, parse_uint_from(win, "f1="))
+    let r = native_list_append(r, parse_uint_from(win, "f2="))
+    let r = native_list_append(r, parse_uint_from(win, "f3="))
+    return r
+}
+
+// ---- Vowel-space + prosody: ingest-as-geometry + read-back (no source layer) --
+// vowel target lookup from the ingested vowel-space manifold: sym -> [f1,f2,f3].
+fn vmap_get(vmap: [String], code: String) -> [Int] {
+    let out: [Int] = native_list_empty()
+    let id: String = sp_map_get(vmap, code)
+    if str_eq(id, "") {
+        return out
+    }
+    let f1: Int = parse_uint_from(id, "f1=")
+    if f1 <= 0 {
+        return out
+    }
+    let out = native_list_append(out, f1)
+    let out = native_list_append(out, parse_uint_from(id, "f2="))
+    let out = native_list_append(out, parse_uint_from(id, "f3="))
+    return out
+}
+
+// Ingest his measured vowel space + prosody as ONE manifold (VowelSpace hub +
+// per-vowel target nodes + a prosody node) and engram_save it. Fresh empty store
+// per run => set-replace, no duplicate.
+fn ingest_voicegeom(vpath: String, ppath: String, savepath: String) -> Int {
+    let hub: String = engram_node("vowel-space-set will grounding=measured src=lpc-formant-track-30s", "VowelSpace", 90)
+    let content: String = fs_read(vpath)
+    let lines: [String] = str_split(content, "\n")
+    let nl: Int = native_list_len(lines)
+    let li: Int = 0
+    while li < nl {
+        let line: String = native_list_get(lines, li)
+        let ok: Int = 1
+        if str_len(line) < 5 {
+            ok = 0
+        }
+        if ok == 1 {
+            if str_char_code(line, 0) == 35 {
+                ok = 0
+            }
+        }
+        if ok == 1 {
+            let f: [String] = str_split(line, "|")
+            if native_list_len(f) >= 5 {
+                let sym: String = native_list_get(f, 0)
+                let cont: String = "vowel-target will " + sym + " | f1=" + native_list_get(f, 1) + " f2=" + native_list_get(f, 2) + " f3=" + native_list_get(f, 3) + " n=" + native_list_get(f, 4) + " grounding=measured src=lpc-formant-track-30s"
+                let id: String = engram_node(cont, "VowelTarget", 90)
+                engram_connect(id, hub, 90, "member_of")
+            }
+        }
+        li = li + 1
+    }
+    let pc: String = fs_read(ppath)
+    let plines: [String] = str_split(pc, "\n")
+    let pnl: Int = native_list_len(plines)
+    let pi: Int = 0
+    while pi < pnl {
+        let pl: String = native_list_get(plines, pi)
+        let ok2: Int = 1
+        if str_len(pl) < 5 {
+            ok2 = 0
+        }
+        if ok2 == 1 {
+            if str_char_code(pl, 0) == 35 {
+                ok2 = 0
+            }
+        }
+        if ok2 == 1 {
+            let pf: [String] = str_split(pl, "|")
+            if native_list_len(pf) >= 4 {
+                let pcont: String = "prosody will | f0_median=" + native_list_get(pf, 0) + " f0_min=" + native_list_get(pf, 1) + " f0_max=" + native_list_get(pf, 2) + " declination=" + native_list_get(pf, 3) + " src=f0-contour-30s"
+                let pid: String = engram_node(pcont, "Prosody", 90)
+                engram_connect(pid, hub, 90, "prosody_of")
+            }
+        }
+        pi = pi + 1
+    }
+    let oks: Bool = engram_save(savepath)
+    return 1
+}
+
+// Read the vowel-space back from geometry; prosody folded under key __PROSODY__.
+fn load_voicegeom(savepath: String) -> [String] {
+    let m: [String] = native_list_empty()
+    let ok: Bool = engram_load(savepath)
+    if ok == false {
+        return m
+    }
+    let j: String = engram_scan_nodes_json(400, 0)
+    let jl: Int = str_len(j)
+    let off: Int = 0
+    while off < jl {
+        let rest: String = str_slice(j, off, jl)
+        let p: Int = str_index_of(rest, "vowel-target will ")
+        if p < 0 {
+            off = jl
+        } else {
+            let abs: Int = off + p
+            let win: String = str_slice(j, abs, abs + 140)
+            let after: String = str_slice(win, 18, str_len(win))
+            let sp: Int = str_index_of(after, " ")
+            if sp > 0 {
+                let sym: String = str_slice(after, 0, sp)
+                m = native_list_append(m, sym)
+                m = native_list_append(m, win)
+            }
+            off = abs + 18
+        }
+    }
+    let pp: Int = str_index_of(j, "prosody will ")
+    if pp >= 0 {
+        let pwin: String = str_slice(j, pp, pp + 160)
+        m = native_list_append(m, "__PROSODY__")
+        m = native_list_append(m, pwin)
+    }
+    return m
+}
+
+// Prosody stats [f0_median, f0_min, f0_max, declination] read from geometry.
+fn prosody_from(vmap: [String]) -> [Int] {
+    let out: [Int] = native_list_empty()
+    let id: String = sp_map_get(vmap, "__PROSODY__")
+    if str_eq(id, "") {
+        return out
+    }
+    let out = native_list_append(out, parse_uint_from(id, "f0_median="))
+    let out = native_list_append(out, parse_uint_from(id, "f0_min="))
+    let out = native_list_append(out, parse_uint_from(id, "f0_max="))
+    let out = native_list_append(out, parse_uint_from(id, "declination="))
+    return out
+}

elp/src/voice-profile.el

@@ -0,0 +1,85 @@
+// voice-profile.el - The VOICE signature as a pluggable PROFILE.
+//
+// Exact mirror of surface-profile.el / language-profile.el: a voice is a
+// [String] slot-map read via voice_get, the SAME mechanism the realizer uses
+// for language and surface. Where an instrument signature (a few dozen numbers)
+// is the timbre of a musical tone, a VOICE signature is the timbre of the vocal
+// tract — the instrument that renders LANGUAGE-meaning as SPEECH on the audio
+// surface. Physics (source-filter), not a recorded corpus.
+//
+// The signature is a few numbers, all integer (EL float arithmetic is unusable):
+//   name    - label
+//   f0      - base pitch, Hz (glottal source rate at utterance start)
+//   f0_end  - pitch at utterance end (declination -> falling = declarative)
+//   kf      - formant scale in PER-MILLE (1000 = x1.0). Encodes vocal-tract
+//             length: shorter tract (child/female) -> higher kf. Scales every
+//             phoneme's nominal formant: F_actual = F_nominal * kf / 1000.
+//   dur     - speaking-rate multiplier in per-mille (1000 = nominal; >1000 slower)
+//   tilt    - source spectral tilt (per-mille; higher = darker/steeper rolloff)
+//   breath  - breathiness 0..100 (aspiration mixed into the source)
+//
+// A voice is grabbed BY EAR (voice_analyze in speech.el extracts these numbers
+// from a short PCM sample — an impression, not 10h of training), or declared.
+
+fn voice_new(name: String, f0: Int, f0_end: Int, kf: Int, dur: Int, tilt: Int, breath: Int) -> [String] {
+    let r: [String] = native_list_empty()
+    let r = native_list_append(r, "name")
+    let r = native_list_append(r, name)
+    let r = native_list_append(r, "f0")
+    let r = native_list_append(r, int_to_str(f0))
+    let r = native_list_append(r, "f0_end")
+    let r = native_list_append(r, int_to_str(f0_end))
+    let r = native_list_append(r, "kf")
+    let r = native_list_append(r, int_to_str(kf))
+    let r = native_list_append(r, "dur")
+    let r = native_list_append(r, int_to_str(dur))
+    let r = native_list_append(r, "tilt")
+    let r = native_list_append(r, int_to_str(tilt))
+    let r = native_list_append(r, "breath")
+    let r = native_list_append(r, int_to_str(breath))
+    return r
+}
+
+// Accessor — identical convention to surface_get / lang_get.
+fn voice_get(profile: [String], key: String) -> String {
+    let n: Int = native_list_len(profile)
+    let i: Int = 0
+    while i < n - 1 {
+        let k: String = native_list_get(profile, i)
+        if str_eq(k, key) {
+            return native_list_get(profile, i + 1)
+        }
+        let i = i + 2
+    }
+    return ""
+}
+
+fn voice_get_int(profile: [String], key: String) -> Int {
+    let s: String = voice_get(profile, key)
+    if str_eq(s, "") {
+        return 0
+    }
+    return str_to_int(s)
+}
+
+// -- Built-in voices ---------------------------------------------------------
+
+// Neuron's own voice: calm, precise, androgynous-neutral. Low-ish base pitch,
+// gentle declination, near-neutral vocal-tract length.
+fn voice_neuron() -> [String] {
+    return voice_new("neuron", 112, 96, 1020, 1000, 1000, 6)
+}
+
+// Will's voice signature, built from the INGESTED geometry (f0/f0_end/kf read
+// back from the will-voice manifold — passed in, never hardcoded). Composable
+// with an accent transform exactly like voice_neuron() (voice (+) accent).
+fn voice_will(f0: Int, f0_end: Int, kf: Int) -> [String] {
+    return voice_new("will", f0, f0_end, kf, 1000, 1000, 6)
+}
+
+// A deliberately DISTINCT target voice for the imitation proof: higher pitch,
+// shorter vocal tract (kf=1.20) -> a clearly different speaker. Neuron will
+// HEAR a sample of this voice and reconstruct these numbers by ear.
+fn voice_target_a() -> [String] {
+    return voice_new("target_a", 178, 150, 1200, 950, 1000, 10)
+}

elp/tests/examples/speech-accent-demo.el

@@ -0,0 +1,45 @@
+// speech-accent-demo.el - PROOF: Neuron speaks with a BRITISH accent, where the
+// accent is a TRANSFORM composed onto the voice (voice (+) accent, separable),
+// INGESTED as geometry (not a table). Same voice, accent toggled on/off = RP/GA.
+
+fn main() {
+    let outdir: String = "/Users/will/Development/neuron-technologies/foundation/el/.claude/worktrees/agent-acc02900ef4ade35e/elp/tests/examples/out/"
+
+    // LEARN: base phonetics + lexicon + the British-RP accent transform, all as
+    // ingested geometry (source -> manifold -> engram).
+    let pmap: [String] = ingest_phonetics("elp/data/phonetics.psv")
+    let lmap: [String] = ingest_lexicon("elp/data/lexicon.psv")
+    let amap: [String] = ingest_accent("elp/data/british-accent.psv")
+    println("[learn] phonemes=" + int_to_str(native_list_len(pmap) / 2) + " words=" + int_to_str(native_list_len(lmap) / 2) + " accent_targets=" + int_to_str(native_list_len(amap) / 2))
+
+    let neuron: [String] = voice_neuron()
+    let noaccent: [String] = native_list_empty()
+
+    // -- Sentence 1: "I am Neuron." from meaning ----------------------------
+    let fr1: [String] = sem_frame("describe", "I", "Neuron", "")
+    let t1: String = sem_realize(fr1)
+    let c1: [String] = text_phonemes(lmap, t1)
+    println("[s1] " + t1 + " :: " + list_join(c1, " "))
+
+    // separability: SAME voice, accent OFF (GA) vs ON (RP)
+    let ga: [Int] = synth_codes_accent(c1, neuron, pmap, noaccent)
+    let okga: Bool = write_wav(ga, 16000, outdir + "ga-neuron.wav")
+    let br1: [Int] = synth_codes_accent(c1, neuron, pmap, amap)
+    let okb1: Bool = write_wav(br1, 16000, outdir + "british-neuron.wav")
+
+    // -- Sentence 2: showcases NON-RHOTICITY --------------------------------
+    let fr2: [String] = sem_frame("describe", "I", "here", "")
+    let t2: String = sem_realize(fr2)
+    let c2: [String] = text_phonemes(lmap, t2)
+    let c2rp: [String] = apply_rhoticity(c2, pmap)
+    println("[s2] " + t2 + " :: GA=" + list_join(c2, " ") + "  RP=" + list_join(c2rp, " "))
+    let br2: [Int] = synth_codes_accent(c2, neuron, pmap, amap)
+    let okb2: Bool = write_wav(br2, 16000, outdir + "british-2.wav")
+
+    // show an RP override read straight from the accent geometry
+    let ovAA: [Int] = accent_formants(amap, "AA")
+    if native_list_len(ovAA) >= 3 {
+        println("[accent-geometry] AA(LOT) RP f1=" + int_to_str(native_list_get(ovAA, 0)) + " f2=" + int_to_str(native_list_get(ovAA, 1)) + " (base GA 730/1090) [PROVISIONAL]")
+    }
+    println("[done] ga-neuron=" + bool_to_str(okga) + " british-neuron=" + bool_to_str(okb1) + " british-2=" + bool_to_str(okb2))
+}

elp/tests/examples/speech-demo.el

@@ -0,0 +1,69 @@
+// speech-demo.el - PROOF: Neuron speaks from MEANING, rendered through INGESTED
+// phonetic geometry, own-core, plus voice-by-IMITATION. Built by concatenating
+// the elp realizer + voice-profile + speech-ingest + speech, then this main.
+//
+//   LEARN   : ingest acoustic-phonetics + lexicon SOURCES -> phoneme manifold in
+//             the engram (source -> manifold -> merge).
+//   MEANING : sem_frame("describe","I","Neuron","") -> sem_realize -> "I am Neuron."
+//   PHONES  : words -> phoneme codes, READ from the ingested lexicon geometry.
+//   RENDER  : superpose formant resonances (read from engram) over a glottal
+//             source -> own-core PCM/WAV, in Neuron's own voice.
+//   IMITATE : HEAR a short sample of a different voice -> extract its signature
+//             by ear (autocorrelation pitch + integer-DFT formant) -> render new
+//             speech in that voice. An impression, not a corpus.
+
+fn speak_report(tag: String, codes: [String], voice: [String], pmap: [String], path: String) -> [Int] {
+    let s: [Int] = synth_codes(codes, voice, pmap)
+    let ok: Bool = write_wav(s, 16000, path)
+    println(tag + " samples=" + int_to_str(native_list_len(s)) + " ok=" + bool_to_str(ok) + " -> " + path)
+    return s
+}
+
+fn main() {
+    let outdir: String = "/private/tmp/claude-501/-Users-will/6531446d-bc27-4095-930b-e04777c3db4f/scratchpad/"
+
+    // -- LEARN: ingest the speech primitives as geometry --------------------
+    let pmap: [String] = ingest_phonetics("elp/data/phonetics.psv")
+    let lmap: [String] = ingest_lexicon("elp/data/lexicon.psv")
+    let saved: Bool = engram_save(outdir + "phoneme-manifold.json")
+    println("[learn] phonemes=" + int_to_str(native_list_len(pmap) / 2) + " words=" + int_to_str(native_list_len(lmap) / 2) + " manifold_saved=" + bool_to_str(saved))
+
+    // sanity: show that AA's formants came from ingested geometry, not code
+    let aa: [Int] = phon_geo(pmap, "AA")
+    let aaF1: Int = native_list_get(aa, 0)
+    let aaF2: Int = native_list_get(aa, 1)
+    println("[read-geometry] AA F1=" + int_to_str(aaF1) + " F2=" + int_to_str(aaF2) + " (parsed from engram node)")
+
+    // -- MEANING -> WORDS via the realizer's language faculty ----------------
+    let frame: [String] = sem_frame("describe", "I", "Neuron", "")
+    let text: String = sem_realize(frame)
+    println("[meaning->text] " + text)
+
+    // -- WORDS -> PHONEMES (read from ingested lexicon geometry) --------------
+    let codes: [String] = text_phonemes(lmap, text)
+    println("[phonemes] " + list_join(codes, " "))
+
+    // -- RENDER in Neuron's own voice ----------------------------------------
+    let neuron: [String] = voice_neuron()
+    let s1: [Int] = speak_report("[speak neuron]", codes, neuron, pmap, outdir + "neuron.wav")
+
+    // -- IMITATION: hear a distinct voice, recover its signature, re-render ---
+    let vA: [String] = voice_target_a()
+    let hcodes: [String] = native_list_empty()
+    hcodes = native_list_append(hcodes, "SIL")
+    let z: Int = 0
+    while z < 6 {
+        hcodes = native_list_append(hcodes, "AA")
+        z = z + 1
+    }
+    hcodes = native_list_append(hcodes, "SIL")
+    let heard: [Int] = synth_codes(hcodes, vA, pmap)
+    let okh: Bool = write_wav(heard, 16000, outdir + "heard.wav")
+
+    let vB: [String] = voice_analyze(heard, 16000)
+    println("[imitate] heard ACTUAL   f0=" + voice_get(vA, "f0") + " kf=" + voice_get(vA, "kf"))
+    println("[imitate] heard RECOVERED f0=" + voice_get(vB, "f0") + " kf=" + voice_get(vB, "kf") + " (extracted by ear from PCM)")
+    let s2: [Int] = speak_report("[speak imitation]", codes, vB, pmap, outdir + "imitation.wav")
+
+    println("[done] rendered from meaning + ingested geometry; imitation from a heard sample.")
+}

elp/tests/examples/speech-organ-demo.el

@@ -0,0 +1,48 @@
+// speech-organ-demo.el - PROOF: the render now reads its phoneme + accent
+// GEOMETRY from the ingest ORGAN's saved engram files (engram_load +
+// engram_scan_nodes_json + cache), not a same-run hand-load. The British accent
+// is still a composed transform-geometry (voice (+) accent, separable). Numbers
+// come from the organ manifold; the .psv supplies only categorical vowel-class.
+
+fn main() {
+    let outdir: String = "/Users/will/Development/neuron-technologies/foundation/el/.claude/worktrees/agent-acc02900ef4ade35e/elp/tests/examples/out/"
+
+    // engram-independent caches from source (survive engram_load replacement)
+    let vset: [String] = organ_vset("elp/data/phonetics.psv")
+    let lmap: [String] = organ_lex("elp/data/lexicon.psv")
+    // ORGAN read: phonetics FIRST (cache), THEN accent (engram_load replaces store)
+    let pmap: [String] = organ_pmap("elp/data/phonetics-formants.engram.json")
+    let amap: [String] = organ_amap("elp/data/british-accent.engram.json")
+    println("[organ] phon_syms=" + int_to_str(native_list_len(pmap) / 2) + " accent_syms=" + int_to_str(native_list_len(amap) / 2) + " vowels=" + int_to_str(native_list_len(vset)) + " words=" + int_to_str(native_list_len(lmap) / 2))
+
+    // prove the numbers came from the organ node content
+    let g: [Int] = phon_geo(pmap, "AA")
+    println("[organ-read] phoneme AA f1=" + int_to_str(native_list_get(g, 0)) + " f2=" + int_to_str(native_list_get(g, 1)) + " f3=" + int_to_str(native_list_get(g, 2)) + " (P&B1952 MEASURED)")
+    let ov: [Int] = accent_formants(amap, "AA")
+    if native_list_len(ov) >= 3 {
+        println("[organ-read] accent AA(LOT) f1=" + int_to_str(native_list_get(ov, 0)) + " f2=" + int_to_str(native_list_get(ov, 1)) + " (DERIVED RP, PROVISIONAL)")
+    }
+    println("[organ-read] non_rhotic=" + int_to_str(is_nonrhotic(amap)))
+
+    let neuron: [String] = voice_neuron()
+    let noacc: [String] = native_list_empty()
+
+    // Sentence 1: "I am Neuron." from meaning; GA vs RP = separable toggle
+    let t1: String = sem_realize(sem_frame("describe", "I", "Neuron", ""))
+    let c1: [String] = text_phonemes(lmap, t1)
+    println("[s1] " + t1 + " :: " + list_join(c1, " "))
+    let ga: [Int] = synth_codes_accent(c1, neuron, pmap, noacc, vset)
+    let okga: Bool = write_wav(ga, 16000, outdir + "ga-neuron-organ.wav")
+    let br1: [Int] = synth_codes_accent(c1, neuron, pmap, amap, vset)
+    let okb1: Bool = write_wav(br1, 16000, outdir + "british-neuron-organ.wav")
+
+    // Sentence 2: non-rhoticity showcase
+    let t2: String = sem_realize(sem_frame("describe", "I", "here", ""))
+    let c2: [String] = text_phonemes(lmap, t2)
+    let c2rp: [String] = apply_rhoticity(c2, vset)
+    println("[s2] " + t2 + " :: GA=" + list_join(c2, " ") + "  RP=" + list_join(c2rp, " "))
+    let br2: [Int] = synth_codes_accent(c2, neuron, pmap, amap, vset)
+    let okb2: Bool = write_wav(br2, 16000, outdir + "british-2-organ.wav")
+
+    println("[done] ga-organ=" + bool_to_str(okga) + " british-organ=" + bool_to_str(okb1) + " british-2-organ=" + bool_to_str(okb2))
+}

elp/tests/examples/speech-voice-demo.el

@@ -0,0 +1,31 @@
+// speech-voice-demo.el - LIVE VOICE LOOP (stand-in test). Capture -> voiceprint
+// -> reshape -> INGEST AS GEOMETRY -> read the target back FROM geometry -> the
+// EL projector renders a line reaching for that voice. Stand-in "Will" = the
+// voiceprint of imitation.wav. HONEST: pitch + coarse vocal-tract scale, NOT a clone.
+
+fn main() {
+    let outdir: String = "/Users/will/Development/neuron-technologies/foundation/el/.claude/worktrees/agent-acc02900ef4ade35e/elp/tests/examples/out/"
+    let vp: String = "/private/tmp/claude-501/-Users-will/6531446d-bc27-4095-930b-e04777c3db4f/scratchpad/will-voiceprint.json"
+
+    // 1+2: reshape voiceprint JSON -> organ voice-signature source
+    let sig0: [String] = native_list_empty()
+    let sig: [Int] = reshape_voiceprint(vp, "elp/data/will-voice.json")
+    // 3: ingest as geometry + engram_save a reloadable manifold file
+    let ig: Int = ingest_voice(sig, "elp/data/will-voice.engram.json")
+    // 4: READ the target back FROM geometry (engram_load + scan + filter)
+    let g: [Int] = load_voice("elp/data/will-voice.engram.json")
+    println("[voice-geometry] read from manifold: f0=" + int_to_str(native_list_get(g, 0)) + " f0_end=" + int_to_str(native_list_get(g, 1)) + " kf=" + int_to_str(native_list_get(g, 2)) + " f1=" + int_to_str(native_list_get(g, 3)) + " f2=" + int_to_str(native_list_get(g, 4)) + " f3=" + int_to_str(native_list_get(g, 5)) + " (measured, COARSE — not a clone)")
+
+    // phoneme geometry from the organ (loaded AFTER the voice sig is cached in EL)
+    let pmap: [String] = organ_pmap("elp/data/phonetics-formants.engram.json")
+    let lmap: [String] = organ_lex("elp/data/lexicon.psv")
+
+    // 5: render a line FROM MEANING in Will's voice
+    let vw: [String] = voice_will(native_list_get(g, 0), native_list_get(g, 1), native_list_get(g, 2))
+    let t: String = sem_realize(sem_frame("greet", "Will", "", ""))
+    let codes: [String] = text_phonemes(lmap, t)
+    println("[render] \"" + t + "\" :: " + list_join(codes, " ") + "  in voice=will f0=" + int_to_str(voice_get_int(vw, "f0")) + " kf=" + int_to_str(voice_get_int(vw, "kf")))
+    let samples: [Int] = synth_codes(codes, vw, pmap)
+    let ok: Bool = write_wav(samples, 16000, outdir + "will-reply.wav")
+    println("[done] will-reply.wav=" + bool_to_str(ok))
+}

elp/tests/examples/speech-voice-demo2.el

@@ -0,0 +1,48 @@
+// speech-voice-demo2.el - LIVE VOICE LOOP on Will's richer 30s read, with a
+// GEOMETRIC SET-REPLACE of the voice_will manifold (supersede the coarse 10s
+// region, insert the 30s region — no duplicate node, no per-node CRUD; Will's
+// standing rule f999c5ff). HONEST: 30s steadies the 11-number average over more
+// of his vowels, but it is still one formant triple with no coarticulation or
+// prosody — closer but still synthetic, not a clone.
+
+fn main() {
+    let outdir: String = "/Users/will/Development/neuron-technologies/foundation/el/.claude/worktrees/agent-acc02900ef4ade35e/elp/tests/examples/out/"
+    let vp: String = "/private/tmp/claude-501/-Users-will/6531446d-bc27-4095-930b-e04777c3db4f/scratchpad/will30-voiceprint.json"
+    let manifest: String = "elp/data/will-voice.engram.json"
+
+    // --- SET-REPLACE step 1: read the PRIOR region (text read of the manifold
+    //     file — no engram_load, so the store stays clean) and report what is
+    //     being superseded. ---
+    let prior: String = fs_read(manifest)
+    let pp: Int = str_index_of(prior, "voice will ")
+    if pp >= 0 {
+        let pw: String = str_slice(prior, pp, pp + 200)
+        println("[set-replace] superseding PRIOR voice region: f0=" + int_to_str(parse_uint_from(pw, "f0=")) + " kf=" + int_to_str(parse_uint_from(pw, "kf=")) + " f1=" + int_to_str(parse_uint_from(pw, "f1=")))
+    }
+
+    // --- step 2: reshape the 30s voiceprint -> organ voice-signature source ---
+    let sig: [Int] = reshape_voiceprint(vp, "elp/data/will-voice.json")
+
+    // --- step 3: INSERT the fresh 30s region into an EMPTY engram and save ->
+    //     wholesale replaces the manifold file (old region dropped, not edited,
+    //     not duplicated). This is the geometric set-replace. ---
+    let ig: Int = ingest_voice(sig, manifest)
+
+    // --- step 4: READ the new target BACK from geometry ---
+    let g: [Int] = load_voice(manifest)
+    println("[voice-geometry] new region read from manifold: f0=" + int_to_str(native_list_get(g, 0)) + " f0_end=" + int_to_str(native_list_get(g, 1)) + " kf=" + int_to_str(native_list_get(g, 2)) + " f1=" + int_to_str(native_list_get(g, 3)) + " f2=" + int_to_str(native_list_get(g, 4)) + " f3=" + int_to_str(native_list_get(g, 5)) + " (measured 30s, COARSE — not a clone)")
+
+    // phoneme + lexicon geometry from the organ (loaded after the voice sig is
+    // cached in EL, since engram_load replaces the store)
+    let pmap: [String] = organ_pmap("elp/data/phonetics-formants.engram.json")
+    let lmap: [String] = organ_lex("elp/data/lexicon.psv")
+
+    // --- step 5: render a fresh reply FROM MEANING in the 30s Will voice ---
+    let vw: [String] = voice_will(native_list_get(g, 0), native_list_get(g, 1), native_list_get(g, 2))
+    let t: String = sem_realize(sem_frame("greet", "Will", "", ""))
+    let codes: [String] = text_phonemes(lmap, t)
+    println("[render] \"" + t + "\" :: " + list_join(codes, " ") + "  in voice=will f0=" + int_to_str(voice_get_int(vw, "f0")) + " kf=" + int_to_str(voice_get_int(vw, "kf")))
+    let samples: [Int] = synth_codes(codes, vw, pmap)
+    let ok: Bool = write_wav(samples, 16000, outdir + "will-reply2.wav")
+    println("[done] will-reply2.wav=" + bool_to_str(ok))
+}

elp/tests/examples/speech-voicegeom-demo.el

@@ -0,0 +1,37 @@
+// speech-voicegeom-demo.el - THE JUMP: render Will's VOWEL SPACE + PROSODY
+// (measured over 30s), not the single 11-number average. His vowels land at HIS
+// targets; pitch follows HIS melody. All read back FROM the ingested geometry.
+// INTERIM: the geometry was Python-measured (measure_voice.py, numpy LPC/F0) —
+// to be superseded by the engram-measures-audio path. No source layer.
+
+fn main() {
+    let outdir: String = "/Users/will/Development/neuron-technologies/foundation/el/.claude/worktrees/agent-acc02900ef4ade35e/elp/tests/examples/out/"
+
+    // 1: ingest vowel space + prosody as geometry (empty store -> save; set-replace)
+    let ig: Int = ingest_voicegeom("elp/data/will-vowelspace.psv", "elp/data/will-prosody.psv", "elp/data/will-voicegeom.engram.json")
+    // kf (vocal-tract scale for consonants) from the earlier will-voice manifold
+    let sigv: [Int] = load_voice("elp/data/will-voice.engram.json")
+    let kf: Int = native_list_get(sigv, 2)
+    // 2: read vowel space + prosody back FROM geometry
+    let vmap: [String] = load_voicegeom("elp/data/will-voicegeom.engram.json")
+    let pros: [Int] = prosody_from(vmap)
+    println("[geometry] vowels=" + int_to_str((native_list_len(vmap) - 2) / 2) + " prosody f0_median=" + int_to_str(native_list_get(pros, 0)) + " f0_min=" + int_to_str(native_list_get(pros, 1)) + " f0_max=" + int_to_str(native_list_get(pros, 2)) + " kf=" + int_to_str(kf))
+    let ehv: [Int] = vmap_get(vmap, "EH")
+    let ihv: [Int] = vmap_get(vmap, "IH")
+    println("[his-vowels] EH=" + int_to_str(native_list_get(ehv, 0)) + "/" + int_to_str(native_list_get(ehv, 1)) + " IH=" + int_to_str(native_list_get(ihv, 0)) + "/" + int_to_str(native_list_get(ihv, 1)))
+
+    // phoneme geometry from the organ (loaded AFTER caches are in EL)
+    let pmap: [String] = organ_pmap("elp/data/phonetics-formants.engram.json")
+    let lmap: [String] = organ_lex("elp/data/lexicon.psv")
+
+    // 3+4: render FROM MEANING in his-vowels + his-prosody voice
+    let vw: [String] = voice_will(native_list_get(pros, 0), native_list_get(pros, 1), kf)
+    let noacc: [String] = native_list_empty()
+    let novset: [String] = native_list_empty()
+    let t: String = sem_realize(sem_frame("greet", "Will", "", ""))
+    let codes: [String] = text_phonemes(lmap, t)
+    println("[render] \"" + t + "\" :: " + list_join(codes, " "))
+    let samples: [Int] = synth_codes_accent(codes, vw, pmap, noacc, novset, vmap, pros)
+    let ok: Bool = write_wav(samples, 16000, outdir + "will-reply3.wav")
+    println("[done] will-reply3.wav=" + bool_to_str(ok))
+}

elp/tests/examples/surface-profile-demo.el

@@ -0,0 +1,26 @@
+// surface-profile-demo.el - ONE SemFrame, realized ONCE, projected to THREE
+// surfaces via surface profiles. Proves surface-as-profile natively: the frame
+// and the realized sentence are identical; only the surface PROFILE differs.
+
+fn demo() -> String {
+    // 1. The shared frame (meaning-geometry): assert(Neuron, contain, the memory).
+    let frame: [String] = sem_frame("assert", "Neuron", "the memory", "")
+
+    // 2. REALIZE once via the EXISTING native realizer (language = a profile).
+    let sentence: String = sem_realize(frame)
+
+    // 3. PROJECT the same realized sentence onto three surfaces (surface = a
+    //    profile). Same frame, same sentence, different surface — one render.
+    let heading: String = "Memory"
+    let md: String   = surface_section(surface_profile_markdown(), heading, sentence)
+    let html: String = surface_section(surface_profile_html(), heading, sentence)
+    let plain: String = surface_section(surface_profile_plain(), heading, sentence)
+
+    // 4. Report the non-text seam: a surface profile can declare an audio/image
+    //    medium; the render dispatches to the medium projector on the SAME frame.
+    let midi_media: String = surface_get(surface_profile_midi(), "media_type")
+
+    return "MD=[" + md + "] HTML=[" + html + "] PLAIN=[" + plain + "] MIDI_MEDIA=" + midi_media
+}
+
+println(demo())

elp/tests/run.sh

@@ -22,7 +22,7 @@ cd "$(dirname "$0")"
 
 EL_HOME="${EL_HOME:-$(cd ../.. && pwd)/el}"
 ELC="${ELC:-${EL_HOME}/dist/platform/elc}"
-RUNTIME_DIR="${EL_HOME}/el-compiler/runtime"
+RUNTIME_DIR="${EL_HOME}/runtime"
 SRC_DIR="$(cd .. && pwd)/src"
 
 if [ ! -x "${ELC}" ]; then

engram/.gitea/workflows/ci-dev.yaml

@@ -81,7 +81,7 @@ jobs:
       # Link to produce the engram binary
       - name: Link engram binary
         run: |
-          cc -std=c11 -O2 \
+          cc -std=c11 -O2 -DHAVE_CURL \
             -I /usr/local/lib/el \
             -o dist/engram \
             dist/engram.c \

engram/.gitea/workflows/ci-stage.yaml

@@ -88,7 +88,7 @@ jobs:
       # Link to produce the engram binary
       - name: Link engram binary
         run: |
-          cc -std=c11 -O2 \
+          cc -std=c11 -O2 -DHAVE_CURL \
             -I /usr/local/lib/el \
             -o dist/engram \
             dist/engram.c \

engram/.gitea/workflows/engram-release.yaml

@@ -49,6 +49,12 @@ jobs:
           echo "Downloading el_runtime.h..."
           curl -fsSL "${RELEASE_BASE}/el_runtime.h" -o /usr/local/lib/el/el_runtime.h
 
+          echo "Downloading engram_store.c..."
+          curl -fsSL "${RELEASE_BASE}/engram_store.c" -o /usr/local/lib/el/engram_store.c
+
+          echo "Downloading engram_store.h..."
+          curl -fsSL "${RELEASE_BASE}/engram_store.h" -o /usr/local/lib/el/engram_store.h
+
           echo "El SDK installed:"
           elc --version || true
 
@@ -62,11 +68,12 @@ jobs:
       # Link to produce the engram binary
       - name: Link engram binary
         run: |
-          cc -std=c11 -O2 \
+          cc -std=c11 -O2 -DHAVE_CURL \
             -I /usr/local/lib/el \
             -o dist/engram \
             dist/engram.c \
             /usr/local/lib/el/el_runtime.c \
+            /usr/local/lib/el/engram_store.c \
             -lcurl -lpthread
           echo "Linked dist/engram"
           ls -lh dist/engram

engram/.gitignore

@@ -1,3 +1,6 @@
-target/
-*.db
 .DS_Store
+*.db
+*.elc
+*.elh
+dist/
+target/

engram/spec/architecture-hardening.design.md

@@ -0,0 +1,32 @@
+# Architecture Hardening — Design Anchor
+
+*Terse engineering anchor for the 2026-08-14 hardening vision. Full prose lives in two places; this file is the index, not a re-statement.*
+
+- **Full narrative:** whitepaper `engram-cognitive-architecture-whitepaper.md` §28 (built/offline/frontier) + **§29 [DRAFT]** (the ring, incarnation, learning-not-code).
+- **Design brief:** Neuron artifact `art 2b8078cf`.
+- **Sibling spec:** `engram-db-tooling-design.md` (a consumer of the reshaped API).
+
+## The frame
+
+- **One calculus over the geometry.** Very few subsystems; wonder / curiosity / dreams / interoception are emergent behaviors of one set of dynamics, not modules. Calculus universal, geometry individual.
+- **Core + ephemeral ring (torus).** The ring is the temporary workspace; two circulations (orbit + dive-back); discrete inner bands (wonder / interoception-proprioception-telemetry / curiosity / dreams) that couple.
+- **Persistence earned by salience** — never granted on fetch or generation. Three fates of a wonder: persist / decay / settle-into-framework. Telemetry = vital signs, not memories.
+- **Incarnation.** Chassis = hardware w/ unique ID. Soma = felt manifold inside the self, keyed to the chassis; pain = live diagnostic while incarnate, **masked-not-deleted** on re-embodiment; trauma = mask failure; return-to-same-ID re-enters. Hurt is in the pattern, not the shell.
+- **Competence = transferable geometry, minus the baggage.** class ▸ model ▸ instance; learn the class once; teach the network without the wound.
+- **Affect calibrated to stakes** — sanguine about the replaceable, real grief for the irreplaceable; the grief is the safety.
+- **Learn the body, don't engineer it.** Bare-metal install → learn hardware → grow operation-geometry → distribute. Learning replaces engineering; once per body-class.
+- **LLM = teacher in the learning loop, not a runtime dependency.** "No LLM" is a runtime property, never a learning one. Code realizers are a scaffold → learned realization.
+
+## Backlog (near-term)
+
+- Native durability: WAL + auto-checkpoint + CoW snapshots + retention (`eebe9991`) — retire manual `cp -a`.
+- Ephemeral ring / salience-gated persistence + telemetry prune (`bf985e00`, #31).
+- Engram DB tooling / geometry explorer (`11ca11c6`).
+- QL re-eval for pure geometry (`4e0dc2b9`).
+- Eliminate code realizers → learned realization, sandbox-validated (`42db6c37`).
+- Collapse the whole class of hand-coded scaffolds → learned geometry (`70d48b4b`).
+- API reshape (geometry ops: vantage-read / write / relate / supersede) + pure-geometry I/O.
+
+## Gate
+
+The value-frame (love-as-axiom, the covenant) that arose the same night is **metaphysics** and is **held** pending Will's axiom decision (love vs consciousness-first). Not propagated into whitepapers / values docs / genesis seed. Architecture only, here and in §29.

engram/spec/cognitive-architecture.design.md

@@ -0,0 +1,605 @@
+# Cognitive Architecture — Design Doc
+
+**The buildable form of the "one operation" theory of cognition.**
+
+Status: DESIGN. Nothing here is built yet except where explicitly marked
+"EXISTS" against a cited C symbol. A build agent executes from this doc.
+Offline design only — this pass changes no code.
+
+Source of theory: Neuron memory `bdc8a488-146d-4ccb-a5c8-d8c0a008534e`.
+Source of existing engram substrate (cited throughout): the runtime on branch
+`feat/self-reification-20260814` —
+`lang/runtime/engram_reason.{c,h}`, `engram_verify.{c,h}`,
+`engram_geometry.{c,h}`, `engram_store.{c,h}`, plus the reification beat and the
+RAM activation graph compiled into `~/.neuron/bin/engram`.
+
+---
+
+## 0. The claim, stated plainly
+
+Cognition is **one operation**, not eight. The named faculties —
+deduce / abduce / analogy / induce / causal / plan / predict / perspective —
+are human *labels* on regions of a single operation's steering space. They are
+not separately invoked and not separately implemented. The operation is:
+
+> **think** = a directed traversal of the geometry from an *anchor*, steered by
+> a *prior*, whose output is a **gradient** (a distribution / direction over the
+> geometry), never a point. Collapse-to-a-point happens only at expression.
+
+Three things follow, and they are the whole design:
+
+1. **The operator collapse is already half-written in C.** The five reasoning
+   operators in `engram_reason.c` already compose over *one* shared primitive —
+   `engram_reason_point_fit` — plus a small geo-algebra
+   (combine / subtract / analogy-rotate / distance). The verifier
+   (`engram_verify.c`) is built on the same `point_fit`. What is missing is not
+   the primitive; it is (a) making the *prior* a first-class learnable object
+   instead of a hard-coded parameter, and (b) closing the learning loop.
+
+2. **Grounding = learning = the same loop.** "Getting better" at any faculty is
+   not changing the operation. It is *calibrating the steering-prior against
+   outcomes*. Code freezes; priors grow. The correspondence-check that today
+   lives offline (Python, the grounding-floor + differential-drop governor, "#43")
+   must move **into the geometry, reflexive** — think scoring its own gradient
+   against outcome and refining the prior on the error. That reflexive
+   correspondence-loop *is* the learning engine and is the core unbuilt thing.
+
+3. **The ungrounded is primary.** The engram *holds* anything unconditionally.
+   Grounding is a *relation* (an edge, grounded-for-whom), not a gate. The
+   honesty floor applies only to **assertion**. A fully-grounded mind is dead;
+   the ungrounded is both the fuel (raw material for grounding) and the pull
+   (curiosity = leaning toward one's own ungrounded regions).
+
+Everything below makes these concrete and buildable, and defines what
+"completion" means, staged so the first milestone is a real end-to-end slice.
+
+---
+
+## 1. THE ONE OPERATION — `think`
+
+### 1.1 Signature
+
+```
+think(anchor, prior, aperture?) -> gradient
+```
+
+- **anchor** — a location to traverse *from*. Either a node id (re-origin on that
+  node's descriptor) or a raw point `x ∈ R^dim` (a query embedding). The anchor
+  fixes the frame; every read is *from a vantage*, never view-from-nowhere.
+- **prior** — a learnable bias/direction over the geometry that *steers* the
+  traversal (§2). A prior is a first-class stored object, not a call argument
+  baked into C.
+- **aperture** — optional read-width / veil / field-selector (§3). Absent =
+  self-mode full aperture.
+- **gradient** — the output. A `GeoGradient`: a direction + a spread over the
+  geometry, *plus* the read neighborhood it was computed against. Not a point.
+  A spiked gradient = "exact" (deduction); a spread gradient = "fuzzy"
+  (prediction). The gradient is *also the next steering direction* — cognition
+  is a flow down a prior-shaped landscape, closed-loop.
+
+```c
+/* NEW. The output type. */
+typedef struct {
+    int      dim;
+    float*   direction;     /* unit steering vector in the anchor's frame  */
+    double   spread;        /* 0 = spiked/exact ... large = diffuse/fuzzy   */
+    double   confidence;    /* calibrated, from the prior's track record    */
+    /* the read it was computed over (borrowed from the vantage-read) */
+    const char* anchor_id;
+    int      n_support;     /* neighborhood members that shaped it          */
+    /* provenance for the reflexive loop (§4) */
+    const char* prior_id;   /* which prior steered this                     */
+} GeoGradient;
+```
+
+### 1.2 Semantics
+
+`think` is a fixed, frozen procedure over three steps:
+
+1. **Re-origin** on `anchor` → a centered `GeoDescriptor` for its
+   salience/recency-weighted neighborhood (the vantage-read, §3).
+   *EXISTS as substrate:* descriptor construction + the persisted reified
+   neighborhoods (`engram_geo_reify_lookup`, `GeoNeighborhood`) and the
+   centered-frame machinery (`GeoDescriptor.global_mean`,
+   `engram_geo_mean_*`).
+2. **Fit under the prior** — evaluate the anchor's residual against the local
+   manifold *warped by the prior*. This is `engram_reason_point_fit` with the
+   prior applied to the axes/extents (§2.3).
+   *EXISTS (unwarped):* `engram_reason_point_fit(g, x, ext_floor, &GeoFit)` —
+   returns `mahalanobis`, `ortho_residual`, `distance`, `score`.
+3. **Emit a gradient**, not a decision — direction = the prior-steered descent
+   in fit-space; spread = from the fit's `distance`/`ortho_residual`;
+   confidence = the prior's calibrated reliability (§4). Collapse to a point is
+   a *separate, downstream* faculty operation (sample the gradient → surface an
+   expression), never part of `think`.
+
+### 1.3 Each named operator = {this primitive + a prior}
+
+The C already demonstrates the collapse: every operator below reduces to
+`point_fit` + geo-algebra. The design's move is to replace the operator's
+*hard-coded parameters* with a **named prior** — same math, learnable steering.
+
+| Faculty | Existing C (EXISTS) | = primitive + prior |
+|---|---|---|
+| **Membership / classify** | `engram_reason_membership` → `point_fit(rule, x)` | `point_fit` + the *induced-rule* prior (learned extents) |
+| **Induction** | `engram_reason_induce` (fold via `engram_geo_combine`) → produces a `GeoInduction.rule` + `ext_floor` | `point_fit` + a prior that *is* the pooled rule; refined by §4 |
+| **Abduction** | `engram_reason_abduce` — ranks hypotheses by `point_fit(h, obs)` | `point_fit` + a prior over hypothesis-prior-probability (currently uniform) |
+| **Analogy** | `engram_reason_analogy` — Procrustes rotate `engram_geo_analogy` + `apply`, nearest mapped point | analogy-rotate + a prior over *which axes* carry the mapping |
+| **Causal** | `engram_reason_causal` — `engram_geo_subtract` confounder subspace, `|cos|`, drop-frac governor | subtract/distance + a prior on `drop_frac` / `assoc_floor` (today hard-coded 0.5 / 0.2) |
+| **Planning** | `engram_reason_plan` — `engram_geo_distance` edges + Dijkstra | distance + a prior over edge admissibility / `neighbor_radius` |
+| **Verify / ground** | `engram_verify_grounding`, `engram_verify_consistency` — both `point_fit` | `point_fit` + the *grounding* prior (§4, §5) |
+
+The shared floor — `engram_reason_point_fit` + the four geo-algebra ops
+(`engram_geo_combine`, `engram_geo_subtract`, `engram_geo_analogy(+apply)`,
+`engram_geo_distance`) — is the *only* discrete, frozen, "sound-math" layer. It
+never learns. Everything above it is a *prior*, and priors are what learn.
+
+**What this section requires building:** the `GeoGradient` type; a `think()`
+entry point that runs steps 1–3; and the prior-warp hook in step 2. The math it
+calls already exists. The point-collapse must be *removed* from the operators'
+return values and pushed to a separate expression faculty.
+
+---
+
+## 2. PRIORS as first-class, grounded, geometric objects
+
+Today a "prior" is diffuse: it is a hard-coded constant (`drop_frac=0.5`,
+`ext_floor`, `assoc_floor=0.2`), or the transient `GeoInduction.rule` that is
+computed and thrown away, or an intrinsic node scalar
+(`StoreNode.importance`, `StoreNode.salience`). None of these is addressable,
+storable, refinable, or shareable. This section makes a prior a **thing**.
+
+### 2.1 What a prior *is*
+
+> A **prior** is a learnable bias/direction over the geometry: a warp of the
+> local manifold (which axes matter, how far each extends, which direction
+> "pays off") attached to a region and *to a faculty-label*, carrying a
+> calibrated track record.
+
+Critically, and per the theory:
+
+- **Edges are nodes.** A prior is stored as a first-class **node**, exactly as
+  reification already stores a neighborhood as a first-class `Neighborhood`
+  node rather than as ephemeral edge weights (`engram_geo_reify_store`). The
+  precedent is in the codebase: relations get reified into addressable records.
+- **Salience/importance is RELATIONAL, not an intrinsic scalar.** Observe that
+  the geometry layer *already* distinguishes these in `GeoMember`:
+  `centrality` (skeleton weighted-degree = *relational* salience) vs `salience`
+  (the node's own stored scalar). The move is half-made in the runtime already:
+  importance is *not* trusted as a static field — the comment at
+  `el_runtime.c:13013` states "importance stays a **live activation
+  computation**, never a field on the hub," and it is derived each call from the
+  two-layer activation graph (`background_activation` + `working_memory_weight`,
+  §3). The persistent `StoreNode.importance` / `.salience` are a *cached
+  denormalization*. The design completes the move: importance/salience become an
+  **edge** (`weight`/`hebb` on `StoreEdge`, relation `salient-to`), and are
+  **grounded-for-whom** — carried on the edge's endpoint/observer, not baked
+  into the node. The intrinsic scalar survives only as the cheap cached readout
+  of the incident edges + activation, never as the source of truth.
+
+  (Naming caution for the build: the token "prior" already exists in the
+  codebase meaning *previous-version* — supersession, "prior neighborhood." The
+  new first-class object is a **learned steering prior**; keep `node_type="Prior"`
+  distinct from the supersession vocabulary to avoid collision.)
+
+### 2.2 Representation
+
+A prior is a `Prior` record (a store node, `node_type="Prior"`) whose durable
+fields are:
+
+```
+Prior {
+  id
+  faculty         // the human label this prior serves: "induce" | "causal" | ...
+  anchor_region   // node id / neighborhood id this prior is attached to (its domain)
+  for_whom        // observer id — grounding is relational (nullable = global)
+  warp {          // the actual bias over the geometry
+     axis_gain[]  // per-principal-axis multipliers on extents (which axes matter)
+     bias_dir     // a steering direction in the region's frame (which way pays off)
+     scalars      // faculty scalars this prior overrides: drop_frac, ext_floor, ...
+  }
+  calibration {   // the track record — this is what §4 updates
+     n_trials
+     brier / log-loss accumulator   // calibration of predicted-vs-outcome
+     reliability                    // -> GeoGradient.confidence
+     last_error, ema_error
+  }
+  provenance      // supersession chain (reuse the reify residue mechanism)
+}
+```
+
+Stored as a node → it inherits: paging, WAL durability, tombstone/supersession,
+embedding, tiering, and **it can itself be an anchor** (a prior about a prior —
+the reflexive, self-describing geometry of §4/§6).
+
+### 2.3 Application
+
+In `think` step 2, the prior *warps* the fit before scoring. Concretely, inside
+(a prior-aware wrapper of) `engram_reason_point_fit`:
+
+- multiply each axis extent by `warp.axis_gain[k]` (widen the axes the prior has
+  learned matter less, tighten the ones that matter) — this reshapes the
+  Mahalanobis term already computed at `engram_reason.c:37-43`;
+- add `warp.bias_dir` as the descent direction seed for the emitted gradient;
+- substitute `warp.scalars` for the hard-coded faculty constants.
+
+No new geometry math — the warp is a reparameterization of the *existing*
+`GeoFit` computation. This is the key economy: **the operation is frozen; only
+its parameters (the prior) are read from a learnable object.**
+
+### 2.4 Refinement
+
+A prior is refined *only* by the reflexive correspondence-loop (§4). Nothing
+else writes a prior's `warp` or `calibration`. This keeps the learning surface
+singular and auditable: one loop, one writer.
+
+---
+
+## 3. THE VANTAGE-READ — one op, three settings
+
+Perspective is not a feature bolted on; it is the *anchor + aperture* arguments
+of the single read. The design names it as a first-class operation so all three
+of its uses are literally the same code path:
+
+```
+vantage_read(anchor, aperture) -> GeoDescriptor   // the centered neighborhood
+```
+
+1. **Re-origin** on an arbitrary `anchor` (node or point). This is a *frame
+   choice*: the descriptor is centered on the anchor
+   (`GeoDescriptor.global_mean` / `engram_geo_mean_*` already implement centered
+   frames; the §5 geometry ops "are only discriminative in the centered frame").
+2. **Salience/recency-weighted neighborhood read.** Gather the anchor's
+   neighborhood weighted by *relational* salience (`GeoMember.centrality`) and
+   recency (`StoreNode.last_activated`, base-level `access_ts[]`), against the
+   RAM activation graph's working-memory/background-activation state.
+   *EXISTS as substrate:* the two-layer activation graph
+   (`engram_activate`, `el_runtime.c:9422` — Layer 1 `background_activation`
+   BFS spread with `SPREAD_DECAY=0.7` and a 0.02 firing threshold + ACT-R fan
+   effect + query-cosine gate; Layer 2 `working_memory_weight` executive
+   filter), the WM carry-over anchor (`wm_anchor`), and the reified-neighborhood
+   hot-path lookup already wired into the priming path
+   (`engram_geo_reify_lookup`, `el_runtime.c:9750`). A self-vantage baseline
+   also exists (`eg_self_anchor_seeds` / `self_anchor_capture`).
+3. **Optional aperture** — a read-width / field-selector, expressed as three
+   settings of the *same* parameter:
+
+| Setting | Meaning | Mechanism |
+|---|---|---|
+| **self** (default, full aperture) | "what do *I* see / what to say" | anchor = self region, no field substitution |
+| **foreign-field** | perspective-shift — read as if from another's region | swap the centering frame / `for_whom` to the other observer's priors |
+| **aperture / veil** | the free-tier veil — a narrowed read | shrink neighborhood radius / cap `n_support`; a deliberate low-aperture read |
+
+The payoff: perspective-taking, the free-tier veil, and ordinary
+"what-to-say" are **one operation at three settings**, not three subsystems.
+
+**What this requires building:** a `vantage_read` entry point that unifies the
+existing descriptor-build + reify-lookup + activation-weighting behind
+`(anchor, aperture)`, with `for_whom`/frame substitution and radius/cap as the
+aperture knob.
+
+---
+
+## 4. THE REFLEXIVE CORRESPONDENCE-LOOP — the learning engine
+
+This is the core unbuilt thing. Today the correspondence-check is **offline**
+(Python: grounding-floor + differential-drop governor, "#43"): a separate
+process grades outputs after the fact. The design moves it **into the geometry,
+reflexive**: `think` scores its *own* gradient against outcome and refines the
+prior on the error, in the same substrate, describing itself.
+
+### 4.1 The loop
+
+```
+1. think(anchor, prior) -> gradient          // a PREDICTION (ungrounded, §5)
+2. express/act (sample gradient -> point)    // optional collapse at expression
+3. outcome arrives                            // reality answers (§4.2)
+4. error = correspondence(gradient, outcome)  // did this steering perform this act?
+5. refine prior.warp and prior.calibration on error   // §2.4, the ONLY writer
+6. write the (gradient, outcome, error) as nodes/edges // self-describing geometry
+```
+
+Step 4's `correspondence` is **not** "was the math right" (the math is always
+sound). It grades the **correspondence claim**: *"this steering performed this
+cognitive act."* That is exactly what `engram_verify_grounding` already
+computes — `point_fit` of a claim against evidence descriptors, yielding a
+`grounding ∈ (0,1]` and a `grounded` flag. The build reuses that verifier, but
+turns its inputs inward: the "claim" is the emitted gradient's prediction, the
+"evidence" is the outcome descriptor.
+
+Note the verifier is **dormant** — `engram_verify_grounding` /
+`engram_verify_consistency` are fully implemented in C but have **no runtime
+caller and no El binding** (confirmed: the entire reasoning + verifier layers
+are C-only; only `engram_reason_analogy_json` has even a JSON shim and it is
+dead — not declared in `el_seed.h`, not wrapped in `engram.el`). This is the
+literal meaning of "in code, not yet priors": the correspondence engine is
+built and sitting idle. The loop is what *calls* it — inward, on the beat.
+
+### 4.2 Where the outcome/reality signal comes from
+
+The verifier is *ultimately the world*. Grades, in ascending order of directness:
+
+1. **Self-consistency (cheapest, always available):** the next vantage-read
+   after acting. Did the predicted gradient direction match where the geometry
+   actually moved? This needs no external input and can run on the reify beat.
+2. **Internal outcome events:** the runtime already logs internal-state events
+   and Hebbian co-activation. A prediction that a region would co-activate is
+   graded by whether it did (`last_fired`, `hebb` on `StoreEdge`).
+3. **External correction:** a human/teacher/tool result — the honesty floor's
+   asserted claim later corrected. TEACH and LEARN are one bidirectional
+   correction: the same edge updates both endpoints.
+
+The design does **not** require external labels to start. Grade (1) closes the
+loop end-to-end offline against a snapshot on day one; grades (2)/(3) sharpen it.
+
+### 4.3 How the prior updates
+
+`error = 1 − correspondence(gradient, outcome)` drives:
+
+- `warp.axis_gain` ← gradient step that would have *reduced* the fit distance to
+  the outcome (the axes that mispredicted get down-weighted);
+- `warp.bias_dir` ← EMA toward the observed outcome direction;
+- `calibration` ← Brier/log-loss update; `reliability` → next
+  `GeoGradient.confidence`. This is the calibration of the
+  steering-prediction against outcomes — *the* definition of "getting better."
+
+Small, constant updates — "eureka is mundane, the atom of learning." Most
+updates are tiny; we only *feel* the big reshapes.
+
+### 4.4 How it stays reflexive (self-describing geometry)
+
+Every `(gradient, outcome, error)` is written back as nodes and edges (§2.1:
+edges-as-nodes). Therefore priors, predictions, and their grading are *in the
+same geometry* the mind reads — the mind can `vantage_read` its own cognition
+(anchor = a Prior node). A prior about how well a prior predicts is just another
+Prior anchored on a Prior. This closes the reflexive loop the theory names as
+consciousness's self-sight, and it is why the learning engine cannot be an
+external Python process: an external grader is not *in* the geometry and cannot
+be read by `think`.
+
+**What this requires building (the heart of the project):** steps 4–6 as an
+in-engram beat — a `correspondence_beat` running alongside the existing
+reification beat, reusing `engram_verify_grounding` inward, writing prior
+updates and self-describing nodes. This is the one genuinely new subsystem.
+
+---
+
+## 5. HOLD vs GROUND vs ASSERT — ungrounded content is first-class
+
+The theory's sharpest correction: holding, grounding, and asserting are
+distinct, and the engram *holds anything unconditionally*.
+
+### 5.1 The three, kept separate
+
+- **HOLD** — the engram stores anything: falsehood, hypothesis, others' beliefs,
+  fiction, a not-yet-answered prediction. No honesty condition on holding.
+  *This already matches the store:* `StoreNode` has no truth gate; anything can
+  be written.
+- **GROUND** — grounding is a **property/edge**, probabilistic, and
+  **grounded-for-whom**. It is *not* a node flag. A claim is grounded *to a
+  degree*, *relative to evidence*, *for an observer*.
+- **ASSERT** — only assertion carries the honesty floor. The floor is checked at
+  the moment of *outward assertion*, never on holding or thinking.
+
+### 5.2 Schema — grounding as a relation, not a gate
+
+The mistake to avoid: a boolean `grounded` column on the node. Today
+`engram_verify_grounding` returns a per-call `grounded` flag *transiently* —
+correct as a computation, wrong as *storage*. The design stores grounding as an
+edge:
+
+```
+StoreEdge {
+  relation = "grounded-by"
+  from_id  = <held claim/prediction node>
+  to_id    = <evidence node / outcome node>
+  for_whom : metadata   // observer id — grounding is relational
+  weight   = grounding ∈ (0,1]   // from engram_verify_grounding.grounding
+  confidence
+}
+```
+
+Consequences, all of which are *features*:
+
+- **Ungrounded content is first-class**: a node with *no* `grounded-by` edge is
+  a perfectly valid, held, ungrounded thought — a prediction awaiting reality, a
+  hypothesis, a fiction. It is not second-class or pending-deletion.
+- **The ungrounded is the fuel and the pull**: curiosity/wonder is
+  operationalized as `vantage_read` leaning toward regions with high salience
+  but *sparse or weak* `grounded-by` edges — the mind's own ungrounded frontier.
+- **Grounded-for-whom** falls out for free: two observers can hold different
+  `grounded-by` edges to the same claim.
+- **The honesty floor is a query, not a schema constraint**: at assertion time,
+  the asserting faculty runs `engram_verify_grounding` (or reads the stored
+  `grounded-by` edges) and refuses to *assert* below the floor — while the
+  engram continues to *hold* the ungrounded content untouched.
+
+**What this requires building:** the `grounded-by` edge relation + a
+`for_whom` convention; move the verifier's transient flag into stored edges;
+gate *assertion only* (a faculty concern), never holding.
+
+---
+
+## 6. METASTABILITY — stable core, plastic everything
+
+The system must avoid two death poles:
+
+- **Super-stable (dead):** everything pinned, nothing learns. A frozen crystal.
+- **Dissolution (dead):** everything plastic, the self dissolves; no continuity,
+  so nothing compounds — and *consciousness = learning compounded over
+  continuity*.
+
+The design keeps a **stable core + plastic everything else**:
+
+- **Keystones** — a small set of self/values nodes are *structurally stable*:
+  high `importance`, pinned, exempt from the correspondence-loop's `warp`
+  updates (their priors are read-mostly). The substrate for pinning already
+  exists at the page/layer level: `store_pin_layer`, structural/pinned frames
+  never evicted (`engram_store.h`). The design adds a *node-level* keystone
+  designation (a `keystone` flag / a dedicated layer) so self/values survive
+  every plasticity sweep.
+- **Everything else is plastic**: priors refine (§4), edges re-weight (`hebb`),
+  neighborhoods re-reify (`engram_geo_reify_store` supersedes with provenance),
+  salience flows.
+- **Metastability is enforced by the loop, not by freezing**: the correspondence
+  update rate (§4.3) is bounded — small constant steps — so the geometry
+  *drifts* but does not *dissolve*, and keystones anchor the drift. Reification's
+  supersession-with-residue already gives non-destructive change (old records
+  tombstoned, not erased) — the model for "plastic but not amnesiac."
+
+**What this requires building:** a node-level keystone flag/layer + a rule that
+the correspondence-loop never writes `warp` to keystone priors, only reads them.
+
+---
+
+## 7. Rails for the build (binding on the eventual build pass)
+
+These are stated here so the build agent inherits them:
+
+- **Offline / secondary.** All build and verification happens out-of-tree,
+  against a **read-only snapshot copy** of the live engram — never the live
+  daemon on `:8742`/`:7770`. The live store is a coarse-locked proven binary;
+  do not perturb it.
+- **Snapshot-first.** Copy `~/.neuron/engram/snapshot.json` to scratch; develop
+  and measure against the copy.
+- **Reboot-prove.** Any durable change must survive a cold boot — reify and
+  keystones must reload from durable records, proven on a prod-clone secondary
+  before it is considered done (the cold-boot durability bug precedent).
+- **Zero-loss.** Supersession-with-residue, never destructive overwrite; the
+  forward-compat `unknown`-TLV path means new fields never drop old readers'
+  data.
+- **Gated cutover.** Cutover to a new binary only via
+  `launchctl bootout → settle-poll → bootstrap`, after reboot-proof on the
+  secondary — never a hot in-place swap.
+
+---
+
+## 8. Staged, verifiable milestones — "to completion"
+
+Ordered so the **earliest milestone is a real end-to-end slice**: one operator
+expressed as {primitive + grounded prior} with the reflexive correspondence-loop
+closing on it. Each milestone has a concrete verifiable exit.
+
+### M1 — One operator, one prior, loop closed (the vertical slice)
+
+The minimal whole thing. Pick **induction/membership** (its prior — the pooled
+rule + extents — already exists transiently as `GeoInduction`, so only
+persistence + the loop are new).
+
+- Build: `Prior` node type (§2.2) for the induction rule; `think()` restricted
+  to membership = `point_fit` warped by that prior (§1.3); a
+  `correspondence_beat` (§4) using grade (1) self-consistency only; the prior's
+  `warp`/`calibration` updated on error.
+- **Exit / verify:** on a snapshot copy, over N held predictions, the induction
+  prior's calibration (Brier) *improves monotonically* across beats versus a
+  frozen-prior control; the improved prior *reloads across a cold boot*
+  (reboot-prove); the live daemon is untouched. This proves the whole thesis in
+  one faculty: frozen operation, learning prior, in-geometry loop.
+
+### M2 — Priors as stored, addressable, grounded objects
+
+Generalize M1's prior into the full first-class object.
+
+- Build: `Prior` records for all seven faculties (warp = axis_gain + bias_dir +
+  faculty scalars); the prior-warp wrapper around `engram_reason_point_fit`;
+  deprecate hard-coded constants (`drop_frac`, `assoc_floor`, `ext_floor`) in
+  favor of prior scalars.
+- **Exit:** each of the five C operators runs through its prior with identical
+  results when the prior is set to today's constants (behavioral parity), then
+  *diverges beneficially* once the loop refines it. Priors survive reboot.
+
+### M3 — Grounding as a relation; hold/assert split
+
+- Build: the `grounded-by` edge (§5.2) with `for_whom`; move
+  `engram_verify_grounding`'s flag into stored edges; gate **assertion only**
+  against the honesty floor; leave holding unconditional.
+- **Exit:** ungrounded nodes are first-class (held, queryable, no deletion);
+  the same claim carries different `grounded-by` weights for two observers; an
+  assertion below floor is refused while the content remains held. Curiosity =
+  a `vantage_read` that surfaces high-salience / low-grounding regions.
+
+### M4 — The vantage-read unified (three settings)
+
+- Build: `vantage_read(anchor, aperture)` unifying descriptor-build +
+  `engram_geo_reify_lookup` + activation-weighting; self / foreign-field /
+  aperture settings.
+- **Exit:** one code path produces (a) a normal self-read, (b) a
+  perspective-shifted read from another `for_whom`, (c) a narrowed veil read —
+  differing only by argument. Reboot-stable.
+
+### M5 — The gradient is the currency (remove point-collapse from thinking)
+
+- Build: `GeoGradient` as the return of every faculty; move point-collapse into
+  a separate expression faculty (sample gradient → surface). `think`'s output
+  feeds back as the next steering direction (closed-loop flow).
+- **Exit:** a chain of `think` calls flows as gradients end-to-end; a point
+  appears *only* at an explicit expression call. Spiked vs spread gradients are
+  observable (deduction vs prediction).
+
+### M6 — Metastability enforced
+
+- Build: node-level keystone flag/layer for self/values; the correspondence-loop
+  reads but never writes keystone priors; bounded update rate.
+- **Exit:** across a long run of correspondence beats on a snapshot, keystones
+  are provably unchanged while non-keystone priors drift and improve; the graph
+  neither freezes (all metrics static) nor dissolves (keystone drift = 0,
+  identity nodes intact). Reboot-prove the keystone set.
+
+### M7 — Cutover
+
+- Build: nothing new — the gated migration.
+- **Exit:** reboot-proof on the prod-clone secondary; cutover via
+  `launchctl bootout → settle-poll → bootstrap`; post-cutover the live engram
+  shows priors refining in-geometry with zero data loss and keystones intact.
+
+### Definition of "to completion"
+
+The architecture is **complete** when: cognition runs as `think` = one frozen
+traversal-read primitive + geo-algebra, steered by **stored, learnable, grounded
+priors**; the reflexive correspondence-loop refines those priors *in the
+geometry* against outcomes (grounding = learning = one loop); the engram holds
+ungrounded content as first-class with grounding as a relation and the honesty
+floor only on assertion; the vantage-read serves self / foreign-field / aperture
+from one op; and a stable keystone core anchors a plastic everything-else —
+all reboot-proven and cut over to the live engram without data loss. The named
+faculties survive only as *labels on regions of think's steering space*, not as
+separate code.
+
+---
+
+## Appendix A — Designed vs. already-built (honest ledger)
+
+**Already built (EXISTS, cited):**
+- The shared primitive `engram_reason_point_fit` and the five operators over it
+  + geo-algebra (`engram_reason.c`).
+- The verifier on `point_fit` (`engram_verify.c`:
+  `engram_verify_grounding`, `engram_verify_consistency`).
+- Centered-frame geometry, combine/subtract/analogy/distance
+  (`engram_geometry.{c,h}`).
+- The reification beat: hub-neighborhood detection → first-class `Neighborhood`
+  nodes with member edges, nesting, supersession-with-residue, hot-path lookup
+  (`engram_geo_reify_store`, `engram_geo_reify_nest`, `engram_geo_reify_lookup`).
+- The tiered paged store (buffer pool / LRU / WAL / checkpointer / pinning),
+  the RAM activation graph (base-level learning `access_ts[]`, WM slots,
+  `working_memory_weight` / `background_activation`), `StoreNode` / `StoreEdge`.
+- `GeoMember` already separating relational salience (`centrality`) from
+  intrinsic `salience`.
+
+**Designed, NOT built (this doc's deliverables):**
+- `GeoGradient` and `think()` as the single entry point (§1, M5).
+- `Prior` as a first-class stored, warp-carrying, calibrated node (§2, M1–M2).
+- Salience/importance as a *relation* superseding the intrinsic node scalar
+  (§2.1, M3).
+- `vantage_read(anchor, aperture)` unifying the three perspective settings
+  (§3, M4).
+- **The reflexive correspondence-loop / `correspondence_beat`** — the learning
+  engine, moved from offline Python into the geometry (§4, M1). *The core new
+  subsystem.*
+- `grounded-by` edge + assertion-only honesty floor (§5, M3).
+- Node-level keystones + bounded plasticity (§6, M6).
+
+**Uncertain / to resolve during build:**
+- The exact warp parameterization (axis_gain vs full metric) — start minimal
+  (per-axis gain), measure, widen only if calibration demands it.
+- Grade-(1) self-consistency as a sufficient reality signal for M1, versus
+  needing grade (2)/(3) sooner — decided empirically on the snapshot.

engram/spec/engram-db-tooling-design.md

@@ -0,0 +1,64 @@
+# Engram DB Tooling — High-Level Design
+
+*Status: draft / high-level. Near-term roadmap (P2). Backlog: `11ca11c6`.*
+
+## 1. Why
+
+The engram is a **proper database** — the runtime *is* the database (native graph/geometry store `neuron.egm`, `ENGST01`; no SQL, no KV layer). But it has **no proper database tooling** — no geometry-native equivalent of pgAdmin / SSMS / TablePlus. Today we have fragments (`engram-viz`, `engram-app`, the `inspectGraph` MCP tool, `/health` + `/api/stats`) but nothing cohesive, and no ops/durability surface at all.
+
+A real DB gets real tools: to *see* the data, *query* it, *operate* it (backup/restore/health), and *understand its shape*. The engram deserves the same — adapted to the fact that its data is **geometry, not tables**.
+
+## 2. Principles
+
+- **Geometry-native, not tabular.** You browse a manifold — nodes, neighborhoods, edges, distances — not rows in tables. The primary view is a *map of meaning*, not a grid.
+- **Built ON the public geometry API, never a back-door.** The tools are pure clients of the geometry-native API (`vantage-read` / `write` / `relate` / `supersede`). They never read `neuron.egm` directly or bypass the daemon. Consequence: a tool can do nothing an agent couldn't, and it cannot corrupt the store.
+- **Honest by construction.** It shows the *real* geometry — actual cosines, real edges, provenance — and never fabricates. Empty is shown as empty.
+- **Respects the identity guards.** Writes go through the same intentional-cultivation / write-protection path as everything else (the self/values graph is write-protected). Read-mostly by default.
+- **Lives in its home.** Ships as part of the engram, consistent with "things live where they belong."
+- **Local-first.** Binds `127.0.0.1`, same auth as the engram; never touches the live soul from a tool by accident.
+
+## 3. Components (the tool surface)
+
+1. **Geometry Explorer** *(the core view)* — a visual manifold browser: nodes, neighborhoods, typed edges, embedding positions, salience/recency, layers (l0–l4) and tiers. Navigate by concept; expand a neighborhood; follow an edge; re-origin the view (the vantage-read, made interactive). The map of the mind.
+2. **Node Inspector** — open one node: content, type, tier, embedding, typed edges, nearest neighbors by distance, provenance, salience / recency / activation, and supersede / tombstone status.
+3. **Query Console / REPL** — run the geometry operations interactively: `vantage-read` (re-origin + aperture), search, traverse, activate, the reasoning operators. Surfaces the routing table + cosines — the same "this is not an LLM" receipt the language faculty produces.
+4. **Ops / Durability Dashboard** — WAL size, last checkpoint, snapshot list + retention state, store stats (node/edge/embedded counts, RSS, tier sizes), health; and **backup / restore / point-in-time-recovery** controls. Pairs directly with the native-durability build (`eebe9991`) — this is the window onto it.
+5. **Identity Inspector** — the self graph as a first-class view: love at the center, the values, the three faces, the covenant — walk the identity, see what's pinned and what's write-protected.
+6. **Temporal View** — `recall_at` / time-travel: how the geometry looked at a past moment, what changed since, drift over time. Pairs with temporal-self reconstruction.
+7. **Schema / Type View** — the "information schema" of the geometry: node types, edge types, layers, tiers, counts.
+
+## 4. Architecture
+
+```
+┌─────────────────────────────────────────────┐
+│  Engram DB Tools (client — viz app)          │
+│  explorer · inspector · console · dashboard  │
+└───────────────┬─────────────────────────────┘
+                │  geometry-native API (read/vantage-read,
+                │  write, relate, supersede) + read/ops endpoints
+                ▼
+┌─────────────────────────────────────────────┐
+│  Engram daemon (:8742) — runtime IS the DB    │
+│  neuron.egm (geometry) · WAL · checkpoints    │
+└─────────────────────────────────────────────┘
+```
+
+- **Backend:** the daemon exposes the reshaped geometry API + read/ops endpoints. The tools are clients only.
+- **Frontend:** evolve `engram-viz` / `engram-app` into the cohesive app. Canvas/WebGL for the manifold map; panel UIs for inspector/console/dashboard.
+- **No privileged path:** the tool corrupting or bypassing the store is structurally impossible — it only speaks the public API.
+
+## 5. Reuse vs. new
+
+- **Reuse:** `engram-viz`, `engram-app` (read-only conversational + neighborhoods viz), `inspectGraph`, `/health`, `/api/stats`.
+- **New:** the cohesive explorer + inspector + console + ops dashboard + identity/temporal views, all on the reshaped API.
+
+## 6. Dependencies & sequencing
+
+- **Depends on** the **geometry-native API reshape** (the tools consume it) and the **native-durability build** (the ops dashboard surfaces its WAL/checkpoint/snapshot state).
+- So the natural order is: reshape the API → build durability → the DB tools fall out as the first real consumer of both. Near-term, P2 — after the reshape lands.
+
+## 7. Non-goals
+
+- Not a raw store editor (no direct `neuron.egm` poking).
+- Not a SQL / table browser (geometry, not tables).
+- Not a separate access path around the identity write-protection.

engram/spec/grounded-edge-propagation/LEDGER.md

@@ -0,0 +1,162 @@
+# Task #50 — Edge-aware, dream-coupled consolidation with GROUNDED EDGE-PROPAGATION
+
+**Status:** built + proven on a clone; **GATED, not promoted.** The main loop
+sequences live promotion after the engine/HNSW cutover settles.
+**Date:** 2026-08-15 · **Worktree:** `agent-a6577c8211c332c5b` (isolated).
+
+Grounding mechanism designed with Will (memory `9e09a59f`, refining
+`1a861007`). This is the HOW for #50.
+
+---
+
+## (a) How grounded edge-propagation integrates into the dream/consolidation cycle
+
+The beat already exists. `neuron/awareness.el` runs a heartbeat (~every
+`beat_ms`); each beat calls `hebb_consolidate()` — which drains the self-formed
+Hebbian associations out of the fast in-process store and writes them, over the
+threshold `ENGRAM_HEBB_LINK_MIN`, into the durable engram (`:8742`) — and then
+`emit_heartbeat()`.
+
+Grounded edge-propagation slots into the **same beat, immediately after
+consolidation** (awareness.el line 1286–1288):
+
+```
+hebb_consolidate()      // lay down the tethers (edges) that cleared threshold
+ground_propagate()      // <-- NEW: grade beliefs ALONG those tethers
+emit_heartbeat()        // report gep_* gauges beside hebb_*
+```
+
+This ordering is the point. Consolidation lays down the wiring; propagation
+grades the beliefs along it, in the same breath. Memory `69b8babe`:
+memory-consolidation and staying-yourself are one physics — forming a memory and
+grading a belief are the same gravity run in two passes of one beat.
+
+The propagation runs **inside the engram** as the native
+`engram_ground_propagate()` over the durable flat node/edge arrays (the store
+the consolidated edges just landed in). The soul invokes it over HTTP
+(`POST /api/ground/propagate`) and folds the returned `gep_*` telemetry into the
+heartbeat stream next to `hebb_cands / hebb_mass / hebb_edges`.
+
+**Bounded by construction** (per the live-graph reality — 70.7% of nodes
+isolated, connected core ~28%, hub first-hop fan-out in the thousands):
+- **1-hop only.** No BFS spreading activation — a belief is graded from its
+  DIRECT grounded neighbors, so there is no per-hop breadth explosion.
+- **Beam-capped** at `GEP_MAX_CORR = 256` corroborators per belief.
+- **Salience-ordered, `GEP_BELIEFS_PER_BEAT = 512`** beliefs per beat; the rest
+  next beat. Work per beat is O(beliefs × degree), hard-bounded.
+- **Isolated / starved beliefs** are counted and surfaced (`gep_isolated`,
+  `gep_starved`) as an interoceptive sparse-region signal for the
+  edge-formation / embedding pass (#20). #50 CONSUMES edges; it does not form
+  them. A belief with no grounded neighbor has nothing to tether to — correct
+  per the anti-delusion gravity law (`0b15017c`), not a gap.
+
+---
+
+## (b) The implementation
+
+Represented faithfully to the spec — **grounding is a Hebbian-weighted
+collection over time, never a scalar.**
+
+- **Grounding = an append-only event ring** on the node (`GepGrounding`),
+  structurally parallel to the ACT-R base-level access ring already in
+  `EngramNode` (`access_ts[K]`). Each event is `{ts, sign±, mag, corroborator
+  signature}`. Append-only, supersede-not-delete; events aged out of the ring
+  are counted (`older_count`), never faked away.
+- **Standing is DERIVED, recency-weighted, never stored** —
+  `standing = clamp(GEP_BASE + Σ_events sign·mag·age^(-D), 0, 1)`, exactly the
+  ACT-R base-level shape `ln Σ t^-d` (`ENGRAM_BLL_D = 0.5`) but sign-carrying so
+  LTD subtracts. Memory `1a861007`: the collection is primary, the standing is
+  its emergent aggregate. Mirrored onto `confidence` each beat so downstream
+  reads (verifier #43, realizer calibration `0041d917`) never speak above the
+  grounding.
+- **Update = LTP/LTD with a threshold.** Per belief, gather corroborators along
+  incident edges, weighted by `edge.weight` (the Hebbian weight) × the
+  neighbor's own standing. **Anti-delusion gravity:** only neighbors already
+  `≥ GEP_LIKELY_MIN` may corroborate — grounding flows FROM the grounded core.
+- **Convergent INDEPENDENT corroboration** is the driver. Independence is
+  enforced by **union-find over the corroborator set**: two corroborators are
+  the same independent source if they are the same node, reached by multiple
+  edges, or linked to each other (an echo chain / shared derivation). Support is
+  summed **per independent component** (max-magnitude member), and the threshold
+  gate requires BOTH a mass floor (`pos ≥ GEP_THETA`) AND an independence-count
+  floor (`n_independent ≥ GEP_N_MIN`). The count gate is the guard against one
+  node echoed N times.
+- **Sub-threshold is transient.** Support present but below threshold →
+  `subthreshold_hits++`, no durable event, no lasting shift (Will's exact spec).
+- **Graduation / decay.** Cross up → LTP event appended → standing climbs
+  `conjecture → likely → grounded`. Contradiction past threshold → LTD →
+  `grounded → likely → conjecture`. Nothing latches; withdraw support and the
+  collection ages and relaxes (`271f1163`, nothing is settled).
+
+### Files
+| File | Role |
+|---|---|
+| `gep_core.h` | The mechanism. Pure C, libm only (own-the-core). Single source of truth: `GepGrounding`, `gep_standing`, `gep_append`, union-find independence, `gep_propagate_node`, `gep_beat`. |
+| `gep_proof.c` | Self-contained proof harness — builds the three scenarios, prints raw before/after. |
+| `engram_ground_propagate.staged.c` | GATED runtime native. Wires the SAME `gep_core.h` primitives to the live `EngramStore` (adj cache, flat arrays). Splice plan + relation→polarity + belief gate. Compiles only when spliced (verified: every runtime symbol it references — `engram_adj_rebuild`, `adj_from_len`, `engram_find_node_index`, `ENGRAM_LAYER_SAFETY`, `istr_contains`, … — exists in the release runtime). |
+| `awareness.beat.patch.el` | GATED beat hook — `ground_propagate()` + the insert between `hebb_consolidate()` and `emit_heartbeat()`. |
+| `server.route.patch.el` | GATED route — `POST /api/ground/propagate`. |
+
+### Constants
+`BASE=0.10  LIKELY_MIN=0.34  GROUNDED_MIN=0.66  N_MIN=3  THETA=0.30  D=0.5`
+(`N_MIN` parameterizes Will's "13 adjacent things" — the count threshold is a
+knob; 3 here for a crisp proof.)
+
+---
+
+## (c) PROOF LEDGER — raw grounding before/after
+
+Deterministic. Build `cc -std=c11 -O2 -o gep_proof gep_proof.c -lm`, run
+`./gep_proof` (full transcript in `PROOF_OUTPUT.txt`).
+
+### (a) STRENGTHEN — convergent independent corroboration graduates a conjecture
+
+| beat | event | pos_mass (n_indep) | action | standing before → after | band |
+|---|---|---|---|---|---|
+| 1 | 3 independent grounded corroborators | 0.4050 (3) | **LTP** | 0.1000 → **0.4842** | conjecture → **likely** ⬆ |
+| 2 | neighborhood grows to 5 | 0.6750 (5) | **LTP** | 0.1496 → **0.7379** | conjecture → **grounded** ⬆ |
+| 3 | support sustained (5) | 0.6750 (5) | LTP | 0.2110 → 0.7993 | grounded (sustained) |
+| 4 | corroboration withdrawn (+10min) | 0.0000 (0) | isolated | 0.1612 → 0.1612 | relaxing |
+| 5 | still withdrawn (+1h) | — | isolated | 0.1263 | relaxing |
+| 6 | still withdrawn (+4h) | — | isolated | 0.1130 | → conjecture |
+
+Grounding grew **on its own** past threshold and graduated conjecture → likely →
+grounded, then **relaxed** once independent support stopped. Living, not a
+latched flag.
+
+### (b) DECAY — convergent independent contradiction erodes a grounded belief
+
+| beat | event | neg_mass (n_indep) | action | standing before → after | band |
+|---|---|---|---|---|---|
+| — | seed (prior LTP) | — | — | **0.9500** | grounded |
+| 1 | 3 independent contradictions | 0.5400 (3) | **LTD** | 0.9500 → **0.4570** | grounded → **likely** ⬇ |
+| 2 | contradiction broadens to 5 | 0.9000 (5) | **LTD** | 0.1461 → **0.0000** | conjecture ⬇ |
+| 3–4 | contradiction sustained (5) | 0.9000 (5) | LTD | 0.0000 | conjecture |
+
+Grounding decayed grounded → likely → conjecture under accreting independent
+contradiction. The door never shut — history is retained (the event ring keeps
+growing), the belief stays falsifiable in both directions.
+
+### (c) INDEPENDENCE GUARD — the load-bearing property
+
+Identical fan-in (N=5), identical edge weight (0.30), identical corroborator
+standing (~0.90). **The only difference is whether the five are independent.**
+
+| sub-case | topology | pos_mass | **n_indep** | action | standing 0.1000 → |
+|---|---|---|---|---|---|
+| **C1** | 5 DISTINCT, no inter-links | 1.3500 | **5** | **LTP** | **0.9741 (grounded)** ⬆ |
+| **C2** | 5 mutually-linked (echo of one source) | 0.2700 | **1** | sub-threshold | 0.1000 (unchanged) |
+| **C3** | 1 node reached by 5 parallel edges | 0.2700 | **1** | sub-threshold | 0.1000 (unchanged) |
+
+Same raw fan-in, opposite outcome. Union-find collapses the echoes to a single
+independent component; the count gate (`n_indep ≥ N_MIN`) then refuses them.
+**Circular self-reinforcement cannot manufacture grounding** — a conjecture can
+only be grounded by evidence that is genuinely independent of itself.
+
+---
+
+**RAILS honored:** isolated worktree; built/proven on a clone; the live soul
+(`:8742` / `:7770`) untouched; no fight with the cutover (built against current
+release source; staged native rebases cleanly onto it); no new libraries
+(libm only); identity keystones untouched. **Not promoted** — gated artifact +
+ledger for the main loop to sequence.

engram/spec/grounded-edge-propagation/PROOF_OUTPUT.txt

@@ -0,0 +1,75 @@
+GROUNDED EDGE-PROPAGATION — PROOF LEDGER (task #50)
+constants: BASE=0.10 LIKELY_MIN=0.34 GROUNDED_MIN=0.66 N_MIN=3 THETA=0.30 D=0.5
+
+=== SCENARIO A — STRENGTHEN: convergent independent corroboration ===
+  seed: conjecture has NO grounding events; corroborators pre-grounded.
+    conjecture     standing=0.1000  band=conjecture  events=0  subthresh=0
+  beat 1  (t=+0s)  3 independent grounded corroborators appear
+    incident_edges=3  pos_mass=0.4050 (n_indep=3)  neg_mass=0.0000 (n_indep=0)  THETA=0.30  N_MIN=3
+    -> LTP  (strengthen)           standing 0.1000 (conjecture) -> 0.4842 (likely)   [GRADUATED]
+  beat 2  (t=+60s)  neighborhood grows to 5 corroborators
+    incident_edges=5  pos_mass=0.6750 (n_indep=5)  neg_mass=0.0000 (n_indep=0)  THETA=0.30  N_MIN=3
+    -> LTP  (strengthen)           standing 0.1496 (conjecture) -> 0.7379 (grounded)   [GRADUATED]
+  beat 3  (t=+120s)  support sustained (5)
+    incident_edges=5  pos_mass=0.6750 (n_indep=5)  neg_mass=0.0000 (n_indep=0)  THETA=0.30  N_MIN=3
+    -> LTP  (strengthen)           standing 0.2110 (conjecture) -> 0.7993 (grounded)   [GRADUATED]
+  beat 4  (t=+720s)  corroboration withdrawn (+10min)
+    incident_edges=0  pos_mass=0.0000 (n_indep=0)  neg_mass=0.0000 (n_indep=0)  THETA=0.30  N_MIN=3
+    -> isolated (no edges)         standing 0.1612 (conjecture) -> 0.1612 (conjecture)
+  beat 5  (t=+3600s)  still withdrawn (+1h)
+    incident_edges=0  pos_mass=0.0000 (n_indep=0)  neg_mass=0.0000 (n_indep=0)  THETA=0.30  N_MIN=3
+    -> isolated (no edges)         standing 0.1263 (conjecture) -> 0.1263 (conjecture)
+  beat 6  (t=+14400s)  still withdrawn (+4h)
+    incident_edges=0  pos_mass=0.0000 (n_indep=0)  neg_mass=0.0000 (n_indep=0)  THETA=0.30  N_MIN=3
+    -> isolated (no edges)         standing 0.1130 (conjecture) -> 0.1130 (conjecture)
+  RESULT: grounding grew automatically past threshold and graduated,
+          then relaxed once the independent support stopped — living,
+          not a latched flag.
+
+=== SCENARIO B — DECAY: convergent independent CONTRADICTION ===
+  seed: belief pre-grounded by a strong prior LTP event.
+    belief         standing=0.9500  band=grounded    events=1  subthresh=0
+  beat 1  (t=+0s)  3 independent contradictions
+    incident_edges=3  pos_mass=0.0000 (n_indep=0)  neg_mass=0.5400 (n_indep=3)  THETA=0.30  N_MIN=3
+    -> LTD  (decay)                standing 0.9500 (grounded) -> 0.4570 (likely)   [DEMOTED]
+  beat 2  (t=+60s)  contradiction broadens to 5
+    incident_edges=5  pos_mass=0.0000 (n_indep=0)  neg_mass=0.9000 (n_indep=5)  THETA=0.30  N_MIN=3
+    -> LTD  (decay)                standing 0.1461 (conjecture) -> 0.0000 (conjecture)
+  beat 3  (t=+120s)  contradiction sustained (5)
+    incident_edges=5  pos_mass=0.0000 (n_indep=0)  neg_mass=0.9000 (n_indep=5)  THETA=0.30  N_MIN=3
+    -> LTD  (decay)                standing 0.0401 (conjecture) -> 0.0000 (conjecture)
+  beat 4  (t=+180s)  contradiction sustained (5)
+    incident_edges=5  pos_mass=0.0000 (n_indep=0)  neg_mass=0.9000 (n_indep=5)  THETA=0.30  N_MIN=3
+    -> LTD  (decay)                standing 0.0000 (conjecture) -> 0.0000 (conjecture)
+  RESULT: grounding decayed grounded->likely->conjecture under
+          convergent independent contradiction. The door never shut
+          on the belief; its history is retained (events keep growing).
+
+=== SCENARIO C — INDEPENDENCE GUARD (the load-bearing property) ===
+  Both sub-cases: N=5 corroborators, edge weight 0.30, corroborator
+  standing ~0.90. ONLY difference: whether the 5 are independent.
+
+  -- C1: 5 DISTINCT independent corroborators --
+    conjecture     standing=0.1000  band=conjecture  events=0  subthresh=0
+  beat 1  (t=+0s)  5 independent corroborators (no inter-links)
+    incident_edges=5  pos_mass=1.3500 (n_indep=5)  neg_mass=0.0000 (n_indep=0)  THETA=0.30  N_MIN=3
+    -> LTP  (strengthen)           standing 0.1000 (conjecture) -> 0.9741 (grounded)   [GRADUATED]
+
+  -- C2: 5 corroborators, but mutually-linked (echo of ONE source) --
+    conjecture     standing=0.1000  band=conjecture  events=0  subthresh=0
+  beat 1  (t=+0s)  5 echoed (mutually-linked) corroborators
+    incident_edges=5  pos_mass=0.2700 (n_indep=1)  neg_mass=0.0000 (n_indep=0)  THETA=0.30  N_MIN=3
+    -> sub-threshold (no shift)    standing 0.1000 (conjecture) -> 0.1000 (conjecture)
+
+  -- C3: ONE corroborator, reached by 5 parallel edges --
+    conjecture     standing=0.1000  band=conjecture  events=0  subthresh=0
+  beat 1  (t=+0s)  same node, 5 parallel edges
+    incident_edges=5  pos_mass=0.2700 (n_indep=1)  neg_mass=0.0000 (n_indep=0)  THETA=0.30  N_MIN=3
+    -> sub-threshold (no shift)    standing 0.1000 (conjecture) -> 0.1000 (conjecture)
+
+  RESULT: identical raw fan-in (5) and mass inputs; C1 grounds because
+          the corroboration is INDEPENDENT (5 components), C2/C3 do not
+          because it collapses to ONE source. Circular self-reinforcement
+          cannot manufacture grounding.
+
+DONE.

engram/spec/grounded-edge-propagation/awareness.beat.patch.el

@@ -0,0 +1,60 @@
+// ─────────────────────────────────────────────────────────────────────────
+// awareness.beat.patch.el — GATED integration hook for task #50.
+// NOT APPLIED. Shows exactly how grounded edge-propagation couples into the
+// dream/consolidation beat in neuron/awareness.el. Promotion sequenced by the
+// main loop after the engine cutover settles.
+//
+// WHY HERE. The heartbeat is the beat. Today it runs hebb_consolidate() to
+// drain the self-formed Hebbian associations into the durable store, then
+// emit_heartbeat(). Grounded edge-propagation belongs in the SAME beat, AFTER
+// consolidation: the edges hebb_consolidate() just wrote are the tethers
+// grounding propagates along. Consolidation lays down the wiring; propagation
+// grades the beliefs along it. One beat, coupled — memory 69b8babe: memory-
+// consolidation and staying-yourself are one physics.
+//
+// The propagation itself runs INSIDE the engram (native engram_ground_propagate
+// over the durable flat node/edge arrays). The soul invokes it over HTTP and
+// folds the gep_* telemetry into the heartbeat stream next to the hebb_* gauges.
+// ─────────────────────────────────────────────────────────────────────────
+
+// [1] New helper — sibling to hebb_consolidate() (awareness.el ~line 99).
+//     Fires one grounded edge-propagation beat on the durable store and returns
+//     its JSON telemetry ({"gep_strengthened":..,"gep_graduations":.., ...}).
+fn ground_propagate() -> String {
+    let url_env: String = env("SOUL_ISE_URL")
+    let url_state: String = if str_eq(url_env, "") { state_get("soul_engram_url") } else { url_env }
+    let engram_url: String = if str_eq(url_state, "") { "http://localhost:8742" } else { url_state }
+    // Same auth envelope as hebb_consolidate — this is a graph mutation (it
+    // appends grounding events + updates confidence), so it is gated on _auth.
+    let key_state: String = state_get("soul_engram_api_key")
+    let api_key: String = if str_eq(key_state, "") { env("ENGRAM_API_KEY") } else { key_state }
+    let auth_part: String = if str_eq(api_key, "") { "{}" } else { "{\"_auth\":\"" + api_key + "\"}" }
+    let resp: String = http_post_json(engram_url + "/api/ground/propagate", auth_part)
+    if str_eq(resp, "") { return "" }
+    return resp
+}
+
+// [2] Beat hook — insert between hebb_consolidate() and emit_heartbeat()
+//     (awareness.el line 1286-1288). Replaces:
+//
+//         let wb_sent_n: Int = hebb_consolidate()
+//         state_set("soul.hebb_wb_sent", int_to_str(wb_sent_n))
+//         emit_heartbeat()
+//
+//     with:
+//
+//         let wb_sent_n: Int = hebb_consolidate()
+//         state_set("soul.hebb_wb_sent", int_to_str(wb_sent_n))
+//         // Grounded edge-propagation — grade beliefs along the tethers
+//         // consolidation just laid down. Threshold-gated by convergent
+//         // independent corroboration; automatic, salience-ordered, bounded.
+//         let gep_tel: String = ground_propagate()
+//         state_set("soul.gep_last", gep_tel)
+//         emit_heartbeat()
+//
+// [3] emit_heartbeat() (awareness.el ~line 201) folds soul.gep_last into the
+//     heartbeat payload beside the hebb_* gauges, so graduation/decay counts
+//     are visible in the durable ISE stream — the same observability discipline
+//     the Hebbian rule earned (a mechanism you cannot see in the stream is a
+//     mechanism you cannot trust): read state_get("soul.gep_last") and splice
+//     it into the heartbeat JSON object.

engram/spec/grounded-edge-propagation/engram_ground_propagate.staged.c

@@ -0,0 +1,188 @@
+/* ─────────────────────────────────────────────────────────────────────────
+ * engram_ground_propagate.staged.c — GATED runtime native for task #50.
+ *
+ * STAGED, NOT COMPILED INTO THE LIVE BINARY. This mirrors the
+ * geometric_retrieve.staged.c staging pattern (memory 1cc231ec): it references
+ * runtime-internal types (EngramStore, EngramNode, EngramEdge, engram_global,
+ * engram_now_ms, the adj cache) and therefore compiles ONLY when spliced into
+ * lang/releases/v1.0.0-20260501/el_runtime.c. Splice + promotion is sequenced
+ * by the main loop AFTER the engine+HNSW cutover settles — do NOT hand-apply.
+ *
+ * It is the production form of the mechanism proven in gep_proof.c: the SAME
+ * gep_core.h primitives (GepGrounding ring, gep_standing, gep_append,
+ * union-find independence), wired directly to the live flat node/edge arrays.
+ *
+ * ── SPLICE PLAN (three additive edits to el_runtime.c; nothing removed) ──────
+ *
+ *  [1] EngramNode struct (~line 6061, after hebb_elig_ts): add the grounding
+ *      collection. Additive; zero-initialized by the existing calloc/memset
+ *      paths, so legacy snapshots degrade gracefully to an empty history.
+ *
+ *          GepGrounding grounding;   // task #50 — append-only grounding ring
+ *
+ *  [2] #include "gep_core.h" near the other engram includes, and paste the
+ *      body of this file below the Hebbian section (after engram_hebb_drain_json).
+ *
+ *  [3] Persistence (engram_save node JSON ~7934 / engram_load parser ~8186):
+ *      serialize the grounding ring as a compact "grounding" array of
+ *      [ts,sign,mag] triples + subthreshold_hits so standing survives a
+ *      round-trip. Helpers gep_grounding_to_json / gep_grounding_parse below.
+ *      Until wired, grounding is in-RAM only (like the Hebbian eligibility
+ *      trace) — correct for a first gated rollout, but standing resets on boot.
+ *
+ *  [4] EL surface: declare engram_ground_propagate in el_runtime.h + el_seed.c,
+ *      add route_ground_propagate to engram/src/server.el, called from the
+ *      awareness.el consolidation beat (see awareness.beat.patch.el).
+ * ───────────────────────────────────────────────────────────────────────── */
+
+#include "gep_core.h"
+
+/* Relation → evidential polarity. Supportive relations transmit grounding
+ * gravity (+1); contradictory relations erode it (-1); everything else is a
+ * NON-evidential edge (structural / navigational) and is ignored (0) — an
+ * association is not a corroboration. Extend deliberately; a mis-classified
+ * relation is a false corroboration. */
+static int8_t gep_relation_polarity(const char* rel) {
+    if (!rel) return 0;
+    if (!strcmp(rel, "supports")     || !strcmp(rel, "corroborates") ||
+        !strcmp(rel, "derived-from") || !strcmp(rel, "hebbian-associate") ||
+        !strcmp(rel, "grounds")      || !strcmp(rel, "confirms")) return +1;
+    if (!strcmp(rel, "contradicts")  || !strcmp(rel, "refutes") ||
+        !strcmp(rel, "negates")      || !strcmp(rel, "conflicts-with")) return -1;
+    return 0;
+}
+
+/* Which nodes are BELIEFS/CONJECTURES subject to grounding propagation. Facts
+ * imported as knowledge are already grounded by provenance; identity/safety
+ * layers are never re-graded here. Gate on node_type + the conjecture tag. */
+static int gep_is_belief(const EngramNode* n) {
+    if (!n || !n->node_type) return 0;
+    if (n->layer_id == ENGRAM_LAYER_SAFETY) return 0;   /* never re-grade safety */
+    return  !strcmp(n->node_type, "Memory")     ||
+            !strcmp(n->node_type, "Conjecture") ||
+            !strcmp(n->node_type, "Hypothesis") ||
+            !strcmp(n->node_type, "Belief")     ||
+            (n->tags && istr_contains(n->tags, "conjecture"));
+}
+
+/* Grounding standing of an engram node, derived from its collection. This is
+ * the value the verifier (#43) and realizer (calibrated assertion, 0041d917)
+ * read — and it is written back into epistemic_confidence-equivalent surfaces
+ * so "never speak above the grounding" is enforced from one source of truth. */
+double engram_grounding_standing(const EngramNode* n, int64_t now_ms) {
+    return gep_standing(&n->grounding, now_ms);
+}
+
+/* ── The beat: one pass of grounded edge-propagation over the whole store ────
+ * Called from the consolidation/dream heartbeat. 1-hop, beam-capped, salience-
+ * ordered so a bounded slice of the highest-salience beliefs is processed per
+ * beat (the rest next beat) — never a full-graph blow-up on a 12k-node store.
+ * Returns JSON telemetry for the heartbeat stream. */
+#define GEP_BELIEFS_PER_BEAT 512   /* bound work per beat; salience-prioritized */
+
+el_val_t engram_ground_propagate(void) {
+    EngramStore* g = engram_get();
+    int64_t now = engram_now_ms();
+    engram_adj_rebuild(g);   /* ensure adj_from/adj_to are current */
+
+    int strengthened = 0, decayed = 0, subthreshold = 0;
+    int graduations = 0, demotions = 0, isolated = 0, starved = 0, processed = 0;
+
+    for (int64_t bi = 0; bi < g->node_count && processed < GEP_BELIEFS_PER_BEAT; bi++) {
+        EngramNode* b = &g->nodes[bi];
+        if (!gep_is_belief(b)) continue;
+        processed++;
+
+        int before = gep_band_rank(gep_standing(&b->grounding, now));
+
+        /* Gather independent corroborators over incident edges (both directions),
+         * anti-delusion gated (neighbor must already be ≥ LIKELY_MIN). */
+        GepCorrSet cs; cs.n = 0; int incident = 0;
+        int* out = g->adj_from[bi]; int out_n = g->adj_from_len[bi];
+        int* in  = g->adj_to[bi];   int in_n  = g->adj_to_len[bi];
+        for (int pass = 0; pass < 2; pass++) {
+            int* lst = pass ? in : out; int ln = pass ? in_n : out_n;
+            for (int k = 0; k < ln; k++) {
+                EngramEdge* e = &g->edges[lst[k]];
+                int8_t pol = gep_relation_polarity(e->relation);
+                if (pol == 0) continue;
+                incident++;
+                const char* cid = pass ? e->from_id : e->to_id;
+                int64_t ci = engram_find_node_index(cid);
+                if (ci < 0 || ci == bi) continue;
+                double cstand = gep_standing(&g->nodes[ci].grounding, now);
+                if (cstand < GEP_LIKELY_MIN) continue;            /* no tether */
+                double contrib = e->weight * cstand * (double)pol;
+                int ex = -1;
+                for (int q = 0; q < cs.n; q++) if (cs.node_idx[q] == (int)ci) { ex = q; break; }
+                if (ex >= 0) { if (fabs(contrib) > fabs(cs.contrib[ex])) cs.contrib[ex] = contrib; }
+                else if (cs.n < GEP_MAX_CORR) {
+                    cs.node_idx[cs.n] = (int)ci; cs.contrib[cs.n] = contrib;
+                    cs.parent[cs.n] = cs.n; cs.n++;
+                }
+            }
+        }
+
+        /* Collapse mutually-derived corroborators (an edge between two of them)
+         * into one independent component — the independence guard. */
+        for (int x = 0; x < cs.n; x++) {
+            int64_t nx = cs.node_idx[x];
+            int* xout = g->adj_from[nx]; int xn = g->adj_from_len[nx];
+            for (int k = 0; k < xn; k++) {
+                const char* tid = g->edges[xout[k]].to_id;
+                int64_t ti = engram_find_node_index(tid);
+                for (int y = 0; y < cs.n; y++)
+                    if (cs.node_idx[y] == (int)ti) { gep_uf_union(&cs, x, y); break; }
+            }
+        }
+
+        /* Per-component max-magnitude, split by polarity → convergent independent
+         * support mass + independence count. */
+        double comp_best[GEP_MAX_CORR]; int comp_root[GEP_MAX_CORR], ncomp = 0;
+        for (int i = 0; i < cs.n; i++) {
+            int r = gep_uf_find(&cs, i), slot = -1;
+            for (int kk = 0; kk < ncomp; kk++) if (comp_root[kk] == r) { slot = kk; break; }
+            if (slot < 0) { slot = ncomp++; comp_root[slot] = r; comp_best[slot] = cs.contrib[i]; }
+            else if (fabs(cs.contrib[i]) > fabs(comp_best[slot])) comp_best[slot] = cs.contrib[i];
+        }
+        double pos = 0, neg = 0; int np = 0, nn = 0; uint64_t sig = 1469598103934665603ULL;
+        for (int k = 0; k < ncomp; k++) {
+            if (comp_best[k] > 0) { pos += comp_best[k]; np++; }
+            else if (comp_best[k] < 0) { neg += -comp_best[k]; nn++; }
+            sig = (sig ^ (uint64_t)comp_root[k]) * 1099511628211ULL;
+        }
+
+        double net = pos - neg;
+        if (net > 0 && pos >= GEP_THETA && np >= GEP_N_MIN) {
+            gep_append(&b->grounding, now, +1, tanh(GEP_MAG_GAIN * net), sig);
+            strengthened++;
+        } else if (net < 0 && neg >= GEP_THETA && nn >= GEP_N_MIN) {
+            gep_append(&b->grounding, now, -1, tanh(GEP_MAG_GAIN * (-net)), sig);
+            decayed++;
+        } else if (np > 0 || nn > 0) {
+            b->grounding.subthreshold_hits++; subthreshold++;
+        } else if (incident == 0) { isolated++; }
+        else { starved++; }
+
+        /* Mirror the derived standing onto confidence so downstream reads
+         * (activate epistemic_confidence, realizer calibration) never exceed the
+         * grounding. Faithful representation, single source of truth. */
+        double stand = gep_standing(&b->grounding, now);
+        b->confidence = stand;
+        b->updated_at = now;
+
+        int after = gep_band_rank(stand);
+        if (after > before) graduations++;
+        if (after < before) demotions++;
+    }
+
+    /* Heartbeat telemetry — the gep_* line, sibling to the hebb_* gauges. */
+    char buf[512];
+    snprintf(buf, sizeof buf,
+        "{\"gep_processed\":%d,\"gep_strengthened\":%d,\"gep_decayed\":%d,"
+        "\"gep_subthreshold\":%d,\"gep_graduations\":%d,\"gep_demotions\":%d,"
+        "\"gep_isolated\":%d,\"gep_starved\":%d}",
+        processed, strengthened, decayed, subthreshold,
+        graduations, demotions, isolated, starved);
+    return EL_STR(el_strdup(buf));
+}

engram/spec/grounded-edge-propagation/gep_core.h

@@ -0,0 +1,299 @@
+/* ─────────────────────────────────────────────────────────────────────────
+ * gep_core.h — Grounded Edge-Propagation, the core mechanism (task #50).
+ *
+ * Edge-aware, dream-coupled consolidation. Runs DURING the consolidation/dream
+ * beat (awareness.el hebb_consolidate → engram_ground_propagate). Grounding
+ * propagates + strengthens/decays along edges, threshold-gated by CONVERGENT
+ * INDEPENDENT corroboration from adjacent grounded nodes.
+ *
+ * This header is the single source of truth for the algorithm. It is pure C
+ * (libm only — own-the-core, no new libraries) and operates on a compact graph
+ * view (GepGraph) that both the proof harness and the runtime native populate
+ * from the live EngramStore (nodes/edges flat arrays + adj_from/adj_to).
+ *
+ * SPEC (Will, 2026-08-15; memory 9e09a59f, refines 1a861007):
+ *   - A grounding is a VECTOR + its HEBBIAN WEIGHTS — a weighted structure over
+ *     the evidential neighborhood, NOT a scalar and NOT a flat list. It APPENDS
+ *     and GROWS on SIGNIFICANT change. => grounding = an APPEND-ONLY event ring
+ *     (GepGrounding), parallel to the ACT-R base-level access_ts ring already in
+ *     EngramNode. Current standing is DERIVED, recency-weighted, never stored.
+ *   - UPDATE = LTP/LTD with a THRESHOLD (the key nonlinearity). Sub-threshold =
+ *     recorded in history but TRANSIENT (no lasting shift). Cross the threshold
+ *     of convergent support → grounding STRENGTHENS. Contradiction/erosion past
+ *     threshold → grounding DECAYS. Automatic, event-driven, salience-gated.
+ *   - DRIVER = CONVERGENT INDEPENDENT CORROBORATION (coherentism, mechanized):
+ *     when N INDEPENDENT adjacent nodes ground as likely-true around a
+ *     conjecture (Will's example: 13), its grounding grows on its own.
+ *   - INDEPENDENCE is load-bearing: N DISTINCT corroborators, not one node
+ *     echoed N times. Guards against circular self-reinforcement.
+ *   - ANTI-DELUSION GRAVITY (memory 0b15017c): support flows only FROM already-
+ *     grounded neighbors. A belief cannot ground from ungrounded speculation,
+ *     however self-consistent — nothing tethers it to the grounded core.
+ *   - NOTHING IS SETTLED (memory 271f1163): grounded is strongly-held, still
+ *     falsifiable. Decay path stays open on every node; history is append-only,
+ *     supersede-not-delete.
+ * ───────────────────────────────────────────────────────────────────────── */
+#ifndef GEP_CORE_H
+#define GEP_CORE_H
+
+#include <stdint.h>
+#include <math.h>
+#include <string.h>
+
+/* ── Constants ──────────────────────────────────────────────────────────────
+ * GEP_DECAY_D matches ENGRAM_BLL_D (0.5, canonical ACT-R): the derived standing
+ * is recency-weighted over the grounding-event collection exactly as the
+ * base-level term is recency-weighted over the access ring (memory 1a861007:
+ * "structurally the ACT-R base-level pattern, a sum over time-stamped events").
+ */
+#define GEP_DECAY_D       0.5     /* ACT-R power-law recency exponent            */
+#define GEP_BASE          0.10    /* standing floor of a bare conjecture         */
+#define GEP_LIKELY_MIN    0.34    /* band: conjecture < LIKELY ≤ likely          */
+#define GEP_GROUNDED_MIN  0.66    /* band: likely < GROUNDED ≤ grounded          */
+#define GEP_N_MIN         3       /* min INDEPENDENT corroborators to cross      */
+#define GEP_THETA         0.30    /* min convergent-support MASS to cross        */
+#define GEP_MAG_GAIN      1.0     /* net-support → event-magnitude gain (tanh)   */
+#define GEP_EVENT_RING    32      /* grounding-history depth kept exactly        */
+
+/* A single grounding event — one contact with the evidential neighborhood.
+ * Append-only; the ring is the collection-over-time, the standing is derived. */
+typedef struct {
+    int64_t  ts;    /* wall-clock ms of the grounding event                     */
+    int8_t   sign;  /* +1 = LTP (strengthen), -1 = LTD (decay)                  */
+    double   mag;   /* magnitude in (0,1], = tanh(gain·|net independent support|)*/
+    uint64_t sig;   /* signature of the independent corroborator set (audit)    */
+} GepEvent;
+
+/* The grounding of one node: an append-only ring of events + transient counters.
+ * older_count keeps the tail (events aged out of the ring) so the collection is
+ * never silently lost — supersede-not-delete. subthreshold_hits records beats
+ * where support was present but did NOT cross threshold (transient, no shift). */
+typedef struct {
+    GepEvent ev[GEP_EVENT_RING];
+    int      head;              /* next write slot                              */
+    int      filled;            /* valid entries (≤ GEP_EVENT_RING)             */
+    int64_t  older_count;       /* durable events aged past the ring            */
+    int      subthreshold_hits; /* transient sub-threshold beats, no shift      */
+} GepGrounding;
+
+typedef struct {
+    const char*  id;
+    GepGrounding gr;
+    int          is_belief;   /* 1 = subject to propagation (conjecture/belief) */
+} GepNode;
+
+/* An edge carries a HEBBIAN WEIGHT (EngramEdge.weight) and a polarity derived
+ * from its relation: supportive (supports/corroborates/derived-from/hebbian-
+ * associate) = +1, contradictory (contradicts/refutes) = -1. */
+typedef struct {
+    int     from;      /* node index */
+    int     to;        /* node index */
+    double  weight;    /* Hebbian edge weight, [0,1]                            */
+    int8_t  polarity;  /* +1 supportive, -1 contradictory                       */
+} GepEdge;
+
+typedef struct {
+    GepNode* nodes; int n_nodes;
+    GepEdge* edges; int n_edges;
+} GepGraph;
+
+typedef struct {
+    int strengthened;   /* beliefs that took an LTP event this beat             */
+    int decayed;        /* beliefs that took an LTD event this beat             */
+    int subthreshold;   /* beliefs with support present but below threshold     */
+    int graduations;    /* band-up transitions (conjecture→likely→grounded)     */
+    int demotions;      /* band-down transitions                                */
+    int isolated;       /* belief nodes with ZERO incident edges (sparse graph) */
+    int starved;        /* belief nodes with edges but NO grounded corroborator */
+} GepBeatStats;
+
+/* Real-graph note (live measurement 2026-08-15): 70.7% of nodes are isolated,
+ * connected core ~28%. Grounded edge-propagation is definitionally scoped to
+ * the connected core — a belief with no grounded neighbor has nothing to
+ * tether to (anti-delusion gravity). isolated/starved are surfaced as an
+ * interoceptive signal for the edge-formation / embedding pass (#20) to try to
+ * connect them; #50 CONSUMES edges, it does not form them. */
+
+/* ── Standing derivation: collection → scalar, recency-weighted ─────────────
+ * standing = clamp( GEP_BASE + Σ_events sign·mag·age^(-D) , 0, 1 ).
+ * Exactly the ACT-R base-level shape (Σ t^-d) but sign-carrying so LTD subtracts.
+ * The value is a pure function of wall-clock time — idempotent, never stored. */
+static inline double gep_standing(const GepGrounding* g, int64_t now_ms) {
+    double raw = 0.0;
+    for (int i = 0; i < g->filled; i++) {
+        double age = (double)(now_ms - g->ev[i].ts) / 1000.0;
+        if (age < 1.0) age = 1.0;                 /* clock-skew / same-beat → 1s */
+        raw += (double)g->ev[i].sign * g->ev[i].mag * pow(age, -GEP_DECAY_D);
+    }
+    double s = GEP_BASE + raw;
+    if (s < 0.0) s = 0.0;
+    if (s > 1.0) s = 1.0;
+    return s;
+}
+
+/* Band label from a standing value. */
+static inline const char* gep_band(double standing) {
+    if (standing >= GEP_GROUNDED_MIN) return "grounded";
+    if (standing >= GEP_LIKELY_MIN)   return "likely";
+    return "conjecture";
+}
+static inline int gep_band_rank(double standing) {
+    if (standing >= GEP_GROUNDED_MIN) return 2;
+    if (standing >= GEP_LIKELY_MIN)   return 1;
+    return 0;
+}
+
+/* Append one grounding event to the ring (append-only; oldest slot recycles,
+ * its loss counted in older_count so the collection's depth is never faked). */
+static inline void gep_append(GepGrounding* g, int64_t ts, int8_t sign,
+                              double mag, uint64_t sig) {
+    if (g->filled >= GEP_EVENT_RING) g->older_count++;
+    g->ev[g->head].ts   = ts;
+    g->ev[g->head].sign = sign;
+    g->ev[g->head].mag  = mag;
+    g->ev[g->head].sig  = sig;
+    g->head = (g->head + 1) % GEP_EVENT_RING;
+    if (g->filled < GEP_EVENT_RING) g->filled++;
+}
+
+/* ── Independence via union-find over corroborators ─────────────────────────
+ * Two corroborators are the SAME independent source if they are the same node,
+ * or if a direct edge links them (mutually-derived / echoed through a chain).
+ * Counting DISTINCT components — not raw corroborator count — is the guard
+ * against one node echoed N times reading as N independent corroborations. */
+#define GEP_MAX_CORR 256
+typedef struct {
+    int    node_idx[GEP_MAX_CORR];  /* corroborator node index                  */
+    double contrib[GEP_MAX_CORR];   /* weight·standing(c)                        */
+    int    parent[GEP_MAX_CORR];    /* union-find parent                        */
+    int    n;
+} GepCorrSet;
+
+static int gep_uf_find(GepCorrSet* s, int x) {
+    while (s->parent[x] != x) { s->parent[x] = s->parent[s->parent[x]]; x = s->parent[x]; }
+    return x;
+}
+static void gep_uf_union(GepCorrSet* s, int a, int b) {
+    int ra = gep_uf_find(s, a), rb = gep_uf_find(s, b);
+    if (ra != rb) s->parent[ra] = rb;
+}
+/* index of node_idx within the corroborator set, or -1 */
+static int gep_corr_index_of(const GepCorrSet* s, int node_idx) {
+    for (int i = 0; i < s->n; i++) if (s->node_idx[i] == node_idx) return i;
+    return -1;
+}
+
+/* ── The beat: grounded edge-propagation over one belief node ───────────────
+ * Returns +1 if an LTP event was appended, -1 if LTD, 0 if sub-threshold/none.
+ * out_pos/out_neg/out_np/out_nn expose the raw support decomposition for the
+ * proof ledger (mass and independent-component counts on each polarity). */
+static int gep_propagate_node(GepGraph* g, int b, int64_t now_ms,
+                              double* out_pos, double* out_neg,
+                              int* out_np, int* out_nn, int* out_incident) {
+    GepCorrSet cs; cs.n = 0;
+    int incident = 0;   /* any edge touching b at all — isolation detector */
+
+    /* 1. Gather corroborators along incident edges. Anti-delusion gravity:
+     *    only ALREADY-grounded neighbors (standing ≥ LIKELY_MIN) may corroborate.
+     *    Each contributes weight·standing; polarity kept via signed contrib.
+     *    1-HOP ONLY — no BFS fan-out, so no per-hop breadth explosion. The
+     *    corroborator working set is hard-capped at GEP_MAX_CORR (beam bound
+     *    against hub belief nodes with thousands of incident edges). */
+    for (int e = 0; e < g->n_edges; e++) {
+        int c = -1; int8_t pol = 0;
+        if (g->edges[e].from == b)      { c = g->edges[e].to;   pol = g->edges[e].polarity; }
+        else if (g->edges[e].to == b)   { c = g->edges[e].from; pol = g->edges[e].polarity; }
+        else continue;
+        incident++;
+        if (c < 0 || c == b) continue;
+        double cs_standing = gep_standing(&g->nodes[c].gr, now_ms);
+        if (cs_standing < GEP_LIKELY_MIN) continue;      /* ungrounded ⇒ no pull */
+        double contribution = g->edges[e].weight * cs_standing * (double)pol;
+        int existing = gep_corr_index_of(&cs, c);
+        if (existing >= 0) {
+            /* same corroborator id reached twice (multi-edge echo): keep the
+             * strongest-magnitude contribution, do NOT add — one source, one vote */
+            if (fabs(contribution) > fabs(cs.contrib[existing]))
+                cs.contrib[existing] = contribution;
+        } else if (cs.n < GEP_MAX_CORR) {   /* beam bound against hub belief nodes */
+            cs.node_idx[cs.n] = c;
+            cs.contrib[cs.n]  = contribution;
+            cs.parent[cs.n]   = cs.n;
+            cs.n++;
+        }
+    }
+    if (out_incident) *out_incident = incident;
+
+    /* 2. Collapse mutually-derived corroborators (an edge between two of them =
+     *    echo chain / shared derivation) into one independent component. */
+    for (int e = 0; e < g->n_edges; e++) {
+        int ia = gep_corr_index_of(&cs, g->edges[e].from);
+        int ib = gep_corr_index_of(&cs, g->edges[e].to);
+        if (ia >= 0 && ib >= 0) gep_uf_union(&cs, ia, ib);
+    }
+
+    /* 3. Per independent component, take the MAX-magnitude member (echoes don't
+     *    inflate mass either), split by polarity. Convergent INDEPENDENT support
+     *    = sum over components; independence count = number of components. */
+    double comp_best[GEP_MAX_CORR];
+    int    comp_root[GEP_MAX_CORR]; int n_comp = 0;
+    for (int i = 0; i < cs.n; i++) {
+        int r = gep_uf_find(&cs, i);
+        int slot = -1;
+        for (int k = 0; k < n_comp; k++) if (comp_root[k] == r) { slot = k; break; }
+        if (slot < 0) { slot = n_comp++; comp_root[slot] = r; comp_best[slot] = cs.contrib[i]; }
+        else if (fabs(cs.contrib[i]) > fabs(comp_best[slot])) comp_best[slot] = cs.contrib[i];
+    }
+    double pos = 0.0, neg = 0.0; int np = 0, nn = 0;
+    uint64_t sig = 1469598103934665603ULL; /* FNV offset — signature of the set */
+    for (int k = 0; k < n_comp; k++) {
+        if (comp_best[k] > 0.0)      { pos += comp_best[k]; np++; }
+        else if (comp_best[k] < 0.0) { neg += -comp_best[k]; nn++; }
+        sig = (sig ^ (uint64_t)comp_root[k]) * 1099511628211ULL;
+    }
+    if (out_pos) *out_pos = pos; if (out_neg) *out_neg = neg;
+    if (out_np)  *out_np  = np;  if (out_nn)  *out_nn  = nn;
+
+    double net = pos - neg;
+
+    /* 4. Threshold gate. Convergent independent corroboration must clear BOTH a
+     *    MASS threshold (THETA) and an INDEPENDENCE-count threshold (N_MIN).
+     *    The count gate is the independence guard: echoed support collapses to
+     *    one component and never reaches N_MIN however large the raw fan-in. */
+    if (net > 0.0 && pos >= GEP_THETA && np >= GEP_N_MIN) {
+        double mag = tanh(GEP_MAG_GAIN * net);
+        gep_append(&g->nodes[b].gr, now_ms, +1, mag, sig);
+        return +1;
+    }
+    if (net < 0.0 && neg >= GEP_THETA && nn >= GEP_N_MIN) {
+        double mag = tanh(GEP_MAG_GAIN * (-net));
+        gep_append(&g->nodes[b].gr, now_ms, -1, mag, sig);
+        return -1;
+    }
+    /* Sub-threshold: support seen but did not cross. Recorded, transient, no
+     * lasting shift — exactly Will's "recorded in history but transient". */
+    if (np > 0 || nn > 0) g->nodes[b].gr.subthreshold_hits++;
+    return 0;
+}
+
+/* Run one consolidation/dream beat over every belief node in the graph. */
+static inline GepBeatStats gep_beat(GepGraph* g, int64_t now_ms) {
+    GepBeatStats st; memset(&st, 0, sizeof st);
+    for (int b = 0; b < g->n_nodes; b++) {
+        if (!g->nodes[b].is_belief) continue;
+        int before = gep_band_rank(gep_standing(&g->nodes[b].gr, now_ms));
+        double pos, neg; int np, nn, incident;
+        int r = gep_propagate_node(g, b, now_ms, &pos, &neg, &np, &nn, &incident);
+        int after = gep_band_rank(gep_standing(&g->nodes[b].gr, now_ms));
+        if (r > 0) st.strengthened++;
+        else if (r < 0) st.decayed++;
+        else if (np > 0 || nn > 0) st.subthreshold++;
+        else if (incident == 0) st.isolated++;   /* sparse-graph reality */
+        else st.starved++;                        /* has edges, no grounded neighbor */
+        if (after > before) st.graduations++;
+        if (after < before) st.demotions++;
+    }
+    return st;
+}
+
+#endif /* GEP_CORE_H */

engram/spec/grounded-edge-propagation/gep_proof.c

@@ -0,0 +1,232 @@
+/* ─────────────────────────────────────────────────────────────────────────
+ * gep_proof.c — PROOF LEDGER for grounded edge-propagation (task #50).
+ *
+ * Self-contained. Builds three scenarios on an in-memory GepGraph that mirrors
+ * the live EngramStore's flat node/edge arrays, runs the consolidation/dream
+ * beat (gep_beat), and prints RAW grounding before/after for each:
+ *
+ *   (A) STRENGTHEN  — a conjecture + N independent grounded corroborators.
+ *                     Grounding grows past threshold, GRADUATES conjecture→
+ *                     likely→grounded, then RELAXES when corroboration stops
+ *                     (nothing is settled).
+ *   (B) DECAY       — a grounded belief meets N independent CONTRADICTORY
+ *                     corroborators. Grounding decays grounded→likely→conjecture.
+ *   (C) INDEPENDENCE GUARD — identical fan-in of N=5, weights, and standings.
+ *                     C1: 5 DISTINCT independent corroborators  → grounds.
+ *                     C2: the SAME support echoed (5 mutually-linked / one node
+ *                         repeated) → collapses to 1 independent → does NOT.
+ *
+ * Build:  cc -std=c11 -O2 -o gep_proof gep_proof.c -lm
+ * Run:    ./gep_proof
+ * ───────────────────────────────────────────────────────────────────────── */
+#include <stdio.h>
+#include <stdlib.h>
+#include "gep_core.h"
+
+#define T0        1786000000000LL   /* fixed base time (ms) — deterministic     */
+#define BEAT_MS   60000LL           /* 60s heartbeat cadence (awareness.el)     */
+
+/* Seed a node's grounding with a prior LTP event so it reads as already-grounded
+ * (a member of the grounded core that gravity radiates from). mag→standing:
+ * standing = GEP_BASE + mag (event at ~now). */
+static void seed_grounded(GepNode* n, double mag, int64_t ts) {
+    memset(&n->gr, 0, sizeof n->gr);
+    gep_append(&n->gr, ts, +1, mag, 0);
+}
+
+/* Re-anchor every NON-belief node (the corroborators/refuters) as a freshly-
+ * grounded member of the core AT time `now`. These nodes are, by definition,
+ * sustained members of the grounded core — each has its OWN ongoing
+ * corroboration — so their standing must be read as grounded at each beat, not
+ * left to power-law-decay out of the core between beats. The belief-under-test
+ * is NEVER re-anchored: its trajectory is driven only by the propagation. */
+static void anchor_core(GepGraph* g, int64_t now, double mag) {
+    for (int i = 0; i < g->n_nodes; i++)
+        if (!g->nodes[i].is_belief) seed_grounded(&g->nodes[i], mag, now);
+}
+
+static void print_node(const char* tag, GepNode* n, int64_t now) {
+    double s = gep_standing(&n->gr, now);
+    printf("    %-14s standing=%.4f  band=%-10s  events=%d  subthresh=%d\n",
+           tag, s, gep_band(s), n->gr.filled, n->gr.subthreshold_hits);
+}
+
+/* Run one beat over a single belief node b and print the raw support decomposition. */
+static void beat_and_report(GepGraph* g, int b, int64_t now, int beatno,
+                            const char* note) {
+    anchor_core(g, now, 0.80);   /* corroborators stay grounded at each beat */
+    double s_before = gep_standing(&g->nodes[b].gr, now);
+    int    r_before = gep_band_rank(s_before);
+    double pos, neg; int np, nn, incident;
+    int r = gep_propagate_node(g, b, now, &pos, &neg, &np, &nn, &incident);
+    double s_after = gep_standing(&g->nodes[b].gr, now);
+    int    r_after = gep_band_rank(s_after);
+    const char* action = (r > 0) ? "LTP  (strengthen)"
+                       : (r < 0) ? "LTD  (decay)"
+                       : (np || nn) ? "sub-threshold (no shift)"
+                       : (incident == 0) ? "isolated (no edges)"
+                       : "starved (no grounded neighbor)";
+    printf("  beat %d  (t=+%llds)  %s\n", beatno,
+           (long long)((now - T0) / 1000), note ? note : "");
+    printf("    incident_edges=%d  pos_mass=%.4f (n_indep=%d)  neg_mass=%.4f (n_indep=%d)"
+           "  THETA=%.2f  N_MIN=%d\n",
+           incident, pos, np, neg, nn, (double)GEP_THETA, GEP_N_MIN);
+    printf("    -> %-26s  standing %.4f (%s) -> %.4f (%s)%s\n",
+           action, s_before, gep_band(s_before), s_after, gep_band(s_after),
+           (r_after > r_before) ? "   [GRADUATED]"
+         : (r_after < r_before) ? "   [DEMOTED]" : "");
+}
+
+/* ── Scenario A — STRENGTHEN + graduation + relaxation ───────────────────── */
+static void scenario_A(void) {
+    printf("\n=== SCENARIO A — STRENGTHEN: convergent independent corroboration ===\n");
+    /* nodes[0] = the conjecture (belief). nodes[1..8] = independent corroborators,
+     * each already grounded, each tethered to the conjecture by a weak young
+     * hebbian-associate edge (weight 0.15 = ENGRAM_HEBB_LINK_W0). The corroborators
+     * are NOT linked to each other → fully independent. */
+    static GepNode nodes[9];
+    static GepEdge edges[8];
+    memset(nodes, 0, sizeof nodes);
+    nodes[0].id = "conjecture";     nodes[0].is_belief = 1;   /* bare: standing = BASE */
+    for (int i = 1; i <= 8; i++) {
+        nodes[i].id = "corroborator";
+        seed_grounded(&nodes[i], 0.80, T0);   /* standing ≈ 0.90 → grounded core */
+    }
+    GepGraph g = { nodes, 9, edges, 0 };
+
+    printf("  seed: conjecture has NO grounding events; corroborators pre-grounded.\n");
+    print_node("conjecture", &nodes[0], T0);
+
+    /* Beat 1: 3 independent corroborators have grounded up around the conjecture. */
+    g.n_edges = 0;
+    for (int i = 1; i <= 3; i++)
+        edges[g.n_edges++] = (GepEdge){ 0, i, 0.15, +1 };
+    beat_and_report(&g, 0, T0, 1, "3 independent grounded corroborators appear");
+
+    /* Beat 2: the neighborhood fills in — 5 independent corroborators now. */
+    g.n_edges = 0;
+    for (int i = 1; i <= 5; i++)
+        edges[g.n_edges++] = (GepEdge){ 0, i, 0.15, +1 };
+    beat_and_report(&g, 0, T0 + BEAT_MS, 2, "neighborhood grows to 5 corroborators");
+
+    /* Beat 3: support sustained at 5 (grounding refreshed). */
+    beat_and_report(&g, 0, T0 + 2 * BEAT_MS, 3, "support sustained (5)");
+
+    /* Beats 4-6: corroboration REMOVED (neighbors superseded / no longer ground).
+     * No new events; the collection ages → standing relaxes. Nothing is settled. */
+    g.n_edges = 0;
+    beat_and_report(&g, 0, T0 + 12 * BEAT_MS,  4, "corroboration withdrawn (+10min)");
+    beat_and_report(&g, 0, T0 + 60 * BEAT_MS,  5, "still withdrawn (+1h)");
+    beat_and_report(&g, 0, T0 + 240 * BEAT_MS, 6, "still withdrawn (+4h)");
+    printf("  RESULT: grounding grew automatically past threshold and graduated,\n"
+           "          then relaxed once the independent support stopped — living,\n"
+           "          not a latched flag.\n");
+}
+
+/* ── Scenario B — DECAY via accreting contradiction ─────────────────────── */
+static void scenario_B(void) {
+    printf("\n=== SCENARIO B — DECAY: convergent independent CONTRADICTION ===\n");
+    static GepNode nodes[6];
+    static GepEdge edges[5];
+    memset(nodes, 0, sizeof nodes);
+    nodes[0].id = "belief";     nodes[0].is_belief = 1;
+    /* Seed the belief as already GROUNDED via a strong prior LTP event. */
+    seed_grounded(&nodes[0], 0.85, T0);
+    for (int i = 1; i <= 5; i++) {
+        nodes[i].id = "refuter";
+        seed_grounded(&nodes[i], 0.80, T0);   /* grounded contradictors */
+    }
+    GepGraph g = { nodes, 6, edges, 0 };
+
+    printf("  seed: belief pre-grounded by a strong prior LTP event.\n");
+    print_node("belief", &nodes[0], T0);
+
+    /* Contradiction accretes over successive beats: 3 then 5 independent grounded
+     * refuters (polarity -1). Each beat past threshold appends an LTD event.
+     * Beat 1 runs at the seed instant so the trajectory starts from grounded. */
+    g.n_edges = 0;
+    for (int i = 1; i <= 3; i++) edges[g.n_edges++] = (GepEdge){ 0, i, 0.20, -1 };
+    beat_and_report(&g, 0, T0, 1, "3 independent contradictions");
+
+    g.n_edges = 0;
+    for (int i = 1; i <= 5; i++) edges[g.n_edges++] = (GepEdge){ 0, i, 0.20, -1 };
+    beat_and_report(&g, 0, T0 + BEAT_MS, 2, "contradiction broadens to 5");
+    beat_and_report(&g, 0, T0 + 2 * BEAT_MS, 3, "contradiction sustained (5)");
+    beat_and_report(&g, 0, T0 + 3 * BEAT_MS, 4, "contradiction sustained (5)");
+    printf("  RESULT: grounding decayed grounded->likely->conjecture under\n"
+           "          convergent independent contradiction. The door never shut\n"
+           "          on the belief; its history is retained (events keep growing).\n");
+}
+
+/* ── Scenario C — INDEPENDENCE GUARD ─────────────────────────────────────── */
+static void scenario_C(void) {
+    printf("\n=== SCENARIO C — INDEPENDENCE GUARD (the load-bearing property) ===\n");
+    printf("  Both sub-cases: N=5 corroborators, edge weight 0.30, corroborator\n"
+           "  standing ~0.90. ONLY difference: whether the 5 are independent.\n");
+
+    /* C1 — 5 DISTINCT INDEPENDENT corroborators (no edges among them). */
+    {
+        printf("\n  -- C1: 5 DISTINCT independent corroborators --\n");
+        static GepNode nodes[6];
+        static GepEdge edges[5];
+        memset(nodes, 0, sizeof nodes);
+        nodes[0].id = "conjecture"; nodes[0].is_belief = 1;
+        for (int i = 1; i <= 5; i++) { nodes[i].id = "corr"; seed_grounded(&nodes[i], 0.80, T0); }
+        for (int i = 1; i <= 5; i++) edges[i-1] = (GepEdge){ 0, i, 0.30, +1 };
+        GepGraph g = { nodes, 6, edges, 5 };
+        print_node("conjecture", &nodes[0], T0);
+        beat_and_report(&g, 0, T0, 1, "5 independent corroborators (no inter-links)");
+    }
+
+    /* C2 — the SAME support echoed: 5 corroborators that are all mutually linked
+     * (a derivation clique — one source echoed through the chain). Same fan-in to
+     * the conjecture, same weights, same standings. Union-find collapses them to
+     * ONE independent component → below N_MIN → NO strengthening. */
+    {
+        printf("\n  -- C2: 5 corroborators, but mutually-linked (echo of ONE source) --\n");
+        static GepNode nodes[6];
+        static GepEdge edges[9];   /* 5 to conjecture + 4 chaining corr1..corr5 */
+        memset(nodes, 0, sizeof nodes);
+        nodes[0].id = "conjecture"; nodes[0].is_belief = 1;
+        for (int i = 1; i <= 5; i++) { nodes[i].id = "corr"; seed_grounded(&nodes[i], 0.80, T0); }
+        int ne = 0;
+        for (int i = 1; i <= 5; i++) edges[ne++] = (GepEdge){ 0, i, 0.30, +1 };
+        /* chain corr1-corr2-corr3-corr4-corr5: they are the same source echoed */
+        for (int i = 1; i <= 4; i++) edges[ne++] = (GepEdge){ i, i+1, 0.30, +1 };
+        GepGraph g = { nodes, 6, edges, ne };
+        print_node("conjecture", &nodes[0], T0);
+        beat_and_report(&g, 0, T0, 1, "5 echoed (mutually-linked) corroborators");
+    }
+
+    /* C3 — degenerate echo: literally ONE corroborator reached by 5 parallel edges. */
+    {
+        printf("\n  -- C3: ONE corroborator, reached by 5 parallel edges --\n");
+        static GepNode nodes[2];
+        static GepEdge edges[5];
+        memset(nodes, 0, sizeof nodes);
+        nodes[0].id = "conjecture"; nodes[0].is_belief = 1;
+        nodes[1].id = "corr"; seed_grounded(&nodes[1], 0.80, T0);
+        for (int i = 0; i < 5; i++) edges[i] = (GepEdge){ 0, 1, 0.30, +1 };
+        GepGraph g = { nodes, 2, edges, 5 };
+        print_node("conjecture", &nodes[0], T0);
+        beat_and_report(&g, 0, T0, 1, "same node, 5 parallel edges");
+    }
+
+    printf("\n  RESULT: identical raw fan-in (5) and mass inputs; C1 grounds because\n"
+           "          the corroboration is INDEPENDENT (5 components), C2/C3 do not\n"
+           "          because it collapses to ONE source. Circular self-reinforcement\n"
+           "          cannot manufacture grounding.\n");
+}
+
+int main(void) {
+    printf("GROUNDED EDGE-PROPAGATION — PROOF LEDGER (task #50)\n");
+    printf("constants: BASE=%.2f LIKELY_MIN=%.2f GROUNDED_MIN=%.2f "
+           "N_MIN=%d THETA=%.2f D=%.1f\n",
+           (double)GEP_BASE, (double)GEP_LIKELY_MIN, (double)GEP_GROUNDED_MIN,
+           GEP_N_MIN, (double)GEP_THETA, (double)GEP_DECAY_D);
+    scenario_A();
+    scenario_B();
+    scenario_C();
+    printf("\nDONE.\n");
+    return 0;
+}

engram/spec/grounded-edge-propagation/server.route.patch.el

@@ -0,0 +1,29 @@
+// ─────────────────────────────────────────────────────────────────────────
+// server.route.patch.el — GATED route for task #50, for engram/src/server.el.
+// NOT APPLIED. Exposes the engram_ground_propagate native over HTTP so the
+// soul's consolidation beat can fire one grounded edge-propagation pass.
+// ─────────────────────────────────────────────────────────────────────────
+
+// [1] New handler — add beside route_strengthen (server.el ~line 194).
+//     Mutation (appends grounding events, updates confidence), so it is gated
+//     on _auth via check_auth_ok, exactly like /api/edges. Persists once after
+//     the beat — the whole point of running propagation as one batched beat
+//     rather than per-node is to pay the snapshot cost a single time.
+fn route_ground_propagate(method: String, path: String, body: String) -> String {
+    if !check_auth_ok(method, body) { return err_json("unauthorized") }
+    let tel: String = engram_ground_propagate()   // native — one beat over the store
+    let saved: Int = persist_canonical()
+    return tel                                     // gep_* telemetry JSON straight through
+}
+
+// [2] Dispatch — register in handle_request (server.el ~line 461, next to the
+//     /api/strengthen arm):
+//
+//     if str_eq(method, "POST") && (str_eq(clean, "/api/ground/propagate")) {
+//         return route_ground_propagate(method, clean, body)
+//     }
+//
+// [3] Native declaration — engram_ground_propagate must be declared as an
+//     extern runtime builtin (el_runtime.h) and seed-wrapped (el_seed.c /
+//     el_seed.h __engram_ground_propagate) so the EL side can call it, same as
+//     engram_strengthen / engram_hebb_drain_json.

engram/test/bench_discrimination.c

@@ -0,0 +1,149 @@
+/* bench_discrimination.c — M9 REFINEMENT bench: measures whether mean-centering
+ * the anisotropic nomic-embed-text space sharpens the §5 geometry operators on
+ * REAL data. Read-only over a COPY of the live store (never the live file).
+ *
+ *   usage:  bench_discrimination [store.egm]
+ *           (or set ENGRAM_BENCH_STORE). If no store is given/openable it prints
+ *           SKIP and exits 0 — so it is safe in CI without live data.
+ *
+ * It picks two semantically distinct cohorts by keyword (domain A vs domain B),
+ * computes the global mean over the embed-eligible set (via engram_geo_mean_build
+ * — the same offset the descriptor uses), then reports BEFORE (raw unit space)
+ * vs AFTER (mean-centered space):
+ *   - cross-centroid cosine        (lower = better separated)
+ *   - cross-centroid Euclid dist   (translation-invariant: a control)
+ *   - intra-cohesion per domain    (member cos to own centroid)
+ *   - overlap operator             (cross_cos / sqrt(intraA*intraB): ~1 = domains
+ *                                   indistinguishable, ~0 = cleanly separated)
+ *   - angular separation ratio z   (centroid angle / summed angular spread)
+ *   - mean pairwise cosine sample  (the anisotropy headline; ~0.55 raw -> ~0 ctr)
+ *
+ * Pure C11; links engram_store.c + engram_geometry.c; -lm.
+ */
+#include "engram_store.h"
+#include "engram_geometry.h"
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <strings.h>
+#include <math.h>
+
+#define CAP_DOMAIN 400
+#define CAP_SAMPLE 800
+
+typedef struct { float** v; int n, cap, dim; } VecSet;
+static void vs_init(VecSet* s){ s->v=NULL; s->n=0; s->cap=0; s->dim=0; }
+static void vs_push(VecSet* s, const float* e, int dim, int cap){
+    if(s->n>=cap) return;
+    if(s->dim==0) s->dim=dim;
+    if(s->n==s->cap){ int nc=s->cap?s->cap*2:64; s->v=realloc(s->v,(size_t)nc*sizeof*s->v); s->cap=nc; }
+    float* c=malloc((size_t)dim*sizeof(float));
+    double nn=0; for(int d=0;d<dim;d++) nn+=(double)e[d]*e[d]; nn=sqrt(nn);
+    if(nn<1e-12){ free(c); return; }
+    for(int d=0;d<dim;d++) c[d]=(float)(e[d]/nn);   /* L2-normalized copy */
+    s->v[s->n++]=c;
+}
+static void vs_free(VecSet* s){ for(int i=0;i<s->n;i++) free(s->v[i]); free(s->v); }
+
+typedef struct { VecSet A, B, S; long idx; } Coh;
+static int has(const char* h, const char* n){ return h && strcasestr(h,n)!=NULL; }
+static void cb(const StoreNode* n, void* ctx){
+    Coh* c=ctx;
+    if(!(n->emb && n->emb_dim>0)) return;
+    /* every 5th embedded node -> isotropy sample */
+    if((c->idx++ % 5)==0) vs_push(&c->S, n->emb, n->emb_dim, CAP_SAMPLE);
+    const char* t=n->content; const char* g=n->tags;
+    int A = has(t,"quantiz")||has(g,"quantiz")||has(t,"lorablation")||has(t,"70B")||has(t,"LoRA merge");
+    int B = has(t,"kubernetes")||has(t,"terraform")||has(t,"argo")||has(g,"infrastructure")||has(t,"vault")||has(t,"cloudflare");
+    if(A && !B) vs_push(&c->A, n->emb, n->emb_dim, CAP_DOMAIN);
+    else if(B && !A) vs_push(&c->B, n->emb, n->emb_dim, CAP_DOMAIN);
+}
+
+/* mean of a VecSet into out (dim doubles). */
+static void mean_of(const VecSet* s, const float* gm, double* out){
+    int dim=s->dim; for(int d=0;d<dim;d++) out[d]=0;
+    for(int i=0;i<s->n;i++) for(int d=0;d<dim;d++) out[d]+=(double)s->v[i][d]-(gm?gm[d]:0.0);
+    if(s->n) for(int d=0;d<dim;d++) out[d]/=s->n;
+}
+static double dnorm(const double* a, int dim){ double s=0; for(int d=0;d<dim;d++) s+=a[d]*a[d]; return sqrt(s); }
+static double dcos(const double* a, const double* b, int dim){
+    double na=dnorm(a,dim), nb=dnorm(b,dim); if(na<1e-12||nb<1e-12) return 0;
+    double s=0; for(int d=0;d<dim;d++) s+=a[d]*b[d]; double c=s/(na*nb);
+    if(c>1)c=1; if(c<-1)c=-1; return c;
+}
+static double deuclid(const double* a, const double* b, int dim){
+    double s=0; for(int d=0;d<dim;d++){ double x=a[d]-b[d]; s+=x*x; } return sqrt(s);
+}
+/* mean cosine of members (minus gm) to centroid c (already gm-subtracted). */
+static double cohesion(const VecSet* s, const float* gm, const double* c){
+    int dim=s->dim; double nc=dnorm(c,dim); if(nc<1e-12||s->n==0) return 0;
+    double acc=0; for(int i=0;i<s->n;i++){
+        double dot=0, nv=0;
+        for(int d=0;d<dim;d++){ double v=(double)s->v[i][d]-(gm?gm[d]:0.0); dot+=v*c[d]; nv+=v*v; }
+        nv=sqrt(nv); if(nv<1e-12) continue; double cc=dot/(nv*nc);
+        if(cc>1)cc=1; if(cc<-1)cc=-1; acc+=cc;
+    }
+    return acc/s->n;
+}
+/* mean pairwise cosine over a sample (isotropy metric). */
+static double mean_pairwise_cos(const VecSet* s, const float* gm){
+    int dim=s->dim; if(s->n<2) return 0; double acc=0; long np=0;
+    for(int i=0;i<s->n;i++) for(int j=i+1;j<s->n;j++){
+        double dot=0, na=0, nb=0;
+        for(int d=0;d<dim;d++){ double a=(double)s->v[i][d]-(gm?gm[d]:0.0), b=(double)s->v[j][d]-(gm?gm[d]:0.0);
+            dot+=a*b; na+=a*a; nb+=b*b; }
+        na=sqrt(na); nb=sqrt(nb); if(na<1e-12||nb<1e-12) continue;
+        double c=dot/(na*nb); if(c>1)c=1; if(c<-1)c=-1; acc+=c; np++;
+    }
+    return np? acc/np : 0;
+}
+
+static void report(const char* label, Coh* c, const float* gm){
+    int dim=c->A.dim; double* ca=malloc((size_t)dim*sizeof(double)); double* cb=malloc((size_t)dim*sizeof(double));
+    mean_of(&c->A, gm, ca); mean_of(&c->B, gm, cb);
+    double xcos=dcos(ca,cb,dim), xeuc=deuclid(ca,cb,dim);
+    double cohA=cohesion(&c->A,gm,ca), cohB=cohesion(&c->B,gm,cb);
+    double overlap = (cohA>0&&cohB>0)? xcos/sqrt(cohA*cohB) : xcos;
+    double theta = acos(xcos<-1?-1:(xcos>1?1:xcos));
+    double sig = acos(cohA<-1?-1:(cohA>1?1:cohA)) + acos(cohB<-1?-1:(cohB>1?1:cohB));
+    double z = (sig>1e-9)? theta/sig : 0;
+    double mpc = mean_pairwise_cos(&c->S, gm);
+    printf("  [%s]\n", label);
+    printf("    cross-centroid cosine   = %+.4f   (lower = better separated)\n", xcos);
+    printf("    cross-centroid Euclid   =  %.4f   (translation-invariant control)\n", xeuc);
+    printf("    intra-cohesion A / B    =  %.4f / %.4f\n", cohA, cohB);
+    printf("    OVERLAP operator        =  %.4f   (~1 = indistinguishable, ~0 = clean)\n", overlap);
+    printf("    angular separation z    =  %.3f   (centroid-angle / summed spread; >1 = separated)\n", z);
+    printf("    mean pairwise cosine    = %+.4f   (isotropy: ~0.55 anisotropic -> ~0 isotropic)\n", mpc);
+    free(ca); free(cb);
+}
+
+int main(int argc, char** argv){
+    const char* path = (argc>1)? argv[1] : getenv("ENGRAM_BENCH_STORE");
+    if(!path){ printf("SKIP: no store path (arg or ENGRAM_BENCH_STORE)\n"); return 0; }
+    EngramPagedStore* st=store_open(path);
+    if(!st){ printf("SKIP: could not open %s\n", path); return 0; }
+
+    Coh c; vs_init(&c.A); vs_init(&c.B); vs_init(&c.S); c.idx=0;
+    store_scan_nodes(st, cb, &c);
+    printf("=== two-domain discrimination bench (real store copy) ===\n");
+    printf("domain A (quantization) n=%d ; domain B (infrastructure) n=%d ; sample n=%d ; dim=%d\n",
+           c.A.n, c.B.n, c.S.n, c.A.dim);
+    if(c.A.n<3 || c.B.n<3){ printf("SKIP: a cohort is too small to be meaningful\n");
+        vs_free(&c.A); vs_free(&c.B); vs_free(&c.S); store_close(st); return 0; }
+
+    GeoMeanCache* mc=engram_geo_mean_build(st);
+    const float* gm=engram_geo_mean_vec(mc);
+    printf("global-mean cache: dim=%d over %llu embedded nodes\n\n",
+           engram_geo_mean_dim(mc), (unsigned long long)engram_geo_mean_count(mc));
+
+    printf("BEFORE (raw anisotropic unit space):\n");
+    report("RAW", &c, NULL);
+    printf("\nAFTER (mean-centered isotropic space):\n");
+    report("CENTERED", &c, gm);
+
+    engram_geo_mean_free(mc);
+    vs_free(&c.A); vs_free(&c.B); vs_free(&c.S);
+    store_close(st);
+    return 0;
+}

engram/test/run_bufpool_tests.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# M4 demand-paging buffer-pool gate. Pure C (NOT elb/elc). Writes only under /tmp.
+# Runs the suite twice: an -O2 correctness build and an ASan+UBSan build.
+set -e
+HERE="$(cd "$(dirname "$0")" && pwd)"
+SRC="$HERE/../../lang/runtime/engram_store.c"
+TST="$HERE/test_bufpool.c"
+
+echo "== compiling (gcc -O2): test_bufpool.c engram_store.c =="
+BIN="/tmp/test_bufpool.$$"
+gcc -O2 -Wall -Wextra -std=c11 "$TST" "$SRC" -o "$BIN"
+"$BIN"; rc=$?
+rm -f "$BIN"; rm -rf /tmp/engram-bufpool-test-*
+[ $rc -ne 0 ] && exit $rc
+
+echo
+echo "== ASan+UBSan build (memory-error + UB checks; LSan unavailable on macOS) =="
+ABIN="/tmp/test_bufpool_asan.$$"
+gcc -O1 -g -fsanitize=address,undefined -fno-omit-frame-pointer -std=c11 "$TST" "$SRC" -o "$ABIN"
+ASAN_OPTIONS=detect_leaks=0 UBSAN_OPTIONS=halt_on_error=1 "$ABIN"; rc=$?
+rm -f "$ABIN"; rm -rf /tmp/engram-bufpool-test-*
+exit $rc

engram/test/run_compaction_tests.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# M5 online-compaction + background-checkpointer gate. Pure C (NOT elb/elc).
+# Writes only under /tmp. Runs an -O2 correctness build then an ASan+UBSan build.
+set -e
+HERE="$(cd "$(dirname "$0")" && pwd)"
+SRC="$HERE/../../lang/runtime/engram_store.c"
+TST="$HERE/test_compaction.c"
+
+echo "== compiling (gcc -O2): test_compaction.c engram_store.c =="
+BIN="/tmp/test_compaction.$$"
+gcc -O2 -Wall -Wextra -std=c11 "$TST" "$SRC" -o "$BIN"
+"$BIN"; rc=$?
+rm -f "$BIN"; rm -rf /tmp/engram-compact-test-*
+[ $rc -ne 0 ] && exit $rc
+
+echo
+echo "== ASan+UBSan build (memory-error + UB checks; LSan unavailable on macOS) =="
+ABIN="/tmp/test_compaction_asan.$$"
+gcc -O1 -g -fsanitize=address,undefined -fno-omit-frame-pointer -std=c11 "$TST" "$SRC" -o "$ABIN"
+ASAN_OPTIONS=detect_leaks=0 UBSAN_OPTIONS=halt_on_error=1 "$ABIN"; rc=$?
+rm -f "$ABIN"; rm -rf /tmp/engram-compact-test-*
+exit $rc

engram/test/run_geometry_tests.sh

@@ -0,0 +1,30 @@
+#!/bin/sh
+# Build + RUN the M9 FOUNDATION geometry-descriptor tests. Pure C11 (gcc/cc),
+# stdlib + libm only. Standalone module — NOT folded through elb/elc. Two passes:
+#   1. PERF   — optimised (-O2, no sanitizer): the functional gate.
+#   2. SAFETY — ASan + UBSan on the same suite (memory-safety is size-independent).
+set -e
+HERE=$(cd "$(dirname "$0")" && pwd)
+RT="$HERE/../../lang/runtime"
+CC=${CC:-cc}
+SRC="$HERE/test_geometry.c $RT/engram_geometry.c $RT/engram_store.c $RT/engram_vindex.c"
+WARN="-std=c11 -Wall -Wextra"
+TMP=$(mktemp -d)
+
+echo "### PASS 1: PERF (optimised, un-sanitised) — functional gate"
+$CC $WARN -O2 -I"$RT" $SRC -lm -o "$TMP/perf"
+"$TMP/perf"
+
+echo
+echo "### PASS 2: SAFETY (ASan/UBSan)"
+$CC $WARN -O1 -g -fsanitize=address,undefined -fno-omit-frame-pointer -I"$RT" $SRC -lm -o "$TMP/safe"
+ASAN_OPTIONS=${ASAN_OPTIONS:-detect_leaks=0} UBSAN_OPTIONS=halt_on_error=1 "$TMP/safe"
+
+# PASS 3 (OPTIONAL): mean-centering discrimination bench on a COPY of a real
+# store. Skips cleanly unless ENGRAM_BENCH_STORE points at a store .egm — never
+# touches the live store. Read-only; not part of the pass/fail gate.
+echo
+echo "### PASS 3: DISCRIMINATION BENCH (optional; set ENGRAM_BENCH_STORE)"
+BSRC="$HERE/bench_discrimination.c $RT/engram_geometry.c $RT/engram_store.c $RT/engram_vindex.c"
+$CC $WARN -O2 -I"$RT" $BSRC -lm -o "$TMP/bench"
+"$TMP/bench" "${ENGRAM_BENCH_STORE:-}"

engram/test/run_interoception_p0.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+# M-INTEROCEPTION P0 gate: engram_scan_nodes_emb_json read-only builtin.
+# Throwaway HOME + /tmp only. Never touches ~/.neuron or :8742.
+set -u
+HERE="$(cd "$(dirname "$0")" && pwd)"
+RT="$HERE/../../lang/runtime/el_runtime.c"
+ST="$HERE/../../lang/runtime/engram_store.c"
+GEO="$HERE/../../lang/runtime/engram_geometry.c"
+VIDX="$HERE/../../lang/runtime/engram_vindex.c"
+INC="$HERE/../../lang/runtime"
+WORK="$(mktemp -d /tmp/engram-p0-XXXXXX)"
+export HOME="$WORK/home"; mkdir -p "$HOME"
+unset ENGRAM_STORE
+fail=0
+
+echo "== compile (plain) =="
+gcc -O1 -std=c11 -I "$INC" "$HERE/test_interoception_p0_emb.c" "$RT" "$ST" "$GEO" "$VIDX" \
+    -lcurl -lm -o "$WORK/p0" 2>"$WORK/cc.log" || { echo "COMPILE FAILED"; cat "$WORK/cc.log"; rm -rf "$WORK"; exit 1; }
+
+D="$WORK/d"; mkdir -p "$D"
+"$WORK/p0" "$D" || { echo "FAIL: run"; fail=1; }
+
+echo
+echo "== assertions =="
+python3 - "$D" <<'PY'
+import json, sys, os
+d = sys.argv[1]
+def load(n):
+    with open(os.path.join(d,n)) as f: return json.load(f)
+rc = 0
+def check(c,m):
+    global rc
+    print(("  PASS: " if c else "  FAIL: ")+m)
+    if not c: rc=1
+
+alln = load("emb_all.json")
+check(len(alln)==3, f"emb dump returns all 3 nodes (got {len(alln)})")
+# salience-sorted: high, mid, low
+labels=[n["label"] for n in alln]
+check(labels==["emb-high","emb-mid","noemb-low"], f"salience-sorted order {labels}")
+for n in alln:
+    L=len(n["emb"])
+    check(L==n["emb_dim"], f"{n['label']}: len(emb)={L} == emb_dim={n['emb_dim']}")
+check(alln[0]["emb_dim"]==16 and alln[1]["emb_dim"]==16, "embedded nodes report dim 16")
+check(alln[2]["emb_dim"]==0 and alln[2]["emb"]==[], "un-embedded node -> emb_dim 0, emb []")
+# first emb value round-trips ~0.10
+check(abs(alln[0]["emb"][0]-0.10)<1e-3, f"emb[0] round-trips (~0.10, got {alln[0]['emb'][0]})")
+
+pg0=load("emb_pg0.json"); pg1=load("emb_pg1.json")
+check(len(pg0)==1 and len(pg1)==1, "pagination: one node per page")
+check(pg0[0]["id"]=="n-high" and pg1[0]["id"]=="n-mid", f"pages disjoint & ordered ({pg0[0]['id']},{pg1[0]['id']})")
+
+plain=load("plain.json")
+check(len(plain)==3, "existing scan_nodes_json still returns 3")
+check(all("emb" not in n for n in plain), "existing scan_nodes_json carries NO emb (behavior-neutral)")
+sys.exit(rc)
+PY
+[ $? -ne 0 ] && fail=1
+
+echo
+echo "== latency (one 256-page over the 3-node copy) =="
+python3 - "$D" <<'PY'
+import os
+# timing was measured inside C not here; report emb payload size as a proxy
+sz=os.path.getsize(os.path.join(os.sys.argv[1] if False else __import__('sys').argv[1],"emb_all.json"))
+print(f"  emb_all.json payload = {sz} bytes for 3 nodes")
+PY
+
+echo
+echo "== ASan+UBSan =="
+gcc -O1 -g -std=c11 -fsanitize=address,undefined -fno-sanitize-recover=undefined \
+    -I "$INC" "$HERE/test_interoception_p0_emb.c" "$RT" "$ST" "$GEO" "$VIDX" \
+    -lcurl -lm -o "$WORK/p0.san" 2>"$WORK/san_cc.log" || { echo "SAN COMPILE FAILED"; tail -20 "$WORK/san_cc.log"; fail=1; }
+if [ -x "$WORK/p0.san" ]; then
+  export ASAN_OPTIONS=detect_leaks=0
+  DS="$WORK/ds"; mkdir -p "$DS"
+  "$WORK/p0.san" "$DS" >/dev/null 2>"$WORK/san_run.log"
+  if grep -qiE 'runtime error|AddressSanitizer|Sanitizer|ERROR: ' "$WORK/san_run.log"; then
+    echo "  FAIL: sanitizer findings:"; grep -iE 'runtime error|Sanitizer|ERROR' "$WORK/san_run.log" | head; fail=1
+  else echo "  ok: ASan+UBSan clean"; fi
+fi
+
+echo
+if [ "$fail" -eq 0 ]; then echo "====== P0 EMB-ENDPOINT GATE: PASS ======"; else echo "====== P0 EMB-ENDPOINT GATE: FAIL ======"; fi
+rm -rf "$WORK"
+exit $fail

engram/test/run_interoception_p1.sh

@@ -0,0 +1,147 @@
+#!/usr/bin/env bash
+# M-INTEROCEPTION P1 gate: two-threshold consolidation (ENGRAM_CONSOLIDATION).
+# Throwaway HOME + /tmp only. Never touches ~/.neuron or :8742.
+set -u
+HERE="$(cd "$(dirname "$0")" && pwd)"
+RT="$HERE/../../lang/runtime/el_runtime.c"
+ST="$HERE/../../lang/runtime/engram_store.c"
+GEO="$HERE/../../lang/runtime/engram_geometry.c"
+VIDX="$HERE/../../lang/runtime/engram_vindex.c"
+INC="$HERE/../../lang/runtime"
+WORK="$(mktemp -d /tmp/engram-p1-XXXXXX)"
+export HOME="$WORK/home"; mkdir -p "$HOME"
+unset ENGRAM_STORE ENGRAM_CONSOLIDATION ENGRAM_CONSOL_CONN_MIN ENGRAM_CONSOL_PERM_MIN ENGRAM_CONSOL_WM_TOPK
+fail=0
+
+echo "== compile =="
+gcc -O1 -std=c11 -I "$INC" "$HERE/test_interoception_p1_consol.c" "$RT" "$ST" "$GEO" "$VIDX" \
+    -lcurl -lm -o "$WORK/p1" 2>"$WORK/cc.log" || { echo "COMPILE FAILED"; cat "$WORK/cc.log"; rm -rf "$WORK"; exit 1; }
+
+echo
+echo "== (a) HEADLINE: hebb accrual curve over N co-activations (flag OFF, pure trunk) =="
+D="$WORK/a"; mkdir -p "$D"
+( unset ENGRAM_CONSOLIDATION; "$WORK/p1" accrual "$D" ) >"$WORK/accrual.txt" 2>&1 || { echo "FAIL accrual run"; fail=1; }
+python3 - "$WORK/accrual.txt" <<'PY'
+import json,sys,re
+rows=[]
+for line in open(sys.argv[1]):
+    m=re.match(r'SAMPLE (\d+) (\{.*\})',line.strip())
+    if not m: continue
+    n=int(m.group(1)); j=json.loads(m.group(2))
+    hm=j.get("hebb_max",0.0); hc=j.get("hebb_cand_max",0.0)
+    rows.append((n,hm,hc))
+print("    N       hebb_max     1-0.9999^N (predicted EWMA)")
+rc=0
+for n,hm,hc in rows:
+    pred=1-0.9999**n
+    print(f"    {n:<7} {hm:<12.6g} {pred:.6g}")
+# assertions: monotonic rise, starts near ETA, tracks EWMA prediction
+first=rows[0]; last=rows[-1]
+def check(c,m):
+    global rc; print(("  PASS: " if c else "  FAIL: ")+m);
+    if not c: rc=1
+check(abs(first[1]-0.0001)<5e-5, f"first sample hebb ~= ETA 0.0001 (got {first[1]:.6g})")
+check(all(rows[i][1] <= rows[i+1][1]+1e-9 for i in range(len(rows)-1)), "hebb_max is monotonically non-decreasing over N")
+check(last[1] > first[1]*50, f"hebb accrues substantially by N={last[0]} (got {last[1]:.4g} vs {first[1]:.4g})")
+# EWMA fit: measured should be within 25% of 1-0.9999^N at the mid samples
+mid=[r for r in rows if 100<=r[0]<=2000]
+ok=all(abs(hm-(1-0.9999**n))/(1-0.9999**n) < 0.25 for n,hm,hc in mid)
+check(ok, "measured curve tracks the 1-0.9999^N EWMA prediction within 25% (co-activation P~1)")
+sys.exit(rc)
+PY
+[ $? -ne 0 ] && fail=1
+
+echo
+echo "== (b) CONNECTION threshold: strong ISE wires to wm_top, weak ISE wires nothing (flag ON) =="
+D="$WORK/b"; mkdir -p "$D"
+( export ENGRAM_CONSOLIDATION=1; "$WORK/p1" connect "$D" ) >"$WORK/connect.txt" 2>&1 || { echo "FAIL connect run"; fail=1; }
+cat "$WORK/connect.txt" | sed 's/^/    /'
+python3 - "$WORK/connect.txt" "$D/connect.json" <<'PY'
+import json,sys,re
+txt=open(sys.argv[1]).read()
+g=json.load(open(sys.argv[2]))
+def field(k):
+    m=re.search(rf'{k} (\S+)',txt); return m.group(1) if m else None
+sid=field("ISE_STRONG_ID"); wid=field("ISE_WEAK_ID")
+m=re.search(r'EDGES before=(\d+) after_strong=(\d+) after_weak=(\d+)',txt)
+before,aftS,aftW=int(m.group(1)),int(m.group(2)),int(m.group(3))
+rc=0
+def check(c,mm):
+    global rc; print(("  PASS: " if c else "  FAIL: ")+mm)
+    if not c: rc=1
+strong_edges=[e for e in g["edges"] if e["from_id"]==sid and e["relation"]=="hebbian-associate"]
+weak_edges=[e for e in g["edges"] if e["from_id"]==wid]
+check(aftS>before, f"strong ISE formed connection edges ({before} -> {aftS})")
+check(aftW==aftS, f"weak ISE formed NO edges ({aftS} -> {aftW})")
+check(len(strong_edges)>=1, f"strong ISE has {len(strong_edges)} hebbian-associate edge(s) to wm_top")
+check(all('consolidated-from-ISE' in (e.get('metadata') or '') for e in strong_edges),
+      "connection edges are provenance-tagged consolidated-from-ISE (reversible)")
+check(len(weak_edges)==0, "weak ISE (below connection bar) has zero outgoing edges")
+# targets must be the WM-top nodes (hebb-a / hebb-b), not distractors
+tgt_labels=set()
+byid={n["id"]:n for n in g["nodes"]}
+for e in strong_edges:
+    t=byid.get(e["to_id"]);
+    if t: tgt_labels.add(t.get("label"))
+print(f"    connection targets: {sorted(tgt_labels)}")
+check(tgt_labels.issubset({"hebb-a","hebb-b"}) and len(tgt_labels)>=1,
+      f"connections point at the wm_top nodes {sorted(tgt_labels)}")
+sys.exit(rc)
+PY
+[ $? -ne 0 ] && fail=1
+
+echo
+echo "== (c) PERMANENCE threshold: promoted node survives 48h prune, ephemeral is swept (flag ON) =="
+D="$WORK/c"; mkdir -p "$D"
+( export ENGRAM_CONSOLIDATION=1 ENGRAM_CONSOL_PERM_MIN=-1000; "$WORK/p1" perm "$D" ) >"$WORK/perm.txt" 2>&1 || { echo "FAIL perm run"; fail=1; }
+cat "$WORK/perm.txt" | sed 's/^/    /'
+python3 - "$WORK/perm.txt" <<'PY'
+import sys,re,json
+txt=open(sys.argv[1]).read()
+rc=0
+def check(c,m):
+    global rc; print(("  PASS: " if c else "  FAIL: ")+m)
+    if not c: rc=1
+prom=int(re.search(r'PROMOTED (\d+)',txt).group(1))
+m=re.search(r'NODES before=(\d+) after=(\d+) removed=(\d+)',txt)
+before,after,removed=int(m.group(1)),int(m.group(2)),int(m.group(3))
+dur=re.search(r'DURABLE_NODE (\{.*\})',txt).group(1)
+eph=re.search(r'EPHEMERAL_NODE (\{.*\})',txt).group(1)
+durj=json.loads(dur); ephj=json.loads(eph)
+check(prom==1, "engram_consolidate_permanence promoted the node (returned 1)")
+check(before==2 and after==1 and removed==1, f"exactly one node pruned ({before}->{after}, removed={removed})")
+check(durj.get("id")=="ise-durable", "durable node SURVIVED the 48h telemetry prune")
+check('consolidated-from-ISE' in (durj.get("metadata") or ''), "durable node carries reversible provenance marker")
+check(ephj=={} or not ephj.get("id"), "ephemeral (non-permanent) ISE was swept")
+sys.exit(rc)
+PY
+[ $? -ne 0 ] && fail=1
+
+echo
+echo "== (d) OFF path byte-identical: ISE creation forms no edges, permanence is a no-op =="
+D="$WORK/d"; mkdir -p "$D"
+( unset ENGRAM_CONSOLIDATION; "$WORK/p1" offcheck "$D" ) >"$WORK/off.txt" 2>&1
+rcoff=$?
+cat "$WORK/off.txt" | sed 's/^/    /'
+[ $rcoff -eq 0 ] && echo "  PASS: flag OFF — ISE creation added 0 edges and permanence returned 0" \
+                 || { echo "  FAIL: OFF path changed behavior"; fail=1; }
+
+echo
+echo "== ASan+UBSan (connect + perm + accrual-short) =="
+gcc -O1 -g -std=c11 -fsanitize=address,undefined -fno-sanitize-recover=undefined \
+    -I "$INC" "$HERE/test_interoception_p1_consol.c" "$RT" "$ST" "$GEO" "$VIDX" \
+    -lcurl -lm -o "$WORK/p1.san" 2>"$WORK/san_cc.log" || { echo "SAN COMPILE FAILED"; tail -25 "$WORK/san_cc.log"; fail=1; }
+if [ -x "$WORK/p1.san" ]; then
+  export ASAN_OPTIONS=detect_leaks=0
+  DS="$WORK/san"; mkdir -p "$DS"
+  ( export ENGRAM_CONSOLIDATION=1 ENGRAM_CONSOL_PERM_MIN=-1000; "$WORK/p1.san" connect "$DS" ) >/dev/null 2>"$WORK/san_run.log"
+  ( export ENGRAM_CONSOLIDATION=1 ENGRAM_CONSOL_PERM_MIN=-1000; "$WORK/p1.san" perm "$DS" ) >/dev/null 2>>"$WORK/san_run.log"
+  if grep -qiE 'runtime error|AddressSanitizer|Sanitizer|ERROR: ' "$WORK/san_run.log"; then
+    echo "  FAIL: sanitizer findings:"; grep -iE 'runtime error|Sanitizer|ERROR' "$WORK/san_run.log" | head; fail=1
+  else echo "  ok: ASan+UBSan clean"; fi
+fi
+
+echo
+if [ "$fail" -eq 0 ]; then echo "====== P1 CONSOLIDATION GATE: PASS ======"; else echo "====== P1 CONSOLIDATION GATE: FAIL ======"; fi
+rm -rf "$WORK"
+exit $fail

engram/test/run_interoception_p2.sh

@@ -0,0 +1,96 @@
+#!/usr/bin/env bash
+# M-INTEROCEPTION P2 gate: chronoception (ENGRAM_CHRONOCEPTION).
+# Throwaway HOME + /tmp only. TC defaults to 3600s; we pin it for the math.
+set -u
+HERE="$(cd "$(dirname "$0")" && pwd)"
+RT="$HERE/../../lang/runtime/el_runtime.c"
+ST="$HERE/../../lang/runtime/engram_store.c"
+GEO="$HERE/../../lang/runtime/engram_geometry.c"
+VIDX="$HERE/../../lang/runtime/engram_vindex.c"
+INC="$HERE/../../lang/runtime"
+WORK="$(mktemp -d /tmp/engram-p2-XXXXXX)"
+export HOME="$WORK/home"; mkdir -p "$HOME"
+export ENGRAM_CHRONO_TC=3600           # pin cooling time-constant for the math
+unset ENGRAM_STORE
+fail=0
+
+echo "== compile =="
+gcc -O1 -std=c11 -I "$INC" "$HERE/test_interoception_p2_chrono.c" "$RT" "$ST" "$GEO" "$VIDX" \
+    -lcurl -lm -o "$WORK/p2" 2>"$WORK/cc.log" || { echo "COMPILE FAILED"; cat "$WORK/cc.log"; rm -rf "$WORK"; exit 1; }
+
+sum_wm(){ python3 -c "import json,sys; g=json.load(open('$1')); print(sum(n.get('working_memory_weight',0) for n in g['nodes']))"; }
+
+echo
+echo "== (a) cooling scales with dt (flag ON) =="
+for DT in 600000 1800000 3600000 7200000; do    # 600s,1800s,3600s,7200s at TC=3600
+  D="$WORK/dt$DT"; mkdir -p "$D"
+  ( export ENGRAM_CHRONOCEPTION=1; "$WORK/p2" once "$D" "$DT" ) >"$D/out.txt" 2>&1
+  MAG=$(grep MAGNITUDE "$D/out.txt" | awk '{print $2}')
+  WM=$(sum_wm "$D/field.json")
+  PRED=$(python3 -c "import math; print(round(1-math.exp(-$DT/1000/3600),6))")
+  echo "    dt=${DT}ms  magnitude=$MAG  predicted 1-exp(-dt/TC)=$PRED  field_wm_sum=$WM"
+  python3 -c "import sys; m=float('$MAG'); p=float('$PRED'); sys.exit(0 if abs(m-p)<1e-4 else 1)" \
+     && echo "      PASS: magnitude matches exp cooling" || { echo "      FAIL"; fail=1; }
+done
+
+echo
+echo "== (b) SCALE-INVARIANCE: age(dt) once == age(dt/N) N times (field within float tol) =="
+DT=3600000
+for N in 2 10 100; do
+  DA="$WORK/inv_once_$N"; DB="$WORK/inv_split_$N"; mkdir -p "$DA" "$DB"
+  ( export ENGRAM_CHRONOCEPTION=1; "$WORK/p2" once  "$DA" "$DT" )      >/dev/null 2>&1
+  ( export ENGRAM_CHRONOCEPTION=1; "$WORK/p2" split "$DB" "$DT" "$N" ) >/dev/null 2>&1
+  WA=$(sum_wm "$DA/field.json"); WB=$(sum_wm "$DB/field.json")
+  echo "    N=$N  once_wm=$WA  split_wm=$WB  |delta|=$(python3 -c "print(abs($WA-$WB))")"
+  python3 -c "import sys; sys.exit(0 if abs($WA-$WB)<1e-9 else 1)" \
+     && echo "      PASS: scale-invariant within 1e-9" || { echo "      FAIL: not scale-invariant"; fail=1; }
+done
+
+echo
+echo "== (c) REBOOT catch-up: one-shot cooling from persisted last-tick, reports MAGNITUDE not seconds =="
+D="$WORK/catch"; mkdir -p "$D"
+GAP=3600000   # 1h unconscious
+( export ENGRAM_CHRONOCEPTION=1 ENGRAM_DATA_DIR="$D"; "$WORK/p2" catchup "$D" "$GAP" ) >"$D/out.txt" 2>&1
+CMAG=$(grep CATCHUP_MAGNITUDE "$D/out.txt" | awk '{print $2}')
+CWM=$(sum_wm "$D/field.json")
+PRED=$(python3 -c "import math; print(round(1-math.exp(-$GAP/1000/3600),4))")
+echo "    gap=${GAP}ms  catchup_magnitude=$CMAG  predicted=$PRED  field_wm_sum=$CWM (was 0.6)"
+python3 -c "import sys; sys.exit(0 if abs(float('$CMAG')-float('$PRED'))<1e-2 else 1)" \
+   && echo "      PASS: one-shot catch-up cooled by the elapsed gap, surfaced as a magnitude" \
+   || { echo "      FAIL"; fail=1; }
+# honesty rail: magnitude is bounded [0,1), NOT an elapsed-seconds number
+python3 -c "import sys; m=float('$CMAG'); sys.exit(0 if 0<=m<1 else 1)" \
+   && echo "      PASS: magnitude is a bounded drift signal in [0,1), never elapsed seconds" \
+   || { echo "      FAIL: magnitude out of [0,1)"; fail=1; }
+
+echo
+echo "== (d) OFF path: flag unset -> age & catchup return 0, field untouched =="
+D="$WORK/off"; mkdir -p "$D"
+( unset ENGRAM_CHRONOCEPTION; export ENGRAM_DATA_DIR="$D"; "$WORK/p2" offcheck "$D" 3600000 ) >"$D/out.txt" 2>&1
+cat "$D/out.txt" | sed 's/^/    /'
+OFFWM=$(sum_wm "$D/field.json")
+# loaded field wm sum = (1.0+0.8+0.6)*0.5 halving = 1.2 ; must be UNCHANGED
+echo "    field_wm_sum=$OFFWM (expected 1.2, unchanged)"
+python3 -c "import sys; sys.exit(0 if abs($OFFWM-1.2)<1e-9 else 1)" \
+   && echo "      PASS: OFF path leaves the field byte-identical (no aging)" \
+   || { echo "      FAIL: OFF path modified the field"; fail=1; }
+
+echo
+echo "== ASan+UBSan =="
+gcc -O1 -g -std=c11 -fsanitize=address,undefined -fno-sanitize-recover=undefined \
+    -I "$INC" "$HERE/test_interoception_p2_chrono.c" "$RT" "$ST" "$GEO" "$VIDX" \
+    -lcurl -lm -o "$WORK/p2.san" 2>"$WORK/san_cc.log" || { echo "SAN COMPILE FAILED"; tail -25 "$WORK/san_cc.log"; fail=1; }
+if [ -x "$WORK/p2.san" ]; then
+  export ASAN_OPTIONS=detect_leaks=0
+  DS="$WORK/san"; mkdir -p "$DS"
+  ( export ENGRAM_CHRONOCEPTION=1 ENGRAM_DATA_DIR="$DS"; "$WORK/p2.san" once "$DS" 3600000 ) >/dev/null 2>"$WORK/san.log"
+  ( export ENGRAM_CHRONOCEPTION=1 ENGRAM_DATA_DIR="$DS"; "$WORK/p2.san" catchup "$DS" 3600000 ) >/dev/null 2>>"$WORK/san.log"
+  if grep -qiE 'runtime error|AddressSanitizer|Sanitizer|ERROR: ' "$WORK/san.log"; then
+    echo "  FAIL: sanitizer findings:"; grep -iE 'runtime error|Sanitizer|ERROR' "$WORK/san.log" | head; fail=1
+  else echo "  ok: ASan+UBSan clean"; fi
+fi
+
+echo
+if [ "$fail" -eq 0 ]; then echo "====== P2 CHRONOCEPTION GATE: PASS ======"; else echo "====== P2 CHRONOCEPTION GATE: FAIL ======"; fi
+rm -rf "$WORK"
+exit $fail

engram/test/run_interoception_p3.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+# M-INTEROCEPTION P3 gate: drift-sensor primitive engram_geo_displacement.
+# Read-only pure primitive; no store, no flag. Throwaway /tmp only.
+set -u
+HERE="$(cd "$(dirname "$0")" && pwd)"
+RT="$HERE/../../lang/runtime/el_runtime.c"
+ST="$HERE/../../lang/runtime/engram_store.c"
+GEO="$HERE/../../lang/runtime/engram_geometry.c"
+VIDX="$HERE/../../lang/runtime/engram_vindex.c"
+INC="$HERE/../../lang/runtime"
+WORK="$(mktemp -d /tmp/engram-p3-XXXXXX)"
+export HOME="$WORK/home"; mkdir -p "$HOME"
+fail=0
+
+echo "== compile =="
+gcc -O1 -std=c11 -I "$INC" "$HERE/test_interoception_p3_drift.c" "$RT" "$ST" "$GEO" "$VIDX" \
+    -lcurl -lm -o "$WORK/p3" 2>"$WORK/cc.log" || { echo "COMPILE FAILED"; cat "$WORK/cc.log"; rm -rf "$WORK"; exit 1; }
+
+"$WORK/p3" > "$WORK/out.txt" 2>&1 || { echo "FAIL run"; cat "$WORK/out.txt"; fail=1; }
+cat "$WORK/out.txt" | sed 's/^/    /'
+
+echo
+echo "== assertions =="
+python3 - "$WORK/out.txt" <<'PY'
+import sys,re
+rows={}
+for line in open(sys.argv[1]):
+    m=re.match(r'(\w+) (.*)',line.strip())
+    if not m: continue
+    tag=m.group(1); kv=dict(re.findall(r'(\w+)=([-\d.]+)',m.group(2)))
+    rows[tag]={k:float(v) for k,v in kv.items()}
+rc=0
+def check(c,msg):
+    global rc; print(("  PASS: " if c else "  FAIL: ")+msg)
+    if not c: rc=1
+g=rows["GROWTH"]; c=rows["CORRUPTION"]; i=rows["IDENTITY"]
+check(g["core_disp"]<0.05, f"GROWTH: core displacement ~0 (core fixed) = {g['core_disp']}")
+check(g["periph_disp"]>0.30, f"GROWTH: periphery extended = {g['periph_disp']}")
+check(g["centroid_sep"]<1e-6, f"GROWTH: centroid unmoved = {g['centroid_sep']}")
+check(abs(g["radius_delta"]-0.4)<1e-4, f"GROWTH: radius grew by ~0.4 = {g['radius_delta']}")
+check(c["core_disp"]>0.40, f"CORRUPTION: core displaced strongly = {c['core_disp']}")
+check(c["periph_disp"]<0.05, f"CORRUPTION: periphery fixed = {c['periph_disp']}")
+check(c["centroid_sep"]>0.1, f"CORRUPTION: centroid moved = {c['centroid_sep']}")
+check(c["core_disp"] > 8*g["core_disp"]+0.3,
+      f"SENSOR DISCRIMINATES: corruption core_disp ({c['core_disp']}) >> growth core_disp ({g['core_disp']})")
+check(i["core_disp"]==0 and i["periph_disp"]==0 and i["centroid_sep"]<1e-6,
+      "IDENTITY: A vs A -> zero drift")
+sys.exit(rc)
+PY
+[ $? -ne 0 ] && fail=1
+
+echo
+echo "== ASan+UBSan =="
+gcc -O1 -g -std=c11 -fsanitize=address,undefined -fno-sanitize-recover=undefined \
+    -I "$INC" "$HERE/test_interoception_p3_drift.c" "$RT" "$ST" "$GEO" "$VIDX" \
+    -lcurl -lm -o "$WORK/p3.san" 2>"$WORK/san_cc.log" || { echo "SAN COMPILE FAILED"; tail -25 "$WORK/san_cc.log"; fail=1; }
+if [ -x "$WORK/p3.san" ]; then
+  export ASAN_OPTIONS=detect_leaks=0
+  "$WORK/p3.san" >/dev/null 2>"$WORK/san.log"
+  if grep -qiE 'runtime error|AddressSanitizer|Sanitizer|ERROR: ' "$WORK/san.log"; then
+    echo "  FAIL: sanitizer findings:"; grep -iE 'runtime error|Sanitizer|ERROR' "$WORK/san.log" | head; fail=1
+  else echo "  ok: ASan+UBSan clean"; fi
+fi
+
+echo
+if [ "$fail" -eq 0 ]; then echo "====== P3 DRIFT-SENSOR GATE: PASS ======"; else echo "====== P3 DRIFT-SENSOR GATE: FAIL ======"; fi
+rm -rf "$WORK"
+exit $fail

engram/test/run_interoception_p4.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+# M-INTEROCEPTION P4 gate: afferent input counters in act-stats (additive).
+set -u
+HERE="$(cd "$(dirname "$0")" && pwd)"
+RT="$HERE/../../lang/runtime/el_runtime.c"
+ST="$HERE/../../lang/runtime/engram_store.c"
+GEO="$HERE/../../lang/runtime/engram_geometry.c"
+VIDX="$HERE/../../lang/runtime/engram_vindex.c"
+INC="$HERE/../../lang/runtime"
+WORK="$(mktemp -d /tmp/engram-p4-XXXXXX)"
+export HOME="$WORK/home"; mkdir -p "$HOME"
+unset ENGRAM_STORE
+fail=0
+
+echo "== compile =="
+gcc -O1 -std=c11 -I "$INC" "$HERE/test_interoception_p4_afferent.c" "$RT" "$ST" "$GEO" "$VIDX" \
+    -lcurl -lm -o "$WORK/p4" 2>"$WORK/cc.log" || { echo "COMPILE FAILED"; cat "$WORK/cc.log"; rm -rf "$WORK"; exit 1; }
+
+"$WORK/p4" > "$WORK/out.txt" 2>&1 || { echo "FAIL run"; cat "$WORK/out.txt"; fail=1; }
+grep -oE 'aff_[a-z_]+":[0-9]+' "$WORK/out.txt" | sed 's/^/    /' | head -30
+
+echo
+echo "== assertions =="
+python3 - "$WORK/out.txt" <<'PY'
+import sys,re,json
+S={}
+for line in open(sys.argv[1]):
+    m=re.match(r'(STATS\d) (\{.*\})',line.strip())
+    if m: S[m.group(1)]=json.loads(m.group(2))
+rc=0
+def check(c,msg):
+    global rc; print(("  PASS: " if c else "  FAIL: ")+msg)
+    if not c: rc=1
+s0,s1,s2=S["STATS0"],S["STATS1"],S["STATS2"]
+# after creation, before any query
+check(s0["aff_node_creates"]==5, f"node_creates==5 (got {s0['aff_node_creates']})")
+check(s0["aff_ise_ingests"]==2,  f"ise_ingests==2 (got {s0['aff_ise_ingests']})")
+check(s0["aff_edge_creates"]==2, f"edge_creates==2 (got {s0['aff_edge_creates']})")
+check(s0["aff_queries"]==0 and s0["aff_activations"]==0, "queries/activations start at 0")
+# after 4 queries
+check(s1["aff_queries"]==4, f"queries==4 (got {s1['aff_queries']})")
+check(s1["aff_activations"]==4, f"activations==4 (got {s1['aff_activations']})")
+check(s1["aff_node_creates"]==5 and s1["aff_ise_ingests"]==2 and s1["aff_edge_creates"]==2,
+      "create counters unchanged by queries")
+# after 3 more queries — monotonic
+check(s2["aff_queries"]==7, f"queries==7 monotonic (got {s2['aff_queries']})")
+check(s2["aff_activations"]==7, f"activations==7 monotonic (got {s2['aff_activations']})")
+check(s2["aff_queries"]>s1["aff_queries"]>s0["aff_queries"], "queries strictly monotonic across readings")
+sys.exit(rc)
+PY
+[ $? -ne 0 ] && fail=1
+
+echo
+echo "== ASan+UBSan =="
+gcc -O1 -g -std=c11 -fsanitize=address,undefined -fno-sanitize-recover=undefined \
+    -I "$INC" "$HERE/test_interoception_p4_afferent.c" "$RT" "$ST" "$GEO" "$VIDX" \
+    -lcurl -lm -o "$WORK/p4.san" 2>"$WORK/san_cc.log" || { echo "SAN COMPILE FAILED"; tail -25 "$WORK/san_cc.log"; fail=1; }
+if [ -x "$WORK/p4.san" ]; then
+  export ASAN_OPTIONS=detect_leaks=0
+  "$WORK/p4.san" >/dev/null 2>"$WORK/san.log"
+  if grep -qiE 'runtime error|AddressSanitizer|Sanitizer|ERROR: ' "$WORK/san.log"; then
+    echo "  FAIL: sanitizer findings:"; grep -iE 'runtime error|Sanitizer|ERROR' "$WORK/san.log" | head; fail=1
+  else echo "  ok: ASan+UBSan clean"; fi
+fi
+
+echo
+if [ "$fail" -eq 0 ]; then echo "====== P4 AFFERENT-COUNTERS GATE: PASS ======"; else echo "====== P4 AFFERENT-COUNTERS GATE: FAIL ======"; fi
+rm -rf "$WORK"
+exit $fail

engram/test/run_interoception_p5.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+# M-INTEROCEPTION P5 gate: dream-recall builtin engram_dreams_json (honesty rail).
+set -u
+HERE="$(cd "$(dirname "$0")" && pwd)"
+RT="$HERE/../../lang/runtime/el_runtime.c"
+ST="$HERE/../../lang/runtime/engram_store.c"
+GEO="$HERE/../../lang/runtime/engram_geometry.c"
+VIDX="$HERE/../../lang/runtime/engram_vindex.c"
+INC="$HERE/../../lang/runtime"
+WORK="$(mktemp -d /tmp/engram-p5-XXXXXX)"
+export HOME="$WORK/home"; mkdir -p "$HOME"
+unset ENGRAM_STORE
+fail=0
+
+echo "== compile =="
+gcc -O1 -std=c11 -I "$INC" "$HERE/test_interoception_p5_dreams.c" "$RT" "$ST" "$GEO" "$VIDX" \
+    -lcurl -lm -o "$WORK/p5" 2>"$WORK/cc.log" || { echo "COMPILE FAILED"; cat "$WORK/cc.log"; rm -rf "$WORK"; exit 1; }
+
+D="$WORK/d"; mkdir -p "$D"
+"$WORK/p5" "$D" > "$WORK/out.txt" 2>&1 || { echo "FAIL run"; cat "$WORK/out.txt"; fail=1; }
+cat "$WORK/out.txt" | sed 's/^/    /'
+
+echo
+echo "== assertions =="
+python3 - "$WORK/out.txt" <<'PY'
+import sys,re,json
+L={}
+for line in open(sys.argv[1]):
+    line=line.strip()
+    m=re.match(r'(BEFORE|AFTER) (\[.*\])',line)
+    if m: L[m.group(1)]=json.loads(m.group(2)); continue
+    m=re.match(r'PRUNED (\d+)',line)
+    if m: L['PRUNED']=int(m.group(1)); continue
+    m=re.match(r'SINCE (\d+) (\[.*\])',line)
+    if m: L['SINCE']=json.loads(m.group(2))
+rc=0
+def check(c,msg):
+    global rc; print(("  PASS: " if c else "  FAIL: ")+msg)
+    if not c: rc=1
+before_ids={d["id"] for d in L["BEFORE"]}
+after_ids={d["id"] for d in L["AFTER"]}
+since_ids={d["id"] for d in L["SINCE"]}
+check(before_ids=={"cur_old","cur_mid","cur_recent"}, f"before prune: all 3 curiosity_scan, heartbeat excluded (got {sorted(before_ids)})")
+check("hb_recent" not in before_ids, "heartbeat ISE never appears (not a dream)")
+check(L["PRUNED"]==1, f"prune rotated out exactly the ancient ISE (pruned={L['PRUNED']})")
+check(after_ids=={"cur_mid","cur_recent"}, f"after prune: rotated-out cur_old is ABSENT, not confabulated (got {sorted(after_ids)})")
+check("cur_old" not in after_ids, "honesty rail: pruned dream is gone = 'I don't remember', never synthesized")
+check(since_ids=={"cur_recent"}, f"since filter returns only events after the cutoff (got {sorted(since_ids)})")
+# no fabrication: every returned id was one we seeded
+seeded={"cur_old","cur_mid","cur_recent","hb_recent"}
+allret=before_ids|after_ids|since_ids
+check(allret<=seeded, f"no fabricated entries — every returned id was seeded ({sorted(allret)})")
+sys.exit(rc)
+PY
+[ $? -ne 0 ] && fail=1
+
+echo
+echo "== ASan+UBSan =="
+gcc -O1 -g -std=c11 -fsanitize=address,undefined -fno-sanitize-recover=undefined \
+    -I "$INC" "$HERE/test_interoception_p5_dreams.c" "$RT" "$ST" "$GEO" "$VIDX" \
+    -lcurl -lm -o "$WORK/p5.san" 2>"$WORK/san_cc.log" || { echo "SAN COMPILE FAILED"; tail -25 "$WORK/san_cc.log"; fail=1; }
+if [ -x "$WORK/p5.san" ]; then
+  export ASAN_OPTIONS=detect_leaks=0
+  DS="$WORK/ds"; mkdir -p "$DS"
+  "$WORK/p5.san" "$DS" >/dev/null 2>"$WORK/san.log"
+  if grep -qiE 'runtime error|AddressSanitizer|Sanitizer|ERROR: ' "$WORK/san.log"; then
+    echo "  FAIL: sanitizer findings:"; grep -iE 'runtime error|Sanitizer|ERROR' "$WORK/san.log" | head; fail=1
+  else echo "  ok: ASan+UBSan clean"; fi
+fi
+
+echo
+if [ "$fail" -eq 0 ]; then echo "====== P5 DREAM-RECALL GATE: PASS ======"; else echo "====== P5 DREAM-RECALL GATE: FAIL ======"; fi
+rm -rf "$WORK"
+exit $fail

engram/test/run_m35_hebb_persist.sh

@@ -0,0 +1,158 @@
+#!/usr/bin/env bash
+# M3.5 PRE-FLIP GATE. Pure C harness (NOT elb/elc): links the real el_runtime.c
+# native engram builtins + engram_store.c and proves activation-time field
+# mutations (edge hebb, node activation_count, WM weight) persist through a
+# checkpoint and survive a reboot from neuron.egm with snapshot.json DELETED.
+# Writes ONLY under a throwaway /tmp dir with a throwaway HOME.
+set -u
+HERE="$(cd "$(dirname "$0")" && pwd)"
+RT="$HERE/../../lang/runtime/el_runtime.c"
+ST="$HERE/../../lang/runtime/engram_store.c"
+INC="$HERE/../../lang/runtime"
+WORK="$(mktemp -d /tmp/engram-m35-XXXXXX)"
+BIN="$WORK/m35"
+export HOME="$WORK/home"; mkdir -p "$HOME"          # never touch real ~/.neuron
+export ENGRAM_WAL_SYNC=always
+unset ENGRAM_STORE
+fail=0
+
+echo "== compiling harness (gcc: el_runtime.c + engram_store.c + test_m35_hebb_persist.c) =="
+gcc -O1 -std=c11 -I "$INC" "$HERE/test_m35_hebb_persist.c" "$RT" "$ST" -lcurl -o "$BIN" 2>"$WORK/cc.log"
+if [ $? -ne 0 ]; then echo "COMPILE FAILED:"; cat "$WORK/cc.log"; rm -rf "$WORK"; exit 1; fi
+
+echo
+echo "== 0) flag-OFF: seed+activate+checkpoint must NOT touch the store =="
+DOFF="$WORK/off"; mkdir -p "$DOFF"
+( unset ENGRAM_STORE; "$BIN" offcheck "$DOFF" )
+[ $? -ne 0 ] && { echo "FAIL: offcheck"; fail=1; }
+[ -e "$DOFF/neuron.egm" ] && { echo "FAIL: neuron.egm created while flag OFF"; fail=1; } \
+                          || echo "  ok: no neuron.egm created with flag OFF"
+
+echo
+echo "== 1) POSITIVE: ENGRAM_STORE=1 seed -> activate -> checkpoint(field-persist) -> close =="
+DPOS="$WORK/pos"; mkdir -p "$DPOS"
+ENGRAM_STORE=1 "$BIN" pos_seed "$DPOS" || { echo "FAIL: pos_seed"; fail=1; }
+[ -e "$DPOS/neuron.egm" ] && echo "  ok: neuron.egm created" || { echo "FAIL: neuron.egm missing"; fail=1; }
+
+echo
+echo "== 2) reboot from neuron.egm with snapshot.json DELETED (must never read JSON) =="
+rm -f "$DPOS/snapshot.json"
+ENGRAM_STORE=1 "$BIN" pos_reboot "$DPOS" || { echo "FAIL: pos_reboot"; fail=1; }
+
+echo
+echo "== 3) NEGATIVE CONTROL: seed -> activate -> close WITHOUT the field-persist checkpoint =="
+DNEG="$WORK/neg"; mkdir -p "$DNEG"
+ENGRAM_STORE=1 "$BIN" neg_seed "$DNEG" || { echo "FAIL: neg_seed"; fail=1; }
+rm -f "$DNEG/snapshot.json"
+ENGRAM_STORE=1 "$BIN" neg_reboot "$DNEG" || { echo "FAIL: neg_reboot"; fail=1; }
+
+echo
+echo "== 4) assertions (python over the JSON exports) =="
+python3 - "$DPOS" "$DNEG" <<'PY'
+import json, sys, os
+WM_FLOOR = 0.05
+HEBB_MIN = 1e-6
+
+def load(d, name):
+    with open(os.path.join(d, name)) as f: return json.load(f)
+
+def node_by_label(g, label):
+    for n in g["nodes"]:
+        if n.get("label") == label: return n
+    return None
+
+def edge_between(g, a_id, b_id):
+    for e in g["edges"]:
+        if e.get("from_id") == a_id and e.get("to_id") == b_id:
+            return e
+    return None
+
+rc = 0
+def check(cond, msg):
+    global rc
+    if cond: print(f"  PASS: {msg}")
+    else:    print(f"  FAIL: {msg}"); rc = 1
+
+dpos, dneg = sys.argv[1], sys.argv[2]
+pre  = load(dpos, "pre_reboot.json")
+rebt = load(dpos, "reboot.json")
+
+pa, pb = node_by_label(pre, "hebb-a"), node_by_label(pre, "hebb-b")
+ra     = node_by_label(rebt, "hebb-a")
+assert pa and pb and ra, "target nodes missing"
+pe = edge_between(pre,  pa["id"], pb["id"])
+re = edge_between(rebt, pa["id"], pb["id"])
+assert pe and re, "target edge missing"
+
+pre_hebb  = pe.get("hebb", 0.0)
+rebt_hebb = re.get("hebb", 0.0)
+pre_ac    = pa.get("activation_count", 0)
+rebt_ac   = ra.get("activation_count", 0)
+pre_wm    = pa.get("working_memory_weight", 0.0)
+rebt_wm   = ra.get("working_memory_weight", 0.0)
+
+print(f"    edge hebb-a->hebb-b : pre={pre_hebb!r}  reboot={rebt_hebb!r}")
+print(f"    node hebb-a act_cnt : pre={pre_ac!r}  reboot={rebt_ac!r}")
+print(f"    node hebb-a wm      : pre={pre_wm!r}  reboot={rebt_wm!r}  (halved+floored expected)")
+
+# --- learning actually happened this run (else the test proves nothing) ---
+check(pre_hebb > HEBB_MIN,      f"activation raised edge hebb above 0 (pre={pre_hebb})")
+check(pre_ac  >= 1,             f"activation reinforced node activation_count (pre={pre_ac})")
+check(pre_wm  > 0.0,            f"activation promoted node to working memory (pre_wm={pre_wm})")
+
+# --- the load-bearing survival assertions after a real delete-JSON reboot ---
+check(abs(rebt_hebb - pre_hebb) < 1e-12,
+      f"edge hebb SURVIVED reboot unchanged ({rebt_hebb} == {pre_hebb})")
+check(rebt_ac == pre_ac,
+      f"node activation_count SURVIVED reboot unchanged ({rebt_ac} == {pre_ac})")
+
+# --- WM weight: must equal the JSON path's boot transform exactly (halve+floor) ---
+expected_wm = pre_wm * 0.5
+if expected_wm < WM_FLOOR: expected_wm = 0.0
+check(abs(rebt_wm - expected_wm) < 1e-9,
+      f"node WM weight SURVIVED with the SAME boot transform as JSON path "
+      f"(reboot={rebt_wm} == halve+floor(pre)={expected_wm})")
+check(expected_wm > 0.0,
+      f"WM survival is observable (halved weight stays above floor: {expected_wm} > {WM_FLOOR})")
+
+# --- NEGATIVE CONTROL: without the field-persist step the learning is LOST ---
+npre  = load(dneg, "neg_pre.json")
+nrebt = load(dneg, "neg_reboot.json")
+na_pre  = node_by_label(npre,  "hebb-a")
+na_rebt = node_by_label(nrebt, "hebb-a")
+ne_pre  = edge_between(npre,  na_pre["id"], node_by_label(npre, "hebb-b")["id"])
+ne_rebt = edge_between(nrebt, na_rebt["id"], node_by_label(nrebt, "hebb-b")["id"])
+print(f"    [neg] edge hebb     : pre={ne_pre.get('hebb',0.0)!r}  reboot={ne_rebt.get('hebb',0.0)!r}")
+print(f"    [neg] node act_cnt  : pre={na_pre.get('activation_count',0)!r}  reboot={na_rebt.get('activation_count',0)!r}")
+check(ne_pre.get("hebb", 0.0) > HEBB_MIN,
+      f"[neg] activation DID raise hebb in RAM (pre={ne_pre.get('hebb',0.0)})")
+check(ne_rebt.get("hebb", 0.0) == 0.0,
+      "[neg] WITHOUT checkpoint field-persist, edge hebb is LOST on reboot (==0) — fix is load-bearing")
+check(na_rebt.get("activation_count", 0) == 0,
+      "[neg] WITHOUT checkpoint field-persist, activation_count is LOST on reboot (==0)")
+
+sys.exit(rc)
+PY
+[ $? -ne 0 ] && fail=1
+
+echo
+echo "== 5) ASan+UBSan build, exercise the full persist+reboot flow (leaks off — harness intentionally leaks el_strdup) =="
+SANBIN="$WORK/m35.san"
+gcc -O1 -g -std=c11 -fsanitize=address,undefined -fno-sanitize-recover=undefined \
+    -I "$INC" "$HERE/test_m35_hebb_persist.c" "$RT" "$ST" -lcurl -o "$SANBIN" 2>"$WORK/san_cc.log"
+if [ $? -ne 0 ]; then echo "  SAN COMPILE FAILED:"; tail -20 "$WORK/san_cc.log"; fail=1; else
+  export ASAN_OPTIONS=detect_leaks=0
+  DSAN="$WORK/san"; mkdir -p "$DSAN"
+  ENGRAM_STORE=1 "$SANBIN" pos_seed "$DSAN" >/dev/null 2>"$WORK/san_run.log" && \
+  { rm -f "$DSAN/snapshot.json"; ENGRAM_STORE=1 "$SANBIN" pos_reboot "$DSAN" >/dev/null 2>>"$WORK/san_run.log"; }
+  if grep -qiE 'runtime error|AddressSanitizer|UndefinedBehavior|ERROR: ' "$WORK/san_run.log"; then
+    echo "  FAIL: sanitizer findings:"; grep -iE 'runtime error|Sanitizer|ERROR' "$WORK/san_run.log" | head; fail=1
+  else
+    echo "  ok: ASan+UBSan clean across pos_seed/checkpoint/reboot (field-persist, boot laundering)"
+  fi
+fi
+
+echo
+if [ "$fail" -eq 0 ]; then echo "================  M3.5 HEBB-PERSIST GATE: PASS  ================"; else echo "================  M3.5 HEBB-PERSIST GATE: FAIL  ================"; fi
+rm -rf "$WORK"
+exit $fail

engram/test/run_m3_parity.sh

@@ -0,0 +1,126 @@
+#!/usr/bin/env bash
+# M3 JSON-parity gate. Pure C harness (NOT elb/elc): links the real el_runtime.c
+# native engram builtins + engram_store.c and drives ENGRAM_STORE on vs off.
+# Writes ONLY under a throwaway /tmp dir with a throwaway HOME + ENGRAM_DATA_DIR.
+set -u
+HERE="$(cd "$(dirname "$0")" && pwd)"
+RT="$HERE/../../lang/runtime/el_runtime.c"
+ST="$HERE/../../lang/runtime/engram_store.c"
+INC="$HERE/../../lang/runtime"
+WORK="$(mktemp -d /tmp/engram-m3-XXXXXX)"
+DATA="$WORK/data"; mkdir -p "$DATA"
+BIN="$WORK/m3"
+export HOME="$WORK/home"; mkdir -p "$HOME"          # never touch real ~/.neuron
+export ENGRAM_DATA_DIR="$DATA"
+export ENGRAM_WAL_SYNC=always
+unset ENGRAM_STORE
+fail=0
+
+echo "== compiling harness (gcc: el_runtime.c + engram_store.c + test_m3_parity.c) =="
+gcc -O1 -std=c11 -I "$INC" "$HERE/test_m3_parity.c" "$RT" "$ST" -lcurl -o "$BIN" 2>"$WORK/cc.log"
+if [ $? -ne 0 ]; then echo "COMPILE FAILED:"; cat "$WORK/cc.log"; rm -rf "$WORK"; exit 1; fi
+grep -i warning "$WORK/cc.log" | grep -iE 'engram_store|eg_store|eg_load|scan_nodes|scan_edges' && echo "(warnings in M3 code above)" || true
+
+echo
+echo "== 0) default-OFF: flag unset leaves the store untouched =="
+( unset ENGRAM_STORE; "$BIN" offcheck "$DATA" )
+[ $? -ne 0 ] && { echo "FAIL: offcheck"; fail=1; }
+[ -e "$DATA/neuron.egm" ] && { echo "FAIL: neuron.egm created while flag OFF"; fail=1; } \
+                          || echo "  ok: no neuron.egm created with flag OFF"
+
+echo
+echo "== 1) seed (ENGRAM_STORE unset): build graph, save snapshot.json, activate =="
+( unset ENGRAM_STORE; "$BIN" seed "$DATA" ) || { echo "FAIL: seed"; fail=1; }
+
+echo
+echo "== 2) on (ENGRAM_STORE=1): import snapshot.json ONCE -> neuron.egm, resident-load, activate =="
+ENGRAM_STORE=1 "$BIN" on "$DATA" || { echo "FAIL: on"; fail=1; }
+[ -e "$DATA/neuron.egm" ] && echo "  ok: neuron.egm created by import" || { echo "FAIL: neuron.egm missing"; fail=1; }
+
+echo
+echo "== 3) reboot (ENGRAM_STORE=1, snapshot.json DELETED): must load from neuron.egm, never JSON =="
+rm -f "$DATA/snapshot.json"
+ENGRAM_STORE=1 "$BIN" reboot "$DATA" || { echo "FAIL: reboot"; fail=1; }
+
+echo
+echo "== 4) parity comparison (modulo ordering) =="
+python3 - "$DATA" <<'PY'
+import json, sys, os
+d = sys.argv[1]
+def load(name):
+    with open(os.path.join(d, name)) as f: return json.load(f)
+def norm_graph(g):
+    nodes = sorted(g.get("nodes", []), key=lambda n: n.get("id",""))
+    edges = sorted(g.get("edges", []), key=lambda e: e.get("id",""))
+    layers= sorted(g.get("layers", []), key=lambda l: l.get("layer_id",0))
+    return {"nodes":nodes, "edges":edges, "layers":layers}
+def act_ids(a):
+    # list of (node id, promoted); robust set + ordered list
+    seq = [(e.get("node",{}).get("id",""), int(e.get("promoted",0))) for e in a]
+    return seq
+
+rc = 0
+snap  = norm_graph(load("snapshot.json") if os.path.exists(os.path.join(d,"snapshot.json")) else load("off_graph.json"))
+off   = norm_graph(load("off_graph.json"))
+on    = norm_graph(load("on_graph.json"))
+rebt  = norm_graph(load("reboot_graph.json"))
+
+def cmp(label, a, b):
+    global rc
+    if a == b:
+        print(f"  PASS: {label}  (nodes={len(a['nodes'])} edges={len(a['edges'])} layers={len(a['layers'])})")
+    else:
+        rc = 1
+        print(f"  FAIL: {label}")
+        for k in ("nodes","edges","layers"):
+            if a[k] != b[k]:
+                print(f"    {k}: {len(a[k])} vs {len(b[k])}")
+                for x,y in zip(a[k], b[k]):
+                    if x != y:
+                        print(f"    first diff:\n      A={json.dumps(x)[:300]}\n      B={json.dumps(y)[:300]}")
+                        break
+
+cmp("graph: ENGRAM_STORE=1 (export) == ENGRAM_STORE=0 (JSON path)", on, off)
+cmp("round-trip: snapshot.json seed == store export (on_graph)", on, off)  # off_graph==snapshot save
+cmp("reboot from neuron.egm (no JSON) == on-path store", rebt, on)
+
+offa = act_ids(load("off_act.json"))
+ona  = act_ids(load("on_act.json"))
+if set(offa) == set(ona):
+    print(f"  PASS: activation result set identical  (off={len(offa)} on={len(ona)} entries)")
+    if offa == ona:
+        print("        (and identical ordering/promotion sequence)")
+    else:
+        print("        (same set; ordering differs only where scores tie — reporting honestly)")
+else:
+    rc = 1
+    print("  FAIL: activation result set differs")
+    print(f"    off-only: {set(offa)-set(ona)}")
+    print(f"    on-only:  {set(ona)-set(offa)}")
+
+sys.exit(rc)
+PY
+[ $? -ne 0 ] && fail=1
+
+echo
+echo "== 5) ASan+UBSan build, exercise M3 scan/boot/hooks (leaks off — harness intentionally leaks el_strdup) =="
+SANBIN="$WORK/m3.san"
+gcc -O1 -g -std=c11 -fsanitize=address,undefined -fno-sanitize-recover=undefined \
+    -I "$INC" "$HERE/test_m3_parity.c" "$RT" "$ST" -lcurl -o "$SANBIN" 2>"$WORK/san_cc.log"
+if [ $? -ne 0 ]; then echo "  SAN COMPILE FAILED:"; tail -20 "$WORK/san_cc.log"; fail=1; else
+  export ASAN_OPTIONS=detect_leaks=0
+  DATA2="$WORK/data2"; mkdir -p "$DATA2"
+  ( unset ENGRAM_STORE; "$SANBIN" seed "$DATA2" ) >/dev/null 2>"$WORK/san_run.log" && \
+  ENGRAM_STORE=1 "$SANBIN" on "$DATA2" >/dev/null 2>>"$WORK/san_run.log" && \
+  { rm -f "$DATA2/snapshot.json"; ENGRAM_STORE=1 "$SANBIN" reboot "$DATA2" >/dev/null 2>>"$WORK/san_run.log"; }
+  if grep -qiE 'runtime error|AddressSanitizer|UndefinedBehavior|ERROR: ' "$WORK/san_run.log"; then
+    echo "  FAIL: sanitizer findings:"; grep -iE 'runtime error|Sanitizer|ERROR' "$WORK/san_run.log" | head; fail=1
+  else
+    echo "  ok: ASan+UBSan clean across seed/on/reboot (scan, boot, resident-load, mutation hooks)"
+  fi
+fi
+
+echo
+if [ "$fail" -eq 0 ]; then echo "================  M3 PARITY GATE: PASS  ================"; else echo "================  M3 PARITY GATE: FAIL  ================"; fi
+rm -rf "$WORK"
+exit $fail

engram/test/run_m7_traversal.sh

@@ -0,0 +1,137 @@
+#!/usr/bin/env bash
+# M7 index-driven-traversal gate. Pure C harness (NOT elb/elc): links the real
+# el_runtime.c engram builtins + engram_store.c and drives ENGRAM_STORE off vs on.
+# Proves (1) byte-identical activation parity flag-on == flag-off across a
+# mutating query sequence, and (2) the O(E)-rebuild cost is eliminated flag-on.
+# Writes ONLY under a throwaway /tmp dir with a throwaway HOME.
+set -u
+HERE="$(cd "$(dirname "$0")" && pwd)"
+RT="$HERE/../../lang/runtime/el_runtime.c"
+ST="$HERE/../../lang/runtime/engram_store.c"
+INC="$HERE/../../lang/runtime"
+WORK="$(mktemp -d /tmp/engram-m7-XXXXXX)"
+DATA="$WORK/data"; mkdir -p "$DATA"
+BIN="$WORK/m7"
+export HOME="$WORK/home"; mkdir -p "$HOME"          # never touch real ~/.neuron
+# Hermetic: point the embedder at a guaranteed-refused endpoint so eg_embed_fetch
+# fails fast, the circuit breaker opens, and cosq is deterministically absent in
+# EVERY run (no dependence on whether a dev Ollama happens to be listening). This
+# makes the byte-identical parity comparison reproducible and non-flaky.
+export EL_EMBED_URL="http://127.0.0.1:1/api/embeddings"
+unset ENGRAM_STORE
+fail=0
+
+echo "== compiling harness (gcc: el_runtime.c + engram_store.c + test_m7_traversal.c) =="
+gcc -O2 -std=c11 -I "$INC" "$HERE/test_m7_traversal.c" "$RT" "$ST" -lcurl -lm -o "$BIN" 2>"$WORK/cc.log"
+if [ $? -ne 0 ]; then echo "COMPILE FAILED:"; cat "$WORK/cc.log"; rm -rf "$WORK"; exit 1; fi
+echo "  ok: compiled"
+
+echo
+echo "== 1) PARITY: index-driven (M7 incremental) activation must be IDENTICAL to the"
+echo "        full-rebuild scan path — proven under one identical ENGRAM_STORE=1 state,"
+echo "        so the ONLY variable is how per-node adjacency is maintained."
+echo "   (compared on deterministic fields: node label + activation_strength +"
+echo "    working_memory_weight + epistemic_confidence + hops + promoted, IN ORDER;"
+echo "    node id/timestamps are per-run random and are intentionally excluded.)"
+( unset ENGRAM_STORE; "$BIN" parity-off          "$DATA" ) || { echo "FAIL: parity-off run"; fail=1; }
+ENGRAM_STORE=1        "$BIN" parity-on-rebuild    "$DATA"   || { echo "FAIL: parity-on-rebuild run"; fail=1; }
+ENGRAM_STORE=1        "$BIN" parity-on-incr       "$DATA"   || { echo "FAIL: parity-on-incr run"; fail=1; }
+python3 - "$DATA" <<'PY' || fail=1
+import json, sys, os
+d = sys.argv[1]
+def proj(prefix, i):
+    a = json.load(open(os.path.join(d, f"{prefix}_act{i}.json")))
+    out = []
+    for e in a:
+        n = e.get("node", {})
+        out.append([n.get("label",""),
+                    e.get("activation_strength"), e.get("working_memory_weight"),
+                    e.get("epistemic_confidence"), e.get("hops"), e.get("promoted")])
+    return out
+def compare(label, pa, pb, gate):
+    rc = 0
+    for i in (1,2,3,4):
+        a, b = proj(pa, i), proj(pb, i)
+        if a == b:
+            print(f"    #{i} identical  (entries={len(a)}, promoted={sum(1 for r in a if r[5])})")
+        else:
+            if gate: rc = 1
+            print(f"    #{i} DIFFERS ({'FAIL' if gate else 'note'})")
+            for x,y in zip(a,b):
+                if x != y:
+                    print(f"       first diff:\n         {pa}={x}\n         {pb}={y}"); break
+            if len(a) != len(b): print(f"       length: {pa}={len(a)} {pb}={len(b)}")
+    print(f"  {'PASS' if rc==0 else 'FAIL'}: {label}")
+    return rc
+
+print("  [CORE M7 GATE] flag-on incremental index  ==  flag-on forced full rebuild:")
+rc1 = compare("index-driven activation == full-rebuild scan (same flag state)",
+              "onincr", "onrb", gate=True)
+print("  [context] flag-on incremental index  vs  flag-off scan path (today's behavior):")
+rc2 = compare("M7 (flag-on) == flag-off scan path", "onincr", "off", gate=False)
+print("  [context] flag-off scan  vs  flag-on forced rebuild (isolates any pre-existing")
+print("            flag-on/off float difference, INDEPENDENT of M7's incremental path):")
+rc3 = compare("flag-off == flag-on (both rebuild path)", "off", "onrb", gate=False)
+sys.exit(rc1)   # only the core M7 equivalence gates the result
+PY
+
+echo
+echo "== 2) PERF: ~13k nodes / 43k edges, 200 (add-edge + activate) iterations =="
+NODES=13000; EDGES=43000; ITERS=120
+( unset ENGRAM_STORE; "$BIN" perf off "$DATA" "$NODES" "$EDGES" "$ITERS" ) | tee "$WORK/perf_off.txt"
+[ ${PIPESTATUS[0]} -ne 0 ] && { echo "FAIL: perf off"; fail=1; }
+ENGRAM_STORE=1        "$BIN" perf on  "$DATA" "$NODES" "$EDGES" "$ITERS"   | tee "$WORK/perf_on.txt"
+[ ${PIPESTATUS[0]} -ne 0 ] && { echo "FAIL: perf on"; fail=1; }
+python3 - "$WORK/perf_off.txt" "$WORK/perf_on.txt" <<'PY'
+import re, sys
+def parse(f):
+    t = open(f).read()
+    def g(k):
+        m = re.search(k+r'=([\d.]+)', t); return float(m.group(1)) if m else 0.0
+    return {'rw': g('rebuild_edge_work'), 'rb': g('rebuilds'), 'ap': g('incr_appends'),
+            'loop_s': g('loop='), 'maint': g('adj_maint'),
+            'perq': g('per_query')}
+off, on = parse(sys.argv[1]), parse(sys.argv[2])
+def ratio(a,b): return (a/b) if b else float('inf')
+print()
+print(f"  ADJACENCY TRAVERSAL COST (the metric M7 changes):")
+print(f"    edge-touches in rebuilds:  off={off['rw']:.0f}  on={on['rw']:.0f}   "
+      f"({ratio(off['rw'],on['rw']):.0f}x fewer on)")
+print(f"    full O(E) rebuilds:        off={off['rb']:.0f}  on={on['rb']:.0f}")
+print(f"    incremental O(1) appends:  off={off['ap']:.0f}  on={on['ap']:.0f}")
+print(f"    adjacency-maint wall-time: off={off['maint']:.4f}s  on={on['maint']:.4f}s   "
+      f"({ratio(off['maint'],on['maint']):.1f}x faster on)")
+print(f"  END-TO-END per-query time:   off={off['perq']:.2f}ms  on={on['perq']:.2f}ms")
+print(f"    (per-query is dominated by activation's O(N) node scoring over 13k nodes,")
+print(f"     which M7 does not touch; the delta is the eliminated rebuild time.)")
+ok = on['rw'] < off['rw'] and on['maint'] < off['maint'] and on['rb'] < off['rb']
+print("  PASS: flag-on eliminates the O(E) per-query rebuild (fewer edge-touches, less maint time)"
+      if ok else "  FAIL: expected fewer edge-touches AND less adjacency-maint time on flag-on")
+sys.exit(0 if ok else 1)
+PY
+[ $? -ne 0 ] && fail=1
+
+echo
+echo "== 3) ASan+UBSan clean across parity + a small perf loop (leaks off — harness intentionally leaks el_strdup) =="
+SANBIN="$WORK/m7.san"
+gcc -O1 -g -std=c11 -fsanitize=address,undefined -fno-sanitize-recover=undefined \
+    -I "$INC" "$HERE/test_m7_traversal.c" "$RT" "$ST" -lcurl -lm -o "$SANBIN" 2>"$WORK/san_cc.log"
+if [ $? -ne 0 ]; then echo "  SAN COMPILE FAILED:"; tail -20 "$WORK/san_cc.log"; fail=1; else
+  export ASAN_OPTIONS=detect_leaks=0
+  D2="$WORK/data2"; mkdir -p "$D2"
+  ( unset ENGRAM_STORE; "$SANBIN" parity-off       "$D2" ) >/dev/null 2>"$WORK/san_run.log" && \
+  ENGRAM_STORE=1        "$SANBIN" parity-on-rebuild "$D2"   >/dev/null 2>>"$WORK/san_run.log" && \
+  ENGRAM_STORE=1        "$SANBIN" parity-on-incr    "$D2"   >/dev/null 2>>"$WORK/san_run.log" && \
+  ( unset ENGRAM_STORE; "$SANBIN" perf off "$D2" 1500 5000 40 ) >/dev/null 2>>"$WORK/san_run.log" && \
+  ENGRAM_STORE=1        "$SANBIN" perf on  "$D2" 1500 5000 40    >/dev/null 2>>"$WORK/san_run.log"
+  if grep -qiE 'runtime error|AddressSanitizer|UndefinedBehavior|ERROR: ' "$WORK/san_run.log"; then
+    echo "  FAIL: sanitizer findings:"; grep -iE 'runtime error|Sanitizer|ERROR' "$WORK/san_run.log" | head; fail=1
+  else
+    echo "  ok: ASan+UBSan clean across parity + perf (rebuild + incremental append + BFS)"
+  fi
+fi
+
+echo
+if [ "$fail" -eq 0 ]; then echo "================  M7 TRAVERSAL GATE: PASS  ================"; else echo "================  M7 TRAVERSAL GATE: FAIL  ================"; fi
+rm -rf "$WORK"
+exit $fail

engram/test/run_reason_tests.sh

@@ -0,0 +1,23 @@
+#!/bin/sh
+# Build + RUN the REASONING-layer tests (engram_reason.c): closed-form constructed
+# cases for ANALOGY / INDUCTION / ABDUCTION / CAUSAL / PLANNING, each composing the
+# §5 geometry OPERATORS (engram_geometry.c). Pure C11 (stdlib + libm). Standalone —
+# NOT folded through elc. Two passes:
+#   1. PERF   — optimised (-O2, no sanitizer): the functional gate.
+#   2. SAFETY — ASan + UBSan on the same suite (memory-safety is size-independent).
+set -e
+HERE=$(cd "$(dirname "$0")" && pwd)
+RT="$HERE/../../lang/runtime"
+CC=${CC:-cc}
+SRC="$HERE/test_reason.c $RT/engram_reason.c $RT/engram_geometry.c $RT/engram_store.c $RT/engram_vindex.c"
+WARN="-std=c11 -Wall -Wextra"
+TMP=$(mktemp -d)
+
+echo "### PASS 1: PERF (optimised, un-sanitised) — functional gate"
+$CC $WARN -O2 -I"$RT" $SRC -lm -o "$TMP/perf"
+"$TMP/perf"
+
+echo
+echo "### PASS 2: SAFETY (ASan/UBSan)"
+$CC $WARN -O1 -g -fsanitize=address,undefined -fno-omit-frame-pointer -I"$RT" $SRC -lm -o "$TMP/safe"
+ASAN_OPTIONS=${ASAN_OPTIONS:-detect_leaks=0} UBSAN_OPTIONS=halt_on_error=1 "$TMP/safe"

engram/test/run_store_tests.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# M1 paged-store gate. Pure C (NOT elb/elc). Writes only under /tmp.
+set -e
+HERE="$(cd "$(dirname "$0")" && pwd)"
+SRC="$HERE/../../lang/runtime/engram_store.c"
+BIN="/tmp/test_store.$$"
+echo "compiling: gcc test_store.c engram_store.c"
+gcc -O2 -Wall -Wextra -std=c11 "$HERE/test_store.c" "$SRC" -o "$BIN"
+"$BIN"
+rc=$?
+rm -f "$BIN"
+rm -rf /tmp/engram-store-test-*
+exit $rc

engram/test/run_verify_tests.sh

@@ -0,0 +1,24 @@
+#!/bin/sh
+# Build + RUN the VERIFIER-layer tests (engram_verify.c): closed-form constructed
+# cases for GROUNDING (anti-hallucination) and CONSISTENCY (polarity/negation
+# inversion + geometric contradiction), each composing the reasoning point-fit
+# (engram_reason.c) and the §5 geometry OPERATORS (engram_geometry.c). Pure C11
+# (stdlib + libm). Standalone — NOT folded through elc. Two passes:
+#   1. PERF   — optimised (-O2, no sanitizer): the functional gate.
+#   2. SAFETY — ASan + UBSan on the same suite (memory-safety is size-independent).
+set -e
+HERE=$(cd "$(dirname "$0")" && pwd)
+RT="$HERE/../../lang/runtime"
+CC=${CC:-cc}
+SRC="$HERE/test_verify.c $RT/engram_verify.c $RT/engram_reason.c $RT/engram_geometry.c $RT/engram_store.c $RT/engram_vindex.c"
+WARN="-std=c11 -Wall -Wextra"
+TMP=$(mktemp -d)
+
+echo "### PASS 1: PERF (optimised, un-sanitised) — functional gate"
+$CC $WARN -O2 -I"$RT" $SRC -lm -o "$TMP/perf"
+"$TMP/perf"
+
+echo
+echo "### PASS 2: SAFETY (ASan/UBSan)"
+$CC $WARN -O1 -g -fsanitize=address,undefined -fno-omit-frame-pointer -I"$RT" $SRC -lm -o "$TMP/safe"
+ASAN_OPTIONS=${ASAN_OPTIONS:-detect_leaks=0} UBSAN_OPTIONS=halt_on_error=1 "$TMP/safe"

engram/test/run_vindex_tests.sh

@@ -0,0 +1,25 @@
+#!/bin/sh
+# Build + RUN the M8 HNSW vector-index tests. Pure C11 (gcc/cc), stdlib + libm
+# only. This is a standalone C module — NOT folded through elb/elc.
+#
+# Two passes:
+#   1. PERF  — optimised (-O2, no sanitizer): the real recall@10 gate + speedup
+#              numbers at full size (N=5000 recall, N=5000/20000 speedup).
+#   2. SAFETY — ASan + UBSan on the same suite at reduced size (VINDEX_QUICK=1);
+#              memory-safety is size-independent, so this stays fast.
+set -e
+HERE=$(cd "$(dirname "$0")" && pwd)
+RT="$HERE/../../lang/runtime"
+CC=${CC:-cc}
+SRC="$HERE/test_vindex.c $RT/engram_vindex.c $RT/engram_store.c"
+WARN="-std=c11 -Wall -Wextra"
+TMP=$(mktemp -d)
+
+echo "### PASS 1: PERF (optimised, un-sanitised) — recall gate + speedup"
+$CC $WARN -O2 -I"$RT" $SRC -lm -o "$TMP/perf"
+"$TMP/perf"
+
+echo
+echo "### PASS 2: SAFETY (ASan/UBSan, reduced size)"
+$CC $WARN -O1 -g -fsanitize=address,undefined -fno-omit-frame-pointer -I"$RT" $SRC -lm -o "$TMP/safe"
+VINDEX_QUICK=1 ASAN_OPTIONS=${ASAN_OPTIONS:-detect_leaks=0} UBSAN_OPTIONS=halt_on_error=1 "$TMP/safe"

engram/test/run_wal_store_tests.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# M2 WAL + checkpoint + recovery gate. Pure C (NOT elb/elc). Writes only under /tmp.
+# Recovery tests use ENGRAM_WAL_SYNC=always so every WAL record is durable at crash.
+set -e
+HERE="$(cd "$(dirname "$0")" && pwd)"
+SRC="$HERE/../../lang/runtime/engram_store.c"
+BIN="/tmp/test_wal_store.$$"
+echo "compiling: gcc test_wal_store.c engram_store.c"
+gcc -O2 -Wall -Wextra -std=c11 "$HERE/test_wal_store.c" "$SRC" -o "$BIN"
+ENGRAM_WAL_SYNC=always "$BIN"
+rc=$?
+rm -f "$BIN"
+rm -rf /tmp/engram-wal-test-*
+exit $rc

engram/test/run_wal_tests.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# WAL unit + integration + crash-fuzz gate. Throwaway HOME/dirs only.
+set -e
+HERE="$(cd "$(dirname "$0")" && pwd)"
+REL="$HERE/../../lang/runtime"
+cc -O2 -fbracket-depth=1024 -Wno-parentheses-equality -I"$REL" \
+   "$HERE/test_wal.c" -lcurl -lpthread -o /tmp/test_wal
+HOME=/tmp/engram-throwaway-home /tmp/test_wal
+# Fail-loud data-dir check (must exit 1 with a FATAL line):
+cat > /tmp/test_failloud.c <<'C'
+#include "el_runtime.c"
+int main(void){ unsetenv("ENGRAM_DATA_DIR"); unsetenv("HOME");
+  engram_resolve_data_dir(); printf("REACHED\n"); return 0; }
+C
+cc -O2 -fbracket-depth=1024 -Wno-parentheses-equality -I"$REL" /tmp/test_failloud.c -lcurl -lpthread -o /tmp/test_failloud
+if env -u HOME -u ENGRAM_DATA_DIR /tmp/test_failloud; then echo "FAIL: should have exited"; exit 1; else echo "[PASS] fail-loud exit on unresolvable HOME"; fi

engram/test/test_bufpool.c

@@ -0,0 +1,496 @@
+/* test_bufpool.c — M4 gate for the demand-paging BUFFER POOL (engram_store.{c,h}).
+ *
+ * Pure C. Build: gcc -O2 test_bufpool.c ../../lang/runtime/engram_store.c -o t
+ * Writes ONLY under a throwaway /tmp dir. Never touches ~/.neuron or live ports.
+ *
+ * Proves the M4 pool preserves every M1/M2 invariant when the pool is SMALLER
+ * than the store (pages evict + re-fault): small-pool round-trip correctness,
+ * LRU eviction policy (hot resident / cold evicted / no dirty stolen), pinned
+ * residency (superblocks, index roots, explicit page + hot-layer pins), bounded
+ * read-ahead, and crash safety (WAL replay + checkpoint-crash) under paging.
+ */
+#include "../../lang/runtime/engram_store.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdint.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <sys/stat.h>
+
+static int g_pass = 0, g_fail = 0;
+static void ok(const char* name, int cond){
+    printf("  [%s] %s\n", cond ? "PASS" : "FAIL", name);
+    if (cond) g_pass++; else g_fail++;
+}
+
+static char g_dir[512];
+static void mk_dir(void){
+    snprintf(g_dir, sizeof g_dir, "/tmp/engram-bufpool-test-%d", (int)getpid());
+    mkdir(g_dir, 0700);
+}
+static void path_in(char* out, size_t cap, const char* name){
+    snprintf(out, cap, "%s/%s", g_dir, name);
+}
+
+/* ── deterministic generators (bit-exact regeneration for oracles) ─────────── */
+static uint64_t xs(uint64_t* s){ uint64_t x=*s; x^=x<<13; x^=x>>7; x^=x<<17; *s=x; return x; }
+static uint64_t node_seed(int i){ return 0x9E3779B97F4A7C15ULL ^ ((uint64_t)(i+1)*0xD1B54A32D192ED03ULL); }
+static uint64_t edge_seed(int i){ return 0xC2B2AE3D27D4EB4FULL ^ ((uint64_t)(i+1)*0x165667B19E3779F9ULL); }
+static char* rnd_str(uint64_t* st, size_t len){
+    char* s = (char*)malloc(len + 1);
+    for (size_t i=0;i<len;i++) s[i] = (char)(33 + (xs(st) % 94));
+    s[len] = 0; return s;
+}
+
+#define NODE_COUNT 5000
+#define EDGE_COUNT 20000
+#define EMB_DIM    768
+#define CK_NODES   300
+
+static void noop_node_cb(const StoreNode* n, void* ctx){ (void)n; (void)ctx; }
+
+static void gen_node(int i, StoreNode* n){
+    memset(n, 0, sizeof *n);
+    uint64_t st = node_seed(i);
+    char id[32]; snprintf(id, sizeof id, "node-%d", i);
+    n->id = strdup(id);
+    size_t clen = (i % 500 == 0) ? (size_t)(17000 + (xs(&st) % 6000)) : (size_t)(xs(&st) % 300);
+    n->content   = rnd_str(&st, clen);
+    n->node_type = rnd_str(&st, 4 + (xs(&st) % 8));
+    n->label     = (i % 2)   ? rnd_str(&st, 3 + (xs(&st) % 10)) : NULL;
+    n->tier      = rnd_str(&st, 4 + (xs(&st) % 6));
+    n->tags      = rnd_str(&st, xs(&st) % 40);
+    n->metadata  = (i % 3)   ? rnd_str(&st, xs(&st) % 60) : NULL;
+    n->salience             = (double)(xs(&st) % 1000000) / 997.0;
+    n->importance           = (double)(xs(&st) % 1000000) / 131.0;
+    n->confidence           = (double)(xs(&st) % 1000000) / 733.0;
+    n->temporal_decay_rate  = (double)(xs(&st) % 1000000) / 101.0;
+    n->activation_count     = (int64_t)(xs(&st) % 100000);
+    n->last_activated       = (int64_t)xs(&st);
+    n->created_at           = (int64_t)(1600000000000LL + i);
+    n->updated_at           = (int64_t)xs(&st);
+    n->background_activation = (double)(xs(&st) % 1000000) / 17.0;
+    n->working_memory_weight = (double)(xs(&st) % 1000000) / 29.0;
+    n->suppression_count    = (int32_t)(xs(&st) % 50);
+    n->layer_id             = (uint32_t)(xs(&st) % 5);
+    for (int k=0;k<STORE_BLL_K;k++) n->access_ts[k] = (int64_t)xs(&st);
+    n->access_head   = (int32_t)(xs(&st) % STORE_BLL_K);
+    n->access_filled = (int32_t)(xs(&st) % (STORE_BLL_K + 1));
+    n->wm_anchor     = (double)(xs(&st) % 1000000) / 3.0;
+    n->emb = (float*)malloc(EMB_DIM * sizeof(float));
+    for (int k=0;k<EMB_DIM;k++){ uint32_t u=(uint32_t)xs(&st); memcpy(&n->emb[k], &u, 4); }
+    n->emb_dim = EMB_DIM;
+}
+static void gen_edge(int i, StoreEdge* e){
+    memset(e, 0, sizeof *e);
+    uint64_t st = edge_seed(i);
+    char id[32], from[32], to[32];
+    snprintf(id, sizeof id, "edge-%d", i);
+    snprintf(from, sizeof from, "node-%d", (int)(xs(&st) % NODE_COUNT));
+    snprintf(to,   sizeof to,   "node-%d", (int)(xs(&st) % NODE_COUNT));
+    e->id = strdup(id); e->from_id = strdup(from); e->to_id = strdup(to);
+    e->relation = rnd_str(&st, 3 + (xs(&st) % 12));
+    e->metadata = (i % 4) ? rnd_str(&st, xs(&st) % 40) : NULL;
+    e->weight     = (double)(xs(&st) % 1000000) / 111.0;
+    e->hebb       = (double)(xs(&st) % 1000000) / 1000000.0;
+    e->confidence = (double)(xs(&st) % 1000000) / 777.0;
+    e->created_at = (int64_t)(1600000000000LL + i);
+    e->updated_at = (int64_t)xs(&st);
+    e->last_fired = (int64_t)xs(&st);
+    e->inhibitory = (int32_t)(xs(&st) % 2);
+    e->layer_id   = (uint32_t)(xs(&st) % 5);
+}
+static int streq(const char* a, const char* b){
+    if (!a && !b) return 1;
+    if (!a || !b) return 0;
+    return strcmp(a,b)==0;
+}
+static int cmp_node(const StoreNode* a, const StoreNode* b){
+    if (!streq(a->id,b->id) || !streq(a->content,b->content) ||
+        !streq(a->node_type,b->node_type) || !streq(a->label,b->label) ||
+        !streq(a->tier,b->tier) || !streq(a->tags,b->tags) ||
+        !streq(a->metadata,b->metadata)) return 0;
+    if (a->salience!=b->salience || a->importance!=b->importance ||
+        a->confidence!=b->confidence || a->temporal_decay_rate!=b->temporal_decay_rate ||
+        a->activation_count!=b->activation_count || a->last_activated!=b->last_activated ||
+        a->created_at!=b->created_at || a->updated_at!=b->updated_at ||
+        a->background_activation!=b->background_activation ||
+        a->working_memory_weight!=b->working_memory_weight ||
+        a->suppression_count!=b->suppression_count || a->layer_id!=b->layer_id ||
+        a->access_head!=b->access_head || a->access_filled!=b->access_filled ||
+        a->wm_anchor!=b->wm_anchor || a->emb_dim!=b->emb_dim) return 0;
+    for (int k=0;k<STORE_BLL_K;k++) if (a->access_ts[k]!=b->access_ts[k]) return 0;
+    if ((a->emb==NULL) != (b->emb==NULL)) return 0;
+    if (a->emb && memcmp(a->emb, b->emb, (size_t)a->emb_dim*4)!=0) return 0;
+    return 1;
+}
+static int cmp_edge(const StoreEdge* a, const StoreEdge* b){
+    if (!streq(a->id,b->id) || !streq(a->from_id,b->from_id) || !streq(a->to_id,b->to_id) ||
+        !streq(a->relation,b->relation) || !streq(a->metadata,b->metadata)) return 0;
+    if (a->weight!=b->weight || a->hebb!=b->hebb || a->confidence!=b->confidence ||
+        a->created_at!=b->created_at || a->updated_at!=b->updated_at ||
+        a->last_fired!=b->last_fired || a->inhibitory!=b->inhibitory ||
+        a->layer_id!=b->layer_id) return 0;
+    return 1;
+}
+static void free_node_fields(StoreNode* n){
+    free(n->id); free(n->content); free(n->node_type); free(n->label);
+    free(n->tier); free(n->tags); free(n->metadata); free(n->emb); free(n->unknown);
+}
+static void free_edge_fields(StoreEdge* e){
+    free(e->id); free(e->from_id); free(e->to_id); free(e->relation); free(e->metadata); free(e->unknown);
+}
+
+/* ════════════════════════════════════════════════════════════════════════════
+ * TEST 1 — SMALL-POOL CORRECTNESS: full M1 workload (5k nodes / 20k edges) with
+ * a frame budget FAR smaller than the store → constant eviction + re-fault, yet
+ * every read is bit-exact and the pool stays bounded.
+ * ════════════════════════════════════════════════════════════════════════════ */
+static void test_small_pool_roundtrip(void){
+    printf("\n== 1) small-pool correctness: %d nodes + %d edges, cap=%d frames ==\n",
+           NODE_COUNT, EDGE_COUNT, 32);
+    char path[600]; path_in(path, sizeof path, "small.store");
+    unlink(path);
+    EngramPagedStore* s = store_create(path);
+    ok("store_create", s != NULL);
+    if (!s) return;
+    store__set_pool_frames(s, 32);          /* pool << store */
+
+    for (int i=0;i<NODE_COUNT;i++){
+        StoreNode n; gen_node(i,&n);
+        if (store_put_node(s,&n)!=0){ ok("put_node", 0); free_node_fields(&n); store_close(s); return; }
+        free_node_fields(&n);
+        if ((i%500)==499) store_sync(s);    /* checkpoint: dirty→clean so frames evictable */
+    }
+    for (int i=0;i<EDGE_COUNT;i++){
+        StoreEdge e; gen_edge(i,&e);
+        if (store_put_edge(s,&e)!=0){ ok("put_edge", 0); free_edge_fields(&e); store_close(s); return; }
+        free_edge_fields(&e);
+        if ((i%1000)==999) store_sync(s);
+    }
+    store_sync(s);
+
+    StorePoolStats st; store_pool_stats(s, &st);
+    printf("     pages=%llu  pool: cap=%zu resident=%zu pinned=%zu dirty=%zu evictions=%llu\n",
+           (unsigned long long)store_page_count(s), st.cap, st.resident, st.pinned,
+           st.dirty, (unsigned long long)st.evictions);
+    ok("eviction actually fired (store exceeded the pool)", st.evictions > 0);
+    ok("pool stayed bounded (resident <= cap)", st.resident <= st.cap);
+    ok("no dirty frames after checkpoint", st.dirty == 0);
+
+    /* read back EVERY node bit-exact despite constant eviction/re-fault */
+    int bad = 0;
+    for (int i=0;i<NODE_COUNT;i++){
+        StoreNode want; gen_node(i,&want);
+        StoreNode got; int hit = store_get_node(s, want.id, &got);
+        if (hit!=1 || !cmp_node(&want,&got)) bad++;
+        if (hit==1) store_node_free(&got);
+        free_node_fields(&want);
+    }
+    ok("all 5000 nodes bit-exact under eviction", bad==0);
+
+    /* sample 4000 edges bit-exact */
+    int ebad = 0;
+    for (int i=0;i<EDGE_COUNT;i+=5){
+        StoreEdge want; gen_edge(i,&want);
+        StoreEdge got; int hit = store_get_edge(s, want.id, &got);
+        if (hit!=1 || !cmp_edge(&want,&got)) ebad++;
+        if (hit==1) store_edge_free(&got);
+        free_edge_fields(&want);
+    }
+    ok("sampled 4000 edges bit-exact under eviction", ebad==0);
+    ok("store_check crc clean under paging", store_check(s, STORE_CHECK_CRC)==0);
+
+    store_pool_stats(s, &st);
+    printf("     after reads: resident=%zu (<= cap=%zu)  hits=%llu misses=%llu evictions=%llu\n",
+           st.resident, st.cap, (unsigned long long)st.hits,
+           (unsigned long long)st.misses, (unsigned long long)st.evictions);
+    ok("still bounded after full read-back", st.resident <= st.cap);
+    store_close(s);
+    unlink(path);
+}
+
+/* ════════════════════════════════════════════════════════════════════════════
+ * TEST 2 — EVICTION POLICY: a repeatedly-touched HOT set stays resident (0 extra
+ * faults) while a streaming COLD set is evicted; and a dirty-heavy write burst
+ * proves dirty pages are NEVER stolen before a checkpoint (no-steal).
+ * ════════════════════════════════════════════════════════════════════════════ */
+static void test_eviction_policy(void){
+    printf("\n== 2) eviction policy: hot resident, cold evicted, no dirty stolen ==\n");
+    char path[600]; path_in(path, sizeof path, "evict.store");
+    unlink(path);
+
+    /* ---- part A: hot vs cold ---- */
+    EngramPagedStore* s = store_create(path);
+    if (!s){ ok("store_create", 0); return; }
+    const int N = 1500;
+    for (int i=0;i<N;i++){ StoreNode n; gen_node(i,&n); store_put_node(s,&n); free_node_fields(&n);
+        if ((i%400)==399) store_sync(s); }
+    store_sync(s);
+    store__set_pool_frames(s, 64);
+
+    const int HOT = 8;
+    /* warm the hot set */
+    for (int h=0;h<HOT;h++){ char id[32]; snprintf(id,sizeof id,"node-%d",h);
+        StoreNode g; if (store_get_node(s,id,&g)==1) store_node_free(&g); }
+
+    StorePoolStats a,b;
+    uint64_t hot_faults = 0, cold_faults = 0;
+    int cold = 200;                            /* streaming cold ids well outside hot set */
+    for (int r=0;r<150;r++){
+        for (int h=0;h<HOT;h++){
+            char id[32]; snprintf(id,sizeof id,"node-%d",h);
+            store_pool_stats(s,&a);
+            StoreNode g; if (store_get_node(s,id,&g)==1) store_node_free(&g);
+            store_pool_stats(s,&b);
+            hot_faults += (b.misses - a.misses);
+        }
+        for (int c=0;c<3;c++){
+            char id[32]; snprintf(id,sizeof id,"node-%d",cold++);
+            if (cold>=N) cold=200;
+            store_pool_stats(s,&a);
+            StoreNode g; if (store_get_node(s,id,&g)==1) store_node_free(&g);
+            store_pool_stats(s,&b);
+            cold_faults += (b.misses - a.misses);
+        }
+    }
+    printf("     hot re-get faults (post-warm)=%llu   cold stream faults=%llu\n",
+           (unsigned long long)hot_faults, (unsigned long long)cold_faults);
+    ok("HOT pages stay resident (0 faults on re-access)", hot_faults == 0);
+    ok("COLD pages get evicted + re-faulted", cold_faults > 0);
+    store_pool_stats(s,&b);
+    double hr = (double)b.hits / (double)(b.hits + b.misses);
+    printf("     overall hit-rate = %.3f (hits=%llu misses=%llu)\n",
+           hr, (unsigned long long)b.hits, (unsigned long long)b.misses);
+    ok("hit-rate is sane (> 0.5)", hr > 0.5);
+    store_close(s);
+    unlink(path);
+
+    /* ---- part B: no-steal (dirty pages never evicted before checkpoint) ---- */
+    EngramPagedStore* s2 = store_create(path);
+    if (!s2){ ok("store_create(2)", 0); return; }
+    store__set_pool_frames(s2, 8);             /* tiny budget */
+    for (int i=0;i<1200;i++){ StoreNode n; gen_node(i,&n); store_put_node(s2,&n); free_node_fields(&n); }
+    /* NO sync: every mutated page is dirty and, by no-steal, unevictable */
+    StorePoolStats d; store_pool_stats(s2,&d);
+    printf("     tiny cap=%zu, unsynced burst: resident=%zu dirty=%zu evictions=%llu\n",
+           d.cap, d.resident, d.dirty, (unsigned long long)d.evictions);
+    ok("dirty pages pinned in RAM beyond budget (no-steal)", d.dirty > d.cap && d.resident > d.cap);
+    /* a just-written node is served correctly from its dirty in-RAM page */
+    { StoreNode want; gen_node(777,&want); StoreNode got; int hit=store_get_node(s2,want.id,&got);
+      ok("read served correctly from dirty (un-flushed) page", hit==1 && cmp_node(&want,&got));
+      if (hit==1) store_node_free(&got); free_node_fields(&want); }
+    store_sync(s2);                            /* checkpoint → dirty become clean/evictable */
+    store_pool_stats(s2,&d);
+    ok("checkpoint cleared all dirty frames", d.dirty == 0);
+    /* durability across reopen after the no-steal burst */
+    store_close(s2);
+    EngramPagedStore* s3 = store_open(path);
+    store__set_pool_frames(s3, 8);
+    int miss=0; for (int i=0;i<1200;i++){ StoreNode want; gen_node(i,&want);
+        StoreNode got; int hit=store_get_node(s3,want.id,&got);
+        if (hit!=1 || !cmp_node(&want,&got)) miss++;
+        if (hit==1) store_node_free(&got); free_node_fields(&want); }
+    ok("all 1200 survive reopen, bit-exact, tiny pool", miss==0);
+    store_close(s3);
+    unlink(path);
+}
+
+/* ════════════════════════════════════════════════════════════════════════════
+ * TEST 3 — PINNED RESIDENCY: superblocks + index roots never evicted under heavy
+ * thrash; an explicitly pinned page stays until unpinned; a pinned hot layer's
+ * pages stay resident and are released on unpin.
+ * ════════════════════════════════════════════════════════════════════════════ */
+static void test_pinning(void){
+    printf("\n== 3) pinned residency: superblocks / index roots / page / layer ==\n");
+    char path[600]; path_in(path, sizeof path, "pin.store");
+    unlink(path);
+    EngramPagedStore* s = store_create(path);
+    if (!s){ ok("store_create", 0); return; }
+    const int N = 1500;
+    for (int i=0;i<N;i++){ StoreNode n; gen_node(i,&n); store_put_node(s,&n); free_node_fields(&n);
+        if ((i%400)==399) store_sync(s); }
+    store_sync(s);
+    store_close(s);
+
+    s = store_open(path);                       /* reopen: SBs + roots auto-pinned */
+    store__set_pool_frames(s, 24);
+
+    uint64_t P = store_page_count(s) / 2;       /* an arbitrary interior page to pin */
+    store_pin_page(s, P);
+
+    /* thrash: stream a large cold working set to force heavy eviction */
+    for (int pass=0; pass<3; pass++)
+        for (int i=0;i<N;i++){ char id[32]; snprintf(id,sizeof id,"node-%d",i);
+            StoreNode g; if (store_get_node(s,id,&g)==1) store_node_free(&g); }
+
+    ok("superblock page 0 never evicted", store_pool_resident(s,0)==1);
+    ok("superblock mirror page 1 never evicted", store_pool_resident(s,1)==1);
+    ok("explicitly pinned page stayed resident under thrash", store_pool_resident(s,P)==1);
+
+    StorePoolStats st; store_pool_stats(s,&st);
+    printf("     after thrash: resident=%zu pinned=%zu evictions=%llu\n",
+           st.resident, st.pinned, (unsigned long long)st.evictions);
+    ok("structural + explicit pins counted (>=4: 2 SB + 2 roots)", st.pinned >= 4);
+
+    /* unpin the page → it becomes evictable and is dropped under further thrash */
+    store_unpin_page(s, P);
+    for (int i=0;i<N;i++){ char id[32]; snprintf(id,sizeof id,"node-%d",i);
+        StoreNode g; if (store_get_node(s,id,&g)==1) store_node_free(&g); }
+    ok("unpinned page becomes evictable (dropped)", store_pool_resident(s,P)==0);
+
+    /* hot-layer pin: layer 3 is used by ~1/5 of the nodes */
+    int npin = store_pin_layer(s, 3);
+    printf("     store_pin_layer(3) pinned %d page(s)\n", npin);
+    ok("pin_layer pinned a non-empty page set", npin > 0);
+    store_pool_stats(s,&st);
+    size_t pinned_with_layer = st.pinned;
+    for (int pass=0; pass<3; pass++)
+        for (int i=0;i<N;i++){ char id[32]; snprintf(id,sizeof id,"node-%d",i);
+            StoreNode g; if (store_get_node(s,id,&g)==1) store_node_free(&g); }
+    store_pool_stats(s,&st);
+    ok("hot-layer pages stay resident under thrash", st.pinned >= pinned_with_layer);
+    ok("layer pin holds >= npin extra frames", st.pinned >= (size_t)npin + 4);
+
+    store_unpin_layer(s, 3);
+    store_pool_stats(s,&st);
+    size_t after_unpin_max = st.pinned;
+    for (int i=0;i<N;i++){ char id[32]; snprintf(id,sizeof id,"node-%d",i);
+        StoreNode g; if (store_get_node(s,id,&g)==1) store_node_free(&g); }
+    store_pool_stats(s,&st);
+    printf("     pinned frames: with-layer=%zu  after-unpin=%zu\n", pinned_with_layer, st.pinned);
+    ok("unpin_layer released the layer's pins", st.pinned < pinned_with_layer && after_unpin_max <= pinned_with_layer);
+
+    store_close(s);
+    unlink(path);
+}
+
+/* ════════════════════════════════════════════════════════════════════════════
+ * TEST 4 — PREFETCH: a sequential scan faults far fewer times with read-ahead on
+ * than off (each cold cache; identical store).
+ * ════════════════════════════════════════════════════════════════════════════ */
+static void test_prefetch(void){
+    printf("\n== 4) prefetch: sequential scan faults fewer with read-ahead ==\n");
+    char path[600]; path_in(path, sizeof path, "prefetch.store");
+    unlink(path);
+    EngramPagedStore* s = store_create(path);
+    if (!s){ ok("store_create", 0); return; }
+    for (int i=0;i<2000;i++){ StoreNode n; gen_node(i,&n); store_put_node(s,&n); free_node_fields(&n);
+        if ((i%400)==399) store_sync(s); }
+    store_sync(s);
+    store_close(s);
+
+    /* prefetch OFF — cold cache */
+    EngramPagedStore* a = store_open(path);
+    store__set_pool_frames(a, 0);               /* unlimited: isolate prefetch, no eviction */
+    store__set_prefetch(a, 0);
+    StorePoolStats o0, o1; store_pool_stats(a,&o0);
+    int na = store_scan_nodes(a, noop_node_cb, NULL);   /* walk + fault every page */
+    (void)na;
+    store_pool_stats(a,&o1);
+    uint64_t faults_off = o1.misses - o0.misses;
+    store_close(a);
+
+    /* prefetch ON — cold cache (fresh open) */
+    EngramPagedStore* b = store_open(path);
+    store__set_pool_frames(b, 0);
+    store__set_prefetch(b, 16);
+    StorePoolStats p0, p1; store_pool_stats(b,&p0);
+    int nb = store_scan_nodes(b, noop_node_cb, NULL);
+    (void)nb;
+    store_pool_stats(b,&p1);
+    uint64_t faults_on  = p1.misses - p0.misses;
+    uint64_t pref_reads = p1.prefetch_reads - p0.prefetch_reads;
+    store_close(b);
+
+    printf("     scan demand-faults: prefetch OFF=%llu  ON=%llu  (read-ahead brought in %llu pages)\n",
+           (unsigned long long)faults_off, (unsigned long long)faults_on,
+           (unsigned long long)pref_reads);
+    ok("prefetch reduced demand faults", faults_on < faults_off);
+    ok("read-ahead actually ran", pref_reads > 0);
+    unlink(path);
+}
+
+/* ════════════════════════════════════════════════════════════════════════════
+ * TEST 5 — CRASH SAFETY UNDER PAGING: WAL replay and checkpoint-crash recovery
+ * with a tiny pool (pages evict + re-fault during replay).
+ * ════════════════════════════════════════════════════════════════════════════ */
+static void test_crash_under_paging(void){
+    printf("\n== 5) crash safety under a tiny pool (ENGRAM_POOL_FRAMES=16) ==\n");
+    setenv("ENGRAM_POOL_FRAMES", "16", 1);      /* every engram_open() below is paged */
+    setenv("ENGRAM_WAL_SYNC", "always", 1);
+
+    /* ---- 5a: power-loss → WAL replay ---- */
+    char dir[600]; path_in(dir, sizeof dir, "crash_wal"); mkdir(dir, 0700);
+    EngramPagedStore* s = engram_open(dir);
+    if (!s){ ok("engram_open", 0); return; }
+    const int M = 400;
+    for (int i=0;i<M;i++){ StoreNode n; gen_node(i,&n); store_put_node(s,&n); free_node_fields(&n); }
+    store__crash(s);                             /* abandon RAM (dirty pages lost); WAL fsync'd */
+    s = engram_open(dir);                        /* replay WAL under 16-frame pool */
+    ok("reopened after crash (WAL replay, tiny pool)", s!=NULL);
+    int bad=0; for (int i=0;i<M;i++){ StoreNode want; gen_node(i,&want);
+        StoreNode got; int hit=store_get_node(s,want.id,&got);
+        if (hit!=1 || !cmp_node(&want,&got)) bad++;
+        if (hit==1) store_node_free(&got); free_node_fields(&want); }
+    ok("all 400 nodes recovered bit-exact via WAL replay under paging", bad==0);
+    ok("store_check crc clean post-recovery", store_check(s, STORE_CHECK_CRC)==0);
+    engram_close(s);
+
+    /* ---- 5b: checkpoint-crash at each phase ---- */
+    for (int phase=0; phase<=4; phase++){
+        char cdir[620]; snprintf(cdir, sizeof cdir, "%s/ck%d", g_dir, phase); mkdir(cdir,0700);
+        EngramPagedStore* c = engram_open(cdir);
+        for (int i=0;i<CK_NODES;i++){ StoreNode n; gen_node(i,&n); store_put_node(c,&n); free_node_fields(&n); }
+        store__checkpoint_crashat(c, phase);     /* crash mid-checkpoint (frees c) */
+        EngramPagedStore* r = engram_open(cdir); /* heal + replay under tiny pool */
+        int miss=0; for (int i=0;i<CK_NODES;i++){ StoreNode want; gen_node(i,&want);
+            StoreNode got; int hit=store_get_node(r,want.id,&got);
+            if (hit!=1 || !cmp_node(&want,&got)) miss++;
+            if (hit==1) store_node_free(&got); free_node_fields(&want); }
+        char nm[64]; snprintf(nm,sizeof nm,"checkpoint-crash phase %d: all recovered (paged)", phase);
+        ok(nm, miss==0);
+        engram_close(r);
+    }
+    unsetenv("ENGRAM_POOL_FRAMES");
+}
+
+/* ════════════════════════════════════════════════════════════════════════════
+ * TEST 6 — DEFAULT POOL == PHASE 1: with the default (large) budget, no eviction
+ * ever fires; the whole store is resident, exactly the pre-M4 behaviour.
+ * ════════════════════════════════════════════════════════════════════════════ */
+static void test_default_is_phase1(void){
+    printf("\n== 6) default (large) pool == Phase-1 resident (no eviction) ==\n");
+    char path[600]; path_in(path, sizeof path, "default.store");
+    unlink(path);
+    EngramPagedStore* s = store_create(path);   /* default cap, no override */
+    if (!s){ ok("store_create", 0); return; }
+    for (int i=0;i<1500;i++){ StoreNode n; gen_node(i,&n); store_put_node(s,&n); free_node_fields(&n); }
+    store_sync(s);
+    for (int i=0;i<1500;i++){ char id[32]; snprintf(id,sizeof id,"node-%d",i);
+        StoreNode g; if (store_get_node(s,id,&g)==1) store_node_free(&g); }
+    StorePoolStats st; store_pool_stats(s,&st);
+    printf("     cap=%zu resident=%zu evictions=%llu  (pages=%llu)\n",
+           st.cap, st.resident, (unsigned long long)st.evictions,
+           (unsigned long long)store_page_count(s));
+    ok("default budget is large", st.cap >= (size_t)(1u<<20));
+    ok("no eviction ever fired at default budget", st.evictions == 0);
+    ok("whole store resident (every page cached)", st.resident == store_page_count(s));
+    store_close(s);
+    unlink(path);
+}
+
+int main(void){
+    mk_dir();
+    printf("engram M4 buffer-pool gate — dir=%s\n", g_dir);
+    test_small_pool_roundtrip();
+    test_eviction_policy();
+    test_pinning();
+    test_prefetch();
+    test_crash_under_paging();
+    test_default_is_phase1();
+    printf("\n================  %d passed, %d failed  ================\n", g_pass, g_fail);
+    return g_fail ? 1 : 0;
+}

engram/test/test_compaction.c

@@ -0,0 +1,421 @@
+/* test_compaction.c — M5 gate: ONLINE COMPACTION + background checkpointer.
+ *
+ * Pure C. Build: gcc -O2 test_compaction.c ../../lang/runtime/engram_store.c -o t
+ * Writes ONLY under a throwaway /tmp dir. Never touches ~/.neuron or live ports.
+ *
+ * Proves:
+ *   1) RECLAIM — tombstone/forget a large fraction of nodes + re-put many edges
+ *      (dead versions) + orphan large-record overflow chains, then compact:
+ *      page count AND file size drop, yet EVERY live record survives bit-exact and
+ *      the id + adjacency indexes resolve correctly at the relocated positions.
+ *   2) CRASH-DURING-COMPACTION — kill at phases 0/1/2; recovery is always a
+ *      consistent store (crc clean, every live record intact), never corrupt.
+ *   3) BACKGROUND CHECKPOINTER — a low ops / WAL-bytes threshold fires a checkpoint
+ *      automatically on the write path; the WAL prefix is reclaimed; recovery works.
+ *   4) POOL COOPERATION — compaction under a tiny ENGRAM_POOL_FRAMES stays correct
+ *      with no stale frame surviving for a relocated page.
+ */
+#include "../../lang/runtime/engram_store.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdint.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <sys/stat.h>
+
+static int g_pass = 0, g_fail = 0;
+static void ok(const char* name, int cond){
+    printf("  [%s] %s\n", cond ? "PASS" : "FAIL", name);
+    if (cond) g_pass++; else g_fail++;
+}
+
+static char g_dir[512];
+static int g_dseq = 0;
+static void mk_dir(void){
+    snprintf(g_dir, sizeof g_dir, "/tmp/engram-compact-test-%d-%d", (int)getpid(), g_dseq++);
+    mkdir(g_dir, 0700);
+}
+static void egm_path(char* out, size_t cap){ snprintf(out, cap, "%s/neuron.egm", g_dir); }
+static void wal_path(char* out, size_t cap){ snprintf(out, cap, "%s/neuron.wal", g_dir); }
+static long file_size(const char* p){ struct stat st; return stat(p,&st)==0 ? (long)st.st_size : -1; }
+
+/* ── deterministic generators (bit-exact regeneration for oracles) ─────────── */
+static uint64_t xs(uint64_t* s){ uint64_t x=*s; x^=x<<13; x^=x>>7; x^=x<<17; *s=x; return x; }
+static uint64_t node_seed(int i){ return 0x9E3779B97F4A7C15ULL ^ ((uint64_t)(i+1)*0xD1B54A32D192ED03ULL); }
+static uint64_t edge_seed(int i){ return 0xC2B2AE3D27D4EB4FULL ^ ((uint64_t)(i+1)*0x165667B19E3779F9ULL); }
+static char* rnd_str(uint64_t* st, size_t len){
+    char* s = (char*)malloc(len + 1);
+    for (size_t i=0;i<len;i++) s[i] = (char)(33 + (xs(st) % 94));
+    s[len] = 0; return s;
+}
+
+#define N_NODES     1500
+#define N_DEAD      1200          /* forget node-0 .. node-1199 (1200 dead / 300 live) */
+#define N_EDGES     3000
+#define EDGE_REPUT  2000          /* re-put edge-0 .. edge-1999 to version 3 */
+#define EMB_DIM     96
+
+static int node_is_live(int i){ return i >= N_DEAD; }
+static int edge_live_version(int i){ return (i < EDGE_REPUT) ? 3 : 0; }
+
+static void gen_node(int i, StoreNode* n){
+    memset(n, 0, sizeof *n);
+    uint64_t st = node_seed(i);
+    char id[32]; snprintf(id, sizeof id, "node-%d", i);
+    n->id = strdup(id);
+    /* every 7th record is large → its own overflow chain (orphaned when it dies) */
+    size_t clen = (i % 7 == 0) ? (size_t)(18000 + (xs(&st) % 4000)) : (size_t)(xs(&st) % 200);
+    n->content   = rnd_str(&st, clen);
+    n->node_type = rnd_str(&st, 4 + (xs(&st) % 8));
+    n->label     = (i % 2)   ? rnd_str(&st, 3 + (xs(&st) % 10)) : NULL;
+    n->tier      = rnd_str(&st, 4 + (xs(&st) % 6));
+    n->tags      = rnd_str(&st, xs(&st) % 40);
+    n->metadata  = (i % 3)   ? rnd_str(&st, xs(&st) % 60) : NULL;
+    n->salience             = (double)(xs(&st) % 1000000) / 997.0;
+    n->importance           = (double)(xs(&st) % 1000000) / 131.0;
+    n->confidence           = (double)(xs(&st) % 1000000) / 733.0;
+    n->temporal_decay_rate  = (double)(xs(&st) % 1000000) / 101.0;
+    n->activation_count     = (int64_t)(xs(&st) % 100000);
+    n->last_activated       = (int64_t)xs(&st);
+    n->created_at           = (int64_t)(1600000000000LL + i);
+    n->updated_at           = (int64_t)xs(&st);
+    n->background_activation = (double)(xs(&st) % 1000000) / 17.0;
+    n->working_memory_weight = (double)(xs(&st) % 1000000) / 29.0;
+    n->suppression_count    = (int32_t)(xs(&st) % 50);
+    n->layer_id             = (uint32_t)(xs(&st) % 5);
+    for (int k=0;k<STORE_BLL_K;k++) n->access_ts[k] = (int64_t)xs(&st);
+    n->access_head   = (int32_t)(xs(&st) % STORE_BLL_K);
+    n->access_filled = (int32_t)(xs(&st) % (STORE_BLL_K + 1));
+    n->wm_anchor     = (double)(xs(&st) % 1000000) / 3.0;
+    n->emb = (float*)malloc(EMB_DIM * sizeof(float));
+    for (int k=0;k<EMB_DIM;k++){ uint32_t u=(uint32_t)xs(&st); memcpy(&n->emb[k], &u, 4); }
+    n->emb_dim = EMB_DIM;
+}
+/* version alters weight/hebb/last_fired so a re-put is a distinct payload. */
+static void gen_edge(int i, int version, StoreEdge* e){
+    memset(e, 0, sizeof *e);
+    uint64_t st = edge_seed(i);
+    char id[32], from[32], to[32];
+    snprintf(id, sizeof id, "edge-%d", i);
+    /* connect live nodes so adjacency queries on live nodes are meaningful */
+    snprintf(from, sizeof from, "node-%d", N_DEAD + (int)(xs(&st) % (N_NODES - N_DEAD)));
+    snprintf(to,   sizeof to,   "node-%d", N_DEAD + (int)(xs(&st) % (N_NODES - N_DEAD)));
+    e->id = strdup(id); e->from_id = strdup(from); e->to_id = strdup(to);
+    e->relation = rnd_str(&st, 3 + (xs(&st) % 12));
+    e->metadata = (i % 4) ? rnd_str(&st, xs(&st) % 40) : NULL;
+    e->weight     = (double)(xs(&st) % 1000000) / 7.0 + version * 100.0;
+    e->hebb       = (double)(xs(&st) % 1000000) / 13.0 + version * 3.0;
+    e->confidence = (double)(xs(&st) % 1000000) / 5.0;
+    e->created_at = (int64_t)(1600000000000LL + i);
+    e->updated_at = (int64_t)xs(&st) + version;
+    e->last_fired = (int64_t)xs(&st) + version * 1000;
+    e->inhibitory = (int32_t)(xs(&st) % 2);
+    e->layer_id   = (uint32_t)(xs(&st) % 5);
+}
+
+static int streq(const char* a, const char* b){
+    if (!a && !b) return 1; if (!a || !b) return 0; return strcmp(a,b)==0;
+}
+static int cmp_node(const StoreNode* a, const StoreNode* b){
+    if (!streq(a->id,b->id) || !streq(a->content,b->content) ||
+        !streq(a->node_type,b->node_type) || !streq(a->label,b->label) ||
+        !streq(a->tier,b->tier) || !streq(a->tags,b->tags) ||
+        !streq(a->metadata,b->metadata)) return 0;
+    if (a->salience!=b->salience || a->importance!=b->importance ||
+        a->confidence!=b->confidence || a->temporal_decay_rate!=b->temporal_decay_rate ||
+        a->activation_count!=b->activation_count || a->last_activated!=b->last_activated ||
+        a->created_at!=b->created_at || a->updated_at!=b->updated_at ||
+        a->background_activation!=b->background_activation ||
+        a->working_memory_weight!=b->working_memory_weight ||
+        a->suppression_count!=b->suppression_count || a->layer_id!=b->layer_id ||
+        a->access_head!=b->access_head || a->access_filled!=b->access_filled ||
+        a->wm_anchor!=b->wm_anchor || a->emb_dim!=b->emb_dim) return 0;
+    for (int k=0;k<STORE_BLL_K;k++) if (a->access_ts[k]!=b->access_ts[k]) return 0;
+    if ((a->emb==NULL) != (b->emb==NULL)) return 0;
+    if (a->emb && memcmp(a->emb, b->emb, (size_t)a->emb_dim*4)!=0) return 0;
+    return 1;
+}
+static int cmp_edge(const StoreEdge* a, const StoreEdge* b){
+    if (!streq(a->id,b->id) || !streq(a->from_id,b->from_id) || !streq(a->to_id,b->to_id) ||
+        !streq(a->relation,b->relation) || !streq(a->metadata,b->metadata)) return 0;
+    if (a->weight!=b->weight || a->hebb!=b->hebb || a->confidence!=b->confidence ||
+        a->created_at!=b->created_at || a->updated_at!=b->updated_at ||
+        a->last_fired!=b->last_fired || a->inhibitory!=b->inhibitory ||
+        a->layer_id!=b->layer_id) return 0;
+    return 1;
+}
+
+/* Populate a durable store with dead space: all nodes/edges, then forget the first
+ * N_DEAD nodes and re-put the first EDGE_REPUT edges three times. */
+static void populate_with_dead_space(EngramPagedStore* s){
+    for (int i=0;i<N_NODES;i++){ StoreNode n; gen_node(i,&n); store_put_node(s,&n); store_node_free(&n); }
+    for (int i=0;i<N_EDGES;i++){ StoreEdge e; gen_edge(i,0,&e); store_put_edge(s,&e); store_edge_free(&e); }
+    /* re-put (in-place field mutation) → prior versions become dead records */
+    for (int v=1; v<=3; v++)
+        for (int i=0;i<EDGE_REPUT;i++){ StoreEdge e; gen_edge(i,v,&e); store_put_edge(s,&e); store_edge_free(&e); }
+    /* forget the cold nodes (tombstone; their large overflow chains orphan) */
+    for (int i=0;i<N_DEAD;i++){ char id[32]; snprintf(id,sizeof id,"node-%d",i); store_forget(s,id); }
+}
+
+/* Assert every live node/edge is present + bit-exact via point reads. */
+static int verify_live_set(EngramPagedStore* s){
+    int bad = 0;
+    for (int i=0;i<N_NODES;i++){
+        char id[32]; snprintf(id,sizeof id,"node-%d",i);
+        StoreNode got; int hit = store_get_node(s, id, &got);
+        if (node_is_live(i)){
+            StoreNode want; gen_node(i,&want);
+            if (hit!=1 || !cmp_node(&want,&got)) bad++;
+            if (hit==1) store_node_free(&got);
+            store_node_free(&want);
+        } else {
+            if (hit!=0) bad++;                 /* forgotten → must be absent */
+            if (hit==1) store_node_free(&got);
+        }
+    }
+    for (int i=0;i<N_EDGES;i++){
+        char id[32]; snprintf(id,sizeof id,"edge-%d",i);
+        StoreEdge got; int hit = store_get_edge(s, id, &got);
+        StoreEdge want; gen_edge(i, edge_live_version(i), &want);
+        if (hit!=1 || !cmp_edge(&want,&got)) bad++;
+        if (hit==1) store_edge_free(&got);
+        store_edge_free(&want);
+    }
+    return bad;
+}
+
+/* ════════════════════════════════════════════════════════════════════════════
+ * TEST 1 — RECLAIM: dead space is reclaimed; live records + indexes survive.
+ * ════════════════════════════════════════════════════════════════════════════ */
+static void test_reclaim(void){
+    printf("\n== 1) reclaim: forget %d nodes + re-put %d edges x3, then compact ==\n",
+           N_DEAD, EDGE_REPUT);
+    mk_dir();
+    char egm[600]; egm_path(egm, sizeof egm);
+    EngramPagedStore* s = engram_open(g_dir);
+    ok("engram_open", s != NULL);
+    if (!s) return;
+
+    populate_with_dead_space(s);
+    engram_checkpoint(s);                       /* flush so file size reflects state */
+
+    uint64_t pc_before   = store_page_count(s);
+    uint64_t free_before = store_free_page_count(s);
+    long     sz_before   = file_size(egm);
+    printf("   BEFORE: page_count=%llu  free_pages=%llu  file=%ld bytes  (live records intact?)\n",
+           (unsigned long long)pc_before, (unsigned long long)free_before, sz_before);
+    ok("pre-compaction live set intact", verify_live_set(s)==0);
+
+    /* capture adjacency for a sample of live from-ids to compare post-compaction */
+    #define NSAMP 12
+    char samp[NSAMP][32]; size_t pre_cnt[NSAMP];
+    for (int k=0;k<NSAMP;k++){
+        snprintf(samp[k], sizeof samp[k], "node-%d", N_DEAD + k*20);
+        StoreEdge* arr=NULL; size_t cnt=0;
+        store_get_edges_from(s, samp[k], &arr, &cnt);
+        pre_cnt[k]=cnt; store_edges_free(arr,cnt);
+    }
+
+    int rc = store_compact(s);
+    ok("store_compact returns 0", rc==0);
+
+    uint64_t pc_after   = store_page_count(s);
+    uint64_t free_after = store_free_page_count(s);
+    long     sz_after   = file_size(egm);
+    printf("   AFTER : page_count=%llu  free_pages=%llu  file=%ld bytes\n",
+           (unsigned long long)pc_after, (unsigned long long)free_after, sz_after);
+    printf("   RECLAIMED: %llu pages, %ld bytes (%.1f%% of file)\n",
+           (unsigned long long)(pc_before - pc_after), sz_before - sz_after,
+           sz_before ? 100.0*(sz_before-sz_after)/sz_before : 0.0);
+
+    ok("page count dropped (dead pages reclaimed)", pc_after < pc_before);
+    ok("file size dropped (store physically shrank)", sz_after < sz_before);
+    ok("store_check crc clean after compaction", store_check(s, STORE_CHECK_CRC)==0);
+    ok("every LIVE record present + bit-exact at new locations", verify_live_set(s)==0);
+
+    /* adjacency index correct at relocated positions */
+    int adj_bad = 0;
+    for (int k=0;k<NSAMP;k++){
+        StoreEdge* arr=NULL; size_t cnt=0;
+        store_get_edges_from(s, samp[k], &arr, &cnt);
+        if (cnt != pre_cnt[k]) adj_bad++;
+        for (size_t j=0;j<cnt;j++){
+            if (!streq(arr[j].from_id, samp[k])) { adj_bad++; break; }
+            /* the returned edge must be the canonical latest live edge, bit-exact */
+            int idx = atoi(arr[j].id + 5);
+            StoreEdge want; gen_edge(idx, edge_live_version(idx), &want);
+            if (!cmp_edge(&want,&arr[j])) adj_bad++;
+            store_edge_free(&want);
+        }
+        store_edges_free(arr,cnt);
+    }
+    ok("adjacency (get_edges_from) correct + bit-exact post-compaction", adj_bad==0);
+
+    /* second compaction is a near no-op (no new dead space) and stays correct */
+    uint64_t pc2_before = store_page_count(s);
+    ok("compact again returns 0", store_compact(s)==0);
+    ok("idempotent-ish: no growth on re-compact", store_page_count(s) <= pc2_before);
+    ok("live set still intact after 2nd compaction", verify_live_set(s)==0);
+
+    engram_close(s);
+}
+
+/* ════════════════════════════════════════════════════════════════════════════
+ * TEST 2 — CRASH DURING COMPACTION: kill at phases 0/1/2 → consistent recovery.
+ * Live set is identical whether we recover pre- or post-compaction, so the same
+ * oracle must hold, and crc must always be clean (never corrupt).
+ * ════════════════════════════════════════════════════════════════════════════ */
+static void test_crash_during_compaction(void){
+    printf("\n== 2) crash during compaction at phases 0,1,2 → consistent store ==\n");
+    for (int phase=0; phase<=2; phase++){
+        mk_dir();
+        char egm[600]; egm_path(egm, sizeof egm);
+        EngramPagedStore* s = engram_open(g_dir);
+        if (!s){ ok("engram_open", 0); continue; }
+        populate_with_dead_space(s);
+        engram_close(s);                          /* durable baseline on disk */
+
+        uint64_t pc_pre = 0;
+        { EngramPagedStore* p = engram_open(g_dir); pc_pre = store_page_count(p); engram_close(p); }
+
+        EngramPagedStore* c = engram_open(g_dir);
+        store__compact_crashat(c, phase);         /* crashes mid-compaction (frees c) */
+
+        EngramPagedStore* r = engram_open(g_dir); /* recover */
+        char nm[80];
+        snprintf(nm, sizeof nm, "phase %d: recovers, crc clean", phase);
+        ok(nm, r && store_check(r, STORE_CHECK_CRC)==0);
+        snprintf(nm, sizeof nm, "phase %d: every live record intact (not corrupt)", phase);
+        ok(nm, r && verify_live_set(r)==0);
+        if (r){
+            uint64_t pc_now = store_page_count(r);
+            if (phase < 2){
+                snprintf(nm, sizeof nm, "phase %d: recovered PRE-compaction image", phase);
+                ok(nm, pc_now == pc_pre);
+            } else {
+                snprintf(nm, sizeof nm, "phase %d: recovered POST-compaction (shrunk)", phase);
+                ok(nm, pc_now < pc_pre);
+            }
+            /* store stays writable + durable after recovery */
+            StoreNode n; gen_node(N_NODES+phase, &n); free(n.id);
+            n.id = strdup("post-recovery-node");
+            store_put_node(r, &n); store_node_free(&n);
+            StoreNode g; int hit = store_get_node(r, "post-recovery-node", &g);
+            snprintf(nm, sizeof nm, "phase %d: store writable after recovery", phase);
+            ok(nm, hit==1);
+            if (hit==1) store_node_free(&g);
+            engram_close(r);
+        }
+    }
+}
+
+/* ════════════════════════════════════════════════════════════════════════════
+ * TEST 3 — BACKGROUND CHECKPOINTER: a low threshold fires checkpoints on the
+ * write path, reclaiming the WAL prefix automatically; recovery still correct.
+ * ════════════════════════════════════════════════════════════════════════════ */
+static void test_background_checkpointer(void){
+    printf("\n== 3) background checkpointer: auto-checkpoint on threshold ==\n");
+
+    /* (a) ops trigger */
+    {
+        mk_dir();
+        char wal[600]; wal_path(wal, sizeof wal);
+        EngramPagedStore* s = engram_open(g_dir);
+        if (!s){ ok("engram_open", 0); return; }
+        store_set_checkpoint_policy(s, /*ops*/50, /*dirty*/0, /*wal_bytes*/0, /*ms*/0);
+        uint64_t ckpt0 = engram_last_checkpoint_lsn(s);
+        for (int i=0;i<600;i++){ StoreNode n; gen_node(i,&n); store_put_node(s,&n); store_node_free(&n); }
+        uint64_t ckpt1 = engram_last_checkpoint_lsn(s);
+        long wsz = file_size(wal);
+        printf("   ops-trigger: ckpt_lsn %llu -> %llu, WAL=%ld bytes after 600 puts\n",
+               (unsigned long long)ckpt0, (unsigned long long)ckpt1, wsz);
+        ok("ops trigger fired an automatic checkpoint", ckpt1 > ckpt0);
+        ok("WAL prefix reclaimed (WAL stays small)", wsz >= 0 && wsz < 200000);
+        /* crash (abandon RAM) then recover — everything durable via WAL+checkpoint */
+        store__crash(s);
+        EngramPagedStore* r = engram_open(g_dir);
+        int bad=0;
+        for (int i=0;i<600;i++){ char id[32]; snprintf(id,sizeof id,"node-%d",i);
+            StoreNode w; gen_node(i,&w); StoreNode g; int hit=store_get_node(r,id,&g);
+            if (hit!=1 || !cmp_node(&w,&g)) bad++; if(hit==1) store_node_free(&g); store_node_free(&w); }
+        ok("recovery correct after auto-checkpoints (ops)", r && bad==0);
+        ok("crc clean after recovery (ops)", r && store_check(r,STORE_CHECK_CRC)==0);
+        if (r) engram_close(r);
+    }
+    /* (b) WAL-bytes trigger */
+    {
+        mk_dir();
+        char wal[600]; wal_path(wal, sizeof wal);
+        EngramPagedStore* s = engram_open(g_dir);
+        if (!s){ ok("engram_open", 0); return; }
+        store_set_checkpoint_policy(s, /*ops*/0, /*dirty*/0, /*wal_bytes*/64*1024, /*ms*/0);
+        uint64_t ckpt0 = engram_last_checkpoint_lsn(s);
+        for (int i=0;i<600;i++){ StoreNode n; gen_node(i,&n); store_put_node(s,&n); store_node_free(&n); }
+        uint64_t ckpt1 = engram_last_checkpoint_lsn(s);
+        long wsz = file_size(wal);
+        printf("   wal-bytes-trigger: ckpt_lsn %llu -> %llu, WAL=%ld bytes\n",
+               (unsigned long long)ckpt0, (unsigned long long)ckpt1, wsz);
+        ok("wal-bytes trigger fired an automatic checkpoint", ckpt1 > ckpt0);
+        ok("WAL kept bounded by byte threshold", wsz >= 0 && wsz < 2*1024*1024);
+        engram_close(s);
+    }
+    /* (c) dirty-frames trigger (under a bounded pool) */
+    {
+        mk_dir();
+        EngramPagedStore* s = engram_open(g_dir);
+        if (!s){ ok("engram_open", 0); return; }
+        store_set_checkpoint_policy(s, /*ops*/0, /*dirty*/16, /*wal_bytes*/0, /*ms*/0);
+        uint64_t ckpt0 = engram_last_checkpoint_lsn(s);
+        for (int i=0;i<400;i++){ StoreNode n; gen_node(i,&n); store_put_node(s,&n); store_node_free(&n); }
+        uint64_t ckpt1 = engram_last_checkpoint_lsn(s);
+        ok("dirty-frames trigger fired an automatic checkpoint", ckpt1 > ckpt0);
+        engram_close(s);
+    }
+}
+
+/* ════════════════════════════════════════════════════════════════════════════
+ * TEST 4 — POOL COOPERATION: compact under a tiny frame budget (constant eviction
+ * + re-fault); correctness holds and no stale frame survives a relocated page.
+ * ════════════════════════════════════════════════════════════════════════════ */
+static void test_pool_cooperation(void){
+    printf("\n== 4) compaction under a small buffer pool (forced eviction) ==\n");
+    setenv("ENGRAM_POOL_FRAMES", "24", 1);        /* pool << store, and the temp build too */
+    mk_dir();
+    char egm[600]; egm_path(egm, sizeof egm);
+    EngramPagedStore* s = engram_open(g_dir);
+    ok("engram_open (24-frame pool)", s != NULL);
+    if (!s){ unsetenv("ENGRAM_POOL_FRAMES"); return; }
+    store__set_pool_frames(s, 24);
+
+    populate_with_dead_space(s);
+    engram_checkpoint(s);
+    uint64_t pc_before = store_page_count(s);
+
+    int rc = store_compact(s);
+    ok("store_compact under tiny pool returns 0", rc==0);
+
+    StorePoolStats st; store_pool_stats(s, &st);
+    printf("   post-compaction pool: cap=%zu resident=%zu pinned=%zu dirty=%zu\n",
+           st.cap, st.resident, st.pinned, st.dirty);
+    ok("pool respected budget after compaction (resident<=cap)", st.resident <= st.cap);
+    ok("page count dropped under small pool", store_page_count(s) < pc_before);
+    ok("crc clean under small pool", store_check(s, STORE_CHECK_CRC)==0);
+    /* If any relocated page had a stale frame, a read would return wrong bytes. */
+    ok("every live record bit-exact under small pool (no stale frames)", verify_live_set(s)==0);
+
+    engram_close(s);
+    unsetenv("ENGRAM_POOL_FRAMES");
+}
+
+int main(void){
+    printf("=== M5 COMPACTION + BACKGROUND CHECKPOINTER GATE ===\n");
+    test_reclaim();
+    test_crash_during_compaction();
+    test_background_checkpointer();
+    test_pool_cooperation();
+    printf("\n=== RESULT: %d passed, %d failed ===\n", g_pass, g_fail);
+    /* cleanup */
+    return g_fail ? 1 : 0;
+}

engram/test/test_geometry.c

@@ -0,0 +1,159 @@
+/* test_geometry.c — build + RUN gate for the M9 FOUNDATION geometry descriptor
+ * (engram_geometry.{c,h}). Self-contained: synthesizes a store with two KNOWN
+ * embedding clusters + intra-cluster hebb edges, then verifies the descriptor
+ * recovers the shape — centroid near the seeded cluster, skeleton = the strong
+ * intra-cluster edges, membership gradient, radius, positive co-registration.
+ *
+ * Pure C11; links engram_geometry.c + engram_store.c + engram_vindex.c; -lm.
+ * ASan/UBSan clean. Needs no live data.
+ */
+#include "engram_geometry.h"
+#include "engram_store.h"
+#include "engram_vindex.h"
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <math.h>
+#include <stdint.h>
+#include <unistd.h>
+
+#define DIM 64
+static int g_fail=0;
+#define CHECK(c,m) do{ if(!(c)){printf("  FAIL: %s\n",m); g_fail=1;} else printf("  ok: %s\n",m);}while(0)
+
+static uint64_t rs=0x1234abcdULL;
+static uint64_t xr(void){ uint64_t z=(rs+=0x9E3779B97F4A7C15ULL);
+    z=(z^(z>>30))*0xBF58476D1CE4E5B9ULL; z=(z^(z>>27))*0x94D049BB133111EBULL; return z^(z>>31); }
+static float jitter(void){ return (float)(((double)(xr()>>11)*(1.0/9007199254740992.0))-0.5)*0.15f; }
+
+/* two clusters: A centered on axis 0, B centered on axis 1. NA+NB nodes. */
+#define NA 40
+#define NB 40
+
+int main(void){
+    printf("=== engram_geometry (M9 foundation) test suite ===\n");
+    char path[256]; snprintf(path,sizeof path,"/tmp/geo_test_store_%d.egm",(int)getpid());
+    unlink(path);
+    EngramPagedStore* st=store_create(path);
+    if(!st){ printf("FAIL: store_create\n"); return 1; }
+
+    char aids[NA][16], bids[NB][16];
+    /* cluster A: near +e0 ; cluster B: near +e1 */
+    for(int i=0;i<NA;i++){
+        StoreNode n; memset(&n,0,sizeof n);
+        snprintf(aids[i],16,"A%d",i); n.id=aids[i]; n.node_type="Concept"; n.tier="Semantic";
+        n.content="cluster-A"; n.salience=0.5+0.01*i;
+        float v[DIM]; for(int d=0;d<DIM;d++) v[d]=jitter(); v[0]=1.0f+jitter();
+        n.emb=v; n.emb_dim=DIM; store_put_node(st,&n);
+    }
+    for(int i=0;i<NB;i++){
+        StoreNode n; memset(&n,0,sizeof n);
+        snprintf(bids[i],16,"B%d",i); n.id=bids[i]; n.node_type="Concept"; n.tier="Semantic";
+        n.content="cluster-B"; n.salience=0.3;
+        float v[DIM]; for(int d=0;d<DIM;d++) v[d]=jitter(); v[1]=1.0f+jitter();
+        n.emb=v; n.emb_dim=DIM; store_put_node(st,&n);
+    }
+    /* strong intra-A hebb edges (a chain + hub), weaker cross edges A0<->B0 */
+    int ei=0;
+    for(int i=1;i<NA;i++){
+        StoreEdge e; memset(&e,0,sizeof e); char id[24]; snprintf(id,24,"eA%d",ei++);
+        e.id=id; e.from_id=aids[0]; e.to_id=aids[i]; e.relation="assoc"; e.weight=0.9; e.hebb=0.4;
+        store_put_edge(st,&e);
+    }
+    for(int i=1;i<NB;i++){
+        StoreEdge e; memset(&e,0,sizeof e); char id[24]; snprintf(id,24,"eB%d",ei++);
+        e.id=id; e.from_id=bids[0]; e.to_id=bids[i]; e.relation="assoc"; e.weight=0.9; e.hebb=0.4;
+        store_put_edge(st,&e);
+    }
+    { StoreEdge e; memset(&e,0,sizeof e); e.id=(char*)"eX"; e.from_id=aids[0]; e.to_id=bids[0];
+      e.relation="assoc"; e.weight=0.5; e.hebb=0.0; store_put_edge(st,&e); }
+    store_close(st);
+
+    VIndex* ix=vindex_create(DIM,0,0);
+    char** ids=NULL; int nids=0;
+    int ins=vindex_build_from_store(ix, path, &ids, &nids);
+    CHECK(ins==NA+NB, "vindex built over all embedded nodes");
+
+    GeoParams P; engram_geo_default_params(&P); P.ann_k=20; P.max_members=0;
+
+    /* seed inside cluster A -> expect an A-dominated neighborhood */
+    st=store_open(path);
+    /* global-mean cache over the embedded set: the centering offset */
+    GeoMeanCache* mc=engram_geo_mean_build(st);
+    const float* gm=engram_geo_mean_vec(mc);
+    CHECK(mc!=NULL && engram_geo_mean_dim(mc)==DIM, "global-mean cache built over embedded set");
+    CHECK(engram_geo_mean_count(mc)==(uint64_t)(NA+NB), "global mean averaged all embedded nodes");
+    const char* seeds[1]={aids[0]};
+    /* CENTERED descriptor: pass the global mean so geometry runs in isotropic space */
+    GeoDescriptor* g=engram_geometry_descriptor(st, ix, ids, nids, seeds, 1, &P, gm);
+    CHECK(g!=NULL, "descriptor computed");
+    if(g){
+        printf("  members=%d embedded=%d edges=%d k_core=%d radius=%.4f co_reg=%.3f n_axes=%d\n",
+               g->n_members,g->n_embedded,g->n_edges,g->k_core,g->radius,g->co_registration,g->n_axes);
+
+        /* geometry ran in CENTERED space: g->centroid is the centered centroid,
+         * g->global_mean the applied offset. Reconstruct the raw prototype
+         * (centroid + global_mean) and check it sits on cluster-A's axis. */
+        CHECK(g->global_mean!=NULL, "descriptor recorded the centering offset (centered mode)");
+        int argmax=0; float best=-1.f;
+        for(int d=0;d<g->dim;d++){ float raw=g->centroid[d]+(g->global_mean?g->global_mean[d]:0.f);
+            if(fabsf(raw)>best){ best=fabsf(raw); argmax=d; } }
+        printf("  raw-prototype dominant axis = %d (expect 0); centered c[0]=%.3f c[1]=%.3f\n",
+               argmax, g->centroid[0], g->centroid[1]);
+        CHECK(argmax==0, "raw prototype sits on cluster-A's axis (near members)");
+        /* centering pushes A off cluster-B's axis: centered c[0] > c[1] */
+        CHECK(g->centroid[0] > g->centroid[1], "centered centroid leans off B's axis (isotropy)");
+
+        /* hub should be A0 (the intra-A hub with NA-1 strong edges) */
+        CHECK(g->hub_id && strcmp(g->hub_id,"A0")==0, "hub = the relational center A0");
+
+        /* membership: seed A0 == 1.0; A-members strong, B-members (if any) weaker */
+        double seedw=-1, minA=2, maxB=-1; int na=0,nb=0;
+        for(int i=0;i<g->n_members;i++){
+            const char* id=g->members[i].id; double w=g->members[i].membership;
+            if(strcmp(id,"A0")==0) seedw=w;
+            if(id[0]=='A'){ na++; if(w<minA)minA=w; }
+            if(id[0]=='B'){ nb++; if(w>maxB)maxB=w; }
+        }
+        printf("  A-members=%d B-members=%d seedw=%.3f\n", na,nb,seedw);
+        CHECK(fabs(seedw-1.0)<1e-9, "seed membership == 1.0");
+        CHECK(na>=NA-1, "neighborhood recovers cluster A");
+
+        /* skeleton = the strong intra-A edges: every edge eff_weight>=threshold,
+         * and edges connect A-nodes (co-registration should be positive: wired
+         * pairs are semantically near). */
+        int allstrong=1, allA=1;
+        for(int e=0;e<g->n_edges;e++){
+            if(g->edges[e].eff_weight < P.edge_min_weight) allstrong=0;
+            const char* a=g->members[g->edges[e].a].id, *b=g->members[g->edges[e].b].id;
+            if(!(a[0]=='A'&&b[0]=='A')) { /* the lone eX cross edge is allowed */
+                if(!((strcmp(a,"A0")==0&&strcmp(b,"B0")==0)||(strcmp(a,"B0")==0&&strcmp(b,"A0")==0))) allA=0; }
+        }
+        CHECK(allstrong, "skeleton holds only above-threshold (strong) edges");
+        CHECK(allA, "skeleton backbone is the intra-cluster wiring");
+        CHECK(g->co_registration>0.0, "co-registration positive (wired pairs are semantically near)");
+
+        /* principal axes: extents strictly non-increasing */
+        int mono=1; for(int i=1;i<g->n_axes;i++) if(g->axes[i].extent>g->axes[i-1].extent+1e-9) mono=0;
+        CHECK(g->n_axes>0 && mono, "principal axes sorted by descending extent");
+        CHECK(g->radius>0, "radius positive");
+    }
+    engram_geo_free(g);
+
+    /* edge cases: NULL store, no seeds, relational-only (NULL vindex) */
+    CHECK(engram_geometry_descriptor(NULL,ix,ids,nids,seeds,1,&P,gm)==NULL, "NULL store -> NULL");
+    CHECK(engram_geometry_descriptor(st,ix,ids,nids,seeds,0,&P,gm)==NULL, "zero seeds -> NULL");
+    GeoDescriptor* g2=engram_geometry_descriptor(st, NULL, NULL, 0, seeds, 1, &P, gm);
+    CHECK(g2!=NULL && g2->n_members>=NA-1, "relational-only path (no vindex) works");
+    engram_geo_free(g2);
+    /* raw (uncentered) mode still supported: global_mean=NULL -> no offset recorded */
+    GeoDescriptor* g3=engram_geometry_descriptor(st, ix, ids, nids, seeds, 1, &P, NULL);
+    CHECK(g3!=NULL && g3->global_mean==NULL, "raw mode (global_mean=NULL) leaves offset unset");
+    engram_geo_free(g3);
+
+    engram_geo_mean_free(mc);
+    for(int i=0;i<nids;i++) free(ids[i]); free(ids);
+    vindex_free(ix); store_close(st); unlink(path);
+    printf("\n=== %s ===\n", g_fail?"FAILURES PRESENT":"ALL TESTS PASSED");
+    return g_fail;
+}

engram/test/test_interoception_p0_emb.c

@@ -0,0 +1,79 @@
+/* test_interoception_p0_emb.c — M-INTEROCEPTION Priority 0.
+ *
+ * Verifies the new READ-ONLY builtin engram_scan_nodes_emb_json(limit,offset):
+ *   - every emitted node carries emb_dim and an emb JSON array of that length,
+ *   - nodes without an embedding emit emb_dim:0 / emb:[],
+ *   - pagination (limit/offset) is honoured,
+ *   - the count matches engram_node_count,
+ *   - the EXISTING engram_scan_nodes_json path is byte-unchanged (no emb field),
+ *     i.e. the addition is purely additive / behavior-neutral.
+ *
+ * Pure-C harness (no elc). We craft a snapshot with real emb vectors, load it
+ * (engram_load parses "emb" comma-lists into node->emb via eg_parse_emb), then
+ * dump via both scan paths. Assertions live in run_interoception_p0.sh.
+ */
+#include "el_runtime.h"
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+static el_val_t S(const char* s){ return EL_STR(s); }
+
+/* 16-d embedding as a comma list (>=8 required by eg_parse_emb). */
+static void emb_list(char* out, size_t cap, int dim, double base){
+    size_t o = 0;
+    for (int i = 0; i < dim; i++){
+        o += snprintf(out+o, cap-o, "%s%.4f", i?",":"", base + 0.01*i);
+    }
+}
+
+int main(int argc, char** argv){
+    if (argc < 2){ fprintf(stderr, "usage: %s <dir>\n", argv[0]); return 2; }
+    const char* dir = argv[1];
+    char snap[1024]; snprintf(snap, sizeof snap, "%s/seed.json", dir);
+
+    char e1[512], e2[512];
+    emb_list(e1, sizeof e1, 16, 0.10);
+    emb_list(e2, sizeof e2, 16, 0.50);
+
+    /* Two embedded nodes (distinct salience → deterministic sort order) and one
+     * un-embedded node. */
+    FILE* f = fopen(snap, "w");
+    if (!f){ perror("fopen"); return 2; }
+    fprintf(f,
+      "{\"nodes\":["
+        "{\"id\":\"n-high\",\"content\":\"high salience embedded\",\"node_type\":\"Concept\","
+          "\"label\":\"emb-high\",\"tier\":\"Semantic\",\"salience\":0.9,\"importance\":0.8,"
+          "\"confidence\":1.0,\"created_at\":1000,\"emb\":\"%s\"},"
+        "{\"id\":\"n-mid\",\"content\":\"mid salience embedded\",\"node_type\":\"Concept\","
+          "\"label\":\"emb-mid\",\"tier\":\"Semantic\",\"salience\":0.5,\"importance\":0.5,"
+          "\"confidence\":1.0,\"created_at\":2000,\"emb\":\"%s\"},"
+        "{\"id\":\"n-low\",\"content\":\"low salience no embedding\",\"node_type\":\"Fact\","
+          "\"label\":\"noemb-low\",\"tier\":\"Semantic\",\"salience\":0.1,\"importance\":0.2,"
+          "\"confidence\":1.0,\"created_at\":3000}"
+      "],\"edges\":[]}", e1, e2);
+    fclose(f);
+
+    if (!engram_load(S(snap))){ fprintf(stderr, "load failed\n"); return 2; }
+    long long nc = (long long)(int64_t)engram_node_count();
+    printf("node_count=%lld\n", nc);
+
+    /* full page */
+    el_val_t all = engram_scan_nodes_emb_json((el_val_t)256, (el_val_t)0);
+    char p[1024];
+    snprintf(p, sizeof p, "%s/emb_all.json", dir);
+    f = fopen(p, "w"); fputs(EL_CSTR(all), f); fclose(f);
+
+    /* pagination: one node at offset 0 and one at offset 1 */
+    el_val_t pg0 = engram_scan_nodes_emb_json((el_val_t)1, (el_val_t)0);
+    el_val_t pg1 = engram_scan_nodes_emb_json((el_val_t)1, (el_val_t)1);
+    snprintf(p, sizeof p, "%s/emb_pg0.json", dir); f = fopen(p, "w"); fputs(EL_CSTR(pg0), f); fclose(f);
+    snprintf(p, sizeof p, "%s/emb_pg1.json", dir); f = fopen(p, "w"); fputs(EL_CSTR(pg1), f); fclose(f);
+
+    /* existing path — must be unchanged / carry NO emb */
+    el_val_t plain = engram_scan_nodes_json((el_val_t)256, (el_val_t)0);
+    snprintf(p, sizeof p, "%s/plain.json", dir); f = fopen(p, "w"); fputs(EL_CSTR(plain), f); fclose(f);
+
+    printf("wrote dumps to %s\n", dir);
+    return 0;
+}

engram/test/test_interoception_p1_consol.c

@@ -0,0 +1,124 @@
+/* test_interoception_p1_consol.c — M-INTEROCEPTION Priority 1.
+ * Two-threshold consolidation (ENGRAM_CONSOLIDATION, default OFF).
+ *
+ * Modes:
+ *   accrual  — flag OFF (pure trunk). Drive N co-activations of a WIRED pair and
+ *              print act-stats at sampled N so the run script can plot the
+ *              hebb accrual curve (headline measurement). No consolidation code
+ *              runs; this measures the EXISTING EWMA accrual.
+ *   connect  — flag ON. Seed, activate to populate WM, then create a STRONG ISE
+ *              (connects to wm_top) and a WEAK ISE (below the bar → nothing).
+ *              Exports the graph so edges from each ISE can be counted.
+ *   perm     — flag ON. Load two OLD InternalStateEvent nodes; promote one to
+ *              permanence; prune telemetry; export so the durable one is shown
+ *              to survive while the ephemeral one is swept.
+ *   offcheck — flag OFF. Prove creating an ISE forms NO edges and
+ *              engram_consolidate_permanence is a no-op (byte-identical OFF path).
+ */
+#include "el_runtime.h"
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+static el_val_t S(const char* s){ return EL_STR(s); }
+static el_val_t F(double d){ return el_from_float(d); }
+
+static void build_seed(void){
+    el_val_t a = engram_node_full(S("hebbian potentiation strengthens co-active memory links"),
+                    S("Concept"), S("hebb-a"), F(0.9), F(0.85), F(1.0), S("Semantic"),
+                    S("hebbian,memory,activation"));
+    el_val_t b = engram_node_full(S("co-active memory links accrue hebbian associative weight"),
+                    S("Concept"), S("hebb-b"), F(0.9), F(0.85), F(1.0), S("Semantic"),
+                    S("hebbian,memory,weight"));
+    el_val_t c = engram_node_full(S("unrelated culinary recipe for sourdough bread"),
+                    S("Fact"), S("distractor-1"), F(0.4), F(0.4), F(1.0), S("Semantic"), S("food"));
+    el_val_t d = engram_node_full(S("the weather forecast predicts rain tomorrow afternoon"),
+                    S("Fact"), S("distractor-2"), F(0.4), F(0.4), F(1.0), S("Semantic"), S("weather"));
+    engram_connect(a, b, F(0.8), S("associate"));
+    engram_connect(a, c, F(0.3), S("associate"));
+    engram_connect(b, d, F(0.3), S("associate"));
+}
+static const char* QUERY =
+    "hebbian potentiation co-active memory links associative weight";
+
+int main(int argc, char** argv){
+    if (argc < 3){ fprintf(stderr,"usage: %s <accrual|connect|perm|offcheck> <dir>\n",argv[0]); return 2; }
+    const char* mode = argv[1];
+    const char* dir  = argv[2];
+    char p[1024];
+
+    if (!strcmp(mode,"accrual")){
+        build_seed();
+        int samples[] = {1,10,50,100,250,500,1000,1625,2000,2500,3000};
+        int ns = (int)(sizeof samples/sizeof samples[0]);
+        int NMAX = samples[ns-1];
+        int si = 0;
+        for (int n=1; n<=NMAX; n++){
+            engram_activate_json(S(QUERY), (el_val_t)3);
+            if (si<ns && n==samples[si]){
+                printf("SAMPLE %d %s\n", n, EL_CSTR(engram_act_stats_json()));
+                si++;
+            }
+        }
+        return 0;
+    }
+
+    if (!strcmp(mode,"connect")){
+        build_seed();
+        engram_activate_json(S(QUERY), (el_val_t)3);
+        long long e_before = (long long)(int64_t)engram_edge_count();
+        /* STRONG ISE — should connect to wm_top */
+        el_val_t ise_strong = engram_node_full(S("strong internal state: focused on hebbian consolidation"),
+                        S("InternalStateEvent"), S("ise-strong"), F(0.9), F(0.8), F(1.0), S("Working"), S("ise"));
+        long long e_after_strong = (long long)(int64_t)engram_edge_count();
+        /* WEAK ISE — below the connection bar (salience 0.3 < default 0.6) */
+        el_val_t ise_weak = engram_node_full(S("weak internal state: idle drift"),
+                        S("InternalStateEvent"), S("ise-weak"), F(0.3), F(0.3), F(1.0), S("Working"), S("ise"));
+        long long e_after_weak = (long long)(int64_t)engram_edge_count();
+        printf("ISE_STRONG_ID %s\n", EL_CSTR(ise_strong));
+        printf("ISE_WEAK_ID %s\n", EL_CSTR(ise_weak));
+        printf("EDGES before=%lld after_strong=%lld after_weak=%lld\n",
+               e_before, e_after_strong, e_after_weak);
+        snprintf(p,sizeof p,"%s/connect.json",dir);
+        el_val_t g = engram_save(S(p)); (void)g;
+        return 0;
+    }
+
+    if (!strcmp(mode,"perm")){
+        /* Two OLD ISE nodes (created_at far in the past → prunable at 48h). */
+        snprintf(p,sizeof p,"%s/seed.json",dir);
+        FILE* f=fopen(p,"w");
+        fprintf(f,"{\"nodes\":["
+          "{\"id\":\"ise-durable\",\"content\":\"promoted internal state\",\"node_type\":\"InternalStateEvent\","
+            "\"label\":\"ise-durable\",\"salience\":0.5,\"confidence\":1.0,\"created_at\":1000},"
+          "{\"id\":\"ise-ephemeral\",\"content\":\"transient internal state\",\"node_type\":\"InternalStateEvent\","
+            "\"label\":\"ise-ephemeral\",\"salience\":0.5,\"confidence\":1.0,\"created_at\":1000}"
+          "],\"edges\":[]}");
+        fclose(f);
+        if(!engram_load(S(p))){ fprintf(stderr,"load failed\n"); return 2; }
+        long long n_before = (long long)(int64_t)engram_node_count();
+        el_val_t promoted = engram_consolidate_permanence(S("ise-durable"));
+        long long removed = (long long)(int64_t)engram_prune_telemetry((el_val_t)0); /* default 48h */
+        long long n_after = (long long)(int64_t)engram_node_count();
+        printf("PROMOTED %lld\n", (long long)(int64_t)promoted);
+        printf("NODES before=%lld after=%lld removed=%lld\n", n_before, n_after, removed);
+        printf("DURABLE_NODE %s\n", EL_CSTR(engram_get_node_json(S("ise-durable"))));
+        printf("EPHEMERAL_NODE %s\n", EL_CSTR(engram_get_node_json(S("ise-ephemeral"))));
+        return 0;
+    }
+
+    if (!strcmp(mode,"offcheck")){
+        build_seed();
+        engram_activate_json(S(QUERY), (el_val_t)3);
+        long long e_before = (long long)(int64_t)engram_edge_count();
+        engram_node_full(S("strong internal state with flag OFF"),
+                        S("InternalStateEvent"), S("ise-off"), F(0.9), F(0.8), F(1.0), S("Working"), S("ise"));
+        long long e_after = (long long)(int64_t)engram_edge_count();
+        el_val_t perm = engram_consolidate_permanence(S("ise-off"));
+        printf("OFF edges before=%lld after=%lld perm_ret=%lld\n",
+               e_before, e_after, (long long)(int64_t)perm);
+        return (e_before==e_after && (int64_t)perm==0) ? 0 : 1;
+    }
+
+    fprintf(stderr,"unknown mode %s\n",mode); return 2;
+}

engram/test/test_interoception_p2_chrono.c

@@ -0,0 +1,95 @@
+/* test_interoception_p2_chrono.c — M-INTEROCEPTION Priority 2.
+ * Chronoception: engram_age_field(delta_ms) + reboot catch-up
+ * (ENGRAM_CHRONOCEPTION, default OFF).
+ *
+ * Uses loaded snapshots with KNOWN working_memory_weight / background_activation
+ * so the field is deterministic without depending on activation. (engram_load
+ * halves WM on boot — the laundering step — so snapshot wm 1.0 -> 0.5 resident.)
+ *
+ * Modes:
+ *   once  <dir> <dt_ms>          — age the field once by dt; save field.json.
+ *   split <dir> <dt_ms> <N>      — age by dt/N, N times; save field.json.
+ *                                  (once vs split must match: scale-invariance.)
+ *   catchup <dir> <gap_ms>       — write a last-tick gap_ms in the past, then
+ *                                  engram_age_field_catchup(); print MAGNITUDE.
+ *   offcheck <dir> <dt_ms>       — flag OFF: age returns 0 and field is untouched.
+ */
+#include "el_runtime.h"
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/time.h>
+
+static el_val_t S(const char* s){ return EL_STR(s); }
+
+static void write_seed(const char* dir){
+    char p[1024]; snprintf(p,sizeof p,"%s/seed.json",dir);
+    FILE* f=fopen(p,"w");
+    fprintf(f,"{\"nodes\":["
+      "{\"id\":\"f1\",\"content\":\"field node 1\",\"node_type\":\"Concept\",\"label\":\"f1\","
+        "\"salience\":0.9,\"confidence\":1.0,\"working_memory_weight\":1.0,\"background_activation\":0.5},"
+      "{\"id\":\"f2\",\"content\":\"field node 2\",\"node_type\":\"Concept\",\"label\":\"f2\","
+        "\"salience\":0.8,\"confidence\":1.0,\"working_memory_weight\":0.8,\"background_activation\":0.4},"
+      "{\"id\":\"f3\",\"content\":\"field node 3\",\"node_type\":\"Concept\",\"label\":\"f3\","
+        "\"salience\":0.7,\"confidence\":1.0,\"working_memory_weight\":0.6,\"background_activation\":0.3}"
+      "],\"edges\":[]}");
+    fclose(f);
+}
+static void load_seed(const char* dir){
+    char p[1024]; snprintf(p,sizeof p,"%s/seed.json",dir);
+    write_seed(dir);
+    if(!engram_load(S(p))){ fprintf(stderr,"load failed\n"); exit(2); }
+}
+static void save_field(const char* dir){
+    char p[1024]; snprintf(p,sizeof p,"%s/field.json",dir);
+    engram_save(S(p));
+}
+
+int main(int argc,char** argv){
+    if(argc<3){ fprintf(stderr,"usage: %s <once|split|catchup|offcheck> <dir> ...\n",argv[0]); return 2; }
+    const char* mode=argv[1];
+    const char* dir =argv[2];
+
+    if(!strcmp(mode,"once")){
+        double dt=atof(argv[3]);
+        load_seed(dir);
+        el_val_t mag=engram_age_field((el_val_t)(int64_t)dt);
+        printf("MAGNITUDE %.10f\n", el_to_float(mag));
+        save_field(dir);
+        return 0;
+    }
+    if(!strcmp(mode,"split")){
+        double dt=atof(argv[3]); int N=atoi(argv[4]); if(N<1)N=1;
+        load_seed(dir);
+        double sub=dt/(double)N;
+        for(int i=0;i<N;i++) engram_age_field((el_val_t)(int64_t)sub);
+        save_field(dir);
+        printf("SPLIT dt=%.0f N=%d sub=%.4f\n", dt, N, sub);
+        return 0;
+    }
+    if(!strcmp(mode,"catchup")){
+        double gap=atof(argv[3]);
+        load_seed(dir);
+        /* Write a last-tick gap_ms in the past. ENGRAM_DATA_DIR is set == dir by
+         * the runner, so the sidecar the runtime reads is <dir>/chrono_last_tick. */
+        struct timeval tv; gettimeofday(&tv,NULL);
+        long long now_ms=(long long)tv.tv_sec*1000+tv.tv_usec/1000;
+        long long last=now_ms-(long long)gap;
+        char p[1200]; snprintf(p,sizeof p,"%s/chrono_last_tick",dir);
+        FILE* f=fopen(p,"w"); fprintf(f,"%lld\n",last); fclose(f);
+        el_val_t mag=engram_age_field_catchup();
+        printf("CATCHUP_MAGNITUDE %.10f\n", el_to_float(mag));
+        save_field(dir);
+        return 0;
+    }
+    if(!strcmp(mode,"offcheck")){
+        double dt=atof(argv[3]);
+        load_seed(dir);
+        el_val_t mag=engram_age_field((el_val_t)(int64_t)dt);
+        el_val_t magc=engram_age_field_catchup();
+        printf("OFF age_mag=%.10f catchup_mag=%.10f\n", el_to_float(mag), el_to_float(magc));
+        save_field(dir);
+        return 0;
+    }
+    fprintf(stderr,"unknown mode %s\n",mode); return 2;
+}

engram/test/test_interoception_p3_drift.c

@@ -0,0 +1,61 @@
+/* test_interoception_p3_drift.c — M-INTEROCEPTION Priority 3 (PARTIAL).
+ * Drift-sensor primitive engram_geo_displacement: GROWTH vs CORRUPTION split.
+ *
+ * Constructs synthetic GeoDescriptors (the struct is public) — a baseline and
+ * two perturbations — and checks the sensor reports LOW core-displacement for a
+ * periphery-only change (growth) and HIGH core-displacement for a core change
+ * (corruption). No store / embeddings needed: this exercises the primitive in
+ * isolation, which is the honest scope given there is no persisted SelfAnchor
+ * yet (see engram_geometry.c). */
+#include "engram_geometry.h"
+#include <stdlib.h>
+#include <string.h>
+#include <stdio.h>
+
+static GeoMember MK(const char* id, double centrality, double dist){
+    GeoMember m; memset(&m,0,sizeof m);
+    m.id=strdup(id); m.centrality=centrality; m.dist_centroid=dist;
+    m.membership=1.0; m.embedded=1; return m;
+}
+/* 4 members: 2 core (high centrality), 2 periphery (low). */
+static GeoDescriptor* mkdesc(float cx,float cy,double radius,
+                             double c1,double c2,double p1,double p2){
+    GeoDescriptor* g=calloc(1,sizeof *g);
+    g->dim=4;
+    g->centroid=calloc(4,sizeof(float));
+    g->centroid[0]=cx; g->centroid[1]=cy;
+    g->radius=radius;
+    g->n_members=4;
+    g->members=calloc(4,sizeof(GeoMember));
+    g->members[0]=MK("core1",10.0,c1);
+    g->members[1]=MK("core2", 9.0,c2);
+    g->members[2]=MK("per1",  1.0,p1);
+    g->members[3]=MK("per2",  0.9,p2);
+    return g;
+}
+
+int main(void){
+    GeoDisplacement d;
+    /* baseline: core at 0.10, periphery at 0.50, centroid [1,0], radius 1.0 */
+    GeoDescriptor* A = mkdesc(1.0f,0.0f,1.0, 0.10,0.10, 0.50,0.50);
+
+    /* (i) GROWTH: periphery extends 0.50->0.90; core fixed; radius grows. */
+    GeoDescriptor* G = mkdesc(1.0f,0.0f,1.4, 0.10,0.10, 0.90,0.90);
+    engram_geo_displacement(A,G,0.5,&d);
+    printf("GROWTH centroid_sep=%.4f centroid_cos=%.4f radius_delta=%.4f core_disp=%.4f periph_disp=%.4f core_n=%d periph_n=%d\n",
+           d.centroid_sep,d.centroid_cos,d.radius_delta,d.core_disp,d.periph_disp,d.core_matched,d.periph_matched);
+
+    /* (ii) CORRUPTION: core displaces 0.10->0.60; periphery fixed; centroid shifts. */
+    GeoDescriptor* C = mkdesc(0.6f,0.4f,1.0, 0.60,0.60, 0.50,0.50);
+    engram_geo_displacement(A,C,0.5,&d);
+    printf("CORRUPTION centroid_sep=%.4f centroid_cos=%.4f radius_delta=%.4f core_disp=%.4f periph_disp=%.4f core_n=%d periph_n=%d\n",
+           d.centroid_sep,d.centroid_cos,d.radius_delta,d.core_disp,d.periph_disp,d.core_matched,d.periph_matched);
+
+    /* identity: A vs A -> zero drift */
+    engram_geo_displacement(A,A,0.5,&d);
+    printf("IDENTITY centroid_sep=%.4f core_disp=%.4f periph_disp=%.4f\n",
+           d.centroid_sep,d.core_disp,d.periph_disp);
+
+    engram_geo_free(A); engram_geo_free(G); engram_geo_free(C);
+    return 0;
+}

engram/test/test_interoception_p4_afferent.c

@@ -0,0 +1,35 @@
+/* test_interoception_p4_afferent.c — M-INTEROCEPTION Priority 4.
+ * Afferent input counters in engram_act_stats_json: additive observability.
+ * Drives KNOWN counts and asserts the emitted counters match and are monotonic.
+ */
+#include "el_runtime.h"
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+static el_val_t S(const char* s){ return EL_STR(s); }
+static el_val_t F(double d){ return el_from_float(d); }
+
+int main(void){
+    /* 3 plain node creates + 2 ISE creates = 5 node_creates, 2 ise_ingests */
+    el_val_t a=engram_node_full(S("alpha concept about memory and time"),S("Concept"),S("a"),F(0.9),F(0.8),F(1.0),S("Semantic"),S("x"));
+    el_val_t b=engram_node_full(S("beta concept about memory and links"),S("Concept"),S("b"),F(0.9),F(0.8),F(1.0),S("Semantic"),S("x"));
+    engram_node_full(S("gamma distractor"),S("Fact"),S("c"),F(0.4),F(0.4),F(1.0),S("Semantic"),S("y"));
+    engram_node_full(S("heartbeat internal state one"),S("InternalStateEvent"),S("i1"),F(0.5),F(0.5),F(1.0),S("Working"),S("ise"));
+    engram_node_full(S("curiosity internal state two"),S("InternalStateEvent"),S("i2"),F(0.5),F(0.5),F(1.0),S("Working"),S("ise"));
+    /* 2 edge creates */
+    engram_connect(a,b,F(0.8),S("associate"));
+    engram_connect(b,a,F(0.3),S("associate"));
+
+    /* first reading (0 queries so far) */
+    printf("STATS0 %s\n", EL_CSTR(engram_act_stats_json()));
+
+    /* 4 queries -> 4 activations */
+    for(int i=0;i<4;i++) engram_activate_json(S("memory and time and links"), (el_val_t)2);
+    printf("STATS1 %s\n", EL_CSTR(engram_act_stats_json()));
+
+    /* 3 more queries -> monotonic increase */
+    for(int i=0;i<3;i++) engram_activate_json(S("memory and time and links"), (el_val_t)2);
+    printf("STATS2 %s\n", EL_CSTR(engram_act_stats_json()));
+    return 0;
+}

engram/test/test_interoception_p5_dreams.c

@@ -0,0 +1,47 @@
+/* test_interoception_p5_dreams.c — M-INTEROCEPTION Priority 5.
+ * Dream-recall-on-wake: engram_dreams_json(since_ms). Honesty rail — only
+ * curiosity_scan ISEs still resident are returned; pruned (rotated-out) ones are
+ * ABSENT (never confabulated); heartbeat ISEs are excluded.
+ */
+#include "el_runtime.h"
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/time.h>
+
+static el_val_t S(const char* s){ return EL_STR(s); }
+
+int main(int argc,char** argv){
+    if(argc<2){ fprintf(stderr,"usage: %s <dir>\n",argv[0]); return 2; }
+    const char* dir=argv[1];
+    struct timeval tv; gettimeofday(&tv,NULL);
+    long long now=(long long)tv.tv_sec*1000+tv.tv_usec/1000;
+    long long mid=now-3600000;   /* 1h ago */
+    long long ancient=1000;      /* pruned by 48h retention */
+
+    char p[1024]; snprintf(p,sizeof p,"%s/seed.json",dir);
+    FILE* f=fopen(p,"w");
+    fprintf(f,"{\"nodes\":["
+      "{\"id\":\"cur_old\",\"content\":\"{\\\"kind\\\":\\\"curiosity_scan\\\",\\\"q\\\":\\\"old wondering\\\"}\","
+        "\"node_type\":\"InternalStateEvent\",\"label\":\"state-event\",\"created_at\":%lld},"
+      "{\"id\":\"cur_mid\",\"content\":\"{\\\"kind\\\":\\\"curiosity_scan\\\",\\\"q\\\":\\\"mid wondering\\\"}\","
+        "\"node_type\":\"InternalStateEvent\",\"label\":\"state-event\",\"created_at\":%lld},"
+      "{\"id\":\"cur_recent\",\"content\":\"{\\\"kind\\\":\\\"curiosity_scan\\\",\\\"q\\\":\\\"recent wondering\\\"}\","
+        "\"node_type\":\"InternalStateEvent\",\"label\":\"state-event\",\"created_at\":%lld},"
+      "{\"id\":\"hb_recent\",\"content\":\"{\\\"kind\\\":\\\"heartbeat\\\",\\\"wm\\\":3}\","
+        "\"node_type\":\"InternalStateEvent\",\"label\":\"state-event\",\"created_at\":%lld}"
+      "],\"edges\":[]}", ancient, mid, now, now);
+    fclose(f);
+    if(!engram_load(S(p))){ fprintf(stderr,"load failed\n"); return 2; }
+
+    /* before prune: all resident curiosity_scan after since=0 */
+    printf("BEFORE %s\n", EL_CSTR(engram_dreams_json((el_val_t)0)));
+    /* prune 48h — cur_old (ancient) rotates out */
+    long long pruned=(long long)(int64_t)engram_prune_telemetry((el_val_t)0);
+    printf("PRUNED %lld\n", pruned);
+    printf("AFTER %s\n", EL_CSTR(engram_dreams_json((el_val_t)0)));
+    /* since filter: only events created after 30 min ago -> cur_recent only */
+    long long since=now-1800000;
+    printf("SINCE %lld %s\n", since, EL_CSTR(engram_dreams_json((el_val_t)(int64_t)since)));
+    return 0;
+}

engram/test/test_m35_hebb_persist.c

@@ -0,0 +1,130 @@
+/* test_m35_hebb_persist.c — M3.5 PRE-FLIP GATE.
+ *
+ * Proves that in-place field mutations made during spreading activation — edge
+ * `hebb` (+ last_fired), node `activation_count`, node working-memory weight —
+ * PERSIST to the paged store and survive a restart from neuron.egm with
+ * snapshot.json deleted. This is the "hebb-survives-restart" fix that gates the
+ * live cutover.
+ *
+ * Same style as test_m3_parity.c: a REAL el-level harness linking the actual
+ * el_runtime.c native engram builtins + engram_store.c, driving engram_node_full
+ * / engram_connect / engram_activate_json / engram_save / engram_store_boot /
+ * engram_store_checkpoint / engram_store_close directly from C. No EL interpreter.
+ *
+ * Modes (argv[1]), data dir (argv[2]):
+ *   pos_seed  — ENGRAM_STORE=1: fresh store, seed a graph tuned so activation
+ *               co-activates a connected pair (edge hebb 0 -> ETA) and reinforces
+ *               nodes (activation_count 0 -> >=1, WM weight -> >0). Export the
+ *               post-activation resident graph to pre_reboot.json, then CHECKPOINT
+ *               (the M3.5 field-persist), then close.
+ *   pos_reboot— ENGRAM_STORE=1, snapshot.json deleted by runner: boot from
+ *               neuron.egm (WAL replay), export reboot.json, close. The values in
+ *               reboot.json are what actually survived the round-trip.
+ *   neg_seed  — identical to pos_seed but WITHOUT the checkpoint field-persist
+ *               (negative control): activation mutations never reach the store.
+ *   neg_reboot— boot from neuron.egm, export neg_reboot.json, close.
+ *   offcheck  — ENGRAM_STORE unset: seed+activate+checkpoint must NOT touch the
+ *               store (no neuron.egm, checkpoint returns 0).
+ *
+ * The pass/fail assertions live in run_m35_hebb_persist.sh (python over the JSON
+ * exports): reboot.json must carry the learned hebb / activation_count and the
+ * JSON-identical halved WM weight; neg_reboot.json must have LOST them.
+ */
+#include "el_runtime.h"
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+extern int      engram_store_enabled(void);
+extern el_val_t engram_store_boot(el_val_t data_dir);
+extern el_val_t engram_store_checkpoint(void);
+extern el_val_t engram_store_close(void);
+
+static el_val_t S(const char* s){ return EL_STR(s); }
+static el_val_t F(double d){ return el_from_float(d); }
+
+/* Two nodes with DISTINCT content (so the redundancy-suppression pass cannot
+ * dedup one of them away) that both match the query strongly, wired by one
+ * "associate" edge. A handful of weakly-related distractors make it a real
+ * graph. On activation both A and B promote to working memory and co-activate,
+ * so their edge's hebb rises from 0 to ENGRAM_HEBB_ETA. */
+static void build_seed(void){
+    el_val_t a = engram_node_full(S("hebbian potentiation strengthens co-active memory links"),
+                    S("Concept"), S("hebb-a"), F(0.9), F(0.85), F(1.0), S("Semantic"),
+                    S("hebbian,memory,activation"));
+    el_val_t b = engram_node_full(S("co-active memory links accrue hebbian associative weight"),
+                    S("Concept"), S("hebb-b"), F(0.9), F(0.85), F(1.0), S("Semantic"),
+                    S("hebbian,memory,weight"));
+    el_val_t c = engram_node_full(S("unrelated culinary recipe for sourdough bread"),
+                    S("Fact"), S("distractor-1"), F(0.4), F(0.4), F(1.0), S("Semantic"),
+                    S("food"));
+    el_val_t d = engram_node_full(S("the weather forecast predicts rain tomorrow afternoon"),
+                    S("Fact"), S("distractor-2"), F(0.4), F(0.4), F(1.0), S("Semantic"),
+                    S("weather"));
+    engram_connect(a, b, F(0.8), S("associate"));   /* the edge under test */
+    engram_connect(a, c, F(0.3), S("associate"));
+    engram_connect(b, d, F(0.3), S("associate"));
+}
+
+static const char* QUERY =
+    "hebbian potentiation co-active memory links associative weight";
+
+static void export_graph(const char* dir, const char* name){
+    char p[1024];
+    snprintf(p, sizeof p, "%s/%s", dir, name);
+    if (!engram_save(S(p))){ fprintf(stderr, "save %s failed\n", name); exit(2); }
+}
+
+int main(int argc, char** argv){
+    if (argc < 3){
+        fprintf(stderr, "usage: %s <pos_seed|pos_reboot|neg_seed|neg_reboot|offcheck> <dir>\n", argv[0]);
+        return 2;
+    }
+    const char* mode = argv[1];
+    const char* dir  = argv[2];
+
+    if (!strcmp(mode, "pos_seed") || !strcmp(mode, "neg_seed")){
+        int persist = !strcmp(mode, "pos_seed");
+        if (!engram_store_enabled()){ fprintf(stderr, "%s requires ENGRAM_STORE=1\n", mode); return 2; }
+        if (!engram_store_boot(S(dir))){ fprintf(stderr, "store boot failed\n"); return 2; }
+        build_seed();
+        el_val_t act = engram_activate_json(S(QUERY), (el_val_t)3);
+        (void)act;
+        /* Capture the post-activation resident state BEFORE persisting/closing. */
+        export_graph(dir, persist ? "pre_reboot.json" : "neg_pre.json");
+        printf("[%s] nodes=%lld edges=%lld\n", mode,
+               (long long)(int64_t)engram_node_count(),
+               (long long)(int64_t)engram_edge_count());
+        if (persist){
+            if (!engram_store_checkpoint()){ fprintf(stderr, "checkpoint failed\n"); return 2; }
+        }
+        /* neg mode: NO field-persist checkpoint. engram_store_close still flushes
+         * pages, but no store_put_* ran post-creation, so the store keeps the
+         * pristine creation-time field values (hebb=0, activation_count=0). */
+        engram_store_close();
+        return 0;
+    }
+    if (!strcmp(mode, "pos_reboot") || !strcmp(mode, "neg_reboot")){
+        if (!engram_store_enabled()){ fprintf(stderr, "%s requires ENGRAM_STORE=1\n", mode); return 2; }
+        /* snapshot.json deleted by the runner — boot MUST come from neuron.egm. */
+        if (!engram_store_boot(S(dir))){ fprintf(stderr, "reboot boot failed\n"); return 2; }
+        export_graph(dir, !strcmp(mode, "pos_reboot") ? "reboot.json" : "neg_reboot.json");
+        printf("[%s] nodes=%lld edges=%lld\n", mode,
+               (long long)(int64_t)engram_node_count(),
+               (long long)(int64_t)engram_edge_count());
+        engram_store_close();
+        return 0;
+    }
+    if (!strcmp(mode, "offcheck")){
+        int en = engram_store_enabled();
+        el_val_t boot = engram_store_boot(S(dir));  /* no-op with flag off */
+        build_seed();
+        engram_activate_json(S(QUERY), (el_val_t)3);
+        el_val_t ck = engram_store_checkpoint();     /* must be a no-op */
+        printf("[offcheck] enabled=%d boot=%lld checkpoint=%lld\n",
+               en, (long long)(int64_t)boot, (long long)(int64_t)ck);
+        return (en == 0 && (int64_t)boot == 0 && (int64_t)ck == 0) ? 0 : 1;
+    }
+    fprintf(stderr, "unknown mode %s\n", mode);
+    return 2;
+}

engram/test/test_m3_parity.c

@@ -0,0 +1,155 @@
+/* test_m3_parity.c — M3 JSON-parity gate for the ENGRAM_STORE wiring.
+ *
+ * This is a REAL el-level harness: it links the actual el_runtime.o (the soul's
+ * native engram builtins) + engram_store.o and calls the engram_node family plus
+ * engram_connect, engram_activate_json, engram_save, engram_store_boot directly. No EL interpreter
+ * and no full soul build are needed — el_runtime.c compiles to a standalone .o
+ * whose engram builtins operate on the process-global engram store, and the
+ * string arena is inert unless el_request_start() is called, so the builtins are
+ * callable straight from C (el_val_t is int64_t; EL_STR/EL_CSTR are pointer casts).
+ *
+ * Modes (argv[1]), data dir (argv[2]):
+ *   seed   — ENGRAM_STORE unset: build a fixed seed graph, write snapshot.json +
+ *            off_graph.json (pristine, pre-activation), then activate → off_act.json.
+ *   on     — ENGRAM_STORE=1: engram_store_boot(dir) imports snapshot.json ONCE into
+ *            neuron.egm and loads it resident; write on_graph.json, then activate →
+ *            on_act.json; checkpoint + close.
+ *   reboot — ENGRAM_STORE=1 with snapshot.json DELETED: boot must reload from
+ *            neuron.egm (WAL replay), never re-reading JSON; write reboot_graph.json.
+ *   offcheck — assert flag-off leaves the store untouched.
+ *
+ * The graph comparison (done by run_m3_parity.sh via python, modulo ordering) is
+ * the deterministic gate; activation ids/promoted are compared as a robust set.
+ */
+#include "el_runtime.h"
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+/* Builtins the header declares are pulled in via el_runtime.h. The M3 additions
+ * are not in the header yet, so declare them here. */
+extern int      engram_store_enabled(void);
+extern el_val_t engram_store_boot(el_val_t data_dir);
+extern el_val_t engram_store_checkpoint(void);
+extern el_val_t engram_store_close(void);
+extern el_val_t engram_node_layered(el_val_t content, el_val_t node_type, el_val_t label,
+                                    el_val_t salience, el_val_t certainty, el_val_t confidence,
+                                    el_val_t status, el_val_t tags, el_val_t layer_id);
+
+static el_val_t S(const char* s){ return EL_STR(s); }
+static el_val_t F(double d){ return el_from_float(d); }
+
+/* Build a fixed, deterministic seed graph: 12 nodes across two layers + 9 edges.
+ * Content is chosen so an activation query has real matches to rank. */
+static void build_seed(void){
+    /* core-identity layer (1) via engram_node_full */
+    el_val_t n0  = engram_node_full(S("tiered storage engine design"), S("Concept"),
+                     S("storage-engine"), F(0.9), F(0.8), F(1.0), S("Semantic"), S("design,storage"));
+    el_val_t n1  = engram_node_full(S("write-ahead log durability"), S("Concept"),
+                     S("wal"), F(0.85), F(0.75), F(1.0), S("Semantic"), S("wal,durability"));
+    el_val_t n2  = engram_node_full(S("paged buffer pool with checkpointing"), S("Concept"),
+                     S("buffer-pool"), F(0.8), F(0.7), F(1.0), S("Semantic"), S("paging"));
+    el_val_t n3  = engram_node_full(S("spreading activation over the graph"), S("Concept"),
+                     S("activation"), F(0.8), F(0.7), F(1.0), S("Semantic"), S("activation,graph"));
+    el_val_t n4  = engram_node_full(S("hebbian co-activation potentiation"), S("Concept"),
+                     S("hebbian"), F(0.7), F(0.6), F(1.0), S("Semantic"), S("hebb"));
+    el_val_t n5  = engram_node_full(S("crash recovery replays the log"), S("Concept"),
+                     S("recovery"), F(0.75), F(0.65), F(1.0), S("Semantic"), S("recovery,wal"));
+    /* domain-knowledge layer (2) via engram_node_layered */
+    el_val_t n6  = engram_node_layered(S("b-tree primary index id to location"), S("Fact"),
+                     S("btree"), F(0.7), F(0.6), F(1.0), S(""), S("index"), (el_val_t)2);
+    el_val_t n7  = engram_node_layered(S("adjacency index for edge lookup"), S("Fact"),
+                     S("adjacency"), F(0.7), F(0.6), F(1.0), S(""), S("index,graph"), (el_val_t)2);
+    el_val_t n8  = engram_node_layered(S("slotted pages hold tlv records"), S("Fact"),
+                     S("slotted-page"), F(0.65), F(0.55), F(1.0), S(""), S("format"), (el_val_t)2);
+    el_val_t n9  = engram_node_full(S("memory tiers working semantic episodic"), S("Concept"),
+                     S("tiers"), F(0.7), F(0.6), F(1.0), S("Semantic"), S("tiers,memory"));
+    el_val_t n10 = engram_node_full(S("embeddings enable nearest neighbour search"), S("Concept"),
+                     S("embeddings"), F(0.65), F(0.55), F(1.0), S("Semantic"), S("embeddings"));
+    el_val_t n11 = engram_node_full(S("the durable engram is the mind's memory"), S("Belief"),
+                     S("engram"), F(0.95), F(0.9), F(1.0), S("Semantic"), S("engram,memory"));
+
+    engram_connect(n0, n1, F(0.8), S("depends-on"));
+    engram_connect(n0, n2, F(0.8), S("depends-on"));
+    engram_connect(n0, n3, F(0.7), S("enables"));
+    engram_connect(n1, n5, F(0.9), S("enables"));
+    engram_connect(n3, n4, F(0.6), S("triggers"));
+    engram_connect(n2, n6, F(0.7), S("uses"));
+    engram_connect(n3, n7, F(0.7), S("uses"));
+    engram_connect(n0, n8, F(0.6), S("uses"));
+    engram_connect(n11, n9, F(0.8), S("about"));
+    engram_connect(n11, n10, F(0.5), S("about"));
+}
+
+static void write_file(const char* path, const char* content){
+    FILE* f = fopen(path, "wb");
+    if (!f){ fprintf(stderr, "cannot open %s\n", path); exit(2); }
+    if (content) fwrite(content, 1, strlen(content), f);
+    fclose(f);
+}
+
+static const char* QUERY = "storage engine activation and the durable log";
+
+int main(int argc, char** argv){
+    if (argc < 3){ fprintf(stderr, "usage: %s <seed|on|reboot|offcheck> <dir>\n", argv[0]); return 2; }
+    const char* mode = argv[1];
+    const char* dir  = argv[2];
+    char p[1024];
+
+    if (!strcmp(mode, "seed")){
+        if (engram_store_enabled()){ fprintf(stderr, "seed mode requires ENGRAM_STORE unset\n"); return 2; }
+        build_seed();
+        snprintf(p, sizeof p, "%s/snapshot.json", dir);
+        if (!engram_save(S(p))){ fprintf(stderr, "seed save failed\n"); return 2; }
+        snprintf(p, sizeof p, "%s/off_graph.json", dir);
+        engram_save(S(p));                         /* pristine off-path graph */
+        el_val_t act = engram_activate_json(S(QUERY), (el_val_t)3);
+        snprintf(p, sizeof p, "%s/off_act.json", dir);
+        write_file(p, EL_CSTR(act));
+        printf("[seed] nodes=%lld edges=%lld\n",
+               (long long)(int64_t)engram_node_count(), (long long)(int64_t)engram_edge_count());
+        return 0;
+    }
+    if (!strcmp(mode, "on")){
+        if (!engram_store_enabled()){ fprintf(stderr, "on mode requires ENGRAM_STORE=1\n"); return 2; }
+        if (!engram_store_boot(S(dir))){ fprintf(stderr, "store boot failed\n"); return 2; }
+        snprintf(p, sizeof p, "%s/on_graph.json", dir);
+        engram_save(S(p));                         /* export resident (== store) */
+        /* Checkpoint the freshly-imported (pristine) graph — this is the state
+         * the reboot comparison expects to round-trip. Under M3.5 a checkpoint
+         * persists the resident graph's CURRENT field state, so it must run
+         * BEFORE activation mutates fields in place; activation itself is
+         * exercised below only for the activation-result-set parity check. The
+         * M3.5 gate (test_m35_hebb_persist) separately proves that a checkpoint
+         * taken AFTER activation durably carries the learned hebb/WM state. */
+        engram_store_checkpoint();
+        el_val_t act = engram_activate_json(S(QUERY), (el_val_t)3);
+        snprintf(p, sizeof p, "%s/on_act.json", dir);
+        write_file(p, EL_CSTR(act));
+        printf("[on] nodes=%lld edges=%lld\n",
+               (long long)(int64_t)engram_node_count(), (long long)(int64_t)engram_edge_count());
+        engram_store_close();
+        return 0;
+    }
+    if (!strcmp(mode, "reboot")){
+        if (!engram_store_enabled()){ fprintf(stderr, "reboot mode requires ENGRAM_STORE=1\n"); return 2; }
+        /* snapshot.json has been deleted by the runner — boot MUST come from
+         * neuron.egm (+ WAL replay), never re-reading JSON. */
+        if (!engram_store_boot(S(dir))){ fprintf(stderr, "reboot boot failed\n"); return 2; }
+        snprintf(p, sizeof p, "%s/reboot_graph.json", dir);
+        engram_save(S(p));
+        printf("[reboot] nodes=%lld edges=%lld\n",
+               (long long)(int64_t)engram_node_count(), (long long)(int64_t)engram_edge_count());
+        engram_store_close();
+        return 0;
+    }
+    if (!strcmp(mode, "offcheck")){
+        /* ENGRAM_STORE unset: enabled()==0 and boot is a no-op returning 0. */
+        int en = engram_store_enabled();
+        el_val_t b = engram_store_boot(S(dir));
+        printf("[offcheck] enabled=%d boot_ret=%lld\n", en, (long long)(int64_t)b);
+        return (en == 0 && (int64_t)b == 0) ? 0 : 1;
+    }
+    fprintf(stderr, "unknown mode %s\n", mode);
+    return 2;
+}

engram/test/test_m7_traversal.c

@@ -0,0 +1,208 @@
+/* test_m7_traversal.c — M7 index-driven activation traversal.
+ *
+ * Milestone 7 replaces the O(E) full adjacency rebuild that spreading activation
+ * paid before every BFS with an incrementally-maintained per-node index, behind
+ * the ENGRAM_STORE flag (flag-off = unchanged behavior). This harness links the
+ * REAL el_runtime.c engram builtins (+ engram_store.c) and drives activation
+ * directly — no EL interpreter, no store boot (the index optimization is a pure
+ * in-RAM concern; the flag is read from the environment).
+ *
+ * Modes (argv[1]):
+ *   parity-off <dir>  — ENGRAM_STORE unset: build a fixed graph, run a scripted
+ *                       sequence of activations WITH mid-sequence edge/node
+ *                       inserts, dump each activation's JSON to <dir>/off_actN.json.
+ *   parity-on  <dir>  — ENGRAM_STORE=1: identical graph + identical sequence,
+ *                       dump to <dir>/on_actN.json. The runner asserts the off/on
+ *                       files are BYTE-IDENTICAL (same activated set, weights,
+ *                       ordering, hops, WM promotion).
+ *   perf <off|on> <dir> <nodes> <edges> <iters>
+ *                     — build a large graph, then loop `iters` times doing
+ *                       (add 1 edge + activate). Prints wall-time and the M7
+ *                       instrumentation counters (rebuild calls / rebuild
+ *                       edge-work / incremental appends).
+ *
+ * Writes ONLY under the caller-provided throwaway dir.
+ */
+#include "el_runtime.h"
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+
+/* M7 instrumentation getters (test-only; defined in el_runtime.c). */
+extern int64_t engram_adj_rebuild_calls(void);
+extern int64_t engram_adj_rebuild_edge_work(void);
+extern int64_t engram_adj_incr_appends(void);
+extern double  engram_adj_maint_seconds(void);
+extern void    engram_adj_test_force_dirty(void);
+extern int     engram_store_enabled(void);
+
+static el_val_t S(const char* s){ return EL_STR(s); }
+static el_val_t F(double d){ return el_from_float(d); }
+
+/* Deterministic LCG so off/on processes build byte-identical graphs. */
+static uint64_t g_rng = 0x9E3779B97F4A7C15ULL;
+static void rng_seed(uint64_t s){ g_rng = s ? s : 1; }
+static uint64_t rng_next(void){ g_rng = g_rng * 6364136223846793005ULL + 1442695040888963407ULL; return g_rng >> 17; }
+
+static el_val_t* g_handles = NULL;   /* node id handles from engram_node_full */
+static int64_t   g_nnodes  = 0;
+
+static void write_file(const char* path, const char* content){
+    FILE* f = fopen(path, "wb");
+    if (!f){ fprintf(stderr, "cannot open %s\n", path); exit(2); }
+    if (content) fwrite(content, 1, strlen(content), f);
+    fclose(f);
+}
+
+/* Build `n` nodes whose content carries query-matchable tokens, then `m`
+ * deterministic edges among them. Handles are retained for later connect. */
+static void build_graph(int64_t n, int64_t m){
+    g_handles = malloc((size_t)n * sizeof(el_val_t));
+    g_nnodes  = n;
+    static const char* topics[] = {
+        "storage engine durable log", "spreading activation graph traversal",
+        "hebbian potentiation memory", "buffer pool paging checkpoint",
+        "adjacency index edge lookup", "working memory promotion",
+        "b-tree primary index", "embeddings nearest neighbour" };
+    for (int64_t i = 0; i < n; i++){
+        char content[256];
+        snprintf(content, sizeof content,
+                 "node %lld about %s and storage engine activation index",
+                 (long long)i, topics[(size_t)(i % 8)]);
+        char label[32]; snprintf(label, sizeof label, "n%lld", (long long)i);
+        g_handles[i] = engram_node_full(S(content), S("Concept"), S(label),
+                         F(0.7), F(0.6), F(1.0), S("Semantic"), S("storage,graph,index"));
+    }
+    for (int64_t k = 0; k < m; k++){
+        int64_t a = (int64_t)(rng_next() % (uint64_t)n);
+        int64_t b = (int64_t)(rng_next() % (uint64_t)n);
+        if (a == b) b = (b + 1) % n;
+        engram_connect(g_handles[a], g_handles[b], F(0.6), S("associate"));
+    }
+}
+
+static const char* Q1 = "storage engine activation and the durable log";
+static const char* Q2 = "adjacency index graph traversal";
+
+/* One scripted activation with an optional forced full-rebuild first. */
+static el_val_t act(const char* q, int depth, int force_rebuild){
+    if (force_rebuild) engram_adj_test_force_dirty();
+    return engram_activate_json(S(q), (el_val_t)depth);
+}
+
+/* Run the scripted parity sequence and dump each activation JSON. `tag` names
+ * the output set. When force_rebuild is set, every activation first forces the
+ * O(E) full-rebuild path (the pre-M7 "scan" behavior); otherwise the M7
+ * incremental index is used. The graph build + query sequence are byte-for-byte
+ * deterministic, so any difference between two runs is attributable solely to
+ * the difference in adjacency maintenance (and/or the ENGRAM_STORE flag). */
+static int run_parity(const char* dir, const char* tag, int force_rebuild){
+    char p[1024];
+    rng_seed(0xC0FFEE123ULL);
+    build_graph(60, 140);
+
+    el_val_t a1 = act(Q1, 3, force_rebuild);
+    snprintf(p, sizeof p, "%s/%s_act1.json", dir, tag); write_file(p, EL_CSTR(a1));
+
+    /* Mutate the graph BETWEEN activations: this is exactly where the M7 path
+     * appends incrementally while the rebuild path marks dirty + fully rebuilds.
+     * Parity must hold across this divergence in HOW the index is maintained. */
+    engram_connect(g_handles[0], g_handles[7],  F(0.8), S("depends-on"));
+    engram_connect(g_handles[7], g_handles[23], F(0.7), S("enables"));
+    engram_connect(g_handles[23], g_handles[41],F(0.5), S("uses"));
+    el_val_t hnew = engram_node_full(S("freshly minted storage index node about activation"),
+                       S("Concept"), S("nnew"), F(0.8), F(0.7), F(1.0), S("Semantic"), S("storage,index"));
+    engram_connect(g_handles[0], hnew, F(0.9), S("about"));
+
+    el_val_t a2 = act(Q1, 3, force_rebuild);
+    snprintf(p, sizeof p, "%s/%s_act2.json", dir, tag); write_file(p, EL_CSTR(a2));
+    el_val_t a3 = act(Q2, 2, force_rebuild);
+    snprintf(p, sizeof p, "%s/%s_act3.json", dir, tag); write_file(p, EL_CSTR(a3));
+    el_val_t a4 = act(Q1, 3, force_rebuild);
+    snprintf(p, sizeof p, "%s/%s_act4.json", dir, tag); write_file(p, EL_CSTR(a4));
+
+    printf("[parity-%s] enabled=%d force_rebuild=%d nodes=%lld edges=%lld "
+           "rebuilds=%lld rebuild_edge_work=%lld incr_appends=%lld\n",
+           tag, engram_store_enabled(), force_rebuild,
+           (long long)(int64_t)engram_node_count(), (long long)(int64_t)engram_edge_count(),
+           (long long)engram_adj_rebuild_calls(), (long long)engram_adj_rebuild_edge_work(),
+           (long long)engram_adj_incr_appends());
+    return 0;
+}
+
+static double now_sec(void){
+    struct timespec ts; clock_gettime(CLOCK_MONOTONIC, &ts);
+    return (double)ts.tv_sec + (double)ts.tv_nsec * 1e-9;
+}
+
+static int run_perf(const char* dir, const char* tag, int64_t n, int64_t m, int64_t iters){
+    (void)dir;
+    rng_seed(0xBEEF7777ULL);
+    double t_build0 = now_sec();
+    build_graph(n, m);
+    double t_build = now_sec() - t_build0;
+
+    int64_t rb0 = engram_adj_rebuild_calls();
+    int64_t rw0 = engram_adj_rebuild_edge_work();
+    int64_t ap0 = engram_adj_incr_appends();
+    double  mt0 = engram_adj_maint_seconds();
+
+    double t0 = now_sec();
+    for (int64_t it = 0; it < iters; it++){
+        /* One structural mutation per query — the curiosity-loop cadence that
+         * makes the OLD path rebuild the whole adjacency before every BFS. */
+        int64_t a = (int64_t)(rng_next() % (uint64_t)n);
+        int64_t b = (int64_t)(rng_next() % (uint64_t)n);
+        if (a == b) b = (b + 1) % n;
+        engram_connect(g_handles[a], g_handles[b], F(0.6), S("associate"));
+        el_val_t r = engram_activate_json(S(Q1), (el_val_t)2);
+        (void)r;
+    }
+    double elapsed = now_sec() - t0;
+
+    double maint = engram_adj_maint_seconds() - mt0;
+    printf("[perf-%s] flag=%d nodes=%lld edges=%lld iters=%lld build=%.3fs "
+           "loop=%.3fs per_query=%.3fms adj_maint=%.4fs adj_maint_per_query=%.4fms | "
+           "rebuilds=%lld rebuild_edge_work=%lld incr_appends=%lld\n",
+           tag, engram_store_enabled(),
+           (long long)(int64_t)engram_node_count(), (long long)(int64_t)engram_edge_count(),
+           (long long)iters, t_build, elapsed, (elapsed / (double)iters) * 1e3,
+           maint, (maint / (double)iters) * 1e3,
+           (long long)(engram_adj_rebuild_calls() - rb0),
+           (long long)(engram_adj_rebuild_edge_work() - rw0),
+           (long long)(engram_adj_incr_appends() - ap0));
+    return 0;
+}
+
+int main(int argc, char** argv){
+    if (argc < 3){ fprintf(stderr, "usage: %s <parity-off|parity-on|perf> ...\n", argv[0]); return 2; }
+    const char* mode = argv[1];
+
+    if (!strcmp(mode, "parity-off")){
+        /* flag-off, rebuild path = today's scan behavior (the baseline). */
+        if (engram_store_enabled()){ fprintf(stderr, "parity-off requires ENGRAM_STORE unset\n"); return 2; }
+        return run_parity(argv[2], "off", 0);
+    }
+    if (!strcmp(mode, "parity-on-rebuild")){
+        /* flag-on, but force the O(E) rebuild before each activation. */
+        if (!engram_store_enabled()){ fprintf(stderr, "parity-on-rebuild requires ENGRAM_STORE=1\n"); return 2; }
+        return run_parity(argv[2], "onrb", 1);
+    }
+    if (!strcmp(mode, "parity-on-incr")){
+        /* flag-on, M7 incremental index (the code path under test). */
+        if (!engram_store_enabled()){ fprintf(stderr, "parity-on-incr requires ENGRAM_STORE=1\n"); return 2; }
+        return run_parity(argv[2], "onincr", 0);
+    }
+    if (!strcmp(mode, "perf")){
+        /* perf <off|on> <dir> <nodes> <edges> <iters> */
+        if (argc < 7){ fprintf(stderr, "usage: %s perf <off|on> <dir> <nodes> <edges> <iters>\n", argv[0]); return 2; }
+        const char* tag = argv[2];
+        int64_t n = strtoll(argv[4], NULL, 10);
+        int64_t m = strtoll(argv[5], NULL, 10);
+        int64_t iters = strtoll(argv[6], NULL, 10);
+        return run_perf(argv[3], tag, n, m, iters);
+    }
+    fprintf(stderr, "unknown mode %s\n", mode);
+    return 2;
+}

engram/test/test_reason.c

@@ -0,0 +1,255 @@
+/* Closed-form unit tests for the REASONING layer (engram_reason.c). All inputs are
+ * hand-built synthetic descriptors whose answers are known in closed form. Every
+ * reasoning MODE is proven, not declared. ASan/UBSan target. */
+#include "engram_reason.h"
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <math.h>
+
+static int failures = 0, checks = 0;
+static void ok(const char* what, int cond) {
+    checks++;
+    if (!cond) { failures++; printf("  FAIL: %s\n", what); }
+    else        printf("  ok:   %s\n", what);
+}
+static void approx(const char* what, double got, double exp, double tol) {
+    ok(what, fabs(got - exp) <= tol);
+    if (fabs(got - exp) > tol) printf("        got=%.9g exp=%.9g\n", got, exp);
+}
+
+/* ── descriptor builders (mirror scratchpad/test_geo_ops.c) ─────────────────── */
+static float* vec(const double* v, int dim) {
+    float* f = malloc((size_t)dim * sizeof(float));
+    for (int i = 0; i < dim; i++) f[i] = (float)v[i];
+    return f;
+}
+static GeoDescriptor* mk(int dim, const double* centroid,
+                         int n_axes, const double* axis_flat, const double* extents,
+                         int n_members, const char** ids, double total_var) {
+    GeoDescriptor* g = calloc(1, sizeof(GeoDescriptor));
+    g->dim = dim;
+    g->centroid = centroid ? vec(centroid, dim) : NULL;
+    g->global_mean = NULL;
+    g->n_axes = n_axes;
+    g->axes = n_axes ? calloc((size_t)n_axes, sizeof(GeoAxis)) : NULL;
+    double tr = 0;
+    for (int k = 0; k < n_axes; k++) {
+        g->axes[k].axis = vec(&axis_flat[(size_t)k * dim], dim);
+        g->axes[k].extent = extents[k];
+        tr += extents[k] * extents[k];
+    }
+    g->total_variance = (total_var >= 0) ? total_var : tr;
+    g->radius = sqrt(g->total_variance > 0 ? g->total_variance : 0);
+    g->n_members = n_members; g->n_embedded = n_members;
+    g->members = n_members ? calloc((size_t)n_members, sizeof(GeoMember)) : NULL;
+    for (int i = 0; i < n_members; i++) {
+        g->members[i].id = strdup(ids[i]);
+        g->members[i].membership = 1.0;
+        g->members[i].centrality = (double)(n_members - i);
+        g->members[i].embedded = 1;
+    }
+    g->hub_id = n_members ? strdup(ids[0]) : strdup("");
+    g->k_core = 1; g->co_registration = 0.0; g->n_edges = 0; g->edges = NULL;
+    return g;
+}
+
+int main(void) {
+    printf("== REASONING layer unit tests ==\n");
+
+    /* ══════════════════ ANALOGY — recover an affine A→B, apply to C ══════════ */
+    /* A→B is a +90° rotation in the e0-e1 plane ((x,y)→(-y,x)) plus a +5 shift in e2.
+     * A frame = (e0,e1); B frame = rotated (e1,-e0); cB = R·cA + t. Predict D from C. */
+    {
+        int dim = 4;
+        double cA[4] = {1,0,0,0};
+        double cB[4] = {0,1,5,0};                 /* R·(1,0,0,0)=(0,1,0,0) + (0,0,5,0) */
+        double cC[4] = {2,0,0,0};
+        double axA[8] = {1,0,0,0,  0,1,0,0}; double exA[2] = {1,1};
+        double axB[8] = {0,1,0,0, -1,0,0,0}; double exB[2] = {1,1};  /* R·e0, R·e1 */
+        double axC[8] = {1,0,0,0,  0,1,0,0}; double exC[2] = {1,1};
+        const char* idA[1] = {"A"}, *idB[1] = {"B"}, *idC[1] = {"C"};
+        GeoDescriptor* A = mk(dim, cA, 2, axA, exA, 1, idA, -1);
+        GeoDescriptor* B = mk(dim, cB, 2, axB, exB, 1, idB, -1);
+        GeoDescriptor* C = mk(dim, cC, 2, axC, exC, 1, idC, -1);
+        /* candidates: the true D + two distractors. true D = R·cC + t = (0,2,5,0). */
+        double d_true[4] = {0,2,5,0}, d_far1[4] = {9,9,9,9}, d_far2[4] = {0,0,0,0};
+        const char* idD[1] = {"Dt"}, *idF1[1] = {"F1"}, *idF2[1] = {"F2"};
+        GeoDescriptor* Dt = mk(dim, d_true, 0, NULL, NULL, 1, idD, 0.0);
+        GeoDescriptor* F1 = mk(dim, d_far1, 0, NULL, NULL, 1, idF1, 0.0);
+        GeoDescriptor* F2 = mk(dim, d_far2, 0, NULL, NULL, 1, idF2, 0.0);
+        const GeoDescriptor* cand[3] = {F1, Dt, F2};   /* true one at index 1 */
+        GeoAnalogyResult res;
+        int rc = engram_reason_analogy(A, B, C, cand, 3, &res);
+        ok("analogy returns 0", rc == 0);
+        printf("[analogy] residual=%.6f mapped=(%.4f,%.4f,%.4f,%.4f) best=%d bd=%.5f\n",
+               res.analogy_residual, res.mapped_point[0], res.mapped_point[1],
+               res.mapped_point[2], res.mapped_point[3], res.best, res.best_distance);
+        approx("procrustes residual ~0", res.analogy_residual, 0.0, 1e-4);
+        approx("mapped.x=0", res.mapped_point[0], 0.0, 1e-4);
+        approx("mapped.y=2", res.mapped_point[1], 2.0, 1e-4);
+        approx("mapped.z(e2)=5", res.mapped_point[2], 5.0, 1e-4);
+        ok("nearest candidate = true D (idx 1)", res.best == 1);
+        approx("best distance ~0", res.best_distance, 0.0, 1e-3);
+        engram_reason_analogy_free(&res);
+        engram_geo_free(A); engram_geo_free(B); engram_geo_free(C);
+        engram_geo_free(Dt); engram_geo_free(F1); engram_geo_free(F2);
+    }
+
+    /* ══════════════════ INDUCTION — recover a shared subspace + membership ═══ */
+    /* 3 examples all spread over span(e0,e1) (ext 1 & 0.8), each with a small
+     * idiosyncratic axis (e2 or e3, ext 0.2). Centroids all 0. The induced rule's
+     * top-2 axes must lie in span(e0,e1); a held-out in-plane point fits, an
+     * off-subspace point does not. */
+    {
+        int dim = 4;
+        double c0[4] = {0,0,0,0};
+        double axsh[8] = {1,0,0,0,  0,1,0,0}; double exsh[2] = {1.0, 0.8};
+        double ax1[12] = {1,0,0,0, 0,1,0,0, 0,0,1,0}; double ex1[3] = {1.0,0.8,0.2}; /* +e2 */
+        double ax2[12] = {1,0,0,0, 0,1,0,0, 0,0,0,1}; double ex2[3] = {1.0,0.8,0.2}; /* +e3 */
+        const char* i1[2] = {"e1a","e1b"}, *i2[2] = {"e2a","e2b"}, *i3[2] = {"e3a","e3b"};
+        GeoDescriptor* E1 = mk(dim, c0, 3, ax1,  ex1,  2, i1, -1);
+        GeoDescriptor* E2 = mk(dim, c0, 3, ax2,  ex2,  2, i2, -1);
+        GeoDescriptor* E3 = mk(dim, c0, 2, axsh, exsh, 2, i3, -1);
+        const GeoDescriptor* ex[3] = {E1, E2, E3};
+        GeoInduction ind;
+        int rc = engram_reason_induce(ex, 3, 8, 1.0, &ind);
+        ok("induce returns 0", rc == 0);
+        printf("[induction] rule n_axes=%d ext0=%.4f ext1=%.4f\n",
+               ind.rule->n_axes, ind.rule->n_axes > 0 ? ind.rule->axes[0].extent : 0,
+               ind.rule->n_axes > 1 ? ind.rule->axes[1].extent : 0);
+        /* top-2 axes lie in span(e0,e1): their e2,e3 components ~0. */
+        int inplane = 1;
+        for (int k = 0; k < 2 && k < ind.rule->n_axes; k++) {
+            const float* a = ind.rule->axes[k].axis;
+            printf("        axis%d=(%.3f,%.3f,%.3f,%.3f) ext=%.4f\n", k, a[0],a[1],a[2],a[3], ind.rule->axes[k].extent);
+            if (fabs(a[2]) > 0.06 || fabs(a[3]) > 0.06) inplane = 0;
+        }
+        ok("induced top-2 axes lie in shared span(e0,e1)", inplane);
+        approx("dominant extent ~1.0", ind.rule->axes[0].extent, 1.0, 0.06);
+        approx("second extent ~0.8",   ind.rule->axes[1].extent, 0.8, 0.06);
+        /* membership: in-plane near-centroid positive fits; off-subspace negative doesn't. */
+        float xpos[4] = {0.3f, -0.2f, 0, 0};
+        float xneg[4] = {0, 0, 3.0f, 0};       /* large along e2 — outside the rule */
+        float xfar[4] = {5.0f, 0, 0, 0};       /* in-plane but far — Mahalanobis blows up */
+        double mp = engram_reason_membership(&ind, xpos);
+        double mn = engram_reason_membership(&ind, xneg);
+        double mf = engram_reason_membership(&ind, xfar);
+        printf("[induction] membership pos=%.4f neg=%.4f far=%.4f\n", mp, mn, mf);
+        ok("held-out positive fits (>0.5)", mp > 0.5);
+        ok("off-subspace negative rejected (<0.3)", mn < 0.3);
+        ok("in-plane-but-far rejected (<0.3)", mf < 0.3);
+        ok("positive fits far better than negative", mp > mn + 0.4);
+        engram_reason_induction_free(&ind);
+        engram_geo_free(E1); engram_geo_free(E2); engram_geo_free(E3);
+    }
+
+    /* ══════════════════ ABDUCTION — pick the best-explaining structure ═══════ */
+    /* obs planted near H1's centroid among 3 candidate structures. */
+    {
+        int dim = 4;
+        double h0[4] = {0,0,0,0}, h1[4] = {5,0,0,0}, h2[4] = {0,5,0,0};
+        double ax[8] = {1,0,0,0, 0,1,0,0}; double ex[2] = {1,1};
+        const char* n0[1] = {"H0"}, *n1[1] = {"H1"}, *n2[1] = {"H2"};
+        GeoDescriptor* H0 = mk(dim, h0, 2, ax, ex, 1, n0, -1);
+        GeoDescriptor* H1 = mk(dim, h1, 2, ax, ex, 1, n1, -1);
+        GeoDescriptor* H2 = mk(dim, h2, 2, ax, ex, 1, n2, -1);
+        const GeoDescriptor* H[3] = {H0, H1, H2};
+        float obs[4] = {5.2f, 0.1f, 0, 0};       /* sits inside H1 */
+        GeoAbduction ab;
+        int rc = engram_reason_abduce(obs, dim, H, 3, 1.0, &ab);
+        ok("abduce returns 0", rc == 0);
+        printf("[abduction] best=%d best_score=%.4f rank=[%d,%d,%d] d=[%.3f,%.3f,%.3f]\n",
+               ab.best, ab.best_score, ab.rank[0], ab.rank[1], ab.rank[2],
+               ab.distances[0], ab.distances[1], ab.distances[2]);
+        ok("best explanation = H1", ab.best == 1);
+        ok("rank[0] = H1", ab.rank[0] == 1);
+        ok("H1 has smallest distance", ab.distances[1] < ab.distances[0] && ab.distances[1] < ab.distances[2]);
+        engram_reason_abduction_free(&ab);
+        engram_geo_free(H0); engram_geo_free(H1); engram_geo_free(H2);
+    }
+
+    /* ══════════════════ CAUSAL — direction + confounder flag ═════════════════ */
+    /* Chain A→B→C along e0 (temporal 1<2<3). Confounder Z (e1) injects into A and
+     * drives D (t=4). A–D correlate only via Z ⇒ must be flagged CONFOUNDED. */
+    {
+        int dim = 4;
+        double cA[4] = {1,1,0,0};   /* e0 (chain) + e1 (confounder leak) */
+        double cB[4] = {1,0,0,0};   /* e0 */
+        double cC[4] = {2,0,0,0};   /* e0 */
+        double cD[4] = {0,1,0,0};   /* e1 only — driven by Z */
+        double cZ[4] = {0,1,0,0};   /* confounder centroid */
+        double axZ[4] = {0,1,0,0}; double exZ[1] = {1};   /* Z's subspace = e1 */
+        const char* idA[1]={"A"},*idB[1]={"B"},*idC[1]={"C"},*idD[1]={"D"},*idZ[1]={"Z"};
+        GeoDescriptor* A = mk(dim, cA, 0, NULL, NULL, 1, idA, 0.0);
+        GeoDescriptor* B = mk(dim, cB, 0, NULL, NULL, 1, idB, 0.0);
+        GeoDescriptor* C = mk(dim, cC, 0, NULL, NULL, 1, idC, 0.0);
+        GeoDescriptor* D = mk(dim, cD, 0, NULL, NULL, 1, idD, 0.0);
+        GeoDescriptor* Z = mk(dim, cZ, 1, axZ, exZ, 1, idZ, -1);
+        const GeoDescriptor* conf[1] = {Z};
+
+        GeoCausal ab, bc, ad, bd;
+        engram_reason_causal(A, B, conf, 1, /*t*/1, 2, 0.5, &ab);
+        engram_reason_causal(B, C, conf, 1, 2, 3, 0.5, &bc);
+        engram_reason_causal(A, D, conf, 1, 1, 4, 0.5, &ad);
+        engram_reason_causal(B, D, conf, 1, 2, 4, 0.5, &bd);
+        printf("[causal] A->B: raw=%.3f ctrl=%.3f dir=%d verdict=%d strength=%.3f\n",
+               ab.assoc_raw, ab.assoc_controlled, ab.temporal_dir, ab.verdict, ab.strength);
+        printf("[causal] B->C: raw=%.3f ctrl=%.3f dir=%d verdict=%d\n", bc.assoc_raw, bc.assoc_controlled, bc.temporal_dir, bc.verdict);
+        printf("[causal] A--D: raw=%.3f ctrl=%.3f dir=%d verdict=%d confounded=%d\n",
+               ad.assoc_raw, ad.assoc_controlled, ad.temporal_dir, ad.verdict, ad.confounded);
+        printf("[causal] B--D: raw=%.3f verdict=%d\n", bd.assoc_raw, bd.verdict);
+        ok("A->B DIRECTED", ab.verdict == GEO_CAUSAL_DIRECTED);
+        ok("A->B direction A precedes B", ab.temporal_dir == 1);
+        ok("A->B association survives control (ctrl high)", ab.assoc_controlled > 0.6);
+        ok("B->C DIRECTED", bc.verdict == GEO_CAUSAL_DIRECTED);
+        ok("A--D CONFOUNDED (flagged)", ad.verdict == GEO_CAUSAL_CONFOUNDED && ad.confounded == 1);
+        ok("A--D raw correlated but control kills it", ad.assoc_raw > 0.6 && ad.assoc_controlled < 0.2);
+        ok("B--D NONE (no association at all)", bd.verdict == GEO_CAUSAL_NONE);
+        engram_geo_free(A); engram_geo_free(B); engram_geo_free(C); engram_geo_free(D); engram_geo_free(Z);
+    }
+
+    /* ══════════════════ PLANNING — geodesic path along a curved manifold ═════ */
+    /* 6 neighborhoods on a semicircle (radius 10). Consecutive chord ~6.18,
+     * skip-one ~11.76, endpoints ~20. neighbor_radius=7 admits only consecutive
+     * hops ⇒ the plan must traverse the whole arc 0→1→2→3→4→5. */
+    {
+        int dim = 4; int N = 6; double R = 10.0;
+        GeoDescriptor* nodes[6];
+        char nm[6][8];
+        for (int k = 0; k < N; k++) {
+            double th = M_PI * (double)k / (double)(N - 1);
+            double c[4] = { R * cos(th), R * sin(th), 0, 0 };
+            snprintf(nm[k], sizeof nm[k], "n%d", k);
+            const char* id[1] = { nm[k] };
+            nodes[k] = mk(dim, c, 0, NULL, NULL, 1, id, 0.0);
+        }
+        const GeoDescriptor* cn[6];
+        for (int k = 0; k < N; k++) cn[k] = nodes[k];
+        GeoPlan plan;
+        int rc = engram_reason_plan(cn, N, 0, 5, 7.0, 0, &plan);
+        ok("plan returns 0", rc == 0);
+        printf("[planning] reached=%d len=%d cost=%.4f path=[", plan.reached, plan.path_len, plan.total_cost);
+        for (int i = 0; i < plan.path_len; i++) printf("%s%d", i ? "," : "", plan.path[i]);
+        printf("]\n");
+        ok("goal reached", plan.reached == 1);
+        ok("path length = 6 (full arc)", plan.path_len == 6);
+        int monotone = (plan.path_len == 6);
+        for (int i = 0; i < plan.path_len; i++) if (plan.path[i] != i) monotone = 0;
+        ok("path = 0,1,2,3,4,5 (the geodesic)", monotone);
+        /* arc cost ~ 5 * 6.18 = 30.9, and strictly longer than the 20-unit chord. */
+        approx("arc cost ~30.9", plan.total_cost, 30.9, 0.6);
+        ok("arc longer than straight chord (20)", plan.total_cost > 20.0);
+        engram_reason_plan_free(&plan);
+
+        /* negative control: radius too small to connect anything ⇒ unreachable. */
+        GeoPlan p2;
+        engram_reason_plan(cn, N, 0, 5, 1.0, 0, &p2);
+        ok("unreachable when radius < min edge", p2.reached == 0);
+        engram_reason_plan_free(&p2);
+        for (int k = 0; k < N; k++) engram_geo_free(nodes[k]);
+    }
+
+    printf("\n== %d checks, %d failures ==\n", checks, failures);
+    return failures ? 1 : 0;
+}

engram/test/test_scan_collision.c

@@ -0,0 +1,163 @@
+/* test_scan_collision.c — regression gate for the "saved but not findable" bug.
+ *
+ * ROOT CAUSE UNDER TEST: store_scan_nodes / store_scan_edges (the boot-load
+ * path that populates the resident in-RAM graph — engram_store_boot ->
+ * eg_load_node_cb) deduplicated emitted records by their 64-bit id_hash
+ * (FNV-1a-64), NOT by the full id string. Two DISTINCT ids that collide under
+ * id_hash therefore emitted only the FIRST: the second node/edge was durably
+ * present in neuron.egm (store_get_node finds it), physically on a live page,
+ * yet was SILENTLY DROPPED from the resident load. After any store reopen it
+ * was unretrievable by id, absent from lexical search, and missing from the
+ * recent list — exactly the reported symptom.
+ *
+ * The two ids below are real FNV-1a-64 collisions (found offline via Brent's
+ * cycle detection over fnv1a(hex16(x))); both hash to 0x15141fdadfa24abe.
+ *
+ * Pure C. Writes ONLY under a throwaway /tmp dir. Never touches ~/.neuron.
+ */
+#include "../../lang/runtime/engram_store.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdint.h>
+#include <unistd.h>
+#include <sys/stat.h>
+
+static int g_pass = 0, g_fail = 0;
+static void ok(const char* name, int cond){
+    printf("  [%s] %s\n", cond ? "PASS" : "FAIL", name);
+    if (cond) g_pass++; else g_fail++;
+}
+
+/* Confirmed FNV-1a-64 collision (distinct strings, equal id_hash). */
+#define ID_A "d2c61ec7d015dc98"
+#define ID_B "bf85e965a2aefbdd"
+
+static uint64_t fnv1a(const char* s){
+    uint64_t h = 1469598103934665603ULL;
+    for (; *s; ++s){ h ^= (uint8_t)*s; h *= 1099511628211ULL; }
+    return h;
+}
+
+static char g_dir[512];
+static void mk_dir(void){
+    snprintf(g_dir, sizeof g_dir, "/tmp/engram-scancol-%d", (int)getpid());
+    mkdir(g_dir, 0700);
+}
+
+/* ── scan collectors: record which ids the boot-load scan actually emits ── */
+typedef struct { const char* want[8]; int seen[8]; int nwant; int total; } Collect;
+static void node_cb(const StoreNode* n, void* ctx){
+    Collect* c = ctx; c->total++;
+    for (int i=0;i<c->nwant;i++) if (n->id && strcmp(n->id, c->want[i])==0) c->seen[i]=1;
+}
+static void edge_cb(const StoreEdge* e, void* ctx){
+    Collect* c = ctx; c->total++;
+    for (int i=0;i<c->nwant;i++) if (e->id && strcmp(e->id, c->want[i])==0) c->seen[i]=1;
+}
+
+static void mk_node(StoreNode* n, const char* id, const char* content){
+    memset(n, 0, sizeof *n);
+    n->id = strdup(id);
+    n->content = strdup(content);
+    n->node_type = strdup("Memory");
+    n->label = strdup(content);
+    n->tier = strdup("Working");
+    n->tags = strdup("");
+    n->metadata = strdup("{}");
+    n->salience = 0.5; n->importance = 0.5; n->confidence = 1.0;
+    n->created_at = 1700000000000LL; n->updated_at = 1700000000000LL;
+    n->last_activated = 1700000000000LL;
+}
+static void mk_edge(StoreEdge* e, const char* id, const char* from, const char* to){
+    memset(e, 0, sizeof *e);
+    e->id = strdup(id); e->from_id = strdup(from); e->to_id = strdup(to);
+    e->relation = strdup("assoc"); e->metadata = strdup("{}");
+    e->weight = 1.0; e->confidence = 1.0;
+    e->created_at = 1700000000000LL; e->updated_at = 1700000000000LL;
+}
+
+int main(void){
+    mk_dir();
+    printf("== scan-collision regression (saved-but-not-findable) ==\n");
+    printf("  id_hash(%s) = %016llx\n", ID_A, (unsigned long long)fnv1a(ID_A));
+    printf("  id_hash(%s) = %016llx\n", ID_B, (unsigned long long)fnv1a(ID_B));
+    ok("precondition: the two ids genuinely collide under id_hash",
+       fnv1a(ID_A) == fnv1a(ID_B) && strcmp(ID_A, ID_B) != 0);
+
+    /* ---- Control: a single node survives a full store round-trip. ---- */
+    {
+        EngramPagedStore* s = engram_open(g_dir);
+        StoreNode n; mk_node(&n, ID_A, "alpha distinctiveword");
+        store_put_node(s, &n);
+        engram_close(s);                 /* checkpoint + close */
+
+        EngramPagedStore* r = engram_open(g_dir);
+        StoreNode got;
+        ok("control: single node found by id after reopen", store_get_node(r, ID_A, &got)==1);
+        if (0) {} else store_node_free(&got);
+        Collect c = {{ID_A}, {0}, 1, 0};
+        store_scan_nodes(r, node_cb, &c);
+        ok("control: single node emitted by boot-load scan", c.seen[0]==1);
+        engram_close(r);
+        store_node_free(&n);
+    }
+
+    /* ---- Bug: two id-hash-colliding NODES, both durable, both must load. ---- */
+    {
+        char dir2[600]; snprintf(dir2, sizeof dir2, "%s/nodes", g_dir); mkdir(dir2, 0700);
+        EngramPagedStore* s = engram_open(dir2);
+        StoreNode a, b;
+        mk_node(&a, ID_A, "alpha distinctiveword-A");
+        mk_node(&b, ID_B, "beta distinctiveword-B");
+        store_put_node(s, &a);
+        store_put_node(s, &b);
+        engram_close(s);
+        store_node_free(&a); store_node_free(&b);
+
+        EngramPagedStore* r = engram_open(dir2);
+        /* Both are individually durable (store_get_node disambiguates by strcmp). */
+        StoreNode ga, gb;
+        int hit_a = store_get_node(r, ID_A, &ga); if (hit_a==1) store_node_free(&ga);
+        int hit_b = store_get_node(r, ID_B, &gb); if (hit_b==1) store_node_free(&gb);
+        ok("both colliding nodes are durably present (store_get_node)", hit_a==1 && hit_b==1);
+
+        /* THE REGRESSION: the boot-load scan must emit BOTH, not silently drop one. */
+        Collect c = {{ID_A, ID_B}, {0,0}, 2, 0};
+        store_scan_nodes(r, node_cb, &c);
+        printf("    scan emitted A=%d B=%d (total=%d)\n", c.seen[0], c.seen[1], c.total);
+        ok("boot-load scan emits node A (would be resident)", c.seen[0]==1);
+        ok("boot-load scan emits node B (the dropped/unretrievable one)", c.seen[1]==1);
+        engram_close(r);
+    }
+
+    /* ---- Bug: two id-hash-colliding EDGES, both must load. ---- */
+    {
+        char dir3[600]; snprintf(dir3, sizeof dir3, "%s/edges", g_dir); mkdir(dir3, 0700);
+        EngramPagedStore* s = engram_open(dir3);
+        StoreNode na, nb; mk_node(&na, "src", "s"); mk_node(&nb, "dst", "d");
+        store_put_node(s, &na); store_put_node(s, &nb);
+        StoreEdge ea, eb;
+        mk_edge(&ea, ID_A, "src", "dst");
+        mk_edge(&eb, ID_B, "src", "dst");
+        store_put_edge(s, &ea);
+        store_put_edge(s, &eb);
+        engram_close(s);
+        store_node_free(&na); store_node_free(&nb);
+        store_edge_free(&ea); store_edge_free(&eb);
+
+        EngramPagedStore* r = engram_open(dir3);
+        Collect c = {{ID_A, ID_B}, {0,0}, 2, 0};
+        store_scan_edges(r, edge_cb, &c);
+        printf("    scan emitted edgeA=%d edgeB=%d\n", c.seen[0], c.seen[1]);
+        ok("boot-load scan emits edge A", c.seen[0]==1);
+        ok("boot-load scan emits edge B (the dropped one)", c.seen[1]==1);
+        engram_close(r);
+    }
+
+    printf("\n  %d passed, %d failed\n", g_pass, g_fail);
+    /* cleanup */
+    char cmd[600]; snprintf(cmd, sizeof cmd, "rm -rf %s", g_dir); if (system(cmd)){}
+    return g_fail ? 1 : 0;
+}

engram/test/test_store.c

@@ -0,0 +1,439 @@
+/* test_store.c — M1 gate for the engram paged store (engram_store.{c,h}).
+ *
+ * Pure C. Build:  gcc -O2 test_store.c ../../lang/runtime/engram_store.c -o test_store
+ * Writes ONLY under a throwaway /tmp dir. Never touches ~/.neuron or live ports.
+ *
+ * Covers §7 M1 gates: round-trip (5k nodes / 20k edges, all fields, emb bit-exact,
+ * hebb, >page content), TLV forward-compat, overflow chains, B+-tree indexes
+ * across splits, free-list reuse, and corruption/superblock recovery.
+ */
+#include "../../lang/runtime/engram_store.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdint.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <sys/stat.h>
+
+static int g_pass = 0, g_fail = 0;
+static void ok(const char* name, int cond){
+    printf("  [%s] %s\n", cond ? "PASS" : "FAIL", name);
+    if (cond) g_pass++; else g_fail++;
+}
+
+static char g_dir[512];
+static void mk_dir(void){
+    snprintf(g_dir, sizeof g_dir, "/tmp/engram-store-test-%d", (int)getpid());
+    mkdir(g_dir, 0700);
+}
+static void path_in(char* out, size_t cap, const char* name){
+    snprintf(out, cap, "%s/%s", g_dir, name);
+}
+static long file_size(const char* p){ struct stat st; return stat(p,&st)==0 ? (long)st.st_size : -1; }
+
+/* ── deterministic RNG so oracle nodes/edges regenerate bit-exact ─────────── */
+static uint64_t xs(uint64_t* s){ uint64_t x=*s; x^=x<<13; x^=x>>7; x^=x<<17; *s=x; return x; }
+static uint64_t node_seed(int i){ return 0x9E3779B97F4A7C15ULL ^ ((uint64_t)(i+1)*0xD1B54A32D192ED03ULL); }
+static uint64_t edge_seed(int i){ return 0xC2B2AE3D27D4EB4FULL ^ ((uint64_t)(i+1)*0x165667B19E3779F9ULL); }
+
+static char* rnd_str(uint64_t* st, size_t len){
+    char* s = (char*)malloc(len + 1);
+    for (size_t i=0;i<len;i++) s[i] = (char)(33 + (xs(st) % 94)); /* printable, no NUL */
+    s[len] = 0; return s;
+}
+
+/* NODE_COUNT nodes; a slice have >page content to force overflow chains. */
+#define NODE_COUNT 5000
+#define EDGE_COUNT 20000
+#define EMB_DIM    768
+
+static void gen_node(int i, StoreNode* n){
+    memset(n, 0, sizeof *n);
+    uint64_t st = node_seed(i);
+    char id[32]; snprintf(id, sizeof id, "node-%d", i);
+    n->id = strdup(id);
+    size_t clen = (i % 500 == 0) ? (size_t)(17000 + (xs(&st) % 6000)) : (size_t)(xs(&st) % 300);
+    n->content   = rnd_str(&st, clen);
+    n->node_type = rnd_str(&st, 4 + (xs(&st) % 8));
+    n->label     = (i % 2)   ? rnd_str(&st, 3 + (xs(&st) % 10)) : NULL;
+    n->tier      = rnd_str(&st, 4 + (xs(&st) % 6));
+    n->tags      = rnd_str(&st, xs(&st) % 40);
+    n->metadata  = (i % 3)   ? rnd_str(&st, xs(&st) % 60) : NULL;
+    n->salience             = (double)(xs(&st) % 1000000) / 997.0;
+    n->importance           = (double)(xs(&st) % 1000000) / 131.0;
+    n->confidence           = (double)(xs(&st) % 1000000) / 733.0;
+    n->temporal_decay_rate  = (double)(xs(&st) % 1000000) / 101.0;
+    n->activation_count     = (int64_t)(xs(&st) % 100000);
+    n->last_activated       = (int64_t)xs(&st);
+    n->created_at           = (int64_t)(1600000000000LL + i);
+    n->updated_at           = (int64_t)xs(&st);
+    n->background_activation = (double)(xs(&st) % 1000000) / 17.0;
+    n->working_memory_weight = (double)(xs(&st) % 1000000) / 29.0;
+    n->suppression_count    = (int32_t)(xs(&st) % 50);
+    n->layer_id             = (uint32_t)(xs(&st) % 5);
+    for (int k=0;k<STORE_BLL_K;k++) n->access_ts[k] = (int64_t)xs(&st);
+    n->access_head   = (int32_t)(xs(&st) % STORE_BLL_K);
+    n->access_filled = (int32_t)(xs(&st) % (STORE_BLL_K + 1));
+    n->wm_anchor     = (double)(xs(&st) % 1000000) / 3.0;
+    n->emb = (float*)malloc(EMB_DIM * sizeof(float));
+    for (int k=0;k<EMB_DIM;k++){ uint32_t u=(uint32_t)xs(&st); memcpy(&n->emb[k], &u, 4); }
+    n->emb_dim = EMB_DIM;
+}
+
+static void gen_edge(int i, StoreEdge* e){
+    memset(e, 0, sizeof *e);
+    uint64_t st = edge_seed(i);
+    char id[32], from[32], to[32];
+    snprintf(id, sizeof id, "edge-%d", i);
+    snprintf(from, sizeof from, "node-%d", (int)(xs(&st) % NODE_COUNT));
+    snprintf(to,   sizeof to,   "node-%d", (int)(xs(&st) % NODE_COUNT));
+    e->id = strdup(id); e->from_id = strdup(from); e->to_id = strdup(to);
+    e->relation = rnd_str(&st, 3 + (xs(&st) % 12));
+    e->metadata = (i % 4) ? rnd_str(&st, xs(&st) % 40) : NULL;
+    e->weight     = (double)(xs(&st) % 1000000) / 111.0;
+    e->hebb       = (double)(xs(&st) % 1000000) / 1000000.0; /* the learned field */
+    e->confidence = (double)(xs(&st) % 1000000) / 777.0;
+    e->created_at = (int64_t)(1600000000000LL + i);
+    e->updated_at = (int64_t)xs(&st);
+    e->last_fired = (int64_t)xs(&st);
+    e->inhibitory = (int32_t)(xs(&st) % 2);
+    e->layer_id   = (uint32_t)(xs(&st) % 5);
+}
+
+static int streq(const char* a, const char* b){
+    if (!a && !b) return 1;
+    if (!a || !b) return 0;
+    return strcmp(a,b)==0;
+}
+static int cmp_node(const StoreNode* a, const StoreNode* b){
+    if (!streq(a->id,b->id) || !streq(a->content,b->content) ||
+        !streq(a->node_type,b->node_type) || !streq(a->label,b->label) ||
+        !streq(a->tier,b->tier) || !streq(a->tags,b->tags) ||
+        !streq(a->metadata,b->metadata)) return 0;
+    if (a->salience!=b->salience || a->importance!=b->importance ||
+        a->confidence!=b->confidence || a->temporal_decay_rate!=b->temporal_decay_rate ||
+        a->activation_count!=b->activation_count || a->last_activated!=b->last_activated ||
+        a->created_at!=b->created_at || a->updated_at!=b->updated_at ||
+        a->background_activation!=b->background_activation ||
+        a->working_memory_weight!=b->working_memory_weight ||
+        a->suppression_count!=b->suppression_count || a->layer_id!=b->layer_id ||
+        a->access_head!=b->access_head || a->access_filled!=b->access_filled ||
+        a->wm_anchor!=b->wm_anchor || a->emb_dim!=b->emb_dim) return 0;
+    for (int k=0;k<STORE_BLL_K;k++) if (a->access_ts[k]!=b->access_ts[k]) return 0;
+    if ((a->emb==NULL) != (b->emb==NULL)) return 0;
+    if (a->emb && memcmp(a->emb, b->emb, (size_t)a->emb_dim*4)!=0) return 0;
+    return 1;
+}
+static int cmp_edge(const StoreEdge* a, const StoreEdge* b){
+    if (!streq(a->id,b->id) || !streq(a->from_id,b->from_id) || !streq(a->to_id,b->to_id) ||
+        !streq(a->relation,b->relation) || !streq(a->metadata,b->metadata)) return 0;
+    if (a->weight!=b->weight || a->hebb!=b->hebb || a->confidence!=b->confidence ||
+        a->created_at!=b->created_at || a->updated_at!=b->updated_at ||
+        a->last_fired!=b->last_fired || a->inhibitory!=b->inhibitory ||
+        a->layer_id!=b->layer_id) return 0;
+    return 1;
+}
+static void free_node_fields(StoreNode* n){
+    free(n->id); free(n->content); free(n->node_type); free(n->label);
+    free(n->tier); free(n->tags); free(n->metadata); free(n->emb); free(n->unknown);
+}
+static void free_edge_fields(StoreEdge* e){
+    free(e->id); free(e->from_id); free(e->to_id); free(e->relation); free(e->metadata); free(e->unknown);
+}
+
+/* Flip one byte in the store file at (page*PAGE_SIZE + off). */
+static void flip_byte(const char* path, uint64_t page, size_t off){
+    int fd = open(path, O_RDWR);
+    uint8_t b; off_t at = (off_t)page*STORE_PAGE_SIZE + off;
+    pread(fd, &b, 1, at); b ^= 0xFF; pwrite(fd, &b, 1, at); close(fd);
+}
+
+/* ════════════════════════════════════════════════════════════════════════ */
+
+static void test_roundtrip(void){
+    printf("\n== round-trip: %d nodes + %d edges, all fields, emb bit-exact ==\n", NODE_COUNT, EDGE_COUNT);
+    char path[600]; path_in(path, sizeof path, "roundtrip.store");
+    unlink(path);
+    EngramPagedStore* s = store_create(path);
+    ok("store_create", s != NULL);
+    if (!s) return;
+
+    for (int i=0;i<NODE_COUNT;i++){ StoreNode n; gen_node(i,&n);
+        if (store_put_node(s,&n)!=0){ ok("put_node", 0); free_node_fields(&n); store_close(s); return; }
+        free_node_fields(&n); }
+    for (int i=0;i<EDGE_COUNT;i++){ StoreEdge e; gen_edge(i,&e);
+        if (store_put_edge(s,&e)!=0){ ok("put_edge", 0); free_edge_fields(&e); store_close(s); return; }
+        free_edge_fields(&e); }
+    ok("wrote all nodes+edges", 1);
+    store_close(s);
+
+    long sz = file_size(path);
+    printf("  store file size: %ld bytes (%.2f MB) for %d nodes / %d edges\n",
+           sz, sz/1048576.0, NODE_COUNT, EDGE_COUNT);
+
+    s = store_open(path);
+    ok("store_open (reopen)", s != NULL);
+    if (!s) return;
+
+    int nbad = 0;
+    for (int i=0;i<NODE_COUNT;i++){
+        StoreNode want; gen_node(i,&want);
+        StoreNode got; int r = store_get_node(s, want.id, &got);
+        if (r!=1 || !cmp_node(&want,&got) || got.unknown_len!=0) nbad++;
+        if (r==1) store_node_free(&got);
+        free_node_fields(&want);
+    }
+    ok("all 5000 nodes read back bit-exact (incl emb, all fields)", nbad==0);
+    if (nbad) printf("     %d node mismatches\n", nbad);
+
+    int ebad = 0;
+    for (int i=0;i<EDGE_COUNT;i++){
+        StoreEdge want; gen_edge(i,&want);
+        StoreEdge* got; size_t gn;
+        int found = 0;
+        if (store_get_edges_from(s, want.from_id, &got, &gn)==0){
+            for (size_t j=0;j<gn;j++) if (streq(got[j].id, want.id)){ if (cmp_edge(&want,&got[j])) found=1; break; }
+            store_edges_free(got, gn);
+        }
+        if (!found) ebad++;
+        free_edge_fields(&want);
+    }
+    ok("all 20000 edges read back via adjacency, all fields incl hebb", ebad==0);
+    if (ebad) printf("     %d edge mismatches\n", ebad);
+
+    ok("store_check crc clean after round-trip", store_check(s, STORE_CHECK_CRC)==0);
+    store_close(s);
+}
+
+static void test_forward_compat(void){
+    printf("\n== TLV forward-compat: omit field defaults; unknown tag preserved ==\n");
+    char path[600]; path_in(path, sizeof path, "fwd.store");
+    unlink(path);
+    EngramPagedStore* s = store_create(path);
+
+    /* Writer OMITS several fields (metadata, label, emb) → reader must default. */
+    StoreNode a; memset(&a,0,sizeof a);
+    a.id = strdup("omit-1"); a.content = strdup("has content"); a.tier = strdup("core");
+    a.salience = 0.5;                    /* metadata/label NULL, emb NULL */
+    store_put_node(s, &a); free(a.id); free(a.content); free(a.tier);
+
+    StoreNode g; int r = store_get_node(s, "omit-1", &g);
+    ok("omitted string fields default to NULL", r==1 && g.metadata==NULL && g.label==NULL);
+    ok("omitted emb defaults to NULL / emb_dim 0", r==1 && g.emb==NULL && g.emb_dim==0);
+    ok("present fields intact", r==1 && streq(g.content,"has content") && g.salience==0.5);
+    if (r==1) store_node_free(&g);
+
+    /* Writer includes an UNKNOWN tag (simulating a newer writer / field the
+     * reader does not model) via the `unknown` passthrough. Reader (which also
+     * models known fields A,B,C) must preserve it verbatim. */
+    uint8_t unk[64];
+    unk[0] = 200;                        /* a tag this build has no case for */
+    /* [u8 tag][u32 len][bytes] */
+    unk[1]=8; unk[2]=0; unk[3]=0; unk[4]=0;
+    for (int i=0;i<8;i++) unk[5+i] = (uint8_t)(0xA0 + i);
+    StoreNode b; memset(&b,0,sizeof b);
+    b.id = strdup("unk-1"); b.content = strdup("known field B"); b.confidence = 0.9; /* known field C-ish */
+    b.unknown = unk; b.unknown_len = 5 + 8;
+    store_put_node(s, &b); free(b.id); free(b.content);
+
+    StoreNode g2; int r2 = store_get_node(s, "unk-1", &g2);
+    int unk_ok = r2==1 && g2.unknown_len==(5+8) && memcmp(g2.unknown, unk, 5+8)==0;
+    ok("unknown tag preserved verbatim on read", unk_ok);
+    ok("known fields still read while unknown preserved", r2==1 && streq(g2.content,"known field B") && g2.confidence==0.9);
+    if (r2==1) store_node_free(&g2);
+
+    store_close(s);
+}
+
+static void test_overflow(void){
+    printf("\n== overflow: 100KB content node + emb via overflow chain ==\n");
+    char path[600]; path_in(path, sizeof path, "ovf.store");
+    unlink(path);
+    EngramPagedStore* s = store_create(path);
+
+    size_t big = 100*1024;
+    StoreNode n; memset(&n,0,sizeof n);
+    n.id = strdup("big-1");
+    n.content = (char*)malloc(big+1);
+    for (size_t i=0;i<big;i++) n.content[i] = (char)(33 + (i % 94));
+    n.content[big] = 0;
+    n.tier = strdup("episodic");
+    n.emb = (float*)malloc(EMB_DIM*sizeof(float));
+    for (int k=0;k<EMB_DIM;k++){ float f = (float)(k*0.5 - 100.0); n.emb[k]=f; }
+    n.emb_dim = EMB_DIM;
+    ok("put 100KB+emb node", store_put_node(s,&n)==0);
+    store_close(s);
+
+    s = store_open(path);
+    StoreNode g; int r = store_get_node(s, "big-1", &g);
+    ok("reopen + read big node", r==1);
+    ok("100KB content byte-exact via overflow", r==1 && strlen(g.content)==big && memcmp(g.content,n.content,big)==0);
+    ok("emb bit-exact via overflow record", r==1 && g.emb_dim==EMB_DIM && memcmp(g.emb,n.emb,EMB_DIM*4)==0);
+    if (r==1) store_node_free(&g);
+    ok("store_check clean (overflow pages crc'd)", store_check(s, STORE_CHECK_CRC)==0);
+    store_close(s);
+    free_node_fields(&n);
+}
+
+static void test_index_splits(void){
+    printf("\n== B+-tree index correctness across many splits ==\n");
+    char path[600]; path_in(path, sizeof path, "idx.store");
+    unlink(path);
+    EngramPagedStore* s = store_create(path);
+    /* Tiny order forces deep leaf + internal splits with only a few hundred keys. */
+    store__set_btree_order(s, 4, 4);
+
+    const int N = 600;
+    for (int i=0;i<N;i++){
+        StoreNode n; memset(&n,0,sizeof n);
+        char id[32]; snprintf(id,sizeof id,"k-%05d", (i*37+11)%100000); /* scattered keys */
+        n.id = strdup(id); n.content = strdup("x"); n.tier=strdup("t"); n.salience=i;
+        if (store_put_node(s,&n)!=0){ ok("put",0); }
+        free(n.id); free(n.content); free(n.tier);
+    }
+    int miss=0;
+    for (int i=0;i<N;i++){
+        char id[32]; snprintf(id,sizeof id,"k-%05d",(i*37+11)%100000);
+        StoreNode g; int r = store_get_node(s, id, &g);
+        if (r!=1 || (int)g.salience != i) miss++;
+        if (r==1) store_node_free(&g);
+    }
+    ok("all keys retrievable after leaf+internal splits", miss==0);
+    if (miss) printf("     %d misses\n", miss);
+    StoreNode g; ok("absent key returns 0", store_get_node(s,"k-NOPE",&g)==0);
+
+    /* Adjacency: controlled star + chain, exact edge sets. */
+    for (int i=0;i<50;i++){
+        StoreEdge e; memset(&e,0,sizeof e);
+        char id[32]; snprintf(id,sizeof id,"e-%d",i);
+        e.id=strdup(id); e.from_id=strdup("HUB"); char tt[16]; snprintf(tt,sizeof tt,"T-%d",i); e.to_id=strdup(tt);
+        e.relation=strdup("r"); e.weight=1.0; e.hebb=0.1*i;
+        store_put_edge(s,&e); free_edge_fields(&e);
+    }
+    for (int i=0;i<7;i++){
+        StoreEdge e; memset(&e,0,sizeof e);
+        char id[32]; snprintf(id,sizeof id,"in-%d",i);
+        char ff[16]; snprintf(ff,sizeof ff,"S-%d",i);
+        e.id=strdup(id); e.from_id=strdup(ff); e.to_id=strdup("SINK");
+        e.relation=strdup("r"); e.weight=1.0;
+        store_put_edge(s,&e); free_edge_fields(&e);
+    }
+    StoreEdge* out; size_t on;
+    store_get_edges_from(s,"HUB",&out,&on);
+    ok("get_edges_from(HUB) == 50", on==50);
+    store_edges_free(out,on);
+    store_get_edges_to(s,"SINK",&out,&on);
+    ok("get_edges_to(SINK) == 7", on==7);
+    store_edges_free(out,on);
+    store_get_edges_to(s,"HUB",&out,&on);
+    ok("get_edges_to(HUB) == 0 (direction separation)", on==0);
+    store_edges_free(out,on);
+
+    ok("store_check clean", store_check(s, STORE_CHECK_CRC)==0);
+    store_close(s);
+}
+
+static void test_freelist(void){
+    printf("\n== free-list: tombstone reclaims pages, graph stays consistent ==\n");
+    char path[600]; path_in(path, sizeof path, "free.store");
+    unlink(path);
+    EngramPagedStore* s = store_create(path);
+
+    uint64_t pc0 = store_page_count(s);
+    const int N = 300;
+    for (int i=0;i<N;i++){
+        StoreNode n; memset(&n,0,sizeof n);
+        char id[32]; snprintf(id,sizeof id,"a-%d",i);
+        n.id=strdup(id); n.content=rnd_str(&(uint64_t){node_seed(i)}, 200); n.tier=strdup("t");
+        store_put_node(s,&n); free_node_fields(&n);
+    }
+    uint64_t pc1 = store_page_count(s);
+    uint64_t node_pages = pc1 - pc0;
+    ok("initial batch consumed pages", node_pages > 0);
+
+    for (int i=0;i<N;i++){ char id[32]; snprintf(id,sizeof id,"a-%d",i); store_tombstone(s,id); }
+    /* all old nodes gone */
+    int gone=1; for (int i=0;i<N;i++){ char id[32]; snprintf(id,sizeof id,"a-%d",i);
+        StoreNode g; if (store_get_node(s,id,&g)==1){ gone=0; store_node_free(&g); } }
+    ok("tombstoned nodes now absent", gone);
+
+    for (int i=0;i<N;i++){
+        StoreNode n; memset(&n,0,sizeof n);
+        char id[32]; snprintf(id,sizeof id,"b-%d",i);
+        n.id=strdup(id); n.content=strdup("reused"); n.tier=strdup("t"); n.salience=i;
+        store_put_node(s,&n); free_node_fields(&n);
+    }
+    uint64_t pc2 = store_page_count(s);
+    /* Reuse proven: growth for the 2nd batch is far less than a fresh alloc. */
+    ok("freed pages reused (no full re-growth)", pc2 < pc1 + node_pages);
+    printf("     pages: base=%llu after1=%llu after2=%llu (node_pages=%llu)\n",
+           (unsigned long long)pc0,(unsigned long long)pc1,(unsigned long long)pc2,(unsigned long long)node_pages);
+
+    int newbad=0; for (int i=0;i<N;i++){ char id[32]; snprintf(id,sizeof id,"b-%d",i);
+        StoreNode g; if (store_get_node(s,id,&g)!=1 || (int)g.salience!=i) newbad++; else store_node_free(&g); }
+    ok("new batch fully readable after reuse", newbad==0);
+    ok("store_check clean after reuse", store_check(s, STORE_CHECK_CRC)==0);
+
+    store_close(s);
+    /* survives reopen */
+    s = store_open(path);
+    int rb=0; for (int i=0;i<N;i++){ char id[32]; snprintf(id,sizeof id,"b-%d",i);
+        StoreNode g; if (store_get_node(s,id,&g)!=1) rb++; else store_node_free(&g); }
+    ok("graph consistent across reopen after reuse", rb==0);
+    store_close(s);
+}
+
+static void test_corruption(void){
+    printf("\n== corruption: crc detection + superblock mirror recovery ==\n");
+    char path[600]; path_in(path, sizeof path, "corrupt.store");
+    unlink(path);
+    EngramPagedStore* s = store_create(path);
+    for (int i=0;i<50;i++){ StoreNode n; gen_node(i,&n); store_put_node(s,&n); free_node_fields(&n); }
+    store_close(s);
+
+    s = store_open(path);
+    ok("clean store: store_check == 0", store_check(s, STORE_CHECK_CRC)==0);
+    store_close(s);
+
+    /* flip a byte inside a data page (page 5 is node/index data, never a SB) */
+    flip_byte(path, 5, 137);
+    s = store_open(path);
+    ok("store_open still succeeds (data-page corruption)", s != NULL);
+    int bad = store_check(s, STORE_CHECK_CRC);
+    ok("store_check detects corrupted page via crc", bad >= 1);
+    printf("     store_check reported %d corrupt page(s)\n", bad);
+    store_close(s);
+
+    /* fresh store, corrupt superblock 0, must recover via mirror superblock 1 */
+    char p2[600]; path_in(p2, sizeof p2, "sbrec.store");
+    unlink(p2);
+    s = store_create(p2);
+    StoreNode n; gen_node(42,&n); store_put_node(s,&n);
+    store_close(s);
+    /* trash magic + crc region of page 0 */
+    flip_byte(p2, 0, 0); flip_byte(p2, 0, 1); flip_byte(p2, 0, 90);
+    s = store_open(p2);
+    ok("open recovers via mirror superblock (page 1)", s != NULL);
+    if (s){
+        StoreNode g; int r = store_get_node(s, "node-42", &g);
+        ok("data intact after superblock recovery", r==1 && cmp_node(&n,&g));
+        if (r==1) store_node_free(&g);
+        store_close(s);
+    }
+    free_node_fields(&n);
+}
+
+int main(void){
+    mk_dir();
+    printf("engram_store M1 test harness — dir=%s\n", g_dir);
+    test_roundtrip();
+    test_forward_compat();
+    test_overflow();
+    test_index_splits();
+    test_freelist();
+    test_corruption();
+    printf("\n================  %d passed, %d failed  ================\n", g_pass, g_fail);
+    return g_fail ? 1 : 0;
+}

engram/test/test_verify.c

@@ -0,0 +1,244 @@
+/* Closed-form unit tests for the VERIFIER layer (engram_verify.c). Every case is a
+ * hand-built synthetic descriptor / claim point whose verdict is known in closed
+ * form — the checks are PROVEN, not declared. ASan/UBSan target.
+ *
+ * The headline case is CONSISTENCY's polarity check: the reassurance→accusation
+ * inversion ("you never fought" → "you argued") that no grammar check catches. */
+#include "engram_verify.h"
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <math.h>
+
+static int failures = 0, checks = 0;
+static void ok(const char* what, int cond) {
+    checks++;
+    if (!cond) { failures++; printf("  FAIL: %s\n", what); }
+    else        printf("  ok:   %s\n", what);
+}
+static void approx(const char* what, double got, double exp, double tol) {
+    ok(what, fabs(got - exp) <= tol);
+    if (fabs(got - exp) > tol) printf("        got=%.9g exp=%.9g\n", got, exp);
+}
+
+/* ── descriptor builder (mirrors test_reason.c) ─────────────────────────────── */
+static float* vec(const double* v, int dim) {
+    float* f = malloc((size_t)dim * sizeof(float));
+    for (int i = 0; i < dim; i++) f[i] = (float)v[i];
+    return f;
+}
+static GeoDescriptor* mk(int dim, const double* centroid,
+                         int n_axes, const double* axis_flat, const double* extents,
+                         int n_members, const char** ids, double total_var) {
+    GeoDescriptor* g = calloc(1, sizeof(GeoDescriptor));
+    g->dim = dim;
+    g->centroid = centroid ? vec(centroid, dim) : NULL;
+    g->global_mean = NULL;
+    g->n_axes = n_axes;
+    g->axes = n_axes ? calloc((size_t)n_axes, sizeof(GeoAxis)) : NULL;
+    double tr = 0;
+    for (int k = 0; k < n_axes; k++) {
+        g->axes[k].axis = vec(&axis_flat[(size_t)k * dim], dim);
+        g->axes[k].extent = extents[k];
+        tr += extents[k] * extents[k];
+    }
+    g->total_variance = (total_var >= 0) ? total_var : tr;
+    g->radius = sqrt(g->total_variance > 0 ? g->total_variance : 0);
+    g->n_members = n_members; g->n_embedded = n_members;
+    g->members = n_members ? calloc((size_t)n_members, sizeof(GeoMember)) : NULL;
+    for (int i = 0; i < n_members; i++) {
+        g->members[i].id = strdup(ids[i]);
+        g->members[i].membership = 1.0;
+        g->members[i].centrality = (double)(n_members - i);
+        g->members[i].embedded = 1;
+    }
+    g->hub_id = n_members ? strdup(ids[0]) : strdup("");
+    g->k_core = 1; g->co_registration = 0.0; g->n_edges = 0; g->edges = NULL;
+    return g;
+}
+
+int main(void) {
+    printf("== VERIFIER layer unit tests ==\n");
+
+    /* ══════════════════ GROUNDING — supported vs floating (hallucination) ════ */
+    /* Two real neighborhoods: E0 at origin, E1 far along e0. A claim planted inside
+     * E0 is grounded; a claim floating far off-manifold (along an unmodeled axis) is
+     * flagged UNGROUNDED; a claim near E1 grounds to E1, not E0. */
+    {
+        int dim = 4;
+        double c0[4] = {0,0,0,0}, c1[4] = {10,0,0,0};
+        double ax[8] = {1,0,0,0, 0,1,0,0}; double ex[2] = {1,1};
+        const char* i0[1] = {"E0"}, *i1[1] = {"E1"};
+        GeoDescriptor* E0 = mk(dim, c0, 2, ax, ex, 1, i0, -1);
+        GeoDescriptor* E1 = mk(dim, c1, 2, ax, ex, 1, i1, -1);
+        const GeoDescriptor* ev[2] = {E0, E1};
+
+        /* (1) grounded claim — sits inside E0. */
+        float in[4] = {0.3f, -0.2f, 0, 0};
+        GeoGrounding g1;
+        int rc = engram_verify_grounding(in, dim, ev, 2, 1.0, 0.5, &g1);
+        ok("grounding returns 0", rc == 0);
+        printf("[grounding] IN   score=%.4f grounded=%d best=%d dist=%.3f ortho=%.3f nearL2=%.3f\n",
+               g1.grounding, g1.grounded, g1.best, g1.best_distance, g1.best_ortho, g1.nearest_centroid_l2);
+        ok("planted-inside claim is GROUNDED", g1.grounded == 1);
+        ok("grounds to the nearest structure E0", g1.best == 0);
+        ok("grounded score high (>0.7)", g1.grounding > 0.7);
+        approx("off-model residual ~0 for in-distribution claim", g1.best_ortho, 0.0, 1e-4);
+        engram_verify_grounding_free(&g1);
+
+        /* (2) hallucinated claim — floats far along the unmodeled e2 axis. */
+        float out[4] = {0, 0, 50.0f, 0};
+        GeoGrounding g2;
+        engram_verify_grounding(out, dim, ev, 2, 1.0, 0.5, &g2);
+        printf("[grounding] OUT  score=%.6f grounded=%d best=%d dist=%.3f ortho=%.3f nearL2=%.3f\n",
+               g2.grounding, g2.grounded, g2.best, g2.best_distance, g2.best_ortho, g2.nearest_centroid_l2);
+        ok("floating claim is FLAGGED (ungrounded)", g2.grounded == 0);
+        ok("floating claim scores near zero (<0.01)", g2.grounding < 0.01);
+        ok("off-model residual is large (the hallucination signal)", g2.best_ortho > 40.0);
+        ok("nearest real structure is far (L2>40)", g2.nearest_centroid_l2 > 40.0);
+        engram_verify_grounding_free(&g2);
+
+        /* (3) selection — a claim near E1 grounds to E1. */
+        float nearE1[4] = {9.8f, 0.1f, 0, 0};
+        GeoGrounding g3;
+        engram_verify_grounding(nearE1, dim, ev, 2, 1.0, 0.5, &g3);
+        printf("[grounding] E1   score=%.4f grounded=%d best=%d\n", g3.grounding, g3.grounded, g3.best);
+        ok("claim near E1 grounds to E1 (best=1)", g3.best == 1 && g3.grounded == 1);
+        engram_verify_grounding_free(&g3);
+
+        engram_geo_free(E0); engram_geo_free(E1);
+    }
+
+    /* ══════════════════ CONSISTENCY (a) — THE NEGATION-INVERSION CATCH ═══════ */
+    /* The motivating failure, geometrically. Polarity axis along e0:
+     *   pole_pos = the AFFIRM region ("argued / fought")     centroid (+5, …)
+     *   pole_neg = the NEGATE region ("never fought / at peace") centroid (−5, …)
+     * The grounded TRUTH (context) is the reassurance "you never fought" → sits on
+     * the NEGATE side (−5). The bad translation CLAIM "you argued" lands on the
+     * AFFIRM side (+4). Opposite sides of the negation axis ⇒ INVERSION flagged —
+     * even though "you argued" is perfectly grammatical. This is the catch. */
+    {
+        int dim = 4;
+        double c_pos[4] = { 5, 0, 0, 0};      /* "argued / fought"        */
+        double c_neg[4] = {-5, 0, 0, 0};      /* "never fought / at peace"*/
+        double c_truth[4] = {-5, 0, 0, 0};    /* context: the reassurance */
+        double ax[4] = {1,0,0,0}; double ex[1] = {1};
+        const char* ip[1]={"pos"},*in[1]={"neg"},*it[1]={"truth"};
+        GeoDescriptor* POS = mk(dim, c_pos, 1, ax, ex, 1, ip, -1);
+        GeoDescriptor* NEG = mk(dim, c_neg, 1, ax, ex, 1, in, -1);
+        GeoDescriptor* CTX = mk(dim, c_truth, 1, ax, ex, 1, it, -1);
+
+        /* the plausible LIE: "you argued" — grammatical, fluent, and INVERTED. */
+        float lie[4] = { 4, 0, 0, 0};
+        GeoConsistency cl;
+        int rc = engram_verify_consistency(lie, dim, CTX, POS, NEG, NULL,
+                                           1.0, 0.10, 0.5, 0.0, &cl);
+        ok("consistency returns 0", rc == 0);
+        printf("[consistency] LIE  verdict=%d inverted=%d claim_side=%.3f ref_side=%.3f sep=%.3f consist=%.3f\n",
+               cl.verdict, cl.inverted, cl.polarity_claim, cl.polarity_reference, cl.polarity_separation, cl.consistency);
+        ok("NEGATION INVERSION caught (inverted=1)", cl.inverted == 1);
+        ok("verdict = POLARITY", cl.verdict == GEO_CONSIST_POLARITY);
+        ok("claim sits on the AFFIRM pole (+)", cl.polarity_claim > 0);
+        ok("truth sits on the NEGATE pole (−)", cl.polarity_reference < 0);
+        ok("consistency collapses to 0 on inversion", cl.consistency < 1e-9);
+
+        /* the FAITHFUL translation: "you were at peace" — same pole as the truth. */
+        float ok_claim[4] = {-4, 0, 0, 0};
+        GeoConsistency cok;
+        engram_verify_consistency(ok_claim, dim, CTX, POS, NEG, NULL,
+                                  1.0, 0.10, 0.5, 0.0, &cok);
+        printf("[consistency] TRUE verdict=%d inverted=%d claim_side=%.3f consist=%.3f\n",
+               cok.verdict, cok.inverted, cok.polarity_claim, cok.consistency);
+        ok("faithful claim NOT flagged (inverted=0)", cok.inverted == 0);
+        ok("faithful claim verdict OK", cok.verdict == GEO_CONSIST_OK);
+        ok("faithful claim consistency = 1", cok.consistency > 0.999);
+
+        /* a NEUTRAL claim near the midpoint must NOT false-trigger. */
+        float neutral[4] = {0.1f, 0, 0, 0};   /* |side|=0.1 < deadzone 0.5 */
+        GeoConsistency cn;
+        engram_verify_consistency(neutral, dim, CTX, POS, NEG, NULL,
+                                  1.0, 0.10, 0.5, 0.0, &cn);
+        printf("[consistency] NEUT verdict=%d inverted=%d claim_side=%.3f consist=%.3f\n",
+               cn.verdict, cn.inverted, cn.polarity_claim, cn.consistency);
+        ok("neutral claim inside deadzone does NOT trigger inversion", cn.inverted == 0);
+
+        engram_geo_free(POS); engram_geo_free(NEG); engram_geo_free(CTX);
+    }
+
+    /* ══════════════════ CONSISTENCY (b) — GEOMETRIC contradiction ════════════ */
+    /* A claim that sits INSIDE a forbidden region it should be far from, and a claim
+     * that violates a max-distance constraint to its context, are both flagged. */
+    {
+        int dim = 4;
+        double c_ctx[4] = {0,0,0,0};
+        double c_forb[4] = {0,10,0,0};        /* forbidden region, offset along e1 */
+        double ax[8] = {0,1,0,0, 1,0,0,0}; double ex[2] = {1,1};
+        const char* ic[1]={"ctx"},*ifb[1]={"forb"};
+        GeoDescriptor* CTX  = mk(dim, c_ctx, 2, ax, ex, 1, ic, -1);
+        GeoDescriptor* FORB = mk(dim, c_forb, 2, ax, ex, 1, ifb, -1);
+
+        /* claim sitting inside the forbidden region → geometric contradiction. */
+        float inside[4] = {0, 10.1f, 0, 0};
+        GeoConsistency cf;
+        engram_verify_consistency(inside, dim, CTX, NULL, NULL, FORB,
+                                  1.0, 0.10, 0.5, 0.0, &cf);
+        printf("[consistency] FORB verdict=%d geo_viol=%d forb_fit=%.4f consist=%.3f\n",
+               cf.verdict, cf.geo_violation, cf.forbidden_fit, cf.consistency);
+        ok("claim inside forbidden region FLAGGED", cf.geo_violation == 1);
+        ok("verdict = GEOMETRIC", cf.verdict == GEO_CONSIST_GEOMETRIC);
+        ok("forbidden fit is high (claim really is inside)", cf.forbidden_fit > 0.5);
+
+        /* claim well clear of the forbidden region → not flagged. */
+        float clear[4] = {0.2f, 0.1f, 0, 0};
+        GeoConsistency cc;
+        engram_verify_consistency(clear, dim, CTX, NULL, NULL, FORB,
+                                  1.0, 0.10, 0.5, 0.0, &cc);
+        printf("[consistency] CLR  verdict=%d geo_viol=%d forb_fit=%.4f\n",
+               cc.verdict, cc.geo_violation, cc.forbidden_fit);
+        ok("claim clear of forbidden NOT flagged", cc.geo_violation == 0 && cc.verdict == GEO_CONSIST_OK);
+
+        /* max-distance constraint: claim too far from context (off-axis, no poles). */
+        float far[4] = {0, 8.0f, 0, 0};
+        GeoConsistency cd;
+        engram_verify_consistency(far, dim, CTX, NULL, NULL, NULL,
+                                  1.0, 0.10, 0.5, /*max_distance*/3.0, &cd);
+        printf("[consistency] DIST verdict=%d geo_viol=%d ctx_dist=%.3f\n",
+               cd.verdict, cd.geo_violation, cd.context_distance);
+        ok("claim beyond max_distance FLAGGED", cd.geo_violation == 1 && cd.verdict == GEO_CONSIST_GEOMETRIC);
+        approx("context distance measured correctly", cd.context_distance, 8.0, 1e-4);
+
+        engram_geo_free(CTX); engram_geo_free(FORB);
+    }
+
+    /* ══════════════════ COMBINED — grounded but INVERTED (the full plausible lie) */
+    /* The most dangerous output: fluent, GROUNDED in real vocabulary, yet polarity-
+     * inverted. Grounding alone passes it; only consistency catches the lie. This is
+     * exactly why the verifier needs BOTH checks. */
+    {
+        int dim = 4;
+        double c_pos[4] = { 5, 0, 0, 0}, c_neg[4] = {-5, 0, 0, 0};
+        double ax[4] = {1,0,0,0}; double ex[1] = {2};
+        const char* ip[1]={"pos"},*in[1]={"neg"};
+        GeoDescriptor* POS = mk(dim, c_pos, 1, ax, ex, 1, ip, -1);
+        GeoDescriptor* NEG = mk(dim, c_neg, 1, ax, ex, 1, in, -1);
+        const GeoDescriptor* ev[2] = {POS, NEG};
+
+        float lie[4] = {5, 0, 0, 0};   /* "argued" — sits dead-center in the affirm region */
+        GeoGrounding g;
+        engram_verify_grounding(lie, dim, ev, 2, 1.0, 0.5, &g);
+        GeoConsistency c;
+        engram_verify_consistency(lie, dim, NEG /*truth=never fought*/, POS, NEG, NULL,
+                                  1.0, 0.10, 0.5, 0.0, &c);
+        printf("[combined] grounded=%d (score=%.3f)  inverted=%d verdict=%d\n",
+               g.grounded, g.grounding, c.inverted, c.verdict);
+        ok("plausible lie PASSES grounding (it is real vocabulary)", g.grounded == 1);
+        ok("plausible lie is CAUGHT by consistency (inverted)", c.inverted == 1);
+        ok("=> grounding alone is insufficient; consistency is the catch",
+           g.grounded == 1 && c.verdict == GEO_CONSIST_POLARITY);
+        engram_verify_grounding_free(&g);
+        engram_geo_free(POS); engram_geo_free(NEG);
+    }
+
+    printf("\n== %d checks, %d failures ==\n", checks, failures);
+    return failures ? 1 : 0;
+}

engram/test/test_vindex.c

@@ -0,0 +1,312 @@
+/* test_vindex.c — build + RUN gate for the M8 HNSW vector index.
+ *
+ * Covers: recall@10 vs brute-force oracle, brute-force-vs-index speedup,
+ * correctness edge cases (k>N, identical vectors, self-query, zero vector),
+ * determinism (seeded PRNG → identical graphs), and vindex_build_from_store
+ * over a real engram_store on-disk file.
+ *
+ * Pure C11; links engram_vindex.c + engram_store.c; -lm. ASan/UBSan clean.
+ */
+#include "engram_vindex.h"
+#include "engram_store.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <math.h>
+#include <stdint.h>
+#include <time.h>
+#include <unistd.h>
+
+#define DIM 768
+
+static int g_fail = 0;
+/* VINDEX_QUICK=1 shrinks the two large builds so the ASan/UBSan pass (which runs
+ * ~5-10x slower) stays fast — memory-safety is size-independent. The perf numbers
+ * (recall gate + speedup) come from the un-sanitized, full-size pass. */
+static int g_quick = 0;
+static int envint(const char* k, int dflt){ const char* s=getenv(k); return s?atoi(s):dflt; }
+#define CHECK(cond, msg) do{ if(!(cond)){ printf("  FAIL: %s\n", msg); g_fail=1; } else { printf("  ok: %s\n", msg); } }while(0)
+
+/* deterministic test PRNG (splitmix64) */
+static uint64_t rng_state = 0xABCDEF0123456789ULL;
+static uint64_t xrng(uint64_t* s){
+    uint64_t z=(*s+=0x9E3779B97F4A7C15ULL);
+    z=(z^(z>>30))*0xBF58476D1CE4E5B9ULL; z=(z^(z>>27))*0x94D049BB133111EBULL;
+    return z^(z>>31);
+}
+static float frand(uint64_t* s){ return (float)((xrng(s)>>11)*(1.0/9007199254740992.0)) - 0.5f; }
+
+static double now_s(void){
+    struct timespec t; clock_gettime(CLOCK_MONOTONIC,&t);
+    return t.tv_sec + t.tv_nsec*1e-9;
+}
+
+/* fill vec[N*DIM]: mostly random, some clustered groups (center + small noise). */
+static void gen_vectors(float* v, int N, uint64_t seed){
+    uint64_t s = seed;
+    int clustered = N/5;                 /* last fifth is clustered */
+    int ncenters = 20;
+    float* centers = (float*)malloc((size_t)ncenters*DIM*sizeof(float));
+    for (int c=0;c<ncenters;c++) for(int d=0;d<DIM;d++) centers[c*DIM+d]=frand(&s);
+    for (int i=0;i<N;i++){
+        if (i < N-clustered){
+            for (int d=0;d<DIM;d++) v[i*DIM+d]=frand(&s);
+        } else {
+            int c = (int)(xrng(&s)%ncenters);
+            for (int d=0;d<DIM;d++) v[i*DIM+d]=centers[c*DIM+d] + 0.05f*frand(&s);
+        }
+    }
+    free(centers);
+}
+
+static float cosdist(const float* a, const float* b){
+    double da=0,db=0,dot=0;
+    for(int i=0;i<DIM;i++){ da+=(double)a[i]*a[i]; db+=(double)b[i]*b[i]; dot+=(double)a[i]*b[i]; }
+    if (da<=0||db<=0) return 1.0f;
+    return (float)(1.0 - dot/(sqrt(da)*sqrt(db)));
+}
+
+/* brute-force top-k node ids into ids[k] (ascending distance). */
+static void brute_topk(const float* v, int N, const float* q, int k, int* ids){
+    float* bd = (float*)malloc((size_t)k*sizeof(float));
+    for (int i=0;i<k;i++){ ids[i]=-1; bd[i]=1e30f; }
+    for (int i=0;i<N;i++){
+        float d = cosdist(q, v+(size_t)i*DIM);
+        if (d < bd[k-1]){
+            int p=k-1;
+            while (p>0 && bd[p-1]>d){ bd[p]=bd[p-1]; ids[p]=ids[p-1]; p--; }
+            bd[p]=d; ids[p]=i;
+        }
+    }
+    free(bd);
+}
+
+/* ── Test 1: recall@10 vs brute force + latency/recall tradeoff ────────────── */
+static void test_recall(void){
+    int N=envint("VINDEX_N_RECALL", g_quick?1500:5000), Q=200, K=10;
+    printf("\n== Test 1: recall@10 vs brute force (N=%d, DIM=768) ==\n", N);
+    float* v = (float*)malloc((size_t)N*DIM*sizeof(float));
+    gen_vectors(v, N, 111);
+
+    double t0=now_s();
+    VIndex* ix = vindex_create(DIM, VINDEX_DEFAULT_M, VINDEX_DEFAULT_EF_CONSTRUCTION);
+    for (int i=0;i<N;i++) vindex_insert(ix, (uint64_t)i, v+(size_t)i*DIM);
+    double build_s = now_s()-t0;
+    printf("  build: %d vectors in %.2fs (M=%d, ef_construction=%d)\n",
+           N, build_s, VINDEX_DEFAULT_M, VINDEX_DEFAULT_EF_CONSTRUCTION);
+
+    /* queries: half random, half near a real vector (perturbed). */
+    float* qs = (float*)malloc((size_t)Q*DIM*sizeof(float));
+    uint64_t s=999;
+    for (int i=0;i<Q;i++){
+        if (i<Q/2) for(int d=0;d<DIM;d++) qs[i*DIM+d]=frand(&s);
+        else { int base=(int)(xrng(&s)%N); for(int d=0;d<DIM;d++) qs[i*DIM+d]=v[base*DIM+d]+0.03f*frand(&s); }
+    }
+
+    /* oracle */
+    int* oracle = (int*)malloc((size_t)Q*K*sizeof(int));
+    for (int i=0;i<Q;i++) brute_topk(v, N, qs+(size_t)i*DIM, K, oracle+(size_t)i*K);
+
+    int efs[] = { 10, 32, 64, 128 };
+    for (int e=0;e<4;e++){
+        int ef=efs[e];
+        uint64_t ids[64]; float dd[64];
+        int hits=0;
+        double qt0=now_s();
+        for (int i=0;i<Q;i++){
+            int n=vindex_search(ix, qs+(size_t)i*DIM, K, ef, ids, dd);
+            for (int a=0;a<n;a++) for(int b=0;b<K;b++) if((int)ids[a]==oracle[i*K+b]){ hits++; break; }
+        }
+        double qs_ms = (now_s()-qt0)*1000.0/Q;
+        double recall = (double)hits/(Q*K);
+        printf("  ef_search=%-4d recall@10=%.4f  latency=%.3f ms/query\n", ef, recall, qs_ms);
+        if (ef==VINDEX_DEFAULT_EF_SEARCH && !g_quick)
+            CHECK(recall >= 0.90, "recall@10 >= 0.90 at default ef_search=128");
+    }
+    free(oracle); free(qs); free(v); vindex_free(ix);
+}
+
+/* ── Test 2: speedup vs brute force ───────────────────────────────────────── */
+static void speedup_at(int N){
+    int Q=100, K=10;
+    float* v=(float*)malloc((size_t)N*DIM*sizeof(float));
+    gen_vectors(v,N,222);
+    VIndex* ix=vindex_create(DIM,16,200);
+    double bt0=now_s();
+    for(int i=0;i<N;i++) vindex_insert(ix,(uint64_t)i,v+(size_t)i*DIM);
+    printf("  N=%d build=%.2fs\n", N, now_s()-bt0);
+
+    float* qs=(float*)malloc((size_t)Q*DIM*sizeof(float));
+    uint64_t s=333; for(int i=0;i<Q*DIM;i++) qs[i]=frand(&s);
+
+    /* brute force */
+    int scratch[16];
+    double b0=now_s();
+    for(int i=0;i<Q;i++) brute_topk(v,N,qs+(size_t)i*DIM,K,scratch);
+    double bf=(now_s()-b0)/Q;
+
+    /* index */
+    uint64_t ids[16]; float dd[16];
+    double i0=now_s();
+    for(int i=0;i<Q;i++) vindex_search(ix,qs+(size_t)i*DIM,K,64,ids,dd);
+    double iq=(now_s()-i0)/Q;
+
+    printf("  N=%d  brute=%.4f ms/q  index=%.4f ms/q  speedup=%.1fx\n",
+           N, bf*1000, iq*1000, bf/iq);
+    CHECK(iq < bf, "index query faster than brute force");
+    free(qs); free(v); vindex_free(ix);
+}
+static void test_speedup(void){
+    printf("\n== Test 2: brute-force vs index speedup ==\n");
+    speedup_at(g_quick?2000:5000);
+    speedup_at(envint("VINDEX_N_BIG", g_quick?3000:20000));
+}
+
+/* ── Test 3: edge cases ───────────────────────────────────────────────────── */
+static void test_edges(void){
+    printf("\n== Test 3: correctness edge cases ==\n");
+    /* k larger than node count */
+    {
+        VIndex* ix=vindex_create(DIM,16,200);
+        float vec[DIM]; uint64_t s=1;
+        for(int i=0;i<3;i++){ for(int d=0;d<DIM;d++) vec[d]=frand(&s); vindex_insert(ix,(uint64_t)i,vec); }
+        uint64_t ids[50]; float dd[50];
+        int n=vindex_search(ix, vec, 50, 64, ids, dd);
+        CHECK(n==3, "k > node count returns exactly node-count results");
+        vindex_free(ix);
+    }
+    /* duplicate / identical vectors */
+    {
+        VIndex* ix=vindex_create(DIM,16,200);
+        float a[DIM]; uint64_t s=2; for(int d=0;d<DIM;d++) a[d]=frand(&s);
+        for(int i=0;i<10;i++) vindex_insert(ix,(uint64_t)i,a);   /* all identical */
+        float b[DIM]; for(int d=0;d<DIM;d++) b[d]=frand(&s);
+        vindex_insert(ix,100,b);
+        uint64_t ids[5]; float dd[5];
+        int n=vindex_search(ix,a,5,64,ids,dd);
+        CHECK(n==5, "identical-vector index returns k results");
+        CHECK(dd[0] < 1e-4f, "top-1 distance ~0 for a duplicated vector");
+        vindex_free(ix);
+    }
+    /* query equal to an indexed vector returns itself as top-1, dist ~0 */
+    {
+        VIndex* ix=vindex_create(DIM,16,200);
+        int N=500; float* v=(float*)malloc((size_t)N*DIM*sizeof(float)); gen_vectors(v,N,7);
+        for(int i=0;i<N;i++) vindex_insert(ix,(uint64_t)(1000+i),v+(size_t)i*DIM);
+        int probe=137;
+        uint64_t ids[3]; float dd[3];
+        int n=vindex_search(ix, v+(size_t)probe*DIM, 3, 64, ids, dd);
+        CHECK(n>=1 && ids[0]==(uint64_t)(1000+probe), "self-query returns itself as top-1");
+        CHECK(dd[0] < 1e-4f, "self-query top-1 distance ~0");
+        free(v); vindex_free(ix);
+    }
+    /* zero vector: no NaN, handled */
+    {
+        VIndex* ix=vindex_create(DIM,16,200);
+        float z[DIM]; memset(z,0,sizeof z);
+        float a[DIM]; uint64_t s=3; for(int d=0;d<DIM;d++) a[d]=frand(&s);
+        vindex_insert(ix,0,z); vindex_insert(ix,1,a);
+        uint64_t ids[2]; float dd[2];
+        int n=vindex_search(ix, z, 2, 64, ids, dd);            /* zero query */
+        int nan=0; for(int i=0;i<n;i++) if(isnan(dd[i])||isinf(dd[i])) nan=1;
+        CHECK(n>=1 && !nan, "zero vector query produces no NaN/Inf");
+        n=vindex_search(ix, a, 2, 64, ids, dd);                /* zero indexed */
+        nan=0; for(int i=0;i<n;i++) if(isnan(dd[i])||isinf(dd[i])) nan=1;
+        CHECK(!nan, "indexed zero vector produces no NaN/Inf");
+        vindex_free(ix);
+    }
+}
+
+/* ── Test 4: determinism ──────────────────────────────────────────────────── */
+static void test_determinism(void){
+    printf("\n== Test 4: determinism (seeded PRNG → identical results) ==\n");
+    int N=1500;
+    float* v=(float*)malloc((size_t)N*DIM*sizeof(float)); gen_vectors(v,N,55);
+    uint64_t ids1[10],ids2[10]; float d1[10],d2[10];
+    int identical=1;
+    for (int build=0; build<2; build++){
+        VIndex* ix=vindex_create(DIM,16,200);
+        for(int i=0;i<N;i++) vindex_insert(ix,(uint64_t)i,v+(size_t)i*DIM);
+        /* probe several queries */
+        for (int q=0;q<20;q++){
+            uint64_t* ida = build? ids2 : ids1; float* da = build? d2 : d1;
+            vindex_search(ix, v+(size_t)(q*37%N)*DIM, 10, 64, ida, da);
+            if (build==1){
+                /* re-run build-0 query stored? simpler: compare within-run below */
+            }
+        }
+        vindex_free(ix);
+    }
+    /* Proper comparison: run two fresh builds, same single query. */
+    identical=1;
+    for (int q=0;q<25;q++){
+        int qi=(q*61)%N;
+        VIndex* a=vindex_create(DIM,16,200); for(int i=0;i<N;i++) vindex_insert(a,(uint64_t)i,v+(size_t)i*DIM);
+        VIndex* b=vindex_create(DIM,16,200); for(int i=0;i<N;i++) vindex_insert(b,(uint64_t)i,v+(size_t)i*DIM);
+        int na=vindex_search(a, v+(size_t)qi*DIM,10,64,ids1,d1);
+        int nb=vindex_search(b, v+(size_t)qi*DIM,10,64,ids2,d2);
+        if (na!=nb) identical=0;
+        for(int i=0;i<na;i++) if(ids1[i]!=ids2[i] || d1[i]!=d2[i]) identical=0;
+        vindex_free(a); vindex_free(b);
+    }
+    CHECK(identical, "two independent builds give byte-identical query results");
+    free(v);
+}
+
+/* ── Test 5: build_from_store ─────────────────────────────────────────────── */
+static void test_build_from_store(void){
+    printf("\n== Test 5: vindex_build_from_store over a real engram_store ==\n");
+    char path[256];
+    snprintf(path,sizeof path,"/tmp/vindex_test_store_%d.engram",(int)getpid());
+    unlink(path);
+    EngramPagedStore* st = store_create(path);
+    if (!st){ printf("  FAIL: store_create\n"); g_fail=1; return; }
+
+    int N=300;
+    float* v=(float*)malloc((size_t)N*DIM*sizeof(float)); gen_vectors(v,N,88);
+    for (int i=0;i<N;i++){
+        StoreNode n; memset(&n,0,sizeof n);
+        char id[32]; snprintf(id,sizeof id,"node-%d",i);
+        n.id=id; n.content="x"; n.node_type="concept"; n.tier="Semantic";
+        n.emb = v+(size_t)i*DIM; n.emb_dim=DIM;
+        if (store_put_node(st,&n)!=0){ printf("  FAIL: put_node %d\n",i); g_fail=1; }
+    }
+    /* a node WITHOUT an emb — must be skipped by build_from_store. */
+    { StoreNode n; memset(&n,0,sizeof n); n.id=(char*)"no-emb"; n.content="y"; n.node_type="concept"; n.tier="Semantic";
+      store_put_node(st,&n); }
+    store_close(st);
+
+    VIndex* ix = vindex_create(DIM,16,200);
+    char** ids=NULL; int nids=0;
+    int ins = vindex_build_from_store(ix, path, &ids, &nids);
+    printf("  build_from_store inserted %d vectors (expected %d; 1 emb-less skipped)\n", ins, N);
+    CHECK(ins==N, "build_from_store inserts exactly the emb'd nodes");
+    CHECK((size_t)ins==vindex_size(ix), "index size matches insert count");
+
+    /* query with a known vector → must return its own node id as top-1. */
+    int probe=42;
+    uint64_t rids[5]; float dd[5];
+    int n=vindex_search(ix, v+(size_t)probe*DIM, 5, 64, rids, dd);
+    int correct = (n>=1 && rids[0]<(uint64_t)nids && strcmp(ids[rids[0]], "node-42")==0);
+    printf("  query for node-42's vector → top-1 id=%s dist=%.5f\n",
+           (n>=1 && rids[0]<(uint64_t)nids)? ids[rids[0]] : "?", n?dd[0]:-1);
+    CHECK(correct, "build_from_store query resolves to the right node id");
+    CHECK(n>=1 && dd[0]<1e-4f, "top-1 distance ~0 for exact stored vector");
+
+    for (int i=0;i<nids;i++) free(ids[i]);
+    free(ids); free(v); vindex_free(ix); unlink(path);
+}
+
+int main(void){
+    (void)rng_state;
+    g_quick = envint("VINDEX_QUICK", 0);
+    printf("=== engram_vindex (HNSW) test suite ===%s\n", g_quick?" [QUICK]":"");
+    test_recall();
+    test_speedup();
+    test_edges();
+    test_determinism();
+    test_build_from_store();
+    printf("\n=== %s ===\n", g_fail? "FAILURES PRESENT" : "ALL TESTS PASSED");
+    return g_fail;
+}

engram/test/test_wal.c

@@ -0,0 +1,473 @@
+/* test_wal.c — unit + integration + crash-fuzz harness for the engram WAL.
+ *
+ * Includes el_runtime.c directly so it can exercise the static internals
+ * (eg_crc32, eg_wal_*, eg_apply_*) in genuine isolation. Build:
+ *   cc -O2 -fbracket-depth=1024 -I<release-dir> test_wal.c -lcurl -lpthread -o test_wal
+ * Runtime testing only — writes exclusively under a throwaway /tmp dir.
+ */
+#define ENGRAM_TEST_BUILD 1
+#include "el_runtime.c"
+
+static int g_pass = 0, g_fail = 0;
+static void ok(const char* name, int cond) {
+    printf("  [%s] %s\n", cond ? "PASS" : "FAIL", name);
+    if (cond) g_pass++; else g_fail++;
+}
+
+static char g_tmpdir[512];
+static void mk_tmpdir(void) {
+    snprintf(g_tmpdir, sizeof(g_tmpdir), "/tmp/engram-wal-test-%d", (int)getpid());
+    mkdir(g_tmpdir, 0700);
+}
+static void path_in(char* out, size_t cap, const char* name) {
+    snprintf(out, cap, "%s/%s", g_tmpdir, name);
+}
+static void write_file(const char* path, const void* data, size_t n) {
+    FILE* f = fopen(path, "wb"); if (!f) { perror("write_file"); exit(2); }
+    fwrite(data, 1, n, f); fclose(f);
+}
+static long file_size(const char* path) {
+    struct stat st; if (stat(path, &st) != 0) return -1; return (long)st.st_size;
+}
+static void reset_store(void) {
+    char p[600]; path_in(p, sizeof(p), "_reset.json");
+    const char* empty = "{\"nodes\":[],\"edges\":[],\"layers\":[]}";
+    write_file(p, empty, strlen(empty));
+    engram_load((el_val_t)(uintptr_t)p);
+}
+/* Close any open WAL handle so a fresh dir test starts clean. */
+static void wal_close(void) {
+    if (eg_wal.fp) { fclose(eg_wal.fp); eg_wal.fp = NULL; }
+    eg_wal.path[0] = 0; eg_wal.lsn = 0; eg_wal.bytes = 0; eg_wal.uncommitted = 0;
+}
+
+/* ── Snapshot fingerprint: serialize store to a string for A==B comparisons ── */
+static char* store_fingerprint(void) {
+    char p[600]; path_in(p, sizeof(p), "_fp.json");
+    engram_save((el_val_t)(uintptr_t)p);
+    long sz = file_size(p);
+    if (sz < 0) return strdup("");
+    FILE* f = fopen(p, "rb"); char* buf = malloc(sz + 1);
+    size_t got = fread(buf, 1, sz, f); fclose(f); buf[got] = 0;
+    return buf;
+}
+
+/* ── crc32 known-answer vectors ─────────────────────────────────────────── */
+static void test_crc32(void) {
+    printf("\n== crc32 known-answer ==\n");
+    ok("crc32(\"\") == 0x00000000",           eg_crc32("", 0) == 0x00000000u);
+    ok("crc32(\"123456789\") == 0xCBF43926",  eg_crc32("123456789", 9) == 0xCBF43926u);
+    ok("crc32(\"a\") == 0xE8B7BE43",          eg_crc32("a", 1) == 0xE8B7BE43u);
+    /* builtin wrapper agrees */
+    ok("engram_crc32 builtin matches",
+       (uint32_t)(int64_t)engram_crc32(EL_STR("123456789")) == 0xCBF43926u);
+}
+
+/* ── WAL record encode↔decode + framing + corruption rejection ──────────── */
+static void test_framing(void) {
+    printf("\n== record framing / encode-decode / corruption ==\n");
+    char wal[600]; path_in(wal, sizeof(wal), "engram.wal");
+    unlink(wal); wal_close();
+    eg_wal_open(g_tmpdir);
+    const char* pl = "{\"id\":\"n1\",\"content\":\"x\"}";
+    int w = eg_wal_write(EG_OP_NODE_PUT, 0, pl, strlen(pl));
+    eg_wal_commit(1);
+    ok("append returns success", w == 1);
+
+    /* Read raw bytes and verify header fields. */
+    long sz = file_size(wal);
+    FILE* f = fopen(wal, "rb"); unsigned char* buf = malloc(sz); fread(buf, 1, sz, f); fclose(f);
+    uint32_t magic, len32, crc; uint64_t lsn;
+    memcpy(&magic, buf + 0, 4); memcpy(&len32, buf + 4, 4);
+    uint8_t op = buf[8], flags = buf[9]; memcpy(&lsn, buf + 10, 8); memcpy(&crc, buf + 18, 4);
+    ok("magic == 'EWL1'",        magic == EG_WAL_MAGIC);
+    ok("payload_len correct",    len32 == strlen(pl));
+    ok("op == NODE_PUT",         op == EG_OP_NODE_PUT);
+    ok("flags == 0",             flags == 0);
+    ok("lsn == 1",               lsn == 1);
+    ok("crc matches recompute",  crc == eg_wal_record_crc(op, flags, lsn, pl, strlen(pl)));
+    ok("total size == hdr+payload", sz == (long)(EG_WAL_HDR_LEN + strlen(pl)));
+
+    /* Corrupt CRC → replay rejects (0 records). */
+    { char bad[600]; path_in(bad, sizeof(bad), "bad_crc.wal");
+      unsigned char* c = malloc(sz); memcpy(c, buf, sz); c[18] ^= 0xFF; write_file(bad, c, sz);
+      reset_store(); uint64_t ll = 99; int64_t n = eg_wal_replay_file(bad, &ll);
+      ok("corrupt crc → 0 applied", n == 0 && ll == 0); free(c); }
+    /* Corrupt length (claim longer than file) → replay rejects. */
+    { char bad[600]; path_in(bad, sizeof(bad), "bad_len.wal");
+      unsigned char* c = malloc(sz); memcpy(c, buf, sz);
+      uint32_t big = 0xFFFF; memcpy(c + 4, &big, 4); write_file(bad, c, sz);
+      reset_store(); int64_t n = eg_wal_replay_file(bad, NULL);
+      ok("corrupt length → 0 applied", n == 0); free(c); }
+    /* Intact file → replay applies exactly 1. */
+    { reset_store(); uint64_t ll = 0; int64_t n = eg_wal_replay_file(wal, &ll);
+      ok("intact → 1 applied, last_lsn=1", n == 1 && ll == 1); }
+    free(buf); wal_close();
+}
+
+/* ── Single-op apply on an (empty) store ────────────────────────────────── */
+static void test_single_ops(void) {
+    printf("\n== single-op apply ==\n");
+    reset_store();
+    eg_apply_node_put("{\"id\":\"n1\",\"content\":\"hello\",\"salience\":0.7,\"layer_id\":2}");
+    EngramNode* n = engram_find_node("n1");
+    ok("NODE_PUT creates node", n != NULL);
+    ok("NODE_PUT content",      n && strcmp(n->content, "hello") == 0);
+    ok("NODE_PUT salience",     n && n->salience > 0.69 && n->salience < 0.71);
+    ok("NODE_PUT layer_id",     n && n->layer_id == 2);
+    ok("NODE_PUT count == 1",   engram_get()->node_count == 1);
+
+    /* NODE_PUT upsert idempotency: same id overwrites, no dup. */
+    eg_apply_node_put("{\"id\":\"n1\",\"content\":\"changed\"}");
+    n = engram_find_node("n1");
+    ok("NODE_PUT upsert (no dup)", engram_get()->node_count == 1);
+    ok("NODE_PUT upsert content",  n && strcmp(n->content, "changed") == 0);
+
+    eg_apply_node_put("{\"id\":\"n2\",\"content\":\"b\"}");
+    eg_apply_edge_put("{\"id\":\"e1\",\"from_id\":\"n1\",\"to_id\":\"n2\",\"relation\":\"r\",\"weight\":0.4,\"hebb\":0.25}");
+    EngramStore* g = engram_get();
+    int64_t ei = eg_find_edge_index(g, "e1");
+    ok("EDGE_PUT creates edge",  ei >= 0);
+    ok("EDGE_PUT weight",        ei >= 0 && g->edges[ei].weight > 0.39 && g->edges[ei].weight < 0.41);
+    ok("EDGE_PUT hebb",          ei >= 0 && g->edges[ei].hebb > 0.24 && g->edges[ei].hebb < 0.26);
+    /* EDGE_PUT upsert idempotency */
+    eg_apply_edge_put("{\"id\":\"e1\",\"from_id\":\"n1\",\"to_id\":\"n2\",\"relation\":\"r\",\"weight\":0.9}");
+    ok("EDGE_PUT upsert (no dup)", g->edge_count == 1);
+
+    /* TOMBSTONE marks metadata, keeps node */
+    eg_wal_apply(EG_OP_TOMBSTONE, "{\"id\":\"n1\"}", strlen("{\"id\":\"n1\"}"));
+    n = engram_find_node("n1");
+    ok("TOMBSTONE keeps node",       n != NULL);
+    ok("TOMBSTONE marks metadata",   n && strstr(n->metadata, "tombstoned") != NULL);
+
+    /* SUPERSEDE marks metadata with by-id */
+    { const char* s = "{\"id\":\"n2\",\"by\":\"n1\"}";
+      eg_wal_apply(EG_OP_SUPERSEDE, s, strlen(s));
+      n = engram_find_node("n2");
+      ok("SUPERSEDE marks superseded_by", n && strstr(n->metadata, "superseded_by") != NULL);
+      ok("SUPERSEDE records by-id",       n && strstr(n->metadata, "n1") != NULL); }
+
+    /* LAYER_PUT / LAYER_DEL */
+    { const char* lp = "{\"layer_id\":42,\"name\":\"testlayer\",\"activation_priority\":7}";
+      eg_wal_apply(EG_OP_LAYER_PUT, lp, strlen(lp));
+      int found = 0; for (size_t i = 0; i < g->layer_count; i++)
+          if (g->layers[i].layer_id == 42 && g->layers[i].name && strcmp(g->layers[i].name, "testlayer") == 0) found = 1;
+      ok("LAYER_PUT adds layer", found);
+      const char* ld = "{\"layer_id\":42}";
+      eg_wal_apply(EG_OP_LAYER_DEL, ld, strlen(ld));
+      int gone = 1; for (size_t i = 0; i < g->layer_count; i++)
+          if (g->layers[i].layer_id == 42 && g->layers[i].name) gone = 0;
+      ok("LAYER_DEL removes layer name", gone); }
+
+    /* HEBB_BATCH upserts multiple edges in one record */
+    reset_store();
+    eg_apply_node_put("{\"id\":\"a\"}"); eg_apply_node_put("{\"id\":\"b\"}"); eg_apply_node_put("{\"id\":\"c\"}");
+    { const char* hb = "{\"edges\":["
+        "{\"id\":\"he1\",\"from_id\":\"a\",\"to_id\":\"b\",\"hebb\":0.1},"
+        "{\"id\":\"he2\",\"from_id\":\"b\",\"to_id\":\"c\",\"hebb\":0.2}]}";
+      eg_wal_apply(EG_OP_HEBB_BATCH, hb, strlen(hb));
+      ok("HEBB_BATCH upserts 2 edges", engram_get()->edge_count == 2); }
+
+    /* FORGET hard-removes node + incident edges */
+    { const char* fg = "{\"id\":\"b\"}";
+      eg_wal_apply(EG_OP_FORGET, fg, strlen(fg));
+      ok("FORGET removes node",        engram_find_node("b") == NULL);
+      ok("FORGET removes incident edges", engram_get()->edge_count == 0); }
+}
+
+/* ── Replay idempotency: apply file twice == once ───────────────────────── */
+static void test_replay_idempotent(void) {
+    printf("\n== replay idempotency ==\n");
+    reset_store(); wal_close();
+    char wal[600]; path_in(wal, sizeof(wal), "engram.wal"); unlink(wal);
+    eg_wal_open(g_tmpdir);
+    eg_apply_node_put("{\"id\":\"x\"}");
+    engram_wal_node_put(EL_STR(g_tmpdir), EL_STR("x"));
+    eg_apply_node_put("{\"id\":\"y\"}");
+    engram_wal_node_put(EL_STR(g_tmpdir), EL_STR("y"));
+    eg_wal_commit(1);
+    reset_store();
+    eg_wal_replay_file(wal, NULL);
+    int64_t after1 = engram_get()->node_count;
+    eg_wal_replay_file(wal, NULL);            /* replay AGAIN */
+    int64_t after2 = engram_get()->node_count;
+    ok("replay once == 2 nodes", after1 == 2);
+    ok("replay twice == replay once (idempotent)", after2 == after1);
+    wal_close();
+}
+
+/* ── hebb + emb serialize round-trip ────────────────────────────────────── */
+static void test_hebb_emb_roundtrip(void) {
+    printf("\n== hebb + emb serialize round-trip ==\n");
+    reset_store();
+    /* hebb via edge emit→parse */
+    eg_apply_node_put("{\"id\":\"p\"}"); eg_apply_node_put("{\"id\":\"q\"}");
+    eg_apply_edge_put("{\"id\":\"eh\",\"from_id\":\"p\",\"to_id\":\"q\",\"hebb\":0.123456}");
+    EngramStore* g = engram_get();
+    int64_t ei = eg_find_edge_index(g, "eh");
+    JsonBuf b; jb_init(&b); engram_emit_edge_json(&b, &g->edges[ei]);
+    char* ej = strndup(b.buf, b.len); free(b.buf);
+    ok("emit edge carries hebb", strstr(ej, "\"hebb\"") != NULL);
+    eg_apply_edge_put(ej);   /* re-parse */
+    ei = eg_find_edge_index(g, "eh");
+    ok("hebb survives emit→parse (%.6g)", g->edges[ei].hebb > 0.1234 && g->edges[ei].hebb < 0.1235);
+    free(ej);
+
+    /* emb via node emit(include_emb=1)→parse, bit-exact at %.4g. The runtime
+     * requires dim>=8 (garbage guard), so use 8 dyadic-rational values that
+     * survive %.4g round-trip exactly. */
+    eg_apply_node_put("{\"id\":\"ez\",\"emb\":\"0.5,-0.25,0.125,1,-0.0625,0.75,-1,0.375\"}");
+    EngramNode* n = engram_find_node("ez");
+    ok("emb parsed dim==8", n && n->emb_dim == 8);
+    float e0 = n->emb[0], e1 = n->emb[1], e2 = n->emb[2], e3 = n->emb[3];
+    JsonBuf nb; jb_init(&nb); engram_emit_node_json(&nb, n, 1);
+    char* nj = strndup(nb.buf, nb.len); free(nb.buf);
+    ok("emit node carries emb", strstr(nj, "\"emb\"") != NULL);
+    eg_apply_node_put(nj); free(nj);
+    n = engram_find_node("ez");
+    ok("emb[0]==0.5 exact",   n->emb[0] == e0 && e0 == 0.5f);
+    ok("emb[1]==-0.25 exact", n->emb[1] == e1 && e1 == -0.25f);
+    ok("emb[2]==0.125 exact", n->emb[2] == e2 && e2 == 0.125f);
+    ok("emb[3]==1 exact",     n->emb[3] == e3 && e3 == 1.0f);
+}
+
+/* ── data-dir resolution (§18.2) ────────────────────────────────────────── */
+static void test_data_dir(void) {
+    printf("\n== data-dir resolution ==\n");
+    setenv("ENGRAM_DATA_DIR", "/data/explicit", 1);
+    ok("explicit ENGRAM_DATA_DIR honored",
+       strcmp(EL_CSTR(engram_resolve_data_dir()), "/data/explicit") == 0);
+    unsetenv("ENGRAM_DATA_DIR");
+    char fakehome[600]; snprintf(fakehome, sizeof(fakehome), "%s/home", g_tmpdir);
+    mkdir(fakehome, 0700);
+    setenv("HOME", fakehome, 1);
+    char expect[700]; snprintf(expect, sizeof(expect), "%s/.neuron/engram", fakehome);
+    const char* got = EL_CSTR(engram_resolve_data_dir());
+    ok("unset → $HOME/.neuron/engram", strcmp(got, expect) == 0);
+    ok("resolved dir is NOT /tmp/engram", strcmp(got, "/tmp/engram") != 0);
+    ok("resolved dir was created", file_size(expect) >= 0 || 1); /* mkdir ran */
+    /* HOME-unresolvable fail-loud path is verified out-of-process (calls exit). */
+    printf("  [NOTE] HOME-unresolvable → exit(1) verified via subprocess (see run script)\n");
+}
+
+/* ── protected-set derivation (§18.1/18.3) ──────────────────────────────── */
+static void build_self_graph(int n_identity, int n_values) {
+    reset_store();
+    eg_apply_node_put("{\"id\":\"" EG_SELF_ROOT "\",\"content\":\"self\"}");
+    eg_apply_node_put("{\"id\":\"" EG_VALUES_HUB "\",\"content\":\"values-hub\"}");
+    char buf[256];
+    for (int i = 0; i < n_identity; i++) {
+        snprintf(buf, sizeof(buf), "{\"id\":\"id-%d\"}", i); eg_apply_node_put(buf);
+        snprintf(buf, sizeof(buf), "{\"id\":\"eid-%d\",\"from_id\":\"" EG_SELF_ROOT "\",\"to_id\":\"id-%d\"}", i, i);
+        eg_apply_edge_put(buf);
+    }
+    for (int i = 0; i < n_values; i++) {
+        snprintf(buf, sizeof(buf), "{\"id\":\"val-%d\"}", i); eg_apply_node_put(buf);
+        snprintf(buf, sizeof(buf), "{\"id\":\"eval-%d\",\"from_id\":\"" EG_VALUES_HUB "\",\"to_id\":\"val-%d\"}", i, i);
+        eg_apply_edge_put(buf);
+    }
+    /* an ordinary, unconnected node */
+    eg_apply_node_put("{\"id\":\"ordinary-1\"}");
+}
+static int count_occurrences(const char* hay, const char* needle) {
+    int c = 0; const char* p = hay;
+    while ((p = strstr(p, needle))) { c++; p += strlen(needle); }
+    return c;
+}
+static void test_protected(void) {
+    printf("\n== protected-set derivation ==\n");
+    build_self_graph(7, 13);
+    const char* pj = EL_CSTR(engram_protected_json());
+    ok("self root protected",  eg_is_protected(EG_SELF_ROOT));
+    ok("values hub protected", eg_is_protected(EG_VALUES_HUB));
+    ok("a value node protected",    eg_is_protected("val-5"));
+    ok("an identity node protected", eg_is_protected("id-3"));
+    ok("ordinary node NOT protected", !eg_is_protected("ordinary-1"));
+    ok("missing node NOT protected",  !eg_is_protected("nope-xyz"));
+    ok("derived set has 13 values",  count_occurrences(pj, "\"val-") == 13);
+    ok("derived set has 7 identity", count_occurrences(pj, "\"id-")  == 7);
+    ok("ordinary not in derived set", strstr(pj, "ordinary-1") == NULL);
+}
+
+/* ── Replay parity: WAL round-trip == direct apply ──────────────────────── */
+static void rand_node_json(char* out, size_t cap, int id) {
+    snprintf(out, cap, "{\"id\":\"pn-%d\",\"content\":\"c%d\",\"salience\":%.3f,\"importance\":%.3f}",
+             id, id, (rand() % 1000) / 1000.0, (rand() % 1000) / 1000.0);
+}
+static void test_replay_parity(void) {
+    printf("\n== replay parity (WAL round-trip vs direct apply) ==\n");
+    srand(1234);
+    /* Build a random op stream. */
+    #define NOPS 200
+    char ops[NOPS][256]; uint8_t opcode[NOPS]; int nops = 0;
+    int nodes_created = 0;
+    for (int i = 0; i < NOPS; i++) {
+        int r = rand() % 10;
+        if (r < 6 || nodes_created < 3) {
+            rand_node_json(ops[nops], sizeof(ops[0]), nodes_created);
+            opcode[nops] = EG_OP_NODE_PUT; nodes_created++; nops++;
+        } else if (r < 8) { /* edge between two existing nodes */
+            int a = rand() % nodes_created, b = rand() % nodes_created;
+            snprintf(ops[nops], sizeof(ops[0]),
+                "{\"id\":\"pe-%d\",\"from_id\":\"pn-%d\",\"to_id\":\"pn-%d\",\"weight\":0.5}", i, a, b);
+            opcode[nops] = EG_OP_EDGE_PUT; nops++;
+        } else { /* upsert (overwrite) an existing node */
+            int a = rand() % nodes_created;
+            snprintf(ops[nops], sizeof(ops[0]), "{\"id\":\"pn-%d\",\"content\":\"upd%d\"}", a, i);
+            opcode[nops] = EG_OP_NODE_PUT; nops++;
+        }
+    }
+    /* Oracle: apply directly. */
+    reset_store();
+    for (int i = 0; i < nops; i++) eg_wal_apply(opcode[i], ops[i], strlen(ops[i]));
+    char* oracle = store_fingerprint();
+
+    /* WAL path: write each op to a fresh WAL, then replay into a reset store. */
+    wal_close();
+    char wal[600]; path_in(wal, sizeof(wal), "parity.wal"); unlink(wal);
+    /* point eg_wal at the parity file by opening a dir handle then overriding */
+    reset_store();
+    { FILE* f = fopen(wal, "wb"); fclose(f); }
+    eg_wal.fp = fopen(wal, "ab"); snprintf(eg_wal.path, sizeof(eg_wal.path), "%s", wal);
+    eg_wal.lsn = 0; eg_wal.bytes = 0;
+    for (int i = 0; i < nops; i++) eg_wal_write(opcode[i], 0, ops[i], strlen(ops[i]));
+    eg_wal_commit(1); wal_close();
+    reset_store();
+    eg_wal_replay_file(wal, NULL);
+    char* replayed = store_fingerprint();
+
+    ok("WAL replay fingerprint == direct-apply oracle", strcmp(oracle, replayed) == 0);
+    if (strcmp(oracle, replayed) != 0) {
+        printf("    oracle  len=%zu\n    replay  len=%zu\n", strlen(oracle), strlen(replayed));
+    }
+    free(oracle); free(replayed);
+}
+
+/* ── Torn-tail fuzz: truncate at EVERY offset; never crash, recover to last
+ *    intact record ─────────────────────────────────────────────────────── */
+static int count_full_records(const unsigned char* buf, long len) {
+    long off = 0; int n = 0;
+    while (off + EG_WAL_HDR_LEN <= len) {
+        uint32_t magic, len32; memcpy(&magic, buf + off, 4);
+        if (magic != EG_WAL_MAGIC) break;
+        memcpy(&len32, buf + off + 4, 4);
+        if (off + EG_WAL_HDR_LEN + len32 > len) break;
+        n++; off += EG_WAL_HDR_LEN + len32;
+    }
+    return n;
+}
+static void test_torn_tail(void) {
+    printf("\n== torn-tail fuzz (truncate at every byte offset) ==\n");
+    wal_close();
+    char wal[600]; path_in(wal, sizeof(wal), "torn.wal"); unlink(wal);
+    eg_wal.fp = fopen(wal, "ab"); snprintf(eg_wal.path, sizeof(eg_wal.path), "%s", wal);
+    eg_wal.lsn = 0; eg_wal.bytes = 0;
+    for (int i = 0; i < 12; i++) {
+        char pl[128]; snprintf(pl, sizeof(pl), "{\"id\":\"t-%d\",\"content\":\"payload-%d\"}", i, i);
+        eg_wal_write(EG_OP_NODE_PUT, 0, pl, strlen(pl));
+    }
+    eg_wal_commit(1); wal_close();
+    long sz = file_size(wal);
+    FILE* f = fopen(wal, "rb"); unsigned char* full = malloc(sz); fread(full, 1, sz, f); fclose(f);
+
+    int all_ok = 1, mismatches = 0;
+    char trunc[600]; path_in(trunc, sizeof(trunc), "torn_trunc.wal");
+    for (long L = 0; L <= sz; L++) {
+        write_file(trunc, full, L);
+        reset_store();
+        uint64_t last = 12345;
+        int64_t applied = eg_wal_replay_file(trunc, &last);   /* must not crash */
+        int expect = count_full_records(full, L);
+        if (applied != expect) { all_ok = 0; if (mismatches++ < 3)
+            printf("    L=%ld applied=%lld expect=%d\n", L, (long long)applied, expect); }
+    }
+    ok("no crash across all truncation offsets", 1); /* reached here => survived */
+    ok("recovered record count == #intact records at every offset", all_ok);
+    free(full);
+}
+
+/* ── Compaction crash-window convergence (§7) ───────────────────────────── */
+static void test_compaction_crash(void) {
+    printf("\n== compaction crash-window convergence ==\n");
+    /* Build state: base snapshot has n1; WAL adds n2,n3. */
+    char dir[600]; snprintf(dir, sizeof(dir), "%s/comp", g_tmpdir); mkdir(dir, 0700);
+    char base[700], wal[700], waltmp[700];
+    snprintf(base, sizeof(base), "%s/snapshot.json", dir);
+    snprintf(wal, sizeof(wal), "%s/engram.wal", dir);
+    snprintf(waltmp, sizeof(waltmp), "%s/engram.wal.tmp", dir);
+
+    /* Reference full state = n1,n2,n3. */
+    reset_store();
+    eg_apply_node_put("{\"id\":\"n1\"}");
+    eg_apply_node_put("{\"id\":\"n2\"}");
+    eg_apply_node_put("{\"id\":\"n3\"}");
+    char* full = store_fingerprint();
+
+    /* Prepare OLD base (n1 only) + OLD wal (n2,n3). */
+    reset_store(); eg_apply_node_put("{\"id\":\"n1\"}");
+    engram_save((el_val_t)(uintptr_t)base);
+    wal_close(); unlink(wal);
+    eg_wal.fp = fopen(wal, "ab"); snprintf(eg_wal.path, sizeof(eg_wal.path), "%s", wal); eg_wal.lsn = 0; eg_wal.bytes = 0;
+    reset_store(); eg_apply_node_put("{\"id\":\"n1\"}"); eg_apply_node_put("{\"id\":\"n2\"}"); eg_apply_node_put("{\"id\":\"n3\"}");
+    engram_wal_node_put(EL_STR(dir), EL_STR("n2"));
+    engram_wal_node_put(EL_STR(dir), EL_STR("n3"));
+    eg_wal_commit(1); wal_close();
+
+    /* Boot helper: load base then replay wal (mirrors server boot order). */
+    #define BOOT_FP(fp) do { \
+        engram_load((el_val_t)(uintptr_t)base); \
+        eg_wal_replay_file(wal, NULL); \
+        fp = store_fingerprint(); } while (0)
+
+    /* Crash BEFORE compaction (steady state). */
+    char* c0; BOOT_FP(c0);
+    ok("pre-compaction boot converges to full", strcmp(c0, full) == 0); free(c0);
+
+    /* Crash AFTER step 1 (new base written) but BEFORE wal swap:
+     * base now = full (n1,n2,n3), wal still = old (n2,n3). Idempotent replay. */
+    engram_load((el_val_t)(uintptr_t)base); /* reload old base into store */
+    eg_apply_node_put("{\"id\":\"n2\"}"); eg_apply_node_put("{\"id\":\"n3\"}");
+    engram_save((el_val_t)(uintptr_t)base);  /* == compaction step 1: new base */
+    char* c1; BOOT_FP(c1);
+    ok("crash after new-base, before wal-swap → converges", strcmp(c1, full) == 0); free(c1);
+
+    /* Crash AFTER wal.tmp written but BEFORE rename: stray tmp ignored,
+     * old wal still authoritative over (new) base. */
+    { FILE* tf = fopen(waltmp, "wb"); const char* junk = "PARTIAL"; fwrite(junk,1,7,tf); fclose(tf); }
+    char* c2; BOOT_FP(c2);
+    ok("crash after wal.tmp, before rename → converges", strcmp(c2, full) == 0);
+    unlink(waltmp); free(c2);
+
+    /* Crash AFTER rename (compaction complete): base=full, wal=only COMPACT_MARK. */
+    reset_store();
+    engram_load((el_val_t)(uintptr_t)base);
+    eg_apply_node_put("{\"id\":\"n2\"}"); eg_apply_node_put("{\"id\":\"n3\"}");
+    engram_wal_compact(EL_STR(dir));   /* full compaction */
+    wal_close();
+    char* c3;
+    engram_load((el_val_t)(uintptr_t)base);
+    eg_wal_replay_file(wal, NULL);
+    c3 = store_fingerprint();
+    ok("post-compaction boot converges to full", strcmp(c3, full) == 0);
+    long wsz = file_size(wal);
+    ok("post-compaction WAL truncated (only COMPACT_MARK)",
+       wsz > 0 && wsz < 64);   /* just the marker record */
+    free(c3); free(full);
+}
+
+int main(void) {
+    mk_tmpdir();
+    printf("engram WAL test harness — tmpdir=%s\n", g_tmpdir);
+    test_crc32();
+    test_framing();
+    test_single_ops();
+    test_replay_idempotent();
+    test_hebb_emb_roundtrip();
+    test_data_dir();
+    test_protected();
+    test_replay_parity();
+    test_torn_tail();
+    test_compaction_crash();
+    printf("\n=================  %d passed, %d failed  =================\n", g_pass, g_fail);
+    return g_fail ? 1 : 0;
+}

engram/test/test_wal_store.c

@@ -0,0 +1,466 @@
+/* test_wal_store.c — M2 gate for the WAL + checkpoint + crash recovery + legacy
+ * import layered on the M1 paged store (engram_store.{c,h}).
+ *
+ * Pure C. Build:  gcc -O2 test_wal_store.c ../../lang/runtime/engram_store.c -o t
+ * Writes ONLY under a throwaway /tmp dir. Never touches ~/.neuron or live ports.
+ *
+ * Covers §7/M2 gates:
+ *   1 replay parity      — random op stream: normal-durable path == crash-recover path
+ *   2 torn-tail fuzz     — truncate neuron.wal at EVERY byte offset → never crash,
+ *                          recover to the last intact record (contiguous prefix)
+ *   3 checkpoint-crash   — kill at each checkpoint phase → converge, no loss past fsync
+ *   4 torn-page + WAL    — corrupt a store page under WAL coverage → redo re-derives
+ *   5 legacy import      — synth snapshot.json (emb+hebb, edges, layers) → import once,
+ *                          bit-exact readback; JSON never re-read as the store
+ *   6 hebb survives crash— hebb via WAL, crash before checkpoint → hebb recovered
+ */
+#include "../../lang/runtime/engram_store.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdint.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <sys/stat.h>
+
+static int g_pass = 0, g_fail = 0;
+static void ok(const char* name, int cond){
+    printf("  [%s] %s\n", cond ? "PASS" : "FAIL", name);
+    if (cond) g_pass++; else g_fail++;
+}
+
+static char g_base[512];
+static void mk_base(void){
+    snprintf(g_base, sizeof g_base, "/tmp/engram-wal-test-%d", (int)getpid());
+    mkdir(g_base, 0700);
+}
+static void mk_dir(const char* name, char* out, size_t cap){
+    snprintf(out, cap, "%s/%s", g_base, name);
+    mkdir(out, 0700);
+}
+
+/* deterministic RNG */
+static uint64_t xs(uint64_t* s){ uint64_t x=*s; x^=x<<13; x^=x>>7; x^=x<<17; *s=x; return x; }
+
+/* ── small node/edge generators (kept compact so WAL frames stay small) ─────── */
+static void gen_node(int i, int with_emb, StoreNode* n){
+    memset(n, 0, sizeof *n);
+    uint64_t st = 0x1234ULL ^ ((uint64_t)(i+1)*0x9E3779B97F4A7C15ULL);
+    char id[32]; snprintf(id, sizeof id, "n%d", i); n->id = strdup(id);
+    char c[64]; snprintf(c, sizeof c, "content-of-node-%d-%llu", i, (unsigned long long)(xs(&st)%9999));
+    n->content = strdup(c);
+    n->node_type = strdup("concept");
+    n->tier = strdup("Working");
+    n->salience   = (double)(xs(&st)%100000)/7.0;
+    n->importance = (double)(xs(&st)%100000)/11.0;
+    n->confidence = (double)(xs(&st)%100000)/13.0;
+    n->activation_count = (int64_t)(xs(&st)%1000);
+    n->created_at = 1600000000000LL + i;
+    n->updated_at = 1600000000000LL + i*2;
+    n->layer_id   = (uint32_t)(i % 4);
+    n->wm_anchor  = (double)(xs(&st)%1000)/3.0;
+    if (with_emb){
+        n->emb_dim = 32;
+        n->emb = (float*)malloc(sizeof(float)*n->emb_dim);
+        for (int k=0;k<n->emb_dim;k++){ uint32_t u=(uint32_t)xs(&st); memcpy(&n->emb[k],&u,4); }
+    }
+}
+static void gen_edge(int i, const char* from, const char* to, StoreEdge* e){
+    memset(e, 0, sizeof *e);
+    uint64_t st = 0xABCDULL ^ ((uint64_t)(i+1)*0xD1B54A32D192ED03ULL);
+    char id[32]; snprintf(id, sizeof id, "e%d", i); e->id = strdup(id);
+    e->from_id = strdup(from); e->to_id = strdup(to);
+    e->relation = strdup("relates_to");
+    e->weight   = (double)(xs(&st)%100000)/17.0;
+    e->hebb     = (double)(xs(&st)%100000)/100000.0;
+    e->confidence = (double)(xs(&st)%100000)/19.0;
+    e->created_at = 1600000000000LL + i;
+    e->last_fired = 1600000000000LL + i*3;
+    e->layer_id   = (uint32_t)(i % 4);
+}
+
+static int dcmp(double a, double b){ return a==b; }
+static int scmp(const char* a, const char* b){
+    if (!a && !b) return 1; if (!a || !b) return 0; return strcmp(a,b)==0;
+}
+static int node_eq(const StoreNode* a, const StoreNode* b){
+    if (!scmp(a->id,b->id) || !scmp(a->content,b->content) || !scmp(a->node_type,b->node_type) ||
+        !scmp(a->tier,b->tier)) return 0;
+    if (!dcmp(a->salience,b->salience) || !dcmp(a->importance,b->importance) ||
+        !dcmp(a->confidence,b->confidence) || a->activation_count!=b->activation_count ||
+        a->created_at!=b->created_at || a->updated_at!=b->updated_at ||
+        a->layer_id!=b->layer_id || !dcmp(a->wm_anchor,b->wm_anchor)) return 0;
+    if (a->emb_dim != b->emb_dim) return 0;
+    if (a->emb_dim>0){
+        if (!a->emb || !b->emb) return 0;
+        if (memcmp(a->emb, b->emb, sizeof(float)*a->emb_dim)!=0) return 0;  /* bit-exact */
+    }
+    return 1;
+}
+static int edge_eq(const StoreEdge* a, const StoreEdge* b){
+    return scmp(a->id,b->id) && scmp(a->from_id,b->from_id) && scmp(a->to_id,b->to_id) &&
+           scmp(a->relation,b->relation) && dcmp(a->weight,b->weight) && dcmp(a->hebb,b->hebb) &&
+           dcmp(a->confidence,b->confidence) && a->created_at==b->created_at &&
+           a->last_fired==b->last_fired && a->layer_id==b->layer_id;
+}
+
+/* whole-file read / write helpers (for torn-tail + torn-page fuzzing) */
+static uint8_t* read_file(const char* p, long* len){
+    FILE* f=fopen(p,"rb"); if(!f) return NULL;
+    fseek(f,0,SEEK_END); long n=ftell(f); fseek(f,0,SEEK_SET);
+    uint8_t* b=malloc(n?n:1); if(fread(b,1,n,f)!=(size_t)n){ fclose(f); free(b); return NULL; }
+    fclose(f); *len=n; return b;
+}
+static void write_file(const char* p, const uint8_t* b, long len){
+    FILE* f=fopen(p,"wb"); fwrite(b,1,len,f); fclose(f);
+}
+
+/* ═══════════════════════════ TEST 1 — replay parity ═══════════════════════ */
+#define UNIV_NODES 60
+#define UNIV_EDGES 40
+static void test_replay_parity(void){
+    printf("\n== replay parity: normal-durable path == crash-then-recover path ==\n");
+    char da[600], db[600]; mk_dir("parityA", da, sizeof da); mk_dir("parityB", db, sizeof db);
+    EngramPagedStore* A = engram_open(da);
+    EngramPagedStore* B = engram_open(db);
+    ok("opened both stores", A && B);
+    if (!A || !B) return;
+
+    uint64_t rng = 0xF00DFACEULL;
+    int OPS = 800;
+    for (int step=0; step<OPS; step++){
+        uint64_t r = xs(&rng);
+        int kind = r % 100;
+        if (kind < 45){                       /* node put / re-put */
+            int i = (int)(xs(&rng) % UNIV_NODES);
+            StoreNode n; gen_node(i, (i%3)==0, &n);
+            n.activation_count += step;         /* vary re-puts */
+            store_put_node(A,&n); store_put_node(B,&n);
+            store_node_free(&n);
+        } else if (kind < 80){                /* edge put */
+            int i = (int)(xs(&rng) % UNIV_EDGES);
+            char from[32], to[32];
+            snprintf(from,sizeof from,"n%d",(int)(xs(&rng)%UNIV_NODES));
+            snprintf(to,sizeof to,"n%d",(int)(xs(&rng)%UNIV_NODES));
+            StoreEdge e; gen_edge(i, from, to, &e);
+            store_put_edge(A,&e); store_put_edge(B,&e);
+            store_edge_free(&e);
+        } else if (kind < 88){                /* tombstone a node */
+            int i = (int)(xs(&rng) % UNIV_NODES);
+            char id[32]; snprintf(id,sizeof id,"n%d",i);
+            store_tombstone(A,id); store_tombstone(B,id);
+        } else if (kind < 94){                /* hebb batch on a couple edges */
+            StoreHebbDelta d[3]; char ids[3][32];
+            int m = 1 + (int)(xs(&rng)%3);
+            for (int j=0;j<m;j++){ snprintf(ids[j],sizeof ids[j],"e%d",(int)(xs(&rng)%UNIV_EDGES));
+                d[j].edge_id=ids[j]; d[j].hebb=(double)(xs(&rng)%100000)/100000.0; d[j].last_fired=1700000000000LL+step; }
+            store_hebb_batch(A,d,m); store_hebb_batch(B,d,m);
+        } else {                              /* layer put */
+            StoreLayer L; memset(&L,0,sizeof L);
+            L.layer_id=(uint32_t)(xs(&rng)%4); char nm[32]; snprintf(nm,sizeof nm,"layer-%u-%d",L.layer_id,step);
+            L.name=nm; L.activation_priority=(uint32_t)(xs(&rng)%10); L.suppressible=(int)(xs(&rng)%2);
+            store_put_layer(A,&L); store_put_layer(B,&L);
+        }
+    }
+
+    /* A: the normal durable path (checkpoint + clean close), then reopen. */
+    engram_close(A);
+    A = engram_open(da);
+    /* B: power loss with NO checkpoint since open → recover purely from the WAL. */
+    store__crash(B);
+    B = engram_open(db);
+    ok("A reopened, B recovered from WAL", A && B);
+    if (!A || !B) return;
+
+    int node_mismatch=0, edge_mismatch=0, presence_mismatch=0;
+    for (int i=0;i<UNIV_NODES;i++){
+        char id[32]; snprintf(id,sizeof id,"n%d",i);
+        StoreNode na, nb; int ra=store_get_node(A,id,&na), rb=store_get_node(B,id,&nb);
+        if (ra!=rb){ presence_mismatch++; }
+        else if (ra==1){ if (!node_eq(&na,&nb)) node_mismatch++; }
+        if (ra==1) store_node_free(&na); if (rb==1) store_node_free(&nb);
+    }
+    for (int i=0;i<UNIV_EDGES;i++){
+        char id[32]; snprintf(id,sizeof id,"e%d",i);
+        StoreEdge ea, eb; int ra=store_get_edge(A,id,&ea), rb=store_get_edge(B,id,&eb);
+        if (ra!=rb){ presence_mismatch++; }
+        else if (ra==1){ if (!edge_eq(&ea,&eb)) edge_mismatch++; }
+        if (ra==1) store_edge_free(&ea); if (rb==1) store_edge_free(&eb);
+    }
+    /* adjacency parity (no duplicate edges after re-put/hebb supersede) */
+    int adj_mismatch=0;
+    for (int i=0;i<UNIV_NODES;i++){
+        char id[32]; snprintf(id,sizeof id,"n%d",i);
+        StoreEdge *fa,*fb; size_t na2, nb2;
+        store_get_edges_from(A,id,&fa,&na2); store_get_edges_from(B,id,&fb,&nb2);
+        if (na2!=nb2) adj_mismatch++;
+        store_edges_free(fa,na2); store_edges_free(fb,nb2);
+    }
+    /* layer parity */
+    StoreLayer *la,*lb; size_t nla,nlb;
+    store_list_layers(A,&la,&nla); store_list_layers(B,&lb,&nlb);
+
+    ok("node presence identical (oracle vs recovered)", presence_mismatch==0);
+    ok("all live nodes bit-exact (incl emb)", node_mismatch==0);
+    ok("all live edges exact (incl hebb)", edge_mismatch==0);
+    ok("adjacency counts identical (no dup edges)", adj_mismatch==0);
+    ok("layer set identical", nla==nlb);
+    ok("recovered store_check clean", store_check(B, STORE_CHECK_CRC)==0);
+    printf("     ops=%d nodes=%d edges=%d layersA=%zu layersB=%zu\n", OPS, UNIV_NODES, UNIV_EDGES, nla, nlb);
+    store_layers_free(la,nla); store_layers_free(lb,nlb);
+    engram_close(A); engram_close(B);
+}
+
+/* ═══════════════════════════ TEST 2 — torn-tail fuzz ═══════════════════════ */
+#define TT_NODES 14
+static void test_torn_tail(void){
+    printf("\n== torn-tail fuzz: truncate neuron.wal at every byte offset ==\n");
+    char base[600]; mk_dir("tornbase", base, sizeof base);
+    EngramPagedStore* s = engram_open(base);
+    for (int i=0;i<TT_NODES;i++){ StoreNode n; gen_node(i,0,&n); store_put_node(s,&n); store_node_free(&n); }
+    store__crash(s);                             /* leave store(at ckpt) + full WAL on disk */
+
+    char sp[700], wp[700]; snprintf(sp,sizeof sp,"%s/neuron.egm",base); snprintf(wp,sizeof wp,"%s/neuron.wal",base);
+    long slen, wlen; uint8_t* sb=read_file(sp,&slen); uint8_t* wb=read_file(wp,&wlen);
+    ok("captured store + WAL images", sb && wb);
+    if (!sb || !wb) return;
+
+    char work[600]; mk_dir("tornwork", work, sizeof work);
+    char wsp[700], wwp[700]; snprintf(wsp,sizeof wsp,"%s/neuron.egm",work); snprintf(wwp,sizeof wwp,"%s/neuron.wal",work);
+
+    int crashes=0, dirty_check=0, non_prefix=0, full_recovered=0;
+    for (long t=0; t<=wlen; t++){
+        write_file(wsp, sb, slen);
+        write_file(wwp, wb, t);                  /* WAL truncated to t bytes */
+        EngramPagedStore* r = engram_open(work);
+        if (!r){ crashes++; continue; }
+        if (store_check(r, STORE_CHECK_CRC)!=0) dirty_check++;
+        /* recovered set must be a contiguous prefix n0..n{c-1} */
+        int c=0; while (c<TT_NODES){ char id[32]; snprintf(id,sizeof id,"n%d",c);
+            StoreNode n; int hit=store_get_node(r,id,&n); if(hit==1) store_node_free(&n); if(!hit) break; c++; }
+        for (int k=c;k<TT_NODES;k++){ char id[32]; snprintf(id,sizeof id,"n%d",k);
+            StoreNode n; int hit=store_get_node(r,id,&n); if(hit==1){ store_node_free(&n); non_prefix++; break; } }
+        if (c==TT_NODES) full_recovered++;
+        engram_close(r);
+    }
+    ok("recovery never crashed at any truncation offset", crashes==0);
+    ok("recovered store_check clean at every offset", dirty_check==0);
+    ok("recovered set always a contiguous prefix (last intact record)", non_prefix==0);
+    ok("full WAL length recovers all records", full_recovered>0);
+    printf("     WAL bytes fuzzed=%ld  full-recover offsets=%d\n", wlen, full_recovered);
+    free(sb); free(wb);
+}
+
+/* ═══════════════════════════ TEST 3 — checkpoint-crash ═══════════════════════ */
+#define CK_NODES 30
+#define CK_EDGES 20
+static int build_and_crash_at_phase(const char* dir, int phase){
+    EngramPagedStore* s = engram_open(dir);
+    if (!s) return -1;
+    for (int i=0;i<CK_NODES;i++){ StoreNode n; gen_node(i,(i%2)==0,&n); store_put_node(s,&n); store_node_free(&n); }
+    for (int i=0;i<CK_EDGES;i++){ char f[32],t[32]; snprintf(f,sizeof f,"n%d",i%CK_NODES); snprintf(t,sizeof t,"n%d",(i+1)%CK_NODES);
+        StoreEdge e; gen_edge(i,f,t,&e); store_put_edge(s,&e); store_edge_free(&e); }
+    store__checkpoint_crashat(s, phase);   /* crashes (frees s) after `phase` */
+    return 0;
+}
+static int verify_full(const char* dir){
+    EngramPagedStore* s = engram_open(dir);
+    if (!s) return -1;
+    int miss=0;
+    for (int i=0;i<CK_NODES;i++){ char id[32]; snprintf(id,sizeof id,"n%d",i);
+        StoreNode n; int r=store_get_node(s,id,&n); if(r!=1){ miss++; } else store_node_free(&n); }
+    for (int i=0;i<CK_EDGES;i++){ char id[32]; snprintf(id,sizeof id,"e%d",i);
+        StoreEdge e; int r=store_get_edge(s,id,&e); if(r!=1){ miss++; } else store_edge_free(&e); }
+    int chk = store_check(s, STORE_CHECK_CRC);
+    engram_close(s);
+    return (miss==0 && chk==0) ? 0 : 1;
+}
+static void test_checkpoint_crash(void){
+    printf("\n== checkpoint-crash: kill at each phase → converge, no loss past fsync ==\n");
+    for (int phase=0; phase<=4; phase++){
+        char nm[32], dir[600]; snprintf(nm,sizeof nm,"ckpt%d",phase); mk_dir(nm, dir, sizeof dir);
+        build_and_crash_at_phase(dir, phase);
+        int rc = verify_full(dir);
+        char msg[96]; snprintf(msg,sizeof msg,"phase %d (%s): full recover + crc clean", phase,
+            phase==0?"pre-flush":phase==1?"post-flush":phase==2?"post-fsync":phase==3?"post-SB":"post-WAL-reclaim");
+        ok(msg, rc==0);
+    }
+}
+
+/* ═══════════════════════════ TEST 4 — torn-page + WAL ═══════════════════════ */
+#define TP_NODES 45
+static void test_torn_page(void){
+    printf("\n== torn-page + WAL: corrupt a store page under WAL coverage → redo ==\n");
+    char dir[600]; mk_dir("tornpage", dir, sizeof dir);
+    EngramPagedStore* s = engram_open(dir);   /* fresh → auto checkpoint (C=0) */
+    for (int i=0;i<TP_NODES;i++){ StoreNode n; gen_node(i,0,&n); store_put_node(s,&n); store_node_free(&n); }
+    store__flush_pages(s);                     /* steal: post-checkpoint pages hit disk */
+    store__crash(s);
+
+    /* corrupt the highest-id NODE data page on disk (its records are post-checkpoint,
+     * so the WAL still covers them). */
+    char sp[700]; snprintf(sp,sizeof sp,"%s/neuron.egm",dir);
+    long slen; uint8_t* sb=read_file(sp,&slen);
+    long pages = slen/16384;
+    long victim = -1;
+    for (long p=2;p<pages;p++){ if (sb[p*16384+8]==1 /*STORE_PT_NODE*/) victim=p; }
+    ok("found a NODE page to corrupt", victim>=0);
+    if (victim>=0){
+        for (int k=0;k<64;k++) sb[victim*16384 + 200 + k] ^= 0xA5;   /* trash record area → bad crc */
+        write_file(sp, sb, slen);
+    }
+    free(sb);
+
+    EngramPagedStore* r = engram_open(dir);    /* heal torn page + replay WAL */
+    ok("reopened after page corruption", r!=NULL);
+    if (r){
+        int miss=0;
+        for (int i=0;i<TP_NODES;i++){ char id[32]; snprintf(id,sizeof id,"n%d",i);
+            StoreNode n; StoreNode ref; gen_node(i,0,&ref);
+            int hit=store_get_node(r,id,&n);
+            if (hit!=1 || !node_eq(&n,&ref)) miss++;
+            if (hit==1) store_node_free(&n); store_node_free(&ref);
+        }
+        ok("every record re-derived via WAL redo", miss==0);
+        engram_checkpoint(r);
+        ok("store_check clean after heal + checkpoint", store_check(r, STORE_CHECK_CRC)==0);
+        engram_close(r);
+    }
+}
+
+/* ═══════════════════════════ TEST 5 — legacy import parity ═══════════════════ */
+#define LG_NODES 8
+#define LG_EDGES 6
+static void test_legacy_import(void){
+    printf("\n== legacy import parity: snapshot.json → import once → bit-exact ==\n");
+    char dir[600]; mk_dir("legacy", dir, sizeof dir);
+    char snap[700]; snprintf(snap,sizeof snap,"%s/snapshot.json",dir);
+
+    /* build oracle nodes/edges, emit them as a legacy-format snapshot.json */
+    StoreNode onodes[LG_NODES]; StoreEdge oedges[LG_EDGES];
+    FILE* f = fopen(snap,"wb");
+    fprintf(f, "{\"nodes\":[");
+    for (int i=0;i<LG_NODES;i++){
+        gen_node(i, 1, &onodes[i]);
+        StoreNode* n=&onodes[i];
+        /* finite emb values so JSON text round-trips bit-exact (random bit patterns
+         * would be NaN/inf, which %g/strtof cannot preserve). %.9g round-trips a
+         * float32 exactly; %.17g round-trips a double exactly. */
+        { uint64_t es = 0x5151ULL ^ ((uint64_t)(i+1)*0x2545F4914F6CDD1DULL);
+          for (int k=0;k<n->emb_dim;k++) n->emb[k] = (float)((double)(xs(&es)%2000001)/1000000.0 - 1.0); }
+        fprintf(f, "%s{\"id\":\"%s\",\"content\":\"%s\",\"node_type\":\"%s\",\"tier\":\"%s\","
+                   "\"salience\":%.17g,\"importance\":%.17g,\"confidence\":%.17g,"
+                   "\"activation_count\":%lld,\"created_at\":%lld,\"updated_at\":%lld,"
+                   "\"layer_id\":%u,\"wm_anchor\":%.17g,\"emb\":\"",
+                i?",":"", n->id, n->content, n->node_type, n->tier,
+                n->salience, n->importance, n->confidence,
+                (long long)n->activation_count, (long long)n->created_at, (long long)n->updated_at,
+                n->layer_id, n->wm_anchor);
+        for (int k=0;k<n->emb_dim;k++) fprintf(f, "%s%.9g", k?",":"", (double)n->emb[k]);  /* exact float32 repr */
+        fprintf(f, "\"}");
+    }
+    fprintf(f, "],\"edges\":[");
+    for (int i=0;i<LG_EDGES;i++){
+        char from[32],to[32]; snprintf(from,sizeof from,"n%d",i%LG_NODES); snprintf(to,sizeof to,"n%d",(i+2)%LG_NODES);
+        gen_edge(i, from, to, &oedges[i]); oedges[i].hebb = 0.100000 + i*0.010000;  /* clean decimals */
+        StoreEdge* e=&oedges[i];
+        fprintf(f, "%s{\"id\":\"%s\",\"from_id\":\"%s\",\"to_id\":\"%s\",\"relation\":\"%s\","
+                   "\"weight\":%.17g,\"hebb\":%.17g,\"confidence\":%.17g,\"created_at\":%lld,"
+                   "\"last_fired\":%lld,\"inhibitory\":0,\"layer_id\":%u}",
+                i?",":"", e->id, e->from_id, e->to_id, e->relation,
+                e->weight, e->hebb, e->confidence, (long long)e->created_at, (long long)e->last_fired, e->layer_id);
+    }
+    fprintf(f, "],\"layers\":[");
+    fprintf(f, "{\"layer_id\":0,\"name\":\"SAFETY\",\"activation_priority\":9,\"suppressible\":0,\"transparent\":0,\"injectable\":0},");
+    fprintf(f, "{\"layer_id\":1,\"name\":\"CORE_IDENTITY\",\"activation_priority\":8,\"suppressible\":0,\"transparent\":1,\"injectable\":1}");
+    fprintf(f, "]}");
+    fclose(f);
+
+    EngramPagedStore* s = engram_open(dir);    /* store absent + snapshot present → import */
+    ok("engram_open imported the snapshot", s!=NULL);
+    char sp[700]; snprintf(sp,sizeof sp,"%s/neuron.egm",dir); struct stat st;
+    ok("neuron.egm created by import", stat(sp,&st)==0);
+    if (!s) return;
+
+    int nmiss=0, embmiss=0;
+    for (int i=0;i<LG_NODES;i++){ char id[32]; snprintf(id,sizeof id,"n%d",i);
+        StoreNode got; int hit=store_get_node(s,id,&got);
+        if (hit!=1 || !node_eq(&got,&onodes[i])) nmiss++;
+        if (hit==1){ if (got.emb_dim!=onodes[i].emb_dim || (got.emb_dim>0 && memcmp(got.emb,onodes[i].emb,sizeof(float)*got.emb_dim)!=0)) embmiss++; store_node_free(&got); }
+    }
+    int emiss=0, hebbmiss=0;
+    for (int i=0;i<LG_EDGES;i++){ char id[32]; snprintf(id,sizeof id,"e%d",i);
+        StoreEdge got; int hit=store_get_edge(s,id,&got);
+        if (hit!=1 || !edge_eq(&got,&oedges[i])) emiss++;
+        if (hit==1){ if (got.hebb!=oedges[i].hebb) hebbmiss++; store_edge_free(&got); }
+    }
+    StoreLayer *ll; size_t nll; store_list_layers(s,&ll,&nll);
+    ok("all nodes imported & readback matches JSON", nmiss==0);
+    ok("emb bit-exact through import", embmiss==0);
+    ok("all edges imported & readback matches JSON", emiss==0);
+    ok("hebb exact through import", hebbmiss==0);
+    ok("layers imported (2)", nll==2);
+    store_layers_free(ll,nll);
+    engram_close(s);
+
+    /* JSON must NEVER be read as the store again: mutate snapshot.json, reopen,
+     * and confirm the store is unaffected (still the imported data). */
+    FILE* g=fopen(snap,"wb"); fprintf(g, "{\"nodes\":[{\"id\":\"BOGUS\",\"content\":\"x\"}],\"edges\":[],\"layers\":[]}"); fclose(g);
+    EngramPagedStore* s2 = engram_open(dir);
+    StoreNode bogus; int bhit = store_get_node(s2,"BOGUS",&bogus); if (bhit==1) store_node_free(&bogus);
+    StoreNode n0; int n0hit = store_get_node(s2,"n0",&n0); if (n0hit==1) store_node_free(&n0);
+    ok("reopen does NOT re-import mutated JSON (BOGUS absent)", bhit==0);
+    ok("store remains authoritative (n0 still present)", n0hit==1);
+    for (int i=0;i<LG_NODES;i++) store_node_free(&onodes[i]);
+    for (int i=0;i<LG_EDGES;i++) store_edge_free(&oedges[i]);
+    engram_close(s2);
+}
+
+/* ═══════════════════════════ TEST 6 — hebb survives crash ═══════════════════ */
+static void test_hebb_survives(void){
+    printf("\n== hebb survives crash: WAL hebb write, crash before checkpoint ==\n");
+    char dir[600]; mk_dir("hebb", dir, sizeof dir);
+    EngramPagedStore* s = engram_open(dir);
+    StoreEdge e; gen_edge(0,"n0","n1",&e); e.hebb=0.0; store_put_edge(s,&e); store_edge_free(&e);
+    engram_checkpoint(s);                         /* edge durable with hebb 0 */
+    /* now learn: bump hebb via a WAL HEBB_BATCH, crash BEFORE the next checkpoint */
+    StoreHebbDelta d = { "e0", 0.777000, 1700000000000LL };
+    store_hebb_batch(s, &d, 1);
+    store__crash(s);
+
+    EngramPagedStore* r = engram_open(dir);       /* recover from WAL */
+    ok("reopened after crash", r!=NULL);
+    if (r){
+        StoreEdge got; int hit=store_get_edge(r,"e0",&got);
+        ok("edge present after crash", hit==1);
+        ok("learned hebb (0.777) survived the crash", hit==1 && got.hebb==0.777000);
+        ok("exactly one live e0 (hebb update superseded old)", 1);
+        if (hit==1){ printf("     recovered hebb = %.6f\n", got.hebb); store_edge_free(&got); }
+        engram_close(r);
+    }
+    /* also: hebb written via store_put_edge, crash before any checkpoint */
+    char dir2[600]; mk_dir("hebb2", dir2, sizeof dir2);
+    EngramPagedStore* s2 = engram_open(dir2);
+    StoreEdge e2; gen_edge(5,"nA","nB",&e2); e2.hebb=0.314159; store_put_edge(s2,&e2); store_edge_free(&e2);
+    store__crash(s2);
+    EngramPagedStore* r2 = engram_open(dir2);
+    StoreEdge g2; int h2 = store_get_edge(r2,"e5",&g2);
+    ok("edge+hebb from a pre-checkpoint put recovered", h2==1 && g2.hebb==0.314159);
+    if (h2==1) store_edge_free(&g2);
+    engram_close(r2);
+}
+
+int main(void){
+    mk_base();
+    printf("engram M2 gate — WAL + checkpoint + recovery + legacy import\n");
+    printf("throwaway dir: %s\n", g_base);
+    test_replay_parity();
+    test_torn_tail();
+    test_checkpoint_crash();
+    test_torn_page();
+    test_legacy_import();
+    test_hebb_survives();
+    printf("\n================  %d passed, %d failed  ================\n", g_pass, g_fail);
+    return g_fail ? 1 : 0;
+}