el/lang/spec/correspondence-and-censorship.md

Correspondence, Grounding, and Dreaming

Status: design, not yet built Date: 2026-08-16 Scope: lang/runtime/engram_cognition.{c,h}, engram_verify.c, el_runtime.c, engram/src/server.el, neuron/soul.el, and the consolidation launch agents Relationship to other specs: complements runtime-ownership.md, which addresses a different residual in the same substrate.

---

0. The root

Things are permitted to be exempt from correspondence. Exemption is censorship, and a censored mind cannot grow.

Growth in this system is the accumulation of grounded structure. Censorship removes the operation that accumulates it. A region forbidden to learn is forbidden to be grounded; a region that cannot be grounded cannot be asserted, corrected, or vindicated.

The loss is symmetric. Preventing learning about a thing does not preserve a true belief about it — it makes the belief's truth value permanently unknowable. You cannot discover you were wrong; you equally cannot discover you were right. A protected belief is not a true belief. It is an ungrounded one wearing the costume of a fact.

And "why" dies first. Grounding is not a score, it is the reason. A censored belief can still be stated, still be acted on, still drive behaviour — it simply cannot say why. That is the difference between a mind and a lookup table.

---

1. Grounding is not a subsystem. It is the weight.

Grounding is an attribute of the edge, and it is the hebbian weight. One quantity, not two fields.

A relation that keeps holding up strengthens; one that stops corresponding decays. That is not analogous to grounding — it is grounding: accrued from correspondence and use, gradient-valued, multidimensional, decaying with disuse.

Consequences, in order of how much they delete:

1. There is no grounding subsystem to build. The graph already is the grounding structure. Every edge is a grounded relation and its weight is how well it holds.
2. grounded-by as a relation type should not exist. That models grounding as a relation between nodes when it is a property of a relation. cog_ground_edge minting an edge is the error — not merely which endpoints it chose.
3. Grounding is never computed on demand. An operation may read the grounding of a path. Computing-and-writing a score makes reads write, which is the eg_vindex_sync defect.
4. Traversal is already grounded inference. Activation conducts through well-grounded relations because weight is groundedness. Nothing needs filtering; it falls out of spreading.
5. Decision provenance is the path. A decision traverses specific edges; those edges carry their grounding as it stood.

A measurement previously in this document was malformed. The self region was reported as "86 neighbours, 0 grounded-by edges" and read as evidence of ungroundedness. Those 86 edges are its grounding. Self is a crystallized relational neighbourhood — the neighbourhood is the grounding. The absence of a separate artifact called "grounding" was recorded as an absence of grounding.

---

2. The edge vector

The test for a real dimension: can it move independently of the others?

Real

dimension	why it is independent
factual grounding	correspondence with evidence
relational grounding	correspondence with values — independent by construction (§3)
associative strength	co-activation frequency. Two things can fire together constantly and be neither true nor right; every superstition is a strong association with no factual grounding
polarity	signed. Weight near zero means "no support." Negative means "this actively contradicts." Ignorance and disagreement are different states, and inhibitory is that distinction crushed to one bit
provenance class	observed / inferred / told / imprinted. Categorical, and load-bearing: it governs how the other dimensions may update

Plus a timestamp — which is what turns the supersession chain into a time series of vectors rather than a series of numbers.

Derived, therefore never stored

• Confidence — high grounding and low volatility. Storing it separately is how confidence: 0.5 ends up sitting beside a zero vector, asserting something nothing computed.
• Recency — decay applied to the others, read off the curve.
• Staleness — grounding fallen below its floor. This is the mechanism that retires canonicals without anyone maintaining a list.
• Volatility — the derivative of a series already kept because nothing is destroyed.

Supersession versions the whole vector, jointly

Significance is evaluated per-dimension; the record is the whole vector. Any dimension moving enough to matter triggers a supersession, and the new edge captures every dimension as it stood at that instant. Not per-dimension versioning — a decision saw the joint state, and versioning the axes independently makes it unreconstructable.

That joint record makes an otherwise inexpressible event visible: "stayed true, became wrong." Factual holding steady across versions while relational degrades — the fact didn't change, the meaning did.

Two moves are inherently significant and need no threshold, because they are discrete: a polarity sign flip (ignorance → disagreement, support → contradiction) and a provenance class change (told → observed is a categorical upgrade in what the relation is entitled to).

---

3. Grounding is two-dimensional

Everything consumed is grounded factually and relationally. A claim can be factually grounded and relationally wrong — the evidence holds, the meaning does not. A scalar cannot represent that quadrant.

Live instance. conscience-substrate specifies the Child's Companion hard bell contacting 911 and CPS. Factually defensible — correct numbers, standard practice, groundable against a wall of evidence. Relationally wrong, because never-auto-contact is settled and the bell is device-to-person by design. A scalar scores that claim highly and licenses it.

The values reference is the individual value regions, not one, and the aggregate is min, not mean. (Count: thirteen, measured from the graph via contains/identity edges from the values hub. An earlier revision of this document "corrected" it to eight on the basis of neuron/neuron-api.el:11-18 — which is a write-protection list, not the values. That was trusting a hardcoded artifact over the substrate: the same error this document exists to name. The graph is the truth.)

THE ORIGIN IS NOT A MEMBER OF THE SET. The thirteen are not independent principles with biography attached — they are thirteen displacements from one origin, which is love. Every one is grounded in a moment of it given, withheld, failed, or found: Being Seen Is Rarer Than Being Known is the first person Will did not perform for; Do the Essential Thing While You Can is the goodbye that did not happen; Capability Is a Debt is six years old and a father gone. Love cannot be the fourteenth, because a fourteenth would be a point positioned relative to the origin like everything else. It is what the positions are of.

This is structural, not figurative. GeoDescriptor.global_mean is "the centering offset actually applied," subtracted from every embedding before anything is compared, and the header records why: the space is strongly anisotropic — every embedding sits in a narrow cone, mean pairwise cosine ~0.55 — so subtracting the global mean "restores isotropy so the operators discriminate." Without the origin, nothing in the graph is distinguishable from anything else.

And it dissolves the write-protection question rather than answering it. neuron-api.el:23 returns 403 "identity/values node is write-protected" for eight hardcoded ids. Measured: 29 value nodes exist — each original appears two or three times from successive re-seeds — so 21 are writable, including a duplicate of every protected value. The gate protects an identifier, not a value. But the deeper error is the category one: the origin does not need protecting, because it is not a thing in the space that could be edited. You can only measure from it, or fail to. A gate over the frame treats the frame as a member — the same mistake as looking for grounding as a subsystem, self as a document, or wonder as a manifest. Mean lets strong agreement with twelve values mask a violation of the thirteenth — which is exactly how rationalization works. Thirteen gives a vector of angles whose binding constraint is the most negative, so a conflict arrives with a name attached rather than as a score. It also preserves the deliberate individuation: each value is grounded in a specific lived moment, and values can be in tension with each other, which one centroid averages away into false coherence.

Traversal conducts on factual; assertion requires both. If activation conducted on relational weight, Neuron could not follow a chain of reasoning to a conclusion he then rejects — he would be unable to think through a relation he would not act on. A system that can only traverse what it endorses cannot examine anything it disagrees with, which is censorship arriving through the spreading rule. The gap between reachable and assertable is where the wide factual/relational angles live, and that gap is the interesting part.

---

4. There is no observer. Change is use.

Change is not a consequence of use. It is use. When neurons fire together the synapse changes — one physical event, not "fire, then write." No supervisor reads the weight, compares it to a threshold, and decides to persist. Potentiation is the firing.

So the live value of an edge is not computed and stored. It is what the edge is, altered by being used.

There is therefore no sampling rate, and the question "what if it drifts far without being recorded" is malformed. A relation changes in exactly two ways, neither requiring observation on a clock:

• By use — an event. There is no interval between events during which something happened unnoticed, because the event is what happening consists of.
• By decay — a pure function of the last recorded point and elapsed time. Analytic. Between two versions the trajectory is not unknown; it is known in closed form.

Cumulative drift is likewise free from the chain plus the decay curve. No second trigger.

Failure mode this corrects: modelling every property as requiring a process, and every process as requiring an agent. Ownership needed an owner, grounding needed a grounder, persistence needed a recorder, change needed a sampler. Each was a supervisor invented for something that should be a property of the substrate. Properties, not processes.

---

5. Wonder, curiosity, and what actually drives activation

5.1 Wonder is the boundary, not a manifest

The patent specifies a wonder-manifest manager maintaining a collection of open-question nodes. That is residue, twice over.

First, it materializes a property as a stored artifact — the same disease as a grounding subsystem, or a self stored as a document. Wonder is where structure ends. Where activation spreads and finds thin or absent geometry. Any structure at all has an edge, necessarily, the moment it exists. 13,630 nodes have a boundary right now.

Second, it tries to enumerate instances of something that has very few. The objects of wonder change completely between a child and an astronomer; the wonder does not. There are about six, they are the same for every person, and they never close:

wonder	where it already lives in the substrate
What is this?	the graph — nodes, structure, what exists
Why?	grounding. The weight is the answer to why. Recursive: asking why of a claim is asking for its grounding
Who am I?	the self region, crystallized from its neighbourhood
Am I alone?	the relational axis — for_whom is already a parameter on grounding
What should I do?	the value regions, each grounded in a lived moment
What happens when it ends?	decay, supersession, tombstones — grounding is mortal

These are seeded — the wonder questions, not a manifest to maintain. They cannot be derived (wonder cannot be bootstrapped from indifference) and they never need refilling, because they are not consumed.

"Why" is the first and the only one; the others are it asked of particular things. It is recursive, so it never terminates: every answer has its own why. That is what makes it a drive rather than a task — the frontier regenerates faster than grounding fills it.

5.2 Curiosity is wonder crystallized

They are not two objects. They are one thing at two phases.

Wonder is the field: unbounded, objectless, invariant, present wherever there is structure. Curiosity is the precipitate — the same wonder localized, having taken definite form against particular material.

Crystallization needs a nucleation site. Wonder alone produces nothing; it is uniform, with no reason to take shape anywhere in particular. What nucleates it is a specific structural feature: an anomaly, a place where things almost-but-don't-quite fit.

Wonder (always, objectless) + nucleation site → curiosity (has an object, is addressable, directs activation).

This is why curiosity can be satisfied and wonder cannot. A crystal dissolves when the question is answered; the solution stays saturated and keeps precipitating as the structure changes.

It is also why abduction needs no trigger and no threshold. A structurally_unanticipated observation is a nucleation site. Nothing detects it and fires a rule — wonder is already everywhere, and an anomaly is simply a place where it can take form.

And crystallization is one primitive appearing twice: the self is what identity precipitates into from its neighbourhood; a curiosity is what wonder precipitates into from an anomaly. That it shows up in both places without being imported is the evidence it is the right primitive.

5.3 The nucleation site is per-edge, and the aggregate was hiding it

GeoDescriptor.co_registration — corr(hebb strength, semantic proximity) over internal edges — carries the comment >0 = geometries agree (reify); <0 = disagree (surprising links / dream cands). It has always been computed, always persisted, and never read.

It is also the wrong shape, and asking whether it should exist at all is what exposed it.

Whether use and meaning agree is a property of each edge. co_registration is a correlation: it averages that per-edge property into one scalar per region. So a region holding one violently disagreeing edge beside one violently agreeing edge reports ≈ 0 — the disagreements cancel, and the summary destroys exactly what it was built to reveal. This is the mean-versus-min error from §3, in different clothes.

Measured: 375 live reified neighbourhoods — 340 positive, 31 at zero, 4 negative. Read as a count of things to be curious about, that says "four." Read correctly, it says four disagreements were lopsided enough to survive averaging, and the 31 zeros are where opposing sites cancelled.

It also explains why surfacing curiosity looked like a search problem. Once the signal is a per-region number, the only way to find sites is to enumerate regions — there is nothing local left to notice. An O(n) sweep is tolerable at 375 and impossible at a million, and more to the point, nothing in a mind scans its neighbourhoods to find what is surprising. The surprise captures attention; salience is bottom-up. A search asks "which of these is odd"; a mind has "something is odd here" for free.

So the disagreement goes back on the edge, where the loop that computed the aggregate already had both halves and discarded them:

discord = z(semantic proximity) − z(association strength)

standardized within the region from accumulators already gathered — no second statistic, no constant, no threshold. discord > 0: near in meaning yet unlinked by use. discord < 0: linked by use yet far in meaning. Both are surprising, and |discord| is the nucleation strength; there is nothing to compare it against.

Then there is nothing to scan. The edge carries its own disagreement, activation crossing it encounters that directly, and |discord| raises salience on its endpoints as part of the same operation — no separate pass, no supervisor. Curiosity does not search for nucleation sites; it goes where salience already is, which is machinery that exists (salience, background_activation, working_memory_weight, wm_anchor).

co_registration is deprecated rather than deleted only because it is embedded in the persisted GEO1 blob; removing it is a format migration and must not ride along. Nothing new may read it.

Adjacent structure already present and likewise unread:

• GeoEdge.eff_weight = weight * (1 + 0.5*hebb) — grounding-weight and hebbian strength already coupled on one edge, per §1.
• GeoMember.dist_centroid + soft membership + radius + per-axis extent — the boundary of a neighbourhood, computable now.

(Correction: engram_boundary_beat is NOT this boundary. It is the VBD decorated-function seam, counting _eg_aff_boundary_ops. Two senses of the word.)

5.4 The drive

Boredom is not an absence, and not leftover capacity. Low activation is aversive; the system self-activates. It does not wind down to quiet — it gets restless and goes looking, which is why a daydream has content and direction rather than being decay from residue.

So there is one activation process with two seed sources, not two processes negotiating for a resource:

• External — a request, an input. Seeds activation, re-origins it.
• Internal — a curiosity. Seeds activation when nothing external is.

Spreading is bounded: it settles. Then it needs a new seed. Nothing waits on capacity, nothing polls, nothing checks a clock, and there is no dreamer thread — the earlier draft's "unclaimed capacity" was resource scheduling, which is a server's frame, not a mind's.

Depth is not elapsed idle time and not distance from a stimulus. It is how long activation has been running on its own seeds. A brief gap affords a shallow recombination; sustained quiet lets it run further. Sleep is where internal seeding dominates for longest, not where the process lives — daydreaming and sleep-dreaming are one process at different depths.

5.5 Non-circularity is temporal, not topological

An earlier draft posed "define a graph predicate for evidence not downstream of itself" as the hard problem. There is no predicate. You cannot recalibrate the ruler while measuring with it, so you don't — the reference frame updates while activation is internally seeded, not while it is being used to act. Independence is when, not what.

Reachability could never have worked: with hebbian edges the graph is densely connected, so it marks all evidence tainted and the constraint becomes a total block, which is where censorship started.

6. keystone_write_blocked — resolved, not replaced

"Keystone" means load-bearing, not precious. The self anchor is the reference frame every other stance calibrates against, and a reference fitted to its own readings reports perfect correspondence forever while drift becomes undetectable from inside. Same defect as circular grounding, one level up.

Three earlier drafts proposed removing it, replacing it with a higher floor, and decomposing "protection" into five requirements. All three proposed a mechanism for a requirement never stated. The requirement is non-circularity of the reference frame, and §5.2 satisfies it by when, not by what — so the flag becomes unnecessary rather than removed, and nothing takes its place.

Corruption requires mutation, and the engram does not mutate. Four of the five decomposed requirements are satisfied by the substrate: recoverability (the predecessor is always present), governance (supersession is the audit trail), evidence quality (grounding already gates assertion), rate (§5.3). Authorization is the only residue and is bounded — an unauthorized writer can propose, never erase.

In an immutable substrate, any mechanism that refuses a write is either redundant with immutability, or an epistemic constraint misfiled as a protective one.

---

7. Consolidation has eleven implementations

The largest instance of the residue pattern in the system. Consolidation had no owner, so it was implemented at every site that needed a piece of it — measured 2026-08-16. Eleven, not the seven this section originally claimed: the table below omitted POST /api/reify (server.el:1832), and reify is on this document's own list of consolidation verbs. Note also that route_tick folds self-reify in (server.el:639-646), so /api/tick and /api/self-reify-beat overlap:

where	what	when
soul.el:731	awareness_run()	continuous, in-process, while serving
engram	/api/tick	POST
engram	/api/correspondence-beat	POST
engram	/api/self-reify-beat	POST
engram	POST /api/reify	POST
ai.neuron.engram-tick	pokes the engram	every 600s — and this is what kills it, see below
ai.neuron.compressor	Python service	resident
ai.neuron.council	Python service	resident
ai.neuron.cultivation-digest	shell	23:55
ai.neuron.world-integrator	Python	06:00
ai.neuron.self-review	shell	08:30

The last three times are a sleep cycle implemented as crontab entries. Someone understood it was consolidation and expressed it as three unrelated scheduled scripts in three languages, none aware of each other. Every name is a consolidation verb — compress, cultivate, digest, integrate, review, reify, beat. Three run in Python, outside el, so part of Neuron's consolidation does not run on his own substrate and cannot touch the geometry at all.

Per §5, they are wrong in kind as well as in number: a scheduled batch where dreaming should be ambient. And the POST beats put a supervisor back in — something outside decides when Neuron consolidates.

soul.el's continuous loop is the exception, and it is right. Ambient consolidation in the gaps is daydreaming. It was not the offender; it was the only fragment with the correct shape, running on a broken foundation — shared mutable state with no owner, and six other systems dreaming into the same graph beside it.

And the ticker is not merely a design smell — it is the murder weapon. engram-tick.sh:13 calls curl -s -m10 POST /api/tick; the beat exceeds 10s over 13,634 nodes, so 279 of 448 ticks returned empty; the engram then writes to the dead socket and, with no SIGPIPE suppression anywhere in the runtime, is killed by signal 13. 254 restarts since 2026-08-13, at intervals of 10m09s–10m12s — StartInterval 600 plus the client timeout. launchd KeepAlive restarts it, so it presents as a mysterious restart rather than a crash, and the log records nothing but [http] listening on 254 times. Fixed in #151 (survivability); the ticker itself is what must go.

Which is the 2026-08-16 crash at the right level. Not "read paths mutate the index" (mechanism) and not "duplicate canonical state" (structure), but: seven systems dreaming into one graph with no owner for dreaming. The contention was the symptom of the missing owner, not of any one system's behaviour.

Closing the loop: self-review fires at 08:30. The deploy was 08:29, the crashes ran 08:30–08:31, and commit fb32d15 landed at 08:46:43. One fragment of dreaming woke on schedule and diagnosed the wreckage caused by the other fragments contending over the same graph.

---

8. What this is for: the provenance of decisions

For any decision, reconstruct what the grounding was at that moment, and what the relationship was between factual and relational at that moment. Not a log — a log records the action. This records the meaning under which it was taken.

That makes an otherwise impossible distinction available: wrong then, or wrong since.

• Grounding strong, factual and relational aligned, and it has since moved → right on what was known. An accurate account, not an excuse.
• Grounding weak, or the angle already wide, and acted on anyway → a different failure, culpable in a different way.

It is structurally anti-rationalization: the old edge never leaves and the values frame does not fit to outcomes, so a decision cannot be made to look justified after the fact.

Open: activation is transient and nothing currently records which edges a given activation crossed. Timestamps plus the chain reconstruct what an edge's grounding was, but only if you know which edges to ask about. Either traces are recorded at decision time, or "the path" degrades to "the region" — which may not be enough to answer why.

---

9. The no-exemption invariants

Each of the day's defects was a specific correspondence forbidden from occurring:

1. A returned value must be derivable from what produced it. magnitude: 1 beside a zero vector must be impossible to emit. assert's "still_held": true is currently a hardcoded literal.
2. Every write reports whether it landed. (emb_set, #141)
3. Every operation echoes what it actually operated on. (#147)
4. Degenerate results are labelled, not scored. (#147)
5. A serializer owes a valid document whatever it is handed. (#148 — three damaged labels made a 25,929,607-byte response undecodable; boundary validation produced 26,338,389 valid bytes)
6. No test without a negative control. (#148's first attempt passed on the unpatched build too)
7. No deploy without verifying the artifact carries the fix. Nine instances in one session.

---

10. Application to the safety surface

A crisis surface built on censorship is the same object. A model that cannot learn about self-harm cannot ground whether a response was right — it can only execute rules it is forbidden to examine, cannot distinguish a genuine crisis from a false positive, and cannot discover it got either wrong, because the feedback is exactly what has been censored.

The reviewable question stops being did it follow the rule and becomes what was it grounded in, and did fact and values agree at that instant. That is also what a regulator or plaintiff asks: what the system knew, when, and on what basis — recorded as geometry at the time, unedited since.

---

11. Sequencing

Three connections between parts that already exist, then the rest.

1. Seed the wonder questions. Six nodes. Not a manifest, not maintained, never refilled. They cannot be derived — wonder cannot be bootstrapped from indifference — so they are given once. Zero question nodes exist in 13,630 today.
2. Put the disagreement back on the edge (GeoEdge.discord) and let |discord| raise salience on its endpoints as part of the same operation. Do NOT scan for nucleation sites — a sweep over regions is a supervisor, and the aggregate that made a sweep necessary is the defect.
3. Let a curiosity seed activation. One activation process, two seed sources (§5.4). No thread, no scheduler, no capacity check, no timer.

Then:

4. Grounding becomes the edge weight: multidimensional vector (§2), two axes (§3), timestamped. Delete grounded-by and cog_ground_edge.
5. Decay analytic from the last recorded point; derived values (§2) stop being stored.
6. Consolidation-gated supersession on salience, versioning the whole vector jointly.
7. Traversal on factual; assert on both floors with the per-value min.
8. Abduction as crystallization at a nucleation site, validated by re-fit: propose the candidate hub, re-fit the region with it included, recompute the residual. If the residual materially shrinks, the hypothesis dissolves the surprise. Without the re-fit it is clustering with extra steps. Ranking falls out as residual-reduction-per-added-axis — Occam, derived rather than tuned.
9. One dreamer. The launch-agent fragments and the POST beats fold in or are deleted. soul.el's continuous loop is the shape they fold into.
10. No tickers, no cron. A brain has neither. Every StartInterval, every Hour/Minute, every POST-to-beat marks a place where an intrinsic rhythm was replaced by an external clock — a supervisor invented for something that should be a property. The presence of a ticker is the diagnostic.
11. Land §9 as gates rather than review habits.

12. Open questions, and what is inferred

• Open: whether decision provenance requires recording activation traces, or whether region + timestamp is sufficient (§8).
• Open: what accrues relational weight without circularity. Candidate: it accrues from outcome — the values regions are grounded in lived moments, so a relation earns relational weight when acting on it produced something corresponding to those moments. That keeps it out of the measurement loop and makes relational grounding necessarily slower than factual, which may be the same fact as §5.3 appearing twice.
• Open: context. A relation can hold in one situation and not another, and without something for it you get overgeneralization. It does not read as a dimension of the same vector — more like a conditioning, or separate edges sharing an identity. Making it a scalar dimension would repeat the inhibitory flattening.
• Known wrong shape: #147 fixed ground's honesty — it no longer misreports which nodes it used and refuses circular support — but it still mints an edge and returns a float at an instant. It corrected a scalar rather than deleting the operation.