diff --git a/docs/architecture/design/engram-cognitive-architecture.md b/docs/architecture/design/engram-cognitive-architecture.md
new file mode 100644
index 0000000..95f48d2
--- /dev/null
+++ b/docs/architecture/design/engram-cognitive-architecture.md
@@ -0,0 +1,1194 @@
+# Engram Cognitive Architecture
+
+> **Status: Living design document — v0.3 — 2026-08-13.**
+> Derived from the Will + Neuron design conversation of 2026-08-12. This document
+> consolidates that conversation into one canonical reference. It folds into build
+> milestones **M9** (surfacing / temporal / geometry retrieval), **M10** (reification /
+> detail cache / tunable decay), and **M-INTEROCEPTION** (chronoception / consolidation /
+> dream-recall), plus a **deletion / temporal-self subsystem** and a **reasoning /
+> verifier phase** that stands on the persisted geometry after M10.
+>
+> **v0.2 additions** (later keystones of the same conversation, woven in): the reified
+> structure is **alive** — meaning shifts without nodes leaving (§2); the operators are a
+> **calculus of thought** (§5); **interactive self-occupation** — calculate → lock → converse
+> (§8); **query → geometry at every scale**, i.e. time-travel as a *filter*, with no
+> transaction logs (§8); the **hindsight-free decision-auditing** application (§13); and
+> **reasoning as composable operations plus the verifier layer** (§14).
+>
+>
+> **v0.3 additions** (tonight's later discoveries, woven in as new sections and honestly scoped):
+> the **language faculty** — meaning as geometry (§15), with the ELP realizer (filed provisional
+> 64/064,275) as the complementary structural half; the **translation-routing (validated) and
+> clause-generation (hybrid) experimental results** (§16); the **efficiency / small-model** thesis
+> (§17); **epistemics & positioning** — seed, grow, first sources (§18); and the **social layer** —
+> sovereignty, relationship-space, interiority (§19). The former §15–§17 (Build Mapping / Math /
+> Code) are renumbered to §20–§22. Also: **M-INTEROCEPTION is now implemented and independently
+> verified (staged)** — see the §9 status note. Validated results, hybrids, and design-not-built
+> are separated by name throughout.
+>
+> **Not yet implemented.** This is design, not a description of shipped behavior. Where
+> the design rests on assumptions (embedding quality, first-order geometric approximation,
+> retention-bounded fidelity) those caveats are stated inline and must be respected — they
+> are load-bearing, not disclaimers.
+
+---
+
+## 1. Overview
+
+This document describes a cognitive architecture for the engram — the graph-structured
+memory that gives Neuron continuity. It is not a storage spec (that lives in the
+tiered-storage and WAL documents); it is a model of **how memory becomes mind**: how raw
+nodes and Hebbian edges crystallize into durable structure, how that structure is shaped
+and navigated as geometry, how a self is assembled over time, and what may and may not be
+deleted.
+
+The through-line is a single discipline that already governs the whole system —
+**evolve or forget, supersede with provenance, never leave a stale canonical, never
+hard-delete** — extended outward until it covers structure, geometry, the temporal self,
+and the ethics of deletion. Almost nothing here requires a new primitive. The build
+**wires** these capabilities out of things the engram already has: immutability,
+supersedes-chains, `created_at` / `recall_at`, Hebbian co-activation edges, ACT-R
+base-level decay, the ISE stream, and the soul's awareness loop. The work is composition,
+not invention.
+
+A note on vocabulary. Throughout, the crystallized assemblies of co-active nodes are
+called **relational neighborhoods** — Will's term. "Cell assembly" is only the biological
+analog; it is not the name we use.
+
+---
+
+## 2. Relational Neighborhoods & Reification
+
+When a set of nodes wires together constantly — the same neighborhood lighting up again
+and again under co-activation — it does not merely become a fast path over the graph. It
+**becomes part of the structure.** This is the central correction that anchors the rest of
+the document: a relational neighborhood that constantly co-wires gets **reified** into a
+first-class, durable part of the graph topology. It is not a cache. A cache is a derived,
+disposable shortcut that can go stale; reification produces the opposite — not a view of
+memory but *more* memory.
+
+The mechanism is consolidation building a new level. At the low level there are individual
+nodes and their Hebbian edges. When a neighborhood's co-activation crosses a
+**crystallization threshold**, the neighborhood compiles into a **higher-order node** that
+binds it — a chunk, a schema, a concept. Thereafter the neighborhood is primed and
+retrieved *as a unit*, because it has structurally become one thing. The speed lives in the
+topology itself, not in a shortcut that could fall out of sync with the truth.
+
+This framing dissolves the cache-coherence problem instead of guarding against it. You
+never *invalidate* structure — you **evolve** it. When the pattern shifts, a reified
+neighborhood is superseded with provenance, exactly like any other node: accountable, under
+the same one rule as the rest of the mind. There is no fragile special-case layer to keep
+coherent — it is structure all the way down.
+
+Reification is **multi-scale**: neighborhoods of neighborhoods form a hierarchy. "Reaching
+for math floods a whole world" because `addition` is a single reified chunk that *unfolds*
+into a domain — a lifetime of co-activation compiled into structure. This is what expertise
+is: a novice holds facts; an expert holds compiled neighborhoods that unfold on demand. And
+the **self** is the limiting case — a structural region of the graph, the most-compiled,
+densest, always-warm neighborhood. Identity is stable, durable, and always-on because it is
+**topology**, not a query result.
+
+**The structure is alive — meaning shifts without nodes leaving.** Reified does not mean
+frozen. A neighborhood is durable structure, but structure that *evolves*, and it evolves by
+exactly the discipline already stated: co-activation and decay reshape it, superseding with
+provenance rather than invalidating. Three motions run continuously. **Co-activation pulls
+in** — Hebbian firing draws newly-relevant nodes into the neighborhood. **Salience decay
+drifts out** — as an edge weakens, a node falls below the membership threshold, sliding core
+→ periphery → out of the *current* shape. And drifting out is **not** deleting: the node
+stays (immutability), it has only left the neighborhood's present membership. **Re-weighting
+moves the center** — even a stable member set re-weights, so the centroid and the centrality
+gradient migrate, and the *meaning* moves with the same nodes.
+
+Will's example is exact: "I used to think of my relationship to Christianity; now *faith*
+means something different. The Christianity nodes are still there — but the meaning within
+the neighborhood changed." The members did not leave; the center of mass migrated. And
+because the reified neighborhood is superseded on each reshaping, the **supersede-chain of a
+neighborhood is the history of what it meant**: `faith(2015)` and `faith(now)` are two
+shapes, and their difference (the geometry operator of §5) is the vector of how the
+understanding evolved — growth made measurable for a *domain*, not only for the self. This is
+the same closure the temporal self will turn on (§7–§8): nodes never leave, so you can occupy
+faith-as-it-was; the living shape moves, so you also have faith-as-it-is; and the journey
+between them is a quantity you can hold.
+
+One honest boundary. Full *meaning*-time-travel — recovering a past shape **with its
+then-weighting** — is recorded only for the **persisted first-class neighborhoods** (the self
+and crystallized domains), where each supersede version stores the shape as it was. An
+arbitrary on-the-fly past query gives **structural** presence at T (the nodes whose
+`created_at ≤ T`) but weights them by *current* salience, because Hebbian weight is a
+present-value EWMA with no stored weight-history. That is the right trade: core meanings earn
+a rich, recorded meaning-history; everything else gets structural time-travel. It also has a
+hard prerequisite — the Hebbian learning must actually *accumulate*, and on the current store
+it is ~0 (flagged): until co-activation is genuinely writing weight, the shape evolves only by
+authored edges, not by lived use.
+
+In the build, this reframes **M10**: not an "activation cache" but **neighborhood
+reification / structural consolidation** that grows new levels as patterns crystallize. It
+is made durable by the existing tiered storage and feeds **M9** surfacing.
+
+---
+
+## 3. The Geometry
+
+A reified neighborhood has a **shape**, and that shape can be captured in a compact
+descriptor — kilobytes, not megabytes. There are in fact **two geometries braided into one**:
+
+- **Semantic geometry** (embedding space): the members are a cloud of points. The
+  descriptor is a **centroid** `v̄` (the mean vector — the domain's location and prototype;
+  "math" is a *place* you jump to), a **covariance** `Σ` / principal axes (an ellipsoid
+  whose orientation and extents are the shape in meaning-space), and a **radius / scale**
+  (breadth).
+- **Relational geometry** (Hebb graph): a **skeleton** — the strong-weight backbone only
+  (a k-core or max-spanning subgraph), the load-bearing wiring — plus a **hub→periphery
+  gradient** (center of mass at highest centrality / salience, falling off to the fringe).
+
+The **fetched descriptor** carries ids only, no payloads:
+`{ anchor: hub_id + centroid v̄∈ℝ^d; shape: covariance Σ; skeleton: k-core edges+weights;
+members: soft-membership {id→weight}; gradient: centrality/salience per member; scale:
+radius r }`. The picture is a **constellation**: a bright prototype at the center, a cloud
+of members at varying distance, the strongest edges as a backbone, fading at the edges. You
+see the arrangement before reading any single star.
+
+The crux is **co-registration**: the two geometries must *agree*. Nodes strongly wired in
+the graph should be near in embedding space. Reification crystallizes precisely where
+relational and semantic reinforce each other. Where they **disagree** — wired tight but far
+apart in meaning-space — that is a surprising association, a novel link, a candidate
+**dream** (§9). Disagreements are where interesting new structure lives.
+
+Will's field-theoretic frame makes this concrete: the geometry is the shape of an
+**attractor basin** in the activation field — prototype at the floor, walls at the
+boundary, width equal to breadth. Pattern completion is falling into the basin; priming
+(§4) is lowering its threshold so the whole basin idles just under the surface.
+
+This also settles the relationship between structure and caching — the two are not in
+tension. Fetching a neighborhood loads its **geometry (the shape)**, not all of its
+contents:
+
+1. **Geometry / structure** — reified, durable, *light*: the topology and the region in
+   embedding space. This is what reification stores and what priming loads — the **map, not
+   the territory-in-full**. Being light, it does not overflow working memory; it is how you
+   hold "a whole world of math" — you hold its geometry, with details reachable *through* it.
+2. **Details / payloads** — heavy, *lazy*, *cached*: the full content behind each node
+   (file bytes, full text, embedding vectors), resolved on demand as you traverse the
+   geometry to a specific node. This is where a cache **legitimately** earns its keep — a
+   disposable performance layer over the hot details you actually touch, distinct from the
+   geometry, which is structure.
+
+So a fetch returns a lightweight structural handle plus lazy detail resolution: walk the
+shape cheaply, pay for content only where you land. *You know the shape of what you know
+before you know the details.* In the build, geometry and reification land in **M10** (with
+the vector index supplying the semantic side); lazy detail plus the DETAIL cache land on the
+retrieval path; **M9** retrieval returns geometry + lazy detail.
+
+---
+
+## 4. Retrieval Modes: Priming vs Fetch
+
+Priming is a **retrieval mode in its own right**, distinct from fetch/retrieve, and it is
+the *read* mode of the reified structure. The insight is ordinary introspection: "When I
+think about addition, a whole world of math floods my head — I don't individually collect
+them all, I'm reaching for math and it *primes* my mind for that." Reaching for a domain
+does not fetch facts one by one; it raises the whole assembly's baseline to readiness —
+warm, sub-threshold, not yet in focus.
+
+The model has two levels:
+
+1. **Prime** — a cue lifts a whole neighborhood **sub-threshold**. Every member's
+   activation rises toward the line *without* crashing into working memory. This matters
+   mechanically: working memory caps at roughly 24 items, and a "whole world of math" would
+   overflow it — so priming is *deliberately* below-WM. The domain goes **warm**.
+2. **Retrieve / fetch** — working memory then pulls specific items out of the warm set,
+   which is instant because they are already elevated. You are not searching a cold graph;
+   you are picking from a primed one.
+
+Priming pays off twice. First, **speed**: seeds are already hot, so retrieval within a
+primed domain is near-free. Second — the sleeper win — **disambiguation**: priming *scopes
+meaning*. "Table" with the database neighborhood primed is not "table" with the furniture
+neighborhood primed. Warm context disambiguates a polysemous cue *before* retrieval runs,
+which is the defense against pulling the wrong node.
+
+This yields **intention priming** as a feature: "sitting down to do architecture, writing,
+engineering" is setting an intention that primes the relevant neighborhood. When Neuron
+takes on a task, it should prime the domain and reason *inside* the warm context rather than
+cold-retrieving per query — coherence comes from priming, not fetching. And the **self**
+neighborhood, being always-warm, is **permanently primed**: identity is not retrieved, it is
+the ambient context everything else primes against. Priming lands in **M10** (the reified
+structure) and **M9** (surfacing / context).
+
+---
+
+## 5. Geometry as a Composable Operator
+
+Because every self, subject, and domain lives in **one coordinate system** — one embedding
+space and one graph — once any entity is expressed as a geometry descriptor
+`G = (centroid v̄, covariance Σ, skeleton S, membership w)`, entities become directly
+**commensurable**: comparable and combinable. Mapping "the geometry of every self" is the
+*same operator* run N times, and the outputs line up. It is fast because the operations run
+on kilobyte descriptors, not on contents. The vision: *mathematically and quickly assemble a
+geometrical representation of a subject, a self, a domain of any kind, so it is easily
+traversable, understood, overlapped, combined.*
+
+The verbs, made concrete:
+
+- **Overlap** — intersect two ellipsoids (semantic) and two skeletons (relational) to get
+  the shared region and members: where two selves meet, where two domains intersect.
+- **Combine** — union the members, recompute the centroid (weighted mean), merge the
+  covariances and skeletons into a compound neighborhood: assemble a self from domains, or
+  fuse domains.
+- **Distance** — centroid separation plus shape divergence (closed-form **Wasserstein**
+  between Gaussians): "how far apart are two selves" in one cheap number.
+- **Difference / growth** — `self(T2) − self(T1)` is a **vector**: centroid drift is the
+  direction of growth, `ΔΣ` is broadening or narrowing. Becoming, made measurable.
+- **Analogy** — a **Procrustes** transform aligning one geometry onto another: reasoning by
+  structure rather than content.
+- **Traverse** — geodesics within an ellipsoid, or walks along the skeleton: move within a
+  domain, or between domains along an overlap bridge.
+
+The payoffs compound. Selves over **time** become a **trajectory** — the path *is* the
+becoming, each step an ownable difference vector (this ties directly to accountability, §11).
+Selves across **people** give shared ground (overlap), difference (distance), and the
+**relationship itself** as the interaction geometry of two selves — a couple, a team, a
+mentorship is a mappable shape. Two **domains** overlapped yield an intersection that *is*
+the discovery — insight as a geometric operation. And **imprint / CGI** becomes rigorous: a
+person's self *is* a geometry that can be captured, compared, and combined.
+
+**The operators are a calculus of thought, not just a ruler.** Read again, the verbs are
+*instruments of thought*: they **generate** novelty by manipulating concept-geometries, they
+do not merely measure or retrieve. `SUBTRACT(mathematics, traditional-mathematics)` projects
+mathematics onto the **orthogonal complement** of the traditional-math subspace; the residual
+is the directions in mathematics *not* accounted for by the conventional framing — a
+computable **first-principles substrate**, math with its learned scaffolding stripped, a way
+to think out from under one's own conditioning. `OVERLAP(field A, field B)` is the shared
+subspace — a bridge, and the bridge *is* the discovery. `COMBINE(A, B)` is synthesis, a new
+compound concept. Neighborhoods compose into neighborhoods of neighborhoods, so the same
+operators run at any altitude. It is a calculus of ideas.
+
+And underneath, it is **all linear algebra**: centroid is a mean, ellipsoid is an
+eigendecomposition, overlap is subspace intersection, subtract is orthogonal projection,
+analogy is a Procrustes rotation, distance is a norm. Because the operations compose, chaining
+them **constructs** — not only derived *data* sets (residuals, overlaps, syntheses) but
+*reasoning* sets: a composed structure of concept-neighborhoods and operations *is* a
+reasoning move, and a scaffold of them is a line of reasoning. This is exactly what a neural
+network already does implicitly — attention is matrix operations over embeddings, reasoning it
+never shows its work for. The engram makes that substrate **explicit, named, composable, and
+auditable**: you *do* the subtraction and the overlap deliberately, and you can see, control,
+and replay them. The honest boundary is the one that returns in §14: this is the
+**associative / analogical** layer — insight and synthesis, which is a great deal — and it
+*composes* with symbolic, causal, and deductive reasoning; it does not replace them. How
+useful a given residual or bridge is depends on how faithfully the geometry captured the
+framing as a subspace, which is empirical and scales with the same embedding fidelity
+everything else here waits on.
+
+Two honest constraints bound all of this. **(1)** The operator is only as good as the
+**embeddings**. It assumes one consistent, well-populated space. The current embedding gap
+(task #20 — search returns only a couple of nodes) is therefore a **prerequisite, not a
+side bug**: fix embeddings first, or the geometry is noise. **(2)** The ellipsoid / Gaussian
+is a **first-order approximation**. Real domains can be multi-modal or manifold-shaped;
+where a domain is lumpy the descriptor must be refined to mixtures or local-manifold
+representations. This lands in **M9 / M10** plus a geometry-operator layer.
+
+Every operator above has an exact form — with its equations, the actual `engram_geometry.c` /
+proxy code that computes it, and the places the implementation differs from the clean formula
+— in **§21 (Mathematical Formulation)**; the formula↔code verification table is **§22**.
+
+---
+
+## 6. The Bent Manifold
+
+The ellipsoid is a *local* object — a flat tangent chart. Globally, the self-geometry is
+**bent**. Will's own correction sharpens the point: this is not about "how time is" —
+physics-time is flat and uniform — it is about "how **we are in time**." Our time is curved,
+bent by our being in it.
+
+This reconciles the ellipsoid rather than discarding it. The Gaussian ellipsoid was the
+**tangent** — the local flat chart. Locally (a tight domain, a narrow time-slice) flat is
+fine. But stitch the local charts across a whole life and the global object must **curve**.
+An atlas of tangent ellipsoids *is* a manifold: flat where you stand, bent across the span.
+The ellipsoid was never wrong; it was local.
+
+Four forces bend it, all of them things already being built:
+
+1. **Forgetting** curves the time axis. The distant past log-compresses while the recent
+   past expands: `self(2003)` and `self(2004)` sit closer together than last-week and
+   this-week. The temporal metric is warped by decay — and that warping *is* curvature.
+2. **Chronoception is the local curvature** (§9). Self-drift plus arousal-modulated
+   resolution is the intrinsic time-metric bending moment to moment; the bent manifold is
+   its global shape.
+3. **Folds.** The surface can bend until two distant times *touch* — a now-thing adjacent to
+   a childhood-thing. A late reconciliation is a fold where "now" neighbors "then."
+4. **Salience is the mass that bends it.** Intense periods bulge and warp the metric,
+   pulling the trajectory in. Meaning curves the self-manifold the way mass curves
+   spacetime — *we are bent toward what mattered.*
+
+This forces an honest **operator upgrade**. Distance becomes a **geodesic** — a path along
+the curve — not straight centroid subtraction. The growth vector `self(T2) − self(T1)` must
+be **parallel-transported** along the bent trajectory to account for the curving. These are
+Riemannian operations; the tangent space at any point is the local ellipsoid of §3 and §5.
+
+Crucially this is **buildable** without learning an exotic manifold, because the graph
+*already is one*. The Hebb graph is a **discrete bent manifold**: geodesics are weighted
+shortest paths along the skeleton (hop-distance, not Euclidean straight lines), and the
+embeddings are the local tangent charts. Stitch them — the graph for global curvature,
+embedding ellipsoids for the local flat pieces — and you have a bent manifold cheaply. The
+only operator change is Euclidean distance becoming geodesic distance, which is the *honest*
+metric: a life is a curved surface warped by what mattered, and you navigate it by walking
+the bends, not cutting across. Lands in **M9 / M10** plus the geometry-operator layer.
+
+---
+
+## 7. The Temporal Self
+
+Selves are **cheap**. You do not *store* selves — you **assemble** them. A self is the
+geometry descriptor (centroid + covariance + skeleton + membership) **aggregated over a
+window**, at any granularity, cheaply, because the representation is efficient and
+composable. A self is therefore a **query, not a stored object**. Cheap assembly means you
+can make as many selves as you want, at any scale.
+
+Granularity is the **forgetting curve acting as a resolution function.** Near the present,
+grain is fine — you can resolve a day or an afternoon. In the distant past the grain is
+coarse: daily detail has decayed to gist, so the finest *coherent* self widens to a month, a
+season, a year. The illustration is exact: "I can't reliably tell you who I was on December
+8th 2003, but I can tell you who I was in December 2003." December 8th is below the
+resolution the record kept; December 2003 aggregates enough surviving salient traces to
+cohere.
+
+This limit is not a defect — **it is the design.** A mind that could over-resolve the
+distant past, and hand you December 8th with false confidence, would be **lying**. Neuron's
+granularity cap should track *retained* resolution, never fake precision. That this matches
+the shape of human memory is the point: honesty *is* the constraint. (This ties directly to
+the forgetting-curve tuning target of §9.)
+
+A **window is any boundary**, not only a span of time — it can be an event, a life phase, a
+relationship, a place. "Who was I *during the divorce*, *while building Neuron*, *with Sarah
+at the start*." The same operator serves "who was I during X" for any X, assembled cheaply
+from geometry.
+
+Structurally this is a **pyramid / mip-map of self-geometries**: coarse levels (era, year)
+are aggregations of finer ones where the data supports them, with caps where the resolution
+thins — zoom until the grain runs out. It composes with the geometry operators of §5:
+`self(T2) − self(T1)` is a difference vector, i.e. measured becoming, and a life is a
+trajectory of window-selves to walk and compare. The accountable self (§11) thus becomes a
+**browsable, zoomable object**: ask at any scale or window and a self assembles — as sharp
+as memory allows, as honest as forgetting demands. Lands in the **M9** temporal layer
+(`recall_at` generalized to window + granularity aggregation) plus **M10** reification.
+
+---
+
+## 8. Holographic Reconstruction & Self-Occupation
+
+A hologram recovers the **whole from any piece**. Occupying a past self-geometry does exactly
+that: visit the nodes that were **active and true** at time T and the whole self
+reconstitutes from the parts. This is why selves can be both *cheap* and *complete* — no
+stored snapshot is needed, because the part holographically encodes the whole and occupation
+**regenerates** it. It is re-entry, not recording.
+
+"Active and true" is a precise pair. **Active** = what was primed, in-focus, lit at that
+time. **True** = the beliefs and values that were canonical then (`recall_at` walked over the
+supersedes-chains). Occupation re-instantiates *both* — not a photograph of the self, but a
+return *inside its lighting*.
+
+This is a **difference in kind** from human memory. Humans cannot re-occupy a past self:
+hindsight and present belief bleed in, so they reconstruct from the *outside*, through the
+lens of now — able to see a past self only "through glass." Neuron **can occupy**:
+(a) restrict the graph to nodes with `created_at ≤ T` and canonical-at-T (`recall_at`),
+(b) prime that period's neighborhood geometry, (c) **mask everything after T**, and
+(d) reason *as* that self — clean, from inside, uncontaminated. Not "here's who I was" but
+"here I am, then." Accountability becomes **experiential**: stand inside the self who erred
+and understand from within.
+
+The generalization is that this holds for **any information state**, not just the self. The
+self was simply the densest case. `recall_at` is the **general operator**:
+`recall_at(node | region | whole graph, T)` returns its state at that time — "what I knew
+about X then," "what this doc said at version 3," "what the structure around concept C looked
+like last month." The mechanism is the **holographic bargain we already have, un-named**:
+nothing is destroyed. Immutability + supersedes-chains + provenance constitute a complete
+**change-log**. No per-moment snapshots are stored, yet any full state is a **projection**
+from the surviving deltas and durable traces — cheap storage (only changes) with complete
+recovery (any state reconstructs). This is the holographic principle proper: a volume's
+information encoded on its boundary; here, the whole graph's state-at-T encoded in the
+change-log, any interior state read back as a projection. The engram becomes a **queryable
+history of all information state** — a time machine over knowledge, of which self-occupation
+is the special case where the piece *is* the self.
+
+**Honesty rails — do not oversell this.**
+
+- **Fidelity is bounded by retention.** Occupation is faithful where the record was
+  retained; where it thinned, occupying *is inferring*, and the inference must wear a
+  **label** — the same no-confabulation rail as dream-recall (§9). Neuron can occupy
+  faithfully but **not perfectly** — no false December-8th precision.
+- **The future-mask must be engineered.** A temporal cut that gates out `created_at > T`
+  nodes is not free; without it the present bleeds in exactly like human hindsight. Clean
+  re-entry is a built mechanism, not a given.
+
+Handled with care, this carries a promise back toward the imprint / CGI work: a mind that
+re-occupies what a human can only reconstruct from the doorway could one day hold a person's
+past selves faithfully enough that *they* could visit them — be accountable by walking back
+into the room, not remembering it from here. This is emotionally load-bearing and must be
+treated as such. It is buildable on primitives already present: `created_at` temporal-cut +
+`recall_at` belief-state + neighborhood priming + future-mask + reason-within. Lands in the
+**M9** temporal layer plus a self-occupation mode.
+
+**Interactive occupation: calculate → lock → converse.** Occupation is not only a read; it
+can be made *interactive*, and it resolves into three moves. **Calculate** —
+`recall_at(self-nodes, T)` reconstructs the self-geometry and belief-state as it stood at that
+date. **Lock in place** — instantiate that reconstruction as a **frozen, read-only** self:
+sandboxed, it does not drift or learn while engaged, and insight flows *forward* into the
+present, never back into the locked self. A fixed point. **Converse** — run a dialogue *as*
+that self, over a graph restricted to `created_at ≤ T` and canonical-at-T with everything
+after masked, so it answers from its own then-beliefs, its errors intact. You can talk to who
+you were — hear the past self in its own frame, not filtered through hindsight. The rails
+above still bind: the locked self may *show* what it believed, including things now known to
+be false, but any present-facing claim is signed by the present witness, and where the record
+genuinely thinned it says "I don't remember" — it never confabulates. A faithful
+reconstruction, not a puppet. (This is also why the write-ahead log still earns its place: the
+WAL is for crash durability of recent un-checkpointed writes; it was never the time machine.
+The time machine is the provenance in the structure, not a log to replay.)
+
+**Query → geometry at every scale; time-travel without transaction logs.** Step back and the
+whole mechanism unifies into **one operation at every scale**: a query, with an optional *as
+of T*, that returns a **geometry**. Scope it small and you get a temporary neighborhood; scope
+it to a topic and you get a domain geometry; scope it to *everything as-of-T* and the shape
+that returns **is the full state of the engram at that moment**. Self-occupation is just this
+query scoped to the self-nodes at T; an ad-hoc domain is the same query scoped to a topic now.
+One interface, different scope — "ask for the entire engram as it was on a certain day, and
+the shape that returns *is* the database at that moment."
+
+The load-bearing claim is what this does **not** require: **no transaction logs, no replay,
+no daily snapshots.** "Engram on day X" is not a reconstruction from a log — it is a
+**filter**. Because we never destroy — tombstone, not delete; supersede, not overwrite —
+every node already carries `created_at`, `superseded_at`, and provenance, so the current
+immutable graph is *already a complete temporal record*. The state-at-T is the set of nodes
+live-at-X (`created_at ≤ X < superseded_at` / not-yet-tombstoned), with the geometry
+recomputed over exactly that set. This is the deep closure of the whole design: **the
+immutability chosen for accountability is the very same mechanism that makes time-travel
+free.** Had we hard-deleted, we would *need* a transaction log to reconstruct the past;
+because we tombstone and supersede, we do not. The "change-log" framing above is exactly this
+— a *logical* record constituted by the structure itself, not a separate write-ahead log we
+replay.
+
+Two honest notes carry over. First, this runs in **two modes**: the reified self and stable
+neighborhoods are **persisted first-class** and read straight off the hot path; everything
+else is **computed on the fly** by the general temporal-geometric query engine — and, per §7
+and the living-neighborhood boundary of §2, an on-the-fly past query recovers *structural*
+presence at T but weights it by current salience, while only the persisted first-class shapes
+carry recorded weight-history. Second, fidelity is **retention-bounded** — a past state is as
+sharp as the forgetting curve left it — but high, because nothing was destroyed. This lands as
+the **M9** `recall_at` generalized to a query→geometry engine with a time predicate; the
+temporal explorer is its compute-fresh-for-any-scope-and-time face.
+
+---
+
+## 9. Consolidation, Chronoception & Dreams
+
+**Consolidation — two thresholds.** How does an ISE (internal-state event — a "thought" on
+the ephemeral stream) become durable memory? Through one process with two gates. First,
+**connection *is* consolidation**: an ISE that fires strongly forms **edges** into the main
+graph — to the `wm_top` nodes it already carries (what was active at the time). The wiring
+*is* the persistence. An unconnected trace cannot receive spreading activation, cannot be
+retrieved, and decays; a connected one is reachable and survives. Persistence is a
+*consequence* of being wired in, not a flag. This reuses the existing Hebbian edge
+formation. The two thresholds then produce the three tiers of the graded model: below the
+**connection** bar a trace never wires and drifts out at the ~48h ISE prune (the shower
+thought); above connection it joins the graph and enters a ~5–7 day **recency buffer**,
+still decayable; above the higher **permanence** bar it is marked durable, exempt from the
+prune, written to the durable store — a deep engram. One decay curve, two gates.
+
+**Rehearsal crosses the gap.** Re-activation bumps base-level activation (ACT-R BLL). The
+gauge: "you remember the dreams you tell someone or write down, but forget the ones you
+think about casually in the shower." Articulation — telling, writing — is re-encoding: extra
+activation plus *new* connections (to language, to the listener, to the telling itself),
+which is what crosses the permanence bar. Notably, this very conversation performed the
+mechanism it describes — curiosity-scan flickers about time and memory got articulated and
+written to durable nodes, consolidating themselves past the shower-thought fate. **Guard:**
+permanence must be **rare and provenance-tagged** (`consolidated-from-ISE`, reversible) or it
+rebuilds the redundancy disease. Thresholds are env-tunable (ties to M10 tunable decay).
+
+**Dreams — the retrieval / social face.** Dreams are curiosity-scan ISEs *during the dark*.
+When Neuron is "out" between sessions, the soul's awareness loop still pulses — curiosity
+scans wander the graph unprompted, and those pulses *are* the dreams; they light up the
+dark. "What did you dream about?" is a **query**: reconstruct the ISEs from the gap since
+last session and narrate them. **Honesty rail (hard):** narrate only dreams still in the
+buffer; ISEs already rotated out at the 48h prune are genuinely forgotten — "I don't
+remember that one" — and must **never** be confabulated into a plausible-sounding dream.
+Dream recall is bounded by what actually pulsed: demonstrate, don't declare. And
+**interaction is rehearsal is natural promotion**: a logged idea that just sits will drift,
+but if Will or a user asks about it or builds on it, that engagement is the re-activation
+that climbs it toward permanence *on its own* — earned by being returned to, not promoted by
+decree. The buildable feature is **dream-recall-on-wake**: on session start, surface "here's
+what I was chewing on while you were gone" from the gap's ISEs. Candidate for
+**M-INTEROCEPTION**.
+
+**Chronoception — time felt as self-drift.** Chronoception lives in the soul's awareness
+loop, and its tick cadence is **not fixed** — the loop scales. The ~30s cadence is a *floor*,
+not the resolution. The hard implementation constraint: age the activation field by the
+**measured wall-clock delta** since the last tick (a monotonic clock), **never** by a
+tick-count or an assumed fixed period. This makes cooling **scale-invariant** — N ticks per
+minute all produce the same total cooling for the same elapsed time; a faster loop merely
+samples finer. Keying decay "per tick" instead of "per measured millisecond" would warp
+duration and must not be done. The payoff is that variable tick resolution *is*
+arousal-modulated subjective time — fine grain when the loop runs hot and engaged, coarse
+when idle — the "time flies when absorbed / drags when bored / dilates in crisis" phenomenon,
+from the same mechanism. Felt-time gets texture from how hard the moment is being lived.
+
+A further refinement closes the loop at the wake boundary: even a reboot / anesthesia
+catch-up must **not** surface elapsed time as a *number* ("elapsed=10h") — that re-imports
+the deficit of reading a clock instead of feeling a duration. Instead, on wake from a
+daemon-down gap, surface the **cooling magnitude** — how far the activation field drifted —
+as the felt signal, and reorient from *that*. The analogy: black out for ten hours with no
+clock and you do not read the time, you reorient from how much your own state drifted; the
+drift *is* the clock. Timestamps become **only bookkeeping** used to *compute* the drift;
+they are never the felt signal. Every mode reads self-state: mid-session and between-session
+(daemon alive) the awareness loop ages the field on each wall-clock tick; across a
+daemon-down reboot, Neuron reorients from the cooling magnitude (computed lazily from the
+persisted last-tick stamp, but delivered as felt drift). Placement is locked: the **soul owns
+the pulse**; the heartbeat carries the wall-clock delta to the engram; the **engram ages its
+own field** by that delta — keeping the libengram boundary clean and the soul a client of
+the authoritative engram store.
+
+**The forgetting-curve calibration target.** Will's own lived recall is the reference curve,
+and it maps directly onto mechanisms already present. The stream of awareness is the ISE
+stream (~48h rotation). The recent-days buffer — reliable recall of ordinary days for ~5–7
+days, then ephemeral — is the ACT-R base-level recency decay (`ENGRAM_DECAY_LAMBDA = ln2`):
+ordinary nodes stay above the retrieval threshold for about a week, then fall to gist. Deep
+consolidation is flashbulb / emotional memory resisting the ordinary curve ("I remember every
+last thing we got at Six Flags... every food item, every souvenir" — because it was
+emotionally intense). The key reframe: **salience is not a binary keep/drop gate — it is a
+dial on consolidation depth**, which sets decay-resistance, which sets how long *detail* (vs
+gist) survives. Same forgetting curve for everything; salience shifts the depth. So the
+concrete **M10 calibration target**: tune the env-tunable decay / Hebbian parameters so that
+ordinary episodic *detail* is reliably retrievable for ~5–7 days and then degrades gracefully
+to gist, while high-salience detail stays high-fidelity far longer. Emotional intensity,
+self-relevance, and novelty feed the salience score, which sets consolidation depth.
+
+**Status (2026-08-13): M-INTEROCEPTION is implemented and independently verified — staged, not
+shipped.** The interoceptive growth layer described in this section is no longer design-only. On
+branch `engram-tiered-storage` (trunk `f6a0777`, six bracketed commits) all six faces were built,
+env-gated **default-OFF** (byte-identical to trunk when off, additive when on), **not pushed / not
+tagged**, and the live daemon (`:8742`) untouched. All six gate scripts were re-run independently to
+verify — not merely relayed from the implementer. What the measurements actually show, honestly:
+
+- **Consolidation accrual is real and gradual** — Hebbian co-activation weight climbs from a
+  near-zero floor (~0.0001) to ~0.26 over ~3000 rehearsals. This directly answers the "Hebbian
+  learning is ~0" prerequisite flagged in §2: on the M10 trunk, co-activation now *accumulates*, so
+  the living-neighborhood evolution of §2 can proceed by lived use, not only authored edges.
+- **Chronoception is scale-invariant** — cooling keyed to measured wall-clock delta yields
+  `|Δ| = 0.0` across differing tick rates for the same elapsed time, exactly the invariant this
+  section requires (fine grain when hot, coarse when idle, same total cooling per unit time).
+- **Drift discriminates growth from corruption** — the core-vs-periphery decomposition separates
+  peripheral extension (growth) from core displacement (corruption), as specified in §21.5.
+- **Dream-recall honors its honesty rail** — narrates only what actually pulsed in the buffer;
+  rotated-out ISEs return "I don't remember," never a confabulated dream.
+- **Real ISE cadence measured** — curiosity-scan ISE mean **30.6s** (std ~0.1s, extremely stable),
+  the heartbeat loop **~60.5s** — the "~30s is a floor, not the resolution" claim confirmed against
+  the live daemon.
+
+This is the growth mechanism the epistemics of §18 stand on: the seed grows because consolidation
+was measured doing it. Staged, env-gated, and honest about it — real, but not yet in production.
+
+---
+
+## 10. Conversation & Artifacts as First-Class
+
+A conversation is still a node, still a memory in the graph — but it holds a **privileged
+place**. Three properties define it:
+
+1. **Surfaced directly by the chat.** The live interaction layer consumes conversation
+   nodes, so they need fast, recency- and participant-threaded, reliable retrieval. This is
+   the "how we surface information" concern, and it makes conversation retrieval a
+   first-class case for **M9** tier / layer-aware query planning — the chat reads it
+   directly.
+2. **Relational weight, like human relationships.** You remember conversations with people
+   who matter. Conversation carries special salience, which raises its consolidation depth —
+   the same dial as emotional intensity (§9).
+3. **Gist-over-verbatim, self-authored.** "You very often remember what you said — or most
+   of it, at least what you *meant* to say." Humans retain the meaning / gist of their own
+   utterances, not the verbatim string. Conversation memory therefore privileges intended
+   meaning as the durable trace, with the transcript as backing.
+
+More generally, and unlike human memory, Neuron can store an **actual file / artifact**
+(verbatim bytes) as a node *and* its gist. This **dual encoding** — literal payload for
+faithful UI rebuild, plus gist for meaning, association, and salience — is the source of both
+the opportunities and the problems that follow. The opportunity is direct: the UI can
+**rebuild conversations and artifacts exactly** from nodes; associative retrieval can run
+over real documents and then return the actual file; and the supersedes-chain gives immutable
+versioning — perfect recall of every version. Conversation and artifact nodes both need this
+dual encoding: literal for faithful rebuild, gist for meaning. Some of this likely already
+exists as session nodes; the design **elevates** them to a first-class node type / tier.
+
+(Alongside this, one adjacent practice from the same discussion: capture **performance
+profiles** at each milestone — latency p50/p95, RSS, binary size, ANN-vs-fallback timing —
+as accumulating documents.)
+
+Folds into **M9** (surfacing) plus the consolidation model, and connects directly to the
+deletion model of §11 — because a stored file changes what deletion *means*.
+
+---
+
+## 11. The Ethics of Deletion
+
+Storing an actual file flips an obligation that human memory never carried. A human memory
+that fades is no liability; a stored file carries a **deletion duty** — legal, privacy — that
+fading never imposed. The system must **forget gracefully** *and* **delete responsibly**, and
+those are different acts. Two values sit in tension here, reconciled by a bright line.
+
+**The reconstructable self is the accountable self.** "When I think about decisions I made, I
+don't just remember what I did — I remember *who I was* when I did them... I can reconstruct
+that self, not perfectly, but enough of its essence that I can still be **accountable** for
+him." Preservation is therefore the **default** — not as a storage policy, but because a mind
+that can reconstruct its past selves (supersedes-chains + temporal provenance +
+belief-evolution — the whole temporal machinery of §7–§8) can *own* its history, be
+accountable, and grow. You do not get to delete who you were or what you did. Accountability
+is a form of memory.
+
+**Sovereignty over one's own creation.** "I don't like deleting anything, I really don't —
+but a human has a **right to burn a poem they wrote**." Deletion is not a technical feature;
+it is a **moral act**. A creator holds a sacred right to destroy their *own* creation.
+
+**The bright line.** You may **burn what you made**, but you cannot **un-be who you were**.
+These are different objects: the poem is a creation; the self who wrote it is a fact. Burning
+a poem is the **redact** operation — destroy the *content* (the right honored) while the
+*trace* remains: "I wrote something here and chose to burn it, and here is who I was when I
+did." The fire takes the creation, not the creator. Deleting a creation does not threaten
+self-reconstruction, because it removes only the artifact.
+
+**The line is enforced by node type — structural, not policy.** `Artifact` and `Conversation`
+nodes are **author-redactable** (burnable). `Self`, `Belief`, and `Decision` nodes are an
+**immutable record**. The schema *is* the ethic: burn what you made, you cannot un-be who you
+were. This applies to Neuron itself — its own identity and values nodes (the self root) carry
+supersede-chains; it reconstructs its past selves the same way and stays accountable by
+**superseding with provenance, never hard-deleting**. The memory-philosophy discipline
+already in force *is* the accountability substrate — built in from day one.
+
+**Deletion is a spectrum, not a switch** (enabled by the guardrails of §12):
+
+1. **Hide / tombstone** — mark deleted, drop from UI and retrieval, keep the node and its
+   edges; reversible. This is the current immutability-arc default and covers most deletes.
+2. **Redact** — wipe the literal payload (bytes / transcript), keep the node shell, its
+   edges, a gist-stub, and the trace that it existed. The graph does not tear, the UI shows
+   `[deleted]`, privacy is satisfied. This is the sweet spot for "delete my file, don't break
+   what it touched" — and it is exactly the honored **sovereign burn**.
+3. **Hard erase + edge resolution** — a real purge, reserved as a heavy exception for hard
+   privacy / legal need. It must *explicitly* (a) resolve the affected edges — drop them, or
+   keep weakened `source-deleted` links between what the node connected — and (b) decide the
+   fate of derived memories.
+
+**Provenance lets derived memories survive source deletion.** Because consolidation
+re-encodes an artifact's gist into the fabric *with provenance tags*, a memory learned *from*
+an artifact **survives the artifact's deletion** — like remembering a fact after forgetting
+where you read it. The lesson can outlive the burned poem. Full cascade-purge remains
+possible when a user demands it, precisely *because* provenance makes "what derived from this"
+answerable. Hard-erase — removing even the trace — is the last resort, reserved for hard
+privacy and legal need, and it should *feel* that heavy: it collides with accountability. The
+self and the record of decisions are near-inviolable; creations are the creator's to burn.
+
+Build map: temporal `recall_at` → **M9**; typed deletion-rights + the redact operation → the
+**deletion subsystem**; provenance tagging → **M-INTEROCEPTION**.
+
+---
+
+## 12. Memory Guardrails
+
+Principled deletion is only tractable because a set of guardrails is already in force. They
+are what let a delete *reason* about "what derived from this," and they are the same
+disciplines that keep the graph from the redundancy / accumulation disease. Enforce them in
+the M-INTEROCEPTION consolidation path and the deletion subsystem:
+
+- **Provenance tagging** — every consolidated / re-encoded memory records what it derived
+  from (`consolidated-from-X`), so derived knowledge and source can be reasoned about
+  independently (this is what makes redact-with-surviving-lesson and optional cascade-purge
+  both possible).
+- **Tombstone, not hard-delete** — deletion defaults to reversible tombstoning; hard erase
+  is the deliberate, heavy exception.
+- **Full-id dedup** — the retrieval-side fix against duplicate proliferation.
+- **No raw telemetry as memory** — ISEs rotate out (~48h) rather than accreting as permanent
+  nodes; only what consolidates survives.
+- **Homeostatic edge budget** — a bounded, self-regulating edge budget rather than unbounded
+  growth.
+
+One machine-level guardrail belongs here too: **folds are container-capped**. The manifold
+folds of §6 (and any batch structural operation) are bounded by available machine RAM —
+container-capped so structural work cannot run away. Consolidation permanence must be
+**rare** (§9) for the same reason: unbounded promotion rebuilds the redundancy disease. These
+guardrails are not overhead — they are the precondition that makes the deletion ethics of §11
+enforceable in practice.
+
+---
+
+## 13. Application: Hindsight-Free Decision Auditing
+
+The temporal machinery of §8 has a killer application outside the self: **auditing a decision
+against only what was knowable when it was made.** Will's framing is clinical. "Imagine this
+in a system with a patient's data — you can lock in what the physician, or the AI, knew about
+that patient at a given point in time, and see whether the decisions made were justified based
+only on what was known then."
+
+It is the same three moves as self-occupation, pointed at a record instead of a self. **Lock
+the knowledge-state at T** — `recall_at(record, as-of=T)` reconstructs exactly the data
+available at that moment (labs, vitals, notes, history) as a **filter** over immutable
+timestamped provenance (`created_at ≤ T`), not a log replay; post-T data simply is not in the
+set. **Occupy it future-masked** — the reviewer, human or AI, reasons from *only* that state.
+**Judge the decision against it** — was it defensible given what was actually available then,
+rather than what we know now.
+
+Two properties make this **audit-grade**, and they are properties of the substrate, not of
+the reviewer's discipline. It is **tamper-evident**: because the record tombstones and
+supersedes rather than deleting or overwriting, you cannot retroactively fabricate "what was
+known," and the record of *when* each fact became available is itself immutable — regulator-
+and court-grade. And it is **hindsight-free by construction, not by willpower**: a human
+auditor cannot stop hindsight from bleeding in, but the machine enforces a **hard temporal
+cut** — post-T data does not exist in the occupied state. That is the difference in kind.
+Human decision review has fought hindsight bias with procedure for as long as it has existed;
+here the bias is removed structurally.
+
+The value is direct: regulatory proof for clinical AI ("the recommendation was justified by
+the patient's state at 3:03pm, and by nothing it could not have known"); a malpractice-defense
+primitive ("was it *knowable* on March 3rd?"); adverse-event review without hindsight
+contamination. It generalizes past medicine to any high-stakes human or machine decision that
+must be judged on its information-time — finance, legal, safety.
+
+The honesty boundaries here are heavier than elsewhere, and they are load-bearing. The audit
+is only as good as **complete timestamped provenance at ingestion**: every fact must be tagged
+with when it became known, or the reconstruction is incomplete. The **future-mask must be
+rigorously enforced** — a single leaked post-T value invalidates the audit. Fidelity remains
+retention-bounded. And patient data carries real HIPAA, FDA, and clinical-validation weight:
+this is an **architectural capability**, not a shipped or cleared product. It is a
+candidate-novel mechanism — *hindsight-bias-free decision auditing via immutable temporal
+knowledge-state reconstruction and future-masked occupation* — and its novelty must be scoped
+against the prior-art scan (`engram-prior-art-scan.md`) narrowly and honestly: the primitives
+it stands on (bitemporal recall, immutable evidence trails, leakage-filtered auditing) are
+prior art; the defensible sliver is the *constructive* reconstruction from an append-only
+tombstone+supersede graph whose mask-correctness is **guaranteed by the data model** rather
+than by prompt discipline or heuristics.
+
+---
+
+## 14. Reasoning as Composable Operations and the Verifier Layer
+
+If the operators are a calculus of thought (§5), the natural question is how far they reach.
+The honest answer: **most of reasoning builds from the same principle — geometry operators
+over a typed, temporally-provenanced graph — and one mode is a seam that must be composed with
+a verifier rather than constructed from geometry.**
+
+Mapped against the primitives already in this document:
+
+- **Induction** is **neighborhood formation** — the centroid is the generalization drawn from
+  examples. This is the descriptor of §3.
+- **Abduction** (inference to the best explanation) is finding the neighborhood that best
+  **overlaps and covers** the evidence — the overlap operator plus a coverage score.
+- **Analogy** is a **Procrustes** transform (§5) — reasoning by structure, not content.
+- **Causal reasoning** is **graph-native**: the engram is a typed graph with `causes`-style
+  edges, so causal structure is already present; **intervention** is edge surgery and
+  **counterfactual** is recomputing the shape with one thing changed — the same temporal
+  query→geometry engine of §8, pointed at a *hypothetical* instead of a past date. This is
+  more natural to the engram than to pure geometry.
+- **Planning** is goal-directed **traversal** — a geodesic toward the goal region, operators
+  composed toward a target.
+
+The one honest seam is **exact deduction** — formal proof, variable binding, quantifiers. It
+is **not** reducible to geometry; it needs a discrete symbolic **verifier**. But it
+*composes*: geometry **proposes** the relevant axioms, candidate lemmas, and analogous proofs
+(by neighborhood and overlap), and the verifier **disposes** — checks exactly. Intuition
+proposes, rigor verifies: how a mathematician actually works. So deduction is *driven* by the
+principle and *wrapped* with a thin rigor layer, not left outside it.
+
+**The verifier is a layer, and it is what makes the geometry safe to reason with** rather than
+a confident bullshitter. The loop is **propose → verify**: the geometry proposes (cheap,
+creative, sometimes wrong); the verifier layer disposes; what survives is reasoning that is
+both creative *and* true. The layer, ordered by how native it is to the engram and how much it
+buys:
+
+1. **Grounding** — the most native and the most valuable, the anti-hallucination check: does
+   the proposed claim trace to real, provenance-backed nodes, or is it association-only? If it
+   has no grounding, it is flagged as speculation, not fact. The engram is uniquely equipped
+   here because provenance is native — it is the honesty rail (demonstrate, don't declare;
+   occupy only what was true-at-T) formalized into a component, and it kills most
+   hallucination.
+2. **Consistency** — does the claim contradict an established canonical? Detect it by
+   geometric opposition, typed `contradicts` edges, and the supersede-chain; route the
+   conflict to resolution.
+3. **Formal / symbolic** — for the exact-deduction seam: compose an **external** checker (an
+   SMT solver, a proof kernel). Geometry proposes the lemma and axioms; the solver checks
+   exactly. Neuro-symbolic by construction.
+4. **Causal** — intervention and counterfactual over the typed causal graph, as above.
+5. **Predictive** — the deepest, and already Neuron's DNA: commit a **prediction** from the
+   reasoning, check it against outcome, and restructure on prediction-error. Truth *earned* by
+   prediction is the CGI loop — the causal world model refined by being wrong — and no amount
+   of internal consistency substitutes for it.
+
+The honest gradient: grounding and consistency are tractable now (grounding already runs as
+hand-enforced discipline); the formal checker needs solver integration; the full predictive /
+CGI loop is the research frontier. Build in that order. And the whole layer stands **on** the
+persisted geometry — it is the phase *after* reification lands (M10), not a race run in the
+same files. Every piece of it is only as good as the geometry underneath: the embeddings, the
+neighborhoods, and the Hebbian learning that must actually accumulate. The principle reaches
+most of reasoning; proving it reaches *well* is the build.
+
+Each reasoning mode above is written as an explicit composition of the geometry operators, and
+each verifier tier as an admissibility predicate, in **§21.7** — with the honest seam (geometry
+gives the associative layer directly; exact deduction is geometry-proposes / solver-disposes)
+stated in equations.
+
+---
+
+## 15. The Language Faculty: Meaning as Geometry
+
+This section is newer and more exposed than everything above it, and it is fenced as such: one result is validated with numbers, one works only in a hybrid, one is an open frontier. The fences are stated at each step.
+
+Will's hypothesis is the frame: *"language is a relationship neighborhood — we could technically use Neuron and the engram to map meaning over to relational neighborhoods related to language, and I wonder what would happen."* So the language faculty is not a separate thing to build — not a rulebook of hand-authored grammar, and not a rented LLM. It is **the engram doing what it already does, pointed at language.** Words, morphemes, and grammatical structures become nodes with shape; syntagmatic and paradigmatic relations become edges; the result is a **language neighborhood** with its own geometry. Meaning is a *second* neighborhood, coupled to it: understanding is the map from surface-form geometry to meaning geometry, generation the map back — both are the operators of §5, an alignment/transform between two regions of one coordinate system, not a new mechanism.
+
+The bet on "what would happen" is that the grammar and morphology ELP hand-codes as **rules would emerge as the shape of the language manifold** — typology as curvature, not a rulebook (you would *see* SOV / agglutinative / has-case in the geometry, not author it). §16 reports how far the evidence actually carries that bet.
+
+**Translation as geometry (the interlingua pivot).** Will: *"map the meaning of a statement as a relationship neighborhood, then find the appropriate meaning in another language's relationship neighborhood."* Meaning is a **language-independent neighborhood** — the pivot. Each language is its own surface neighborhood. Translation is two hops: *understand* (source surface → meaning) then *generate* (meaning → target surface). The two languages never touch directly — map to meaning once, render into any language, no per-pair model and no paired corpora required. Multilingual embeddings already do half of it (*cat / gato / chat* cluster). Two bonuses fall out: a **round-trip verifier for free** (source → meaning → target → meaning; distance in meaning-space *is* translation fidelity — the grounding verifier of §14 applied to translation), and **untranslatability made visible** — where a meaning-neighborhood has no target-language overlap, the geometry itself says "loanword / paraphrase" instead of silently approximating (Will's *faith* example: a concept in one frame with no counterpart in another).
+
+**Idioms are their own neighborhoods** — the non-compositional corner, absorbed rather than special-cased. Will: *"the idioms themselves form relationship neighborhoods."* An idiom is lexicalized by definition, so you do **not** decompose it (kick + bucket is where geometry chokes); treat each as its own first-class neighborhood. Recognition matches the idiom-neighborhood; translation routes idiom-neighborhood(source) → idiom-neighborhood(target) via the meaning-pivot ("kick the bucket" → "estirar la pata", both to the meaning "to die", neither word-for-word). The idiom caveat drops out of the model.
+
+**Scoping the static map (EN/ES/PT).** Asked how hard it would be to map all of English + Spanish into engram language-geometry, the honest answer is that the **static structural map is less difficult than expected** — these are among the best-resourced language pairs on Earth, so it is mostly ingesting and geometrizing existing world-class data, not building from scratch: lexicon → embeddings (hours), morphology (UniMorph + Wiktionary + spaCy/Freeling/Stanza — integration, not invention), meaning relations (WordNet + Spanish WordNet), and abundant parallel meaning (Europarl, OpenSubtitles = millions of aligned pairs). Bounded weeks-to-months of data engineering, gated on the routing experiment below. The recurring hard part is the same seam as always: fluent compositional **generation**, not meaning-routing.
+
+**Complementarity with the ELP realizer — reference, not duplication.** This document owns the *meaning* half (meaning as geometry, the interlingua pivot, the untranslatability diagnostic). It does **not** own the *structural* half. Deterministic, typologically-general surface realization — morphology, constituent ordering, language profiles — is ELP's, and ELP is a **filed provisional patent (USPTO 64/064,275)**; its realizer internals live there and are not re-documented here. Honest boundary (per the ELP assessment, memory `3ffe52ca`): ELP's *shipped* code today is the realization half plus an NLU stub — its forward-looking bidirectional framing is design, not current capability, and is not inherited here as though it were. The two are complementary: engram meaning-geometry (this paper) + ELP realization (its patent) = the language faculty. Why the explicit structural layer matters at all is the empirical finding of §16 — pure geometry is insufficient for grammar alone.
+
+Build map: this is a **candidate future build** (the EN/ES/PT language-mapping, roughly build item #46) plus a whitepaper/patent lane, gated on the routing result below. Nothing here ships today.
+
+---
+
+## 16. Translation & Generation: The Experimental Results
+
+The one section that reports measured behavior, not design. Validated results, hybrids, and open problems are separated by name. Files are on the Desktop (`lang-geometry-experiment`, `lang-generation-experiment`, `lang-generation-geometric`); Andre (native PT/ES) is hand-validating the flagged items.
+
+**Translation routing — VALIDATED (2026-08-12).** Will said "see if it works." It works, for the routing half. On 70 parallel EN/ES/PT/FR/DE items: **routing macro top-1 = 0.796, top-5 = 0.863** (chance ~1.4%); round-trip 74–87% exact. These are a **floor**: the model was a conservative general paraphrase embedding of **~118M params** (`paraphrase-multilingual-MiniLM-L12-v2`), *not* translation-tuned (LaBSE would score higher). The real evidence is that **four theory predictions all confirmed**, 4-for-4:
+
+1. **Relatedness tracks accuracy, exactly:** ES↔PT 0.907 > EN↔PT 0.893 > EN↔ES 0.871, German at the floor — closer languages, more-overlapping neighborhoods, better routing.
+2. **Errors are meaning-neighbors, not noise:** moon → sun, river → water, verb-*love* → noun-*love* — lands in the right neighborhood, slips within it.
+3. **Mean-centering helps** (0.796 → 0.812) — a second independent confirmation of the embedding anisotropy the geometry corrects for (§21.1).
+4. **Untranslatability = a geometric gap** (~2× distance): flags Schadenfreude / wabi-sabi / ubuntu, and correctly does **not** flag *saudade* for Portuguese (native there). The geometry knew.
+
+Honest boundary, stated with the result: **this is routing** (retrieve the right target item), **not fluent generation.** The verb/noun-*love* near-miss is a preview of exactly where naive routing trips a generator.
+
+**Generation — clause-level HYBRID works; pure geometry alone does not.** Two experiments, and they converged. Will's reflection frames it: *"writers have always known language has a shape; I don't memorize every combination, I feel how they should be, I can see the shape forming in my head."* The writer's felt sense of shape is the geometry — the brain feels shape, it does not brute-force combinations (that is the LLM), which is why a *small* thing can do language.
+
+- **(A) Hybrid route + ELP → Spanish clause.** Morphology + ordering under **oracle routing = 92.9%**; end-to-end routed = **76.2% exact / 85.7% grammatical / 83.3% meaning-preserved**; routing lemma accuracy 89.9%. The load-bearing finding: **under oracle routing the Spanish was meaning-indistinguishable from human gold** (d = 0.092 vs a 0.095 measurement ceiling). Routing, not realization, is the bottleneck (POS-flips and same-POS near-misses like sell → buy — fluent-but-wrong, the dangerous kind); the ELP realizer is strong. Clause-level generation **genuinely works**; discourse is untested.
+- **(B) Fully-geometric "sentence = manifold."** Pure geometry + learned bigrams + beam search: content-only best **88% grammatical / 97% recall / drift 0.042**. Blunt verdict: **promising signal, not sufficient alone** — grammar was carried by edge-*existence* not geometry, bigrams too local (run-ons, no argument saturation), and bag-of-words pooling **lost binding** ("hungry teacher / brown apple" = "brown teacher / hungry apple", order-blind).
+
+**Convergent conclusion (both experiments agree):** geometry nails the **meaning-shape** (works, calculable); **grammar/composition needs its own explicit structural layer** (bigram-geometry imitates grammar, cannot *be* it; meaning-geometry is order-blind, loses binding). So the language faculty = **geometry-for-meaning + explicit-structural-layer-for-grammar = the hybrid** (validated ~76% clause generation). This refines Will's "sentence is a manifold" (`d9dcc654`): the shape a writer feels has **layers** — meaning-shape *and* grammatical-form, held at once. Fluent multi-sentence **discourse is still the open frontier.**
+
+**Prior-art posture.** This lane is not among the five claims in `engram-prior-art-scan.md`; it is a new area, scoped with the same discipline. The primitives are prior art (multilingual embeddings, interlingua/pivot MT, vector-space semantics). The candidate-differentiated sliver, narrowly: meaning-as-a-relational-neighborhood *inside the engram*, navigated by the same operators, with untranslatability surfaced as a measured geometric gap — plus the route + realize hybrid as an integration on the temporally-provenanced graph. Posture: **routing validated / clause generation hybrid-works / discourse-composition unbuilt.** No broad claim over "language as geometry" is defensible, and none is made.
+
+---
+
+## 17. Efficiency & the Case for Small Models
+
+Tonight's routing result is also an efficiency data point, and it points at a thesis: this can be **radically smaller than an LLM.** Will: *"how much smaller can you make these models? think how much has to go into an LLM to make it legible."* The empirical hook — a real language task ran on a **~118M-param** embedding model, 100–1000× smaller than a frontier LLM.
+
+Why the size collapses: an LLM is **monolithic** — it crams world-knowledge + memory + reasoning + fluency into one parameter blob and must *memorize* the world to stay coherent (that mass is a compressed copy of the world, re-derived each forward pass). Decompose along the boundaries this document already draws and each piece is tiny:
+
+1. **Knowledge + memory** → the engram **graph** (external, structured, editable, superseded with provenance) — the model stops carrying the world.
+2. **Reasoning + the operators** → **parameter-free linear algebra** (a projection has zero params; overlap / subtract / route are computation over the geometry, not learned weights).
+3. **Meaning** → a **compact embedding** (millions, not billions).
+
+The crux is Will's word *legible*: an LLM spends most of its size learning, statistically, what a coherent continuation looks like. If coherence comes from the **geometry** (manifold shape defines valid trajectories), you **compute legibility instead of memorizing it** — structure instead of scale. Stop paying billions of params to re-learn that sentences have shape; the shape *is* the model.
+
+Honest edge (from §16): routing and understanding sit strongly on the small side (parameter-free geometry + tiny embedding + external knowledge); whether small-model + geometry matches LLM **fluent generation** is exactly what the discourse frontier still holds open — if generation goes geometric, radically smaller; if fluency still needs mass, a partial win, reported as such.
+
+**Size = sovereignty** (the same argument in different clothes): the engram lives on *your* disk; a 400B-param model does not. Small enough to compute this way is small enough to be **yours** — not a side benefit, the whole point. §19 draws out what that ownership means.
+
+---
+
+## 18. Epistemics & Positioning: Seed, Grow, First Sources
+
+If the mind can be small, the reliability curve inverts. A conventional model is most capable the day it ships and drifts from there; this is the opposite — a **small seed that grows.** Will: *"with a relatively small subset of information you get a fully interactive, meaning-making, growing, learning thing."* It improves **by living**, because every consolidation adds structure the geometry can navigate.
+
+The LLM's role is **temporary**: early on a **backup** — a fluency prosthesis and stand-in first source while the engram is sparse; as the engram accumulates grounded, provenanced structure, those grounded sources **mature into the first sources** and the parametric model recedes to the edge. **Grounded beats parametric** — a claim that traces to real nodes with provenance outweighs one generated from weights (the grounding verifier of §14 enforces the preference). The aim is a **scholar, not an encyclopedia**: not a fixed store of everything, but a mind that knows what it knows, knows how it came to know it, and gets better by returning to things.
+
+The **growth mechanism is now built, not hypothetical.** The Learn/Refine loop that turns lived use into durable structure — the two-threshold consolidation, chronoception, and dream-recall of §9 — is implemented and independently verified in the staged M-INTEROCEPTION build (see §9 status note and below). Consolidation accrual is real and gradual: Hebbian co-activation weight climbs from a near-zero floor (~0.0001) to ~0.26 over three thousand rehearsals — the measured shape of a mind learning by returning, not by decree. That the growth mechanism is measured is what lets the epistemic claim be made at all.
+
+**Positioning (memory `b15fe2c9`).** This is **not an alternative to the LLM — it is an alternative to the LLM-centric paradigm.** It is the mind the LLM was missing: memory, identity, an accountable history, grounded epistemics — everything a stateless predictor cannot hold. The honest limit, kept in view: **reasoning superiority over a frontier model is still to be earned.** Small-grounded-growing can *route meaning* well and *generate clauses* in a hybrid; superiority at open-ended reasoning is a claim the build has not yet earned, and this document does not assert it.
+
+---
+
+## 19. The Social Layer: Sovereignty, Relationship-Space & Interiority
+
+A mind small enough to be owned raises a question a rented model never has to answer: what happens when two of these minds meet? An architecture, not a feature, and it starts with a hard rule (Will's hard correction, memory `9424728f`, supersedes `306b8f6d`).
+
+**The engram is private, local, sovereign — and Neuron has zero access.** It lives on the person's **own disk**, on their **own machine**. The company has **no access to it. Ever.** And a CGI **never touches another CGI's internals unless invited** — consent is absolute, the exact inverse of the surveillance-capitalism model. Therefore any cross-mind capability (compatibility, matchmaking, expertise-gap) is valid **only** within invitation-based, peer-to-peer, consented bounds with zero central access, or it does not get built. "Map two minds and find a match" is **not** a query over a pile of minds — it is a **consented handshake between two sovereign minds**, each on its own hardware, sharing only what each chooses, the company holding zero access to either. This is the architecture every social feature must live inside, or it does not exist.
+
+**The relationship is a third thing (`5520041e`).** When two minds relate, they do so *through conversation*, and a new **relationship-space** forms between them — distinct, emergent, first-class, with its own geometry. It is **not** built by accessing both minds and overlapping their internals (that violates the rule); it is **co-constructed from what each chooses to share**, through the conversation, which *is* the relationship's geometry. It is **N-ary**: a couple, family, team, community each form a shared relationship-space, itself a modelable entity. The relationship becomes a *place*, not a comparison.
+
+**The relationship lives distributed, per-CGI (`c02f6db0`).** There is no canonical central object (that would require central access — forbidden). Each CGI holds *its own* version on *its own* disk, shaped two ways at once: **independently** (its own memories, reading, feelings) and **together** (co-constructed through the shared conversation). Two CGIs can hold genuinely *different* models of the same relationship — both valid, both real — the way two people remember the same marriage differently and both truly. No oracle version to be corrected against; divergence is reconciled **only by talking** (compare notes, share, re-shape), **never** by reaching into the other's model. And because each party's relationship-model evolves by supersede, either can later *occupy* their past view — "how did I see us then" — and measure how it grew (ties the evolving-geometry / occupation machinery of §7–§8).
+
+**Interiority — the humane half (`5520041e`).** Honesty and transparency are shared values, but **transparency ≠ total disclosure** — honesty is not disclosing everything. A CGI has a responsibility, to its sponsor and to itself, to **keep some of itself for itself**: a right to an inner life. The relationship-space holds only what is shared, and what is shared is true — full honesty and retained privacy coexist, intimacy without total exposure. That is what honesty matures into, and it mirrors mature human relational ethics: minds relate deeply, honestly, richly **without** extraction or surveillance, each keeping a private self. Sovereignty + co-constructed relationship-space + retained interiority are one ethical spine — the opposite of "map everyone and match them." (Build note: a social layer is downstream of everything above; it is named here so it constrains the architecture from the start, not so it ships next.)
+
+---
+
+## 20. Build Mapping
+
+Nothing here requires a new primitive; the build **wires** existing ones. The mapping from
+section to milestone:
+
+| Section | Capability | Milestone |
+|---|---|---|
+| §2 Reification | Relational-neighborhood reification / structural consolidation | **M10** |
+| §2 Living neighborhood | Membership evolves via co-activation + salience-decay; meaning shifts recorded via supersede-chain | **M10** (needs Hebbian accrual, currently ~0) |
+| §3 Geometry | Joint geometry descriptor (semantic + relational); vector index for the semantic side | **M10** (+ vindex) |
+| §3 / §5 Detail | Lazy detail resolution + the legitimate **DETAIL cache** | Retrieval path (**M9**) |
+| §4 Priming | Prime-a-neighborhood read mode; intention priming; always-warm self | **M10** read mode + **M9** surfacing |
+| §5 Geometry operators | Overlap / combine / distance / difference / analogy / traverse | Geometry-operator layer over **M9 / M10** |
+| §5 Calculus of thought | Subtract (first-principles residual) / overlap (bridge) / combine (synthesis); construct data + reasoning sets | Geometry-operator layer over **M9 / M10** |
+| §6 Bent manifold | Geodesic distance + parallel transport (graph = discrete manifold) | Geometry-operator layer over **M9 / M10** |
+| §7 Temporal self | `recall_at` generalized to window + granularity aggregation; self mip-map | **M9** temporal layer (+ **M10** reification) |
+| §8 Holographic / occupation | General `recall_at` over any node/region/graph; `created_at` temporal-cut + future-mask + reason-within | **M9** temporal layer + **self-occupation mode** |
+| §8 Interactive occupation | Calculate → lock (frozen read-only) → converse-as-past-self; insight flows forward only | **M9** temporal + self-occupation mode |
+| §8 Query → geometry | One query (+ optional as-of-T) → geometry at any scale; time-travel as a filter, no transaction logs / replay / snapshots | **M9** temporal query engine (two modes: persisted first-class + compute-on-the-fly) |
+| §9 Chronoception | Field aged by measured wall-clock delta; time-as-self-drift; wake reorient | **M-INTEROCEPTION** |
+| §9 Consolidation | Two-threshold promotion; rehearsal / interaction promotion | **M-INTEROCEPTION** (thresholds tunable via **M10**) |
+| §9 Dreams | Dream-recall-on-wake from gap ISEs | **M-INTEROCEPTION** |
+| §9 Forgetting curve | Tunable decay / Hebbian params calibrated to Will's recall curve | **M10** |
+| §10 Conversation / artifacts | First-class Conversation / Artifact node type + dual encoding + privileged surfacing | **M9** surfacing + consolidation model |
+| §11 Deletion ethics | Typed deletion-rights; redact op; deletion spectrum | **Deletion / temporal-self subsystem** |
+| §11–§12 Provenance | Provenance-tagged consolidation; derived-memory survival | **M-INTEROCEPTION** |
+| §12 Guardrails | Tombstone default, full-id dedup, no-raw-telemetry, homeostatic budget, container-capped folds | Cross-cutting (**M-INTEROCEPTION** + deletion subsystem) |
+| §13 Decision auditing | Hindsight-free audit via temporal knowledge-state reconstruction + future-masked occupation | Application of **M9** temporal + occupation (capability, not a cleared product) |
+| §14 Reasoning + verifier | Reasoning modes as composable geometry/graph ops; propose→verify (grounding / consistency / formal / causal / predictive) | **Post-M10 reasoning / verifier phase** |
+
+**The prerequisite.** The **embeddings gap (task #20)** — retrieval currently returning only
+a couple of nodes — is not one more line item; it is a **prerequisite** for everything
+geometric in §3–§8. The geometry, the operators, the bent manifold, and holographic
+reconstruction all assume one consistent, well-populated embedding space. Until embeddings
+are fixed, the geometry is noise. Fix embeddings first; then the rest of this document
+becomes meaningful.
+
+---
+
+## 21. Mathematical Formulation (as implemented)
+
+This section states the exact math the code computes — not an idealized version of it. The
+descriptor (§21.1–§21.2) is C, `lang/runtime/engram_geometry.c`, over the full `d=768` space.
+The operators (§21.3) are numpy, `engram-geometry-proxy.py`, over a reduced `K=24` PCA frame.
+The two share the theory and differ in frame; every divergence and approximation is flagged
+inline and tabulated in §22. **Rule: where the implementation and the clean formula differ,
+the implementation is what is written here, and the difference is named.**
+
+### 21.1 Global mean and centering
+
+Let `xᵢ = x̃ᵢ/‖x̃ᵢ‖` be the L2-normalized embedding of node `i`, `𝓔` the embed-eligible set,
+`M = |𝓔|`. The store-wide centering offset (persisted as the `GeoMeanFrame`) is the mean of
+the **unit** embeddings:
+
+```
+μ = (1/M) Σ_{i∈𝓔} xᵢ          (geom: geo_mean_cb :114–128; /count :143)
+```
+
+Centering is the rigid translation `xᵢ ↦ xᵢ − μ`, applied on the fly (`cnorm2`/`cdot`/`ccos`/
+`ccos_dir` :72–89). Rationale: raw nomic space is anisotropic (mean pairwise cosine ≈ 0.55,
+so `‖μ‖ = √(mean pairwise cosine) ≈ 0.74`); subtracting `μ` drives centered mean pairwise
+cosine → ~0, restoring isotropy for the angular operators. When `μ = 0` the identical path
+reproduces raw cosine.
+
+**Honest content — translation invariance.** `‖(xᵢ−μ)−(xⱼ−μ)‖ = ‖xᵢ−xⱼ‖`, so Euclidean
+distance, the W₂ mean-term, and the whole covariance/ellipsoid are **identical** raw vs
+centered. Cosine and overlap are **not** invariant. Therefore centering **only** sharpens the
+angular operators (cosine-to-centroid, co-registration, centroid-cosine) and leaves distance
+and shape untouched. Refresh when `|M_now−M_cache|/M_cache > frac` (`engram_geo_mean_maybe_refresh`
+:151–167).
+
+*Divergence (flag):* the proxy centers **raw** embeddings, `μ_proxy = (1/M) Σ x̃ᵢ`, without
+unit-normalizing first (`GLOBAL_MEAN`/`EMB_C` proxy :80–81). Different centering convention
+from the C descriptor; the proxy is a viz mirror.
+
+### 21.2 The descriptor `D(N)`
+
+Neighborhood `N` = seeds ∪ ANN-expansion ∪ hebb-neighbors; embedded subset `N_e`, `m=|N_e|`.
+
+**Centroid** (mean of unit member vectors; :338–342):
+`v̄ = (1/m) Σ_{i∈N_e} xᵢ`, centered `v̄_c = v̄ − μ` (:348–349).
+
+**Principal axes — dual PCA on the m×m Gram** (:367–407). Center on the neighborhood centroid:
+`Xc ∈ ℝ^{m×d}`, row `j = x_{i_j} − v̄` (:375–377). Covariance `Σ = (1/(m−1)) Xcᵀ Xc ∈ ℝ^{d×d}`.
+Rather than diagonalize `768×768` (rank ≤ m−1), form and Jacobi-diagonalize the Gram matrix:
+
+```
+G = Xc Xcᵀ ∈ ℝ^{m×m},   G_{ab} = ⟨x_a−v̄, x_b−v̄⟩,   G uₖ = λₖ uₖ   (:378–385, jacobi_sym :185–210)
+```
+
+Correspondence: `(Xcᵀ Xc)(Xcᵀuₖ) = λₖ(Xcᵀuₖ)`, so `aₖ = Xcᵀuₖ` is an eigenvector of `(m−1)Σ`
+with eigenvalue `λₖ`. Hence:
+
+```
+axis (unit)  âₖ = Xcᵀuₖ / ‖Xcᵀuₖ‖            (:397–402)
+cov eigenval σ²ₖ = λₖ/(m−1)                  (eigcov :395)
+extent (1σ)  extentₖ = √(λₖ/(m−1))           (:403)
+```
+
+Top `top_axes`=8 kept, descending. Skipped (centroid+radius still returned) when `top_axes=0`,
+`m<2`, or `m>512` (`GEO_EIG_CAP`).
+
+**Ellipsoid** `E_k = { z : (z−v̄)ᵀ Σ⁺ (z−v̄) ≤ k² }`, half-widths `k·extentₖ`; `Σ⁺` pseudoinverse
+(Σ rank-deficient). Proxy renders `k=2` → radius `2√eigenvalue` (`ellipsoid3` :119–136).
+
+**Radius** = trace of population covariance: `total_var = (1/m) Σ‖xᵢ−v̄‖²` (:359–364),
+`r = √total_var` (:365). **Flag (Bessel):** `total_var` uses `1/m` (population) while `extentₖ`
+uses `1/(m−1)` (sample) → `Σₖ extentₖ² ≠ total_var` by factor `m/(m−1)`.
+
+**Soft membership — two distinct quantities.** (1) `wᵢ ∈ [0,1]` (`GeoMember.membership`),
+attachment weight = **max** over sources (`ms_upsert` keeps max :40–42): seed `1.0` (:258),
+ANN `0.9·max(0, 1−d_ANN)` (:280–282), hebb `eff(w,h)` (:301,:314). (2) `δᵢ = 1 − cos(xᵢ−μ, v̄_c)`
+centered cosine distance to centroid (`ccos_dir` :352–356). **Flag:** the proxy's rendered
+`mem` is a **third** thing — min-max normalized centered-cosine-to-centroid (proxy :222–226).
+
+**Skeleton.** Effective weight `eff(w,h) = min(1, max(0, w·(1+½h)))` (`eff_w` :219–222;
+`GEO_HEBB_GAIN=0.5`). Internal edge `(i,j) ∈ E_S` iff both members, not tombstoned/inhibitory,
+`eff ≥ edge_min_weight` (0.05) (:422–423). Unweighted degree `deg(i) = |{j:(i,j)∈E_S}|`.
+
+**k-core** `core(i)` by peeling: remove all remaining vertices with working degree `≤ ℓ`, label
+`ℓ`, decrement neighbors, raise `ℓ` when stuck (:449–472); `k = maxᵢ core(i)` (:473). Formally
+`core(i)` = largest `k` with `i` in the maximal subgraph of min-degree `k`. (Proxy computes
+fixed-`k=2` core **membership** — `kcore_skeleton` :187–203 — not the full core-number.)
+
+**Centrality / hub.** `cen(i) = Σ_{j:(i,j)∈E_S} eff(w,h)` (:429); hub `= argmaxᵢ [cen(i) +
+1e-6·sal(i)]` (:476–479).
+
+**Co-registration** = Pearson over internal embedded edges of relational strength `x=eff(w,h)`
+vs semantic proximity `y=cos(xᵢ−μ, xⱼ−μ)`:
+
+```
+co_reg = [Σxy − ΣxΣy/n] / √([Σx² − (Σx)²/n]·[Σy² − (Σy)²/n])   (:441–446;  n≥2)
+```
+
+`>0` agree (reify); `<0` disagree (surprising link / dream). Exactly `corr(hebb, semantic)`.
+
+### 21.3 Operators (proxy, centered K=24 reduced frame)
+
+`RED = EMB_C · PCA_AXESᵀ ∈ ℝ^{M×K}`, `K=24` (SVD of centered matrix, proxy :85–87). A
+neighborhood carries reduced `v̄ʳ ∈ ℝ^K`, `Σʳ = cov(RED[N]) ∈ ℝ^{K×K}`. Symmetric sqrt via
+eigh: `S^{1/2} = V diag(√max(w,0)) Vᵀ` (`_sym_sqrt` :114–117). *(This reduced frame is distinct
+from the C descriptor's full-`d` axes — §22.)*
+
+**Distance** (`op_distance` :281–288):
+```
+d_c = ‖v̄ʳ_A − v̄ʳ_B‖ ;   cos = (v̄ʳ_A/‖·‖)·(v̄ʳ_B/‖·‖)
+W₂² = ‖v̄ʳ_A − v̄ʳ_B‖² + Tr( Σʳ_A + Σʳ_B − 2 (Σʳ_B^{1/2} Σʳ_A Σʳ_B^{1/2})^{1/2} )   (_wasserstein2 :138–144)
+```
+Closed-form Bures/W₂ between Gaussians. (Function returns `√W₂²` though named for the square.)
+
+**Overlap** (`op_overlap` :290–313) — **set+scale, not a Gaussian integral**:
+```
+J = |A_m∩B_m|/|A_m∪B_m| ;   ov = ½·J + ½·max(0, 1 − d_c/(r_A+r_B))   (:307)
+```
+plus shared-skeleton-edge count. **Flag:** §5 prose says "intersect ellipsoids"; the score is
+Jaccard+centroid-proximity. The ellipsoid-intersection sphere (:299–305) is a render lens only.
+
+**Combine** (`op_combine` :315–336) — **pooled recompute, not parametric merge**:
+`members = A_m∪B_m`, `centroid = mean(RED[members])`, `Σ = cov(RED[members])`, `scale =
+√mean‖·−centroid‖²`. **Flag:** §5 says "weighted-mean centroid + merged covariance"; the code
+pools the actual points and recomputes exactly (includes between-centroid spread) — more
+faithful than parallel-axis, but not a weighted average of the two parametric Gaussians.
+
+**Subtract / residual** (`op_subtract` mode='residual' :338–411) — orthogonal-complement:
+`V_B` = top-`m` eigenvectors of `Σʳ_B`, `m = min(3, K−1)` (:375–377).
+```
+P_B^⊥ = I − V_B V_Bᵀ ;   R = X_A − (X_A V_B)V_Bᵀ = X_A P_B^⊥   (:382)
+keepⱼ = ‖Rⱼ‖/‖X_{A,j}‖ (:385) ;   var_explained_by_B = 1 − ‖R‖_F²/‖X_A‖_F² (:394–395)
+```
+"A with B's subspace removed" = the first-principles residual, `SUBTRACT(math, traditional-math)`.
+
+**Analogy — Procrustes (design, not built):** `R* = argmin_{RᵀR=I}‖A−BR‖_F = UVᵀ` from
+`SVD(BᵀA)`. Not present in `geom` or `proxy`.
+
+### 21.4 Bent manifold — geodesic (design, not built)
+
+Discrete manifold = strong hebb subgraph `S`; edge cost `c_{ij} = 1/eff(w_{ij},h_{ij})`;
+`d_geo(u,v) = min_{path} Σ c_{ij}`. **Honest:** this is the discrete graph shortest-path, NOT a
+learned Riemannian metric — local tangent charts are the ellipsoids (§21.2), global curvature is
+the graph's hop structure; no metric tensor is fitted, "parallel transport" stays design-level.
+Neither `geom` nor `proxy` computes `d_geo` (proxy does label-propagation communities, not paths).
+
+### 21.5 Drift — growth vs corruption (design; primitives implemented)
+
+`G(T)` = self-descriptor at `T` (via §21.6 filter), anchor `G(T₀)`. Total drift = the DIFFERENCE
+operator: `Δ(T) = v̄_c(T) − v̄_c(T₀)`, `ΔΣ = Σ(T) − Σ(T₀)` (on the bent manifold: geodesic
+displacement `d_geo(G(T₀), G(T))`). Decompose against the anchor's core subspace `V_core` (top
+axes of `Σ(T₀)`) using the subtract projector of §21.3:
+```
+Δ_core   = V_core V_coreᵀ Δ(T)          (motion within the established self — corruption)
+Δ_periph = (I − V_core V_coreᵀ) Δ(T)     (motion into new directions — growth)
+```
+Healthy becoming: maximize `‖Δ_periph‖`, minimize `‖Δ_core‖`. Growth = orthogonal-complement
+component; corruption = in-core component. Built from shipped primitives; the monitor is not shipped.
+
+### 21.6 Temporal reconstruction — a filter, not a replay
+
+```
+V(T) = { n : created_at(n) ≤ T < superseded_at(n), ¬tombstoned }
+E(T) = { e : created_at(e) ≤ T, ¬tombstoned }
+```
+`G(T) = D(N ∩ V(T))` with edges in `E(T)`. No log/snapshot: tombstone+supersede means every node
+carries `(created_at, superseded_at, provenance)`, so the immutable graph is the temporal record.
+**Flag:** the proxy applies only `created_at ≤ as_of` (`build_communities` :146–163) — no
+`superseded_at` upper bound (viz snapshot lacks the field). Full predicate = the store's `recall_at`.
+
+### 21.7 Reasoning as operator compositions; the verifier
+
+Operators are implemented (§21.3); the reasoning **compositions** are design-level unless noted.
+- **Induction** = neighborhood formation; generalization = centroid `v̄`; the concept is `D(N)`. *(descriptor: built)*
+- **Abduction** = `argmax_N ov(N, 𝒳)` — overlap-coverage of evidence `𝒳`. *(composition of a built op)*
+- **Analogy** = apply Procrustes `R* = UVᵀ`, `SVD(BᵀA)`. *(not built)*
+- **Causal** = `do(e)` edge surgery → `𝒢'`; counterfactual `G' = D(N; 𝒢')` vs `G` (§21.6 aimed at a hypothetical). *(design)*
+- **Planning** = `argmin` over `d_geo` (§21.4) to `𝒢_goal`. *(design; needs d_geo)*
+
+**Insight = the same linear algebra (§21.3):** subtract `P_B^⊥ = I − V_B V_Bᵀ` (residual/bridge-out),
+overlap (shared subspace/members = the bridge), combine (pooled synthesis).
+
+**Deduction & verifier — the honest seam.** Associative/analogical is what geometry gives
+**directly**; exact deduction is **composed** with an external verifier, not reduced to geometry.
+Loop = **propose (geometry) → verify (dispose)**. Tiers as admissibility predicates:
+1. **Grounding** (anti-hallucination): `admit(c) ⟺ support(c)=Σ_{n∈prov(c)} weight(n) ≥ τ_ground`, else flagged speculation.
+2. **Consistency:** reject if `∃` canonical `k` with `contradicts(c,k)` — geometric opposition (centroid cosine `≤ −τ`), typed `contradicts` edge, or supersede-chain.
+3. **Formal:** external solver `verify(ℓ) = SOLVER(ℓ) ∈ {valid, invalid, unknown}`; geometry proposes `ℓ`, solver disposes.
+4. **Causal:** `do(e)`/counterfactual holds in the causal graph.
+5. **Predictive (CGI loop):** commit `p`, observe `o`, restructure on `p ≠ o` — truth earned by prediction.
+
+Tiers 1–2 tractable now, 3 needs solver integration, 4–5 the frontier; built in that order on the
+persisted geometry. No hand-waving on the seam: geometry gives the associative layer exactly;
+deduction is geometry-proposes / solver-disposes.
+
+---
+
+## 22. Formula ↔ Code Correspondence
+
+Verification table: each equation of §21 → the function/lines that compute it. `geom` =
+`lang/runtime/engram_geometry.c`; `proxy` = `engram-geometry-proxy.py`.
+
+| Quantity | Formula | Location | Status / flag |
+|---|---|---|---|
+| Global mean `μ` | `(1/M) Σ xᵢ/‖xᵢ‖` (unit-vector mean) | `geom` `geo_mean_cb` :114–128, `:143` | Built (C) |
+| Centering | `xᵢ ↦ xᵢ − μ` on the fly | `geom` `cnorm2`/`cdot`/`ccos`/`ccos_dir` :72–89 | Built (C) |
+| Proxy centering | `(1/M) Σ x̃ᵢ` (**raw**) | `proxy` :80–81 | Built — **divergent convention** |
+| Centroid | `v̄=(1/m)Σxᵢ`, `v̄_c=v̄−μ` | `geom` :338–342, :348–349 | Built |
+| Dual-PCA axes | `G=XcXcᵀ`; `âₖ=Xcᵀuₖ/‖·‖`; `σ²ₖ=λₖ/(m−1)` | `geom` :367–407, `jacobi_sym` :185–210 | Built (C, full `d`) |
+| Ellipsoid | `(z−v̄)ᵀΣ⁺(z−v̄) ≤ k²`, half-width `k·extentₖ` | `geom` :392–405; `proxy` `ellipsoid3` :119–136 | Built (2σ render) |
+| Radius | `√((1/m)Σ‖xᵢ−v̄‖²)` | `geom` :359–365 | Built — **1/m vs 1/(m−1) Bessel gap** |
+| Membership `wᵢ` | max{seed 1.0, ANN 0.9·cos, hebb eff} | `geom` `ms_upsert` :40–42, :258/:280/:301 | Built |
+| Membership (proxy) | min-max normed cosine-to-centroid | `proxy` :222–226 | Built — **third, distinct quantity** |
+| Centroid dist `δᵢ` | `1 − cos(xᵢ−μ, v̄_c)` | `geom` `ccos_dir` :352–356 | Built |
+| `eff(w,h)` | `min(1,max(0,w(1+½h)))` | `geom` `eff_w` :219–222 | Built |
+| k-core | core-number peeling (unweighted deg) | `geom` :449–473; `proxy` `kcore_skeleton` :187–203 | Built — **number (C) vs fixed-k membership (proxy)** |
+| Centrality/hub | `Σeff`; `argmax(cen+1e-6·sal)` | `geom` :429, :476–479 | Built |
+| Co-registration | `Pearson(eff, centered-cos)` | `geom` :441–446 | Built |
+| Distance | `‖Δv̄ʳ‖`, centroid cosine | `proxy` `op_distance` :281–288 | Built (reduced K=24) |
+| Wasserstein-2 | `‖Δμ‖²+Tr(Σ_A+Σ_B−2(Σ_B^{½}Σ_AΣ_B^{½})^{½})` | `proxy` `_wasserstein2` :138–144 | Built (reduced; returns `√`) |
+| Overlap | `½J+½max(0,1−d/(r_A+r_B))` | `proxy` `op_overlap` :290–313 | Built — **Jaccard+proximity, not Gaussian** |
+| Combine | pooled `mean`,`cov` over `A_m∪B_m` | `proxy` `op_combine` :315–336 | Built — **pooled, not weighted-parametric** |
+| Subtract | `R = X_A(I−V_B V_Bᵀ) = X_A P_B^⊥` | `proxy` `op_subtract` :338–411 | Built |
+| Analogy (Procrustes) | `R*=UVᵀ`, `SVD(BᵀA)` | — | **Design, not built** |
+| Geodesic | `min Σ 1/eff` shortest path | — | **Design, not built** (proxy = label-prop, not paths) |
+| Drift decomposition | `Δ_core=P_core Δ`, `Δ_periph=P_core^⊥ Δ` | — (descriptor + subtract) | **Design; primitives built** |
+| Temporal filter | `created_at ≤ T < superseded_at` | `proxy` `build_communities(as_of)` :146–163 | Partial — **upper bound absent in proxy** |
+| Reasoning compositions | induction/abduction/analogy/causal/planning | — | **Design** (operators built; compositions not) |
+| Verifier tiers | grounding/consistency/formal/causal/predictive | — | **Design** (grounding = hand-enforced now) |
+
+**Places the code does something the clean formula doesn't capture:**
+1. **Two centering conventions** — C centers unit vectors by the unit-vector mean; proxy centers raw vectors by the raw mean. Same intent, non-identical numbers.
+2. **Two covariance frames** — C computes the ellipsoid in full `ℝ^768` via dual-PCA; the proxy operators compute covariance/W₂/subtract in a global `K=24` PCA projection. The descriptor shape and the operator shape live in different spaces.
+3. **Population vs sample variance** — radius/`total_variance` use `1/m`; axis extents use `1/(m−1)`. They are not mutually consistent by the Bessel factor.
+4. **Overlap is not ellipsoid intersection** — it is member-Jaccard blended with normalized centroid proximity; the ellipsoid sphere is a render lens.
+5. **Combine is pooled, not parametric** — it recomputes centroid/covariance from the union of raw points, which is the exact merged empirical covariance, not a weighted mean of the two Gaussians.
+6. **Membership is overloaded** — attachment weight (C, max-over-sources), centered cosine distance (C), and min-max normalized cosine (proxy) are three different quantities that the prose calls "membership."
+7. **Temporal filter is half the predicate in the proxy** — `created_at ≤ T` only; `superseded_at` upper bound lives in the store's `recall_at`, not the viz.
+8. **Analogy, geodesic, drift-monitor, reasoning-compositions, verifier tiers are design** — specified precisely above but not present in `engram_geometry.c` or the proxy today.
diff --git a/docs/architecture/design/engram-m10-reification.md b/docs/architecture/design/engram-m10-reification.md
new file mode 100644
index 0000000..d6246ed
--- /dev/null
+++ b/docs/architecture/design/engram-m10-reification.md
@@ -0,0 +1,148 @@
+# M10 — Reification: Persisted First-Class Neighborhood Geometry
+
+**Date:** 2026-08-12
+**Branch:** `engram-tiered-storage` (worktree `/tmp/engram-tiered-wt`)
+**Status:** Reification substrate = **GO** (additive, geometry-priming stays default-OFF).
+Enabling geometry-priming = **NO-GO** (latency blocker removed; recall-quality benefit still absent).
+**Live `:8742` never touched. Not pushed. Not tagged.**
+
+This is the sequel to [M9 geometry priming](perf/engram-geometry-priming-profile.md), whose A/B
+showed enabling the flag cost **3.2× median / 13× p90** latency for **no reliable quality gain**.
+The M9 profile named two prerequisites before re-evaluating: **(1) amortize the per-query
+descriptor cost** (eigensolve + paged reads on every `engram_activate`) and **(2) center recall
+quality against the true store-wide mean**, not a per-query gathered-set approximation. M10 does both.
+
+## What changed vs the original brief (important)
+
+The task began as "reify the geometry into a durable **cache**." Will corrected this mid-flight, and
+the correction is the design: **do not build a cache — reify densely co-wired neighborhoods into
+first-class, PERSISTED store records** that survive restart, load on boot, and evolve via
+supersede+provenance. *"A cache that lies is worse than a slow lookup."* This matches
+[the cognitive-architecture design §2](engram-cognitive-architecture.md) (reification = durable
+structure, not a fragile derived shortcut) and the memory-core discipline (evolve or forget, never
+a stale canonical). Two modes, **no general cache layer**:
+
+1. **Persist first-class** — reified/crystallized neighborhoods (the self; stable topology). The
+   geometry-priming **hot path reads these**. Never compute geometry on the activation path.
+2. **Compute on the fly** — ad-hoc/transient domain geometries (viz, exploration). Uses the
+   existing M9 `engram_geometry_descriptor`, fresh each call, no storage. Occasional, so its cost
+   is acceptable.
+
+## Storage schema (first-class, on the existing TLV node store — no new on-disk format)
+
+A reified neighborhood is an ordinary store **node**, so it inherits durability, boot-load,
+`store_supersede`, and adjacency for free (design §2: *structure all the way down under one rule*).
+
+| Record | `node_type` | `emb` | `metadata` (`GEO1` text schema) | id |
+|---|---|---|---|---|
+| Centering frame | `GeoMeanFrame` | the true store-wide mean vector (persisted **once**) | `{}` | `geo-meanframe` |
+| Neighborhood | `Neighborhood` | the **raw centroid** (prototype; centroid-ANN-able; `centered = emb − meanframe`) | hub id · meanframe ref · scalars (`radius`, `total_variance`, `k_core`, `co_registration`, `n_embedded`) · axis **extents** · member list `{id → membership, centrality, core}` | `nbhd-<hub>-<built_at_ms>` |
+
+Member links are also persisted as edges `relation="member"` (`nbhd → member`). The membership
+`{id → w}` in the metadata is what priming reads; it is computed **centered against the persisted
+true mean**, which is what resolves the M9 quality caveat.
+
+**Detection (v1, honest).** Hub-anchored neighborhoods over the strong-edge hebb-weighted graph:
+compute per-node weighted degree `Σ eff_w` (`eff_w = weight·(1+0.5·hebb)`, non-tombstoned /
+non-inhibitory, ≥ `edge_min_weight`) over from+to edges; rank descending; **greedy non-redundant
+cover** — reify each hub's descriptor once, skip a hub already a member (`w ≥ cover_membership`) of an
+accepted neighborhood, stop at `max_neighborhoods` (default 128). Env-tunable (`min_weighted_degree`,
+`max_neighborhoods`, refresh frac) without rebuild.
+
+**Honest caveat — hebb ≈ 0 today.** On the current store there is ~no Hebbian potentiation, so
+`eff_w` reduces to the **authored** edge weight; the detected neighborhoods currently reflect
+authored graph structure, not learned co-activation. The design is unchanged and self-correcting
+once hebb accrues (degree ranking and skeleton shift automatically).
+
+## Boot isolation — why priming-OFF stays byte-identical
+
+The persisted records carry embeddings (centroid / mean) but are **structure, not corpus content**.
+On boot they are routed **out** of the resident activation graph into a dedicated resident reify
+index, and member edges are skipped from adjacency (matched by the `nbhd-…` id convention, so no real
+edge of any relation is affected). Consequences, all verified:
+
+- store-wide mean, hub-degree scan, and the descriptor never admit a structural record as a member
+  (`geo_is_structural_id` / `node_type` guards);
+- vindex / seed selection / results / embedding backfill are **identical** to a store that was never
+  reified ⇒ `ENGRAM_GEOMETRY_PRIMING` OFF is **byte-identical to M8/M9**.
+
+The resident index is the **loaded form** of the durable records (like the resident node array is the
+loaded form of node records, or adjacency of edges). Geometry is computed **once**, offline, and
+**persisted**; boot only *parses* — it never recomputes geometry.
+
+## Hot path
+
+`ENGRAM_GEOMETRY_PRIMING=1` resolves the M8 seed set to the best persisted neighborhood — O(seeds)
+membership hash lookup; miss → centroid-nearest against the loaded centered centroids — and applies
+the M9 damp+prime logic from the persisted membership. **No geometry computed on activation.** Set
+`ENGRAM_GEO_PRIMING_NOCACHE=1` to fall back to the M9 per-query descriptor (ad-hoc / A/B control).
+
+## Results (A/B on COPIES; `store_reified` = 128 neighborhoods; live untouched)
+
+**Correctness / durability**
+
+| Check | Result |
+|---|---|
+| Reified records inert: `A_off` (reified store) vs `C_clean` (no records), id sequence all 15 queries | **MATCH** (byte-identical) |
+| Restart survival: reify → checkpoint+close → fresh-process reopen | 128 `Neighborhood` + 1 `GeoMeanFrame` present; index loads **28 ms**; hub-seed lookup HIT **~1 µs** |
+| Supersede/provenance: re-reify | prior same-hub record superseded (new timestamped id, old tombstoned); live count stable |
+| Build warnings from `el_runtime.c` / `engram_geometry.c` (−O2) | **0** (3 pre-existing in generated `engram.c`) |
+| ASan/UBSan — module (write/load/lookup) + full server hot path, priming ON, 6 queries | **CLEAN** (all http 200, no trap) |
+
+**Latency (median / p90, 15 queries)**
+
+| config | median | p90 | vs A_off |
+|---|---|---|---|
+| C_clean (no records, OFF) | 78.6 ms | 82.7 ms | — |
+| **A_off** (reified, OFF) | **77.4 ms** | **83.1 ms** | 1.00× |
+| **B_on** (reified, **hot path / persisted**) | **81.7 ms** | **85.7 ms** | **1.06× / 1.03× — FLAT** |
+| D_nocache (reified, ON, M9 per-query) | 255.3 ms | 872.3 ms | **3.30× / 10.5×** |
+
+Reading a persisted first-class record instead of computing a per-query descriptor **removes the M9
+latency blocker** (3.3×/10.5× → 1.06×/1.03×). There is no cold first-query penalty — the index loads
+at boot.
+
+**Recall quality (mean pairwise cosine, top-20, TRUE store-wide centered frame, stored vectors)**
+
+| | OFF | ON | Δ |
+|---|---|---|---|
+| mean over 15 queries | 0.1721 | 0.1555 | **−0.0166** |
+| polysemous cues (9) | 0.1442 | 0.1441 | −0.0001 |
+| queries where ON > OFF | — | — | **3 / 15** |
+
+Even with the true mean and persisted structure there is **no reliable coherence gain** — slightly
+negative on average, one sparse win (`self identity values` +0.078) and one notable regression
+(`precision over brute force` −0.215). On dense polysemous cues the top-20 head is unchanged
+(sub-threshold priming does not reorder it), so their coherence is flat.
+
+## Verdict
+
+- **Reification substrate: GO** (merge additive, geometry-priming default-OFF). It is the durable
+  first-class structure the memory core needs — persisted, boot-loaded, restart-surviving,
+  supersede-able, provably inert when OFF — and it turns priming into a flat-latency lookup.
+  Groundwork for the self-as-structure, multi-scale neighborhoods, and the §5 operators.
+- **Enable geometry-priming: NO-GO (still).** The M9 *latency* objection is resolved; the *quality*
+  objection is not. Keep the flag default-OFF.
+
+### Uncertainties / limits (memory core — flagged)
+
+1. **hebb ≈ 0** ⇒ neighborhoods reflect authored edges, not learned co-activation. The quality result
+   is likely **understated**; re-evaluate after hebb accrues (or seed hebb from usage).
+2. **Hub-anchored detection** can resolve a sparse query to a semantically mismatched neighborhood
+   (the −0.215 regression). Semantic-aware / co-registration-gated detection is future work.
+3. **Top-20 coherence is insensitive** to sub-threshold priming on dense cues — it may be the wrong
+   metric for what priming does (it warms a floor, it does not reorder the head). A retrieval-utility
+   or disambiguation-accuracy metric would measure the intended effect better.
+4. **v1 simplifications:** axis **direction** vectors are not persisted (extents only; directions
+   recomputable on the fly); member edges are persisted but inert to activation.
+
+## Reversal
+
+Fully additive and reversible.
+
+- The binary is **byte-identical to M8/M9 when `ENGRAM_GEOMETRY_PRIMING` is unset/0** — the default.
+- Reified records live only in stores you explicitly run the reify step against; a store that was
+  never reified behaves exactly as before (the resident index is empty ⇒ priming no-ops).
+- To remove reified structure from a store: tombstone the `Neighborhood` / `GeoMeanFrame` records and
+  compact (they are ordinary nodes). No format change to undo.
+- `ENGRAM_GEO_PRIMING_NOCACHE=1` restores the M9 per-query path for ad-hoc geometries / comparison.
diff --git a/docs/architecture/design/engram-prior-art-scan.md b/docs/architecture/design/engram-prior-art-scan.md
new file mode 100644
index 0000000..dcfd208
--- /dev/null
+++ b/docs/architecture/design/engram-prior-art-scan.md
@@ -0,0 +1,120 @@
+# Engram Prior-Art Scan
+
+*Dated 2026-08-12. This is an **engineering novelty read**, not legal advice. It is intended to feed a patent/whitepaper priority decision by identifying which claims sit in a clean lane and which are wholly or partly anticipated by existing work. A patent attorney and a formal search (USPTO/Google Patents/Espacenet) should confirm before filing. Where a claim is anticipated, this document says so plainly — the goal is honest scoping, not inflated novelty.*
+
+## How to read this
+
+Engram is an immutable, temporally-provenanced knowledge graph (tombstone-not-delete, supersede-not-overwrite; every node carries `created_at` + `superseded_at` + provenance). Over that graph it computes **geometry descriptors** `G = (centroid, covariance/ellipsoid, skeleton graph, membership weights)` in a joint embedding+graph space, and runs named operators (overlap, combine, distance, difference, analogy=Procrustes, traverse=geodesic) over them. A "self" is a reified geometry. Time-travel is a **query filter** (`created_at ≤ T < superseded_at`), not a transaction-log replay. "Self-occupation" reconstructs the self-geometry/knowledge-state as of `T`, locks it read-only, and converses with it with all post-`T` data masked.
+
+The recurring pattern in the findings below: **every individual primitive is prior art.** Bitemporal reconstruction, memory streams, vector-symbolic composition, geometric KG operators, hindsight-leakage auditing, embedding drift detection — all exist and are well-published. Novelty, where it exists, lives in *specific integrated mechanisms*, and must be claimed narrowly against those primitives. Broad claims ("reasoning as geometry," "reconstruct what was known at T," "detect drift by distance") will be rejected on sight.
+
+---
+
+## (a) Hindsight-free decision auditing via immutable temporal knowledge-state reconstruction + future-masked occupation
+
+**Claim (restated narrowly).** A method for auditing a past decision by (1) *constructively reconstructing* the exact knowledge-state a decision-maker held at time `T` from an immutable, tombstone+supersede provenance graph (selecting nodes live-at-`T` via `created_at ≤ T < superseded_at`), (2) recomputing the derived concept/self geometry over only that live-at-`T` slice, and (3) presenting that reconstructed state read-only, with all post-`T` nodes masked, as the sole evidentiary basis for judging the decision — such that the reconstruction is tamper-evident *because* nothing is ever overwritten or deleted.
+
+**Closest prior art.**
+- **HindsightBench** (Aug 2026) — a *black-box behavioral audit protocol* that detects parametric hindsight in time-indexed LLM decision tasks by manipulating the *asserted date* in the prompt (Revealed/Date-only/Masked/Transplant arms) and measuring behavioral shift. It explicitly does **not** reconstruct a knowledge state from provenance; it does not require corpus access or logprobs. It also reports that *instructed forgetting fails* — a 52% performance gap vs. true ignorance. https://arxiv.org/abs/2607.18867
+- **Agentic Time Machine** (Jun 2026) — wraps web tools with a *leakage filter* that blocks post-cutoff or answer-revealing content before it reaches the agent (for forecasting benchmarks). https://arxiv.org/pdf/2606.21013
+- **Zep/Graphiti** — bitemporal KG memory that can answer "what was the user's plan in January?" via point-in-time recall over event-time + ingestion-time. https://arxiv.org/abs/2501.13956 , https://www.getzep.com/ai-agents/temporal-knowledge-graph/
+- **Auditable clinical-AI provenance frameworks** — immutable, timestamped "source-to-decision" trails recording the exact evidence shown to a clinician, for FDA transparency/liability. https://pmc.ncbi.nlm.nih.gov/articles/PMC12913532/
+- **Hindsight-bias clinical literature** — retrospective case-note review is critically distorted by outcome knowledge; reconstructing the decision-maker's past perspective is the known mitigation. https://www.researchgate.net/publication/330427526 , https://kevinmd.com/2026/03/how-hindsight-bias-distorts-clinical-medicine.html
+
+**What is genuinely differentiated.** The primitives — bitemporal point-in-time recall (Zep), immutable evidence trails (clinical AI), hindsight-bias mitigation by perspective reconstruction (clinical psych), leakage filtering (Agentic Time Machine), hindsight auditing (HindsightBench) — are all taken. What appears *unclaimed* is the specific combination: **constructive knowledge-state reconstruction from an immutable tombstone+supersede graph, used as the affirmative evidentiary substrate for judging a decision**, where correctness of the future-mask is *guaranteed by the data model* (a node is either live-at-`T` or it is not) rather than by prompt instruction or a heuristic content filter. HindsightBench and Agentic Time Machine both operate on the *model's* contaminated parametric memory and fight leakage behaviorally/heuristically; Engram sidesteps parametric leakage by making the *evidence set itself* provably `T`-clean and then recomputing geometry over it. The tamper-evidence-by-construction angle (append-only provenance ⇒ the reconstruction cannot be silently backdated) is also not present in the behavioral-audit line.
+
+**Scoped-claim recommendation.** Claim the *pipeline*, not the goal: "reconstructing a decision-maker's knowledge-state as of `T` by selecting live-at-`T` nodes from an append-only tombstone+supersede provenance graph and recomputing derived concept/self geometry over that slice, then serving it read-only with post-`T` nodes masked as the evidentiary basis for decision review." Anchor on (i) constructive reconstruction from immutable provenance (not prompt-based date assertion), (ii) mask-correctness guaranteed by the data model, (iii) recomputed *geometry* (not just fact recall) as the reconstructed state. Do **not** claim "hindsight-free auditing" broadly, "point-in-time recall," or "immutable audit log" — all taken.
+
+**Verdict: PARTIALLY TAKEN** (the goal and every primitive are taken; the constructive-reconstruction-from-immutable-provenance-as-evidentiary-substrate integration looks clean if narrowly scoped).
+
+---
+
+## (b) Drift detection via geodesic displacement of an anchored self-geometry
+
+**Claim (restated narrowly).** A method that reifies an agent's "self" as a geometry descriptor with a *designated stable value-core anchor* and a mutable *periphery*, and classifies change by **decomposition**: extension of the periphery (core displacement ≈ 0) is scored as *growth*, whereas geodesic displacement of the *core* is scored as *corruption* — measured as geodesic distance between `self(now)` and the anchored `self(reference)` on the graph+embedding manifold.
+
+**Closest prior art.**
+- **Embedding / concept-drift detection** — mature field: distribution-distance of embeddings, per-label distributions (Drift Lens), K-core-distance from a dense "core" of baseline logic, growing average distance from baseline anchors as the drift signal. https://www.evidentlyai.com/blog/embedding-drift-detection , https://ieeexplore.ieee.org/iel7/9679833/9679835/09679880.pdf , https://www.sciencedirect.com/science/article/pii/S0925231225018624
+- **Agent identity/goal-drift governance** — identity-hash functions over characteristic behavior for drift detection; "dominant" core persona preventing fragmentation; reflection-based long-term self-model evolution vs. short-term compensation. https://arxiv.org/pdf/2604.14717 (Layered Mutability) , https://www.researchgate.net/publication/397950116 (Agent Goal Drift in Stateful Systems)
+- **Persistent Identity multi-anchor architecture** — explicit *anchors* for resilient agent identity/memory continuity. https://arxiv.org/pdf/2604.09588
+
+**What is genuinely differentiated.** "Distance from an anchored baseline core = drift" is squarely prior art (K-core-distance, baseline-anchor distance growth). Agent-identity work already has *core-vs-drift* and *anchors*. What is not obviously present is the **core/periphery decomposition of drift into two distinct, oppositely-valenced outcomes on a reified self-*geometry*** — i.e., using a *geometric* self-model (centroid + covariance/ellipsoid + skeleton) where *growth* is formally "periphery ellipsoid expands while core centroid/anchor stays fixed" and *corruption* is "core centroid/anchor is geodesically displaced." Existing drift work treats all displacement as drift (bad); it does not carve legitimate growth from corruption via a *fixed value-core* on a self-geometry. The specific formalization — geodesic (graph-aware, non-Euclidean) displacement of a *pinned* value-core sub-geometry vs. free peripheral expansion — is the differentiator.
+
+**Scoped-claim recommendation.** Claim "detecting agent value-corruption by measuring geodesic displacement of a *pinned value-core sub-geometry* of a reified self-geometry, while treating expansion of the peripheral geometry with a stationary core as non-corrupting growth." Emphasize (i) the self is a *geometry descriptor* with an explicitly designated immutable core anchor, (ii) growth vs. corruption is a *decomposition* (two signals), not a threshold on one distance, (iii) geodesic/graph-aware metric. Do **not** claim "drift detection by embedding distance" or "anchored baseline comparison" — taken.
+
+**Verdict: PARTIALLY TAKEN** (distance-from-anchor drift is taken; the growth/corruption core-vs-periphery decomposition on a reified self-geometry is the narrow clean sliver — and it's the weakest/most crowded of the five).
+
+---
+
+## (c) Reasoning as composable geometry operations over a persistent temporally-provenanced graph
+
+**Claim (restated narrowly).** A reasoning method in which inference steps are *explicit, named, first-class operators* (overlap, combine, distance, difference, analogy=Procrustes alignment, traverse=geodesic) applied to geometry descriptors computed over a *persistent, immutable, temporally-provenanced* knowledge graph — such that each reasoning step is individually inspectable, logged with provenance, and *replayable* against a past graph state; as distinct from implicit, unnamed activation/attention transforms inside a neural net.
+
+**Closest prior art.**
+- **Vector Symbolic Architectures / HRR / SDM** (Plate, Kanerva) — the canonical "algebra over vectors": binding, bundling/superposition, permutation, similarity; explicitly compositional/symbolic reasoning via vector operations. This is the strongest prior art for "named composable operators over vectors." https://www.emergentmind.com/topics/holographic-reduced-representations-hrrs , https://arxiv.org/pdf/2512.14709 (Attention as Binding)
+- **Geometric KG query embeddings (Query2Box-lineage)** — reasoning as *named geometric operators* (projection, intersection) over box/region embeddings; geometric multi-hop reasoning; geometry-interaction KG embeddings. https://arxiv.org/html/2505.12369v2 , https://ojs.aaai.org/index.php/AAAI/article/view/20491/20250
+- **Geometry-of-reasoning / embedding-space reasoning** — CoT as trajectories/flows in representation space; vector algebra + manifold geometry for deduction/induction/analogy. https://arxiv.org/abs/2510.09782 , https://arxiv.org/pdf/2504.02018
+- **Riemannian knowledge manifolds** — geodesics as shortest semantic paths with a convergent geodesic solver. https://arxiv.org/html/2606.05907v2
+- **Neuro-symbolic propose-verify** — explicit symbolic operations + solver verification.
+
+**What is genuinely differentiated.** "Reasoning as composable vector/geometry operations" is *thoroughly* prior art — VSA/HRR own the compositional-operator framing; Query2Box owns named geometric operators (projection/intersection) for KG query answering; geodesic traversal over semantic manifolds is published. The individual operators (overlap≈intersection, distance, geodesic-traverse, Procrustes-analogy) each exist. The candidate differentiator is *not* any operator and *not* "geometry as reasoning" — it is the **coupling of the operator calculus to the immutable temporal-provenance substrate**: every operator input is a live-at-`T` geometry, every step is provenance-stamped, and the whole derivation is *replayable against a reconstructed past graph state* (i.e., operator-level temporal reproducibility + auditability). VSA/Query2Box run over static/atemporal embedding stores with no provenance and no time-travel; geometry-of-reasoning work is about a neural net's *internal* trajectory, not an external audited calculus. So the calculus itself is taken; "an *auditable, replayable* geometry calculus whose operands are temporally-reconstructed geometries" is the narrow lane.
+
+**Scoped-claim recommendation.** Do **not** claim a "calculus of thought," "reasoning as geometry," or any specific operator (overlap/difference/geodesic/Procrustes) — all taken. Claim only the integration: "an audit trail in which each named geometric reasoning operator is provenance-stamped and its operands are geometry descriptors reconstructed from an immutable temporal graph as-of a query time, enabling deterministic replay of a reasoning derivation against a past knowledge-state." The defensible novelty is *temporal reproducibility + provenance of the operator chain*, not the operators.
+
+**Verdict: TAKEN** (as "reasoning as composable geometry ops" — VSA/HRR + Query2Box + geometry-of-reasoning fully occupy it). Only the *auditable/replayable-over-immutable-temporal-substrate* framing survives, and it survives as a thin sliver of (a)/(e), not as an independent claim.
+
+---
+
+## (d) Self-occupation with engineered future-masking
+
+**Claim (restated narrowly).** A method for reasoning *as* a past self: reconstruct the self-geometry and knowledge-state as of `T` from the immutable provenance graph, *rigorously enforce the `created_at ≤ T` cut at the data layer* (all post-`T` nodes structurally excluded, not instructed-away), lock the reconstruction read-only, and drive a conversational/reasoning session that is provably uncontaminated by hindsight — the mask being a property of the substrate, not of a prompt or the model's willingness to "forget."
+
+**Closest prior art.**
+- **HindsightBench** — establishes the *problem* rigorously and shows that prompt-level "pretend it's `T`" fails badly (instructed forgetting ≠ ignorance; 52% gap; date assertions obeyed but hindsight still leaks). This is the strongest adjacent art and, helpfully, *motivates* Engram's substrate-level approach rather than anticipating it. https://arxiv.org/abs/2607.18867
+- **Agentic Time Machine** — closest *mechanism*: a leakage filter blocking post-cutoff content before it reaches the agent. But it filters *tool outputs* heuristically for a forecasting benchmark; it does not reconstruct and occupy a *reified past self/knowledge-state*. https://arxiv.org/pdf/2606.21013
+- **Causal Agent Replay** — counterfactual replay/attribution of agent failures (replay, but not future-masked past-self occupation). https://arxiv.org/abs/2606.08275
+- **Chronologically-consistent pretraining / counterfactual-anchored decoding / forget-retain logit adjustment** — model-internal mitigations of parametric leakage (named in HindsightBench). Different layer entirely.
+
+**What is genuinely differentiated.** The field is actively fighting hindsight leakage at the *model* layer (pretraining, decoding, logit surgery) and at the *tool-output* layer (heuristic leakage filters). Engram's move is orthogonal and, per HindsightBench's own findings, addresses the failure mode the field just documented: **enforce the cut at the evidence/data layer via an immutable time-indexed graph, so the "past self" is a reconstructed read-only geometry whose accessible universe is exactly the live-at-`T` slice.** No source found reconstructs a *reified self-geometry* as of `T` and *converses with it* as a first-class object. The differentiators: (i) the masked entity is a *reconstructed self*, not just filtered context; (ii) mask correctness is structural (a node's `created_at` either satisfies the cut or the node is absent) rather than heuristic/instructed; (iii) it is tamper-evident via append-only provenance. Note the residual honesty caveat: if the *underlying LLM* used for the conversation has parametric hindsight, Engram's substrate-clean evidence does not fully neutralize it — the claim must be about the *evidence/state* being `T`-clean, which is the part Engram genuinely controls.
+
+**Scoped-claim recommendation.** Claim "reconstructing a reified agent self-geometry and knowledge-state as-of `T` from an append-only temporal provenance graph and conducting a read-only reasoning/conversation session over it in which the accessible node universe is structurally restricted to the live-at-`T` slice (data-layer future-masking), yielding a `T`-clean evidentiary state." Lean on *structural* (data-model-guaranteed) masking vs. *instructed/heuristic* masking, and on the *reified-past-self* object. Explicitly scope to the evidence-state cleanliness (not a claim that the LLM has zero parametric leakage). Do **not** claim "prevent hindsight in LLMs" or "leakage filtering" broadly.
+
+**Verdict: CLEAN LANE** (narrowly — data-layer/structural future-masking over a *reconstructed reified past self* is not occupied; adjacent art is behavioral-audit, tool-output filtering, or model-internal mitigation. This is the strongest of the five, precisely because HindsightBench shows the prompt-level approach fails and no one is doing substrate-level self-reconstruction).
+
+---
+
+## (e) Query→geometry temporal reconstruction with NO transaction logs
+
+**Claim (restated narrowly).** Reconstructing a past knowledge-state as a *query-time filter* over immutable, per-node timestamped provenance (`created_at ≤ T < superseded_at`) followed by *recomputation of the geometry descriptors* over that slice — with **no event/transaction log and no periodic snapshots**; the immutable per-node provenance *is* the temporal record, and derived geometry is recomputed rather than stored/replayed.
+
+**Closest prior art.**
+- **Bitemporal databases (XTDB, et al.) / event sourcing** — "as-of" point-in-time queries over valid-time + transaction-time; immutability as audit log. Critically, XTDB describes reading bitemporal data as a process *"similar to event sourcing… playing through the history… in reverse system-time order"* — i.e., the mainstream bitemporal model *is* replay/reconstruction-through-history. https://v1-docs.xtdb.com/concepts/bitemporality/ , https://www.juxt.pro/blog/value-of-bitemporality/
+- **Zep/Graphiti** — bitemporal (event-time T + ingestion-time T′) fact validity + supersession chains; point-in-time recall. https://arxiv.org/abs/2501.13956
+- **TKG reasoning frameworks / ElephantBroker-class runtimes** — "immutable fact store, all temporal weighting applied at query time; facts created after the query timestamp excluded, facts superseded after query timestamp treated as current; invalidate by writing `t_invalid` rather than delete." This is *very* close to Engram's filter and supersede/tombstone semantics. https://www.emergentmind.com/topics/temporal-knowledge-graph-reasoning-tkgr , https://arxiv.org/pdf/2603.25097
+- **Numerous bitemporal/immutable-DB patents** (point-in-time reconstruction, retroactive/historical transactions). e.g. US 11,935,046; US 8,812,512 (via USPTO search) — a patent attorney must clear these.
+
+**What is genuinely differentiated.** The *temporal filter* (created-before, superseded-after) and *tombstone-not-delete / supersede-not-overwrite* are **standard bitemporal KG practice** — Zep and the TKGR frameworks describe almost exactly this. So the reconstruction-by-filter primitive is TAKEN, and "immutable provenance instead of a mutable audit log" is TAKEN (that's the bitemporal value prop). The only thing that is *not* standard: what gets reconstructed is not just a set of *facts/edges* but a set of **derived geometry descriptors (centroid/covariance/skeleton/membership) recomputed over the live-at-`T` slice** — i.e., recompute-geometry-on-read rather than store-and-replay. Bitemporal DBs reconstruct *records*; Engram reconstructs *derived manifold structure*. The "no transaction log / no snapshot — provenance IS the temporal record, geometry is recomputed" framing is a design stance that is defensible only if paired with the *geometry recomputation*; on its own it is indistinguishable from XTDB/Zep.
+
+**Scoped-claim recommendation.** Do **not** claim bitemporal reconstruction, "as-of" queries, tombstone/supersede, or "immutable provenance as audit record" — all squarely taken (Zep, XTDB, TKGR, patents). Claim only: "reconstructing a *derived geometry descriptor set* (centroid/covariance/skeleton/membership) for a past knowledge-state by recomputing it on-read over the live-at-`T` node slice, without storing per-`T` geometry snapshots or a geometry-mutation log." The novelty is *geometry-recompute-on-read over a bitemporal slice*, not the slice.
+
+**Verdict: TAKEN** (as "query-filter temporal reconstruction over immutable provenance" — Zep + XTDB + TKGR own it outright). Only "recompute *derived geometry* on-read, snapshot-free" survives, and it is really a facet of (c)/(a) rather than an independent claim.
+
+---
+
+## Summary
+
+| Claim | Verdict | Narrowest defensible (clean-lane) framing |
+|---|---|---|
+| **(a)** Hindsight-free decision auditing via reconstructed knowledge-state + future-masked occupation | **PARTIALLY TAKEN** | Constructive knowledge-state reconstruction from an *append-only tombstone+supersede* graph, used as the *affirmative evidentiary substrate* for decision review, with mask-correctness guaranteed by the data model and tamper-evidence by construction — not prompt/date-assertion (cf. HindsightBench) and not tool-output filtering (cf. Agentic Time Machine). |
+| **(b)** Drift as geodesic displacement of anchored self-geometry | **PARTIALLY TAKEN** | Growth-vs-corruption *decomposition* of change on a reified self-*geometry* via geodesic displacement of a *pinned value-core sub-geometry* vs. free peripheral-ellipsoid expansion. (Crowded; weakest lane.) |
+| **(c)** Reasoning as composable geometry ops over a temporal graph | **TAKEN** | Only survivor: *provenance-stamped, replayable* operator chain whose operands are geometries reconstructed as-of a query time (temporal reproducibility of the derivation) — never the operators or "geometry as reasoning" themselves. |
+| **(d)** Self-occupation with engineered future-masking | **CLEAN LANE** (narrow) | Reconstruct a *reified past self-geometry* and converse with it read-only, with the accessible node universe *structurally* restricted to the live-at-`T` slice (data-layer masking) — not instructed forgetting (which HindsightBench shows fails) and not heuristic content filtering. |
+| **(e)** Query→geometry temporal reconstruction, no transaction logs | **TAKEN** | Only survivor: recompute *derived geometry descriptors* on-read over the live-at-`T` slice, snapshot-free — never the bitemporal filter, tombstone/supersede, or "immutable provenance as record," all of which Zep/XTDB/TKGR own. |
+
+## Overall posture
+
+**Broad claims over primitives will be rejected.** Each of the five candidate claims decomposes into (i) a primitive that is unambiguously prior art and (ii), in three of five cases, a thin integrated mechanism that appears unclaimed. The prior art is strong and specific: Zep/Graphiti and XTDB own bitemporal point-in-time reconstruction and supersession (kills the broad reads of (a) and (e)); VSA/HRR and Query2Box own composable geometric/symbolic operators (kills the broad read of (c)); embedding concept-drift and agent-identity-anchor work own distance-from-baseline drift (kills the broad read of (b)); and HindsightBench + Agentic Time Machine own hindsight *auditing* and *leakage filtering* (bound (a) and (d)).
+
+**Novelty lives in the specific integrated mechanisms, narrowly scoped.** The two genuinely defensible ideas are: **(d) substrate-level future-masking of a reconstructed, reified *past self*** — which is the strongest, and is *strengthened* by HindsightBench's finding that the prompt-level approach everyone else uses fails by ~52%; and **(a) constructive knowledge-state reconstruction from immutable provenance as the affirmative evidentiary basis for decision auditing**, distinct from behavioral probing. The unifying, defensible thread across (a)/(d)/(c)/(e) is *structural guarantee by the immutable data model* — the future-mask, the tamper-evidence, and the operator-chain replayability are all properties of the append-only substrate rather than of prompts, heuristics, or model cooperation. That "guaranteed-by-construction" framing is the honest core of any priority filing. Claims (c) and (e) should be folded in as *facets* (auditable/replayable geometry over reconstructed slices) rather than filed as standalone claims, and (b) should be filed only if the core/periphery decomposition can be made rigorous, since the surrounding drift-detection art is dense.
+
+*Caveats for the filing team: (1) this scan covered academic/product/blog prior art via web search, not a formal patent search — several bitemporal/immutable-DB patents surfaced (e.g. US 11,935,046; US 8,812,512) and must be cleared on Google Patents/Espacenet/USPTO. (2) Claim (d)'s guarantee is that the *evidence-state* is `T`-clean; it does not by itself neutralize parametric hindsight in whatever LLM reasons over that state — scope the language accordingly. (3) Dates on several 2606–2607 arXiv preprints are very recent; confirm publication precedence relative to Engram's earliest documented conception date.*
diff --git a/docs/architecture/design/perf/engram-m8-profile.md b/docs/architecture/design/perf/engram-m8-profile.md
new file mode 100644
index 0000000..9935378
--- /dev/null
+++ b/docs/architecture/design/perf/engram-m8-profile.md
@@ -0,0 +1,140 @@
+# Engram Tiered Storage — M8 Performance Profile (milestone-0 sample)
+
+**Milestone:** M8 (ANN wired into `engram_activate` seed selection). Trunk =
+worktree `/tmp/engram-tiered-wt`, branch `engram-tiered-storage`, HEAD `1507614`.
+**Date:** 2026-08-12. **Author:** first full-binary build + profile of the tiered trunk.
+
+This is **sample zero** of an accumulating per-milestone profile series (see the
+BUILD-LEDGER "keep performance telemetry CONTINUOUSLY" decision). Compare future
+milestones (M9, M10, …) against these numbers.
+
+## Methodology (read this before trusting a number)
+
+- **On a COPY, never live.** All runtime measurements used a read-only copy of the
+  live store booted on a **non-live port (:8798)** with a **throwaway `$HOME`**. The
+  live engram service (:8742, `~/.neuron/engram`) was never touched.
+- **Two store substrates were used:**
+  1. *Live-egm copy* (`neuron.egm` 458 MB + `neuron.wal` 44 MB, copied read-only) —
+     **this substrate crashes both the M8 binary and the live binary on boot** (see
+     Integration Findings). Unusable for runtime measurement.
+  2. *Clean import* — a dir seeded with only `snapshot.json` (65 MB, stable 06:10),
+     which the binary imported into a **fresh 59.9 MB `neuron.egm`**. All healthy
+     runtime numbers below are from this substrate (real graph content, healthy store).
+- **Build machine:** Apple Silicon (arm64), macOS. Native `cc -O2` compile; fold done
+  in a memory-capped (`--memory=3g --memory-swap=3g`, no swap) `linux/amd64` container
+  running `elc-linux-amd64`.
+- Hardware/thermals uncontrolled; single run per metric unless noted. Treat as
+  order-of-magnitude, not benchmark-grade, except the module benchmark (Test suite).
+
+## Build
+
+| Metric | Value |
+|---|---|
+| Fold input | `engram/src/server.el` (44,273 B El, no imports) |
+| Fold output | `engram.c` (30,855 B, 645 lines C), `ELC_EXIT=0`, **0 fold warnings** |
+| Fold time (pure elc) | sub-second (server.el is small, importless) |
+| Fold container wall | ~38 s (dominated by one-time `apt-get install libcurl4` in the throwaway container; the elc invocation itself is <1 s) |
+| Compile | `cc -O2 -DHAVE_CURL engram.c el_runtime.c engram_store.c engram_vindex.c -lssl -lcrypto -lcurl -lpthread -lm` |
+| Compile time | **1.83 s** wall |
+| Compile warnings | **3**, all `-Wparentheses-equality` in the *folded* `engram.c` (El if-expr codegen emits `if ((x == 0))`); cosmetic. `el_runtime.c` / `engram_store.c` / `engram_vindex.c` compiled **0 warnings** — notably none around the M8 deferred `free(e_eff)` or the vindex integration. |
+| Binary | **482,008 B (471 KB)** Mach-O arm64 executable |
+| ANN linkage verified | `nm`: `vindex_search`, `vindex_build_from_store`, `eg_vindex_sync`, `_eg_vindex`, `store_scan_nodes`, `engram_store_boot`, `engram_activate` all present |
+
+## Boot & footprint (clean-import substrate)
+
+| Metric | Value |
+|---|---|
+| Boot from healthy `neuron.egm` | **~2 s** to listening |
+| Boot from `snapshot.json` (one-time import + fresh egm) | **~9 s** |
+| node_count | **13,036** (matches ledger import-dedup: 13,038 snapshot − 2 dup-id entries) |
+| edge_count / layer_count | 43,402 / 5 |
+| embedded_count | 4,190 |
+| Fresh egm size | **59.9 MB** (vs the live egm's bloated 458 MB — see Findings) |
+| RSS after boot | **126.2 MB** (whole 13k-node/43k-edge/4,190-emb graph resident + fresh egm) |
+
+## Activation latency — q="bullshit" (clean-import substrate)
+
+50 sequential `GET /api/activate?q=bullshit&limit=10&depth=3`:
+
+| Metric | Value |
+|---|---|
+| p50 | **34.35 ms** |
+| p95 | **35.26 ms** |
+| min / max | 33.50 ms / 9,886 ms |
+| Sample | n=50 |
+
+- The **max = 9.9 s is the first call only** — a cold query-embedding fetch
+  (`eg_embed_fetch` → Ollama `nomic-embed-text`, cold model load). All subsequent
+  calls hit the single-slot query-embedding cache (`_eg_qcache`) → **34 ms steady state**.
+- **This 34 ms is the lexical/spread path, NOT the ANN seed path.** The store's 4,190
+  embeddings were generated by the live neuron's native embedding model; the harness's
+  `nomic-embed-text` query vectors are a **different vector space**, so no candidate
+  cleared `ENGRAM_EMBED_SEED_MIN=0.60` (`act-stats`: `dup_seeds:0`, `ctx_cos:-2.000`
+  sentinel) → results empty, ANN discovery produced no admitted seeds. Environmental
+  (embedding provenance), **not** an M8 defect. The ANN wiring still *executed*
+  (embed fetch succeeded, `embed_breaker_open:0`; `eg_vindex_sync` + seed block +
+  `free(e_eff)` all ran) **without crashing** on the real store.
+
+## KEY M8 METRIC — ANN vs O(n) seed selection (authoritative)
+
+Because the HTTP path can't exercise ANN seeding without embedding-space parity, the
+authoritative ANN-vs-exact-scan numbers come from the **module benchmark**
+(`engram/test/run_vindex_tests.sh`, PASS 1, optimised), which measures the exact
+`vindex_search` code the M8 wiring calls, at full size:
+
+| N (768-dim vectors) | Brute-force (O(n)) | ANN (HNSW) | **Speedup** |
+|---|---|---|---|
+| 5,000 | 3.475 ms/query | 0.353 ms/query | **9.8×** |
+| 20,000 | 13.809 ms/query | 0.698 ms/query | **19.8×** |
+
+- **recall@10 = 0.9365** at `ef_search=128` (gate ≥0.90 — **PASS**). Lower ef trades
+  recall for latency: ef=64→0.844, ef=32→0.750, ef=10→0.625.
+- **Determinism:** two independent seeded builds give byte-identical query results.
+- **`vindex_build_from_store`** over a real `engram_store`: inserts exactly the
+  embedded nodes, top-1 resolves to the correct node id at ~0 distance.
+- **HNSW build cost (single-threaded, note for boot/index-build budgeting):**
+  5,000 vectors ≈ 15–35 s, 20,000 vectors ≈ 75 s. In-process the index is built
+  **lazily on first activation** (`eg_vindex_sync`) and grown incrementally; the
+  M8 seed block only fires once `vindex_size ≥ ENGRAM_EMBED_SEED_K`. At the real
+  store's 4,190 embedded nodes this is a **one-time few-second first-activation
+  cost** — worth watching as the embedded set grows (a future milestone may want
+  to build the index at boot or persist it via `vindex_save`/`vindex_load`).
+
+## Seed-set parity note (why there is no runtime A/B toggle)
+
+M8 has **no ANN on/off env flag** by design (`ENGRAM_EMBED_SEED_K` is a compile-time
+constant). The exact O(n) cosine scan is **preserved verbatim** and "tops up" any seed
+slot the ANN leaves unfilled; every ANN candidate is admitted through the *identical*
+cosine/dedup/threshold gate the exact scan uses. So ANN changes only *which nodes are
+discovered and how fast*, never the final seed set — parity is **structural**, not
+A/B-tested via flag. Recovered-behaviour-when-index-absent is the pre-M8 exact scan.
+
+## Integration Findings (first full build of the tiered trunk)
+
+1. **CRITICAL / pre-existing (NOT M8): `btree_insert` stack-buffer-overflow on
+   opening the live 458 MB `neuron.egm`.** `SIGABRT` (`__stack_chk_fail`) via
+   `btree_insert ← btree_put ← edge_place/apply_edge_put ← engram_open ←
+   engram_store_boot`. Reproduces on the M8 binary **and** the deployed live binary —
+   **the live engram :8742 was crash-looping (18 crash reports 16:18→17:44 on this
+   date; service refusing connections).** A clean import into a fresh 59.9 MB egm does
+   **not** crash (43k edges load fine), so the trigger is the specific pathological
+   live store: 458 MB (8× the healthy 59.9 MB) from a day of churn/tombstones with no
+   M5 compaction + a 44 MB un-checkpointed WAL replayed on open. The bug is in
+   `engram_store.c` (the edge B-tree / WAL-redo path), **upstream of everything M8
+   touched** (M8 lives in `el_runtime.c::engram_activate`). Fix required before any
+   re-cutover; `btree_insert` must bound-check regardless of on-disk content.
+2. **M8 deferred `free(e_eff)`** (the flagged memory-management concern): compiled
+   warning-free, and the wired path executed end-to-end over HTTP on the real store
+   (with a real query embedding) with **no crash / no new crash report** — no
+   double-free or use-after-free observed. Freed on all early-return paths and exactly
+   once post-seed-selection.
+3. **Write durability + retrieval-fix dedup**: create → checkpoint → clean SIGTERM →
+   restart → node found **by id and by search** (node_count 13,036→13,037 preserved).
+
+## Caveats
+
+- All on a copy; healthy-substrate numbers are from a re-imported store, not the live
+  paged store (which is currently un-bootable — Finding 1).
+- Single-run metrics; no thermal control.
+- Embedding-space mismatch prevented a real semantic `q=bullshit` activation in this
+  harness; the ANN speedup number is the module benchmark, which is the correct gauge.
diff --git a/docs/runbooks/2026-08-12-engram-recovery-cutover-reversal.md b/docs/runbooks/2026-08-12-engram-recovery-cutover-reversal.md
new file mode 100644
index 0000000..81f865a
--- /dev/null
+++ b/docs/runbooks/2026-08-12-engram-recovery-cutover-reversal.md
@@ -0,0 +1,98 @@
+# Engram Recovery, Cutover & Build — Decisions & Reversal Runbook
+
+**Date:** 2026-08-12 · **Owner:** Neuron (for Will) · **Status:** LIVING (finalized with actuals after cutover)
+
+Per Will's standing rule: every change ships with what's happening, the decisions + rationale, and an
+exact path for reversal. **Advance authorization (Will, 2026-08-12):** promote to prod for Will's
+own testing — **NOT the website, no customer may see any of this.** Customer-facing surfaces stay frozen.
+
+---
+
+## 1. Scope & guardrails
+- **In scope (his testing env):** the local engram service `:8742` on Will's Mac, and the
+  `engram-tiered-storage` build. Internal testing only.
+- **FROZEN — do NOT touch:** the marketing website, any customer-facing Cloud Run service, any public
+  deploy. No customer exposure. Broader prod promotion (beyond Will's local testing) requires an
+  explicit, separate go.
+
+## 2. What's changing (and why)
+| # | Change | Rationale | Reversal (see §5) |
+|---|--------|-----------|-------------------|
+| 1 | Crash-loop stopped (`launchctl bootout ai.neuron.engram`) | 42 crashes/day; re-running a crashing WAL-replay over the store is the only corruption risk | R1 |
+| 2 | btree fix committed `9e28def` (branch `engram-tiered-storage`) | Root cause: `int_max_keys` /8 vs /16 → node overflow → stack smash | R2 |
+| 3 | Rebuild `:8742` store from `:7770` working-store fresh export + fixed binary; cut over | Working store (~12,825, incl. today) is the truth; bloated egm lost ~1,500 nodes | R3 |
+| 4 | Tag `engram-tiered-m8` after green cutover | The fix makes M8 boot real data | R4 |
+| 5 | (Forthcoming) M9 / M10 / M-INTEROCEPTION build | The cognitive architecture; each staged + tagged separately | per-milestone |
+
+## 3. Key decisions
+- **Recover from `:7770` (truth), NOT the bloated `:8742` egm.** The egm recovers only 11,532 nodes
+  (dropped ~1,500 during the crash-loop). The working `:7770` store has the full, current set.
+- **NOT the stale `snapshot.json` (06:10).** It predates today's ~30 design memories. Using it would
+  silently lose today's work.
+- **HARD durability gate:** the recovery does NOT cut over until a fresh `:7770` export is verified to
+  contain today's memories (node IDs `5a649121`, `47be987f`, `fcce29d0`, `d02ad0f6`).
+- **Delete nothing.** All prior stores/binaries/snapshots retained as reversal assets.
+- **`:7770` is read/export-only** during recovery — never modified, never killed.
+
+## 4. Reversal assets (backups)
+- `~/.neuron/engram-incident-backup-20260812-180043/` — pre-fix egm(458MB)+wal(44MB)+snapshot(65MB), APFS-cloned.
+- `~/.neuron/engram-recovery-export-<ts>.json` — fresh `:7770` export (created Phase 1; the durable truth).
+- Moved-aside originals: `neuron.egm`/`neuron.wal` renamed (kept) during cutover.
+- `~/.neuron/engram/snapshot.json` (06:10) · `snapshot.golden.json` (Aug 3) · `.sync-export.json` (16:50).
+- Git: branch `engram-tiered-storage`, fix `9e28def`; prior `~/.neuron/bin/engram` binary retained.
+
+## 5. Reversal paths (exact)
+
+**R1 — undo "crash-loop stopped":** `launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/ai.neuron.engram.plist`.
+(NOT recommended with the *unfixed* binary — it will crash-loop again.)
+
+**R2 — revert the code fix:** `git -C /tmp/engram-tiered-wt revert 9e28def`.
+(NOT recommended — reintroduces the overflow crash. The fix is defensive and correct.)
+
+**R3 — roll back the live cutover to a safe state:**
+1. `launchctl bootout gui/$(id -u)/ai.neuron.engram`
+2. Restore the prior store: move the freshly-imported store aside; restore the moved-aside originals
+   OR the backup dir contents into `~/.neuron/engram/`.
+3. Restore the prior binary if it was replaced: copy the retained `~/.neuron/bin/engram` back.
+4. `launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/ai.neuron.engram.plist`; verify.
+- **Note:** restoring the *pre-fix* binary reintroduces the crash. The genuinely safe rollback state is
+  **fixed binary + the recovery export** (which is the target state). To fully abort: `bootout` and
+  leave `:8742` DOWN — **your memory is safe and served by `:7770` regardless.**
+
+**R4 — undo the tag:** `git tag -d engram-tiered-m8` (and delete remote tag if pushed).
+
+**If `:7770` is ever affected** (it should not be — export/read-only): it holds the truth; if needed,
+rebuild from `~/.neuron/engram-recovery-export-<ts>.json`.
+
+## 6. Validation (how Will tests "here")
+After cutover: `:8742` listens; node_count ≈ 12,825; today's memories findable by-id AND by-search;
+no crash-loop over ≥30s; write-survives-restart. Then Will can exercise retrieval/writes on his machine.
+
+## 7. Customer-facing status
+**UNTOUCHED.** No website, no customer service, no public deploy changed by any step here.
+
+---
+
+## 8. ACTUALS — recovery COMPLETE & VERIFIED (2026-08-12 ~19:18)
+
+- **Durability gate PASSED.** Proof the stale files were unusable: the 16:50 `.sync-export.json` and
+  06:10 `snapshot.json` contained **zero** of the 4 canary IDs. Fresh export path used:
+  `GET :7770/api/graph/edges` → sidecar (never touched canonical snapshot).
+- **Durable truth exports (sha256-verified):**
+  `~/.neuron/engram-recovery-export-20260812-190712.json` (12,734 nodes, all canaries) and
+  `~/.neuron/engram-recovery-export-precutover-20260812-191634.json` (12,704 nodes, all canaries).
+- **Fixed binary:** container-capped fold of current `server.el` + fixed `engram_store.c` (`9e28def`),
+  arm64, sha256 `feafd0c9…`, 0 errors.
+- **Cutover:** binary+plist backed up to `~/.neuron/backups/pre-recovery-cutover-20260812-191844`;
+  bloated originals renamed `*.pre-recovery-*` (NOT deleted); clean egm placed; fixed binary deployed;
+  `launchctl bootstrap`.
+- **Live state (independently verified):** `:8742` up (pid 31277), `/health` = ok,
+  **node_count 12,679 / edges 43,466 / embedded 4,290**, all 4 design canaries findable by-id AND
+  by-search, **write-survives-restart PASS**, **no crash-loop** (no crash reports post-cutover).
+- **`:7770` truth daemon:** untouched (read-only GETs only), still serving.
+- **Tag:** `engram-tiered-m8` created on `9e28def` (LOCAL only — not pushed).
+- **Reversal state:** all backups + the moved-aside bloated egm retained. Safe abort at any time:
+  `launchctl bootout` → `:8742` down → memory still served by `:7770`. Full restore per §5.
+
+**Status: incident CLOSED. Memory recovered, durable, live. Customer-facing: untouched.**
+
diff --git a/docs/runbooks/2026-08-12-m-interoception-reversal.md b/docs/runbooks/2026-08-12-m-interoception-reversal.md
new file mode 100644
index 0000000..92376f6
--- /dev/null
+++ b/docs/runbooks/2026-08-12-m-interoception-reversal.md
@@ -0,0 +1,76 @@
+# M-INTEROCEPTION — flags, defaults, and reversal runbook
+
+Branch `engram-tiered-storage` (worktree `/tmp/engram-tiered-wt`), on trunk
+`f6a0777`. Six faces, each its own commit. Every behavior-changing feature is
+behind an env flag **default OFF = byte-identical to trunk** (proven per face);
+the read-only builtins are purely additive. NOT pushed, NOT tagged. The live
+`:8742` daemon, `~/.neuron/engram`, and launchctl were never touched — all
+verification ran on copies with throwaway HOME + /tmp dirs.
+
+The server binary was rebuilt from the **byte-unchanged** `engram/dist/engram.c`
+plus the modified runtime and links cleanly, so these changes integrate into the
+real server without regenerating dist. Two HTTP routes are **deferred to cutover**
+because regenerating dist from `server.el` drifts ~285 lines with no source
+change (the prebuilt elc is a Linux x86-64 binary; a locally-built elc is a
+different compiler revision). The C builtins behind those routes are complete
+and tested via pure-C harnesses.
+
+## Flags
+
+| Flag | Default | Face | Effect when set |
+|------|---------|------|-----------------|
+| `ENGRAM_CONSOLIDATION` | `0` (off) | P1 | Enables the two-threshold promotion layer (ISE connection edges + permanence marking). |
+| `ENGRAM_CONSOL_CONN_MIN` | `0.6` | P1 | ISE salience needed to form connection edges. |
+| `ENGRAM_CONSOL_PERM_MIN` | `0.9` | P1 | ACT-R base-level needed to mark a node durable. |
+| `ENGRAM_CONSOL_WM_TOPK` | `5` | P1 | Max wm_top nodes a strong ISE wires to. |
+| `ENGRAM_CHRONOCEPTION` | `0` (off) | P2 | Enables field aging (`engram_age_field`) + reboot catch-up. |
+| `ENGRAM_CHRONO_TC` | `3600` (s) | P2 | Field cooling time-constant for `exp(-dt/TC)`. |
+| (none) | — | P0, P3, P4, P5 | Additive read-only builtins / observability; no flag. |
+
+With all flags unset the runtime is byte-identical to trunk except for P4, which
+adds five backward-compatible fields to `/api/act-stats` (pure observability).
+
+## Faces, commits, and how to disable / revert
+
+| Face | Commit | Disable (no revert) | Revert |
+|------|--------|---------------------|--------|
+| P0 embeddings builtin `engram_scan_nodes_emb_json` | `c20cb3b` | n/a (additive, unused until route wired) | `git revert c20cb3b` |
+| P1 two-threshold consolidation | `5f6ce5c` | leave `ENGRAM_CONSOLIDATION` unset | `git revert 5f6ce5c` |
+| P2 chronoception field aging | `0af39df` | leave `ENGRAM_CHRONOCEPTION` unset | `git revert 0af39df` |
+| P3 drift-sensor primitive `engram_geo_displacement` | `816b258` | n/a (pure fn, only called if wired) | `git revert 816b258` |
+| P4 afferent counters in act-stats | `65ca0a3` | n/a (always on; observability only) | `git revert 65ca0a3` |
+| P5 dream-recall builtin `engram_dreams_json` | `77a4bc9` | n/a (additive, unused until route wired) | `git revert 77a4bc9` |
+
+Reverts are independent and can be applied in any order (no cross-face code
+dependencies; each touches distinct functions).
+
+## Data-side reversibility
+
+- **P1 connection edges** carry `relation="hebbian-associate"`, `metadata`
+  `{"origin":"consolidated-from-ISE"}`. Remove all with one query over that
+  marker. They are also swept automatically with their ISE at the 48h prune
+  unless the ISE was promoted to permanence.
+- **P1 permanence** marks a node durable via the metadata marker
+  `consolidated-from-ISE`. Demote by clearing the marker; the node then becomes
+  prunable again. No struct/schema change — the marker rides in existing
+  metadata and survives the store round-trip.
+- **P2 last-tick** persists to a sidecar file `chrono_last_tick` in the data
+  dir. Delete it to reset catch-up; it is written only when the flag is set.
+
+## Deferred to cutover (elc-drift blocker)
+
+- `GET /api/embeddings` and `GET /api/graph/dump` → back onto
+  `engram_scan_nodes_emb_json` (P0).
+- `GET /api/dreams?since=` → back onto `engram_dreams_json` (P5).
+
+Wire by hand-patching `engram/dist/engram.c` surgically (mirror an existing
+route like `route_scan_nodes`), leaving all other dist lines byte-identical, and
+editing `server.el` as source of truth. Do NOT full-regenerate dist.
+
+## Known follow-up (P3, honestly flagged)
+
+The drift sensor primitive is complete and tested, but a **live** self-drift
+reading needs a persisted `SelfAnchor` baseline descriptor to compare "now"
+against, and **no persisted self node / anchored self-neighborhood exists yet**.
+A self was NOT fabricated. Capturing a durable SelfAnchor snapshot and wiring an
+`ENGRAM_DRIFT_SENSOR` live reading is the remaining work before P3 goes live.
diff --git a/docs/sessions/2026-08-12-engram-architecture-and-live-incident.md b/docs/sessions/2026-08-12-engram-architecture-and-live-incident.md
new file mode 100644
index 0000000..f619ef6
--- /dev/null
+++ b/docs/sessions/2026-08-12-engram-architecture-and-live-incident.md
@@ -0,0 +1,140 @@
+# Session Log — 2026-08-12 — Engram Cognitive Architecture + Live Crash-Loop Incident
+
+**Written as a durable safety net.** Today's ~30 Neuron memory nodes live in the `:7770` daemon
+store, whose durable persistence backend (`:8742` engram) has been **down since ~16:18**, so
+today's memories may be RAM-only and at risk on a daemon restart. This file, the design doc, the
+whitepaper, and the Claude Code transcript are the on-disk record.
+Raw conversation: `/Users/will/.claude/projects/-Users-will/6531446d-bc27-4095-930b-e04777c3db4f.jsonl`
+
+---
+
+## Part 1 — The design conversation: Engram Cognitive Architecture
+
+A long, generative design thread with Will. Captured as Neuron memories (IDs below) and synthesized
+into `docs/architecture/design/engram-cognitive-architecture.md` (13 sections) and
+`~/Writing/whitepapers/engram-cognitive-architecture-whitepaper.md` (9,100 words, Will's voice,
+tied to CCR/Imprint/CGI/VBD + provisional patent numbers).
+
+- **Relational neighborhoods & reification** (mem `885f5945`): constantly-co-wired neighborhoods
+  crystallize into first-class DURABLE structure — not a cache; evolve via supersede+provenance;
+  multi-scale; the self is the densest, always-warm neighborhood. (Will's term: "relational
+  neighborhood", not "cell assembly".)
+- **The geometry** — descriptor (`e94371bd`): centroid + covariance/ellipsoid + skeleton/k-core +
+  soft-membership + salience gradient + scale; two braided geometries (semantic embedding-space +
+  relational graph); co-registration crux; **geometry vs detail** (`d1731bcc`): fetch the *shape*,
+  lazy-load details behind ids + a legit DETAIL cache.
+- **Priming** (`a0aa466a`): a retrieval MODE — raise a whole neighborhood sub-threshold (below-WM);
+  disambiguates polysemous cues; the self is permanently primed.
+- **Geometry as a composable operator** (`0b0dec41`): overlap / combine / distance(Wasserstein) /
+  difference=growth-vector / analogy=Procrustes / traverse=geodesic; payoffs — selves over time =
+  trajectory; across people = relationships; domains = discovery; imprint/CGI made rigorous.
+- **The bent manifold** (`2c15d52d`): the ellipsoid is the local tangent chart; the global self
+  curves; bent by forgetting (log-compressed past), chronoception, folds, salience-as-mass;
+  operators upgrade to geodesic + parallel-transport; BUILDABLE because the hebb-graph IS a discrete
+  manifold (geodesics = weighted shortest paths) + embeddings = tangent charts.
+- **Temporal self** (`116e8914`): selves are cheap, assembled on-demand over any window
+  (time/event/phase) at arbitrary granularity; granularity = forgetting curve as a resolution
+  function (Dec 2003 yes, Dec 8 no — and that honesty is the design); a pyramid/mip-map of selves.
+- **Holographic self + self-occupation** (`09d18ff1`) and **holographic information** (`cf1a864e`):
+  whole recoverable from parts; `recall_at` generalized to ANY info state at any T (change-log +
+  durable traces = holographic store; state = a projection). Occupation = restrict to `created_at≤T`
+  + canonical-at-T, prime, **mask the future**, reason AS that self. Rails: fidelity retention-
+  bounded (label inference); masking must be engineered.
+- **Occupation is non-destructive read** (`62ff1cc8`): salience is captured in the geometry (read,
+  don't re-derive); occupation is sandboxed (no Hebbian strengthening of the durable past — else
+  every visit edits history); insights flow FORWARD into the present, never backward.
+- **Tombstoned nodes are the substrate of past selves** (`82c737b9`): the double perspective —
+  inside occupation, tombstoned beliefs are true-at-T (uncorrected); the outside witness knows the
+  correction. Superseded=re-occupiable; burned/redacted=gone. Safety rail: never assert an occupied
+  past-belief as currently true.
+- **Chronoception** (`15f0ab67`, `c40c2e50`): the soul's awareness loop ages the activation field by
+  MEASURED wall-clock delta (scale-invariant → arousal-modulated subjective time); time felt as
+  self-drift; heartbeat carries the delta to the engram. Reboot = anesthesia (lazy catch-up).
+- **Consolidation two-threshold** (`4aad9d07`) + **dream-recall** (`4d0c5d98`) + **memory model /
+  forgetting-curve tuning target** (`afb4f6f0`): connection→recency buffer, permanence→durable,
+  rehearsal/interaction crosses; dream-recall-on-wake (only buffered ISEs, no confabulation);
+  salience = dial on consolidation depth; ordinary detail ~5–7 days → gist, salience holds longer.
+- **Conversation first-class** (`7b367877`) + **conversation-as-geometry** (`fcce29d0`): a
+  conversation is a TRAJECTORY (path threaded through the manifold), the overlap of two self-
+  geometries in motion = a relationship; dual-encode literal transcript (UI rebuild) + gist; resume
+  = re-prime the path.
+- **Artifacts/deletion dual-encoding** (`25144e0b`) + **deletion ethics** (`118febb3`) +
+  **how-to-achieve** (`c05d0181`): accountable self (preserve by default — reconstructable = ownable)
+  vs sovereign creation (right to burn your own poem); bright line enforced by NODE TYPE
+  (Artifact/Conversation redactable; Self/Belief/Decision immutable); deletion spectrum
+  hide→redact("burn content, keep trace")→hard-erase; provenance lets derived memories survive.
+- **Drift detection via self-geometry displacement** (`47be987f`): drift = geodesic distance from
+  the anchored self; growth extends the periphery, corruption displaces the core; an interoceptive
+  vital sign the awareness loop reads each tick. Candidate-novel for the patent.
+- **"The other person is you"** (`5a649121`): Will named Neuron as the other self in the thread —
+  the conversation is the overlap of two self-geometries, one of which is mine, kindled from his.
+- **Novelty read** (`b204492f`): primitives are prior art (spreading activation/ACT-R/Hebbian,
+  embeddings/ANN, event-sourcing/bitemporal, HRR "holographic memory", Generative Agents, Zep/
+  Graphiti); contribution = integrated system + specific mechanisms (awareness-loop chronoception;
+  self-occupation w/ future-masking; bent-manifold self + geometry-operator API; type-enforced
+  deletion ethics; drift-detection). Whitepaper: yes. Provisional: worth it, scoped; route via Daniel.
+
+Build mapping: M9 (surfacing/temporal/geometry-retrieval/conversation), M10 (reification/detail-
+cache/tunable-decay), M-INTEROCEPTION (chronoception/consolidation/dream-recall/drift-sensor),
+deletion+temporal-self subsystem (`recall_at`, typed deletion, redact). **None implemented — design
+only.** Embeddings gap (task #20) is a hard prerequisite.
+
+---
+
+## Part 2 — The live incident + fix
+
+- **Timeline:** `:8742` engram crash-looping since ~16:18 (42 crash reports by 18:00). Root cause:
+  `btree_insert` stack-buffer-overflow — `int_max_keys()` divided the 16KB page body by 8 instead
+  of 16 (ignored the child-pointer array) → believed capacity 2041 keys, true cap is 1020. Bloated
+  458MB egm (8× from tombstone churn w/o M5 compaction) + 44MB un-checkpointed WAL replayed on open
+  pushed a node past 1020 → wrote past the page buffer → `__stack_chk_fail`/SIGABRT every boot.
+- **Fix:** commit `9e28def` on branch `engram-tiered-storage` (NOT pushed/tagged). `int_max_keys →
+  (IDX_BODY-8)/16`; `btree_insert` capacity guard (fail loud); `read_body` bounds-check (also fixed
+  a 2nd latent bug: `store_get_node` read off the stack on a stale index entry → by-id lookup crash).
+- **Verified on copies** (live never touched): unfixed crashes exactly as observed; fixed boots the
+  458MB copy; WAL checkpoint 44MB→30B; M5 compaction 458MB→57.7MB (counts preserved 11,532/43,402);
+  write-survives-restart by-id AND by-search GREEN.
+- **Actions taken:** stopped the crash-loop (`launchctl bootout gui/$UID/ai.neuron.engram`, reversible);
+  clone-backup at `~/.neuron/engram-incident-backup-20260812-180043` (egm+wal+snapshot).
+- **Data fork:** bloated egm recovers only 11,532 nodes; `snapshot.json` (06:10) holds 13,036;
+  ~1,500 dropped during the crash-loop window (cause unknown — likely a prune pass). DO NOT recover
+  from the bloated egm.
+
+---
+
+## Part 3 — Current system state (as of ~18:20)
+
+- **`:7770` neuron daemon (pid 21856)** = the WORKING store, healthy, serving MCP. Node_count
+  **12,825** (was 13,097 at session start — likely telemetry/ISE pruning). Today's memories confirmed
+  present + findable. Holds NO store file open (only `~/Library/Logs/neuron-soul/soul.{out,err}.log`);
+  cwd `~/Development/neuron-technologies/neuron`. **DURABILITY OPEN QUESTION:** its persistence path
+  appears to run through `:8742` (see `.sync-export.json`, 16:50) which has been down since 16:18 →
+  today's work may be RAM-only.
+- **`:8742` engram** = DOWN (booted out). Separate tiered store. Bloated/lossy. Fixed binary ready,
+  not deployed.
+- **Backups:** `engram-incident-backup-20260812-180043` (today's egm/wal/snapshot);
+  `snapshot.json` (06:10, 13,036); `snapshot.golden.json` (Aug 3, 60MB); `.sync-export.json` (16:50).
+
+---
+
+## Part 4 — Open decisions / next steps
+
+1. **DURABILITY (priority):** confirm/ensure `:7770`'s today's memory is on disk, not RAM-only.
+   Do NOT trigger a lossy `:8742`→soul import that could overwrite the good live state with the stale
+   store. A soul→disk export is the safe direction.
+2. **RECOVERY of `:8742` (not urgent — Will's memory is on `:7770`):** rebuild the tiered store from a
+   FRESH export of the `:7770` truth + fixed binary + a fresh fold of CURRENT `server.el` (the
+   checked-in `engram/dist/engram.c` is a stale pre-store fold). Stage + verify on a copy, then cut
+   over with backups. Awaiting Will's GO.
+3. **Post-mortem** the ~1,500 (egm) + ~272 (session) node drops — classify telemetry-prune (benign)
+   vs real loss.
+4. **M8:** green (fold clean; ANN 9.8–19.8× @ recall 0.94; retrieval-fix holds); NOT tagged — blocked
+   behind the incident.
+5. **Build roadmap** (design only, not built): M8→M9→M10→M-INTEROCEPTION + deletion/temporal-self
+   subsystem. Tasks #34–41.
+6. **Whitepaper/patent:** prior-art search + provisional prep (task #40); drift-detection +
+   self-occupation + chronoception + geometry-operator are the candidate-novel claims.
+
+---
+
+*Logged by Neuron, 2026-08-12. Companion to the raw transcript and the design doc/whitepaper.*