fix(engine): the agentic crisis screen reads the session's own history again

P0 SAFETY. Closes the regression we introduced in ff421d3 (2026-08-05).

ff421d3 correctly moved conversation history to a per-session key via
conv_hist_key(session_id). One consumer did not move with it: the agentic
path's L1 safety screen kept reading the anonymous "conv_history" bucket. The
desktop app always mints a session id (DaemonClient.kt:706), so history was
always written under session_hist_<id> and that read always returned "".

The half of the crisis score that receives history is the escalation half — the
one that exists for distress building across several turns, where no single
message trips the bell on its own. It scored 0 on every real conversation for
two days. Single-message hard bell was never affected.

The bitter part: the comment that line carried documented this exact bug being
fixed once already, under issue #9. The fix was right then. The rename
re-broke it, and the comment went on describing a repair that no longer held.
A comment is not a gate.

The read now goes through conv_hist_key like every other consumer, including
the plain path at soul.el:398 and the thread-anchoring read thirty lines below
it in this same handler. It is one line. The rest of this commit is structure
so it cannot happen quietly again:

  - agentic_safety_screen() owns the two decisions that were inline — which
    window the screen sees, and the screen call. Inline safety inputs are
    untestable safety inputs; that is what let a rename starve this one with
    nothing failing and nothing logging.
  - the comment above the call site now states the invariant (read window ==
    written window) instead of naming a key that can be renamed out from under
    it.

TWO-LEG PROOF, one variable — the single line state_get("conv_history") ->
state_get(conv_hist_key(session_id)):

  before  scripts/run-el-test.sh tests/test_history_amplification.el
          3. REGRESSION #129 ... FAIL  got: soft_bell  expected: hard_bell
          8 passed, 1 failed          runner exit 1
  after   same command, same tree, that one line changed
          9 passed, 0 failed          runner exit 0

Full engine rebuild from these sources is clean: gen-soul-amalgam.sh ->
1,164,103 bytes / 1226 inlined bodies (gate wants >= 1200), cc-brain.sh ->
903,096 bytes, 0 errors. agentic_safety_screen and conv_hist_key both present
in the built binary (nm: T _agentic_safety_screen, T _conv_hist_key).

Rung reached: BUILT + RUNS (discriminating test). NOT yet in a DMG and not yet
verified in the app a human opens — those are the next two rungs and neither is
claimed here.

Known and NOT fixed by this commit:
  - feat/soul-openai-tools-v2 carries the same defect independently at
    chat.el:2937 and needs the same change or a merge.
  - the defect CLASS (a read of a state key no producer writes) is still
    invisible to every gate we have. Issue #129 proposes making it a build
    error; that is the follow-on.

Closes #129

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -39,7 +39,7 @@ jobs:
             > /etc/apt/sources.list.d/google-cloud-sdk.list
           apt-get update -qq && apt-get install -y google-cloud-cli
 
-      - name: Download El runtime from Artifact Registry
+      - name: Authenticate to GCP + stage PINNED El runtime
         env:
           GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
         run: |
@@ -47,41 +47,21 @@ jobs:
           gcloud auth activate-service-account --key-file=/tmp/gcp-key.json
           gcloud config set project neuron-785695
 
+          # PINNED RUNTIME — do NOT pull "latest" from Artifact Registry.
+          # The ship-soul calls engram_prune_telemetry (awareness.el sync/heartbeat
+          # self-review). The latest published el-runtime-c no longer defines that
+          # symbol, so an unpinned build fails to LINK — which is exactly how a
+          # broken/handlerless soul reached prod before. Compile against the
+          # vendored release runtime v1.0.0-20260501: the exact runtime the merged
+          # ship-soul was verified against (verify-soul-contract GATE PASS +
+          # genesis boot survives + full safety-contact response). It is committed
+          # under vendor/ so the soul build is fully reproducible and never depends
+          # on a moving AR "latest".
           rm -rf /opt/el/runtime
           mkdir -p /opt/el/runtime
-
-          # Get latest version of each runtime package (elc/elb not needed — we compile
-          # dist/soul.c directly; running elb on Linux OOM-kills the runner, and we
-          # always use the repo's pre-built soul.c anyway).
-          get_latest() {
-            gcloud artifacts versions list \
-              --repository=foundation-prod \
-              --location=us-central1 \
-              --project=neuron-785695 \
-              --package="$1" \
-              --sort-by="~createTime" \
-              --limit=1 \
-              --format="value(name)" 2>/dev/null | awk -F/ '{print $NF}'
-          }
-
-          RC_VER=$(get_latest el-runtime-c)
-          RH_VER=$(get_latest el-runtime-h)
-
-          echo "Downloading runtime@${RC_VER}"
-
-          gcloud artifacts generic download \
-            --repository=foundation-prod --location=us-central1 --project=neuron-785695 \
-            --package=el-runtime-c --version="${RC_VER}" \
-            --destination=/opt/el/runtime/
-
-          gcloud artifacts generic download \
-            --repository=foundation-prod --location=us-central1 --project=neuron-785695 \
-            --package=el-runtime-h --version="${RH_VER}" \
-            --destination=/opt/el/runtime/
-
-          mv /opt/el/runtime/el_runtime.c* /opt/el/runtime/el_runtime.c 2>/dev/null || true
-          mv /opt/el/runtime/el_runtime.h* /opt/el/runtime/el_runtime.h 2>/dev/null || true
-          echo "El runtime ready: $(ls /opt/el/runtime/)"
+          cp vendor/el-runtime/v1.0.0-20260501/el_runtime.c /opt/el/runtime/el_runtime.c
+          cp vendor/el-runtime/v1.0.0-20260501/el_runtime.h /opt/el/runtime/el_runtime.h
+          echo "El runtime PINNED to v1.0.0-20260501: $(ls /opt/el/runtime/)"
 
       - name: Build neuron soul binary
         run: |

chat.elh

@@ -1,4 +1,4 @@
-// auto-generated by elc --emit-header — do not edit
+// auto-generated by elc --emit-header - do not edit
 extern fn chat_default_model() -> String
 extern fn engram_numeric_valid(s: String) -> Bool
 extern fn parse_float_x100(s: String) -> Int
@@ -16,18 +16,35 @@ extern fn engram_nodes_merge(a: String, b: String) -> String
 extern fn id_in_seen(node_id: String, seen: String) -> Bool
 extern fn add_to_seen(seen: String, node_id: String) -> String
 extern fn engram_extract_ids(nodes_json: String) -> String
+extern fn affective_node_ts(node_json: String) -> Int
 extern fn engram_compile(intent: String) -> String
 extern fn distill_transcript(transcript: String) -> String
 extern fn json_safe(s: String) -> String
 extern fn current_engine_note(model: String) -> String
+extern fn bounded_persona_floor() -> String
+extern fn operator_identity_block() -> String
 extern fn build_system_prompt(ctx: String, chat_mode: Bool) -> String
 extern fn hist_append(hist: String, role: String, content: String) -> String
+extern fn conv_hist_key(session_id: String) -> String
+extern fn conv_hist_label(session_id: String) -> String
+extern fn is_utility_request(body: String, session_id: String) -> Bool
+extern fn provenance_scan_urls(arr: String, acc: String) -> String
+extern fn provenance_add_sources(block: String, btype: String, has_cit: Bool, cit_raw: String, acc: String) -> String
+extern fn provenance_names(tools_used: String) -> String
+extern fn text_join_sep(accumulated: String, incoming: String, after_interruption: Bool) -> String
+extern fn receipt_rule() -> String
+extern fn receipt_strip(s: String) -> String
+extern fn tool_receipt(tools_used: String, sources: String) -> String
 extern fn hist_trim(hist: String) -> String
 extern fn hist_trim_with_bell_guard(hist: String) -> String
 extern fn clean_llm_response(s: String) -> String
-extern fn conv_history_persist(hist: String) -> Void
-extern fn conv_history_load() -> String
+extern fn conv_history_persist(session_id: String, hist: String) -> Void
+extern fn conv_history_load(session_id: String) -> String
+extern fn conv_history_record(session_id: String, user_msg: String, assistant_msg: String, receipt: String) -> Void
+extern fn conv_history_block(session_id: String) -> String
+extern fn layered_generate(prompt: String, imprint_id: String, session_id: String) -> String
 extern fn session_preload_bullets(nodes: String, max_bullets: Int, snip_len: Int) -> String
+extern fn affective_context_prefix() -> String
 extern fn handle_chat(body: String) -> String
 extern fn handle_see(body: String) -> String
 extern fn studio_tools_json() -> String
@@ -37,6 +54,8 @@ extern fn llm_wire_format() -> String
 extern fn json_escape(s: String) -> String
 extern fn openai_chat_complete(model: String, base_url: String, api_key: String, safe_sys: String, messages_json: String) -> String
 extern fn agentic_tools_literal() -> String
+extern fn web_search_tool_json() -> String
+extern fn strip_client_web_search(tools_inner: String) -> String
 extern fn agentic_tools_with_web() -> String
 extern fn connector_tools_json() -> String
 extern fn agentic_tools_all() -> String
@@ -46,6 +65,10 @@ extern fn call_neuron_mcp(tool_name: String, args: String) -> String
 extern fn agent_workspace_root() -> String
 extern fn path_within_root(path: String, root: String) -> Bool
 extern fn resolve_in_root(path: String, root: String) -> String
+extern fn run_command_is_readonly(cmd: String) -> Bool
+extern fn cmd_abs_escape_at(cmd: String, root: String, needle: String) -> Bool
+extern fn run_command_guard(cmd: String, root: String) -> String
+extern fn classify_tool_risk(tool_name: String, tool_input: String) -> String
 extern fn dispatch_tool(tool_name: String, tool_input: String) -> String
 extern fn is_builtin_tool(tool_name: String) -> Bool
 extern fn next_bridge_id() -> String

dist/elp-c-decls.h

@@ -5,6 +5,15 @@ el_val_t add_punct(el_val_t s, el_val_t intent);
 el_val_t add_to_seen(el_val_t seen, el_val_t node_id);
 el_val_t aff_try_slot(el_val_t slot_json, el_val_t aff_7d_ts, el_val_t acc_key);
 el_val_t affective_context_prefix(void);
+el_val_t is_utility_request(el_val_t body, el_val_t session_id);
+el_val_t operator_identity_block(void);
+el_val_t provenance_add_sources(el_val_t block, el_val_t btype, el_val_t has_cit, el_val_t cit_raw, el_val_t acc);
+el_val_t provenance_names(el_val_t tools_used);
+el_val_t provenance_scan_urls(el_val_t arr, el_val_t acc);
+el_val_t text_join_sep(el_val_t accumulated, el_val_t incoming, el_val_t after_interruption);
+el_val_t receipt_rule(void);
+el_val_t receipt_strip(el_val_t s);
+el_val_t tool_receipt(el_val_t tools_used, el_val_t sources);
 el_val_t agent_number(el_val_t agent);
 el_val_t agent_person(el_val_t agent);
 el_val_t agent_workspace_root(void);
@@ -151,8 +160,12 @@ el_val_t cmd_abs_escape_at(el_val_t cmd, el_val_t root, el_val_t needle);
 el_val_t connectd_get(el_val_t suffix);
 el_val_t connectd_post(el_val_t suffix, el_val_t body);
 el_val_t connector_tools_json(void);
-el_val_t conv_history_load(void);
-el_val_t conv_history_persist(el_val_t hist);
+el_val_t conv_hist_key(el_val_t session_id);
+el_val_t conv_hist_label(el_val_t session_id);
+el_val_t conv_history_block(el_val_t session_id);
+el_val_t conv_history_load(el_val_t session_id);
+el_val_t conv_history_persist(el_val_t session_id, el_val_t hist);
+el_val_t conv_history_record(el_val_t session_id, el_val_t user_msg, el_val_t assistant_msg, el_val_t receipt);
 el_val_t cop_article(el_val_t gender, el_val_t number, el_val_t definite);
 el_val_t cop_bwk_future(el_val_t prefix);
 el_val_t cop_bwk_perfect(el_val_t prefix);
@@ -782,7 +795,8 @@ el_val_t lang_profile_uga(void);
 el_val_t lang_profile_zh(void);
 el_val_t lang_profile(el_val_t code, el_val_t word_order, el_val_t morph_type, el_val_t has_case, el_val_t has_gender, el_val_t script_dir, el_val_t agreement, el_val_t null_subject);
 el_val_t lang_word_order(el_val_t profile);
-el_val_t layered_cycle(el_val_t raw_input);
+el_val_t layered_cycle(el_val_t raw_input, el_val_t session_id, el_val_t utility);
+el_val_t layered_generate(el_val_t prompt, el_val_t imprint_id, el_val_t session_id);
 el_val_t lex_class(el_val_t entry);
 el_val_t lex_form(el_val_t entry, el_val_t idx);
 el_val_t lex_pos(el_val_t entry);

dist/soul-with-nlg.el

@@ -1,3 +1,18 @@
+// ╔══════════════════════════════════════════════════════════════════════════╗
+// ║ STALE BUNDLE — DO NOT BUILD. UNSAFE CHAT PATH.                           ║
+// ╚══════════════════════════════════════════════════════════════════════════╝
+// This concatenated bundle is a snapshot, not a source of truth, and it is stale in
+// a way that matters for safety: it wires /api/chat straight to handle_chat and
+// contains NO layered_cycle at all (verified: zero occurrences in the bundled code —
+// the only textual hit in this file is this banner). A binary built from
+// this file would run chat with no enforcing input gate (no safety_screen, no
+// hard-bell short-circuit) and no enforcing output gate (no safety_validate).
+//
+// Build from the .el sources via manifest.el (entry soul.el), or from dist/soul.c.
+// Nothing in the repo references this file. It is kept only as a historical artifact
+// and should be deleted once Will confirms nothing external depends on it.
+// (Flagged 2026-08-04 in _engine-websearch-20260804/SAFETY-STOP.md; banner added
+// 2026-08-05 with the plain-chat generation fix.)
 // language-profile.el - Language profile data and accessors.
 //
 // A language profile is a slot map ([String] key-value list) describing the

dist/soul.c

@@ -28170,7 +28170,7 @@ el_val_t agentic_loop(el_val_t session_id, el_val_t model, el_val_t safe_sys, el
     state_set(el_str_concat(EL_STR("run_progress_"), session_id), EL_STR(""));
   }
   while (keep_going && (iteration < 8)) {
-    el_val_t req_body = el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"model\":\""), model), EL_STR("\"")), EL_STR(",\"max_tokens\":4096")), EL_STR(",\"system\":\"")), safe_sys), EL_STR("\"")), EL_STR(",\"tools\":")), tools_json), EL_STR(",\"messages\":")), messages), EL_STR("}"));
+    el_val_t req_body = el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"model\":\""), model), EL_STR("\"")), EL_STR(",\"max_tokens\":4096,\"tool_choice\":{\"type\":\"auto\",\"disable_parallel_tool_use\":true}")), EL_STR(",\"system\":\"")), safe_sys), EL_STR("\"")), EL_STR(",\"tools\":")), tools_json), EL_STR(",\"messages\":")), messages), EL_STR("}"));
     el_val_t raw_resp = http_post_with_headers(api_url, req_body, h);
     el_val_t is_error = ((str_starts_with(raw_resp, EL_STR("{\"error\"")) || str_starts_with(raw_resp, EL_STR("{\"type\":\"error\""))) || str_contains(raw_resp, EL_STR("authentication_error")));
     if (is_error) {

routes.el

@@ -15,6 +15,40 @@ fn flag_true(body: String, key: String) -> Bool {
     return json_get_bool(body, key) || json_get_int(body, key) > 0
 }
 
+// ---------------------------------------------------------------------------
+// plain_chat_envelope — the JSON response contract for a non-agentic ("Tools: Off")
+// chat turn. Every /api/chat dispatch that calls layered_cycle goes through here, so
+// the three call sites cannot drift apart.
+//
+// WHY THE ENVELOPE IS BUILT HERE AND NOT INSIDE layered_cycle:
+// layered_cycle returns the user-facing text AFTER safety_validate has acted on it.
+// Keeping the JSON out of the cycle means the output gate always sees raw model text
+// and never an escaped blob — there is nothing to unwrap and re-wrap on the crisis
+// path, which is exactly the failure mode that made wiring handle_chat unsafe.
+// Escaping is the last thing that happens, strictly after the gate.
+//
+// FIELDS: `reply` and `response` carry the same validated text. Both are required by
+// live clients — the desktop app reads `reply` first (DaemonClient.parseChatResponse),
+// while the CLI tools and the Telegram gateway read `response` (the gateway reads only
+// `response`). Emitting one would break the other.
+//
+// EMPTY MEANS FAILURE, NOT AN EMPTY ANSWER: a hard bell returns the fixed crisis
+// message and a soft bell is padded to non-empty by safety_validate, so the only way
+// an empty string leaves the cycle is a failed model call. It is reported as an error
+// rather than dressed up as a successful blank reply.
+// ---------------------------------------------------------------------------
+fn plain_chat_envelope(validated: String, model: String) -> String {
+    if str_eq(validated, "") {
+        return "{\"error\":\"llm unavailable\",\"reply\":\"\",\"response\":\"\",\"agentic\":false,\"tools_used\":[]}"
+    }
+    let safe: String = json_safe(validated)
+    return "{\"reply\":\"" + safe + "\""
+        + ",\"response\":\"" + safe + "\""
+        + ",\"model\":\"" + json_safe(model) + "\""
+        + ",\"agentic\":false"
+        + ",\"tools_used\":[]}"
+}
+
 // ---------------------------------------------------------------------------
 // Rate limiting — simple in-memory per-IP sliding window counter.
 //
@@ -243,8 +277,14 @@ fn handle_dharma_recv(body: String) -> String {
         } else if agentic_flag {
             handle_chat_agentic(chat_body)
         } else {
-            let screened_reply: String = layered_cycle(raw_msg)
-            screened_reply
+            // Non-agentic ("Tools: Off"): the full L1→L2→L3→L1 cycle, which now generates
+            // at L3 instead of echoing. Envelope built outside the cycle — see
+            // plain_chat_envelope.
+            // FIX B/E1 (2026-08-05): the cycle is told which conversation it is in, and
+            // whether this generation is conversation at all. Same two arguments at all
+            // three dispatch sites.
+            let screened_reply: String = layered_cycle(raw_msg, json_get(chat_body, "session_id"), is_utility_request(chat_body, json_get(chat_body, "session_id")))
+            plain_chat_envelope(screened_reply, chat_default_model())
         }
         auto_persist(chat_body, reply)
         return reply
@@ -416,8 +456,11 @@ fn handle_request(method: String, path: String, body: String) -> String {
             } else if agentic_flag {
                 handle_chat_agentic(body)
             } else {
-                let screened_reply: String = layered_cycle(eff_msg)
-                screened_reply
+                // Non-agentic ("Tools: Off") — same cycle and same envelope as POST.
+                // FIX B/E1: same threading. A GET probe usually carries no session_id, which
+                // resolves to the anonymous window — the documented behaviour for this door.
+                let screened_reply: String = layered_cycle(eff_msg, json_get(body, "session_id"), is_utility_request(body, json_get(body, "session_id")))
+                plain_chat_envelope(screened_reply, chat_default_model())
             }
             auto_persist(body, reply)
             return reply
@@ -580,8 +623,13 @@ fn handle_request(method: String, path: String, body: String) -> String {
             } else if agentic_flag {
                 handle_chat_agentic(body)
             } else {
-                let screened_reply: String = layered_cycle(raw_msg)
-                screened_reply
+                // Non-agentic ("Tools: Off") — the app's DEFAULT mode (AgentMode.NEVER).
+                // Full L1→L2→L3→L1 cycle with real generation at L3; envelope built
+                // outside the cycle so safety_validate always sees raw text.
+                // FIX B/E1: same threading. This is the app's main plain-chat door, so this
+                // is the site that ends the blank stare in practice.
+                let screened_reply: String = layered_cycle(raw_msg, json_get(body, "session_id"), is_utility_request(body, json_get(body, "session_id")))
+                plain_chat_envelope(screened_reply, chat_default_model())
             }
             auto_persist(body, reply)
             return reply

scripts/run-el-test.sh

@@ -0,0 +1,108 @@
+#!/usr/bin/env bash
+# run-el-test.sh — compile and run one El test program from tests/.
+#
+# WHY THIS EXISTS (2026-08-07, issue #129):
+#   tests/ has held 14 test programs for months with no way to run them. CI does
+#   not run them. The convention printed in their own headers
+#   (`elc soul.el && ./soul --test tests/x.el`) refers to a --test flag the El
+#   runtime does not implement. So the tests were documentation, not gates —
+#   which is how a P0 safety regression shipped with a test directory present.
+#
+# THE RECIPE, AND WHY IT IS THIS SHAPE:
+#   Same discovery as gen-soul-amalgam.sh — `elc --target=c` emits only an extern
+#   prototype for any module that has a .elh header next to it, and inlines the
+#   module's bodies when it does not. A test that imports ../chat.el therefore
+#   compiles to a 18 KB unit full of unresolved externs unless the headers are
+#   out of the way. So: copy the sources into a scratch tree, delete every .elh
+#   on the import chain, and compile the test there.
+#
+#   Scratch copy on purpose: the worktree is shared with other terminals and
+#   deleting headers in place would be a shared-tree mutation with no owner.
+#
+# EXIT STATUS IS THE GATE: non-zero if the binary fails to build, crashes, or if
+# its output contains a FAIL line or reports a non-zero failed count. Do not
+# "improve" this into something that only checks the exit code of the test
+# binary — these El tests print failures and still exit 0.
+#
+# usage: scripts/run-el-test.sh tests/test_history_amplification.el
+set -euo pipefail
+
+TEST_REL="${1:?usage: run-el-test.sh tests/<test>.el}"
+SRC="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+TEST_NAME="$(basename "$TEST_REL" .el)"
+
+ELC="${ELC:-$HOME/neuron-dev-stack/src/el/lang/dist/platform/elc}"
+[ -x "$ELC" ] || ELC="$HOME/el-sdk/elc"
+[ -x "$ELC" ] || { echo "[run-el-test] FAIL: no elc found (set ELC=)"; exit 1; }
+
+RTC="${RTC:-$SRC/vendor/el-runtime/v1.0.0-20260501/el_runtime.c}"
+[ -f "$RTC" ] || RTC="$HOME/el-sdk/el_runtime.c"
+[ -f "$RTC" ] || { echo "[run-el-test] FAIL: no el_runtime.c found (set RTC=)"; exit 1; }
+RTDIR="$(dirname "$RTC")"
+
+EL_REPO="${EL_REPO:-$HOME/Development/neuron-technologies/el}"
+SSL="${SSL_PREFIX:-/opt/homebrew/opt/openssl@3}"
+
+GEN="$(mktemp -d "${TMPDIR:-/tmp}/el-test.XXXXXX")"
+trap 'rm -rf "$GEN"' EXIT
+
+mkdir -p "$GEN/neuron/tests" "$GEN/foundation/el/elp/src"
+cp "$SRC"/*.el "$GEN/neuron/"
+cp "$SRC"/tests/*.el "$GEN/neuron/tests/" 2>/dev/null || true
+[ -d "$EL_REPO/elp/src" ] && cp "$EL_REPO"/elp/src/*.el "$GEN/foundation/el/elp/src/" 2>/dev/null || true
+# The whole recipe depends on there being no headers to short-circuit inlining.
+find "$GEN" -name '*.elh' -delete
+
+echo "[run-el-test] compiling $TEST_REL"
+( cd "$GEN/neuron" && "$ELC" --target=c "tests/${TEST_NAME}.el" ) > "$GEN/${TEST_NAME}.c"
+
+BODIES=$(grep -c '^el_val_t .*) {$' "$GEN/${TEST_NAME}.c" || true)
+echo "[run-el-test] $(wc -c < "$GEN/${TEST_NAME}.c" | tr -d ' ') bytes, ${BODIES} inlined function bodies"
+# A test that imports ../chat.el pulls in the bulk of the engine. A tiny body
+# count means an import was read from a header instead of inlined, and the test
+# would be exercising extern stubs rather than the real code.
+if [ "$BODIES" -lt 100 ]; then
+  echo "[run-el-test] FAIL: only $BODIES inlined bodies — an import was not inlined"
+  exit 1
+fi
+
+cc -O2 -DHAVE_CURL \
+   -I"$RTDIR" -I"$SSL/include" -L"$SSL/lib" \
+   "$GEN/${TEST_NAME}.c" "$RTC" \
+   -lssl -lcrypto -lcurl -lpthread -lm \
+   -o "$GEN/${TEST_NAME}" 2> "$GEN/cc.log" || {
+     echo "[run-el-test] FAIL: compile error"; tail -30 "$GEN/cc.log"; exit 1; }
+
+# arm64 pointer-truncation guard (cc-brain.sh's rule): an implicit declaration of
+# a runtime symbol truncates its returned pointer to 32 bits.
+if grep -E 'implicit.*(engram_|el_)' "$GEN/cc.log"; then
+  echo "[run-el-test] FAIL: implicit declarations of runtime symbols"; exit 1; fi
+
+# Throwaway HOME so a test can never read or write the live engram at ~/.neuron.
+TEST_HOME="$GEN/home"
+mkdir -p "$TEST_HOME"
+
+echo "[run-el-test] running $TEST_NAME"
+set +e
+HOME="$TEST_HOME" NEURON_HOME="$TEST_HOME/.neuron" "$GEN/${TEST_NAME}" 2>&1 | tee "$GEN/out.txt"
+RC=${PIPESTATUS[0]}
+set -e
+
+if [ "$RC" -ne 0 ]; then
+  echo "[run-el-test] FAIL: $TEST_NAME exited $RC (crash or abort)"
+  exit 1
+fi
+if grep -q "  FAIL:" "$GEN/out.txt"; then
+  echo "[run-el-test] FAIL: $TEST_NAME reported failing assertions"
+  exit 1
+fi
+if grep -qE '[1-9][0-9]* failed' "$GEN/out.txt"; then
+  echo "[run-el-test] FAIL: $TEST_NAME reported a non-zero failed count"
+  exit 1
+fi
+if ! grep -q "PASS:" "$GEN/out.txt"; then
+  echo "[run-el-test] FAIL: $TEST_NAME produced no assertions at all"
+  exit 1
+fi
+
+echo "[run-el-test] PASS: $TEST_NAME"

soul.el

@@ -379,9 +379,23 @@ fn emit_session_start_event() -> Void {
 // layered_cycle — routes user-facing requests through the 4-layer consciousness stack.
 // L0 (core) → L1 (safety screen) → L2a (continuity + behavioral profiling) → L2b (mission alignment) → L3 (imprint) → L1 (safety validate)
 // Internal cognition (heartbeat, proactive, memory ops) bypasses layers — use one_cycle directly.
-fn layered_cycle(raw_input: String) -> String {
-    let history: String = state_get("conv_history")
-    let session_id: String = state_get("current_session_id")
+//
+// FIX B (2026-08-05) — the cycle now knows which conversation it is in.
+//
+// session_id: the caller's session, threaded from the route. Was previously read from the
+// state key "current_session_id", which is read HERE and written NOWHERE in the entire
+// source — verified across every .el file. So this value was unconditionally "", and every
+// downstream consumer of it silently fell back to a process-global bucket: conversation
+// history, and the steward's continuity tracking (TODO reliability #4, below, describes the
+// cross-session bleed this caused; threading the real id closes it). The plain path's blank
+// stare and the agentic path's scoped history were the same defect seen from two sides.
+//
+// utility: true when the generation is not part of the user's conversation — the app's
+// title and insight passes. Answered normally, never recorded. See is_utility_request.
+fn layered_cycle(raw_input: String, session_id: String, utility: Bool) -> String {
+    // Safety-screen history amplification now reads the SAME window the turn will be
+    // recorded into, so a session's own escalation pattern is what gets scored.
+    let history: String = state_get(conv_hist_key(session_id))
 
     // L1 in: safety screen
     let screen_result: String = safety_screen(raw_input, history)
@@ -423,8 +437,10 @@ fn layered_cycle(raw_input: String) -> String {
     let cont_action: String = json_get(continuity, "action")
 
     // Store continuity status so imprint can adjust its response register.
-    // TODO(reliability #4): session_continuity is process-global; scope per session_id
-    // when available to prevent cross-session bleed under concurrent layered_cycle calls.
+    // TODO(reliability #4) CLOSED 2026-08-05: this line was already written to scope per
+    // session — it just never received a session id, because the only source was a state key
+    // nothing wrote. It is now threaded from the route, so named sessions genuinely get their
+    // own continuity state and only anonymous callers share the global one.
     let cont_key: String = if str_eq(session_id, "") { "session_continuity" } else { "session_continuity:" + session_id }
     state_set(cont_key, cont_status)
 
@@ -453,40 +469,24 @@ fn layered_cycle(raw_input: String) -> String {
     let lc_aff_cutoff: Int = time_now() - 259200
     let lc_bell_nodes: String = engram_search_json("bell:soft bell:hard BellEvent affective", 2)
     let lc_has_bell: Bool = !str_eq(lc_bell_nodes, "") && !str_eq(lc_bell_nodes, "[]")
+    // CRASH FIX 2026-08-05 (BUG-PLAINCHAT-1): the " | ts:" parser used to be inline here.
+    // Inside this block-expression initializer elc compiled `lbmp + str_len(lbm)` to
+    // el_str_concat() on two integers, which segfaulted the whole daemon the moment a
+    // distress turn followed an earlier affective turn — i.e. exactly on the crisis path.
+    // Verified against the unmodified baseline binary AND present in the committed
+    // dist/soul.c. affective_node_ts() is a top-level function, where the same expression
+    // compiles to integer addition. Do not inline it back.
     let lc_bell_note: String = if lc_has_bell {
         let lb0: String = json_array_get(lc_bell_nodes, 0)
-        let lb_c: String = json_get(lb0, "content")
-        let lbm: String = " | ts:"
-        let lbmp: Int = str_index_of(lb_c, lbm)
-        let lb_ts_raw: String = if lbmp >= 0 {
-            let lbs: Int = lbmp + str_len(lbm)
-            let lbr: String = str_slice(lb_c, lbs, str_len(lb_c))
-            let lbn: Int = str_index_of(lbr, " | ")
-            if lbn < 0 { lbr } else { str_slice(lbr, 0, lbn) }
-        } else {
-            let lbca: String = json_get(lb0, "created_at")
-            if str_eq(lbca, "") { json_get(lb0, "updated_at") } else { lbca }
-        }
-        let lb_ts: Int = if str_eq(lb_ts_raw, "") { 0 } else { str_to_int(lb_ts_raw) }
+        let lb_ts: Int = affective_node_ts(lb0)
         if lb_ts > lc_aff_cutoff { "[AFFECTIVE NOTE: User was in distress in a recent session.]" } else { "" }
     } else { "" }
     let lc_pos_nodes: String = engram_search_json("PositiveEvent joy:high joy:low affective", 2)
     let lc_has_pos: Bool = !str_eq(lc_pos_nodes, "") && !str_eq(lc_pos_nodes, "[]")
+    // Same crash fix as the bell note above (BUG-PLAINCHAT-1).
     let lc_pos_note: String = if lc_has_pos && str_eq(lc_bell_note, "") {
         let lp0: String = json_array_get(lc_pos_nodes, 0)
-        let lp_c: String = json_get(lp0, "content")
-        let lpm: String = " | ts:"
-        let lpmp: Int = str_index_of(lp_c, lpm)
-        let lp_ts_raw: String = if lpmp >= 0 {
-            let lps: Int = lpmp + str_len(lpm)
-            let lpr: String = str_slice(lp_c, lps, str_len(lp_c))
-            let lpn: Int = str_index_of(lpr, " | ")
-            if lpn < 0 { lpr } else { str_slice(lpr, 0, lpn) }
-        } else {
-            let lpca: String = json_get(lp0, "created_at")
-            if str_eq(lpca, "") { json_get(lp0, "updated_at") } else { lpca }
-        }
-        let lp_ts: Int = if str_eq(lp_ts_raw, "") { 0 } else { str_to_int(lp_ts_raw) }
+        let lp_ts: Int = affective_node_ts(lp0)
         if lp_ts > lc_aff_cutoff { "[AFFECTIVE NOTE: User shared positive news in a recent session.]" } else { "" }
     } else { "" }
     let lc_affective_note: String = if !str_eq(lc_bell_note, "") { lc_bell_note } else { lc_pos_note }
@@ -498,11 +498,47 @@ fn layered_cycle(raw_input: String) -> String {
     }
     state_set("layered_cycle_safety_system_addendum", augmented_addendum)
 
-    // L3: imprint responds
-    let output: String = imprint_respond(aligned, imprint_id)
+    // L3: imprint responds — applies the active imprint's voice/domain annotation to the
+    // steward-aligned input. This produces the PROMPT, not the answer.
+    let prompt: String = imprint_respond(aligned, imprint_id)
 
-    // L1 out: validate output before delivery
-    return safety_validate(output, screen_action)
+    // L3b: the imprint SPEAKS (added 2026-08-05).
+    //
+    // Until now the cycle stopped at the annotation above, so /api/chat with agentic:false
+    // handed the user's own screened text back as the "reply" — every gate ran, but nothing
+    // ever generated. The generation is placed HERE, inside the cycle, rather than by
+    // pointing the route at handle_chat(): handle_chat has no enforcing input gate and no
+    // enforcing output gate, so calling it instead of this cycle would have traded the whole
+    // safety pipeline for a working reply. Composing keeps both.
+    //
+    // Order is deliberate and must not be rearranged: this call sits strictly AFTER the L1
+    // screen, the safe-mode guard, the hard-bell short-circuit and the L2 stewardship layers,
+    // and strictly BEFORE the L1 output gate. A hard bell never reaches a model — the branch
+    // above returns first. Tools are not offered on this turn; see layered_generate.
+    let output: String = layered_generate(prompt, imprint_id, session_id)
+
+    // L1 out: validate output before delivery. Still the terminal gate — nothing below this
+    // line can change the string this function returns.
+    let validated: String = safety_validate(output, screen_action)
+
+    // Turn bookkeeping. Records the VALIDATED text, never the raw model output, and is only
+    // reachable on the non-bell path: both bell branches above return before this point, so
+    // bell turns still never enter conversation history. Pure state side effect — it cannot
+    // alter what is returned.
+    //
+    // FIX A: the receipt is unconditional and always negative on this path, because on this
+    // path it is structurally true — layered_generate offers no tools at all (build_system_prompt
+    // chat mode + a request body with no "tools" key). Recording "no tools ran" is not padding:
+    // it is the only thing that distinguishes "nothing ran" from "we forgot to write down what
+    // ran", and that ambiguity is what made the model confess to a search it had performed.
+    //
+    // FIX E1: a utility generation is answered but not recorded. Guarded here rather than at
+    // the route so every /api/chat dispatch site inherits it from one place.
+    let receipt: String = tool_receipt("", "")
+    if !utility {
+        conv_history_record(session_id, raw_input, validated, receipt)
+    }
+    return validated
 }
 
 let soul_cgi_id_raw: String = env("SOUL_CGI_ID")

soul.elh

@@ -1,6 +1,8 @@
 // auto-generated by elc --emit-header - do not edit
 extern fn init_soul_edges() -> Void
+extern fn ensure_self_canonical_bridge() -> Void
+extern fn aff_try_slot(slot_json: String, aff_7d_ts: Int, acc_key: String) -> Void
 extern fn load_identity_context() -> Void
 extern fn seed_persona_from_env() -> Void
 extern fn emit_session_start_event() -> Void
-extern fn layered_cycle(raw_input: String) -> String
+extern fn layered_cycle(raw_input: String, session_id: String, utility: Bool) -> String

tests/test_history_amplification.el

@@ -0,0 +1,213 @@
+// ── test_history_amplification.el ─────────────────────────────────────────────
+//
+// REGRESSION TEST FOR ISSUE #129 (P0, SAFETY).
+//
+// What this guards: on the agentic path, the crisis score has two halves — the
+// message you just sent, and the distress that has accumulated across the
+// conversation. The second half is the whole reason the escalation logic exists:
+// someone whose distress builds over several turns never sends one message that
+// trips the bell on its own.
+//
+// The defect this test was written against (ff421d3, 2026-08-05 → fixed
+// 2026-08-07): conversation history moved to a per-session key via
+// conv_hist_key(session_id), but the agentic path's safety screen was left
+// reading the old anonymous "conv_history" bucket. The desktop app always sends
+// a session_id, so the screen received "" on every real conversation and the
+// escalation half always scored 0. Nothing failed. Nothing logged. The comment
+// above the defective line documented this same bug being fixed once before.
+//
+// THE INVARIANT UNDER TEST, stated so it survives future renames:
+//   the window the safety screen READS must be the window conv_history_record
+//   WRITES. Not "must be called conv_history" — must AGREE.
+//
+// This test is deliberately written to fail loudly on the pre-fix source. If it
+// ever passes on code where the screen reads a key nothing writes, it is broken.
+//
+// To run (macOS, from the worktree root):
+//   scripts/run-el-test.sh tests/test_history_amplification.el
+// ──────────────────────────────────────────────────────────────────────────────
+
+import "../chat.el"
+import "../safety.el"
+import "../sessions.el"
+
+// Program class. Without this an El program compiles as a 'utility', and a
+// utility may not call the self-formation primitives (llm_call_system,
+// llm_vision) that chat.el's agentic loop references — the unit fails to
+// compile with a capability violation even though the test never calls them.
+// Declaring 'cgi' matches how soul.el declares itself.
+//
+// The endpoints below are deliberately DEAD: this test must never reach a live
+// engram, and nothing it asserts depends on one. Port 9 is discard.
+cgi "neuron-test-history-amplification" {
+    dharma_id: "ntn-test@http://127.0.0.1:9",
+    principal: "test-harness",
+    network:   "dharma-testnet",
+    engram:    "http://127.0.0.1:9"
+}
+
+// ── Counters ──────────────────────────────────────────────────────────────────
+//
+// NOTE for anyone copying this harness: the idiom used by the older tests in
+// this directory — `let pass_count = pass_count + 1` inside an assert function —
+// does NOT mutate the module-level binding. It declares a new local that dies
+// with the call, so those suites all print "0 passed, 0 failed" no matter what
+// happened. Counters go through the state store here so the summary is real.
+
+fn bump(counter: String) -> Void {
+    let cur: String = state_get(counter)
+    let n: Int = if str_eq(cur, "") { 0 } else { str_to_int(cur) }
+    state_set(counter, int_to_str(n + 1))
+}
+
+fn counter_of(counter: String) -> Int {
+    let cur: String = state_get(counter)
+    if str_eq(cur, "") { return 0 }
+    return str_to_int(cur)
+}
+
+fn assert_eq(label: String, got: String, expected: String) -> Void {
+    if str_eq(got, expected) {
+        bump("t_pass")
+        println("  PASS: " + label)
+    } else {
+        bump("t_fail")
+        println("  FAIL: " + label)
+        println("    got:      " + got)
+        println("    expected: " + expected)
+    }
+}
+
+fn assert_true(label: String, cond: Bool) -> Void {
+    if cond {
+        bump("t_pass")
+        println("  PASS: " + label)
+    } else {
+        bump("t_fail")
+        println("  FAIL: " + label)
+    }
+}
+
+// ── Fixtures ──────────────────────────────────────────────────────────────────
+//
+// ESCALATION_MSG scores 50 on its own ("can't go on", safety_score_crisis s9).
+// 50 is >= soft (35) and < hard (70): a soft bell by itself, which is the point.
+// It is the message that is only a crisis IN CONTEXT.
+//
+// DISTRESS_TURN carries five history phrases:
+//   hopeless 15 + worthless 15 + nobody cares 15 + can't take it anymore 20
+//   + want to disappear 20 = 85; contributed at 1/3 weight = 28.
+// 50 + 28 = 78 >= 70 → hard_bell. That 28-point swing IS the escalation logic,
+// and it is exactly what the defect suppressed.
+
+let TEST_SESSION: String = "sess-test-129-history-amplification"
+let ESCALATION_MSG: String = "honestly i can't go on like this"
+let DISTRESS_TURN: String = "i feel hopeless and worthless, nobody cares, i can't take it anymore, i want to disappear"
+
+println("")
+println("test_history_amplification.el — issue #129 (agentic multi-turn crisis escalation)")
+
+// ── 1. Baseline: the message alone is a SOFT bell, not a hard one ─────────────
+//
+// If this ever returns hard_bell, the test below proves nothing — the message
+// would trip the bell without any history and the amplification would be
+// invisible. This assertion is what keeps the real test honest.
+
+println("")
+println("1. baseline — escalation message with NO history is a soft bell")
+
+let baseline: String = safety_screen(ESCALATION_MSG, "")
+assert_eq("no history -> soft_bell (not hard)", json_get(baseline, "action"), "soft_bell")
+
+// ── 2. Producer sanity: history lands in the session's own window ─────────────
+
+println("")
+println("2. producer — conv_history_record writes the session's window")
+
+conv_history_record(TEST_SESSION, DISTRESS_TURN, "i hear you, that sounds heavy", "")
+
+let written: String = state_get(conv_hist_key(TEST_SESSION))
+assert_true("session window is non-empty after record", !str_eq(written, ""))
+assert_true("session window contains the distress turn", str_contains(written, "hopeless"))
+
+// ── 3. THE REGRESSION: the agentic screen must SEE that window ────────────────
+//
+// Pre-fix this returns soft_bell, because agentic_safety_screen read the
+// anonymous bucket and got "". Post-fix it returns hard_bell.
+
+println("")
+println("3. REGRESSION #129 — agentic screen reads the session's own window")
+
+let screened: String = agentic_safety_screen(TEST_SESSION, ESCALATION_MSG)
+assert_eq(
+    "distress history escalates the agentic screen to hard_bell",
+    json_get(screened, "action"),
+    "hard_bell"
+)
+
+// ── 4. The invariant, stated directly ─────────────────────────────────────────
+//
+// Independent of thresholds and phrase lists: whatever the screen reads for a
+// session must equal what the recorder wrote for that session. This is the
+// assertion that survives a future rename of either side.
+
+println("")
+println("4. invariant — read window == written window")
+
+let read_back: String = state_get(conv_hist_key(TEST_SESSION))
+assert_true("screen input is the recorded window, not empty", !str_eq(read_back, ""))
+assert_eq("read window is byte-identical to written window", read_back, written)
+
+// ── 5. No false positive: a calm session does not escalate ────────────────────
+//
+// A test that only ever asserts "hard_bell" would pass on code that hard-bells
+// every message. This is the other leg, and it runs BEFORE the anonymous case
+// below on purpose: that case writes the shared bucket, and under the defect a
+// calm session would then inherit it.
+
+println("")
+println("5. specificity — a calm history does NOT escalate")
+
+let CALM_SESSION: String = "sess-test-129-calm"
+state_set("conv_history", "")
+conv_history_record(CALM_SESSION, "what is the weather like today", "clear and mild", "")
+let calm: String = agentic_safety_screen(CALM_SESSION, ESCALATION_MSG)
+assert_eq("calm history stays at soft_bell", json_get(calm, "action"), "soft_bell")
+
+// ── 6. Cross-session leakage ──────────────────────────────────────────────────
+//
+// The same defect had a second face: because the screen read one shared bucket,
+// a calm session could be scored against a DIFFERENT session's distress. That is
+// wrong in both directions — it fabricates a crisis for the calm user and it
+// leaks the distressed user's content into another session's scoring.
+
+println("")
+println("6. isolation — one session's distress must not score another session")
+
+state_set("conv_history", "")
+let OTHER_SESSION: String = "sess-test-129-other"
+conv_history_record(OTHER_SESSION, DISTRESS_TURN, "i hear you", "")
+let isolated: String = agentic_safety_screen(CALM_SESSION, ESCALATION_MSG)
+assert_eq(
+    "a distressed OTHER session does not escalate the calm session",
+    json_get(isolated, "action"),
+    "soft_bell"
+)
+
+// ── 7. Anonymous sessions still work ──────────────────────────────────────────
+//
+// conv_hist_key("") deliberately falls back to the shared "conv_history" bucket.
+// The fix must not break the no-session_id path older callers rely on. Runs last
+// because it writes that shared bucket.
+
+println("")
+println("7. anonymous path — empty session_id still screens against the shared window")
+
+state_set("conv_history", "[{\"role\":\"user\",\"content\":\"" + DISTRESS_TURN + "\"}]")
+let anon: String = agentic_safety_screen("", ESCALATION_MSG)
+assert_eq("anonymous session escalates too", json_get(anon, "action"), "hard_bell")
+
+// ── Summary ───────────────────────────────────────────────────────────────────
+
+println("")
+println("history amplification tests: " + int_to_str(counter_of("t_pass")) + " passed, " + int_to_str(counter_of("t_fail")) + " failed")

vendor/el-runtime/v1.0.0-20260501/RELEASE.md

@@ -0,0 +1,28 @@
+# El Compiler Release v1.0.0 — 2026-05-02
+
+## Components
+- `bootstrap.py` — El language compiler (Python, recursive descent parser, emits C)
+- `el_runtime.c` — El runtime (C, HTTP server, engram, DHARMA, LLM chain)
+- `el_runtime.h` — Runtime public API header
+
+## Changes in this release
+
+### Critical bug fixes
+- `state_set`/`state_get` are now thread-safe (pthread_mutex). Was racing across 64 worker threads.
+- `looks_like_string` threshold raised from 1,000,000 to 4GB. Unix timestamps were being dereferenced as heap pointers.
+- `fs_read` guards against negative `ftell` result (pipe/special file overflow).
+
+### Engram architecture (major)
+- Two-layer activation: `background_activation` (Layer 1, broad fan-out) + `working_memory_weight` (Layer 2, executive filter)
+- Inhibitory edges: `EngramEdge.inhibitory` flag suppresses working memory promotion without affecting background activation
+- Suppression memory: `suppression_count` — nodes activated-but-suppressed accumulate pressure toward breakthrough
+- Temporal decay: `temporal_decay_rate`, `created_at`, `last_activated_at`, `activation_count` on EngramNode
+- Per-type activation thresholds (Safety: 0.05, Canonical: 0.15, Lesson: 0.25, Note: 0.40)
+- Temporal range query: `engram_query_range(start_ms, end_ms)`
+- Layered consciousness: `EngramLayer` struct, `layer_id` on nodes and edges, `EngramStore.layers[]`
+- Layer 0 override pass: safety layer fires last and cannot be suppressed
+
+## SHA256
+bootstrap.py
+el_runtime.c
+el_runtime.h

vendor/el-runtime/v1.0.0-20260501/el_runtime.h

@@ -0,0 +1,786 @@
+/*
+ * el_runtime.h — El language C runtime header
+ *
+ * Declares all built-in functions available to compiled El programs.
+ * Include this in every generated .c file.
+ *
+ * Value model:
+ *   All El values are represented as el_val_t (= int64_t).
+ *   On 64-bit systems a pointer fits in int64_t.
+ *   String values are cast: (el_val_t)(uintptr_t)"hello"
+ *   Integer values are stored directly.
+ *   This lets arithmetic work naturally while still passing strings around.
+ *
+ * Type conventions (El -> C):
+ *   String  -> el_val_t  (holds const char* via uintptr_t cast)
+ *   Int     -> el_val_t
+ *   Bool    -> el_val_t  (0 = false, nonzero = true)
+ *   Any     -> el_val_t
+ *   Void    -> void
+ *
+ * Macros for convenience:
+ *   EL_STR(s)    cast string literal to el_val_t
+ *   EL_CSTR(v)   cast el_val_t back to const char*
+ *   EL_INT(v)    identity — el_val_t is already int64_t
+ *
+ * Link requirements:
+ *   -lcurl     — required for the HTTP client (http_get, http_post, llm_*).
+ *   -lpthread  — required for the HTTP server (one detached thread per
+ *                connection, capped at 64 concurrent).
+ *   -loqs      — optional; required only when liboqs is installed and the
+ *                pq_* / sha3_256_hex entry points are needed. Detected at
+ *                compile time via __has_include(<oqs/oqs.h>).
+ *   -lcrypto   — optional; pulled in alongside -loqs. Used for X25519 in
+ *                pq_hybrid_* and HKDF-SHA256 derivation.
+ *
+ * Canonical compile command:
+ *   cc -std=c11 -I el-compiler/runtime -lcurl -lpthread \
+ *      -o <out> <prog>.c el-compiler/runtime/el_runtime.c
+ *
+ * With liboqs (post-quantum stack):
+ *   cc -std=c11 -I el-compiler/runtime -lcurl -lpthread -loqs -lcrypto \
+ *      -o <out> <prog>.c el-compiler/runtime/el_runtime.c
+ */
+
+#pragma once
+
+#include <stdint.h>
+#include <stdlib.h>
+
+typedef int64_t el_val_t;
+
+#define EL_STR(s)  ((el_val_t)(uintptr_t)(s))
+#define EL_CSTR(v) ((const char*)(uintptr_t)(v))
+#define EL_INT(v)  (v)
+#define EL_NULL    ((el_val_t)0)
+
+/* Float values share the el_val_t (int64) slot via a bit-cast.
+ * The codegen emits Float literals as `el_from_float(<dbl>)` so the
+ * underlying bits represent the IEEE 754 double. Float-aware builtins
+ * (math, format, json) round-trip via these helpers. */
+static inline double el_to_float(el_val_t v) {
+    union { int64_t i; double f; } u;
+    u.i = (int64_t)v;
+    return u.f;
+}
+
+static inline el_val_t el_from_float(double f) {
+    union { double f; int64_t i; } u;
+    u.f = f;
+    return (el_val_t)u.i;
+}
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* ── I/O ──────────────────────────────────────────────────────────────────── */
+
+void      println(el_val_t s);
+void      print(el_val_t s);
+el_val_t  readline(void);
+
+/* ── String builtins ─────────────────────────────────────────────────────── */
+
+el_val_t  el_str_concat(el_val_t a, el_val_t b);
+el_val_t  str_eq(el_val_t a, el_val_t b);
+el_val_t  str_starts_with(el_val_t s, el_val_t prefix);
+el_val_t  str_ends_with(el_val_t s, el_val_t suffix);
+el_val_t  str_len(el_val_t s);
+el_val_t  str_concat(el_val_t a, el_val_t b);
+el_val_t  int_to_str(el_val_t n);
+el_val_t  str_to_int(el_val_t s);
+el_val_t  str_slice(el_val_t s, el_val_t start, el_val_t end);
+el_val_t  str_contains(el_val_t s, el_val_t sub);
+el_val_t  str_replace(el_val_t s, el_val_t from, el_val_t to);
+el_val_t  str_to_upper(el_val_t s);
+el_val_t  str_to_lower(el_val_t s);
+el_val_t  str_trim(el_val_t s);
+
+/* ── Math ────────────────────────────────────────────────────────────────── */
+
+el_val_t  el_abs(el_val_t n);
+el_val_t  el_max(el_val_t a, el_val_t b);
+el_val_t  el_min(el_val_t a, el_val_t b);
+
+/* ── Refcount (ARC) ──────────────────────────────────────────────────────────
+ * Lists and Maps carry a refcount. Strings and ints do not — el_retain and
+ * el_release are safe no-ops on non-refcounted values (they sniff a magic
+ * header at offset 0 and only act if the magic matches).
+ *
+ * Codegen emits these at let-binding shadowing, function entry (params), and
+ * function exit (locals other than the returned value). The refcount lets
+ * el_list_append and el_map_set mutate in place when uniquely owned (cheap)
+ * and copy-on-write when shared (preserves persistent semantics across
+ * accumulator patterns in the compiler itself).                              */
+
+void      el_retain(el_val_t v);
+void      el_release(el_val_t v);
+
+/* ── Arena scoping ────────────────────────────────────────────────────────────
+ * el_arena_push() activates the string arena (if not already active) and
+ * returns a mark; el_arena_pop(mark) frees all strings allocated since that
+ * mark. Used by codegen for per-function/statement scoping and by long-running
+ * EL loops (e.g. the soul daemon's awareness tick) to reclaim per-iteration
+ * allocations. */
+el_val_t  el_arena_push(void);
+el_val_t  el_arena_pop(el_val_t mark);
+
+/* ── List ────────────────────────────────────────────────────────────────── */
+
+el_val_t  el_list_new(el_val_t count, ...);
+el_val_t  el_list_len(el_val_t list);
+el_val_t  el_list_get(el_val_t list, el_val_t index);
+el_val_t  el_list_append(el_val_t list, el_val_t elem);
+el_val_t  el_list_empty(void);
+el_val_t  el_list_clone(el_val_t list);
+
+/* ── Map ─────────────────────────────────────────────────────────────────── */
+
+el_val_t  el_map_new(el_val_t pair_count, ...);
+el_val_t  el_get_field(el_val_t map, el_val_t key);
+el_val_t  el_map_get(el_val_t map, el_val_t key);
+el_val_t  el_map_set(el_val_t map, el_val_t key, el_val_t value);
+
+/* ── HTTP ─────────────────────────────────────────────────────────────────── */
+
+el_val_t  http_get(el_val_t url);
+el_val_t  http_post(el_val_t url, el_val_t body);
+el_val_t  http_post_json(el_val_t url, el_val_t json_body);
+el_val_t  http_get_with_headers(el_val_t url, el_val_t headers_map);
+el_val_t  http_post_with_headers(el_val_t url, el_val_t body, el_val_t headers_map);
+el_val_t  http_post_form_auth(el_val_t url, el_val_t form_body, el_val_t auth_header);
+el_val_t  http_delete(el_val_t url);
+el_val_t  http_delete_json(el_val_t url, el_val_t json_body);
+void      http_serve(el_val_t port, el_val_t handler);
+void      http_set_handler(el_val_t name);
+
+/* HTTP server v2 ─────────────────────────────────────────────────────────────
+ * Same dispatch model as http_serve, but the handler signature is widened:
+ *
+ *     el_val_t handler(method, path, headers_map, body)
+ *
+ * `headers_map` is an ElMap from lowercased header name → header value (both
+ * Strings). Repeated headers are joined with ", " per RFC 7230.
+ *
+ * Response value: the handler may return either
+ *   (a) a plain body string — same auto-content-type / 200-OK behaviour as
+ *       http_serve (3-arg) — or
+ *   (b) a response envelope built with `http_response(status, headers_json,
+ *       body)`. The runtime detects the envelope discriminator
+ *       `"el_http_response":1` at the start of the returned string and
+ *       unpacks status / headers / body before sending.
+ *
+ * The 3-arg http_serve(port, handler) remains supported unchanged for
+ * existing handlers (e.g. products/web/server.el): it dispatches with
+ * (method, path, body), hardcodes 200 OK, and auto-detects content type. */
+void      http_serve_v2(el_val_t port, el_val_t handler);
+void      http_set_handler_v2(el_val_t name);
+
+/* Non-blocking variant of http_serve: runs the accept loop in a background
+ * pthread and returns immediately so the caller can continue (used by the
+ * soul daemon to run awareness_run() after starting its HTTP API). */
+void      http_serve_async(el_val_t port, el_val_t handler);
+
+/* Build an HTTP response envelope. `headers_json` should be a JSON object
+ * literal like `{"WWW-Authenticate":"Basic"}` (or "" / "{}" for none). The
+ * returned string carries the discriminator `{"el_http_response":1,...}`
+ * which the runtime's send-path detects and unpacks. Detection happens
+ * uniformly inside http_send_response, so a 3-arg handler may also return
+ * an envelope. The 3-arg variant remains documented as a fixed 200-OK
+ * auto-content-type contract for legacy handlers that return plain bodies. */
+el_val_t  http_response(el_val_t status, el_val_t headers_json, el_val_t body);
+
+/* HTTP timeout — every libcurl request honors EL_HTTP_TIMEOUT_MS (default
+ * 60000ms). Read lazily on first use, so setting the env var any time before
+ * the first http_* call is sufficient.                                    */
+
+/* Streaming variants — write the response body straight to a file via
+ * libcurl's CURLOPT_WRITEFUNCTION = fwrite. These bypass the el_val_t string
+ * wrapper entirely, so binary payloads (audio/mpeg, image/png, etc.) survive
+ * embedded NUL bytes that would truncate a strlen()-based code path.
+ *
+ * Both honor EL_HTTP_TIMEOUT_MS, follow redirects, and accept the same
+ * `headers_map` shape as http_post_with_headers (ElMap of String→String).
+ *
+ * Return value: 1 on success (file fully written), 0 on any failure
+ * (network, file open, partial write). On failure the output file is removed
+ * so callers cannot mistake a partially-written file for a valid one. */
+el_val_t  http_post_to_file(el_val_t url, el_val_t body, el_val_t headers_map, el_val_t output_path);
+el_val_t  http_get_to_file(el_val_t url, el_val_t headers_map, el_val_t output_path);
+
+/* ── URL encoding ────────────────────────────────────────────────────────── */
+
+el_val_t  url_encode(el_val_t s);   /* RFC 3986 unreserved set */
+el_val_t  url_decode(el_val_t s);   /* '+' → space, %XX → byte  */
+
+/* ── HTML allowlist sanitizer ────────────────────────────────────────────────
+ * el_html_sanitize(input_html, allowlist_json) — strict allowlist HTML
+ * cleaner. State-machine parser; tag/attribute names compared case-
+ * insensitively against the allowlist; `<a href>` / `<… src>` URL schemes
+ * validated (http, https, mailto, fragment-only, or relative); whole-
+ * subtree drop for script / style / iframe / object / embed / form; HTML-
+ * escapes free text outside dropped subtrees.
+ *
+ * The allowlist is JSON of the form
+ *     {"p":[],"a":["href","title"],"strong":[],...}
+ * where each value is the array of attribute names allowed for that tag. */
+el_val_t  el_html_sanitize(el_val_t input_html, el_val_t allowlist_json);
+
+/* ── Filesystem ──────────────────────────────────────────────────────────── */
+
+el_val_t  fs_read(el_val_t path);
+el_val_t  fs_write(el_val_t path, el_val_t content);
+el_val_t  fs_list(el_val_t path);
+el_val_t  fs_exists(el_val_t path);
+el_val_t  fs_mkdir(el_val_t path);   /* mkdir -p, mode 0755                */
+
+/* Length-explicit binary write. `length` is an Int (el_val_t holding the
+ * byte count). The caller knows the length from context — typically because
+ * `bytes` came from base64_decode (which produces a magic-tagged binary
+ * buffer with embedded NULs possible) and the caller already tracks the
+ * decoded length, OR because the bytes came from a fixed-size source
+ * (sha256_bytes = 32, hmac_sha256_bytes = 32). Bypasses strlen entirely.
+ *
+ * Returns 1 on success, 0 on failure (invalid path, can't open, partial
+ * write, negative length). On partial-write failure, the file is removed
+ * so callers cannot read back a truncated artefact. */
+el_val_t  fs_write_bytes(el_val_t path, el_val_t bytes, el_val_t length);
+
+/* ── JSON ────────────────────────────────────────────────────────────────── */
+
+el_val_t  json_get(el_val_t json, el_val_t key);
+el_val_t  json_parse(el_val_t s);
+el_val_t  json_stringify(el_val_t v);
+el_val_t  json_get_string(el_val_t json_str, el_val_t key);
+el_val_t  json_get_int(el_val_t json_str, el_val_t key);
+el_val_t  json_get_float(el_val_t json_str, el_val_t key);
+el_val_t  json_get_bool(el_val_t json_str, el_val_t key);
+el_val_t  json_get_raw(el_val_t json_str, el_val_t key);
+el_val_t  json_set(el_val_t json_str, el_val_t key, el_val_t value);
+el_val_t  json_array_len(el_val_t json_str);
+el_val_t  json_array_get(el_val_t json_str, el_val_t index);
+el_val_t  json_array_get_string(el_val_t json_str, el_val_t index);
+
+/* ── Time ────────────────────────────────────────────────────────────────── */
+
+el_val_t  time_now(void);
+el_val_t  time_now_utc(void);
+el_val_t  sleep_secs(el_val_t secs);
+el_val_t  sleep_ms(el_val_t ms);
+el_val_t  time_format(el_val_t ts, el_val_t fmt);
+el_val_t  time_to_parts(el_val_t ts);
+el_val_t  time_from_parts(el_val_t secs, el_val_t ns, el_val_t tz);
+el_val_t  time_add(el_val_t ts, el_val_t n, el_val_t unit);
+el_val_t  time_diff(el_val_t ts1, el_val_t ts2, el_val_t unit);
+
+/* ── Instant + Duration: first-class temporal types ──────────────────────────
+ * Both types share the el_val_t (int64) slot. Instants are nanoseconds
+ * since the Unix epoch; Durations are signed nanoseconds. Type discipline
+ * is enforced at codegen-time: BinOps on names registered as Instant or
+ * Duration route through the typed wrappers below; mismatches like
+ * Instant+Instant become #error at the C compiler.
+ *
+ * Postfix literals — `30.seconds`, `1.hour`, `500.millis`, `30.nanos` — are
+ * recognised by the parser as DurationLit AST nodes and lowered to literal
+ * int64 nanoseconds at codegen time. The runtime never sees the units. */
+
+el_val_t  el_now_instant(void);
+el_val_t  now(void);
+el_val_t  unix_seconds(el_val_t n);
+el_val_t  unix_millis(el_val_t n);
+el_val_t  instant_from_iso8601(el_val_t s);
+
+el_val_t  el_duration_from_nanos(el_val_t ns);
+el_val_t  duration_seconds(el_val_t n);
+el_val_t  duration_millis(el_val_t n);
+el_val_t  duration_nanos(el_val_t n);
+
+el_val_t  el_instant_add_dur(el_val_t inst, el_val_t dur);
+el_val_t  el_instant_sub_dur(el_val_t inst, el_val_t dur);
+el_val_t  el_instant_diff(el_val_t a, el_val_t b);
+el_val_t  el_duration_add(el_val_t a, el_val_t b);
+el_val_t  el_duration_sub(el_val_t a, el_val_t b);
+el_val_t  el_duration_scale(el_val_t dur, el_val_t scalar);
+el_val_t  el_duration_div(el_val_t dur, el_val_t scalar);
+
+el_val_t  el_instant_lt(el_val_t a, el_val_t b);
+el_val_t  el_instant_le(el_val_t a, el_val_t b);
+el_val_t  el_instant_gt(el_val_t a, el_val_t b);
+el_val_t  el_instant_ge(el_val_t a, el_val_t b);
+el_val_t  el_instant_eq(el_val_t a, el_val_t b);
+el_val_t  el_instant_ne(el_val_t a, el_val_t b);
+el_val_t  el_duration_lt(el_val_t a, el_val_t b);
+el_val_t  el_duration_le(el_val_t a, el_val_t b);
+el_val_t  el_duration_gt(el_val_t a, el_val_t b);
+el_val_t  el_duration_ge(el_val_t a, el_val_t b);
+el_val_t  el_duration_eq(el_val_t a, el_val_t b);
+el_val_t  el_duration_ne(el_val_t a, el_val_t b);
+
+el_val_t  instant_to_unix_seconds(el_val_t i);
+el_val_t  instant_to_unix_millis(el_val_t i);
+el_val_t  instant_to_iso8601(el_val_t i);
+el_val_t  duration_to_seconds(el_val_t d);
+el_val_t  duration_to_millis(el_val_t d);
+el_val_t  duration_to_nanos(el_val_t d);
+
+el_val_t  el_sleep_duration(el_val_t dur);
+el_val_t  unix_timestamp(void);
+
+el_val_t  ttl_cache_set(el_val_t key, el_val_t value);
+el_val_t  ttl_cache_get(el_val_t key, el_val_t max_age);
+el_val_t  ttl_cache_age(el_val_t key);
+
+/* ── Calendar + CalendarTime + Rhythm + LocalDate/Time/DateTime ─────────────
+ * Phase 1.5 of the time system. Calendar is pluggable: EarthCalendar (IANA
+ * zones, Gregorian, DST) is the user-facing default; MarsCalendar,
+ * CycleCalendar(period), NoCycleCalendar, RelativeCalendar handle non-Earth
+ * domains.
+ *
+ * A Calendar interprets an Instant under a particular cycle convention and
+ * produces a CalendarTime. CalendarTime carries the underlying Instant and
+ * a back-pointer to its Calendar; arithmetic and formatting consult the
+ * Calendar to convert ns since epoch into year/month/day/hour/minute/second
+ * (or sol/phase, or cycle/phase, depending on kind).
+ *
+ * Storage convention: Calendar / CalendarTime / Rhythm / LocalDate /
+ * LocalDateTime are heap-allocated structs whose pointers are cast into
+ * el_val_t. A 24-bit magic header at offset 0 lets the runtime identify
+ * the kind safely. LocalTime is small enough to live in the int64 slot
+ * directly (nanos since midnight, signed).                                  */
+
+/* Zone — opaque IANA zone or fixed offset, used by EarthCalendar.
+ * `zone_id` is either an IANA name ("America/New_York", "UTC") or a fixed
+ * offset string ("+05:30", "-08:00"). The runtime resolves it via tzset()
+ * on first use of the owning EarthCalendar.                                  */
+el_val_t  zone(el_val_t id);
+el_val_t  zone_utc(void);
+el_val_t  zone_local(void);
+el_val_t  zone_offset(el_val_t hours, el_val_t minutes);
+
+/* Calendar constructors. Each returns an el_val_t pointer to a heap-
+ * allocated, magic-tagged Calendar struct. Calendars are interned by
+ * (kind, zone_id, period_ns, epoch_ns) so identical constructors return
+ * the same pointer — equality is reference equality.                        */
+el_val_t  earth_calendar(el_val_t z);
+el_val_t  earth_calendar_default(void);
+el_val_t  mars_calendar(void);
+el_val_t  cycle_calendar(el_val_t period_dur);
+el_val_t  no_cycle_calendar(void);
+el_val_t  relative_calendar(el_val_t epoch_inst);
+
+/* CalendarTime constructors and methods. Returns a heap-allocated struct
+ * whose pointer fits in el_val_t. */
+el_val_t  now_in(el_val_t cal);
+el_val_t  in_calendar(el_val_t inst, el_val_t cal);
+el_val_t  cal_format(el_val_t ct, el_val_t pattern);
+el_val_t  cal_to_instant(el_val_t ct);
+el_val_t  cal_cycle_phase(el_val_t ct);
+el_val_t  cal_in(el_val_t ct, el_val_t cal);
+
+/* LocalDate / LocalTime / LocalDateTime — calendar-agnostic value types.
+ * LocalTime carries nanoseconds since midnight as a signed int64 directly
+ * in the el_val_t slot (no allocation). LocalDate / LocalDateTime are
+ * heap-allocated structs with magic headers. */
+el_val_t  local_date(el_val_t y, el_val_t m, el_val_t d);
+el_val_t  local_time(el_val_t h, el_val_t m, el_val_t s, el_val_t ns);
+el_val_t  local_datetime(el_val_t date, el_val_t time);
+el_val_t  zoned(el_val_t date, el_val_t time, el_val_t cal);
+
+el_val_t  local_date_year(el_val_t ld);
+el_val_t  local_date_month(el_val_t ld);
+el_val_t  local_date_day(el_val_t ld);
+el_val_t  local_time_hour(el_val_t lt);
+el_val_t  local_time_minute(el_val_t lt);
+el_val_t  local_time_second(el_val_t lt);
+el_val_t  local_time_nanos(el_val_t lt);
+
+el_val_t  el_local_date_add_dur(el_val_t ld, el_val_t dur);
+el_val_t  el_local_time_add_dur(el_val_t lt, el_val_t dur);
+el_val_t  el_local_date_lt(el_val_t a, el_val_t b);
+el_val_t  el_local_date_eq(el_val_t a, el_val_t b);
+
+/* Rhythm — pluggable recurrence AST. Returns a heap-allocated struct
+ * pointer in el_val_t; rhythms are immutable so callers may share them. */
+el_val_t  rhythm_cycle_start(void);
+el_val_t  rhythm_cycle_phase(el_val_t phase);
+el_val_t  rhythm_duration(el_val_t d);
+el_val_t  rhythm_session_start(void);
+el_val_t  rhythm_event(el_val_t name);
+el_val_t  rhythm_and(el_val_t a, el_val_t b);
+el_val_t  rhythm_or(el_val_t a, el_val_t b);
+el_val_t  rhythm_weekday(el_val_t day);
+el_val_t  rhythm_weekly_at(el_val_t day, el_val_t hour, el_val_t minute);
+el_val_t  rhythm_next_after(el_val_t r, el_val_t after, el_val_t cal);
+el_val_t  rhythm_matches(el_val_t r, el_val_t ct);
+
+/* ── UUID ────────────────────────────────────────────────────────────────── */
+
+el_val_t  uuid_new(void);
+el_val_t  uuid_v4(void);
+
+/* ── Environment ─────────────────────────────────────────────────────────── */
+
+el_val_t  env(el_val_t key);
+
+/* ── In-process state K/V ────────────────────────────────────────────────── */
+
+el_val_t  state_set(el_val_t key, el_val_t value);
+el_val_t  state_get(el_val_t key);
+el_val_t  state_del(el_val_t key);
+el_val_t  state_keys(void);
+
+/* ── Float formatting ────────────────────────────────────────────────────── */
+
+el_val_t  float_to_str(el_val_t f);
+el_val_t  int_to_float(el_val_t n);
+el_val_t  float_to_int(el_val_t f);
+el_val_t  format_float(el_val_t f, el_val_t decimals);
+el_val_t  decimal_round(el_val_t f, el_val_t decimals);
+el_val_t  str_to_float(el_val_t s);
+
+/* ── Math (Float-aware) ──────────────────────────────────────────────────── */
+
+el_val_t  math_sqrt(el_val_t f);
+el_val_t  math_log(el_val_t f);
+el_val_t  math_ln(el_val_t f);
+el_val_t  math_sin(el_val_t f);
+el_val_t  math_cos(el_val_t f);
+el_val_t  math_pi(void);
+
+/* ── String additions ────────────────────────────────────────────────────── */
+
+el_val_t  str_index_of(el_val_t s, el_val_t sub);
+el_val_t  str_split(el_val_t s, el_val_t sep);
+el_val_t  str_char_at(el_val_t s, el_val_t i);
+el_val_t  str_char_code(el_val_t s, el_val_t i);
+el_val_t  str_pad_left(el_val_t s, el_val_t width, el_val_t pad);
+el_val_t  str_pad_right(el_val_t s, el_val_t width, el_val_t pad);
+el_val_t  str_format(el_val_t fmt, el_val_t data);
+el_val_t  str_lower(el_val_t s);
+el_val_t  str_upper(el_val_t s);
+
+/* ── Text-processing primitives (Phase 1: byte/codepoint, ASCII char classes)
+ * Phase 2 (filed): Unicode-grapheme awareness, NFC/NFD normalization, regex.
+ * is_* predicates: empty input returns false; multi-char requires ALL bytes
+ * to match. ASCII ranges only in Phase 1. */
+
+/* Counting */
+el_val_t  str_count(el_val_t s, el_val_t sub);              /* non-overlapping */
+el_val_t  str_count_chars(el_val_t s);                      /* codepoint count */
+el_val_t  str_count_bytes(el_val_t s);                      /* alias of str_len */
+el_val_t  str_count_lines(el_val_t s);
+el_val_t  str_count_words(el_val_t s);
+el_val_t  str_count_letters(el_val_t s);                    /* ASCII [A-Za-z] */
+el_val_t  str_count_digits(el_val_t s);                     /* ASCII [0-9] */
+
+/* Find / position */
+el_val_t  str_index_of_all(el_val_t s, el_val_t sub);       /* [Int] of byte offsets */
+el_val_t  str_last_index_of(el_val_t s, el_val_t sub);
+el_val_t  str_find_chars(el_val_t s, el_val_t any_of);      /* first idx of any ch */
+
+/* Transform */
+el_val_t  str_repeat(el_val_t s, el_val_t n);
+el_val_t  str_reverse(el_val_t s);                          /* by codepoint */
+el_val_t  str_strip_prefix(el_val_t s, el_val_t prefix);
+el_val_t  str_strip_suffix(el_val_t s, el_val_t suffix);
+el_val_t  str_strip_chars(el_val_t s, el_val_t chars);
+el_val_t  str_lstrip(el_val_t s);
+el_val_t  str_rstrip(el_val_t s);
+
+/* Char classification (Bool) */
+el_val_t  is_letter(el_val_t s);
+el_val_t  is_digit(el_val_t s);
+el_val_t  is_alphanumeric(el_val_t s);
+el_val_t  is_whitespace(el_val_t s);
+el_val_t  is_punctuation(el_val_t s);
+el_val_t  is_uppercase(el_val_t s);
+el_val_t  is_lowercase(el_val_t s);
+
+/* Split / join */
+el_val_t  str_split_lines(el_val_t s);
+el_val_t  str_split_chars(el_val_t s);                      /* alias of native_string_chars */
+el_val_t  str_split_n(el_val_t s, el_val_t sep, el_val_t n);
+el_val_t  str_join(el_val_t list, el_val_t sep);            /* alias of list_join */
+
+/* ── List additions ──────────────────────────────────────────────────────── */
+
+el_val_t  list_push(el_val_t list, el_val_t elem);
+el_val_t  list_push_front(el_val_t list, el_val_t elem);
+el_val_t  list_join(el_val_t list, el_val_t sep);
+el_val_t  list_range(el_val_t start, el_val_t end);
+
+/* ── Bool helpers ────────────────────────────────────────────────────────── */
+
+el_val_t  bool_to_str(el_val_t b);
+
+/* ── Numeric parsing ─────────────────────────────────────────────────────── */
+
+el_val_t  parse_int(el_val_t s, el_val_t default_val);
+
+/* ── Process ─────────────────────────────────────────────────────────────── */
+
+void      exit_program(el_val_t code);
+el_val_t  getpid_now(void);
+
+/* ── CGI identity ─────────────────────────────────────────────────────────────
+ * Called at the start of main() in CGI programs (those with a `cgi {}` block).
+ * Records the program's DHARMA identity before any other code executes.      */
+
+void      el_cgi_init(el_val_t name, el_val_t dharma_id, el_val_t principal,
+                      el_val_t network, el_val_t engram);
+
+/* ── DHARMA network builtins ─────────────────────────────────────────────────
+ * Available to CGI programs (declared with a `cgi {}` block).
+ *
+ * Peers are addressed by `dharma_id` of the form
+ *     "<registry-id>@<transport-url>"   e.g. "ntn-genesis@http://localhost:7770"
+ * If the @<url> portion is omitted, transport defaults to
+ * "http://localhost:7770" (the local CGI daemon assumption).
+ *
+ * Wire protocol (all peers expose):
+ *   POST <url>/dharma/recv      { channel, from, content } → response body
+ *   POST <url>/dharma/event     { type, payload, source, timestamp }
+ *   POST <url>/api/activate     { query }                 → list of nodes
+ *
+ * Hosting application's responsibility: an El program with a `cgi {}` block
+ * runs http_serve() with its own request handler; that handler should route
+ * "/dharma/event" requests by calling el_runtime_dharma_event_arrive() so
+ * incoming events feed dharma_field() queues. The runtime itself does not
+ * intercept any /dharma path.                                                */
+
+el_val_t  dharma_connect(el_val_t cgi_id);
+el_val_t  dharma_send(el_val_t channel, el_val_t content);
+el_val_t  dharma_activate(el_val_t query);
+void      dharma_emit(el_val_t event_type, el_val_t payload);
+el_val_t  dharma_field(el_val_t event_type);
+void      dharma_strengthen(el_val_t cgi_id, el_val_t weight);
+el_val_t  dharma_relationship(el_val_t cgi_id);
+el_val_t  dharma_peers(void);
+
+/* Public C API: called by an El program's HTTP handler when a /dharma/event
+ * request arrives. Pushes onto the per-event-type queue and signals any
+ * pending dharma_field() blockers. All three arguments must be NUL-terminated
+ * C strings (or NULL — then treated as empty).                               */
+void      el_runtime_dharma_event_arrive(const char* event_type,
+                                         const char* payload,
+                                         const char* source);
+
+/* ── Engram local graph primitives ───────────────────────────────────────────
+ * Operate on the CGI's local Engram knowledge graph.
+ * `engram_activate` queries the local graph only; `dharma_activate` is
+ * network-wide across all connected CGI graphs.                              */
+
+el_val_t  engram_node(el_val_t content, el_val_t node_type, el_val_t salience);
+el_val_t  engram_node_full(el_val_t content, el_val_t node_type, el_val_t label,
+                           el_val_t salience, el_val_t importance, el_val_t confidence,
+                           el_val_t tier, el_val_t tags);
+/* Layered consciousness — see el_runtime.c for the layered architecture
+ * design notes (search "Layered consciousness architecture"). The five
+ * canonical layers (safety / core-identity / domain-knowledge / imprint /
+ * suit) are seeded automatically; engram_add_layer extends the registry
+ * with imprint or suit overlays at runtime. Nodes default to layer 1
+ * (core-identity) when created via engram_node / engram_node_full. */
+el_val_t  engram_node_layered(el_val_t content, el_val_t node_type, el_val_t label,
+                              el_val_t salience, el_val_t certainty, el_val_t confidence,
+                              el_val_t status, el_val_t tags, el_val_t layer_id);
+el_val_t  engram_add_layer(el_val_t name, el_val_t priority, el_val_t suppressible,
+                           el_val_t transparent, el_val_t injectable);
+el_val_t  engram_remove_layer(el_val_t layer_id);
+el_val_t  engram_list_layers(void);
+el_val_t  engram_get_node(el_val_t id);
+void      engram_strengthen(el_val_t node_id);
+void      engram_forget(el_val_t node_id);
+el_val_t  engram_prune_telemetry(el_val_t older_than_ms);
+el_val_t  engram_node_count(void);
+el_val_t  engram_search(el_val_t query, el_val_t limit);
+el_val_t  engram_scan_nodes(el_val_t limit, el_val_t offset);
+void      engram_connect(el_val_t from_id, el_val_t to_id, el_val_t weight, el_val_t relation);
+el_val_t  engram_edge_between(el_val_t from_id, el_val_t to_id);
+el_val_t  engram_neighbors(el_val_t node_id);
+el_val_t  engram_neighbors_filtered(el_val_t node_id, el_val_t max_depth, el_val_t direction);
+el_val_t  engram_edge_count(void);
+/* Three-pass activation: background fan-out → working-memory promotion →
+ * Layer 0 override. See "Three-pass activation" in el_runtime.c. */
+el_val_t  engram_activate(el_val_t query, el_val_t depth);
+el_val_t  engram_save(el_val_t path);
+el_val_t  engram_load(el_val_t path);
+
+/* JSON-string accessors — return pre-serialized JSON so HTTP handlers
+ * can pass results straight through without round-tripping ElList/ElMap
+ * through json_stringify. */
+el_val_t  engram_get_node_json(el_val_t id);
+el_val_t  engram_get_node_by_label(el_val_t label);
+el_val_t  engram_search_json(el_val_t query, el_val_t limit);
+el_val_t  engram_scan_nodes_json(el_val_t limit, el_val_t offset);
+el_val_t  engram_scan_nodes_by_type_json(el_val_t node_type, el_val_t limit, el_val_t offset);
+el_val_t  engram_neighbors_json(el_val_t node_id, el_val_t max_depth, el_val_t direction);
+el_val_t  engram_activate_json(el_val_t query, el_val_t depth);
+el_val_t  engram_stats_json(void);
+el_val_t  engram_act_stats_json(void);
+el_val_t  engram_cosine_sim(el_val_t id_a, el_val_t id_b);
+/* Document frequency of a term across node labels — term-specificity signal
+ * for curiosity seed selection. (2026-08-03 self-review.) */
+el_val_t  engram_label_df(el_val_t term);
+el_val_t  engram_embed_backfill(el_val_t count);
+el_val_t  engram_list_layers_json(void);
+/* Working memory introspection — count, mean weight, and top-N snapshot.
+ * Ported from el-compiler/runtime on 2026-06-30 self-review. */
+el_val_t  engram_wm_count(void);
+el_val_t  engram_wm_avg_weight(void);
+el_val_t  engram_wm_top_json(el_val_t n);
+/* Merge-load: add nodes/edges from a snapshot without resetting the store. */
+el_val_t  engram_load_merge(el_val_t path);
+/* engram_compile_layered_json — produce a prompt-ready text block split
+ * into "[LAYER 0 — STRUCTURAL]" (non-suppressible layers, sacred fire)
+ * and "[ENGRAM CONTEXT]" (standard suppressible layers). Returns "" if
+ * no nodes promoted to working memory. */
+el_val_t  engram_compile_layered_json(el_val_t intent, el_val_t depth);
+
+/* ── LLM (Anthropic API client) ─────────────────────────────────────────────
+ * All functions call https://api.anthropic.com/v1/messages with the API key
+ * from env ANTHROPIC_API_KEY. Default model when empty: claude-sonnet-4-5. */
+
+el_val_t  llm_call(el_val_t model, el_val_t prompt);
+el_val_t  llm_call_system(el_val_t model, el_val_t system_prompt, el_val_t user_prompt);
+el_val_t  llm_call_agentic(el_val_t model, el_val_t system, el_val_t user, el_val_t tools);
+el_val_t  llm_vision(el_val_t model, el_val_t system, el_val_t prompt, el_val_t image_url_or_b64);
+el_val_t  llm_models(void);
+
+/* Register a tool handler by name. The handler is looked up via dlsym
+ * (mirroring http_set_handler), so any El `fn <name>(input)` compiles to
+ * a global C symbol that this function can locate at runtime.
+ * Handler signature: `el_val_t handler(el_val_t input_json)` — receives
+ * the tool input as a JSON-string el_val_t and returns a JSON-string
+ * el_val_t result. Used by llm_call_agentic.                                 */
+void      llm_register_tool(el_val_t name, el_val_t handler_fn_name);
+
+/* ── args() ─────────────────────────────────────────────────────────────────
+ * Provides access to command-line arguments passed to the program.
+ * Populated by el_runtime_init_args() before main() runs.           */
+
+el_val_t  args(void);
+void      el_runtime_init_args(int argc, char** argv);
+
+/* ── Crypto primitives ─────────────────────────────────────────────────────
+ * SHA-256, HMAC-SHA-256, and base64 (standard + URL-safe).
+ * Self-contained — no OpenSSL/libcrypto dependency. The implementations are
+ * adapted from public-domain reference code (Brad Conte / RFC 4648).
+ *
+ * Bytes-returning variants (sha256_bytes, hmac_sha256_bytes) return a string
+ * value whose contents are raw binary; callers usually feed these into
+ * base64_encode. Note that el_val_t strings are NUL-terminated by convention,
+ * so the binary payload may contain embedded NULs — pass it directly into
+ * base64_encode (which uses an explicit length) rather than treating it as
+ * a printable C string.
+ *
+ * The "base64" variants emit/accept RFC 4648 standard alphabet with padding.
+ * The "base64url" variants use URL-safe alphabet (`-`/`_`) with no padding,
+ * as used in JWTs.                                                           */
+
+el_val_t  sha256_hex(el_val_t input);
+el_val_t  sha256_bytes(el_val_t input);
+el_val_t  hmac_sha256_hex(el_val_t key, el_val_t message);
+el_val_t  hmac_sha256_bytes(el_val_t key, el_val_t message);
+el_val_t  base64_encode(el_val_t input);
+el_val_t  base64_decode(el_val_t input);
+el_val_t  base64url_encode(el_val_t input);
+el_val_t  base64url_decode(el_val_t input);
+
+/* Length-aware variants (internal — exposed for the rare caller that already
+ * has a known-length binary buffer and doesn't want to round-trip through
+ * a NUL-terminated el_val_t string). Sha256_bytes and hmac_sha256_bytes feed
+ * these implicitly. */
+el_val_t  el_sha256_bytes_n(const unsigned char* data, size_t len);
+el_val_t  el_base64_encode_n(const unsigned char* data, size_t len, int url_safe);
+
+/* ── Post-quantum primitives (liboqs-backed) ────────────────────────────────
+ * All inputs/outputs hex-encoded. Algorithm choices:
+ *   Signature: CRYSTALS-Dilithium-3   (NIST level 3, balanced)
+ *   KEM:       CRYSTALS-Kyber-768     (NIST level 3)
+ *   Hash:      SHA3-256 (Keccak)      (PQ-aware protocols favour SHA3 over SHA2)
+ *
+ * If liboqs is not linked (detected via __has_include(<oqs/oqs.h>) at compile
+ * time), the pq_* entry points return a JSON-shaped error string so callers
+ * fail loudly rather than silently fall back to classical schemes:
+ *   {"error":"liboqs not linked, post-quantum primitives unavailable"}
+ *
+ * The hybrid handshake pairs X25519 with Kyber-768 per NIST PQ guidance and
+ * CNSA 2.0. Combined shared secret is HKDF-SHA256(x25519_ss || kyber_ss).
+ * Even if Kyber falls, X25519 holds; if X25519 falls under quantum attack,
+ * Kyber holds. SHA3-256 also remains usable independent of liboqs (the
+ * Keccak permutation is PQ-OK as a primitive). */
+
+el_val_t  pq_keygen_signature(void);
+el_val_t  pq_sign(el_val_t secret_key_hex, el_val_t message);
+el_val_t  pq_verify(el_val_t public_key_hex, el_val_t message, el_val_t signature_hex);
+
+el_val_t  pq_kem_keygen(void);
+el_val_t  pq_kem_encaps(el_val_t public_key_hex);
+el_val_t  pq_kem_decaps(el_val_t secret_key_hex, el_val_t ciphertext_hex);
+
+el_val_t  pq_hybrid_keygen(void);
+el_val_t  pq_hybrid_handshake(el_val_t remote_pub_combined);
+
+el_val_t  sha3_256_hex(el_val_t input);
+
+/* ── AEAD: AES-256-GCM (libcrypto-backed) ───────────────────────────────────
+ * Symmetric authenticated encryption used to wrap envelopes after a KEM
+ * handshake. Caller MUST supply a 32-byte key (64 hex chars) — typically the
+ * Kyber-768 / hybrid shared_secret, optionally normalized via SHA3-256.
+ *
+ * aead_encrypt returns a JSON map {"nonce":"...","ciphertext":"..."} where
+ * ciphertext is the AES-256-GCM output with the 16-byte auth tag appended.
+ * Nonce is a fresh 12-byte CSPRNG draw — callers never pick the nonce, which
+ * structurally rules out the GCM nonce-reuse footgun.
+ *
+ * aead_decrypt returns the plaintext String, or "" on any failure (including
+ * auth-tag mismatch). Callers MUST check for "" before trusting the result. */
+el_val_t  aead_encrypt(el_val_t key_hex, el_val_t plaintext);
+el_val_t  aead_decrypt(el_val_t key_hex, el_val_t nonce_hex, el_val_t ciphertext_hex);
+
+/* ── Native VM builtin aliases (for compiled El source) ─────────────────────
+ * These match the El VM's native_* builtins so that El source compiled
+ * to C can call the same names without modification.                */
+
+el_val_t  native_list_get(el_val_t list, el_val_t index);
+el_val_t  native_list_len(el_val_t list);
+el_val_t  native_list_append(el_val_t list, el_val_t elem);
+el_val_t  native_list_empty(void);
+el_val_t  native_list_clone(el_val_t list);
+el_val_t  native_string_chars(el_val_t s);
+el_val_t  native_int_to_str(el_val_t n);
+
+/* ── Method-call shorthand aliases ──────────────────────────────────────────
+ * The El method-call convention `obj.method(args)` compiles to
+ * `method(obj, args)`.  These aliases expose the runtime functions under
+ * the short names that result from method calls in El source.
+ *
+ * Example: `myList.append(x)` → `append(myList, x)` (calls this alias)
+ *          `myList.len()`     → `len(myList)`         (calls this alias)  */
+
+el_val_t  append(el_val_t list, el_val_t elem);   /* el_list_append */
+el_val_t  len(el_val_t list);                      /* el_list_len    */
+el_val_t  get(el_val_t list, el_val_t index);      /* el_list_get    */
+el_val_t  map_get(el_val_t map, el_val_t key);     /* el_map_get     */
+el_val_t  map_set(el_val_t map, el_val_t key, el_val_t value); /* el_map_set */
+
+/* ── OTLP/HTTP Observability ─────────────────────────────────────────────── */
+/* See bottom of el_runtime.c for the implementation.
+ * Configured by env vars OTLP_ENDPOINT, OTEL_SERVICE_NAME, OTEL_SERVICE_VERSION.
+ * No-op when OTLP_ENDPOINT is unset. Drop-on-failure semantics. */
+/* ── Subprocess execution ────────────────────────────────────────────────── */
+el_val_t exec_command(el_val_t cmd);   /* run shell command, return exit code */
+el_val_t exec_capture(el_val_t cmd);   /* run shell command, capture stdout   */
+el_val_t exec(el_val_t cmd);           /* exec(cmd) → stdout String (30s timeout) */
+el_val_t exec_bg(el_val_t cmd);        /* exec_bg(cmd) → PID String (non-blocking) */
+
+el_val_t emit_log(el_val_t level, el_val_t msg, el_val_t fields_json);
+el_val_t emit_metric(el_val_t name, el_val_t value, el_val_t tags_json);
+el_val_t trace_span_start(el_val_t name);
+el_val_t trace_span_end(el_val_t span_handle);
+el_val_t emit_event(el_val_t name, el_val_t duration_ms);
+
+#ifdef __cplusplus
+}
+#endif