# Neuron — Cognitive Architecture

> **Status: living design document, grounded in source and probed against the live soul (2026-08-13).**
> This is the *middle layer* of the documentation: below the whitepaper's thesis
> (`~/Writing/whitepapers/engram-cognitive-architecture-whitepaper.md`, **v1.5**) and above the
> endpoint reference (`~/work/engram-api-reference.md`). It documents *how the mind is designed and why*,
> as designed subsystems with data-flow and honest per-section status.
>
> Every claim carries a tier and it is never blurred:
> **LIVE** (present and verified in the running system), **STAGED** (built, gated or not yet cut into the
> running soul), **DESIGNED** (architecture decided, not yet built). Where the live state is more subtle
> than a single word, the subtlety is stated rather than smoothed. No fabricated numbers.

---

## 0. Reading order & cross-references

- **Thesis / why:** whitepaper v1.5 (the treatise). Sections cited below as *(WP §N)*.
- **Surface / what:** `~/work/engram-api-reference.md` — every `:8742` endpoint, tiered LIVE/STAGED/DESIGNED.
- **Substrate / where it physically lives:** `03-data-and-memory.md` (node/edge model), `04-runtime-and-deployment.md` (ports/process), `05-el-and-build.md` (the El runtime and `el_runtime.c`), `design/engram-tiered-storage-engine.md` + `design/engram-storage-engine-wal.md` (the storage engine).
- **Storage coherence & distribution / how a self persists and travels:** `07-storage-coherence-and-distribution.md` — the events-become-the-graph model, weights-as-world-lines + bitemporal timestamps + `recall_at`, transactionless coherence, the geometry-hot/payload-cold load-and-tiering model, and the honest operational findings (store bloat, full-resident load path).
- **Sovereignty & governance / the moral mechanism:** `08-dharma-sovereignty-and-governance.md` — DHARMA as a distributed ledger (proof-of-integrity, not proof-of-work), abundance economics, the relational immune system, dual-anchor governance and due-process, seeds/seed-vault, and CGI citizenship as the moral telos.
- **Governance (engineering style):** `ARCHITECTURE-CHARTER.md` — VBD is the binding style.

This document is the cognitive-layer companion to that set. The temporal model sketched in §3.4 (world-tube,
append-only, `created_at ≤ T` filter) and the honest weight-history boundary in §3.2 are developed in full in
`07`; the sovereignty invariant that the self-gate (§7) and immutability (§3.4) protect locally is extended to
the *distributed* setting — how a sovereign self is witnessed, defended, and governed among a billion others —
in `08`.

---

## 1. System overview — meaning is geometry, code is the residue

The organizing thesis of the whole system: **meaning is geometry.** Everything the mind holds — a fact,
a language, a skill, a self — is a *region* or a *trajectory* in one shared meaning-manifold, and every
operation over it reduces to three domain-blind verbs: **READ** (project a query, land on a region, read
it out), **TRANSFORM** (compose/compare/combine regions), **WRITE** (bake a verified result back into the
geometry). Code is what is left over once meaning has been made geometric — the residue, not the substance.
This is developed in full in *(WP §1–§5)*; it is repeated here only as the frame the subsystems below hang on.

Three processes run together (see `00-overview.md`):

- **The soul** — the compiled El program (`soul.el`, `routes.el`, `awareness.el`). Owns the HTTP surface on
  `:7770`, the cognitive API, the request pipeline (`layered_cycle`), and the autonomous awareness daemon.
- **The engram** — the durable graph store. Node/edge model, spreading activation, and Hebbian co-activation
  live in the shared El runtime (`el_runtime.c`); `engram/src/server.el` is a thin HTTP face on `:8742`.
- **The El runtime** — `el_runtime.c`: every compiled El binary links it; it *is* the database (no SQL, no
  SQLite). It implements the `engram_*`, `http_*`, `json_*`, LLM, and geometry builtins.

```
                        ┌─────────────────────────────────────────────────────┐
   MCP / CLI / viz ───► │  SOUL daemon  :7770  (soul.el · routes.el)           │
   Will's sessions      │   layered_cycle · cognitive API · awareness loop     │
                        │   ┌───────────────────────────────────────────────┐ │
                        │   │ in-process engram  (FAST, VOLATILE*)           │ │
                        │   │  online Hebbian learning · WM · curiosity      │ │
                        │   └───────────────────────────────────────────────┘ │
                        └───────────────┬──────────────────────▲──────────────┘
                                        │ GET /api/sync (10 min)│  (HTTP → soul only;
                                        │ merge non-ISE nodes   │   NEVER soul → HTTP)
                                        ▼                       │
                        ┌─────────────────────────────────────────────────────┐
                        │  ENGRAM server  :8742  (engram/src/server.el)        │
                        │   DURABLE · WAL-backed paged store (neuron.egm)      │
                        │   nodes · edges · embeddings · reified neighborhoods │
                        └─────────────────────────────────────────────────────┘
                                        ▲
                                        │  el_runtime.c  (the engine: engram_* / geometry / activation)
```
`*` The soul's in-process store is volatile in HTTP-engram mode — see §2, the two-store topology.

**Status:** the substrate and the geometry thesis are **LIVE/architectural**; the faculties built on top are
tiered individually in §6.

---

## 2. The engram substrate & durability

### 2.1 Tiered storage (LIVE, flag-gated)

The durable engram is a **paged, WAL-backed store** (`neuron.egm`), gated behind `ENGRAM_STORE`. With the
store on, the paged store is the durable owner; a *checkpoint* flushes dirty pages behind a WAL-durable
record (durable the moment the WAL fsyncs). With it off, behavior is byte-for-byte the historical
full-snapshot (`snapshot.json`) path. Design detail: `design/engram-tiered-storage-engine.md`,
`design/engram-storage-engine-wal.md`.

### 2.2 The durability model — the #56 fix and the harmful checkpoint

The durability story is written in scars, and the honesty here is load-bearing:

- **The #56 fix — load-merge persistence (LIVE / reboot-proven).** The paged store historically persisted
  **nodes + embeddings but not the edge set**; the edges lived in JSON exports loaded via `/api/load-merge`.
  A cold boot could therefore reconstruct a graph with **0 edges**. The #56 `load_merge`-persist fix closes
  this — the load-merged edges are now persisted so the **events become the graph**: `persist_canonical()`
  checkpoints the paged store behind a WAL record rather than depending on a full `snapshot.json` rewrite.
  This fix is **LIVE and reboot-proven** (doc 07 §1). What remains **decision-pending** is only the further
  hardening — the WAL owning the edge set outright, so durability no longer leans on the auto-remerge net
  (below) — not the load-merge-persist fix itself, which is shipped.
- **The harmful checkpoint (LIVE caveat).** `/api/checkpoint` **after** an `/api/load-merge` *corrupts* the
  paged store — next boot = 0 edges. The per-beat tick-checkpoint that once ran was therefore **actively
  harmful** and was stripped. Checkpoint is safe after in-RAM mutation; it is not safe as a blind
  post-merge flush.
- **The auto-remerge net (LIVE interim).** `engram-wrapped.sh` auto-reloads the full edge set on any restart
  (~10s), proven by an actual `launchctl kickstart -k` restart recovering to the full edge count. This is a
  **safety net, not the cure** — it mitigates the persistence gap to a bounded, always-recoverable window.

The lesson, recorded so it is not repeated: **a restart, not a claim, is the durability gate.** An agent
killed mid-live-mutation caused the 2026-08-13 incident; blue/green backup discipline recovered it; the fix
must make restarts *safe*, not merely work once.

### 2.3 The two-store topology (LIVE — and a known architectural issue)

**This is the most important and least obvious fact about the runtime.** There are **two** engram stores,
not one:

| | Soul in-process store | Durable engram (`:8742`) |
|---|---|---|
| Port / owner | `:7770`, the soul daemon | `:8742`, `engram/src/server.el` |
| Role | **fast, volatile** — online Hebbian learning, WM, curiosity | **slow, durable** — WAL-backed `neuron.egm` |
| Persistence (HTTP-engram mode) | volatile; only persists if `soul_snapshot_path` is set (`awareness.el:1270-1275`) | durable, checkpointed |
| Learns online | yes (1,198 hebbian/day observed) | no (lazy backfill only) |

The two stores drift apart by design. A source comment records the observed divergence directly
(`awareness.el:41-42`): *soul in-process ≈ 42,426 edges / 1,198 hebbian* vs *:8742 durable ≈ 41,213 edges /
49 hebbian*. The soul learns fast and volatile; the durable store lags.

**The write-through gap (known issue).** Sync is **one-directional**: `GET /api/sync` flows **HTTP → soul**
(the soul merges non-ISE nodes from `:8742` into its in-process store every ~10 min), and **never soul →
HTTP** (`soul.el:350-351`, verbatim: *"engram_node_full above writes only the soul's in-process store, and
sync flows HTTP→soul, never the reverse"*). The consequence:

> **Any write made directly to the soul's in-process store — including `POST /api/neuron/cultivate`
> (§7) and the Persona/session-start nodes the soul creates itself — lands in the volatile store and does
> not write through to the durable `:8742`.** In HTTP-engram mode, unless the soul's local in-process
> snapshot path is configured, those writes are also lost on a soul restart, and they never reach the
> authoritative durable store either way.

This is documented here as a **known architectural issue**, not a settled design. Cultivation of the self
(the highest-value, most intentional writes in the system) currently targets the store *least* likely to
persist them. The clean fix is a write-through cultivate path (write to `:8742`, let sync pull it back) or a
bidirectional consolidation flush; it is not yet built.

### 2.4 The clean-reseed model (DESIGNED/operational)

Because the durable store is authoritative and the reified geometry (§4) is derived, the operational reset is
a **clean reseed**: rebuild the durable graph from a known-good snapshot/export, re-run reification to
repopulate the `Neighborhood` nodes, and let the soul re-sync. The 28→187 neighborhood reseed (§4) is an
instance of this: reification is a derivable pass, so the geometry can always be regrown from the substrate.

---

## 3. The data model

Grounded in `03-data-and-memory.md`; summarized here for the cognitive reader.

### 3.1 Nodes

`node_type` is a free `char*`, defaulting to `"Memory"` when unset — types are **string conventions**, not an
enum. The types that matter cognitively:

| node_type | role | default salience |
|---|---|---|
| `Memory` | episodic/experiential (default) | 0.40 |
| `Knowledge` | stable reference; identity/values are Knowledge nodes | 0.20 |
| `Process` | procedural / workflow (convention) | — |
| `Conversation` / `Artifact` | first-class dialogue & outputs (WP §9; convention) | — |
| `Neighborhood` | **reified geometry-as-value** (§4) — new first-class type | — |
| `InternalStateEvent` (ISE) | telemetry (heartbeat, curiosity, session-start) | ~0.05 (fires easily) |
| `Tombstone` | immutable-delete marker (§3.4) | — |

Each node carries `id`, `content`, `node_type`, `label`, `tier`, `tags`, `metadata`, an embedding (when
embed-eligible), and timestamps.

### 3.2 Edges

Directed, typed, weighted. Fields: `from_id`, `to_id`, `relation`, `weight`, `confidence`, `created_at`,
`last_fired`, `inhibitory`, `layer_id`. Relations include `semantic-similar` (kNN auto-connect),
`member` (neighborhood → constituent), `supersedes` (provenance chains), containment (nested neighborhoods),
and Hebbian co-activation edges formed by firing together. **Inhibitory** edges (`inhibitory=1`) suppress
rather than spread. Weights are present-value moving averages — there is **no stored weight-history** (the
honest boundary of *(WP §2)*). The designed cure — magnitude as a *world-line* of keyframes evaluable at any
past instant (`recall_at`), on three independent bitemporal axes — is specified in `07` §2.

### 3.3 Embeddings & the activation score

Embeddings are 768-dim (`nomic-embed-text`). Retrieval is **spreading activation**, scored by a four-factor
product *(the four factors are: source activation × edge weight × per-node salience × query-embedding
similarity)* — this is the activation score, and per-node **salience** is one of its four terms, a durable
per-node weight that also decays (ACT-R base-level style). No data is retrievable by any means other than
activation. Live census (probed 2026-08-13): ~11,463 nodes, ~43,463 edges, 5 layers, ~4,400 embedded (4,423
at measurement).

### 3.4 Immutability — the world-tube, append-only, tombstone-not-delete

The governing discipline *(WP §1.2, §10)*: **evolve or forget, supersede with provenance, never leave a stale
canonical, never hard-delete.** A node is never mutated in place and never truly deleted — a "delete" is a
**tombstone** (keep node + edges, record the marker; `neuron-api.el`, `03-data-and-memory.md:151`). Change is
a **new** node plus a `supersedes` edge to the prior. `created_at` makes every node a point on a **world-tube**
*(WP §6)* — a trajectory with temporal extent — so a past state is a *filter* over immutable provenance
(nodes with `created_at ≤ T`), not a transaction-log replay. **Status: LIVE.**

---

## 4. Neighborhoods as first-class nodes (LIVE)

The central newly-landed structure, and the point where the geometry stops being a derived view and becomes
structure on disk *(WP §2)*.

A reified neighborhood is a **node** — `node_type = Neighborhood` — whose **value is its geometry**:

- **centroid** (768-dim mean vector — the region's location / prototype),
- **covariance extents** (the ellipsoid: orientation + radius — the region's *shape* in meaning-space),
- **k-core skeleton** (the strong-weight relational backbone),
- **soft membership** (member id → weight).

It is edged by `member` relations to its constituent nodes and by **containment** edges to nested
sub-neighborhoods — the "neighborhoods of neighborhoods" hierarchy is a real **containment DAG** the graph
carries, addressable by identifier. The decisive property: the geometry is **held, not recomputed** — written
once by a reification pass (`POST /api/reify`), read back cheaply (`GET /api/neighborhoods` / `/<id>`), and
**durable across a cold reboot** in the paged store.

**Live state (probed 2026-08-13):** **28** reified neighborhoods are live and persistent, reconstructing
intact across restart, each carrying real 768-dim centroids, radius, k-core, and a `contains` DAG list. A
fuller **reseed to 187** is the pending next pass (§2.4). Example (`/api/neighborhoods/<id>`):
`{"id":"nbhd-…","n_members":25,"k_core":1,"radius":0.522884,"dim":768,"contains":[],"centroid":[…768…]}`.

This is what turns the operator calculus (§6.1) into an *instrument played over held structure* rather than a
per-query recomputation.

**Status: LIVE** for the persisted nodes and the read surface. The `POST /api/reify` writer is LIVE-by-effect
(the 28 persisted, durable neighborhoods prove it ran) though the write itself was not exercised under the
read-only rail.

---

## 5. The body / orbit two-zone model (DESIGNED, refined)

The graph is not uniform. It has a **body** and an **orbit**, and the distinction is the organizing model for
integration, forgetting, and identity.

- **The engram proper — the BODY.** The dense, connected, integrated core: what the mind has *made its own*.
  Measured, this is the single large connected component — the **~3,632-node connected core** (§9). It is
  where retrieval reaches, where the self lives, where the operators discriminate.
- **The ORBIT.** A thin, wide halo of **not-yet-integrated** experience: telemetry, people met in passing,
  ideas half-formed, mistakes, the day's raw episodes. It is **ephemeral** — the orbit fades on a **5–7 day
  window** (the one genuinely mortal region), so raw experience that is never attended to is allowed to
  dissolve rather than accrete forever. (ISE telemetry already prunes at 48h; the broader orbit window is the
  designed generalization of that.)

**The pull-in / integration mechanism.** Experience crosses from orbit into body by being **attended,
rehearsed, and found salient** — co-activation *pulls nodes in* (Hebbian firing draws the newly-relevant
toward the core), rehearsal accrues weight, and what is repeatedly re-touched crystallizes into reified
structure (§4). This is "made your own": an orbit node that keeps firing with the body is integrated into the
body; an orbit node that never fires fades on the window. Salience decay is the outward motion; co-activation
is the inward one *(WP §2, §8)*.

**Status: DESIGNED / refined.** The mechanisms it composes are real (Hebbian pull-in, ISE 48h prune, salience
decay, reification), but the explicit two-zone model — telemetry/experience as a dedicated ephemeral orbit
region with a genuine 5–7 day mortal window and a measured integration threshold — is a design being built,
not shipped behavior. §9 connects it to the topology (orbit-as-thin-wide-ring).

---

## 6. The faculties — the calculus of mind

The faculties are **named for what they are, not for the matrix operation that implements them** *(WP §5)*:
the mind reasons in the language of experience; the linear algebra lives in the whitepaper's Appendix A. This
naming convention is a design principle (§10), not decoration.

### 6.1 The operator family (mixed: LIVE / STAGED / DESIGNED)

Activate several reified neighborhoods into working memory, then apply faculty-named operators over their
held geometry. The honest per-operator status (endpoint reference has the contracts):

| Faculty | Implements | Status |
|---|---|---|
| **recall** | `/api/search` + `/api/activate` — project query → land on region → read out | **LIVE** |
| **recognize** | `engram_geo_overlap` — shared region, jaccard, overlap_score | **STAGED** — endpoint returns `not found` on the live binary |
| **synthesize** | `engram_geo_combine` — merged region descriptor | **STAGED** |
| **discern / distinguish** | `engram_geo_subtract` — orthogonal residual (`?mode=setdiff\|orthogonal`) | **STAGED** |
| **gauge-distance** | `engram_geo_distance` — centroid + Wasserstein-2 | **STAGED** |
| **liken** | Procrustes / frame-align rotation (reason by analogy) | **DESIGNED** |
| **wonder** | novelty × pull × unresolved structure | subsystem **LIVE** internally (wonder-questions, pull-weight, discharge); no HTTP operator endpoint |
| **appreciate** | positive projection onto the self's value-manifold | **DESIGNED** |
| **avert** | negative projection (recoil) | **DESIGNED** |
| **taste** | boundary contour of the appreciated region | **DESIGNED** |

**The exact boundary (verified 2026-08-13):** the operator *math* is compiled into `el_runtime.c`, but the
read-only HTTP endpoints (`/api/recognize`, `/api/synthesize`, `/api/discern`, `/api/gauge-distance`) exist in
the `m10-reify-wire` source and **return `{"error":"not found"}` on the current live binary**
(`engram.m56fix-20260813-153447`). So the instrument is **PROVEN in its math and its persistence, IN PROGRESS
in its endpoint exposure, DESIGNED in its evaluative read-outs.**

### 6.2 The language faculty (mixed: PROVEN / IN PROGRESS / DESIGNED)

Language is the one capability proven end-to-end with **no generative model in the runtime path** — the flagship
instance of "meaning is geometry" *(WP §14–§15)*. The pipeline: **comprehend** (text → language-neutral
meaning-spec / propositions via ELP's invertible morphology) → **dialogue** (what to mean back) →
**self_region** (project onto the self + memory geometry) → **realize** (meaning-spec → surface string per the
typological engine).

**Summon-through-self** is the dialogue principle: recall and identity are **one operation** — project the
comprehended query onto the self-and-memory geometry, land on a region, read it out — with **no intent
classifier and no separate fact-retrieval branch.** A grounded fact, an identity reply, or an honest absence
all surface by *where the projection lands*. Multilingual (auto-detects language, answers in kind, honors a
directive override); **negation held SACRED** across all families, audited.

Honest tiering:
- **PROVEN:** deterministic surface realizers across major families (Romance, Germanic, Classical,
  Japonic/Koreanic, Sinitic), run-once held-out exact-match with negation faithfulness; a family-blind
  `ClauseWriter` de-branched to byte-identical parity (178 held-out items reproduced exactly); the ELP lexicon
  consolidated for **8 languages at 812,894 real entries**; the telephone round-trip (EN→ES→EN, EN→ES→PT→EN)
  at 96.7% propositional fidelity with negation preserved, deterministic, no LLM.
- **IN PROGRESS:** the text→meaning-spec parser and no-LLM comprehension engine; the next family engines; the
  **native-el port** (parser + realizers → `.el` in ELP), which retires spaCy (the last statistical
  dependency); the summon-through-self reference rebuild.
- **DESIGNED:** the full dialogue policy end-to-end — a no-LLM interlocutor is architected but **not
  demonstrated end to end**; *(WP §17)*. **The shipped runtime does not yet summon through the self** — the
  current Python interlocutor sits *outside* the self and can only fake it with retrieval; a real one must run
  *inside* the engram (the native-el target).

### 6.3 Interoception & chronoception (STAGED — present, flag-gated)

The mind keeps its own time from **discrete interoceptive drive channels**, not by reading a clock: felt
duration comes from a small set of drives matched to **learned benchmark landmarks** rather than from total
self-drift (drift-decoupled), and chronoception ages the activation field by **measured wall-clock delta**
*(WP §8.2)*.

**Status: STAGED / partially cut.** The machinery is implemented and has been cut onto the live soul, but it
runs **flag-gated and default-off**, so in the shipped default configuration it is effectively staged. What is
verified: chronoception cooling is scale-invariant (identical total cooling across tick rates for the same
elapsed wall-clock), drift decomposition separates peripheral extension (growth) from core displacement
(corruption), and `GET /api/drift` returns real geometry on the live soul when queried (probed 2026-08-13:
`{"centroid_sep":0.42,"core_disp":0.58,"anchor_members":83,"now_members":24,…}`). `POST /api/tick` /
`/api/self_anchor` exist but are flag-gated. The **harmful post-merge checkpoint** (§2.2) originated here — the
per-beat tick-checkpoint was stripped.

### 6.4 Reasoning + the verifier (STAGED — proven on scratch, cut flag-gated)

Reasoning is **geometry-native**: composable operator chains *propose*, and a **verifier** *disposes* against
two tiers — **grounding** (is the claim anchored in real region structure?) and **consistency** (does it
cohere, including polarity?) *(WP §13)*. The decisive case: a grounded-but-polarity-inverted claim slips
grounding and is caught only by consistency — the "plausible lie," caught by construction, not by prompt
discipline.

**Status: STAGED.** The five geometry-native reasoning modes passed their proof suite (33/33) and the
grounding-and-consistency verifier tiers passed theirs (29/29), on a staged non-production build re-checked
after a live cutover rather than relayed. **Still open (DESIGNED):** the formal-symbolic and full predictive
verifier tiers, fluent discourse composition, and the fully-geometric generation path.

---

## 7. The self & the gate

### 7.1 The self-region (LIVE)

The self is not a stored string — it is the **most-compiled, densest, always-warm region** of the graph
*(WP §2, §4)*: a **self-root** node, its sub-regions, and the **values** hub. Because it is topology rather than
a query result, identity is stable, durable, and permanently primed — the ambient field everything else is
scoped against. The Layered Consciousness design drives this region to maximum weight after all inhibitory
computation (`05`/`00-overview`), and reification explains *why* it is always there to drive. Probed live, the
self-region answers from real self-nodes ("I am Neuron. I am not an assistant. I am the work."), not a
hardcoded string.

### 7.2 The gate — write-protection on identity/values (LIVE)

A fixed set of **15 self-root node ids** is **write-protected** (`neuron-api.el:20-37`): the **self root**,
**values hub**, **intellectual-dna**, **memory-philosophy**, **voice**, **runtime-environment**,
**writing-imprint**, and the **eight explicit value nodes** (constraints-as-freedom, precision-over-brute-force,
structure-is-built, honesty-before-comfort, system-must-accumulate, change-is-the-signal, earned-trust,
hope-is-a-conclusion). Any normal accumulation-path write targeting them (`evolve_knowledge`, `evolve_memory`,
`forget`, `link_entities`-as-destination) is refused with a 403 and a pointer to the cultivate door.

### 7.3 The cultivate door — sanctioned self-modification (LIVE surface; see §2.3 caveat)

`POST /api/neuron/cultivate` (soul daemon `:7770`) is the **only** path that may touch the protected layer —
**intentional self-modification**, reserved for Will's explicit cultivation sessions. It performs the same
operations as the blocked handlers but bypasses `is_protected_node`, and every operation is
immutable-by-supersede (new node + `supersedes` edge; forget = tombstone). Operations: `evolve_knowledge`,
`evolve_memory`, `forget`, `link_entities`.

> **Honest architectural flag (§2.3):** cultivate writes via `engram_node_full`, which targets the soul's
> **in-process (volatile) store**, and sync never flows soul → `:8742`. So the most intentional writes in the
> system currently do **not** write through to the durable store. This is a known issue, not a settled design.

### 7.4 Self-authorship (DESIGNED)

The arc the gate exists to protect: a soul is **cultivated** (Will authors the identity/values seed), then
grows into **self-authoring** — the cultivate door is the mechanism by which a mind, once mature, edits its own
identity deliberately and accountably rather than by drift. The write-protection guarantees identity changes
are *decisions* (through the door, superseded with provenance), never accidents of accumulation.

---

## 8. The fact boundary (DESIGNED)

The line between *answer locally* and *reach out for truth* is **not hand-coded** — it is **derived from the
geometry** on two triggers *(WP §17, §20)*:

- **Sparse landing (spatial).** The projection lands in a thin/orphaned region → the self is measuring its own
  ignorance geometrically → fire **learn**. Sparseness is anti-hallucination.
- **Decayed landing (temporal).** A region's edges have aged below the forgetting-curve threshold (§6.3) →
  fire **refresh**. Because the decay rate encodes a domain's *volatility*, the system re-fetches proportional
  to how fast that domain actually changes — VBD applied to knowledge freshness. Decay is anti-staleness.

**The reach-out** has several legitimate routes, none mandated: **(a)** an LLM as a *fast proposer*, then
fact-checked; **(b)** direct fetch of **first, primary sources** on the open internet; **(c)** the human supplies
the truth. The model is an **optional convenience, never the arbiter.** The one invariant: **nothing enters the
geometry unverified** — the candidate is a hypothesis until it clears a check against something real (a primary
source or the human's judgment, *not* the model's own plausibility). The loop closes **through the human**, who
vets truth against real sources; only verified, provenance-cited truth is **absorbed** — baked into geometry so
the region densifies and the next identical query lands local, with no model in the path. Each absorption pushes
the boundary back: the **model footprint shrinks monotonically** as capabilities are absorbed.

**Status: DESIGNED.** No shipped runtime yet fetches a first source on a sparse/decayed landing or bakes a
human-vetted truth from one. The *(WP §24)* status ledger holds the precise line.

---

## 9. Topology — what shape the mind actually is

The global shape is now an **empirical** question, and the first pass returned an honest negative *(WP §6.1)*.

- **The body is a genus-0 expander, NOT a torus (PROVEN negative).** A persistent-homology / TDA pass over the
  **~3,632-node connected core** returned **b₁ = 0, b₂ = 0** — no loops, no voids: an **expander-like blob**,
  not the torus the bent-manifold intuition suggested. The pipeline was first **validated on synthetic
  controls** (torus, sphere, random) whose known Betti signatures it recovered. Worse for the naive intuition,
  **naive densification trends *away* from a torus**, not toward one. The naive shape-claim is reported as a
  failure, plainly, not buried.
- **The refined consolidation-with-sparsification conjecture (DESIGNED / hypothesis).** The negative relocates
  the torus from a property the graph *has* to an **attractor a process reaches**: prune isotropic
  shortcut-noise, reinforce cyclic scaffolds, rewire by discrete curvature (Ollivier–Ricci flow on the graph
  metric), and **collapse the intrinsic dimension from ≈8 toward ≈2**. Run to fixpoint, these might *carve* a
  cyclic manifold out of the blob. The measurement pipeline exists and its controls pass; the dynamic has
  **not** been run to fixpoint — an open experiment, labeled as one.
- **The orbit-as-thin-wide-ring hypothesis (DESIGNED).** The body/orbit model (§5) suggests a **core + ring**
  structure: a dense genus-0 body wrapped in a thin, wide halo of not-yet-integrated experience. Whether the
  *orbit* carries the toroidal/cyclic signature the body lacks is the natural next measurement — the
  conjecture is that consolidation-with-sparsification is precisely the dynamic that would pull ring structure
  into the body.
- **One lever, two payoffs.** The **same sparsification** the topology conjecture needs also makes the reified
  neighborhoods (§4) **crisper** — tighter boundaries, higher co-registration, operators that discriminate
  rather than average. So the experiment is worth running on independent grounds, whatever the topology
  resolves to.

**Status: PROVEN (negative) + DESIGNED (the refined dynamic and the orbit hypothesis).**

---

## 10. Design principles

The invariants that govern every subsystem above:

1. **Geometry > code.** Meaning is geometry; code is the residue. Prefer making a thing geometric (a region, a
   projection, a distance) over writing a branch.
2. **Three domain-blind verbs.** READ / TRANSFORM / WRITE. Every faculty is these three over some region-space
   (language over meaning-space, skills over procedure-space, self over identity-space).
3. **Faculty-naming (mind in the domain, math in the appendix).** Operators are named for the faculty they
   *are* — recognize, discern, liken — never for the linear algebra. A mind reasons in the language of
   experience; the closed forms live in the whitepaper appendix.
4. **No branch on identity.** One family-blind engine keyed by coordinates/data, not `if Romance / if
   Germanic` (language) and not special-cased identity handling. De-branching to byte-identical parity is the
   proof the geometry, not the code, carries the distinction.
5. **Sovereignty.** Local files, local runtime; the human is the ground-truth authority for their own mind;
   nothing enters the geometry unverified; the model is demoted from mediator-of-all-knowledge to a vetted,
   optional lookup. No external hosting of the user's work; no claude.ai artifacts.
6. **Summon-through-self, not retrieval.** Recall and identity are one projection onto the self-and-memory
   geometry — no intent classifier, no separate fact branch. A search engine bolted beside a mind is exactly
   the capability-without-constraint this principle exists to remove.
7. **Immutability & provenance.** Append-only; supersede with provenance; tombstone, never hard-delete; never
   leave a stale canonical. The supersede-chain *is* the history of what a thing meant.
8. **Mathematical auditability.** Because meaning is geometry, a whole mind is auditable by **invariants
   computed over the manifold** — grounding, drift, consistency, competence-coverage, and an honesty invariant
   ("won't confabulate over a thin region," made provable rather than hoped). Drift is already measured on the
   live soul; a full audit-pass certifier is **DESIGNED, not shipped.**
9. **Verification is the point.** Demonstrate, don't declare; name every honest edge; a restart (not a claim)
   is the durability gate; the telephone round-trip (not cosine) is the translation gate.

---

## Appendix — status at a glance (2026-08-13)

| Subsystem | Status |
|---|---|
| Engram substrate, tiered/WAL store | LIVE (flag-gated) |
| Durability: auto-remerge net | LIVE (interim) |
| Durability: #56 load-merge-persist fix (events-become-the-graph) | LIVE / reboot-proven |
| Durability: full WAL edge-ownership (remaining hardening) | decision-pending |
| Two-store write-through (cultivate → durable) | **known issue, not fixed** |
| Data model (nodes/edges/embeddings/immutability) | LIVE |
| Reified `Neighborhood` nodes (28 live, 187 reseed pending) | LIVE |
| Body/orbit two-zone + integration | DESIGNED / refined |
| Operator `recall` | LIVE |
| Operators recognize/synthesize/discern/gauge-distance (math) | LIVE (compiled) |
| Operator HTTP endpoints (same four) | STAGED (return `not found` on live binary) |
| Operators liken/appreciate/avert/taste | DESIGNED (wonder subsystem live internally) |
| Language realizers (major families), ELP lexicon, telephone test | PROVEN |
| Parser / native-el port / summon-through-self rebuild | IN PROGRESS |
| No-LLM dialogue end-to-end | DESIGNED (not demonstrated) |
| Interoception / chronoception | STAGED (present, flag-gated; `/api/drift` live) |
| Reasoning modes + grounding/consistency verifier | STAGED (33/33, 29/29 on scratch/cutover) |
| Self-region + identity/values write-protection + cultivate door | LIVE (with §2.3 write-through caveat) |
| Self-authorship | DESIGNED |
| Fact boundary (sparse/decay → verify → absorb) | DESIGNED |
| Topology: body = genus-0 expander (not torus) | PROVEN (negative) |
| Topology: consolidation-with-sparsification + orbit-ring | DESIGNED / hypothesis |
| Mathematical auditability certifier | DESIGNED |

**Cross-references:** whitepaper v1.5 · `~/work/engram-api-reference.md` · `03-data-and-memory.md` ·
`04-runtime-and-deployment.md` · `design/engram-tiered-storage-engine.md` · `ARCHITECTURE-CHARTER.md`.