@@ -0,0 +1 @@
+engine/binaries/** binary -text
@@ -3,20 +3,23 @@
 #
 # EVERY merge to main runs this. Each language's engine id (src/pipeline/run-souffle.sh
 # --print-engine-id) is a hash of that language's rules alone, so the plan step decides per
-# language: an id that already has a release is unchanged and skipped; an id without one is
-# built on every platform. A Python-only merge therefore rebuilds Python on all four targets
-# and nothing else; a merge touching no rule set builds nothing and finishes in seconds. For
-# each language that needs building:
+# language: an id equal to the one recorded in engine/binaries/<lang>/ENGINE_ID is unchanged
+# and skipped; any other id is built on every platform. A Python-only merge therefore rebuilds
+# Python on all four targets and nothing else; a merge touching no rule set builds nothing and
+# finishes in seconds. For each language that needs building:
 #   generate  Ubuntu + the pinned Soufflé .deb: emit the program, `souffle -g` it to portable
 #             C++ once, and capture the header tree the C++ compiles against.
 #   build     compile that C++ on every platform with the SAME flags the script uses locally
 #             (-std=c++17 -O3, no OpenMP/zlib/sqlite defines — the binary links against nothing
 #             but the C++ runtime). Portable target: no -march=native; macOS universal.
-#   release   one GitHub release per (language, id), tagged engine-<lang>-<id>, holding
-#             axiom-engine-<lang>-<os>-<arch>[.exe], sha256sum.txt, and the generated .cpp.
-# run-souffle.sh computes the same id on the user's machine and fetches the matching asset.
-# The id is a function of the repository alone (see engine_id in the script), which is what
-# makes "no release for this id" mean exactly "these rules have not been merged and built".
+#   publish   COMMIT the binaries to main under engine/binaries/<lang>/<platform>/ with the id
+#             they were built from in engine/binaries/<lang>/ENGINE_ID — so a checkout carries
+#             its own engines and nothing is downloaded — and, as a secondary copy, a GitHub
+#             release tagged engine-<lang>-<id> with the same files plus the generated .cpp.
+# run-souffle.sh computes the same id on the user's machine and uses the committed binary only
+# when the ids agree. The id is a function of the repository alone (see engine_id in the
+# script), which is what makes "id differs" mean exactly "these rules were edited after the
+# binary was built".
 # ─────────────────────────────────────────────────────────────────────────────
 name: engine-binaries
 
@@ -62,10 +65,11 @@ jobs:
           for lang in $LANGUAGES; do
             id="$(bash src/pipeline/run-souffle.sh --language "$lang" --print-engine-id)"
             echo "$lang: $id"
-            if [ "$FORCE" != "true" ] && [ "${{ github.event_name }}" != "pull_request" ] && gh release view "engine-$lang-$id" >/dev/null 2>&1; then
-              echo "  unchanged — release engine-$lang-$id exists"; continue
+            have="$(tr -d '[:space:]' < "engine/binaries/$lang/ENGINE_ID" 2>/dev/null || true)"
+            if [ "$FORCE" != "true" ] && [ "${{ github.event_name }}" != "pull_request" ] && [ "$have" = "$id" ]; then
+              echo "  unchanged — engine/binaries/$lang is at this id"; continue
             fi
-            echo "  changed — no release for this id; building on every platform"
+            echo "  changed — engine/binaries/$lang is at '${have:-<none>}'; building on every platform"
             printf '%s' "$id" > "out/$lang.id"
             langs="$langs \"$lang\""
           done
@@ -184,48 +188,89 @@ jobs:
           path: axiom-engine-*
           if-no-files-found: error
 
-  # Per language, and independent of the other languages' builds: `always()` lets this run
-  # when some build job failed, and the step below publishes a language only if ALL FOUR of
-  # its binaries exist. A language with a missing platform gets no release — so the next
-  # merge retries it — while the others publish.
-  release:
+  # One job for every language built: `always()` lets it run when some build failed, and a
+  # language is published only if ALL FOUR of its binaries exist — a language with a missing
+  # platform is left as it was (the next merge retries it, since its ENGINE_ID still differs)
+  # while the others go in. One commit on main carries everything that was rebuilt.
+  publish:
     needs: [generate, build]
     if: always() && needs.generate.result == 'success' && needs.generate.outputs.langs != '[]' && github.event_name != 'pull_request'
     runs-on: ubuntu-24.04
-    strategy:
-      matrix:
-        lang: ${{ fromJson(needs.generate.outputs.langs) }}
     steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: main
       - uses: actions/download-artifact@v4
         with:
           name: generated
           path: gen
       - uses: actions/download-artifact@v4
         with:
-          pattern: engine-${{ matrix.lang }}-*
+          pattern: engine-*
           path: bins
           merge-multiple: true
 
-      - name: Publish release engine-${{ matrix.lang }}-<id>
+      - name: Place the binaries under engine/binaries/<lang>/<platform>/
+        id: place
+        run: |
+          set -e
+          echo "artifacts:"; ls -la bins
+          published=""
+          for lang in $LANGUAGES; do
+            [ -f "gen/$lang.id" ] || continue
+            id="$(cat "gen/$lang.id")"
+            n="$(ls bins/axiom-engine-$lang-* 2>/dev/null | grep -vc '\.sha256$' || true)"
+            if [ "$n" != 4 ]; then
+              echo "::warning::$lang: only $n of 4 platform binaries were built — engine/binaries/$lang left unchanged; the next merge to main retries"
+              continue
+            fi
+            rm -rf "engine/binaries/$lang"
+            for f in bins/axiom-engine-$lang-*; do
+              case "$f" in *.sha256) continue;; esac
+              name="$(basename "$f")"
+              platform="${name#axiom-engine-$lang-}"; platform="${platform%.exe}"
+              mkdir -p "engine/binaries/$lang/$platform"
+              cp "$f" "engine/binaries/$lang/$platform/$name"
+              chmod +x "engine/binaries/$lang/$platform/$name"
+            done
+            cat bins/axiom-engine-$lang-*.sha256 | sed 's#  .*/#  #' > "engine/binaries/$lang/sha256sum.txt"
+            printf '%s\n' "$id" > "engine/binaries/$lang/ENGINE_ID"
+            printf 'Built by the engine-binaries workflow from %s.\nRule-set id: %s (src/pipeline/run-souffle.sh --language %s --print-engine-id).\nrun-souffle.sh uses these only while the rules hash to that id.\n' "${{ github.sha }}" "$id" "$lang" > "engine/binaries/$lang/BUILD.txt"
+            published="$published $lang"
+          done
+          echo "published=${published# }" >> "$GITHUB_OUTPUT"
+          git status --short engine/binaries | head -20
+
+      - name: Commit to main
+        if: steps.place.outputs.published != ''
+        run: |
+          set -e
+          git config user.name "engine-binaries"
+          git config user.email "engine-binaries@users.noreply.github.com"
+          git add -A engine/binaries
+          git commit -m "engine: rebuilt binaries for ${{ steps.place.outputs.published }} from ${{ github.sha }}" \
+                     -m "Built on linux-x86_64, linux-arm64, darwin-universal and windows-x86_64 by the engine-binaries workflow. Each language's ENGINE_ID is the id of the rules it was compiled from; run-souffle.sh uses the binary only while the checkout's rules hash to that id."
+          # main may have moved during the build; rebase our one commit on top and retry.
+          for attempt in 1 2 3 4 5; do
+            git push origin HEAD:main && exit 0
+            echo "push rejected (attempt $attempt) — rebasing on the current main"
+            git fetch origin main && git rebase origin/main
+          done
+          echo "::error::could not push the binaries to main after 5 attempts"; exit 1
+
+      - name: Secondary copy — a release per language
+        if: steps.place.outputs.published != ''
         env:
           GH_TOKEN: ${{ github.token }}
-          FORCE: ${{ inputs.force }}
         run: |
           set -e
-          lang="${{ matrix.lang }}"
-          id="$(cat "gen/$lang.id")"
-          tag="engine-$lang-$id"
-          n="$(ls bins/axiom-engine-$lang-* 2>/dev/null | grep -vc '\.sha256$')"
-          if [ "$n" != 4 ]; then
-            echo "::warning::$lang: only $n of 4 platform binaries were built — not publishing $tag; the next merge to main retries"
-            exit 0
-          fi
-          cat bins/*.sha256 | sed 's#  .*/#  #' > bins/sha256sum.txt
-          rm -f bins/*.sha256
-          cp "gen/$lang.cpp" "bins/$lang.cpp"
-          echo "assets:"; ls -la bins
-          notes="Prebuilt engine for the **$lang** rule set at id \`$id\` (Soufflé $(cat gen/souffle.version), pinned in src/pipeline/engine.conf), built from ${{ github.sha }}.
-
-          \`run-souffle.sh --language $lang\` fetches the asset for its platform when \`souffle\` is not installed. \`$lang.cpp\` is the generated program for anyone who prefers to compile it themselves (needs only the Soufflé headers and a C++17 compiler)."
-          if [ "$FORCE" = "true" ]; then gh release delete "$tag" -y 2>/dev/null || true; fi
-          gh release create "$tag" --title "engine · $lang · ${id:0:12}" --notes "$notes" --target "${{ github.sha }}" bins/*
+          for lang in ${{ steps.place.outputs.published }}; do
+            id="$(cat "gen/$lang.id")"; tag="engine-$lang-$id"
+            mkdir -p "rel/$lang"
+            cp engine/binaries/$lang/*/axiom-engine-* engine/binaries/$lang/sha256sum.txt "rel/$lang/"
+            cp "gen/$lang.cpp" "rel/$lang/$lang.cpp"
+            gh release delete "$tag" -y 2>/dev/null || true
+            gh release create "$tag" --title "engine · $lang · ${id:0:12}" --target main \
+              --notes "Prebuilt engine for the **$lang** rule set at id \`$id\` (Soufflé $(cat gen/souffle.version), pinned in src/pipeline/engine.conf), built from ${{ github.sha }}. The same binaries are committed under engine/binaries/$lang/; \`$lang.cpp\` is the generated program for anyone who prefers to compile it (Soufflé headers + a C++17 compiler)." \
+              rel/$lang/*
+          done
@@ -127,10 +127,11 @@ receiver is a lambda parameter. Restricted to files of 1,000 lines or more, d1 r
 ## Run
 
 Requirements: Node ≥ 22.5 and a POSIX shell with `awk` (Git Bash on Windows). **No Soufflé and
-no C++ compiler**: the rules compile to one self-contained executable, CI builds it for
-Linux (x86_64, arm64), macOS (universal) and Windows on every merge to `main`, and the script
-fetches the one for your platform on first use — verified by sha256, cached under the rule
-set's id. With `souffle` installed the script compiles locally instead, exactly as before.
+no C++ compiler**: the rules compile to one self-contained executable, and CI builds it for
+Linux (x86_64, arm64), macOS (universal) and Windows on every merge to `main` and commits it
+to `engine/binaries/<lang>/<platform>/` — so a checkout already contains the engine for every
+platform and nothing is downloaded. With `souffle` installed the script compiles locally
+instead, exactly as before.
 
 ```bash
 npm install && npm run build
@@ -146,11 +147,14 @@ bash src/pipeline/run-souffle.sh \
      --intermediate <scratch> --output <out>
 ```
 
-The prebuilt binaries live in GitHub releases tagged `engine-<lang>-<id>`, where `<id>` is
-`bash src/pipeline/run-souffle.sh --language <lang> --print-engine-id` — a sha256 of the rules
-and the pinned Soufflé version (`src/pipeline/engine.conf`), the same from any checkout. The
-repository is private, so the fetch authenticates through `gh` or a `GH_TOKEN`. A rule set that
-has not been merged has no release: edit rules with Soufflé installed, or merge first.
+`engine/binaries/<lang>/ENGINE_ID` records the rule-set id the committed binaries were built
+from — `bash src/pipeline/run-souffle.sh --language <lang> --print-engine-id`, a sha256 of the
+rules and the pinned Soufflé version (`src/pipeline/engine.conf`), the same from any checkout.
+The script uses a committed binary only while the checkout's rules hash to that id; rules you
+have edited locally need Soufflé installed to compile, or a merge to `main` so CI rebuilds and
+commits them. The same binaries are also published as a GitHub release tagged
+`engine-<lang>-<id>`, which the script falls back to fetching (sha256-verified) when neither
+a committed nor a locally compiled engine exists.
 
 **Outputs — the same in every language** ([`src/bundle/SCHEMA.md`](src/bundle/SCHEMA.md))
 
 
@@ -8,9 +8,13 @@
 #
 # NO SOUFFLÉ NEEDED TO RUN. The rules compile to one self-contained executable that is
 # project-independent; CI builds it for every platform on merge (engine-binaries.yml) and
-# publishes it under a release tagged engine-<lang>-<id>. When `souffle` is not on PATH this
-# script fetches that binary for the local platform (once, into the cache) and verifies its
-# sha256. With souffle installed it compiles locally as before. See src/pipeline/engine.conf.
+# COMMITS it under engine/binaries/<lang>/<platform>/ next to the id of the rules it was
+# built from, so a checkout carries its own engines. The binary is resolved in this order:
+#   1. engine/binaries/<lang>/<platform>/  — used only if its ENGINE_ID equals the id of the
+#      rules in this checkout (edited rules never silently run a stale binary);
+#   2. a locally compiled engine, when `souffle` is on PATH (the cache under .souffle-cache);
+#   3. the GitHub release tagged engine-<lang>-<id> (sha256-verified), when it exists.
+# See src/pipeline/engine.conf.
 #
 # OUTPUT LAYOUT — the same in every language (src/bundle/SCHEMA.md):
 #   $OUT/graph.sqlite   the contract: core tables + ext_* tables + the schema catalog
@@ -390,7 +394,26 @@ fetch_engine(){
   echo "▶ verified sha256 $sum → $BIN"
 }
 
-if [ -x "$BIN" ]; then
+# 1. the binary committed with the repository, if it was built from exactly these rules
+COMMITTED_DIR="$SRC/../engine/binaries/$LANG_ARG"
+COMMITTED=""
+if [ -f "$COMMITTED_DIR/ENGINE_ID" ]; then
+  if [ "$(tr -d '[:space:]' < "$COMMITTED_DIR/ENGINE_ID")" = "$ENGINE_ID" ]; then
+    platform="$(engine_platform 2>/dev/null || true)"
+    cand="$COMMITTED_DIR/$platform/axiom-engine-$LANG_ARG-$platform$EXE"
+    if [ -n "$platform" ] && [ -f "$cand" ]; then
+      COMMITTED="$cand"; chmod +x "$COMMITTED" 2>/dev/null || true
+    else
+      echo "  ! engine/binaries/$LANG_ARG matches these rules but has no binary for ${platform:-this platform}"
+    fi
+  else
+    echo "  ! engine/binaries/$LANG_ARG was built from $(cut -c1-12 "$COMMITTED_DIR/ENGINE_ID")…, these rules are ${ENGINE_ID:0:12}… — not using it"
+  fi
+fi
+
+if [ -n "$COMMITTED" ]; then
+  BIN="$COMMITTED"; echo "▶ using committed engine ${COMMITTED#"$SRC/../"}"
+elif [ -x "$BIN" ]; then
   echo "▶ reusing cached binary"
 elif command -v souffle >/dev/null 2>&1; then
   echo "▶ compiling souffle program (cache miss)..."
@@ -421,9 +444,9 @@ elif command -v souffle >/dev/null 2>&1; then
   mv -f "$BIN.tmp.$$" "$BIN"
 else
   fetch_engine || {
-    echo "❌ no engine for $LANG_ARG@$ENGINE_ID on this machine. Either:" >&2
+    echo "❌ no engine for $LANG_ARG@${ENGINE_ID:0:12}… on this machine. Either:" >&2
     echo "   • install souffle $SOUFFLE_VERSION to compile locally (macOS: brew install souffle; Ubuntu: the .deb from souffle-lang/souffle releases), or" >&2
-    echo "   • use a rule set CI has built: merge to main, wait for the engine-binaries workflow, then rerun." >&2
+    echo "   • use a rule set CI has built: merge to main, wait for the engine-binaries workflow to commit engine/binaries/$LANG_ARG, then pull and rerun." >&2
     exit 1
   }
 fi
 
@@ -11,11 +11,15 @@
 # ─────────────────────────────────────────────────────────────────────────────
 set -u
 ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
-RUN="$ROOT/src/pipeline/run-souffle.sh"
 fail=0; bad(){ echo "  ✗ $*"; fail=$((fail+1)); }
 [ -x "$ROOT/node_modules/.bin/tsx" ] || { echo "engine-fetch: SKIP (no node_modules/.bin/tsx — run npm install)"; exit 0; }
 W="$(mktemp -d)"; trap 'rm -rf "$W"' EXIT
-mkdir -p "$W/bin" "$W/release" "$W/cache" "$W/ir" "$W/int" "$W/out"
+mkdir -p "$W/bin" "$W/release" "$W/cache" "$W/ir" "$W/int" "$W/out" "$W/tree"
+# a copy of the tree, so a committed engine can be planted under engine/binaries/ without
+# touching the repository; the bundler's node_modules and tsconfig are shared by link
+cp -R "$ROOT/src" "$W/tree/src"
+ln -s "$ROOT/node_modules" "$W/tree/node_modules"; ln -s "$ROOT/tsconfig.json" "$W/tree/tsconfig.json"; ln -s "$ROOT/package.json" "$W/tree/package.json"
+RUN="$W/tree/src/pipeline/run-souffle.sh"
 # a PATH with everything the driver and the bundler need, and no souffle
 for t in bash sh grep awk sed sort cut tr mktemp uname cat rm cp mv ls dirname basename shasum sha256sum stat date mkdir chmod head tail wc find ln printf tee env node git curl; do
   p="$(command -v "$t" 2>/dev/null)" && ln -sf "$p" "$W/bin/$t"
@@ -50,6 +54,29 @@ export FAKE_TAG="engine-$lang-$id" FAKE_RELEASE="$W/release"
 
 run(){ PATH="$W/bin" AXIOM_SOUFFLE_CACHE="$W/cache" bash "$RUN" --language $lang --client-ir "$W/ir" --library "" --intermediate "$W/int" --output "$W/out" > "$W/log" 2>&1; }
 
+# 0. a COMMITTED engine whose ENGINE_ID matches the rules is used directly — no download
+committed="$W/tree/engine/binaries/$lang"
+mkdir -p "$committed/$platform"; cp "$W/release/$asset" "$committed/$platform/$asset"; printf '%s\n' "$id" > "$committed/ENGINE_ID"
+export FAKE_TAG="engine-$lang-must-not-be-asked"
+if run; then
+  grep -q "using committed engine" "$W/log" || bad "committed engine with a matching id was not used"
+  grep -q "fetching prebuilt" "$W/log" && bad "a download was attempted although a matching committed engine exists"
+  [ -f "$W/out/graph.sqlite" ] || [ -f "$W/out/graph/call_edges.csv" ] || bad "the committed-engine run did not reach the bundle stage"
+else
+  bad "run with a matching committed engine failed:"; tail -8 "$W/log" | sed 's/^/      /'
+fi
+# 0b. a committed engine built from OTHER rules is ignored, with a message, and the fetch runs
+printf 'deadbeef%s\n' "${id:8}" > "$committed/ENGINE_ID"; rm -rf "$W/out"
+export FAKE_TAG="engine-$lang-$id"
+if run; then
+  grep -q "not using it" "$W/log" || bad "a stale committed engine was not reported"
+  grep -q "using committed engine" "$W/log" && bad "a committed engine with a different id was used"
+  grep -q "verified sha256" "$W/log" || bad "after ignoring the stale committed engine, no fetch happened"
+else
+  bad "run with a stale committed engine and a valid release failed:"; tail -8 "$W/log" | sed 's/^/      /'
+fi
+rm -rf "$W/tree/engine" "$W/cache"/* "$W/out"
+
 # 1. a good release is fetched, verified, cached and run through to the bundle
 if run; then
   grep -q "verified sha256" "$W/log" || bad "no 'verified sha256' line in the log"
@@ -74,4 +101,4 @@ if run; then bad "a run with no release and no souffle succeeded"; else
   grep -q "install souffle" "$W/log" && grep -q "merge to main" "$W/log" || bad "the no-release error does not name both ways out"
 fi
 
-if [ "$fail" -eq 0 ]; then echo "engine-fetch: ok (fetch, verify, cache, refuse tampered, explain absence)"; else echo "engine-fetch: $fail failure(s)"; exit 1; fi
+if [ "$fail" -eq 0 ]; then echo "engine-fetch: ok (committed engine by id, fetch, verify, cache, refuse tampered, explain absence)"; else echo "engine-fetch: $fail failure(s)"; exit 1; fi