nervous: locus and viability — the plexus stops being telemetry

INTERO (RobOntics'25) axiom 7: a variable is interoceptive only if some
subsystem can act on it. That is doctrine §13 in first-order logic, so
`unreachable()` lists inner fields with no verb and a test fails on them.

Candia-Rivera §2.1/3.1 supplies the other half: asymmetric viable ranges
and allostatic pressure, which biases before the bound is crossed rather
than after. Empty threatens, full does not.

src/core/nervous/belief.rs

@@ -270,6 +270,45 @@ impl Field {
 
 // ── The somatic contract ──────────────────────────────────────────
 
+/// Which side of the body's boundary a signal comes from.
+///
+/// INTERO (RobOntics'25, §4–5) makes this the test for interoception: a
+/// variable counts as interoceptive only when it is inside the boundary,
+/// observed, *and* some subsystem can act on it — axioms (5), (6), (7).
+/// Sensation without a reachable verb is not interoception; it is doctrine
+/// §13's defect, stated ontologically.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum Locus {
+    /// Inside. `regulator` names the verb that moves it. `None` is a state
+    /// she can feel and cannot reach — audit it, do not ship it.
+    Inner { regulator: Option<String> },
+    /// At the boundary, reporting the world. Nothing she does moves it.
+    Boundary,
+}
+
+impl Locus {
+    pub fn inner(regulator: &str) -> Self {
+        Locus::Inner {
+            regulator: Some(regulator.to_string()),
+        }
+    }
+
+    /// Inner, with no verb that reaches it. A §13 defect by construction.
+    pub fn unreachable() -> Self {
+        Locus::Inner { regulator: None }
+    }
+
+    pub fn is_inner(&self) -> bool {
+        matches!(self, Locus::Inner { .. })
+    }
+
+    /// Satisfies INTERO (7) — there is a subsystem that acts on it.
+    pub fn is_regulated(&self) -> bool {
+        matches!(self, Locus::Inner { regulator: Some(_) })
+    }
+}
+
 /// An event worth waking for. Generated at threshold crossings and
 /// source health transitions, consumed on read — each edge fires once.
 #[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
@@ -282,12 +321,28 @@ pub enum SomaticEvent {
         level: f32,
     },
     /// An expected source went silent past the health threshold.
+    ///
+    /// `locus` carries the whole difference: a boundary source going quiet
+    /// is blindness, an inner one is numbness, and they are not the same
+    /// alarm.
     SourceSilent {
         source: String,
+        locus: Locus,
         silent_for_secs: u64,
     },
     /// A previously silent source resumed reporting.
     SourceRecovered { source: String },
+    /// A viability variable is heading out of its preferred range.
+    ///
+    /// Candia-Rivera §3.1: the allostatic signal biases behaviour *before*
+    /// the violation, not after it. `eta_secs` is when the bound is crossed
+    /// at the present rate — `None` when the field is not travelling toward
+    /// one, which is a different thing from travelling slowly.
+    ViabilityThreatened {
+        field: String,
+        pressure: f32,
+        eta_secs: Option<u64>,
+    },
 }
 
 /// The contract every rung of the somatic ladder implements.