Graph & write ledger

Loader of record

load_papers_into_neo4j.py — MERGE-based load from cited/parsed corpus + methods + reviews. Refuses review-queue-flagged papers before connecting. Requires WriteLedger + intent. Other writers: load_institutions.py, load_paperswithcode_links.py, load_code_repo_implements.py, 16_load_s2_reference_edges.py, stream_paper_loader.py, code-lane loaders under groundwork/14_*, etc.

WriteLedger

Production-critical module lives under groundwork/19_structured_provenance/write_ledger.py (experiments directory — F-08 path coupling). Advisory lock: .write_lock.json. Append-only write_ledger.jsonl. Count and field-coverage regression recorded, not always hard-blocked. syntology.ledger on fresher trees re-exports the same object for a single source.

Credential tiers (names only)

Tier	Typical env	Role
reader	`NEO4J_USER` / `NEO4J_PASSWORD` → `syntology_api_reader`	API, MCP, QC reads; no procedure execution
writer	`NEO4J_WRITE_USER` / `NEO4J_WRITE_PASSWORD` → `syntology_loader`	Loaders / harvest
admin	`NEO4J_ADMIN` (password), user `syntology_admin`	Break-glass; naming hazard F-03 / D-1
web	`syntology_web` via Aura HTTP	Worker Cypher modules

Many scripts fall back writer→reader when write env unset (F-14) — kernel candidate refuses silent fallback.

Schema discipline

Uniqueness constraints and indexes (RANGE, TEXT *_lower twins, FULLTEXT, VECTOR) are managed out-of-band; serving should assert, not create, on the request path. Label/reltype inventories for Text2Cypher must stay fresh (qc_t2c_schema.py on trees that have it).

Gaps

Lock is filesystem-local — multiple checkouts can race (F-08).
Tests under groundwork/19 can write scratch nodes to production (F-05) — never run unattended.