self-review 2026-06-26: WM cap, breakthrough floor 0.25→0.10, ISE WM exclusion, /api/neuron/state-events route

Three improvements from today's self-review:

1. ENGRAM_BREAKTHROUGH_WEIGHT 0.25→0.10
   Live data showed 524/525 WM nodes at breakthrough floor (0.25). Knowledge
   nodes promoted at 0.21 decayed to 0.147 in one call, fell below the old
   0.25 floor, and were immediately evicted for fresh breakthrough candidates.
   Natural promotion was invisible. Invariant maintained: 0.10 < all
   per-type thresholds (min=0.15 Canonical).

2. ENGRAM_WM_CAP=24 with Pass 4 (per-call) + Pass 5 (global) enforcement
   Without a cap, broad queries like 'knowledge' promote 525+ nodes
   simultaneously. WM is now bounded to 24 nodes. Algorithm: qsort on
   promoted weights, keep top-24 by cutoff, evict the rest. Global pass
   enforces cap across nodes that were promoted in prior calls and persist
   via working_memory_weight. Validated: WM promoted goes 525→24.
   Cognitive basis: Cowan (2001) WM ~4 chunks; 24 gives richer multi-topic
   context while preventing flooding.

3. ISE exclusion from WM + /api/neuron/state-events route
   InternalStateEvent nodes were reaching WM via breakthrough (5 suppression
   cycles) because their content (curiosity seed JSON with 'knowledge',
   'memory', etc.) triggered lexical seeding. ISEs are observability-only
   and must never surface in context. Fix: guard in Pass 2 clears
   suppression_count and skips to wm_weights[i]=0.0.
   Also added POST /api/neuron/state-events route to server.el (auth-exempt,
   internal endpoint). The main soul daemon posts ISEs here but the route
   was missing — all ise_post() calls were silently returning 'not found'.

Research: SYNAPSE (arXiv 2601.02744) validates spreading factor 0.8 (our
0.7), top-M WM cap design, and cosine similarity seeding. Next priority:
implement cosine similarity initial seeding from the other branch.

engram/src/server.el

@@ -206,6 +206,37 @@ fn route_health(method: String, path: String, body: String) -> String {
     "{\"status\":\"ok\",\"engine\":\"engram-runtime-native\"}"
 }
 
+// route_emit_ise — write an InternalStateEvent node from the soul daemon.
+//
+// Endpoint: POST /api/neuron/state-events
+// Body:     {"content": "<json-string>"}
+//
+// Auth: exempt (internal endpoint, soul daemon on same host, no _auth needed).
+// The soul's ise_post() sends {"content":"..."} without _auth; enforcing auth
+// here would silently drop all heartbeat/curiosity ISEs. Unauthenticated POST
+// to this endpoint is acceptable: ISE writes are observability-only, append-only,
+// and come from a trusted process on localhost.
+//
+// Salience/importance set to match engram_node_full ISE defaults used by the
+// in-process fallback path in awareness.el (salience=0.3, importance=0.3,
+// confidence=0.8, tier=Episodic). High temporal_decay_rate (1.617) — ISEs
+// are inherently transient; they should decay faster than structural knowledge.
+// (2026-06-26 self-review: added this route after discovering ise_post was
+// silently failing — the soul posts here but the endpoint didn't exist.)
+fn route_emit_ise(method: String, path: String, body: String) -> String {
+    let content: String = json_get_string(body, "content")
+    if str_eq(content, "") { return err_json("missing content") }
+    let sal: Float = 0.3
+    let imp: Float = 0.3
+    let conf: Float = 0.8
+    let id: String = engram_node_full(
+        content, "InternalStateEvent", "state-event",
+        sal, imp, conf,
+        "Episodic", "[\"internal-state\",\"InternalStateEvent\"]"
+    )
+    "{\"ok\":true,\"id\":\"" + id + "\"}"
+}
+
 // ── Auth ──────────────────────────────────────────────────────────────────────
 
 fn check_auth_ok(method: String, body: String) -> Bool {
@@ -232,6 +263,11 @@ fn handle_request(method: String, path: String, body: String) -> String {
         }
     }
 
+    // ISE posting is auth-exempt (internal soul daemon, same host, no _auth key)
+    if str_eq(method, "POST") && str_eq(clean, "/api/neuron/state-events") {
+        return route_emit_ise(method, path, body)
+    }
+
     // Auth (when ENGRAM_API_KEY is set)
     if !check_auth_ok(method, body) {
         return err_json("unauthorized")