Kills the engram-clobber loop at its source. engram_save did a bare fopen("wb")
that truncates snapshot.json to 0 bytes before the 47MB write — a booting soul's
engram_load could read that empty window -> genesis -> nodes=1 -> a 63-node save
overwrote the populated file. Two guards:
1. Atomic write: serialize to <path>.tmp, fflush+fsync, rename() over target
(atomic on POSIX) — no reader ever sees a truncated/0-byte snapshot.
2. Sparse-write floor: refuse to overwrite a >200KB snapshot with one < 1/16 its
size — a partial load can never clobber a healthy graph, whatever the cause.
Validated in isolation: standalone clang harness 11/11; rebuilt the darwin soul
(scripts/build-soul-darwin.sh) and booted it on an isolated port against a golden
copy — loaded 5113 nodes and round-tripped the full 47MB snapshot, no .tmp leftover,
live ~/.neuron untouched. Adds scripts/build-soul-darwin.sh (local elb replacement).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Tim Lingo
89e45ed689