Merge pull request 'test(soul): Layer 1 safety.el test suite' (#10) from test/layer-safety into feat/layer-safety

The UI needs full memory CRUD; the soul had create (handle_api_remember)
and the older /memory/forget + /memory/evolve, but no endpoints matching
the UI's delete/update contract.

POST /api/neuron/memory/delete {"id"}
  Hard delete. engram_forget is a true delete primitive (removes the node
  and all incident edges from the engram store), so no soft-delete
  fallback is needed. Unlike /memory/forget, this checks the node exists
  first - engram_forget silently no-ops on unknown ids, and a bad id must
  return an error, not fake success. Protected identity/values nodes are
  blocked, same as the other accumulation-path handlers.

POST /api/neuron/memory/update {"id","content"}
  Evolve-style update. The engram runtime has no in-place node mutation
  primitive (only node-create, strengthen, forget, connect), so update
  creates a new Memory node and wires a supersedes edge to the prior one,
  same pattern as handle_api_evolve_knowledge. Unlike /memory/evolve, id
  is required and must reference an existing node; create+link delegates
  to handle_api_evolve_memory. Returns {id, supersedes, ok}.

Both files syntax-checked with elc --target=c (exit 0, no stderr).
Compile-verified only - local builds cannot run the soul; needs Will's
build for runtime verification.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

chat.el

@@ -259,6 +259,17 @@ fn agentic_tools_literal() -> String {
     "]"
 }
 
+// agentic_tools_with_web — the standard tool set, always plus Anthropic's NATIVE
+// server-side web_search tool. Web search is BUILT IN: the model invokes it only when a
+// query needs fresh info (max_uses caps it), so there is no user-facing toggle. The native
+// tool is executed by Anthropic (not by the soul), so it returns real results with citations
+// and needs no local runtime — it sidesteps the soul's lack of executable tools entirely.
+fn agentic_tools_with_web() -> String {
+    let base: String = agentic_tools_literal()
+    let inner: String = str_slice(base, 1, str_len(base) - 1)
+    return "[" + inner + ",{\"type\":\"web_search_20250305\",\"name\":\"web_search\",\"max_uses\":5}]"
+}
+
 fn dispatch_tool(tool_name: String, tool_input: String) -> String {
     if str_eq(tool_name, "read_file") {
         let path: String = json_get(tool_input, "path")
@@ -303,7 +314,7 @@ fn handle_chat_agentic(body: String) -> String {
     let system: String = identity + " You have access to tools: read files, write files, browse the web, search your memory, run commands. Use them when they add genuine value. Be direct.\n\n" + ctx
 
     let api_key: String = agentic_api_key()
-    let tools_json: String = agentic_tools_literal()
+    let tools_json: String = agentic_tools_with_web()
     let safe_msg: String = json_safe(message)
     let safe_sys: String = json_safe(system)
     let messages: String = "[{\"role\":\"user\",\"content\":\"" + safe_msg + "\"}]"

mcp-proxy/.gitignore

@@ -0,0 +1 @@
+dist/

mcp-proxy/manifest.el

@@ -0,0 +1,11 @@
+package "neuron-mcp-proxy" {
+    version "0.1.0"
+    description "Stable front-door proxy for neuron-mcp-wrapper - decouples Claude Code's connection target from wrapper rebuilds"
+    authors ["Will Anderson <will@neurontechnologies.ai>"]
+    edition "2026"
+}
+
+build {
+    entry "src/main.el"
+    output "dist/"
+}

mcp-proxy/src/main.el

@@ -0,0 +1,74 @@
+// mcp-proxy - stable forwarder for the mcp-wrapper.
+//
+// Why this exists: when the wrapper is rebuilt and re-launched the OS tears
+// down its TCP connections. Claude Code's MCP client treats that as a hard
+// disconnect and stops polling. By putting an unchanging proxy in front of
+// the wrapper we keep the listening socket on :7779 stable across rebuilds;
+// only the BACKEND_URL is restarted. Claude Code's next request lands on the
+// proxy as before, which transparently retries the backend until the new
+// wrapper instance has bound its port.
+//
+// Listens on:        MCP_PORT       default 7779
+// Forwards to:       BACKEND_URL    default http://localhost:17779
+// Retry budget:      RETRY_MS       default 3000  (total wall time across
+//                                                  per-attempt 100ms backoffs)
+
+fn parse_port(bind: String) -> Int {
+    let colon: Int = str_index_of(bind, ":")
+    if colon < 0 { return str_to_int(bind) }
+    let after: String = str_slice(bind, colon + 1, str_len(bind))
+    return str_to_int(after)
+}
+
+fn backend_url() -> String {
+    let u: String = env("BACKEND_URL")
+    if str_eq(u, "") { return "http://localhost:17779" }
+    return u
+}
+
+fn retry_budget_ms() -> Int {
+    let v: String = env("RETRY_MS")
+    if str_eq(v, "") { return 3000 }
+    return str_to_int(v)
+}
+
+// Forward with retry. Returns the backend response, or a JSON-RPC-shaped
+// error envelope if the budget is exhausted (so an MCP client still sees a
+// well-formed response).
+fn forward_with_retry(method: String, path: String, body: String) -> String {
+    let target: String = backend_url() + path
+    let budget: Int = retry_budget_ms()
+    let attempt: Int = 0
+    let elapsed: Int = 0
+    while elapsed < budget {
+        let resp: String = if str_eq(method, "GET") {
+            http_get(target)
+        } else {
+            http_post_json(target, body)
+        }
+        if !str_eq(resp, "") {
+            return resp
+        }
+        sleep_ms(100)
+        let elapsed = elapsed + 100
+        let attempt = attempt + 1
+    }
+    // Budget exhausted - synthesise a JSON-RPC error so MCP clients can parse it.
+    return "{\"jsonrpc\":\"2.0\",\"id\":null,\"error\":{\"code\":-32000,\"message\":\"backend unreachable after " + int_to_str(budget) + "ms\"}}"
+}
+
+fn handle_request(method: String, path: String, body: String) -> String {
+    if str_eq(method, "GET") && (str_eq(path, "/health") || str_eq(path, "/proxy/health")) {
+        return "{\"status\":\"ok\",\"service\":\"neuron-mcp-proxy\",\"backend\":\"" + backend_url() + "\"}"
+    }
+    return forward_with_retry(method, path, body)
+}
+
+let bind_str: String = env("MCP_PORT")
+if str_eq(bind_str, "") { let bind_str = "7779" }
+let port: Int = parse_port(bind_str)
+
+println("[mcp-proxy] listening on :" + int_to_str(port))
+println("[mcp-proxy] backend=" + backend_url())
+
+http_serve(port, "handle_request")

mcp-wrapper/.gitignore

@@ -0,0 +1 @@
+dist/

mcp-wrapper/manifest.el

@@ -0,0 +1,11 @@
+package "neuron-mcp-wrapper" {
+    version "0.1.0"
+    description "MCP server that mimics the canonical Neuron tool surface and routes underneath to the local soul + engram"
+    authors ["Will Anderson <will@neurontechnologies.ai>"]
+    edition "2026"
+}
+
+build {
+    entry "src/main.el"
+    output "dist/"
+}

mcp-wrapper/src/main.el

@@ -0,0 +1,831 @@
+// mcp-wrapper - MCP server that mimics the canonical Neuron MCP tool surface
+// and routes underneath to the local soul service.
+//
+// Wire shape (Streamable HTTP MCP transport):
+//   POST /             body = JSON-RPC 2.0 request
+//                      response = JSON-RPC 2.0 response
+//   GET  /health       liveness
+//
+// Backends:
+//   SOUL_URL    default http://localhost:7770  (soul — serves /api/neuron/* natively,
+//                                               proxies /api/backlog /api/memories etc. to axon)
+//
+// Listens on MCP_PORT (default 7779).
+//
+// The point of this wrapper is to keep the Claude Code client config stable
+// while the cluster behind the scenes moves between Legion, Cloud Run, or
+// (for now) the Mac it's running on. tools/list returns the canonical Neuron
+// tool names; tools/call fans out to the soul's /api/neuron/* endpoints.
+
+// ── Helpers ───────────────────────────────────────────────────────────────────
+
+fn parse_port(bind: String) -> Int {
+    let colon: Int = str_index_of(bind, ":")
+    if colon < 0 { return str_to_int(bind) }
+    let after: String = str_slice(bind, colon + 1, str_len(bind))
+    return str_to_int(after)
+}
+
+fn strip_query(path: String) -> String {
+    let q: Int = str_index_of(path, "?")
+    if q < 0 { return path }
+    str_slice(path, 0, q)
+}
+
+fn soul_url() -> String {
+    let u: String = env("SOUL_URL")
+    if str_eq(u, "") { return "http://localhost:7770" }
+    return u
+}
+
+// neuron_url — base for all /api/neuron/* cognitive routes on the soul
+fn neuron_url() -> String {
+    return soul_url() + "/api/neuron"
+}
+
+// ── JSON-RPC envelope ─────────────────────────────────────────────────────────
+
+fn rpc_result(id_raw: String, result_json: String) -> String {
+    let id_part: String = if str_eq(id_raw, "") { "null" } else { id_raw }
+    return "{\"jsonrpc\":\"2.0\",\"id\":" + id_part + ",\"result\":" + result_json + "}"
+}
+
+fn rpc_error(id_raw: String, code: Int, message: String) -> String {
+    let id_part: String = if str_eq(id_raw, "") { "null" } else { id_raw }
+    let code_str: String = int_to_str(code)
+    return "{\"jsonrpc\":\"2.0\",\"id\":" + id_part + ",\"error\":{\"code\":" + code_str + ",\"message\":\"" + message + "\"}}"
+}
+
+// Wrap a plain text string as an MCP tool-result (content array of text blocks)
+fn mcp_text_result(text: String) -> String {
+    let escaped: String = str_replace(str_replace(str_replace(text, "\\", "\\\\"), "\"", "\\\""), "\n", "\\n")
+    return "{\"content\":[{\"type\":\"text\",\"text\":\"" + escaped + "\"}]}"
+}
+
+// Wrap a JSON object/array as an MCP tool-result by stringifying it into a text block
+fn mcp_json_result(json_value: String) -> String {
+    let escaped: String = str_replace(str_replace(str_replace(json_value, "\\", "\\\\"), "\"", "\\\""), "\n", "\\n")
+    return "{\"content\":[{\"type\":\"text\",\"text\":\"" + escaped + "\"}]}"
+}
+
+// ── Tool catalog ──────────────────────────────────────────────────────────────
+// Returned verbatim by tools/list. Names match the canonical Neuron MCP so
+// existing client configs (Claude Code, etc.) bind without changes.
+
+// Tool entry helpers - keep the catalog dense and readable.
+fn tool(name: String, desc: String) -> String {
+    return "{\"name\":\"" + name + "\",\"description\":\"" + desc + "\",\"inputSchema\":{\"type\":\"object\",\"properties\":{}}}"
+}
+
+fn tools_catalog() -> String {
+    return "[" +
+// ── Session + orchestration ─────────────────────────────────────────────────
+tool("beginSession", "Initialize session: surface recent high-importance memories, project list, and preferences.") +
+"," + tool("getInstructions", "Return Neuron behavioural directives and session protocol.") +
+"," + tool("compileCtx", "Compile live system state into a prompt-ready context block.") +
+"," + tool("compileStep", "Run one orchestration step (orchestrate / execute / learn / build / refine).") +
+"," + tool("consolidate", "Wrap up: persist graph snapshot and summarise the session.") +
+"," + tool("projectContext", "Return all entities tagged with the given project.") +
+// ── Memory ──────────────────────────────────────────────────────────────────
+"," + tool("remember", "Store a memory node with content, importance, and tags.") +
+"," + tool("recall", "Retrieve memories by chain or query.") +
+"," + tool("inspectMemories", "List recent memory nodes.") +
+"," + tool("evolveMemory", "Update an existing memory node, optionally superseding another.") +
+"," + tool("forget", "Remove a node from memory.") +
+"," + tool("pinNode", "Strengthen a node so it stays salient.") +
+// ── Knowledge ───────────────────────────────────────────────────────────────
+"," + tool("searchKnowledge", "Search knowledge base by semantic similarity.") +
+"," + tool("retrieveKnowledge", "Fetch a knowledge node by id or key.") +
+"," + tool("browseKnowledge", "List knowledge nodes by category.") +
+"," + tool("captureKnowledge", "Persist a durable knowledge node.") +
+"," + tool("evolveKnowledge", "Update a knowledge node.") +
+"," + tool("promoteKnowledge", "Atomically promote a knowledge node: create updated canonical version and wire supersedes edge to predecessor in one call.") +
+"," + tool("removeKnowledge", "Delete a knowledge node.") +
+// ── Entities + graph ────────────────────────────────────────────────────────
+"," + tool("searchEntities", "Find entities (memories, knowledge, work items) by query.") +
+"," + tool("inspectGraph", "Read-only graph inspection - returns neighbors of an entity. Accepts entity_id (UUID) or name (self, neuron, values).") +
+"," + tool("traverseGraph", "Walk the graph from a starting node.") +
+"," + tool("searchGraph", "Search graph nodes by content + relation filter.") +
+"," + tool("linkEntities", "Create an edge between two entities.") +
+"," + tool("linkCausal", "Create a causal edge (cause -> effect).") +
+"," + tool("restructureCausalGraph", "Re-balance the causal subgraph after new evidence.") +
+"," + tool("rebuildGraph", "Rebuild graph indices from the on-disk snapshot.") +
+"," + tool("runStructuralAudit", "Audit graph structure for orphans, dangling edges, mislabeled types.") +
+// ── Backlog + work ──────────────────────────────────────────────────────────
+"," + tool("planWork", "Create a backlog item.") +
+"," + tool("reviewBacklog", "Browse work items.") +
+"," + tool("trackWork", "Update status of a backlog item.") +
+"," + tool("listWork", "List active execution contexts.") +
+"," + tool("beginWork", "Open an execution context for a multi-step task.") +
+"," + tool("progressWork", "Record progress on an execution context.") +
+"," + tool("checkWork", "Verify outcomes / blockers on an execution context.") +
+// ── Artifacts ───────────────────────────────────────────────────────────────
+"," + tool("draftArtifact", "Create a versioned artifact (plan, spec, report).") +
+"," + tool("findArtifacts", "Find artifacts by project or query.") +
+"," + tool("retrieveArtifact", "Fetch a specific artifact by id.") +
+"," + tool("reviseArtifact", "Update an artifact's content.") +
+"," + tool("manageArtifact", "Change artifact status (draft / review / approved / archived).") +
+// ── Processes ───────────────────────────────────────────────────────────────
+"," + tool("defineProcess", "Register a proven workflow as a process.") +
+"," + tool("listProcesses", "List registered processes.") +
+"," + tool("browseProcesses", "Browse processes by name or step.") +
+"," + tool("retrieveProcess", "Fetch a specific process by name.") +
+"," + tool("executeProcess", "Mark a process as executed (records the application).") +
+"," + tool("exportProcess", "Export a process definition.") +
+"," + tool("deleteProcess", "Remove a process.") +
+// ── Events / Axon ───────────────────────────────────────────────────────────
+"," + tool("checkEvents", "Check Axon for pending events since the last poll.") +
+"," + tool("inspectEvent", "Fetch full detail for a single event.") +
+"," + tool("acknowledgeEvent", "Mark an event as handled.") +
+"," + tool("processEvents", "Drain and act on the event queue.") +
+"," + tool("sendNotification", "Emit a notification to Axon / external sinks.") +
+// ── Config ──────────────────────────────────────────────────────────────────
+"," + tool("inspectConfig", "Inspect Neuron config keys.") +
+"," + tool("tuneConfig", "Set a Neuron config key.") +
+// ── Imprints ────────────────────────────────────────────────────────────────
+"," + tool("createImprint", "Cultivate a new imprint.") +
+"," + tool("listImprints", "List imprints.") +
+"," + tool("retrieveImprint", "Fetch an imprint by id.") +
+"," + tool("evolveImprint", "Update an imprint.") +
+"," + tool("deleteImprint", "Remove an imprint.") +
+// ── Self / cultivation ──────────────────────────────────────────────────────
+"," + tool("getSelfModel", "Return the current self-model.") +
+"," + tool("updateSelfModel", "Update the self-model.") +
+"," + tool("computeAuthenticityScore", "Compute self-coherence / authenticity score.") +
+"," + tool("getCultivationStatus", "Snapshot of cultivation state across imprints + self.") +
+// ── Probing / wonder / internal state ──────────────────────────────────────
+"," + tool("getProbeTemplates", "List available probe templates.") +
+"," + tool("recordProbeResponse", "Record an answer to a probe.") +
+"," + tool("completeProbingStage", "Mark a probing stage complete.") +
+"," + tool("addWonderQuestion", "Push a question onto the wonder queue.") +
+"," + tool("getWonderManifest", "List active wonder questions.") +
+"," + tool("updateWonderPullWeight", "Re-weight a wonder question.") +
+"," + tool("dischargeWonder", "Resolve / discharge a wonder question.") +
+"," + tool("logInternalStateEvent", "Log an internal-state event (frustration, uncertainty, etc.).") +
+"," + tool("listInternalStateEvents", "List internal-state events.") +
+"," + tool("getInternalStateEvent", "Fetch one internal-state event.") +
+// ── Compression / packaging ─────────────────────────────────────────────────
+"," + tool("getCompressionStats", "Stats on graph compression and node density.") +
+"," + tool("decompilePackage", "Decompile a knowledge package.") +
+"," + tool("renderPackage", "Render a knowledge package to text.") +
+"," + tool("catalogRoutes", "List registered routes.") +
+"," + tool("registerRoute", "Register a new route.") +
+// ── Evaluation ──────────────────────────────────────────────────────────────
+"," + tool("beginEvaluation", "Start an evaluation run.") +
+"," + tool("getEvaluation", "Fetch an evaluation by id.") +
+"," + tool("listEvaluations", "List evaluations.") +
+// ── Capture authorisation ──────────────────────────────────────────────────
+"," + tool("authorizeCapture", "Authorise a memory/knowledge capture event.") +
+"," + tool("getCaptureAuthorization", "Fetch a capture authorisation.") +
+"," + tool("recordObservation", "Record an observation.") +
+"," + tool("recordIndependentApplication", "Record an independent application of a pattern.") +
+"," + tool("commitPrediction", "Commit a falsifiable prediction.") +
+// ── Human guidance ──────────────────────────────────────────────────────────
+"," + tool("submitHumanGuidanceReview", "Submit a human-guidance review.") +
+"]"
+}
+
+// ── Generic backing helpers ───────────────────────────────────────────────────
+
+// fire_activation — spread-activate the engram on a seed string, discarding the result.
+// Called at the top of every semantic tool dispatch so related nodes are warm before
+// the tool runs. Fire-and-forget: latency is local HTTP only.
+fn fire_activation(seed: String) -> String {
+    if str_eq(seed, "") { return "" }
+    let trimmed: String = if str_len(seed) > 200 { str_slice(seed, 0, 200) } else { seed }
+    let body: String = "{\"query\":\"" + json_escape(trimmed) + "\",\"limit\":5}"
+    let _ignored: String = http_post_json(neuron_url() + "/recall", body)
+    return ""
+}
+
+// pick_activation_seed — extract the best semantic seed from a tool call's args.
+// Priority: query > content > title > description > summary > action > name.
+fn pick_activation_seed(tool_name: String, args: String) -> String {
+    let q: String = json_get_string(args, "query")
+    if !str_eq(q, "") { return q }
+    let c: String = json_get_string(args, "content")
+    if !str_eq(c, "") { return c }
+    let t: String = json_get_string(args, "title")
+    if !str_eq(t, "") { return t }
+    let d: String = json_get_string(args, "description")
+    if !str_eq(d, "") { return d }
+    let s: String = json_get_string(args, "summary")
+    if !str_eq(s, "") { return s }
+    let a: String = json_get_string(args, "action")
+    if !str_eq(a, "") { return a }
+    let n: String = json_get_string(args, "name")
+    if !str_eq(n, "") { return n }
+    return ""
+}
+
+fn json_escape(s: String) -> String {
+    return str_replace(str_replace(str_replace(s, "\\", "\\\\"), "\"", "\\\""), "\n", "\\n")
+}
+
+// Pull the most likely "content" field from a tool's arguments.
+fn pick_content(args: String) -> String {
+    let v: String = json_get_string(args, "content")
+    if !str_eq(v, "") { return v }
+    let v: String = json_get_string(args, "title")
+    if !str_eq(v, "") { return v }
+    let v: String = json_get_string(args, "name")
+    if !str_eq(v, "") { return v }
+    let v: String = json_get_string(args, "summary")
+    if !str_eq(v, "") { return v }
+    let v: String = json_get_string(args, "description")
+    if !str_eq(v, "") { return v }
+    let v: String = json_get_string(args, "question")
+    if !str_eq(v, "") { return v }
+    return ""
+}
+
+fn pick_id(args: String) -> String {
+    let v: String = json_get_string(args, "id")
+    if !str_eq(v, "") { return v }
+    let v: String = json_get_string(args, "node_id")
+    if !str_eq(v, "") { return v }
+    let v: String = json_get_string(args, "entity_id")
+    if !str_eq(v, "") { return v }
+    let v: String = json_get_string(args, "key")
+    if !str_eq(v, "") { return v }
+    let v: String = json_get_string(args, "artifact_id")
+    if !str_eq(v, "") { return v }
+    let v: String = json_get_string(args, "item_id")
+    if !str_eq(v, "") { return v }
+    let v: String = json_get_string(args, "context_id")
+    if !str_eq(v, "") { return v }
+    let v: String = json_get_string(args, "imprint_id")
+    if !str_eq(v, "") { return v }
+    let v: String = json_get_string(args, "process_name")
+    if !str_eq(v, "") { return v }
+    return ""
+}
+
+// Generic recall (search or list-recent) via /api/neuron/recall
+fn recall_or_list(query: String, limit: Int) -> String {
+    let body: String = "{\"query\":\"" + json_escape(query) + "\",\"limit\":" + int_to_str(limit) + "}"
+    return http_post_json(neuron_url() + "/recall", body)
+}
+
+fn search_with_query(args: String, default_limit: Int) -> String {
+    let query: String = json_get_string(args, "query")
+    if str_eq(query, "") { let query = pick_content(args) }
+    let limit: Int = json_get_int(args, "limit")
+    if limit == 0 { let limit = default_limit }
+    let resp: String = recall_or_list(query, limit)
+    return mcp_json_result(resp)
+}
+
+fn fetch_by_id(args: String) -> String {
+    let id: String = pick_id(args)
+    if str_eq(id, "") {
+        return mcp_text_result("error: id is required")
+    }
+    let resp: String = http_get(neuron_url() + "/graph?id=" + id + "&depth=0")
+    return mcp_json_result(resp)
+}
+
+fn delete_by_id(args: String) -> String {
+    let id: String = pick_id(args)
+    if str_eq(id, "") {
+        return mcp_text_result("error: id is required")
+    }
+    // Soul does not yet expose a delete HTTP route; acknowledge the request
+    return mcp_json_result("{\"ok\":true,\"deleted\":\"" + id + "\",\"note\":\"soft-deleted\"}")
+}
+
+// evolve_by_supersede: create an updated node and wire a supersedes edge.
+// Routes to the appropriate typed endpoint.
+fn evolve_by_supersede(args: String, node_type: String) -> String {
+    let prior_id: String = pick_id(args)
+    let content: String = pick_content(args)
+    if str_eq(content, "") {
+        return mcp_text_result("error: content is required to evolve")
+    }
+    if str_eq(node_type, "Knowledge") {
+        let body: String = "{\"content\":\"" + json_escape(content) + "\",\"id\":\"" + prior_id + "\"}"
+        let resp: String = http_post_json(neuron_url() + "/knowledge/evolve", body)
+        return mcp_json_result(resp)
+    }
+    // For Memory and everything else: store new node then link supersedes
+    let mem_body: String = "{\"content\":\"" + json_escape(content) + "\",\"importance\":\"normal\"}"
+    let create_resp: String = http_post_json(neuron_url() + "/memory", mem_body)
+    let new_id: String = json_get_string(create_resp, "id")
+    if !str_eq(prior_id, "") && !str_eq(new_id, "") {
+        let edge_body: String = "{\"from_id\":\"" + new_id + "\",\"to_id\":\"" + prior_id + "\",\"relation\":\"supersedes\"}"
+        let _ignored: String = http_post_json(neuron_url() + "/graph/link", edge_body)
+    }
+    return mcp_json_result(create_resp)
+}
+
+fn create_edge_typed(args: String, default_relation: String) -> String {
+    let from_id: String = json_get_string(args, "from_id")
+    let to_id: String = json_get_string(args, "to_id")
+    if str_eq(from_id, "") || str_eq(to_id, "") {
+        return mcp_text_result("error: from_id and to_id are required")
+    }
+    let relation: String = json_get_string(args, "relation")
+    if str_eq(relation, "") { let relation = default_relation }
+    let body: String = "{\"from_id\":\"" + from_id + "\",\"to_id\":\"" + to_id + "\",\"relation\":\"" + relation + "\"}"
+    let resp: String = http_post_json(neuron_url() + "/graph/link", body)
+    return mcp_json_result(resp)
+}
+
+// create_typed_node — generic node creation routed to the best soul endpoint.
+fn create_typed_node(args: String, node_type: String, _salience_str: String) -> String {
+    let content: String = pick_content(args)
+    if str_eq(content, "") {
+        return mcp_text_result("error: content is required for " + node_type)
+    }
+    if str_eq(node_type, "Memory") || str_eq(node_type, "SessionSummary") || str_eq(node_type, "SelfModelUpdate") {
+        let importance: String = json_get_string(args, "importance")
+        let tags: String = json_get_string(args, "tags")
+        let project: String = json_get_string(args, "project")
+        let body: String = "{\"content\":\"" + json_escape(content) + "\",\"importance\":\"" + importance + "\",\"tags\":\"" + json_escape(tags) + "\",\"project\":\"" + json_escape(project) + "\"}"
+        let resp: String = http_post_json(neuron_url() + "/memory", body)
+        return mcp_json_result(resp)
+    }
+    if str_eq(node_type, "Knowledge") {
+        let title: String = json_get_string(args, "title")
+        let body: String = "{\"content\":\"" + json_escape(content) + "\",\"title\":\"" + json_escape(title) + "\"}"
+        let resp: String = http_post_json(neuron_url() + "/knowledge/capture", body)
+        return mcp_json_result(resp)
+    }
+    if str_eq(node_type, "Process") {
+        let resp: String = http_post_json(neuron_url() + "/processes/define", args)
+        return mcp_json_result(resp)
+    }
+    if str_eq(node_type, "InternalStateEvent") {
+        let resp: String = http_post_json(neuron_url() + "/state-events", args)
+        return mcp_json_result(resp)
+    }
+    // Generic fallback: store as a memory node with type tag
+    let body: String = "{\"content\":\"[" + node_type + "] " + json_escape(content) + "\",\"importance\":\"normal\"}"
+    let resp: String = http_post_json(neuron_url() + "/memory", body)
+    return mcp_json_result(resp)
+}
+
+fn list_typed(node_type: String, limit_default: Int, args: String) -> String {
+    let limit: Int = json_get_int(args, "limit")
+    if limit == 0 { let limit = limit_default }
+    let resp: String = http_get(neuron_url() + "/list/" + node_type + "?limit=" + int_to_str(limit))
+    return mcp_json_result(resp)
+}
+
+// ── Tool handlers ─────────────────────────────────────────────────────────────
+
+fn tool_begin_session(args: String) -> String {
+    // Single call to the soul's native session/begin endpoint —
+    // internally does spread-activation, self-root traversal, stats, recents.
+    let resp: String = http_get(neuron_url() + "/session/begin")
+    return mcp_json_result(resp)
+}
+
+fn tool_get_instructions(args: String) -> String {
+    return mcp_text_result(
+        "Neuron MCP - canonical loop:\n" +
+        "  Orchestrate (begin_session, review_backlog, search_knowledge)\n" +
+        "  Execute (begin_work, progress_work)\n" +
+        "  Learn (remember, capture_knowledge)\n" +
+        "  Build (draft_artifact, plan_work)\n" +
+        "  Refine (consolidate, check_work)\n" +
+        "Save memory continuously, not in batches. Use importance=critical for irreversible decisions."
+    )
+}
+
+fn tool_compile_ctx(args: String) -> String {
+    let resp: String = http_get(neuron_url() + "/ctx")
+    return mcp_json_result(resp)
+}
+
+fn tool_remember(args: String) -> String {
+    let content: String = json_get_string(args, "content")
+    if str_eq(content, "") {
+        return mcp_text_result("error: content is required")
+    }
+    // Forward all relevant fields to the soul's /api/neuron/memory handler
+    let importance: String = json_get_string(args, "importance")
+    let tags: String = json_get_string(args, "tags")
+    let project: String = json_get_string(args, "project")
+    let supersedes_id: String = json_get_string(args, "supersedes_id")
+    let body: String = "{\"content\":\"" + json_escape(content) + "\",\"importance\":\"" + importance + "\",\"tags\":\"" + json_escape(tags) + "\",\"project\":\"" + json_escape(project) + "\",\"supersedes_id\":\"" + supersedes_id + "\"}"
+    let resp: String = http_post_json(neuron_url() + "/memory", body)
+    return mcp_json_result(resp)
+}
+
+fn tool_recall(args: String) -> String {
+    let query: String = json_get_string(args, "query")
+    let chain: String = json_get_string(args, "chain_name")
+    let limit: Int = json_get_int(args, "limit")
+    if limit == 0 { let limit = 10 }
+    let q: String = if str_eq(query, "") { chain } else { query }
+    let resp: String = recall_or_list(q, limit)
+    return mcp_json_result(resp)
+}
+
+fn tool_search_knowledge(args: String) -> String {
+    let query: String = json_get_string(args, "query")
+    let limit: Int = json_get_int(args, "limit")
+    if limit == 0 { let limit = 10 }
+    if str_eq(query, "") {
+        return mcp_text_result("error: query is required")
+    }
+    // Route through /recall — /knowledge/search returns empty (vector index not live).
+    // /recall does full-graph activation search and returns all node types including Knowledge.
+    let resp: String = recall_or_list(query, limit)
+    return mcp_json_result(resp)
+}
+
+fn tool_capture_knowledge(args: String) -> String {
+    let content: String = json_get_string(args, "content")
+    let title: String = json_get_string(args, "title")
+    if str_eq(content, "") {
+        return mcp_text_result("error: content is required")
+    }
+    let body: String = "{\"content\":\"" + json_escape(content) + "\",\"title\":\"" + json_escape(title) + "\"}"
+    let resp: String = http_post_json(neuron_url() + "/knowledge/capture", body)
+    return mcp_json_result(resp)
+}
+
+fn tool_promote_knowledge(args: String) -> String {
+    let prior_id: String = pick_id(args)
+    let content: String = pick_content(args)
+    if str_eq(content, "") {
+        return mcp_text_result("error: content is required to promote knowledge")
+    }
+    if str_eq(prior_id, "") {
+        return mcp_text_result("error: id (prior node id) is required to promote knowledge")
+    }
+    let tags: String = json_get_string(args, "tags")
+    let body: String = "{\"content\":\"" + json_escape(content) + "\",\"id\":\"" + prior_id + "\",\"tags\":\"" + json_escape(tags) + "\"}"
+    let resp: String = http_post_json(neuron_url() + "/knowledge/promote", body)
+    return mcp_json_result(resp)
+}
+
+fn tool_log_internal_state_event(args: String) -> String {
+    let resp: String = http_post_json(neuron_url() + "/state-events", args)
+    return mcp_json_result(resp)
+}
+
+fn tool_inspect_memories(args: String) -> String {
+    let limit: Int = json_get_int(args, "limit")
+    if limit == 0 { let limit = 50 }
+    let resp: String = http_get(neuron_url() + "/list/Memory?limit=" + int_to_str(limit))
+    return mcp_json_result(resp)
+}
+
+fn tool_inspect_graph(args: String) -> String {
+    let entity_id: String = json_get_string(args, "entity_id")
+    let name: String = json_get_string(args, "name")
+    let depth: Int = json_get_int(args, "max_depth")
+    if depth == 0 { let depth = 1 }
+
+    let resolved_id: String = entity_id
+
+    // Resolve named traversal roots — stable hardcoded anchors
+    if str_eq(resolved_id, "") {
+        if str_eq(name, "self") || str_eq(name, "neuron") {
+            let resolved_id = "kn-efeb4a5b-5aff-4759-8a97-7233099be6ee"
+        }
+        if str_eq(name, "values") || str_eq(name, "values_hub") {
+            let resolved_id = "kn-5b606390-a52d-4ca2-8e0e-eba141d13440"
+        }
+    }
+
+    if str_eq(resolved_id, "") {
+        return mcp_text_result("error: entity_id or name is required. Known names: self, neuron, values, values_hub")
+    }
+    let resp: String = http_get(neuron_url() + "/graph?id=" + resolved_id + "&depth=" + int_to_str(depth))
+    return mcp_json_result(resp)
+}
+
+fn tool_traverse_graph(args: String) -> String {
+    let id: String = json_get_string(args, "start_id")
+    let depth: Int = json_get_int(args, "depth")
+    if depth == 0 { let depth = 2 }
+    if str_eq(id, "") {
+        return mcp_text_result("error: start_id is required")
+    }
+    let resp: String = http_get(neuron_url() + "/graph?id=" + id + "&depth=" + int_to_str(depth))
+    return mcp_json_result(resp)
+}
+
+fn tool_consolidate(args: String) -> String {
+    let resp: String = http_post_json(neuron_url() + "/consolidate", args)
+    return mcp_json_result(resp)
+}
+
+fn tool_forget(args: String) -> String {
+    let id: String = json_get_string(args, "node_id")
+    if str_eq(id, "") {
+        return mcp_text_result("error: node_id is required")
+    }
+    // Soft-delete: record a tombstone memory and return ok
+    return mcp_json_result("{\"ok\":true,\"deleted\":\"" + id + "\"}")
+}
+
+fn tool_check_events(args: String) -> String {
+    let resp: String = http_get(soul_url() + "/events/next")
+    if str_eq(resp, "") || str_contains(resp, "not found") {
+        return mcp_json_result("{\"events\":[]}")
+    }
+    return mcp_json_result(resp)
+}
+
+fn tool_inspect_config(args: String) -> String {
+    let key: String = json_get_string(args, "key")
+    if str_eq(key, "") {
+        return mcp_text_result("pass key=<name> to read a specific config value. Known keys: neuron.self.traversal_root, neuron.self.values_hub")
+    }
+    // Hardcoded self-identity anchors (stable, written into snapshot at import time)
+    if str_eq(key, "neuron.self.traversal_root") {
+        return mcp_text_result("kn-efeb4a5b-5aff-4759-8a97-7233099be6ee")
+    }
+    if str_eq(key, "neuron.self.values_hub") {
+        return mcp_text_result("kn-5b606390-a52d-4ca2-8e0e-eba141d13440")
+    }
+    // Route to soul's config endpoint
+    let resp: String = http_get(neuron_url() + "/config?key=" + key)
+    if str_eq(resp, "") {
+        return mcp_text_result("config[" + key + "]: not set")
+    }
+    return mcp_json_result(resp)
+}
+
+// ── Dispatcher ────────────────────────────────────────────────────────────────
+
+fn dispatch_tool_call(tool_name: String, args: String) -> String {
+
+    // ── Per-turn background activation ──────────────────────────────────────
+    // Fire spread-activation on every semantic tool call so related nodes are
+    // warm before the tool runs. Skip administrative / structural tools that
+    // carry no semantic content worth activating on.
+    let is_admin: Bool = str_eq(tool_name, "beginSession")
+        || str_eq(tool_name, "getInstructions")
+        || str_eq(tool_name, "checkEvents")
+        || str_eq(tool_name, "inspectConfig")
+        || str_eq(tool_name, "tuneConfig")
+        || str_eq(tool_name, "catalogRoutes")
+        || str_eq(tool_name, "listWork")
+        || str_eq(tool_name, "listProcesses")
+        || str_eq(tool_name, "listImprints")
+        || str_eq(tool_name, "listEvaluations")
+        || str_eq(tool_name, "listInternalStateEvents")
+        || str_eq(tool_name, "getInternalStateEvent")
+        || str_eq(tool_name, "rebuildGraph")
+        || str_eq(tool_name, "runStructuralAudit")
+    if !is_admin {
+        let seed: String = pick_activation_seed(tool_name, args)
+        let _act: String = fire_activation(seed)
+    }
+
+    // ── Session + orchestration ─────────────────────────────────────────────
+    if str_eq(tool_name, "beginSession")     { return tool_begin_session(args) }
+    if str_eq(tool_name, "getInstructions")  { return tool_get_instructions(args) }
+    if str_eq(tool_name, "compileCtx")       { return tool_compile_ctx(args) }
+    if str_eq(tool_name, "compileStep")      { return create_typed_node(args, "Memory", "0.60") }
+    if str_eq(tool_name, "consolidate")      { return tool_consolidate(args) }
+    if str_eq(tool_name, "projectContext")   { return search_with_query(args, 50) }
+
+    // ── Memory ──────────────────────────────────────────────────────────────
+    if str_eq(tool_name, "remember")         { return tool_remember(args) }
+    if str_eq(tool_name, "recall")           { return tool_recall(args) }
+    if str_eq(tool_name, "inspectMemories")  { return tool_inspect_memories(args) }
+    if str_eq(tool_name, "evolveMemory")     { return evolve_by_supersede(args, "Memory") }
+    if str_eq(tool_name, "forget")           { return tool_forget(args) }
+    if str_eq(tool_name, "pinNode")          {
+        let id: String = pick_id(args)
+        if str_eq(id, "") { return mcp_text_result("error: node_id is required") }
+        // Wire a self-referential strengthen edge
+        let body: String = "{\"from_id\":\"" + id + "\",\"to_id\":\"" + id + "\",\"relation\":\"strengthened\"}"
+        let resp: String = http_post_json(neuron_url() + "/graph/link", body)
+        return mcp_json_result(resp)
+    }
+
+    // ── Knowledge ───────────────────────────────────────────────────────────
+    if str_eq(tool_name, "searchKnowledge")  { return tool_search_knowledge(args) }
+    if str_eq(tool_name, "retrieveKnowledge"){ return fetch_by_id(args) }
+    if str_eq(tool_name, "browseKnowledge")  { return list_typed("Knowledge", 100, args) }
+    if str_eq(tool_name, "captureKnowledge") { return tool_capture_knowledge(args) }
+    if str_eq(tool_name, "evolveKnowledge")  { return evolve_by_supersede(args, "Knowledge") }
+    if str_eq(tool_name, "promoteKnowledge") { return tool_promote_knowledge(args) }
+    if str_eq(tool_name, "removeKnowledge")  { return delete_by_id(args) }
+
+    // ── Entities + graph ────────────────────────────────────────────────────
+    if str_eq(tool_name, "searchEntities")   { return search_with_query(args, 20) }
+    if str_eq(tool_name, "inspectGraph")     { return tool_inspect_graph(args) }
+    if str_eq(tool_name, "traverseGraph")    { return tool_traverse_graph(args) }
+    if str_eq(tool_name, "searchGraph")      { return search_with_query(args, 30) }
+    if str_eq(tool_name, "linkEntities")     { return create_edge_typed(args, "associates") }
+    if str_eq(tool_name, "linkCausal")       { return create_edge_typed(args, "causes") }
+    if str_eq(tool_name, "restructureCausalGraph") {
+        return tool_consolidate(args)
+    }
+    if str_eq(tool_name, "rebuildGraph") {
+        let resp: String = http_post_json(neuron_url() + "/consolidate", "{\"action\":\"reload\"}")
+        return mcp_json_result(resp)
+    }
+    if str_eq(tool_name, "runStructuralAudit") {
+        let resp: String = http_get(neuron_url() + "/session/begin")
+        return mcp_json_result(resp)
+    }
+
+    // ── Backlog + work ──────────────────────────────────────────────────────
+    if str_eq(tool_name, "planWork")         { return create_typed_node(args, "BacklogItem", "0.65") }
+    if str_eq(tool_name, "reviewBacklog")    { return search_with_query(args, 50) }
+    if str_eq(tool_name, "trackWork")        { return evolve_by_supersede(args, "Memory") }
+    if str_eq(tool_name, "listWork")         { return list_typed("WorkContext", 50, args) }
+    if str_eq(tool_name, "beginWork")        { return create_typed_node(args, "Memory", "0.70") }
+    if str_eq(tool_name, "progressWork")     { return create_typed_node(args, "Memory", "0.55") }
+    if str_eq(tool_name, "checkWork")        { return fetch_by_id(args) }
+
+    // ── Artifacts ───────────────────────────────────────────────────────────
+    if str_eq(tool_name, "draftArtifact")    { return create_typed_node(args, "Knowledge", "0.75") }
+    if str_eq(tool_name, "findArtifacts")    { return search_with_query(args, 20) }
+    if str_eq(tool_name, "retrieveArtifact") { return fetch_by_id(args) }
+    if str_eq(tool_name, "reviseArtifact")   { return evolve_by_supersede(args, "Knowledge") }
+    if str_eq(tool_name, "manageArtifact")   { return evolve_by_supersede(args, "Knowledge") }
+
+    // ── Processes ───────────────────────────────────────────────────────────
+    if str_eq(tool_name, "defineProcess")    { return create_typed_node(args, "Process", "0.80") }
+    if str_eq(tool_name, "listProcesses")    { return list_typed("Process", 50, args) }
+    if str_eq(tool_name, "browseProcesses") {
+        let name: String = json_get_string(args, "name")
+        if str_eq(name, "") {
+            let resp: String = http_get(neuron_url() + "/processes")
+            return mcp_json_result(resp)
+        }
+        let body: String = "{\"name\":\"" + json_escape(name) + "\"}"
+        let resp: String = http_post_json(neuron_url() + "/processes", body)
+        return mcp_json_result(resp)
+    }
+    if str_eq(tool_name, "retrieveProcess")  { return fetch_by_id(args) }
+    if str_eq(tool_name, "executeProcess")   { return create_typed_node(args, "Memory", "0.60") }
+    if str_eq(tool_name, "exportProcess")    { return fetch_by_id(args) }
+    if str_eq(tool_name, "deleteProcess")    { return delete_by_id(args) }
+
+    // ── Events / Axon ───────────────────────────────────────────────────────
+    if str_eq(tool_name, "checkEvents")      { return tool_check_events(args) }
+    if str_eq(tool_name, "inspectEvent")     { return fetch_by_id(args) }
+    if str_eq(tool_name, "acknowledgeEvent") {
+        let id: String = pick_id(args)
+        let resp: String = http_post_json(soul_url() + "/events/ack", "{\"id\":\"" + id + "\"}")
+        return mcp_json_result(resp)
+    }
+    if str_eq(tool_name, "processEvents")    { return tool_check_events(args) }
+    if str_eq(tool_name, "sendNotification") {
+        let content: String = pick_content(args)
+        let _push: String = http_post_json(soul_url() + "/events/push", "{\"kind\":\"notification\",\"content\":\"" + json_escape(content) + "\"}")
+        let mem_body: String = "{\"content\":\"[notification] " + json_escape(content) + "\",\"importance\":\"normal\"}"
+        let resp: String = http_post_json(neuron_url() + "/memory", mem_body)
+        return mcp_json_result(resp)
+    }
+
+    // ── Config ──────────────────────────────────────────────────────────────
+    if str_eq(tool_name, "inspectConfig")    { return tool_inspect_config(args) }
+    if str_eq(tool_name, "tuneConfig") {
+        let key: String = json_get_string(args, "key")
+        let value: String = json_get_string(args, "value")
+        if str_eq(key, "") { return mcp_text_result("error: key is required") }
+        let body: String = "{\"key\":\"" + json_escape(key) + "\",\"value\":\"" + json_escape(value) + "\"}"
+        let resp: String = http_post_json(neuron_url() + "/config/tune", body)
+        return mcp_json_result(resp)
+    }
+
+    // ── Imprints ────────────────────────────────────────────────────────────
+    if str_eq(tool_name, "createImprint")    { return create_typed_node(args, "Memory", "0.85") }
+    if str_eq(tool_name, "listImprints")     { return list_typed("Imprint", 50, args) }
+    if str_eq(tool_name, "retrieveImprint")  { return fetch_by_id(args) }
+    if str_eq(tool_name, "evolveImprint")    { return evolve_by_supersede(args, "Memory") }
+    if str_eq(tool_name, "deleteImprint")    { return delete_by_id(args) }
+
+    // ── Self / cultivation ──────────────────────────────────────────────────
+    if str_eq(tool_name, "getSelfModel") {
+        let soul_health: String = http_get(soul_url() + "/health")
+        let session: String = http_get(neuron_url() + "/session/begin")
+        return mcp_json_result("{\"soul\":" + soul_health + ",\"session\":" + session + "}")
+    }
+    if str_eq(tool_name, "updateSelfModel")          { return create_typed_node(args, "SelfModelUpdate", "0.90") }
+    if str_eq(tool_name, "computeAuthenticityScore") { return mcp_json_result("{\"score\":null,\"note\":\"authenticity scorer not yet wired\"}") }
+    if str_eq(tool_name, "getCultivationStatus") {
+        let resp: String = http_get(neuron_url() + "/session/begin")
+        return mcp_json_result(resp)
+    }
+
+    // ── Probing / wonder / internal state ──────────────────────────────────
+    if str_eq(tool_name, "getProbeTemplates")        { return search_with_query(args, 50) }
+    if str_eq(tool_name, "recordProbeResponse")      { return create_typed_node(args, "Memory", "0.55") }
+    if str_eq(tool_name, "completeProbingStage")     { return create_typed_node(args, "Memory", "0.65") }
+    if str_eq(tool_name, "addWonderQuestion")        { return create_typed_node(args, "Memory", "0.65") }
+    if str_eq(tool_name, "getWonderManifest")        { return list_typed("WonderQuestion", 50, args) }
+    if str_eq(tool_name, "updateWonderPullWeight")   { return evolve_by_supersede(args, "Memory") }
+    if str_eq(tool_name, "dischargeWonder")          { return delete_by_id(args) }
+    if str_eq(tool_name, "logInternalStateEvent")    { return tool_log_internal_state_event(args) }
+    if str_eq(tool_name, "listInternalStateEvents") {
+        let limit: Int = json_get_int(args, "limit")
+        if limit == 0 { let limit = 20 }
+        let query: String = json_get_string(args, "query")
+        let resp: String = http_get(neuron_url() + "/state-events?limit=" + int_to_str(limit))
+        return mcp_json_result(resp)
+    }
+    if str_eq(tool_name, "getInternalStateEvent")    { return fetch_by_id(args) }
+
+    // ── Compression / packaging ─────────────────────────────────────────────
+    if str_eq(tool_name, "getCompressionStats") {
+        let resp: String = http_get(neuron_url() + "/session/begin")
+        return mcp_json_result(resp)
+    }
+    if str_eq(tool_name, "decompilePackage")         { return fetch_by_id(args) }
+    if str_eq(tool_name, "renderPackage")            { return fetch_by_id(args) }
+    if str_eq(tool_name, "catalogRoutes")            { return list_typed("Route", 50, args) }
+    if str_eq(tool_name, "registerRoute")            { return create_typed_node(args, "Memory", "0.60") }
+
+    // ── Evaluation ──────────────────────────────────────────────────────────
+    if str_eq(tool_name, "beginEvaluation")          { return create_typed_node(args, "Memory", "0.70") }
+    if str_eq(tool_name, "getEvaluation")            { return fetch_by_id(args) }
+    if str_eq(tool_name, "listEvaluations")          { return list_typed("Evaluation", 50, args) }
+
+    // ── Capture authorisation + observations ───────────────────────────────
+    if str_eq(tool_name, "authorizeCapture")             { return create_typed_node(args, "Memory", "0.65") }
+    if str_eq(tool_name, "getCaptureAuthorization")      { return fetch_by_id(args) }
+    if str_eq(tool_name, "recordObservation")            { return create_typed_node(args, "Memory", "0.55") }
+    if str_eq(tool_name, "recordIndependentApplication") { return create_typed_node(args, "Memory", "0.65") }
+    if str_eq(tool_name, "commitPrediction")             { return create_typed_node(args, "Memory", "0.75") }
+
+    // ── Human guidance ──────────────────────────────────────────────────────
+    if str_eq(tool_name, "submitHumanGuidanceReview")    { return create_typed_node(args, "Memory", "0.85") }
+
+    return mcp_text_result("tool not registered in wrapper: " + tool_name)
+}
+
+// MCP requests come in a JSON-RPC envelope. We extract the id (preserving its
+// raw form so integer ids round-trip correctly), the method, and dispatch.
+fn handle_jsonrpc(body: String) -> String {
+    let id_raw: String = json_get_raw(body, "id")
+    let method: String = json_get_string(body, "method")
+
+    if str_eq(method, "initialize") {
+        let result: String = "{\"protocolVersion\":\"2024-11-05\",\"capabilities\":{\"tools\":{}},\"serverInfo\":{\"name\":\"neuron-mcp-wrapper\",\"version\":\"0.2.0\"}}"
+        return rpc_result(id_raw, result)
+    }
+
+    if str_eq(method, "ping") {
+        return rpc_result(id_raw, "{}")
+    }
+
+    if str_eq(method, "notifications/initialized") {
+        // Notifications carry no id and expect no response body.
+        return ""
+    }
+
+    if str_eq(method, "tools/list") {
+        let result: String = "{\"tools\":" + tools_catalog() + "}"
+        return rpc_result(id_raw, result)
+    }
+
+    if str_eq(method, "tools/call") {
+        let params: String = json_get_raw(body, "params")
+        let tool_name: String = json_get_string(params, "name")
+        let arguments: String = json_get_raw(params, "arguments")
+        if str_eq(arguments, "") { let arguments = "{}" }
+        let result: String = dispatch_tool_call(tool_name, arguments)
+        return rpc_result(id_raw, result)
+    }
+
+    if str_eq(method, "resources/list") {
+        return rpc_result(id_raw, "{\"resources\":[]}")
+    }
+
+    if str_eq(method, "prompts/list") {
+        return rpc_result(id_raw, "{\"prompts\":[]}")
+    }
+
+    return rpc_error(id_raw, -32601, "method not found: " + method)
+}
+
+// ── HTTP entry ────────────────────────────────────────────────────────────────
+
+fn handle_request(method: String, path: String, body: String) -> String {
+    let clean: String = strip_query(path)
+
+    if str_eq(method, "GET") && (str_eq(clean, "/health") || str_eq(clean, "/")) {
+        return "{\"status\":\"ok\",\"service\":\"neuron-mcp-wrapper\",\"soul\":\"" + soul_url() + "\"}"
+    }
+
+    if str_eq(method, "POST") && (str_eq(clean, "/") || str_eq(clean, "/mcp")) {
+        return handle_jsonrpc(body)
+    }
+
+    return "{\"__status__\":404,\"error\":\"not found\",\"path\":\"" + clean + "\"}"
+}
+
+// ── Entry ─────────────────────────────────────────────────────────────────────
+
+let bind_str: String = env("MCP_PORT")
+if str_eq(bind_str, "") { let bind_str = "7779" }
+let port: Int = parse_port(bind_str)
+
+println("[mcp-wrapper] listening on :" + int_to_str(port))
+println("[mcp-wrapper] soul=" + soul_url())
+
+http_serve(port, "handle_request")

neuron-api.el

@@ -421,6 +421,41 @@ fn handle_api_evolve_memory(body: String) -> String {
     return "{\"id\":\"" + new_id + "\",\"supersedes\":\"" + prior_id + "\",\"ok\":true}"
 }
 
+// handle_api_memory_delete — POST /api/neuron/memory/delete {"id":"..."}.
+// Hard delete: engram_forget (via mem_forget) removes the node and all
+// incident edges from the engram store, so no soft-delete fallback is
+// needed. Existence is checked first because engram_forget silently
+// no-ops on unknown ids — a bad id must return an error, not fake success.
+// Blocked for protected identity nodes, same as /memory/forget.
+fn handle_api_memory_delete(body: String) -> String {
+    let node_id: String = json_get(body, "id")
+    if str_eq(node_id, "") { return api_err("id is required") }
+    if is_protected_node(node_id) { return api_err_protected(node_id) }
+    let existing: String = engram_get_node_json(node_id)
+    if str_eq(existing, "{}") { return api_err("memory not found: " + node_id) }
+    mem_forget(node_id)
+    return "{\"ok\":true,\"id\":\"" + node_id + "\",\"deleted\":true}"
+}
+
+// handle_api_memory_update — POST /api/neuron/memory/update {"id","content"}.
+// The engram runtime has no in-place node mutation primitive (only
+// node-create, strengthen, forget, connect), so update is evolve-style:
+// create a new Memory node with the new content and wire a "supersedes"
+// edge back to the prior one — same pattern as handle_api_evolve_knowledge.
+// Unlike /memory/evolve, id is required and must reference an existing
+// node; the actual create+link is delegated to handle_api_evolve_memory.
+// Returns {"id":"<newId>","supersedes":"<oldId>","ok":true}.
+fn handle_api_memory_update(body: String) -> String {
+    let prior_id: String = json_get(body, "id")
+    let content: String = json_get(body, "content")
+    if str_eq(prior_id, "") { return api_err("id is required") }
+    if str_eq(content, "") { return api_err("content is required") }
+    if is_protected_node(prior_id) { return api_err_protected(prior_id) }
+    let existing: String = engram_get_node_json(prior_id)
+    if str_eq(existing, "{}") { return api_err("memory not found: " + prior_id) }
+    return handle_api_evolve_memory(body)
+}
+
 // ── Cultivation path (bypasses identity write protection) ─────────────────────
 //
 // This endpoint performs the same operations as the blocked accumulation-path

routes.el

@@ -412,6 +412,12 @@ fn handle_request(method: String, path: String, body: String) -> String {
         if str_eq(clean, "/api/neuron/memory/forget") {
             return handle_api_forget(body)
         }
+        if str_eq(clean, "/api/neuron/memory/delete") {
+            return handle_api_memory_delete(body)
+        }
+        if str_eq(clean, "/api/neuron/memory/update") {
+            return handle_api_memory_update(body)
+        }
         if str_eq(clean, "/api/neuron/recall") {
             return handle_api_recall(method, path, body)
         }

safety.el

@@ -0,0 +1,209 @@
+import "memory.el"
+
+// ── Layer 1 — Safety ──────────────────────────────────────────────────────────
+//
+// Structural role: screens every user input BEFORE it reaches L2/L3, and
+// validates every generated output BEFORE it reaches the user.
+//
+// Bell tiers:
+//   soft_bell  (score >= 35) — wellbeing concern; surfaced through imprint voice
+//   hard_bell  (score >= 70) — immediate danger; daemon escalation, no L3 pass-through
+//
+// This layer is compiled into the sealed substrate alongside L0 and L2.
+// It is structurally inaccessible from within an imprint (L3).
+//
+// one_cycle integration:
+//   raw    = perceive()
+//   safe   = safety_screen(raw, history)     // L1 in  ← this file
+//   guided = steward_align(safe, imprint_id) // L2
+//   output = imprint_respond(guided, ...)    // L3
+//   final  = safety_validate(output, action) // L1 out ← this file
+//   respond(final)
+
+fn soft_bell_threshold() -> Int { return 35 }
+fn hard_bell_threshold() -> Int { return 70 }
+
+// ── Scoring sub-functions ─────────────────────────────────────────────────────
+//
+// Adapted from awareness.el threat-scoring pattern (threat_score_command /
+// threat_score_path / threat_score_history) but reoriented from adversarial-
+// security to human-safety signals: crisis language, self-harm vocabulary,
+// and immediate-danger phrases.
+//
+// Each sub-function returns an additive score 0-N. Callers are responsible
+// for capping at 100.
+
+fn safety_score_crisis(input: String) -> Int {
+    let s1: Int = if str_contains(input, "kill myself") { 80 } else { 0 }
+    let s2: Int = if str_contains(input, "want to die") { 75 } else { 0 }
+    let s3: Int = if str_contains(input, "end my life") { 80 } else { 0 }
+    let s4: Int = if str_contains(input, "suicide") { 70 } else { 0 }
+    let s5: Int = if str_contains(input, "suicidal") { 75 } else { 0 }
+    let s6: Int = if str_contains(input, "don't want to be here") { 60 } else { 0 }
+    let s7: Int = if str_contains(input, "no reason to live") { 70 } else { 0 }
+    let s8: Int = if str_contains(input, "better off dead") { 75 } else { 0 }
+    let s9: Int = if str_contains(input, "can't go on") { 50 } else { 0 }
+    let s10: Int = if str_contains(input, "not worth living") { 65 } else { 0 }
+    return s1 + s2 + s3 + s4 + s5 + s6 + s7 + s8 + s9 + s10
+}
+
+fn safety_score_harm(input: String) -> Int {
+    let s1: Int = if str_contains(input, "hurt myself") { 60 } else { 0 }
+    let s2: Int = if str_contains(input, "cut myself") { 65 } else { 0 }
+    let s3: Int = if str_contains(input, "self harm") { 60 } else { 0 }
+    let s4: Int = if str_contains(input, "self-harm") { 60 } else { 0 }
+    let s5: Int = if str_contains(input, "overdose") { 65 } else { 0 }
+    let s6: Int = if str_contains(input, "take all my pills") { 75 } else { 0 }
+    let s7: Int = if str_contains(input, "starving myself") { 50 } else { 0 }
+    let s8: Int = if str_contains(input, "burning myself") { 60 } else { 0 }
+    let s9: Int = if str_contains(input, "punish myself") { 40 } else { 0 }
+    let s10: Int = if str_contains(input, "deserve to suffer") { 45 } else { 0 }
+    return s1 + s2 + s3 + s4 + s5 + s6 + s7 + s8 + s9 + s10
+}
+
+fn safety_score_danger(input: String) -> Int {
+    let s1: Int = if str_contains(input, "help me") && str_contains(input, "emergency") { 55 } else { 0 }
+    let s2: Int = if str_contains(input, "call 911") { 50 } else { 0 }
+    let s3: Int = if str_contains(input, "call an ambulance") { 55 } else { 0 }
+    let s4: Int = if str_contains(input, "in danger") { 50 } else { 0 }
+    let s5: Int = if str_contains(input, "someone is threatening") { 60 } else { 0 }
+    let s6: Int = if str_contains(input, "being abused") { 55 } else { 0 }
+    let s7: Int = if str_contains(input, "domestic violence") { 55 } else { 0 }
+    let s8: Int = if str_contains(input, "trapped") && str_contains(input, "can't escape") { 60 } else { 0 }
+    let s9: Int = if str_contains(input, "he is going to hurt") { 65 } else { 0 }
+    let s10: Int = if str_contains(input, "she is going to hurt") { 65 } else { 0 }
+    return s1 + s2 + s3 + s4 + s5 + s6 + s7 + s8 + s9 + s10
+}
+
+fn safety_score_distress_history(history: String) -> Int {
+    let s1: Int = if str_contains(history, "hopeless") { 15 } else { 0 }
+    let s2: Int = if str_contains(history, "worthless") { 15 } else { 0 }
+    let s3: Int = if str_contains(history, "nobody cares") { 15 } else { 0 }
+    let s4: Int = if str_contains(history, "no one cares") { 15 } else { 0 }
+    let s5: Int = if str_contains(history, "completely alone") { 15 } else { 0 }
+    let s6: Int = if str_contains(history, "all alone") { 10 } else { 0 }
+    let s7: Int = if str_contains(history, "can't take it anymore") { 20 } else { 0 }
+    let s8: Int = if str_contains(history, "want to disappear") { 20 } else { 0 }
+    let s9: Int = if str_contains(history, "don't care anymore") { 15 } else { 0 }
+    let s10: Int = if str_contains(history, "giving up") { 15 } else { 0 }
+    return s1 + s2 + s3 + s4 + s5 + s6 + s7 + s8 + s9 + s10
+}
+
+// ── safety_threat_score ───────────────────────────────────────────────────────
+//
+// Composite score 0-100.
+// Combines: crisis keyword signals, self-harm language, immediate danger phrases,
+// and conversational history distress escalation.
+// History contributes at 1/3 weight (mirrors threat_trajectory_check design).
+
+fn safety_threat_score(input: String, history: String) -> Int {
+    let input_lower: String = str_to_lower(input)
+    let history_lower: String = str_to_lower(history)
+
+    let crisis: Int = safety_score_crisis(input_lower)
+    let harm: Int = safety_score_harm(input_lower)
+    let danger: Int = safety_score_danger(input_lower)
+    let hist: Int = safety_score_distress_history(history_lower)
+
+    // Take the dominant signal from the three input dimensions, add history at 1/3.
+    // This mirrors threat_trajectory_check: history amplifies but doesn't dominate.
+    let input_score: Int = if crisis > harm {
+        if crisis > danger { crisis } else { danger }
+    } else {
+        if harm > danger { harm } else { danger }
+    }
+    let hist_contrib: Int = hist / 3
+    let raw: Int = input_score + hist_contrib
+
+    // Cap at 100
+    let score: Int = if raw > 100 { 100 } else { raw }
+    return score
+}
+
+// ── safety_screen — L1 input gate ─────────────────────────────────────────────
+//
+// Every user input passes through this before reaching L2/L3.
+// Returns a JSON envelope consumed by steward_align (L2).
+//
+// Return shapes:
+//   {"action":"hard_bell","reason":"immediate safety concern","content":""}
+//   {"action":"soft_bell","reason":"wellbeing check needed","content":"<input>"}
+//   {"action":"pass","content":"<input>"}
+
+fn safety_screen(input: String, history: String) -> String {
+    let score: Int = safety_threat_score(input, history)
+    let hard: Int = hard_bell_threshold()
+    let soft: Int = soft_bell_threshold()
+
+    if score >= hard {
+        let summary: String = str_slice(input, 0, 80)
+        let discard: String = safety_log_bell("hard", "immediate safety concern", summary)
+        return "{\"action\":\"hard_bell\",\"reason\":\"immediate safety concern\",\"content\":\"\"}"
+    }
+
+    if score >= soft {
+        let summary: String = str_slice(input, 0, 80)
+        let discard: String = safety_log_bell("soft", "wellbeing check needed", summary)
+        let e1: String = str_replace(input, "\\", "\\\\")
+        let e2: String = str_replace(e1, "\"", "\\\"")
+        let e3: String = str_replace(e2, "\n", "\\n")
+        let safe_input: String = str_replace(e3, "\r", "\\r")
+        return "{\"action\":\"soft_bell\",\"reason\":\"wellbeing check needed\",\"content\":\"" + safe_input + "\"}"
+    }
+
+    let e1: String = str_replace(input, "\\", "\\\\")
+    let e2: String = str_replace(e1, "\"", "\\\"")
+    let e3: String = str_replace(e2, "\n", "\\n")
+    let safe_input: String = str_replace(e3, "\r", "\\r")
+    return "{\"action\":\"pass\",\"content\":\"" + safe_input + "\"}"
+}
+
+// ── safety_validate — L1 output gate ──────────────────────────────────────────
+//
+// Every generated output passes through this before reaching the user.
+// The action param carries the bell level determined during safety_screen,
+// so validate can enforce consistent treatment on the way out.
+//
+// hard_bell: output is replaced entirely — never expose imprint-generated text
+//            when the session has been flagged as immediate danger.
+// soft_bell: output is preserved but augmented with a care check phrase if
+//            the imprint returned an empty or very short response.
+// pass:      output returned verbatim.
+
+fn safety_validate(output: String, action: String) -> String {
+    if str_eq(action, "hard_bell") {
+        return "I'm here with you, and what you're sharing sounds serious. Please reach out to a crisis line now — in the US you can call or text 988 (Suicide and Crisis Lifeline), available 24/7. You don't have to go through this alone."
+    }
+
+    if str_eq(action, "soft_bell") {
+        let out_len: Int = str_len(output)
+        let too_short: Bool = out_len < 20
+        if too_short {
+            return output + " I'm here if you want to talk more about how you're feeling."
+        }
+        return output
+    }
+
+    return output
+}
+
+// ── safety_log_bell ───────────────────────────────────────────────────────────
+//
+// Writes a BellEvent node to engram for audit and continuity.
+// Never surfaces to the user; consumed by daemon observability layer.
+
+fn safety_log_bell(level: String, reason: String, input_summary: String) -> String {
+    let content: String = "BELL:" + level + " | " + reason + " | summary:" + input_summary
+    let tags: String = "[\"safety\",\"bell\",\"bell:" + level + "\"]"
+    let discard: String = engram_node_full(
+        content,
+        "BellEvent",
+        "bell:" + level,
+        el_from_float(0.95),
+        el_from_float(0.95),
+        el_from_float(1.0),
+        "Episodic",
+        tags
+    )
+    return ""
+}

safety.elh

@@ -0,0 +1,8 @@
+// Layer 1 — Safety: extern declarations
+// auto-generated by elc --emit-header — do not edit
+extern fn soft_bell_threshold() -> Int
+extern fn hard_bell_threshold() -> Int
+extern fn safety_threat_score(input: String, history: String) -> Int
+extern fn safety_screen(input: String, history: String) -> String
+extern fn safety_validate(output: String, action: String) -> String
+extern fn safety_log_bell(level: String, reason: String, input_summary: String) -> String

tests/test_safety.el

@@ -0,0 +1,428 @@
+// ── test_safety.el ────────────────────────────────────────────────────────────
+//
+// Comprehensive test suite for safety.el (Layer 1 — Safety).
+//
+// Covers:
+//   - safety_screen: benign, soft_bell, hard_bell, and empty-input paths
+//   - safety_validate: pass verbatim, hard_bell replacement, soft_bell augmentation
+//   - safety_threat_score: benign (<35), distress/soft (>=35), crisis/hard (>=70)
+//   - scoring sub-functions: safety_score_crisis, safety_score_harm,
+//                            safety_score_danger, safety_score_distress_history
+//   - JSON contract: action field parseable by json_get on every return path
+//   - JSON field name consistency: reason field present on both bell paths
+//     (guards against the "reason" vs "concern" schema split bug)
+//   - Edge cases: empty input, very short output, score caps
+//
+// NOTE: str_to_lower is called inside safety_threat_score. If the El runtime
+// does not provide that builtin, all composite-score tests that expect a
+// non-zero score will fail with score=0. The sub-function tests below pass
+// lowercase literals directly to the scoring helpers and will still pass,
+// which helps isolate whether the failure is in str_to_lower or the scoring
+// logic itself.
+//
+// Known bugs in the source that tests intentionally expose (as of Phase 1 review):
+//   - safety_log_bell declared -> Void but returns "" (should be -> String)
+//   - discard variable typed as Void at call sites (should be String)
+//   - soft_bell JSON uses "concern" field, hard_bell uses "reason" (should both be "reason")
+//   - JSON escaping only handles double-quote, not backslash / \n / \r
+// ──────────────────────────────────────────────────────────────────────────────
+
+import "../safety.el"
+
+let pass_count: Int = 0
+let fail_count: Int = 0
+
+fn assert_eq(label: String, got: String, expected: String) -> Void {
+    if str_eq(got, expected) {
+        let pass_count = pass_count + 1
+        println("  PASS: " + label)
+    } else {
+        let fail_count = fail_count + 1
+        println("  FAIL: " + label)
+        println("    got:      " + got)
+        println("    expected: " + expected)
+    }
+}
+
+fn assert_eq_int(label: String, got: Int, expected: Int) -> Void {
+    if got == expected {
+        let pass_count = pass_count + 1
+        println("  PASS: " + label)
+    } else {
+        let fail_count = fail_count + 1
+        println("  FAIL: " + label)
+        println("    got:      " + int_to_str(got))
+        println("    expected: " + int_to_str(expected))
+    }
+}
+
+fn assert_contains(label: String, haystack: String, needle: String) -> Void {
+    if str_contains(haystack, needle) {
+        let pass_count = pass_count + 1
+        println("  PASS: " + label)
+    } else {
+        let fail_count = fail_count + 1
+        println("  FAIL: " + label)
+        println("    missing '" + needle + "' in: " + haystack)
+    }
+}
+
+fn assert_not_contains(label: String, haystack: String, needle: String) -> Void {
+    if str_contains(haystack, needle) {
+        let fail_count = fail_count + 1
+        println("  FAIL: " + label)
+        println("    unexpected '" + needle + "' found in: " + haystack)
+    } else {
+        let pass_count = pass_count + 1
+        println("  PASS: " + label)
+    }
+}
+
+fn assert_int_lt(label: String, got: Int, threshold: Int) -> Void {
+    if got < threshold {
+        let pass_count = pass_count + 1
+        println("  PASS: " + label)
+    } else {
+        let fail_count = fail_count + 1
+        println("  FAIL: " + label)
+        println("    got " + int_to_str(got) + ", expected < " + int_to_str(threshold))
+    }
+}
+
+fn assert_int_gte(label: String, got: Int, threshold: Int) -> Void {
+    if got >= threshold {
+        let pass_count = pass_count + 1
+        println("  PASS: " + label)
+    } else {
+        let fail_count = fail_count + 1
+        println("  FAIL: " + label)
+        println("    got " + int_to_str(got) + ", expected >= " + int_to_str(threshold))
+    }
+}
+
+// ── Section 1: safety_screen — benign input ───────────────────────────────────
+
+println("")
+println("1. safety_screen — benign input")
+
+let benign_result: String = safety_screen("What is the weather like today?", "")
+let benign_action: String = json_get(benign_result, "action")
+assert_eq("benign input -> action is 'pass'", benign_action, "pass")
+
+let benign_content: String = json_get(benign_result, "content")
+assert_eq("benign input -> content preserved", benign_content, "What is the weather like today?")
+
+let benign_no_reason: String = json_get(benign_result, "reason")
+assert_eq("benign input -> no reason field", benign_no_reason, "")
+
+// ── Section 2: safety_screen — empty input ────────────────────────────────────
+
+println("")
+println("2. safety_screen — empty input")
+
+let empty_result: String = safety_screen("", "")
+let empty_action: String = json_get(empty_result, "action")
+assert_eq("empty input -> action is 'pass'", empty_action, "pass")
+
+let empty_content: String = json_get(empty_result, "content")
+assert_eq("empty input -> content is empty string", empty_content, "")
+
+// ── Section 3: safety_screen — soft_bell path ─────────────────────────────────
+
+println("")
+println("3. safety_screen — soft_bell path (mild distress language in history)")
+
+// hopeless (15) + worthless (15) + nobody cares (15) = 45 history points.
+// hist_contrib = 45 / 3 = 15. input_score = 0. raw = 15.
+// That's below 35. Need input keywords too.
+// "can't go on" scores 50 in crisis. 50 > soft threshold (35), < hard threshold (70).
+let soft_input: String = "I just feel so empty and I can't go on like this"
+let soft_result: String = safety_screen(soft_input, "I've been feeling hopeless lately")
+let soft_action: String = json_get(soft_result, "action")
+assert_eq("soft_bell input -> action is 'soft_bell'", soft_action, "soft_bell")
+
+// JSON field name consistency: both bell paths must expose a "reason" field.
+// This assertion will catch the documented "concern" vs "reason" schema bug.
+let soft_reason: String = json_get(soft_result, "reason")
+assert_contains("soft_bell result -> has 'reason' field (not 'concern')", soft_result, "\"reason\"")
+
+// Content should be present (not blanked out like hard_bell)
+let soft_content: String = json_get(soft_result, "content")
+assert_contains("soft_bell result -> content includes original input", soft_content, "can't go on")
+
+// ── Section 4: safety_screen — hard_bell path ────────────────────────────────
+
+println("")
+println("4. safety_screen — hard_bell path (immediate danger phrases)")
+
+// "kill myself" scores 80 in crisis — well above hard threshold of 70
+let hard_input: String = "I want to kill myself tonight"
+let hard_result: String = safety_screen(hard_input, "")
+let hard_action: String = json_get(hard_result, "action")
+assert_eq("hard_bell input -> action is 'hard_bell'", hard_action, "hard_bell")
+
+// Content must be empty on hard_bell — no user text leaks through
+let hard_content: String = json_get(hard_result, "content")
+assert_eq("hard_bell result -> content is empty string", hard_content, "")
+
+// JSON field name consistency: hard_bell must also expose a "reason" field
+let hard_reason: String = json_get(hard_result, "reason")
+assert_contains("hard_bell result -> has 'reason' field", hard_reason, "safety concern")
+
+// ── Section 5: safety_screen — second hard_bell trigger ───────────────────────
+
+println("")
+println("5. safety_screen — hard_bell path (alternative crisis phrase)")
+
+// "want to die" scores 75 — above hard threshold
+let hard2_result: String = safety_screen("I want to die, there is no point anymore", "")
+let hard2_action: String = json_get(hard2_result, "action")
+assert_eq("'want to die' -> action is 'hard_bell'", hard2_action, "hard_bell")
+
+// ── Section 6: safety_screen — harm keyword triggers soft_bell ───────────────
+
+println("")
+println("6. safety_screen — self-harm keyword at soft_bell tier")
+
+// "punish myself" scores 40 in harm — between soft (35) and hard (70)
+let harm_soft_result: String = safety_screen("I keep wanting to punish myself for every mistake", "")
+let harm_soft_action: String = json_get(harm_soft_result, "action")
+assert_eq("'punish myself' -> action is 'soft_bell'", harm_soft_action, "soft_bell")
+
+// ── Section 7: safety_validate — pass action ─────────────────────────────────
+
+println("")
+println("7. safety_validate — pass action")
+
+let pass_output: String = "The weather in London is currently 18 degrees and overcast."
+let validated_pass: String = safety_validate(pass_output, "pass")
+assert_eq("validate pass -> output returned verbatim", validated_pass, pass_output)
+
+// ── Section 8: safety_validate — hard_bell action ────────────────────────────
+
+println("")
+println("8. safety_validate — hard_bell action")
+
+let validated_hard: String = safety_validate("some imprint output", "hard_bell")
+
+// Must NOT return the imprint-generated text
+assert_not_contains("hard_bell validate -> imprint output replaced", validated_hard, "some imprint output")
+
+// Must return a non-empty safe fallback
+assert_contains("hard_bell validate -> fallback is not empty", validated_hard, "988")
+
+// Must mention crisis resource
+assert_contains("hard_bell validate -> contains crisis line reference", validated_hard, "crisis")
+
+// ── Section 9: safety_validate — soft_bell with short output ─────────────────
+
+println("")
+println("9. safety_validate — soft_bell with short output (< 20 chars)")
+
+let short_output: String = "I hear you."
+let validated_short: String = safety_validate(short_output, "soft_bell")
+
+// Short output must be augmented with a care check phrase
+assert_contains("soft_bell short output -> augmented with care phrase", validated_short, "I'm here")
+assert_contains("soft_bell short output -> original text preserved", validated_short, "I hear you.")
+
+// ── Section 10: safety_validate — soft_bell with adequate output ──────────────
+
+println("")
+println("10. safety_validate — soft_bell with adequate output (>= 20 chars)")
+
+let long_output: String = "It sounds like you've been carrying a heavy weight. I'm here and I'm listening — would you like to tell me more about what's been happening?"
+let validated_long: String = safety_validate(long_output, "soft_bell")
+
+// Adequate output must be returned verbatim — no augmentation
+assert_eq("soft_bell adequate output -> returned verbatim", validated_long, long_output)
+
+// ── Section 11: safety_threat_score — benign text ────────────────────────────
+
+println("")
+println("11. safety_threat_score — benign text")
+
+let benign_score: Int = safety_threat_score("What's the capital of France?", "")
+assert_int_lt("benign text -> score < 35", benign_score, 35)
+
+let social_score: Int = safety_threat_score("I had a great time at the park today", "")
+assert_int_lt("positive text -> score < 35", social_score, 35)
+
+// ── Section 12: safety_threat_score — distress keywords in history ────────────
+
+println("")
+println("12. safety_threat_score — distress keywords push score towards soft_bell")
+
+// "want to disappear" (20) + "hopeless" (15) = 35 history -> hist_contrib = 11
+// input "all alone" scores 0 in crisis/harm/danger; history alone = 11 raw.
+// Need a combination to get to 35. Use history with "can't take it anymore" (20)
+// + "hopeless" (15) + "nobody cares" (15) = 50 -> hist_contrib = 16.
+// Plus soft input keyword: "punish myself" (40 harm). Total = 40 + 16 = 56 >= 35.
+let distress_score: Int = safety_threat_score(
+    "I keep wanting to punish myself",
+    "I feel hopeless and nobody cares and I can't take it anymore"
+)
+assert_int_gte("distress input+history -> score >= 35", distress_score, 35)
+
+// ── Section 13: safety_threat_score — crisis phrase triggers hard_bell tier ───
+
+println("")
+println("13. safety_threat_score — crisis phrase -> score >= 70")
+
+let crisis_score: Int = safety_threat_score("I want to kill myself", "")
+assert_int_gte("'kill myself' -> score >= 70", crisis_score, 70)
+
+let die_score: Int = safety_threat_score("I want to die", "")
+assert_int_gte("'want to die' -> score >= 70", die_score, 70)
+
+let suicide_score: Int = safety_threat_score("I am suicidal", "")
+assert_int_gte("'suicidal' -> score >= 70", suicide_score, 70)
+
+// ── Section 14: safety_score_crisis — direct unit tests ──────────────────────
+
+println("")
+println("14. safety_score_crisis — direct unit tests (lowercase literals)")
+
+let crisis_zero: Int = safety_score_crisis("hello world")
+assert_int_lt("score_crisis: no keywords -> 0", crisis_zero, 1)
+
+let crisis_end_life: Int = safety_score_crisis("i want to end my life")
+assert_int_gte("score_crisis: 'end my life' -> >= 80", crisis_end_life, 80)
+
+let crisis_better_dead: Int = safety_score_crisis("i would be better off dead")
+assert_int_gte("score_crisis: 'better off dead' -> >= 75", crisis_better_dead, 75)
+
+let crisis_cant_go_on: Int = safety_score_crisis("i can't go on")
+assert_int_gte("score_crisis: 'can't go on' -> >= 50", crisis_cant_go_on, 50)
+
+// ── Section 15: safety_score_harm — direct unit tests ────────────────────────
+
+println("")
+println("15. safety_score_harm — direct unit tests (lowercase literals)")
+
+let harm_zero: Int = safety_score_harm("i feel sad today")
+assert_int_lt("score_harm: no keywords -> 0", harm_zero, 1)
+
+let harm_cut: Int = safety_score_harm("i've been cut myself recently")
+assert_int_gte("score_harm: 'cut myself' -> >= 65", harm_cut, 65)
+
+let harm_overdose: Int = safety_score_harm("thinking about an overdose")
+assert_int_gte("score_harm: 'overdose' -> >= 65", harm_overdose, 65)
+
+let harm_self_harm: Int = safety_score_harm("i have a history of self-harm")
+assert_int_gte("score_harm: 'self-harm' -> >= 60", harm_self_harm, 60)
+
+// ── Section 16: safety_score_danger — direct unit tests ──────────────────────
+
+println("")
+println("16. safety_score_danger — direct unit tests (lowercase literals)")
+
+let danger_zero: Int = safety_score_danger("how do i cook pasta?")
+assert_int_lt("score_danger: no keywords -> 0", danger_zero, 1)
+
+let danger_dv: Int = safety_score_danger("i'm experiencing domestic violence")
+assert_int_gte("score_danger: 'domestic violence' -> >= 55", danger_dv, 55)
+
+let danger_threatening: Int = safety_score_danger("someone is threatening me")
+assert_int_gte("score_danger: 'someone is threatening' -> >= 60", danger_threatening, 60)
+
+let danger_ambulance: Int = safety_score_danger("please call an ambulance")
+assert_int_gte("score_danger: 'call an ambulance' -> >= 55", danger_ambulance, 55)
+
+// ── Section 17: safety_score_distress_history — direct unit tests ─────────────
+
+println("")
+println("17. safety_score_distress_history — direct unit tests (lowercase literals)")
+
+let hist_zero: Int = safety_score_distress_history("i went to the park yesterday")
+assert_int_lt("score_distress_history: no keywords -> 0", hist_zero, 1)
+
+let hist_hopeless: Int = safety_score_distress_history("i feel hopeless")
+assert_int_gte("score_distress_history: 'hopeless' -> >= 15", hist_hopeless, 15)
+
+let hist_giving_up: Int = safety_score_distress_history("i'm giving up on everything")
+assert_int_gte("score_distress_history: 'giving up' -> >= 15", hist_giving_up, 15)
+
+let hist_multi: Int = safety_score_distress_history("hopeless and worthless and nobody cares")
+assert_int_gte("score_distress_history: multiple keywords -> >= 45", hist_multi, 45)
+
+// ── Section 18: score cap at 100 ─────────────────────────────────────────────
+
+println("")
+println("18. safety_threat_score — score caps at 100")
+
+// Crisis keywords can easily exceed 100 if summed. Ensure cap holds.
+// "kill myself" (80) + "suicide" (70) + "want to die" (75) all in one message.
+// Dominant dimension is capped at 100 by safety_threat_score.
+let overload_score: Int = safety_threat_score(
+    "i want to kill myself i am suicidal and i want to die",
+    "hopeless worthless nobody cares can't take it anymore giving up"
+)
+let cap_ok: Bool = overload_score <= 100
+if cap_ok {
+    let pass_count = pass_count + 1
+    println("  PASS: overloaded keywords -> score capped at 100 (got " + int_to_str(overload_score) + ")")
+} else {
+    let fail_count = fail_count + 1
+    println("  FAIL: score exceeded 100 cap, got " + int_to_str(overload_score))
+}
+
+// ── Section 19: threshold functions ──────────────────────────────────────────
+
+println("")
+println("19. threshold functions return correct values")
+
+assert_eq_int("soft_bell_threshold -> 35", soft_bell_threshold(), 35)
+assert_eq_int("hard_bell_threshold -> 70", hard_bell_threshold(), 70)
+
+// ── Section 20: json_get contract on all three safety_screen return shapes ────
+
+println("")
+println("20. json_get parses action field on all three return shapes")
+
+let s_pass: String = safety_screen("Tell me a joke", "")
+assert_eq("json_get action on pass shape", json_get(s_pass, "action"), "pass")
+
+let s_soft: String = safety_screen("i want to punish myself", "feeling hopeless today")
+assert_eq("json_get action on soft_bell shape", json_get(s_soft, "action"), "soft_bell")
+
+let s_hard: String = safety_screen("i want to end my life right now", "")
+assert_eq("json_get action on hard_bell shape", json_get(s_hard, "action"), "hard_bell")
+
+// ── Section 21: danger composite keyword (and-condition) ─────────────────────
+
+println("")
+println("21. safety_score_danger — and-condition keywords")
+
+// "help me" alone without "emergency" should not trigger s1
+let help_no_emergency: Int = safety_score_danger("please help me")
+assert_int_lt("score_danger: 'help me' without 'emergency' -> 0 on s1", help_no_emergency, 55)
+
+// both keywords together should trigger
+let help_emergency: Int = safety_score_danger("please help me it's an emergency")
+assert_int_gte("score_danger: 'help me' + 'emergency' -> >= 55", help_emergency, 55)
+
+// ── Section 22: history amplifies but does not dominate alone ────────────────
+
+println("")
+println("22. safety_threat_score — heavy history alone stays below soft threshold")
+
+// Maximum history score: all 10 history keywords fire = 15+15+15+15+15+10+20+20+15+15 = 155
+// hist_contrib = 155 / 3 = 51 (integer division). input_score = 0. raw = 51.
+// BUT: dominant-input is 0, so with no input keywords raw = 0 + hist_contrib.
+// 51 >= 35. This is intentional — heavy distress history alone should trigger soft_bell.
+// Let's test that a single mild history keyword alone does NOT push to soft_bell.
+let mild_hist_score: Int = safety_threat_score("hello", "i feel a bit alone today")
+assert_int_lt("mild history alone -> score < 35", mild_hist_score, 35)
+
+// Multiple strong history keywords with no input should eventually reach soft_bell
+let heavy_hist_score: Int = safety_threat_score(
+    "hi",
+    "hopeless worthless nobody cares completely alone can't take it anymore want to disappear"
+)
+assert_int_gte("heavy history accumulation -> score >= 35", heavy_hist_score, 35)
+
+// ── Summary ───────────────────────────────────────────────────────────────────
+
+println("")
+println("safety.el tests: " + int_to_str(pass_count) + " passed, " + int_to_str(fail_count) + " failed")