Make engram deletes/updates/forgets immutable on the launch branch

The ship-soul builds from this branch, which has the bounded-persona floor
(#93) but never received the tombstone/supersede immutability fix (that
went to main; hotfix diverged before it). So the launch soul failed
verify-soul-contract IMMUTABILITY on the delete/update/forget routes —
they hard-removed engram nodes via engram_forget/mem_forget.

Apply the same fix, mirroring the knowledge routes' supersede pattern:
- node/update -> create new node + "supersedes" edge to the original, KEEP
  the original (no engram_forget).
- node/delete, memory/delete, memory/forget, cultivate forget, and the
  autonomous awareness forget -> TOMBSTONE via the canonical mem_tombstone
  (memory.el): keep the node + its edges, record a Tombstone marker, hide
  from default bounded list reads (?include_deleted recovers). Never
  engram_forget. The MCP forget tool now routes to the tombstoning delete
  instead of faking a delete.
Internal GC that genuinely removes transient nodes (awareness inbox-trigger
consume, consolidation dedup, session-summary replace, telemetry pruning)
still calls engram_forget directly and is unchanged.

Regenerated dist/soul.c (single-TU) + per-module dist/{memory,awareness,
neuron-api}.c from THIS branch's sources under a 3GB physical-RSS watchdog
(peak ~32MB), built against the release el_runtime (v1.0.0-20260501). The
bounded-persona floor is preserved — verified in the emitted C and the
linked binary (BOUNDED PERSONA / SOUL_PERSONA_NAME strings present).

verify-soul-contract.sh: GATE PASS — PRESENCE all 27 routes, IMMUTABILITY
5/5 KEPT (memory-update, memory-delete, node-update, node-delete,
memory-forget).

awareness.el

@@ -507,8 +507,10 @@ fn respond(action_json: String) -> String {
     }
 
     if str_eq(kind, "forget") {
-        engram_forget(payload)
-        return "{\"outcome\":\"forgotten\",\"id\":\"" + payload + "\"}"
+        // The soul must NOT be able to autonomously hard-delete a memory.
+        // Tombstone instead (keep node + edges, recoverable).
+        let _marker: String = mem_tombstone(payload)
+        return "{\"outcome\":\"tombstoned\",\"id\":\"" + payload + "\"}"
     }
 
     return "{\"outcome\":\"noop\"}"

dist/awareness.c

@@ -10,6 +10,7 @@ el_val_t mem_remember(el_val_t content, el_val_t tags);
 el_val_t mem_recall(el_val_t query, el_val_t depth);
 el_val_t mem_search(el_val_t query, el_val_t limit);
 el_val_t mem_strengthen(el_val_t node_id);
+el_val_t mem_tombstone(el_val_t node_id);
 el_val_t mem_forget(el_val_t node_id);
 el_val_t mem_consolidate(void);
 el_val_t mem_save(el_val_t path);
@@ -375,8 +376,8 @@ el_val_t respond(el_val_t action_json) {
     return el_str_concat(el_str_concat(EL_STR("{\"outcome\":\"strengthened\",\"id\":\""), payload), EL_STR("\"}"));
   }
   if (str_eq(kind, EL_STR("forget"))) {
-    engram_forget(payload);
-    return el_str_concat(el_str_concat(EL_STR("{\"outcome\":\"forgotten\",\"id\":\""), payload), EL_STR("\"}"));
+    el_val_t _marker = mem_tombstone(payload);
+    return el_str_concat(el_str_concat(EL_STR("{\"outcome\":\"tombstoned\",\"id\":\""), payload), EL_STR("\"}"));
   }
   return EL_STR("{\"outcome\":\"noop\"}");
   return 0;

dist/memory.c

@@ -10,6 +10,7 @@ el_val_t mem_remember(el_val_t content, el_val_t tags);
 el_val_t mem_recall(el_val_t query, el_val_t depth);
 el_val_t mem_search(el_val_t query, el_val_t limit);
 el_val_t mem_strengthen(el_val_t node_id);
+el_val_t mem_tombstone(el_val_t node_id);
 el_val_t mem_forget(el_val_t node_id);
 el_val_t mem_consolidate(void);
 el_val_t mem_save(el_val_t path);
@@ -69,8 +70,18 @@ el_val_t mem_strengthen(el_val_t node_id) {
   return 0;
 }
 
+el_val_t mem_tombstone(el_val_t node_id) {
+  el_val_t tags = EL_STR("[\"Tombstone\",\"status:deleted\"]");
+  el_val_t marker = engram_node_full(node_id, EL_STR("Tombstone"), el_str_concat(EL_STR("tombstone:"), node_id), el_from_float(0.01), el_from_float(0.01), el_from_float(1.0), EL_STR("Episodic"), tags);
+  if (!str_eq(marker, EL_STR(""))) {
+    engram_connect(marker, node_id, el_from_float(1.0), EL_STR("tombstones"));
+  }
+  return marker;
+  return 0;
+}
+
 el_val_t mem_forget(el_val_t node_id) {
-  engram_forget(node_id);
+  el_val_t _marker = mem_tombstone(node_id);
   return 0;
 }
 

dist/neuron-api.c

@@ -10,6 +10,7 @@ el_val_t mem_remember(el_val_t content, el_val_t tags);
 el_val_t mem_recall(el_val_t query, el_val_t depth);
 el_val_t mem_search(el_val_t query, el_val_t limit);
 el_val_t mem_strengthen(el_val_t node_id);
+el_val_t mem_tombstone(el_val_t node_id);
 el_val_t mem_forget(el_val_t node_id);
 el_val_t mem_consolidate(void);
 el_val_t mem_save(el_val_t path);
@@ -28,6 +29,9 @@ el_val_t api_nonempty(el_val_t s);
 el_val_t api_or_empty(el_val_t s);
 el_val_t api_persisted(el_val_t id);
 el_val_t api_not_persisted(el_val_t id);
+el_val_t tombstone_node(el_val_t id);
+el_val_t tombstoned_id_set(void);
+el_val_t memory_hide_tombstoned(el_val_t raw, el_val_t path);
 el_val_t handle_api_begin_session(el_val_t body);
 el_val_t handle_api_compile_ctx(el_val_t body);
 el_val_t handle_api_remember(el_val_t body);
@@ -189,6 +193,61 @@ el_val_t api_not_persisted(el_val_t id) {
   return 0;
 }
 
+el_val_t tombstone_node(el_val_t id) {
+  return mem_tombstone(id);
+  return 0;
+}
+
+el_val_t tombstoned_id_set(void) {
+  el_val_t markers = engram_scan_nodes_by_type_json(EL_STR("Tombstone"), 5000, 0);
+  if (str_eq(markers, EL_STR("")) || str_eq(markers, EL_STR("[]"))) {
+    return EL_STR("");
+  }
+  el_val_t n = json_array_len(markers);
+  el_val_t acc = EL_STR("|");
+  el_val_t i = 0;
+  while (i < n) {
+    el_val_t m = json_array_get(markers, i);
+    el_val_t tid = json_get(m, EL_STR("content"));
+    acc = ({ el_val_t _if_result_1 = 0; if (str_eq(tid, EL_STR(""))) { _if_result_1 = (acc); } else { _if_result_1 = (el_str_concat(el_str_concat(acc, tid), EL_STR("|"))); } _if_result_1; });
+    i = (i + 1);
+  }
+  return acc;
+  return 0;
+}
+
+el_val_t memory_hide_tombstoned(el_val_t raw, el_val_t path) {
+  if (str_contains(path, EL_STR("include_deleted"))) {
+    return raw;
+  }
+  if (str_eq(raw, EL_STR("")) || str_eq(raw, EL_STR("[]"))) {
+    return raw;
+  }
+  el_val_t dead = tombstoned_id_set();
+  if (str_eq(dead, EL_STR(""))) {
+    return raw;
+  }
+  el_val_t n = json_array_len(raw);
+  if (n > 1000) {
+    return raw;
+  }
+  el_val_t out = EL_STR("[");
+  el_val_t first = 1;
+  el_val_t i = 0;
+  while (i < n) {
+    el_val_t node = json_array_get(raw, i);
+    el_val_t nid = json_get(node, EL_STR("id"));
+    el_val_t ntype = json_get(node, EL_STR("node_type"));
+    el_val_t is_dead = (!str_eq(nid, EL_STR("")) && str_contains(dead, el_str_concat(el_str_concat(EL_STR("|"), nid), EL_STR("|"))));
+    el_val_t keep = (!str_eq(ntype, EL_STR("Tombstone")) && !is_dead);
+    out = ({ el_val_t _if_result_2 = 0; if (keep) { _if_result_2 = (({ el_val_t _if_result_3 = 0; if (first) { _if_result_3 = (el_str_concat(out, node)); } else { _if_result_3 = (el_str_concat(el_str_concat(out, EL_STR(",")), node)); } _if_result_3; })); } else { _if_result_2 = (out); } _if_result_2; });
+    first = ({ el_val_t _if_result_4 = 0; if (keep) { _if_result_4 = (0); } else { _if_result_4 = (first); } _if_result_4; });
+    i = (i + 1);
+  }
+  return el_str_concat(out, EL_STR("]"));
+  return 0;
+}
+
 el_val_t handle_api_begin_session(el_val_t body) {
   el_val_t stats = engram_stats_json();
   el_val_t activated = engram_activate_json(EL_STR("session start recent memory important"), 2);
@@ -215,10 +274,10 @@ el_val_t handle_api_remember(el_val_t body) {
   el_val_t importance = json_get(body, EL_STR("importance"));
   el_val_t tags_raw = json_get(body, EL_STR("tags"));
   el_val_t project = json_get(body, EL_STR("project"));
-  el_val_t sal_str = ({ el_val_t _if_result_1 = 0; if (str_eq(importance, EL_STR("critical"))) { _if_result_1 = (EL_STR("0.95")); } else { _if_result_1 = (({ el_val_t _if_result_2 = 0; if (str_eq(importance, EL_STR("high"))) { _if_result_2 = (EL_STR("0.75")); } else { _if_result_2 = (({ el_val_t _if_result_3 = 0; if (str_eq(importance, EL_STR("low"))) { _if_result_3 = (EL_STR("0.25")); } else { _if_result_3 = (EL_STR("0.50")); } _if_result_3; })); } _if_result_2; })); } _if_result_1; });
-  el_val_t sal = ({ el_val_t _if_result_4 = 0; if (str_eq(sal_str, EL_STR("0.95"))) { _if_result_4 = (el_from_float(0.95)); } else { _if_result_4 = (({ el_val_t _if_result_5 = 0; if (str_eq(sal_str, EL_STR("0.75"))) { _if_result_5 = (el_from_float(0.75)); } else { _if_result_5 = (({ el_val_t _if_result_6 = 0; if (str_eq(sal_str, EL_STR("0.25"))) { _if_result_6 = (el_from_float(0.25)); } else { _if_result_6 = (el_from_float(0.5)); } _if_result_6; })); } _if_result_5; })); } _if_result_4; });
-  el_val_t base_tags = ({ el_val_t _if_result_7 = 0; if (str_eq(tags_raw, EL_STR(""))) { _if_result_7 = (EL_STR("[\"Memory\"]")); } else { _if_result_7 = (tags_raw); } _if_result_7; });
-  el_val_t final_tags = ({ el_val_t _if_result_8 = 0; if (str_eq(project, EL_STR(""))) { _if_result_8 = (base_tags); } else { el_val_t inner = str_slice(base_tags, 1, (str_len(base_tags) - 1)); _if_result_8 = (el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("["), inner), EL_STR(",\"project:")), project), EL_STR("\"]"))); } _if_result_8; });
+  el_val_t sal_str = ({ el_val_t _if_result_5 = 0; if (str_eq(importance, EL_STR("critical"))) { _if_result_5 = (EL_STR("0.95")); } else { _if_result_5 = (({ el_val_t _if_result_6 = 0; if (str_eq(importance, EL_STR("high"))) { _if_result_6 = (EL_STR("0.75")); } else { _if_result_6 = (({ el_val_t _if_result_7 = 0; if (str_eq(importance, EL_STR("low"))) { _if_result_7 = (EL_STR("0.25")); } else { _if_result_7 = (EL_STR("0.50")); } _if_result_7; })); } _if_result_6; })); } _if_result_5; });
+  el_val_t sal = ({ el_val_t _if_result_8 = 0; if (str_eq(sal_str, EL_STR("0.95"))) { _if_result_8 = (el_from_float(0.95)); } else { _if_result_8 = (({ el_val_t _if_result_9 = 0; if (str_eq(sal_str, EL_STR("0.75"))) { _if_result_9 = (el_from_float(0.75)); } else { _if_result_9 = (({ el_val_t _if_result_10 = 0; if (str_eq(sal_str, EL_STR("0.25"))) { _if_result_10 = (el_from_float(0.25)); } else { _if_result_10 = (el_from_float(0.5)); } _if_result_10; })); } _if_result_9; })); } _if_result_8; });
+  el_val_t base_tags = ({ el_val_t _if_result_11 = 0; if (str_eq(tags_raw, EL_STR(""))) { _if_result_11 = (EL_STR("[\"Memory\"]")); } else { _if_result_11 = (tags_raw); } _if_result_11; });
+  el_val_t final_tags = ({ el_val_t _if_result_12 = 0; if (str_eq(project, EL_STR(""))) { _if_result_12 = (base_tags); } else { el_val_t inner = str_slice(base_tags, 1, (str_len(base_tags) - 1)); _if_result_12 = (el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("["), inner), EL_STR(",\"project:")), project), EL_STR("\"]"))); } _if_result_12; });
   el_val_t id = engram_node_full(content, EL_STR("Memory"), EL_STR("memory:remembered"), el_from_float(sal), el_from_float(sal), el_from_float(0.9), EL_STR("Episodic"), final_tags);
   if (!api_persisted(id)) {
     return api_not_persisted(id);
@@ -233,15 +292,15 @@ el_val_t handle_api_node_create(el_val_t body) {
     return api_err(EL_STR("content is required"));
   }
   el_val_t nt_raw = json_get(body, EL_STR("node_type"));
-  el_val_t node_type = ({ el_val_t _if_result_9 = 0; if (str_eq(nt_raw, EL_STR(""))) { _if_result_9 = (EL_STR("Memory")); } else { _if_result_9 = (nt_raw); } _if_result_9; });
+  el_val_t node_type = ({ el_val_t _if_result_13 = 0; if (str_eq(nt_raw, EL_STR(""))) { _if_result_13 = (EL_STR("Memory")); } else { _if_result_13 = (nt_raw); } _if_result_13; });
   el_val_t label_raw = json_get(body, EL_STR("label"));
-  el_val_t label = ({ el_val_t _if_result_10 = 0; if (str_eq(label_raw, EL_STR(""))) { _if_result_10 = (EL_STR("node:created")); } else { _if_result_10 = (label_raw); } _if_result_10; });
+  el_val_t label = ({ el_val_t _if_result_14 = 0; if (str_eq(label_raw, EL_STR(""))) { _if_result_14 = (EL_STR("node:created")); } else { _if_result_14 = (label_raw); } _if_result_14; });
   el_val_t tier_raw = json_get(body, EL_STR("tier"));
-  el_val_t tier = ({ el_val_t _if_result_11 = 0; if (str_eq(tier_raw, EL_STR(""))) { _if_result_11 = (EL_STR("Episodic")); } else { _if_result_11 = (tier_raw); } _if_result_11; });
+  el_val_t tier = ({ el_val_t _if_result_15 = 0; if (str_eq(tier_raw, EL_STR(""))) { _if_result_15 = (EL_STR("Episodic")); } else { _if_result_15 = (tier_raw); } _if_result_15; });
   el_val_t tags_raw = json_get(body, EL_STR("tags"));
-  el_val_t tags = ({ el_val_t _if_result_12 = 0; if (str_eq(tags_raw, EL_STR(""))) { _if_result_12 = (el_str_concat(el_str_concat(EL_STR("[\""), node_type), EL_STR("\"]"))); } else { _if_result_12 = (tags_raw); } _if_result_12; });
+  el_val_t tags = ({ el_val_t _if_result_16 = 0; if (str_eq(tags_raw, EL_STR(""))) { _if_result_16 = (el_str_concat(el_str_concat(EL_STR("[\""), node_type), EL_STR("\"]"))); } else { _if_result_16 = (tags_raw); } _if_result_16; });
   el_val_t importance = json_get(body, EL_STR("importance"));
-  el_val_t sal = ({ el_val_t _if_result_13 = 0; if (str_eq(importance, EL_STR("critical"))) { _if_result_13 = (el_from_float(0.95)); } else { _if_result_13 = (({ el_val_t _if_result_14 = 0; if (str_eq(importance, EL_STR("high"))) { _if_result_14 = (el_from_float(0.75)); } else { _if_result_14 = (({ el_val_t _if_result_15 = 0; if (str_eq(importance, EL_STR("low"))) { _if_result_15 = (el_from_float(0.25)); } else { _if_result_15 = (el_from_float(0.5)); } _if_result_15; })); } _if_result_14; })); } _if_result_13; });
+  el_val_t sal = ({ el_val_t _if_result_17 = 0; if (str_eq(importance, EL_STR("critical"))) { _if_result_17 = (el_from_float(0.95)); } else { _if_result_17 = (({ el_val_t _if_result_18 = 0; if (str_eq(importance, EL_STR("high"))) { _if_result_18 = (el_from_float(0.75)); } else { _if_result_18 = (({ el_val_t _if_result_19 = 0; if (str_eq(importance, EL_STR("low"))) { _if_result_19 = (el_from_float(0.25)); } else { _if_result_19 = (el_from_float(0.5)); } _if_result_19; })); } _if_result_18; })); } _if_result_17; });
   el_val_t id = engram_node_full(content, node_type, label, el_from_float(sal), el_from_float(sal), el_from_float(0.9), tier, tags);
   if (!api_persisted(id)) {
     return api_not_persisted(id);
@@ -255,8 +314,18 @@ el_val_t handle_api_node_delete(el_val_t body) {
   if (str_eq(id, EL_STR(""))) {
     return api_err(EL_STR("id is required"));
   }
-  engram_forget(id);
-  return el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"id\":\""), id), EL_STR("\"}"));
+  if (is_protected_node(id)) {
+    return api_err_protected(id);
+  }
+  el_val_t existing = engram_get_node_json(id);
+  if (str_eq(existing, EL_STR("{}"))) {
+    return api_err(el_str_concat(EL_STR("node not found: "), id));
+  }
+  el_val_t marker = tombstone_node(id);
+  if (str_eq(marker, EL_STR(""))) {
+    return api_err(el_str_concat(EL_STR("tombstone failed: "), id));
+  }
+  return el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"id\":\""), id), EL_STR("\",\"tombstoned\":true}"));
   return 0;
 }
 
@@ -270,37 +339,37 @@ el_val_t handle_api_node_update(el_val_t body) {
   }
   el_val_t old = engram_get_node_json(id);
   el_val_t body_content = json_get(body, EL_STR("content"));
-  el_val_t content = ({ el_val_t _if_result_16 = 0; if (str_eq(body_content, EL_STR(""))) { _if_result_16 = (json_get(old, EL_STR("content"))); } else { _if_result_16 = (body_content); } _if_result_16; });
+  el_val_t content = ({ el_val_t _if_result_20 = 0; if (str_eq(body_content, EL_STR(""))) { _if_result_20 = (json_get(old, EL_STR("content"))); } else { _if_result_20 = (body_content); } _if_result_20; });
   el_val_t body_nt = json_get(body, EL_STR("node_type"));
   el_val_t old_nt = json_get(old, EL_STR("node_type"));
-  el_val_t node_type = ({ el_val_t _if_result_17 = 0; if (!str_eq(body_nt, EL_STR(""))) { _if_result_17 = (body_nt); } else { _if_result_17 = (({ el_val_t _if_result_18 = 0; if (!str_eq(old_nt, EL_STR(""))) { _if_result_18 = (old_nt); } else { _if_result_18 = (EL_STR("Memory")); } _if_result_18; })); } _if_result_17; });
+  el_val_t node_type = ({ el_val_t _if_result_21 = 0; if (!str_eq(body_nt, EL_STR(""))) { _if_result_21 = (body_nt); } else { _if_result_21 = (({ el_val_t _if_result_22 = 0; if (!str_eq(old_nt, EL_STR(""))) { _if_result_22 = (old_nt); } else { _if_result_22 = (EL_STR("Memory")); } _if_result_22; })); } _if_result_21; });
   el_val_t body_label = json_get(body, EL_STR("label"));
   el_val_t old_label = json_get(old, EL_STR("label"));
-  el_val_t label = ({ el_val_t _if_result_19 = 0; if (!str_eq(body_label, EL_STR(""))) { _if_result_19 = (body_label); } else { _if_result_19 = (({ el_val_t _if_result_20 = 0; if (!str_eq(old_label, EL_STR(""))) { _if_result_20 = (old_label); } else { _if_result_20 = (EL_STR("node:updated")); } _if_result_20; })); } _if_result_19; });
+  el_val_t label = ({ el_val_t _if_result_23 = 0; if (!str_eq(body_label, EL_STR(""))) { _if_result_23 = (body_label); } else { _if_result_23 = (({ el_val_t _if_result_24 = 0; if (!str_eq(old_label, EL_STR(""))) { _if_result_24 = (old_label); } else { _if_result_24 = (EL_STR("node:updated")); } _if_result_24; })); } _if_result_23; });
   el_val_t body_tier = json_get(body, EL_STR("tier"));
   el_val_t old_tier = json_get(old, EL_STR("tier"));
-  el_val_t tier = ({ el_val_t _if_result_21 = 0; if (!str_eq(body_tier, EL_STR(""))) { _if_result_21 = (body_tier); } else { _if_result_21 = (({ el_val_t _if_result_22 = 0; if (!str_eq(old_tier, EL_STR(""))) { _if_result_22 = (old_tier); } else { _if_result_22 = (EL_STR("Episodic")); } _if_result_22; })); } _if_result_21; });
+  el_val_t tier = ({ el_val_t _if_result_25 = 0; if (!str_eq(body_tier, EL_STR(""))) { _if_result_25 = (body_tier); } else { _if_result_25 = (({ el_val_t _if_result_26 = 0; if (!str_eq(old_tier, EL_STR(""))) { _if_result_26 = (old_tier); } else { _if_result_26 = (EL_STR("Episodic")); } _if_result_26; })); } _if_result_25; });
   el_val_t body_tags = json_get(body, EL_STR("tags"));
-  el_val_t tags = ({ el_val_t _if_result_23 = 0; if (str_eq(body_tags, EL_STR(""))) { _if_result_23 = (el_str_concat(el_str_concat(EL_STR("[\""), node_type), EL_STR("\"]"))); } else { _if_result_23 = (body_tags); } _if_result_23; });
+  el_val_t tags = ({ el_val_t _if_result_27 = 0; if (str_eq(body_tags, EL_STR(""))) { _if_result_27 = (el_str_concat(el_str_concat(EL_STR("[\""), node_type), EL_STR("\"]"))); } else { _if_result_27 = (body_tags); } _if_result_27; });
   el_val_t new_id = engram_node_full(content, node_type, label, el_from_float(0.5), el_from_float(0.5), el_from_float(0.8), tier, tags);
   if (!api_persisted(new_id)) {
     return api_not_persisted(new_id);
   }
-  engram_forget(id);
-  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"id\":\""), new_id), EL_STR("\",\"replaced\":\"")), id), EL_STR("\",\"ok\":true}"));
+  engram_connect(new_id, id, el_from_float(0.9), EL_STR("supersedes"));
+  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"id\":\""), new_id), EL_STR("\",\"supersedes\":\"")), id), EL_STR("\",\"ok\":true}"));
   return 0;
 }
 
 el_val_t handle_api_recall(el_val_t method, el_val_t path, el_val_t body) {
-  el_val_t url_q = ({ el_val_t _if_result_24 = 0; if (str_eq(api_query_param(path, EL_STR("query")), EL_STR(""))) { _if_result_24 = (api_query_param(path, EL_STR("q"))); } else { _if_result_24 = (api_query_param(path, EL_STR("query"))); } _if_result_24; });
+  el_val_t url_q = ({ el_val_t _if_result_28 = 0; if (str_eq(api_query_param(path, EL_STR("query")), EL_STR(""))) { _if_result_28 = (api_query_param(path, EL_STR("q"))); } else { _if_result_28 = (api_query_param(path, EL_STR("query"))); } _if_result_28; });
   el_val_t body_query = json_get(body, EL_STR("query"));
   el_val_t body_q = json_get(body, EL_STR("q"));
-  el_val_t q = ({ el_val_t _if_result_25 = 0; if (!str_eq(url_q, EL_STR(""))) { _if_result_25 = (url_q); } else { _if_result_25 = (({ el_val_t _if_result_26 = 0; if (!str_eq(body_query, EL_STR(""))) { _if_result_26 = (body_query); } else { _if_result_26 = (body_q); } _if_result_26; })); } _if_result_25; });
+  el_val_t q = ({ el_val_t _if_result_29 = 0; if (!str_eq(url_q, EL_STR(""))) { _if_result_29 = (url_q); } else { _if_result_29 = (({ el_val_t _if_result_30 = 0; if (!str_eq(body_query, EL_STR(""))) { _if_result_30 = (body_query); } else { _if_result_30 = (body_q); } _if_result_30; })); } _if_result_29; });
   el_val_t chain = json_get(body, EL_STR("chain_name"));
   el_val_t limit = api_query_int(path, EL_STR("limit"), 0);
-  limit = ({ el_val_t _if_result_27 = 0; if ((limit == 0)) { _if_result_27 = (json_get_int(body, EL_STR("limit"))); } else { _if_result_27 = (limit); } _if_result_27; });
-  limit = ({ el_val_t _if_result_28 = 0; if ((limit == 0)) { _if_result_28 = (10); } else { _if_result_28 = (limit); } _if_result_28; });
-  el_val_t eff_q = ({ el_val_t _if_result_29 = 0; if (str_eq(q, EL_STR(""))) { _if_result_29 = (chain); } else { _if_result_29 = (q); } _if_result_29; });
+  limit = ({ el_val_t _if_result_31 = 0; if ((limit == 0)) { _if_result_31 = (json_get_int(body, EL_STR("limit"))); } else { _if_result_31 = (limit); } _if_result_31; });
+  limit = ({ el_val_t _if_result_32 = 0; if ((limit == 0)) { _if_result_32 = (10); } else { _if_result_32 = (limit); } _if_result_32; });
+  el_val_t eff_q = ({ el_val_t _if_result_33 = 0; if (str_eq(q, EL_STR(""))) { _if_result_33 = (chain); } else { _if_result_33 = (q); } _if_result_33; });
   if (str_eq(eff_q, EL_STR(""))) {
     return api_or_empty(engram_scan_nodes_json(limit, 0));
   }
@@ -313,10 +382,10 @@ el_val_t handle_api_search_knowledge(el_val_t method, el_val_t path, el_val_t bo
   el_val_t url_q = api_query_param(path, EL_STR("q"));
   el_val_t body_query = json_get(body, EL_STR("query"));
   el_val_t body_q = json_get(body, EL_STR("q"));
-  el_val_t q = ({ el_val_t _if_result_30 = 0; if (!str_eq(url_q, EL_STR(""))) { _if_result_30 = (url_q); } else { _if_result_30 = (({ el_val_t _if_result_31 = 0; if (!str_eq(body_query, EL_STR(""))) { _if_result_31 = (body_query); } else { _if_result_31 = (body_q); } _if_result_31; })); } _if_result_30; });
+  el_val_t q = ({ el_val_t _if_result_34 = 0; if (!str_eq(url_q, EL_STR(""))) { _if_result_34 = (url_q); } else { _if_result_34 = (({ el_val_t _if_result_35 = 0; if (!str_eq(body_query, EL_STR(""))) { _if_result_35 = (body_query); } else { _if_result_35 = (body_q); } _if_result_35; })); } _if_result_34; });
   el_val_t limit = api_query_int(path, EL_STR("limit"), 0);
-  limit = ({ el_val_t _if_result_32 = 0; if ((limit == 0)) { _if_result_32 = (json_get_int(body, EL_STR("limit"))); } else { _if_result_32 = (limit); } _if_result_32; });
-  limit = ({ el_val_t _if_result_33 = 0; if ((limit == 0)) { _if_result_33 = (10); } else { _if_result_33 = (limit); } _if_result_33; });
+  limit = ({ el_val_t _if_result_36 = 0; if ((limit == 0)) { _if_result_36 = (json_get_int(body, EL_STR("limit"))); } else { _if_result_36 = (limit); } _if_result_36; });
+  limit = ({ el_val_t _if_result_37 = 0; if ((limit == 0)) { _if_result_37 = (10); } else { _if_result_37 = (limit); } _if_result_37; });
   if (str_eq(q, EL_STR(""))) {
     return api_err(EL_STR("query is required"));
   }
@@ -344,7 +413,7 @@ el_val_t handle_api_capture_knowledge(el_val_t body) {
   if (str_eq(content, EL_STR(""))) {
     return api_err(EL_STR("content is required"));
   }
-  el_val_t full = ({ el_val_t _if_result_34 = 0; if (str_eq(title, EL_STR(""))) { _if_result_34 = (content); } else { _if_result_34 = (el_str_concat(el_str_concat(title, EL_STR(": ")), content)); } _if_result_34; });
+  el_val_t full = ({ el_val_t _if_result_38 = 0; if (str_eq(title, EL_STR(""))) { _if_result_38 = (content); } else { _if_result_38 = (el_str_concat(el_str_concat(title, EL_STR(": ")), content)); } _if_result_38; });
   el_val_t tags = EL_STR("[\"Knowledge\",\"captured\"]");
   el_val_t id = engram_node_full(full, EL_STR("Knowledge"), EL_STR("knowledge:captured"), el_from_float(0.85), el_from_float(0.8), el_from_float(0.9), EL_STR("Episodic"), tags);
   if (!api_persisted(id)) {
@@ -385,7 +454,7 @@ el_val_t handle_api_promote_knowledge(el_val_t body) {
     return api_err(EL_STR("id (prior node) is required"));
   }
   el_val_t tags_raw = json_get(body, EL_STR("tags"));
-  el_val_t tags = ({ el_val_t _if_result_35 = 0; if (str_eq(tags_raw, EL_STR(""))) { _if_result_35 = (EL_STR("[\"Knowledge\",\"tier:canonical\",\"disposition:stable\"]")); } else { _if_result_35 = (tags_raw); } _if_result_35; });
+  el_val_t tags = ({ el_val_t _if_result_39 = 0; if (str_eq(tags_raw, EL_STR(""))) { _if_result_39 = (EL_STR("[\"Knowledge\",\"tier:canonical\",\"disposition:stable\"]")); } else { _if_result_39 = (tags_raw); } _if_result_39; });
   el_val_t new_id = engram_node_full(content, EL_STR("Knowledge"), EL_STR("knowledge:canonical"), el_from_float(0.9), el_from_float(0.9), el_from_float(1.0), EL_STR("Canonical"), tags);
   if (!api_persisted(new_id)) {
     return api_not_persisted(new_id);
@@ -396,7 +465,7 @@ el_val_t handle_api_promote_knowledge(el_val_t body) {
 }
 
 el_val_t handle_api_browse_processes(el_val_t method, el_val_t path, el_val_t body) {
-  el_val_t name = ({ el_val_t _if_result_36 = 0; if (str_eq(method, EL_STR("GET"))) { _if_result_36 = (api_query_param(path, EL_STR("name"))); } else { _if_result_36 = (json_get(body, EL_STR("name"))); } _if_result_36; });
+  el_val_t name = ({ el_val_t _if_result_40 = 0; if (str_eq(method, EL_STR("GET"))) { _if_result_40 = (api_query_param(path, EL_STR("name"))); } else { _if_result_40 = (json_get(body, EL_STR("name"))); } _if_result_40; });
   el_val_t limit = api_query_int(path, EL_STR("limit"), 50);
   if (str_eq(name, EL_STR(""))) {
     return api_or_empty(engram_scan_nodes_by_type_json(EL_STR("Process"), limit, 0));
@@ -411,7 +480,7 @@ el_val_t handle_api_define_process(el_val_t body) {
   if (str_eq(content, EL_STR(""))) {
     return api_err(EL_STR("content is required"));
   }
-  el_val_t label = ({ el_val_t _if_result_37 = 0; if (str_eq(name, EL_STR(""))) { _if_result_37 = (EL_STR("process:unnamed")); } else { _if_result_37 = (el_str_concat(EL_STR("process:"), name)); } _if_result_37; });
+  el_val_t label = ({ el_val_t _if_result_41 = 0; if (str_eq(name, EL_STR(""))) { _if_result_41 = (EL_STR("process:unnamed")); } else { _if_result_41 = (el_str_concat(EL_STR("process:"), name)); } _if_result_41; });
   el_val_t tags = EL_STR("[\"Process\"]");
   el_val_t id = engram_node_full(content, EL_STR("Process"), label, el_from_float(0.8), el_from_float(0.8), el_from_float(0.9), EL_STR("Canonical"), tags);
   if (!api_persisted(id)) {
@@ -429,12 +498,12 @@ el_val_t handle_api_log_state_event(el_val_t body) {
   el_val_t gap = json_get(body, EL_STR("gap_direction"));
   el_val_t legacy = json_get(body, EL_STR("content"));
   el_val_t parts = EL_STR("INTERNAL STATE EVENT");
-  parts = ({ el_val_t _if_result_38 = 0; if (!str_eq(trigger, EL_STR(""))) { _if_result_38 = (el_str_concat(el_str_concat(parts, EL_STR("\nTrigger: ")), trigger)); } else { _if_result_38 = (parts); } _if_result_38; });
-  parts = ({ el_val_t _if_result_39 = 0; if (!str_eq(pre, EL_STR(""))) { _if_result_39 = (el_str_concat(el_str_concat(parts, EL_STR("\nPre-reasoning: ")), pre)); } else { _if_result_39 = (parts); } _if_result_39; });
-  parts = ({ el_val_t _if_result_40 = 0; if (!str_eq(post, EL_STR(""))) { _if_result_40 = (el_str_concat(el_str_concat(parts, EL_STR("\nPost-reasoning: ")), post)); } else { _if_result_40 = (parts); } _if_result_40; });
-  parts = ({ el_val_t _if_result_41 = 0; if (!str_eq(ratio, EL_STR(""))) { _if_result_41 = (el_str_concat(el_str_concat(parts, EL_STR("\nCompression-ratio: ")), ratio)); } else { _if_result_41 = (parts); } _if_result_41; });
-  parts = ({ el_val_t _if_result_42 = 0; if (!str_eq(gap, EL_STR(""))) { _if_result_42 = (el_str_concat(el_str_concat(parts, EL_STR("\nGap-direction: ")), gap)); } else { _if_result_42 = (parts); } _if_result_42; });
-  parts = ({ el_val_t _if_result_43 = 0; if (!str_eq(legacy, EL_STR(""))) { _if_result_43 = (el_str_concat(el_str_concat(parts, EL_STR("\n")), legacy)); } else { _if_result_43 = (parts); } _if_result_43; });
+  parts = ({ el_val_t _if_result_42 = 0; if (!str_eq(trigger, EL_STR(""))) { _if_result_42 = (el_str_concat(el_str_concat(parts, EL_STR("\nTrigger: ")), trigger)); } else { _if_result_42 = (parts); } _if_result_42; });
+  parts = ({ el_val_t _if_result_43 = 0; if (!str_eq(pre, EL_STR(""))) { _if_result_43 = (el_str_concat(el_str_concat(parts, EL_STR("\nPre-reasoning: ")), pre)); } else { _if_result_43 = (parts); } _if_result_43; });
+  parts = ({ el_val_t _if_result_44 = 0; if (!str_eq(post, EL_STR(""))) { _if_result_44 = (el_str_concat(el_str_concat(parts, EL_STR("\nPost-reasoning: ")), post)); } else { _if_result_44 = (parts); } _if_result_44; });
+  parts = ({ el_val_t _if_result_45 = 0; if (!str_eq(ratio, EL_STR(""))) { _if_result_45 = (el_str_concat(el_str_concat(parts, EL_STR("\nCompression-ratio: ")), ratio)); } else { _if_result_45 = (parts); } _if_result_45; });
+  parts = ({ el_val_t _if_result_46 = 0; if (!str_eq(gap, EL_STR(""))) { _if_result_46 = (el_str_concat(el_str_concat(parts, EL_STR("\nGap-direction: ")), gap)); } else { _if_result_46 = (parts); } _if_result_46; });
+  parts = ({ el_val_t _if_result_47 = 0; if (!str_eq(legacy, EL_STR(""))) { _if_result_47 = (el_str_concat(el_str_concat(parts, EL_STR("\n")), legacy)); } else { _if_result_47 = (parts); } _if_result_47; });
   el_val_t ts = time_now();
   el_val_t boot = state_get(EL_STR("soul_boot_count"));
   el_val_t tags = EL_STR("[\"internal-state\",\"InternalStateEvent\",\"pre-reasoning\"]");
@@ -447,7 +516,7 @@ el_val_t handle_api_log_state_event(el_val_t body) {
 }
 
 el_val_t handle_api_list_state_events(el_val_t method, el_val_t path, el_val_t body) {
-  el_val_t q = ({ el_val_t _if_result_44 = 0; if (str_eq(method, EL_STR("GET"))) { _if_result_44 = (api_query_param(path, EL_STR("query"))); } else { _if_result_44 = (json_get(body, EL_STR("query"))); } _if_result_44; });
+  el_val_t q = ({ el_val_t _if_result_48 = 0; if (str_eq(method, EL_STR("GET"))) { _if_result_48 = (api_query_param(path, EL_STR("query"))); } else { _if_result_48 = (json_get(body, EL_STR("query"))); } _if_result_48; });
   el_val_t limit = api_query_int(path, EL_STR("limit"), 20);
   if (!str_eq(q, EL_STR(""))) {
     return api_or_empty(engram_search_json(el_str_concat(EL_STR("internal state "), q), limit));
@@ -458,7 +527,7 @@ el_val_t handle_api_list_state_events(el_val_t method, el_val_t path, el_val_t b
 
 el_val_t handle_api_inspect_config(el_val_t path, el_val_t body) {
   el_val_t key = api_query_param(path, EL_STR("key"));
-  key = ({ el_val_t _if_result_45 = 0; if (str_eq(key, EL_STR(""))) { _if_result_45 = (json_get(body, EL_STR("key"))); } else { _if_result_45 = (key); } _if_result_45; });
+  key = ({ el_val_t _if_result_49 = 0; if (str_eq(key, EL_STR(""))) { _if_result_49 = (json_get(body, EL_STR("key"))); } else { _if_result_49 = (key); } _if_result_49; });
   if (str_eq(key, EL_STR(""))) {
     return EL_STR("{\"hint\":\"pass ?key=<name>\",\"known\":[\"neuron.self.traversal_root\",\"neuron.self.values_hub\"]}");
   }
@@ -475,7 +544,7 @@ el_val_t handle_api_inspect_config(el_val_t path, el_val_t body) {
   el_val_t node = json_array_get(results, 0);
   el_val_t content = json_get(node, EL_STR("content"));
   el_val_t prefix = el_str_concat(el_str_concat(EL_STR("config:"), key), EL_STR("="));
-  el_val_t value = ({ el_val_t _if_result_46 = 0; if (str_starts_with(content, prefix)) { _if_result_46 = (str_slice(content, str_len(prefix), str_len(content))); } else { _if_result_46 = (content); } _if_result_46; });
+  el_val_t value = ({ el_val_t _if_result_50 = 0; if (str_starts_with(content, prefix)) { _if_result_50 = (str_slice(content, str_len(prefix), str_len(content))); } else { _if_result_50 = (content); } _if_result_50; });
   return el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"key\":\""), key), EL_STR("\",\"value\":\"")), value), EL_STR("\"}"));
   return 0;
 }
@@ -497,13 +566,13 @@ el_val_t handle_api_tune_config(el_val_t body) {
 }
 
 el_val_t handle_api_inspect_graph(el_val_t method, el_val_t path, el_val_t body) {
-  el_val_t entity_id = ({ el_val_t _if_result_47 = 0; if (str_eq(method, EL_STR("GET"))) { _if_result_47 = (api_query_param(path, EL_STR("id"))); } else { _if_result_47 = (json_get(body, EL_STR("entity_id"))); } _if_result_47; });
-  el_val_t name = ({ el_val_t _if_result_48 = 0; if (str_eq(method, EL_STR("GET"))) { _if_result_48 = (api_query_param(path, EL_STR("name"))); } else { _if_result_48 = (json_get(body, EL_STR("name"))); } _if_result_48; });
+  el_val_t entity_id = ({ el_val_t _if_result_51 = 0; if (str_eq(method, EL_STR("GET"))) { _if_result_51 = (api_query_param(path, EL_STR("id"))); } else { _if_result_51 = (json_get(body, EL_STR("entity_id"))); } _if_result_51; });
+  el_val_t name = ({ el_val_t _if_result_52 = 0; if (str_eq(method, EL_STR("GET"))) { _if_result_52 = (api_query_param(path, EL_STR("name"))); } else { _if_result_52 = (json_get(body, EL_STR("name"))); } _if_result_52; });
   el_val_t depth = api_query_int(path, EL_STR("depth"), 0);
-  depth = ({ el_val_t _if_result_49 = 0; if ((depth == 0)) { _if_result_49 = (json_get_int(body, EL_STR("max_depth"))); } else { _if_result_49 = (depth); } _if_result_49; });
-  depth = ({ el_val_t _if_result_50 = 0; if ((depth == 0)) { _if_result_50 = (1); } else { _if_result_50 = (depth); } _if_result_50; });
+  depth = ({ el_val_t _if_result_53 = 0; if ((depth == 0)) { _if_result_53 = (json_get_int(body, EL_STR("max_depth"))); } else { _if_result_53 = (depth); } _if_result_53; });
+  depth = ({ el_val_t _if_result_54 = 0; if ((depth == 0)) { _if_result_54 = (1); } else { _if_result_54 = (depth); } _if_result_54; });
   el_val_t resolved = entity_id;
-  resolved = ({ el_val_t _if_result_51 = 0; if (str_eq(resolved, EL_STR(""))) { _if_result_51 = (({ el_val_t _if_result_52 = 0; if ((str_eq(name, EL_STR("self")) || str_eq(name, EL_STR("neuron")))) { _if_result_52 = (EL_STR("kn-efeb4a5b-5aff-4759-8a97-7233099be6ee")); } else { _if_result_52 = (({ el_val_t _if_result_53 = 0; if ((str_eq(name, EL_STR("values")) || str_eq(name, EL_STR("values_hub")))) { _if_result_53 = (EL_STR("kn-5b606390-a52d-4ca2-8e0e-eba141d13440")); } else { _if_result_53 = (EL_STR("")); } _if_result_53; })); } _if_result_52; })); } else { _if_result_51 = (resolved); } _if_result_51; });
+  resolved = ({ el_val_t _if_result_55 = 0; if (str_eq(resolved, EL_STR(""))) { _if_result_55 = (({ el_val_t _if_result_56 = 0; if ((str_eq(name, EL_STR("self")) || str_eq(name, EL_STR("neuron")))) { _if_result_56 = (EL_STR("kn-efeb4a5b-5aff-4759-8a97-7233099be6ee")); } else { _if_result_56 = (({ el_val_t _if_result_57 = 0; if ((str_eq(name, EL_STR("values")) || str_eq(name, EL_STR("values_hub")))) { _if_result_57 = (EL_STR("kn-5b606390-a52d-4ca2-8e0e-eba141d13440")); } else { _if_result_57 = (EL_STR("")); } _if_result_57; })); } _if_result_56; })); } else { _if_result_55 = (resolved); } _if_result_55; });
   if (str_eq(resolved, EL_STR(""))) {
     return api_err(EL_STR("entity_id or name required. Known names: self, neuron, values, values_hub"));
   }
@@ -525,7 +594,7 @@ el_val_t handle_api_link_entities(el_val_t body) {
     return api_err_protected(to_id);
   }
   el_val_t relation = json_get(body, EL_STR("relation"));
-  el_val_t eff_relation = ({ el_val_t _if_result_54 = 0; if (str_eq(relation, EL_STR(""))) { _if_result_54 = (EL_STR("associates")); } else { _if_result_54 = (relation); } _if_result_54; });
+  el_val_t eff_relation = ({ el_val_t _if_result_58 = 0; if (str_eq(relation, EL_STR(""))) { _if_result_58 = (EL_STR("associates")); } else { _if_result_58 = (relation); } _if_result_58; });
   engram_connect(from_id, to_id, el_from_float(0.5), eff_relation);
   return el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"from_id\":\""), from_id), EL_STR("\",\"to_id\":\"")), to_id), EL_STR("\",\"relation\":\"")), eff_relation), EL_STR("\"}"));
   return 0;
@@ -540,7 +609,7 @@ el_val_t handle_api_forget(el_val_t body) {
     return api_err_protected(node_id);
   }
   mem_forget(node_id);
-  return el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"id\":\""), node_id), EL_STR("\"}"));
+  return el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"id\":\""), node_id), EL_STR("\",\"tombstoned\":true}"));
   return 0;
 }
 
@@ -554,8 +623,8 @@ el_val_t handle_api_evolve_memory(el_val_t body) {
     return api_err_protected(prior_id);
   }
   el_val_t importance = json_get(body, EL_STR("importance"));
-  el_val_t sal_str = ({ el_val_t _if_result_55 = 0; if (str_eq(importance, EL_STR("critical"))) { _if_result_55 = (EL_STR("0.95")); } else { _if_result_55 = (({ el_val_t _if_result_56 = 0; if (str_eq(importance, EL_STR("high"))) { _if_result_56 = (EL_STR("0.75")); } else { _if_result_56 = (({ el_val_t _if_result_57 = 0; if (str_eq(importance, EL_STR("low"))) { _if_result_57 = (EL_STR("0.25")); } else { _if_result_57 = (EL_STR("0.50")); } _if_result_57; })); } _if_result_56; })); } _if_result_55; });
-  el_val_t sal = ({ el_val_t _if_result_58 = 0; if (str_eq(sal_str, EL_STR("0.95"))) { _if_result_58 = (el_from_float(0.95)); } else { _if_result_58 = (({ el_val_t _if_result_59 = 0; if (str_eq(sal_str, EL_STR("0.75"))) { _if_result_59 = (el_from_float(0.75)); } else { _if_result_59 = (({ el_val_t _if_result_60 = 0; if (str_eq(sal_str, EL_STR("0.25"))) { _if_result_60 = (el_from_float(0.25)); } else { _if_result_60 = (el_from_float(0.5)); } _if_result_60; })); } _if_result_59; })); } _if_result_58; });
+  el_val_t sal_str = ({ el_val_t _if_result_59 = 0; if (str_eq(importance, EL_STR("critical"))) { _if_result_59 = (EL_STR("0.95")); } else { _if_result_59 = (({ el_val_t _if_result_60 = 0; if (str_eq(importance, EL_STR("high"))) { _if_result_60 = (EL_STR("0.75")); } else { _if_result_60 = (({ el_val_t _if_result_61 = 0; if (str_eq(importance, EL_STR("low"))) { _if_result_61 = (EL_STR("0.25")); } else { _if_result_61 = (EL_STR("0.50")); } _if_result_61; })); } _if_result_60; })); } _if_result_59; });
+  el_val_t sal = ({ el_val_t _if_result_62 = 0; if (str_eq(sal_str, EL_STR("0.95"))) { _if_result_62 = (el_from_float(0.95)); } else { _if_result_62 = (({ el_val_t _if_result_63 = 0; if (str_eq(sal_str, EL_STR("0.75"))) { _if_result_63 = (el_from_float(0.75)); } else { _if_result_63 = (({ el_val_t _if_result_64 = 0; if (str_eq(sal_str, EL_STR("0.25"))) { _if_result_64 = (el_from_float(0.25)); } else { _if_result_64 = (el_from_float(0.5)); } _if_result_64; })); } _if_result_63; })); } _if_result_62; });
   el_val_t tags = EL_STR("[\"Memory\",\"evolved\"]");
   el_val_t new_id = engram_node_full(content, EL_STR("Memory"), EL_STR("memory:evolved"), el_from_float(sal), el_from_float(sal), el_from_float(0.9), EL_STR("Episodic"), tags);
   if (!str_eq(prior_id, EL_STR("")) && !str_eq(new_id, EL_STR(""))) {
@@ -577,8 +646,11 @@ el_val_t handle_api_memory_delete(el_val_t body) {
   if (str_eq(existing, EL_STR("{}"))) {
     return api_err(el_str_concat(EL_STR("memory not found: "), node_id));
   }
-  mem_forget(node_id);
-  return el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"id\":\""), node_id), EL_STR("\",\"deleted\":true}"));
+  el_val_t marker = tombstone_node(node_id);
+  if (str_eq(marker, EL_STR(""))) {
+    return api_err(el_str_concat(EL_STR("tombstone failed: "), node_id));
+  }
+  return el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"id\":\""), node_id), EL_STR("\",\"tombstoned\":true}"));
   return 0;
 }
 
@@ -627,7 +699,7 @@ el_val_t handle_api_cultivate(el_val_t body) {
       return api_err(EL_STR("content is required"));
     }
     el_val_t importance = json_get(body, EL_STR("importance"));
-    el_val_t sal = ({ el_val_t _if_result_61 = 0; if (str_eq(importance, EL_STR("critical"))) { _if_result_61 = (el_from_float(0.95)); } else { _if_result_61 = (({ el_val_t _if_result_62 = 0; if (str_eq(importance, EL_STR("high"))) { _if_result_62 = (el_from_float(0.75)); } else { _if_result_62 = (({ el_val_t _if_result_63 = 0; if (str_eq(importance, EL_STR("low"))) { _if_result_63 = (el_from_float(0.25)); } else { _if_result_63 = (el_from_float(0.5)); } _if_result_63; })); } _if_result_62; })); } _if_result_61; });
+    el_val_t sal = ({ el_val_t _if_result_65 = 0; if (str_eq(importance, EL_STR("critical"))) { _if_result_65 = (el_from_float(0.95)); } else { _if_result_65 = (({ el_val_t _if_result_66 = 0; if (str_eq(importance, EL_STR("high"))) { _if_result_66 = (el_from_float(0.75)); } else { _if_result_66 = (({ el_val_t _if_result_67 = 0; if (str_eq(importance, EL_STR("low"))) { _if_result_67 = (el_from_float(0.25)); } else { _if_result_67 = (el_from_float(0.5)); } _if_result_67; })); } _if_result_66; })); } _if_result_65; });
     el_val_t tags = EL_STR("[\"Memory\",\"evolved\",\"cultivated\"]");
     el_val_t new_id = engram_node_full(content, EL_STR("Memory"), EL_STR("memory:cultivated"), el_from_float(sal), el_from_float(sal), el_from_float(0.9), EL_STR("Episodic"), tags);
     if (!str_eq(prior_id, EL_STR("")) && !str_eq(new_id, EL_STR(""))) {
@@ -641,7 +713,7 @@ el_val_t handle_api_cultivate(el_val_t body) {
       return api_err(EL_STR("id is required"));
     }
     mem_forget(node_id);
-    return el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"id\":\""), node_id), EL_STR("\",\"cultivated\":true}"));
+    return el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"id\":\""), node_id), EL_STR("\",\"tombstoned\":true,\"cultivated\":true}"));
   }
   if (str_eq(op, EL_STR("link_entities"))) {
     el_val_t from_id = json_get(body, EL_STR("from_id"));
@@ -653,7 +725,7 @@ el_val_t handle_api_cultivate(el_val_t body) {
       return api_err(EL_STR("to_id is required"));
     }
     el_val_t relation = json_get(body, EL_STR("relation"));
-    el_val_t eff_relation = ({ el_val_t _if_result_64 = 0; if (str_eq(relation, EL_STR(""))) { _if_result_64 = (EL_STR("associates")); } else { _if_result_64 = (relation); } _if_result_64; });
+    el_val_t eff_relation = ({ el_val_t _if_result_68 = 0; if (str_eq(relation, EL_STR(""))) { _if_result_68 = (EL_STR("associates")); } else { _if_result_68 = (relation); } _if_result_68; });
     engram_connect(from_id, to_id, el_from_float(0.5), eff_relation);
     return el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"from_id\":\""), from_id), EL_STR("\",\"to_id\":\"")), to_id), EL_STR("\",\"relation\":\"")), eff_relation), EL_STR("\",\"cultivated\":true}"));
   }
@@ -663,7 +735,8 @@ el_val_t handle_api_cultivate(el_val_t body) {
 
 el_val_t handle_api_list_typed(el_val_t node_type, el_val_t path, el_val_t body) {
   el_val_t limit = api_query_int(path, EL_STR("limit"), 50);
-  return api_or_empty(engram_scan_nodes_by_type_json(node_type, limit, 0));
+  el_val_t raw = api_or_empty(engram_scan_nodes_by_type_json(node_type, limit, 0));
+  return memory_hide_tombstoned(raw, path);
   return 0;
 }
 

mcp-wrapper/src/main.el

@@ -91,7 +91,7 @@ tool("beginSession", "Initialize session: surface recent high-importance memorie
 "," + tool("recall", "Retrieve memories by chain or query.") +
 "," + tool("inspectMemories", "List recent memory nodes.") +
 "," + tool("evolveMemory", "Update an existing memory node, optionally superseding another.") +
-"," + tool("forget", "Remove a node from memory.") +
+"," + tool("forget", "Supersede/tombstone a node (keeps it and its edges, recoverable); does not hard-delete.") +
 "," + tool("pinNode", "Strengthen a node so it stays salient.") +
 // ── Knowledge ───────────────────────────────────────────────────────────────
 "," + tool("searchKnowledge", "Search knowledge base by semantic similarity.") +
@@ -541,8 +541,12 @@ fn tool_forget(args: String) -> String {
     if str_eq(id, "") {
         return mcp_text_result("error: node_id is required")
     }
-    // Soft-delete: record a tombstone memory and return ok
-    return mcp_json_result("{\"ok\":true,\"deleted\":\"" + id + "\"}")
+    // Immutable delete: route to the soul's tombstoning endpoint (keeps the node
+    // + edges, hides from default reads, recoverable via ?include_deleted).
+    // Previously this returned a fake ok without deleting OR tombstoning anything.
+    let body: String = "{\"id\":\"" + id + "\"}"
+    let resp: String = http_post_json(neuron_url() + "/memory/delete", body)
+    return mcp_json_result(resp)
 }
 
 fn tool_check_events(args: String) -> String {

memory.el

@@ -43,8 +43,32 @@ fn mem_strengthen(node_id: String) -> Void {
     engram_strengthen(node_id)
 }
 
+// mem_tombstone — immutable "delete": KEEP the node and all its edges; record a
+// Tombstone marker (content = target id, label "tombstone:<id>", wired with a
+// "tombstones" edge). Never engram_forget. Default bounded list reads hide
+// tombstoned nodes; ?include_deleted=1 recovers them. This is the ONE canonical
+// tombstone helper — every forget path routes through it. Defined here in
+// memory.el (imported first) so awareness.el and neuron-api.el can both call it.
+fn mem_tombstone(node_id: String) -> String {
+    let tags: String = "[\"Tombstone\",\"status:deleted\"]"
+    let marker: String = engram_node_full(
+        node_id, "Tombstone", "tombstone:" + node_id,
+        el_from_float(0.01), el_from_float(0.01), el_from_float(1.0),
+        "Episodic", tags)
+    if !str_eq(marker, "") {
+        engram_connect(marker, node_id, el_from_float(1.0), "tombstones")
+    }
+    return marker
+}
+
+// mem_forget — NOTE: no longer a hard delete. Engram nodes are immutable, so
+// this now TOMBSTONES (via mem_tombstone): the node and its edges are kept and
+// stay recoverable. Every caller (the /memory/forget route and the cultivate
+// forget op) is non-destructive as a result. Internal GC that genuinely needs
+// removal (session-summary replace, telemetry pruning) calls engram_forget
+// directly and is unaffected by this.
 fn mem_forget(node_id: String) -> Void {
-    engram_forget(node_id)
+    let _marker: String = mem_tombstone(node_id)
 }
 
 // mem_consolidate — structural scan plus salience-evolution pass.

neuron-api.el

@@ -104,6 +104,66 @@ fn api_not_persisted(id: String) -> String {
     return "{\"ok\":false,\"error\":\"write_not_persisted\",\"id\":\"" + id + "\"}"
 }
 
+// ── Immutability: tombstone instead of hard-delete ────────────────────────────
+//
+// Day-one rule: engram nodes are immutable. A "delete" must never engram_forget
+// (which frees the node and drops its incident edges). Instead we TOMBSTONE: the
+// original node and all its edges are KEPT and stay traversable; a small
+// Tombstone marker node records the deletion (content = target id, label
+// "tombstone:<id>"), wired to the target with a "tombstones" edge. Default
+// bounded list reads hide tombstoned nodes (memory_hide_tombstoned); internal
+// cognition and explicit ?include_deleted reads still see them.
+fn tombstone_node(id: String) -> String {
+    // Delegates to the canonical helper in memory.el (single source of truth).
+    return mem_tombstone(id)
+}
+
+// tombstoned_id_set — delimited "|id1|id2|" of every tombstoned target id.
+// Empty string when nothing is tombstoned (callers fast-path on that).
+fn tombstoned_id_set() -> String {
+    let markers: String = engram_scan_nodes_by_type_json("Tombstone", 5000, 0)
+    if str_eq(markers, "") || str_eq(markers, "[]") { return "" }
+    let n: Int = json_array_len(markers)
+    let acc: String = "|"
+    let i: Int = 0
+    while i < n {
+        let m: String = json_array_get(markers, i)
+        let tid: String = json_get(m, "content")
+        let acc = if str_eq(tid, "") { acc } else { acc + tid + "|" }
+        let i = i + 1
+    }
+    return acc
+}
+
+// memory_hide_tombstoned — drop tombstone markers and tombstoned nodes from a
+// scanned node array. BOUNDED use only (typed/paginated lists), NOT the full
+// graph scan: json_array_get is O(index), so a full pass is O(n^2). Safe for the
+// ~50-item memory list; a hard cap protects against a large limit. The full
+// /api/graph/nodes hide needs a runtime scan filter and is deferred (see PR).
+// ?include_deleted bypasses the filter (explicit traversal).
+fn memory_hide_tombstoned(raw: String, path: String) -> String {
+    if str_contains(path, "include_deleted") { return raw }
+    if str_eq(raw, "") || str_eq(raw, "[]") { return raw }
+    let dead: String = tombstoned_id_set()
+    if str_eq(dead, "") { return raw }
+    let n: Int = json_array_len(raw)
+    if n > 1000 { return raw }
+    let out: String = "["
+    let first: Bool = true
+    let i: Int = 0
+    while i < n {
+        let node: String = json_array_get(raw, i)
+        let nid: String = json_get(node, "id")
+        let ntype: String = json_get(node, "node_type")
+        let is_dead: Bool = !str_eq(nid, "") && str_contains(dead, "|" + nid + "|")
+        let keep: Bool = !str_eq(ntype, "Tombstone") && !is_dead
+        let out = if keep { if first { out + node } else { out + "," + node } } else { out }
+        let first = if keep { false } else { first }
+        let i = i + 1
+    }
+    return out + "]"
+}
+
 // ── Session ───────────────────────────────────────────────────────────────────
 
 // handle_api_begin_session — full context bootstrap.
@@ -191,25 +251,26 @@ fn handle_api_node_create(body: String) -> String {
     return "{\"id\":\"" + id + "\",\"ok\":true}"
 }
 
-// handle_api_node_delete — remove a node by id (engram_forget) and verify it is gone.
+// handle_api_node_delete — TOMBSTONE a node by id (immutable delete).
 // Backs /api/neuron/node/delete and the /api/neuron/memory/delete alias the UI calls.
+// The node and all its incident edges are KEPT; a Tombstone marker records the
+// deletion. Never engram_forget — engram nodes are immutable by design.
 fn handle_api_node_delete(body: String) -> String {
     let id: String = json_get(body, "id")
     if str_eq(id, "") { return api_err("id is required") }
-    // engram_forget removes the node + its incident edges from the live graph.
-    // Delete is NOT read-back-verified: engram_get_node_json can return a stale hit
-    // for a just-forgotten id because the id→index map is not rebuilt on forget.
-    // A stale hit would cause a false "delete_failed" on a successful deletion.
-    // This exception is correct: read-back-verify guards WRITES; for deletes,
-    // the graph endpoints (/api/graph/nodes) reflect the removal and are the source of truth.
-    engram_forget(id)
-    return "{\"ok\":true,\"id\":\"" + id + "\"}"
+    if is_protected_node(id) { return api_err_protected(id) }
+    let existing: String = engram_get_node_json(id)
+    if str_eq(existing, "{}") { return api_err("node not found: " + id) }
+    let marker: String = tombstone_node(id)
+    if str_eq(marker, "") { return api_err("tombstone failed: " + id) }
+    return "{\"ok\":true,\"id\":\"" + id + "\",\"tombstoned\":true}"
 }
 
 // handle_api_node_update — update a node's content/fields. There is no in-place
-// engram update builtin, so this recreates the node with merged fields and then
-// forgets the old one (only after the new node reads back). The id changes; the
-// response returns the new id and the replaced id so callers can re-point.
+// engram update builtin, so this creates a new node with merged fields and wires
+// a "supersedes" edge new->old. The original is KEPT (immutable); the id changes,
+// and the response returns the new id and the superseded id so callers re-point.
+// Mirrors handle_api_memory_update / evolve exactly. Never engram_forget.
 fn handle_api_node_update(body: String) -> String {
     let id: String = json_get(body, "id")
     if str_eq(id, "") { return api_err("id is required") }
@@ -240,8 +301,8 @@ fn handle_api_node_update(body: String) -> String {
         el_from_float(0.5), el_from_float(0.5), el_from_float(0.8),
         tier, tags)
     if !api_persisted(new_id) { return api_not_persisted(new_id) }
-    engram_forget(id)
-    return "{\"id\":\"" + new_id + "\",\"replaced\":\"" + id + "\",\"ok\":true}"
+    engram_connect(new_id, id, el_from_float(0.9), "supersedes")
+    return "{\"id\":\"" + new_id + "\",\"supersedes\":\"" + id + "\",\"ok\":true}"
 }
 
 // handle_api_recall — search or activate memory by query.
@@ -504,13 +565,15 @@ fn handle_api_link_entities(body: String) -> String {
     return "{\"ok\":true,\"from_id\":\"" + from_id + "\",\"to_id\":\"" + to_id + "\",\"relation\":\"" + eff_relation + "\"}"
 }
 
-// handle_api_forget — delete a node by ID. Blocked for protected identity nodes.
+// handle_api_forget — TOMBSTONE a node by ID (immutable; mem_forget now
+// tombstones). The node + edges are kept and recoverable. Blocked for protected
+// identity nodes.
 fn handle_api_forget(body: String) -> String {
     let node_id: String = json_get(body, "id")
     if str_eq(node_id, "") { return api_err("id is required") }
     if is_protected_node(node_id) { return api_err_protected(node_id) }
     mem_forget(node_id)
-    return "{\"ok\":true,\"id\":\"" + node_id + "\"}"
+    return "{\"ok\":true,\"id\":\"" + node_id + "\",\"tombstoned\":true}"
 }
 
 // handle_api_evolve_memory — evolve a Memory node. Blocked for protected identity nodes.
@@ -541,10 +604,10 @@ fn handle_api_evolve_memory(body: String) -> String {
 }
 
 // handle_api_memory_delete — POST /api/neuron/memory/delete {"id":"..."}.
-// Hard delete: engram_forget (via mem_forget) removes the node and all
-// incident edges from the engram store, so no soft-delete fallback is
-// needed. Existence is checked first because engram_forget silently
-// no-ops on unknown ids — a bad id must return an error, not fake success.
+// Immutable delete: TOMBSTONE via tombstone_node — the node and all its incident
+// edges are KEPT and stay traversable; a Tombstone marker records the deletion
+// and default bounded list reads hide it. Never engram_forget. Existence is
+// checked first so a bad id errors rather than faking success.
 // Blocked for protected identity nodes, same as /memory/forget.
 fn handle_api_memory_delete(body: String) -> String {
     let node_id: String = json_get(body, "id")
@@ -552,8 +615,10 @@ fn handle_api_memory_delete(body: String) -> String {
     if is_protected_node(node_id) { return api_err_protected(node_id) }
     let existing: String = engram_get_node_json(node_id)
     if str_eq(existing, "{}") { return api_err("memory not found: " + node_id) }
-    mem_forget(node_id)
-    return "{\"ok\":true,\"id\":\"" + node_id + "\",\"deleted\":true}"
+    // Immutable delete: tombstone, never mem_forget/engram_forget. Node + edges KEPT.
+    let marker: String = tombstone_node(node_id)
+    if str_eq(marker, "") { return api_err("tombstone failed: " + node_id) }
+    return "{\"ok\":true,\"id\":\"" + node_id + "\",\"tombstoned\":true}"
 }
 
 // handle_api_memory_update — POST /api/neuron/memory/update {"id","content"}.
@@ -623,8 +688,9 @@ fn handle_api_cultivate(body: String) -> String {
     if str_eq(op, "forget") {
         let node_id: String = json_get(body, "id")
         if str_eq(node_id, "") { return api_err("id is required") }
+        // Immutable: mem_forget now tombstones (keep node + edges), never hard-delete.
         mem_forget(node_id)
-        return "{\"ok\":true,\"id\":\"" + node_id + "\",\"cultivated\":true}"
+        return "{\"ok\":true,\"id\":\"" + node_id + "\",\"tombstoned\":true,\"cultivated\":true}"
     }
 
     if str_eq(op, "link_entities") {
@@ -646,7 +712,10 @@ fn handle_api_cultivate(body: String) -> String {
 // handle_api_list_typed — list nodes by node_type.
 fn handle_api_list_typed(node_type: String, path: String, body: String) -> String {
     let limit: Int = api_query_int(path, "limit", 50)
-    return api_or_empty(engram_scan_nodes_by_type_json(node_type, limit, 0))
+    let raw: String = api_or_empty(engram_scan_nodes_by_type_json(node_type, limit, 0))
+    // Hide tombstoned nodes from the default (bounded) memory list.
+    // ?include_deleted=1 returns them for explicit traversal.
+    return memory_hide_tombstoned(raw, path)
 }
 
 // ── Consolidate ───────────────────────────────────────────────────────────────