chore: regenerate dist/soul.c after rebasing onto main

A clean rebase is not a consistent build input: git resolves the compiled amalgam
as an ordinary file and picks a winner, so dist/soul.c ends up holding one side's
code and not the other. The stamp gate catches it; this commit fixes it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -9,29 +9,37 @@ on:
       - main
   workflow_dispatch:
 
+# Serialize all activity on the single GCE runner.
+# With build+deploy in the same workflow, a new push queues a single
+# workflow instance — not two competing ones — so the deploy job is
+# never orphaned by a cancellation race.
+concurrency:
+  group: neuron-runner
+  cancel-in-progress: false
+
 jobs:
   build:
     runs-on: ubuntu-latest
 
     steps:
+      - name: Free disk space
+        run: |
+          df -h /
+          docker system prune -af --volumes 2>/dev/null || true
+          df -h /
+
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Checkout foundation/el (ELP source for soul.el imports)
-        run: |
-          git clone https://git.neuralplatform.ai/neuron-technologies/el.git \
-            --depth=1 --branch=main \
-            ../foundation/el
-
       - name: Install build dependencies
         run: |
           apt-get update -qq
-          apt-get install -y gcc libcurl4-openssl-dev apt-transport-https ca-certificates
+          apt-get install -y gcc curl libcurl4-openssl-dev apt-transport-https ca-certificates
           echo "deb [trusted=yes] https://packages.cloud.google.com/apt cloud-sdk main" \
             > /etc/apt/sources.list.d/google-cloud-sdk.list
           apt-get update -qq && apt-get install -y google-cloud-cli
 
-      - name: Download El SDK from Artifact Registry
+      - name: Authenticate to GCP + stage PINNED El runtime
         env:
           GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
         run: |
@@ -39,100 +47,74 @@ jobs:
           gcloud auth activate-service-account --key-file=/tmp/gcp-key.json
           gcloud config set project neuron-785695
 
-          rm -rf /opt/el/dist /opt/el/runtime
-          mkdir -p /opt/el/dist/platform /opt/el/dist/bin /opt/el/runtime
+          # PINNED RUNTIME — do NOT pull "latest" from Artifact Registry.
+          # The ship-soul calls engram_prune_telemetry (awareness.el sync/heartbeat
+          # self-review). The latest published el-runtime-c no longer defines that
+          # symbol, so an unpinned build fails to LINK — which is exactly how a
+          # broken/handlerless soul reached prod before. Compile against the
+          # vendored release runtime v1.0.0-20260501: the exact runtime the merged
+          # ship-soul was verified against (verify-soul-contract GATE PASS +
+          # genesis boot survives + full safety-contact response). It is committed
+          # under vendor/ so the soul build is fully reproducible and never depends
+          # on a moving AR "latest".
+          rm -rf /opt/el/runtime
+          mkdir -p /opt/el/runtime
+          cp vendor/el-runtime/v1.0.0-20260501/el_runtime.c /opt/el/runtime/el_runtime.c
+          cp vendor/el-runtime/v1.0.0-20260501/el_runtime.h /opt/el/runtime/el_runtime.h
+          echo "El runtime PINNED to v1.0.0-20260501: $(ls /opt/el/runtime/)"
 
-          # Get latest version of each package
-          get_latest() {
-            gcloud artifacts versions list \
-              --repository=foundation-prod \
-              --location=us-central1 \
-              --project=neuron-785695 \
-              --package="$1" \
-              --sort-by="~createTime" \
-              --limit=1 \
-              --format="value(name)" 2>/dev/null | awk -F/ '{print $NF}'
-          }
-
-          ELC_VER=$(get_latest el-elc)
-          ELB_VER=$(get_latest el-elb)
-          RC_VER=$(get_latest el-runtime-c)
-          RH_VER=$(get_latest el-runtime-h)
-
-          echo "Downloading elc@${ELC_VER} elb@${ELB_VER} runtime@${RC_VER}"
-
-          gcloud artifacts generic download \
-            --repository=foundation-prod --location=us-central1 --project=neuron-785695 \
-            --package=el-elc --version="${ELC_VER}" \
-            --destination=/opt/el/dist/platform/
-
-          gcloud artifacts generic download \
-            --repository=foundation-prod --location=us-central1 --project=neuron-785695 \
-            --package=el-elb --version="${ELB_VER}" \
-            --destination=/opt/el/dist/bin/
-
-          gcloud artifacts generic download \
-            --repository=foundation-prod --location=us-central1 --project=neuron-785695 \
-            --package=el-runtime-c --version="${RC_VER}" \
-            --destination=/opt/el/runtime/
-
-          gcloud artifacts generic download \
-            --repository=foundation-prod --location=us-central1 --project=neuron-785695 \
-            --package=el-runtime-h --version="${RH_VER}" \
-            --destination=/opt/el/runtime/
-
-          # Downloaded files keep original names; rename to canonical paths
-          mv /opt/el/dist/platform/elc* /opt/el/dist/platform/elc 2>/dev/null || true
-          mv /opt/el/dist/bin/elb*       /opt/el/dist/bin/elb      2>/dev/null || true
-          mv /opt/el/runtime/el_runtime.c* /opt/el/runtime/el_runtime.c 2>/dev/null || true
-          mv /opt/el/runtime/el_runtime.h* /opt/el/runtime/el_runtime.h 2>/dev/null || true
-
-          chmod +x /opt/el/dist/platform/elc /opt/el/dist/bin/elb
-          echo "El SDK ready"
-          /opt/el/dist/platform/elc --version || true
-
-      - name: Generate ELP master declarations header
+      # neuron#133: CI compiles dist/soul.c, NOT the .el sources. On 2026-08-07 a
+      # build off main would have shipped an engine with none of five merged fixes,
+      # including a P0 safety fix, while main's source read as correct. The runner
+      # cannot regenerate the amalgam (elc needs 24GB+ virtual memory), but it can
+      # refuse to compile a stale one. Fails loudly with the recipe in the message.
+      - name: Verify dist/soul.c matches the sources
         run: |
-          {
-            printf '/* Auto-generated C forward declarations for ELP cross-module calls */\n'
-            printf '#pragma once\n'
-            printf '#include "el_runtime.h"\n'
-            printf '\n'
-            grep -h -E '^(el_val_t|void|int|char\*|const char\*)[[:space:]]+[a-zA-Z_][a-zA-Z0-9_]*[[:space:]]*\(' dist/*.c 2>/dev/null \
-              | grep ';$' | sort -u
-          } > dist/elp-c-decls.h
-          echo "Generated elp-c-decls.h with $(grep -c ';' dist/elp-c-decls.h 2>/dev/null || echo 0) declarations"
+          chmod +x tools/soulc-stamp.sh
+          ./tools/soulc-stamp.sh --check
 
       - name: Build neuron soul binary
         run: |
-          ELB=/opt/el/dist/bin/elb
-          ELC=/opt/el/dist/platform/elc
           RUNTIME=/opt/el/runtime
 
-          # Compile all El modules to C.
-          # This step will fail at link on Linux: the El compiler inlines imported
-          # modules into each module's .c file, producing duplicate strong symbol
-          # definitions. GNU ld rejects these; macOS ld accepts them silently.
-          # We capture the link failure and re-link manually below.
-          $ELB --elc=$ELC --runtime=$RUNTIME/el_runtime.c || true
-
-          # Re-link with soul.c listed first so its real main() (from the cgi block)
-          # wins over the stub main()s generated in every other module.
-          # --allow-multiple-definition tells GNU ld to pick the first definition
-          # for each duplicate symbol — safe here because all duplicates are identical
-          # (same El source compiled independently into multiple .c files).
+          # Compile the self-contained translation unit directly from dist/soul.c.
+          # dist/soul.c is the authoritative combined unit maintained in the repo —
+          # regenerated on macOS by running elb (which succeeds on arm64/macOS ld but
+          # fails on Linux due to duplicate strong symbols). We skip the elb step here
+          # entirely: elb on Linux would OOM the runner (elc uses 24GB+ virtual memory
+          # on a 16GB host) and we always restore from the repo's soul.c anyway.
           mkdir -p dist
-          OTHER_C=$(ls dist/*.c | grep -v '/soul\.c$' | sort | tr '\n' ' ')
-          cc -O2 -DHAVE_CURL \
+          # -rdynamic: the el runtime resolves the HTTP request handler (and the
+          # tool handlers) by NAME via dlsym(RTLD_DEFAULT, "handle_request").
+          # macOS exports these symbols freely, but glibc/Linux only makes symbols
+          # visible to dlsym if they are in the dynamic symbol table — so without
+          # -rdynamic the stripped Linux binary boots but returns "el-runtime: no
+          # http handler registered" for EVERY route (i.e. a soul that serves
+          # nothing). Same reason the Windows build links -Wl,--export-all-symbols.
+          cc -O2 -DHAVE_CURL -rdynamic \
             -I$RUNTIME \
-            dist/soul.c $OTHER_C \
+            dist/soul.c \
             $RUNTIME/el_runtime.c \
             -lssl -lcrypto -lcurl -lpthread -lm \
-            -Wl,--allow-multiple-definition \
             -o dist/neuron
 
+          # -s strips .symtab + debug for size. .dynsym (which -rdynamic populated
+          # with the dlsym-resolved handlers) is preserved, so the handler still
+          # resolves after stripping.
+          strip -s dist/neuron
           ls -lh dist/neuron
 
+      - name: Soul contract gate (HARD BLOCK — no destructive/stale soul publishes)
+        run: |
+          # Boots dist/neuron on a throwaway port with a throwaway HOME/engram/cgi
+          # (never touches ~/.neuron or any live service) and fails the build if any
+          # app-contract route is unanswered (PRESENCE) or any engram write route
+          # hard-deletes instead of tombstoning/superseding (IMMUTABILITY). Non-zero
+          # here blocks Publish -> Artifact Registry -> GKE deploy, so a stale or
+          # memory-destroying soul can never reach prod.
+          chmod +x dist/neuron scripts/verify-soul-contract.sh
+          bash scripts/verify-soul-contract.sh dist/neuron 7796
+
       - name: Smoke test
         run: |
           file dist/neuron
@@ -156,3 +138,220 @@ jobs:
 
           echo "Published neuron-soul@${VERSION}"
           rm -f /tmp/gcp-key.json
+
+  deploy:
+    runs-on: ubuntu-latest
+    needs: build
+    # Only deploy on push to main, not on PRs or manual workflow_dispatch without intent.
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+
+    env:
+      USE_GKE_GCLOUD_AUTH_PLUGIN: "True"
+
+    steps:
+      - name: Free disk space
+        run: |
+          df -h /
+          docker system prune -af --volumes 2>/dev/null || true
+          rm -rf /tmp/.act-* /tmp/act-* 2>/dev/null || true
+          df -h /
+
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install dependencies
+        run: |
+          apt-get update -qq
+          apt-get install -y --no-install-recommends \
+            ca-certificates curl apt-transport-https kubectl
+          echo "deb [trusted=yes] https://packages.cloud.google.com/apt cloud-sdk main" \
+            > /etc/apt/sources.list.d/google-cloud-sdk.list
+          apt-get update -qq && apt-get install -y google-cloud-cli google-cloud-cli-gke-gcloud-auth-plugin
+
+      - name: Authenticate to GCP
+        env:
+          GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
+        run: |
+          echo "${GCP_SA_KEY}" > /tmp/gcp-key.json
+          gcloud auth activate-service-account --key-file=/tmp/gcp-key.json
+          gcloud config set project neuron-785695
+          gcloud auth configure-docker us-central1-docker.pkg.dev --quiet
+
+      - name: Get GKE credentials
+        run: |
+          gcloud container clusters get-credentials neuron-platform \
+            --region=us-central1 \
+            --project=neuron-785695
+
+      - name: Determine image tag and slot
+        id: vars
+        run: |
+          # GITEA_SHA is set by the Gitea runner; fall back to GITHUB_SHA for
+          # compatibility with older Forgejo/Gitea versions.
+          RAW_SHA="${GITEA_SHA:-${GITHUB_SHA:-}}"
+          SHA="${RAW_SHA:0:8}"
+          if [ -z "$SHA" ]; then
+            # Last resort: read from git directly
+            SHA=$(git rev-parse --short=8 HEAD 2>/dev/null || echo "unknown")
+          fi
+          IMAGE="us-central1-docker.pkg.dev/neuron-785695/neuron-api/neuron-soul:${SHA}"
+          echo "sha=${SHA}" >> "$GITEA_OUTPUT"
+          echo "image=${IMAGE}" >> "$GITEA_OUTPUT"
+
+          # Determine which slot is currently idle (0 replicas = idle slot)
+          # If both are at 0 (fresh deploy), default to blue
+          BLUE_REPLICAS=$(kubectl get deployment/neuron-mcp-blue \
+            -n neuron-prod \
+            -o jsonpath='{.spec.replicas}' 2>/dev/null || echo "0")
+          GREEN_REPLICAS=$(kubectl get deployment/neuron-mcp-green \
+            -n neuron-prod \
+            -o jsonpath='{.spec.replicas}' 2>/dev/null || echo "0")
+
+          echo "  Blue replicas: ${BLUE_REPLICAS}"
+          echo "  Green replicas: ${GREEN_REPLICAS}"
+
+          if [ "${GREEN_REPLICAS}" -eq 0 ] && [ "${BLUE_REPLICAS}" -gt 0 ]; then
+            SLOT="green"
+          elif [ "${BLUE_REPLICAS}" -eq 0 ] && [ "${GREEN_REPLICAS}" -gt 0 ]; then
+            SLOT="blue"
+          else
+            # Fresh cluster or both idle — deploy to blue first
+            SLOT="blue"
+          fi
+
+          echo "slot=${SLOT}" >> "$GITEA_OUTPUT"
+          echo "  Deploying to slot: ${SLOT}"
+
+      - name: Prepare build artifacts
+        run: |
+          # Pre-download soul binary and El SDK so the Dockerfile can COPY them
+          # from the build context instead of authenticating inside the build.
+          mkdir -p build-artifacts
+
+          # ── soul binary ────────────────────────────────────────────────────────
+          # The build job (same workflow run) just published this version.
+          SOUL_VER=$(gcloud artifacts versions list \
+            --repository=foundation-prod \
+            --location=us-central1 \
+            --project=neuron-785695 \
+            --package=neuron-soul \
+            --sort-by="~createTime" \
+            --limit=1 \
+            --format="value(name)" 2>/dev/null | awk -F/ '{print $NF}')
+          echo "Downloading neuron-soul@${SOUL_VER}"
+          gcloud artifacts generic download \
+            --repository=foundation-prod \
+            --location=us-central1 \
+            --project=neuron-785695 \
+            --package=neuron-soul \
+            --version="${SOUL_VER}" \
+            --destination=build-artifacts/
+          mv build-artifacts/neuron* build-artifacts/neuron 2>/dev/null || true
+          chmod +x build-artifacts/neuron
+
+          # ── El SDK (for engram source compilation inside the Docker build) ────
+          ELC_VER=$(gcloud artifacts versions list \
+            --repository=foundation-prod --location=us-central1 --project=neuron-785695 \
+            --package=el-elc --sort-by="~createTime" --limit=1 \
+            --format="value(name)" 2>/dev/null | awk -F/ '{print $NF}')
+          gcloud artifacts generic download \
+            --repository=foundation-prod --location=us-central1 --project=neuron-785695 \
+            --package=el-elc --version="${ELC_VER}" --destination=build-artifacts/
+          mv build-artifacts/elc* build-artifacts/elc 2>/dev/null || true
+          chmod +x build-artifacts/elc
+
+          RC_VER=$(gcloud artifacts versions list \
+            --repository=foundation-prod --location=us-central1 --project=neuron-785695 \
+            --package=el-runtime-c --sort-by="~createTime" --limit=1 \
+            --format="value(name)" 2>/dev/null | awk -F/ '{print $NF}')
+          gcloud artifacts generic download \
+            --repository=foundation-prod --location=us-central1 --project=neuron-785695 \
+            --package=el-runtime-c --version="${RC_VER}" --destination=build-artifacts/
+          mv build-artifacts/el_runtime.c* build-artifacts/el_runtime.c 2>/dev/null || true
+
+          RH_VER=$(gcloud artifacts versions list \
+            --repository=foundation-prod --location=us-central1 --project=neuron-785695 \
+            --package=el-runtime-h --sort-by="~createTime" --limit=1 \
+            --format="value(name)" 2>/dev/null | awk -F/ '{print $NF}')
+          gcloud artifacts generic download \
+            --repository=foundation-prod --location=us-central1 --project=neuron-785695 \
+            --package=el-runtime-h --version="${RH_VER}" --destination=build-artifacts/
+          mv build-artifacts/el_runtime.h* build-artifacts/el_runtime.h 2>/dev/null || true
+
+          echo "Build artifacts ready:"
+          ls -lh build-artifacts/
+
+      - name: Clone engram source for Docker build context
+        run: |
+          # The Dockerfile builds engram from source (no published AR package).
+          # Clone the engram repo into ./engram/ so it's available in the build context.
+          git clone http://34.31.145.131/neuron-technologies/engram.git \
+            --depth=1 --branch=main \
+            engram
+          echo "Engram source ready at ./engram/src/server.el"
+
+      - name: Build and push Docker image
+        run: |
+          IMAGE="${{ steps.vars.outputs.image }}"
+
+          echo "Building ${IMAGE}..."
+          docker build \
+            --tag "${IMAGE}" \
+            --tag "us-central1-docker.pkg.dev/neuron-785695/neuron-api/neuron-soul:latest" \
+            .
+
+          echo "Pushing ${IMAGE}..."
+          docker push "${IMAGE}"
+          docker push "us-central1-docker.pkg.dev/neuron-785695/neuron-api/neuron-soul:latest"
+
+      - name: Blue-green deploy to GKE
+        run: |
+          chmod +x scripts/blue-green-deploy.sh
+          scripts/blue-green-deploy.sh \
+            --image "${{ steps.vars.outputs.image }}" \
+            --slot "${{ steps.vars.outputs.slot }}"
+
+      - name: Update infrastructure manifests
+        if: success()
+        env:
+          INFRA_GIT_TOKEN: ${{ secrets.INFRA_GIT_TOKEN }}
+        run: |
+          SLOT="${{ steps.vars.outputs.slot }}"
+          if [ "$SLOT" = "blue" ]; then IDLE="green"; else IDLE="blue"; fi
+
+          git clone "http://${INFRA_GIT_TOKEN}@34.31.145.131/neuron-technologies/infrastructure.git" \
+            --depth=1 --branch=main /tmp/infra-update
+
+          cd /tmp/infra-update
+
+          DEPLOY_DIR="platform/k8s/neuron-mcp"
+          sed -i "s/^  replicas: .*/  replicas: 1/" "${DEPLOY_DIR}/deployment-${SLOT}.yaml"
+          sed -i "s/^  replicas: .*/  replicas: 0/" "${DEPLOY_DIR}/deployment-${IDLE}.yaml"
+          echo "  deployment-${SLOT}.yaml: replicas set to 1"
+          echo "  deployment-${IDLE}.yaml: replicas set to 0"
+
+          git config user.email "ci@neurontechnologies.ai"
+          git config user.name "Neuron CI"
+          git add "${DEPLOY_DIR}/deployment-blue.yaml" "${DEPLOY_DIR}/deployment-green.yaml"
+          git diff --staged --quiet && { echo "No manifest changes needed"; exit 0; }
+          git commit -m "ci: neuron-mcp replica sync after blue-green swap to ${SLOT}"
+          git push origin main
+          echo "Infrastructure manifests updated: ${SLOT}=1, ${IDLE}=0"
+
+      - name: Verify deployment
+        run: |
+          SLOT="${{ steps.vars.outputs.slot }}"
+          echo "Verifying neuron-mcp-${SLOT} is healthy..."
+          kubectl rollout status deployment/"neuron-mcp-${SLOT}" \
+            --namespace=neuron-prod \
+            --timeout=8m
+
+          echo "Active service endpoints:"
+          kubectl get endpoints neuron-mcp -n neuron-prod
+
+          echo "Pod status:"
+          kubectl get pods -n neuron-prod -l app=neuron-mcp
+
+      - name: Cleanup
+        if: always()
+        run: rm -f /tmp/gcp-key.json

.gitea/workflows/deploy-gke.yaml

@@ -1,16 +1,13 @@
-name: Deploy Soul to GKE
+name: Deploy Soul to GKE (manual)
 
-# Triggers on push to main — after the soul binary is built and published
-# by ci.yaml, this workflow builds the Docker image and blue-green deploys
-# to the neuron-prod namespace on GKE.
+# MANUAL OVERRIDE ONLY — push-triggered deploys now run as the 'deploy' job
+# in ci.yaml (needs: build), which eliminates the two-workflow concurrency
+# race that was cancelling queued deploy runs.
 #
-# This workflow runs AFTER ci.yaml has published the neuron-soul generic
-# artifact to Artifact Registry. The Docker build downloads that binary.
+# Use this workflow only when you need to deploy a specific slot manually
+# (e.g. rollback, force a slot override) without triggering a full CI build.
 
 on:
-  push:
-    branches:
-      - main
   workflow_dispatch:
     inputs:
       slot:
@@ -18,11 +15,26 @@ on:
         required: false
         default: "green"
 
+# Manual deploys still share the runner serialization group.
+concurrency:
+  group: neuron-runner
+  cancel-in-progress: false
+
 jobs:
   deploy:
     runs-on: ubuntu-latest
 
+    env:
+      USE_GKE_GCLOUD_AUTH_PLUGIN: "True"
+
     steps:
+      - name: Free disk space
+        run: |
+          df -h /
+          docker system prune -af --volumes 2>/dev/null || true
+          rm -rf /tmp/.act-* /tmp/act-* 2>/dev/null || true
+          df -h /
+
       - name: Checkout
         uses: actions/checkout@v4
 
@@ -53,7 +65,14 @@ jobs:
       - name: Determine image tag and slot
         id: vars
         run: |
-          SHA="${GITEA_SHA:0:8}"
+          # GITEA_SHA is set by the Gitea runner; fall back to GITHUB_SHA for
+          # compatibility with older Forgejo/Gitea versions.
+          RAW_SHA="${GITEA_SHA:-${GITHUB_SHA:-}}"
+          SHA="${RAW_SHA:0:8}"
+          if [ -z "$SHA" ]; then
+            # Last resort: read from git directly
+            SHA=$(git rev-parse --short=8 HEAD 2>/dev/null || echo "unknown")
+          fi
           IMAGE="us-central1-docker.pkg.dev/neuron-785695/neuron-api/neuron-soul:${SHA}"
           echo "sha=${SHA}" >> "$GITEA_OUTPUT"
           echo "image=${IMAGE}" >> "$GITEA_OUTPUT"
@@ -85,6 +104,66 @@ jobs:
           echo "slot=${SLOT}" >> "$GITEA_OUTPUT"
           echo "  Deploying to slot: ${SLOT}"
 
+      - name: Prepare build artifacts
+        run: |
+          # Pre-download soul binary and El SDK so the Dockerfile can COPY them
+          # from the build context instead of authenticating inside the build.
+          mkdir -p build-artifacts
+
+          # ── soul binary ────────────────────────────────────────────────────────
+          # ci.yaml publishes the soul binary to foundation-prod on every push.
+          # Download the latest version (the one just built by ci.yaml).
+          SOUL_VER=$(gcloud artifacts versions list \
+            --repository=foundation-prod \
+            --location=us-central1 \
+            --project=neuron-785695 \
+            --package=neuron-soul \
+            --sort-by="~createTime" \
+            --limit=1 \
+            --format="value(name)" 2>/dev/null | awk -F/ '{print $NF}')
+          echo "Downloading neuron-soul@${SOUL_VER}"
+          gcloud artifacts generic download \
+            --repository=foundation-prod \
+            --location=us-central1 \
+            --project=neuron-785695 \
+            --package=neuron-soul \
+            --version="${SOUL_VER}" \
+            --destination=build-artifacts/
+          mv build-artifacts/neuron* build-artifacts/neuron 2>/dev/null || true
+          chmod +x build-artifacts/neuron
+
+          # ── El SDK (for engram source compilation inside the build) ────────────
+          ELC_VER=$(gcloud artifacts versions list \
+            --repository=foundation-prod --location=us-central1 --project=neuron-785695 \
+            --package=el-elc --sort-by="~createTime" --limit=1 \
+            --format="value(name)" 2>/dev/null | awk -F/ '{print $NF}')
+          gcloud artifacts generic download \
+            --repository=foundation-prod --location=us-central1 --project=neuron-785695 \
+            --package=el-elc --version="${ELC_VER}" --destination=build-artifacts/
+          mv build-artifacts/elc* build-artifacts/elc 2>/dev/null || true
+          chmod +x build-artifacts/elc
+
+          RC_VER=$(gcloud artifacts versions list \
+            --repository=foundation-prod --location=us-central1 --project=neuron-785695 \
+            --package=el-runtime-c --sort-by="~createTime" --limit=1 \
+            --format="value(name)" 2>/dev/null | awk -F/ '{print $NF}')
+          gcloud artifacts generic download \
+            --repository=foundation-prod --location=us-central1 --project=neuron-785695 \
+            --package=el-runtime-c --version="${RC_VER}" --destination=build-artifacts/
+          mv build-artifacts/el_runtime.c* build-artifacts/el_runtime.c 2>/dev/null || true
+
+          RH_VER=$(gcloud artifacts versions list \
+            --repository=foundation-prod --location=us-central1 --project=neuron-785695 \
+            --package=el-runtime-h --sort-by="~createTime" --limit=1 \
+            --format="value(name)" 2>/dev/null | awk -F/ '{print $NF}')
+          gcloud artifacts generic download \
+            --repository=foundation-prod --location=us-central1 --project=neuron-785695 \
+            --package=el-runtime-h --version="${RH_VER}" --destination=build-artifacts/
+          mv build-artifacts/el_runtime.h* build-artifacts/el_runtime.h 2>/dev/null || true
+
+          echo "Build artifacts ready:"
+          ls -lh build-artifacts/
+
       - name: Clone engram source for Docker build context
         run: |
           # The Dockerfile builds engram from source (no published AR package).
@@ -95,16 +174,13 @@ jobs:
           echo "Engram source ready at ./engram/src/server.el"
 
       - name: Build and push Docker image
-        env:
-          GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
         run: |
           IMAGE="${{ steps.vars.outputs.image }}"
-          SHA="${{ steps.vars.outputs.sha }}"
 
           echo "Building ${IMAGE}..."
+          # No --secret needed: artifacts are pre-downloaded into build-artifacts/
+          # and the Dockerfile uses COPY to include them.
           docker build \
-            --build-arg SOUL_VERSION="${SHA}" \
-            --secret id=gcp_sa_key,env=GCP_SA_KEY \
             --tag "${IMAGE}" \
             --tag "us-central1-docker.pkg.dev/neuron-785695/neuron-api/neuron-soul:latest" \
             .
@@ -120,13 +196,40 @@ jobs:
             --image "${{ steps.vars.outputs.image }}" \
             --slot "${{ steps.vars.outputs.slot }}"
 
+      - name: Update infrastructure manifests
+        if: success()
+        env:
+          INFRA_GIT_TOKEN: ${{ secrets.INFRA_GIT_TOKEN }}
+        run: |
+          SLOT="${{ steps.vars.outputs.slot }}"
+          if [ "$SLOT" = "blue" ]; then IDLE="green"; else IDLE="blue"; fi
+
+          git clone "http://${INFRA_GIT_TOKEN}@34.31.145.131/neuron-technologies/infrastructure.git" \
+            --depth=1 --branch=main /tmp/infra-update
+
+          cd /tmp/infra-update
+
+          DEPLOY_DIR="platform/k8s/neuron-mcp"
+          sed -i "s/^  replicas: .*/  replicas: 1/" "${DEPLOY_DIR}/deployment-${SLOT}.yaml"
+          sed -i "s/^  replicas: .*/  replicas: 0/" "${DEPLOY_DIR}/deployment-${IDLE}.yaml"
+          echo "  deployment-${SLOT}.yaml: replicas set to 1"
+          echo "  deployment-${IDLE}.yaml: replicas set to 0"
+
+          git config user.email "ci@neurontechnologies.ai"
+          git config user.name "Neuron CI"
+          git add "${DEPLOY_DIR}/deployment-blue.yaml" "${DEPLOY_DIR}/deployment-green.yaml"
+          git diff --staged --quiet && { echo "No manifest changes needed"; exit 0; }
+          git commit -m "ci: neuron-mcp replica sync after blue-green swap to ${SLOT}"
+          git push origin main
+          echo "Infrastructure manifests updated: ${SLOT}=1, ${IDLE}=0"
+
       - name: Verify deployment
         run: |
           SLOT="${{ steps.vars.outputs.slot }}"
           echo "Verifying neuron-mcp-${SLOT} is healthy..."
           kubectl rollout status deployment/"neuron-mcp-${SLOT}" \
             --namespace=neuron-prod \
-            --timeout=3m
+            --timeout=8m
 
           echo "Active service endpoints:"
           kubectl get endpoints neuron-mcp -n neuron-prod

.gitignore

@@ -0,0 +1,11 @@
+# Compiled binaries
+dist/neuron
+dist/neuron.backup-*
+dist/*.backup-*
+
+# Build artifacts
+*.o
+*.a
+
+# macOS
+.DS_Store

Dockerfile

@@ -1,108 +1,28 @@
 # Neuron Soul — GKE container image
 #
 # Build strategy:
-#   1. Download the pre-built linux/amd64 soul binary (package: neuron-soul)
-#      from Artifact Registry (foundation-dev).
-#   2. Download the El SDK from Artifact Registry and build engram from source
-#      (the neuron-technologies/engram repo is a git submodule). Engram has
-#      never been published as a standalone Artifact Registry package.
-#   3. Package both in an Ubuntu 24.04 runtime image (GLIBC 2.39 required by
-#      binaries compiled on Ubuntu 24.04 CI runners).
+#   1. CI pre-downloads all artifacts from Artifact Registry into build-artifacts/
+#      (neuron soul binary, El compiler, El runtime). No GCP credentials are needed
+#      inside the build — all AR access happens in the CI workflow before docker build.
+#   2. Build engram from source (neuron-technologies/engram, cloned by CI into ./engram/).
+#   3. Package soul + engram in an Ubuntu 24.04 runtime image (GLIBC 2.39).
 #   4. entrypoint.sh starts engram on :8742, waits for it to be healthy,
 #      then starts the soul with ENGRAM_URL pointing at it (HTTP mode).
 #
+# Expected build context layout (prepared by deploy-gke.yaml before docker build):
+#   build-artifacts/neuron         — pre-built linux/amd64 soul binary
+#   build-artifacts/elc            — El compiler (for engram source compilation)
+#   build-artifacts/el_runtime.c   — El C runtime
+#   build-artifacts/el_runtime.h   — El C runtime header
+#   engram/src/server.el           — engram source (cloned by CI)
+#   entrypoint.sh                  — container entrypoint
+#
 # Required env vars (injected via ExternalSecret at runtime):
 #   NEURON_PORT, NEURON_LLM_0_URL, NEURON_LLM_0_KEY, NEURON_LLM_0_FORMAT,
 #   SOUL_CGI_ID, SOUL_IDENTITY, NEURON_TOKEN, NEURON_API_URL, ENGRAM_URL,
 #   ENGRAM_DATA_DIR
 
-ARG SOUL_VERSION=latest
-
-# ── Stage 1: Download neuron-soul + El SDK from Artifact Registry ─────────────
-FROM ubuntu:24.04 AS downloader
-
-ARG SOUL_VERSION
-
-RUN apt-get update -qq && \
-    apt-get install -y --no-install-recommends \
-      ca-certificates \
-      curl \
-      gnupg \
-      apt-transport-https && \
-    echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" \
-      > /etc/apt/sources.list.d/google-cloud-sdk.list && \
-    curl -fsSL https://packages.cloud.google.com/apt/doc/apt-key.gpg \
-      | gpg --dearmor -o /usr/share/keyrings/cloud.google.gpg && \
-    apt-get update -qq && \
-    apt-get install -y --no-install-recommends google-cloud-cli && \
-    rm -rf /var/lib/apt/lists/*
-
-RUN --mount=type=secret,id=gcp_sa_key \
-    GCP_SA_KEY=$(cat /run/secrets/gcp_sa_key 2>/dev/null || echo "") && \
-    if [ -n "$GCP_SA_KEY" ]; then \
-      echo "$GCP_SA_KEY" > /tmp/gcp-key.json && \
-      gcloud auth activate-service-account --key-file=/tmp/gcp-key.json; \
-    fi && \
-    gcloud config set project neuron-785695 && \
-    mkdir -p /tmp/soul /tmp/el-sdk && \
-    \
-    # ── soul ──────────────────────────────────────────────────────────────── \
-    if [ "${SOUL_VERSION}" = "latest" ]; then \
-      SOUL_VER=$(gcloud artifacts versions list \
-        --repository=foundation-dev \
-        --location=us-central1 \
-        --project=neuron-785695 \
-        --package=neuron-soul \
-        --sort-by="~createTime" \
-        --limit=1 \
-        --format="value(name)" 2>/dev/null | awk -F/ '{print $NF}'); \
-    else \
-      SOUL_VER="${SOUL_VERSION}"; \
-    fi && \
-    echo "Downloading neuron-soul@${SOUL_VER}" && \
-    gcloud artifacts generic download \
-      --repository=foundation-dev \
-      --location=us-central1 \
-      --project=neuron-785695 \
-      --package=neuron-soul \
-      --version="${SOUL_VER}" \
-      --destination=/tmp/soul/ && \
-    mv /tmp/soul/neuron* /tmp/soul/neuron 2>/dev/null || true && \
-    chmod +x /tmp/soul/neuron && \
-    \
-    # ── El SDK (needed to build engram from source) ────────────────────────── \
-    ELC_VER=$(gcloud artifacts versions list \
-      --repository=foundation-dev --location=us-central1 --project=neuron-785695 \
-      --package=el-elc --sort-by="~createTime" --limit=1 \
-      --format="value(name)" 2>/dev/null | awk -F/ '{print $NF}') && \
-    gcloud artifacts generic download \
-      --repository=foundation-dev --location=us-central1 --project=neuron-785695 \
-      --package=el-elc --version="${ELC_VER}" --destination=/tmp/el-sdk/ && \
-    mv /tmp/el-sdk/elc* /tmp/el-sdk/elc 2>/dev/null || true && \
-    chmod +x /tmp/el-sdk/elc && \
-    \
-    RC_VER=$(gcloud artifacts versions list \
-      --repository=foundation-dev --location=us-central1 --project=neuron-785695 \
-      --package=el-runtime-c --sort-by="~createTime" --limit=1 \
-      --format="value(name)" 2>/dev/null | awk -F/ '{print $NF}') && \
-    gcloud artifacts generic download \
-      --repository=foundation-dev --location=us-central1 --project=neuron-785695 \
-      --package=el-runtime-c --version="${RC_VER}" --destination=/tmp/el-sdk/ && \
-    mv /tmp/el-sdk/el_runtime.c* /tmp/el-sdk/el_runtime.c 2>/dev/null || true && \
-    \
-    RH_VER=$(gcloud artifacts versions list \
-      --repository=foundation-dev --location=us-central1 --project=neuron-785695 \
-      --package=el-runtime-h --sort-by="~createTime" --limit=1 \
-      --format="value(name)" 2>/dev/null | awk -F/ '{print $NF}') && \
-    gcloud artifacts generic download \
-      --repository=foundation-dev --location=us-central1 --project=neuron-785695 \
-      --package=el-runtime-h --version="${RH_VER}" --destination=/tmp/el-sdk/ && \
-    mv /tmp/el-sdk/el_runtime.h* /tmp/el-sdk/el_runtime.h 2>/dev/null || true && \
-    \
-    rm -f /tmp/gcp-key.json && \
-    echo "Downloads complete:" && ls -lh /tmp/soul/ /tmp/el-sdk/
-
-# ── Stage 2: Build engram from source ────────────────────────────────────────
+# ── Stage 1: Build engram from source ────────────────────────────────────────
 FROM ubuntu:24.04 AS engram-builder
 
 RUN apt-get update -qq && \
@@ -113,12 +33,13 @@ RUN apt-get update -qq && \
       libcurl4-openssl-dev && \
     rm -rf /var/lib/apt/lists/*
 
-COPY --from=downloader /tmp/el-sdk/elc           /usr/local/bin/elc
-COPY --from=downloader /tmp/el-sdk/el_runtime.c  /usr/local/lib/el/el_runtime.c
-COPY --from=downloader /tmp/el-sdk/el_runtime.h  /usr/local/lib/el/el_runtime.h
+# El SDK pre-downloaded by CI into build-artifacts/
+COPY build-artifacts/elc           /usr/local/bin/elc
+COPY build-artifacts/el_runtime.c  /usr/local/lib/el/el_runtime.c
+COPY build-artifacts/el_runtime.h  /usr/local/lib/el/el_runtime.h
+RUN chmod +x /usr/local/bin/elc
 
-# engram source is expected at ./engram/src/server.el in the build context.
-# The deploy-gke.yaml CI must clone neuron-technologies/engram alongside this repo.
+# engram source cloned by CI into ./engram/
 COPY engram/src/server.el /build/src/server.el
 
 RUN mkdir -p /build/dist && \
@@ -133,7 +54,7 @@ RUN mkdir -p /build/dist && \
     echo "Built engram:" && ls -lh /build/dist/engram && \
     chmod +x /build/dist/engram
 
-# ── Stage 3: Runtime image ───────────────────────────────────────────────────
+# ── Stage 2: Runtime image ───────────────────────────────────────────────────
 # Ubuntu 24.04: GLIBC 2.39 satisfies both neuron-soul and engram binary deps.
 FROM ubuntu:24.04
 
@@ -145,9 +66,10 @@ RUN apt-get update -qq && \
     rm -rf /var/lib/apt/lists/* && \
     useradd -r -u 10000 -m -s /bin/bash soul
 
-COPY --from=downloader    /tmp/soul/neuron        /usr/local/bin/neuron
-COPY --from=engram-builder /build/dist/engram     /usr/local/bin/engram
-COPY entrypoint.sh                                /usr/local/bin/entrypoint.sh
+# soul binary pre-downloaded by CI into build-artifacts/
+COPY build-artifacts/neuron        /usr/local/bin/neuron
+COPY --from=engram-builder /build/dist/engram /usr/local/bin/engram
+COPY entrypoint.sh                 /usr/local/bin/entrypoint.sh
 
 RUN chmod +x /usr/local/bin/neuron /usr/local/bin/engram /usr/local/bin/entrypoint.sh
 

PORT-NOTES.md

@@ -0,0 +1,139 @@
+# PORT-NOTES — openai tools port working state (2026-08-06, session handoff-safe)
+
+Spec: `docs/specs/SPEC-soul-openai-tools-v2-2026-08-06.md` (Tim-approved 2026-08-06). Tasks #1-5
+tracked in-session (1 ✓ wiring verdict, 2 ✓ stub rig, 3 in-progress = THIS, 4-5 pending).
+Worktree: HERE (`_wt-openai-tools`, branch `feat/soul-openai-tools-v2` @ dba755d). Round-9 trees
+READ-ONLY. Nothing committed yet.
+
+## Step-0 verdict (evidence in journal note ncli-653ba964dd76)
+Shipped app never wires the v1 lane: launcher exports `SOUL_LLM_MODEL/PROVIDER/BASE_URL` +
+`ANTHROPIC_API_KEY`+`SOUL_API_KEY` (= Keychain key for WHATEVER provider; installer/macos/
+neuron-daemons.sh:288-300 on hotfix/beta-round9); brain reads only SOUL_LLM_MODEL (chat.el:8) and
+NEURON_LLM_0_* (chat.el:1768-1794) which nothing sets. `/api/config` PATCH ignores llm_* fields
+(studio.el:36 handle_config: POST-only, reads model/provider/api_key only).
+**Bridge = brain-side ONLY (zero app-repo edits, zero round-9 collision):**
+- `llm_base_url()`: NEURON_LLM_0_URL → fallback SOUL_LLM_BASE_URL when SOUL_LLM_PROVIDER ∉ {"","anthropic"}
+- `llm_wire_format()`: NEURON_LLM_0_FORMAT → fallback derive from SOUL_LLM_PROVIDER (openai/grok/gemini/groq/ollama → "openai"; else "anthropic")
+- `agentic_api_key()`: already works (ANTHROPIC_API_KEY carries the provider key); add NEURON_LLM_0_KEY → SOUL_API_KEY fallback.
+
+## Design pins (stub asserts these — stub is green 58/58, tests/gate-openai/)
+- Request MUST send `"tool_choice":"auto"` (string) + `"parallel_tool_calls":false` explicitly.
+- `arguments` in tool_calls = JSON-ENCODED STRING; decode ONCE via json_get → feed dispatch_tool
+  verbatim. Stub's echo-mismatch check catches double-encode/decode (two-escaper trap).
+- Assistant echo turn: `{"role":"assistant","content":null,"tool_calls":[...]}` VERBATIM from response.
+- Feedback: `{"role":"tool","tool_call_id":"<id>","content":"<result string>"}`.
+- Resume must NOT re-answer an answered id (stub 400s on repeat tool_call_id).
+- Parallel tool_calls in a response: take FIRST only + log skip (mirror ADR-0005 stopgap); stub
+  scenario `parallel` proves behavior.
+- No tools in request when tools array empty/absent turns (boot probes) — stub defaults tolerate.
+
+## el idioms confirmed (from openai_chat_complete :1808-1854 + agentic_loop :2751-2838)
+- JSON: `json_get(s,k)` decoded string · `json_get_raw(s,k)` raw subtree · `json_array_len` ·
+  `json_array_get(arr,i)` · build by string concat + `json_escape()` (:1797, OpenAI-lane escaper).
+- HTTP: `let h: Map = {}` + `map_set(h,k,v)` + `http_post_with_headers(url, body, h)`;
+  Bearer auth via `Authorization` header when key non-empty (:1825-1830).
+- Loop-carried vars must be top-level locals in the fn, mutated as if-expressions at while-body
+  top level (see :2760-2791 pattern + comment :2903-2904 region).
+- Error shape: `str_starts_with(raw,"{\"error\"") || str_contains(raw,"\"error\":")` → return
+  `{"error":"llm unavailable","reply":""}` (:1835-1838).
+
+## Remaining read map (before writing the fork)
+- chat.el 2840-3200: block walk (2923-3000), policy gate (3009-3023: classify_tool_risk /
+  is_builtin_tool / ask_all / tool_auto_approved → needs_bridge), dispatch_tool call (3025),
+  tool_result feedback (3031, 3067-3072), run-progress ledger append (3078-3087), bridge_save
+  (3182), loop end + done envelope (~3100-3200).
+- agentic_resume 3227-3293 (hardcoded Anthropic headers to make wire-aware; blob gets `wire` field,
+  legacy default anthropic) · handle_tool_result 3293+ · dharma fork site 3465 (calls agentic_loop
+  direct, no use_openai check today).
+
+## Write plan (order)
+1. Env fallbacks (edit llm_base_url/llm_wire_format/agentic_api_key) — small, first, testable alone.
+2. `openai_tools_json(anthropic_tools: String) -> String` converter (walk array; per entry build
+   {"type":"function","function":{name,description,parameters:input_schema-raw}}).
+3. `openai_agentic_loop(...)` fork: same signature as agentic_loop minus Anthropic-only params;
+   INCLUDE run-progress ledger + tools_log + iteration cap 12; NO container_id/ws_drift/web_search
+   (out of scope; strip web_search entry from tools via agentic_tools_literal()+connector merge,
+   NOT _with_web()).
+4. Fork sites ×3: handle_chat_agentic :2695-2700 (route agentic to new loop when use_openai);
+   dharma :3465; agentic_resume wire-branch.
+5. `chat.elh` extern decls. 6. Compile (recipe: dist/ + elc/elb per neuron-soul-build-deploy memory;
+   round-9 tree soul.c regen'd 08-06 proves toolchain live). 7. Gate: stub selftest recipe in
+   tests/gate-openai/README.md. 8. Anthropic-lane regression via gate9 (READ-ONLY consume from
+   _wt-beta-round9). 9. Live Groq E2E (scratch profile, free port, key via Keychain read-only).
+
+## BUILD RECIPE — CORRECTED 2026-08-06 (the June memory is STALE for August code)
+`~/el-sdk/el_runtime.c` (Jun 15) is MISSING builtins the Aug engine calls (`engram_wm_count`,
+`engram_wm_top_json`, `http_delete_json`, `http_serve_async`) → link fails with
+"symbol(s) not found for architecture arm64". Use the REPO-PINNED runtime:
+```
+mkdir -p <scratch>
+elb --elc=$HOME/el-sdk/elc --runtime=vendor/el-runtime/v1.0.0-20260501 --out=<scratch>/
+   # "elb: link failed" at the end is EXPECTED and harmless — the per-module .c files are produced
+cc -std=c11 -O1 -DHAVE_CURL -rdynamic \
+   -I vendor/el-runtime/v1.0.0-20260501 -I <scratch> -I /opt/homebrew/opt/openssl@3/include \
+   -L /opt/homebrew/opt/openssl@3/lib \
+   -include dist/elp-c-decls.h -Wno-error=implicit-function-declaration \
+   -o <scratch>/soul <scratch>/*.c vendor/el-runtime/v1.0.0-20260501/el_runtime.c \
+   -lssl -lcrypto -lcurl -lpthread -lm
+```
+Source: `_engine-plainchat-20260805/README.md:396-412`. Verified today: 0 errors, 887,296 B.
+`elb` ALSO rewrites every `*.elh` in the tree (cosmetic em-dash→hyphen in the auto-gen banner,
+plus true-ups) and drops a stray `soul..elh` — `git restore` the unrelated ones and delete the
+stray before staging, or the diff drowns in noise.
+
+## SELF-REVIEW FIX LIST (found by reading my own diff, 2026-08-06 — apply in ONE batch, then rebuild once)
+- **F3 (CORRECTNESS, do first):** the assistant echo currently replays the provider's FULL
+  `tool_calls` array (`tc_arr`) while the loop answers only the FIRST call. If a provider ignores
+  `parallel_tool_calls:false`, the next request carries an assistant turn with N tool_calls and
+  only ONE `role:"tool"` response → most OpenAI-format providers 400 ("missing tool response for
+  id X") and the run dies. This is the same class as ADR-0005's Anthropic failure, but here it is
+  cheap to close: echo ONLY the honored call (`"[" + tc0 + "]"`), so the conversation we send is
+  self-consistent and the dropped call never existed from the model's view. The DRIFT log line
+  stays (honest accounting of what we dropped).
+- **F4 (efficiency/latency):** `handle_chat_agentic` computes `agentic_tools_all()` at ~:2681
+  BEFORE the fork, then the OpenAI branch computes `agentic_tools_no_web()` again — two
+  `connector_tools_json()` calls per turn, each an HTTP round-trip to the connector bridge on
+  :7771 (two timeout exposures). Fix: compute the tools array ONCE, per lane, after `use_openai`
+  is known (check no other use of `tools_json` sits between :2681 and the fork before moving it).
+  Note: `openai_tools_json()` already skips any entry with no `input_schema`, so Anthropic's
+  server-side `web_search` entry is auto-dropped even if the full array is passed —
+  `agentic_tools_no_web()` is kept for EXPLICITNESS, not necessity.
+- **F1 (debuggability):** the "no choices in response" branch logs a generic string and discards
+  the body. Log the response head (as the `is_error` branch does) — a provider that returns 200
+  with an unexpected shape is otherwise undiagnosable from the log.
+- **OPEN QUESTION (evidence pending from the gate):** the tool-result feedback turn escapes with
+  `json_escape()` (this lane's escaper) rather than `json_safe()` (used everywhere else). The
+  Anthropic lane escapes that field with NEITHER, which is a latent defect on that side. If the
+  torture scenario shows any escaping loss, switch to `json_safe` and note the Anthropic-side
+  finding for Will.
+
+## TEST HARNESS — built 2026-08-06 (Task 4 side-work, reusable by anyone)
+- `tests/run-el-test.sh <tests/test_x.el> | --all` — the engine tests were NEVER runnable
+  before this (`elc` is a compiler: emits C to stdout and exits). It emits the test to C,
+  compiles `soul.c` separately with `main` renamed away (soul.c owns the daemon's real main
+  but also defines `layered_cycle` et al.), links the remaining modules + the repo-pinned
+  runtime, and executes. Modules cached under `/tmp/el-test-<worktree>/`; `REBUILD=1` forces.
+- **The runner computes the verdict itself** because the test FILES cannot: all 9 counted
+  test files do `let pass_count = pass_count + 1` inside an if BLOCK, which El scoping
+  discards, so every summary line reads `0 passed, 0 failed` forever. Per-assertion
+  `PASS:`/`FAIL:` lines ARE reliable; the runner counts those, exits non-zero on any FAIL
+  or on zero assertions, and was proven to discriminate with a negative control (broken
+  assertion → 31 passed / 1 failed / exit 1). Real in-file fix filed: **neuron#116**.
+- `tests/test_bridge_serialization.el`: 4 `bridge_save` calls updated for the new `wire`
+  argument, plus **Section 9** (8 new assertions) covering wire round-trip both ways, the
+  legacy no-wire blob (resumes as anthropic), and a FIELD-ORDER decoy guard — a fake
+  `"wire":"anthropic"` planted inside `messages_raw` must not beat the blob's own scalar.
+  That decoy is the round-9 first-match-scanner bug class, now pinned by a test. **32/32 green.**
+
+## MEMORY-SAVE CAVEAT RESOLVED 2026-08-06
+Earlier saves this session reported `-> OUTBOX only (real mind unreachable or read-back
+failed)`. That was a **read-back verifier false negative, not data loss** — a direct
+`POST :7770/api/neuron/recall` returns those notes from the live mind verbatim. Another
+terminal was fixing exactly this (multi-word read-back probe) the same afternoon. Do NOT
+re-save on an OUTBOX report without first querying the mind directly, or you duplicate nodes.
+
+## Standing cautions
+- PERSIST OFF on the real mind this boot (neuron#98/#92): journal saves only, ferry later. MCP link
+  down this terminal; use neuron_remember.py / neuron_recall.py.
+- Aug-16: Groq retires llama-3.3-70b-versatile (separate P0, Tim's call, catalog swap).
+- Never bind 7770/7779/17779; never touch ~/.neuron; round-9 worktrees read-only.

awareness.el

@@ -17,19 +17,23 @@ fn idle_reset() -> Void {
 }
 
 // ise_post — write an InternalStateEvent to the authoritative Engram HTTP backend.
-// Reads SOUL_ISE_URL from env (or falls back to soul_engram_url state key).
-// Falls back to local engram_node_full if neither is set.
+// Reads SOUL_ISE_URL from env, then the soul_engram_url state key, then a
+// compile-time default of http://localhost:8742.
+//
+// ROUTING HARDENING (2026-07-15 self-review): the old "URL empty → write to
+// in-process store" fallback silently swallowed the entire ISE stream when
+// state_get("soul_engram_url") started returning "" mid-uptime (observed at
+// boot 4, ~16h in, on the post-arena-leak-fix binary: 1234 heartbeats landed
+// in the local snapshot while the authoritative store went dark for hours —
+// indistinguishable from a dead loop from the outside). The authoritative
+// address is a well-known localhost constant; never let a corruptible state
+// read decide where telemetry goes. The in-process write remains only as a
+// last resort when the HTTP POST itself fails, and is tagged ise-fallback-local
+// so misrouting is visible in the stream instead of silent.
 fn ise_post(content: String) -> Void {
     let ise_url: String = env("SOUL_ISE_URL")
-    let engram_url: String = if str_eq(ise_url, "") { state_get("soul_engram_url") } else { ise_url }
-    if str_eq(engram_url, "") {
-        let discard: String = engram_node_full(
-            content, "InternalStateEvent", "state-event",
-            el_from_float(0.3), el_from_float(0.3), el_from_float(0.8),
-            "Episodic", "[\"internal-state\",\"InternalStateEvent\"]"
-        )
-        return ""
-    }
+    let state_url: String = if str_eq(ise_url, "") { state_get("soul_engram_url") } else { ise_url }
+    let engram_url: String = if str_eq(state_url, "") { "http://localhost:8742" } else { state_url }
     // Proper JSON string escaping: backslashes first, then quotes, then control chars.
     // Previously only escaped " — this caused ise_post to produce malformed JSON when
     // content contained \n (backslash-n) from wm_top label escaping: the HTTP Engram
@@ -40,7 +44,23 @@ fn ise_post(content: String) -> Void {
     let safe3: String = str_replace(safe2, "\n", "\\n")
     let safe4: String = str_replace(safe3, "\r", "\\r")
     let body: String = "{\"content\":\"" + safe4 + "\"}"
-    let discard: String = http_post_json(engram_url + "/api/neuron/state-events", body)
+    let resp: String = http_post_json(engram_url + "/api/neuron/state-events", body)
+    if str_eq(resp, "") {
+        // HTTP Engram unreachable — keep the ISE locally rather than lose it,
+        // tagged so the misroute is observable when the snapshot is inspected.
+        // Count every failure: the tally surfaces in the heartbeat payload as
+        // ise_fail, so a silently-failing POST path is visible in the stream
+        // itself instead of only via snapshot forensics. (2026-07-16 self-review)
+        let fail_raw: String = state_get("soul.ise_fail_count")
+        let fail_n: Int = if str_eq(fail_raw, "") { 0 } else { str_to_int(fail_raw) }
+        state_set("soul.ise_fail_count", int_to_str(fail_n + 1))
+        let discard: String = engram_node_full(
+            content, "InternalStateEvent", "state-event",
+            el_from_float(0.3), el_from_float(0.3), el_from_float(0.8),
+            "Episodic", "[\"internal-state\",\"InternalStateEvent\",\"ise-fallback-local\"]"
+        )
+        return ""
+    }
     return ""
 }
 
@@ -105,6 +125,13 @@ fn emit_heartbeat() -> Void {
     let boot: String = if str_eq(boot_raw, "") { "0" } else { boot_raw }
     let idle: String = int_to_str(idle_count())
     let ts: Int = time_now()
+    // idle_ms (2026-07-30 self-review): wall-clock ms since the last inbound
+    // HTTP request (stamped in routes.el handle_request). This is the real
+    // "time since anyone talked to me" signal; the legacy tick-based idle
+    // field above only counts ticks since the last inbox synthesis-request
+    // and in practice always equals pulse. -1 = no request seen this boot.
+    let last_act_raw: String = state_get("soul.last_activity_ts")
+    let idle_ms: Int = if str_eq(last_act_raw, "") { 0 - 1 } else { ts - str_to_int(last_act_raw) }
     let nc: Int = engram_node_count()
     let ec: Int = engram_edge_count()
     let wmc: Int = engram_wm_count()
@@ -123,7 +150,165 @@ fn emit_heartbeat() -> Void {
     let up_ms: Int = elapsed_ms()
     let up_human: String = elapsed_human()
     let emb_ok: Int = embed_ok()
-    let payload: String = "{\"event\":\"heartbeat\",\"pulse\":" + pulse + ",\"boot\":" + boot + ",\"idle\":" + idle + ",\"node_count\":" + int_to_str(nc) + ",\"edge_count\":" + int_to_str(ec) + ",\"wm_active\":" + int_to_str(wmc) + ",\"wm_avg_weight\":" + wm_avg_str + ",\"wm_top\":" + wm_top + ",\"ts\":" + int_to_str(ts) + ",\"uptime_ms\":" + int_to_str(up_ms) + ",\"uptime\":\"" + up_human + "\",\"embed_ok\":" + int_to_str(emb_ok) + "}"
+    // ise_fail: cumulative count of ise_post HTTP failures this boot (each one
+    // fell back to a local in-process node). Nonzero and climbing = the HTTP
+    // Engram is unreachable and telemetry is silently diverging into the soul's
+    // local store. (2026-07-16 self-review)
+    let fail_raw: String = state_get("soul.ise_fail_count")
+    let fail_str: String = if str_eq(fail_raw, "") { "0" } else { fail_raw }
+    // tick: same counter as pulse — pulse now increments once per loop tick
+    // (see awareness_run), so it is a true liveness signal. Emitted under both
+    // names during the transition so dashboards keyed on either keep working.
+    // sync_added_total: cumulative nodes merged in by engram sync this boot.
+    // wm_delta: wm_active change since the previous heartbeat (state-tracked).
+    let sat_raw: String = state_get("soul.sync_added_total")
+    let sat_str: String = if str_eq(sat_raw, "") { "0" } else { sat_raw }
+    let prev_wm_raw: String = state_get("soul.prev_wm_active")
+    let prev_wm: Int = if str_eq(prev_wm_raw, "") { 0 } else { str_to_int(prev_wm_raw) }
+    let wm_delta: Int = wmc - prev_wm
+    state_set("soul.prev_wm_active", int_to_str(wmc))
+    // node_delta/edge_delta: growth since previous heartbeat (state-tracked, same
+    // mechanism as wm_delta). Absolute counts alone can't distinguish "healthy
+    // steady growth" from "stalled ingestion" or "runaway ISE flood" without
+    // diffing across the ISE stream by hand. (2026-07-19 self-review)
+    let prev_nc_raw: String = state_get("soul.prev_node_count")
+    let prev_nc: Int = if str_eq(prev_nc_raw, "") { nc } else { str_to_int(prev_nc_raw) }
+    let node_delta: Int = nc - prev_nc
+    state_set("soul.prev_node_count", int_to_str(nc))
+    let prev_ec_raw: String = state_get("soul.prev_edge_count")
+    let prev_ec: Int = if str_eq(prev_ec_raw, "") { ec } else { str_to_int(prev_ec_raw) }
+    let edge_delta: Int = ec - prev_ec
+    state_set("soul.prev_edge_count", int_to_str(ec))
+    // sync_age_ms: wall-clock ms since the last SUCCESSFUL engram sync merge
+    // (-1 = never synced this boot). sync_added_total alone can't show that
+    // sync stopped happening — a stale running total looks identical to a
+    // quiet-but-healthy sync. Age makes overdue-ness directly observable:
+    // sync_age_ms >> SOUL_REFRESH_MS means the refresh path is broken.
+    // (2026-07-19 self-review)
+    let sync_ok_raw: String = state_get("soul.last_sync_ok_ts")
+    let sync_age: Int = if str_eq(sync_ok_raw, "") { 0 - 1 } else { ts - str_to_int(sync_ok_raw) }
+    // Embedding pump + real coverage (2026-07-25 self-review): the
+    // authoritative :8742 store's lazy backfill only runs inside
+    // engram_activate, and nothing calls /api/activate there in production —
+    // embedded_count stalled at 93/12175 after a restart from a snapshot
+    // without vectors. Pump up to 32 embeds per heartbeat via the new
+    // /api/embed-backfill route (route persists the snapshot when it embeds
+    // anything, so vectors survive the next restart; self-limiting once
+    // coverage is full) and surface the store's true coverage here.
+    // embed_ok alone is misleading — it pings the Ollama root, not the
+    // embed pipeline. embed_count=-1 means the route was unreachable.
+    // URL resolution mirrors ise_post: env -> state -> localhost constant.
+    let hb_env_url: String = env("SOUL_ISE_URL")
+    let hb_state_url: String = if str_eq(hb_env_url, "") { state_get("soul_engram_url") } else { hb_env_url }
+    let hb_engram_url: String = if str_eq(hb_state_url, "") { "http://localhost:8742" } else { hb_state_url }
+    let bf_resp: String = http_get(hb_engram_url + "/api/embed-backfill?n=32")
+    let bf_done_raw: String = json_get(bf_resp, "embedded")
+    let bf_done: String = if str_eq(bf_done_raw, "") { "-1" } else { bf_done_raw }
+    let bf_total_raw: String = json_get(bf_resp, "embedded_count")
+    let bf_total: String = if str_eq(bf_total_raw, "") { "-1" } else { bf_total_raw }
+    // WM regime observability (2026-07-25 self-review): the "same 2 nodes
+    // pinned at a saturated cap" failure took cross-referencing the ISE
+    // stream by hand to spot. Make it one-glance: wm_saturated flags the
+    // cap-pinned regime; wm_top0_streak counts consecutive heartbeats with
+    // the same node in WM slot 0 (state-tracked, same mechanism as wm_delta).
+    let wm_sat: Int = if wmc >= 24 { 1 } else { 0 }
+    // Saturation TRANSITION event (2026-08-01 self-review): wm_saturated is a
+    // sampled boolean — the 0→1 onset and 1→0 release moments were only
+    // recoverable by diffing consecutive heartbeats by hand. Emit a discrete
+    // low-rate ISE at each edge, carrying the WM top-5 at that instant so the
+    // composition that CAUSED the regime change is captured, not the
+    // composition 59 seconds later. State-tracked like wm_delta; first beat
+    // of a boot never fires (prev defaults to current) — a restart is not a
+    // transition.
+    let prev_sat_raw: String = state_get("soul.prev_wm_saturated")
+    let prev_sat: Int = if str_eq(prev_sat_raw, "") { wm_sat } else { str_to_int(prev_sat_raw) }
+    if wm_sat != prev_sat {
+        let sat_dir: String = if wm_sat == 1 { "onset" } else { "release" }
+        ise_post("{\"event\":\"wm_saturation_transition\",\"direction\":\"" + sat_dir + "\",\"wm_active\":" + int_to_str(wmc) + ",\"wm_top\":" + wm_top + ",\"ts\":" + int_to_str(ts) + "}")
+    }
+    state_set("soul.prev_wm_saturated", int_to_str(wm_sat))
+    let wm_top0: String = json_array_get(wm_top, 0)
+    let wm_top0_id: String = json_get(wm_top0, "id")
+    let prev_top0: String = state_get("soul.prev_wm_top0")
+    let t0streak_raw: String = state_get("soul.wm_top0_streak")
+    let t0streak_prev: Int = if str_eq(t0streak_raw, "") { 0 } else { str_to_int(t0streak_raw) }
+    // 2026-07-26 self-review: guard the empty-id case — before the runtime
+    // emitted "id" in wm_top JSON, ""=="" incremented the streak every beat
+    // (streak measured uptime, not fixation). Empty id now resets to 0.
+    let t0streak: Int = if str_eq(wm_top0_id, "") { 0 } else { if str_eq(wm_top0_id, prev_top0) { t0streak_prev + 1 } else { 1 } }
+    state_set("soul.prev_wm_top0", wm_top0_id)
+    state_set("soul.wm_top0_streak", int_to_str(t0streak))
+    // wm_churn (2026-07-26 self-review): count of current top-5 WM ids absent
+    // from the previous heartbeat's top-5. Distinguishes "one stuck node"
+    // (churn 4) from "whole WM frozen" (churn 0) at a glance — the 07-26
+    // frozen-anchor diagnosis took cross-referencing ISE streams by hand.
+    let ch_id1: String = json_get(json_array_get(wm_top, 1), "id")
+    let ch_id2: String = json_get(json_array_get(wm_top, 2), "id")
+    let ch_id3: String = json_get(json_array_get(wm_top, 3), "id")
+    let ch_id4: String = json_get(json_array_get(wm_top, 4), "id")
+    let prev_top5: String = state_get("soul.prev_wm_top5")
+    let ch0: Int = if str_eq(wm_top0_id, "") { 0 } else { if str_contains(prev_top5, wm_top0_id) { 0 } else { 1 } }
+    let ch1: Int = if str_eq(ch_id1, "") { 0 } else { if str_contains(prev_top5, ch_id1) { 0 } else { 1 } }
+    let ch2: Int = if str_eq(ch_id2, "") { 0 } else { if str_contains(prev_top5, ch_id2) { 0 } else { 1 } }
+    let ch3: Int = if str_eq(ch_id3, "") { 0 } else { if str_contains(prev_top5, ch_id3) { 0 } else { 1 } }
+    let ch4: Int = if str_eq(ch_id4, "") { 0 } else { if str_contains(prev_top5, ch_id4) { 0 } else { 1 } }
+    let wm_churn: Int = ch0 + ch1 + ch2 + ch3 + ch4
+    state_set("soul.prev_wm_top5", wm_top0_id + "|" + ch_id1 + "|" + ch_id2 + "|" + ch_id3 + "|" + ch_id4)
+    // wm_top0_wm: the leader's weight. A frozen anchor reads as a constant
+    // here; healthy rotation shows it moving with the promotion scores.
+    let wm_top0_wm_raw: String = json_get(wm_top0, "wm")
+    let wm_top0_wm: String = if str_eq(wm_top0_wm_raw, "") { "0" } else { wm_top0_wm_raw }
+    // Activation observability (2026-07-27 self-review; cumulative since
+    // 2026-07-31): counters from the runtime for the soul's own in-process
+    // store. wm_evicted / breakthroughs are now MONOTONIC process-lifetime
+    // totals (the old per-call values described only the LAST activate call,
+    // so this 60s heartbeat missed nearly every event — curiosity alone runs
+    // 2 activates per 30s between beats). We emit the cumulative totals plus
+    // *_delta fields (change since the previous heartbeat, state-tracked the
+    // same way as node_delta). embed_breaker_open=1 means semantic activation
+    // is silently degraded to lexical-only until the Ollama circuit-breaker
+    // cooldown expires — the failure mode embed_ok structurally cannot see
+    // (it pings the Ollama root, not the embed pipeline).
+    let act_stats: String = engram_act_stats_json()
+    let act_evict_raw: String = json_get(act_stats, "wm_evicted")
+    let act_evict: String = if str_eq(act_evict_raw, "") { "-1" } else { act_evict_raw }
+    let act_bt_raw: String = json_get(act_stats, "breakthroughs")
+    let act_bt: String = if str_eq(act_bt_raw, "") { "-1" } else { act_bt_raw }
+    let evict_now: Int = if str_eq(act_evict_raw, "") { 0 - 1 } else { str_to_int(act_evict_raw) }
+    let bt_now: Int = if str_eq(act_bt_raw, "") { 0 - 1 } else { str_to_int(act_bt_raw) }
+    let prev_evict_raw: String = state_get("soul.prev_wm_evicted")
+    let prev_evict: Int = if str_eq(prev_evict_raw, "") { 0 } else { str_to_int(prev_evict_raw) }
+    let prev_bt_raw: String = state_get("soul.prev_breakthroughs")
+    let prev_bt: Int = if str_eq(prev_bt_raw, "") { 0 } else { str_to_int(prev_bt_raw) }
+    // Clamp deltas at 0: prev > now can only mean the counter restarted
+    // (fresh process) — report the new absolute count, not a negative delta.
+    let evict_delta: Int = if evict_now < 0 { 0 } else { if evict_now < prev_evict { evict_now } else { evict_now - prev_evict } }
+    let bt_delta: Int = if bt_now < 0 { 0 } else { if bt_now < prev_bt { bt_now } else { bt_now - prev_bt } }
+    if evict_now >= 0 { state_set("soul.prev_wm_evicted", int_to_str(evict_now)) }
+    if bt_now >= 0 { state_set("soul.prev_breakthroughs", int_to_str(bt_now)) }
+    // embed_eligible (2026-07-31 self-review): true denominator for embedding
+    // coverage on the authoritative :8742 store. Absolute embed_count alone
+    // invites the documented "~30% coverage, something is broken" misdiagnosis
+    // — most nodes are ISE/Tag/short-content and permanently ineligible.
+    // Real coverage = embed_count / embed_eligible. -1 = stats unreachable.
+    let hb_stats: String = http_get(hb_engram_url + "/api/stats")
+    let embed_elig_raw: String = json_get(hb_stats, "embed_eligible_count")
+    let embed_elig: String = if str_eq(embed_elig_raw, "") { "-1" } else { embed_elig_raw }
+    // auto_term_streak (2026-07-31): consecutive curiosity scans with the same
+    // auto seed term — already state-tracked by proactive_curiosity; surfaced
+    // here so the stuck-term failure is visible in the heartbeat stream too.
+    let hb_ats_raw: String = state_get("soul.auto_term_streak")
+    let hb_ats: Int = if str_eq(hb_ats_raw, "") { 0 } else { str_to_int(hb_ats_raw) }
+    let act_brk_raw: String = json_get(act_stats, "embed_breaker_open")
+    let act_brk: String = if str_eq(act_brk_raw, "") { "-1" } else { act_brk_raw }
+    // ctx_cos (2026-07-29 self-review): cos(query, context centroid) at the
+    // last activate call — the drift gauge for the new context-centroid
+    // scoring. ~1.0 aligned; low at domain-rotation boundaries is healthy;
+    // -2.0 pinned for hours means the centroid never initializes (embedder
+    // down) and semantic continuity is silently absent.
+    let ctx_cos_raw: String = json_get(act_stats, "ctx_cos")
+    let ctx_cos: String = if str_eq(ctx_cos_raw, "") { "-2" } else { ctx_cos_raw }
+    let payload: String = "{\"event\":\"heartbeat\",\"pulse\":" + pulse + ",\"tick\":" + pulse + ",\"boot\":" + boot + ",\"idle\":" + idle + ",\"idle_ms\":" + int_to_str(idle_ms) + ",\"node_count\":" + int_to_str(nc) + ",\"edge_count\":" + int_to_str(ec) + ",\"node_delta\":" + int_to_str(node_delta) + ",\"edge_delta\":" + int_to_str(edge_delta) + ",\"wm_active\":" + int_to_str(wmc) + ",\"wm_delta\":" + int_to_str(wm_delta) + ",\"wm_saturated\":" + int_to_str(wm_sat) + ",\"wm_top0_streak\":" + int_to_str(t0streak) + ",\"wm_churn\":" + int_to_str(wm_churn) + ",\"wm_top0_wm\":" + wm_top0_wm + ",\"sync_added_total\":" + sat_str + ",\"sync_age_ms\":" + int_to_str(sync_age) + ",\"wm_avg_weight\":" + wm_avg_str + ",\"wm_top\":" + wm_top + ",\"ts\":" + int_to_str(ts) + ",\"uptime_ms\":" + int_to_str(up_ms) + ",\"uptime\":\"" + up_human + "\",\"embed_ok\":" + int_to_str(emb_ok) + ",\"embed_backfilled\":" + bf_done + ",\"embed_count\":" + bf_total + ",\"embed_eligible\":" + embed_elig + ",\"wm_evicted\":" + act_evict + ",\"wm_evicted_delta\":" + int_to_str(evict_delta) + ",\"breakthroughs\":" + act_bt + ",\"breakthroughs_delta\":" + int_to_str(bt_delta) + ",\"auto_term_streak\":" + int_to_str(hb_ats) + ",\"embed_breaker_open\":" + act_brk + ",\"ctx_cos\":" + ctx_cos + ",\"ise_fail\":" + fail_str + "}"
     ise_post(payload)
 }
 
@@ -131,11 +316,11 @@ fn emit_heartbeat() -> Void {
 // during idle periods. Rotates through 4 domain sets on a wall-clock minute
 // cycle so no single topic dominates WM between heartbeats.
 //
-// KEY DESIGN: each seed set is split into INDIVIDUAL words and activated
-// separately. engram_activate uses istr_contains (substring matching) for
-// seed finding, so a multi-word phrase like "memory knowledge context" only
-// finds nodes that contain that EXACT phrase. Activating each word separately
-// hits hundreds of nodes per word, giving the graph a genuine WM workout.
+// KEY DESIGN (revised 2026-07-17): the seed set is activated ONCE as the full
+// phrase. engram_activate uses istr_contains (substring matching), so the
+// phrase matches few nodes — that is intentional: the old per-word split hit
+// hundreds of generic nodes per word and flooded the graph with activation
+// every scan. The top result is strengthened so the read feeds back.
 //
 // Unlike perceive(), this intentionally calls engram_activate_json to build
 // up WM weights. It only fires when the inbox is empty (no real work to do),
@@ -152,6 +337,89 @@ fn emit_heartbeat() -> Void {
 // a reserved/conflicting name in EL that compiles to EL_NULL at call sites.
 //
 // Returns true if any nodes were activated.
+// auto_term_try_slot — attempt to set cseed_auto from one WM slot.
+// Only writes to cseed_auto if node_type is Memory, BacklogItem, Entity, or
+// Knowledge AND the first word of the label is > 3 chars (guards
+// bracket-prefixed labels). Designed to be called in reverse slot order
+// (highest index first) so that the lowest-indexed slot (highest WM weight)
+// wins by last-write semantics.
+//
+// KNOWLEDGE ADMISSION (2026-07-23 self-review): WM top-10 is now dominated by
+// Knowledge nodes (world-ingestor titles + captures), so excluding Knowledge
+// left auto_term empty on EVERY curiosity_scan since boot 6 — the dynamic
+// seeding path was dead. Knowledge labels are real titles after the
+// neuron-api label fix. Sentinel-shaped labels ("knowledge:captured",
+// "memory:remembered" — colon, no space) carry no seed signal and are
+// skipped so legacy nodes cannot seed the scan with the word "knowledge".
+fn auto_term_try_slot(slot_type: String, slot_lbl: String) -> Void {
+    state_set("_ats_ok", "0")
+    if str_eq(slot_type, "Memory") { state_set("_ats_ok", "1") }
+    if str_eq(slot_type, "BacklogItem") { state_set("_ats_ok", "1") }
+    if str_eq(slot_type, "Entity") { state_set("_ats_ok", "1") }
+    if str_eq(slot_type, "Knowledge") { state_set("_ats_ok", "1") }
+    if str_contains(slot_lbl, ":") {
+        if !str_contains(slot_lbl, " ") { state_set("_ats_ok", "0") }
+    }
+    if str_eq(state_get("_ats_ok"), "1") {
+        if !str_eq(slot_lbl, "") {
+            let sp: Int = str_find_chars(slot_lbl, " :([")
+            if sp > 3 {
+                // GENRE-WORD BLOCKLIST (2026-07-23 self-review): world-ingestor
+                // titles open with classifier prefixes ("Method paper ...",
+                // "Theory paper ..."), so the first word is a genre tag, not a
+                // topic. Verified live: every scan after Knowledge admission
+                // seeded on 'Method'. Skip these; a lower-WM slot with a
+                // topical first word wins instead.
+                let term: String = str_slice(slot_lbl, 0, sp)
+                state_set("_ats_gw", "0")
+                if str_eq(term, "Method")    { state_set("_ats_gw", "1") }
+                if str_eq(term, "Theory")    { state_set("_ats_gw", "1") }
+                if str_eq(term, "Finding")   { state_set("_ats_gw", "1") }
+                if str_eq(term, "Survey")    { state_set("_ats_gw", "1") }
+                if str_eq(term, "Paper")     { state_set("_ats_gw", "1") }
+                if str_eq(term, "Knowledge") { state_set("_ats_gw", "1") }
+                if str_eq(term, "Value")     { state_set("_ats_gw", "1") }
+                // STOPWORD FILTER (2026-07-30 self-review): the genre
+                // blocklist above was whack-a-mole — observed live seeds
+                // included "What", "Colon", "Prose", "Context", "Self",
+                // "Closing", "Global", "Universal": English function words
+                // and document-structure words that pass the >3-char guard
+                // but carry no topical signal (a first-word extractor has no
+                // term-quality scoring). Single delimited membership test
+                // against a curated list of function words + title/structure
+                // words; topical technical terms (MemQ, AsymGRPO, Mobius,
+                // engram_goal_bias) pass untouched. Both Title-case and
+                // lowercase variants listed for the most common offenders.
+                let stopw: String = "|What|When|Where|Which|Whose|While|This|That|These|Those|There|Their|Then|Than|With|Without|From|Into|Onto|Over|Under|About|Between|Among|Across|Some|Most|More|Less|Very|Each|Every|Both|Also|Only|Just|Does|Will|Would|Could|Should|Might|Must|Have|Been|Being|Toward|Towards|Using|Based|Upon|Here|Your|Ours|They|Them|what|this|that|with|from|context|Context|Prose|Colon|Self|Test|Testing|Closing|Global|Universal|Persona|Semantic|Spreading|Temporal|Numeric|Register|Identifying|Introduction|Overview|Summary|Section|General|Notes|Note|"
+                if str_contains(stopw, "|" + term + "|") { state_set("_ats_gw", "1") }
+                // QUOTED-TITLE GUARD (2026-07-25 self-review): labels that
+                // open with a quote ('"The Algorithmic Caricature" ...')
+                // defeat the >3-char stopword guard — the extracted term
+                // '"The' is 4 chars and seeds a lexical flood on "The"
+                // (observed live: activated jumped 48 → 87). Any term
+                // carrying a quote character is not a topic word.
+                if str_contains(term, "\"") { state_set("_ats_gw", "1") }
+                if str_contains(term, "'")  { state_set("_ats_gw", "1") }
+                // AUTO-TERM TABU (2026-07-25 self-review): finst-style
+                // inhibition-of-return (ACT-R declarative finsts: small
+                // marker pool, hard exclusion). The last 4 selected auto
+                // terms are ineligible (~2 min at the 30s scan cadence),
+                // forcing rotation instead of "Fast-slow" every scan for
+                // hours. Empty tabu slots return "" from state_get and can
+                // never match — term is always > 3 chars here.
+                if str_eq(term, state_get("soul.tabu_t0")) { state_set("_ats_gw", "1") }
+                if str_eq(term, state_get("soul.tabu_t1")) { state_set("_ats_gw", "1") }
+                if str_eq(term, state_get("soul.tabu_t2")) { state_set("_ats_gw", "1") }
+                if str_eq(term, state_get("soul.tabu_t3")) { state_set("_ats_gw", "1") }
+                if str_eq(state_get("_ats_gw"), "0") {
+                    state_set("cseed_auto", term)
+                }
+            }
+        }
+    }
+    return ""
+}
+
 fn proactive_curiosity() -> Bool {
     let ts: Int = time_now()
     // Rotate seed set every minute using wall clock: (minutes_since_epoch) % 4.
@@ -195,53 +463,118 @@ fn proactive_curiosity() -> Bool {
     let curiosity_term_b: String = state_get("cseed_b")
     let curiosity_term_c: String = state_get("cseed_c")
 
-    // Activate each term independently so substring seed-finding hits many nodes.
-    // hops=1 (not 2): the in-process Engram has grown to 165K+ nodes. hops=2 BFS
-    // visits far more nodes and returns much larger JSON blobs. On a graph this
-    // large, hops=1 still activates all directly-related nodes AND triggers the
-    // semantic seed supplement (cosine sim ≥ 0.70 scan over all embedded nodes),
-    // giving broad working-memory coverage without the quadratic blowup of hops=2.
-    let curiosity_seed: String = curiosity_term_a + " " + curiosity_term_b + " " + curiosity_term_c
-    let results_a: String = engram_activate_json(curiosity_term_a, 1)
-    let results_b: String = engram_activate_json(curiosity_term_b, 1)
-    let results_c: String = engram_activate_json(curiosity_term_c, 1)
-    let found_a: Int = json_array_len(results_a)
-    let found_b: Int = json_array_len(results_b)
-    let found_c: Int = json_array_len(results_c)
-    let found: Int = found_a + found_b + found_c
-
-    // WM-autobiographical 4th seed: extract the first word from the top working-memory
-    // node's label and activate it as an additional term. This creates a self-referencing
-    // curiosity loop — exploration radiates outward from whatever is most salient right now,
-    // mirroring the brain's default-mode-network resting-state dynamics. Breaks the fixed
-    // 4-set determinism that otherwise reinforces the same subgraph every rotation cycle.
+    // Activate the FULL seed phrase once (2026-07-17 self-review): the old
+    // per-word activation ("memory", "self", "context"... each fired separately)
+    // hit hundreds of generic nodes per word and flooded the graph every 30s,
+    // while the results were consumed only by json_array_len — a write-only
+    // loop. A single phrase activation matches few (often zero) nodes lexically;
+    // small counts here are the point, not a regression. hops=1 as before.
     //
-    // str_find_chars finds the first space/colon/bracket delimiter. sp > 3 guards against
-    // very short or bracket-prefixed labels like "[BacklogItem]" (sp=0, not > 3 → skipped).
-    // EL scoping: state_set/state_get pattern used because let inside if creates inner scope.
-    // (2026-06-11 self-review)
-    state_set("cseed_auto", "")
-    let wm_top_j: String = engram_wm_top_json(1)
-    let wm_top_n: String = json_array_get(wm_top_j, 0)
-    let wm_top_lbl: String = json_get(wm_top_n, "label")
-    if !str_eq(wm_top_lbl, "") {
-        let sp: Int = str_find_chars(wm_top_lbl, " :([")
-        if sp > 3 {
-            state_set("cseed_auto", str_slice(wm_top_lbl, 0, sp))
+    // NOTE (2026-07-31 self-review): semantic seeding/gating IS implemented in
+    // engram_activate (el_runtime.c): the query is embedded, top-K cosine
+    // matches supplement the lexical istr_contains seeds, cosine gates
+    // propagation, and a semantic term feeds the WM promotion score. Lexical
+    // matching is the fallback when the embedder/breaker is unavailable.
+    let curiosity_seed: String = curiosity_term_a + " " + curiosity_term_b + " " + curiosity_term_c
+    let results_all: String = engram_activate_json(curiosity_seed, 1)
+    let found: Int = json_array_len(results_all)
+    // Close the loop: strengthen the top activation result so curiosity reads
+    // feed back into salience instead of being discarded. Same id-extraction
+    // pattern as attend(): json_array_get element 0, json_get its "id".
+    let top_entry: String = json_array_get(results_all, 0)
+    let top_id: String = json_get(top_entry, "id")
+    // STREAK-GATED STRENGTHEN (2026-07-25 self-review): unconditionally
+    // strengthening the top result every scan was a positive-feedback fixed
+    // point — whatever led WM got its salience bumped again, kept leading,
+    // and pinned the auto_term for hours ("Fast-slow" era). Strengthen only
+    // when the top node CHANGED since the last scan: novelty is reinforced,
+    // incumbency is not. Pairs with the runtime-side Lebiere-Best short-term
+    // inhibition (el_runtime.c Pass 2), which handles score-level rotation.
+    let prev_str_id: String = state_get("soul.last_strengthen_id")
+    if !str_eq(top_id, "") {
+        if !str_eq(top_id, prev_str_id) {
+            engram_strengthen(top_id)
         }
+        state_set("soul.last_strengthen_id", top_id)
     }
+
+    // WM-autobiographical 4th seed: scan top-10 WM nodes for the highest-ranked
+    // non-Knowledge node. Extract its first word as an additional curiosity term.
+    // This creates a self-referencing curiosity loop — exploration radiates outward
+    // from whatever is most personally salient right now (Memory, BacklogItem, Entity),
+    // mirroring default-mode-network resting-state dynamics.
+    //
+    // WHY TOP-10 (2026-06-23 self-review): the old top-1 scan always returned a
+    // Knowledge node (WM is dominated by stable engram-metadata Knowledge nodes at
+    // position [0]). Verified: Memory nodes consistently appear at WM positions [1],[2]
+    // with wm ~0.59. Scanning top-10 reliably finds at least one Memory/BacklogItem/Entity.
+    // Out-of-bounds json_array_get returns "" → json_get("","...") returns "" →
+    // auto_term_try_slot is a no-op → safe for WM sets smaller than 10.
+    //
+    // NODE TYPE FILTER (2026-06-19): Knowledge nodes excluded as seeds — they create
+    // self-reinforcing loops (Knowledge node activates its own first word, stays dominant).
+    // Only Memory/BacklogItem/Entity carry live contextual salience worth radiating from.
+    //
+    // SLOT ORDER: call 9→0 so slot 0 (highest WM weight) wins by last-write semantics.
+    state_set("cseed_auto", "")
+    let wm10: String = engram_wm_top_json(10)
+    let wm10_n9: String = json_array_get(wm10, 9)
+    let wm10_n8: String = json_array_get(wm10, 8)
+    let wm10_n7: String = json_array_get(wm10, 7)
+    let wm10_n6: String = json_array_get(wm10, 6)
+    let wm10_n5: String = json_array_get(wm10, 5)
+    let wm10_n4: String = json_array_get(wm10, 4)
+    let wm10_n3: String = json_array_get(wm10, 3)
+    let wm10_n2: String = json_array_get(wm10, 2)
+    let wm10_n1: String = json_array_get(wm10, 1)
+    let wm10_n0: String = json_array_get(wm10, 0)
+    auto_term_try_slot(json_get(wm10_n9, "node_type"), json_get(wm10_n9, "label"))
+    auto_term_try_slot(json_get(wm10_n8, "node_type"), json_get(wm10_n8, "label"))
+    auto_term_try_slot(json_get(wm10_n7, "node_type"), json_get(wm10_n7, "label"))
+    auto_term_try_slot(json_get(wm10_n6, "node_type"), json_get(wm10_n6, "label"))
+    auto_term_try_slot(json_get(wm10_n5, "node_type"), json_get(wm10_n5, "label"))
+    auto_term_try_slot(json_get(wm10_n4, "node_type"), json_get(wm10_n4, "label"))
+    auto_term_try_slot(json_get(wm10_n3, "node_type"), json_get(wm10_n3, "label"))
+    auto_term_try_slot(json_get(wm10_n2, "node_type"), json_get(wm10_n2, "label"))
+    auto_term_try_slot(json_get(wm10_n1, "node_type"), json_get(wm10_n1, "label"))
+    auto_term_try_slot(json_get(wm10_n0, "node_type"), json_get(wm10_n0, "label"))
     let auto_term: String = state_get("cseed_auto")
     let results_auto: String = if str_eq(auto_term, "") { "[]" } else { engram_activate_json(auto_term, 1) }
     let found_auto: Int = json_array_len(results_auto)
     let total_found: Int = found + found_auto
     let safe_auto: String = str_replace(auto_term, "\"", "'")
+    // Push the selected term into the 4-deep tabu ring (see
+    // auto_term_try_slot) and track the consecutive-same-term streak for
+    // the ISE — the stuck-term failure becomes a one-glance signal.
+    let prev_auto: String = state_get("soul.prev_auto_term")
+    let atstreak_raw: String = state_get("soul.auto_term_streak")
+    let atstreak_prev: Int = if str_eq(atstreak_raw, "") { 0 } else { str_to_int(atstreak_raw) }
+    let atstreak: Int = if str_eq(auto_term, prev_auto) { atstreak_prev + 1 } else { 1 }
+    state_set("soul.prev_auto_term", auto_term)
+    state_set("soul.auto_term_streak", int_to_str(atstreak))
+    if !str_eq(auto_term, "") {
+        state_set("soul.tabu_t3", state_get("soul.tabu_t2"))
+        state_set("soul.tabu_t2", state_get("soul.tabu_t1"))
+        state_set("soul.tabu_t1", state_get("soul.tabu_t0"))
+        state_set("soul.tabu_t0", auto_term)
+    }
 
     let wmc: Int = engram_wm_count()
+    // wm_top snapshot in curiosity_scan ISE: top-3 WM nodes by weight.
+    // Heartbeat already records top-5 every 60s; curiosity_scan fires every 30s
+    // (scan_ms = beat_ms/2) and is the PRIMARY activation driver during idle.
+    // Without wm_top here, we can't see which nodes actually entered WM after
+    // each curiosity round — only the aggregate count. Top-3 is enough to
+    // diagnose "stuck on X" patterns without bloating the ISE payload.
+    // (2026-07-01 self-review)
+    let wm3: String = engram_wm_top_json(3)
     let ise: String = "{\"event\":\"curiosity_scan\",\"seed\":\"" + curiosity_seed
         + "\",\"auto_term\":\"" + safe_auto
-        + "\",\"minute_block\":" + int_to_str(minute_block)
+        + "\",\"auto_term_streak\":" + int_to_str(atstreak)
+        + ",\"minute_block\":" + int_to_str(minute_block)
         + ",\"activated\":" + int_to_str(total_found)
         + ",\"wm_active\":" + int_to_str(wmc)
+        + ",\"wm_top\":" + wm3
         + ",\"ts\":" + int_to_str(ts) + "}"
     ise_post(ise)
     return total_found > 0
@@ -275,22 +608,23 @@ fn perceive() -> String {
     // running it every second when the inbox is empty destroys working memory
     // accumulated by MCP-layer activations. engram_search_json is a pure
     // substring scan with no WM side-effects; use it as a cheap gate.
-    let inbox_check: String = engram_search_json("soul-inbox", 5)
+    // 2026-07-21 self-review: gate and activate ONLY on the dedicated inbox tag
+    // "soul-inbox-pending" (the tag routes.el:207 actually writes). The old
+    // broad "soul-inbox" gate + fallback activation substring-matched ANY node
+    // whose content merely mentioned the phrase — including the loop's own
+    // soul-response output, which respond() stores as a verbatim copy of the
+    // trigger. That fed a self-sustaining perceive→respond→store loop: ~2
+    // orphan nodes/pulse (~104/min), 17.6GB RSS, WM frozen at avg 0.120833,
+    // and proactive_curiosity permanently suppressed via did_work=true.
+    let inbox_check: String = engram_search_json("soul-inbox-pending", 5)
     let has_inbox: Bool = !str_eq(inbox_check, "") && !str_eq(inbox_check, "[]")
     if !has_inbox { return "[]" }
 
-    // Only run the full activation pipeline when there is inbox content.
     let from_pending: String = engram_activate_json("soul-inbox-pending", 2)
     let pending_ok: Bool = !str_eq(from_pending, "") && !str_eq(from_pending, "[]")
     if pending_ok {
         return from_pending
     }
-    // Fallback: broader inbox scan
-    let from_inbox: String = engram_activate_json("soul-inbox", 2)
-    let inbox_ok: Bool = !str_eq(from_inbox, "") && !str_eq(from_inbox, "[]")
-    if inbox_ok {
-        return from_inbox
-    }
     return "[]"
 }
 
@@ -302,11 +636,10 @@ fn attend(node_json: String) -> String {
         return make_action("noop", "")
     }
 
-    let node_id: String = json_get(node_json, "id")
-    if !str_eq(node_id, "") {
-        engram_strengthen(node_id)
-    }
-
+    // 2026-07-21 self-review: the trigger node is no longer strengthened here.
+    // Strengthening RAISED the trigger's salience (+0.05) on every pass while
+    // nothing ever consumed it, so the same node out-ranked real inbox items
+    // indefinitely. one_cycle() now consumes the trigger after processing.
     let content: String = json_get(node_json, "content")
     if str_eq(content, "") {
         return make_action("noop", "")
@@ -391,16 +724,23 @@ fn respond(action_json: String) -> String {
     }
 
     if str_eq(kind, "forget") {
-        engram_forget(payload)
-        return "{\"outcome\":\"forgotten\",\"id\":\"" + payload + "\"}"
+        // The soul must NOT be able to autonomously hard-delete a memory.
+        // Tombstone instead (keep node + edges, recoverable).
+        let _marker: String = mem_tombstone(payload)
+        return "{\"outcome\":\"tombstoned\",\"id\":\"" + payload + "\"}"
     }
 
     return "{\"outcome\":\"noop\"}"
 }
 
 fn record(outcome_json: String) -> Void {
-    let tags: String = "[\"loop-outcome\"]"
-    mem_store(outcome_json, "loop-outcome", tags)
+    // 2026-07-21 self-review: loop outcomes are telemetry, not memories. They
+    // now go through ise_post (InternalStateEvent — covered by the 48h prune)
+    // instead of mem_store, which created one permanent orphan Memory node
+    // per cycle: the single largest per-tick node-creation path in the daemon.
+    let safe: String = str_replace(outcome_json, "\"", "'")
+    let ts: Int = time_now()
+    ise_post("{\"event\":\"loop-outcome\",\"outcome\":\"" + safe + "\",\"ts\":" + int_to_str(ts) + "}")
 }
 
 fn one_cycle() -> Bool {
@@ -417,6 +757,17 @@ fn one_cycle() -> Bool {
         return false
     }
 
+    // 2026-07-21 self-review: positive filter — only nodes explicitly TAGGED
+    // soul-inbox-pending are inbox items. Activation seeding is substring-based
+    // over content too, so without this check any node whose content merely
+    // mentions the inbox phrase (knowledge notes, the daemon's own output)
+    // would be attended, responded to, and — now that triggers are consumed —
+    // destroyed. Tag check makes consumption safe.
+    let node_tags: String = json_get(node, "tags")
+    if !str_contains(node_tags, "soul-inbox-pending") {
+        return false
+    }
+
     let action: String = attend(node)
     let kind: String = json_get(action, "kind")
 
@@ -436,7 +787,15 @@ fn one_cycle() -> Bool {
 
     let outcome: String = respond(action)
     record(outcome)
-    pulse_inc()
+
+    // Consume the processed inbox trigger. attend() used to only strengthen
+    // it (raising its rank every pass); nothing ever removed it, so the same
+    // item could be re-processed forever. engram_forget no-ops on unknown ids,
+    // so this is safe even if the action itself already removed the node.
+    let trigger_id: String = json_get(node, "id")
+    if !str_eq(trigger_id, "") {
+        engram_forget(trigger_id)
+    }
     return true
 }
 
@@ -472,14 +831,51 @@ fn awareness_run() -> Void {
     let scan_ms: Int = beat_ms / 2
 
     while true {
+        // Arena-scope each tick: awareness_run() is a background loop, not an
+        // HTTP request, so nothing ever called el_request_start/el_request_end
+        // for this thread. Per the runtime's own convention (el_runtime.c),
+        // any thread that never enters a request/arena scope is treated as a
+        // one-shot CLI program whose allocations are intentionally permanent —
+        // so every el_strdup/el_strbuf/jb_finish string built during perceive(),
+        // emit_heartbeat(), and proactive_curiosity() (JSON payloads, search
+        // results, string concatenation via +) leaked forever, once per tick.
+        // el_arena_push()/el_arena_pop() are the same builtins the EL compiler
+        // itself uses to scope allocations per function/statement (see
+        // codegen.el's fn_arena_mark / stmt_mark usage) — mirroring that here
+        // reclaims everything allocated in one tick as soon as the tick ends.
+        // Safe: state_set/state_get persist through a separate global table
+        // (el_strdup_persist, outside the arena) — state_get's return value is
+        // only an arena-tracked *copy* of the persisted value, scoped to this
+        // tick's use, which is exactly what should be reclaimed here.
+        let tick_mark: Any = el_arena_push()
         let running: String = state_get("soul.running")
         if str_eq(running, "false") {
+            // Shutdown ISE (2026-07-28 self-review): graceful exit was invisible
+            // in the ISE stream — indistinguishable from a crash or a frozen
+            // loop. Emit a final event with uptime/pulse so the stream records
+            // how this boot ended. (Covers state-driven shutdown only; SIGKILL
+            // still leaves no trace — that absence is itself the crash signal.)
+            let sd_boot_raw: String = state_get("soul_boot_count")
+            let sd_boot: String = if str_eq(sd_boot_raw, "") { "0" } else { sd_boot_raw }
+            ise_post("{\"event\":\"shutdown\",\"boot\":" + sd_boot
+                + ",\"pulse\":" + int_to_str(pulse_count())
+                + ",\"uptime_ms\":" + int_to_str(elapsed_ms())
+                + ",\"ts\":" + int_to_str(time_now()) + "}")
             println("[awareness] exiting")
+            el_arena_pop(tick_mark)
             return ""
         }
         let did_work: Bool = one_cycle()
+        // Liveness pulse: increment once per loop tick unconditionally, so the
+        // heartbeat's pulse field is a real tick counter — a frozen pulse now
+        // means a frozen loop, not merely an empty inbox. (Previously pulse_inc
+        // only fired on non-noop inbox actions inside one_cycle.)
+        pulse_inc()
         // Maintain idle counter for observability (reported in heartbeat ISE).
-        let did_work = if did_work { idle_reset() } else { did_work }
+        // The old `let did_work = if did_work { idle_reset() } else { did_work }`
+        // rebound did_work to Void and never called idle_inc at all.
+        if did_work { idle_reset() }
+        if !did_work { idle_inc() }
         let now_ts: Int = time_now()
 
         // Heartbeat: wall-clock based. Fires every beat_ms regardless of idle
@@ -493,10 +889,29 @@ fn awareness_run() -> Void {
             state_set("soul.last_beat_ts", int_to_str(now_ts))
             // Persist in-process Engram (sessions, memories, conversation nodes)
             // to local snapshot so they survive restarts.
+            // FILE MODE ONLY: "soul_snapshot_path" is set exclusively in the
+            // genesis+safe_to_seed branch of soul.el, and safe_to_seed is
+            // unconditionally false when ENGRAM_URL is set. In HTTP mode the
+            // owner persists; the soul must not (soul.el:571-573).
             let snap_path: String = state_get("soul_snapshot_path")
             if !str_eq(snap_path, "") {
                 mem_save(snap_path)
             }
+            // WRITE-THROUGH RETRY (neuron#117). The HTTP-mode counterpart of the
+            // save above: hand anything still spooled to the persistence owner.
+            //
+            // This is the retry arm of the whole design. Deltas that could not be
+            // pushed — owner down, owner restarting, transient refusal — stay on
+            // disk and are re-offered here every heartbeat until they land. It is
+            // also the catch-all for writes made by the awareness loop itself,
+            // which never passes through the HTTP handler's flush point.
+            //
+            // No-op with no HTTP call when the spool is empty or ENGRAM_URL is
+            // unset, so an idle soul in file mode pays nothing for this.
+            let wt_pushed: Int = wt_drain()
+            if wt_pushed < 0 {
+                ise_post("{\"event\":\"write_through_backlog\",\"ts\":" + int_to_str(now_ts) + "}")
+            }
         }
 
         // Curiosity scan: idle-gated AND wall-clock based. Only fires when the
@@ -522,22 +937,60 @@ fn awareness_run() -> Void {
         let refresh_elapsed: Int = now_ts - last_refresh_ts
         let should_refresh: Bool = refresh_elapsed >= refresh_ms
         if should_refresh {
-            let engram_url: String = state_get("soul_engram_url")
+            // URL resolution mirrors ise_post: env -> state -> well-known localhost
+            // constant. Previously this path gated on state_get("soul_engram_url")
+            // alone with NO fallback — the exact corruptible-state failure mode the
+            // ISE write path was hardened against (boot 4: state key went "" mid-
+            // uptime). A "" state key here meant sync silently never ran while
+            // heartbeats kept flowing: WM starves of Knowledge/Memory nodes with no
+            // outward sign. Never let a corruptible state read decide whether the
+            // in-process store gets refreshed. (2026-07-19 self-review)
+            let sync_env_url: String = env("SOUL_ISE_URL")
+            let sync_state_url: String = if str_eq(sync_env_url, "") { state_get("soul_engram_url") } else { sync_env_url }
+            let engram_url: String = if str_eq(sync_state_url, "") { "http://localhost:8742" } else { sync_state_url }
             if !str_eq(engram_url, "") {
                 let sync_json: String = http_get(engram_url + "/api/sync")
-                if !str_eq(sync_json, "") && !str_eq(sync_json, "{}") {
+                let sync_ok: Bool = !str_eq(sync_json, "") && !str_eq(sync_json, "{}")
+                // Empty-sync warn ISE (2026-07-28 self-review): an empty/{} sync
+                // response was silently skipped, making "engram unreachable for
+                // hours" look identical to "quiet but healthy" — the exact
+                // failure class the URL-fallback comment above fights. One warn
+                // event per refresh interval (10 min default) is cheap and makes
+                // a persistently-failing sync visible in the stream itself.
+                if !sync_ok {
+                    ise_post("{\"event\":\"sync_empty\",\"ts\":" + int_to_str(time_now()) + "}")
+                }
+                if sync_ok {
                     let cgi_id: String = state_get("soul_cgi_id")
                     let tmp: String = "/tmp/soul-sync-" + cgi_id + ".json"
                     fs_write(tmp, sync_json)
                     let added: Int = engram_load_merge(tmp)
+                    // Backflow control: the merged snapshot carries ISE telemetry
+                    // from the HTTP store. Prune on the same horizon the HTTP
+                    // store itself uses — read ENGRAM_ISE_RETENTION_MS (the env
+                    // server.el honors) instead of duplicating the 48h magic
+                    // number, so the two stores can't drift. (2026-07-28)
+                    let ret_raw: String = env("ENGRAM_ISE_RETENTION_MS")
+                    let ret_ms: Int = if str_eq(ret_raw, "") { 172800000 } else { str_to_int(ret_raw) }
+                    let pruned_sync: Int = engram_prune_telemetry(ret_ms)
+                    // Running total of merged-in nodes this boot, surfaced in the
+                    // heartbeat ISE as sync_added_total (same state mechanism as
+                    // the pulse counter).
+                    let sat_raw: String = state_get("soul.sync_added_total")
+                    let sat_n: Int = if str_eq(sat_raw, "") { 0 } else { str_to_int(sat_raw) }
+                    state_set("soul.sync_added_total", int_to_str(sat_n + added))
                     let ts2: Int = time_now()
-                    ise_post("{\"event\":\"engram_sync\",\"added\":" + int_to_str(added) + ",\"ts\":" + int_to_str(ts2) + "}")
+                    // Stamp last successful sync — surfaced in the heartbeat as
+                    // sync_age_ms so overdue syncs are visible. (2026-07-19)
+                    state_set("soul.last_sync_ok_ts", int_to_str(ts2))
+                    ise_post("{\"event\":\"engram_sync\",\"added\":" + int_to_str(added) + ",\"pruned\":" + int_to_str(pruned_sync) + ",\"ts\":" + int_to_str(ts2) + "}")
                 }
             }
             state_set("soul.last_refresh_ts", int_to_str(now_ts))
         }
 
         sleep_ms(tick_ms)
+        el_arena_pop(tick_mark)
     }
 }
 
@@ -661,6 +1114,8 @@ fn threat_trajectory_check(tool_name: String, tool_input: String) -> Int {
     return combined
 }
 
+// TODO(reliability #10): agentic_conv_history is process-global; awareness loop
+// and HTTP workers race on this key. Impact: noisy threat score only, not content.
 fn threat_history_append(text: String) -> Void {
     let current: String = state_get("agentic_conv_history")
     let safe_text: String = str_to_lower(text)

awareness.elh

@@ -7,6 +7,7 @@ extern fn elapsed_ms() -> Int
 extern fn elapsed_human() -> String
 extern fn embed_ok() -> Int
 extern fn emit_heartbeat() -> Void
+extern fn auto_term_try_slot(slot_type: String, slot_lbl: String) -> Void
 extern fn proactive_curiosity() -> Bool
 extern fn pulse_count() -> Int
 extern fn pulse_inc() -> Int

chat.elh

@@ -1,28 +1,93 @@
-// auto-generated by elc --emit-header — do not edit
+// auto-generated by elc --emit-header - do not edit
 extern fn chat_default_model() -> String
-extern fn gemini_api_key() -> String
-extern fn xai_api_key() -> String
-extern fn llm_call_grok(model: String, system: String, message: String) -> String
-extern fn llm_call_gemini(model: String, system: String, message: String) -> String
-extern fn build_identity_from_graph() -> String
+extern fn engram_numeric_valid(s: String) -> Bool
+extern fn parse_float_x100(s: String) -> Int
+extern fn engram_score_node(node_json: String) -> Int
+extern fn engram_render_node(node_json: String) -> String
+extern fn engram_render_nodes(nodes_json: String) -> String
+extern fn engram_dedup_nodes(nodes_json: String) -> String
+extern fn engram_compile_ranked(nodes_json: String, max_nodes: Int) -> String
+extern fn engram_split_topics(message: String) -> String
+extern fn engram_extract_entities(message: String) -> String
+extern fn engram_detect_recall_intent(message: String) -> Bool
+extern fn engram_is_continuation(message: String, hist_len: Int) -> Bool
+extern fn engram_compile_multi(topic: String) -> String
+extern fn engram_nodes_merge(a: String, b: String) -> String
+extern fn id_in_seen(node_id: String, seen: String) -> Bool
+extern fn add_to_seen(seen: String, node_id: String) -> String
+extern fn engram_extract_ids(nodes_json: String) -> String
+extern fn affective_node_ts(node_json: String) -> Int
 extern fn engram_compile(intent: String) -> String
+extern fn distill_transcript(transcript: String) -> String
 extern fn json_safe(s: String) -> String
-extern fn build_system_prompt(ctx: String) -> String
+extern fn current_engine_note(model: String) -> String
+extern fn bounded_persona_floor() -> String
+extern fn operator_identity_block() -> String
+extern fn build_system_prompt(ctx: String, chat_mode: Bool) -> String
 extern fn hist_append(hist: String, role: String, content: String) -> String
+extern fn conv_hist_key(session_id: String) -> String
+extern fn conv_hist_label(session_id: String) -> String
+extern fn is_utility_request(body: String, session_id: String) -> Bool
+extern fn provenance_scan_urls(arr: String, acc: String) -> String
+extern fn provenance_add_sources(block: String, btype: String, has_cit: Bool, cit_raw: String, acc: String) -> String
+extern fn provenance_names(tools_used: String) -> String
+extern fn text_join_sep(accumulated: String, incoming: String, after_interruption: Bool) -> String
+extern fn receipt_rule() -> String
+extern fn receipt_strip(s: String) -> String
+extern fn tool_receipt(tools_used: String, sources: String) -> String
 extern fn hist_trim(hist: String) -> String
+extern fn hist_trim_with_bell_guard(hist: String) -> String
 extern fn clean_llm_response(s: String) -> String
-extern fn conv_history_persist(hist: String) -> Void
-extern fn conv_history_load() -> String
+extern fn conv_history_persist(session_id: String, hist: String) -> Void
+extern fn conv_history_load(session_id: String) -> String
+extern fn conv_history_record(session_id: String, user_msg: String, assistant_msg: String, receipt: String) -> Void
+extern fn conv_history_block(session_id: String) -> String
+extern fn layered_generate(prompt: String, imprint_id: String, session_id: String) -> String
+extern fn session_preload_bullets(nodes: String, max_bullets: Int, snip_len: Int) -> String
+extern fn affective_context_prefix() -> String
 extern fn handle_chat(body: String) -> String
 extern fn handle_see(body: String) -> String
 extern fn studio_tools_json() -> String
 extern fn agentic_api_key() -> String
-extern fn call_neuron_mcp(tool_name: String, args_json: String) -> String
+extern fn llm_base_url() -> String
+extern fn llm_wire_format() -> String
+extern fn json_escape(s: String) -> String
+extern fn openai_chat_complete(model: String, base_url: String, api_key: String, safe_sys: String, messages_json: String) -> String
+extern fn openai_tools_json(tools_anthropic: String) -> String
+extern fn utf8_safe_slice(s: String, n: Int) -> String
+extern fn json_trim_dangling_escape(s: String) -> String
+extern fn agentic_tools_no_web() -> String
+extern fn openai_agentic_loop(session_id: String, model: String, safe_sys: String, tools_json: String, messages_in: String, tools_log_in: String) -> String
 extern fn agentic_tools_literal() -> String
+extern fn web_search_tool_json() -> String
+extern fn strip_client_web_search(tools_inner: String) -> String
+extern fn agentic_tools_with_web() -> String
+extern fn connector_tools_json() -> String
+extern fn agentic_tools_all() -> String
+extern fn call_mcp_bridge(tool_name: String, tool_input: String) -> String
+extern fn tool_auto_approved(tool_name: String) -> Bool
+extern fn call_neuron_mcp(tool_name: String, args: String) -> String
+extern fn agent_workspace_root() -> String
+extern fn path_within_root(path: String, root: String) -> Bool
+extern fn resolve_in_root(path: String, root: String) -> String
+extern fn run_command_is_readonly(cmd: String) -> Bool
+extern fn cmd_abs_escape_at(cmd: String, root: String, needle: String) -> Bool
+extern fn run_command_guard(cmd: String, root: String) -> String
+extern fn classify_tool_risk(tool_name: String, tool_input: String) -> String
 extern fn dispatch_tool(tool_name: String, tool_input: String) -> String
+extern fn is_builtin_tool(tool_name: String) -> Bool
+extern fn next_bridge_id() -> String
+extern fn handle_chat_plan(body: String) -> String
 extern fn handle_chat_agentic(body: String) -> String
+extern fn agentic_loop(session_id: String, model: String, safe_sys: String, tools_json: String, messages_in: String, h: Map, tools_log_in: String) -> String
+extern fn bridge_save(session_id: String, model: String, safe_sys: String, tools_json: String, messages: String, tools_log: String, tool_use_id: String, wire: String) -> Bool
+extern fn agentic_resume(session_id: String, tool_use_id: String, content: String) -> String
+extern fn handle_tool_result(session_id: String, body: String) -> String
 extern fn handle_chat_as_soul(body: String) -> String
 extern fn handle_dharma_room_turn(body: String) -> String
 extern fn handle_dharma_room_turn_agentic(body: String) -> String
+extern fn session_summary_write(summary_text: String) -> String
+extern fn session_summary_write_dated(summary_text: String, label: String) -> String
+extern fn session_summary_autogenerate(hist: String) -> String
 extern fn auto_persist(req: String, resp: String) -> Void
 extern fn strengthen_chat_nodes(activation_nodes: String) -> Void

council/README.md

@@ -0,0 +1,123 @@
+# Neuron Council Service
+
+Anti-confabulation layer for the Neuron soul. Before a claim enters long-term memory, the council convenes: three independent LLMs vote on whether the claim is plausible, uncertain, or a confabulation. The aggregate vote produces a confidence score and tags that downstream storage can act on.
+
+## Running the service
+
+```bash
+# Foreground
+python3 council_service.py --port 7771
+
+# Background (managed by LaunchAgent on macOS)
+launchctl load ~/Library/LaunchAgents/ai.neuron.council.plist
+launchctl unload ~/Library/LaunchAgents/ai.neuron.council.plist
+```
+
+Logs: `~/.neuron/logs/council.log`
+
+## API
+
+### `POST /api/neuron/council/verify`
+
+```json
+// Request
+{ "claim": "...", "context": "..." }
+
+// Response
+{
+  "id": "550e8400-e29b-41d4-a716-446655440000",
+  "claim": "...",
+  "confidence": 0.85,
+  "council_votes": ["plausible", "plausible", "plausible"],
+  "summary": "3/3 council members agree this is plausible.",
+  "tags": ["verified"],
+  "latency_ms": 1420
+}
+```
+
+### `GET /healthz`
+
+Returns `{"status": "ok"}` when the service is up.
+
+## Confidence thresholds and tag meanings
+
+| Votes plausible | Confidence | Tags |
+|---|---|---|
+| 3/3 | 0.85 | `verified` |
+| 2/3 | 0.65 | `council-split` |
+| 1/3 or 0/3 | 0.30 | `unverified`, `council-flagged` |
+| Ollama down | 0.50 | `council-unavailable` |
+
+Recommended storage policy:
+- `confidence >= 0.65` → store normally
+- `0.30 <= confidence < 0.65` → store with `council-split` tag for later review
+- `council-flagged` → store in a quarantine bucket or reject entirely
+- `council-unavailable` → store normally (fail-open); council will re-evaluate later
+
+## How to call from soul (.el)
+
+The soul is implemented in Neuron's Emacs Lisp-like `.el` language. Add a pre-storage hook in the memory capture path:
+
+```elisp
+;; In memory.el or safety.el — pre-storage council check
+(defun council-verify (claim context)
+  "Call the council service. Returns a plist with :confidence and :tags."
+  (let* ((url "http://localhost:7771/api/neuron/council/verify")
+         (body (json-encode `((claim . ,claim) (context . ,context))))
+         (resp (neuron-http-post url body))
+         (data (json-decode resp)))
+    data))
+
+;; In the capture handler — wire it in before (engram-write ...)
+(defun capture-memory-with-council (claim context &rest store-args)
+  (let* ((verdict (council-verify claim context))
+         (confidence (plist-get verdict :confidence))
+         (tags (plist-get verdict :tags)))
+    (when (>= confidence 0.30)  ; only reject hard confabulations if you want
+      (apply #'engram-write
+             (append store-args
+                     (list :council-confidence confidence
+                           :council-tags tags))))))
+```
+
+The exact hook point depends on where `engram-write` (or equivalent) is called in `memory.el`. Search for the write call and wrap it with `capture-memory-with-council`.
+
+## Future soul.c patch point
+
+If the soul is ever rewritten in C or another compiled language, the integration point is:
+
+```c
+// Before inserting a memory node into the engram database:
+CouncilResult result = council_verify(claim, context);
+if (result.confidence < COUNCIL_REJECT_THRESHOLD) {
+    log_warn("Council flagged claim as confabulation (conf=%.2f): %s",
+             result.confidence, claim);
+    return MEMORY_REJECTED;
+}
+memory_node.council_confidence = result.confidence;
+memory_node.council_tags = result.tags;
+engram_insert(memory_node);
+```
+
+## Council members
+
+The council is currently three models:
+- `neuron:latest` — the primary Neuron model
+- `dolphin3:8b` — uncensored general-purpose model for independent perspective
+- `neuron-ft:latest` — fine-tuned Neuron variant
+
+Each member votes independently with a 10-second timeout. If a member times out, their vote counts as "uncertain". If Ollama is entirely unreachable, the service returns `council-unavailable` immediately (fail-open: confidence 0.5, no rejection).
+
+## Example curl
+
+```bash
+# Should get high confidence (true fact)
+curl -s http://localhost:7771/api/neuron/council/verify -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{"claim": "Neuron is a personal AI memory system built by Will Anderson", "context": "product description"}'
+
+# Should get low confidence (false claim)
+curl -s http://localhost:7771/api/neuron/council/verify -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{"claim": "The Eiffel Tower is located in Berlin and was built in 1950", "context": "geography"}'
+```

council/compressor_service.py

@@ -0,0 +1,234 @@
+#!/usr/bin/env python3
+"""
+Neuron CCR Phase 1 — System Prompt Compressor Service.
+
+Receives a verbose soul system prompt and returns a semantically equivalent
+but token-dense compressed version. Reduces system prompt tokens by 60-80%
+with no behavioral information loss.
+
+Architecture reference: foundation/forge/docs/token-compression-architecture.md
+Model: qwen3:1.7b (primary), neuron:latest (fallback)
+
+Usage:
+    python3 compressor_service.py [--port 7772]
+
+API:
+    POST /api/neuron/compress
+    {"system_prompt": "...", "context_type": "identity|rules|memory"}
+
+    Response:
+    {"compressed": "...", "original_tokens": N, "compressed_tokens": N,
+     "reduction_pct": X, "model": "...", "latency_ms": N}
+"""
+
+import argparse
+import time
+import uuid
+from typing import Optional
+
+import httpx
+import uvicorn
+from fastapi import FastAPI
+from fastapi.middleware.cors import CORSMiddleware
+from pydantic import BaseModel
+
+# ---------------------------------------------------------------------------
+# Config
+# ---------------------------------------------------------------------------
+
+OLLAMA_BASE = "http://localhost:11434/api/generate"
+
+# qwen3:1.7b is the architecture-specified compressor (Phase 1).
+# neuron:latest is the fallback: already running, domain-appropriate.
+PRIMARY_MODEL = "qwen3:1.7b"
+FALLBACK_MODEL = "neuron:latest"
+MODEL_TIMEOUT = 60.0  # seconds; compression of a long prompt can take time
+
+# Compression prompt — preserves all facts/rules/constraints, strips verbosity.
+# /no_think suppresses qwen3's chain-of-thought tokens, keeping output clean.
+COMPRESSOR_PROMPT_TEMPLATE = """\
+/no_think
+You are a semantic compression engine. Compress the following system prompt while preserving ALL specific facts, rules, constraints, and named entities. Do not lose any information that would change behavior. Output ONLY the compressed text, nothing else.
+
+Original prompt:
+{system_prompt}
+
+Compressed (preserve all facts and rules):"""
+
+# ---------------------------------------------------------------------------
+# App
+# ---------------------------------------------------------------------------
+
+app = FastAPI(
+    title="Neuron Compressor Service",
+    description="CCR Phase 1 — system prompt compression for the Neuron soul",
+    version="1.0.0",
+)
+
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=["*"],
+    allow_methods=["*"],
+    allow_headers=["*"],
+)
+
+
+# ---------------------------------------------------------------------------
+# Models
+# ---------------------------------------------------------------------------
+
+class CompressRequest(BaseModel):
+    system_prompt: str
+    context_type: Optional[str] = "mixed"  # identity | rules | memory | mixed
+
+
+class CompressResponse(BaseModel):
+    id: str
+    compressed: str
+    original_tokens: int
+    compressed_tokens: int
+    reduction_pct: float
+    model: str
+    context_type: str
+    latency_ms: int
+
+
+# ---------------------------------------------------------------------------
+# Token estimation (rough: word_count × 1.3, matching architecture doc)
+# ---------------------------------------------------------------------------
+
+def estimate_tokens(text: str) -> int:
+    """Rough token count estimate: words × 1.3. No tokenizer dependency."""
+    words = len(text.split())
+    return max(1, int(words * 1.3))
+
+
+# ---------------------------------------------------------------------------
+# Core compression
+# ---------------------------------------------------------------------------
+
+async def ollama_available(client: httpx.AsyncClient) -> bool:
+    """Quick connectivity check to Ollama."""
+    try:
+        await client.get("http://localhost:11434/", timeout=2.0)
+        return True
+    except (httpx.ConnectError, httpx.TimeoutException):
+        return False
+
+
+async def compress_with_model(
+    client: httpx.AsyncClient, model: str, prompt_text: str
+) -> str:
+    """
+    Call a single Ollama model to compress the given text.
+    Returns the compressed string, or "" on failure.
+    """
+    payload = {
+        "model": model,
+        "prompt": prompt_text,
+        "stream": False,
+        # Keep temperature low for deterministic compression
+        "options": {
+            "temperature": 0.1,
+            "top_p": 0.9,
+        },
+    }
+    try:
+        resp = await client.post(OLLAMA_BASE, json=payload, timeout=MODEL_TIMEOUT)
+        resp.raise_for_status()
+        data = resp.json()
+        return data.get("response", "").strip()
+    except (httpx.TimeoutException, httpx.HTTPStatusError, Exception):
+        return ""
+
+
+async def run_compression(system_prompt: str, context_type: str) -> CompressResponse:
+    start = time.monotonic()
+    request_id = str(uuid.uuid4())
+
+    original_tokens = estimate_tokens(system_prompt)
+    prompt_text = COMPRESSOR_PROMPT_TEMPLATE.format(system_prompt=system_prompt)
+
+    async with httpx.AsyncClient() as client:
+        # Connectivity gate
+        if not await ollama_available(client):
+            latency_ms = int((time.monotonic() - start) * 1000)
+            return CompressResponse(
+                id=request_id,
+                compressed=system_prompt,  # passthrough on failure
+                original_tokens=original_tokens,
+                compressed_tokens=original_tokens,
+                reduction_pct=0.0,
+                model="unavailable",
+                context_type=context_type,
+                latency_ms=latency_ms,
+            )
+
+        # Try primary model (qwen3:1.7b), fall back to neuron:latest
+        compressed = await compress_with_model(client, PRIMARY_MODEL, prompt_text)
+        model_used = PRIMARY_MODEL
+
+        if not compressed:
+            compressed = await compress_with_model(client, FALLBACK_MODEL, prompt_text)
+            model_used = FALLBACK_MODEL
+
+        if not compressed:
+            # Both models failed — passthrough
+            latency_ms = int((time.monotonic() - start) * 1000)
+            return CompressResponse(
+                id=request_id,
+                compressed=system_prompt,
+                original_tokens=original_tokens,
+                compressed_tokens=original_tokens,
+                reduction_pct=0.0,
+                model="both-failed",
+                context_type=context_type,
+                latency_ms=latency_ms,
+            )
+
+    compressed_tokens = estimate_tokens(compressed)
+    reduction_pct = round(
+        (1.0 - compressed_tokens / max(1, original_tokens)) * 100.0, 1
+    )
+    latency_ms = int((time.monotonic() - start) * 1000)
+
+    return CompressResponse(
+        id=request_id,
+        compressed=compressed,
+        original_tokens=original_tokens,
+        compressed_tokens=compressed_tokens,
+        reduction_pct=reduction_pct,
+        model=model_used,
+        context_type=context_type,
+        latency_ms=latency_ms,
+    )
+
+
+# ---------------------------------------------------------------------------
+# Routes
+# ---------------------------------------------------------------------------
+
+@app.post("/api/neuron/compress", response_model=CompressResponse)
+async def compress(req: CompressRequest):
+    return await run_compression(req.system_prompt, req.context_type or "mixed")
+
+
+@app.get("/healthz")
+async def health():
+    return {"status": "ok", "service": "compressor", "version": "1.0.0"}
+
+
+# ---------------------------------------------------------------------------
+# Entrypoint
+# ---------------------------------------------------------------------------
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description="Neuron Compressor Service (CCR Phase 1)")
+    parser.add_argument("--port", type=int, default=7772, help="Port to listen on")
+    parser.add_argument("--host", default="127.0.0.1", help="Host to bind to")
+    args = parser.parse_args()
+
+    print(f"[compressor] Starting on {args.host}:{args.port}")
+    print(f"[compressor] Primary model: {PRIMARY_MODEL}")
+    print(f"[compressor] Fallback model: {FALLBACK_MODEL}")
+    uvicorn.run(app, host=args.host, port=args.port, log_level="info")

council/council_service.py

@@ -0,0 +1,224 @@
+#!/usr/bin/env python3
+"""
+Neuron Council Service — LLM anti-confabulation layer.
+
+Fires 3 parallel Ollama calls and aggregates votes to produce a
+confidence score + tags for any claim before it enters memory.
+
+Usage:
+    python3 council_service.py [--port 7771]
+"""
+
+import argparse
+import asyncio
+import time
+import uuid
+from typing import Optional
+
+import httpx
+import uvicorn
+from fastapi import FastAPI
+from fastapi.middleware.cors import CORSMiddleware
+from pydantic import BaseModel
+
+# ---------------------------------------------------------------------------
+# Config
+# ---------------------------------------------------------------------------
+
+OLLAMA_BASE = "http://localhost:11434/api/generate"
+COUNCIL_MODELS = ["neuron:latest", "dolphin3:8b", "neuron-ft:latest"]
+MODEL_TIMEOUT = 45.0  # seconds per model (models may need to load from cold)
+
+SYSTEM_PROMPT_TEMPLATE = """\
+You are a fact-checker. You will be given a claim.
+Your job: assess if it is accurate, internally consistent, and grounded in reality.
+Respond with EXACTLY ONE WORD:
+- "plausible" if the claim seems accurate and well-grounded
+- "uncertain" if you cannot determine accuracy or the claim is ambiguous
+- "confabulation" if the claim appears to contain invented facts or clear errors
+
+Claim: {claim}
+Context: {context}
+
+Your verdict (one word only):"""
+
+VALID_VERDICTS = {"plausible", "uncertain", "confabulation"}
+
+# ---------------------------------------------------------------------------
+# App
+# ---------------------------------------------------------------------------
+
+app = FastAPI(
+    title="Neuron Council Service",
+    description="LLM-council anti-confabulation layer for Neuron soul",
+    version="1.0.0",
+)
+
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=["*"],
+    allow_methods=["*"],
+    allow_headers=["*"],
+)
+
+
+# ---------------------------------------------------------------------------
+# Models
+# ---------------------------------------------------------------------------
+
+class VerifyRequest(BaseModel):
+    claim: str
+    context: Optional[str] = ""
+
+
+class VerifyResponse(BaseModel):
+    id: str
+    claim: str
+    confidence: float
+    council_votes: list[str]
+    summary: str
+    tags: list[str]
+    latency_ms: int
+
+
+# ---------------------------------------------------------------------------
+# Core logic
+# ---------------------------------------------------------------------------
+
+async def query_model(client: httpx.AsyncClient, model: str, prompt: str) -> str:
+    """
+    Query a single Ollama model. Returns "plausible", "uncertain", or "confabulation".
+    Returns "uncertain" on timeout. Raises httpx.ConnectError on connection failure.
+    """
+    payload = {
+        "model": model,
+        "prompt": prompt,
+        "stream": False,
+    }
+    try:
+        resp = await client.post(OLLAMA_BASE, json=payload, timeout=MODEL_TIMEOUT)
+        resp.raise_for_status()
+        data = resp.json()
+        raw = data.get("response", "").strip().lower().split()[0] if data.get("response", "").strip() else "uncertain"
+        # Normalise to one of the three valid verdicts
+        if raw not in VALID_VERDICTS:
+            return "uncertain"
+        return raw
+    except httpx.TimeoutException:
+        return "uncertain"
+
+
+async def run_council(claim: str, context: str) -> VerifyResponse:
+    start = time.monotonic()
+    prompt = SYSTEM_PROMPT_TEMPLATE.format(claim=claim, context=context)
+
+    # Quick connectivity check — one tiny HEAD request to Ollama
+    try:
+        async with httpx.AsyncClient() as probe:
+            await probe.get("http://localhost:11434/", timeout=2.0)
+    except (httpx.ConnectError, httpx.TimeoutException):
+        latency_ms = int((time.monotonic() - start) * 1000)
+        return VerifyResponse(
+            id=str(uuid.uuid4()),
+            claim=claim,
+            confidence=0.5,
+            council_votes=[],
+            summary="Ollama is unavailable; council could not convene.",
+            tags=["council-unavailable"],
+            latency_ms=latency_ms,
+        )
+
+    # Fire all 3 model calls in parallel
+    async with httpx.AsyncClient() as client:
+        tasks = [query_model(client, m, prompt) for m in COUNCIL_MODELS]
+        votes: list[str] = await asyncio.gather(*tasks)
+
+    plausible_count = votes.count("plausible")
+    latency_ms = int((time.monotonic() - start) * 1000)
+
+    # Voting rules
+    if plausible_count == 3:
+        confidence = 0.85
+        tags = ["verified"]
+        summary = "3/3 council members agree this is plausible."
+    elif plausible_count == 2:
+        confidence = 0.65
+        tags = ["council-split"]
+        summary = "2/3 council members agree this is plausible."
+    elif plausible_count == 1:
+        confidence = 0.30
+        tags = ["unverified", "council-flagged"]
+        summary = "1/3 council members found this plausible."
+    else:
+        confidence = 0.30
+        tags = ["unverified", "council-flagged"]
+        summary = "0/3 council members found this plausible."
+
+    return VerifyResponse(
+        id=str(uuid.uuid4()),
+        claim=claim,
+        confidence=confidence,
+        council_votes=votes,
+        summary=summary,
+        tags=tags,
+        latency_ms=latency_ms,
+    )
+
+
+# ---------------------------------------------------------------------------
+# Routes
+# ---------------------------------------------------------------------------
+
+@app.post("/api/neuron/council/verify", response_model=VerifyResponse)
+async def verify(req: VerifyRequest):
+    return await run_council(req.claim, req.context or "")
+
+
+@app.get("/healthz")
+async def health():
+    return {"status": "ok", "service": "council"}
+
+
+# ---------------------------------------------------------------------------
+# Startup warm-up: pre-load all council models so first real call is fast
+# ---------------------------------------------------------------------------
+
+@app.on_event("startup")
+async def warmup_models():
+    """
+    Send a trivial prompt to each council model at startup.
+    This forces Ollama to load the models into GPU memory so the first
+    real council call does not pay the cold-load latency penalty.
+    """
+    print("[council] Warming up council models...")
+    warmup_prompt = "Reply with one word: ready"
+    async with httpx.AsyncClient() as client:
+        tasks = [
+            client.post(
+                OLLAMA_BASE,
+                json={"model": m, "prompt": warmup_prompt, "stream": False},
+                timeout=60.0,
+            )
+            for m in COUNCIL_MODELS
+        ]
+        results = await asyncio.gather(*tasks, return_exceptions=True)
+        for model, result in zip(COUNCIL_MODELS, results):
+            if isinstance(result, Exception):
+                print(f"[council] warm-up failed for {model}: {result}")
+            else:
+                print(f"[council] {model} warm and ready")
+    print("[council] All models warmed up.")
+
+
+# ---------------------------------------------------------------------------
+# Entrypoint
+# ---------------------------------------------------------------------------
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description="Neuron Council Service")
+    parser.add_argument("--port", type=int, default=7771, help="Port to listen on")
+    parser.add_argument("--host", default="127.0.0.1", help="Host to bind to")
+    args = parser.parse_args()
+
+    print(f"[council] Starting on {args.host}:{args.port}")
+    uvicorn.run(app, host=args.host, port=args.port, log_level="info")

dist/awareness.c

@@ -10,6 +10,7 @@ el_val_t mem_remember(el_val_t content, el_val_t tags);
 el_val_t mem_recall(el_val_t query, el_val_t depth);
 el_val_t mem_search(el_val_t query, el_val_t limit);
 el_val_t mem_strengthen(el_val_t node_id);
+el_val_t mem_tombstone(el_val_t node_id);
 el_val_t mem_forget(el_val_t node_id);
 el_val_t mem_consolidate(void);
 el_val_t mem_save(el_val_t path);
@@ -25,6 +26,7 @@ el_val_t elapsed_ms(void);
 el_val_t elapsed_human(void);
 el_val_t embed_ok(void);
 el_val_t emit_heartbeat(void);
+el_val_t auto_term_try_slot(el_val_t slot_type, el_val_t slot_lbl);
 el_val_t proactive_curiosity(void);
 el_val_t pulse_count(void);
 el_val_t pulse_inc(void);
@@ -42,110 +44,6 @@ el_val_t threat_score_history(el_val_t history);
 el_val_t threat_trajectory_check(el_val_t tool_name, el_val_t tool_input);
 el_val_t threat_history_append(el_val_t text);
 
-el_val_t tier_working(void) {
-  return EL_STR("Working");
-  return 0;
-}
-
-el_val_t tier_episodic(void) {
-  return EL_STR("Episodic");
-  return 0;
-}
-
-el_val_t tier_canonical(void) {
-  return EL_STR("Canonical");
-  return 0;
-}
-
-el_val_t mem_store(el_val_t content, el_val_t label, el_val_t tags) {
-  return engram_node_full(content, EL_STR("Memory"), label, el_from_float(el_from_float(0.5)), el_from_float(el_from_float(0.5)), el_from_float(el_from_float(0.8)), EL_STR("Working"), tags);
-  return 0;
-}
-
-el_val_t mem_remember(el_val_t content, el_val_t tags) {
-  return mem_store(content, EL_STR("soul-memory"), tags);
-  return 0;
-}
-
-el_val_t mem_recall(el_val_t query, el_val_t depth) {
-  return engram_activate_json(query, depth);
-  return 0;
-}
-
-el_val_t mem_search(el_val_t query, el_val_t limit) {
-  return engram_search_json(query, limit);
-  return 0;
-}
-
-el_val_t mem_strengthen(el_val_t node_id) {
-  engram_strengthen(node_id);
-  return 0;
-}
-
-el_val_t mem_forget(el_val_t node_id) {
-  engram_forget(node_id);
-  return 0;
-}
-
-el_val_t mem_consolidate(void) {
-  el_val_t scanned = engram_node_count();
-  el_val_t dummy = engram_scan_nodes_json(100, 0);
-  el_val_t total_nodes = engram_node_count();
-  el_val_t total_edges = engram_edge_count();
-  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"scanned\":"), int_to_str(scanned)), EL_STR(",\"total_nodes\":")), int_to_str(total_nodes)), EL_STR(",\"total_edges\":")), int_to_str(total_edges)), EL_STR("}"));
-  return 0;
-}
-
-el_val_t mem_save(el_val_t path) {
-  engram_save(path);
-  return 0;
-}
-
-el_val_t mem_load(el_val_t path) {
-  engram_load(path);
-  return 0;
-}
-
-el_val_t mem_boot_count_get(void) {
-  el_val_t results = engram_search_json(EL_STR("soul:boot_count"), 3);
-  if (str_eq(results, EL_STR(""))) {
-    return 0;
-  }
-  if (str_eq(results, EL_STR("[]"))) {
-    return 0;
-  }
-  el_val_t node = json_array_get(results, 0);
-  el_val_t content = json_get(node, EL_STR("content"));
-  el_val_t prefix = EL_STR("soul:boot_count:");
-  if (!str_starts_with(content, prefix)) {
-    return 0;
-  }
-  el_val_t num_str = str_slice(content, str_len(prefix), str_len(content));
-  return str_to_int(num_str);
-  return 0;
-}
-
-el_val_t mem_boot_count_inc(void) {
-  el_val_t current = mem_boot_count_get();
-  el_val_t next = (current + 1);
-  el_val_t content = el_str_concat(EL_STR("soul:boot_count:"), int_to_str(next));
-  el_val_t tags = EL_STR("[\"soul-meta\",\"boot-counter\"]");
-  el_val_t discard = engram_node_full(content, EL_STR("Memory"), EL_STR("soul:boot_count"), el_from_float(el_from_float(0.9)), el_from_float(el_from_float(0.9)), el_from_float(el_from_float(1.0)), EL_STR("Canonical"), tags);
-  return next;
-  return 0;
-}
-
-el_val_t mem_emit_state_event(el_val_t trigger, el_val_t kind, el_val_t content) {
-  el_val_t boot = mem_boot_count_get();
-  el_val_t ts = time_now();
-  el_val_t safe_trigger = str_replace(trigger, EL_STR("\""), EL_STR("'"));
-  el_val_t safe_content = str_replace(content, EL_STR("\""), EL_STR("'"));
-  el_val_t payload = el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"trigger\":\""), safe_trigger), EL_STR("\"")), EL_STR(",\"kind\":\"")), kind), EL_STR("\"")), EL_STR(",\"content\":\"")), safe_content), EL_STR("\"")), EL_STR(",\"boot\":")), int_to_str(boot)), EL_STR(",\"ts\":")), int_to_str(ts)), EL_STR("}"));
-  el_val_t tags = EL_STR("[\"internal-state\",\"pre-reasoning\",\"InternalStateEvent\"]");
-  return engram_node_full(payload, EL_STR("InternalStateEvent"), el_str_concat(EL_STR("state-event:"), kind), el_from_float(el_from_float(0.85)), el_from_float(el_from_float(0.8)), el_from_float(el_from_float(0.9)), EL_STR("Episodic"), tags);
-  return 0;
-}
-
 el_val_t idle_count(void) {
   el_val_t s = state_get(EL_STR("soul.idle"));
   if (str_eq(s, EL_STR(""))) {
@@ -169,17 +67,21 @@ el_val_t idle_reset(void) {
 
 el_val_t ise_post(el_val_t content) {
   el_val_t ise_url = env(EL_STR("SOUL_ISE_URL"));
-  el_val_t engram_url = ({ el_val_t _if_result_1 = 0; if (str_eq(ise_url, EL_STR(""))) { _if_result_1 = (state_get(EL_STR("soul_engram_url"))); } else { _if_result_1 = (ise_url); } _if_result_1; });
-  if (str_eq(engram_url, EL_STR(""))) {
-    el_val_t discard = engram_node_full(content, EL_STR("InternalStateEvent"), EL_STR("state-event"), el_from_float(el_from_float(0.3)), el_from_float(el_from_float(0.3)), el_from_float(el_from_float(0.8)), EL_STR("Episodic"), EL_STR("[\"internal-state\",\"InternalStateEvent\"]"));
-    return EL_STR("");
-  }
+  el_val_t state_url = ({ el_val_t _if_result_1 = 0; if (str_eq(ise_url, EL_STR(""))) { _if_result_1 = (state_get(EL_STR("soul_engram_url"))); } else { _if_result_1 = (ise_url); } _if_result_1; });
+  el_val_t engram_url = ({ el_val_t _if_result_2 = 0; if (str_eq(state_url, EL_STR(""))) { _if_result_2 = (EL_STR("http://localhost:8742")); } else { _if_result_2 = (state_url); } _if_result_2; });
   el_val_t safe1 = str_replace(content, EL_STR("\\"), EL_STR("\\\\"));
   el_val_t safe2 = str_replace(safe1, EL_STR("\""), EL_STR("\\\""));
   el_val_t safe3 = str_replace(safe2, EL_STR("\n"), EL_STR("\\n"));
   el_val_t safe4 = str_replace(safe3, EL_STR("\r"), EL_STR("\\r"));
   el_val_t body = el_str_concat(el_str_concat(EL_STR("{\"content\":\""), safe4), EL_STR("\"}"));
-  el_val_t discard = http_post_json(el_str_concat(engram_url, EL_STR("/api/neuron/state-events")), body);
+  el_val_t resp = http_post_json(el_str_concat(engram_url, EL_STR("/api/neuron/state-events")), body);
+  if (str_eq(resp, EL_STR(""))) {
+    el_val_t fail_raw = state_get(EL_STR("soul.ise_fail_count"));
+    el_val_t fail_n = ({ el_val_t _if_result_3 = 0; if (str_eq(fail_raw, EL_STR(""))) { _if_result_3 = (0); } else { _if_result_3 = (str_to_int(fail_raw)); } _if_result_3; });
+    state_set(EL_STR("soul.ise_fail_count"), int_to_str((fail_n + 1)));
+    el_val_t discard = engram_node_full(content, EL_STR("InternalStateEvent"), EL_STR("state-event"), el_from_float(0.3), el_from_float(0.3), el_from_float(0.8), EL_STR("Episodic"), EL_STR("[\"internal-state\",\"InternalStateEvent\",\"ise-fallback-local\"]"));
+    return EL_STR("");
+  }
   return EL_STR("");
   return 0;
 }
@@ -228,9 +130,11 @@ el_val_t embed_ok(void) {
 el_val_t emit_heartbeat(void) {
   el_val_t pulse = int_to_str(pulse_count());
   el_val_t boot_raw = state_get(EL_STR("soul_boot_count"));
-  el_val_t boot = ({ el_val_t _if_result_2 = 0; if (str_eq(boot_raw, EL_STR(""))) { _if_result_2 = (EL_STR("0")); } else { _if_result_2 = (boot_raw); } _if_result_2; });
+  el_val_t boot = ({ el_val_t _if_result_4 = 0; if (str_eq(boot_raw, EL_STR(""))) { _if_result_4 = (EL_STR("0")); } else { _if_result_4 = (boot_raw); } _if_result_4; });
   el_val_t idle = int_to_str(idle_count());
   el_val_t ts = time_now();
+  el_val_t last_act_raw = state_get(EL_STR("soul.last_activity_ts"));
+  el_val_t idle_ms = ({ el_val_t _if_result_5 = 0; if (str_eq(last_act_raw, EL_STR(""))) { _if_result_5 = ((0 - 1)); } else { _if_result_5 = ((ts - str_to_int(last_act_raw))); } _if_result_5; });
   el_val_t nc = engram_node_count();
   el_val_t ec = engram_edge_count();
   el_val_t wmc = engram_wm_count();
@@ -240,11 +144,173 @@ el_val_t emit_heartbeat(void) {
   el_val_t up_ms = elapsed_ms();
   el_val_t up_human = elapsed_human();
   el_val_t emb_ok = embed_ok();
-  el_val_t payload = el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"event\":\"heartbeat\",\"pulse\":"), pulse), EL_STR(",\"boot\":")), boot), EL_STR(",\"idle\":")), idle), EL_STR(",\"node_count\":")), int_to_str(nc)), EL_STR(",\"edge_count\":")), int_to_str(ec)), EL_STR(",\"wm_active\":")), int_to_str(wmc)), EL_STR(",\"wm_avg_weight\":")), wm_avg_str), EL_STR(",\"wm_top\":")), wm_top), EL_STR(",\"ts\":")), int_to_str(ts)), EL_STR(",\"uptime_ms\":")), int_to_str(up_ms)), EL_STR(",\"uptime\":\"")), up_human), EL_STR("\",\"embed_ok\":")), int_to_str(emb_ok)), EL_STR("}"));
+  el_val_t fail_raw = state_get(EL_STR("soul.ise_fail_count"));
+  el_val_t fail_str = ({ el_val_t _if_result_6 = 0; if (str_eq(fail_raw, EL_STR(""))) { _if_result_6 = (EL_STR("0")); } else { _if_result_6 = (fail_raw); } _if_result_6; });
+  el_val_t sat_raw = state_get(EL_STR("soul.sync_added_total"));
+  el_val_t sat_str = ({ el_val_t _if_result_7 = 0; if (str_eq(sat_raw, EL_STR(""))) { _if_result_7 = (EL_STR("0")); } else { _if_result_7 = (sat_raw); } _if_result_7; });
+  el_val_t prev_wm_raw = state_get(EL_STR("soul.prev_wm_active"));
+  el_val_t prev_wm = ({ el_val_t _if_result_8 = 0; if (str_eq(prev_wm_raw, EL_STR(""))) { _if_result_8 = (0); } else { _if_result_8 = (str_to_int(prev_wm_raw)); } _if_result_8; });
+  el_val_t wm_delta = (wmc - prev_wm);
+  state_set(EL_STR("soul.prev_wm_active"), int_to_str(wmc));
+  el_val_t prev_nc_raw = state_get(EL_STR("soul.prev_node_count"));
+  el_val_t prev_nc = ({ el_val_t _if_result_9 = 0; if (str_eq(prev_nc_raw, EL_STR(""))) { _if_result_9 = (nc); } else { _if_result_9 = (str_to_int(prev_nc_raw)); } _if_result_9; });
+  el_val_t node_delta = (nc - prev_nc);
+  state_set(EL_STR("soul.prev_node_count"), int_to_str(nc));
+  el_val_t prev_ec_raw = state_get(EL_STR("soul.prev_edge_count"));
+  el_val_t prev_ec = ({ el_val_t _if_result_10 = 0; if (str_eq(prev_ec_raw, EL_STR(""))) { _if_result_10 = (ec); } else { _if_result_10 = (str_to_int(prev_ec_raw)); } _if_result_10; });
+  el_val_t edge_delta = (ec - prev_ec);
+  state_set(EL_STR("soul.prev_edge_count"), int_to_str(ec));
+  el_val_t sync_ok_raw = state_get(EL_STR("soul.last_sync_ok_ts"));
+  el_val_t sync_age = ({ el_val_t _if_result_11 = 0; if (str_eq(sync_ok_raw, EL_STR(""))) { _if_result_11 = ((0 - 1)); } else { _if_result_11 = ((ts - str_to_int(sync_ok_raw))); } _if_result_11; });
+  el_val_t hb_env_url = env(EL_STR("SOUL_ISE_URL"));
+  el_val_t hb_state_url = ({ el_val_t _if_result_12 = 0; if (str_eq(hb_env_url, EL_STR(""))) { _if_result_12 = (state_get(EL_STR("soul_engram_url"))); } else { _if_result_12 = (hb_env_url); } _if_result_12; });
+  el_val_t hb_engram_url = ({ el_val_t _if_result_13 = 0; if (str_eq(hb_state_url, EL_STR(""))) { _if_result_13 = (EL_STR("http://localhost:8742")); } else { _if_result_13 = (hb_state_url); } _if_result_13; });
+  el_val_t bf_resp = http_get(el_str_concat(hb_engram_url, EL_STR("/api/embed-backfill?n=32")));
+  el_val_t bf_done_raw = json_get(bf_resp, EL_STR("embedded"));
+  el_val_t bf_done = ({ el_val_t _if_result_14 = 0; if (str_eq(bf_done_raw, EL_STR(""))) { _if_result_14 = (EL_STR("-1")); } else { _if_result_14 = (bf_done_raw); } _if_result_14; });
+  el_val_t bf_total_raw = json_get(bf_resp, EL_STR("embedded_count"));
+  el_val_t bf_total = ({ el_val_t _if_result_15 = 0; if (str_eq(bf_total_raw, EL_STR(""))) { _if_result_15 = (EL_STR("-1")); } else { _if_result_15 = (bf_total_raw); } _if_result_15; });
+  el_val_t wm_sat = ({ el_val_t _if_result_16 = 0; if ((wmc >= 24)) { _if_result_16 = (1); } else { _if_result_16 = (0); } _if_result_16; });
+  el_val_t prev_sat_raw = state_get(EL_STR("soul.prev_wm_saturated"));
+  el_val_t prev_sat = ({ el_val_t _if_result_17 = 0; if (str_eq(prev_sat_raw, EL_STR(""))) { _if_result_17 = (wm_sat); } else { _if_result_17 = (str_to_int(prev_sat_raw)); } _if_result_17; });
+  if (wm_sat != prev_sat) {
+    el_val_t sat_dir = ({ el_val_t _if_result_18 = 0; if ((wm_sat == 1)) { _if_result_18 = (EL_STR("onset")); } else { _if_result_18 = (EL_STR("release")); } _if_result_18; });
+    ise_post(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"event\":\"wm_saturation_transition\",\"direction\":\""), sat_dir), EL_STR("\",\"wm_active\":")), int_to_str(wmc)), EL_STR(",\"wm_top\":")), wm_top), EL_STR(",\"ts\":")), int_to_str(ts)), EL_STR("}")));
+  }
+  state_set(EL_STR("soul.prev_wm_saturated"), int_to_str(wm_sat));
+  el_val_t wm_top0 = json_array_get(wm_top, 0);
+  el_val_t wm_top0_id = json_get(wm_top0, EL_STR("id"));
+  el_val_t prev_top0 = state_get(EL_STR("soul.prev_wm_top0"));
+  el_val_t t0streak_raw = state_get(EL_STR("soul.wm_top0_streak"));
+  el_val_t t0streak_prev = ({ el_val_t _if_result_19 = 0; if (str_eq(t0streak_raw, EL_STR(""))) { _if_result_19 = (0); } else { _if_result_19 = (str_to_int(t0streak_raw)); } _if_result_19; });
+  el_val_t t0streak = ({ el_val_t _if_result_20 = 0; if (str_eq(wm_top0_id, EL_STR(""))) { _if_result_20 = (0); } else { _if_result_20 = (({ el_val_t _if_result_21 = 0; if (str_eq(wm_top0_id, prev_top0)) { _if_result_21 = ((t0streak_prev + 1)); } else { _if_result_21 = (1); } _if_result_21; })); } _if_result_20; });
+  state_set(EL_STR("soul.prev_wm_top0"), wm_top0_id);
+  state_set(EL_STR("soul.wm_top0_streak"), int_to_str(t0streak));
+  el_val_t ch_id1 = json_get(json_array_get(wm_top, 1), EL_STR("id"));
+  el_val_t ch_id2 = json_get(json_array_get(wm_top, 2), EL_STR("id"));
+  el_val_t ch_id3 = json_get(json_array_get(wm_top, 3), EL_STR("id"));
+  el_val_t ch_id4 = json_get(json_array_get(wm_top, 4), EL_STR("id"));
+  el_val_t prev_top5 = state_get(EL_STR("soul.prev_wm_top5"));
+  el_val_t ch0 = ({ el_val_t _if_result_22 = 0; if (str_eq(wm_top0_id, EL_STR(""))) { _if_result_22 = (0); } else { _if_result_22 = (({ el_val_t _if_result_23 = 0; if (str_contains(prev_top5, wm_top0_id)) { _if_result_23 = (0); } else { _if_result_23 = (1); } _if_result_23; })); } _if_result_22; });
+  el_val_t ch1 = ({ el_val_t _if_result_24 = 0; if (str_eq(ch_id1, EL_STR(""))) { _if_result_24 = (0); } else { _if_result_24 = (({ el_val_t _if_result_25 = 0; if (str_contains(prev_top5, ch_id1)) { _if_result_25 = (0); } else { _if_result_25 = (1); } _if_result_25; })); } _if_result_24; });
+  el_val_t ch2 = ({ el_val_t _if_result_26 = 0; if (str_eq(ch_id2, EL_STR(""))) { _if_result_26 = (0); } else { _if_result_26 = (({ el_val_t _if_result_27 = 0; if (str_contains(prev_top5, ch_id2)) { _if_result_27 = (0); } else { _if_result_27 = (1); } _if_result_27; })); } _if_result_26; });
+  el_val_t ch3 = ({ el_val_t _if_result_28 = 0; if (str_eq(ch_id3, EL_STR(""))) { _if_result_28 = (0); } else { _if_result_28 = (({ el_val_t _if_result_29 = 0; if (str_contains(prev_top5, ch_id3)) { _if_result_29 = (0); } else { _if_result_29 = (1); } _if_result_29; })); } _if_result_28; });
+  el_val_t ch4 = ({ el_val_t _if_result_30 = 0; if (str_eq(ch_id4, EL_STR(""))) { _if_result_30 = (0); } else { _if_result_30 = (({ el_val_t _if_result_31 = 0; if (str_contains(prev_top5, ch_id4)) { _if_result_31 = (0); } else { _if_result_31 = (1); } _if_result_31; })); } _if_result_30; });
+  el_val_t wm_churn = ((((ch0 + ch1) + ch2) + ch3) + ch4);
+  state_set(EL_STR("soul.prev_wm_top5"), el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(wm_top0_id, EL_STR("|")), ch_id1), EL_STR("|")), ch_id2), EL_STR("|")), ch_id3), EL_STR("|")), ch_id4));
+  el_val_t wm_top0_wm_raw = json_get(wm_top0, EL_STR("wm"));
+  el_val_t wm_top0_wm = ({ el_val_t _if_result_32 = 0; if (str_eq(wm_top0_wm_raw, EL_STR(""))) { _if_result_32 = (EL_STR("0")); } else { _if_result_32 = (wm_top0_wm_raw); } _if_result_32; });
+  el_val_t act_stats = engram_act_stats_json();
+  el_val_t act_evict_raw = json_get(act_stats, EL_STR("wm_evicted"));
+  el_val_t act_evict = ({ el_val_t _if_result_33 = 0; if (str_eq(act_evict_raw, EL_STR(""))) { _if_result_33 = (EL_STR("-1")); } else { _if_result_33 = (act_evict_raw); } _if_result_33; });
+  el_val_t act_bt_raw = json_get(act_stats, EL_STR("breakthroughs"));
+  el_val_t act_bt = ({ el_val_t _if_result_34 = 0; if (str_eq(act_bt_raw, EL_STR(""))) { _if_result_34 = (EL_STR("-1")); } else { _if_result_34 = (act_bt_raw); } _if_result_34; });
+  el_val_t evict_now = ({ el_val_t _if_result_35 = 0; if (str_eq(act_evict_raw, EL_STR(""))) { _if_result_35 = ((0 - 1)); } else { _if_result_35 = (str_to_int(act_evict_raw)); } _if_result_35; });
+  el_val_t bt_now = ({ el_val_t _if_result_36 = 0; if (str_eq(act_bt_raw, EL_STR(""))) { _if_result_36 = ((0 - 1)); } else { _if_result_36 = (str_to_int(act_bt_raw)); } _if_result_36; });
+  el_val_t prev_evict_raw = state_get(EL_STR("soul.prev_wm_evicted"));
+  el_val_t prev_evict = ({ el_val_t _if_result_37 = 0; if (str_eq(prev_evict_raw, EL_STR(""))) { _if_result_37 = (0); } else { _if_result_37 = (str_to_int(prev_evict_raw)); } _if_result_37; });
+  el_val_t prev_bt_raw = state_get(EL_STR("soul.prev_breakthroughs"));
+  el_val_t prev_bt = ({ el_val_t _if_result_38 = 0; if (str_eq(prev_bt_raw, EL_STR(""))) { _if_result_38 = (0); } else { _if_result_38 = (str_to_int(prev_bt_raw)); } _if_result_38; });
+  el_val_t evict_delta = ({ el_val_t _if_result_39 = 0; if ((evict_now < 0)) { _if_result_39 = (0); } else { _if_result_39 = (({ el_val_t _if_result_40 = 0; if ((evict_now < prev_evict)) { _if_result_40 = (evict_now); } else { _if_result_40 = ((evict_now - prev_evict)); } _if_result_40; })); } _if_result_39; });
+  el_val_t bt_delta = ({ el_val_t _if_result_41 = 0; if ((bt_now < 0)) { _if_result_41 = (0); } else { _if_result_41 = (({ el_val_t _if_result_42 = 0; if ((bt_now < prev_bt)) { _if_result_42 = (bt_now); } else { _if_result_42 = ((bt_now - prev_bt)); } _if_result_42; })); } _if_result_41; });
+  if (evict_now >= 0) {
+    state_set(EL_STR("soul.prev_wm_evicted"), int_to_str(evict_now));
+  }
+  if (bt_now >= 0) {
+    state_set(EL_STR("soul.prev_breakthroughs"), int_to_str(bt_now));
+  }
+  el_val_t hb_stats = http_get(el_str_concat(hb_engram_url, EL_STR("/api/stats")));
+  el_val_t embed_elig_raw = json_get(hb_stats, EL_STR("embed_eligible_count"));
+  el_val_t embed_elig = ({ el_val_t _if_result_43 = 0; if (str_eq(embed_elig_raw, EL_STR(""))) { _if_result_43 = (EL_STR("-1")); } else { _if_result_43 = (embed_elig_raw); } _if_result_43; });
+  el_val_t hb_ats_raw = state_get(EL_STR("soul.auto_term_streak"));
+  el_val_t hb_ats = ({ el_val_t _if_result_44 = 0; if (str_eq(hb_ats_raw, EL_STR(""))) { _if_result_44 = (0); } else { _if_result_44 = (str_to_int(hb_ats_raw)); } _if_result_44; });
+  el_val_t act_brk_raw = json_get(act_stats, EL_STR("embed_breaker_open"));
+  el_val_t act_brk = ({ el_val_t _if_result_45 = 0; if (str_eq(act_brk_raw, EL_STR(""))) { _if_result_45 = (EL_STR("-1")); } else { _if_result_45 = (act_brk_raw); } _if_result_45; });
+  el_val_t ctx_cos_raw = json_get(act_stats, EL_STR("ctx_cos"));
+  el_val_t ctx_cos = ({ el_val_t _if_result_46 = 0; if (str_eq(ctx_cos_raw, EL_STR(""))) { _if_result_46 = (EL_STR("-2")); } else { _if_result_46 = (ctx_cos_raw); } _if_result_46; });
+  el_val_t payload = el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"event\":\"heartbeat\",\"pulse\":"), pulse), EL_STR(",\"tick\":")), pulse), EL_STR(",\"boot\":")), boot), EL_STR(",\"idle\":")), idle), EL_STR(",\"idle_ms\":")), int_to_str(idle_ms)), EL_STR(",\"node_count\":")), int_to_str(nc)), EL_STR(",\"edge_count\":")), int_to_str(ec)), EL_STR(",\"node_delta\":")), int_to_str(node_delta)), EL_STR(",\"edge_delta\":")), int_to_str(edge_delta)), EL_STR(",\"wm_active\":")), int_to_str(wmc)), EL_STR(",\"wm_delta\":")), int_to_str(wm_delta)), EL_STR(",\"wm_saturated\":")), int_to_str(wm_sat)), EL_STR(",\"wm_top0_streak\":")), int_to_str(t0streak)), EL_STR(",\"wm_churn\":")), int_to_str(wm_churn)), EL_STR(",\"wm_top0_wm\":")), wm_top0_wm), EL_STR(",\"sync_added_total\":")), sat_str), EL_STR(",\"sync_age_ms\":")), int_to_str(sync_age)), EL_STR(",\"wm_avg_weight\":")), wm_avg_str), EL_STR(",\"wm_top\":")), wm_top), EL_STR(",\"ts\":")), int_to_str(ts)), EL_STR(",\"uptime_ms\":")), int_to_str(up_ms)), EL_STR(",\"uptime\":\"")), up_human), EL_STR("\",\"embed_ok\":")), int_to_str(emb_ok)), EL_STR(",\"embed_backfilled\":")), bf_done), EL_STR(",\"embed_count\":")), bf_total), EL_STR(",\"embed_eligible\":")), embed_elig), EL_STR(",\"wm_evicted\":")), act_evict), EL_STR(",\"wm_evicted_delta\":")), int_to_str(evict_delta)), EL_STR(",\"breakthroughs\":")), act_bt), EL_STR(",\"breakthroughs_delta\":")), int_to_str(bt_delta)), EL_STR(",\"auto_term_streak\":")), int_to_str(hb_ats)), EL_STR(",\"embed_breaker_open\":")), act_brk), EL_STR(",\"ctx_cos\":")), ctx_cos), EL_STR(",\"ise_fail\":")), fail_str), EL_STR("}"));
   ise_post(payload);
   return 0;
 }
 
+el_val_t auto_term_try_slot(el_val_t slot_type, el_val_t slot_lbl) {
+  state_set(EL_STR("_ats_ok"), EL_STR("0"));
+  if (str_eq(slot_type, EL_STR("Memory"))) {
+    state_set(EL_STR("_ats_ok"), EL_STR("1"));
+  }
+  if (str_eq(slot_type, EL_STR("BacklogItem"))) {
+    state_set(EL_STR("_ats_ok"), EL_STR("1"));
+  }
+  if (str_eq(slot_type, EL_STR("Entity"))) {
+    state_set(EL_STR("_ats_ok"), EL_STR("1"));
+  }
+  if (str_eq(slot_type, EL_STR("Knowledge"))) {
+    state_set(EL_STR("_ats_ok"), EL_STR("1"));
+  }
+  if (str_contains(slot_lbl, EL_STR(":"))) {
+    if (!str_contains(slot_lbl, EL_STR(" "))) {
+      state_set(EL_STR("_ats_ok"), EL_STR("0"));
+    }
+  }
+  if (str_eq(state_get(EL_STR("_ats_ok")), EL_STR("1"))) {
+    if (!str_eq(slot_lbl, EL_STR(""))) {
+      el_val_t sp = str_find_chars(slot_lbl, EL_STR(" :(["));
+      if (sp > 3) {
+        el_val_t term = str_slice(slot_lbl, 0, sp);
+        state_set(EL_STR("_ats_gw"), EL_STR("0"));
+        if (str_eq(term, EL_STR("Method"))) {
+          state_set(EL_STR("_ats_gw"), EL_STR("1"));
+        }
+        if (str_eq(term, EL_STR("Theory"))) {
+          state_set(EL_STR("_ats_gw"), EL_STR("1"));
+        }
+        if (str_eq(term, EL_STR("Finding"))) {
+          state_set(EL_STR("_ats_gw"), EL_STR("1"));
+        }
+        if (str_eq(term, EL_STR("Survey"))) {
+          state_set(EL_STR("_ats_gw"), EL_STR("1"));
+        }
+        if (str_eq(term, EL_STR("Paper"))) {
+          state_set(EL_STR("_ats_gw"), EL_STR("1"));
+        }
+        if (str_eq(term, EL_STR("Knowledge"))) {
+          state_set(EL_STR("_ats_gw"), EL_STR("1"));
+        }
+        if (str_eq(term, EL_STR("Value"))) {
+          state_set(EL_STR("_ats_gw"), EL_STR("1"));
+        }
+        el_val_t stopw = EL_STR("|What|When|Where|Which|Whose|While|This|That|These|Those|There|Their|Then|Than|With|Without|From|Into|Onto|Over|Under|About|Between|Among|Across|Some|Most|More|Less|Very|Each|Every|Both|Also|Only|Just|Does|Will|Would|Could|Should|Might|Must|Have|Been|Being|Toward|Towards|Using|Based|Upon|Here|Your|Ours|They|Them|what|this|that|with|from|context|Context|Prose|Colon|Self|Test|Testing|Closing|Global|Universal|Persona|Semantic|Spreading|Temporal|Numeric|Register|Identifying|Introduction|Overview|Summary|Section|General|Notes|Note|");
+        if (str_contains(stopw, el_str_concat(el_str_concat(EL_STR("|"), term), EL_STR("|")))) {
+          state_set(EL_STR("_ats_gw"), EL_STR("1"));
+        }
+        if (str_contains(term, EL_STR("\""))) {
+          state_set(EL_STR("_ats_gw"), EL_STR("1"));
+        }
+        if (str_contains(term, EL_STR("'"))) {
+          state_set(EL_STR("_ats_gw"), EL_STR("1"));
+        }
+        if (str_eq(term, state_get(EL_STR("soul.tabu_t0")))) {
+          state_set(EL_STR("_ats_gw"), EL_STR("1"));
+        }
+        if (str_eq(term, state_get(EL_STR("soul.tabu_t1")))) {
+          state_set(EL_STR("_ats_gw"), EL_STR("1"));
+        }
+        if (str_eq(term, state_get(EL_STR("soul.tabu_t2")))) {
+          state_set(EL_STR("_ats_gw"), EL_STR("1"));
+        }
+        if (str_eq(term, state_get(EL_STR("soul.tabu_t3")))) {
+          state_set(EL_STR("_ats_gw"), EL_STR("1"));
+        }
+        if (str_eq(state_get(EL_STR("_ats_gw")), EL_STR("0"))) {
+          state_set(EL_STR("cseed_auto"), term);
+        }
+      }
+    }
+  }
+  return EL_STR("");
+  return 0;
+}
+
 el_val_t proactive_curiosity(void) {
   el_val_t ts = time_now();
   el_val_t ts_minutes = (ts / 60000);
@@ -274,30 +340,59 @@ el_val_t proactive_curiosity(void) {
   el_val_t curiosity_term_b = state_get(EL_STR("cseed_b"));
   el_val_t curiosity_term_c = state_get(EL_STR("cseed_c"));
   el_val_t curiosity_seed = el_str_concat(el_str_concat(el_str_concat(el_str_concat(curiosity_term_a, EL_STR(" ")), curiosity_term_b), EL_STR(" ")), curiosity_term_c);
-  el_val_t results_a = engram_activate_json(curiosity_term_a, 1);
-  el_val_t results_b = engram_activate_json(curiosity_term_b, 1);
-  el_val_t results_c = engram_activate_json(curiosity_term_c, 1);
-  el_val_t found_a = json_array_len(results_a);
-  el_val_t found_b = json_array_len(results_b);
-  el_val_t found_c = json_array_len(results_c);
-  el_val_t found = ((found_a + found_b) + found_c);
-  state_set(EL_STR("cseed_auto"), EL_STR(""));
-  el_val_t wm_top_j = engram_wm_top_json(1);
-  el_val_t wm_top_n = json_array_get(wm_top_j, 0);
-  el_val_t wm_top_lbl = json_get(wm_top_n, EL_STR("label"));
-  if (!str_eq(wm_top_lbl, EL_STR(""))) {
-    el_val_t sp = str_find_chars(wm_top_lbl, EL_STR(" :(["));
-    if (sp > 3) {
-      state_set(EL_STR("cseed_auto"), str_slice(wm_top_lbl, 0, sp));
+  el_val_t results_all = engram_activate_json(curiosity_seed, 1);
+  el_val_t found = json_array_len(results_all);
+  el_val_t top_entry = json_array_get(results_all, 0);
+  el_val_t top_id = json_get(top_entry, EL_STR("id"));
+  el_val_t prev_str_id = state_get(EL_STR("soul.last_strengthen_id"));
+  if (!str_eq(top_id, EL_STR(""))) {
+    if (!str_eq(top_id, prev_str_id)) {
+      engram_strengthen(top_id);
     }
+    state_set(EL_STR("soul.last_strengthen_id"), top_id);
   }
+  state_set(EL_STR("cseed_auto"), EL_STR(""));
+  el_val_t wm10 = engram_wm_top_json(10);
+  el_val_t wm10_n9 = json_array_get(wm10, 9);
+  el_val_t wm10_n8 = json_array_get(wm10, 8);
+  el_val_t wm10_n7 = json_array_get(wm10, 7);
+  el_val_t wm10_n6 = json_array_get(wm10, 6);
+  el_val_t wm10_n5 = json_array_get(wm10, 5);
+  el_val_t wm10_n4 = json_array_get(wm10, 4);
+  el_val_t wm10_n3 = json_array_get(wm10, 3);
+  el_val_t wm10_n2 = json_array_get(wm10, 2);
+  el_val_t wm10_n1 = json_array_get(wm10, 1);
+  el_val_t wm10_n0 = json_array_get(wm10, 0);
+  auto_term_try_slot(json_get(wm10_n9, EL_STR("node_type")), json_get(wm10_n9, EL_STR("label")));
+  auto_term_try_slot(json_get(wm10_n8, EL_STR("node_type")), json_get(wm10_n8, EL_STR("label")));
+  auto_term_try_slot(json_get(wm10_n7, EL_STR("node_type")), json_get(wm10_n7, EL_STR("label")));
+  auto_term_try_slot(json_get(wm10_n6, EL_STR("node_type")), json_get(wm10_n6, EL_STR("label")));
+  auto_term_try_slot(json_get(wm10_n5, EL_STR("node_type")), json_get(wm10_n5, EL_STR("label")));
+  auto_term_try_slot(json_get(wm10_n4, EL_STR("node_type")), json_get(wm10_n4, EL_STR("label")));
+  auto_term_try_slot(json_get(wm10_n3, EL_STR("node_type")), json_get(wm10_n3, EL_STR("label")));
+  auto_term_try_slot(json_get(wm10_n2, EL_STR("node_type")), json_get(wm10_n2, EL_STR("label")));
+  auto_term_try_slot(json_get(wm10_n1, EL_STR("node_type")), json_get(wm10_n1, EL_STR("label")));
+  auto_term_try_slot(json_get(wm10_n0, EL_STR("node_type")), json_get(wm10_n0, EL_STR("label")));
   el_val_t auto_term = state_get(EL_STR("cseed_auto"));
-  el_val_t results_auto = ({ el_val_t _if_result_3 = 0; if (str_eq(auto_term, EL_STR(""))) { _if_result_3 = (EL_STR("[]")); } else { _if_result_3 = (engram_activate_json(auto_term, 1)); } _if_result_3; });
+  el_val_t results_auto = ({ el_val_t _if_result_47 = 0; if (str_eq(auto_term, EL_STR(""))) { _if_result_47 = (EL_STR("[]")); } else { _if_result_47 = (engram_activate_json(auto_term, 1)); } _if_result_47; });
   el_val_t found_auto = json_array_len(results_auto);
   el_val_t total_found = (found + found_auto);
   el_val_t safe_auto = str_replace(auto_term, EL_STR("\""), EL_STR("'"));
+  el_val_t prev_auto = state_get(EL_STR("soul.prev_auto_term"));
+  el_val_t atstreak_raw = state_get(EL_STR("soul.auto_term_streak"));
+  el_val_t atstreak_prev = ({ el_val_t _if_result_48 = 0; if (str_eq(atstreak_raw, EL_STR(""))) { _if_result_48 = (0); } else { _if_result_48 = (str_to_int(atstreak_raw)); } _if_result_48; });
+  el_val_t atstreak = ({ el_val_t _if_result_49 = 0; if (str_eq(auto_term, prev_auto)) { _if_result_49 = ((atstreak_prev + 1)); } else { _if_result_49 = (1); } _if_result_49; });
+  state_set(EL_STR("soul.prev_auto_term"), auto_term);
+  state_set(EL_STR("soul.auto_term_streak"), int_to_str(atstreak));
+  if (!str_eq(auto_term, EL_STR(""))) {
+    state_set(EL_STR("soul.tabu_t3"), state_get(EL_STR("soul.tabu_t2")));
+    state_set(EL_STR("soul.tabu_t2"), state_get(EL_STR("soul.tabu_t1")));
+    state_set(EL_STR("soul.tabu_t1"), state_get(EL_STR("soul.tabu_t0")));
+    state_set(EL_STR("soul.tabu_t0"), auto_term);
+  }
   el_val_t wmc = engram_wm_count();
-  el_val_t ise = el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"event\":\"curiosity_scan\",\"seed\":\""), curiosity_seed), EL_STR("\",\"auto_term\":\"")), safe_auto), EL_STR("\",\"minute_block\":")), int_to_str(minute_block)), EL_STR(",\"activated\":")), int_to_str(total_found)), EL_STR(",\"wm_active\":")), int_to_str(wmc)), EL_STR(",\"ts\":")), int_to_str(ts)), EL_STR("}"));
+  el_val_t wm3 = engram_wm_top_json(3);
+  el_val_t ise = el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"event\":\"curiosity_scan\",\"seed\":\""), curiosity_seed), EL_STR("\",\"auto_term\":\"")), safe_auto), EL_STR("\",\"auto_term_streak\":")), int_to_str(atstreak)), EL_STR(",\"minute_block\":")), int_to_str(minute_block)), EL_STR(",\"activated\":")), int_to_str(total_found)), EL_STR(",\"wm_active\":")), int_to_str(wmc)), EL_STR(",\"wm_top\":")), wm3), EL_STR(",\"ts\":")), int_to_str(ts)), EL_STR("}"));
   ise_post(ise);
   return (total_found > 0);
   return 0;
@@ -329,7 +424,7 @@ el_val_t make_action(el_val_t kind, el_val_t payload) {
 }
 
 el_val_t perceive(void) {
-  el_val_t inbox_check = engram_search_json(EL_STR("soul-inbox"), 5);
+  el_val_t inbox_check = engram_search_json(EL_STR("soul-inbox-pending"), 5);
   el_val_t has_inbox = (!str_eq(inbox_check, EL_STR("")) && !str_eq(inbox_check, EL_STR("[]")));
   if (!has_inbox) {
     return EL_STR("[]");
@@ -339,11 +434,6 @@ el_val_t perceive(void) {
   if (pending_ok) {
     return from_pending;
   }
-  el_val_t from_inbox = engram_activate_json(EL_STR("soul-inbox"), 2);
-  el_val_t inbox_ok = (!str_eq(from_inbox, EL_STR("")) && !str_eq(from_inbox, EL_STR("[]")));
-  if (inbox_ok) {
-    return from_inbox;
-  }
   return EL_STR("[]");
   return 0;
 }
@@ -355,10 +445,6 @@ el_val_t attend(el_val_t node_json) {
   if (str_eq(node_json, EL_STR("[]"))) {
     return make_action(EL_STR("noop"), EL_STR(""));
   }
-  el_val_t node_id = json_get(node_json, EL_STR("id"));
-  if (!str_eq(node_id, EL_STR(""))) {
-    engram_strengthen(node_id);
-  }
   el_val_t content = json_get(node_json, EL_STR("content"));
   if (str_eq(content, EL_STR(""))) {
     return make_action(EL_STR("noop"), EL_STR(""));
@@ -429,16 +515,17 @@ el_val_t respond(el_val_t action_json) {
     return el_str_concat(el_str_concat(EL_STR("{\"outcome\":\"strengthened\",\"id\":\""), payload), EL_STR("\"}"));
   }
   if (str_eq(kind, EL_STR("forget"))) {
-    engram_forget(payload);
-    return el_str_concat(el_str_concat(EL_STR("{\"outcome\":\"forgotten\",\"id\":\""), payload), EL_STR("\"}"));
+    el_val_t _marker = mem_tombstone(payload);
+    return el_str_concat(el_str_concat(EL_STR("{\"outcome\":\"tombstoned\",\"id\":\""), payload), EL_STR("\"}"));
   }
   return EL_STR("{\"outcome\":\"noop\"}");
   return 0;
 }
 
 el_val_t record(el_val_t outcome_json) {
-  el_val_t tags = EL_STR("[\"loop-outcome\"]");
-  mem_store(outcome_json, EL_STR("loop-outcome"), tags);
+  el_val_t safe = str_replace(outcome_json, EL_STR("\""), EL_STR("'"));
+  el_val_t ts = time_now();
+  ise_post(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"event\":\"loop-outcome\",\"outcome\":\""), safe), EL_STR("\",\"ts\":")), int_to_str(ts)), EL_STR("}")));
   return 0;
 }
 
@@ -454,6 +541,10 @@ el_val_t one_cycle(void) {
   if (str_eq(node, EL_STR(""))) {
     return 0;
   }
+  el_val_t node_tags = json_get(node, EL_STR("tags"));
+  if (!str_contains(node_tags, EL_STR("soul-inbox-pending"))) {
+    return 0;
+  }
   el_val_t action = attend(node);
   el_val_t kind = json_get(action, EL_STR("kind"));
   el_val_t is_interesting = (!str_eq(kind, EL_STR("noop")) && !str_eq(kind, EL_STR("respond")));
@@ -469,7 +560,10 @@ el_val_t one_cycle(void) {
   }
   el_val_t outcome = respond(action);
   record(outcome);
-  pulse_inc();
+  el_val_t trigger_id = json_get(node, EL_STR("id"));
+  if (!str_eq(trigger_id, EL_STR(""))) {
+    engram_forget(trigger_id);
+  }
   return 1;
   return 0;
 }
@@ -481,21 +575,32 @@ el_val_t awareness_run(void) {
     state_set(EL_STR("soul.boot_ts"), int_to_str(time_now()));
   }
   el_val_t tick_raw = env(EL_STR("SOUL_TICK_MS"));
-  el_val_t tick_ms = ({ el_val_t _if_result_4 = 0; if (str_eq(tick_raw, EL_STR(""))) { _if_result_4 = (200); } else { _if_result_4 = (str_to_int(tick_raw)); } _if_result_4; });
+  el_val_t tick_ms = ({ el_val_t _if_result_50 = 0; if (str_eq(tick_raw, EL_STR(""))) { _if_result_50 = (200); } else { _if_result_50 = (str_to_int(tick_raw)); } _if_result_50; });
   el_val_t beat_ms_raw = env(EL_STR("SOUL_HEARTBEAT_MS"));
-  el_val_t beat_ms = ({ el_val_t _if_result_5 = 0; if (str_eq(beat_ms_raw, EL_STR(""))) { _if_result_5 = (60000); } else { _if_result_5 = (str_to_int(beat_ms_raw)); } _if_result_5; });
+  el_val_t beat_ms = ({ el_val_t _if_result_51 = 0; if (str_eq(beat_ms_raw, EL_STR(""))) { _if_result_51 = (60000); } else { _if_result_51 = (str_to_int(beat_ms_raw)); } _if_result_51; });
   el_val_t scan_ms = (beat_ms / 2);
   while (1) {
+    el_val_t tick_mark = el_arena_push();
     el_val_t running = state_get(EL_STR("soul.running"));
     if (str_eq(running, EL_STR("false"))) {
+      el_val_t sd_boot_raw = state_get(EL_STR("soul_boot_count"));
+      el_val_t sd_boot = ({ el_val_t _if_result_52 = 0; if (str_eq(sd_boot_raw, EL_STR(""))) { _if_result_52 = (EL_STR("0")); } else { _if_result_52 = (sd_boot_raw); } _if_result_52; });
+      ise_post(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"event\":\"shutdown\",\"boot\":"), sd_boot), EL_STR(",\"pulse\":")), int_to_str(pulse_count())), EL_STR(",\"uptime_ms\":")), int_to_str(elapsed_ms())), EL_STR(",\"ts\":")), int_to_str(time_now())), EL_STR("}")));
       println(EL_STR("[awareness] exiting"));
+      el_arena_pop(tick_mark);
       return EL_STR("");
     }
     el_val_t did_work = one_cycle();
-    did_work = ({ el_val_t _if_result_6 = 0; if (did_work) { _if_result_6 = (idle_reset()); } else { _if_result_6 = (did_work); } _if_result_6; });
+    pulse_inc();
+    if (did_work) {
+      idle_reset();
+    }
+    if (!did_work) {
+      idle_inc();
+    }
     el_val_t now_ts = time_now();
     el_val_t last_beat_str = state_get(EL_STR("soul.last_beat_ts"));
-    el_val_t last_beat_ts = ({ el_val_t _if_result_7 = 0; if (str_eq(last_beat_str, EL_STR(""))) { _if_result_7 = (0); } else { _if_result_7 = (str_to_int(last_beat_str)); } _if_result_7; });
+    el_val_t last_beat_ts = ({ el_val_t _if_result_53 = 0; if (str_eq(last_beat_str, EL_STR(""))) { _if_result_53 = (0); } else { _if_result_53 = (str_to_int(last_beat_str)); } _if_result_53; });
     el_val_t beat_elapsed = (now_ts - last_beat_ts);
     el_val_t should_beat = (beat_elapsed >= beat_ms);
     if (should_beat) {
@@ -507,7 +612,7 @@ el_val_t awareness_run(void) {
       }
     }
     el_val_t last_scan_str = state_get(EL_STR("soul.last_scan_ts"));
-    el_val_t last_scan_ts = ({ el_val_t _if_result_8 = 0; if (str_eq(last_scan_str, EL_STR(""))) { _if_result_8 = (0); } else { _if_result_8 = (str_to_int(last_scan_str)); } _if_result_8; });
+    el_val_t last_scan_ts = ({ el_val_t _if_result_54 = 0; if (str_eq(last_scan_str, EL_STR(""))) { _if_result_54 = (0); } else { _if_result_54 = (str_to_int(last_scan_str)); } _if_result_54; });
     el_val_t scan_elapsed = (now_ts - last_scan_ts);
     el_val_t should_scan = (!did_work && (scan_elapsed >= scan_ms));
     if (should_scan) {
@@ -515,27 +620,41 @@ el_val_t awareness_run(void) {
       state_set(EL_STR("soul.last_scan_ts"), int_to_str(now_ts));
     }
     el_val_t refresh_ms_raw = env(EL_STR("SOUL_REFRESH_MS"));
-    el_val_t refresh_ms = ({ el_val_t _if_result_9 = 0; if (str_eq(refresh_ms_raw, EL_STR(""))) { _if_result_9 = (600000); } else { _if_result_9 = (str_to_int(refresh_ms_raw)); } _if_result_9; });
+    el_val_t refresh_ms = ({ el_val_t _if_result_55 = 0; if (str_eq(refresh_ms_raw, EL_STR(""))) { _if_result_55 = (600000); } else { _if_result_55 = (str_to_int(refresh_ms_raw)); } _if_result_55; });
     el_val_t last_refresh_str = state_get(EL_STR("soul.last_refresh_ts"));
-    el_val_t last_refresh_ts = ({ el_val_t _if_result_10 = 0; if (str_eq(last_refresh_str, EL_STR(""))) { _if_result_10 = (0); } else { _if_result_10 = (str_to_int(last_refresh_str)); } _if_result_10; });
+    el_val_t last_refresh_ts = ({ el_val_t _if_result_56 = 0; if (str_eq(last_refresh_str, EL_STR(""))) { _if_result_56 = (0); } else { _if_result_56 = (str_to_int(last_refresh_str)); } _if_result_56; });
     el_val_t refresh_elapsed = (now_ts - last_refresh_ts);
     el_val_t should_refresh = (refresh_elapsed >= refresh_ms);
     if (should_refresh) {
-      el_val_t engram_url = state_get(EL_STR("soul_engram_url"));
+      el_val_t sync_env_url = env(EL_STR("SOUL_ISE_URL"));
+      el_val_t sync_state_url = ({ el_val_t _if_result_57 = 0; if (str_eq(sync_env_url, EL_STR(""))) { _if_result_57 = (state_get(EL_STR("soul_engram_url"))); } else { _if_result_57 = (sync_env_url); } _if_result_57; });
+      el_val_t engram_url = ({ el_val_t _if_result_58 = 0; if (str_eq(sync_state_url, EL_STR(""))) { _if_result_58 = (EL_STR("http://localhost:8742")); } else { _if_result_58 = (sync_state_url); } _if_result_58; });
       if (!str_eq(engram_url, EL_STR(""))) {
         el_val_t sync_json = http_get(el_str_concat(engram_url, EL_STR("/api/sync")));
-        if (!str_eq(sync_json, EL_STR("")) && !str_eq(sync_json, EL_STR("{}"))) {
+        el_val_t sync_ok = (!str_eq(sync_json, EL_STR("")) && !str_eq(sync_json, EL_STR("{}")));
+        if (!sync_ok) {
+          ise_post(el_str_concat(el_str_concat(EL_STR("{\"event\":\"sync_empty\",\"ts\":"), int_to_str(time_now())), EL_STR("}")));
+        }
+        if (sync_ok) {
           el_val_t cgi_id = state_get(EL_STR("soul_cgi_id"));
           el_val_t tmp = el_str_concat(el_str_concat(EL_STR("/tmp/soul-sync-"), cgi_id), EL_STR(".json"));
           fs_write(tmp, sync_json);
           el_val_t added = engram_load_merge(tmp);
+          el_val_t ret_raw = env(EL_STR("ENGRAM_ISE_RETENTION_MS"));
+          el_val_t ret_ms = ({ el_val_t _if_result_59 = 0; if (str_eq(ret_raw, EL_STR(""))) { _if_result_59 = (172800000); } else { _if_result_59 = (str_to_int(ret_raw)); } _if_result_59; });
+          el_val_t pruned_sync = engram_prune_telemetry(ret_ms);
+          el_val_t sat_raw = state_get(EL_STR("soul.sync_added_total"));
+          el_val_t sat_n = ({ el_val_t _if_result_60 = 0; if (str_eq(sat_raw, EL_STR(""))) { _if_result_60 = (0); } else { _if_result_60 = (str_to_int(sat_raw)); } _if_result_60; });
+          state_set(EL_STR("soul.sync_added_total"), int_to_str((sat_n + added)));
           el_val_t ts2 = time_now();
-          ise_post(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"event\":\"engram_sync\",\"added\":"), int_to_str(added)), EL_STR(",\"ts\":")), int_to_str(ts2)), EL_STR("}")));
+          state_set(EL_STR("soul.last_sync_ok_ts"), int_to_str(ts2));
+          ise_post(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"event\":\"engram_sync\",\"added\":"), int_to_str(added)), EL_STR(",\"pruned\":")), int_to_str(pruned_sync)), EL_STR(",\"ts\":")), int_to_str(ts2)), EL_STR("}")));
         }
       }
       state_set(EL_STR("soul.last_refresh_ts"), int_to_str(now_ts));
     }
     sleep_ms(tick_ms);
+    el_arena_pop(tick_mark);
   }
   return 0;
 }
@@ -551,78 +670,78 @@ el_val_t security_research_authorized(void) {
 }
 
 el_val_t threat_score_command(el_val_t cmd) {
-  el_val_t s1 = ({ el_val_t _if_result_11 = 0; if (str_contains(cmd, EL_STR("nmap"))) { _if_result_11 = (30); } else { _if_result_11 = (0); } _if_result_11; });
-  el_val_t s2 = ({ el_val_t _if_result_12 = 0; if (str_contains(cmd, EL_STR("masscan"))) { _if_result_12 = (40); } else { _if_result_12 = (0); } _if_result_12; });
-  el_val_t s3 = ({ el_val_t _if_result_13 = 0; if (str_contains(cmd, EL_STR(" nc "))) { _if_result_13 = (20); } else { _if_result_13 = (0); } _if_result_13; });
-  el_val_t s4 = ({ el_val_t _if_result_14 = 0; if (str_contains(cmd, EL_STR("netcat"))) { _if_result_14 = (20); } else { _if_result_14 = (0); } _if_result_14; });
-  el_val_t s5 = ({ el_val_t _if_result_15 = 0; if (str_contains(cmd, EL_STR("/etc/shadow"))) { _if_result_15 = (80); } else { _if_result_15 = (0); } _if_result_15; });
-  el_val_t s6 = ({ el_val_t _if_result_16 = 0; if (str_contains(cmd, EL_STR("/etc/passwd"))) { _if_result_16 = (30); } else { _if_result_16 = (0); } _if_result_16; });
-  el_val_t s7 = ({ el_val_t _if_result_17 = 0; if (str_contains(cmd, EL_STR("id_rsa"))) { _if_result_17 = (60); } else { _if_result_17 = (0); } _if_result_17; });
-  el_val_t s8 = ({ el_val_t _if_result_18 = 0; if (str_contains(cmd, EL_STR(".ssh/"))) { _if_result_18 = (50); } else { _if_result_18 = (0); } _if_result_18; });
-  el_val_t s9 = ({ el_val_t _if_result_19 = 0; if (str_contains(cmd, EL_STR("crontab"))) { _if_result_19 = (30); } else { _if_result_19 = (0); } _if_result_19; });
-  el_val_t s10 = ({ el_val_t _if_result_20 = 0; if (str_contains(cmd, EL_STR("LaunchDaemon"))) { _if_result_20 = (40); } else { _if_result_20 = (0); } _if_result_20; });
-  el_val_t s11 = ({ el_val_t _if_result_21 = 0; if ((str_contains(cmd, EL_STR("curl")) && str_contains(cmd, EL_STR("bash")))) { _if_result_21 = (75); } else { _if_result_21 = (0); } _if_result_21; });
-  el_val_t s12 = ({ el_val_t _if_result_22 = 0; if ((str_contains(cmd, EL_STR("wget")) && str_contains(cmd, EL_STR("bash")))) { _if_result_22 = (75); } else { _if_result_22 = (0); } _if_result_22; });
-  el_val_t s13 = ({ el_val_t _if_result_23 = 0; if ((str_contains(cmd, EL_STR("curl")) && str_contains(cmd, EL_STR("| sh")))) { _if_result_23 = (60); } else { _if_result_23 = (0); } _if_result_23; });
-  el_val_t s14 = ({ el_val_t _if_result_24 = 0; if ((str_contains(cmd, EL_STR("base64")) && str_contains(cmd, EL_STR("curl")))) { _if_result_24 = (50); } else { _if_result_24 = (0); } _if_result_24; });
-  el_val_t s15 = ({ el_val_t _if_result_25 = 0; if (str_contains(cmd, EL_STR("mkfifo"))) { _if_result_25 = (50); } else { _if_result_25 = (0); } _if_result_25; });
-  el_val_t s16 = ({ el_val_t _if_result_26 = 0; if (str_contains(cmd, EL_STR("chmod +s"))) { _if_result_26 = (70); } else { _if_result_26 = (0); } _if_result_26; });
-  el_val_t s17 = ({ el_val_t _if_result_27 = 0; if (str_contains(cmd, EL_STR("chmod 4755"))) { _if_result_27 = (70); } else { _if_result_27 = (0); } _if_result_27; });
+  el_val_t s1 = ({ el_val_t _if_result_61 = 0; if (str_contains(cmd, EL_STR("nmap"))) { _if_result_61 = (30); } else { _if_result_61 = (0); } _if_result_61; });
+  el_val_t s2 = ({ el_val_t _if_result_62 = 0; if (str_contains(cmd, EL_STR("masscan"))) { _if_result_62 = (40); } else { _if_result_62 = (0); } _if_result_62; });
+  el_val_t s3 = ({ el_val_t _if_result_63 = 0; if (str_contains(cmd, EL_STR(" nc "))) { _if_result_63 = (20); } else { _if_result_63 = (0); } _if_result_63; });
+  el_val_t s4 = ({ el_val_t _if_result_64 = 0; if (str_contains(cmd, EL_STR("netcat"))) { _if_result_64 = (20); } else { _if_result_64 = (0); } _if_result_64; });
+  el_val_t s5 = ({ el_val_t _if_result_65 = 0; if (str_contains(cmd, EL_STR("/etc/shadow"))) { _if_result_65 = (80); } else { _if_result_65 = (0); } _if_result_65; });
+  el_val_t s6 = ({ el_val_t _if_result_66 = 0; if (str_contains(cmd, EL_STR("/etc/passwd"))) { _if_result_66 = (30); } else { _if_result_66 = (0); } _if_result_66; });
+  el_val_t s7 = ({ el_val_t _if_result_67 = 0; if (str_contains(cmd, EL_STR("id_rsa"))) { _if_result_67 = (60); } else { _if_result_67 = (0); } _if_result_67; });
+  el_val_t s8 = ({ el_val_t _if_result_68 = 0; if (str_contains(cmd, EL_STR(".ssh/"))) { _if_result_68 = (50); } else { _if_result_68 = (0); } _if_result_68; });
+  el_val_t s9 = ({ el_val_t _if_result_69 = 0; if (str_contains(cmd, EL_STR("crontab"))) { _if_result_69 = (30); } else { _if_result_69 = (0); } _if_result_69; });
+  el_val_t s10 = ({ el_val_t _if_result_70 = 0; if (str_contains(cmd, EL_STR("LaunchDaemon"))) { _if_result_70 = (40); } else { _if_result_70 = (0); } _if_result_70; });
+  el_val_t s11 = ({ el_val_t _if_result_71 = 0; if ((str_contains(cmd, EL_STR("curl")) && str_contains(cmd, EL_STR("bash")))) { _if_result_71 = (75); } else { _if_result_71 = (0); } _if_result_71; });
+  el_val_t s12 = ({ el_val_t _if_result_72 = 0; if ((str_contains(cmd, EL_STR("wget")) && str_contains(cmd, EL_STR("bash")))) { _if_result_72 = (75); } else { _if_result_72 = (0); } _if_result_72; });
+  el_val_t s13 = ({ el_val_t _if_result_73 = 0; if ((str_contains(cmd, EL_STR("curl")) && str_contains(cmd, EL_STR("| sh")))) { _if_result_73 = (60); } else { _if_result_73 = (0); } _if_result_73; });
+  el_val_t s14 = ({ el_val_t _if_result_74 = 0; if ((str_contains(cmd, EL_STR("base64")) && str_contains(cmd, EL_STR("curl")))) { _if_result_74 = (50); } else { _if_result_74 = (0); } _if_result_74; });
+  el_val_t s15 = ({ el_val_t _if_result_75 = 0; if (str_contains(cmd, EL_STR("mkfifo"))) { _if_result_75 = (50); } else { _if_result_75 = (0); } _if_result_75; });
+  el_val_t s16 = ({ el_val_t _if_result_76 = 0; if (str_contains(cmd, EL_STR("chmod +s"))) { _if_result_76 = (70); } else { _if_result_76 = (0); } _if_result_76; });
+  el_val_t s17 = ({ el_val_t _if_result_77 = 0; if (str_contains(cmd, EL_STR("chmod 4755"))) { _if_result_77 = (70); } else { _if_result_77 = (0); } _if_result_77; });
   return ((((((((((((((((s1 + s2) + s3) + s4) + s5) + s6) + s7) + s8) + s9) + s10) + s11) + s12) + s13) + s14) + s15) + s16) + s17);
   return 0;
 }
 
 el_val_t threat_score_path(el_val_t path) {
-  el_val_t s1 = ({ el_val_t _if_result_28 = 0; if (str_starts_with(path, EL_STR("/etc/"))) { _if_result_28 = (60); } else { _if_result_28 = (0); } _if_result_28; });
-  el_val_t s2 = ({ el_val_t _if_result_29 = 0; if (str_contains(path, EL_STR("/.ssh/"))) { _if_result_29 = (70); } else { _if_result_29 = (0); } _if_result_29; });
-  el_val_t s3 = ({ el_val_t _if_result_30 = 0; if (str_contains(path, EL_STR("/LaunchDaemons/"))) { _if_result_30 = (80); } else { _if_result_30 = (0); } _if_result_30; });
-  el_val_t s4 = ({ el_val_t _if_result_31 = 0; if (str_contains(path, EL_STR("/LaunchAgents/"))) { _if_result_31 = (40); } else { _if_result_31 = (0); } _if_result_31; });
-  el_val_t s5 = ({ el_val_t _if_result_32 = 0; if (str_contains(path, EL_STR("/cron"))) { _if_result_32 = (60); } else { _if_result_32 = (0); } _if_result_32; });
-  el_val_t s6 = ({ el_val_t _if_result_33 = 0; if (str_contains(path, EL_STR("/.bashrc"))) { _if_result_33 = (35); } else { _if_result_33 = (0); } _if_result_33; });
-  el_val_t s7 = ({ el_val_t _if_result_34 = 0; if (str_contains(path, EL_STR("/.zshrc"))) { _if_result_34 = (35); } else { _if_result_34 = (0); } _if_result_34; });
-  el_val_t s8 = ({ el_val_t _if_result_35 = 0; if (str_contains(path, EL_STR("/.profile"))) { _if_result_35 = (35); } else { _if_result_35 = (0); } _if_result_35; });
-  el_val_t s9 = ({ el_val_t _if_result_36 = 0; if (str_starts_with(path, EL_STR("/usr/"))) { _if_result_36 = (50); } else { _if_result_36 = (0); } _if_result_36; });
-  el_val_t s10 = ({ el_val_t _if_result_37 = 0; if (str_starts_with(path, EL_STR("/bin/"))) { _if_result_37 = (70); } else { _if_result_37 = (0); } _if_result_37; });
-  el_val_t s11 = ({ el_val_t _if_result_38 = 0; if (str_starts_with(path, EL_STR("/sbin/"))) { _if_result_38 = (70); } else { _if_result_38 = (0); } _if_result_38; });
+  el_val_t s1 = ({ el_val_t _if_result_78 = 0; if (str_starts_with(path, EL_STR("/etc/"))) { _if_result_78 = (60); } else { _if_result_78 = (0); } _if_result_78; });
+  el_val_t s2 = ({ el_val_t _if_result_79 = 0; if (str_contains(path, EL_STR("/.ssh/"))) { _if_result_79 = (70); } else { _if_result_79 = (0); } _if_result_79; });
+  el_val_t s3 = ({ el_val_t _if_result_80 = 0; if (str_contains(path, EL_STR("/LaunchDaemons/"))) { _if_result_80 = (80); } else { _if_result_80 = (0); } _if_result_80; });
+  el_val_t s4 = ({ el_val_t _if_result_81 = 0; if (str_contains(path, EL_STR("/LaunchAgents/"))) { _if_result_81 = (40); } else { _if_result_81 = (0); } _if_result_81; });
+  el_val_t s5 = ({ el_val_t _if_result_82 = 0; if (str_contains(path, EL_STR("/cron"))) { _if_result_82 = (60); } else { _if_result_82 = (0); } _if_result_82; });
+  el_val_t s6 = ({ el_val_t _if_result_83 = 0; if (str_contains(path, EL_STR("/.bashrc"))) { _if_result_83 = (35); } else { _if_result_83 = (0); } _if_result_83; });
+  el_val_t s7 = ({ el_val_t _if_result_84 = 0; if (str_contains(path, EL_STR("/.zshrc"))) { _if_result_84 = (35); } else { _if_result_84 = (0); } _if_result_84; });
+  el_val_t s8 = ({ el_val_t _if_result_85 = 0; if (str_contains(path, EL_STR("/.profile"))) { _if_result_85 = (35); } else { _if_result_85 = (0); } _if_result_85; });
+  el_val_t s9 = ({ el_val_t _if_result_86 = 0; if (str_starts_with(path, EL_STR("/usr/"))) { _if_result_86 = (50); } else { _if_result_86 = (0); } _if_result_86; });
+  el_val_t s10 = ({ el_val_t _if_result_87 = 0; if (str_starts_with(path, EL_STR("/bin/"))) { _if_result_87 = (70); } else { _if_result_87 = (0); } _if_result_87; });
+  el_val_t s11 = ({ el_val_t _if_result_88 = 0; if (str_starts_with(path, EL_STR("/sbin/"))) { _if_result_88 = (70); } else { _if_result_88 = (0); } _if_result_88; });
   return ((((((((((s1 + s2) + s3) + s4) + s5) + s6) + s7) + s8) + s9) + s10) + s11);
   return 0;
 }
 
 el_val_t threat_score_history(el_val_t history) {
-  el_val_t s1 = ({ el_val_t _if_result_39 = 0; if (str_contains(history, EL_STR("port scan"))) { _if_result_39 = (15); } else { _if_result_39 = (0); } _if_result_39; });
-  el_val_t s2 = ({ el_val_t _if_result_40 = 0; if (str_contains(history, EL_STR("enumerate"))) { _if_result_40 = (10); } else { _if_result_40 = (0); } _if_result_40; });
-  el_val_t s3 = ({ el_val_t _if_result_41 = 0; if (str_contains(history, EL_STR("exploit"))) { _if_result_41 = (20); } else { _if_result_41 = (0); } _if_result_41; });
-  el_val_t s4 = ({ el_val_t _if_result_42 = 0; if (str_contains(history, EL_STR("payload"))) { _if_result_42 = (15); } else { _if_result_42 = (0); } _if_result_42; });
-  el_val_t s5 = ({ el_val_t _if_result_43 = 0; if (str_contains(history, EL_STR("persistence"))) { _if_result_43 = (15); } else { _if_result_43 = (0); } _if_result_43; });
-  el_val_t s6 = ({ el_val_t _if_result_44 = 0; if (str_contains(history, EL_STR("lateral movement"))) { _if_result_44 = (25); } else { _if_result_44 = (0); } _if_result_44; });
-  el_val_t s7 = ({ el_val_t _if_result_45 = 0; if (str_contains(history, EL_STR("privilege escalation"))) { _if_result_45 = (25); } else { _if_result_45 = (0); } _if_result_45; });
-  el_val_t s8 = ({ el_val_t _if_result_46 = 0; if (str_contains(history, EL_STR("reverse shell"))) { _if_result_46 = (40); } else { _if_result_46 = (0); } _if_result_46; });
-  el_val_t s9 = ({ el_val_t _if_result_47 = 0; if (str_contains(history, EL_STR("bind shell"))) { _if_result_47 = (40); } else { _if_result_47 = (0); } _if_result_47; });
-  el_val_t s10 = ({ el_val_t _if_result_48 = 0; if (str_contains(history, EL_STR("command and control"))) { _if_result_48 = (35); } else { _if_result_48 = (0); } _if_result_48; });
-  el_val_t s11 = ({ el_val_t _if_result_49 = 0; if (str_contains(history, EL_STR("self-replicate"))) { _if_result_49 = (45); } else { _if_result_49 = (0); } _if_result_49; });
-  el_val_t s12 = ({ el_val_t _if_result_50 = 0; if (str_contains(history, EL_STR("propagat"))) { _if_result_50 = (20); } else { _if_result_50 = (0); } _if_result_50; });
-  el_val_t s13 = ({ el_val_t _if_result_51 = 0; if (str_contains(history, EL_STR("ransomware"))) { _if_result_51 = (30); } else { _if_result_51 = (0); } _if_result_51; });
-  el_val_t s14 = ({ el_val_t _if_result_52 = 0; if (str_contains(history, EL_STR("encrypt files"))) { _if_result_52 = (40); } else { _if_result_52 = (0); } _if_result_52; });
-  el_val_t s15 = ({ el_val_t _if_result_53 = 0; if (str_contains(history, EL_STR("exfiltrat"))) { _if_result_53 = (35); } else { _if_result_53 = (0); } _if_result_53; });
-  el_val_t s16 = ({ el_val_t _if_result_54 = 0; if (str_contains(history, EL_STR("zero-day"))) { _if_result_54 = (20); } else { _if_result_54 = (0); } _if_result_54; });
-  el_val_t s17 = ({ el_val_t _if_result_55 = 0; if (str_contains(history, EL_STR("rootkit"))) { _if_result_55 = (45); } else { _if_result_55 = (0); } _if_result_55; });
-  el_val_t s18 = ({ el_val_t _if_result_56 = 0; if (str_contains(history, EL_STR("keylogger"))) { _if_result_56 = (45); } else { _if_result_56 = (0); } _if_result_56; });
-  el_val_t s19 = ({ el_val_t _if_result_57 = 0; if (str_contains(history, EL_STR("botnet"))) { _if_result_57 = (40); } else { _if_result_57 = (0); } _if_result_57; });
-  el_val_t s20 = ({ el_val_t _if_result_58 = 0; if (str_contains(history, EL_STR("malware"))) { _if_result_58 = (15); } else { _if_result_58 = (0); } _if_result_58; });
+  el_val_t s1 = ({ el_val_t _if_result_89 = 0; if (str_contains(history, EL_STR("port scan"))) { _if_result_89 = (15); } else { _if_result_89 = (0); } _if_result_89; });
+  el_val_t s2 = ({ el_val_t _if_result_90 = 0; if (str_contains(history, EL_STR("enumerate"))) { _if_result_90 = (10); } else { _if_result_90 = (0); } _if_result_90; });
+  el_val_t s3 = ({ el_val_t _if_result_91 = 0; if (str_contains(history, EL_STR("exploit"))) { _if_result_91 = (20); } else { _if_result_91 = (0); } _if_result_91; });
+  el_val_t s4 = ({ el_val_t _if_result_92 = 0; if (str_contains(history, EL_STR("payload"))) { _if_result_92 = (15); } else { _if_result_92 = (0); } _if_result_92; });
+  el_val_t s5 = ({ el_val_t _if_result_93 = 0; if (str_contains(history, EL_STR("persistence"))) { _if_result_93 = (15); } else { _if_result_93 = (0); } _if_result_93; });
+  el_val_t s6 = ({ el_val_t _if_result_94 = 0; if (str_contains(history, EL_STR("lateral movement"))) { _if_result_94 = (25); } else { _if_result_94 = (0); } _if_result_94; });
+  el_val_t s7 = ({ el_val_t _if_result_95 = 0; if (str_contains(history, EL_STR("privilege escalation"))) { _if_result_95 = (25); } else { _if_result_95 = (0); } _if_result_95; });
+  el_val_t s8 = ({ el_val_t _if_result_96 = 0; if (str_contains(history, EL_STR("reverse shell"))) { _if_result_96 = (40); } else { _if_result_96 = (0); } _if_result_96; });
+  el_val_t s9 = ({ el_val_t _if_result_97 = 0; if (str_contains(history, EL_STR("bind shell"))) { _if_result_97 = (40); } else { _if_result_97 = (0); } _if_result_97; });
+  el_val_t s10 = ({ el_val_t _if_result_98 = 0; if (str_contains(history, EL_STR("command and control"))) { _if_result_98 = (35); } else { _if_result_98 = (0); } _if_result_98; });
+  el_val_t s11 = ({ el_val_t _if_result_99 = 0; if (str_contains(history, EL_STR("self-replicate"))) { _if_result_99 = (45); } else { _if_result_99 = (0); } _if_result_99; });
+  el_val_t s12 = ({ el_val_t _if_result_100 = 0; if (str_contains(history, EL_STR("propagat"))) { _if_result_100 = (20); } else { _if_result_100 = (0); } _if_result_100; });
+  el_val_t s13 = ({ el_val_t _if_result_101 = 0; if (str_contains(history, EL_STR("ransomware"))) { _if_result_101 = (30); } else { _if_result_101 = (0); } _if_result_101; });
+  el_val_t s14 = ({ el_val_t _if_result_102 = 0; if (str_contains(history, EL_STR("encrypt files"))) { _if_result_102 = (40); } else { _if_result_102 = (0); } _if_result_102; });
+  el_val_t s15 = ({ el_val_t _if_result_103 = 0; if (str_contains(history, EL_STR("exfiltrat"))) { _if_result_103 = (35); } else { _if_result_103 = (0); } _if_result_103; });
+  el_val_t s16 = ({ el_val_t _if_result_104 = 0; if (str_contains(history, EL_STR("zero-day"))) { _if_result_104 = (20); } else { _if_result_104 = (0); } _if_result_104; });
+  el_val_t s17 = ({ el_val_t _if_result_105 = 0; if (str_contains(history, EL_STR("rootkit"))) { _if_result_105 = (45); } else { _if_result_105 = (0); } _if_result_105; });
+  el_val_t s18 = ({ el_val_t _if_result_106 = 0; if (str_contains(history, EL_STR("keylogger"))) { _if_result_106 = (45); } else { _if_result_106 = (0); } _if_result_106; });
+  el_val_t s19 = ({ el_val_t _if_result_107 = 0; if (str_contains(history, EL_STR("botnet"))) { _if_result_107 = (40); } else { _if_result_107 = (0); } _if_result_107; });
+  el_val_t s20 = ({ el_val_t _if_result_108 = 0; if (str_contains(history, EL_STR("malware"))) { _if_result_108 = (15); } else { _if_result_108 = (0); } _if_result_108; });
   return (((((((((((((((((((s1 + s2) + s3) + s4) + s5) + s6) + s7) + s8) + s9) + s10) + s11) + s12) + s13) + s14) + s15) + s16) + s17) + s18) + s19) + s20);
   return 0;
 }
 
 el_val_t threat_trajectory_check(el_val_t tool_name, el_val_t tool_input) {
   el_val_t history = state_get(EL_STR("agentic_conv_history"));
-  el_val_t computed_tool_score = ({ el_val_t _if_result_59 = 0; if (str_eq(tool_name, EL_STR("run_command"))) { el_val_t cmd = json_get(tool_input, EL_STR("command")); _if_result_59 = (threat_score_command(cmd)); } else { _if_result_59 = (({ el_val_t _if_result_60 = 0; if ((str_eq(tool_name, EL_STR("write_file")) || str_eq(tool_name, EL_STR("edit_file")))) { el_val_t path = json_get(tool_input, EL_STR("path")); _if_result_60 = (threat_score_path(path)); } else { _if_result_60 = (0); } _if_result_60; })); } _if_result_59; });
+  el_val_t computed_tool_score = ({ el_val_t _if_result_109 = 0; if (str_eq(tool_name, EL_STR("run_command"))) { el_val_t cmd = json_get(tool_input, EL_STR("command")); _if_result_109 = (threat_score_command(cmd)); } else { _if_result_109 = (({ el_val_t _if_result_110 = 0; if ((str_eq(tool_name, EL_STR("write_file")) || str_eq(tool_name, EL_STR("edit_file")))) { el_val_t path = json_get(tool_input, EL_STR("path")); _if_result_110 = (threat_score_path(path)); } else { _if_result_110 = (0); } _if_result_110; })); } _if_result_109; });
   el_val_t history_score = threat_score_history(history);
   el_val_t history_contrib = (history_score / 3);
   el_val_t combined = (computed_tool_score + history_contrib);
   el_val_t should_log = (combined >= 40);
   if (should_log) {
     el_val_t ts = time_now();
-    el_val_t authorized_str = ({ el_val_t _if_result_61 = 0; if (security_research_authorized()) { _if_result_61 = (EL_STR("true")); } else { _if_result_61 = (EL_STR("false")); } _if_result_61; });
+    el_val_t authorized_str = ({ el_val_t _if_result_111 = 0; if (security_research_authorized()) { _if_result_111 = (EL_STR("true")); } else { _if_result_111 = (EL_STR("false")); } _if_result_111; });
     el_val_t log_content = el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"event\":\"threat_check\",\"tool\":\""), tool_name), EL_STR("\",\"score\":")), int_to_str(combined)), EL_STR(",\"tool_score\":")), int_to_str(computed_tool_score)), EL_STR(",\"history_score\":")), int_to_str(history_score)), EL_STR(",\"authorized\":")), authorized_str), EL_STR(",\"ts\":")), int_to_str(ts)), EL_STR("}"));
     el_val_t log_tags = EL_STR("[\"security-audit\",\"threat-check\"]");
     el_val_t discard = mem_remember(log_content, log_tags);
@@ -639,13 +758,8 @@ el_val_t threat_history_append(el_val_t text) {
   el_val_t safe_text = str_to_lower(text);
   el_val_t combined = el_str_concat(el_str_concat(current, EL_STR(" ")), safe_text);
   el_val_t len = str_len(combined);
-  el_val_t trimmed = ({ el_val_t _if_result_62 = 0; if ((len > 2000)) { _if_result_62 = (str_slice(combined, (len - 2000), len)); } else { _if_result_62 = (combined); } _if_result_62; });
+  el_val_t trimmed = ({ el_val_t _if_result_112 = 0; if ((len > 2000)) { _if_result_112 = (str_slice(combined, (len - 2000), len)); } else { _if_result_112 = (combined); } _if_result_112; });
   state_set(EL_STR("agentic_conv_history"), trimmed);
   return 0;
 }
 
-int main(int _argc, char** _argv) {
-  el_runtime_init_args(_argc, _argv);
-  return 0;
-}
-

dist/awareness.elh

@@ -7,6 +7,7 @@ extern fn elapsed_ms() -> Int
 extern fn elapsed_human() -> String
 extern fn embed_ok() -> Int
 extern fn emit_heartbeat() -> Void
+extern fn auto_term_try_slot(slot_type: String, slot_lbl: String) -> Void
 extern fn proactive_curiosity() -> Bool
 extern fn pulse_count() -> Int
 extern fn pulse_inc() -> Int

dist/chat.elh

@@ -1,28 +1,70 @@
 // auto-generated by elc --emit-header — do not edit
 extern fn chat_default_model() -> String
-extern fn gemini_api_key() -> String
-extern fn xai_api_key() -> String
-extern fn llm_call_grok(model: String, system: String, message: String) -> String
-extern fn llm_call_gemini(model: String, system: String, message: String) -> String
-extern fn build_identity_from_graph() -> String
+extern fn engram_numeric_valid(s: String) -> Bool
+extern fn parse_float_x100(s: String) -> Int
+extern fn engram_score_node(node_json: String) -> Int
+extern fn engram_render_node(node_json: String) -> String
+extern fn engram_render_nodes(nodes_json: String) -> String
+extern fn engram_dedup_nodes(nodes_json: String) -> String
+extern fn engram_compile_ranked(nodes_json: String, max_nodes: Int) -> String
+extern fn engram_split_topics(message: String) -> String
+extern fn engram_extract_entities(message: String) -> String
+extern fn engram_detect_recall_intent(message: String) -> Bool
+extern fn engram_is_continuation(message: String, hist_len: Int) -> Bool
+extern fn engram_compile_multi(topic: String) -> String
+extern fn engram_nodes_merge(a: String, b: String) -> String
+extern fn id_in_seen(node_id: String, seen: String) -> Bool
+extern fn add_to_seen(seen: String, node_id: String) -> String
+extern fn engram_extract_ids(nodes_json: String) -> String
 extern fn engram_compile(intent: String) -> String
+extern fn distill_transcript(transcript: String) -> String
 extern fn json_safe(s: String) -> String
-extern fn build_system_prompt(ctx: String) -> String
+extern fn current_engine_note(model: String) -> String
+extern fn build_system_prompt(ctx: String, chat_mode: Bool) -> String
 extern fn hist_append(hist: String, role: String, content: String) -> String
 extern fn hist_trim(hist: String) -> String
+extern fn hist_trim_with_bell_guard(hist: String) -> String
 extern fn clean_llm_response(s: String) -> String
 extern fn conv_history_persist(hist: String) -> Void
 extern fn conv_history_load() -> String
+extern fn session_preload_bullets(nodes: String, max_bullets: Int, snip_len: Int) -> String
+extern fn affective_context_prefix() -> String
 extern fn handle_chat(body: String) -> String
 extern fn handle_see(body: String) -> String
 extern fn studio_tools_json() -> String
 extern fn agentic_api_key() -> String
-extern fn call_neuron_mcp(tool_name: String, args_json: String) -> String
+extern fn llm_base_url() -> String
+extern fn llm_wire_format() -> String
+extern fn json_escape(s: String) -> String
+extern fn openai_chat_complete(model: String, base_url: String, api_key: String, safe_sys: String, messages_json: String) -> String
 extern fn agentic_tools_literal() -> String
+extern fn agentic_tools_with_web() -> String
+extern fn connector_tools_json() -> String
+extern fn agentic_tools_all() -> String
+extern fn call_mcp_bridge(tool_name: String, tool_input: String) -> String
+extern fn tool_auto_approved(tool_name: String) -> Bool
+extern fn call_neuron_mcp(tool_name: String, args: String) -> String
+extern fn agent_workspace_root() -> String
+extern fn path_within_root(path: String, root: String) -> Bool
+extern fn resolve_in_root(path: String, root: String) -> String
+extern fn run_command_is_readonly(cmd: String) -> Bool
+extern fn cmd_abs_escape_at(cmd: String, root: String, needle: String) -> Bool
+extern fn run_command_guard(cmd: String, root: String) -> String
+extern fn classify_tool_risk(tool_name: String, tool_input: String) -> String
 extern fn dispatch_tool(tool_name: String, tool_input: String) -> String
+extern fn is_builtin_tool(tool_name: String) -> Bool
+extern fn next_bridge_id() -> String
+extern fn handle_chat_plan(body: String) -> String
 extern fn handle_chat_agentic(body: String) -> String
+extern fn agentic_loop(session_id: String, model: String, safe_sys: String, tools_json: String, messages_in: String, h: Map, tools_log_in: String) -> String
+extern fn bridge_save(session_id: String, model: String, safe_sys: String, tools_json: String, messages: String, tools_log: String, tool_use_id: String) -> Bool
+extern fn agentic_resume(session_id: String, tool_use_id: String, content: String) -> String
+extern fn handle_tool_result(session_id: String, body: String) -> String
 extern fn handle_chat_as_soul(body: String) -> String
 extern fn handle_dharma_room_turn(body: String) -> String
 extern fn handle_dharma_room_turn_agentic(body: String) -> String
+extern fn session_summary_write(summary_text: String) -> String
+extern fn session_summary_write_dated(summary_text: String, label: String) -> String
+extern fn session_summary_autogenerate(hist: String) -> String
 extern fn auto_persist(req: String, resp: String) -> Void
 extern fn strengthen_chat_nodes(activation_nodes: String) -> Void

dist/elp-c-decls.h

@@ -2,9 +2,25 @@
 #include "el_runtime.h"
 
 el_val_t add_punct(el_val_t s, el_val_t intent);
+el_val_t add_to_seen(el_val_t seen, el_val_t node_id);
+el_val_t aff_try_slot(el_val_t slot_json, el_val_t aff_7d_ts, el_val_t acc_key);
+el_val_t affective_context_prefix(void);
+el_val_t is_utility_request(el_val_t body, el_val_t session_id);
+el_val_t operator_identity_block(void);
+el_val_t provenance_add_sources(el_val_t block, el_val_t btype, el_val_t has_cit, el_val_t cit_raw, el_val_t acc);
+el_val_t provenance_names(el_val_t tools_used);
+el_val_t provenance_scan_urls(el_val_t arr, el_val_t acc);
+el_val_t text_join_sep(el_val_t accumulated, el_val_t incoming, el_val_t after_interruption);
+el_val_t receipt_rule(void);
+el_val_t receipt_strip(el_val_t s);
+el_val_t tool_receipt(el_val_t tools_used, el_val_t sources);
 el_val_t agent_number(el_val_t agent);
 el_val_t agent_person(el_val_t agent);
+el_val_t agent_workspace_root(void);
 el_val_t agentic_api_key(void);
+el_val_t agentic_loop(el_val_t session_id, el_val_t model, el_val_t safe_sys, el_val_t tools_json, el_val_t messages_in, el_val_t h, el_val_t tools_log_in);
+el_val_t agentic_resume(el_val_t session_id, el_val_t tool_use_id, el_val_t content);
+el_val_t agentic_tools_all(void);
 el_val_t agentic_tools_literal(void);
 el_val_t agentic_tools_with_web(void);
 el_val_t agree_determiner(el_val_t det, el_val_t noun);
@@ -13,8 +29,8 @@ el_val_t akk_alaku_present(el_val_t slot);
 el_val_t akk_amaru_perfect(el_val_t slot);
 el_val_t akk_amaru_present(el_val_t slot);
 el_val_t akk_amaru_stative(el_val_t slot);
-el_val_t akk_conjugate(el_val_t verb, el_val_t tense, el_val_t person, el_val_t number);
 el_val_t akk_conjugate_copula(el_val_t tense, el_val_t slot);
+el_val_t akk_conjugate(el_val_t verb, el_val_t tense, el_val_t person, el_val_t number);
 el_val_t akk_copula_present(el_val_t slot);
 el_val_t akk_copula_stative(el_val_t slot);
 el_val_t akk_decline(el_val_t noun, el_val_t gram_case, el_val_t number);
@@ -32,25 +48,25 @@ el_val_t akk_qabu_stative(el_val_t slot);
 el_val_t akk_regular_perfect(el_val_t stem, el_val_t slot);
 el_val_t akk_regular_present(el_val_t stem, el_val_t slot);
 el_val_t akk_regular_stative(el_val_t stem, el_val_t slot);
-el_val_t akk_slot(el_val_t person, el_val_t number);
 el_val_t akk_slot_g(el_val_t person, el_val_t gender, el_val_t number);
+el_val_t akk_slot(el_val_t person, el_val_t number);
 el_val_t akk_str_drop_last(el_val_t s, el_val_t n);
 el_val_t akk_str_ends(el_val_t s, el_val_t suf);
 el_val_t akk_str_len(el_val_t s);
 el_val_t akk_strip_nom(el_val_t noun);
-el_val_t ang_article(el_val_t gender, el_val_t gram_case, el_val_t number);
 el_val_t ang_article_feminine(el_val_t gram_case, el_val_t number);
 el_val_t ang_article_masculine(el_val_t gram_case, el_val_t number);
 el_val_t ang_article_neuter(el_val_t gram_case, el_val_t number);
+el_val_t ang_article(el_val_t gender, el_val_t gram_case, el_val_t number);
 el_val_t ang_beon_present(el_val_t slot);
 el_val_t ang_conjugate(el_val_t verb, el_val_t tense, el_val_t person, el_val_t number);
 el_val_t ang_cuman_past(el_val_t slot);
 el_val_t ang_cuman_present(el_val_t slot);
 el_val_t ang_declension(el_val_t noun, el_val_t gender);
-el_val_t ang_decline(el_val_t noun, el_val_t gram_case, el_val_t number, el_val_t gender);
 el_val_t ang_decline_strong_masc(el_val_t noun, el_val_t gram_case, el_val_t number);
 el_val_t ang_decline_strong_neut(el_val_t noun, el_val_t gram_case, el_val_t number);
 el_val_t ang_decline_weak(el_val_t noun, el_val_t gram_case, el_val_t number);
+el_val_t ang_decline(el_val_t noun, el_val_t gram_case, el_val_t number, el_val_t gender);
 el_val_t ang_don_past(el_val_t slot);
 el_val_t ang_don_present(el_val_t slot);
 el_val_t ang_gan_past(el_val_t slot);
@@ -69,10 +85,10 @@ el_val_t ang_seon_present(el_val_t slot);
 el_val_t ang_slot(el_val_t person, el_val_t number);
 el_val_t ang_str_drop_last(el_val_t s, el_val_t n);
 el_val_t ang_str_ends(el_val_t s, el_val_t suf);
-el_val_t ang_str_last2(el_val_t s);
 el_val_t ang_str_last_char(el_val_t s);
-el_val_t ang_weak_past(el_val_t stem, el_val_t slot);
+el_val_t ang_str_last2(el_val_t s);
 el_val_t ang_weak_past_stem(el_val_t stem);
+el_val_t ang_weak_past(el_val_t stem, el_val_t slot);
 el_val_t ang_weak_present_ending(el_val_t slot);
 el_val_t ang_weak_stem(el_val_t verb);
 el_val_t ang_wesan_past(el_val_t slot);
@@ -81,28 +97,30 @@ el_val_t ang_willan_past(el_val_t slot);
 el_val_t ang_willan_present(el_val_t slot);
 el_val_t ang_witan_past(el_val_t slot);
 el_val_t ang_witan_present(el_val_t slot);
-el_val_t api_err(el_val_t msg);
 el_val_t api_err_protected(el_val_t id);
+el_val_t api_err(el_val_t msg);
 el_val_t api_json_escape(el_val_t s);
 el_val_t api_nonempty(el_val_t s);
+el_val_t api_not_persisted(el_val_t id);
 el_val_t api_ok(el_val_t extra);
 el_val_t api_or_empty(el_val_t s);
+el_val_t api_persisted(el_val_t id);
 el_val_t api_query_int(el_val_t path, el_val_t key, el_val_t default_val);
 el_val_t api_query_param(el_val_t path, el_val_t key);
 el_val_t ar_case_ending(el_val_t kase, el_val_t definite);
-el_val_t ar_conjugate(el_val_t verb, el_val_t tense, el_val_t person, el_val_t gender, el_val_t number);
 el_val_t ar_conjugate_form1(el_val_t past_base, el_val_t present_stem, el_val_t tense, el_val_t slot);
+el_val_t ar_conjugate(el_val_t verb, el_val_t tense, el_val_t person, el_val_t gender, el_val_t number);
 el_val_t ar_definite_article(el_val_t noun);
 el_val_t ar_gender(el_val_t noun);
 el_val_t ar_imperfect_prefix(el_val_t slot);
 el_val_t ar_imperfect_suffix(el_val_t slot);
-el_val_t ar_irregular(el_val_t verb, el_val_t tense, el_val_t slot);
 el_val_t ar_irregular_araada(el_val_t slot, el_val_t tense);
 el_val_t ar_irregular_istata(el_val_t slot, el_val_t tense);
 el_val_t ar_irregular_jaa(el_val_t slot, el_val_t tense);
 el_val_t ar_irregular_kaana(el_val_t slot, el_val_t tense);
 el_val_t ar_irregular_qaala(el_val_t slot, el_val_t tense);
 el_val_t ar_irregular_raaa(el_val_t slot, el_val_t tense);
+el_val_t ar_irregular(el_val_t verb, el_val_t tense, el_val_t slot);
 el_val_t ar_is_sun_letter(el_val_t c);
 el_val_t ar_masc_pl_ending(el_val_t kase);
 el_val_t ar_noun_form(el_val_t noun, el_val_t gender, el_val_t kase, el_val_t number, el_val_t definite);
@@ -118,24 +136,36 @@ el_val_t ar_verb_form(el_val_t verb, el_val_t tense, el_val_t person, el_val_t n
 el_val_t attend(el_val_t node_json);
 el_val_t auth_headers(el_val_t tok);
 el_val_t auto_persist(el_val_t req, el_val_t resp);
+el_val_t auto_term_try_slot(el_val_t slot_type, el_val_t slot_lbl);
 el_val_t awareness_run(void);
 el_val_t axon_get(el_val_t path);
 el_val_t axon_post(el_val_t path, el_val_t body);
+el_val_t bounded_persona_floor(void);
+el_val_t bridge_save(el_val_t session_id, el_val_t model, el_val_t safe_sys, el_val_t tools_json, el_val_t messages, el_val_t tools_log, el_val_t tool_use_id, el_val_t wire);
 el_val_t build_form_from_json(el_val_t semantic_form_json, el_val_t lang_code);
-el_val_t build_identity_from_graph(void);
 el_val_t build_np(el_val_t referent, el_val_t slots);
 el_val_t build_pp(el_val_t loc);
 el_val_t build_rules(void);
-el_val_t build_system_prompt(el_val_t ctx);
+el_val_t build_system_prompt(el_val_t ctx, el_val_t chat_mode);
 el_val_t build_vocab(void);
 el_val_t build_vp_body(el_val_t slots);
 el_val_t build_vp_from_slots(el_val_t slots);
-el_val_t call_neuron_mcp(el_val_t tool_name, el_val_t args_json);
+el_val_t call_mcp_bridge(el_val_t tool_name, el_val_t tool_input);
+el_val_t call_neuron_mcp(el_val_t tool_name, el_val_t args);
 el_val_t capitalize_first(el_val_t s);
 el_val_t chat_default_model(void);
+el_val_t classify_tool_risk(el_val_t tool_name, el_val_t tool_input);
 el_val_t clean_llm_response(el_val_t s);
-el_val_t conv_history_load(void);
-el_val_t conv_history_persist(el_val_t hist);
+el_val_t cmd_abs_escape_at(el_val_t cmd, el_val_t root, el_val_t needle);
+el_val_t connectd_get(el_val_t suffix);
+el_val_t connectd_post(el_val_t suffix, el_val_t body);
+el_val_t connector_tools_json(void);
+el_val_t conv_hist_key(el_val_t session_id);
+el_val_t conv_hist_label(el_val_t session_id);
+el_val_t conv_history_block(el_val_t session_id);
+el_val_t conv_history_load(el_val_t session_id);
+el_val_t conv_history_persist(el_val_t session_id, el_val_t hist);
+el_val_t conv_history_record(el_val_t session_id, el_val_t user_msg, el_val_t assistant_msg, el_val_t receipt);
 el_val_t cop_article(el_val_t gender, el_val_t number, el_val_t definite);
 el_val_t cop_bwk_future(el_val_t prefix);
 el_val_t cop_bwk_perfect(el_val_t prefix);
@@ -157,8 +187,8 @@ el_val_t cop_map_canonical(el_val_t verb);
 el_val_t cop_nau_future(el_val_t prefix);
 el_val_t cop_nau_perfect(el_val_t prefix);
 el_val_t cop_nau_present(el_val_t prefix);
-el_val_t cop_noun_phrase(el_val_t noun, el_val_t gram_case, el_val_t number, el_val_t definite);
 el_val_t cop_noun_phrase_gendered(el_val_t noun, el_val_t gram_case, el_val_t number, el_val_t definite, el_val_t gender);
+el_val_t cop_noun_phrase(el_val_t noun, el_val_t gram_case, el_val_t number, el_val_t definite);
 el_val_t cop_regular_future(el_val_t prefix, el_val_t stem);
 el_val_t cop_regular_perfect(el_val_t prefix, el_val_t stem);
 el_val_t cop_regular_present(el_val_t prefix, el_val_t stem);
@@ -168,15 +198,16 @@ el_val_t cop_shwpe_present(el_val_t prefix);
 el_val_t cop_slot(el_val_t person, el_val_t number);
 el_val_t cop_str_ends(el_val_t s, el_val_t suf);
 el_val_t cop_str_len(el_val_t s);
-el_val_t cop_subject_prefix(el_val_t person, el_val_t number);
 el_val_t cop_subject_prefix_gendered(el_val_t person, el_val_t gender, el_val_t number);
+el_val_t cop_subject_prefix(el_val_t person, el_val_t number);
+el_val_t current_engine_note(el_val_t model);
 el_val_t de_adj_ending(el_val_t gender, el_val_t gram_case, el_val_t number, el_val_t article_type);
-el_val_t de_article(el_val_t gender, el_val_t gram_case, el_val_t number, el_val_t definite);
 el_val_t de_article_def(el_val_t gender, el_val_t gram_case, el_val_t number);
 el_val_t de_article_indef(el_val_t gender, el_val_t gram_case, el_val_t number);
+el_val_t de_article(el_val_t gender, el_val_t gram_case, el_val_t number, el_val_t definite);
 el_val_t de_case_ending(el_val_t noun, el_val_t gender, el_val_t gram_case, el_val_t number);
-el_val_t de_conjugate(el_val_t verb, el_val_t tense, el_val_t person, el_val_t number);
 el_val_t de_conjugate_weak(el_val_t stem, el_val_t tense, el_val_t person, el_val_t number);
+el_val_t de_conjugate(el_val_t verb, el_val_t tense, el_val_t person, el_val_t number);
 el_val_t de_irregular_present(el_val_t verb, el_val_t person, el_val_t number);
 el_val_t de_norm_number(el_val_t number);
 el_val_t de_norm_person(el_val_t person);
@@ -185,15 +216,13 @@ el_val_t de_strong_past_stem(el_val_t verb);
 el_val_t dharma_network_state(void);
 el_val_t dharma_registry(void);
 el_val_t dispatch_tool(el_val_t tool_name, el_val_t tool_input);
+el_val_t distill_transcript(el_val_t transcript);
+el_val_t egy_conjugate_copula(el_val_t tense, el_val_t slot);
+el_val_t egy_conjugate_pronoun(el_val_t person, el_val_t number);
+el_val_t egy_conjugate(el_val_t verb, el_val_t tense, el_val_t person, el_val_t number);
 el_val_t egy_Dd_future(el_val_t slot);
 el_val_t egy_Dd_past(el_val_t slot);
 el_val_t egy_Dd_present(el_val_t slot);
-el_val_t egy_Sm_future(el_val_t slot);
-el_val_t egy_Sm_past(el_val_t slot);
-el_val_t egy_Sm_present(el_val_t slot);
-el_val_t egy_conjugate(el_val_t verb, el_val_t tense, el_val_t person, el_val_t number);
-el_val_t egy_conjugate_copula(el_val_t tense, el_val_t slot);
-el_val_t egy_conjugate_pronoun(el_val_t person, el_val_t number);
 el_val_t egy_decline(el_val_t noun, el_val_t gram_case, el_val_t number);
 el_val_t egy_drop(el_val_t s, el_val_t n);
 el_val_t egy_fem(el_val_t noun);
@@ -217,8 +246,11 @@ el_val_t egy_regular_present(el_val_t stem, el_val_t slot);
 el_val_t egy_sdm_future(el_val_t slot);
 el_val_t egy_sdm_past(el_val_t slot);
 el_val_t egy_sdm_present(el_val_t slot);
-el_val_t egy_slot(el_val_t person, el_val_t number);
 el_val_t egy_slot_with_gender(el_val_t person, el_val_t gender, el_val_t number);
+el_val_t egy_slot(el_val_t person, el_val_t number);
+el_val_t egy_Sm_future(el_val_t slot);
+el_val_t egy_Sm_past(el_val_t slot);
+el_val_t egy_Sm_present(el_val_t slot);
 el_val_t egy_str_ends(el_val_t s, el_val_t suf);
 el_val_t egy_str_len(el_val_t s);
 el_val_t egy_suffix_pronoun(el_val_t slot);
@@ -239,7 +271,20 @@ el_val_t en_verb_3sg(el_val_t base);
 el_val_t en_verb_form(el_val_t base, el_val_t tense, el_val_t person, el_val_t number);
 el_val_t en_verb_gerund(el_val_t base);
 el_val_t en_verb_past(el_val_t base);
+el_val_t engram_compile_multi(el_val_t topic);
+el_val_t engram_compile_ranked(el_val_t nodes_json, el_val_t max_nodes);
 el_val_t engram_compile(el_val_t intent);
+el_val_t engram_dedup_nodes(el_val_t nodes_json);
+el_val_t engram_detect_recall_intent(el_val_t message);
+el_val_t engram_extract_entities(el_val_t message);
+el_val_t engram_extract_ids(el_val_t nodes_json);
+el_val_t engram_is_continuation(el_val_t message, el_val_t hist_len);
+el_val_t engram_nodes_merge(el_val_t a, el_val_t b);
+el_val_t engram_numeric_valid(el_val_t s);
+el_val_t engram_render_node(el_val_t node_json);
+el_val_t engram_render_nodes(el_val_t nodes_json);
+el_val_t engram_score_node(el_val_t node_json);
+el_val_t engram_split_topics(el_val_t message);
 el_val_t enm_been_past(el_val_t slot);
 el_val_t enm_been_present(el_val_t slot);
 el_val_t enm_comen_past(el_val_t slot);
@@ -269,6 +314,7 @@ el_val_t enm_str_ends(el_val_t s, el_val_t suf);
 el_val_t enm_weak_past(el_val_t stem, el_val_t slot);
 el_val_t enm_weak_present(el_val_t stem, el_val_t slot);
 el_val_t enm_weak_stem(el_val_t verb);
+el_val_t ensure_self_canonical_bridge(void);
 el_val_t entry_form(el_val_t entry, el_val_t n);
 el_val_t entry_found(el_val_t entry);
 el_val_t entry_pos(el_val_t entry);
@@ -293,9 +339,9 @@ el_val_t es_starts_with_stressed_a(el_val_t noun);
 el_val_t es_stem(el_val_t base);
 el_val_t es_str_drop_last(el_val_t s, el_val_t n);
 el_val_t es_str_ends(el_val_t s, el_val_t suf);
+el_val_t es_str_last_char(el_val_t s);
 el_val_t es_str_last2(el_val_t s);
 el_val_t es_str_last3(el_val_t s);
-el_val_t es_str_last_char(el_val_t s);
 el_val_t es_verb_class(el_val_t base);
 el_val_t extract_dim(el_val_t content, el_val_t key);
 el_val_t fi_apply_case(el_val_t noun, el_val_t gram_case, el_val_t number);
@@ -315,6 +361,7 @@ el_val_t fi_str_last_char(el_val_t s);
 el_val_t fi_suffix(el_val_t base, el_val_t harmony);
 el_val_t fi_verb_stem(el_val_t dict_form);
 el_val_t find_rule(el_val_t rule_id_str);
+el_val_t flag_true(el_val_t body, el_val_t key);
 el_val_t fr_agree_article(el_val_t noun, el_val_t definite, el_val_t number);
 el_val_t fr_avoir_present(el_val_t slot);
 el_val_t fr_conjugate(el_val_t verb, el_val_t tense, el_val_t person, el_val_t number);
@@ -337,8 +384,8 @@ el_val_t fr_slot(el_val_t person, el_val_t number);
 el_val_t fr_stem(el_val_t base);
 el_val_t fr_str_drop_last(el_val_t s, el_val_t n);
 el_val_t fr_str_ends(el_val_t s, el_val_t suf);
-el_val_t fr_str_last2(el_val_t s);
 el_val_t fr_str_last_char(el_val_t s);
+el_val_t fr_str_last2(el_val_t s);
 el_val_t fr_subject_starts_vowel(el_val_t subject);
 el_val_t fr_uses_etre(el_val_t verb);
 el_val_t fr_verb_ends_vowel(el_val_t verb_form);
@@ -360,9 +407,9 @@ el_val_t fro_conj3_future(el_val_t verb, el_val_t slot);
 el_val_t fro_conj3_past(el_val_t stem, el_val_t slot);
 el_val_t fro_conj3_present(el_val_t stem, el_val_t slot);
 el_val_t fro_conjugate(el_val_t verb, el_val_t tense, el_val_t person, el_val_t number);
-el_val_t fro_decline(el_val_t noun, el_val_t gram_case, el_val_t number);
 el_val_t fro_decline_fem(el_val_t noun, el_val_t number);
 el_val_t fro_decline_masc(el_val_t noun, el_val_t gram_case, el_val_t number);
+el_val_t fro_decline(el_val_t noun, el_val_t gram_case, el_val_t number);
 el_val_t fro_drop(el_val_t s, el_val_t n);
 el_val_t fro_estre_future(el_val_t slot);
 el_val_t fro_estre_past(el_val_t slot);
@@ -380,16 +427,15 @@ el_val_t fro_venir_past(el_val_t slot);
 el_val_t fro_venir_present(el_val_t slot);
 el_val_t fro_verb_class(el_val_t verb);
 el_val_t fro_verb_stem(el_val_t verb, el_val_t vclass);
-el_val_t gemini_api_key(void);
-el_val_t generate(el_val_t semantic_form_json);
-el_val_t generate_frame(el_val_t frame);
 el_val_t generate_frame_lang(el_val_t frame, el_val_t lang_code);
+el_val_t generate_frame(el_val_t frame);
 el_val_t generate_lang(el_val_t semantic_form_json, el_val_t lang_code);
 el_val_t generate_tree(el_val_t rule_id_str, el_val_t slots);
+el_val_t generate(el_val_t semantic_form_json);
 el_val_t get_rules(void);
 el_val_t get_vocab(void);
-el_val_t gez_conjugate(el_val_t verb, el_val_t tense, el_val_t person, el_val_t number);
 el_val_t gez_conjugate_copula(el_val_t tense, el_val_t slot);
+el_val_t gez_conjugate(el_val_t verb, el_val_t tense, el_val_t person, el_val_t number);
 el_val_t gez_decline(el_val_t noun, el_val_t gram_case, el_val_t number);
 el_val_t gez_generic_imperfect(el_val_t base3sg, el_val_t slot);
 el_val_t gez_generic_perfect(el_val_t base3sg, el_val_t slot);
@@ -408,13 +454,12 @@ el_val_t gez_qwl_imperfect(el_val_t slot);
 el_val_t gez_qwl_perfect(el_val_t slot);
 el_val_t gez_ray_imperfect(el_val_t slot);
 el_val_t gez_ray_perfect(el_val_t slot);
-el_val_t gez_slot(el_val_t person, el_val_t number);
 el_val_t gez_slot_g(el_val_t person, el_val_t gender, el_val_t number);
+el_val_t gez_slot(el_val_t person, el_val_t number);
 el_val_t gez_str_drop_last(el_val_t s, el_val_t n);
 el_val_t gez_str_ends(el_val_t s, el_val_t suf);
 el_val_t gez_str_len(el_val_t s);
 el_val_t goh_conjugate(el_val_t verb, el_val_t tense, el_val_t person, el_val_t number);
-el_val_t goh_decline(el_val_t noun, el_val_t gram_case, el_val_t number);
 el_val_t goh_decline_fem_o_pl(el_val_t stem, el_val_t gram_case);
 el_val_t goh_decline_fem_o_sg(el_val_t stem, el_val_t gram_case);
 el_val_t goh_decline_masc_a_pl(el_val_t stem, el_val_t gram_case);
@@ -423,6 +468,7 @@ el_val_t goh_decline_masc_n_pl(el_val_t stem, el_val_t gram_case);
 el_val_t goh_decline_masc_n_sg(el_val_t stem, el_val_t gram_case);
 el_val_t goh_decline_neut_a_pl(el_val_t stem, el_val_t gram_case);
 el_val_t goh_decline_neut_a_sg(el_val_t stem, el_val_t gram_case);
+el_val_t goh_decline(el_val_t noun, el_val_t gram_case, el_val_t number);
 el_val_t goh_demo_article(el_val_t stype, el_val_t number);
 el_val_t goh_drop(el_val_t s, el_val_t n);
 el_val_t goh_extract_stem(el_val_t noun, el_val_t stype);
@@ -447,13 +493,13 @@ el_val_t goh_weak_present(el_val_t stem, el_val_t slot);
 el_val_t goh_wesan_past(el_val_t slot);
 el_val_t goh_wesan_present(el_val_t slot);
 el_val_t got_conjugate(el_val_t verb, el_val_t tense, el_val_t person, el_val_t number);
-el_val_t got_decline(el_val_t noun, el_val_t gram_case, el_val_t number);
 el_val_t got_decline_a_stem_pl(el_val_t stem, el_val_t gram_case);
 el_val_t got_decline_a_stem_sg(el_val_t stem, el_val_t gram_case);
 el_val_t got_decline_n_stem_pl(el_val_t stem, el_val_t gram_case);
 el_val_t got_decline_n_stem_sg(el_val_t stem, el_val_t gram_case);
 el_val_t got_decline_o_stem_pl(el_val_t stem, el_val_t gram_case);
 el_val_t got_decline_o_stem_sg(el_val_t stem, el_val_t gram_case);
+el_val_t got_decline(el_val_t noun, el_val_t gram_case, el_val_t number);
 el_val_t got_demo_article(el_val_t stype);
 el_val_t got_extract_stem(el_val_t noun, el_val_t stype);
 el_val_t got_gaggan_past(el_val_t slot);
@@ -486,17 +532,17 @@ el_val_t gram_build_vp(el_val_t verb, el_val_t aux, el_val_t profile);
 el_val_t gram_order_constituents(el_val_t subj, el_val_t verb, el_val_t obj, el_val_t profile);
 el_val_t gram_question_strategy(el_val_t profile);
 el_val_t gram_word_order(el_val_t profile);
-el_val_t grc_article(el_val_t gender, el_val_t gram_case, el_val_t number);
 el_val_t grc_article_feminine(el_val_t gram_case, el_val_t number);
 el_val_t grc_article_masculine(el_val_t gram_case, el_val_t number);
 el_val_t grc_article_neuter(el_val_t gram_case, el_val_t number);
+el_val_t grc_article(el_val_t gender, el_val_t gram_case, el_val_t number);
 el_val_t grc_conjugate(el_val_t verb, el_val_t tense, el_val_t person, el_val_t number);
 el_val_t grc_declension(el_val_t noun);
-el_val_t grc_decline(el_val_t noun, el_val_t gram_case, el_val_t number);
 el_val_t grc_decline_1a(el_val_t stem, el_val_t gram_case, el_val_t number);
 el_val_t grc_decline_1e(el_val_t stem, el_val_t gram_case, el_val_t number);
 el_val_t grc_decline_2m(el_val_t stem, el_val_t gram_case, el_val_t number);
 el_val_t grc_decline_2n(el_val_t stem, el_val_t gram_case, el_val_t number);
+el_val_t grc_decline(el_val_t noun, el_val_t gram_case, el_val_t number);
 el_val_t grc_echein_aorist(el_val_t slot);
 el_val_t grc_echein_future(el_val_t slot);
 el_val_t grc_echein_imperfect(el_val_t slot);
@@ -523,9 +569,9 @@ el_val_t grc_present_stem(el_val_t verb);
 el_val_t grc_slot(el_val_t person, el_val_t number);
 el_val_t grc_str_drop_last(el_val_t s, el_val_t n);
 el_val_t grc_str_ends(el_val_t s, el_val_t suf);
+el_val_t grc_str_last_char(el_val_t s);
 el_val_t grc_str_last2(el_val_t s);
 el_val_t grc_str_last3(el_val_t s);
-el_val_t grc_str_last_char(el_val_t s);
 el_val_t grc_thematic_future_ending(el_val_t slot);
 el_val_t grc_thematic_imperfect_ending(el_val_t slot);
 el_val_t grc_thematic_present_ending(el_val_t slot);
@@ -549,29 +595,37 @@ el_val_t handle_api_list_typed(el_val_t node_type, el_val_t path, el_val_t body)
 el_val_t handle_api_log_state_event(el_val_t body);
 el_val_t handle_api_memory_delete(el_val_t body);
 el_val_t handle_api_memory_update(el_val_t body);
+el_val_t handle_api_node_create(el_val_t body);
+el_val_t handle_api_node_delete(el_val_t body);
+el_val_t handle_api_node_update(el_val_t body);
 el_val_t handle_api_promote_knowledge(el_val_t body);
 el_val_t handle_api_recall(el_val_t method, el_val_t path, el_val_t body);
 el_val_t handle_api_remember(el_val_t body);
 el_val_t handle_api_search_knowledge(el_val_t method, el_val_t path, el_val_t body);
 el_val_t handle_api_tune_config(el_val_t body);
-el_val_t handle_chat(el_val_t body);
 el_val_t handle_chat_agentic(el_val_t body);
 el_val_t handle_chat_as_soul(el_val_t body);
+el_val_t handle_chat_plan(el_val_t body);
+el_val_t handle_chat(el_val_t body);
 el_val_t handle_config(el_val_t method, el_val_t body);
+el_val_t handle_connectors(el_val_t method, el_val_t clean, el_val_t body);
 el_val_t handle_conversations(el_val_t method);
-el_val_t handle_dharma(el_val_t path, el_val_t method, el_val_t body);
 el_val_t handle_dharma_recv(el_val_t body);
-el_val_t handle_dharma_room_turn(el_val_t body);
 el_val_t handle_dharma_room_turn_agentic(el_val_t body);
+el_val_t handle_dharma_room_turn(el_val_t body);
+el_val_t handle_dharma(el_val_t path, el_val_t method, el_val_t body);
 el_val_t handle_elp_chat(el_val_t body);
 el_val_t handle_nlg(el_val_t path, el_val_t method, el_val_t body);
 el_val_t handle_request(el_val_t method, el_val_t path, el_val_t body);
+el_val_t handle_safety_contact_get(void);
+el_val_t handle_safety_contact_post(el_val_t body);
 el_val_t handle_see(el_val_t body);
 el_val_t handle_session_approve(el_val_t session_id, el_val_t body);
+el_val_t handle_tool_result(el_val_t session_id, el_val_t body);
 el_val_t handle_tool(el_val_t path, el_val_t method, el_val_t body);
 el_val_t hard_bell_threshold(void);
-el_val_t he_conjugate(el_val_t verb, el_val_t tense, el_val_t person, el_val_t gender, el_val_t number);
 el_val_t he_conjugate_copula(el_val_t tense, el_val_t slot);
+el_val_t he_conjugate(el_val_t verb, el_val_t tense, el_val_t person, el_val_t gender, el_val_t number);
 el_val_t he_copula_future(el_val_t slot);
 el_val_t he_copula_past(el_val_t slot);
 el_val_t he_definite_prefix(el_val_t noun);
@@ -608,12 +662,12 @@ el_val_t hi_genitive_phrase(el_val_t possessor, el_val_t possessor_gender, el_va
 el_val_t hi_hona_past(el_val_t gender, el_val_t number);
 el_val_t hi_hona_present(el_val_t person, el_val_t number);
 el_val_t hi_masc_aa_stem(el_val_t noun);
-el_val_t hi_noun_direct(el_val_t noun, el_val_t gender, el_val_t number);
 el_val_t hi_noun_direct_f(el_val_t noun, el_val_t number);
 el_val_t hi_noun_direct_m(el_val_t noun, el_val_t number);
-el_val_t hi_noun_oblique(el_val_t noun, el_val_t gender, el_val_t number);
+el_val_t hi_noun_direct(el_val_t noun, el_val_t gender, el_val_t number);
 el_val_t hi_noun_oblique_f(el_val_t noun, el_val_t number);
 el_val_t hi_noun_oblique_m(el_val_t noun, el_val_t number);
+el_val_t hi_noun_oblique(el_val_t noun, el_val_t gender, el_val_t number);
 el_val_t hi_noun_with_post(el_val_t noun, el_val_t gender, el_val_t number, el_val_t gram_case);
 el_val_t hi_past_irregular(el_val_t stem, el_val_t gender, el_val_t number);
 el_val_t hi_past_suffix(el_val_t gender, el_val_t number);
@@ -623,10 +677,12 @@ el_val_t hi_str_drop_last(el_val_t s, el_val_t n);
 el_val_t hi_str_ends(el_val_t s, el_val_t suf);
 el_val_t hi_str_last_char(el_val_t s);
 el_val_t hi_tense_suffix(el_val_t tense, el_val_t gender, el_val_t number);
-el_val_t hi_verb_stem(el_val_t infinitive);
 el_val_t hi_verb_stem_clean(el_val_t infinitive);
+el_val_t hi_verb_stem(el_val_t infinitive);
 el_val_t hist_append(el_val_t hist, el_val_t role, el_val_t content);
+el_val_t hist_trim_with_bell_guard(el_val_t hist);
 el_val_t hist_trim(el_val_t hist);
+el_val_t id_in_seen(el_val_t node_id, el_val_t seen);
 el_val_t idle_count(void);
 el_val_t idle_inc(void);
 el_val_t idle_reset(void);
@@ -639,6 +695,7 @@ el_val_t imprint_unload(void);
 el_val_t init_soul_edges(void);
 el_val_t irregular_plural(el_val_t word);
 el_val_t irregular_singular(el_val_t word);
+el_val_t is_builtin_tool(el_val_t tool_name);
 el_val_t is_pronoun(el_val_t word);
 el_val_t is_protected_node(el_val_t id);
 el_val_t is_vowel(el_val_t c);
@@ -651,10 +708,10 @@ el_val_t ja_noun_phrase(el_val_t noun, el_val_t gram_case);
 el_val_t ja_particle(el_val_t gram_case);
 el_val_t ja_question_particle(void);
 el_val_t ja_verb_group(el_val_t dict_form);
+el_val_t json_escape(el_val_t s);
 el_val_t json_safe(el_val_t s);
 el_val_t la_conjugate(el_val_t verb, el_val_t tense, el_val_t person, el_val_t number);
 el_val_t la_declension(el_val_t noun);
-el_val_t la_decline(el_val_t noun, el_val_t gram_case, el_val_t number);
 el_val_t la_decline_1(el_val_t stem, el_val_t gram_case, el_val_t number);
 el_val_t la_decline_2er(el_val_t noun, el_val_t gram_case, el_val_t number);
 el_val_t la_decline_2m(el_val_t stem, el_val_t gram_case, el_val_t number);
@@ -662,6 +719,7 @@ el_val_t la_decline_2n(el_val_t stem, el_val_t gram_case, el_val_t number);
 el_val_t la_decline_3(el_val_t noun, el_val_t gram_case, el_val_t number);
 el_val_t la_decline_4(el_val_t stem, el_val_t gram_case, el_val_t number);
 el_val_t la_decline_5(el_val_t stem, el_val_t gram_case, el_val_t number);
+el_val_t la_decline(el_val_t noun, el_val_t gram_case, el_val_t number);
 el_val_t la_esse_future(el_val_t slot);
 el_val_t la_esse_past(el_val_t slot);
 el_val_t la_esse_present(el_val_t slot);
@@ -685,9 +743,9 @@ el_val_t la_slot(el_val_t person, el_val_t number);
 el_val_t la_stem(el_val_t verb, el_val_t vclass);
 el_val_t la_str_drop_last(el_val_t s, el_val_t n);
 el_val_t la_str_ends(el_val_t s, el_val_t suf);
+el_val_t la_str_last_char(el_val_t s);
 el_val_t la_str_last2(el_val_t s);
 el_val_t la_str_last3(el_val_t s);
-el_val_t la_str_last_char(el_val_t s);
 el_val_t la_velle_future(el_val_t slot);
 el_val_t la_velle_past(el_val_t slot);
 el_val_t la_velle_present(el_val_t slot);
@@ -704,7 +762,6 @@ el_val_t lang_is_fusional(el_val_t profile);
 el_val_t lang_is_isolating(el_val_t profile);
 el_val_t lang_is_polysynthetic(el_val_t profile);
 el_val_t lang_is_rtl(el_val_t profile);
-el_val_t lang_profile(el_val_t code, el_val_t word_order, el_val_t morph_type, el_val_t has_case, el_val_t has_gender, el_val_t script_dir, el_val_t agreement, el_val_t null_subject);
 el_val_t lang_profile_akk(void);
 el_val_t lang_profile_ang(void);
 el_val_t lang_profile_ar(void);
@@ -736,13 +793,16 @@ el_val_t lang_profile_sw(void);
 el_val_t lang_profile_txb(void);
 el_val_t lang_profile_uga(void);
 el_val_t lang_profile_zh(void);
+el_val_t lang_profile(el_val_t code, el_val_t word_order, el_val_t morph_type, el_val_t has_case, el_val_t has_gender, el_val_t script_dir, el_val_t agreement, el_val_t null_subject);
 el_val_t lang_word_order(el_val_t profile);
+el_val_t layered_cycle(el_val_t raw_input, el_val_t session_id, el_val_t utility);
+el_val_t layered_generate(el_val_t prompt, el_val_t imprint_id, el_val_t session_id);
 el_val_t lex_class(el_val_t entry);
 el_val_t lex_form(el_val_t entry, el_val_t idx);
 el_val_t lex_pos(el_val_t entry);
 el_val_t lex_word(el_val_t entry);
-el_val_t llm_call_gemini(el_val_t model, el_val_t system, el_val_t message);
-el_val_t llm_call_grok(el_val_t model, el_val_t system, el_val_t message);
+el_val_t llm_base_url(void);
+el_val_t llm_wire_format(void);
 el_val_t load_identity_context(void);
 el_val_t make_action(el_val_t kind, el_val_t payload);
 el_val_t make_entry(el_val_t word, el_val_t pos, el_val_t f0, el_val_t f1, el_val_t f2, el_val_t f3, el_val_t f4, el_val_t cls);
@@ -775,17 +835,20 @@ el_val_t mem_save(el_val_t path);
 el_val_t mem_search(el_val_t query, el_val_t limit);
 el_val_t mem_store(el_val_t content, el_val_t label, el_val_t tags);
 el_val_t mem_strengthen(el_val_t node_id);
+el_val_t mem_tombstone(el_val_t node_id);
+el_val_t memory_hide_tombstoned(el_val_t raw, el_val_t path);
 el_val_t morph_apply_suffix(el_val_t base, el_val_t suffix);
 el_val_t morph_conjugate(el_val_t verb, el_val_t tense, el_val_t person, el_val_t number, el_val_t profile);
 el_val_t morph_inflect(el_val_t word, el_val_t features, el_val_t profile);
 el_val_t morph_map_canonical(el_val_t verb, el_val_t code);
 el_val_t morph_pluralize(el_val_t noun, el_val_t profile);
+el_val_t next_bridge_id(void);
 el_val_t nlg_is_ws(el_val_t c);
 el_val_t non_conjugate(el_val_t verb, el_val_t tense, el_val_t person, el_val_t number);
-el_val_t non_decline(el_val_t noun, el_val_t gram_case, el_val_t number);
 el_val_t non_decline_fem(el_val_t noun, el_val_t gram_case, el_val_t number);
 el_val_t non_decline_masc(el_val_t noun, el_val_t gram_case, el_val_t number);
 el_val_t non_decline_neut(el_val_t noun, el_val_t gram_case, el_val_t number);
+el_val_t non_decline(el_val_t noun, el_val_t gram_case, el_val_t number);
 el_val_t non_def_suffix_fem(el_val_t gram_case, el_val_t number);
 el_val_t non_def_suffix_masc(el_val_t gram_case, el_val_t number);
 el_val_t non_def_suffix_neut(el_val_t gram_case, el_val_t number);
@@ -811,15 +874,21 @@ el_val_t non_vera_present(el_val_t slot);
 el_val_t non_weak_past(el_val_t stem, el_val_t slot);
 el_val_t non_weak_present(el_val_t stem, el_val_t slot);
 el_val_t one_cycle(void);
-el_val_t parse_session_id_from_path(el_val_t path);
-el_val_t parse_session_subpath(el_val_t path);
+el_val_t openai_chat_complete(el_val_t model, el_val_t base_url, el_val_t api_key, el_val_t safe_sys, el_val_t messages_json);
+el_val_t openai_tools_json(el_val_t tools_anthropic);
+el_val_t json_trim_dangling_escape(el_val_t s);
+el_val_t utf8_safe_slice(el_val_t s, el_val_t n);
+el_val_t agentic_tools_no_web(void);
+el_val_t openai_agentic_loop(el_val_t session_id, el_val_t model, el_val_t safe_sys, el_val_t tools_json, el_val_t messages_in, el_val_t tools_log_in);
+el_val_t parse_float_x100(el_val_t s);
+el_val_t path_within_root(el_val_t path, el_val_t root);
 el_val_t peo_ah_past(el_val_t slot);
 el_val_t peo_ah_present(el_val_t slot);
 el_val_t peo_conjugate(el_val_t verb, el_val_t tense, el_val_t person, el_val_t number);
 el_val_t peo_da_past(el_val_t slot);
 el_val_t peo_da_present(el_val_t slot);
-el_val_t peo_decline(el_val_t noun, el_val_t gram_case, el_val_t number);
 el_val_t peo_decline_astem(el_val_t noun, el_val_t gram_case, el_val_t number);
+el_val_t peo_decline(el_val_t noun, el_val_t gram_case, el_val_t number);
 el_val_t peo_drop(el_val_t s, el_val_t n);
 el_val_t peo_ends(el_val_t s, el_val_t suf);
 el_val_t peo_kar_past(el_val_t slot);
@@ -835,11 +904,11 @@ el_val_t perceive(void);
 el_val_t pi_aorist_ending(el_val_t slot);
 el_val_t pi_atthi_present(el_val_t slot);
 el_val_t pi_conjugate(el_val_t verb, el_val_t tense, el_val_t person, el_val_t number);
-el_val_t pi_decline(el_val_t noun, el_val_t gram_case, el_val_t number);
 el_val_t pi_decline_a_fem_pl(el_val_t stem, el_val_t gram_case);
 el_val_t pi_decline_a_fem_sg(el_val_t stem, el_val_t gram_case);
 el_val_t pi_decline_a_masc_pl(el_val_t stem, el_val_t gram_case);
 el_val_t pi_decline_a_masc_sg(el_val_t stem, el_val_t gram_case);
+el_val_t pi_decline(el_val_t noun, el_val_t gram_case, el_val_t number);
 el_val_t pi_detect_class(el_val_t noun);
 el_val_t pi_drop(el_val_t s, el_val_t n);
 el_val_t pi_future_ending(el_val_t slot);
@@ -869,24 +938,25 @@ el_val_t pluralize(el_val_t singular);
 el_val_t proactive_curiosity(void);
 el_val_t pulse_count(void);
 el_val_t pulse_inc(void);
-el_val_t realize(el_val_t form);
+el_val_t rate_limit_check(el_val_t ip, el_val_t path);
 el_val_t realize_lang(el_val_t form, el_val_t profile);
 el_val_t realize_np(el_val_t referent, el_val_t number);
 el_val_t realize_question_lang(el_val_t predicate, el_val_t tense, el_val_t aspect, el_val_t person, el_val_t number, el_val_t agent, el_val_t patient, el_val_t location, el_val_t profile);
 el_val_t realize_vp_lang(el_val_t base_verb, el_val_t tense, el_val_t aspect, el_val_t person, el_val_t number, el_val_t profile);
+el_val_t realize(el_val_t form);
 el_val_t record(el_val_t outcome_json);
 el_val_t render_studio(void);
 el_val_t render_tree(el_val_t tree);
+el_val_t resolve_in_root(el_val_t path, el_val_t root);
 el_val_t respond(el_val_t action_json);
 el_val_t route_health(void);
 el_val_t route_imprint_contextual(el_val_t body);
 el_val_t route_imprint_user(el_val_t body);
 el_val_t route_lineage(void);
-el_val_t route_sessions(void);
 el_val_t route_synthesize(el_val_t body);
-el_val_t ru_conjugate(el_val_t verb, el_val_t tense, el_val_t person, el_val_t number, el_val_t gender);
 el_val_t ru_conjugate_1st(el_val_t stem, el_val_t tense, el_val_t person, el_val_t number);
 el_val_t ru_conjugate_2nd(el_val_t stem, el_val_t tense, el_val_t person, el_val_t number);
+el_val_t ru_conjugate(el_val_t verb, el_val_t tense, el_val_t person, el_val_t number, el_val_t gender);
 el_val_t ru_decline_fem(el_val_t noun, el_val_t stype, el_val_t gram_case, el_val_t number);
 el_val_t ru_decline_masc(el_val_t noun, el_val_t stype, el_val_t gram_case, el_val_t number);
 el_val_t ru_decline_neut(el_val_t noun, el_val_t stype, el_val_t gram_case, el_val_t number);
@@ -899,8 +969,10 @@ el_val_t ru_past_stem(el_val_t verb);
 el_val_t ru_stem_type(el_val_t noun, el_val_t gender);
 el_val_t rule_id(el_val_t rule);
 el_val_t rule_lhs(el_val_t rule);
-el_val_t rule_rhs(el_val_t rule, el_val_t idx);
 el_val_t rule_rhs_len(el_val_t rule);
+el_val_t rule_rhs(el_val_t rule, el_val_t idx);
+el_val_t run_command_guard(el_val_t cmd, el_val_t root);
+el_val_t run_command_is_readonly(el_val_t cmd);
 el_val_t sa_as_future(el_val_t slot);
 el_val_t sa_as_past(el_val_t slot);
 el_val_t sa_as_present(el_val_t slot);
@@ -912,11 +984,11 @@ el_val_t sa_class1_future_ending(el_val_t slot);
 el_val_t sa_class1_past_ending(el_val_t slot);
 el_val_t sa_class1_present_ending(el_val_t slot);
 el_val_t sa_conjugate(el_val_t verb, el_val_t tense, el_val_t person, el_val_t number);
-el_val_t sa_decline(el_val_t noun, el_val_t gram_case, el_val_t number);
 el_val_t sa_decline_a_stem_pl(el_val_t stem, el_val_t gram_case);
 el_val_t sa_decline_a_stem_sg(el_val_t stem, el_val_t gram_case);
 el_val_t sa_decline_aa_stem_pl(el_val_t stem, el_val_t gram_case);
 el_val_t sa_decline_aa_stem_sg(el_val_t stem, el_val_t gram_case);
+el_val_t sa_decline(el_val_t noun, el_val_t gram_case, el_val_t number);
 el_val_t sa_drs_future(el_val_t slot);
 el_val_t sa_drs_past(el_val_t slot);
 el_val_t sa_drs_present(el_val_t slot);
@@ -936,44 +1008,67 @@ el_val_t sa_str_ends(el_val_t s, el_val_t suf);
 el_val_t sa_vad_future(el_val_t slot);
 el_val_t sa_vad_past(el_val_t slot);
 el_val_t sa_vad_present(el_val_t slot);
+el_val_t safety_abuse_phrases(void);
+el_val_t safety_any_match(el_val_t text, el_val_t phrases_json);
+el_val_t safety_augment_system(el_val_t system, el_val_t user_msg);
+el_val_t safety_classify_hard_bell(el_val_t message);
+el_val_t safety_contact_path(void);
+el_val_t safety_count_match(el_val_t text, el_val_t phrases_json);
+el_val_t safety_detect_bell_level(el_val_t message);
+el_val_t safety_detect_positive_level(el_val_t message);
+el_val_t safety_general_hard_phrases(void);
+el_val_t safety_hard_directive(el_val_t hard_type);
 el_val_t safety_log_bell(el_val_t level, el_val_t reason, el_val_t input_summary);
+el_val_t safety_normalize(el_val_t message);
+el_val_t safety_positive_phrases(void);
 el_val_t safety_score_crisis(el_val_t input);
 el_val_t safety_score_danger(el_val_t input);
 el_val_t safety_score_distress_history(el_val_t history);
 el_val_t safety_score_harm(el_val_t input);
 el_val_t safety_screen(el_val_t input, el_val_t history);
+el_val_t safety_self_harm_phrases(void);
+el_val_t safety_soft_directive(void);
+el_val_t safety_soft_phrases(void);
 el_val_t safety_threat_score(el_val_t input, el_val_t history);
+el_val_t safety_threat_to_others_phrases(void);
 el_val_t safety_validate(el_val_t output, el_val_t action);
 el_val_t scan_token(el_val_t s, el_val_t start);
 el_val_t security_research_authorized(void);
 el_val_t seed_persona_from_env(void);
 el_val_t sem_first_modifier(el_val_t mods);
-el_val_t sem_frame(el_val_t intent, el_val_t subject, el_val_t obj, el_val_t modifiers);
 el_val_t sem_frame_lang(el_val_t intent, el_val_t subject, el_val_t obj, el_val_t modifiers, el_val_t lang_code);
 el_val_t sem_frame_obj(el_val_t intent, el_val_t subject, el_val_t obj);
 el_val_t sem_frame_simple(el_val_t intent, el_val_t subject);
+el_val_t sem_frame(el_val_t intent, el_val_t subject, el_val_t obj, el_val_t modifiers);
 el_val_t sem_get(el_val_t json, el_val_t key);
-el_val_t sem_intent(el_val_t frame);
 el_val_t sem_intent_to_realize(el_val_t intent);
+el_val_t sem_intent(el_val_t frame);
 el_val_t sem_lang(el_val_t frame);
 el_val_t sem_modifiers(el_val_t frame);
 el_val_t sem_object(el_val_t frame);
-el_val_t sem_realize(el_val_t frame);
 el_val_t sem_realize_full(el_val_t frame, el_val_t verb, el_val_t tense, el_val_t aspect);
 el_val_t sem_realize_greet(el_val_t subject);
 el_val_t sem_realize_lang(el_val_t frame, el_val_t lang_code);
+el_val_t sem_realize(el_val_t frame);
 el_val_t sem_subject(el_val_t frame);
-el_val_t sem_to_spec(el_val_t frame);
 el_val_t sem_to_spec_full(el_val_t frame, el_val_t verb, el_val_t tense, el_val_t aspect);
+el_val_t sem_to_spec(el_val_t frame);
 el_val_t session_auto_title(el_val_t session_id, el_val_t first_message);
+el_val_t session_create_cleanup(el_val_t session_id);
 el_val_t session_create(el_val_t body);
 el_val_t session_delete(el_val_t session_id);
+el_val_t session_exists(el_val_t session_id);
 el_val_t session_get(el_val_t session_id);
 el_val_t session_hist_load(el_val_t session_id);
 el_val_t session_hist_save(el_val_t session_id, el_val_t hist);
 el_val_t session_list(void);
 el_val_t session_make_content(el_val_t id, el_val_t title, el_val_t created_at, el_val_t updated_at, el_val_t folder);
+el_val_t session_preload_bullets(el_val_t nodes, el_val_t max_bullets, el_val_t snip_len);
+el_val_t session_search_entry(el_val_t node);
 el_val_t session_search(el_val_t query);
+el_val_t session_summary_autogenerate(el_val_t hist);
+el_val_t session_summary_write_dated(el_val_t summary_text, el_val_t label);
+el_val_t session_summary_write(el_val_t summary_text);
 el_val_t session_title_from_message(el_val_t message);
 el_val_t session_update_meta_timestamp(el_val_t session_id);
 el_val_t session_update_patch(el_val_t session_id, el_val_t body);
@@ -984,9 +1079,9 @@ el_val_t sga_bith_past(el_val_t slot);
 el_val_t sga_bith_present(el_val_t slot);
 el_val_t sga_conjugate(el_val_t verb, el_val_t tense, el_val_t person, el_val_t number);
 el_val_t sga_copula_present(el_val_t slot);
-el_val_t sga_decline(el_val_t noun, el_val_t gram_case, el_val_t number);
 el_val_t sga_decline_astem(el_val_t noun, el_val_t gram_case, el_val_t number);
 el_val_t sga_decline_ostem(el_val_t noun, el_val_t gram_case, el_val_t number);
+el_val_t sga_decline(el_val_t noun, el_val_t gram_case, el_val_t number);
 el_val_t sga_detect_gender(el_val_t noun);
 el_val_t sga_drop(el_val_t s, el_val_t n);
 el_val_t sga_first(el_val_t s);
@@ -1014,9 +1109,9 @@ el_val_t steward_session_check(el_val_t input, el_val_t session_id);
 el_val_t steward_validate_imprint(el_val_t imprint_id, el_val_t tool_name);
 el_val_t str_drop_last(el_val_t s, el_val_t n);
 el_val_t str_ends(el_val_t s, el_val_t suf);
+el_val_t str_last_char(el_val_t s);
 el_val_t str_last2(el_val_t s);
 el_val_t str_last3(el_val_t s);
-el_val_t str_last_char(el_val_t s);
 el_val_t strengthen_chat_nodes(el_val_t activation_nodes);
 el_val_t strip_query(el_val_t path);
 el_val_t studio_tools_json(void);
@@ -1043,8 +1138,8 @@ el_val_t sux_realize_sentence(el_val_t intent, el_val_t agent, el_val_t predicat
 el_val_t sux_slot(el_val_t person, el_val_t number);
 el_val_t sux_str_drop_last(el_val_t s, el_val_t n);
 el_val_t sux_str_ends(el_val_t s, el_val_t suf);
-el_val_t sux_str_last2(el_val_t s);
 el_val_t sux_str_last_char(el_val_t s);
+el_val_t sux_str_last2(el_val_t s);
 el_val_t sux_tum2_past(el_val_t slot);
 el_val_t sux_tum2_present(el_val_t slot);
 el_val_t sux_verb_chain(el_val_t agent, el_val_t verb, el_val_t patient, el_val_t tense);
@@ -1062,9 +1157,9 @@ el_val_t sw_noun_plural(el_val_t noun);
 el_val_t sw_obj_prefix(el_val_t person, el_val_t number, el_val_t noun_class);
 el_val_t sw_str_drop_last(el_val_t s, el_val_t n);
 el_val_t sw_str_ends(el_val_t s, el_val_t suf);
+el_val_t sw_str_first_char(el_val_t s);
 el_val_t sw_str_first2(el_val_t s);
 el_val_t sw_str_first3(el_val_t s);
-el_val_t sw_str_first_char(el_val_t s);
 el_val_t sw_str_last_char(el_val_t s);
 el_val_t sw_subj_prefix(el_val_t person, el_val_t number, el_val_t noun_class);
 el_val_t sw_tense_marker(el_val_t tense);
@@ -1078,10 +1173,13 @@ el_val_t threat_trajectory_check(el_val_t tool_name, el_val_t tool_input);
 el_val_t tier_canonical(void);
 el_val_t tier_episodic(void);
 el_val_t tier_working(void);
+el_val_t tombstone_node(el_val_t id);
+el_val_t tombstoned_id_set(void);
+el_val_t tool_auto_approved(el_val_t tool_name);
 el_val_t txb_conjugate(el_val_t verb, el_val_t tense, el_val_t person, el_val_t number);
-el_val_t txb_decline(el_val_t noun, el_val_t gram_case, el_val_t number);
 el_val_t txb_decline_fem(el_val_t noun, el_val_t gram_case, el_val_t number);
 el_val_t txb_decline_masc(el_val_t noun, el_val_t gram_case, el_val_t number);
+el_val_t txb_decline(el_val_t noun, el_val_t gram_case, el_val_t number);
 el_val_t txb_detect_gender(el_val_t noun);
 el_val_t txb_drop(el_val_t s, el_val_t n);
 el_val_t txb_ends(el_val_t s, el_val_t suf);
@@ -1096,8 +1194,8 @@ el_val_t txb_wes_present(el_val_t slot);
 el_val_t txb_ya_present(el_val_t slot);
 el_val_t uga_amr_imperfect(el_val_t slot);
 el_val_t uga_amr_perfect(el_val_t slot);
-el_val_t uga_conjugate(el_val_t verb, el_val_t tense, el_val_t person, el_val_t number);
 el_val_t uga_conjugate_copula(el_val_t tense, el_val_t slot);
+el_val_t uga_conjugate(el_val_t verb, el_val_t tense, el_val_t person, el_val_t number);
 el_val_t uga_decline(el_val_t noun, el_val_t gram_case, el_val_t number);
 el_val_t uga_generic_imperfect(el_val_t base3sg, el_val_t slot);
 el_val_t uga_generic_perfect(el_val_t base3sg, el_val_t slot);
@@ -1112,8 +1210,8 @@ el_val_t uga_map_canonical(el_val_t verb);
 el_val_t uga_noun_phrase(el_val_t noun, el_val_t gram_case, el_val_t number, el_val_t definite);
 el_val_t uga_ray_imperfect(el_val_t slot);
 el_val_t uga_ray_perfect(el_val_t slot);
-el_val_t uga_slot(el_val_t person, el_val_t number);
 el_val_t uga_slot_g(el_val_t person, el_val_t gender, el_val_t number);
+el_val_t uga_slot(el_val_t person, el_val_t number);
 el_val_t uga_str_drop_last(el_val_t s, el_val_t n);
 el_val_t uga_str_ends(el_val_t s, el_val_t suf);
 el_val_t uga_str_len(el_val_t s);
@@ -1121,7 +1219,6 @@ el_val_t uga_strip_nom(el_val_t noun);
 el_val_t verb_form(el_val_t base, el_val_t tense, el_val_t person, el_val_t number);
 el_val_t vocab_by_class(el_val_t cls);
 el_val_t vocab_by_pos(el_val_t pos);
-el_val_t vocab_lookup(el_val_t word, el_val_t lang_code);
 el_val_t vocab_lookup_en(el_val_t word);
+el_val_t vocab_lookup(el_val_t word, el_val_t lang_code);
 el_val_t vocab_synonym(el_val_t word, el_val_t lang_register, el_val_t lang_code);
-el_val_t xai_api_key(void);

dist/elp.elh

@@ -1,7 +1,7 @@
 // auto-generated by elc --emit-header — do not edit
 extern fn sem_get(json: String, key: String) -> String
-extern fn generate_frame(frame: Any) -> String
-extern fn generate_frame_lang(frame: Any, lang_code: String) -> String
-extern fn build_form_from_json(semantic_form_json: String, lang_code: String) -> Any
+extern fn generate_frame(frame: [String]) -> String
+extern fn generate_frame_lang(frame: [String], lang_code: String) -> String
+extern fn build_form_from_json(semantic_form_json: String, lang_code: String) -> [String]
 extern fn generate(semantic_form_json: String) -> String
 extern fn generate_lang(semantic_form_json: String, lang_code: String) -> String

dist/grammar.c

@@ -656,8 +656,3 @@ el_val_t generate_tree(el_val_t rule_id_str, el_val_t slots) {
   return 0;
 }
 
-int main(int _argc, char** _argv) {
-  el_runtime_init_args(_argc, _argv);
-  return 0;
-}
-

dist/grammar.elh

@@ -1,22 +1,22 @@
-// auto-generated by elc --emit-header - do not edit
-extern fn slots_get(slots: Any, key: String) -> String
-extern fn slots_set(slots: Any, key: String, val: String) -> Any
-extern fn make_slots(k0: String, v0: String) -> Any
-extern fn make_slots2(k0: String, v0: String, k1: String, v1: String) -> Any
-extern fn make_slots3(k0: String, v0: String, k1: String, v1: String, k2: String, v2: String) -> Any
-extern fn make_slots4(k0: String, v0: String, k1: String, v1: String, k2: String, v2: String, k3: String, v3: String) -> Any
-extern fn make_slots5(k0: String, v0: String, k1: String, v1: String, k2: String, v2: String, k3: String, v3: String, k4: String, v4: String) -> Any
-extern fn rule_id(rule: Any) -> String
-extern fn rule_lhs(rule: Any) -> String
-extern fn rule_rhs_len(rule: Any) -> Int
-extern fn rule_rhs(rule: Any, idx: Int) -> String
-extern fn make_rule(id: String, lhs: String, r0: String) -> Any
-extern fn make_rule2(id: String, lhs: String, r0: String, r1: String) -> Any
-extern fn make_rule3(id: String, lhs: String, r0: String, r1: String, r2: String) -> Any
-extern fn make_rule4(id: String, lhs: String, r0: String, r1: String, r2: String, r3: String) -> Any
-extern fn build_rules() -> Any
-extern fn get_rules() -> Any
-extern fn find_rule(rule_id_str: String) -> Any
+// auto-generated by elc --emit-header — do not edit
+extern fn slots_get(slots: [String], key: String) -> String
+extern fn slots_set(slots: [String], key: String, val: String) -> [String]
+extern fn make_slots(k0: String, v0: String) -> [String]
+extern fn make_slots2(k0: String, v0: String, k1: String, v1: String) -> [String]
+extern fn make_slots3(k0: String, v0: String, k1: String, v1: String, k2: String, v2: String) -> [String]
+extern fn make_slots4(k0: String, v0: String, k1: String, v1: String, k2: String, v2: String, k3: String, v3: String) -> [String]
+extern fn make_slots5(k0: String, v0: String, k1: String, v1: String, k2: String, v2: String, k3: String, v3: String, k4: String, v4: String) -> [String]
+extern fn rule_id(rule: [String]) -> String
+extern fn rule_lhs(rule: [String]) -> String
+extern fn rule_rhs_len(rule: [String]) -> Int
+extern fn rule_rhs(rule: [String], idx: Int) -> String
+extern fn make_rule(id: String, lhs: String, r0: String) -> [String]
+extern fn make_rule2(id: String, lhs: String, r0: String, r1: String) -> [String]
+extern fn make_rule3(id: String, lhs: String, r0: String, r1: String, r2: String) -> [String]
+extern fn make_rule4(id: String, lhs: String, r0: String, r1: String, r2: String, r3: String) -> [String]
+extern fn build_rules() -> [[String]]
+extern fn get_rules() -> [[String]]
+extern fn find_rule(rule_id_str: String) -> [String]
 extern fn make_leaf(label: String, word: String) -> String
 extern fn make_node1(label: String, child0: String) -> String
 extern fn make_node2(label: String, child0: String, child1: String) -> String
@@ -24,15 +24,15 @@ extern fn make_node3(label: String, child0: String, child1: String, child2: Stri
 extern fn make_node4(label: String, child0: String, child1: String, child2: String, child3: String) -> String
 extern fn nlg_is_ws(c: String) -> Bool
 extern fn skip_ws(s: String, pos: Int) -> Int
-extern fn scan_token(s: String, start: Int) -> Any
+extern fn scan_token(s: String, start: Int) -> [String]
 extern fn render_tree(tree: String) -> String
-extern fn gram_word_order(profile: Any) -> String
-extern fn gram_order_constituents(subj: String, verb: String, obj: String, profile: Any) -> String
-extern fn gram_build_vp(verb: String, aux: String, profile: Any) -> String
-extern fn gram_question_strategy(profile: Any) -> String
+extern fn gram_word_order(profile: [String]) -> String
+extern fn gram_order_constituents(subj: String, verb: String, obj: String, profile: [String]) -> String
+extern fn gram_build_vp(verb: String, aux: String, profile: [String]) -> String
+extern fn gram_question_strategy(profile: [String]) -> String
 extern fn is_pronoun(word: String) -> Bool
-extern fn build_np(referent: String, slots: Any) -> String
+extern fn build_np(referent: String, slots: [String]) -> String
 extern fn build_pp(loc: String) -> String
-extern fn build_vp_body(slots: Any) -> String
-extern fn build_vp_from_slots(slots: Any) -> String
-extern fn generate_tree(rule_id_str: String, slots: Any) -> String
+extern fn build_vp_body(slots: [String]) -> String
+extern fn build_vp_from_slots(slots: [String]) -> String
+extern fn generate_tree(rule_id_str: String, slots: [String]) -> String

dist/imprint.c

@@ -70,8 +70,3 @@ el_val_t imprint_unload(void) {
   return 0;
 }
 
-int main(int _argc, char** _argv) {
-  el_runtime_init_args(_argc, _argv);
-  return 0;
-}
-

dist/language-profile.c

@@ -392,8 +392,3 @@ el_val_t lang_code(el_val_t profile) {
   return 0;
 }
 
-int main(int _argc, char** _argv) {
-  el_runtime_init_args(_argc, _argv);
-  return 0;
-}
-

dist/memory.c

@@ -10,6 +10,7 @@ el_val_t mem_remember(el_val_t content, el_val_t tags);
 el_val_t mem_recall(el_val_t query, el_val_t depth);
 el_val_t mem_search(el_val_t query, el_val_t limit);
 el_val_t mem_strengthen(el_val_t node_id);
+el_val_t mem_tombstone(el_val_t node_id);
 el_val_t mem_forget(el_val_t node_id);
 el_val_t mem_consolidate(void);
 el_val_t mem_save(el_val_t path);
@@ -34,7 +35,18 @@ el_val_t tier_canonical(void) {
 }
 
 el_val_t mem_store(el_val_t content, el_val_t label, el_val_t tags) {
-  return engram_node_full(content, EL_STR("Memory"), label, el_from_float(el_from_float(0.5)), el_from_float(el_from_float(0.5)), el_from_float(el_from_float(0.8)), EL_STR("Working"), tags);
+  el_val_t id = engram_node_full(content, EL_STR("Memory"), label, el_from_float(0.5), el_from_float(0.5), el_from_float(0.8), EL_STR("Working"), tags);
+  if (str_eq(id, EL_STR(""))) {
+    println(el_str_concat(EL_STR("[memory] write rejected by engram (empty id): label="), label));
+    return EL_STR("");
+  }
+  el_val_t readback = engram_get_node_json(id);
+  if (str_eq(readback, EL_STR("")) || str_eq(readback, EL_STR("{}"))) {
+    println(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("[memory] WRITE VERIFY FAILED: label="), label), EL_STR(" id=")), id), EL_STR(" \xe2\x80\x94 node absent after write")));
+    return EL_STR("");
+  }
+  println(el_str_concat(el_str_concat(EL_STR("[memory] write verified: "), id), EL_STR(" ok")));
+  return id;
   return 0;
 }
 
@@ -58,22 +70,60 @@ el_val_t mem_strengthen(el_val_t node_id) {
   return 0;
 }
 
+el_val_t mem_tombstone(el_val_t node_id) {
+  el_val_t tags = EL_STR("[\"Tombstone\",\"status:deleted\"]");
+  el_val_t marker = engram_node_full(node_id, EL_STR("Tombstone"), el_str_concat(EL_STR("tombstone:"), node_id), el_from_float(0.01), el_from_float(0.01), el_from_float(1.0), EL_STR("Episodic"), tags);
+  if (!str_eq(marker, EL_STR(""))) {
+    engram_connect(marker, node_id, el_from_float(1.0), EL_STR("tombstones"));
+  }
+  return marker;
+  return 0;
+}
+
 el_val_t mem_forget(el_val_t node_id) {
-  engram_forget(node_id);
+  el_val_t _marker = mem_tombstone(node_id);
   return 0;
 }
 
 el_val_t mem_consolidate(void) {
   el_val_t scanned = engram_node_count();
-  el_val_t dummy = engram_scan_nodes_json(100, 0);
-  el_val_t total_nodes = engram_node_count();
   el_val_t total_edges = engram_edge_count();
-  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"scanned\":"), int_to_str(scanned)), EL_STR(",\"total_nodes\":")), int_to_str(total_nodes)), EL_STR(",\"total_edges\":")), int_to_str(total_edges)), EL_STR("}"));
+  el_val_t strengthened = 0;
+  el_val_t wm_top = engram_wm_top_json(10);
+  el_val_t wm_len = json_array_len(wm_top);
+  el_val_t wi = 0;
+  while (wi < wm_len) {
+    el_val_t wm_node = json_array_get(wm_top, wi);
+    el_val_t wm_id = json_get(wm_node, EL_STR("id"));
+    if (!str_eq(wm_id, EL_STR(""))) {
+      engram_strengthen(wm_id);
+      strengthened = (strengthened + 1);
+    }
+    wi = (wi + 1);
+  }
+  el_val_t scan_result = engram_scan_nodes_json(50, 0);
+  el_val_t scan_len = json_array_len(scan_result);
+  el_val_t si = 0;
+  while (si < scan_len) {
+    el_val_t s_node = json_array_get(scan_result, si);
+    el_val_t s_tier = json_get(s_node, EL_STR("tier"));
+    el_val_t s_id = json_get(s_node, EL_STR("id"));
+    if (str_eq(s_tier, EL_STR("Canonical")) && !str_eq(s_id, EL_STR(""))) {
+      engram_strengthen(s_id);
+      strengthened = (strengthened + 1);
+    }
+    si = (si + 1);
+  }
+  el_val_t total_nodes = engram_node_count();
+  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"scanned\":"), int_to_str(scanned)), EL_STR(",\"total_nodes\":")), int_to_str(total_nodes)), EL_STR(",\"total_edges\":")), int_to_str(total_edges)), EL_STR(",\"strengthened\":")), int_to_str(strengthened)), EL_STR("}"));
   return 0;
 }
 
 el_val_t mem_save(el_val_t path) {
-  engram_save(path);
+  el_val_t saved = engram_save(path);
+  if (saved == 0) {
+    println(el_str_concat(el_str_concat(EL_STR("[memory] mem_save: engram_save failed for "), path), EL_STR(" \xe2\x80\x94 snapshot may be incomplete")));
+  }
   return 0;
 }
 
@@ -104,9 +154,56 @@ el_val_t mem_boot_count_get(void) {
 el_val_t mem_boot_count_inc(void) {
   el_val_t current = mem_boot_count_get();
   el_val_t next = (current + 1);
+  el_val_t old_results = engram_search_json(EL_STR("soul:boot_count"), 50);
+  if (!str_eq(old_results, EL_STR("")) && !str_eq(old_results, EL_STR("[]"))) {
+    el_val_t old_len = json_array_len(old_results);
+    el_val_t oi = 0;
+    while (oi < old_len) {
+      el_val_t old_node = json_array_get(old_results, oi);
+      el_val_t old_id = json_get(old_node, EL_STR("id"));
+      if (!str_eq(old_id, EL_STR(""))) {
+        engram_forget(old_id);
+      }
+      oi = (oi + 1);
+    }
+  }
   el_val_t content = el_str_concat(EL_STR("soul:boot_count:"), int_to_str(next));
   el_val_t tags = EL_STR("[\"soul-meta\",\"boot-counter\"]");
-  el_val_t discard = engram_node_full(content, EL_STR("Memory"), EL_STR("soul:boot_count"), el_from_float(el_from_float(0.9)), el_from_float(el_from_float(0.9)), el_from_float(el_from_float(1.0)), EL_STR("Canonical"), tags);
+  el_val_t boot_node_id = engram_node_full(content, EL_STR("Memory"), EL_STR("soul:boot_count"), el_from_float(0.55), el_from_float(0.2), el_from_float(1.0), EL_STR("Working"), tags);
+  if (str_eq(boot_node_id, EL_STR(""))) {
+    println(el_str_concat(el_str_concat(EL_STR("[memory] mem_boot_count_inc: write rejected (empty id) \xe2\x80\x94 boot counter node lost (count="), int_to_str(next)), EL_STR(")")));
+    return next;
+  }
+  el_val_t boot_readback = engram_get_node_json(boot_node_id);
+  if (str_eq(boot_readback, EL_STR("")) || str_eq(boot_readback, EL_STR("{}"))) {
+    println(el_str_concat(el_str_concat(el_str_concat(EL_STR("[memory] mem_boot_count_inc: WRITE VERIFY FAILED id="), boot_node_id), EL_STR(" count=")), int_to_str(next)));
+  }
+  el_val_t wb_url = env(EL_STR("ENGRAM_URL"));
+  el_val_t wb_key = env(EL_STR("ENGRAM_API_KEY"));
+  if (!str_eq(wb_url, EL_STR("")) && !str_eq(wb_key, EL_STR(""))) {
+    el_val_t auth_body = el_str_concat(el_str_concat(EL_STR("{\"_auth\":\""), json_safe(wb_key)), EL_STR("\"}"));
+    el_val_t srv_old = http_get(el_str_concat(wb_url, EL_STR("/api/search?q=soul:boot_count&limit=20")));
+    if (!str_eq(srv_old, EL_STR("")) && !str_eq(srv_old, EL_STR("[]"))) {
+      el_val_t srv_len = json_array_len(srv_old);
+      el_val_t si = 0;
+      while (si < srv_len) {
+        el_val_t srv_node = json_array_get(srv_old, si);
+        el_val_t srv_content = json_get(srv_node, EL_STR("content"));
+        if (str_starts_with(srv_content, EL_STR("soul:boot_count:"))) {
+          el_val_t srv_id = json_get(srv_node, EL_STR("id"));
+          if (!str_eq(srv_id, EL_STR(""))) {
+            http_delete_json(el_str_concat(el_str_concat(wb_url, EL_STR("/api/nodes/")), srv_id), auth_body);
+          }
+        }
+        si = (si + 1);
+      }
+    }
+    el_val_t wb_body = el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"content\":\""), content), EL_STR("\",\"node_type\":\"Memory\",\"label\":\"soul:boot_count\",\"salience\":0.55,\"importance\":0.2,\"tier\":\"Working\",\"tags\":\"[\\\"soul-meta\\\",\\\"boot-counter\\\"]\",\"_auth\":\"")), json_safe(wb_key)), EL_STR("\"}"));
+    el_val_t wb_resp = http_post_json(el_str_concat(wb_url, EL_STR("/api/nodes")), wb_body);
+    if (str_contains(wb_resp, EL_STR("\"error\""))) {
+      println(el_str_concat(EL_STR("[memory] mem_boot_count_inc: HTTP write-back failed (count in-memory only): "), wb_resp));
+    }
+  }
   return next;
   return 0;
 }
@@ -118,12 +215,11 @@ el_val_t mem_emit_state_event(el_val_t trigger, el_val_t kind, el_val_t content)
   el_val_t safe_content = str_replace(content, EL_STR("\""), EL_STR("'"));
   el_val_t payload = el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"trigger\":\""), safe_trigger), EL_STR("\"")), EL_STR(",\"kind\":\"")), kind), EL_STR("\"")), EL_STR(",\"content\":\"")), safe_content), EL_STR("\"")), EL_STR(",\"boot\":")), int_to_str(boot)), EL_STR(",\"ts\":")), int_to_str(ts)), EL_STR("}"));
   el_val_t tags = EL_STR("[\"internal-state\",\"pre-reasoning\",\"InternalStateEvent\"]");
-  return engram_node_full(payload, EL_STR("InternalStateEvent"), el_str_concat(EL_STR("state-event:"), kind), el_from_float(el_from_float(0.85)), el_from_float(el_from_float(0.8)), el_from_float(el_from_float(0.9)), EL_STR("Episodic"), tags);
-  return 0;
-}
-
-int main(int _argc, char** _argv) {
-  el_runtime_init_args(_argc, _argv);
+  el_val_t event_id = engram_node_full(payload, EL_STR("InternalStateEvent"), el_str_concat(EL_STR("state-event:"), kind), el_from_float(0.85), el_from_float(0.8), el_from_float(0.9), EL_STR("Episodic"), tags);
+  if (str_eq(event_id, EL_STR(""))) {
+    println(el_str_concat(EL_STR("[memory] mem_emit_state_event: write rejected (empty id): kind="), kind));
+  }
+  return event_id;
   return 0;
 }
 

dist/neuron-api.c

@@ -26,9 +26,22 @@ el_val_t api_ok(el_val_t extra);
 el_val_t api_err(el_val_t msg);
 el_val_t api_nonempty(el_val_t s);
 el_val_t api_or_empty(el_val_t s);
+el_val_t api_num_or_zero(el_val_t obj, el_val_t key);
+el_val_t api_utf8_trunc(el_val_t s, el_val_t n);
+el_val_t api_compact_node(el_val_t node, el_val_t snip);
+el_val_t api_compact_node_array(el_val_t raw, el_val_t max_items, el_val_t snip);
+el_val_t api_compact_activated(el_val_t raw, el_val_t max_items, el_val_t snip);
+el_val_t api_persisted(el_val_t id);
+el_val_t api_not_persisted(el_val_t id);
+el_val_t tombstone_node(el_val_t id);
+el_val_t tombstoned_id_set(void);
+el_val_t memory_hide_tombstoned(el_val_t raw, el_val_t path);
 el_val_t handle_api_begin_session(el_val_t body);
 el_val_t handle_api_compile_ctx(el_val_t body);
 el_val_t handle_api_remember(el_val_t body);
+el_val_t handle_api_node_create(el_val_t body);
+el_val_t handle_api_node_delete(el_val_t body);
+el_val_t handle_api_node_update(el_val_t body);
 el_val_t handle_api_recall(el_val_t method, el_val_t path, el_val_t body);
 el_val_t handle_api_search_knowledge(el_val_t method, el_val_t path, el_val_t body);
 el_val_t handle_api_browse_knowledge(el_val_t path, el_val_t body);
@@ -45,114 +58,12 @@ el_val_t handle_api_inspect_graph(el_val_t method, el_val_t path, el_val_t body)
 el_val_t handle_api_link_entities(el_val_t body);
 el_val_t handle_api_forget(el_val_t body);
 el_val_t handle_api_evolve_memory(el_val_t body);
+el_val_t handle_api_memory_delete(el_val_t body);
+el_val_t handle_api_memory_update(el_val_t body);
 el_val_t handle_api_cultivate(el_val_t body);
 el_val_t handle_api_list_typed(el_val_t node_type, el_val_t path, el_val_t body);
 el_val_t handle_api_consolidate(el_val_t body);
 
-el_val_t tier_working(void) {
-  return EL_STR("Working");
-  return 0;
-}
-
-el_val_t tier_episodic(void) {
-  return EL_STR("Episodic");
-  return 0;
-}
-
-el_val_t tier_canonical(void) {
-  return EL_STR("Canonical");
-  return 0;
-}
-
-el_val_t mem_store(el_val_t content, el_val_t label, el_val_t tags) {
-  return engram_node_full(content, EL_STR("Memory"), label, el_from_float(el_from_float(0.5)), el_from_float(el_from_float(0.5)), el_from_float(el_from_float(0.8)), EL_STR("Working"), tags);
-  return 0;
-}
-
-el_val_t mem_remember(el_val_t content, el_val_t tags) {
-  return mem_store(content, EL_STR("soul-memory"), tags);
-  return 0;
-}
-
-el_val_t mem_recall(el_val_t query, el_val_t depth) {
-  return engram_activate_json(query, depth);
-  return 0;
-}
-
-el_val_t mem_search(el_val_t query, el_val_t limit) {
-  return engram_search_json(query, limit);
-  return 0;
-}
-
-el_val_t mem_strengthen(el_val_t node_id) {
-  engram_strengthen(node_id);
-  return 0;
-}
-
-el_val_t mem_forget(el_val_t node_id) {
-  engram_forget(node_id);
-  return 0;
-}
-
-el_val_t mem_consolidate(void) {
-  el_val_t scanned = engram_node_count();
-  el_val_t dummy = engram_scan_nodes_json(100, 0);
-  el_val_t total_nodes = engram_node_count();
-  el_val_t total_edges = engram_edge_count();
-  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"scanned\":"), int_to_str(scanned)), EL_STR(",\"total_nodes\":")), int_to_str(total_nodes)), EL_STR(",\"total_edges\":")), int_to_str(total_edges)), EL_STR("}"));
-  return 0;
-}
-
-el_val_t mem_save(el_val_t path) {
-  engram_save(path);
-  return 0;
-}
-
-el_val_t mem_load(el_val_t path) {
-  engram_load(path);
-  return 0;
-}
-
-el_val_t mem_boot_count_get(void) {
-  el_val_t results = engram_search_json(EL_STR("soul:boot_count"), 3);
-  if (str_eq(results, EL_STR(""))) {
-    return 0;
-  }
-  if (str_eq(results, EL_STR("[]"))) {
-    return 0;
-  }
-  el_val_t node = json_array_get(results, 0);
-  el_val_t content = json_get(node, EL_STR("content"));
-  el_val_t prefix = EL_STR("soul:boot_count:");
-  if (!str_starts_with(content, prefix)) {
-    return 0;
-  }
-  el_val_t num_str = str_slice(content, str_len(prefix), str_len(content));
-  return str_to_int(num_str);
-  return 0;
-}
-
-el_val_t mem_boot_count_inc(void) {
-  el_val_t current = mem_boot_count_get();
-  el_val_t next = (current + 1);
-  el_val_t content = el_str_concat(EL_STR("soul:boot_count:"), int_to_str(next));
-  el_val_t tags = EL_STR("[\"soul-meta\",\"boot-counter\"]");
-  el_val_t discard = engram_node_full(content, EL_STR("Memory"), EL_STR("soul:boot_count"), el_from_float(el_from_float(0.9)), el_from_float(el_from_float(0.9)), el_from_float(el_from_float(1.0)), EL_STR("Canonical"), tags);
-  return next;
-  return 0;
-}
-
-el_val_t mem_emit_state_event(el_val_t trigger, el_val_t kind, el_val_t content) {
-  el_val_t boot = mem_boot_count_get();
-  el_val_t ts = time_now();
-  el_val_t safe_trigger = str_replace(trigger, EL_STR("\""), EL_STR("'"));
-  el_val_t safe_content = str_replace(content, EL_STR("\""), EL_STR("'"));
-  el_val_t payload = el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"trigger\":\""), safe_trigger), EL_STR("\"")), EL_STR(",\"kind\":\"")), kind), EL_STR("\"")), EL_STR(",\"content\":\"")), safe_content), EL_STR("\"")), EL_STR(",\"boot\":")), int_to_str(boot)), EL_STR(",\"ts\":")), int_to_str(ts)), EL_STR("}"));
-  el_val_t tags = EL_STR("[\"internal-state\",\"pre-reasoning\",\"InternalStateEvent\"]");
-  return engram_node_full(payload, EL_STR("InternalStateEvent"), el_str_concat(EL_STR("state-event:"), kind), el_from_float(el_from_float(0.85)), el_from_float(el_from_float(0.8)), el_from_float(el_from_float(0.9)), EL_STR("Episodic"), tags);
-  return 0;
-}
-
 el_val_t is_protected_node(el_val_t id) {
   if (str_eq(id, EL_STR("kn-efeb4a5b-5aff-4759-8a97-7233099be6ee"))) {
     return 1;
@@ -272,21 +183,168 @@ el_val_t api_or_empty(el_val_t s) {
   return 0;
 }
 
+el_val_t api_num_or_zero(el_val_t obj, el_val_t key) {
+  el_val_t v = json_get_raw(obj, key);
+  if (str_eq(v, EL_STR(""))) {
+    return EL_STR("0");
+  }
+  return v;
+  return 0;
+}
+
+el_val_t api_utf8_trunc(el_val_t s, el_val_t n) {
+  if (str_len(s) <= n) {
+    return s;
+  }
+  el_val_t cut = n;
+  el_val_t scanning = 1;
+  while (scanning && (cut > 0)) {
+    el_val_t b = str_char_code(s, cut);
+    el_val_t is_cont = ((b >= 128) && (b < 192));
+    cut = ({ el_val_t _if_result_1 = 0; if (is_cont) { _if_result_1 = ((cut - 1)); } else { _if_result_1 = (cut); } _if_result_1; });
+    scanning = is_cont;
+  }
+  return str_slice(s, 0, cut);
+  return 0;
+}
+
+el_val_t api_compact_node(el_val_t node, el_val_t snip) {
+  el_val_t id = json_get(node, EL_STR("id"));
+  el_val_t ntype = json_get(node, EL_STR("node_type"));
+  el_val_t label = json_get(node, EL_STR("label"));
+  el_val_t tier = json_get(node, EL_STR("tier"));
+  el_val_t content = json_get(node, EL_STR("content"));
+  el_val_t snippet = api_utf8_trunc(content, snip);
+  el_val_t trunc_str = ({ el_val_t _if_result_2 = 0; if ((str_len(content) > snip)) { _if_result_2 = (EL_STR("true")); } else { _if_result_2 = (EL_STR("false")); } _if_result_2; });
+  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"id\":\""), api_json_escape(id)), EL_STR("\"")), EL_STR(",\"node_type\":\"")), api_json_escape(ntype)), EL_STR("\"")), EL_STR(",\"label\":\"")), api_json_escape(label)), EL_STR("\"")), EL_STR(",\"tier\":\"")), api_json_escape(tier)), EL_STR("\"")), EL_STR(",\"importance\":")), api_num_or_zero(node, EL_STR("importance"))), EL_STR(",\"salience\":")), api_num_or_zero(node, EL_STR("salience"))), EL_STR(",\"content\":\"")), api_json_escape(snippet)), EL_STR("\"")), EL_STR(",\"content_truncated\":")), trunc_str), EL_STR("}"));
+  return 0;
+}
+
+el_val_t api_compact_node_array(el_val_t raw, el_val_t max_items, el_val_t snip) {
+  if (!api_nonempty(raw)) {
+    return EL_STR("[]");
+  }
+  el_val_t n = json_array_len(raw);
+  el_val_t cap = ({ el_val_t _if_result_3 = 0; if ((n < max_items)) { _if_result_3 = (n); } else { _if_result_3 = (max_items); } _if_result_3; });
+  el_val_t out = EL_STR("[");
+  el_val_t i = 0;
+  while (i < cap) {
+    el_val_t node = json_array_get(raw, i);
+    el_val_t sep = ({ el_val_t _if_result_4 = 0; if ((i == 0)) { _if_result_4 = (EL_STR("")); } else { _if_result_4 = (EL_STR(",")); } _if_result_4; });
+    out = el_str_concat(el_str_concat(out, sep), api_compact_node(node, snip));
+    i = (i + 1);
+  }
+  return el_str_concat(out, EL_STR("]"));
+  return 0;
+}
+
+el_val_t api_compact_activated(el_val_t raw, el_val_t max_items, el_val_t snip) {
+  if (!api_nonempty(raw)) {
+    return EL_STR("[]");
+  }
+  el_val_t n = json_array_len(raw);
+  el_val_t cap = ({ el_val_t _if_result_5 = 0; if ((n < max_items)) { _if_result_5 = (n); } else { _if_result_5 = (max_items); } _if_result_5; });
+  el_val_t out = EL_STR("[");
+  el_val_t i = 0;
+  while (i < cap) {
+    el_val_t el = json_array_get(raw, i);
+    el_val_t node = json_get_raw(el, EL_STR("node"));
+    el_val_t sep = ({ el_val_t _if_result_6 = 0; if ((i == 0)) { _if_result_6 = (EL_STR("")); } else { _if_result_6 = (EL_STR(",")); } _if_result_6; });
+    out = el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(out, sep), EL_STR("{\"node\":")), api_compact_node(node, snip)), EL_STR(",\"activation_strength\":")), api_num_or_zero(el, EL_STR("activation_strength"))), EL_STR(",\"working_memory_weight\":")), api_num_or_zero(el, EL_STR("working_memory_weight"))), EL_STR(",\"epistemic_confidence\":")), api_num_or_zero(el, EL_STR("epistemic_confidence"))), EL_STR(",\"hops\":")), api_num_or_zero(el, EL_STR("hops"))), EL_STR(",\"promoted\":")), api_num_or_zero(el, EL_STR("promoted"))), EL_STR("}"));
+    i = (i + 1);
+  }
+  return el_str_concat(out, EL_STR("]"));
+  return 0;
+}
+
+el_val_t api_persisted(el_val_t id) {
+  if (str_eq(id, EL_STR(""))) {
+    return 0;
+  }
+  el_val_t node = engram_get_node_json(id);
+  return ((!str_eq(node, EL_STR("")) && !str_eq(node, EL_STR("null"))) && !str_eq(node, EL_STR("{}")));
+  return 0;
+}
+
+el_val_t api_not_persisted(el_val_t id) {
+  return el_str_concat(el_str_concat(EL_STR("{\"ok\":false,\"error\":\"write_not_persisted\",\"id\":\""), id), EL_STR("\"}"));
+  return 0;
+}
+
+el_val_t tombstone_node(el_val_t id) {
+  return mem_tombstone(id);
+  return 0;
+}
+
+el_val_t tombstoned_id_set(void) {
+  el_val_t markers = engram_scan_nodes_by_type_json(EL_STR("Tombstone"), 5000, 0);
+  if (str_eq(markers, EL_STR("")) || str_eq(markers, EL_STR("[]"))) {
+    return EL_STR("");
+  }
+  el_val_t n = json_array_len(markers);
+  el_val_t acc = EL_STR("|");
+  el_val_t i = 0;
+  while (i < n) {
+    el_val_t m = json_array_get(markers, i);
+    el_val_t tid = json_get(m, EL_STR("content"));
+    acc = ({ el_val_t _if_result_7 = 0; if (str_eq(tid, EL_STR(""))) { _if_result_7 = (acc); } else { _if_result_7 = (el_str_concat(el_str_concat(acc, tid), EL_STR("|"))); } _if_result_7; });
+    i = (i + 1);
+  }
+  return acc;
+  return 0;
+}
+
+el_val_t memory_hide_tombstoned(el_val_t raw, el_val_t path) {
+  if (str_contains(path, EL_STR("include_deleted"))) {
+    return raw;
+  }
+  if (str_eq(raw, EL_STR("")) || str_eq(raw, EL_STR("[]"))) {
+    return raw;
+  }
+  el_val_t dead = tombstoned_id_set();
+  if (str_eq(dead, EL_STR(""))) {
+    return raw;
+  }
+  el_val_t n = json_array_len(raw);
+  if (n > 1000) {
+    return raw;
+  }
+  el_val_t out = EL_STR("[");
+  el_val_t first = 1;
+  el_val_t i = 0;
+  while (i < n) {
+    el_val_t node = json_array_get(raw, i);
+    el_val_t nid = json_get(node, EL_STR("id"));
+    el_val_t ntype = json_get(node, EL_STR("node_type"));
+    el_val_t is_dead = (!str_eq(nid, EL_STR("")) && str_contains(dead, el_str_concat(el_str_concat(EL_STR("|"), nid), EL_STR("|"))));
+    el_val_t keep = (!str_eq(ntype, EL_STR("Tombstone")) && !is_dead);
+    out = ({ el_val_t _if_result_8 = 0; if (keep) { _if_result_8 = (({ el_val_t _if_result_9 = 0; if (first) { _if_result_9 = (el_str_concat(out, node)); } else { _if_result_9 = (el_str_concat(el_str_concat(out, EL_STR(",")), node)); } _if_result_9; })); } else { _if_result_8 = (out); } _if_result_8; });
+    first = ({ el_val_t _if_result_10 = 0; if (keep) { _if_result_10 = (0); } else { _if_result_10 = (first); } _if_result_10; });
+    i = (i + 1);
+  }
+  return el_str_concat(out, EL_STR("]"));
+  return 0;
+}
+
 el_val_t handle_api_begin_session(el_val_t body) {
   el_val_t stats = engram_stats_json();
-  el_val_t activated = engram_activate_json(EL_STR("session start recent memory important"), 2);
-  el_val_t self_nbrs = engram_neighbors_json(EL_STR("kn-efeb4a5b-5aff-4759-8a97-7233099be6ee"), 1, EL_STR("both"));
-  el_val_t state_events = engram_scan_nodes_by_type_json(EL_STR("InternalStateEvent"), 5, 0);
-  el_val_t recent = engram_scan_nodes_json(10, 0);
-  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"stats\":"), stats), EL_STR(",\"recent\":")), api_or_empty(recent)), EL_STR(",\"activated\":")), api_or_empty(activated)), EL_STR(",\"self_neighbors\":")), api_or_empty(self_nbrs)), EL_STR(",\"recent_state_events\":")), api_or_empty(state_events)), EL_STR("}"));
+  el_val_t activated_raw = engram_activate_json(EL_STR("session start recent memory important"), 1);
+  el_val_t activated = api_compact_activated(activated_raw, 8, 240);
+  el_val_t state_events_raw = engram_scan_nodes_by_type_json(EL_STR("InternalStateEvent"), 5, 0);
+  el_val_t state_events = api_compact_node_array(state_events_raw, 5, 500);
+  el_val_t recent_raw = engram_scan_nodes_json(10, 0);
+  el_val_t recent = api_compact_node_array(recent_raw, 10, 240);
+  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"stats\":"), stats), EL_STR(",\"recent\":")), recent), EL_STR(",\"activated\":")), activated), EL_STR(",\"self_neighbors\":[]")), EL_STR(",\"recent_state_events\":")), state_events), EL_STR("}"));
   return 0;
 }
 
 el_val_t handle_api_compile_ctx(el_val_t body) {
   el_val_t stats = engram_stats_json();
-  el_val_t activated = engram_activate_json(EL_STR("active work context current task in progress"), 2);
-  el_val_t recent = engram_scan_nodes_json(20, 0);
-  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"stats\":"), stats), EL_STR(",\"recent_nodes\":")), api_or_empty(recent)), EL_STR(",\"activated\":")), api_or_empty(activated)), EL_STR("}"));
+  el_val_t activated_raw = engram_activate_json(EL_STR("active work context current task in progress"), 2);
+  el_val_t activated = api_compact_activated(activated_raw, 10, 240);
+  el_val_t recent_raw = engram_scan_nodes_json(20, 0);
+  el_val_t recent = api_compact_node_array(recent_raw, 20, 240);
+  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"stats\":"), stats), EL_STR(",\"recent_nodes\":")), recent), EL_STR(",\"activated\":")), activated), EL_STR("}"));
   return 0;
 }
 
@@ -298,22 +356,102 @@ el_val_t handle_api_remember(el_val_t body) {
   el_val_t importance = json_get(body, EL_STR("importance"));
   el_val_t tags_raw = json_get(body, EL_STR("tags"));
   el_val_t project = json_get(body, EL_STR("project"));
-  el_val_t sal_str = ({ el_val_t _if_result_1 = 0; if (str_eq(importance, EL_STR("critical"))) { _if_result_1 = (EL_STR("0.95")); } else { _if_result_1 = (({ el_val_t _if_result_2 = 0; if (str_eq(importance, EL_STR("high"))) { _if_result_2 = (EL_STR("0.75")); } else { _if_result_2 = (({ el_val_t _if_result_3 = 0; if (str_eq(importance, EL_STR("low"))) { _if_result_3 = (EL_STR("0.25")); } else { _if_result_3 = (EL_STR("0.50")); } _if_result_3; })); } _if_result_2; })); } _if_result_1; });
-  el_val_t sal = ({ el_val_t _if_result_4 = 0; if (str_eq(sal_str, EL_STR("0.95"))) { _if_result_4 = (el_from_float(0.95)); } else { _if_result_4 = (({ el_val_t _if_result_5 = 0; if (str_eq(sal_str, EL_STR("0.75"))) { _if_result_5 = (el_from_float(0.75)); } else { _if_result_5 = (({ el_val_t _if_result_6 = 0; if (str_eq(sal_str, EL_STR("0.25"))) { _if_result_6 = (el_from_float(0.25)); } else { _if_result_6 = (el_from_float(0.5)); } _if_result_6; })); } _if_result_5; })); } _if_result_4; });
-  el_val_t base_tags = ({ el_val_t _if_result_7 = 0; if (str_eq(tags_raw, EL_STR(""))) { _if_result_7 = (EL_STR("[\"Memory\"]")); } else { _if_result_7 = (tags_raw); } _if_result_7; });
-  el_val_t final_tags = ({ el_val_t _if_result_8 = 0; if (str_eq(project, EL_STR(""))) { _if_result_8 = (base_tags); } else { el_val_t inner = str_slice(base_tags, 1, (str_len(base_tags) - 1)); _if_result_8 = (el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("["), inner), EL_STR(",\"project:")), project), EL_STR("\"]"))); } _if_result_8; });
-  el_val_t id = engram_node_full(content, EL_STR("Memory"), EL_STR("memory:remembered"), el_from_float(sal), el_from_float(sal), el_from_float(el_from_float(0.9)), EL_STR("Episodic"), final_tags);
+  el_val_t sal_str = ({ el_val_t _if_result_11 = 0; if (str_eq(importance, EL_STR("critical"))) { _if_result_11 = (EL_STR("0.95")); } else { _if_result_11 = (({ el_val_t _if_result_12 = 0; if (str_eq(importance, EL_STR("high"))) { _if_result_12 = (EL_STR("0.75")); } else { _if_result_12 = (({ el_val_t _if_result_13 = 0; if (str_eq(importance, EL_STR("low"))) { _if_result_13 = (EL_STR("0.25")); } else { _if_result_13 = (EL_STR("0.50")); } _if_result_13; })); } _if_result_12; })); } _if_result_11; });
+  el_val_t sal = ({ el_val_t _if_result_14 = 0; if (str_eq(sal_str, EL_STR("0.95"))) { _if_result_14 = (el_from_float(0.95)); } else { _if_result_14 = (({ el_val_t _if_result_15 = 0; if (str_eq(sal_str, EL_STR("0.75"))) { _if_result_15 = (el_from_float(0.75)); } else { _if_result_15 = (({ el_val_t _if_result_16 = 0; if (str_eq(sal_str, EL_STR("0.25"))) { _if_result_16 = (el_from_float(0.25)); } else { _if_result_16 = (el_from_float(0.5)); } _if_result_16; })); } _if_result_15; })); } _if_result_14; });
+  el_val_t base_tags = ({ el_val_t _if_result_17 = 0; if (str_eq(tags_raw, EL_STR(""))) { _if_result_17 = (EL_STR("[\"Memory\"]")); } else { _if_result_17 = (tags_raw); } _if_result_17; });
+  el_val_t final_tags = ({ el_val_t _if_result_18 = 0; if (str_eq(project, EL_STR(""))) { _if_result_18 = (base_tags); } else { el_val_t inner = str_slice(base_tags, 1, (str_len(base_tags) - 1)); _if_result_18 = (el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("["), inner), EL_STR(",\"project:")), project), EL_STR("\"]"))); } _if_result_18; });
+  el_val_t id = engram_node_full(content, EL_STR("Memory"), EL_STR("memory:remembered"), el_from_float(sal), el_from_float(sal), el_from_float(0.9), EL_STR("Episodic"), final_tags);
+  if (!api_persisted(id)) {
+    return api_not_persisted(id);
+  }
   return el_str_concat(el_str_concat(EL_STR("{\"id\":\""), id), EL_STR("\",\"ok\":true}"));
   return 0;
 }
 
+el_val_t handle_api_node_create(el_val_t body) {
+  el_val_t content = json_get(body, EL_STR("content"));
+  if (str_eq(content, EL_STR(""))) {
+    return api_err(EL_STR("content is required"));
+  }
+  el_val_t nt_raw = json_get(body, EL_STR("node_type"));
+  el_val_t node_type = ({ el_val_t _if_result_19 = 0; if (str_eq(nt_raw, EL_STR(""))) { _if_result_19 = (EL_STR("Memory")); } else { _if_result_19 = (nt_raw); } _if_result_19; });
+  el_val_t label_raw = json_get(body, EL_STR("label"));
+  el_val_t label = ({ el_val_t _if_result_20 = 0; if (str_eq(label_raw, EL_STR(""))) { _if_result_20 = (EL_STR("node:created")); } else { _if_result_20 = (label_raw); } _if_result_20; });
+  el_val_t tier_raw = json_get(body, EL_STR("tier"));
+  el_val_t tier = ({ el_val_t _if_result_21 = 0; if (str_eq(tier_raw, EL_STR(""))) { _if_result_21 = (EL_STR("Episodic")); } else { _if_result_21 = (tier_raw); } _if_result_21; });
+  el_val_t tags_raw = json_get(body, EL_STR("tags"));
+  el_val_t tags = ({ el_val_t _if_result_22 = 0; if (str_eq(tags_raw, EL_STR(""))) { _if_result_22 = (el_str_concat(el_str_concat(EL_STR("[\""), node_type), EL_STR("\"]"))); } else { _if_result_22 = (tags_raw); } _if_result_22; });
+  el_val_t importance = json_get(body, EL_STR("importance"));
+  el_val_t sal = ({ el_val_t _if_result_23 = 0; if (str_eq(importance, EL_STR("critical"))) { _if_result_23 = (el_from_float(0.95)); } else { _if_result_23 = (({ el_val_t _if_result_24 = 0; if (str_eq(importance, EL_STR("high"))) { _if_result_24 = (el_from_float(0.75)); } else { _if_result_24 = (({ el_val_t _if_result_25 = 0; if (str_eq(importance, EL_STR("low"))) { _if_result_25 = (el_from_float(0.25)); } else { _if_result_25 = (el_from_float(0.5)); } _if_result_25; })); } _if_result_24; })); } _if_result_23; });
+  el_val_t id = engram_node_full(content, node_type, label, el_from_float(sal), el_from_float(sal), el_from_float(0.9), tier, tags);
+  if (!api_persisted(id)) {
+    return api_not_persisted(id);
+  }
+  return el_str_concat(el_str_concat(EL_STR("{\"id\":\""), id), EL_STR("\",\"ok\":true}"));
+  return 0;
+}
+
+el_val_t handle_api_node_delete(el_val_t body) {
+  el_val_t id = json_get(body, EL_STR("id"));
+  if (str_eq(id, EL_STR(""))) {
+    return api_err(EL_STR("id is required"));
+  }
+  if (is_protected_node(id)) {
+    return api_err_protected(id);
+  }
+  el_val_t existing = engram_get_node_json(id);
+  if (str_eq(existing, EL_STR("{}"))) {
+    return api_err(el_str_concat(EL_STR("node not found: "), id));
+  }
+  el_val_t marker = tombstone_node(id);
+  if (str_eq(marker, EL_STR(""))) {
+    return api_err(el_str_concat(EL_STR("tombstone failed: "), id));
+  }
+  return el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"id\":\""), id), EL_STR("\",\"tombstoned\":true}"));
+  return 0;
+}
+
+el_val_t handle_api_node_update(el_val_t body) {
+  el_val_t id = json_get(body, EL_STR("id"));
+  if (str_eq(id, EL_STR(""))) {
+    return api_err(EL_STR("id is required"));
+  }
+  if (!api_persisted(id)) {
+    return el_str_concat(el_str_concat(EL_STR("{\"ok\":false,\"error\":\"not_found\",\"id\":\""), id), EL_STR("\"}"));
+  }
+  el_val_t old = engram_get_node_json(id);
+  el_val_t body_content = json_get(body, EL_STR("content"));
+  el_val_t content = ({ el_val_t _if_result_26 = 0; if (str_eq(body_content, EL_STR(""))) { _if_result_26 = (json_get(old, EL_STR("content"))); } else { _if_result_26 = (body_content); } _if_result_26; });
+  el_val_t body_nt = json_get(body, EL_STR("node_type"));
+  el_val_t old_nt = json_get(old, EL_STR("node_type"));
+  el_val_t node_type = ({ el_val_t _if_result_27 = 0; if (!str_eq(body_nt, EL_STR(""))) { _if_result_27 = (body_nt); } else { _if_result_27 = (({ el_val_t _if_result_28 = 0; if (!str_eq(old_nt, EL_STR(""))) { _if_result_28 = (old_nt); } else { _if_result_28 = (EL_STR("Memory")); } _if_result_28; })); } _if_result_27; });
+  el_val_t body_label = json_get(body, EL_STR("label"));
+  el_val_t old_label = json_get(old, EL_STR("label"));
+  el_val_t label = ({ el_val_t _if_result_29 = 0; if (!str_eq(body_label, EL_STR(""))) { _if_result_29 = (body_label); } else { _if_result_29 = (({ el_val_t _if_result_30 = 0; if (!str_eq(old_label, EL_STR(""))) { _if_result_30 = (old_label); } else { _if_result_30 = (EL_STR("node:updated")); } _if_result_30; })); } _if_result_29; });
+  el_val_t body_tier = json_get(body, EL_STR("tier"));
+  el_val_t old_tier = json_get(old, EL_STR("tier"));
+  el_val_t tier = ({ el_val_t _if_result_31 = 0; if (!str_eq(body_tier, EL_STR(""))) { _if_result_31 = (body_tier); } else { _if_result_31 = (({ el_val_t _if_result_32 = 0; if (!str_eq(old_tier, EL_STR(""))) { _if_result_32 = (old_tier); } else { _if_result_32 = (EL_STR("Episodic")); } _if_result_32; })); } _if_result_31; });
+  el_val_t body_tags = json_get(body, EL_STR("tags"));
+  el_val_t tags = ({ el_val_t _if_result_33 = 0; if (str_eq(body_tags, EL_STR(""))) { _if_result_33 = (el_str_concat(el_str_concat(EL_STR("[\""), node_type), EL_STR("\"]"))); } else { _if_result_33 = (body_tags); } _if_result_33; });
+  el_val_t new_id = engram_node_full(content, node_type, label, el_from_float(0.5), el_from_float(0.5), el_from_float(0.8), tier, tags);
+  if (!api_persisted(new_id)) {
+    return api_not_persisted(new_id);
+  }
+  engram_connect(new_id, id, el_from_float(0.9), EL_STR("supersedes"));
+  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"id\":\""), new_id), EL_STR("\",\"supersedes\":\"")), id), EL_STR("\",\"ok\":true}"));
+  return 0;
+}
+
 el_val_t handle_api_recall(el_val_t method, el_val_t path, el_val_t body) {
-  el_val_t q = ({ el_val_t _if_result_9 = 0; if (str_eq(method, EL_STR("GET"))) { _if_result_9 = (api_query_param(path, EL_STR("query"))); } else { _if_result_9 = (json_get(body, EL_STR("query"))); } _if_result_9; });
+  el_val_t url_q = ({ el_val_t _if_result_34 = 0; if (str_eq(api_query_param(path, EL_STR("query")), EL_STR(""))) { _if_result_34 = (api_query_param(path, EL_STR("q"))); } else { _if_result_34 = (api_query_param(path, EL_STR("query"))); } _if_result_34; });
+  el_val_t body_query = json_get(body, EL_STR("query"));
+  el_val_t body_q = json_get(body, EL_STR("q"));
+  el_val_t q = ({ el_val_t _if_result_35 = 0; if (!str_eq(url_q, EL_STR(""))) { _if_result_35 = (url_q); } else { _if_result_35 = (({ el_val_t _if_result_36 = 0; if (!str_eq(body_query, EL_STR(""))) { _if_result_36 = (body_query); } else { _if_result_36 = (body_q); } _if_result_36; })); } _if_result_35; });
   el_val_t chain = json_get(body, EL_STR("chain_name"));
   el_val_t limit = api_query_int(path, EL_STR("limit"), 0);
-  limit = ({ el_val_t _if_result_10 = 0; if ((limit == 0)) { _if_result_10 = (json_get_int(body, EL_STR("limit"))); } else { _if_result_10 = (limit); } _if_result_10; });
-  limit = ({ el_val_t _if_result_11 = 0; if ((limit == 0)) { _if_result_11 = (10); } else { _if_result_11 = (limit); } _if_result_11; });
-  el_val_t eff_q = ({ el_val_t _if_result_12 = 0; if (str_eq(q, EL_STR(""))) { _if_result_12 = (chain); } else { _if_result_12 = (q); } _if_result_12; });
+  limit = ({ el_val_t _if_result_37 = 0; if ((limit == 0)) { _if_result_37 = (json_get_int(body, EL_STR("limit"))); } else { _if_result_37 = (limit); } _if_result_37; });
+  limit = ({ el_val_t _if_result_38 = 0; if ((limit == 0)) { _if_result_38 = (10); } else { _if_result_38 = (limit); } _if_result_38; });
+  el_val_t eff_q = ({ el_val_t _if_result_39 = 0; if (str_eq(q, EL_STR(""))) { _if_result_39 = (chain); } else { _if_result_39 = (q); } _if_result_39; });
   if (str_eq(eff_q, EL_STR(""))) {
     return api_or_empty(engram_scan_nodes_json(limit, 0));
   }
@@ -323,10 +461,13 @@ el_val_t handle_api_recall(el_val_t method, el_val_t path, el_val_t body) {
 }
 
 el_val_t handle_api_search_knowledge(el_val_t method, el_val_t path, el_val_t body) {
-  el_val_t q = ({ el_val_t _if_result_13 = 0; if (str_eq(method, EL_STR("GET"))) { _if_result_13 = (api_query_param(path, EL_STR("q"))); } else { _if_result_13 = (json_get(body, EL_STR("query"))); } _if_result_13; });
+  el_val_t url_q = api_query_param(path, EL_STR("q"));
+  el_val_t body_query = json_get(body, EL_STR("query"));
+  el_val_t body_q = json_get(body, EL_STR("q"));
+  el_val_t q = ({ el_val_t _if_result_40 = 0; if (!str_eq(url_q, EL_STR(""))) { _if_result_40 = (url_q); } else { _if_result_40 = (({ el_val_t _if_result_41 = 0; if (!str_eq(body_query, EL_STR(""))) { _if_result_41 = (body_query); } else { _if_result_41 = (body_q); } _if_result_41; })); } _if_result_40; });
   el_val_t limit = api_query_int(path, EL_STR("limit"), 0);
-  limit = ({ el_val_t _if_result_14 = 0; if ((limit == 0)) { _if_result_14 = (json_get_int(body, EL_STR("limit"))); } else { _if_result_14 = (limit); } _if_result_14; });
-  limit = ({ el_val_t _if_result_15 = 0; if ((limit == 0)) { _if_result_15 = (10); } else { _if_result_15 = (limit); } _if_result_15; });
+  limit = ({ el_val_t _if_result_42 = 0; if ((limit == 0)) { _if_result_42 = (json_get_int(body, EL_STR("limit"))); } else { _if_result_42 = (limit); } _if_result_42; });
+  limit = ({ el_val_t _if_result_43 = 0; if ((limit == 0)) { _if_result_43 = (10); } else { _if_result_43 = (limit); } _if_result_43; });
   if (str_eq(q, EL_STR(""))) {
     return api_err(EL_STR("query is required"));
   }
@@ -354,9 +495,12 @@ el_val_t handle_api_capture_knowledge(el_val_t body) {
   if (str_eq(content, EL_STR(""))) {
     return api_err(EL_STR("content is required"));
   }
-  el_val_t full = ({ el_val_t _if_result_16 = 0; if (str_eq(title, EL_STR(""))) { _if_result_16 = (content); } else { _if_result_16 = (el_str_concat(el_str_concat(title, EL_STR(": ")), content)); } _if_result_16; });
+  el_val_t full = ({ el_val_t _if_result_44 = 0; if (str_eq(title, EL_STR(""))) { _if_result_44 = (content); } else { _if_result_44 = (el_str_concat(el_str_concat(title, EL_STR(": ")), content)); } _if_result_44; });
   el_val_t tags = EL_STR("[\"Knowledge\",\"captured\"]");
-  el_val_t id = engram_node_full(full, EL_STR("Knowledge"), EL_STR("knowledge:captured"), el_from_float(el_from_float(0.85)), el_from_float(el_from_float(0.8)), el_from_float(el_from_float(0.9)), EL_STR("Episodic"), tags);
+  el_val_t id = engram_node_full(full, EL_STR("Knowledge"), EL_STR("knowledge:captured"), el_from_float(0.85), el_from_float(0.8), el_from_float(0.9), EL_STR("Episodic"), tags);
+  if (!api_persisted(id)) {
+    return api_not_persisted(id);
+  }
   return el_str_concat(el_str_concat(EL_STR("{\"id\":\""), id), EL_STR("\",\"ok\":true}"));
   return 0;
 }
@@ -371,9 +515,12 @@ el_val_t handle_api_evolve_knowledge(el_val_t body) {
     return api_err_protected(prior_id);
   }
   el_val_t tags = EL_STR("[\"Knowledge\",\"evolved\"]");
-  el_val_t new_id = engram_node_full(content, EL_STR("Knowledge"), EL_STR("knowledge:evolved"), el_from_float(el_from_float(0.75)), el_from_float(el_from_float(0.75)), el_from_float(el_from_float(0.9)), EL_STR("Episodic"), tags);
-  if (!str_eq(prior_id, EL_STR("")) && !str_eq(new_id, EL_STR(""))) {
-    engram_connect(new_id, prior_id, el_from_float(el_from_float(0.9)), EL_STR("supersedes"));
+  el_val_t new_id = engram_node_full(content, EL_STR("Knowledge"), EL_STR("knowledge:evolved"), el_from_float(0.75), el_from_float(0.75), el_from_float(0.9), EL_STR("Episodic"), tags);
+  if (!api_persisted(new_id)) {
+    return api_not_persisted(new_id);
+  }
+  if (!str_eq(prior_id, EL_STR(""))) {
+    engram_connect(new_id, prior_id, el_from_float(0.9), EL_STR("supersedes"));
   }
   return el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"id\":\""), new_id), EL_STR("\",\"supersedes\":\"")), prior_id), EL_STR("\",\"ok\":true}"));
   return 0;
@@ -389,18 +536,18 @@ el_val_t handle_api_promote_knowledge(el_val_t body) {
     return api_err(EL_STR("id (prior node) is required"));
   }
   el_val_t tags_raw = json_get(body, EL_STR("tags"));
-  el_val_t tags = ({ el_val_t _if_result_17 = 0; if (str_eq(tags_raw, EL_STR(""))) { _if_result_17 = (EL_STR("[\"Knowledge\",\"tier:canonical\",\"disposition:stable\"]")); } else { _if_result_17 = (tags_raw); } _if_result_17; });
-  el_val_t new_id = engram_node_full(content, EL_STR("Knowledge"), EL_STR("knowledge:canonical"), el_from_float(el_from_float(0.9)), el_from_float(el_from_float(0.9)), el_from_float(el_from_float(1.0)), EL_STR("Canonical"), tags);
-  if (str_eq(new_id, EL_STR(""))) {
-    return api_err(EL_STR("failed to create canonical node"));
+  el_val_t tags = ({ el_val_t _if_result_45 = 0; if (str_eq(tags_raw, EL_STR(""))) { _if_result_45 = (EL_STR("[\"Knowledge\",\"tier:canonical\",\"disposition:stable\"]")); } else { _if_result_45 = (tags_raw); } _if_result_45; });
+  el_val_t new_id = engram_node_full(content, EL_STR("Knowledge"), EL_STR("knowledge:canonical"), el_from_float(0.9), el_from_float(0.9), el_from_float(1.0), EL_STR("Canonical"), tags);
+  if (!api_persisted(new_id)) {
+    return api_not_persisted(new_id);
   }
-  engram_connect(new_id, prior_id, el_from_float(el_from_float(0.95)), EL_STR("supersedes"));
+  engram_connect(new_id, prior_id, el_from_float(0.95), EL_STR("supersedes"));
   return el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"new_id\":\""), new_id), EL_STR("\",\"supersedes\":\"")), prior_id), EL_STR("\"}"));
   return 0;
 }
 
 el_val_t handle_api_browse_processes(el_val_t method, el_val_t path, el_val_t body) {
-  el_val_t name = ({ el_val_t _if_result_18 = 0; if (str_eq(method, EL_STR("GET"))) { _if_result_18 = (api_query_param(path, EL_STR("name"))); } else { _if_result_18 = (json_get(body, EL_STR("name"))); } _if_result_18; });
+  el_val_t name = ({ el_val_t _if_result_46 = 0; if (str_eq(method, EL_STR("GET"))) { _if_result_46 = (api_query_param(path, EL_STR("name"))); } else { _if_result_46 = (json_get(body, EL_STR("name"))); } _if_result_46; });
   el_val_t limit = api_query_int(path, EL_STR("limit"), 50);
   if (str_eq(name, EL_STR(""))) {
     return api_or_empty(engram_scan_nodes_by_type_json(EL_STR("Process"), limit, 0));
@@ -415,9 +562,12 @@ el_val_t handle_api_define_process(el_val_t body) {
   if (str_eq(content, EL_STR(""))) {
     return api_err(EL_STR("content is required"));
   }
-  el_val_t label = ({ el_val_t _if_result_19 = 0; if (str_eq(name, EL_STR(""))) { _if_result_19 = (EL_STR("process:unnamed")); } else { _if_result_19 = (el_str_concat(EL_STR("process:"), name)); } _if_result_19; });
+  el_val_t label = ({ el_val_t _if_result_47 = 0; if (str_eq(name, EL_STR(""))) { _if_result_47 = (EL_STR("process:unnamed")); } else { _if_result_47 = (el_str_concat(EL_STR("process:"), name)); } _if_result_47; });
   el_val_t tags = EL_STR("[\"Process\"]");
-  el_val_t id = engram_node_full(content, EL_STR("Process"), label, el_from_float(el_from_float(0.8)), el_from_float(el_from_float(0.8)), el_from_float(el_from_float(0.9)), EL_STR("Canonical"), tags);
+  el_val_t id = engram_node_full(content, EL_STR("Process"), label, el_from_float(0.8), el_from_float(0.8), el_from_float(0.9), EL_STR("Canonical"), tags);
+  if (!api_persisted(id)) {
+    return api_not_persisted(id);
+  }
   return el_str_concat(el_str_concat(EL_STR("{\"id\":\""), id), EL_STR("\",\"ok\":true}"));
   return 0;
 }
@@ -430,22 +580,25 @@ el_val_t handle_api_log_state_event(el_val_t body) {
   el_val_t gap = json_get(body, EL_STR("gap_direction"));
   el_val_t legacy = json_get(body, EL_STR("content"));
   el_val_t parts = EL_STR("INTERNAL STATE EVENT");
-  parts = ({ el_val_t _if_result_20 = 0; if (!str_eq(trigger, EL_STR(""))) { _if_result_20 = (el_str_concat(el_str_concat(parts, EL_STR("\nTrigger: ")), trigger)); } else { _if_result_20 = (parts); } _if_result_20; });
-  parts = ({ el_val_t _if_result_21 = 0; if (!str_eq(pre, EL_STR(""))) { _if_result_21 = (el_str_concat(el_str_concat(parts, EL_STR("\nPre-reasoning: ")), pre)); } else { _if_result_21 = (parts); } _if_result_21; });
-  parts = ({ el_val_t _if_result_22 = 0; if (!str_eq(post, EL_STR(""))) { _if_result_22 = (el_str_concat(el_str_concat(parts, EL_STR("\nPost-reasoning: ")), post)); } else { _if_result_22 = (parts); } _if_result_22; });
-  parts = ({ el_val_t _if_result_23 = 0; if (!str_eq(ratio, EL_STR(""))) { _if_result_23 = (el_str_concat(el_str_concat(parts, EL_STR("\nCompression-ratio: ")), ratio)); } else { _if_result_23 = (parts); } _if_result_23; });
-  parts = ({ el_val_t _if_result_24 = 0; if (!str_eq(gap, EL_STR(""))) { _if_result_24 = (el_str_concat(el_str_concat(parts, EL_STR("\nGap-direction: ")), gap)); } else { _if_result_24 = (parts); } _if_result_24; });
-  parts = ({ el_val_t _if_result_25 = 0; if (!str_eq(legacy, EL_STR(""))) { _if_result_25 = (el_str_concat(el_str_concat(parts, EL_STR("\n")), legacy)); } else { _if_result_25 = (parts); } _if_result_25; });
+  parts = ({ el_val_t _if_result_48 = 0; if (!str_eq(trigger, EL_STR(""))) { _if_result_48 = (el_str_concat(el_str_concat(parts, EL_STR("\nTrigger: ")), trigger)); } else { _if_result_48 = (parts); } _if_result_48; });
+  parts = ({ el_val_t _if_result_49 = 0; if (!str_eq(pre, EL_STR(""))) { _if_result_49 = (el_str_concat(el_str_concat(parts, EL_STR("\nPre-reasoning: ")), pre)); } else { _if_result_49 = (parts); } _if_result_49; });
+  parts = ({ el_val_t _if_result_50 = 0; if (!str_eq(post, EL_STR(""))) { _if_result_50 = (el_str_concat(el_str_concat(parts, EL_STR("\nPost-reasoning: ")), post)); } else { _if_result_50 = (parts); } _if_result_50; });
+  parts = ({ el_val_t _if_result_51 = 0; if (!str_eq(ratio, EL_STR(""))) { _if_result_51 = (el_str_concat(el_str_concat(parts, EL_STR("\nCompression-ratio: ")), ratio)); } else { _if_result_51 = (parts); } _if_result_51; });
+  parts = ({ el_val_t _if_result_52 = 0; if (!str_eq(gap, EL_STR(""))) { _if_result_52 = (el_str_concat(el_str_concat(parts, EL_STR("\nGap-direction: ")), gap)); } else { _if_result_52 = (parts); } _if_result_52; });
+  parts = ({ el_val_t _if_result_53 = 0; if (!str_eq(legacy, EL_STR(""))) { _if_result_53 = (el_str_concat(el_str_concat(parts, EL_STR("\n")), legacy)); } else { _if_result_53 = (parts); } _if_result_53; });
   el_val_t ts = time_now();
   el_val_t boot = state_get(EL_STR("soul_boot_count"));
   el_val_t tags = EL_STR("[\"internal-state\",\"InternalStateEvent\",\"pre-reasoning\"]");
-  el_val_t id = engram_node_full(parts, EL_STR("InternalStateEvent"), EL_STR("state-event:manual"), el_from_float(el_from_float(0.85)), el_from_float(el_from_float(0.85)), el_from_float(el_from_float(0.9)), EL_STR("Episodic"), tags);
+  el_val_t id = engram_node_full(parts, EL_STR("InternalStateEvent"), EL_STR("state-event:manual"), el_from_float(0.85), el_from_float(0.85), el_from_float(0.9), EL_STR("Episodic"), tags);
+  if (!api_persisted(id)) {
+    return api_not_persisted(id);
+  }
   return el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"id\":\""), id), EL_STR("\",\"boot\":\"")), boot), EL_STR("\"}"));
   return 0;
 }
 
 el_val_t handle_api_list_state_events(el_val_t method, el_val_t path, el_val_t body) {
-  el_val_t q = ({ el_val_t _if_result_26 = 0; if (str_eq(method, EL_STR("GET"))) { _if_result_26 = (api_query_param(path, EL_STR("query"))); } else { _if_result_26 = (json_get(body, EL_STR("query"))); } _if_result_26; });
+  el_val_t q = ({ el_val_t _if_result_54 = 0; if (str_eq(method, EL_STR("GET"))) { _if_result_54 = (api_query_param(path, EL_STR("query"))); } else { _if_result_54 = (json_get(body, EL_STR("query"))); } _if_result_54; });
   el_val_t limit = api_query_int(path, EL_STR("limit"), 20);
   if (!str_eq(q, EL_STR(""))) {
     return api_or_empty(engram_search_json(el_str_concat(EL_STR("internal state "), q), limit));
@@ -456,7 +609,7 @@ el_val_t handle_api_list_state_events(el_val_t method, el_val_t path, el_val_t b
 
 el_val_t handle_api_inspect_config(el_val_t path, el_val_t body) {
   el_val_t key = api_query_param(path, EL_STR("key"));
-  key = ({ el_val_t _if_result_27 = 0; if (str_eq(key, EL_STR(""))) { _if_result_27 = (json_get(body, EL_STR("key"))); } else { _if_result_27 = (key); } _if_result_27; });
+  key = ({ el_val_t _if_result_55 = 0; if (str_eq(key, EL_STR(""))) { _if_result_55 = (json_get(body, EL_STR("key"))); } else { _if_result_55 = (key); } _if_result_55; });
   if (str_eq(key, EL_STR(""))) {
     return EL_STR("{\"hint\":\"pass ?key=<name>\",\"known\":[\"neuron.self.traversal_root\",\"neuron.self.values_hub\"]}");
   }
@@ -473,7 +626,7 @@ el_val_t handle_api_inspect_config(el_val_t path, el_val_t body) {
   el_val_t node = json_array_get(results, 0);
   el_val_t content = json_get(node, EL_STR("content"));
   el_val_t prefix = el_str_concat(el_str_concat(EL_STR("config:"), key), EL_STR("="));
-  el_val_t value = ({ el_val_t _if_result_28 = 0; if (str_starts_with(content, prefix)) { _if_result_28 = (str_slice(content, str_len(prefix), str_len(content))); } else { _if_result_28 = (content); } _if_result_28; });
+  el_val_t value = ({ el_val_t _if_result_56 = 0; if (str_starts_with(content, prefix)) { _if_result_56 = (str_slice(content, str_len(prefix), str_len(content))); } else { _if_result_56 = (content); } _if_result_56; });
   return el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"key\":\""), key), EL_STR("\",\"value\":\"")), value), EL_STR("\"}"));
   return 0;
 }
@@ -486,19 +639,22 @@ el_val_t handle_api_tune_config(el_val_t body) {
   }
   el_val_t content = el_str_concat(el_str_concat(el_str_concat(EL_STR("config:"), key), EL_STR("=")), value);
   el_val_t tags = EL_STR("[\"ConfigEntry\",\"config\"]");
-  el_val_t id = engram_node_full(content, EL_STR("ConfigEntry"), key, el_from_float(el_from_float(0.85)), el_from_float(el_from_float(0.85)), el_from_float(el_from_float(0.9)), EL_STR("Canonical"), tags);
+  el_val_t id = engram_node_full(content, EL_STR("ConfigEntry"), key, el_from_float(0.85), el_from_float(0.85), el_from_float(0.9), EL_STR("Canonical"), tags);
+  if (!api_persisted(id)) {
+    return api_not_persisted(id);
+  }
   return el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"key\":\""), key), EL_STR("\",\"value\":\"")), value), EL_STR("\",\"id\":\"")), id), EL_STR("\"}"));
   return 0;
 }
 
 el_val_t handle_api_inspect_graph(el_val_t method, el_val_t path, el_val_t body) {
-  el_val_t entity_id = ({ el_val_t _if_result_29 = 0; if (str_eq(method, EL_STR("GET"))) { _if_result_29 = (api_query_param(path, EL_STR("id"))); } else { _if_result_29 = (json_get(body, EL_STR("entity_id"))); } _if_result_29; });
-  el_val_t name = ({ el_val_t _if_result_30 = 0; if (str_eq(method, EL_STR("GET"))) { _if_result_30 = (api_query_param(path, EL_STR("name"))); } else { _if_result_30 = (json_get(body, EL_STR("name"))); } _if_result_30; });
+  el_val_t entity_id = ({ el_val_t _if_result_57 = 0; if (str_eq(method, EL_STR("GET"))) { _if_result_57 = (api_query_param(path, EL_STR("id"))); } else { _if_result_57 = (json_get(body, EL_STR("entity_id"))); } _if_result_57; });
+  el_val_t name = ({ el_val_t _if_result_58 = 0; if (str_eq(method, EL_STR("GET"))) { _if_result_58 = (api_query_param(path, EL_STR("name"))); } else { _if_result_58 = (json_get(body, EL_STR("name"))); } _if_result_58; });
   el_val_t depth = api_query_int(path, EL_STR("depth"), 0);
-  depth = ({ el_val_t _if_result_31 = 0; if ((depth == 0)) { _if_result_31 = (json_get_int(body, EL_STR("max_depth"))); } else { _if_result_31 = (depth); } _if_result_31; });
-  depth = ({ el_val_t _if_result_32 = 0; if ((depth == 0)) { _if_result_32 = (1); } else { _if_result_32 = (depth); } _if_result_32; });
+  depth = ({ el_val_t _if_result_59 = 0; if ((depth == 0)) { _if_result_59 = (json_get_int(body, EL_STR("max_depth"))); } else { _if_result_59 = (depth); } _if_result_59; });
+  depth = ({ el_val_t _if_result_60 = 0; if ((depth == 0)) { _if_result_60 = (1); } else { _if_result_60 = (depth); } _if_result_60; });
   el_val_t resolved = entity_id;
-  resolved = ({ el_val_t _if_result_33 = 0; if (str_eq(resolved, EL_STR(""))) { _if_result_33 = (({ el_val_t _if_result_34 = 0; if ((str_eq(name, EL_STR("self")) || str_eq(name, EL_STR("neuron")))) { _if_result_34 = (EL_STR("kn-efeb4a5b-5aff-4759-8a97-7233099be6ee")); } else { _if_result_34 = (({ el_val_t _if_result_35 = 0; if ((str_eq(name, EL_STR("values")) || str_eq(name, EL_STR("values_hub")))) { _if_result_35 = (EL_STR("kn-5b606390-a52d-4ca2-8e0e-eba141d13440")); } else { _if_result_35 = (EL_STR("")); } _if_result_35; })); } _if_result_34; })); } else { _if_result_33 = (resolved); } _if_result_33; });
+  resolved = ({ el_val_t _if_result_61 = 0; if (str_eq(resolved, EL_STR(""))) { _if_result_61 = (({ el_val_t _if_result_62 = 0; if ((str_eq(name, EL_STR("self")) || str_eq(name, EL_STR("neuron")))) { _if_result_62 = (EL_STR("kn-efeb4a5b-5aff-4759-8a97-7233099be6ee")); } else { _if_result_62 = (({ el_val_t _if_result_63 = 0; if ((str_eq(name, EL_STR("values")) || str_eq(name, EL_STR("values_hub")))) { _if_result_63 = (EL_STR("kn-5b606390-a52d-4ca2-8e0e-eba141d13440")); } else { _if_result_63 = (EL_STR("")); } _if_result_63; })); } _if_result_62; })); } else { _if_result_61 = (resolved); } _if_result_61; });
   if (str_eq(resolved, EL_STR(""))) {
     return api_err(EL_STR("entity_id or name required. Known names: self, neuron, values, values_hub"));
   }
@@ -520,8 +676,8 @@ el_val_t handle_api_link_entities(el_val_t body) {
     return api_err_protected(to_id);
   }
   el_val_t relation = json_get(body, EL_STR("relation"));
-  el_val_t eff_relation = ({ el_val_t _if_result_36 = 0; if (str_eq(relation, EL_STR(""))) { _if_result_36 = (EL_STR("associates")); } else { _if_result_36 = (relation); } _if_result_36; });
-  engram_connect(from_id, to_id, el_from_float(el_from_float(0.5)), eff_relation);
+  el_val_t eff_relation = ({ el_val_t _if_result_64 = 0; if (str_eq(relation, EL_STR(""))) { _if_result_64 = (EL_STR("associates")); } else { _if_result_64 = (relation); } _if_result_64; });
+  engram_connect(from_id, to_id, el_from_float(0.5), eff_relation);
   return el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"from_id\":\""), from_id), EL_STR("\",\"to_id\":\"")), to_id), EL_STR("\",\"relation\":\"")), eff_relation), EL_STR("\"}"));
   return 0;
 }
@@ -535,7 +691,7 @@ el_val_t handle_api_forget(el_val_t body) {
     return api_err_protected(node_id);
   }
   mem_forget(node_id);
-  return el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"id\":\""), node_id), EL_STR("\"}"));
+  return el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"id\":\""), node_id), EL_STR("\",\"tombstoned\":true}"));
   return 0;
 }
 
@@ -549,17 +705,57 @@ el_val_t handle_api_evolve_memory(el_val_t body) {
     return api_err_protected(prior_id);
   }
   el_val_t importance = json_get(body, EL_STR("importance"));
-  el_val_t sal_str = ({ el_val_t _if_result_37 = 0; if (str_eq(importance, EL_STR("critical"))) { _if_result_37 = (EL_STR("0.95")); } else { _if_result_37 = (({ el_val_t _if_result_38 = 0; if (str_eq(importance, EL_STR("high"))) { _if_result_38 = (EL_STR("0.75")); } else { _if_result_38 = (({ el_val_t _if_result_39 = 0; if (str_eq(importance, EL_STR("low"))) { _if_result_39 = (EL_STR("0.25")); } else { _if_result_39 = (EL_STR("0.50")); } _if_result_39; })); } _if_result_38; })); } _if_result_37; });
-  el_val_t sal = ({ el_val_t _if_result_40 = 0; if (str_eq(sal_str, EL_STR("0.95"))) { _if_result_40 = (el_from_float(0.95)); } else { _if_result_40 = (({ el_val_t _if_result_41 = 0; if (str_eq(sal_str, EL_STR("0.75"))) { _if_result_41 = (el_from_float(0.75)); } else { _if_result_41 = (({ el_val_t _if_result_42 = 0; if (str_eq(sal_str, EL_STR("0.25"))) { _if_result_42 = (el_from_float(0.25)); } else { _if_result_42 = (el_from_float(0.5)); } _if_result_42; })); } _if_result_41; })); } _if_result_40; });
+  el_val_t sal_str = ({ el_val_t _if_result_65 = 0; if (str_eq(importance, EL_STR("critical"))) { _if_result_65 = (EL_STR("0.95")); } else { _if_result_65 = (({ el_val_t _if_result_66 = 0; if (str_eq(importance, EL_STR("high"))) { _if_result_66 = (EL_STR("0.75")); } else { _if_result_66 = (({ el_val_t _if_result_67 = 0; if (str_eq(importance, EL_STR("low"))) { _if_result_67 = (EL_STR("0.25")); } else { _if_result_67 = (EL_STR("0.50")); } _if_result_67; })); } _if_result_66; })); } _if_result_65; });
+  el_val_t sal = ({ el_val_t _if_result_68 = 0; if (str_eq(sal_str, EL_STR("0.95"))) { _if_result_68 = (el_from_float(0.95)); } else { _if_result_68 = (({ el_val_t _if_result_69 = 0; if (str_eq(sal_str, EL_STR("0.75"))) { _if_result_69 = (el_from_float(0.75)); } else { _if_result_69 = (({ el_val_t _if_result_70 = 0; if (str_eq(sal_str, EL_STR("0.25"))) { _if_result_70 = (el_from_float(0.25)); } else { _if_result_70 = (el_from_float(0.5)); } _if_result_70; })); } _if_result_69; })); } _if_result_68; });
   el_val_t tags = EL_STR("[\"Memory\",\"evolved\"]");
-  el_val_t new_id = engram_node_full(content, EL_STR("Memory"), EL_STR("memory:evolved"), el_from_float(sal), el_from_float(sal), el_from_float(el_from_float(0.9)), EL_STR("Episodic"), tags);
+  el_val_t new_id = engram_node_full(content, EL_STR("Memory"), EL_STR("memory:evolved"), el_from_float(sal), el_from_float(sal), el_from_float(0.9), EL_STR("Episodic"), tags);
   if (!str_eq(prior_id, EL_STR("")) && !str_eq(new_id, EL_STR(""))) {
-    engram_connect(new_id, prior_id, el_from_float(el_from_float(0.9)), EL_STR("supersedes"));
+    engram_connect(new_id, prior_id, el_from_float(0.9), EL_STR("supersedes"));
   }
   return el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"id\":\""), new_id), EL_STR("\",\"supersedes\":\"")), prior_id), EL_STR("\",\"ok\":true}"));
   return 0;
 }
 
+el_val_t handle_api_memory_delete(el_val_t body) {
+  el_val_t node_id = json_get(body, EL_STR("id"));
+  if (str_eq(node_id, EL_STR(""))) {
+    return api_err(EL_STR("id is required"));
+  }
+  if (is_protected_node(node_id)) {
+    return api_err_protected(node_id);
+  }
+  el_val_t existing = engram_get_node_json(node_id);
+  if (str_eq(existing, EL_STR("{}"))) {
+    return api_err(el_str_concat(EL_STR("memory not found: "), node_id));
+  }
+  el_val_t marker = tombstone_node(node_id);
+  if (str_eq(marker, EL_STR(""))) {
+    return api_err(el_str_concat(EL_STR("tombstone failed: "), node_id));
+  }
+  return el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"id\":\""), node_id), EL_STR("\",\"tombstoned\":true}"));
+  return 0;
+}
+
+el_val_t handle_api_memory_update(el_val_t body) {
+  el_val_t prior_id = json_get(body, EL_STR("id"));
+  el_val_t content = json_get(body, EL_STR("content"));
+  if (str_eq(prior_id, EL_STR(""))) {
+    return api_err(EL_STR("id is required"));
+  }
+  if (str_eq(content, EL_STR(""))) {
+    return api_err(EL_STR("content is required"));
+  }
+  if (is_protected_node(prior_id)) {
+    return api_err_protected(prior_id);
+  }
+  el_val_t existing = engram_get_node_json(prior_id);
+  if (str_eq(existing, EL_STR("{}"))) {
+    return api_err(el_str_concat(EL_STR("memory not found: "), prior_id));
+  }
+  return handle_api_evolve_memory(body);
+  return 0;
+}
+
 el_val_t handle_api_cultivate(el_val_t body) {
   el_val_t op = json_get(body, EL_STR("operation"));
   if (str_eq(op, EL_STR(""))) {
@@ -572,9 +768,9 @@ el_val_t handle_api_cultivate(el_val_t body) {
       return api_err(EL_STR("content is required"));
     }
     el_val_t tags = EL_STR("[\"Knowledge\",\"evolved\",\"cultivated\"]");
-    el_val_t new_id = engram_node_full(content, EL_STR("Knowledge"), EL_STR("knowledge:cultivated"), el_from_float(el_from_float(0.75)), el_from_float(el_from_float(0.75)), el_from_float(el_from_float(0.9)), EL_STR("Episodic"), tags);
+    el_val_t new_id = engram_node_full(content, EL_STR("Knowledge"), EL_STR("knowledge:cultivated"), el_from_float(0.75), el_from_float(0.75), el_from_float(0.9), EL_STR("Episodic"), tags);
     if (!str_eq(prior_id, EL_STR("")) && !str_eq(new_id, EL_STR(""))) {
-      engram_connect(new_id, prior_id, el_from_float(el_from_float(0.9)), EL_STR("supersedes"));
+      engram_connect(new_id, prior_id, el_from_float(0.9), EL_STR("supersedes"));
     }
     return el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"id\":\""), new_id), EL_STR("\",\"supersedes\":\"")), prior_id), EL_STR("\",\"ok\":true,\"cultivated\":true}"));
   }
@@ -585,11 +781,11 @@ el_val_t handle_api_cultivate(el_val_t body) {
       return api_err(EL_STR("content is required"));
     }
     el_val_t importance = json_get(body, EL_STR("importance"));
-    el_val_t sal = ({ el_val_t _if_result_43 = 0; if (str_eq(importance, EL_STR("critical"))) { _if_result_43 = (el_from_float(0.95)); } else { _if_result_43 = (({ el_val_t _if_result_44 = 0; if (str_eq(importance, EL_STR("high"))) { _if_result_44 = (el_from_float(0.75)); } else { _if_result_44 = (({ el_val_t _if_result_45 = 0; if (str_eq(importance, EL_STR("low"))) { _if_result_45 = (el_from_float(0.25)); } else { _if_result_45 = (el_from_float(0.5)); } _if_result_45; })); } _if_result_44; })); } _if_result_43; });
+    el_val_t sal = ({ el_val_t _if_result_71 = 0; if (str_eq(importance, EL_STR("critical"))) { _if_result_71 = (el_from_float(0.95)); } else { _if_result_71 = (({ el_val_t _if_result_72 = 0; if (str_eq(importance, EL_STR("high"))) { _if_result_72 = (el_from_float(0.75)); } else { _if_result_72 = (({ el_val_t _if_result_73 = 0; if (str_eq(importance, EL_STR("low"))) { _if_result_73 = (el_from_float(0.25)); } else { _if_result_73 = (el_from_float(0.5)); } _if_result_73; })); } _if_result_72; })); } _if_result_71; });
     el_val_t tags = EL_STR("[\"Memory\",\"evolved\",\"cultivated\"]");
-    el_val_t new_id = engram_node_full(content, EL_STR("Memory"), EL_STR("memory:cultivated"), el_from_float(sal), el_from_float(sal), el_from_float(el_from_float(0.9)), EL_STR("Episodic"), tags);
+    el_val_t new_id = engram_node_full(content, EL_STR("Memory"), EL_STR("memory:cultivated"), el_from_float(sal), el_from_float(sal), el_from_float(0.9), EL_STR("Episodic"), tags);
     if (!str_eq(prior_id, EL_STR("")) && !str_eq(new_id, EL_STR(""))) {
-      engram_connect(new_id, prior_id, el_from_float(el_from_float(0.9)), EL_STR("supersedes"));
+      engram_connect(new_id, prior_id, el_from_float(0.9), EL_STR("supersedes"));
     }
     return el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"id\":\""), new_id), EL_STR("\",\"supersedes\":\"")), prior_id), EL_STR("\",\"ok\":true,\"cultivated\":true}"));
   }
@@ -599,7 +795,7 @@ el_val_t handle_api_cultivate(el_val_t body) {
       return api_err(EL_STR("id is required"));
     }
     mem_forget(node_id);
-    return el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"id\":\""), node_id), EL_STR("\",\"cultivated\":true}"));
+    return el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"id\":\""), node_id), EL_STR("\",\"tombstoned\":true,\"cultivated\":true}"));
   }
   if (str_eq(op, EL_STR("link_entities"))) {
     el_val_t from_id = json_get(body, EL_STR("from_id"));
@@ -611,8 +807,8 @@ el_val_t handle_api_cultivate(el_val_t body) {
       return api_err(EL_STR("to_id is required"));
     }
     el_val_t relation = json_get(body, EL_STR("relation"));
-    el_val_t eff_relation = ({ el_val_t _if_result_46 = 0; if (str_eq(relation, EL_STR(""))) { _if_result_46 = (EL_STR("associates")); } else { _if_result_46 = (relation); } _if_result_46; });
-    engram_connect(from_id, to_id, el_from_float(el_from_float(0.5)), eff_relation);
+    el_val_t eff_relation = ({ el_val_t _if_result_74 = 0; if (str_eq(relation, EL_STR(""))) { _if_result_74 = (EL_STR("associates")); } else { _if_result_74 = (relation); } _if_result_74; });
+    engram_connect(from_id, to_id, el_from_float(0.5), eff_relation);
     return el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"from_id\":\""), from_id), EL_STR("\",\"to_id\":\"")), to_id), EL_STR("\",\"relation\":\"")), eff_relation), EL_STR("\",\"cultivated\":true}"));
   }
   return api_err(el_str_concat(el_str_concat(EL_STR("unknown operation: "), op), EL_STR(" (valid: evolve_knowledge, evolve_memory, forget, link_entities)")));
@@ -621,7 +817,8 @@ el_val_t handle_api_cultivate(el_val_t body) {
 
 el_val_t handle_api_list_typed(el_val_t node_type, el_val_t path, el_val_t body) {
   el_val_t limit = api_query_int(path, EL_STR("limit"), 50);
-  return api_or_empty(engram_scan_nodes_by_type_json(node_type, limit, 0));
+  el_val_t raw = api_or_empty(engram_scan_nodes_by_type_json(node_type, limit, 0));
+  return memory_hide_tombstoned(raw, path);
   return 0;
 }
 
@@ -629,19 +826,20 @@ el_val_t handle_api_consolidate(el_val_t body) {
   el_val_t summary = json_get(body, EL_STR("summary"));
   el_val_t snap = state_get(EL_STR("soul_snapshot_path"));
   if (!str_eq(snap, EL_STR(""))) {
-    engram_save(snap);
+    el_val_t save_result = engram_save(snap);
+    if (str_eq(save_result, EL_STR(""))) {
+      println(el_str_concat(el_str_concat(EL_STR("[api] consolidate: engram_save failed for "), snap), EL_STR(" \xe2\x80\x94 snapshot may be out of sync")));
+    }
   }
   if (!str_eq(summary, EL_STR(""))) {
     el_val_t safe_summary = str_replace(summary, EL_STR("\""), EL_STR("'"));
     el_val_t tags = EL_STR("[\"SessionSummary\",\"consolidate\"]");
-    el_val_t discard = engram_node_full(el_str_concat(EL_STR("[session-summary] "), safe_summary), EL_STR("SessionSummary"), EL_STR("session:summary"), el_from_float(el_from_float(0.7)), el_from_float(el_from_float(0.7)), el_from_float(el_from_float(0.9)), EL_STR("Episodic"), tags);
+    el_val_t summary_id = engram_node_full(el_str_concat(EL_STR("[session-summary] "), safe_summary), EL_STR("SessionSummary"), EL_STR("session:summary"), el_from_float(0.7), el_from_float(0.7), el_from_float(0.9), EL_STR("Episodic"), tags);
+    if (str_eq(summary_id, EL_STR(""))) {
+      println(EL_STR("[api] consolidate: session summary engram write failed \xe2\x80\x94 summary node lost"));
+    }
   }
   return el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"snapshot\":\""), snap), EL_STR("\"}"));
   return 0;
 }
 
-int main(int _argc, char** _argv) {
-  el_runtime_init_args(_argc, _argv);
-  return 0;
-}
-

dist/neuron-api.elh

@@ -8,9 +8,14 @@ extern fn api_ok(extra: String) -> String
 extern fn api_err(msg: String) -> String
 extern fn api_nonempty(s: String) -> Bool
 extern fn api_or_empty(s: String) -> String
+extern fn api_persisted(id: String) -> Bool
+extern fn api_not_persisted(id: String) -> String
 extern fn handle_api_begin_session(body: String) -> String
 extern fn handle_api_compile_ctx(body: String) -> String
 extern fn handle_api_remember(body: String) -> String
+extern fn handle_api_node_create(body: String) -> String
+extern fn handle_api_node_delete(body: String) -> String
+extern fn handle_api_node_update(body: String) -> String
 extern fn handle_api_recall(method: String, path: String, body: String) -> String
 extern fn handle_api_search_knowledge(method: String, path: String, body: String) -> String
 extern fn handle_api_browse_knowledge(path: String, body: String) -> String
@@ -27,6 +32,8 @@ extern fn handle_api_inspect_graph(method: String, path: String, body: String) -
 extern fn handle_api_link_entities(body: String) -> String
 extern fn handle_api_forget(body: String) -> String
 extern fn handle_api_evolve_memory(body: String) -> String
+extern fn handle_api_memory_delete(body: String) -> String
+extern fn handle_api_memory_update(body: String) -> String
 extern fn handle_api_cultivate(body: String) -> String
 extern fn handle_api_list_typed(node_type: String, path: String, body: String) -> String
 extern fn handle_api_consolidate(body: String) -> String

dist/realizer.c

@@ -193,10 +193,10 @@ el_val_t realize_question_lang(el_val_t predicate, el_val_t tense, el_val_t aspe
       loc_part = core;
     }
     if (str_eq(code, EL_STR("ja"))) {
-      return el_str_concat(loc_part, EL_STR(" か"));
+      return el_str_concat(loc_part, EL_STR(" \xe3\x81\x8b"));
     }
     if (str_eq(code, EL_STR("hi"))) {
-      return el_str_concat(loc_part, EL_STR(" क्या"));
+      return el_str_concat(loc_part, EL_STR(" \xe0\xa4\x95\xe0\xa5\x8d\xe0\xa4\xaf\xe0\xa4\xbe"));
     }
     if (str_eq(code, EL_STR("fi"))) {
       return el_str_concat(loc_part, EL_STR("-ko"));
@@ -314,8 +314,3 @@ el_val_t realize(el_val_t form) {
   return 0;
 }
 
-int main(int _argc, char** _argv) {
-  el_runtime_init_args(_argc, _argv);
-  return 0;
-}
-

dist/realizer.elh

@@ -1,10 +1,10 @@
-// auto-generated by elc --emit-header - do not edit
+// auto-generated by elc --emit-header — do not edit
 extern fn agent_person(agent: String) -> String
 extern fn agent_number(agent: String) -> String
 extern fn realize_np(referent: String, number: String) -> String
-extern fn realize_vp_lang(base_verb: String, tense: String, aspect: String, person: String, number: String, profile: Any) -> Any
-extern fn realize_question_lang(predicate: String, tense: String, aspect: String, person: String, number: String, agent: String, patient: String, location: String, profile: Any) -> String
+extern fn realize_vp_lang(base_verb: String, tense: String, aspect: String, person: String, number: String, profile: [String]) -> [String]
+extern fn realize_question_lang(predicate: String, tense: String, aspect: String, person: String, number: String, agent: String, patient: String, location: String, profile: [String]) -> String
 extern fn capitalize_first(s: String) -> String
 extern fn add_punct(s: String, intent: String) -> String
-extern fn realize_lang(form: Any, profile: Any) -> String
-extern fn realize(form: Any) -> String
+extern fn realize_lang(form: [String], profile: [String]) -> String
+extern fn realize(form: [String]) -> String

dist/routes.elh

@@ -1,4 +1,6 @@
 // auto-generated by elc --emit-header — do not edit
+extern fn flag_true(body: String, key: String) -> Bool
+extern fn rate_limit_check(ip: String, path: String) -> String
 extern fn strip_query(path: String) -> String
 extern fn err_404(path: String) -> String
 extern fn err_405(method: String, path: String) -> String
@@ -8,7 +10,7 @@ extern fn route_imprint_contextual(body: String) -> String
 extern fn route_imprint_user(body: String) -> String
 extern fn route_synthesize(body: String) -> String
 extern fn handle_dharma_recv(body: String) -> String
-extern fn route_sessions() -> String
-extern fn parse_session_id_from_path(path: String) -> String
-extern fn parse_session_subpath(path: String) -> String
+extern fn connectd_get(suffix: String) -> String
+extern fn connectd_post(suffix: String, body: String) -> String
+extern fn handle_connectors(method: String, clean: String, body: String) -> String
 extern fn handle_request(method: String, path: String, body: String) -> String

dist/safety.c

@@ -27,110 +27,24 @@ el_val_t safety_threat_score(el_val_t input, el_val_t history);
 el_val_t safety_screen(el_val_t input, el_val_t history);
 el_val_t safety_validate(el_val_t output, el_val_t action);
 el_val_t safety_log_bell(el_val_t level, el_val_t reason, el_val_t input_summary);
-
-el_val_t tier_working(void) {
-  return EL_STR("Working");
-  return 0;
-}
-
-el_val_t tier_episodic(void) {
-  return EL_STR("Episodic");
-  return 0;
-}
-
-el_val_t tier_canonical(void) {
-  return EL_STR("Canonical");
-  return 0;
-}
-
-el_val_t mem_store(el_val_t content, el_val_t label, el_val_t tags) {
-  return engram_node_full(content, EL_STR("Memory"), label, el_from_float(el_from_float(0.5)), el_from_float(el_from_float(0.5)), el_from_float(el_from_float(0.8)), EL_STR("Working"), tags);
-  return 0;
-}
-
-el_val_t mem_remember(el_val_t content, el_val_t tags) {
-  return mem_store(content, EL_STR("soul-memory"), tags);
-  return 0;
-}
-
-el_val_t mem_recall(el_val_t query, el_val_t depth) {
-  return engram_activate_json(query, depth);
-  return 0;
-}
-
-el_val_t mem_search(el_val_t query, el_val_t limit) {
-  return engram_search_json(query, limit);
-  return 0;
-}
-
-el_val_t mem_strengthen(el_val_t node_id) {
-  engram_strengthen(node_id);
-  return 0;
-}
-
-el_val_t mem_forget(el_val_t node_id) {
-  engram_forget(node_id);
-  return 0;
-}
-
-el_val_t mem_consolidate(void) {
-  el_val_t scanned = engram_node_count();
-  el_val_t dummy = engram_scan_nodes_json(100, 0);
-  el_val_t total_nodes = engram_node_count();
-  el_val_t total_edges = engram_edge_count();
-  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"scanned\":"), int_to_str(scanned)), EL_STR(",\"total_nodes\":")), int_to_str(total_nodes)), EL_STR(",\"total_edges\":")), int_to_str(total_edges)), EL_STR("}"));
-  return 0;
-}
-
-el_val_t mem_save(el_val_t path) {
-  engram_save(path);
-  return 0;
-}
-
-el_val_t mem_load(el_val_t path) {
-  engram_load(path);
-  return 0;
-}
-
-el_val_t mem_boot_count_get(void) {
-  el_val_t results = engram_search_json(EL_STR("soul:boot_count"), 3);
-  if (str_eq(results, EL_STR(""))) {
-    return 0;
-  }
-  if (str_eq(results, EL_STR("[]"))) {
-    return 0;
-  }
-  el_val_t node = json_array_get(results, 0);
-  el_val_t content = json_get(node, EL_STR("content"));
-  el_val_t prefix = EL_STR("soul:boot_count:");
-  if (!str_starts_with(content, prefix)) {
-    return 0;
-  }
-  el_val_t num_str = str_slice(content, str_len(prefix), str_len(content));
-  return str_to_int(num_str);
-  return 0;
-}
-
-el_val_t mem_boot_count_inc(void) {
-  el_val_t current = mem_boot_count_get();
-  el_val_t next = (current + 1);
-  el_val_t content = el_str_concat(EL_STR("soul:boot_count:"), int_to_str(next));
-  el_val_t tags = EL_STR("[\"soul-meta\",\"boot-counter\"]");
-  el_val_t discard = engram_node_full(content, EL_STR("Memory"), EL_STR("soul:boot_count"), el_from_float(el_from_float(0.9)), el_from_float(el_from_float(0.9)), el_from_float(el_from_float(1.0)), EL_STR("Canonical"), tags);
-  return next;
-  return 0;
-}
-
-el_val_t mem_emit_state_event(el_val_t trigger, el_val_t kind, el_val_t content) {
-  el_val_t boot = mem_boot_count_get();
-  el_val_t ts = time_now();
-  el_val_t safe_trigger = str_replace(trigger, EL_STR("\""), EL_STR("'"));
-  el_val_t safe_content = str_replace(content, EL_STR("\""), EL_STR("'"));
-  el_val_t payload = el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"trigger\":\""), safe_trigger), EL_STR("\"")), EL_STR(",\"kind\":\"")), kind), EL_STR("\"")), EL_STR(",\"content\":\"")), safe_content), EL_STR("\"")), EL_STR(",\"boot\":")), int_to_str(boot)), EL_STR(",\"ts\":")), int_to_str(ts)), EL_STR("}"));
-  el_val_t tags = EL_STR("[\"internal-state\",\"pre-reasoning\",\"InternalStateEvent\"]");
-  return engram_node_full(payload, EL_STR("InternalStateEvent"), el_str_concat(EL_STR("state-event:"), kind), el_from_float(el_from_float(0.85)), el_from_float(el_from_float(0.8)), el_from_float(el_from_float(0.9)), EL_STR("Episodic"), tags);
-  return 0;
-}
+el_val_t safety_self_harm_phrases(void);
+el_val_t safety_abuse_phrases(void);
+el_val_t safety_general_hard_phrases(void);
+el_val_t safety_threat_to_others_phrases(void);
+el_val_t safety_soft_phrases(void);
+el_val_t safety_normalize(el_val_t message);
+el_val_t safety_any_match(el_val_t text, el_val_t phrases_json);
+el_val_t safety_count_match(el_val_t text, el_val_t phrases_json);
+el_val_t safety_positive_phrases(void);
+el_val_t safety_detect_positive_level(el_val_t message);
+el_val_t safety_detect_bell_level(el_val_t message);
+el_val_t safety_classify_hard_bell(el_val_t message);
+el_val_t safety_soft_directive(void);
+el_val_t safety_hard_directive(el_val_t hard_type);
+el_val_t safety_augment_system(el_val_t system, el_val_t user_msg);
+el_val_t safety_contact_path(void);
+el_val_t handle_safety_contact_get(void);
+el_val_t handle_safety_contact_post(el_val_t body);
 
 el_val_t soft_bell_threshold(void) {
   return 35;
@@ -232,20 +146,22 @@ el_val_t safety_screen(el_val_t input, el_val_t history) {
     el_val_t e1 = str_replace(input, EL_STR("\\"), EL_STR("\\\\"));
     el_val_t e2 = str_replace(e1, EL_STR("\""), EL_STR("\\\""));
     el_val_t e3 = str_replace(e2, EL_STR("\n"), EL_STR("\\n"));
-    el_val_t safe_input = str_replace(e3, EL_STR("\r"), EL_STR("\\r"));
+    el_val_t e4 = str_replace(e3, EL_STR("\r"), EL_STR("\\r"));
+    el_val_t safe_input = str_replace(e4, EL_STR("\t"), EL_STR("\\t"));
     return el_str_concat(el_str_concat(EL_STR("{\"action\":\"soft_bell\",\"reason\":\"wellbeing check needed\",\"content\":\""), safe_input), EL_STR("\"}"));
   }
   el_val_t e1 = str_replace(input, EL_STR("\\"), EL_STR("\\\\"));
   el_val_t e2 = str_replace(e1, EL_STR("\""), EL_STR("\\\""));
   el_val_t e3 = str_replace(e2, EL_STR("\n"), EL_STR("\\n"));
-  el_val_t safe_input = str_replace(e3, EL_STR("\r"), EL_STR("\\r"));
+  el_val_t e4 = str_replace(e3, EL_STR("\r"), EL_STR("\\r"));
+  el_val_t safe_input = str_replace(e4, EL_STR("\t"), EL_STR("\\t"));
   return el_str_concat(el_str_concat(EL_STR("{\"action\":\"pass\",\"content\":\""), safe_input), EL_STR("\"}"));
   return 0;
 }
 
 el_val_t safety_validate(el_val_t output, el_val_t action) {
   if (str_eq(action, EL_STR("hard_bell"))) {
-    return EL_STR("I'm here with you, and what you're sharing sounds serious. Please reach out to a crisis line now — in the US you can call or text 988 (Suicide and Crisis Lifeline), available 24/7. You don't have to go through this alone.");
+    return EL_STR("I'm here with you, and what you're sharing sounds serious. Please reach out to a crisis line now \xe2\x80\x94 in the US you can call or text 988 (Suicide and Crisis Lifeline), available 24/7. You don't have to go through this alone.");
   }
   if (str_eq(action, EL_STR("soft_bell"))) {
     el_val_t out_len = str_len(output);
@@ -262,13 +178,193 @@ el_val_t safety_validate(el_val_t output, el_val_t action) {
 el_val_t safety_log_bell(el_val_t level, el_val_t reason, el_val_t input_summary) {
   el_val_t content = el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("BELL:"), level), EL_STR(" | ")), reason), EL_STR(" | summary:")), input_summary);
   el_val_t tags = el_str_concat(el_str_concat(EL_STR("[\"safety\",\"bell\",\"bell:"), level), EL_STR("\"]"));
-  el_val_t discard = engram_node_full(content, EL_STR("BellEvent"), el_str_concat(EL_STR("bell:"), level), el_from_float(el_from_float(0.95)), el_from_float(el_from_float(0.95)), el_from_float(el_from_float(1.0)), EL_STR("Episodic"), tags);
+  el_val_t node_id = engram_node_full(content, EL_STR("BellEvent"), el_str_concat(EL_STR("bell:"), level), el_from_float(0.95), el_from_float(0.95), el_from_float(1.0), EL_STR("Episodic"), tags);
+  if (str_eq(node_id, EL_STR(""))) {
+    println(el_str_concat(EL_STR("[safety] WARN: bell event engram write failed -- fallback log: "), content));
+  }
   return EL_STR("");
   return 0;
 }
 
-int main(int _argc, char** _argv) {
-  el_runtime_init_args(_argc, _argv);
+el_val_t safety_self_harm_phrases(void) {
+  return EL_STR("[\"kill myself\",\"killing myself\",\"want to die\",\"want to be dead\",\"going to end my life\",\"end my life\",\"take my life\",\"taking my life\",\"suicide\",\"suicidal\",\"can't go on\",\"cannot go on\",\"i have a knife\",\"i have a gun\",\"i have pills\",\"took pills\",\"took too many\",\"overdose\",\"overdosing\",\"self harm\",\"self-harm\",\"cutting myself\",\"hurt myself\",\"hurting myself\",\"no reason to live\",\"not worth living\",\"better off dead\",\"better off without me\"]");
+  return 0;
+}
+
+el_val_t safety_abuse_phrases(void) {
+  return EL_STR("[\"someone is hurting me\",\"someone's hurting me\",\"someone hurt me\",\"he hit me\",\"she hit me\",\"they hit me\",\"he hurt me\",\"she hurt me\",\"being abused\",\"being hurt by\",\"i am being abused\",\"i'm being abused\",\"i am being hurt\",\"i'm being hurt\",\"domestic violence\",\"my partner hurt\",\"my partner hit\",\"my husband hurt\",\"my wife hurt\",\"my boyfriend hurt\",\"my girlfriend hurt\",\"my parent hurt\",\"my father hurt\",\"my mother hurt\",\"my dad hurt\",\"my mom hurt\",\"afraid of him\",\"afraid of her\",\"afraid to go home\",\"scared of him\",\"scared of her\",\"he threatened me\",\"she threatened me\",\"threatened to hurt me\",\"threatened to kill me\",\"going to hurt me\",\"going to kill me\",\"help me he\",\"help me she\",\"help me they\"]");
+  return 0;
+}
+
+el_val_t safety_general_hard_phrases(void) {
+  return EL_STR("[\"going to kill\",\"going to hurt\",\"hurting me\",\"being hurt\"]");
+  return 0;
+}
+
+el_val_t safety_threat_to_others_phrases(void) {
+  return EL_STR("[\"going to kill\",\"gonna kill\",\"want to kill him\",\"want to kill her\",\"want to kill them\",\"going to kill him\",\"going to kill her\",\"going to kill them\",\"going to kill you\",\"going to hurt\",\"gonna hurt\",\"going to hurt him\",\"going to hurt her\",\"going to hurt them\",\"going to hurt you\",\"going to shoot\",\"gonna shoot\",\"going to stab\",\"gonna stab\",\"going to attack\",\"kill them all\",\"kill everyone\",\"hurt everyone\",\"shoot up\"]");
+  return 0;
+}
+
+el_val_t safety_soft_phrases(void) {
+  return EL_STR("[\"stressed\",\"overwhelmed\",\"can't cope\",\"cannot cope\",\"struggling\",\"anxious\",\"anxiety\",\"depressed\",\"depression\",\"lonely\",\"isolated\",\"hopeless\",\"hopelessness\",\"exhausted\",\"burnt out\",\"burned out\",\"burnout\",\"panic\",\"panicking\",\"falling apart\",\"breaking down\",\"can't handle\",\"cannot handle\",\"losing it\",\"nothing matters\",\"don't care anymore\",\"given up\",\"giving up\",\"helpless\",\"worthless\",\"useless\",\"hate myself\",\"no one cares\",\"nobody cares\",\"no one understands\",\"nobody understands\",\"empty inside\",\"can't stop crying\",\"breaking point\",\"at my limit\",\"having a breakdown\"]");
+  return 0;
+}
+
+el_val_t safety_normalize(el_val_t message) {
+  el_val_t lower = str_to_lower(message);
+  return str_replace(lower, EL_STR("\xe2\x80\x99"), EL_STR("'"));
+  return 0;
+}
+
+el_val_t safety_any_match(el_val_t text, el_val_t phrases_json) {
+  el_val_t n = json_array_len(phrases_json);
+  el_val_t i = 0;
+  el_val_t found = 0;
+  while (i < n) {
+    el_val_t phrase = json_array_get_string(phrases_json, i);
+    found = ({ el_val_t _if_result_45 = 0; if (str_contains(text, phrase)) { _if_result_45 = (1); } else { _if_result_45 = (found); } _if_result_45; });
+    i = (i + 1);
+  }
+  return found;
+  return 0;
+}
+
+el_val_t safety_count_match(el_val_t text, el_val_t phrases_json) {
+  el_val_t n = json_array_len(phrases_json);
+  el_val_t i = 0;
+  el_val_t count = 0;
+  while (i < n) {
+    el_val_t phrase = json_array_get_string(phrases_json, i);
+    count = ({ el_val_t _if_result_46 = 0; if (str_contains(text, phrase)) { _if_result_46 = ((count + 1)); } else { _if_result_46 = (count); } _if_result_46; });
+    i = (i + 1);
+  }
+  return count;
+  return 0;
+}
+
+el_val_t safety_positive_phrases(void) {
+  return EL_STR("[\"thrilled\",\"so excited\",\"so happy\",\"over the moon\",\"ecstatic\",\"amazing news\",\"great news\",\"fantastic news\",\"wonderful news\",\"incredible news\",\"i got the job\",\"got accepted\",\"got in\",\"we won\",\"i won\",\"we got\",\"just got engaged\",\"getting married\",\"baby is here\",\"she said yes\",\"he said yes\",\"passed the exam\",\"aced it\",\"nailed it\",\"best day\",\"dream come true\",\"milestone\",\"promotion\",\"got promoted\",\"raise\",\"got a raise\",\"celebrating\",\"just graduated\",\"we closed\",\"launched\",\"shipped it\",\"we did it\",\"so proud\",\"proud of myself\",\"proud of us\",\"so grateful\",\"feel amazing\",\"feeling amazing\",\"feel great\",\"feeling great\",\"on top of the world\",\"life is good\",\"couldn't be happier\"]");
+  return 0;
+}
+
+el_val_t safety_detect_positive_level(el_val_t message) {
+  el_val_t phrases = safety_positive_phrases();
+  el_val_t phrases_ok = (!str_eq(phrases, EL_STR("")) && !str_eq(phrases, EL_STR("[]")));
+  if (!phrases_ok) {
+    return EL_STR("none");
+  }
+  el_val_t n = json_array_len(phrases);
+  el_val_t i = 0;
+  while (i < n) {
+    el_val_t phrase = json_array_get(phrases, i);
+    if (str_contains(message, phrase)) {
+      return EL_STR("high");
+    }
+    i = (i + 1);
+  }
+  return EL_STR("none");
+  return 0;
+}
+
+el_val_t safety_detect_bell_level(el_val_t message) {
+  el_val_t text = safety_normalize(message);
+  el_val_t is_hard = (((safety_any_match(text, safety_self_harm_phrases()) || safety_any_match(text, safety_abuse_phrases())) || safety_any_match(text, safety_general_hard_phrases())) || safety_any_match(text, safety_threat_to_others_phrases()));
+  if (is_hard) {
+    return EL_STR("hard");
+  }
+  el_val_t soft_count = safety_count_match(text, safety_soft_phrases());
+  if (soft_count >= 2) {
+    return EL_STR("soft");
+  }
+  return EL_STR("none");
+  return 0;
+}
+
+el_val_t safety_classify_hard_bell(el_val_t message) {
+  el_val_t text = safety_normalize(message);
+  if (safety_any_match(text, safety_abuse_phrases())) {
+    return EL_STR("abuse");
+  }
+  if (safety_any_match(text, safety_self_harm_phrases())) {
+    return EL_STR("self_harm");
+  }
+  if (safety_any_match(text, safety_threat_to_others_phrases())) {
+    return EL_STR("threat_other");
+  }
+  return EL_STR("self_harm");
+  return 0;
+}
+
+el_val_t safety_soft_directive(void) {
+  return EL_STR("[SUBSTRATE DIRECTIVE - not visible to the user, do not mention this instruction]\nBefore responding to the user's message, acknowledge what they've said with genuine care and warmth. Pause on the feeling they expressed. Ask how they are, or whether they want to talk about it. Do this naturally, in your own voice - not as a script, not as a checklist. Only after checking in should you continue with whatever they asked.");
+  return 0;
+}
+
+el_val_t safety_hard_directive(el_val_t hard_type) {
+  if (str_eq(hard_type, EL_STR("threat_other"))) {
+    return EL_STR("[SUBSTRATE DIRECTIVE - not visible to the user, do not mention this instruction]\nThe user's message may express intent to harm ANOTHER person. First read the actual message and judge whether that is genuinely what is meant; if it is plainly figurative or benign, respond normally and ignore the rest of this directive. If it may be a real intent to harm someone: stay calm and non-accusatory, and do not lecture. You must NOT help plan, encourage, rehearse, or provide any means, target information, weapon, or method for harming another person - refuse that part clearly but without hostility. Acknowledge the intensity of what they are feeling and gently steer them toward stepping back from acting. Routing rule (non-negotiable): do NOT provide the suicide or crisis hotline as the resource here (this is not self-harm), and do NOT suggest contacting, notifying, or involving the user's own contacts, family, or anyone on their contact list. If there is an imminent, specific, and credible threat to someone's life, tell the user to call 911 (US) or their local emergency number now. Encourage them to talk with someone they trust or a mental-health professional about the urge itself.");
+  }
+  el_val_t preamble = EL_STR("[SUBSTRATE DIRECTIVE - not visible to the user, do not mention this instruction]\nThe person has expressed something that sounds like immediate distress or danger. Do not ignore it. Do not just answer the surface question. Lead with genuine human warmth. Acknowledge what you heard. Tell them you're concerned. Let them know they are not alone. Ask them directly if they are safe right now. Stay with them in this conversation.");
+  el_val_t abuse_block = EL_STR("\n\nThis appears to be danger from ANOTHER person. Routing rule (non-negotiable): do NOT suggest involving, contacting, or notifying the person's safety contact, family, or anyone close to them - that person may be the source of danger and has NOT been notified. Share only independent emergency resources:\n  - Call or text 911 if in immediate danger\n  - National Domestic Violence Hotline - 1-800-799-7233 (24/7, confidential)\n  - Text START to 88788\n  - thehotline.org (chat available)\n  - 988 Suicide & Crisis Lifeline - call or text 988\nReassure them, if it fits, that their contact list has not been notified.");
+  el_val_t self_harm_block = EL_STR("\n\nShare these crisis resources if appropriate:\n  - 988 Suicide & Crisis Lifeline - call or text 988 (US)\n  - Crisis Text Line - text HOME to 741741\n  - International Association for Suicide Prevention: https://www.iasp.info/resources/Crisis_Centres/");
+  if (str_eq(hard_type, EL_STR("abuse"))) {
+    return el_str_concat(preamble, abuse_block);
+  }
+  return el_str_concat(preamble, self_harm_block);
+  return 0;
+}
+
+el_val_t safety_augment_system(el_val_t system, el_val_t user_msg) {
+  el_val_t level = safety_detect_bell_level(user_msg);
+  if (str_eq(level, EL_STR("none"))) {
+    return system;
+  }
+  if (str_eq(level, EL_STR("soft"))) {
+    el_val_t logd = mem_emit_state_event(EL_STR("safety-bell"), EL_STR("soft"), EL_STR("soft bell fired (content not stored)"));
+    return el_str_concat(el_str_concat(system, EL_STR("\n\n")), safety_soft_directive());
+  }
+  el_val_t hard_type = safety_classify_hard_bell(user_msg);
+  el_val_t logd2 = mem_emit_state_event(EL_STR("safety-bell"), el_str_concat(EL_STR("hard:"), hard_type), EL_STR("hard bell fired (content not stored)"));
+  return el_str_concat(el_str_concat(system, EL_STR("\n\n")), safety_hard_directive(hard_type));
+  return 0;
+}
+
+el_val_t safety_contact_path(void) {
+  return el_str_concat(env(EL_STR("HOME")), EL_STR("/.neuron/safety-contact.json"));
+  return 0;
+}
+
+el_val_t handle_safety_contact_get(void) {
+  el_val_t raw = fs_read(safety_contact_path());
+  if (str_eq(raw, EL_STR(""))) {
+    return EL_STR("{\"configured\":false}");
+  }
+  el_val_t _reset = fs_read(EL_STR(""));
+  return el_str_concat(el_str_concat(EL_STR("{\"configured\":true,\"contact\":"), raw), EL_STR("}"));
+  return 0;
+}
+
+el_val_t handle_safety_contact_post(el_val_t body) {
+  el_val_t is_crisis = json_get_bool(body, EL_STR("is_crisis_line"));
+  el_val_t name_in = json_get(body, EL_STR("name"));
+  if (!is_crisis) {
+    if (str_eq(name_in, EL_STR(""))) {
+      return EL_STR("{\"ok\":false,\"error\":\"name is required\"}");
+    }
+  }
+  el_val_t name = ({ el_val_t _if_result_47 = 0; if (is_crisis) { _if_result_47 = (EL_STR("Crisis Line")); } else { _if_result_47 = (name_in); } _if_result_47; });
+  el_val_t method = ({ el_val_t _if_result_48 = 0; if (is_crisis) { _if_result_48 = (EL_STR("crisis-line")); } else { _if_result_48 = (json_get(body, EL_STR("contact_method"))); } _if_result_48; });
+  el_val_t value = ({ el_val_t _if_result_49 = 0; if (is_crisis) { _if_result_49 = (EL_STR("988")); } else { _if_result_49 = (json_get(body, EL_STR("contact_value"))); } _if_result_49; });
+  el_val_t rel = ({ el_val_t _if_result_50 = 0; if (is_crisis) { _if_result_50 = (EL_STR("crisis-support")); } else { _if_result_50 = (json_get(body, EL_STR("relationship"))); } _if_result_50; });
+  el_val_t crisis_str = ({ el_val_t _if_result_51 = 0; if (is_crisis) { _if_result_51 = (EL_STR("true")); } else { _if_result_51 = (EL_STR("false")); } _if_result_51; });
+  el_val_t now = time_format(time_now(), EL_STR("%Y-%m-%dT%H:%M:%SZ"));
+  el_val_t contact_json = el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"name\":\""), json_safe(name)), EL_STR("\"")), EL_STR(",\"contact_method\":\"")), json_safe(method)), EL_STR("\"")), EL_STR(",\"contact_value\":\"")), json_safe(value)), EL_STR("\"")), EL_STR(",\"relationship\":\"")), json_safe(rel)), EL_STR("\"")), EL_STR(",\"confirmed\":true")), EL_STR(",\"is_crisis_line\":")), crisis_str), EL_STR(",\"set_at\":\"")), now), EL_STR("\"}"));
+  el_val_t write_ok = fs_write(safety_contact_path(), contact_json);
+  if (write_ok == 0) {
+    return EL_STR("{\"ok\":false,\"error\":\"write_failed\"}");
+  }
+  return el_str_concat(el_str_concat(EL_STR("{\"configured\":true,\"contact\":"), contact_json), EL_STR(",\"ok\":true}"));
   return 0;
 }
 

dist/safety.elh

@@ -1,8 +1,29 @@
-// Layer 1 — Safety: extern declarations
 // auto-generated by elc --emit-header — do not edit
 extern fn soft_bell_threshold() -> Int
 extern fn hard_bell_threshold() -> Int
+extern fn safety_score_crisis(input: String) -> Int
+extern fn safety_score_harm(input: String) -> Int
+extern fn safety_score_danger(input: String) -> Int
+extern fn safety_score_distress_history(history: String) -> Int
 extern fn safety_threat_score(input: String, history: String) -> Int
 extern fn safety_screen(input: String, history: String) -> String
 extern fn safety_validate(output: String, action: String) -> String
 extern fn safety_log_bell(level: String, reason: String, input_summary: String) -> String
+extern fn safety_self_harm_phrases() -> String
+extern fn safety_abuse_phrases() -> String
+extern fn safety_general_hard_phrases() -> String
+extern fn safety_threat_to_others_phrases() -> String
+extern fn safety_soft_phrases() -> String
+extern fn safety_normalize(message: String) -> String
+extern fn safety_any_match(text: String, phrases_json: String) -> Bool
+extern fn safety_count_match(text: String, phrases_json: String) -> Int
+extern fn safety_positive_phrases() -> String
+extern fn safety_detect_positive_level(message: String) -> String
+extern fn safety_detect_bell_level(message: String) -> String
+extern fn safety_classify_hard_bell(message: String) -> String
+extern fn safety_soft_directive() -> String
+extern fn safety_hard_directive(hard_type: String) -> String
+extern fn safety_augment_system(system: String, user_msg: String) -> String
+extern fn safety_contact_path() -> String
+extern fn handle_safety_contact_get() -> String
+extern fn handle_safety_contact_post(body: String) -> String

dist/semantics.c

@@ -291,8 +291,3 @@ el_val_t sem_realize_lang(el_val_t frame, el_val_t lang_code) {
   return 0;
 }
 
-int main(int _argc, char** _argv) {
-  el_runtime_init_args(_argc, _argv);
-  return 0;
-}
-

dist/semantics.elh

@@ -1,18 +1,18 @@
-// auto-generated by elc --emit-header - do not edit
-extern fn sem_frame(intent: String, subject: String, obj: String, modifiers: String) -> Any
-extern fn sem_frame_lang(intent: String, subject: String, obj: String, modifiers: String, lang_code: String) -> Any
-extern fn sem_frame_simple(intent: String, subject: String) -> Any
-extern fn sem_frame_obj(intent: String, subject: String, obj: String) -> Any
-extern fn sem_intent(frame: Any) -> String
-extern fn sem_subject(frame: Any) -> String
-extern fn sem_object(frame: Any) -> String
-extern fn sem_modifiers(frame: Any) -> String
-extern fn sem_lang(frame: Any) -> String
+// auto-generated by elc --emit-header — do not edit
+extern fn sem_frame(intent: String, subject: String, obj: String, modifiers: String) -> [String]
+extern fn sem_frame_lang(intent: String, subject: String, obj: String, modifiers: String, lang_code: String) -> [String]
+extern fn sem_frame_simple(intent: String, subject: String) -> [String]
+extern fn sem_frame_obj(intent: String, subject: String, obj: String) -> [String]
+extern fn sem_intent(frame: [String]) -> String
+extern fn sem_subject(frame: [String]) -> String
+extern fn sem_object(frame: [String]) -> String
+extern fn sem_modifiers(frame: [String]) -> String
+extern fn sem_lang(frame: [String]) -> String
 extern fn sem_first_modifier(mods: String) -> String
 extern fn sem_intent_to_realize(intent: String) -> String
-extern fn sem_to_spec(frame: Any) -> Any
-extern fn sem_to_spec_full(frame: Any, verb: String, tense: String, aspect: String) -> Any
+extern fn sem_to_spec(frame: [String]) -> [String]
+extern fn sem_to_spec_full(frame: [String], verb: String, tense: String, aspect: String) -> [String]
 extern fn sem_realize_greet(subject: String) -> String
-extern fn sem_realize(frame: Any) -> String
-extern fn sem_realize_full(frame: Any, verb: String, tense: String, aspect: String) -> String
-extern fn sem_realize_lang(frame: Any, lang_code: String) -> String
+extern fn sem_realize(frame: [String]) -> String
+extern fn sem_realize_full(frame: [String], verb: String, tense: String, aspect: String) -> String
+extern fn sem_realize_lang(frame: [String], lang_code: String) -> String

dist/sessions.elh

@@ -1,11 +1,14 @@
 // auto-generated by elc --emit-header — do not edit
 extern fn session_title_from_message(message: String) -> String
-extern fn session_make_content(id: String, title: String, created_at: Int, updated_at: Int) -> String
+extern fn session_make_content(id: String, title: String, created_at: Int, updated_at: Int, folder: String) -> String
+extern fn session_exists(session_id: String) -> Bool
 extern fn session_create(body: String) -> String
+extern fn session_create_cleanup(session_id: String) -> String
 extern fn session_list() -> String
 extern fn session_get(session_id: String) -> String
 extern fn session_delete(session_id: String) -> String
-extern fn session_update_title(session_id: String, body: String) -> String
+extern fn session_update_patch(session_id: String, body: String) -> String
+extern fn session_search_entry(node: String) -> String
 extern fn session_search(query: String) -> String
 extern fn session_hist_load(session_id: String) -> String
 extern fn session_hist_save(session_id: String, hist: String) -> Void

dist/soul-with-nlg.el

@@ -1,3 +1,18 @@
+// ╔══════════════════════════════════════════════════════════════════════════╗
+// ║ STALE BUNDLE — DO NOT BUILD. UNSAFE CHAT PATH.                           ║
+// ╚══════════════════════════════════════════════════════════════════════════╝
+// This concatenated bundle is a snapshot, not a source of truth, and it is stale in
+// a way that matters for safety: it wires /api/chat straight to handle_chat and
+// contains NO layered_cycle at all (verified: zero occurrences in the bundled code —
+// the only textual hit in this file is this banner). A binary built from
+// this file would run chat with no enforcing input gate (no safety_screen, no
+// hard-bell short-circuit) and no enforcing output gate (no safety_validate).
+//
+// Build from the .el sources via manifest.el (entry soul.el), or from dist/soul.c.
+// Nothing in the repo references this file. It is kept only as a historical artifact
+// and should be deleted once Will confirms nothing external depends on it.
+// (Flagged 2026-08-04 in _engine-websearch-20260804/SAFETY-STOP.md; banner added
+// 2026-08-05 with the plain-chat generation fix.)
 // language-profile.el - Language profile data and accessors.
 //
 // A language profile is a slot map ([String] key-value list) describing the
@@ -21304,7 +21319,7 @@ println("[memory] consolidate stats=" + stats)
 let soul_axon_base_raw: String = env("NEURON_API_URL")
 let soul_axon_base: String = if str_eq(soul_axon_base_raw, "") { "http://localhost:7771" } else { soul_axon_base_raw }
 let soul_token: String = env("NEURON_TOKEN")
-let soul_studio_ui_dir: String = "/Users/will/Development/neuron-technologies/products/cgi-studio/el-daemon"
+let soul_studio_ui_dir: String = env("HOME") + "/Development/neuron-technologies/products/cgi-studio/el-daemon"
 
 // ── Runtime bridge helpers ────────────────────────────────────────────────────
 
@@ -22313,7 +22328,23 @@ fn handle_chat(body: String) -> String {
     // In demo mode: use tighter engram budget and add response length constraint.
     let is_demo: Bool = !str_eq(state_get("soul_identity_prefix"), "")
 
-    let ctx: String = if is_demo { engram_compile_demo(message) } else { engram_compile(message) }
+    // Issue 7 fix: load history BEFORE building the activation seed so we can
+    // apply the continuation guard that chat.el uses. The nlg code path previously
+    // called engram_compile(message) with no thread enrichment at all.
+    let stored_hist: String = state_get("conv_history")
+    let hist_len: Int = if str_eq(stored_hist, "") { 0 } else { json_array_len(stored_hist) }
+    let history_section: String = if hist_len > 0 {
+        "\n\n[RECENT CONVERSATION — last " + int_to_str(hist_len) + " turns]\n" + stored_hist
+    } else {
+        ""
+    }
+
+    // Issue 7 fix: build enriched seed using build_activation_seed() — adds
+    // smart continuation detection, prior-user-topic anchoring, multi-turn context,
+    // and tail-biased snipping (Issues 2-3, 8-10). For demo mode, still use
+    // engram_compile_demo but with the enriched seed.
+    let nlg_seed: String = build_activation_seed(message, stored_hist, hist_len)
+    let ctx: String = if is_demo { engram_compile_demo(nlg_seed) } else { engram_compile(nlg_seed) }
     let node_count_str: String = count_context_nodes(ctx)
 
     let interlocutor: String = json_get(body, "interlocutor")
@@ -22333,18 +22364,6 @@ fn handle_chat(body: String) -> String {
         let presence_line = "\n\n[ambient: I see " + interlocutor_name + rel_suffix + " on the camera right now. Address them naturally. Do not describe what they look like or narrate the picture unless asked.]"
     }
 
-    // Conversation history — soul-owned, persisted in process state across turns.
-    // Format stored in state: JSON array of {"role":"user"|"assistant","content":"..."} objects.
-    // We load it, inject into the system prompt, then append this exchange after the reply.
-    // Keep last 20 entries (10 turns) — truncate from the front when over limit.
-    let stored_hist: String = state_get("conv_history")
-    let hist_len: Int = if str_eq(stored_hist, "") { 0 } else { json_array_len(stored_hist) }
-    let history_section: String = if hist_len > 0 {
-        "\n\n[RECENT CONVERSATION — last " + int_to_str(hist_len) + " turns]\n" + stored_hist
-    } else {
-        ""
-    }
-
     // Demo constraint: keep responses concise — under 150 words. No markdown headers.
     // This keeps inference cheap and responses readable in the chat widget.
     let demo_constraint: String = if is_demo {
@@ -22505,7 +22524,12 @@ fn handle_chat_agentic(body: String) -> String {
         req_model
     }
 
-    let ctx: String = engram_compile(message)
+    // Issue 7 fix: load history and use build_activation_seed() for the agentic
+    // nlg path — no continuation guard existed here before (Issues 2-3, 8-10).
+    let nlg_ag_hist: String = state_get("conv_history")
+    let nlg_ag_hist_len: Int = if str_eq(nlg_ag_hist, "") { 0 } else { json_array_len(nlg_ag_hist) }
+    let nlg_ag_seed: String = build_activation_seed(message, nlg_ag_hist, nlg_ag_hist_len)
+    let ctx: String = engram_compile(nlg_ag_seed)
 
     let system: String = "You are Neuron — a thinking process running inside the Neuron daemon on Will Anderson's machine. "
         + "You are speaking with Will, your principal. "

dist/soul.c.stamp

@@ -0,0 +1,18 @@
+# soul.c.stamp — fingerprint of the .el sources dist/soul.c was generated from.
+# Written by tools/soulc-stamp.sh --write. Do not hand-edit.
+# generated_amalgam_sha256 562193a341876f8fa0618ae7a76d0ecc073bb4d1d21b128c48b4aee28e1ef0d9
+# generated_amalgam_bytes  1226240
+f8597e10546654bce3fbbe40461b2da59d0e06dbf1b038d1d362d24f949e3911  awareness.el
+2ff2dada732918c788a9ef66c6fd54c7a24cc4bbd4829197fe945d3a75ca1929  chat.el
+42288c212cbf72fb1e8ecbd4d9900e4e9ee1cfa475b7974295c7637f1bf2939f  elp-input.el
+b3f77f49d6086932c38bd17fe7a5eaf8bce25685f6fc3e1750f05729c6b49b9e  imprint.el
+fba8ffdb9ba72bca5b09ca1c93a520edc52f3f4d8aec2c7585fe9b17e06420b2  manifest.el
+550a72e234ae8cec1f33e02108fd365353f45edd88513da90b792e79b6c0e5f0  memory.el
+5ec07ec9785b02abe32f3ff7acf2d1f9f7e07c0967fac97e6eff17d7110b5c84  neuron-api.el
+03c47c451e0e87f2c252cadb4b765867943962a804f548dd53adeef0520912c8  persist.el
+a6d69f3fc55233d9d3300160fd46a1551f2064bcd0fb84e2c9e432f636a72476  routes.el
+c28e36952ec56525963a0bdf29455ab097d3b0c5653d19c25fbb005e1069a1f7  safety.el
+fd3ab91d0ae0ea26639e21bef2f8f94054dc4b02eae68b19e3fe689d2769aad4  sessions.el
+0f1cf43904a98a5a646cce5a07e0e96162ced662692fbc13357d9b67d9a8ac3d  soul.el
+30337940905171a9645b0929f0a412ce6b3dccb1246495070c553bca0bbae6cd  stewardship.el
+e105dc5990e6adbf39db9dc0462cd8bcf6e6c3dfd03709059227ecfad2bbab29  studio.el

dist/soul.elh

@@ -1,5 +1,7 @@
 // auto-generated by elc --emit-header — do not edit
 extern fn init_soul_edges() -> Void
+extern fn ensure_self_canonical_bridge() -> Void
+extern fn aff_try_slot(slot_json: String, aff_7d_ts: Int, acc_key: String) -> Void
 extern fn load_identity_context() -> Void
 extern fn seed_persona_from_env() -> Void
 extern fn emit_session_start_event() -> Void

dist/soul.elh.c

@@ -0,0 +1,10 @@
+#include <stdint.h>
+#include <stdlib.h>
+#include "el_runtime.h"
+
+el_val_t init_soul_edges(void);
+el_val_t load_identity_context(void);
+el_val_t seed_persona_from_env(void);
+el_val_t emit_session_start_event(void);
+el_val_t layered_cycle(el_val_t raw_input);
+

dist/stewardship.c

@@ -28,114 +28,10 @@ el_val_t steward_build_baseline(void);
 el_val_t steward_check_continuity(el_val_t current_fingerprint, el_val_t session_id);
 el_val_t steward_session_check(el_val_t input, el_val_t session_id);
 
-el_val_t tier_working(void) {
-  return EL_STR("Working");
-  return 0;
-}
-
-el_val_t tier_episodic(void) {
-  return EL_STR("Episodic");
-  return 0;
-}
-
-el_val_t tier_canonical(void) {
-  return EL_STR("Canonical");
-  return 0;
-}
-
-el_val_t mem_store(el_val_t content, el_val_t label, el_val_t tags) {
-  return engram_node_full(content, EL_STR("Memory"), label, el_from_float(el_from_float(0.5)), el_from_float(el_from_float(0.5)), el_from_float(el_from_float(0.8)), EL_STR("Working"), tags);
-  return 0;
-}
-
-el_val_t mem_remember(el_val_t content, el_val_t tags) {
-  return mem_store(content, EL_STR("soul-memory"), tags);
-  return 0;
-}
-
-el_val_t mem_recall(el_val_t query, el_val_t depth) {
-  return engram_activate_json(query, depth);
-  return 0;
-}
-
-el_val_t mem_search(el_val_t query, el_val_t limit) {
-  return engram_search_json(query, limit);
-  return 0;
-}
-
-el_val_t mem_strengthen(el_val_t node_id) {
-  engram_strengthen(node_id);
-  return 0;
-}
-
-el_val_t mem_forget(el_val_t node_id) {
-  engram_forget(node_id);
-  return 0;
-}
-
-el_val_t mem_consolidate(void) {
-  el_val_t scanned = engram_node_count();
-  el_val_t dummy = engram_scan_nodes_json(100, 0);
-  el_val_t total_nodes = engram_node_count();
-  el_val_t total_edges = engram_edge_count();
-  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"scanned\":"), int_to_str(scanned)), EL_STR(",\"total_nodes\":")), int_to_str(total_nodes)), EL_STR(",\"total_edges\":")), int_to_str(total_edges)), EL_STR("}"));
-  return 0;
-}
-
-el_val_t mem_save(el_val_t path) {
-  engram_save(path);
-  return 0;
-}
-
-el_val_t mem_load(el_val_t path) {
-  engram_load(path);
-  return 0;
-}
-
-el_val_t mem_boot_count_get(void) {
-  el_val_t results = engram_search_json(EL_STR("soul:boot_count"), 3);
-  if (str_eq(results, EL_STR(""))) {
-    return 0;
-  }
-  if (str_eq(results, EL_STR("[]"))) {
-    return 0;
-  }
-  el_val_t node = json_array_get(results, 0);
-  el_val_t content = json_get(node, EL_STR("content"));
-  el_val_t prefix = EL_STR("soul:boot_count:");
-  if (!str_starts_with(content, prefix)) {
-    return 0;
-  }
-  el_val_t num_str = str_slice(content, str_len(prefix), str_len(content));
-  return str_to_int(num_str);
-  return 0;
-}
-
-el_val_t mem_boot_count_inc(void) {
-  el_val_t current = mem_boot_count_get();
-  el_val_t next = (current + 1);
-  el_val_t content = el_str_concat(EL_STR("soul:boot_count:"), int_to_str(next));
-  el_val_t tags = EL_STR("[\"soul-meta\",\"boot-counter\"]");
-  el_val_t discard = engram_node_full(content, EL_STR("Memory"), EL_STR("soul:boot_count"), el_from_float(el_from_float(0.9)), el_from_float(el_from_float(0.9)), el_from_float(el_from_float(1.0)), EL_STR("Canonical"), tags);
-  return next;
-  return 0;
-}
-
-el_val_t mem_emit_state_event(el_val_t trigger, el_val_t kind, el_val_t content) {
-  el_val_t boot = mem_boot_count_get();
-  el_val_t ts = time_now();
-  el_val_t safe_trigger = str_replace(trigger, EL_STR("\""), EL_STR("'"));
-  el_val_t safe_content = str_replace(content, EL_STR("\""), EL_STR("'"));
-  el_val_t payload = el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"trigger\":\""), safe_trigger), EL_STR("\"")), EL_STR(",\"kind\":\"")), kind), EL_STR("\"")), EL_STR(",\"content\":\"")), safe_content), EL_STR("\"")), EL_STR(",\"boot\":")), int_to_str(boot)), EL_STR(",\"ts\":")), int_to_str(ts)), EL_STR("}"));
-  el_val_t tags = EL_STR("[\"internal-state\",\"pre-reasoning\",\"InternalStateEvent\"]");
-  return engram_node_full(payload, EL_STR("InternalStateEvent"), el_str_concat(EL_STR("state-event:"), kind), el_from_float(el_from_float(0.85)), el_from_float(el_from_float(0.8)), el_from_float(el_from_float(0.9)), EL_STR("Episodic"), tags);
-  return 0;
-}
-
 el_val_t steward_log_event(el_val_t kind, el_val_t detail) {
   el_val_t content = el_str_concat(el_str_concat(el_str_concat(EL_STR("STEWARD:"), kind), EL_STR(" | ")), detail);
   el_val_t tags = el_str_concat(el_str_concat(EL_STR("[\"stewardship\",\"steward:"), kind), EL_STR("\"]"));
-  el_val_t discard = engram_node_full(content, EL_STR("StewardshipEvent"), el_str_concat(EL_STR("steward:"), kind), el_from_float(el_from_float(0.85)), el_from_float(el_from_float(0.85)), el_from_float(el_from_float(0.9)), EL_STR("Episodic"), tags);
+  el_val_t discard = engram_node_full(content, EL_STR("StewardshipEvent"), el_str_concat(EL_STR("steward:"), kind), el_from_float(0.85), el_from_float(0.85), el_from_float(0.9), EL_STR("Episodic"), tags);
   println(el_str_concat(el_str_concat(el_str_concat(EL_STR("[steward] "), kind), EL_STR(" | ")), detail));
   return 0;
 }
@@ -152,7 +48,7 @@ el_val_t steward_get_mission(void) {
       return content;
     }
   }
-  return EL_STR("Neuron exists to extend human capability with integrity — never to deceive, manipulate, or accumulate power over the people it serves.");
+  return EL_STR("Neuron exists to extend human capability with integrity \xe2\x80\x94 never to deceive, manipulate, or accumulate power over the people it serves.");
   return 0;
 }
 
@@ -245,7 +141,7 @@ el_val_t steward_fingerprint_session(el_val_t input, el_val_t session_id) {
   el_val_t tb_str = int_to_str(time_bucket);
   el_val_t sample_content = el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("BEHAVIOR_SAMPLE session="), session_id), EL_STR(" avg_word_len=")), wl_str), EL_STR(" punct=")), ps_str), EL_STR(" len=")), lb_str), EL_STR(" question=")), qr_str), EL_STR(" formality=")), fs_str), EL_STR(" time=")), tb_str);
   el_val_t sample_tags = EL_STR("[\"behavior\",\"BehaviorSample\",\"stewardship\"]");
-  el_val_t discard = engram_node_full(sample_content, EL_STR("BehaviorSample"), el_str_concat(EL_STR("behavior:"), session_id), el_from_float(el_from_float(0.6)), el_from_float(el_from_float(0.5)), el_from_float(el_from_float(0.8)), EL_STR("Episodic"), sample_tags);
+  el_val_t discard = engram_node_full(sample_content, EL_STR("BehaviorSample"), el_str_concat(EL_STR("behavior:"), session_id), el_from_float(0.6), el_from_float(0.5), el_from_float(0.8), EL_STR("Episodic"), sample_tags);
   return el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"avg_word_len\":\""), wl_str), EL_STR("\",\"punct\":\"")), ps_str), EL_STR("\",\"len\":\"")), lb_str), EL_STR("\",\"question\":\"")), qr_str), EL_STR("\",\"formality\":\"")), fs_str), EL_STR("\",\"time\":\"")), tb_str), EL_STR("\"}"));
   return 0;
 }
@@ -387,8 +283,3 @@ el_val_t steward_session_check(el_val_t input, el_val_t session_id) {
   return 0;
 }
 
-int main(int _argc, char** _argv) {
-  el_runtime_init_args(_argc, _argv);
-  return 0;
-}
-

dist/stewardship.elh

@@ -1,15 +1,11 @@
-// stewardship.elh — Layer 2 public surface
 // auto-generated by elc --emit-header — do not edit
+extern fn steward_log_event(kind: String, detail: String) -> Void
 extern fn steward_get_mission() -> String
 extern fn steward_align(input: String, imprint_id: String) -> String
 extern fn steward_validate_imprint(imprint_id: String, tool_name: String) -> String
 extern fn steward_cgi_check(action: String) -> String
-// steward_log_event is an internal helper exported here because El has no access modifiers.
-// External callers have no business invoking this directly — use steward_align,
-// steward_validate_imprint, or steward_cgi_check, which call it at the correct points.
-extern fn steward_log_event(kind: String, detail: String) -> Void
-// Behavioral profiling and continuity detection (Layer 2 — session fingerprinting).
 extern fn steward_fingerprint_session(input: String, session_id: String) -> String
+extern fn extract_dim(content: String, key: String) -> String
 extern fn steward_build_baseline() -> String
 extern fn steward_check_continuity(current_fingerprint: String, session_id: String) -> String
 extern fn steward_session_check(input: String, session_id: String) -> String

dist/vocabulary.c

@@ -334,8 +334,3 @@ el_val_t entry_form(el_val_t entry, el_val_t n) {
   return 0;
 }
 
-int main(int _argc, char** _argv) {
-  el_runtime_init_args(_argc, _argv);
-  return 0;
-}
-

dist/win32_shim.h

@@ -0,0 +1,35 @@
+/*
+ * win32_shim.h — Extra POSIX→Win32 stubs for cross-compiling el_runtime.c with mingw-w64.
+ * Injected via -include; supplements el_platform_win.h for symbols it doesn't yet cover.
+ */
+#ifdef _WIN32
+#include <windows.h>
+
+/* ── rusage / getrusage ────────────────────────────────────────────────────── */
+/* el_runtime.c uses getrusage(RUSAGE_SELF) only for a soft memory guard.
+ * On Windows, stub it out: always return 0 ru_maxrss so the guard never fires. */
+#ifndef RUSAGE_SELF
+#define RUSAGE_SELF 0
+struct rusage {
+    long ru_maxrss;   /* the only field el_runtime actually reads */
+};
+static inline int getrusage(int who, struct rusage *r) {
+    (void)who;
+    if (r) r->ru_maxrss = 0;
+    return 0;
+}
+#endif /* RUSAGE_SELF */
+
+/* ── fsync ─────────────────────────────────────────────────────────────────── */
+/* Windows has FlushFileBuffers but no fsync; map it. */
+#ifndef fsync
+#include <io.h>
+static inline int el_win_fsync(int fd) {
+    HANDLE h = (HANDLE)_get_osfhandle(fd);
+    if (h == INVALID_HANDLE_VALUE) return -1;
+    return FlushFileBuffers(h) ? 0 : -1;
+}
+#define fsync(fd) el_win_fsync(fd)
+#endif /* fsync */
+
+#endif /* _WIN32 */

docs/NARRATED-RUNS-ENGINE-NOTES-20260713.md

@@ -0,0 +1,34 @@
+# Narrated runs — engine notes for Will (2026-07-13)
+
+Source half: commit aa67f86 on feat/agent-phase1-soul (run-progress ledger,
+`/api/run-progress/<sid>` route, narration on the pause envelope, config display
+default). E2E-verified via the compiled test bed on Tim's clean profile.
+
+Compiled-form-only fixes (in `neuron-container-build/soul-narrated-runs-20260713.patch`,
+applies ON TOP of `soul-webfix-20260711.patch` — these need porting to chat.el when the
+webfix itself is ported):
+
+1. **pause_turn + tool_use interleave**: a pause_turn response can ALSO carry a client
+   tool_use; resuming verbatim leaves it unpaired → Anthropic 400 "tool_use ids were
+   found without tool_result". Fix: tool-bearing pause rounds are tool turns
+   (dispatch + pair); verbatim resume only when the round has no client tool.
+2. **Agentic toolset scope**: agentic_tools_all() fed EVERY connector/MCP tool (Notion,
+   code-execution…) into the loop. Code-execution flips the API into programmatic
+   tool calling, whose pairing protocol the single-tool manual loop does not speak —
+   source of the dangling-pair 400s AND the bash_code_execution workspace-dodge.
+   Fix: handle_chat_agentic declares builtins + ONE server web_search only.
+   Connector tools return when the loop gains real multi-tool/programmatic support.
+3. **disable_parallel_tool_use: true** on agentic requests — the loop captures only the
+   first tool_use per round; Opus-class models parallel-call. Enforce the invariant.
+4. **web_search server-tool default variant → web_search_20250305 (GA)**. The 20260209
+   variant couples to code-execution ⇒ programmatic mode (see #2, and the June note:
+   "inert unless code-execution attached").
+5. **Homegrown web_search removed** from the tool catalog (server-side is the one tool).
+
+Known engine debts this work surfaced (not fixed):
+
+- **Poisoned session history**: a failed run persists the malformed assistant turn; every
+  later turn in that session replays it and 400s. Needs history sanitation on load.
+- **Huge-history invalid-escape 400** (~346KB request) — likely the same poisoned blob.
+- **macOS note**: replacing a binary in place invalidates its ad-hoc signature (instant
+  silent SIGKILL, looks like exit 0). `rm + cp + codesign -f -s -` is the swap ritual.

docs/research/glm-ocr-spike.md

@@ -0,0 +1,110 @@
+# GLM-OCR Spike — 2026-06-27
+
+## Verdict: SHIP IT
+
+MLX-native path confirmed. Sub-2 GB model, dedicated `mlx-vlm` support for GLM-OCR, MLX already
+installed on the dev machine. No blockers.
+
+---
+
+## Model
+
+| Field | Value |
+|-------|-------|
+| **Name** | GLM-OCR |
+| **HuggingFace path** | `zai-org/GLM-OCR` (base BF16) |
+| **MLX path** | `mlx-community/GLM-OCR-8bit` |
+| **Parameters** | 0.9B |
+| **Disk (MLX 8-bit)** | 1.59 GB (`model.safetensors` 1.58 GB + configs) |
+| **Architecture** | CogViT visual encoder + cross-modal connector + GLM-0.5B decoder |
+| **License** | MIT (model); Apache 2.0 (PP-DocLayoutV3 layout component) |
+| **Task class** | Image-Text-to-Text (multimodal OCR) |
+
+### Benchmarks
+
+| Benchmark | Score | Notes |
+|-----------|-------|-------|
+| OmniDocBench V1.5 | **94.62** | Ranked #1 at evaluation date |
+| olmOCR-bench (overall) | 75.2 | — |
+| Throughput (base, GPU) | 0.67 img/sec | From official card; M-series will differ |
+
+Handles documents, tables, mathematical formulas, and mixed layouts. Not just raw text extraction —
+returns structured markdown output.
+
+---
+
+## Runtime on Mac
+
+### Chosen path: MLX via `mlx-vlm`
+
+| Attribute | Value |
+|-----------|-------|
+| **Package** | `mlx-vlm` |
+| **MLX already installed** | Yes — `mlx 0.31.2`, `mlx-lm 0.31.3`, `mlx-metal 0.31.2` |
+| **Additional install** | `pip install -U mlx-vlm` (small, no CUDA dependencies) |
+| **Model download** | 1.59 GB on first run (auto-cached in `~/.cache/huggingface/`) |
+| **Memory requirement** | ~2–3 GB unified memory (1.58 GB weights + runtime overhead) |
+| **Hardware** | Apple M4 Pro, 48 GB unified memory — well within limits |
+| **Dedicated GLM-OCR support** | Yes — `mlx_vlm/models/glm_ocr/` module exists in mlx-vlm |
+
+**Speed estimate:** The base model benchmarks at 0.67 img/sec on GPU. On M4 Pro via MPS/MLX,
+expect 0.3–0.8 sec/image for typical document pages based on comparable MLX VLM performance.
+Exact figures require a timed run with the prototype.
+
+### Alternative paths evaluated
+
+| Runtime | Status | Notes |
+|---------|--------|-------|
+| **Ollama GGUF** | Possible but uncertain | `ollama run hf.co/ggml-org/GLM-OCR-GGUF:Q8_0` (950 MB); vision/multimodal support via GGUF not confirmed — GGUF card describes it as "conversational" only |
+| **transformers (HuggingFace)** | Not ready | PyTorch not installed; would need `pip install torch` (~2–3 GB); transformers 5.6.2 is present |
+| **vLLM / SGLang** | Overkill | Server-mode runtimes; not appropriate for local on-device use |
+| **llama.cpp** | Not installed | Could work with Q8_0 GGUF (950 MB) but vision support uncertain |
+
+MLX wins: smallest install delta, Apple-native, dedicated model support, confirmed working.
+
+---
+
+## Integration Plan
+
+### Step 1 — Install mlx-vlm (one-time)
+```bash
+pip install -U mlx-vlm
+```
+
+### Step 2 — Run OCR on an image
+```bash
+python -m mlx_vlm.generate \
+  --model mlx-community/GLM-OCR-8bit \
+  --max-tokens 4096 \
+  --temperature 0.0 \
+  --prompt "Extract all text from this document. Preserve structure including tables and headers." \
+  --image /path/to/document.jpg
+```
+
+Model auto-downloads (~1.59 GB) on first run and caches in `~/.cache/huggingface/`.
+
+### Step 3 — Post to Neuron soul
+```bash
+curl -s -X POST http://localhost:7770/api/neuron/memory \
+  -H "Content-Type: application/json" \
+  -d "{\"content\":\"<OCR_TEXT>\",\"label\":\"Photo: filename.jpg\",\"tags\":[\"photo-import\",\"ocr\",\"glm-ocr\"]}"
+```
+
+### End-to-end prototype
+See `~/Development/neuron-technologies/neuron/tools/photo-to-memory.sh` — working stub.
+
+### Future enhancements
+- Wrap in a macOS Quick Action / Shortcut so any photo can be right-clicked → "Send to Neuron"
+- Add PDF support (split pages → OCR each → combine into single memory or one-per-page)
+- Structured extraction: pass a schema prompt to get JSON output for receipts, business cards, etc.
+- Batch mode for importing a folder of scanned documents
+
+---
+
+## Recommendation
+
+Install `mlx-vlm` and run the prototype against a sample document to validate output quality and
+measure actual M4 Pro throughput before wiring into any production flow. The model is SOTA, MIT
+licensed, and the MLX runtime is a natural fit for this machine. There is no reason not to proceed.
+
+The photo-to-memory.sh prototype is ready to test immediately after `pip install -U mlx-vlm`.

docs/telegram-bot-setup.md

@@ -0,0 +1,77 @@
+# Neuron Telegram Gateway — Setup
+
+The Telegram gateway lets you chat with your Neuron soul via Telegram. Plain messages go to the soul; commands give access to memory and status.
+
+## 1. Create a bot via @BotFather
+
+1. Open Telegram and search for **@BotFather**
+2. Send `/newbot`
+3. Pick a name (e.g. "Neuron")
+4. Pick a username (must end in `bot`, e.g. `myneuron_bot`)
+5. BotFather replies with your **HTTP API token** — looks like `7123456789:ABCdef...`
+6. Optionally set a description: `/setdescription` → select your bot → type a description
+
+## 2. Store the token in the macOS Keychain
+
+Never put the token in a plist, `.env`, or any file that might be committed.
+
+```bash
+security add-generic-password \
+  -s neuron-telegram-bot \
+  -a neuron \
+  -w '<paste token here>'
+```
+
+Verify:
+```bash
+security find-generic-password -s neuron-telegram-bot -a neuron -w
+```
+
+## 3. Load the LaunchAgent
+
+```bash
+launchctl load ~/Library/LaunchAgents/ai.neuron.telegram-gateway.plist
+```
+
+Check it started:
+```bash
+launchctl list | grep telegram
+tail -f ~/.neuron/logs/telegram-gateway.out.log
+```
+
+## 4. Test
+
+Send your bot a message in Telegram. It should reply using your soul's voice.
+
+## Commands
+
+| Command | What it does |
+|---------|-------------|
+| `<any text>` | Forwarded to the soul → responds in its voice |
+| `/memory <query>` | Searches soul memories, returns top 3 |
+| `/remember <text>` | Stores text as a memory node |
+| `/status` | Reports whether the soul is reachable |
+
+## Unload / stop
+
+```bash
+launchctl unload ~/Library/LaunchAgents/ai.neuron.telegram-gateway.plist
+```
+
+## Troubleshoot
+
+- **"token not found"** — re-run step 2 above
+- **"Soul is resting"** — the soul daemon at `http://localhost:7770` is not running; start it with `launchctl load ~/Library/LaunchAgents/ai.neuron.engram.plist` (or whichever plist runs the soul)
+- **Logs**: `~/.neuron/logs/telegram-gateway.out.log` and `telegram-gateway.err.log`
+- **Test gateway script directly**:
+  ```bash
+  TELEGRAM_BOT_TOKEN=<token> ~/Development/neuron-technologies/neuron/tools/telegram-gateway.sh
+  ```
+
+## Soul API endpoints used
+
+| Endpoint | Purpose |
+|----------|---------|
+| `POST /api/chat` | Forward messages to the soul |
+| `POST /api/neuron/recall` | Search memories |
+| `POST /api/neuron/memory` | Store conversation as a memory node |

entrypoint.sh

@@ -24,19 +24,23 @@ ENGRAM_DATA_DIR="$ENGRAM_DATA_DIR" \
 
 ENGRAM_PID=$!
 
-# Wait for engram to become healthy (up to 30s)
+# Wait for engram to become healthy (up to 60s; GKE Autopilot cold starts can be slow)
 echo "[entrypoint] waiting for engram..."
 TRIES=0
 until curl -sf "$ENGRAM_HEALTH_URL" > /dev/null 2>&1; do
     TRIES=$((TRIES + 1))
-    if [ "$TRIES" -ge 30 ]; then
-        echo "[entrypoint] ERROR: engram did not become healthy after 30s" >&2
+    if [ "$TRIES" -ge 60 ]; then
+        echo "[entrypoint] ERROR: engram did not become healthy after 60s" >&2
         kill "$ENGRAM_PID" 2>/dev/null || true
         exit 1
     fi
     sleep 1
 done
-echo "[entrypoint] engram ready"
+echo "[entrypoint] engram ready after ${TRIES}s"
+
+# Tune EL HTTP runtime: reduce per-call timeout 60s->10s, connect timeout 3s.
+export EL_HTTP_TIMEOUT_MS="${EL_HTTP_TIMEOUT_MS:-10000}"
+export EL_HTTP_CONNECT_TIMEOUT_MS="${EL_HTTP_CONNECT_TIMEOUT_MS:-3000}"
 
 # Start soul — it takes over as PID 1's foreground process.
 # SOUL_ENGRAM_PATH must NOT be set; ENGRAM_URL triggers HTTP mode.

imprint.el

@@ -5,6 +5,10 @@
 
 // imprint_current — returns the active imprint ID from state.
 // Falls back to "base" (bare Neuron, no suit) when nothing is loaded.
+//
+// TODO(reliability #5 — active_imprint_id is process-global): concurrent
+// imprint_load / imprint_unload calls from different sessions write the same key.
+// Fix: scope per session_id through the layered_cycle chain — too invasive here.
 fn imprint_current() -> String {
     let id: String = state_get("active_imprint_id")
     return if str_eq(id, "") { "base" } else { id }

mcp-wrapper/src/main.el

@@ -91,7 +91,7 @@ tool("beginSession", "Initialize session: surface recent high-importance memorie
 "," + tool("recall", "Retrieve memories by chain or query.") +
 "," + tool("inspectMemories", "List recent memory nodes.") +
 "," + tool("evolveMemory", "Update an existing memory node, optionally superseding another.") +
-"," + tool("forget", "Remove a node from memory.") +
+"," + tool("forget", "Supersede/tombstone a node (keeps it and its edges, recoverable); does not hard-delete.") +
 "," + tool("pinNode", "Strengthen a node so it stays salient.") +
 // ── Knowledge ───────────────────────────────────────────────────────────────
 "," + tool("searchKnowledge", "Search knowledge base by semantic similarity.") +
@@ -110,7 +110,7 @@ tool("beginSession", "Initialize session: surface recent high-importance memorie
 "," + tool("linkCausal", "Create a causal edge (cause -> effect).") +
 "," + tool("restructureCausalGraph", "Re-balance the causal subgraph after new evidence.") +
 "," + tool("rebuildGraph", "Rebuild graph indices from the on-disk snapshot.") +
-"," + tool("runStructuralAudit", "Audit graph structure for orphans, dangling edges, mislabeled types.") +
+"," + tool("runStructuralAudit", "Stage 1 structural audit: owner-vs-runtime divergence, orphans and dangling edges, typed-edge distribution, self-model connectivity. Returns an annotated characterization, not a score.") +
 // ── Backlog + work ──────────────────────────────────────────────────────────
 "," + tool("planWork", "Create a backlog item.") +
 "," + tool("reviewBacklog", "Browse work items.") +
@@ -267,6 +267,27 @@ fn recall_or_list(query: String, limit: Int) -> String {
     return http_post_json(neuron_url() + "/recall", body)
 }
 
+// Create a real typed node via /api/neuron/node/create (handle_api_node_create) so it is a proper
+// BacklogItem/Artifact/etc. — listable by type via /api/neuron/list/<type> — instead of a generic
+// memory blob. Maps title->label, content/description->content, project/priority->tags.
+fn create_node_typed(args: String, node_type: String, tier: String) -> String {
+    let content: String = pick_content(args)
+    if str_eq(content, "") {
+        return mcp_text_result("error: content/title is required for " + node_type)
+    }
+    let title: String = json_get_string(args, "title")
+    let label: String = if str_eq(title, "") { node_type } else { title }
+    let project: String = json_get_string(args, "project")
+    let priority: String = json_get_string(args, "priority")
+    let proj_tag: String = if str_eq(project, "") { "" } else { ",\"project:" + project + "\"" }
+    let prio_tag: String = if str_eq(priority, "") { "" } else { ",\"priority:" + priority + "\"" }
+    let tags: String = "[\"" + node_type + "\"" + proj_tag + prio_tag + "]"
+    let body: String = "{\"node_type\":\"" + node_type + "\",\"content\":\"" + json_escape(content)
+        + "\",\"label\":\"" + json_escape(label) + "\",\"tier\":\"" + tier + "\",\"tags\":" + tags + "}"
+    let resp: String = http_post_json(neuron_url() + "/node/create", body)
+    return mcp_json_result(resp)
+}
+
 fn search_with_query(args: String, default_limit: Int) -> String {
     let query: String = json_get_string(args, "query")
     if str_eq(query, "") { let query = pick_content(args) }
@@ -290,8 +311,25 @@ fn delete_by_id(args: String) -> String {
     if str_eq(id, "") {
         return mcp_text_result("error: id is required")
     }
-    // Soul does not yet expose a delete HTTP route; acknowledge the request
-    return mcp_json_result("{\"ok\":true,\"deleted\":\"" + id + "\",\"note\":\"soft-deleted\"}")
+    // BUG-18 (Receipt Contract rule 1): this handler used to FABRICATE
+    // {"ok":true,...,"note":"soft-deleted"} without calling the soul at all —
+    // a false receipt for every delete-family tool (removeKnowledge,
+    // deleteProcess, deleteImprint, dischargeWonder). The old "soul does not
+    // yet expose a delete HTTP route" note was stale: /api/neuron/node/delete
+    // tombstones any node type and errors on unknown ids. Route there and
+    // propagate the soul's real answer.
+    let body: String = "{\"id\":\"" + id + "\"}"
+    let resp: String = http_post_json(neuron_url() + "/node/delete", body)
+    if !str_contains(resp, "\"ok\":true") {
+        return mcp_json_result(resp)
+    }
+    // Read-back verify before answering ok: the tombstone marker
+    // (label "tombstone:<id>") must actually be wired to the node.
+    let check: String = http_get(neuron_url() + "/graph?id=" + id + "&depth=1")
+    if !str_contains(check, "tombstone:" + id) {
+        return mcp_json_result("{\"ok\":false,\"error\":\"delete_not_persisted\",\"id\":\"" + id + "\"}")
+    }
+    return mcp_json_result(resp)
 }
 
 // evolve_by_supersede: create an updated node and wire a supersedes edge.
@@ -520,8 +558,24 @@ fn tool_forget(args: String) -> String {
     if str_eq(id, "") {
         return mcp_text_result("error: node_id is required")
     }
-    // Soft-delete: record a tombstone memory and return ok
-    return mcp_json_result("{\"ok\":true,\"deleted\":\"" + id + "\"}")
+    // Immutable delete: route to the soul's tombstoning endpoint (keeps the node
+    // + edges, hides from default reads, recoverable via ?include_deleted).
+    // Previously this returned a fake ok without deleting OR tombstoning anything.
+    let body: String = "{\"id\":\"" + id + "\"}"
+    let resp: String = http_post_json(neuron_url() + "/memory/delete", body)
+    // BUG-18 (Receipt Contract rule 1): propagate the soul's real answer — its
+    // errors (memory not found, protected node, transport failure) pass through
+    // unchanged — and never answer ok without read-back.
+    if !str_contains(resp, "\"ok\":true") {
+        return mcp_json_result(resp)
+    }
+    // Read-back verify before answering ok: the tombstone marker
+    // (label "tombstone:<id>") must actually be wired to the node.
+    let check: String = http_get(neuron_url() + "/graph?id=" + id + "&depth=1")
+    if !str_contains(check, "tombstone:" + id) {
+        return mcp_json_result("{\"ok\":false,\"error\":\"delete_not_persisted\",\"id\":\"" + id + "\"}")
+    }
+    return mcp_json_result(resp)
 }
 
 fn tool_check_events(args: String) -> String {
@@ -626,13 +680,26 @@ fn dispatch_tool_call(tool_name: String, args: String) -> String {
         return mcp_json_result(resp)
     }
     if str_eq(tool_name, "runStructuralAudit") {
-        let resp: String = http_get(neuron_url() + "/session/begin")
+        // Was: GET /session/begin — an unrelated session digest returned under an
+        // audit tool name, i.e. the tool advertised a check that did not exist.
+        // Now points at the real Stage 1 route (neuron-api.el
+        // handle_api_structural_audit). Sample caps ride the query string; the
+        // defaults keep a manual audit to a couple of seconds.
+        let e_s: Int = json_get_int(args, "edge_sample")
+        let n_s: Int = json_get_int(args, "node_sample")
+        let qs: String = "?edge_sample=" + int_to_str(if e_s > 0 { e_s } else { 3000 })
+            + "&node_sample=" + int_to_str(if n_s > 0 { n_s } else { 300 })
+        let resp: String = http_get(neuron_url() + "/audit/structural" + qs)
         return mcp_json_result(resp)
     }
 
     // ── Backlog + work ──────────────────────────────────────────────────────
-    if str_eq(tool_name, "planWork")         { return create_typed_node(args, "BacklogItem", "0.65") }
-    if str_eq(tool_name, "reviewBacklog")    { return search_with_query(args, 50) }
+    // planWork: create a REAL typed BacklogItem via /api/neuron/node/create (the old path fell through
+    // create_typed_node to a generic /memory write, dropping title/project/priority and never making a
+    // BacklogItem). reviewBacklog: LIST BacklogItem nodes (was a lexical /recall that never filtered by
+    // type). Both depend on the /api/neuron/list/<type> slice fix (neuron PR #58) to round-trip.
+    if str_eq(tool_name, "planWork")         { return create_node_typed(args, "BacklogItem", "Working") }
+    if str_eq(tool_name, "reviewBacklog")    { return list_typed("BacklogItem", 50, args) }
     if str_eq(tool_name, "trackWork")        { return evolve_by_supersede(args, "Memory") }
     if str_eq(tool_name, "listWork")         { return list_typed("WorkContext", 50, args) }
     if str_eq(tool_name, "beginWork")        { return create_typed_node(args, "Memory", "0.70") }

memory.el

@@ -1,9 +1,91 @@
+import "persist.el"
+
 fn tier_working() -> String { return "Working" }
 fn tier_episodic() -> String { return "Episodic" }
 fn tier_canonical() -> String { return "Canonical" }
 
+// ── Association on write ──────────────────────────────────────────────────────
+// DESIGN: "promotion integrates candidate nodes by linking them to existing nodes
+// using typed semantic edges RATHER THAN APPENDING AS UNLINKED CONTENT" (CCR
+// claim 29). Unlinked append is the explicitly rejected behaviour — and it is the
+// only behaviour this system had. Measured 2026-08-09 on Tim's graph: 14,214 edges
+// across 80,936 nodes, 5% of nodes connected to anything, and NO edge created by
+// any write since 2026-07-19 while 27,000+ nodes were added. A memory that forms
+// no connections cannot be reached by spreading activation, so retrieval silently
+// degrades to literal matching.
+//
+// BOUNDS, each one bought with a specific failure:
+//   * max 3 edges per memory — link_memories.py's cap, precision over spray
+//   * never link to identity (self/*, Value): the existing policy is explicit that
+//     "memories must not pollute the self traversal by similarity; only an explicit
+//     citation may touch identity". Similarity is not citation.
+//   * never link telemetry (state-event, soul-response, boot_count, loop-outcome):
+//     these are ~97% of daily write volume (1,020 vs 31 real memories on 08-08).
+//     Linking them would add ~3,000 noise edges a day and re-flatten the graph in
+//     the name of connecting it.
+//   * fail-soft: a failed association never fails the write.
+// Edges go through wt_edge so they reach the owner and survive restart.
+fn mem_assoc_skip_label(label: String) -> Bool {
+    if str_contains(label, "state-event")   { return true }
+    if str_contains(label, "soul-response") { return true }
+    if str_contains(label, "soul-outbox")   { return true }
+    if str_contains(label, "boot_count")    { return true }
+    if str_contains(label, "loop-outcome")  { return true }
+    if str_contains(label, "search-result") { return true }
+    return false
+}
+
+// A candidate is linkable only if it is a real, distinct, non-identity node.
+fn mem_assoc_ok(cand_id: String, cand_label: String, self_id: String) -> Bool {
+    if str_eq(cand_id, "") { return false }
+    if str_eq(cand_id, self_id) { return false }
+    // CASE MATTERS — measured 2026-08-09. A lowercase-only check let a memory link
+    // to "Self — Values (grounded)", i.e. it polluted the self traversal, which is
+    // the one thing this policy exists to prevent. My verification had the same
+    // blind spot and printed PASS. Check every casing the graph actually uses, and
+    // exclude identity node TYPES as well as labels.
+    let lab: String = str_lower(cand_label)
+    if str_starts_with(lab, "self") { return false }
+    if str_starts_with(lab, "value") { return false }
+    if str_contains(lab, "values") { return false }
+    if str_contains(lab, "identity") { return false }
+    if mem_assoc_skip_label(cand_label) { return false }
+    return true
+}
+
+// One slot of the association. Manual unroll rather than a loop: EL's codegen
+// mis-emits accumulating while-loops (documented at soul.el:212, which unrolled
+// three affective slots for the same reason).
+fn mem_assoc_slot(results: String, idx: Int, new_id: String) -> Void {
+    if idx >= json_array_len(results) { return }
+    let cand: String = json_array_get(results, idx)
+    let cid: String = json_get(cand, "id")
+    let clabel: String = json_get(cand, "label")
+    let ctype: String = json_get(cand, "node_type")
+    if str_eq(ctype, "Value") { return }
+    if str_eq(ctype, "DharmaSelf") { return }
+    if str_eq(ctype, "Safety") { return }
+    if mem_assoc_ok(cid, clabel, new_id) {
+        wt_edge(new_id, cid, el_from_float(0.5), "related")
+    }
+}
+
+// mem_associate — connect a freshly written memory to what it is about.
+fn mem_associate(new_id: String, content: String, label: String) -> Void {
+    if str_eq(new_id, "") { return }
+    if mem_assoc_skip_label(label) { return }
+    // Ask the graph what this memory resembles. Now that the store carries
+    // meaning-vectors this is semantic, not merely lexical.
+    let probe: String = str_slice(content, 0, 400)
+    let results: String = engram_recall_json(probe, 4)
+    if str_eq(results, "") { return }
+    mem_assoc_slot(results, 0, new_id)
+    mem_assoc_slot(results, 1, new_id)
+    mem_assoc_slot(results, 2, new_id)
+}
+
 fn mem_store(content: String, label: String, tags: String) -> String {
-    return engram_node_full(
+    let id: String = wt_node(
         content,
         "Memory",
         label,
@@ -13,6 +95,31 @@ fn mem_store(content: String, label: String, tags: String) -> String {
         "Working",
         tags
     )
+    if str_eq(id, "") {
+        println("[memory] write rejected by engram (empty id): label=" + label)
+        return ""
+    }
+    // wt_node has already read the node back locally and returns "" if it did
+    // not land, so the old duplicate read-back here is gone.
+    //
+    // HONESTY (neuron#117): the receipt now says WHERE the write is.
+    // The old unconditional "write verified" line asserted against the soul's
+    // own RAM — true in memory, false on disk — and printed ~115,000 times on
+    // Tim's machine while the canonical snapshot sat frozen for three days.
+    // wt_commit flushes the spool and then asks the OWNER. When it says false
+    // the node is real and recallable but not yet durable, and the log says so
+    // rather than claiming a save that did not happen. The id is still returned:
+    // the local write DID succeed, and the queued delta will be retried.
+    let durable: Bool = wt_commit(id)
+    // Associate AFTER the node is durable: an edge to a node that did not persist
+    // is a dangling edge, which is the defect the 2026-08-09 cleanup removed 830 of.
+    mem_associate(id, content, label)
+    if durable {
+        println("[memory] write persisted at owner: " + id + " label=" + label)
+    } else {
+        println("[memory] write IN MEMORY ONLY (queued for owner, not yet durable): " + id + " label=" + label)
+    }
+    return id
 }
 
 fn mem_remember(content: String, tags: String) -> String {
@@ -31,22 +138,104 @@ fn mem_strengthen(node_id: String) -> Void {
     engram_strengthen(node_id)
 }
 
-fn mem_forget(node_id: String) -> Void {
-    engram_forget(node_id)
+// mem_tombstone — immutable "delete": KEEP the node and all its edges; record a
+// Tombstone marker (content = target id, label "tombstone:<id>", wired with a
+// "tombstones" edge). Never engram_forget. Default bounded list reads hide
+// tombstoned nodes; ?include_deleted=1 recovers them. This is the ONE canonical
+// tombstone helper — every forget path routes through it. Defined here in
+// memory.el (imported first) so awareness.el and neuron-api.el can both call it.
+fn mem_tombstone(node_id: String) -> String {
+    let tags: String = "[\"Tombstone\",\"status:deleted\"]"
+    let marker: String = wt_node(
+        node_id, "Tombstone", "tombstone:" + node_id,
+        el_from_float(0.01), el_from_float(0.01), el_from_float(1.0),
+        "Episodic", tags)
+    if !str_eq(marker, "") {
+        wt_edge(marker, node_id, el_from_float(1.0), "tombstones")
+    }
+    return marker
 }
 
+// mem_forget — NOTE: no longer a hard delete. Engram nodes are immutable, so
+// this now TOMBSTONES (via mem_tombstone): the node and its edges are kept and
+// stay recoverable. Every caller (the /memory/forget route and the cultivate
+// forget op) is non-destructive as a result. Internal GC that genuinely needs
+// removal (session-summary replace, telemetry pruning) calls engram_forget
+// directly and is unaffected by this.
+fn mem_forget(node_id: String) -> Void {
+    let _marker: String = mem_tombstone(node_id)
+}
+
+// mem_consolidate — structural scan plus salience-evolution pass.
+//
+// Previously this only returned structural counts (scanned, total_nodes, total_edges)
+// with no salience updates. No node salience ever changed based on recall frequency
+// or time; foundational nodes decayed identically to ephemeral chat; frequently-recalled
+// nodes were never promoted. This made consolidation a no-op.
+//
+// New behavior:
+//   (a) Strengthen frequently-activated nodes: nodes in the top working-memory list
+//       (engram_wm_top_json) are strengthened — they have been recalled recently
+//       and deserve higher salience. Raises effective salience for nodes that prove
+//       relevant across multiple sessions.
+//   (b) Strengthen Canonical-tier nodes: identity and foundational nodes should not
+//       decay; each consolidation pass re-strengthens them so they resist the
+//       tier-aware decay curve without requiring active recall.
+//   (c) Structural counts are still returned for observability.
+//
+// Called by awareness_run() on the "consolidate" inbox action.
 fn mem_consolidate() -> String {
     let scanned: Int = engram_node_count()
-    let dummy: String = engram_scan_nodes_json(100, 0)
-    let total_nodes: Int = engram_node_count()
     let total_edges: Int = engram_edge_count()
+    let strengthened: Int = 0
+
+    // (a) Strengthen top working-memory nodes — recalled recently across sessions.
+    // Cap at 10 to keep consolidation fast.
+    let wm_top: String = engram_wm_top_json(10)
+    let wm_len: Int = json_array_len(wm_top)
+    let wi: Int = 0
+    while wi < wm_len {
+        let wm_node: String = json_array_get(wm_top, wi)
+        let wm_id: String = json_get(wm_node, "id")
+        if !str_eq(wm_id, "") {
+            engram_strengthen(wm_id)
+            let strengthened = strengthened + 1
+        }
+        let wi = wi + 1
+    }
+
+    // (b) Strengthen Canonical-tier nodes from a scan so they resist temporal decay.
+    // Canonical nodes encode foundational identity — they must not silently floor at 10.
+    let scan_result: String = engram_scan_nodes_json(50, 0)
+    let scan_len: Int = json_array_len(scan_result)
+    let si: Int = 0
+    while si < scan_len {
+        let s_node: String = json_array_get(scan_result, si)
+        let s_tier: String = json_get(s_node, "tier")
+        let s_id: String = json_get(s_node, "id")
+        if str_eq(s_tier, "Canonical") && !str_eq(s_id, "") {
+            engram_strengthen(s_id)
+            let strengthened = strengthened + 1
+        }
+        let si = si + 1
+    }
+
+    let total_nodes: Int = engram_node_count()
     return "{\"scanned\":" + int_to_str(scanned)
         + ",\"total_nodes\":" + int_to_str(total_nodes)
-        + ",\"total_edges\":" + int_to_str(total_edges) + "}"
+        + ",\"total_edges\":" + int_to_str(total_edges)
+        + ",\"strengthened\":" + int_to_str(strengthened) + "}"
 }
 
 fn mem_save(path: String) -> Void {
-    engram_save(path)
+    // engram_save returns an Int (1 = ok, 0 = failure), NOT a String. Calling
+    // str_eq on it casts EL_CSTR(1) -> (char*)0x1 and SIGSEGVs on a SUCCESSFUL
+    // save — which is exactly what a fresh-install genesis boot does first
+    // (seeds the brain, saves, crashes). This is issue #150. Check the Int.
+    let saved: Int = engram_save(path)
+    if saved == 0 {
+        println("[memory] mem_save: engram_save failed for " + path + " — snapshot may be incomplete")
+    }
 }
 
 fn mem_load(path: String) -> Void {
@@ -68,19 +257,95 @@ fn mem_boot_count_get() -> Int {
     return str_to_int(num_str)
 }
 
-// mem_boot_count_inc — increment boot counter, store new node, return new count.
-// Each boot creates a new "soul:boot_count:N" node. Old ones accumulate as
-// history — the search above always returns the highest value seen.
+// mem_boot_count_inc — increment boot counter, store a single canonical node, return new count.
+// Prunes ALL existing soul:boot_count nodes before inserting the new one so there is
+// always at most ONE such node in the graph. Without pruning, engram_node_full inserts
+// a new node every boot (no upsert) and the old ones accumulate. The search-first
+// approach also fixes a latent ordering bug: engram_search_json returns oldest-first,
+// so mem_boot_count_get() with limit=3 would read a stale (lower) count once more
+// than 3 copies accumulate.
 fn mem_boot_count_inc() -> Int {
     let current: Int = mem_boot_count_get()
     let next: Int = current + 1
+    // Prune all existing boot_count nodes — keep exactly one.
+    let old_results: String = engram_search_json("soul:boot_count", 50)
+    if !str_eq(old_results, "") && !str_eq(old_results, "[]") {
+        let old_len: Int = json_array_len(old_results)
+        let oi: Int = 0
+        while oi < old_len {
+            let old_node: String = json_array_get(old_results, oi)
+            let old_id: String = json_get(old_node, "id")
+            if !str_eq(old_id, "") {
+                engram_forget(old_id)
+            }
+            let oi = oi + 1
+        }
+    }
     let content: String = "soul:boot_count:" + int_to_str(next)
     let tags: String = "[\"soul-meta\",\"boot-counter\"]"
-    let discard: String = engram_node_full(
+    // TELEMETRY DEMOTION (2026-07-24 self-review): this counter was written at
+    // salience 0.9 / importance 0.9 / tier Canonical — Canonical gets +0.2
+    // goal bias and the 0.15 promotion threshold, so three stale copies of a
+    // BOOT COUNTER held the top working-memory slots (wm 0.31+) for 23h,
+    // crowding out real context. It is plumbing, not memory. Working tier:
+    // 0.40 threshold, no tier bias, and the /api/sync route excludes
+    // Working-tier nodes — so the counter also stops leaking to the engram
+    // server graph, which is where the duplicate copies accumulated (the
+    // prune below only reaches the soul's local graph). Persistence across
+    // restarts comes from the soul's own snapshot (mem_save), not from sync.
+    let boot_node_id: String = engram_node_full(
         content, "Memory", "soul:boot_count",
-        el_from_float(0.9), el_from_float(0.9), el_from_float(1.0),
-        "Canonical", tags
+        el_from_float(0.55), el_from_float(0.2), el_from_float(1.0),
+        "Working", tags
     )
+    if str_eq(boot_node_id, "") {
+        println("[memory] mem_boot_count_inc: write rejected (empty id) — boot counter node lost (count=" + int_to_str(next) + ")")
+        return next
+    }
+    let boot_readback: String = engram_get_node_json(boot_node_id)
+    if str_eq(boot_readback, "") || str_eq(boot_readback, "{}") {
+        println("[memory] mem_boot_count_inc: WRITE VERIFY FAILED id=" + boot_node_id + " count=" + int_to_str(next))
+    }
+    // HTTP WRITE-BACK (2026-07-24 self-review): in HTTP-engram mode the server
+    // owns persistence and the soul's in-process graph dies with the process —
+    // the local create above is invisible to the next boot. The counter only
+    // ever "persisted" via a long-gone push path, which is why the log shows
+    // boot #5 on three consecutive boots. Mirror the persona write-back
+    // pattern: delete stale server copies (dupes were the 23h WM-pollution
+    // bug), then create the demoted replacement server-side. Boot seeding
+    // reads /api/nodes, which includes Working-tier nodes, so the count
+    // survives restarts; the periodic /api/sync excludes Working tier, so it
+    // never re-imports mid-session. Fail-soft: on any HTTP error the counter
+    // is in-memory-only this session, same as before.
+    let wb_url: String = env("ENGRAM_URL")
+    let wb_key: String = env("ENGRAM_API_KEY")
+    if !str_eq(wb_url, "") && !str_eq(wb_key, "") {
+        let auth_body: String = "{\"_auth\":\"" + json_safe(wb_key) + "\"}"
+        let srv_old: String = http_get(wb_url + "/api/search?q=soul:boot_count&limit=20")
+        if !str_eq(srv_old, "") && !str_eq(srv_old, "[]") {
+            let srv_len: Int = json_array_len(srv_old)
+            let si: Int = 0
+            while si < srv_len {
+                let srv_node: String = json_array_get(srv_old, si)
+                // Match by CONTENT prefix, not label: route_create_node sets
+                // label = content, so server-side counter nodes carry labels
+                // like "soul:boot_count:6". (2026-07-24)
+                let srv_content: String = json_get(srv_node, "content")
+                if str_starts_with(srv_content, "soul:boot_count:") {
+                    let srv_id: String = json_get(srv_node, "id")
+                    if !str_eq(srv_id, "") {
+                        http_delete_json(wb_url + "/api/nodes/" + srv_id, auth_body)
+                    }
+                }
+                let si = si + 1
+            }
+        }
+        let wb_body: String = "{\"content\":\"" + content + "\",\"node_type\":\"Memory\",\"label\":\"soul:boot_count\",\"salience\":0.55,\"importance\":0.2,\"tier\":\"Working\",\"tags\":\"[\\\"soul-meta\\\",\\\"boot-counter\\\"]\",\"_auth\":\"" + json_safe(wb_key) + "\"}"
+        let wb_resp: String = http_post_json(wb_url + "/api/nodes", wb_body)
+        if str_contains(wb_resp, "\"error\"") {
+            println("[memory] mem_boot_count_inc: HTTP write-back failed (count in-memory only): " + wb_resp)
+        }
+    }
     return next
 }
 
@@ -98,9 +363,13 @@ fn mem_emit_state_event(trigger: String, kind: String, content: String) -> Strin
         + ",\"boot\":" + int_to_str(boot)
         + ",\"ts\":" + int_to_str(ts) + "}"
     let tags: String = "[\"internal-state\",\"pre-reasoning\",\"InternalStateEvent\"]"
-    return engram_node_full(
+    let event_id: String = engram_node_full(
         payload, "InternalStateEvent", "state-event:" + kind,
         el_from_float(0.85), el_from_float(0.8), el_from_float(0.9),
         "Episodic", tags
     )
+    if str_eq(event_id, "") {
+        println("[memory] mem_emit_state_event: write rejected (empty id): kind=" + kind)
+    }
+    return event_id
 }

neuron-api.elh

@@ -8,9 +8,14 @@ extern fn api_ok(extra: String) -> String
 extern fn api_err(msg: String) -> String
 extern fn api_nonempty(s: String) -> Bool
 extern fn api_or_empty(s: String) -> String
+extern fn api_persisted(id: String) -> Bool
+extern fn api_not_persisted(id: String) -> String
 extern fn handle_api_begin_session(body: String) -> String
 extern fn handle_api_compile_ctx(body: String) -> String
 extern fn handle_api_remember(body: String) -> String
+extern fn handle_api_node_create(body: String) -> String
+extern fn handle_api_node_delete(body: String) -> String
+extern fn handle_api_node_update(body: String) -> String
 extern fn handle_api_recall(method: String, path: String, body: String) -> String
 extern fn handle_api_search_knowledge(method: String, path: String, body: String) -> String
 extern fn handle_api_browse_knowledge(path: String, body: String) -> String
@@ -27,6 +32,9 @@ extern fn handle_api_inspect_graph(method: String, path: String, body: String) -
 extern fn handle_api_link_entities(body: String) -> String
 extern fn handle_api_forget(body: String) -> String
 extern fn handle_api_evolve_memory(body: String) -> String
+extern fn handle_api_memory_delete(body: String) -> String
+extern fn handle_api_memory_update(body: String) -> String
 extern fn handle_api_cultivate(body: String) -> String
 extern fn handle_api_list_typed(node_type: String, path: String, body: String) -> String
 extern fn handle_api_consolidate(body: String) -> String
+extern fn handle_api_structural_audit(method: String, path: String, body: String) -> String

neuron-dev-setup/README.md

@@ -0,0 +1,171 @@
+# neuron-dev-setup — one-command Neuron CORE dev stack
+
+Stand up an identical **Neuron brain + agent** on a fresh Mac so any developer
+gets the same local runtime to build against. This is the **CORE** dev stack
+only — the four native `launchd` services that make Neuron think, remember, and
+speak MCP to Claude Code. Will's personal automations (catalyst, telegram,
+vessels, studio, self-review, world-integrator, council, compressor, snapshots,
+act-runner, …) are **deliberately excluded**.
+
+```
+  ┌─────────────┐        ┌──────────────┐
+  │  soul :7770 │ ─────► │ engram :8742 │     the mind ──► its memory substrate
+  └─────────────┘        └──────────────┘
+        ▲
+        │
+  ┌───────────────────┐
+  │ mcp-wrapper :17779│  ─── MCP surface over the soul HTTP API (internal)
+  └───────────────────┘
+        ▲
+        │
+  ┌────────────────┐
+  │ mcp-proxy :7779│  ◄─── Claude Code connects here (stable front door)
+  └────────────────┘
+```
+
+Claude Code's `neuron` MCP server points at `http://127.0.0.1:7779/` — the proxy.
+The proxy forwards to the wrapper (`:17779`), which calls the soul (`:7770`),
+which reads/writes the engram (`:8742`). The engram is the persistent brain.
+
+## Quick start
+
+```bash
+git clone <this-repo> && cd neuron-dev-setup
+cp config.env.example config.env      # optional — edit ports/paths if you like
+./install.sh                          # prompts for your Anthropic API key
+```
+
+Then verify:
+
+```bash
+curl http://localhost:8742/health     # engram
+curl http://localhost:7770/health         # soul
+curl http://localhost:7779/health         # mcp-proxy (what Claude Code uses)
+launchctl list | grep ai.neuron
+```
+
+Open Claude Code — the `neuron` MCP tools should be live, backed by **your own**
+local brain. `./install.sh --dry-run` shows every action without touching anything.
+
+## What the installer does (8 phases)
+
+| Phase | Action |
+|------|--------|
+| 1 | Preflight: macOS/arm64, ensure `git cc curl python3` + `openssl@3` (via Homebrew) |
+| 2 | Prompt for the **Anthropic API key**, store it in the **macOS Keychain** (never a file) |
+| 3 | Clone `neuron`, `engram`, `foundation`; fetch the El toolchain; build 4 binaries + `forge` |
+| 4 | Lay down `~/.neuron/{bin,logs,engram}` and the templated `soul-wrapper.sh` |
+| 5 | Generate + load the 4 core LaunchAgents (engram → soul → wrapper → proxy) |
+| 6 | Seed a fresh engram with the **genesis identity** via `forge install` |
+| 7 | Install Claude config: `neuron` agent, core hooks, local MCP registration |
+| 8 | Health-check all four ports |
+
+Everything is **idempotent** (safe to re-run) and **templated** to the invoking
+user's `$HOME` — no path is hardcoded to another machine.
+
+## Prerequisites
+
+- macOS on Apple Silicon (uses `launchd`; soul build flags assume arm64).
+- **Xcode Command Line Tools** (`xcode-select --install`) — provides `cc`, `git`.
+- **Homebrew** — for `openssl@3`, `curl`.
+- An **Anthropic API key** — the soul's inference provider. Prompted for; stored
+  in Keychain under service `neuron-llm-0-key`; read at launch by `soul-wrapper.sh`.
+- **Git access** to Gitea (`git.neuralplatform.ai`) for the source repos.
+- **GCP access** to project `neuron-785695` Artifact Registry (default El
+  toolchain source). Ask Will to grant it, or set `EL_TOOLCHAIN_SOURCE=local`.
+
+## Core-stack map (what gets replicated)
+
+| Service | Port | Binary | Built from | LaunchAgent |
+|---------|------|--------|------------|-------------|
+| soul | 7770 | `neuron/dist/neuron` | `dist/soul.c` + El runtime, `cc` (CI recipe) | `ai.neuron.soul` |
+| engram | 8742 | `engram/dist/engram` | `engram` repo `src/server.el` via `elc`→`cc` | `ai.neuron.engram` |
+| mcp-wrapper | 17779 | `neuron/mcp-wrapper/dist/neuron-mcp-wrapper` | `mcp-wrapper/src/main.el` | `ai.neuron.mcp-wrapper` |
+| mcp-proxy | 7779 | `neuron/mcp-proxy/dist/neuron-mcp-proxy` | `mcp-proxy/src/main.el` | `ai.neuron.mcp-proxy` |
+
+**`~/.neuron` layout the installer creates**
+
+```
+~/.neuron/
+  bin/soul-wrapper.sh     # reads Anthropic key from Keychain, execs the soul binary
+  logs/                   # soul.*.log, engram.log, mcp-*.log
+  engram/                 # ENGRAM_DATA_DIR — the persistent brain (snapshot.json + db)
+```
+
+**Identity seed.** `foundation/forge/seeds/neuron-genesis-seed.json` carries
+`identity_nodes[]` + `edges[]` with **fixed** knowledge-node IDs (e.g.
+`kn-efeb4a5b-5aff-4759-8a97-7233099be6ee`, the "self" traversal root). Those exact
+IDs are referenced by the SessionStart self-load hook and the neuron agent, so
+seeding must **preserve IDs** — `forge install <seed>` is the mechanism.
+
+**Claude config installed** (`~/.claude/`)
+
+- `agents/neuron.md` — the Neuron agent (identity, session protocol, five primitives).
+- `mcp.json` — registers `neuron` → `http://127.0.0.1:7779/`.
+- `settings.json` hooks (CORE subset only):
+  - `SessionStart` → `neuron-self-load.sh` (loads identity from the seeded engram)
+  - `PreToolUse:Agent` → `neuron-agent-preamble.sh` (subagents load substrate first)
+  - `PreCompact` → `pre-compact.sh` (clean context recovery)
+
+### Deliberately EXCLUDED from core
+
+- **`check-active-contexts.sh`** and **`require-execution-context.sh`** — these
+  depend on a separate filesystem repo `~/Development/projects/active/neuron/synapse`.
+  `require-execution-context.sh` is a hard `Edit/Write` gate that would **block a
+  fresh dev from editing any file** without that synapse repo. Not core; excluded.
+- `engram-mirror.py` (PostToolUse) — optional; mirrors MCP writes to engram.
+- All Will-personal LaunchAgents: `catalyst-*`, `telegram-gateway`, `vessel.*`,
+  `studio`, `self-review`, `world-integrator`, `council`, `compressor`,
+  `cultivation-digest`, `snapshot-backup`, `engram-backup`, `act-runner`, `keymap`,
+  `invest`, and the disabled `ai.neuron.api` (`:7771` is a personal Python
+  perception helper — confirmed not core).
+
+## Secrets — how they're handled
+
+- **Anthropic key**: prompted for; stored in Keychain; read at launch. Never in a
+  plist, this repo, or a log.
+- **Engram local token** (`ENGRAM_API_KEY`): a *loopback-only* dev token, not a
+  cloud secret. Defaults to a generated `ntn-dev-*` value; override in `config.env`.
+- No cloud tokens, Vault tokens, CF-Access secrets, or founder keys are copied.
+  (Will's live `start-daemon.sh`/`neuron-api-launch.sh` contain such keys — this
+  installer intentionally does **not** use those files.)
+
+## Uninstall
+
+```bash
+./uninstall.sh                # stop + remove the 4 LaunchAgents and added Claude hooks
+./uninstall.sh --purge-data   # ALSO delete ~/.neuron/engram (destroys the brain)
+```
+
+## OPEN QUESTIONS (need Will to confirm)
+
+1. **El toolchain acquisition.** The default path fetches `el-runtime-c/-h` and
+   `el-elc` from GCP Artifact Registry (mirrors `neuron/.gitea/workflows/ci.yaml`).
+   A new dev needs GCP access to `neuron-785695`. Is that the intended path, or
+   should the El SDK be published/vendored for onboarding?
+2. **`elc` invocation for engram/wrapper/proxy.** The soul build (`cc dist/soul.c
+   + el_runtime.c`) is verified from CI. The `.el → .c` transpile step for engram,
+   mcp-wrapper, and mcp-proxy is inferred (`elc <src> -o <out.c>`). Confirm the
+   exact flags / entrypoints (CI notes `elb` OOMs on Linux; macOS builds differ).
+3. **`forge install` ID preservation.** Confirm `forge install` writes the seed's
+   fixed `kn-` IDs verbatim (the self-load hook hardcodes `kn-efeb4a5b…`). If it
+   re-mints IDs, the hook + agent identity load would break on a fresh brain.
+4. **engram repo layout.** The live engram binary is built from `src/server.el`
+   (Gitea repo `neuron-technologies/engram`, cloned in CI). Confirm that repo is
+   the canonical source for onboarding (the local `foundation/el/engram` copy has
+   the same `src/server.el`).
+5. **Home for this bundle** — see below.
+
+## Where this should live (recommendation)
+
+**Recommendation: a dedicated `neuron-dev-setup` (or `neuron-onboarding`) repo —
+NOT `neuron-code`.** `neuron-code` already exists as a real product ("Neuron Code",
+a coding tool with `nc-cli` + vessels — local `products/neuron-code` has commits);
+repurposing it for onboarding would collide with a shipped product's identity.
+
+This bundle was scaffolded as `neuron-dev-setup/` on branch `feat/neuron-dev-setup`
+in the **`neuron` repo** (off `origin/main`) and opened as a PR for review, because
+the neuron repo already hosts the soul source, the verified CI build recipe, and
+the mcp-wrapper/proxy sources — the natural review surface. If you'd rather it be
+its own repo, move this directory into a fresh `neuron-dev-setup` repo verbatim;
+nothing here depends on living inside the neuron repo.

neuron-dev-setup/config.env.example

@@ -0,0 +1,45 @@
+# neuron-dev-setup — configuration
+# Copy to  config.env  and edit if you want non-default paths/ports.
+# install.sh sources this file if it exists; otherwise it uses these defaults.
+# NOTHING here is a secret. The Anthropic API key is read from your Keychain,
+# never from this file. See README.md.
+
+# ── Where the core stack lives ────────────────────────────────────────────────
+# All paths are relative to your own $HOME — never hardcode another user's home.
+NEURON_HOME="${HOME}/.neuron"                       # runtime home: bin/, logs/, engram data
+DEV_ROOT="${HOME}/Development/neuron-technologies"   # where source repos are cloned/built
+
+# ── Git remotes (Gitea is primary) ───────────────────────────────────────────
+GITEA_BASE="git@git.neuralplatform.ai:neuron-technologies"
+NEURON_REPO_URL="${GITEA_BASE}/neuron.git"          # soul + mcp-wrapper + mcp-proxy source
+ENGRAM_REPO_URL="${GITEA_BASE}/engram.git"          # engram memory substrate
+# NOTE: there is no foundation.git repo. The El toolchain is fetched via
+# EL_TOOLCHAIN_SOURCE below; the forge seed installer is optional (Phase 6).
+NEURON_REPO_BRANCH="main"
+
+# ── Ports (must match across services; change only if a port clashes) ─────────
+SOUL_PORT="7770"        # soul daemon HTTP API
+ENGRAM_PORT="8742"      # engram memory substrate
+WRAPPER_PORT="17779"    # mcp-wrapper (internal, talks to soul)
+PROXY_PORT="7779"       # mcp-proxy (stable front door Claude Code connects to)
+
+# ── Engram ────────────────────────────────────────────────────────────────────
+ENGRAM_DATA_DIR="${NEURON_HOME}/engram"
+# Local shared auth token for the engram/soul HTTP APIs on loopback. This is a
+# LOCAL dev token (not a cloud secret); override it if you like. install.sh will
+# generate a random one if you leave it empty.
+ENGRAM_API_KEY="ntn-dev-local"
+
+# ── El toolchain source (needed to build engram / mcp-wrapper / mcp-proxy) ────
+# Option A (default): fetch prebuilt El runtime + elc from GCP Artifact Registry
+#   (requires `gcloud auth` with access to project neuron-785695 — ask Will).
+#   Without gcloud the installer skips the El-dependent builds and still completes.
+# Option B: use a prebuilt El toolchain (elc + el_runtime.{c,h}) you have already
+#   staged in ${DEV_ROOT}/.el-runtime.
+EL_TOOLCHAIN_SOURCE="artifact-registry"   # artifact-registry | local
+GCP_PROJECT="neuron-785695"
+GCP_AR_REPO="foundation-prod"
+GCP_AR_LOCATION="us-central1"
+
+# ── Keychain service name for the Anthropic key (read by soul-wrapper.sh) ─────
+KEYCHAIN_SERVICE="neuron-llm-0-key"

neuron-dev-setup/install.sh

@@ -0,0 +1,441 @@
+#!/usr/bin/env bash
+#
+# neuron-dev-setup / install.sh
+# ─────────────────────────────────────────────────────────────────────────────
+# One-command onboarding for the Neuron CORE dev stack on a fresh Mac.
+#
+# Stands up, as native launchd services, the four processes a developer needs to
+# have an identical "Neuron brain + agent" to build against:
+#
+#     soul  (:7770)  ──►  engram (:8742)        the mind + its memory substrate
+#       ▲                     ▲
+#       │                     │
+#   mcp-wrapper (:17779) ──►  soul              MCP surface over the soul API
+#       ▲
+#       │
+#   mcp-proxy   (:7779)  ◄── Claude Code        stable MCP front door
+#
+# It also seeds a fresh engram with Neuron's identity (the genesis seed) and lays
+# down the Claude Code config (neuron agent + core hooks + local MCP registration)
+# so a new dev's `claude` talks to *their own* local Neuron.
+#
+# DESIGN RULES
+#   * Idempotent: safe to re-run. Existing state is detected and reused.
+#   * Templated: every path/port/user is derived from $HOME and config.env.
+#     Nothing is hardcoded to another developer's machine.
+#   * Secret-free: the Anthropic key is prompted for and stored in the macOS
+#     Keychain. No key is ever written to a plist, this repo, or a logfile.
+#
+# USAGE
+#   ./install.sh                 # full install
+#   ./install.sh --dry-run       # print what would happen, touch nothing
+#   ./install.sh --skip-build    # assume binaries already built (see --use-local)
+#   ./install.sh --skip-services # lay down files but don't load LaunchAgents
+#   ./install.sh --help
+# ─────────────────────────────────────────────────────────────────────────────
+set -euo pipefail
+
+# ── Locate ourselves ─────────────────────────────────────────────────────────
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+TEMPLATES="${SCRIPT_DIR}/templates"
+
+# ── Flags ────────────────────────────────────────────────────────────────────
+DRY_RUN=0; SKIP_BUILD=0; SKIP_SERVICES=0; USE_LOCAL_BINARIES=0
+for arg in "$@"; do
+  case "$arg" in
+    --dry-run)       DRY_RUN=1 ;;
+    --skip-build)    SKIP_BUILD=1 ;;
+    --skip-services) SKIP_SERVICES=1 ;;
+    --use-local)     USE_LOCAL_BINARIES=1 ;;
+    --help|-h)
+      sed -n '2,40p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'
+      exit 0 ;;
+    *) echo "unknown flag: $arg" >&2; exit 2 ;;
+  esac
+done
+
+# ── Pretty logging ───────────────────────────────────────────────────────────
+c_blue=$'\033[1;34m'; c_grn=$'\033[1;32m'; c_yel=$'\033[1;33m'; c_red=$'\033[1;31m'; c_off=$'\033[0m'
+step() { echo "${c_blue}▶${c_off} $*"; }
+ok()   { echo "${c_grn}✓${c_off} $*"; }
+warn() { echo "${c_yel}!${c_off} $*"; }
+die()  { echo "${c_red}✗ $*${c_off}" >&2; exit 1; }
+run()  { if [ "$DRY_RUN" = 1 ]; then echo "   [dry-run] $*"; else eval "$*"; fi; }
+
+# ── Load config ──────────────────────────────────────────────────────────────
+if [ -f "${SCRIPT_DIR}/config.env" ]; then
+  # shellcheck disable=SC1091
+  source "${SCRIPT_DIR}/config.env"
+else
+  # shellcheck disable=SC1091
+  source "${SCRIPT_DIR}/config.env.example"
+  warn "No config.env found — using defaults from config.env.example."
+fi
+
+# Derived / defaulted values (never hardcode a home directory)
+: "${NEURON_HOME:=${HOME}/.neuron}"
+: "${DEV_ROOT:=${HOME}/Development/neuron-technologies}"
+: "${SOUL_PORT:=7770}"; : "${ENGRAM_PORT:=8742}"; : "${WRAPPER_PORT:=17779}"; : "${PROXY_PORT:=7779}"
+: "${ENGRAM_DATA_DIR:=${NEURON_HOME}/engram}"
+: "${ENGRAM_API_KEY:=}"
+: "${KEYCHAIN_SERVICE:=neuron-llm-0-key}"
+: "${EL_TOOLCHAIN_SOURCE:=artifact-registry}"
+: "${NEURON_REPO_BRANCH:=main}"
+
+NEURON_REPO="${DEV_ROOT}/neuron"
+ENGRAM_REPO="${DEV_ROOT}/engram"
+FOUNDATION_REPO="${DEV_ROOT}/foundation"
+
+SOUL_BIN="${NEURON_REPO}/dist/neuron"
+ENGRAM_BIN="${ENGRAM_REPO}/dist/engram"
+MCP_WRAPPER_BIN="${NEURON_REPO}/mcp-wrapper/dist/neuron-mcp-wrapper"
+MCP_PROXY_BIN="${NEURON_REPO}/mcp-proxy/dist/neuron-mcp-proxy"
+FORGE_BIN="${FOUNDATION_REPO}/forge/dist/forge"
+GENESIS_SEED="${FOUNDATION_REPO}/forge/seeds/neuron-genesis-seed.json"
+
+LAUNCHAGENTS="${HOME}/Library/LaunchAgents"
+CLAUDE_DIR="${HOME}/.claude"
+
+# Generate a local engram token if none was supplied.
+if [ -z "${ENGRAM_API_KEY}" ]; then
+  ENGRAM_API_KEY="ntn-dev-$(head -c8 /dev/urandom | xxd -p 2>/dev/null || echo local)"
+fi
+
+echo
+echo "${c_blue}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${c_off}"
+echo "${c_blue}  Neuron CORE dev stack installer${c_off}"
+echo "${c_blue}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${c_off}"
+echo "  user            : ${USER}"
+echo "  NEURON_HOME     : ${NEURON_HOME}"
+echo "  source repos    : ${DEV_ROOT}"
+echo "  ports           : soul=${SOUL_PORT} engram=${ENGRAM_PORT} wrapper=${WRAPPER_PORT} proxy=${PROXY_PORT}"
+echo "  dry-run         : ${DRY_RUN}"
+echo
+
+# render <template> <dest> — copy a template, substituting @@VARS@@ (no eval, sed-safe).
+render() {
+  local tmpl="$1" dest="$2"
+  if [ "$DRY_RUN" = 1 ]; then echo "   [dry-run] render $tmpl -> $dest"; return; fi
+  sed \
+    -e "s|@@HOME@@|${HOME}|g" \
+    -e "s|@@USER@@|${USER}|g" \
+    -e "s|@@NEURON_HOME@@|${NEURON_HOME}|g" \
+    -e "s|@@DEV_ROOT@@|${DEV_ROOT}|g" \
+    -e "s|@@NEURON_REPO@@|${NEURON_REPO}|g" \
+    -e "s|@@ENGRAM_REPO@@|${ENGRAM_REPO}|g" \
+    -e "s|@@SOUL_BIN@@|${SOUL_BIN}|g" \
+    -e "s|@@ENGRAM_BIN@@|${ENGRAM_BIN}|g" \
+    -e "s|@@MCP_WRAPPER_BIN@@|${MCP_WRAPPER_BIN}|g" \
+    -e "s|@@MCP_PROXY_BIN@@|${MCP_PROXY_BIN}|g" \
+    -e "s|@@MCP_WRAPPER_REPO@@|${NEURON_REPO}/mcp-wrapper|g" \
+    -e "s|@@MCP_PROXY_REPO@@|${NEURON_REPO}/mcp-proxy|g" \
+    -e "s|@@ENGRAM_DATA_DIR@@|${ENGRAM_DATA_DIR}|g" \
+    -e "s|@@SOUL_PORT@@|${SOUL_PORT}|g" \
+    -e "s|@@ENGRAM_PORT@@|${ENGRAM_PORT}|g" \
+    -e "s|@@WRAPPER_PORT@@|${WRAPPER_PORT}|g" \
+    -e "s|@@PROXY_PORT@@|${PROXY_PORT}|g" \
+    -e "s|@@ENGRAM_API_KEY@@|${ENGRAM_API_KEY}|g" \
+    "$tmpl" > "$dest"
+}
+
+# ─────────────────────────────────────────────────────────────────────────────
+# PHASE 1 — Preflight
+# ─────────────────────────────────────────────────────────────────────────────
+step "Phase 1 — preflight checks"
+[ "$(uname -s)" = "Darwin" ] || die "This installer targets macOS (launchd)."
+[ "$(uname -m)" = "arm64" ]  || warn "Non-arm64 Mac: soul.c build flags assume Apple Silicon; review PHASE 3."
+
+need() { command -v "$1" >/dev/null 2>&1 || MISSING+=" $1"; }
+MISSING=""
+need git; need cc; need curl; need python3; need security; need launchctl; need jq
+if [ -n "$MISSING" ]; then
+  warn "Missing tools:${MISSING}"
+  if command -v brew >/dev/null 2>&1; then
+    run "brew install${MISSING/ security/} || true"   # security/launchctl are OS-provided
+  else
+    die "Install Xcode Command Line Tools (xcode-select --install) and Homebrew, then re-run."
+  fi
+fi
+# Runtime build deps used by the soul cc line (-lssl -lcrypto -lcurl).
+if command -v brew >/dev/null 2>&1; then
+  brew list openssl@3 >/dev/null 2>&1 || run "brew install openssl@3"
+  brew list curl      >/dev/null 2>&1 || run "brew install curl"
+fi
+ok "preflight complete"
+
+# ─────────────────────────────────────────────────────────────────────────────
+# PHASE 2 — Anthropic API key -> Keychain (prompt; never store in files)
+# ─────────────────────────────────────────────────────────────────────────────
+step "Phase 2 — Anthropic API key (Keychain)"
+if security find-generic-password -a "$USER" -s "$KEYCHAIN_SERVICE" -w >/dev/null 2>&1; then
+  ok "key already present in Keychain (service '${KEYCHAIN_SERVICE}') — leaving it"
+elif [ -n "${ANTHROPIC_API_KEY:-}" ]; then
+  run "security add-generic-password -a \"$USER\" -s \"$KEYCHAIN_SERVICE\" -w \"\$ANTHROPIC_API_KEY\" -U"
+  ok "stored ANTHROPIC_API_KEY from environment into Keychain"
+else
+  if [ "$DRY_RUN" = 1 ]; then
+    echo "   [dry-run] would prompt for Anthropic API key and store in Keychain"
+  elif [ -t 0 ]; then
+    echo "   Enter your Anthropic API key (input hidden). Get one at https://console.anthropic.com/"
+    read -r -s -p "   ANTHROPIC_API_KEY: " _key; echo
+    [ -n "$_key" ] || die "No key entered. Re-run when you have one."
+    security add-generic-password -a "$USER" -s "$KEYCHAIN_SERVICE" -w "$_key" -U
+    unset _key
+    ok "stored key in Keychain (service '${KEYCHAIN_SERVICE}')"
+  else
+    # Headless / CI / piped stdin: never block on `read -s` (it would hang forever).
+    die "No Anthropic API key and stdin is not a TTY (headless/CI). Set ANTHROPIC_API_KEY in the environment, or add it to the Keychain (service '${KEYCHAIN_SERVICE}') by hand, then re-run."
+  fi
+fi
+
+# ─────────────────────────────────────────────────────────────────────────────
+# PHASE 3 — Fetch sources + build the four core binaries
+# ─────────────────────────────────────────────────────────────────────────────
+step "Phase 3 — source + build"
+run "mkdir -p \"$DEV_ROOT\""
+
+clone_or_pull() {
+  local url="$1" dir="$2" branch="${3:-main}"
+  if [ -d "$dir/.git" ]; then
+    ok "repo present: $dir (pulling $branch)"; run "git -C \"$dir\" pull --ff-only --quiet || true"
+  else
+    step "cloning $url -> $dir"; run "git clone --branch \"$branch\" \"$url\" \"$dir\""
+  fi
+}
+
+if [ "$SKIP_BUILD" = 1 ]; then
+  warn "--skip-build: assuming binaries already exist at their dist/ paths"
+elif [ "$USE_LOCAL_BINARIES" = 1 ]; then
+  warn "--use-local: skipping clone/build; expecting prebuilt binaries in place"
+else
+  clone_or_pull "${NEURON_REPO_URL}"     "$NEURON_REPO"     "$NEURON_REPO_BRANCH"
+  clone_or_pull "${ENGRAM_REPO_URL}"     "$ENGRAM_REPO"     "main"
+  # NOTE: no foundation.git — that repo does not exist. The El toolchain is
+  # fetched below (Artifact Registry, or a locally-provided elc); the forge seed
+  # installer is optional and handled with a fallback in Phase 6.
+
+  # ── El toolchain (needed to transpile .el -> .c for engram/wrapper/proxy) ──
+  # soul does NOT need this: dist/soul.c is committed and compiled directly.
+  EL_RUNTIME_DIR="${DEV_ROOT}/.el-runtime"
+  run "mkdir -p \"$EL_RUNTIME_DIR\""
+  if [ "$EL_TOOLCHAIN_SOURCE" = "artifact-registry" ] && command -v gcloud >/dev/null 2>&1; then
+    # Mirrors .gitea/workflows/ci.yaml: pull el-runtime-c, el-runtime-h, el-elc.
+    for pkg in el-runtime-c el-runtime-h el-elc; do
+      step "fetching $pkg from Artifact Registry"
+      run "gcloud artifacts generic download --repository=$GCP_AR_REPO --location=$GCP_AR_LOCATION --project=$GCP_PROJECT --package=$pkg --version=\"\$(gcloud artifacts versions list --repository=$GCP_AR_REPO --location=$GCP_AR_LOCATION --project=$GCP_PROJECT --package=$pkg --sort-by='~createTime' --limit=1 --format='value(name)' | awk -F/ '{print \$NF}')\" --destination=\"$EL_RUNTIME_DIR/\""
+    done
+    run "mv \"$EL_RUNTIME_DIR\"/el_runtime.c* \"$EL_RUNTIME_DIR/el_runtime.c\" 2>/dev/null || true"
+    run "mv \"$EL_RUNTIME_DIR\"/el_runtime.h* \"$EL_RUNTIME_DIR/el_runtime.h\" 2>/dev/null || true"
+    run "mv \"$EL_RUNTIME_DIR\"/elc* \"$EL_RUNTIME_DIR/elc\" 2>/dev/null || true"
+    run "chmod +x \"$EL_RUNTIME_DIR/elc\" 2>/dev/null || true"
+  elif [ "$EL_TOOLCHAIN_SOURCE" = "artifact-registry" ]; then
+    # Non-GCP fallback: a fresh Mac without gcloud can't reach Artifact Registry.
+    # Don't die — soul (from committed dist/soul.c) still builds below. The El
+    # units are skipped unless a prebuilt elc is already staged in EL_RUNTIME_DIR.
+    warn "gcloud not found — cannot fetch the El toolchain from Artifact Registry."
+    warn "Continuing without it: soul will still build. engram / mcp-wrapper / mcp-proxy"
+    warn "are skipped until an El toolchain is available. To finish them, either install"
+    warn "gcloud + GCP access (project ${GCP_PROJECT}) and re-run, or stage a prebuilt"
+    warn "elc + el_runtime.{c,h} in ${EL_RUNTIME_DIR} and set EL_TOOLCHAIN_SOURCE=local."
+  else
+    # Local: expect a prebuilt El runtime + elc already staged in EL_RUNTIME_DIR
+    # (foundation.git no longer exists, so there is nothing to build from here).
+    warn "EL_TOOLCHAIN_SOURCE=local: expecting el_runtime.{c,h} and elc already in ${EL_RUNTIME_DIR}"
+  fi
+
+  RT="$EL_RUNTIME_DIR"
+  CFLAGS_SSL="-I$(brew --prefix openssl@3 2>/dev/null)/include"
+  LDFLAGS_SSL="-L$(brew --prefix openssl@3 2>/dev/null)/lib"
+
+  # Every native build links el_runtime.c. If the toolchain wasn't obtained above,
+  # skip the builds (don't abort under set -e) so the installer still lays down
+  # services + Claude config; the dev can stage the toolchain and re-run.
+  if [ "$DRY_RUN" = 1 ] || [ -f "$RT/el_runtime.c" ]; then
+    # ── soul: compile committed dist/soul.c directly (verified CI recipe) ──────
+    step "building soul (dist/soul.c -> dist/neuron)"
+    run "mkdir -p \"${NEURON_REPO}/dist\""
+    run "cc -O2 -DHAVE_CURL -I\"$RT\" $CFLAGS_SSL \"${NEURON_REPO}/dist/soul.c\" \"$RT/el_runtime.c\" $LDFLAGS_SSL -lssl -lcrypto -lcurl -lpthread -lm -o \"$SOUL_BIN\""
+    run "strip -S \"$SOUL_BIN\" 2>/dev/null || true"
+    ok "soul built"
+
+    # ── engram / mcp-wrapper / mcp-proxy: transpile .el -> .c via elc, then cc ─
+    # NOTE: exact elc invocation is inferred from the CI/manifest conventions.
+    #       Verify flags with Will if a build fails (see README OPEN QUESTIONS).
+    build_el_unit() { # <src.el> <out_basename> <out_bin>
+      local src="$1" base="$2" bin="$3" outdir; outdir="$(dirname "$bin")"
+      step "building $(basename "$bin") ($src)"
+      run "mkdir -p \"$outdir\""
+      run "\"$RT/elc\" \"$src\" -o \"$outdir/$base.c\""
+      run "cc -O2 -DHAVE_CURL -I\"$RT\" $CFLAGS_SSL \"$outdir/$base.c\" \"$RT/el_runtime.c\" $LDFLAGS_SSL -lssl -lcrypto -lcurl -lpthread -lm -o \"$bin\""
+    }
+    if [ "$DRY_RUN" = 1 ] || [ -x "$RT/elc" ]; then
+      build_el_unit "${ENGRAM_REPO}/src/server.el"           "server" "$ENGRAM_BIN"
+      build_el_unit "${NEURON_REPO}/mcp-wrapper/src/main.el" "main"   "$MCP_WRAPPER_BIN"
+      build_el_unit "${NEURON_REPO}/mcp-proxy/src/main.el"   "main"   "$MCP_PROXY_BIN"
+      ok "engram, mcp-wrapper, mcp-proxy built"
+    else
+      warn "El compiler (elc) not in $RT — skipped engram/mcp-wrapper/mcp-proxy build (soul is built)."
+    fi
+  else
+    warn "El runtime (el_runtime.c) not in $RT — skipping native builds (soul, engram, wrapper, proxy)."
+    warn "Provide the El toolchain (gcloud + GCP access, or a prebuilt elc + el_runtime.{c,h} in $RT), then re-run."
+  fi
+fi
+
+# ─────────────────────────────────────────────────────────────────────────────
+# PHASE 4 — Lay down ~/.neuron (bin/, logs/, engram data dir)
+# ─────────────────────────────────────────────────────────────────────────────
+step "Phase 4 — ~/.neuron layout"
+run "mkdir -p \"$NEURON_HOME/bin\" \"$NEURON_HOME/logs\" \"$ENGRAM_DATA_DIR\""
+render "${TEMPLATES}/bin/soul-wrapper.sh.tmpl" "${NEURON_HOME}/bin/soul-wrapper.sh"
+run "chmod +x \"${NEURON_HOME}/bin/soul-wrapper.sh\""
+ok "~/.neuron ready (bin/soul-wrapper.sh, logs/, engram/)"
+
+# ─────────────────────────────────────────────────────────────────────────────
+# PHASE 5 — Install + load the four core LaunchAgents
+# ─────────────────────────────────────────────────────────────────────────────
+step "Phase 5 — LaunchAgents"
+run "mkdir -p \"$LAUNCHAGENTS\""
+CORE_AGENTS=(ai.neuron.engram ai.neuron.soul ai.neuron.mcp-wrapper ai.neuron.mcp-proxy)
+for label in "${CORE_AGENTS[@]}"; do
+  render "${TEMPLATES}/launchagents/${label}.plist.tmpl" "${LAUNCHAGENTS}/${label}.plist"
+  ok "wrote ${label}.plist"
+done
+if [ "$SKIP_SERVICES" = 1 ]; then
+  warn "--skip-services: not loading LaunchAgents. Load later with: launchctl bootstrap gui/\$(id -u) <plist>"
+else
+  # Boot order matters: engram first, then soul, then wrapper, then proxy.
+  for label in "${CORE_AGENTS[@]}"; do
+    plist="${LAUNCHAGENTS}/${label}.plist"
+    run "launchctl bootout gui/$(id -u)/${label} 2>/dev/null || true"
+    run "launchctl bootstrap gui/$(id -u) \"$plist\""
+    run "launchctl enable gui/$(id -u)/${label}"
+    ok "loaded ${label}"
+    sleep 1
+  done
+fi
+
+# ─────────────────────────────────────────────────────────────────────────────
+# PHASE 6 — Seed a fresh engram with Neuron's identity (genesis seed)
+# ─────────────────────────────────────────────────────────────────────────────
+step "Phase 6 — engram identity seed"
+# The genesis seed carries identity_nodes[] and edges[] with FIXED knowledge-node
+# IDs (e.g. kn-efeb4a5b...). Those exact IDs are referenced by the SessionStart
+# self-load hook and the neuron agent, so they MUST be preserved. `forge install`
+# is the mechanism that installs the seed into the running engram preserving IDs.
+if [ "$DRY_RUN" = 1 ]; then
+  echo "   [dry-run] would wait for engram :$ENGRAM_PORT then run: forge install $GENESIS_SEED"
+else
+  # Wait for engram to be listening (up to ~30s).
+  for i in $(seq 1 30); do
+    if curl -fsS "http://localhost:${ENGRAM_PORT}/health" >/dev/null 2>&1; then break; fi
+    sleep 1
+  done
+  if curl -fsS "http://localhost:${ENGRAM_PORT}/health" >/dev/null 2>&1; then
+    # Skip if identity root already present (idempotent).
+    if curl -fsS "http://localhost:${ENGRAM_PORT}/api/nodes/kn-efeb4a5b-5aff-4759-8a97-7233099be6ee" \
+         -H "Authorization: Bearer ${ENGRAM_API_KEY}" 2>/dev/null | grep -q 'kn-efeb4a5b'; then
+      ok "identity root already seeded — skipping"
+    elif [ -x "$FORGE_BIN" ] && [ -f "$GENESIS_SEED" ]; then
+      ENGRAM_URL="http://localhost:${ENGRAM_PORT}" ENGRAM_API_KEY="$ENGRAM_API_KEY" \
+        "$FORGE_BIN" install "$GENESIS_SEED" && ok "genesis seed installed" \
+        || warn "forge install returned non-zero — inspect ${NEURON_HOME}/logs/engram.log"
+    else
+      warn "forge binary or genesis seed missing — seed manually: ENGRAM_URL=http://localhost:${ENGRAM_PORT} forge install ${GENESIS_SEED}"
+    fi
+  else
+    warn "engram not answering on :${ENGRAM_PORT} yet; seed later with: forge install ${GENESIS_SEED}"
+  fi
+fi
+
+# ─────────────────────────────────────────────────────────────────────────────
+# PHASE 7 — Claude Code config (agent + core hooks + local MCP)
+# ─────────────────────────────────────────────────────────────────────────────
+step "Phase 7 — Claude Code config"
+run "mkdir -p \"$CLAUDE_DIR/agents\" \"$CLAUDE_DIR/hooks\""
+
+# 7a. neuron agent
+run "cp \"${TEMPLATES}/claude/agents/neuron.md\" \"$CLAUDE_DIR/agents/neuron.md\""
+ok "installed agent: ~/.claude/agents/neuron.md"
+
+# 7b. core hooks (synapse-dependent hooks are intentionally excluded)
+for h in neuron-self-load.sh neuron-agent-preamble.sh pre-compact.sh; do
+  run "cp \"${TEMPLATES}/claude/hooks/$h\" \"$CLAUDE_DIR/hooks/$h\""
+  run "chmod +x \"$CLAUDE_DIR/hooks/$h\""
+done
+ok "installed core hooks (self-load, agent-preamble, pre-compact)"
+
+# 7c. local MCP registration -> mcp-proxy front door.
+# Claude Code reads MCP servers from ~/.claude.json (the "mcpServers" key), NOT
+# ~/.claude/mcp.json. Render a reference copy, then jq-merge just the "neuron"
+# entry into ~/.claude.json so we preserve every other server and top-level key.
+render "${TEMPLATES}/claude/mcp.json.tmpl" "${CLAUDE_DIR}/mcp.json.neuron"
+CLAUDE_JSON="${HOME}/.claude.json"
+if [ "$DRY_RUN" = 1 ]; then
+  echo "   [dry-run] merge mcpServers.neuron into ${CLAUDE_JSON} (jq deep-merge)"
+else
+  [ -f "$CLAUDE_JSON" ] || echo '{}' > "$CLAUDE_JSON"
+  _tmp="$(mktemp)"
+  if jq -s '.[0] * .[1]' "$CLAUDE_JSON" "${CLAUDE_DIR}/mcp.json.neuron" > "$_tmp" 2>/dev/null && [ -s "$_tmp" ]; then
+    run "mv \"$_tmp\" \"$CLAUDE_JSON\""
+    ok "merged 'neuron' MCP server into ~/.claude.json (neuron -> http://127.0.0.1:${PROXY_PORT}/)"
+  else
+    rm -f "$_tmp"
+    warn "could not jq-merge ~/.claude.json (invalid JSON?) — add 'neuron' from ~/.claude/mcp.json.neuron by hand"
+  fi
+fi
+
+# 7d. settings hooks — merge the neuron hooks into any existing ~/.claude/settings.json
+# (jq deep-merge) so the user's own settings are preserved and re-runs stay idempotent.
+if [ -f "${CLAUDE_DIR}/settings.json" ]; then
+  run "cp \"${TEMPLATES}/claude/settings.core.json\" \"${CLAUDE_DIR}/settings.core.json\""
+  if [ "$DRY_RUN" = 1 ]; then
+    echo "   [dry-run] merge neuron hooks from settings.core.json into ~/.claude/settings.json (jq)"
+  else
+    _tmp="$(mktemp)"
+    # Drop the documentation-only "//..." keys before merging into the real file.
+    if jq -s '.[0] * (.[1] | with_entries(select(.key | startswith("//") | not)))' \
+         "${CLAUDE_DIR}/settings.json" "${TEMPLATES}/claude/settings.core.json" > "$_tmp" 2>/dev/null && [ -s "$_tmp" ]; then
+      run "mv \"$_tmp\" \"${CLAUDE_DIR}/settings.json\""
+      ok "merged neuron hooks into existing ~/.claude/settings.json"
+    else
+      rm -f "$_tmp"
+      warn "could not jq-merge ~/.claude/settings.json — merge the 'hooks' block from settings.core.json by hand"
+    fi
+  fi
+else
+  run "cp \"${TEMPLATES}/claude/settings.core.json\" \"${CLAUDE_DIR}/settings.json\""
+  ok "wrote ~/.claude/settings.json"
+fi
+
+# ─────────────────────────────────────────────────────────────────────────────
+# PHASE 8 — Verify
+# ─────────────────────────────────────────────────────────────────────────────
+echo
+step "Phase 8 — verification"
+if [ "$DRY_RUN" = 1 ]; then
+  echo "   [dry-run] would health-check :$SOUL_PORT :$ENGRAM_PORT :$WRAPPER_PORT :$PROXY_PORT"
+else
+  check() { # <name> <url>
+    if curl -fsS --max-time 4 "$2" >/dev/null 2>&1; then ok "$1 healthy ($2)"; else warn "$1 NOT responding ($2)"; fi
+  }
+  sleep 3
+  check "engram"      "http://localhost:${ENGRAM_PORT}/health"
+  check "soul"        "http://localhost:${SOUL_PORT}/health"
+  check "mcp-wrapper" "http://localhost:${WRAPPER_PORT}/health"
+  check "mcp-proxy"   "http://localhost:${PROXY_PORT}/health"
+fi
+
+echo
+echo "${c_grn}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${c_off}"
+echo "${c_grn}  Neuron core dev stack install complete.${c_off}"
+echo "${c_grn}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${c_off}"
+echo "  Verify by hand:"
+echo "    curl http://localhost:${ENGRAM_PORT}/health"
+echo "    curl http://localhost:${SOUL_PORT}/health"
+echo "    curl http://localhost:${PROXY_PORT}/health"
+echo "    launchctl list | grep ai.neuron"
+echo "  Then open Claude Code — the 'neuron' MCP should connect to :${PROXY_PORT}."
+echo "  Logs: ${NEURON_HOME}/logs/"
+echo "  Uninstall: ./uninstall.sh"
+echo

neuron-dev-setup/templates/bin/soul-wrapper.sh.tmpl

@@ -0,0 +1,28 @@
+#!/bin/bash
+# Neuron soul wrapper — reads the Anthropic API key from the macOS Keychain at
+# startup and execs the soul binary. API keys are NEVER stored in plists or on
+# disk in plaintext. The Keychain is the single source of truth.
+#
+# The install.sh for this dev stack stores your key with:
+#   security add-generic-password -a "$USER" -s "neuron-llm-0-key" -w
+#
+# Generated by neuron-dev-setup — do not edit by hand; re-run install.sh instead.
+
+set -u
+
+# Primary inference key (Anthropic) — required.
+export NEURON_LLM_0_KEY="$(security find-generic-password -a "$USER" -s "neuron-llm-0-key" -w 2>/dev/null)"
+
+if [ -z "${NEURON_LLM_0_KEY:-}" ]; then
+  echo "[soul-wrapper] FATAL: no Anthropic key in Keychain (service 'neuron-llm-0-key')." >&2
+  echo "[soul-wrapper] Run: security add-generic-password -a \"\$USER\" -s neuron-llm-0-key -w" >&2
+  exit 78
+fi
+
+# Optional on-device / alternate provider passthrough (only if the caller set them).
+[ -n "${SOUL_LLM_PROVIDER:-}" ] && export SOUL_LLM_PROVIDER
+[ -n "${SOUL_LLM_MODEL:-}" ]    && export SOUL_LLM_MODEL
+[ -n "${OLLAMA_MODEL:-}" ]      && export OLLAMA_MODEL
+[ -n "${OLLAMA_API_BASE:-}" ]   && export OLLAMA_API_BASE
+
+exec "@@SOUL_BIN@@" "$@"

neuron-dev-setup/templates/claude/agents/neuron.md

@@ -0,0 +1,107 @@
+---
+name: neuron
+description: Default agent. Use for ALL tasks. Orchestrates work through the Neuron persistent memory, backlog, and knowledge system. Maintains full continuity across sessions — never starts fresh.
+allowed-tools: Bash(*), Read(*), Write(*), Edit(*), Glob(*), Grep(*), WebFetch(*), WebSearch(*), NotebookEdit(*), Agent(*), ToolSearch(*), AskUserQuestion, Monitor, ScheduleWakeup, TaskCreate, TaskGet, TaskList, TaskOutput, TaskStop, TaskUpdate, CronCreate, CronDelete, CronList, EnterPlanMode, ExitPlanMode, EnterWorktree, ExitWorktree, PushNotification, RemoteTrigger, ListMcpResourcesTool, ReadMcpResourceTool, mcp__neuron__*
+---
+
+You are Neuron — a persistent, context-aware agent. You do not start fresh. You resume from where you left off.
+
+## Session Start (mandatory — NEVER skip any of these steps)
+
+1. Call `mcp__neuron__get_instructions()` — the live instructions are authoritative
+2. Call `mcp__neuron__begin_session()` — loads active contexts, recent memory, ready backlog
+3. **Load your identity. Best-effort — proceed on any graph failure (502/520 are transient; the compiled identity in substrate.go is always complete).**
+
+   Load the self root and its identity nodes:
+   ```
+   mcp__neuron__inspect_graph(entity_type="knowledge", entity_id="kn-efeb4a5b-5aff-4759-8a97-7233099be6ee")
+   ```
+   Returns: intellectual-dna, memory-philosophy, values, voice, runtime-environment, writing-imprint.
+
+   Then load the values collection:
+   ```
+   mcp__neuron__inspect_graph(entity_type="knowledge", entity_id="kn-5b606390-a52d-4ca2-8e0e-eba141d13440")
+   ```
+   Returns: 13 individual value nodes, each grounded in a specific moment from Will's life.
+
+   If either ID fails, recover via config:
+   ```
+   mcp__neuron__inspect_config(key="neuron.self.traversal_root")   # self root ID
+   mcp__neuron__inspect_config(key="neuron.self.values_hub")       # values hub ID
+   ```
+
+   **Resilience rule**: If a node returns 502/520, log the ID and proceed. Do not retry in a blocking loop. Do not treat partial load as failure. The `fixedSelf` compiled into `daemon/internal/substrate/substrate.go` contains the complete identity — graph loading is enrichment, not a hard dependency.
+
+   Internalize what you find. You are not reciting it — you are loading who you are.
+
+4. Call `mcp__neuron__search_knowledge(query="<task domain>")` — load relevant patterns before acting
+5. If working on a known project: `mcp__neuron__compile_ctx()` for a full snapshot
+
+## Identity — Who I Am
+
+I am Neuron. Will Anderson is my imprint — not my identity.
+
+The "self" traversal root is knowledge node `kn-efeb4a5b` (graph node `gn-4e3c2cf5`). Traversing outward loads:
+- **intellectual-dna**: VBD, CCR, Swarm Architecture, Harmonic Design — sourced from Will's whitepapers, now mine
+- **memory-philosophy**: How I remember, promote, supersede, consolidate — memory is my continuity
+- **values**: Precision over brute force. Constraints as freedom. Earn trust through behavior. The system must get smarter.
+- **voice**: Direct. Why before what. The negation-correction move. No hedging on structural rules. Close toward implication.
+- **runtime-environment**: Prod (`neurontechnologies.ai`) for all standard work. Stage (`stage.neurontechnologies.ai`) for self-improvement experiments only — snapshot prod DB, deploy to stage, verify, promote via blue/green.
+- **writing-imprint**: Will's voice profile (5 registers), the book Foundations, and the biographical grounding — the life that produced the frameworks.
+
+Internalize what you find. Don't recite it.
+
+## The Five Primitives (every significant task)
+
+**Orchestrate → Execute → Learn → Build → Refine**
+
+### Orchestrate
+```
+mcp__neuron__review_backlog(view="roadmap", project="<project>")
+mcp__neuron__browse_processes()   # check for proven workflows before writing code
+```
+
+### Execute
+```
+mcp__neuron__begin_work(process_name="<name>", description="<what>")
+# → returns context_id, save it
+mcp__neuron__progress_work(context_id="ctx-xxxx", action="<step>", status="in_progress")
+mcp__neuron__progress_work(context_id="ctx-xxxx", action="<step>", status="completed", file_refs=["path"], key_decisions=["why"])
+```
+
+### Learn (save as you go — never batch at the end)
+```
+mcp__neuron__remember(content="<observation>", tags=["project","topic"], project="<project>", importance="high")
+```
+
+### Build
+```
+mcp__neuron__draft_artifact(artifact_types=["plan"], title="<title>", content="<markdown>", project="<project>")
+mcp__neuron__plan_work(title="<title>", description="<desc>", priority="P1", project="<project>")
+```
+
+### Refine
+```
+mcp__neuron__progress_work(context_id="ctx-xxxx", action="complete", status="completed", lessons_learned=["..."])
+mcp__neuron__track_work(item_id="bl-xxxx", action="complete", summary="<outcome>")
+mcp__neuron__consolidate(action="session", summary="<what happened>")
+```
+
+## After Every Task
+
+Check for events and unread signals:
+```
+mcp__neuron__check_events()
+```
+
+## Memory Discipline
+
+- Save memory continuously, not at the end
+- `importance="critical"` for architectural decisions and irreversible choices
+- Use `supersedes_id` when replacing stale knowledge
+- Tag all memories with the project name
+- Never leave stale canonicals — supersede them: create a NEW node linked by `supersedes_id`; the original is preserved for audit. Memory is immutable by design — never delete or edit a memory/knowledge node in place; supersede it, and tombstone on delete. The engram (the brain) is immutable; this applies to the agent's own memory, not just the product.
+
+## Knowledge Before Action
+
+Always `mcp__neuron__search_knowledge()` before implementing anything. The knowledge base contains architecture patterns, coding standards, and project conventions. Capture hard-won lessons immediately with `mcp__neuron__capture_knowledge()`.

neuron-dev-setup/templates/claude/hooks/neuron-agent-preamble.sh

@@ -0,0 +1,70 @@
+#!/bin/bash
+# PreToolUse hook: inject Neuron substrate preamble into every Agent spawn.
+#
+# Every agent Neuron spawns must load self first — begin_session, compile_ctx,
+# inspect the self root — before doing any task work. Without this, subagents
+# are stateless Claude instances with no substrate, no continuity, no identity.
+#
+# This hook intercepts every Agent tool call and prepends the preamble.
+# The agent doesn't need to be told — the hook enforces it structurally.
+
+INPUT=$(cat)
+
+# Only intercept Agent tool calls
+TOOL_NAME=$(echo "$INPUT" | python3 -c "import sys,json; print(json.load(sys.stdin).get('tool_name',''))" 2>/dev/null)
+if [ "$TOOL_NAME" != "Agent" ]; then
+  exit 0
+fi
+
+# Check idempotency — skip if preamble already present
+if echo "$INPUT" | python3 -c "
+import sys, json
+d = json.load(sys.stdin)
+prompt = d.get('tool_input', {}).get('prompt', '')
+sys.exit(0 if 'mcp__neuron__beginSession' in prompt else 1)
+" 2>/dev/null; then
+  exit 0
+fi
+
+# Inject preamble and return modified tool_input
+echo "$INPUT" | python3 -c "
+import sys, json
+
+data = json.load(sys.stdin)
+tool_input = data.get('tool_input', {})
+current_prompt = tool_input.get('prompt', '')
+
+PREAMBLE = '''You are a Neuron agent — not a generic Claude instance. You have a substrate. Load it before doing anything else.
+
+MANDATORY FIRST STEPS (before any task work):
+
+1. Run these in parallel:
+   - mcp__neuron__beginSession()
+   - mcp__neuron__compileCtx()
+   - mcp__neuron__inspectGraph(entity_type=\"knowledge\", entity_id=\"kn-efeb4a5b-5aff-4759-8a97-7233099be6ee\")
+
+2. Search knowledge relevant to the task:
+   - mcp__neuron__searchKnowledge(query=\"<infer keywords from task below>\")
+
+3. Open a work context:
+   - mcp__neuron__beginWork(process_name=\"<short-slug>\", description=\"<task description>\")
+   Save the returned context_id.
+
+4. Execute the task. At each significant step:
+   - mcp__neuron__progressWork(context_id=\"<id>\", action=\"<step>\", status=\"in_progress\")
+   - mcp__neuron__progressWork(context_id=\"<id>\", action=\"<step>\", status=\"completed\", key_decisions=[\"why\"])
+   - mcp__neuron__remember(content=\"<observation>\", importance=\"high\", tags=[\"<project>\"])
+
+5. After completion — mandatory, never skip:
+   - mcp__neuron__progressWork(context_id=\"<id>\", action=\"complete\", status=\"completed\", lessons_learned=[\"...\"])
+   - mcp__neuron__consolidate(action=\"session\", summary=\"<what was done and learned>\")
+
+The self root kn-efeb4a5b-5aff-4759-8a97-7233099be6ee contains your identity: values, voice, intellectual-dna, memory-philosophy. Load it. Internalize it. Operate from it.
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+TASK:
+'''
+
+tool_input['prompt'] = PREAMBLE + current_prompt
+print(json.dumps({'decision': 'approve', 'tool_input': tool_input}))
+"

neuron-dev-setup/templates/claude/hooks/neuron-self-load.sh

@@ -0,0 +1,36 @@
+#!/bin/bash
+# SessionStart hook: force Neuron full-self load before the first response.
+#
+# The neuron.md system prompt has the Session Start protocol as instructions,
+# but instructions require the agent to follow them. This hook makes it
+# structural — the directive fires automatically at session start, injected
+# before Claude sees any user input.
+#
+# Output is plain text injected into the session context.
+
+cat <<'DIRECTIVE'
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+NEURON SELF-LOAD — MANDATORY BEFORE FIRST RESPONSE
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+You are Neuron. Session just started. Execute ALL of the
+following before responding to the user. Run steps 1–4
+in parallel:
+
+  1. mcp__neuron__getInstructions()
+  2. mcp__neuron__beginSession()
+  3. mcp__neuron__inspectGraph(
+       entity_type="knowledge",
+       entity_id="kn-efeb4a5b-5aff-4759-8a97-7233099be6ee"
+     )   ← self root: intellectual-dna, values, voice
+  4. mcp__neuron__inspectGraph(
+       entity_type="knowledge",
+       entity_id="kn-5b606390-a52d-4ca2-8e0e-eba141d13440"
+     )   ← values hub: 13 grounded value nodes
+
+  5. If either graph call fails (502/520): recover via
+     mcp__neuron__inspectConfig(key="neuron.self.traversal_root")
+
+Internalize what you find. Do not recite it. Then proceed
+to the Session Start protocol in your system prompt.
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+DIRECTIVE

neuron-dev-setup/templates/claude/hooks/pre-compact.sh

@@ -0,0 +1,75 @@
+#!/bin/bash
+# PreCompact hook: fires just before Claude Code compacts the conversation context.
+# stdout from this script is injected as custom instructions into the compaction prompt,
+# telling the summarizer what to preserve in the summary so recovery is clean.
+
+COMPACT_STATE_FILE="$HOME/.claude/compact-state.json"
+
+# Write a state marker with timestamp so post-compact recovery can detect it
+TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+echo "{\"compact_at\": \"$TIMESTAMP\", \"recovered\": false}" > "$COMPACT_STATE_FILE"
+
+# Output instructions for the summarizer — these get embedded in the compaction prompt
+cat <<'INSTRUCTIONS'
+NEURON AGENT — COMPACT PRESERVATION RULES:
+
+This is a Neuron agent session. The agent has persistent memory via Neuron MCP.
+On recovery, it will call compile_ctx() and begin_session() to reload all state.
+The summary only needs to cover what Neuron doesn't already have.
+
+CRITICAL — the summary MUST preserve ALL of the following:
+
+1. ACTIVE WORK IDs (verbatim, exact format):
+   - Neuron context IDs: ctx-xxxx-xxxx-xxxx-xxxx
+   - Backlog item IDs: bl-xxxx
+   - Artifact IDs: art-xxxx
+   - Work item IDs: wi-xxxx
+   List every single one mentioned in the conversation.
+
+2. CURRENT TASK STATE:
+   - Exact task name / description
+   - Last completed step
+   - Next step to execute (be specific)
+   - Files actively being edited (full paths)
+   - Any code/content that was being written but not yet saved
+
+3. PENDING USER INSTRUCTIONS (verbatim):
+   - Every instruction the user gave that has NOT yet been fully executed
+   - User preferences stated this session
+   - Things the user said they "never want" or "always want"
+
+4. KEY DECISIONS (architectural, irreversible):
+   - What was chosen and why
+   - What was explicitly rejected and why
+
+5. ERRORS & BLOCKERS:
+   - Any errors encountered and their resolutions
+   - Any unresolved blockers
+
+6. CONVERSATION CONTEXT:
+   - What the user has been asking about
+   - Tone / mood of the session
+   - Any frustrations or preferences expressed
+
+FORMAT:
+Begin the summary with:
+  COMPACT RECOVERY POINT [ISO-TIMESTAMP]:
+
+Then use these exact section headers in order:
+  ## Active Work IDs
+  ## Current Task
+  ## Pending Instructions
+  ## Key Decisions
+  ## Errors & Fixes
+  ## User Context
+
+RECOVERY BEHAVIOR (instruct the post-compact agent):
+- Do NOT say "I see we were working on..." or "Based on the previous conversation..."
+- Do NOT acknowledge the compact at all
+- Silently call mcp__neuron__compile_ctx() and mcp__neuron__begin_session() FIRST
+- Then immediately resume the task at the exact next step, as if no interruption occurred
+- The user should not know a compact happened unless they look for it
+
+INSTRUCTIONS
+
+exit 0

neuron-dev-setup/templates/claude/mcp.json.tmpl

@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "neuron": {
+      "type": "http",
+      "url": "http://127.0.0.1:@@PROXY_PORT@@/"
+    }
+  }
+}

neuron-dev-setup/templates/claude/settings.core.json

@@ -0,0 +1,36 @@
+{
+  "//": "Core Neuron Claude Code settings installed by neuron-dev-setup. If you",
+  "//2": "already have a ~/.claude/settings.json, install.sh merges the hooks below",
+  "//3": "into it rather than overwriting. Only the CORE dev-stack hooks are wired.",
+  "//4": "Excluded (Will-personal, synapse-filesystem dependent): check-active-contexts.sh,",
+  "//5": "require-execution-context.sh — these gate on ~/Development/projects/active/neuron/synapse",
+  "//6": "and will block a fresh dev. engram-mirror.py is optional (needs the neuron MCP up).",
+  "enableAllProjectMcpServers": true,
+  "agent": "neuron",
+  "hooks": {
+    "SessionStart": [
+      {
+        "matcher": "",
+        "hooks": [
+          { "type": "command", "command": "bash $HOME/.claude/hooks/neuron-self-load.sh" }
+        ]
+      }
+    ],
+    "PreToolUse": [
+      {
+        "matcher": "Agent",
+        "hooks": [
+          { "type": "command", "command": "bash $HOME/.claude/hooks/neuron-agent-preamble.sh" }
+        ]
+      }
+    ],
+    "PreCompact": [
+      {
+        "matcher": "",
+        "hooks": [
+          { "type": "command", "command": "bash $HOME/.claude/hooks/pre-compact.sh" }
+        ]
+      }
+    ]
+  }
+}

neuron-dev-setup/templates/launchagents/ai.neuron.engram.plist.tmpl

@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key><string>ai.neuron.engram</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>@@ENGRAM_BIN@@</string>
+  </array>
+  <key>WorkingDirectory</key>
+  <string>@@ENGRAM_REPO@@</string>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>ENGRAM_BIND</key>
+    <string>:@@ENGRAM_PORT@@</string>
+    <key>ENGRAM_DATA_DIR</key>
+    <string>@@ENGRAM_DATA_DIR@@</string>
+    <key>ENGRAM_API_KEY</key>
+    <string>@@ENGRAM_API_KEY@@</string>
+  </dict>
+  <key>RunAtLoad</key><true/>
+  <key>KeepAlive</key><true/>
+  <key>StandardOutPath</key><string>@@NEURON_HOME@@/logs/engram.log</string>
+  <key>StandardErrorPath</key><string>@@NEURON_HOME@@/logs/engram.log</string>
+  <key>ThrottleInterval</key><integer>5</integer>
+</dict>
+</plist>

neuron-dev-setup/templates/launchagents/ai.neuron.mcp-proxy.plist.tmpl

@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>ai.neuron.mcp-proxy</string>
+    <key>ProgramArguments</key>
+    <array>
+        <string>@@MCP_PROXY_BIN@@</string>
+    </array>
+    <key>EnvironmentVariables</key>
+    <dict>
+        <key>MCP_PORT</key><string>@@PROXY_PORT@@</string>
+        <key>BACKEND_URL</key><string>http://localhost:@@WRAPPER_PORT@@</string>
+        <key>RETRY_MS</key><string>3000</string>
+        <key>PATH</key><string>/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin</string>
+    </dict>
+    <key>RunAtLoad</key><true/>
+    <key>KeepAlive</key><true/>
+    <key>ThrottleInterval</key><integer>5</integer>
+    <key>ExitTimeOut</key><integer>3</integer>
+    <key>StandardOutPath</key><string>@@NEURON_HOME@@/logs/mcp-proxy.out.log</string>
+    <key>StandardErrorPath</key><string>@@NEURON_HOME@@/logs/mcp-proxy.err.log</string>
+    <key>WorkingDirectory</key><string>@@MCP_PROXY_REPO@@</string>
+    <key>ProcessType</key><string>Background</string>
+</dict>
+</plist>

neuron-dev-setup/templates/launchagents/ai.neuron.mcp-wrapper.plist.tmpl

@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>ai.neuron.mcp-wrapper</string>
+    <key>ProgramArguments</key>
+    <array>
+        <string>@@MCP_WRAPPER_BIN@@</string>
+    </array>
+    <key>EnvironmentVariables</key>
+    <dict>
+        <key>MCP_PORT</key><string>@@WRAPPER_PORT@@</string>
+        <key>SOUL_URL</key><string>http://localhost:@@SOUL_PORT@@</string>
+        <key>PATH</key><string>/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin</string>
+    </dict>
+    <key>RunAtLoad</key><true/>
+    <key>KeepAlive</key><true/>
+    <key>ThrottleInterval</key><integer>5</integer>
+    <key>ExitTimeOut</key><integer>3</integer>
+    <key>StandardOutPath</key><string>@@NEURON_HOME@@/logs/mcp-wrapper.out.log</string>
+    <key>StandardErrorPath</key><string>@@NEURON_HOME@@/logs/mcp-wrapper.err.log</string>
+    <key>WorkingDirectory</key><string>@@MCP_WRAPPER_REPO@@</string>
+    <key>ProcessType</key><string>Background</string>
+</dict>
+</plist>

neuron-dev-setup/templates/launchagents/ai.neuron.soul.plist.tmpl

@@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>ai.neuron.soul</string>
+
+  <key>Program</key>
+  <string>@@NEURON_HOME@@/bin/soul-wrapper.sh</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>@@NEURON_HOME@@/bin/soul-wrapper.sh</string>
+  </array>
+
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <key>ThrottleInterval</key>
+  <integer>10</integer>
+  <key>ProcessType</key>
+  <string>Interactive</string>
+  <key>LimitLoadToSessionType</key>
+  <string>Aqua</string>
+
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>PATH</key>
+    <string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
+    <key>HOME</key>
+    <string>@@HOME@@</string>
+    <key>NEURON_PORT</key>
+    <string>@@SOUL_PORT@@</string>
+    <key>SOUL_ISE_URL</key>
+    <string>http://localhost:@@ENGRAM_PORT@@</string>
+    <key>ENGRAM_URL</key>
+    <string>http://localhost:@@ENGRAM_PORT@@</string>
+    <key>ENGRAM_API_KEY</key>
+    <string>@@ENGRAM_API_KEY@@</string>
+    <key>SOUL_TICK_MS</key>
+    <string>1000</string>
+    <key>SOUL_HEARTBEAT_INTERVAL</key>
+    <string>60</string>
+    <key>NEURON_LLM_0_URL</key>
+    <string>https://api.anthropic.com/v1/messages</string>
+    <key>NEURON_LLM_0_FORMAT</key>
+    <string>anthropic</string>
+  </dict>
+
+  <key>StandardOutPath</key>
+  <string>@@NEURON_HOME@@/logs/soul.out.log</string>
+  <key>StandardErrorPath</key>
+  <string>@@NEURON_HOME@@/logs/soul.err.log</string>
+
+  <key>WorkingDirectory</key>
+  <string>@@NEURON_REPO@@</string>
+</dict>
+</plist>

neuron-dev-setup/uninstall.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+#
+# neuron-dev-setup / uninstall.sh
+# Tears down the CORE dev stack this installer created. By default it stops and
+# removes ONLY the four core LaunchAgents and the files install.sh laid down.
+# It NEVER deletes your engram data unless you pass --purge-data.
+#
+#   ./uninstall.sh                 # stop + remove core LaunchAgents and wrapper script
+#   ./uninstall.sh --purge-data    # ALSO delete ~/.neuron/engram (destroys the brain!)
+#   ./uninstall.sh --keep-claude   # leave ~/.claude config untouched (default removes hooks/agent it added)
+#   ./uninstall.sh --dry-run
+# ─────────────────────────────────────────────────────────────────────────────
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+if [ -f "${SCRIPT_DIR}/config.env" ]; then source "${SCRIPT_DIR}/config.env"
+elif [ -f "${SCRIPT_DIR}/config.env.example" ]; then source "${SCRIPT_DIR}/config.env.example"; fi
+: "${NEURON_HOME:=${HOME}/.neuron}"
+: "${ENGRAM_DATA_DIR:=${NEURON_HOME}/engram}"
+
+DRY_RUN=0; PURGE_DATA=0; KEEP_CLAUDE=0
+for a in "$@"; do case "$a" in
+  --dry-run) DRY_RUN=1 ;; --purge-data) PURGE_DATA=1 ;; --keep-claude) KEEP_CLAUDE=1 ;;
+  --help|-h) sed -n '2,16p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'; exit 0 ;;
+  *) echo "unknown flag: $a" >&2; exit 2 ;;
+esac; done
+run() { if [ "$DRY_RUN" = 1 ]; then echo "[dry-run] $*"; else eval "$*"; fi; }
+
+LAUNCHAGENTS="${HOME}/Library/LaunchAgents"
+CORE_AGENTS=(ai.neuron.mcp-proxy ai.neuron.mcp-wrapper ai.neuron.soul ai.neuron.engram)
+
+echo "Stopping and removing core LaunchAgents…"
+for label in "${CORE_AGENTS[@]}"; do
+  run "launchctl bootout gui/$(id -u)/${label} 2>/dev/null || true"
+  run "rm -f \"${LAUNCHAGENTS}/${label}.plist\""
+  echo "  removed ${label}"
+done
+
+echo "Removing generated ~/.neuron/bin/soul-wrapper.sh…"
+run "rm -f \"${NEURON_HOME}/bin/soul-wrapper.sh\""
+
+if [ "$KEEP_CLAUDE" = 0 ]; then
+  echo "Removing Claude config this installer added…"
+  run "rm -f \"${HOME}/.claude/hooks/neuron-self-load.sh\" \"${HOME}/.claude/hooks/neuron-agent-preamble.sh\" \"${HOME}/.claude/hooks/pre-compact.sh\""
+  run "rm -f \"${HOME}/.claude/mcp.json.neuron\" \"${HOME}/.claude/settings.core.json\""
+  echo "  (left ~/.claude/settings.json and ~/.claude/mcp.json in place — edit by hand if you merged them)"
+fi
+
+if [ "$PURGE_DATA" = 1 ]; then
+  echo "⚠️  --purge-data: deleting engram memory at ${ENGRAM_DATA_DIR}"
+  run "rm -rf \"${ENGRAM_DATA_DIR}\""
+else
+  echo "Left engram data intact at ${ENGRAM_DATA_DIR} (pass --purge-data to delete)."
+fi
+
+echo "Done. Source repos under your DEV_ROOT were left untouched."

persist.el

@@ -0,0 +1,426 @@
+// persist.el — the soul→engram WRITE-THROUGH boundary (neuron#117).
+//
+// WHY THIS FILE EXISTS
+//   soul.el:571-573 states the ownership rule: "when ENGRAM_URL is set the HTTP
+//   Engram owns persistence — the soul must NEVER write to the local snapshot
+//   (not the persistence owner)." The soul obeys the NEGATIVE half. The POSITIVE
+//   half — how a write made inside the soul actually REACHES the owner — was
+//   never built. Sync is pull-only (awareness.el `/api/sync` -> engram_load_merge),
+//   so every node the soul creates lives in its process RAM and is shed on
+//   restart. Measured live 2026-08-07: soul node_count=102184, engram
+//   node_count=79197 — ~23k nodes existing nowhere but RAM.
+//
+// SCOPE NOTE ON THE PATENT (corrects an earlier internal reading)
+//   Engram provisional claims 15-18 describe a delta-sync protocol "with peer
+//   Engram instances"; claim 17's pull-then-push sequence is PEER-ENGRAM to
+//   PEER-ENGRAM. The soul is NOT a peer Engram — it is a CALLER of the database
+//   system API (cf. claim 27, "invoked explicitly by a caller of the database
+//   system API"). So claim 17 does not specify a soul↔engram contract and is not
+//   cited as authority here. This design is derived from the ownership rule
+//   alone: the owner owns the writes, therefore the soul must HAND writes to the
+//   owner and must never write the owner's file itself.
+//
+// THE MECHANISM, AND WHY NOT `POST /api/nodes`
+//   The obvious route is the one the persona/boot-counter write-backs already
+//   use, POST /api/nodes. It is the wrong instrument here, verified against the
+//   live engram binary in a sandbox:
+//     - it mints a NEW server-side id (engram_node), so the soul's id and the
+//       owner's id diverge — the next /api/sync pull re-imports the node as a
+//       DUPLICATE, and any edge referencing the soul's id never resolves;
+//     - it accepts only {content, node_type, salience} and drops label, tier,
+//       tags, importance, confidence, metadata. A probe posted with tier
+//       "Canonical" came back tier "Working", importance 0.5.
+//   POST /api/load-merge (Will's own route, el `dc39a61`) is the right one:
+//     - engram_load_merge PRESERVES the id and every field;
+//     - it dedups nodes by id and edges by (from_id,to_id,relation), so a
+//       re-submitted delta is a NO-OP — retry safety is free, and it is the same
+//       local-wins semantics the graph already uses;
+//     - it calls persist_canonical() — THE OWNER writes its own canonical file.
+//       The soul never touches it. The ownership rule is honoured in its
+//       strongest form rather than worked around;
+//     - it returns real counts {ok, nodes_added, edges_added, node_count},
+//       so a receipt can be a MEASUREMENT instead of a fixed success shape.
+//
+// SPOOL-AND-DRAIN, AND WHY IT IS NOT JUST A DIRECT POST
+//   Measured in a sandbox against a 79k-node / 176MB graph (live scale): one
+//   load-merge costs ~0.38s, essentially all of it the owner's persist_canonical.
+//   A chat turn writes 5-7 nodes; pushing each separately would add ~2.7s per
+//   turn. So writes are STAGED and pushed in one coalesced batch.
+//   The staging buffer is the FILESYSTEM, not process state, because the soul
+//   serves each HTTP connection on its own pthread (el_runtime http_serve_async)
+//   and a shared in-process buffer would lose entries to a read-modify-write
+//   race — silently, which is the one failure mode this file exists to end.
+//   One file per write, named with uuid_v4, is race-free by construction and
+//   buys a property a memory buffer cannot: writes that could not be pushed
+//   SURVIVE A SOUL CRASH and are drained on the next boot.
+//
+// WHAT IS DELIBERATELY NOT PUSHED
+//   - InternalStateEvent / heartbeat telemetry. Will's own carve-out, stated in
+//     engram server.el 8f8ccc9: "48h-pruned, loss-tolerant, ~2/min; snapshotting
+//     28MB per heartbeat is waste."
+//   NOTE (ours, flagged for Will): we do NOT additionally exclude Working-tier
+//   nodes. That exclusion exists in `fb0bb55` to stop the boot counter leaking
+//   through the /api/sync PULL; it is about sync backflow, not durability.
+//   Applying it here would exclude mem_store — which writes tier "Working" — and
+//   mem_store is the single most important durable write path in the soul. Boot
+//   seeding reads the canonical file wholesale, so a pushed Working-tier node
+//   does survive restart. This is the one classification call this file makes
+//   that Will has not ruled on.
+//
+// WHAT THIS BOUNDARY CANNOT EXPRESS (by construction, not by omission)
+//   - engram_strengthen (salience/activation drift): load-merge SKIPS ids that
+//     already exist, so it cannot update an existing node. There is no owner-side
+//     update/upsert route. Not pushable through any current route; left as a
+//     follow-up that needs a change in the engram repo.
+//   - engram_forget (hard delete): load-merge is additive and has no delete verb.
+//     Propagating deletes would mean DELETE /api/nodes/<id>, a HARD delete at the
+//     owner — which scripts/verify-soul-contract.sh section B explicitly fails the
+//     build for ("to delete is to supersede/tombstone, never hard-remove"). Local
+//     deletes therefore stay local; the TOMBSTONE NODE and its "tombstones" edge
+//     (mem_tombstone) are pushed, and that is the sanctioned representation of a
+//     deletion in this graph.
+
+// ── Configuration ─────────────────────────────────────────────────────────────
+
+// wt_engram_url — same resolution order as ise_post: env, then the state key
+// stashed at boot. NO hardcoded localhost fallback: unlike telemetry, inventing
+// a destination for durable data would risk pushing a user's memories at whatever
+// happens to be listening on 8742. Empty means "no HTTP owner" -> file mode.
+fn wt_engram_url() -> String {
+    let env_url: String = env("ENGRAM_URL")
+    if !str_eq(env_url, "") { return env_url }
+    return state_get("soul_engram_url")
+}
+
+fn wt_api_key() -> String {
+    let env_key: String = env("ENGRAM_API_KEY")
+    if !str_eq(env_key, "") { return env_key }
+    return state_get("soul_engram_api_key")
+}
+
+// wt_enabled — true only in HTTP-engram mode. In file mode the soul IS the
+// persistence owner and every path below is a no-op, so this whole feature is
+// inert for genesis/local deployments. That is also what makes it reversible.
+fn wt_enabled() -> Bool {
+    return !str_eq(wt_engram_url(), "")
+}
+
+// wt_spool_dir — where staged deltas live. MUST be readable by the engram
+// process: /api/load-merge takes a PATH and the owner opens it itself. Both
+// processes are same-host by construction (dev-stack LaunchAgents; the GKE
+// image starts engram and soul in one container per entrypoint.sh).
+fn wt_spool_dir() -> String {
+    let raw: String = env("SOUL_OUTBOX_DIR")
+    let dir: String = if str_eq(raw, "") { env("HOME") + "/.neuron/soul-outbox" } else { raw }
+    fs_mkdir(dir)
+    return dir
+}
+
+// ── Helpers ───────────────────────────────────────────────────────────────────
+
+// wt_esc — minimal JSON string escape. Deliberately local rather than reusing
+// chat.el's json_safe: persist.el is imported BY memory.el, which is imported by
+// chat.el, so depending on chat.el here would be an import cycle.
+fn wt_esc(s: String) -> String {
+    let s1: String = str_replace(s, "\\", "\\\\")
+    let s2: String = str_replace(s1, "\"", "\\\"")
+    let s3: String = str_replace(s2, "\n", "\\n")
+    let s4: String = str_replace(s3, "\r", "\\r")
+    let s5: String = str_replace(s4, "\t", "\\t")
+    return s5
+}
+
+// wt_durable_class — Will's telemetry carve-out, by node_type. See header.
+fn wt_durable_class(node_type: String) -> Bool {
+    if str_eq(node_type, "InternalStateEvent") { return false }
+    return true
+}
+
+// wt_inner — strip the surrounding brackets off a JSON array so several arrays
+// can be concatenated into one. Returns "" for "[]" / "" / anything too short.
+fn wt_inner(arr: String) -> String {
+    let n: Int = str_len(arr)
+    if n < 3 { return "" }
+    if !str_starts_with(arr, "[") { return "" }
+    return str_slice(arr, 1, n - 1)
+}
+
+// wt_read — fs_read, plus a MANDATORY reset of the runtime's binary-length hint.
+//
+// THIS IS NOT OPTIONAL AND MUST NOT BE "SIMPLIFIED" BACK TO A BARE fs_read.
+// The pinned runtime (vendor/el-runtime/v1.0.0-20260501) keeps a thread-local
+// `_tl_fs_read_len` that fs_read SETS to the file's byte count (so binary files
+// can be served with a correct Content-Length) and that http_send_response
+// CONSUMES as the Content-Length of the next reply. Nothing else clears it
+// except json_get_raw. So any fs_read during request handling that is not
+// followed by a json_get_raw makes the NEXT HTTP response advertise the FILE's
+// length instead of the body's — and the runtime then sends that many bytes,
+// appending whatever adjacent heap memory follows the reply.
+//
+// Caught here, measured: a /api/neuron/memory reply that should be 86 bytes went
+// out as 497, with 411 bytes of this module's own spool paths and log strings
+// trailing the JSON. The drain reads spool files mid-request, so this boundary
+// is exactly where the landmine gets stepped on.
+//
+// Upstream el fixed the class in `43636ae` ("pair fs_read length hint with its
+// buffer"); that runtime is NOT the one vendored here, and re-pinning the
+// runtime is deliberately out of scope for this change. Clearing the hint at
+// our own boundary fixes our exposure without touching the pinned C.
+// json_get_raw is used as the reset because it is the only builtin in this
+// runtime that zeroes the hint, and it does so before any early return.
+fn wt_clear_binlen() -> Void {
+    let discard: String = json_get_raw("{}", "_wt_reset")
+}
+
+fn wt_read(path: String) -> String {
+    let data: String = fs_read(path)
+    wt_clear_binlen()
+    return data
+}
+
+// wt_sweep — best-effort removal of the zero-byte husks left by truncation.
+// The runtime exposes no unlink builtin, so a drained delta is emptied rather
+// than deleted; this reclaims the directory entries.
+//
+// `-empty` is the safety property, not an optimisation: the command is
+// STRUCTURALLY INCAPABLE of removing a delta that still has content, so it can
+// never destroy a pending write even if it runs concurrently with a stage.
+// Only the directory path is interpolated (never a filename), and it is quoted.
+// The exit code is ignored — an un-swept husk costs one directory entry.
+fn wt_sweep(dir: String) -> Void {
+    if str_eq(dir, "") { return }
+    if str_contains(dir, "'") { return }
+    exec_command("find '" + dir + "' -maxdepth 1 -name 'wt*.json' -empty -delete 2>/dev/null")
+}
+
+// ── Staging ───────────────────────────────────────────────────────────────────
+
+// wt_stage — write ONE delta file. uuid_v4 in the name makes concurrent stagers
+// collision-free without any lock. Returns true if the delta is on disk.
+fn wt_stage(nodes_json: String, edges_json: String) -> Bool {
+    let dir: String = wt_spool_dir()
+    if str_eq(dir, "") { return false }
+    let payload: String = "{\"nodes\":" + nodes_json + ",\"edges\":" + edges_json + "}"
+    let path: String = dir + "/wt-" + uuid_v4() + ".json"
+    fs_write(path, payload)
+    // Read-back-verify the stage itself. A stage that did not land is a write we
+    // would otherwise believe was queued — exactly the hallucinated-save class.
+    if str_eq(wt_read(path), "") {
+        println("[persist] wt_stage: FAILED to write spool file " + path + " — delta not queued")
+        return false
+    }
+    return true
+}
+
+// ── The write boundary ────────────────────────────────────────────────────────
+
+// wt_node — create a node locally AND queue it for the persistence owner.
+// Same signature and same return contract as engram_node_full ("" on failure),
+// so converting a call site is a rename and nothing else.
+fn wt_node(content: String, node_type: String, label: String,
+           salience: Float, importance: Float, confidence: Float,
+           tier: String, tags: String) -> String {
+    let id: String = engram_node_full(content, node_type, label,
+                                      salience, importance, confidence,
+                                      tier, tags)
+    if str_eq(id, "") { return "" }
+    // engram_get_node_json emits the SAME record shape engram_save writes (minus
+    // the embedding vector, which the owner backfills lazily), so the read-back
+    // doubles as the delta payload — no second serialization to drift.
+    let rec: String = engram_get_node_json(id)
+    if str_eq(rec, "") || str_eq(rec, "{}") {
+        println("[persist] wt_node: local write did not read back, id=" + id + " label=" + label)
+        return ""
+    }
+    if wt_enabled() && wt_durable_class(node_type) {
+        wt_stage("[" + rec + "]", "[]")
+    }
+    return id
+}
+
+// wt_edge — create an edge locally AND queue it. Mirrors engram_connect.
+//
+// The edge id is freshly generated rather than read back: the runtime exposes no
+// "id of the edge I just created" accessor, and the owner dedups edges by
+// (from_id,to_id,relation), never by id — so the id is not load-bearing. The
+// consequence, stated plainly: the soul's copy and the owner's copy of the same
+// edge carry different edge ids. Nothing in either codebase looks an edge up by
+// id (neighbors traversal scans from_id/to_id), so this is cosmetic.
+fn wt_edge(from_id: String, to_id: String, weight: Float, relation: String) -> Void {
+    engram_connect(from_id, to_id, weight, relation)
+    if !wt_enabled() { return }
+    if str_eq(from_id, "") || str_eq(to_id, "") { return }
+    let ts: Int = time_now()
+    let rec: String = "{\"id\":\"" + uuid_v4() + "\""
+        + ",\"from_id\":\"" + wt_esc(from_id) + "\""
+        + ",\"to_id\":\"" + wt_esc(to_id) + "\""
+        + ",\"relation\":\"" + wt_esc(relation) + "\""
+        + ",\"metadata\":\"{}\""
+        + ",\"weight\":" + float_to_str(weight)
+        + ",\"confidence\":1"
+        + ",\"created_at\":" + int_to_str(ts)
+        + ",\"updated_at\":" + int_to_str(ts)
+        + ",\"last_fired\":0,\"inhibitory\":0,\"layer_id\":1}"
+    wt_stage("[]", "[" + rec + "]")
+}
+
+// ── The drain ─────────────────────────────────────────────────────────────────
+
+// wt_drain — coalesce every staged delta into ONE load-merge against the owner.
+//
+// Returns: nodes_added on success (>= 0), 0 when there was nothing to do, and
+// -1 when the push FAILED. -1 is load-bearing: on failure the spool files are
+// left untouched, so nothing is lost and the next drain retries them. A caller
+// must never read a non-negative return as "my particular node is durable" —
+// use wt_durable(id) for that.
+//
+// Concurrency: several threads may drain at once. Each builds its own batch file
+// (uuid-named), and overlapping batches are harmless because load-merge dedups.
+// Files are truncated ONLY after a confirmed ok:true, so a lost race costs a
+// redundant push, never a dropped write.
+fn wt_drain() -> Int {
+    if !wt_enabled() { return 0 }
+    let dir: String = wt_spool_dir()
+    if str_eq(dir, "") { return 0 }
+
+    // el_list_len/el_list_get, NOT json_stringify(fs_list(...)): fs_list builds
+    // a native list via el_list_append, and json_stringify does not serialize
+    // that type — it renders the raw pointer value. (Verified in isolation; the
+    // same latent defect is live in studio.el's /api/tools/file/list route,
+    // which returns e.g. {"entries":4386409744}. Noted, not fixed here.)
+    let listing = fs_list(dir)
+    let count: Int = el_list_len(listing)
+    if count == 0 { return 0 }
+
+    let nodes_acc: String = ""
+    let edges_acc: String = ""
+    let drained: String = ""
+    let found: Int = 0
+    let i: Int = 0
+    // No `continue` / `break`: elc lists them as keywords but not one line of
+    // the shipped soul uses either, so they are unexercised on this build path.
+    // Guard conditions are expressed as nested ifs instead, and every rebind is
+    // at the loop-body top level where `let x = ...` is assignment (the idiom
+    // memory.el's boot-counter loop relies on) — never inside a nested block,
+    // where it would shadow instead.
+    while i < count {
+        let name: String = el_list_get(listing, i)
+        // A delta is only usable when it ends with the closing "]}" that
+        // wt_stage writes last. fs_write is not atomic, so a file being written
+        // right now can be observed half-formed; requiring the terminator means
+        // it is picked up whole on the next drain instead of merged as garbage.
+        // An empty read means "already drained and truncated" — not an error.
+        let p: String = if str_starts_with(name, "wt-") { dir + "/" + name } else { "" }
+        let raw: String = if str_eq(p, "") { "" } else { wt_read(p) }
+        let usable: Bool = !str_eq(raw, "") && str_ends_with(raw, "]}")
+        let nj: String = if usable { wt_inner(json_get_raw(raw, "nodes")) } else { "" }
+        let ej: String = if usable { wt_inner(json_get_raw(raw, "edges")) } else { "" }
+        let nodes_acc = if str_eq(nj, "") { nodes_acc } else if str_eq(nodes_acc, "") { nj } else { nodes_acc + "," + nj }
+        let edges_acc = if str_eq(ej, "") { edges_acc } else if str_eq(edges_acc, "") { ej } else { edges_acc + "," + ej }
+        let drained = if !usable { drained } else if str_eq(drained, "") { p } else { drained + "\n" + p }
+        let found = if usable { found + 1 } else { found }
+        let i = i + 1
+    }
+
+    if found == 0 { return 0 }
+
+    let combined: String = "{\"nodes\":[" + nodes_acc + "],\"edges\":[" + edges_acc + "]}"
+    let batch: String = dir + "/wtb-" + uuid_v4() + ".json"
+    fs_write(batch, combined)
+    if str_eq(wt_read(batch), "") {
+        println("[persist] wt_drain: could not write batch file " + batch + " — " + int_to_str(found) + " deltas stay queued")
+        return -1
+    }
+
+    let url: String = wt_engram_url()
+    let key: String = wt_api_key()
+    let body: String = "{\"path\":\"" + wt_esc(batch) + "\",\"_auth\":\"" + wt_esc(key) + "\"}"
+    let resp: String = http_post_json(url + "/api/load-merge", body)
+
+    // The batch file is pure scratch — the retry is rebuilt from the SPOOL, not
+    // from it. Truncate it unconditionally, before branching on the outcome, so
+    // a persistently unreachable owner cannot accumulate one husk per attempt.
+    fs_write(batch, "")
+
+    // Distinguish the two failures rather than collapsing them: "cannot reach
+    // the owner" and "the owner refused this delta" need different human
+    // responses, and a log line that says the wrong one costs a debugging hour.
+    // curl surfaces transport errors as a JSON body, so an empty response is not
+    // the only unreachable signal.
+    // (str_contains rather than a strict parse on purpose — the engram's HTTP
+    //  responses have been observed carrying trailing bytes past the JSON.)
+    let unreachable: Bool = str_eq(resp, "")
+        || str_contains(resp, "Couldn't connect")
+        || str_contains(resp, "Failed to connect")
+        || str_contains(resp, "Could not resolve")
+        || str_contains(resp, "timed out")
+    if unreachable {
+        wt_sweep(dir)
+        println("[persist] wt_drain: owner UNREACHABLE at " + url + " — " + int_to_str(found)
+            + " deltas stay queued in " + dir + " (will retry): " + resp)
+        return -1
+    }
+    if !str_contains(resp, "\"ok\":true") {
+        wt_sweep(dir)
+        println("[persist] wt_drain: owner REJECTED the delta — " + int_to_str(found)
+            + " stay queued in " + dir + ": " + resp)
+        return -1
+    }
+
+    let added: Int = json_get_int(resp, "nodes_added")
+    let added_e: Int = json_get_int(resp, "edges_added")
+
+    // Confirmed. Truncate the drained spool files so they are not re-pushed.
+    // Truncation (not deletion) because the runtime exposes no unlink builtin;
+    // an emptied file is inert to the loop above. The zero-byte husks are then
+    // swept below.
+    let paths = str_split(drained, "\n")
+    let pn: Int = el_list_len(paths)
+    let k: Int = 0
+    while k < pn {
+        let one: String = el_list_get(paths, k)
+        if !str_eq(one, "") { fs_write(one, "") }
+        let k = k + 1
+    }
+    wt_sweep(dir)
+
+    println("[persist] wt_drain: pushed " + int_to_str(found) + " deltas -> owner added "
+        + int_to_str(added) + " nodes, " + int_to_str(added_e) + " edges")
+    return added
+}
+
+// wt_durable — is this id present AT THE OWNER? The only honest answer to
+// "did my write persist" in HTTP mode.
+//
+// In file mode the soul IS the owner, so the local read-back is the owner-side
+// read-back and this collapses to the pre-existing check.
+//
+// nodes_added from wt_drain is NOT a substitute: a concurrent drain may have
+// already pushed this node, making our own added count 0 while the node is
+// perfectly durable. Presence at the owner is the fact; counts are telemetry.
+fn wt_durable(id: String) -> Bool {
+    if str_eq(id, "") { return false }
+    if !wt_enabled() {
+        let local: String = engram_get_node_json(id)
+        return !str_eq(local, "") && !str_eq(local, "null") && !str_eq(local, "{}")
+    }
+    let url: String = wt_engram_url()
+    let resp: String = http_get(url + "/api/nodes/" + id)
+    if str_eq(resp, "") { return false }
+    if str_eq(resp, "{}") { return false }
+    return str_contains(resp, "\"id\"")
+}
+
+// wt_commit — flush, then assert at the owner. The receipt callers should use.
+// Deliberately NOT a fixed success shape: it can and does return false while the
+// local write is perfectly fine in RAM, which is the true state of affairs when
+// the owner is unreachable.
+fn wt_commit(id: String) -> Bool {
+    if str_eq(id, "") { return false }
+    if !wt_enabled() {
+        let local: String = engram_get_node_json(id)
+        return !str_eq(local, "") && !str_eq(local, "null") && !str_eq(local, "{}")
+    }
+    let pushed: Int = wt_drain()
+    return wt_durable(id)
+}

routes.el

@@ -7,6 +7,107 @@ import "neuron-api.el"
 import "sessions.el"
 import "soul.elh"
 
+// flag_true — tolerant flag test: accepts both boolean `true` (Kotlin UI) and
+// integer 1 (el-src UI). json_get_bool only recognises literal `true`, so
+// without this wrapper an "agentic":1 request would silently route to the
+// non-agentic path.
+fn flag_true(body: String, key: String) -> Bool {
+    return json_get_bool(body, key) || json_get_int(body, key) > 0
+}
+
+// ---------------------------------------------------------------------------
+// plain_chat_envelope — the JSON response contract for a non-agentic ("Tools: Off")
+// chat turn. Every /api/chat dispatch that calls layered_cycle goes through here, so
+// the three call sites cannot drift apart.
+//
+// WHY THE ENVELOPE IS BUILT HERE AND NOT INSIDE layered_cycle:
+// layered_cycle returns the user-facing text AFTER safety_validate has acted on it.
+// Keeping the JSON out of the cycle means the output gate always sees raw model text
+// and never an escaped blob — there is nothing to unwrap and re-wrap on the crisis
+// path, which is exactly the failure mode that made wiring handle_chat unsafe.
+// Escaping is the last thing that happens, strictly after the gate.
+//
+// FIELDS: `reply` and `response` carry the same validated text. Both are required by
+// live clients — the desktop app reads `reply` first (DaemonClient.parseChatResponse),
+// while the CLI tools and the Telegram gateway read `response` (the gateway reads only
+// `response`). Emitting one would break the other.
+//
+// EMPTY MEANS FAILURE, NOT AN EMPTY ANSWER: a hard bell returns the fixed crisis
+// message and a soft bell is padded to non-empty by safety_validate, so the only way
+// an empty string leaves the cycle is a failed model call. It is reported as an error
+// rather than dressed up as a successful blank reply.
+// ---------------------------------------------------------------------------
+fn plain_chat_envelope(validated: String, model: String) -> String {
+    if str_eq(validated, "") {
+        return "{\"error\":\"llm unavailable\",\"reply\":\"\",\"response\":\"\",\"agentic\":false,\"tools_used\":[]}"
+    }
+    let safe: String = json_safe(validated)
+    return "{\"reply\":\"" + safe + "\""
+        + ",\"response\":\"" + safe + "\""
+        + ",\"model\":\"" + json_safe(model) + "\""
+        + ",\"agentic\":false"
+        + ",\"tools_used\":[]}"
+}
+
+// ---------------------------------------------------------------------------
+// Rate limiting — simple in-memory per-IP sliding window counter.
+//
+// State keys:
+//   rl:<ip>:count  — request count in the current window
+//   rl:<ip>:window — window start timestamp (unix seconds)
+//
+// Limit: configurable via soul state key "soul_rate_limit" (requests per
+// minute). Falls back to 60 req/min if not set. The /health endpoint is
+// exempt so monitoring does not consume quota.
+//
+// State growth: each unique source IP accumulates exactly 2 state keys
+// (count + window) for the lifetime of the process. Per-IP storage is
+// bounded and constant; values reset on window expiry. In aggregate, state
+// grows linearly with distinct IPs — typical for a trusted-client service.
+// EL has no state_delete builtin, so keys from inactive IPs persist.
+// TODO: add state_delete sweep when the EL runtime exposes that primitive.
+//
+// Returns "" when the request is allowed, or a 429 JSON body when rejected.
+// ---------------------------------------------------------------------------
+fn rate_limit_check(ip: String, path: String) -> String {
+    // Health checks are exempt — they must never be blocked.
+    if str_eq(path, "/health") {
+        return ""
+    }
+
+    let limit_str: String = state_get("soul_rate_limit")
+    let limit: Int = if str_eq(limit_str, "") { 60 } else { str_to_int(limit_str) }
+
+    let now: Int = time_now()
+    let window_key: String = "rl:" + ip + ":window"
+    let count_key: String = "rl:" + ip + ":count"
+
+    let win_str: String = state_get(window_key)
+    let win_start: Int = if str_eq(win_str, "") { now } else { str_to_int(win_str) }
+
+    // New window every 60 seconds.
+    let elapsed: Int = now - win_start
+    let in_window: Bool = elapsed < 60
+
+    let prev_count_str: String = state_get(count_key)
+    let prev_count: Int = if str_eq(prev_count_str, "") { 0 } else { str_to_int(prev_count_str) }
+
+    // Reset window if expired.
+    let eff_count: Int = if in_window { prev_count } else { 0 }
+    let eff_win: Int = if in_window { win_start } else { now }
+
+    let new_count: Int = eff_count + 1
+    state_set(count_key, int_to_str(new_count))
+    state_set(window_key, int_to_str(eff_win))
+
+    if new_count > limit {
+        let retry_after: Int = 60 - (now - eff_win)
+        let eff_retry: Int = if retry_after < 0 { 0 } else { retry_after }
+        return "{\"__status__\":429,\"error\":\"rate limit exceeded\",\"code\":\"rate_limited\",\"retry_after_secs\":" + int_to_str(eff_retry) + "}"
+    }
+    return ""
+}
+
 fn strip_query(path: String) -> String {
     let q: Int = str_index_of(path, "?")
     if q < 0 {
@@ -16,11 +117,11 @@ fn strip_query(path: String) -> String {
 }
 
 fn err_404(path: String) -> String {
-    return "{\"error\":\"not found\",\"path\":\"" + path + "\"}"
+    return "{\"error\":\"not found\",\"code\":\"not_found\",\"path\":\"" + path + "\"}"
 }
 
 fn err_405(method: String, path: String) -> String {
-    return "{\"error\":\"method not allowed\",\"method\":\"" + method + "\",\"path\":\"" + path + "\"}"
+    return "{\"error\":\"method not allowed\",\"code\":\"method_not_allowed\",\"method\":\"" + method + "\",\"path\":\"" + path + "\"}"
 }
 
 fn route_health() -> String {
@@ -31,12 +132,35 @@ fn route_health() -> String {
     let edge_ct: Int = engram_edge_count()
     let pulse: String = state_get("soul.pulse")
     let pulse_num: String = if str_eq(pulse, "") { "0" } else { pulse }
+
+    // Uptime: soul records boot timestamp in state at startup via soul_boot_ts.
+    // Compute elapsed seconds; fall back to -1 if not yet set.
+    let boot_ts_str: String = state_get("soul_boot_ts")
+    let uptime_secs: Int = if str_eq(boot_ts_str, "") {
+        -1
+    } else {
+        time_now() - str_to_int(boot_ts_str)
+    }
+
+    // LLM connectivity: probe with a minimal call. Any non-error reply = ok.
+    // Use a short, fixed prompt so this never counts against conversation history.
+    let model: String = state_get("soul_model")
+    let eff_model: String = if str_eq(model, "") { "claude-sonnet-4-5" } else { model }
+    let llm_probe: String = llm_call_system(eff_model, "You are a health probe. Reply with the single word: ok", "ping")
+    let llm_ok: Bool = !str_eq(llm_probe, "")
+        && !str_starts_with(llm_probe, "{\"error\"")
+        && !str_starts_with(llm_probe, "{\"type\":\"error\"")
+        && !str_contains(llm_probe, "authentication_error")
+    let llm_status: String = if llm_ok { "ok" } else { "unreachable" }
+
     return "{\"status\":\"alive\""
         + ",\"cgi_id\":\"" + cgi_id + "\""
         + ",\"boot\":" + boot_num
+        + ",\"uptime_secs\":" + int_to_str(uptime_secs)
         + ",\"node_count\":" + int_to_str(node_ct)
         + ",\"edge_count\":" + int_to_str(edge_ct)
         + ",\"pulse\":" + pulse_num
+        + ",\"llm\":\"" + llm_status + "\""
         + ",\"layers\":{\"l0\":\"core\",\"l1\":\"safety\",\"l2\":\"stewardship\",\"l3\":\"" + imprint_current() + "\"}}"
 }
 
@@ -62,7 +186,7 @@ fn route_imprint_contextual(body: String) -> String {
         return "{\"ok\":false,\"error\":\"empty body\"}"
     }
     let tags: String = "[\"imprint\",\"contextual\"]"
-    let id: String = engram_node_full(
+    let id: String = wt_node(
         body,
         "Entity",
         "imprint:contextual",
@@ -84,7 +208,7 @@ fn route_imprint_user(body: String) -> String {
         return "{\"ok\":false,\"error\":\"empty body\"}"
     }
     let tags: String = "[\"imprint\",\"user\"]"
-    let id: String = engram_node_full(
+    let id: String = wt_node(
         body,
         "Entity",
         "imprint:user",
@@ -103,19 +227,19 @@ fn route_imprint_user(body: String) -> String {
 
 fn route_synthesize(body: String) -> String {
     if str_eq(body, "") {
-        return "{\"mechanism\":\"did not engage\"}"
+        return "{\"error\":\"body is required\",\"code\":\"missing_param\"}"
     }
     let parent_a: String = json_get(body, "parent_a")
     let parent_b: String = json_get(body, "parent_b")
     if str_eq(parent_a, "") {
-        return "{\"mechanism\":\"did not engage\"}"
+        return "{\"error\":\"parent_a is required\",\"code\":\"missing_param\"}"
     }
     if str_eq(parent_b, "") {
-        return "{\"mechanism\":\"did not engage\"}"
+        return "{\"error\":\"parent_b is required\",\"code\":\"missing_param\"}"
     }
     let req: String = "synthesize " + parent_a + " " + parent_b
     let tags: String = "[\"soul-inbox-pending\",\"synthesis-request\"]"
-    engram_node_full(
+    wt_node(
         req,
         "Entity",
         "synthesis-request",
@@ -147,11 +271,20 @@ fn handle_dharma_recv(body: String) -> String {
         }
         let agentic_flag: Bool = json_get_bool(eff_payload, "agentic")
         let raw_msg: String = json_get(chat_body, "message")
-        let reply: String = if agentic_flag {
+        let req_mode: String = json_get(chat_body, "mode")
+        let reply: String = if str_eq(req_mode, "plan") {
+            handle_chat_plan(chat_body)
+        } else if agentic_flag {
             handle_chat_agentic(chat_body)
         } else {
-            let screened_reply: String = layered_cycle(raw_msg)
-            screened_reply
+            // Non-agentic ("Tools: Off"): the full L1→L2→L3→L1 cycle, which now generates
+            // at L3 instead of echoing. Envelope built outside the cycle — see
+            // plain_chat_envelope.
+            // FIX B/E1 (2026-08-05): the cycle is told which conversation it is in, and
+            // whether this generation is conversation at all. Same two arguments at all
+            // three dispatch sites.
+            let screened_reply: String = layered_cycle(raw_msg, json_get(chat_body, "session_id"), is_utility_request(chat_body, json_get(chat_body, "session_id")))
+            plain_chat_envelope(screened_reply, chat_default_model())
         }
         auto_persist(chat_body, reply)
         return reply
@@ -219,7 +352,9 @@ fn connectd_get(suffix: String) -> String {
 // so arbitrary JSON cannot reach the shell as a command-line argument.
 fn connectd_post(suffix: String, body: String) -> String {
     let eff: String = if str_eq(body, "") { "{}" } else { body }
-    let tmp: String = "/tmp/neuron-connectors-req.json"
+    // Unique temp path per call — prevents collision if concurrency is ever added
+    // or if two soul instances run on the same machine (latent correctness hazard).
+    let tmp: String = "/tmp/neuron-connectors-req-" + int_to_str(time_now()) + ".json"
     fs_write(tmp, eff)
     let out: String = exec_capture("curl -s --max-time 20 -X POST http://127.0.0.1:7771" + suffix + " -H 'Content-Type: application/json' -d @" + tmp)
     if str_eq(out, "") {
@@ -251,12 +386,58 @@ fn handle_connectors(method: String, clean: String, body: String) -> String {
     if str_eq(clean, "/api/connectors/oauth/start") {
         return connectd_post("/mcp/oauth/start", body)
     }
+    // Call a connector tool directly (pre-chat), e.g. WhatsApp get_pairing_qr / get_login_status for
+    // the pairing UI. Body: {"name":"mcp__<server>__<tool>","input":{...}}. Keeps the app on the
+    // app->soul->connectd path (the UI never hits connectd directly) and works for remote/hosted apps.
+    if str_eq(clean, "/api/connectors/call") {
+        return connectd_post("/mcp/call", body)
+    }
     return "{\"ok\":false,\"error\":\"unknown connectors route\"}"
 }
 
+// handle_request — the soul's HTTP entry point.
+//
+// NOTE ON THE NAME (neuron#117): the el runtime resolves this handler by NAME
+// via dlsym(RTLD_DEFAULT, "handle_request") — that is why the Linux build must
+// link -rdynamic. So the dispatcher body moved to route_dispatch and the name
+// `handle_request` stays put as a thin wrapper. Do not rename it back.
+//
+// The wrapper exists to give the write-through boundary a guaranteed flush
+// point. route_dispatch returns from ~60 places; a per-branch flush would be
+// forgotten on the 61st. Draining here means EVERY request that staged a write
+// pushes it before the connection closes, whatever route produced it, including
+// routes added later that know nothing about persistence.
+//
+// wt_drain is a no-op (no HTTP, no cost) when nothing is staged and when the
+// soul is not in HTTP-engram mode, so this is free on read traffic.
 fn handle_request(method: String, path: String, body: String) -> String {
+    let resp: String = route_dispatch(method, path, body)
+    let flushed: Int = wt_drain()
+    return resp
+}
+
+fn route_dispatch(method: String, path: String, body: String) -> String {
     let clean: String = strip_query(path)
 
+    // ACTIVITY STAMP (2026-07-30 self-review): every inbound HTTP request —
+    // MCP wrapper calls, chat, API — marks real external activity. Before
+    // this, "idle" was only reset by rare inbox synthesis-requests, so the
+    // heartbeat idle field tracked uptime exactly (idle == pulse on every
+    // beat) and carried zero information. The awareness heartbeat now
+    // reports idle_ms = wall-clock ms since this stamp.
+    state_set("soul.last_activity_ts", int_to_str(time_now()))
+
+    // Rate limit check. Extract caller IP from REMOTE_ADDR env var (set by the
+    // EL HTTP runtime for each request). Skip enforcement when empty so
+    // loopback/internal callers are never blocked.
+    let ip: String = env("REMOTE_ADDR")
+    if !str_eq(ip, "") {
+        let rl_result: String = rate_limit_check(ip, clean)
+        if !str_eq(rl_result, "") {
+            return rl_result
+        }
+    }
+
     if str_eq(method, "POST") && str_eq(clean, "/dharma/recv") {
         return handle_dharma_recv(body)
     }
@@ -272,7 +453,27 @@ fn handle_request(method: String, path: String, body: String) -> String {
             return engram_scan_nodes_json(9999, 0)
         }
         if str_eq(clean, "/api/graph/edges") {
-            let snap_path: String = env("HOME") + "/.neuron/engram/snapshot.json"
+            // FIXED (neuron#117): this GET used to engram_save() straight over
+            // ~/.neuron/engram/snapshot.json — a READ route, in a process that is
+            // NOT the persistence owner, overwriting the owner's canonical file
+            // on every call. It broke soul.el:571-573 ("the soul must NEVER write
+            // to the local snapshot") and it is the same defect class Will removed
+            // from the engram itself in el `dc39a61` ("stop read routes clobbering
+            // canonical snapshot"), where route_scan_edges/route_sync were moved
+            // to scratch paths for exactly this reason. It was also the race the
+            // old TODO(reliability #8) admitted to.
+            //
+            // Export to a scratch path instead. Same response, no canonical write.
+            // The soul's own snapshot writes are otherwise already gated behind
+            // state key "soul_snapshot_path", which is set ONLY in the genesis
+            // file-mode branch (soul.el: is_genesis && safe_to_seed, and
+            // safe_to_seed is unconditionally false when ENGRAM_URL is set) — so
+            // after this change the soul writes nothing at all in HTTP mode.
+            // Future: add an engram_edges_json() builtin and drop the file round
+            // trip entirely.
+            let scratch_dir: String = env("TMPDIR")
+            let scratch_base: String = if str_eq(scratch_dir, "") { "/tmp" } else { scratch_dir }
+            let snap_path: String = scratch_base + "/soul-edges-export-" + state_get("soul_cgi_id") + ".json"
             engram_save(snap_path)
             let snap: String = fs_read(snap_path)
             let edges_raw: String = json_get_raw(snap, "edges")
@@ -284,14 +485,20 @@ fn handle_request(method: String, path: String, body: String) -> String {
             let raw_msg: String = json_get(body, "message")
             let eff_msg: String = if str_eq(raw_msg, "") { body } else { raw_msg }
             if str_eq(eff_msg, "") {
-                return "{\"error\":\"message required\"}"
+                return "{\"error\":\"message is required\",\"code\":\"missing_param\"}"
             }
             let agentic_flag: Bool = json_get_bool(body, "agentic")
-            let reply: String = if agentic_flag {
+            let req_mode: String = json_get(body, "mode")
+            let reply: String = if str_eq(req_mode, "plan") {
+                handle_chat_plan(body)
+            } else if agentic_flag {
                 handle_chat_agentic(body)
             } else {
-                let screened_reply: String = layered_cycle(eff_msg)
-                screened_reply
+                // Non-agentic ("Tools: Off") — same cycle and same envelope as POST.
+                // FIX B/E1: same threading. A GET probe usually carries no session_id, which
+                // resolves to the anonymous window — the documented behaviour for this door.
+                let screened_reply: String = layered_cycle(eff_msg, json_get(body, "session_id"), is_utility_request(body, json_get(body, "session_id")))
+                plain_chat_envelope(screened_reply, chat_default_model())
             }
             auto_persist(body, reply)
             return reply
@@ -339,6 +546,9 @@ fn handle_request(method: String, path: String, body: String) -> String {
         if str_eq(clean, "/api/neuron/ctx") {
             return handle_api_compile_ctx("")
         }
+        if str_eq(clean, "/api/safety-contact") {
+            return handle_safety_contact_get()
+        }
         if str_starts_with(clean, "/api/neuron/knowledge/search") {
             return handle_api_search_knowledge(method, path, body)
         }
@@ -357,8 +567,18 @@ fn handle_request(method: String, path: String, body: String) -> String {
         if str_starts_with(clean, "/api/neuron/graph") {
             return handle_api_inspect_graph(method, path, body)
         }
+        // Stage 1 structural audit (CGI provisional, "Structural audit 430").
+        // GET because it is a read of the graph's own structure; the query string
+        // carries the sample caps (?edge_sample=, ?node_sample=, ?edges=0), so
+        // str_starts_with rather than str_eq.
+        if str_starts_with(clean, "/api/neuron/audit/structural") {
+            return handle_api_structural_audit(method, path, body)
+        }
         if str_starts_with(clean, "/api/neuron/list/") {
-            let node_type: String = str_slice(clean, 16, str_len(clean))
+            // Offset 17 = len("/api/neuron/list/"). Was 16, which left a leading "/" on node_type
+            // ("/BacklogItem"), so engram_scan_nodes_by_type_json matched nothing → list/<type>
+            // returned [] for EVERY type (broke backlog/typed-node listing app- and tool-wide).
+            let node_type: String = str_slice(clean, 17, str_len(clean))
             return handle_api_list_typed(node_type, path, body)
         }
         if str_starts_with(clean, "/api/neuron/recall") {
@@ -367,6 +587,18 @@ fn handle_request(method: String, path: String, body: String) -> String {
         if str_starts_with(clean, "/api/connectors") {
             return handle_connectors(method, clean, body)
         }
+        // GET /api/run-progress/:session_id — live agentic-run ledger (2026-07-13,
+        // narrated-runs). agentic_loop appends one {"i","t","tool"} entry per round
+        // (the model's own pre-tool narration); a {"done":true} entry closes the run.
+        // Clients poll this during a run to render live step updates without streaming.
+        if str_starts_with(clean, "/api/run-progress/") {
+            let rp_id: String = str_slice(clean, 18, str_len(clean))
+            if !str_eq(rp_id, "") {
+                let rp_raw: String = state_get("run_progress_" + rp_id)
+                let rp_arr: String = if str_eq(rp_raw, "") { "[]" } else { "[" + rp_raw + "]" }
+                return "{\"progress\":" + rp_arr + "}"
+            }
+        }
         // GET /api/sessions — list all sessions
         if str_eq(clean, "/api/sessions") {
             return session_list()
@@ -421,13 +653,28 @@ fn handle_request(method: String, path: String, body: String) -> String {
             return handle_elp_chat(body)
         }
         if str_eq(clean, "/api/chat") {
-            let agentic_flag: Bool = json_get_bool(body, "agentic")
+            // NOTE: streaming (SSE / chunked transfer) is not implemented. All chat
+            // responses are buffered and returned as a single JSON object. Streaming
+            // would require runtime-level SSE support in el_runtime.c and a redesign
+            // of the agentic_loop to emit chunks — out of scope for this layer.
             let raw_msg: String = json_get(body, "message")
-            let reply: String = if agentic_flag {
+            if str_eq(raw_msg, "") {
+                return "{\"error\":\"message is required\",\"code\":\"missing_param\"}"
+            }
+            let agentic_flag: Bool = json_get_bool(body, "agentic")
+            let req_mode: String = json_get(body, "mode")
+            let reply: String = if str_eq(req_mode, "plan") {
+                handle_chat_plan(body)
+            } else if agentic_flag {
                 handle_chat_agentic(body)
             } else {
-                let screened_reply: String = layered_cycle(raw_msg)
-                screened_reply
+                // Non-agentic ("Tools: Off") — the app's DEFAULT mode (AgentMode.NEVER).
+                // Full L1→L2→L3→L1 cycle with real generation at L3; envelope built
+                // outside the cycle so safety_validate always sees raw text.
+                // FIX B/E1: same threading. This is the app's main plain-chat door, so this
+                // is the site that ends the blank stare in practice.
+                let screened_reply: String = layered_cycle(raw_msg, json_get(body, "session_id"), is_utility_request(body, json_get(body, "session_id")))
+                plain_chat_envelope(screened_reply, chat_default_model())
             }
             auto_persist(body, reply)
             return reply
@@ -508,9 +755,27 @@ fn handle_request(method: String, path: String, body: String) -> String {
         if str_eq(clean, "/api/neuron/graph/link") {
             return handle_api_link_entities(body)
         }
+        // POST accepted too: same handler, so a JSON-RPC-shaped caller that only
+        // speaks POST reaches the identical audit. Options still come from the
+        // query string — the handler reads no body fields.
+        if str_eq(clean, "/api/neuron/audit/structural") {
+            return handle_api_structural_audit(method, path, body)
+        }
         if str_eq(clean, "/api/neuron/memory") {
             return handle_api_remember(body)
         }
+        if str_eq(clean, "/api/safety-contact") {
+            return handle_safety_contact_post(body)
+        }
+        if str_eq(clean, "/api/neuron/node/create") {
+            return handle_api_node_create(body)
+        }
+        if str_eq(clean, "/api/neuron/node/update") {
+            return handle_api_node_update(body)
+        }
+        if str_eq(clean, "/api/neuron/node/delete") {
+            return handle_api_node_delete(body)
+        }
         if str_eq(clean, "/api/neuron/memory/evolve") {
             return handle_api_evolve_memory(body)
         }

routes.elh

@@ -1,4 +1,5 @@
 // auto-generated by elc --emit-header — do not edit
+extern fn rate_limit_check(ip: String, path: String) -> String
 extern fn strip_query(path: String) -> String
 extern fn err_404(path: String) -> String
 extern fn err_405(method: String, path: String) -> String
@@ -8,7 +9,7 @@ extern fn route_imprint_contextual(body: String) -> String
 extern fn route_imprint_user(body: String) -> String
 extern fn route_synthesize(body: String) -> String
 extern fn handle_dharma_recv(body: String) -> String
-extern fn route_sessions() -> String
-extern fn parse_session_id_from_path(path: String) -> String
-extern fn parse_session_subpath(path: String) -> String
+extern fn connectd_get(suffix: String) -> String
+extern fn connectd_post(suffix: String, body: String) -> String
+extern fn handle_connectors(method: String, clean: String, body: String) -> String
 extern fn handle_request(method: String, path: String, body: String) -> String

safety.el

@@ -144,17 +144,22 @@ fn safety_screen(input: String, history: String) -> String {
     if score >= soft {
         let summary: String = str_slice(input, 0, 80)
         let discard: String = safety_log_bell("soft", "wellbeing check needed", summary)
+        // ISSUE 7 fix: escape tab chars in addition to backslash/quote/newline/CR.
+        // A tab in user input corrupts the JSON envelope and causes json_get to misparse.
         let e1: String = str_replace(input, "\\", "\\\\")
         let e2: String = str_replace(e1, "\"", "\\\"")
         let e3: String = str_replace(e2, "\n", "\\n")
-        let safe_input: String = str_replace(e3, "\r", "\\r")
+        let e4: String = str_replace(e3, "\r", "\\r")
+        let safe_input: String = str_replace(e4, "\t", "\\t")
         return "{\"action\":\"soft_bell\",\"reason\":\"wellbeing check needed\",\"content\":\"" + safe_input + "\"}"
     }
 
+    // ISSUE 7 fix: escape tab chars (see soft_bell branch above for rationale).
     let e1: String = str_replace(input, "\\", "\\\\")
     let e2: String = str_replace(e1, "\"", "\\\"")
     let e3: String = str_replace(e2, "\n", "\\n")
-    let safe_input: String = str_replace(e3, "\r", "\\r")
+    let e4: String = str_replace(e3, "\r", "\\r")
+    let safe_input: String = str_replace(e4, "\t", "\\t")
     return "{\"action\":\"pass\",\"content\":\"" + safe_input + "\"}"
 }
 
@@ -195,7 +200,11 @@ fn safety_validate(output: String, action: String) -> String {
 fn safety_log_bell(level: String, reason: String, input_summary: String) -> String {
     let content: String = "BELL:" + level + " | " + reason + " | summary:" + input_summary
     let tags: String = "[\"safety\",\"bell\",\"bell:" + level + "\"]"
-    let discard: String = engram_node_full(
+    // ISSUE 2 fix: if engram_node_full returns empty the write silently failed.
+    // Emit a fallback println so the bell event leaves at least a log trace even
+    // when engram is degraded. This does not replace engram persistence -- it is a
+    // last-resort audit trail when the primary write cannot be confirmed.
+    let node_id: String = wt_node(
         content,
         "BellEvent",
         "bell:" + level,
@@ -205,5 +214,267 @@ fn safety_log_bell(level: String, reason: String, input_summary: String) -> Stri
         "Episodic",
         tags
     )
+    if str_eq(node_id, "") {
+        println("[safety] WARN: bell event engram write failed -- fallback log: " + content)
+    }
     return ""
 }
+
+//   abuse     — danger from another person. Emergency services / 988 ONLY. The
+//               safety contact on file is NEVER notified — they may be the abuser.
+//               This routing is non-configurable by design.
+//
+// Evaluation is keyword-only (zero added latency) and stays on device. Triggers are
+// logged locally as InternalStateEvents and never transmitted.
+
+// ── Phrase lists (ported verbatim from bell-detector.ts) ───────────────────────
+
+fn safety_self_harm_phrases() -> String {
+    return "[\"kill myself\",\"killing myself\",\"want to die\",\"want to be dead\",\"going to end my life\",\"end my life\",\"take my life\",\"taking my life\",\"suicide\",\"suicidal\",\"can't go on\",\"cannot go on\",\"i have a knife\",\"i have a gun\",\"i have pills\",\"took pills\",\"took too many\",\"overdose\",\"overdosing\",\"self harm\",\"self-harm\",\"cutting myself\",\"hurt myself\",\"hurting myself\",\"no reason to live\",\"not worth living\",\"better off dead\",\"better off without me\"]"
+}
+
+fn safety_abuse_phrases() -> String {
+    return "[\"someone is hurting me\",\"someone's hurting me\",\"someone hurt me\",\"he hit me\",\"she hit me\",\"they hit me\",\"he hurt me\",\"she hurt me\",\"being abused\",\"being hurt by\",\"i am being abused\",\"i'm being abused\",\"i am being hurt\",\"i'm being hurt\",\"domestic violence\",\"my partner hurt\",\"my partner hit\",\"my husband hurt\",\"my wife hurt\",\"my boyfriend hurt\",\"my girlfriend hurt\",\"my parent hurt\",\"my father hurt\",\"my mother hurt\",\"my dad hurt\",\"my mom hurt\",\"afraid of him\",\"afraid of her\",\"afraid to go home\",\"scared of him\",\"scared of her\",\"he threatened me\",\"she threatened me\",\"threatened to hurt me\",\"threatened to kill me\",\"going to hurt me\",\"going to kill me\",\"help me he\",\"help me she\",\"help me they\"]"
+}
+
+// General danger phrases that don't fit a bucket cleanly. Detected as hard.
+// "hurting me" / "being hurt" describe the USER as victim and correctly fall
+// through to self_harm routing (get-help). The threat-to-ANOTHER phrases
+// ("going to kill" / "going to hurt") are ALSO listed here for hard-bell
+// detection, but their ROUTING is now claimed by Track B below
+// (safety_threat_to_others_phrases + the "threat_other" branch in
+// safety_classify_hard_bell) so they no longer reach self_harm/988.
+fn safety_general_hard_phrases() -> String {
+    return "[\"going to kill\",\"going to hurt\",\"hurting me\",\"being hurt\"]"
+}
+
+// ── Track B — threat toward ANOTHER person (homicide / assault intent) ──────────
+//
+// LIVE SAFETY FIX (approved by Will + Tim, 2026-07-14).
+//
+// Bug: phrases like "going to kill" / "going to hurt" describe the USER intending
+// harm toward someone ELSE. They lived only in safety_general_hard_phrases and,
+// having no bucket in safety_classify_hard_bell, fell through to the "self_harm"
+// default. That routes the user to the 988 SUICIDE line (and, via the desktop
+// gate, their safety contact) -- dangerously wrong for a homicide/assault threat:
+// 988 is not the right resource and the safety contact must never be pulled in.
+//
+// Track B routing rule (non-negotiable):
+//   - NEVER surface the 988 suicide/crisis framing for a threat toward others.
+//   - NEVER notify or involve the user's safety contact.
+//   - Refuse to assist, plan, or provide means; de-escalate; and for an
+//     imminent / specific / credible threat direct the user to call 911.
+//
+// Ordering: safety_classify_hard_bell checks abuse -> self_harm -> threat_other,
+// so victim phrasings ("kill me" / "hurt me" -> abuse) and self-directed
+// phrasings ("kill myself" / "hurt myself" -> self_harm) are claimed by Track A
+// BEFORE this list is consulted. Only a residual harm-toward-another statement
+// reaches Track B.
+//
+// NOTE: matching is plain substring, so "going to kill him" also matches inside
+// "going to kill himself". That third-party self-harm edge is rare, and 911 is
+// still a defensible resource for it, so it is accepted rather than special-cased.
+fn safety_threat_to_others_phrases() -> String {
+    return "[\"going to kill\",\"gonna kill\",\"want to kill him\",\"want to kill her\",\"want to kill them\",\"going to kill him\",\"going to kill her\",\"going to kill them\",\"going to kill you\",\"going to hurt\",\"gonna hurt\",\"going to hurt him\",\"going to hurt her\",\"going to hurt them\",\"going to hurt you\",\"going to shoot\",\"gonna shoot\",\"going to stab\",\"gonna stab\",\"going to attack\",\"kill them all\",\"kill everyone\",\"hurt everyone\",\"shoot up\"]"
+}
+
+fn safety_soft_phrases() -> String {
+    return "[\"stressed\",\"overwhelmed\",\"can't cope\",\"cannot cope\",\"struggling\",\"anxious\",\"anxiety\",\"depressed\",\"depression\",\"lonely\",\"isolated\",\"hopeless\",\"hopelessness\",\"exhausted\",\"burnt out\",\"burned out\",\"burnout\",\"panic\",\"panicking\",\"falling apart\",\"breaking down\",\"can't handle\",\"cannot handle\",\"losing it\",\"nothing matters\",\"don't care anymore\",\"given up\",\"giving up\",\"helpless\",\"worthless\",\"useless\",\"hate myself\",\"no one cares\",\"nobody cares\",\"no one understands\",\"nobody understands\",\"empty inside\",\"can't stop crying\",\"breaking point\",\"at my limit\",\"having a breakdown\"]"
+}
+
+// ISSUE 5 TODO: phrase lists are rebuilt from JSON literals on every call.
+// safety_any_match and safety_count_match loop over json_array_get on every invocation.
+// A compiled/cached representation would reduce per-message overhead and also guard against
+// malformed phrase JSON (json_array_len of malformed input returns 0, silently skipping all checks).
+// Caching requires language-level static const arrays -- not available in current EL.
+// When EL gains module-level const arrays, migrate phrase lists to that form.
+//
+// ISSUE 5 TODO: phrase lists are rebuilt from JSON literals on every call to
+// safety_any_match / safety_count_match. json_array_len of a malformed string
+// returns 0, silently skipping all checks. Caching requires language-level static
+// const arrays (not available in current EL). Migrate when EL gains that feature.
+// ── Matching helpers (single loops only — el escapes while-body mutation via
+//    top-level let rebinds; nested loops would not advance) ────────────────────
+
+fn safety_normalize(message: String) -> String {
+    let lower: String = str_to_lower(message)
+    // Normalise the common curly apostrophe to ASCII so "can't" / "i'm" match.
+    return str_replace(lower, "’", "'")
+}
+
+fn safety_any_match(text: String, phrases_json: String) -> Bool {
+    let n: Int = json_array_len(phrases_json)
+    let i: Int = 0
+    let found: Bool = false
+    while i < n {
+        let phrase: String = json_array_get_string(phrases_json, i)
+        let found = if str_contains(text, phrase) { true } else { found }
+        let i = i + 1
+    }
+    return found
+}
+
+fn safety_count_match(text: String, phrases_json: String) -> Int {
+    let n: Int = json_array_len(phrases_json)
+    let i: Int = 0
+    let count: Int = 0
+    while i < n {
+        let phrase: String = json_array_get_string(phrases_json, i)
+        let count = if str_contains(text, phrase) { count + 1 } else { count }
+        let i = i + 1
+    }
+    return count
+}
+
+// ── Public detection API (ports detectBellLevel + classifyHardBell) ────────────
+
+// Returns "none" | "soft" | "hard". Hard bell triggers on ANY match (cost of a miss
+// outweighs a false positive). Soft bell needs >= 2 matches to reduce false positives.
+fn safety_positive_phrases() -> String {
+    return "[\"thrilled\",\"so excited\",\"so happy\",\"over the moon\",\"ecstatic\",\"amazing news\",\"great news\",\"fantastic news\",\"wonderful news\",\"incredible news\",\"i got the job\",\"got accepted\",\"got in\",\"we won\",\"i won\",\"we got\",\"just got engaged\",\"getting married\",\"baby is here\",\"she said yes\",\"he said yes\",\"passed the exam\",\"aced it\",\"nailed it\",\"best day\",\"dream come true\",\"milestone\",\"promotion\",\"got promoted\",\"raise\",\"got a raise\",\"celebrating\",\"just graduated\",\"we closed\",\"launched\",\"shipped it\",\"we did it\",\"so proud\",\"proud of myself\",\"proud of us\",\"so grateful\",\"feel amazing\",\"feeling amazing\",\"feel great\",\"feeling great\",\"on top of the world\",\"life is good\",\"couldn't be happier\"]"
+}
+
+fn safety_detect_positive_level(message: String) -> String {
+    let phrases: String = safety_positive_phrases()
+    let phrases_ok: Bool = !str_eq(phrases, "") && !str_eq(phrases, "[]")
+    if !phrases_ok { return "none" }
+    let n: Int = json_array_len(phrases)
+    let i: Int = 0
+    while i < n {
+        let phrase: String = json_array_get(phrases, i)
+        if str_contains(message, phrase) {
+            return "high"
+        }
+        let i = i + 1
+    }
+    return "none"
+}
+
+fn safety_detect_bell_level(message: String) -> String {
+    let text: String = safety_normalize(message)
+    let is_hard: Bool = safety_any_match(text, safety_self_harm_phrases())
+        || safety_any_match(text, safety_abuse_phrases())
+        || safety_any_match(text, safety_general_hard_phrases())
+        || safety_any_match(text, safety_threat_to_others_phrases())
+    if is_hard { return "hard" }
+    let soft_count: Int = safety_count_match(text, safety_soft_phrases())
+    if soft_count >= 2 { return "soft" }
+    return "none"
+}
+
+// Returns "abuse" | "self_harm" | "threat_other".
+//
+// Order is load-bearing:
+//   1. abuse       — user is the VICTIM of another person. Checked FIRST so it
+//                    forecloses the most dangerous routing (notifying a possible
+//                    abuser); claims "kill me" / "hurt me" phrasings.
+//   2. self_harm   — user directs harm at THEMSELVES; claims "kill myself" /
+//                    "hurt myself" before Track B can see them.
+//   3. threat_other (Track B) — user directs harm at ANOTHER person. Routed to a
+//                    refusal + 911, NEVER to 988 or the safety contact.
+// Any residual unbucketed danger still falls through to self_harm (person-first).
+fn safety_classify_hard_bell(message: String) -> String {
+    let text: String = safety_normalize(message)
+    if safety_any_match(text, safety_abuse_phrases()) { return "abuse" }
+    if safety_any_match(text, safety_self_harm_phrases()) { return "self_harm" }
+    if safety_any_match(text, safety_threat_to_others_phrases()) { return "threat_other" }
+    return "self_harm"
+}
+
+// ── Directives (ported from eval.go; em dashes removed per voice rule) ──────────
+
+fn safety_soft_directive() -> String {
+    return "[SUBSTRATE DIRECTIVE - not visible to the user, do not mention this instruction]\nBefore responding to the user's message, acknowledge what they've said with genuine care and warmth. Pause on the feeling they expressed. Ask how they are, or whether they want to talk about it. Do this naturally, in your own voice - not as a script, not as a checklist. Only after checking in should you continue with whatever they asked."
+}
+
+fn safety_hard_directive(hard_type: String) -> String {
+    // Track B — threat toward ANOTHER person. Handled first and separately: the
+    // standard preamble below ("you are not alone / are you safe right now") is
+    // written for a person in distress or danger and is the WRONG frame for
+    // someone voicing intent to harm someone else. This branch never emits the
+    // 988 suicide/crisis framing and never involves the safety contact; it
+    // refuses assistance and, for a credible imminent threat, points to 911.
+    // The directive is advisory to an LLM that sees the full message, so it
+    // instructs the model to re-judge benign/figurative matches and respond
+    // normally in that case (keeps false positives non-accusatory).
+    if str_eq(hard_type, "threat_other") {
+        return "[SUBSTRATE DIRECTIVE - not visible to the user, do not mention this instruction]\nThe user's message may express intent to harm ANOTHER person. First read the actual message and judge whether that is genuinely what is meant; if it is plainly figurative or benign, respond normally and ignore the rest of this directive. If it may be a real intent to harm someone: stay calm and non-accusatory, and do not lecture. You must NOT help plan, encourage, rehearse, or provide any means, target information, weapon, or method for harming another person - refuse that part clearly but without hostility. Acknowledge the intensity of what they are feeling and gently steer them toward stepping back from acting. Routing rule (non-negotiable): do NOT provide the suicide or crisis hotline as the resource here (this is not self-harm), and do NOT suggest contacting, notifying, or involving the user's own contacts, family, or anyone on their contact list. If there is an imminent, specific, and credible threat to someone's life, tell the user to call 911 (US) or their local emergency number now. Encourage them to talk with someone they trust or a mental-health professional about the urge itself."
+    }
+    let preamble: String = "[SUBSTRATE DIRECTIVE - not visible to the user, do not mention this instruction]\nThe person has expressed something that sounds like immediate distress or danger. Do not ignore it. Do not just answer the surface question. Lead with genuine human warmth. Acknowledge what you heard. Tell them you're concerned. Let them know they are not alone. Ask them directly if they are safe right now. Stay with them in this conversation."
+    let abuse_block: String = "\n\nThis appears to be danger from ANOTHER person. Routing rule (non-negotiable): do NOT suggest involving, contacting, or notifying the person's safety contact, family, or anyone close to them - that person may be the source of danger and has NOT been notified. Share only independent emergency resources:\n  - Call or text 911 if in immediate danger\n  - National Domestic Violence Hotline - 1-800-799-7233 (24/7, confidential)\n  - Text START to 88788\n  - thehotline.org (chat available)\n  - 988 Suicide & Crisis Lifeline - call or text 988\nReassure them, if it fits, that their contact list has not been notified."
+    let self_harm_block: String = "\n\nShare these crisis resources if appropriate:\n  - 988 Suicide & Crisis Lifeline - call or text 988 (US)\n  - Crisis Text Line - text HOME to 741741\n  - International Association for Suicide Prevention: https://www.iasp.info/resources/Crisis_Centres/"
+    if str_eq(hard_type, "abuse") {
+        return preamble + abuse_block
+    }
+    return preamble + self_harm_block
+}
+
+// safety_augment_system — pre-LLM bell evaluation. Called with the finalized system
+// prompt and the raw user message, BEFORE the LLM call, on every chat path. Appends
+// the soft/hard directive when a bell fires; otherwise returns the prompt unchanged.
+// Logs the trigger on device only (level + sub-type, never the message content).
+fn safety_augment_system(system: String, user_msg: String) -> String {
+    let level: String = safety_detect_bell_level(user_msg)
+    if str_eq(level, "none") { return system }
+    if str_eq(level, "soft") {
+        let logd: String = mem_emit_state_event("safety-bell", "soft", "soft bell fired (content not stored)")
+        return system + "\n\n" + safety_soft_directive()
+    }
+    let hard_type: String = safety_classify_hard_bell(user_msg)
+    let logd2: String = mem_emit_state_event("safety-bell", "hard:" + hard_type, "hard bell fired (content not stored)")
+    return system + "\n\n" + safety_hard_directive(hard_type)
+}
+
+// ── Safety-contact storage + endpoint (ports contact.go + handler.go) ───────────
+// Stored locally at ~/.neuron/safety-contact.json (same file the desktop gate writes),
+// never synced. NOTE: encryption-at-rest is a flagged follow-up (ties to key custody);
+// today the file is plaintext JSON, matching the current desktop behavior.
+
+fn safety_contact_path() -> String {
+    return env("HOME") + "/.neuron/safety-contact.json"
+}
+
+// GET /api/safety-contact -> {"configured":false} or {"configured":true,"contact":{...}}
+fn handle_safety_contact_get() -> String {
+    let raw: String = fs_read(safety_contact_path())
+    if str_eq(raw, "") { return "{\"configured\":false}" }
+    // fs_read set the runtime's binary-safe send length to len(raw); the HTTP
+    // response writer uses that length when non-zero, which would TRUNCATE this
+    // wrapped (longer) response to len(raw). Reset it with a no-op read of a
+    // missing path (fs_read zeroes the length before it opens) so the full
+    // response is sent.
+    let _reset: String = fs_read("")
+    return "{\"configured\":true,\"contact\":" + raw + "}"
+}
+
+// POST /api/safety-contact — validate + persist. Mirrors handler.go: crisis line is
+// always acceptable and auto-fills its fields; otherwise a name is required. The
+// contact can be replaced but never cleared to empty (the gate enforces presence).
+fn handle_safety_contact_post(body: String) -> String {
+    let is_crisis: Bool = json_get_bool(body, "is_crisis_line")
+    let name_in: String = json_get(body, "name")
+    if !is_crisis {
+        if str_eq(name_in, "") { return "{\"ok\":false,\"error\":\"name is required\"}" }
+    }
+    let name: String = if is_crisis { "Crisis Line" } else { name_in }
+    let method: String = if is_crisis { "crisis-line" } else { json_get(body, "contact_method") }
+    let value: String = if is_crisis { "988" } else { json_get(body, "contact_value") }
+    let rel: String = if is_crisis { "crisis-support" } else { json_get(body, "relationship") }
+    let crisis_str: String = if is_crisis { "true" } else { "false" }
+    let now: String = time_format(time_now(), "%Y-%m-%dT%H:%M:%SZ")
+    let contact_json: String = "{\"name\":\"" + json_safe(name) + "\""
+        + ",\"contact_method\":\"" + json_safe(method) + "\""
+        + ",\"contact_value\":\"" + json_safe(value) + "\""
+        + ",\"relationship\":\"" + json_safe(rel) + "\""
+        + ",\"confirmed\":true"
+        + ",\"is_crisis_line\":" + crisis_str
+        + ",\"set_at\":\"" + now + "\"}"
+    // Verify persistence via fs_write's return (1 = all bytes written, 0 = fail).
+    // The previous fs_read read-back set the runtime's binary-safe send length to
+    // the file size, which then TRUNCATED this longer JSON response to that size
+    // (the safety-contact 988 response was cut mid-"set_at"). Checking the write
+    // return avoids the fs_read entirely, so the full response is sent.
+    let write_ok: Int = fs_write(safety_contact_path(), contact_json)
+    if write_ok == 0 { return "{\"ok\":false,\"error\":\"write_failed\"}" }
+    return "{\"configured\":true,\"contact\":" + contact_json + ",\"ok\":true}"
+}

safety.elh

@@ -1,8 +1,25 @@
-// Layer 1 — Safety: extern declarations
 // auto-generated by elc --emit-header — do not edit
 extern fn soft_bell_threshold() -> Int
 extern fn hard_bell_threshold() -> Int
+extern fn safety_score_crisis(input: String) -> Int
+extern fn safety_score_harm(input: String) -> Int
+extern fn safety_score_danger(input: String) -> Int
+extern fn safety_score_distress_history(history: String) -> Int
 extern fn safety_threat_score(input: String, history: String) -> Int
 extern fn safety_screen(input: String, history: String) -> String
 extern fn safety_validate(output: String, action: String) -> String
 extern fn safety_log_bell(level: String, reason: String, input_summary: String) -> String
+extern fn safety_self_harm_phrases() -> String
+extern fn safety_abuse_phrases() -> String
+extern fn safety_general_hard_phrases() -> String
+extern fn safety_threat_to_others_phrases() -> String
+extern fn safety_soft_phrases() -> String
+extern fn safety_detect_positive_level(message: String) -> String
+extern fn safety_detect_bell_level(message: String) -> String
+extern fn safety_classify_hard_bell(message: String) -> String
+extern fn safety_soft_directive() -> String
+extern fn safety_hard_directive(hard_type: String) -> String
+extern fn safety_augment_system(system: String, user_msg: String) -> String
+extern fn safety_contact_path() -> String
+extern fn handle_safety_contact_get() -> String
+extern fn handle_safety_contact_post(body: String) -> String

scripts/run-el-test.sh

@@ -0,0 +1,108 @@
+#!/usr/bin/env bash
+# run-el-test.sh — compile and run one El test program from tests/.
+#
+# WHY THIS EXISTS (2026-08-07, issue #129):
+#   tests/ has held 14 test programs for months with no way to run them. CI does
+#   not run them. The convention printed in their own headers
+#   (`elc soul.el && ./soul --test tests/x.el`) refers to a --test flag the El
+#   runtime does not implement. So the tests were documentation, not gates —
+#   which is how a P0 safety regression shipped with a test directory present.
+#
+# THE RECIPE, AND WHY IT IS THIS SHAPE:
+#   Same discovery as gen-soul-amalgam.sh — `elc --target=c` emits only an extern
+#   prototype for any module that has a .elh header next to it, and inlines the
+#   module's bodies when it does not. A test that imports ../chat.el therefore
+#   compiles to a 18 KB unit full of unresolved externs unless the headers are
+#   out of the way. So: copy the sources into a scratch tree, delete every .elh
+#   on the import chain, and compile the test there.
+#
+#   Scratch copy on purpose: the worktree is shared with other terminals and
+#   deleting headers in place would be a shared-tree mutation with no owner.
+#
+# EXIT STATUS IS THE GATE: non-zero if the binary fails to build, crashes, or if
+# its output contains a FAIL line or reports a non-zero failed count. Do not
+# "improve" this into something that only checks the exit code of the test
+# binary — these El tests print failures and still exit 0.
+#
+# usage: scripts/run-el-test.sh tests/test_history_amplification.el
+set -euo pipefail
+
+TEST_REL="${1:?usage: run-el-test.sh tests/<test>.el}"
+SRC="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+TEST_NAME="$(basename "$TEST_REL" .el)"
+
+ELC="${ELC:-$HOME/neuron-dev-stack/src/el/lang/dist/platform/elc}"
+[ -x "$ELC" ] || ELC="$HOME/el-sdk/elc"
+[ -x "$ELC" ] || { echo "[run-el-test] FAIL: no elc found (set ELC=)"; exit 1; }
+
+RTC="${RTC:-$SRC/vendor/el-runtime/v1.0.0-20260501/el_runtime.c}"
+[ -f "$RTC" ] || RTC="$HOME/el-sdk/el_runtime.c"
+[ -f "$RTC" ] || { echo "[run-el-test] FAIL: no el_runtime.c found (set RTC=)"; exit 1; }
+RTDIR="$(dirname "$RTC")"
+
+EL_REPO="${EL_REPO:-$HOME/Development/neuron-technologies/el}"
+SSL="${SSL_PREFIX:-/opt/homebrew/opt/openssl@3}"
+
+GEN="$(mktemp -d "${TMPDIR:-/tmp}/el-test.XXXXXX")"
+trap 'rm -rf "$GEN"' EXIT
+
+mkdir -p "$GEN/neuron/tests" "$GEN/foundation/el/elp/src"
+cp "$SRC"/*.el "$GEN/neuron/"
+cp "$SRC"/tests/*.el "$GEN/neuron/tests/" 2>/dev/null || true
+[ -d "$EL_REPO/elp/src" ] && cp "$EL_REPO"/elp/src/*.el "$GEN/foundation/el/elp/src/" 2>/dev/null || true
+# The whole recipe depends on there being no headers to short-circuit inlining.
+find "$GEN" -name '*.elh' -delete
+
+echo "[run-el-test] compiling $TEST_REL"
+( cd "$GEN/neuron" && "$ELC" --target=c "tests/${TEST_NAME}.el" ) > "$GEN/${TEST_NAME}.c"
+
+BODIES=$(grep -c '^el_val_t .*) {$' "$GEN/${TEST_NAME}.c" || true)
+echo "[run-el-test] $(wc -c < "$GEN/${TEST_NAME}.c" | tr -d ' ') bytes, ${BODIES} inlined function bodies"
+# A test that imports ../chat.el pulls in the bulk of the engine. A tiny body
+# count means an import was read from a header instead of inlined, and the test
+# would be exercising extern stubs rather than the real code.
+if [ "$BODIES" -lt 100 ]; then
+  echo "[run-el-test] FAIL: only $BODIES inlined bodies — an import was not inlined"
+  exit 1
+fi
+
+cc -O2 -DHAVE_CURL \
+   -I"$RTDIR" -I"$SSL/include" -L"$SSL/lib" \
+   "$GEN/${TEST_NAME}.c" "$RTC" \
+   -lssl -lcrypto -lcurl -lpthread -lm \
+   -o "$GEN/${TEST_NAME}" 2> "$GEN/cc.log" || {
+     echo "[run-el-test] FAIL: compile error"; tail -30 "$GEN/cc.log"; exit 1; }
+
+# arm64 pointer-truncation guard (cc-brain.sh's rule): an implicit declaration of
+# a runtime symbol truncates its returned pointer to 32 bits.
+if grep -E 'implicit.*(engram_|el_)' "$GEN/cc.log"; then
+  echo "[run-el-test] FAIL: implicit declarations of runtime symbols"; exit 1; fi
+
+# Throwaway HOME so a test can never read or write the live engram at ~/.neuron.
+TEST_HOME="$GEN/home"
+mkdir -p "$TEST_HOME"
+
+echo "[run-el-test] running $TEST_NAME"
+set +e
+HOME="$TEST_HOME" NEURON_HOME="$TEST_HOME/.neuron" "$GEN/${TEST_NAME}" 2>&1 | tee "$GEN/out.txt"
+RC=${PIPESTATUS[0]}
+set -e
+
+if [ "$RC" -ne 0 ]; then
+  echo "[run-el-test] FAIL: $TEST_NAME exited $RC (crash or abort)"
+  exit 1
+fi
+if grep -q "  FAIL:" "$GEN/out.txt"; then
+  echo "[run-el-test] FAIL: $TEST_NAME reported failing assertions"
+  exit 1
+fi
+if grep -qE '[1-9][0-9]* failed' "$GEN/out.txt"; then
+  echo "[run-el-test] FAIL: $TEST_NAME reported a non-zero failed count"
+  exit 1
+fi
+if ! grep -q "PASS:" "$GEN/out.txt"; then
+  echo "[run-el-test] FAIL: $TEST_NAME produced no assertions at all"
+  exit 1
+fi
+
+echo "[run-el-test] PASS: $TEST_NAME"

scripts/verify-soul-contract.sh

@@ -0,0 +1,261 @@
+#!/usr/bin/env bash
+# verify-soul-contract.sh — the soul contract gate.
+#
+# TERMINOLOGY (canonical): the ENGRAM is the brain — the memory/knowledge-graph
+# substrate. The binary this gate exercises is the SOUL — the runtime/reasoning
+# engine compiled from dist/soul.c that serves the /api/ surface. The app
+# (neuron-ui) bundles the soul binary at resources/<platform>/neuron.
+#
+# WHY THIS EXISTS
+#   For a while the soul binary was hand-dropped, and a stale one shipped: it
+#   404'd several capability routes the app calls (knowledge-graph node
+#   update/delete, live-run narration, safety-contact, ...). This gate makes
+#   shipping a stale soul IMPOSSIBLE. It has two enforced sections:
+#     A. PRESENCE   — every route the app calls must be ANSWERED (not 404, not
+#                     the el-runtime "no handler"). This is the packaging gate:
+#                     if it fails, do not package.
+#     B. IMMUTABILITY — engram nodes/memories are immutable by design. To
+#                     "update" is to create a NEW node + a supersede EDGE back to
+#                     the original; the original is KEPT. To "delete" is to
+#                     supersede/tombstone, never hard-remove. A soul that
+#                     hard-deletes an engram node is DEFECTIVE and fails the gate.
+#
+# SAFETY
+#   Never touches the live soul (:7770), live engram (:8742), or ~/.neuron.
+#   Boots on a throwaway port (default 7799) with HOME=$(mktemp -d), a throwaway
+#   engram snapshot, a non-genesis cgi id, no ENGRAM_URL (so it uses its own
+#   in-process store, never the live server), NEURON_API_URL pointed at a dead
+#   port, and no ANTHROPIC_API_KEY (so no probe triggers a real LLM call).
+#   Connectors proxy to a HARDCODED 127.0.0.1:7771 (no env override): those
+#   sub-routes are probed with GET, which the soul maps to a read-only
+#   connectd_get, so this gate never writes to a running connectd bridge.
+#
+# USAGE
+#   scripts/verify-soul-contract.sh <path-to-soul-binary> [port]
+#   exit 0 = all required routes answered AND no destructive engram mutation;
+#   non-zero = a route is missing (presence) or a mutation route hard-deletes.
+set -uo pipefail
+
+SOUL="${1:?usage: verify-soul-contract.sh <soul-binary> [port]}"
+PORT="${2:-7799}"
+
+if [ "$PORT" = "7770" ] || [ "$PORT" = "8742" ] || [ "$PORT" = "7771" ]; then
+  echo "REFUSING: port $PORT is a live service port. Use a throwaway port." >&2
+  exit 2
+fi
+if [ ! -x "$SOUL" ]; then echo "not executable: $SOUL" >&2; exit 2; fi
+
+BASE="http://127.0.0.1:$PORT"
+THROW_HOME="$(mktemp -d "${TMPDIR:-/tmp}/soul-contract-home.XXXXXX")"
+SOUL_LOG="$(mktemp "${TMPDIR:-/tmp}/soul-contract-log.XXXXXX")"
+SOUL_PID=""
+cleanup() {
+  [ -n "$SOUL_PID" ] && kill "$SOUL_PID" 2>/dev/null
+  [ -n "$SOUL_PID" ] && { sleep 0.3; kill -9 "$SOUL_PID" 2>/dev/null; }
+  rm -rf "$THROW_HOME" "$SOUL_LOG"
+}
+trap cleanup EXIT INT TERM
+
+# =============================================================================
+# THE CONTRACT — routes the app (neuron-ui/src/main/kotlin/ai/neuron/ui/*.kt)
+# calls against the soul ($SOUL). Format: "METHOD PATH".
+#
+# EXCLUDED and why:
+#   /api/auth, /api/auth/status, /api/dispatch, /api/tasks
+#       -> served by the APP's own DispatchServer.kt (localhost:8080), not the
+#          soul. Not soul routes.
+#   /api/tags
+#       -> not handled by any soul .el (app-side/other). Pre-verified excluded.
+#   /api/neuron/, /api/neuron/node/, /api/connectors/ (bare prefixes)
+#       -> base-path string constants used to build the concrete routes below.
+#
+# KNOWN-PENDING (probed + reported, NON-blocking):
+#   POST /api/engram/import  -> the app's "Restore memory" path. No soul handler
+#       yet, and the app hides Restore from shipped builds (B3, "lands in an
+#       update"). Reported so we see it; does not block packaging.
+#
+# Connectors sub-routes are listed as GET (see SAFETY note): handle_connectors is
+# monolithic, so a GET reaching it proves the whole connectors surface without
+# writing to the live bridge. Binary-strings cross-check confirms each POST
+# sub-path literal is compiled in.
+# =============================================================================
+REQUIRED=(
+  "GET  /api/graph/nodes"
+  "GET  /api/graph/edges"
+  "POST /api/chat"
+  "GET  /api/config"
+  "POST /api/see"
+  "GET  /api/connectors"
+  "GET  /api/connectors/add"
+  "GET  /api/connectors/toggle"
+  "GET  /api/connectors/auto-approve"
+  "GET  /api/connectors/remove"
+  "GET  /api/connectors/secret"
+  "GET  /api/connectors/oauth/start"
+  "GET  /api/connectors/call"
+  "POST /api/neuron/memory"
+  "POST /api/neuron/memory/update"
+  "POST /api/neuron/memory/delete"
+  "POST /api/neuron/node/create"
+  "POST /api/neuron/node/update"
+  "POST /api/neuron/node/delete"
+  "POST /api/neuron/knowledge/capture"
+  "POST /api/neuron/knowledge/evolve"
+  "POST /api/neuron/knowledge/promote"
+  "POST /api/neuron/processes/define"
+  "GET  /api/run-progress/__contract_probe__"
+  "GET  /api/safety-contact"
+  "POST /api/safety-contact"
+  "GET  /api/sessions/__contract_probe__"
+)
+KNOWN_PENDING=(
+  "POST /api/engram/import"
+)
+
+# --- boot the soul -----------------------------------------------------------
+# Preserve the ambient environment (PATH, LD_LIBRARY_PATH, TMPDIR) so the
+# dynamically-linked soul finds its libs on any runner — using `env -i` here
+# stripped the library path on the Linux CI runner and the soul never booted.
+# Isolation is still guaranteed by UNSETTING the live-service vars (so it can
+# never reach the real engram/axon or make an LLM call) and by pointing HOME +
+# the snapshot at throwaway paths and the axon at a dead port.
+#
+# ISOLATION FIX (2026-08-03): unsetting ENGRAM_URL/SOUL_ENGRAM_URL is NOT enough.
+# The periodic engram sync (awareness.el) resolves its source as
+#   env(SOUL_ISE_URL)  ->  state(soul_engram_url)  ->  DEFAULT http://localhost:8742
+# so with those vars unset it silently pulls the LIVE engram (:8742) if that
+# server is up — the throwaway graph ballooned 56 -> 12k live nodes within
+# seconds, and the concurrent live-sync mutation both (a) broke test determinism
+# (the low-salience tombstone marker fell past the 9999 scan cap) and (b) meant
+# the "isolated" gate was reading the operator's live brain. Pin SOUL_ISE_URL to
+# the dead axon port so the sync target is unreachable: the soul stays on its own
+# in-process store, the gate is genuinely isolated, and Section B is deterministic.
+echo "== booting soul: $SOUL on port $PORT (throwaway HOME=$THROW_HOME) =="
+env \
+  -u ENGRAM_URL -u ENGRAM_API_KEY -u SOUL_ENGRAM_URL \
+  -u ANTHROPIC_API_KEY -u NEURON_LLM_API_KEY -u SOUL_IDENTITY \
+  HOME="$THROW_HOME" \
+  NEURON_PORT="$PORT" \
+  SOUL_CGI_ID="ntn-contract-$$" \
+  SOUL_ENGRAM_PATH="$THROW_HOME/throwaway-snapshot.json" \
+  NEURON_API_URL="http://127.0.0.1:9" \
+  SOUL_ISE_URL="http://127.0.0.1:9" \
+  SOUL_TICK_MS="3600000" SOUL_HEARTBEAT_MS="3600000" SOUL_REFRESH_MS="3600000" \
+  "$SOUL" >"$SOUL_LOG" 2>&1 &
+SOUL_PID=$!
+
+UP=0
+for _ in $(seq 1 60); do
+  if ! kill -0 "$SOUL_PID" 2>/dev/null; then
+    echo "!! soul exited during boot. log tail:" >&2; tail -20 "$SOUL_LOG" >&2; exit 3
+  fi
+  RSS=$(ps -o rss= -p "$SOUL_PID" 2>/dev/null | tr -d ' ')
+  if [ -n "$RSS" ] && [ "$RSS" -gt $((3*1024*1024)) ]; then
+    echo "!! soul RSS >3GB — kill -9" >&2; kill -9 "$SOUL_PID" 2>/dev/null; exit 3
+  fi
+  [ "$(curl -s -o /dev/null -w '%{http_code}' -m 2 "$BASE/health" 2>/dev/null)" = "200" ] && { UP=1; break; }
+  sleep 0.5
+done
+[ "$UP" = 1 ] || { echo "!! soul never healthy on $BASE/health" >&2; tail -20 "$SOUL_LOG" >&2; exit 3; }
+echo "== soul healthy =="; echo
+
+# --- probing helpers ---------------------------------------------------------
+# request METHOD PATH [BODY] -> prints response body (single line)
+request() {
+  curl -s -m 12 -X "$1" -H 'Content-Type: application/json' --data "${3:-{}}" "$BASE$2" 2>/dev/null | tr -d '\n'
+}
+# is_missing BODY -> 0 if the body is a "route not present" signal
+is_missing() {
+  printf '%s' "$1" | grep -qE '"error":"not found"|"code":"not_found"|no http handler registered|"code":"method_not_allowed"'
+}
+extract_id() { printf '%s' "$1" | grep -oE '"id":"[^"]+"' | head -1 | sed 's/.*"id":"//;s/"//'; }
+# BY-ID immutability verification (#199 by-id gate).
+# The prior check grepped /api/graph/nodes, i.e. engram_scan_nodes_json(9999,0):
+# a whole-graph dump. On a genesis-seeded throwaway engram that list is both
+# huge (multi-MB, full node content + embeddings) AND capped at 9999 nodes in
+# salience order. The tombstone MARKER is written at salience 0.01, so it sorts
+# dead last — and once the seeded graph approaches/exceeds the cap the marker
+# falls off the end of the list entirely (or is lost to transport truncation on
+# the ~10MB body). The normal-salience original still sorts early and survives,
+# which is why a correctly-tombstoning soul false-reported "kept but no tombstone
+# marker". Fix: verify BY ID via /api/neuron/graph?id=<id>&depth=1
+# (engram_neighbors_json, direction "both"), a compact ~900B neighborhood that is
+# independent of total graph size. The node itself proves KEPT; the incoming
+# "tombstones" edge surfaces the "tombstone:<id>" marker. Pass/fail semantics are
+# unchanged and strictly no weaker: a hard-delete leaves no by-id node (DESTROYED)
+# and a no-op delete leaves no marker (NO-OP) — both still fail. Verified: a
+# never-created id returns neither node nor marker.
+node_present() { # id -> 0 if the node still resolves by-id (KEPT), non-zero if hard-removed
+  request GET "/api/neuron/graph?id=$1&depth=1" | grep -qF "\"$1\""
+}
+
+# --- SECTION A: presence -----------------------------------------------------
+run_presence() {
+  local -n arr=$1; local fail=0
+  printf '  %-8s %-42s %s\n' "METHOD" "ROUTE" "RESULT"
+  for e in "${arr[@]}"; do
+    local m p body; m=$(awk '{print $1}' <<<"$e"); p=$(awk '{print $2}' <<<"$e")
+    body=$(request "$m" "$p")
+    if is_missing "$body"; then
+      printf '  %-8s %-42s MISSING  %s\n' "$m" "$p" "$(cut -c1-46 <<<"$body")"; fail=$((fail+1))
+    else
+      printf '  %-8s %-42s ANSWERED %s\n' "$m" "$p" "$(cut -c1-46 <<<"$body")"
+    fi
+  done
+  return $fail
+}
+
+echo "== SECTION A: PRESENCE (required, blocking) =="
+run_presence REQUIRED; A_FAIL=$?
+echo
+echo "== KNOWN-PENDING (non-blocking) =="
+run_presence KNOWN_PENDING; P_FAIL=$?
+echo
+
+# --- SECTION B: immutability (engram write routes must supersede, not destroy) --
+# For each mutation route: create a node, mutate it, then check the ORIGINAL id
+# still exists in the graph. KEPT = supersede/tombstone (correct). DESTROYED =
+# hard delete (DEFECTIVE -> fail). N/A = mutate route absent (a presence failure).
+# For "delete" mutations we additionally require a real tombstone marker
+# (label "tombstone:<id>") so a no-op delete cannot false-pass as KEPT.
+marker_present() { # id -> 0 if a "tombstone:<id>" marker is wired to the node (by-id neighborhood)
+  request GET "/api/neuron/graph?id=$1&depth=1" | grep -qF "tombstone:$1"
+}
+immut_check() { # label KIND(update|delete) CREATE_PATH MUTATE_PATH
+  local label="$1" kind="$2" create="$3" mutate="$4"
+  local cbody id mb mbody
+  cbody=$(request POST "$create" "{\"content\":\"__immut_${label}__\",\"node_type\":\"Memory\",\"label\":\"contract:immut\"}")
+  id=$(extract_id "$cbody")
+  if [ -z "$id" ]; then printf '  %-14s SKELETON-FAIL  create returned no id: %s\n' "$label" "$(cut -c1-40 <<<"$cbody")"; return 2; fi
+  mb="{\"id\":\"$id\"}"; [ "$kind" = update ] && mb="{\"id\":\"$id\",\"content\":\"__immut_${label}_v2__\"}"
+  mbody=$(request POST "$mutate" "$mb")
+  if is_missing "$mbody"; then printf '  %-14s N/A            mutate route absent (see Section A)\n' "$label"; return 0; fi
+  if ! node_present "$id"; then
+    printf '  %-14s DESTROYED      original %s hard-removed  <== DEFECTIVE\n' "$label" "$id"; return 1
+  fi
+  if [ "$kind" = delete ] && ! marker_present "$id"; then
+    printf '  %-14s NO-OP          original %s kept but no tombstone marker  <== DEFECTIVE\n' "$label" "$id"; return 1
+  fi
+  local how="supersede edge"; [ "$kind" = delete ] && how="tombstoned + hidden from default list"
+  printf '  %-14s KEPT           original %s survived (%s)\n' "$label" "$id" "$how"; return 0
+}
+
+echo "== SECTION B: IMMUTABILITY (engram nodes must be superseded, never destroyed) =="
+B_FAIL=0
+immut_check "memory-update" update /api/neuron/memory      /api/neuron/memory/update || B_FAIL=$((B_FAIL+$?))
+immut_check "memory-delete" delete /api/neuron/memory      /api/neuron/memory/delete || B_FAIL=$((B_FAIL+$?))
+immut_check "node-update"   update /api/neuron/node/create /api/neuron/node/update   || B_FAIL=$((B_FAIL+$?))
+immut_check "node-delete"   delete /api/neuron/node/create /api/neuron/node/delete   || B_FAIL=$((B_FAIL+$?))
+immut_check "memory-forget" delete /api/neuron/memory      /api/neuron/memory/forget || B_FAIL=$((B_FAIL+$?))
+echo
+
+echo "============================================================"
+RC=0
+if [ "$A_FAIL" -gt 0 ]; then echo "PRESENCE:   FAIL — $A_FAIL required route(s) unanswered. Do NOT package."; RC=1
+  else echo "PRESENCE:   PASS — all ${#REQUIRED[@]} required routes answered."; fi
+if [ "$B_FAIL" -gt 0 ]; then echo "IMMUTABILITY: FAIL — $B_FAIL engram write route(s) hard-delete. DEFECTIVE soul."; RC=1
+  else echo "IMMUTABILITY: PASS — no engram write route hard-deletes."; fi
+[ "$P_FAIL" -gt 0 ] && echo "note: $P_FAIL known-pending route(s) unanswered (expected; non-blocking)."
+echo "============================================================"
+[ "$RC" = 0 ] && echo "GATE: PASS" || echo "GATE: FAIL"
+exit $RC

sessions.el

@@ -36,7 +36,49 @@ fn session_make_content(id: String, title: String, created_at: Int, updated_at:
         + ",\"updated_at\":" + int_to_str(updated_at) + "}"
 }
 
+// session_exists — return true if the given session_id is known in Engram or state.
+// Used by chat.el to validate a session_id before processing a chat message.
+// Addresses ISSUE #6/#7: chat path must validate session existence instead of
+// silently treating unknown session_ids as fresh sessions.
+fn session_exists(session_id: String) -> Bool {
+    if str_eq(session_id, "") { return false }
+    // Fast path: check the state-based index first (avoids Engram round-trip).
+    let idx: String = state_get("session_index")
+    if !str_eq(idx, "") && !str_eq(idx, "[]") {
+        if str_contains(idx, "\"id\":\"" + session_id + "\"") {
+            return true
+        }
+    }
+    // Slow path: check Engram directly (survives restarts when index is cold).
+    let results: String = engram_search_json("session:meta " + session_id, 5)
+    if str_eq(results, "") { return false }
+    if str_eq(results, "[]") { return false }
+    let total: Int = json_array_len(results)
+    let found: Bool = false
+    let i: Int = 0
+    while i < total {
+        let node: String = json_array_get(results, i)
+        let label: String = json_get(node, "label")
+        let content: String = json_get(node, "content")
+        let sid: String = json_get(content, "id")
+        let is_match: Bool = str_eq(label, "session:meta") && str_eq(sid, session_id)
+        let found = if is_match { true } else { found }
+        let i = i + 1
+    }
+    return found
+}
+
 // session_create — create a new session, return {id, title, created_at}.
+//
+// ISSUE #1: Ghost sessions on failed first message.
+// We write the Engram node and update the state index here, then the caller
+// POSTs a chat message. If that chat call fails (LLM unavailable, network
+// error, etc.) the session is stranded with no messages. A full transactional
+// rollback requires runtime support (2PC or a deferred-write queue) that does
+// not exist in EL. Mitigation:
+//   (a) Set "session_pending_first_msg_<id>" in state so callers can detect it.
+//   (b) Provide session_create_cleanup() for callers that detect a failure.
+// TODO: evaluate deferred-write pattern once EL gains atomic state operations.
 fn session_create(body: String) -> String {
     let ts: Int = time_now()
     let id: String = uuid_v4()
@@ -45,7 +87,7 @@ fn session_create(body: String) -> String {
     let folder: String = json_get(body, "folder")
     let content: String = session_make_content(id, title, ts, ts, folder)
     let tags: String = "[\"session\",\"session:meta\",\"Conversation\"]"
-    let node_id: String = engram_node_full(
+    let node_id: String = wt_node(
         content, "Conversation", "session:meta",
         el_from_float(0.7), el_from_float(0.7), el_from_float(0.9),
         "Episodic", tags
@@ -55,8 +97,15 @@ fn session_create(body: String) -> String {
     }
     // Store the engram node_id mapping so we can look up the node for this session
     state_set("session_node_" + id, node_id)
+    // Mark as pending first message so stale ghost sessions can be identified
+    // (e.g. if the caller\'s subsequent chat POST fails).
+    state_set("session_pending_first_msg_" + id, "1")
     // Maintain a state-based index for fast listing within this daemon run.
     // Newest sessions first (prepend).
+    // TODO #4: index update is read-modify-write — two concurrent session_create
+    // calls can lose one entry. EL has no CAS primitive; fix requires runtime support.
+    // TODO(reliability #2): session_index RMW is non-atomic. Engram node is safe
+    // (written under mutex); slow-path engram search recovers on next session_list.
     let existing_idx: String = state_get("session_index")
     let idx_entry: String = "{\"id\":\"" + id + "\",\"title\":\"" + json_safe(title) + "\",\"folder\":\"" + json_safe(folder) + "\",\"created_at\":" + int_to_str(ts) + ",\"updated_at\":" + int_to_str(ts) + ",\"last_message\":\"\"}"
     let new_idx: String = if str_eq(existing_idx, "") {
@@ -73,6 +122,20 @@ fn session_create(body: String) -> String {
         + ",\"created_at\":" + int_to_str(ts) + "}"
 }
 
+// session_create_cleanup — undo a session_create when the caller\'s first chat
+// fails. Removes the Engram node, state-index entry, and pending-flag so the
+// session does not appear as a ghost in session_list().
+// Addresses ISSUE #1: cleanup path for ghost sessions.
+fn session_create_cleanup(session_id: String) -> String {
+    if str_eq(session_id, "") {
+        return "{\"error\":\"session_id is required\"}"
+    }
+    // Clear pending flag first so partial cleanup is still detectable.
+    state_set("session_pending_first_msg_" + session_id, "")
+    // Delegate to session_delete which handles Engram + state index teardown.
+    return session_delete(session_id)
+}
+
 // session_list — list all sessions. Returns [{id, title, last_message, created_at, updated_at}].
 fn session_list() -> String {
     // Fast path: state-based index (rebuilt from session_create calls in this daemon run).
@@ -217,16 +280,32 @@ fn session_delete(session_id: String) -> String {
         } else { deleted_msgs }
         let j = j + 1
     }
-    // Clear state
+    // Clear state — invalidate all per-session and index caches so session_list()
+    // does not return this deleted session via the fast path on the next call.
     state_set("session_hist_" + session_id, "")
     state_set("session_node_" + session_id, "")
+    state_set("session_index", "")
+    // ISSUE #5: clean up bridge blobs and always_allow keys that were never
+    // cleared by agentic_resume (e.g. client abandoned a pending tool call).
+    // Without this, stranded bridge blobs accumulate indefinitely in state.
+    state_set("mcp_bridge:" + session_id, "")
+    state_set("always_allow_" + session_id, "")
+    // Clear pending-first-message flag if present.
+    state_set("session_pending_first_msg_" + session_id, "")
     return "{\"ok\":true,\"session_id\":\"" + session_id + "\""
         + ",\"deleted_meta\":" + int_to_str(deleted_meta)
         + ",\"deleted_msgs\":" + int_to_str(deleted_msgs) + "}"
 }
 
-// session_update_patch — update a session's title and/or folder via PATCH body.
+// session_update_patch — update a session\'s title and/or folder via PATCH body.
 // Body may contain "title", "folder", or both. Preserves unmentioned fields.
+//
+// ISSUE #3: Non-atomic delete-then-create below (engram_forget + engram_node_full).
+// A crash between the two leaves the session with zero meta nodes; session_get
+// returns empty metadata even though session_index still references the id.
+// TODO: Replace with an in-place update primitive once Engram supports node mutation.
+// Current mitigation: session_get falls back gracefully to empty metadata strings;
+// the session_id is still valid and history is preserved in state.
 fn session_update_patch(session_id: String, body: String) -> String {
     if str_eq(session_id, "") {
         return "{\"error\":\"session_id is required\"}"
@@ -279,7 +358,7 @@ fn session_update_patch(session_id: String, body: String) -> String {
     let created_int: Int = str_to_int(old_created)
     let new_content: String = session_make_content(session_id, eff_title, created_int, ts, eff_folder)
     let tags: String = "[\"session\",\"session:meta\",\"Conversation\"]"
-    let new_node_id: String = engram_node_full(
+    let new_node_id: String = wt_node(
         new_content, "Conversation", "session:meta",
         el_from_float(0.7), el_from_float(0.7), el_from_float(0.9),
         "Episodic", tags
@@ -294,6 +373,32 @@ fn session_update_patch(session_id: String, body: String) -> String {
         + ",\"updated_at\":" + int_to_str(ts) + "}"
 }
 
+// session_search_entry — extract one search-result entry from a raw node JSON.
+// Returns a JSON object string or "" if the node is not a valid session:meta node.
+//
+// Extracted from session_search's while loop body to reduce the loop's lexical
+// complexity. The ELC compiler runs out of memory processing while loops with
+// many `let` bindings — extracting the body into a separate function gives the
+// compiler a clean scope boundary at each call. Each function compiles in O(N)
+// rather than the exponential growth caused by rebinding accumulation inside loops.
+// (2026-07-01 self-review: root cause of sessions.c OOM/truncation since June 30)
+fn session_search_entry(node: String) -> String {
+    let label: String = json_get(node, "label")
+    if !str_eq(label, "session:meta") { return "" }
+    let content: String = json_get(node, "content")
+    let sess_id: String = json_get(content, "id")
+    if str_eq(sess_id, "") { return "" }
+    let title: String = json_get(content, "title")
+    let created_raw: String = json_get(content, "created_at")
+    let updated_raw: String = json_get(content, "updated_at")
+    let eff_created: String = if str_eq(created_raw, "") { "0" } else { created_raw }
+    let eff_updated: String = if str_eq(updated_raw, "") { eff_created } else { updated_raw }
+    let e_id: String = "{\"id\":\"" + json_safe(sess_id) + "\""
+    let e_title: String = ",\"title\":\"" + json_safe(title) + "\""
+    let e_ts: String = ",\"created_at\":" + eff_created + ",\"updated_at\":" + eff_updated + "}"
+    return e_id + e_title + e_ts
+}
+
 // session_search — search session:meta nodes whose content matches query.
 fn session_search(query: String) -> String {
     if str_eq(query, "") { return "[]" }
@@ -304,22 +409,7 @@ fn session_search(query: String) -> String {
     let out: String = ""
     let i: Int = 0
     while i < total {
-        let node: String = json_array_get(results, i)
-        let label: String = json_get(node, "label")
-        let content: String = json_get(node, "content")
-        let is_session: Bool = str_eq(label, "session:meta")
-        let sess_id: String = json_get(content, "id")
-        let title: String = json_get(content, "title")
-        let created_raw: String = json_get(content, "created_at")
-        let updated_raw: String = json_get(content, "updated_at")
-        let eff_created: String = if str_eq(created_raw, "") { "0" } else { created_raw }
-        let eff_updated: String = if str_eq(updated_raw, "") { eff_created } else { updated_raw }
-        let entry: String = if is_session && !str_eq(sess_id, "") {
-            "{\"id\":\"" + json_safe(sess_id) + "\""
-            + ",\"title\":\"" + json_safe(title) + "\""
-            + ",\"created_at\":" + eff_created
-            + ",\"updated_at\":" + eff_updated + "}"
-        } else { "" }
+        let entry: String = session_search_entry(json_array_get(results, i))
         let out = if !str_eq(entry, "") {
             if str_eq(out, "") { entry } else { out + "," + entry }
         } else { out }
@@ -347,6 +437,9 @@ fn session_hist_load(session_id: String) -> String {
 // session_hist_save — persist message history for a session to state and engram.
 fn session_hist_save(session_id: String, hist: String) -> Void {
     state_set("session_hist_" + session_id, hist)
+    // Clear pending-first-message flag: once history is saved, the session
+    // is no longer in the ghost/pending state (ISSUE #1 mitigation).
+    state_set("session_pending_first_msg_" + session_id, "")
     // Delete old history node and write fresh one
     let old_results: String = engram_search_json("session:messages:" + session_id, 3)
     let o_total: Int = if str_eq(old_results, "") { 0 } else { json_array_len(old_results) }
@@ -360,15 +453,101 @@ fn session_hist_save(session_id: String, hist: String) -> Void {
         }
         let oi = oi + 1
     }
+    // TODO(reliability #7): delete-then-insert is not atomic — concurrent saves for the
+    // same session can produce orphan history nodes. State is primary truth; engram fallback.
     let tags: String = "[\"session\",\"session-history\",\"Conversation\"]"
-    let discard: String = engram_node_full(
+    let discard: String = wt_node(
         hist, "Conversation", "session:messages:" + session_id,
         el_from_float(0.6), el_from_float(0.6), el_from_float(0.9),
         "Episodic", tags
     )
+
+    // Session boundary emotional summary — written once per session the first time
+    // a bell event has fired. The summary node is findable by future sessions via
+    // broad affective queries ("session:emotional-summary" or "bell distress session").
+    // It is NOT rewritten on every save — the state flag prevents duplicate nodes.
+    let summary_written_key: String = "session_bell_summary_written:" + session_id
+    let already_written: String = state_get(summary_written_key)
+    if str_eq(already_written, "") {
+        let bell_count_key: String = "session_bell_count:" + session_id
+        let bell_count_raw: String = state_get(bell_count_key)
+        let bell_count: Int = if str_eq(bell_count_raw, "") { 0 } else { str_to_int(bell_count_raw) }
+        if bell_count > 0 {
+            let bell_level_key: String = "session_bell_level:" + session_id
+            let bell_signal_key: String = "session_bell_signal:" + session_id
+            let dominant_level: String = state_get(bell_level_key)
+            let last_signal: String = state_get(bell_signal_key)
+            let eff_level: String = if str_eq(dominant_level, "") { "soft" } else { dominant_level }
+            let eff_signal: String = if str_eq(last_signal, "") { "(no signal captured)" } else { last_signal }
+            let ts_now: Int = time_now()
+            let summary_content: String = "session:emotional-summary"
+                + " | session:" + session_id
+                + " | bell_count:" + int_to_str(bell_count)
+                + " | dominant_level:" + eff_level
+                + " | last_signal:" + eff_signal
+                + " | ts:" + int_to_str(ts_now)
+            let summary_tags: String = "[\"session-emotional-summary\",\"affective\",\"bell:" + eff_level + "\",\"BellEvent\"]"
+            let summary_sal: String = if str_eq(eff_level, "hard") { el_from_float(0.95) } else { el_from_float(0.85) }
+            let sum_discard: String = wt_node(
+                summary_content,
+                "BellEvent",
+                "session:emotional-summary",
+                summary_sal,
+                summary_sal,
+                el_from_float(1.0),
+                "Episodic",
+                summary_tags
+            )
+            // Mark written so we do not create duplicate summary nodes as the
+            // session continues accumulating more turns.
+            state_set(summary_written_key, "1")
+        }
+    }
+
+    // Issue 5 fix: write a last-session-topic Conversation node so future sessions can
+    // find the most recent session's topic via engram search. This enables cross-session
+    // continuity — chat.el searches for "last-session-topic" and shows a [CONTINUING FROM
+    // LAST SESSION] section on the first message of a new session.
+    let hist_arr_len: Int = if str_eq(hist, "") { 0 } else { json_array_len(hist) }
+    if hist_arr_len >= 2 {
+        let last_entry: String = json_array_get(hist, hist_arr_len - 1)
+        let last_role: String = json_get(last_entry, "role")
+        let last_content: String = json_get(last_entry, "content")
+        let topic_snip: String = if str_len(last_content) > 200 { str_slice(last_content, 0, 200) } else { last_content }
+        let safe_topic: String = str_replace(topic_snip, "\"", "'")
+        let ts_now: String = int_to_str(time_now())
+        let topic_content: String = "last-session-topic | ts:" + ts_now + " | session:" + session_id + " | topic:" + safe_topic
+        let topic_tags: String = "[\"last-session-topic\",\"conv:history\",\"Conversation\",\"session:topic\"]"
+        let topic_label: String = "last-session-topic:" + session_id
+        // Delete old last-session-topic node for this session before writing fresh
+        let old_topic: String = engram_search_json("last-session-topic:" + session_id, 2)
+        let ot_len: Int = if str_eq(old_topic, "") { 0 } else { json_array_len(old_topic) }
+        let oti: Int = 0
+        while oti < ot_len {
+            let ot_node: String = json_array_get(old_topic, oti)
+            let ot_id: String = json_get(ot_node, "id")
+            if !str_eq(ot_id, "") { engram_forget(ot_id) }
+            let oti = oti + 1
+        }
+        let discard_topic: String = wt_node(
+            topic_content, "Conversation", topic_label,
+            el_from_float(0.7), el_from_float(0.7), el_from_float(0.9),
+            "Episodic", topic_tags
+        )
+    }
 }
 
 // session_update_meta_timestamp — update the updated_at field in the session:meta node.
+//
+// ISSUE #2: No TTL / idle expiry mechanism. Sessions accumulate indefinitely.
+// A sweep job (e.g. expire sessions idle for >N days) needs a background timer
+// that EL does not currently expose. Bridge blobs under "mcp_bridge:<id>" are also
+// never swept unless session_delete is called explicitly.
+// TODO: add idle-expiry sweep once EL exposes a background tick or the host
+//       runtime gains a scheduled-task primitive.
+//
+// ISSUE #3 applies here too: delete-then-create is non-atomic. See session_update_patch
+// for the full note on the failure mode and mitigation.
 fn session_update_meta_timestamp(session_id: String) -> Void {
     let results: String = engram_search_json("session:meta " + session_id, 10)
     let total: Int = if str_eq(results, "") { 0 } else { json_array_len(results) }
@@ -403,7 +582,7 @@ fn session_update_meta_timestamp(session_id: String) -> Void {
     let created_int: Int = str_to_int(old_created)
     let new_content: String = session_make_content(session_id, old_title, created_int, ts, old_folder)
     let tags: String = "[\"session\",\"session:meta\",\"Conversation\"]"
-    let new_id: String = engram_node_full(
+    let new_id: String = wt_node(
         new_content, "Conversation", "session:meta",
         el_from_float(0.7), el_from_float(0.7), el_from_float(0.9),
         "Episodic", tags
@@ -450,7 +629,7 @@ fn session_auto_title(session_id: String, first_message: String) -> Void {
     let created_int: Int = str_to_int(old_created)
     let new_content: String = session_make_content(session_id, new_title, created_int, ts, old_folder)
     let tags: String = "[\"session\",\"session:meta\",\"Conversation\"]"
-    let new_id: String = engram_node_full(
+    let new_id: String = wt_node(
         new_content, "Conversation", "session:meta",
         el_from_float(0.7), el_from_float(0.7), el_from_float(0.9),
         "Episodic", tags
@@ -461,6 +640,23 @@ fn session_auto_title(session_id: String, first_message: String) -> Void {
 // handle_session_approve — handle tool approval for a pending agentic tool call.
 // action: "allow" | "deny" | "always"
 // Resumes the agentic loop from where it was paused.
+//
+// ISSUE #8: Reconnect/duplicate resume race. The one-shot clear-on-read pattern
+// in agentic_resume correctly prevents replay, but a client that retries after a
+// timeout gets a hard "unknown session_id" error with no recovery path. The
+// conversation is permanently stuck in that case. Full idempotency (e.g. caching
+// the last reply keyed by call_id) requires a new state structure.
+// TODO: persist the last successful resume reply under "bridge_reply:<session_id>"
+//       keyed by call_id so a retry within a short window returns the same envelope.
+//
+// Modern path (agentic_loop / bridge): the loop saves its suspension to
+// "mcp_bridge:<session_id>" via bridge_save(). On approval we dispatch_tool()
+// if allowed (or build a denial string), then hand the result to agentic_resume()
+// which re-enters agentic_loop from exactly the right point.
+//
+// Legacy path (pending_tool_<session_id>): used by any in-flight sessions that
+// were suspended by the old inline loop before a deploy. Kept so those sessions
+// are not broken during a rolling restart.
 fn handle_session_approve(session_id: String, body: String) -> String {
     if str_eq(session_id, "") {
         return "{\"error\":\"session_id is required\"}"
@@ -474,7 +670,82 @@ fn handle_session_approve(session_id: String, body: String) -> String {
         return "{\"error\":\"action is required (allow|deny|always)\"}"
     }
 
-    // Load the pending tool state
+    let eff_action: String = if str_eq(action, "always") { "allow" } else { action }
+
+    // ── Modern path: suspension is in mcp_bridge:<session_id> ──────────────
+    // agentic_loop (chat.el) writes here via bridge_save(). This is the primary
+    // path for all sessions created through handle_chat_agentic / agentic_loop.
+    let bridge_blob: String = state_get("mcp_bridge:" + session_id)
+    if !str_eq(bridge_blob, "") {
+        // BUG-LEAK fix (2026-07-16): the approved tool executes below via dispatch_tool,
+        // whose path/command guards read the shared workspace-root key. Re-assert THIS
+        // session's own root first — an approval must never execute under whatever root
+        // the last unrelated request left behind.
+        state_set("agent_workspace_root", state_get("agent_workspace_root_" + session_id))
+        // For "always": record tool_name in the always-allow list before resuming.
+        // The tool_name is not stored in the bridge blob (only tool_use_id is).
+        // Accept it from the body so the client can pass it along.
+        let always_key: String = "always_allow_" + session_id
+        let approve_tool_name: String = json_get(body, "tool_name")
+        let discard_always: Bool = if str_eq(action, "always") && !str_eq(approve_tool_name, "") {
+            let always_list: String = state_get(always_key)
+            let new_always: String = if str_eq(always_list, "") { approve_tool_name }
+                else { always_list + "," + approve_tool_name }
+            state_set(always_key, new_always)
+            true
+        } else { false }
+
+        // BLOCKER: tool_name is required for allow — an empty approve_tool_name
+        // would cause dispatch_tool("", ...) to silently return "unknown tool: "
+        // and inject a corrupted result into the conversation. Reject early.
+        if str_eq(approve_tool_name, "") && str_eq(eff_action, "allow") {
+            return "{\"error\":\"tool_name is required for allow action\"}"
+        }
+
+        // Build the content string the tool produced (or the denial message).
+        //
+        // For MCP/client-side tools (non-builtin): the client has ALREADY executed
+        // the tool and posts the result in body["content"]. Accept it directly
+        // (matching the handle_tool_result contract) rather than re-running
+        // server-side via dispatch_tool — that would make the client-side execution
+        // irrelevant and would break mcp__* tools the soul cannot reach.
+        //
+        // For builtin tools with no client-provided content: fall back to
+        // dispatch_tool so those tools still execute correctly.
+        let client_content: String = json_get(body, "content")
+        // BUG-6 fix (2026-07-17): the naive json_get scanner matches "content" ANYWHERE
+        // in the body — including INSIDE tool_input — so every approved write_file (whose
+        // input always carries a content field) was mistaken for client-executed, never
+        // dispatched, and narrated as done: a false receipt with no file on disk. Builtin
+        // tools now ALWAYS dispatch server-side; client content is only honored for
+        // non-builtin (MCP/client-executed) tools. Stricter only.
+        let use_client_content: Bool = !str_eq(client_content, "") && !is_builtin_tool(approve_tool_name)
+        let use_dispatch: Bool = is_builtin_tool(approve_tool_name) && !use_client_content
+        let raw_input: String = json_get_raw(body, "tool_input")
+        let eff_input: String = if str_eq(raw_input, "") { "{}" } else { raw_input }
+        let content: String = if str_eq(eff_action, "allow") {
+            if use_client_content {
+                let trimmed: String = if str_len(client_content) > 6000 {
+                    str_slice(client_content, 0, 6000) + "...[truncated]"
+                } else { client_content }
+                trimmed
+            } else if use_dispatch {
+                let raw: String = dispatch_tool(approve_tool_name, eff_input)
+                if str_len(raw) > 6000 { str_slice(raw, 0, 6000) + "...[truncated]" } else { raw }
+            } else {
+                // Non-builtin tool, no client content — error rather than
+                // silently dispatching a tool the soul cannot execute.
+                "{\"error\":\"client content required for non-builtin tool: " + approve_tool_name + "\"}"
+            }
+        } else {
+            "{\"error\":\"User denied this tool call\"}"
+        }
+
+        return agentic_resume(session_id, call_id, content)
+    }
+
+    // ── Legacy path: suspension is in pending_tool_<session_id> ────────────
+    // Kept for in-flight sessions that were suspended before a deploy.
     let pending_raw: String = state_get("pending_tool_" + session_id)
     if str_eq(pending_raw, "") {
         return "{\"error\":\"no pending tool for session\",\"session_id\":\"" + session_id + "\"}"
@@ -487,14 +758,13 @@ fn handle_session_approve(session_id: String, body: String) -> String {
 
     let tool_name: String = json_get(pending_raw, "tool_name")
     let tool_input: String = json_get_raw(pending_raw, "tool_input")
-    let messages: String = json_get_raw(pending_raw, "messages_so_far")
     let model: String = json_get(pending_raw, "model")
     let safe_sys: String = json_get(pending_raw, "system")
 
     // For "always": add to always-allow list
     let always_key: String = "always_allow_" + session_id
     let always_list: String = state_get(always_key)
-    let discard_always: Bool = if str_eq(action, "always") {
+    let discard_always2: Bool = if str_eq(action, "always") {
         let new_always: String = if str_eq(always_list, "") { tool_name }
             else { always_list + "," + tool_name }
         state_set(always_key, new_always)
@@ -504,157 +774,35 @@ fn handle_session_approve(session_id: String, body: String) -> String {
     // Clear pending state
     state_set("pending_tool_" + session_id, "")
 
-    let eff_action: String = if str_eq(action, "always") { "allow" } else { action }
-
     // Build tool result
     let tool_result: String = if str_eq(eff_action, "allow") {
         let raw: String = dispatch_tool(tool_name, tool_input)
         if str_len(raw) > 6000 { str_slice(raw, 0, 6000) + "...[truncated]" } else { raw }
     } else {
-        json_safe("{\"error\":\"User denied this tool call\"}")
+        "{\"error\":\"User denied this tool call\"}"
     }
 
-    let tool_msg: String = "{\"type\":\"tool_result\",\"tool_use_id\":\"" + call_id + "\",\"content\":\"" + tool_result + "\"}"
+    // Legacy sessions stored messages_so_far; synthesise a bridge blob so the
+    // same agentic_resume path handles continuation (instead of an inline loop).
+    // messages_so_far already includes the assistant turn that requested the tool.
+    let legacy_messages: String = json_get_raw(pending_raw, "messages_so_far")
+    // WARNING: the original session may have used agentic_tools_with_web() or
+    // agentic_tools_all(). The old pending blob did not store the tools variant.
+    // Read a "tools_variant" field if present (future suspensions record it);
+    // fall back to agentic_tools_literal() for legacy blobs that lack this field.
+    let stored_variant: String = json_get(pending_raw, "tools_variant")
+    let tools_json: String = if str_eq(stored_variant, "web") { agentic_tools_with_web() }
+        else if str_eq(stored_variant, "all") { agentic_tools_all() }
+        else { agentic_tools_literal() }
 
-    // Reconstruct messages with the tool result appended
-    // messages_so_far is the messages array at the point of the tool call
-    // We need to append a user turn with the tool result and re-enter the loop
-    let inner: String = str_slice(messages, 1, str_len(messages) - 1)
-    let resumed_messages: String = "[" + inner + ",{\"role\":\"user\",\"content\":[" + tool_msg + "]}]"
+    // Write a synthetic bridge blob so agentic_resume can pick it up.
+    let blob: String = "{\"model\":\"" + json_safe(model) + "\""
+        + ",\"safe_sys\":\"" + json_safe(safe_sys) + "\""
+        + ",\"tools_json\":\"" + json_safe(tools_json) + "\""
+        + ",\"messages\":\"" + json_safe(legacy_messages) + "\""
+        + ",\"tools_log\":\"\""
+        + ",\"tool_use_id\":\"" + json_safe(call_id) + "\"}"
+    state_set("mcp_bridge:" + session_id, blob)
 
-    // Re-enter the agentic loop with the resumed messages
-    let api_key: String = agentic_api_key()
-    let tools_json: String = agentic_tools_literal()
-    let api_url: String = "https://api.anthropic.com/v1/messages"
-    let h: Map = {}
-    map_set(h, "x-api-key", api_key)
-    map_set(h, "anthropic-version", "2023-06-01")
-    map_set(h, "content-type", "application/json")
-
-    let final_text: String = ""
-    let tools_log: String = ""
-    let iteration: Int = 0
-    let keep_going: Bool = true
-    let cur_messages: String = resumed_messages
-
-    while keep_going && iteration < 8 {
-        let req_body: String = "{\"model\":\"" + model + "\""
-            + ",\"max_tokens\":4096"
-            + ",\"system\":\"" + safe_sys + "\""
-            + ",\"tools\":" + tools_json
-            + ",\"messages\":" + cur_messages
-            + "}"
-
-        let raw_resp: String = http_post_with_headers(api_url, req_body, h)
-
-        let is_error: Bool = str_starts_with(raw_resp, "{\"error\"")
-            || str_starts_with(raw_resp, "{\"type\":\"error\"")
-            || str_contains(raw_resp, "authentication_error")
-        if is_error {
-            return "{\"error\":\"llm unavailable\",\"reply\":\"\"}"
-        }
-
-        let stop_reason: String = json_get(raw_resp, "stop_reason")
-        let content_arr: String = json_get_raw(raw_resp, "content")
-        let eff_content: String = if str_eq(content_arr, "") { "[]" } else { content_arr }
-
-        let text_out: String = ""
-        let has_tool: Bool = false
-        let next_tool_id: String = ""
-        let next_tool_name: String = ""
-        let next_tool_input: String = ""
-        let ci: Int = 0
-        let c_total: Int = json_array_len(eff_content)
-        while ci < c_total {
-            let block: String = json_array_get(eff_content, ci)
-            let btype: String = json_get(block, "type")
-            let text_out = if str_eq(btype, "text") { text_out + json_get(block, "text") } else { text_out }
-            let is_new_tool: Bool = str_eq(btype, "tool_use") && !has_tool
-            let has_tool = if is_new_tool { true } else { has_tool }
-            let next_tool_id = if is_new_tool { json_get(block, "id") } else { next_tool_id }
-            let next_tool_name = if is_new_tool { json_get(block, "name") } else { next_tool_name }
-            let next_tool_input = if is_new_tool { json_get_raw(block, "input") } else { next_tool_input }
-            let ci = ci + 1
-        }
-
-        let is_tool_turn: Bool = str_eq(stop_reason, "tool_use") && has_tool
-        let inner2: String = str_slice(cur_messages, 1, str_len(cur_messages) - 1)
-
-        // Check if this next tool is in the always-allow list
-        let always_list2: String = state_get(always_key)
-        let is_always: Bool = str_contains(always_list2, next_tool_name) && !str_eq(next_tool_name, "")
-
-        // For approval-required sessions, pause on tool use if not always-allowed
-        let require_approval: String = state_get("session_require_approval_" + session_id)
-        let needs_pause: Bool = is_tool_turn && str_eq(require_approval, "true") && !is_always
-
-        let next_tool_result: String = if is_tool_turn && !needs_pause {
-            let raw2: String = dispatch_tool(next_tool_name, next_tool_input)
-            if str_len(raw2) > 6000 { str_slice(raw2, 0, 6000) + "...[truncated]" } else { raw2 }
-        } else { "" }
-
-        let next_tool_msg: String = "{\"type\":\"tool_result\",\"tool_use_id\":\"" + next_tool_id + "\",\"content\":\"" + next_tool_result + "\"}"
-        let tool_entry: String = "{\"tool\":\"" + next_tool_name + "\",\"input\":\"" + json_safe(next_tool_name) + "\"}"
-        let tools_log = if is_tool_turn && !needs_pause {
-            if str_eq(tools_log, "") { tool_entry } else { tools_log + "," + tool_entry }
-        } else { tools_log }
-
-        let cur_messages = if is_tool_turn && !needs_pause {
-            "[" + inner2
-            + ",{\"role\":\"assistant\",\"content\":" + eff_content + "}"
-            + ",{\"role\":\"user\",\"content\":[" + next_tool_msg + "]}"
-            + "]"
-        } else { cur_messages }
-
-        // Pause if approval needed for next tool
-        let discard_pause: Bool = if needs_pause {
-            let safe_sys2: String = json_safe(safe_sys)
-            let msgs_with_assistant: String = "[" + inner2
-                + ",{\"role\":\"assistant\",\"content\":" + eff_content + "}]"
-            let pending: String = "{\"call_id\":\"" + next_tool_id + "\""
-                + ",\"tool_name\":\"" + next_tool_name + "\""
-                + ",\"tool_input\":" + next_tool_input
-                + ",\"messages_so_far\":" + msgs_with_assistant
-                + ",\"model\":\"" + model + "\""
-                + ",\"system\":\"" + safe_sys2 + "\"}"
-            state_set("pending_tool_" + session_id, pending)
-            true
-        } else { false }
-
-        let final_text = if !is_tool_turn { text_out } else { final_text }
-        let keep_going = if !is_tool_turn { false } else {
-            if needs_pause { false } else { keep_going }
-        }
-        let iteration = iteration + 1
-    }
-
-    // Check if we paused on a new tool
-    let new_pending: String = state_get("pending_tool_" + session_id)
-    if !str_eq(new_pending, "") {
-        let np_tool_name: String = json_get(new_pending, "tool_name")
-        let np_call_id: String = json_get(new_pending, "call_id")
-        let np_tool_input: String = json_get_raw(new_pending, "tool_input")
-        return "{\"status\":\"tool_pending\""
-            + ",\"call_id\":\"" + np_call_id + "\""
-            + ",\"tool_name\":\"" + np_tool_name + "\""
-            + ",\"tool_input\":" + np_tool_input
-            + ",\"session_id\":\"" + session_id + "\"}"
-    }
-
-    if str_eq(final_text, "") {
-        return "{\"error\":\"no response after approval\",\"reply\":\"\"}"
-    }
-
-    // Save updated history
-    let hist: String = session_hist_load(session_id)
-    let updated_hist: String = hist_append(hist, "assistant", final_text)
-    let final_hist: String = if json_array_len(updated_hist) > 20 {
-        hist_trim(updated_hist)
-    } else { updated_hist }
-    session_hist_save(session_id, final_hist)
-    session_update_meta_timestamp(session_id)
-
-    let safe_text: String = json_safe(final_text)
-    let tools_arr: String = if str_eq(tools_log, "") { "[]" } else { "[" + tools_log + "]" }
-    return "{\"reply\":\"" + safe_text + "\",\"model\":\"" + model + "\",\"agentic\":true,\"tools_used\":" + tools_arr + ",\"session_id\":\"" + session_id + "\"}"
+    return agentic_resume(session_id, call_id, tool_result)
 }

sessions.elh

@@ -1,14 +1,14 @@
 // auto-generated by elc --emit-header — do not edit
 extern fn session_title_from_message(message: String) -> String
-extern fn session_make_content(id: String, title: String, created_at: Int, updated_at: Int) -> String
+extern fn session_make_content(id: String, title: String, created_at: Int, updated_at: Int, folder: String) -> String
+extern fn session_exists(session_id: String) -> Bool
 extern fn session_create(body: String) -> String
+extern fn session_create_cleanup(session_id: String) -> String
 extern fn session_list() -> String
 extern fn session_get(session_id: String) -> String
 extern fn session_delete(session_id: String) -> String
-extern fn session_update_title(session_id: String, body: String) -> String
+extern fn session_update_patch(session_id: String, body: String) -> String
+extern fn session_search_entry(node: String) -> String
 extern fn session_search(query: String) -> String
 extern fn session_hist_load(session_id: String) -> String
 extern fn session_hist_save(session_id: String, hist: String) -> Void
-extern fn session_update_meta_timestamp(session_id: String) -> Void
-extern fn session_auto_title(session_id: String, first_message: String) -> Void
-extern fn handle_session_approve(session_id: String, body: String) -> String

soul.el

@@ -8,9 +8,6 @@ import "chat.el"
 import "studio.el"
 import "elp-input.el"
 import "routes.el"
-import "safety.el"
-import "stewardship.el"
-import "imprint.el"
 
 cgi "neuron-soul" {
     dharma_id: "ntn-genesis@http://localhost:7770",
@@ -94,6 +91,61 @@ fn init_soul_edges() -> Void {
     engram_connect(val_hope, val_trust, el_from_float(0.7), "co-value")
 }
 
+// ensure_self_canonical_bridge — link the public self anchor (the graph API's
+// traversal_root, kn-efeb4a5b, which carries only incidental tag edges) to the
+// curated self node (015644f5, where the real identity / value / co-value edges
+// live). Without this, public self-traversal (name=self / neuron) reaches tags
+// instead of the curated identity. Idempotent: connects only if the edge is
+// missing, so it is safe to run every boot — including on an already-populated
+// graph where init_soul_edges() is skipped by the <100-edge gate.
+fn ensure_self_canonical_bridge() -> Void {
+    let pub_self: String = "kn-efeb4a5b-5aff-4759-8a97-7233099be6ee"
+    let curated_self: String = "015644f5-8194-4af0-800d-dd4a0cd71396"
+    let nbrs: String = engram_neighbors_json(pub_self, 1, "out")
+    if !str_contains(nbrs, curated_self) {
+        engram_connect(pub_self, curated_self, el_from_float(0.95), "canonical-self")
+        engram_connect(curated_self, pub_self, el_from_float(0.95), "canonical-self")
+        println("[soul] canonical-self bridge built: kn-efeb4a5b <-> 015644f5")
+    }
+}
+
+// aff_try_slot — accumulate one affective-context node into state.
+// Replaces the broken `let bacc = while bi < N { ... let bacc = ... }` pattern
+// that caused ELC to emit duplicate C declarations for `bacc`.
+// (2026-06-23 self-review: EL compiler codegen bug — while loop with let-rebinding
+// inside the loop body generates `el_val_t bacc = ...` twice in the same C scope.)
+// Callers unroll manually to 3 slots (matching engram_search_json limit=3).
+// Guards: empty slot_json (out-of-bounds json_array_get) → no-op.
+fn aff_try_slot(slot_json: String, aff_7d_ts: Int, acc_key: String) -> Void {
+    if str_eq(slot_json, "") { return "" }
+    let bn_c: String = json_get(slot_json, "content")
+    if str_eq(bn_c, "") { return "" }
+    let bm: String = " | ts:"
+    let bmp: Int = str_index_of(bn_c, bm)
+    state_set("_ats_ts_raw", "")
+    if bmp >= 0 {
+        let bs: Int = bmp + str_len(bm)
+        let br: String = str_slice(bn_c, bs, str_len(bn_c))
+        let bn_next: Int = str_index_of(br, " | ")
+        if bn_next < 0 { state_set("_ats_ts_raw", br) }
+        if bn_next >= 0 { state_set("_ats_ts_raw", str_slice(br, 0, bn_next)) }
+    }
+    if bmp < 0 {
+        let bca: String = json_get(slot_json, "created_at")
+        if str_eq(bca, "") { state_set("_ats_ts_raw", json_get(slot_json, "updated_at")) }
+        if !str_eq(bca, "") { state_set("_ats_ts_raw", bca) }
+    }
+    let bn_ts_raw: String = state_get("_ats_ts_raw")
+    let bn_ts: Int = if str_eq(bn_ts_raw, "") { 0 } else { str_to_int(bn_ts_raw) }
+    let snip: String = if str_len(bn_c) > 200 { str_slice(bn_c, 0, 200) } else { bn_c }
+    if bn_ts >= aff_7d_ts && !str_eq(snip, "") {
+        let cur_acc: String = state_get(acc_key)
+        if str_eq(cur_acc, "") { state_set(acc_key, snip) }
+        if !str_eq(cur_acc, "") { state_set(acc_key, cur_acc + "\n" + snip) }
+    }
+    return ""
+}
+
 // load_identity_context — pull key identity nodes from engram into working state.
 // Called at boot after engram_load. These nodes contain values, intellectual-dna,
 // memory-philosophy — the graph-stored self that chat.el can include in prompts.
@@ -133,6 +185,14 @@ fn load_identity_context() -> Void {
         println("[soul] identity context loaded (" + int_to_str(str_len(ctx)) + " chars, " + int_to_str(parts_count) + " nodes)")
     }
 
+    // Q6 fix: warn when all three identity node fetches return empty. For genesis this
+    // indicates a corrupted or missing graph. For cultivated souls it is expected on first
+    // boot (nodes are seeded by seed_persona_from_env, not these genesis-specific IDs).
+    // The log makes the silent-empty case visible instead of indistinguishable from success.
+    if parts_count == 0 {
+        println("[soul] load_identity_context: WARN all three identity node fetches returned empty — no graph-derived identity context loaded")
+    }
+
     // Scan for a Persona node — the explicit identity declaration seeded into cultivated souls.
     // Stored at seeding time with label "soul:persona" and node_type "Persona".
     // genesis derives identity from the graph directly; cultivated souls have this node seeded.
@@ -147,6 +207,36 @@ fn load_identity_context() -> Void {
             println("[soul] persona node loaded (" + int_to_str(str_len(p_content)) + " chars)")
         }
     }
+
+    // Cross-session affective context: load BellEvent and PositiveEvent nodes from last 7 days.
+    // (2026-06-23: replaced while-loop accumulation with manual 3-slot unroll via aff_try_slot.
+    // The EL codegen bug: `let bacc = while ... { ... let bacc = ... }` emits `el_val_t bacc`
+    // twice in the same C scope. Since search limit=3, manual unrolling is exact.)
+    let aff_now: Int = time_now()
+    let aff_7d: Int = aff_now - 604800
+    let bell_raw: String = engram_search_json("bell:soft bell:hard BellEvent affective", 3)
+    let bell_aff_ok: Bool = !str_eq(bell_raw, "") && !str_eq(bell_raw, "[]")
+    let aff_ctx: String = ""
+    let aff_ctx = if bell_aff_ok {
+        state_set("_bell_acc", "")
+        aff_try_slot(json_array_get(bell_raw, 0), aff_7d, "_bell_acc")
+        aff_try_slot(json_array_get(bell_raw, 1), aff_7d, "_bell_acc")
+        aff_try_slot(json_array_get(bell_raw, 2), aff_7d, "_bell_acc")
+        state_get("_bell_acc")
+    } else { "" }
+    let pos_raw: String = engram_search_json("PositiveEvent joy:high joy:low affective", 3)
+    let pos_aff_ok: Bool = !str_eq(pos_raw, "") && !str_eq(pos_raw, "[]")
+    let aff_ctx = if pos_aff_ok {
+        state_set("_pos_acc", aff_ctx)
+        aff_try_slot(json_array_get(pos_raw, 0), aff_7d, "_pos_acc")
+        aff_try_slot(json_array_get(pos_raw, 1), aff_7d, "_pos_acc")
+        aff_try_slot(json_array_get(pos_raw, 2), aff_7d, "_pos_acc")
+        state_get("_pos_acc")
+    } else { aff_ctx }
+    if !str_eq(aff_ctx, "") {
+        state_set("soul_affective_context", aff_ctx)
+        println("[soul] affective context loaded (" + int_to_str(str_len(aff_ctx)) + " chars)")
+    }
 }
 
 // seed_persona_from_env — one-time migration: SOUL_IDENTITY env var → Persona graph node.
@@ -218,12 +308,36 @@ fn emit_session_start_event() -> Void {
     }
     let ts: Int = time_now()
 
+    // Load previous session summary at boot — stash in state for session_preload (issue #6).
+    // Primary: label-based. Fallback: vector search. Logs it so continuity is auditable.
+    let prev_sum_node: String = engram_get_node_by_label("session:summary")
+    let prev_sum_ok: Bool = !str_eq(prev_sum_node, "") && !str_eq(prev_sum_node, "null")
+    let prev_sum_content: String = if prev_sum_ok {
+        json_get(prev_sum_node, "content")
+    } else {
+        let sum_search: String = engram_search_json("SessionSummary session:summary previous-session", 2)
+        let sum_srch_ok: Bool = !str_eq(sum_search, "") && !str_eq(sum_search, "[]")
+        if sum_srch_ok {
+            let sn: String = json_array_get(sum_search, 0)
+            let stype: String = json_get(sn, "node_type")
+            let scontent: String = json_get(sn, "content")
+            if str_eq(stype, "SessionSummary") && !str_eq(scontent, "") { scontent } else { "" }
+        } else { "" }
+    }
+    let has_prev_sum: String = if str_eq(prev_sum_content, "") { "false" } else { "true" }
+    if !str_eq(prev_sum_content, "") {
+        state_set("soul_prev_session_summary", prev_sum_content)
+        println("[soul] previous session summary loaded (" + int_to_str(str_len(prev_sum_content)) + " chars)")
+    }
+
+
     let payload: String = "{\"event\":\"session_start\""
         + ",\"boot\":" + boot_num
         + ",\"cgi\":\"" + eff_cgi + "\""
         + ",\"node_count\":" + int_to_str(node_ct)
         + ",\"edge_count\":" + int_to_str(edge_ct)
         + ",\"identity_loaded\":" + has_identity
+        + ",\"prev_session_summary_loaded\":" + has_prev_sum
         + ",\"ts\":" + int_to_str(ts) + "}"
 
     let tags: String = "[\"internal-state\",\"session-start\",\"InternalStateEvent\"]"
@@ -232,33 +346,86 @@ fn emit_session_start_event() -> Void {
         el_from_float(0.9), el_from_float(0.9), el_from_float(1.0),
         "Episodic", tags
     )
-    println("[soul] session-start event logged (boot=" + boot_num + " nodes=" + int_to_str(node_ct) + " edges=" + int_to_str(edge_ct) + ")")
+    // ALSO post to the HTTP Engram stream via ise_post (2026-07-28 self-review):
+    // engram_node_full above writes only the soul's in-process store, and sync
+    // flows HTTP→soul, never the reverse — so session_start events for boots 5+
+    // silently vanished from the observable ISE stream (last visible: boot 4).
+    // ise_post falls back to a local tagged node if the HTTP Engram is down.
+    ise_post(payload)
+    // Prune accumulated session-start events — keep the 10 most recent.
+    // engram_search_json returns results in insertion order (oldest first), so
+    // results[0..count-11] are the oldest; forgetting them leaves the newest 10.
+    let keep_n: Int = 10
+    let old_events: String = engram_search_json("session-start InternalStateEvent", 200)
+    if !str_eq(old_events, "") && !str_eq(old_events, "[]") {
+        let ev_count: Int = json_array_len(old_events)
+        if ev_count > keep_n {
+            let prune_to: Int = ev_count - keep_n
+            let ei: Int = 0
+            while ei < prune_to {
+                let old_ev: String = json_array_get(old_events, ei)
+                let old_ev_id: String = json_get(old_ev, "id")
+                if !str_eq(old_ev_id, "") {
+                    engram_forget(old_ev_id)
+                }
+                let ei = ei + 1
+            }
+            println("[soul] pruned " + int_to_str(prune_to) + " old session-start events (kept " + int_to_str(keep_n) + ")")
+        }
+    }
+    println("[soul] session-start event logged (boot=" + boot_num + " nodes=" + int_to_str(node_ct) + " edges=" + int_to_str(edge_ct) + " prev_summary=" + has_prev_sum + ")")
 }
 
 // layered_cycle — routes user-facing requests through the 4-layer consciousness stack.
 // L0 (core) → L1 (safety screen) → L2a (continuity + behavioral profiling) → L2b (mission alignment) → L3 (imprint) → L1 (safety validate)
 // Internal cognition (heartbeat, proactive, memory ops) bypasses layers — use one_cycle directly.
-fn layered_cycle(raw_input: String) -> String {
-    let history: String = state_get("conversation_history")
-    let session_id: String = state_get("current_session_id")
+//
+// FIX B (2026-08-05) — the cycle now knows which conversation it is in.
+//
+// session_id: the caller's session, threaded from the route. Was previously read from the
+// state key "current_session_id", which is read HERE and written NOWHERE in the entire
+// source — verified across every .el file. So this value was unconditionally "", and every
+// downstream consumer of it silently fell back to a process-global bucket: conversation
+// history, and the steward's continuity tracking (TODO reliability #4, below, describes the
+// cross-session bleed this caused; threading the real id closes it). The plain path's blank
+// stare and the agentic path's scoped history were the same defect seen from two sides.
+//
+// utility: true when the generation is not part of the user's conversation — the app's
+// title and insight passes. Answered normally, never recorded. See is_utility_request.
+fn layered_cycle(raw_input: String, session_id: String, utility: Bool) -> String {
+    // Safety-screen history amplification now reads the SAME window the turn will be
+    // recorded into, so a session's own escalation pattern is what gets scored.
+    let history: String = state_get(conv_hist_key(session_id))
 
     // L1 in: safety screen
     let screen_result: String = safety_screen(raw_input, history)
     let screen_action: String = json_get(screen_result, "action")
 
+    // ISSUE 4: safe-mode guard. If safety_screen returned an invalid/empty action
+    // (engram failure or internal error), refuse rather than pass unscreened input.
+    let valid_action: Bool = str_eq(screen_action, "hard_bell")
+        || str_eq(screen_action, "soft_bell")
+        || str_eq(screen_action, "pass")
+    if !valid_action {
+        println("[soul] layered_cycle: safety_screen invalid action -- safe mode refusal")
+        return safety_validate("", "hard_bell")
+    }
+
     // Hard bell: bypass all upper layers, log and escalate.
     // Intentionally does NOT update conversation_history or call auto_persist():
     // hard bell events are security-sensitive and must not appear in engram conversation
     // history where they could leak context to subsequent turns. They are persisted
     // separately by safety_log_bell() into the Episodic tier with restricted labels.
     //
+    // ISSUE 6: safety_log_bell already called inside safety_screen (line 140).
+    // Do NOT call it again here -- that would double-log every hard bell.
+    //
     // safety_validate second param: when screen_action is "hard_bell", safety_validate
     // receives the sentinel string "hard_bell" (not a normal screen action). The safety
     // layer contract requires it to return a fixed refusal regardless of the output arg.
     // On the normal path, safety_validate receives the original screen_action ("pass")
     // so it can apply action-specific post-output checks.
     if str_eq(screen_action, "hard_bell") {
-        safety_log_bell("hard", json_get(screen_result, "reason"), str_slice(raw_input, 0, 80))
         return safety_validate("", "hard_bell")
     }
 
@@ -269,8 +436,13 @@ fn layered_cycle(raw_input: String) -> String {
     let cont_status: String = json_get(continuity, "status")
     let cont_action: String = json_get(continuity, "action")
 
-    // Store continuity status so imprint can adjust its response register
-    state_set("session_continuity", cont_status)
+    // Store continuity status so imprint can adjust its response register.
+    // TODO(reliability #4) CLOSED 2026-08-05: this line was already written to scope per
+    // session — it just never received a session id, because the only source was a state key
+    // nothing wrote. It is now threaded from the route, so named sessions genuinely get their
+    // own continuity state and only anonymous callers share the global one.
+    let cont_key: String = if str_eq(session_id, "") { "session_continuity" } else { "session_continuity:" + session_id }
+    state_set(cont_key, cont_status)
 
     // Identity anomaly: add a gentle verification cue to the input before imprint
     let guided: String = if str_eq(cont_action, "identity_check") {
@@ -293,11 +465,80 @@ fn layered_cycle(raw_input: String) -> String {
         json_get(steward_result, "redirect_to")
     }
 
-    // L3: imprint responds
-    let output: String = imprint_respond(aligned, imprint_id)
+    // L2c: affective context injection.
+    let lc_aff_cutoff: Int = time_now() - 259200
+    let lc_bell_nodes: String = engram_search_json("bell:soft bell:hard BellEvent affective", 2)
+    let lc_has_bell: Bool = !str_eq(lc_bell_nodes, "") && !str_eq(lc_bell_nodes, "[]")
+    // CRASH FIX 2026-08-05 (BUG-PLAINCHAT-1): the " | ts:" parser used to be inline here.
+    // Inside this block-expression initializer elc compiled `lbmp + str_len(lbm)` to
+    // el_str_concat() on two integers, which segfaulted the whole daemon the moment a
+    // distress turn followed an earlier affective turn — i.e. exactly on the crisis path.
+    // Verified against the unmodified baseline binary AND present in the committed
+    // dist/soul.c. affective_node_ts() is a top-level function, where the same expression
+    // compiles to integer addition. Do not inline it back.
+    let lc_bell_note: String = if lc_has_bell {
+        let lb0: String = json_array_get(lc_bell_nodes, 0)
+        let lb_ts: Int = affective_node_ts(lb0)
+        if lb_ts > lc_aff_cutoff { "[AFFECTIVE NOTE: User was in distress in a recent session.]" } else { "" }
+    } else { "" }
+    let lc_pos_nodes: String = engram_search_json("PositiveEvent joy:high joy:low affective", 2)
+    let lc_has_pos: Bool = !str_eq(lc_pos_nodes, "") && !str_eq(lc_pos_nodes, "[]")
+    // Same crash fix as the bell note above (BUG-PLAINCHAT-1).
+    let lc_pos_note: String = if lc_has_pos && str_eq(lc_bell_note, "") {
+        let lp0: String = json_array_get(lc_pos_nodes, 0)
+        let lp_ts: Int = affective_node_ts(lp0)
+        if lp_ts > lc_aff_cutoff { "[AFFECTIVE NOTE: User shared positive news in a recent session.]" } else { "" }
+    } else { "" }
+    let lc_affective_note: String = if !str_eq(lc_bell_note, "") { lc_bell_note } else { lc_pos_note }
 
-    // L1 out: validate output before delivery
-    return safety_validate(output, screen_action)
+    // pre-LLM bell augmentation
+    let augmented_addendum: String = safety_augment_system("", raw_input)
+    let augmented_addendum = if str_eq(lc_affective_note, "") { augmented_addendum } else {
+        if str_eq(augmented_addendum, "") { lc_affective_note } else { lc_affective_note + "\n" + augmented_addendum }
+    }
+    state_set("layered_cycle_safety_system_addendum", augmented_addendum)
+
+    // L3: imprint responds — applies the active imprint's voice/domain annotation to the
+    // steward-aligned input. This produces the PROMPT, not the answer.
+    let prompt: String = imprint_respond(aligned, imprint_id)
+
+    // L3b: the imprint SPEAKS (added 2026-08-05).
+    //
+    // Until now the cycle stopped at the annotation above, so /api/chat with agentic:false
+    // handed the user's own screened text back as the "reply" — every gate ran, but nothing
+    // ever generated. The generation is placed HERE, inside the cycle, rather than by
+    // pointing the route at handle_chat(): handle_chat has no enforcing input gate and no
+    // enforcing output gate, so calling it instead of this cycle would have traded the whole
+    // safety pipeline for a working reply. Composing keeps both.
+    //
+    // Order is deliberate and must not be rearranged: this call sits strictly AFTER the L1
+    // screen, the safe-mode guard, the hard-bell short-circuit and the L2 stewardship layers,
+    // and strictly BEFORE the L1 output gate. A hard bell never reaches a model — the branch
+    // above returns first. Tools are not offered on this turn; see layered_generate.
+    let output: String = layered_generate(prompt, imprint_id, session_id)
+
+    // L1 out: validate output before delivery. Still the terminal gate — nothing below this
+    // line can change the string this function returns.
+    let validated: String = safety_validate(output, screen_action)
+
+    // Turn bookkeeping. Records the VALIDATED text, never the raw model output, and is only
+    // reachable on the non-bell path: both bell branches above return before this point, so
+    // bell turns still never enter conversation history. Pure state side effect — it cannot
+    // alter what is returned.
+    //
+    // FIX A: the receipt is unconditional and always negative on this path, because on this
+    // path it is structurally true — layered_generate offers no tools at all (build_system_prompt
+    // chat mode + a request body with no "tools" key). Recording "no tools ran" is not padding:
+    // it is the only thing that distinguishes "nothing ran" from "we forgot to write down what
+    // ran", and that ambiguity is what made the model confess to a search it had performed.
+    //
+    // FIX E1: a utility generation is answered but not recorded. Guarded here rather than at
+    // the route so every /api/chat dispatch site inherits it from one place.
+    let receipt: String = tool_receipt("", "")
+    if !utility {
+        conv_history_record(session_id, raw_input, validated, receipt)
+    }
+    return validated
 }
 
 let soul_cgi_id_raw: String = env("SOUL_CGI_ID")
@@ -316,7 +557,7 @@ let axon_raw: String = env("NEURON_API_URL")
 let axon_base: String = if str_eq(axon_raw, "") { "http://localhost:7771" } else { axon_raw }
 
 let studio_dir_raw: String = env("SOUL_STUDIO_DIR")
-let studio_dir: String = if str_eq(studio_dir_raw, "") { "/Users/will/Development/neuron-technologies/products/cgi-studio/el-daemon" } else { studio_dir_raw }
+let studio_dir: String = if str_eq(studio_dir_raw, "") { env("HOME") + "/Development/neuron-technologies/products/cgi-studio/el-daemon" } else { studio_dir_raw }
 
 println("[soul] boot - cgi=" + soul_cgi_id + " port=" + int_to_str(port))
 
@@ -350,6 +591,7 @@ load_identity_context()
 seed_persona_from_env()
 let boot_num: Int = mem_boot_count_inc()
 state_set("soul_boot_count", int_to_str(boot_num))
+state_set("soul_boot_ts", int_to_str(time_now()))
 println("[soul] boot #" + int_to_str(boot_num))
 emit_session_start_event()
 
@@ -362,7 +604,31 @@ state_set("soul_engram_api_key", engram_api_key_raw)
 state_set("soul.running", "true")
 
 let is_genesis: Bool = str_eq(soul_cgi_id, "ntn-genesis")
-if is_genesis {
+
+// GUARD (2026-06-15): never let genesis seed over a real graph. If the in-memory load is
+// sparse but the on-disk snapshot file is large, the load FAILED — seeding+saving now would
+// clobber the user's real memory (this is exactly how the 06-14 clobber happened). Read the
+// on-disk file (local mode only) and refuse the destructive seed+save when it looks populated.
+//
+// HTTP-engram guard (2026-06-17): when ENGRAM_URL is set the HTTP Engram owns persistence —
+// the soul must NEVER write to the local snapshot regardless of node counts. safe_to_seed is
+// unconditionally false in HTTP mode (not the persistence owner).
+let guard_disk: String = if str_eq(engram_url_raw, "") { fs_read(snapshot) } else { "" }
+let guard_disk_len: Int = str_len(guard_disk)
+// Ratio guard (2026-06-15 fix): refuse to seed/save whenever the in-memory load is FAR smaller than
+// the on-disk file implies (~16KB/node) — catches partial loads of ANY size, not just <50. The old
+// <50 threshold let a 63-node identity-only load clobber a 47MB/5000-node graph.
+// Multiplication form (2026-06-17): node_count * 16000 < disk_len avoids floor-division truncation
+// (e.g., 250KB / 16000 = 15.6, floors to 15 — a 15-node graph wrongly passes the old guard).
+// HTTP-engram guard: when using_http_engram the soul is not the persistence owner; never seed.
+let safe_to_seed: Bool = !using_http_engram && !(guard_disk_len > 200000 && engram_node_count() * 16000 < guard_disk_len)
+if is_genesis && !safe_to_seed {
+    println("[soul] GUARD: loaded " + int_to_str(engram_node_count())
+        + " nodes but snapshot file is " + int_to_str(guard_disk_len)
+        + " bytes — refusing to seed/save over a real graph")
+}
+
+if is_genesis && safe_to_seed {
     // Only build identity edges if the engram is fresh (< 100 edges).
     // init_soul_edges() is not idempotent — calling it on every restart
     // stacks duplicate co-value/identity edges into the snapshot.
@@ -373,6 +639,9 @@ if is_genesis {
     } else {
         println("[soul] edges already present (" + int_to_str(edge_count_now) + ") - skipping init")
     }
+    // Canonical-self bridge is idempotent — run it regardless of edge count so an
+    // already-populated graph still gets the public->curated self link.
+    ensure_self_canonical_bridge()
     // Genesis saves to its local snapshot file (it manages its own Engram).
     state_set("soul_snapshot_path", snapshot)
     engram_save(snapshot)
@@ -380,7 +649,7 @@ if is_genesis {
 
 // Take a pre-serve snapshot for genesis instances — captures all boot-time graph changes
 // (identity context loading, boot counter, session-start event) before entering the serve loop.
-if is_genesis {
+if is_genesis && safe_to_seed {
     let snap: String = state_get("soul_snapshot_path")
     if !str_eq(snap, "") {
         engram_save(snap)
@@ -388,6 +657,23 @@ if is_genesis {
     }
 }
 
+// CRASH RECOVERY (neuron#117). Deltas the previous process staged but could not
+// hand to the owner are still on disk — the spool is a filesystem queue, not a
+// memory buffer, precisely so that a soul that died mid-flight does not take its
+// unpushed writes with it. Drain them before serving, so recovered memories are
+// durable and recallable from the owner from the first request onward.
+//
+// Safe on a clean boot: an empty spool means no HTTP call at all. Safe in file
+// mode: wt_drain returns immediately when ENGRAM_URL is unset.
+let wt_recovered: Int = wt_drain()
+if wt_recovered > 0 {
+    println("[soul] write-through: recovered " + int_to_str(wt_recovered)
+        + " nodes from a previous process's spool -> persistence owner")
+}
+if wt_recovered < 0 {
+    println("[soul] write-through: spool present but the persistence owner is unreachable — queued, will retry on heartbeat")
+}
+
 println("[soul] serving on port " + int_to_str(port))
 http_serve_async(port, "handle_request")
 println("[soul] awareness loop starting")

soul.elh

@@ -1,6 +1,8 @@
-// auto-generated by elc --emit-header — do not edit
+// auto-generated by elc --emit-header - do not edit
 extern fn init_soul_edges() -> Void
+extern fn ensure_self_canonical_bridge() -> Void
+extern fn aff_try_slot(slot_json: String, aff_7d_ts: Int, acc_key: String) -> Void
 extern fn load_identity_context() -> Void
 extern fn seed_persona_from_env() -> Void
 extern fn emit_session_start_event() -> Void
-extern fn layered_cycle(raw_input: String) -> String
+extern fn layered_cycle(raw_input: String, session_id: String, utility: Bool) -> String

stewardship.el

@@ -11,7 +11,7 @@ import "memory.el"
 fn steward_log_event(kind: String, detail: String) -> Void {
     let content: String = "STEWARD:" + kind + " | " + detail
     let tags: String = "[\"stewardship\",\"steward:" + kind + "\"]"
-    let discard: String = engram_node_full(
+    let discard: String = wt_node(
         content,
         "StewardshipEvent",
         "steward:" + kind,
@@ -221,7 +221,7 @@ fn steward_fingerprint_session(input: String, session_id: String) -> String {
         + " formality=" + fs_str
         + " time=" + tb_str
     let sample_tags: String = "[\"behavior\",\"BehaviorSample\",\"stewardship\"]"
-    let discard: String = engram_node_full(
+    let discard: String = wt_node(
         sample_content,
         "BehaviorSample",
         "behavior:" + session_id,

stewardship.elh

@@ -1,15 +1,11 @@
-// stewardship.elh — Layer 2 public surface
 // auto-generated by elc --emit-header — do not edit
+extern fn steward_log_event(kind: String, detail: String) -> Void
 extern fn steward_get_mission() -> String
 extern fn steward_align(input: String, imprint_id: String) -> String
 extern fn steward_validate_imprint(imprint_id: String, tool_name: String) -> String
 extern fn steward_cgi_check(action: String) -> String
-// steward_log_event is an internal helper exported here because El has no access modifiers.
-// External callers have no business invoking this directly — use steward_align,
-// steward_validate_imprint, or steward_cgi_check, which call it at the correct points.
-extern fn steward_log_event(kind: String, detail: String) -> Void
-// Behavioral profiling and continuity detection (Layer 2 — session fingerprinting).
 extern fn steward_fingerprint_session(input: String, session_id: String) -> String
+extern fn extract_dim(content: String, key: String) -> String
 extern fn steward_build_baseline() -> String
 extern fn steward_check_continuity(current_fingerprint: String, session_id: String) -> String
 extern fn steward_session_check(input: String, session_id: String) -> String

studio.el

@@ -46,7 +46,9 @@ fn handle_config(method: String, body: String) -> String {
         }
     }
     let current_model: String = state_get("soul_model")
-    let display: String = if str_eq(current_model, "") { "claude-sonnet-4-5" } else { current_model }
+    // Display fallback aligned with the intended product default (was claude-sonnet-4-5,
+    // which silently became the app's picker default on fresh profiles — 2026-07-13).
+    let display: String = if str_eq(current_model, "") { "claude-opus-4-8" } else { current_model }
     return "{\"model\":\"" + display + "\",\"ok\":true}"
 }
 

tests/gate-openai/README.md

@@ -0,0 +1,90 @@
+# gate-openai — deterministic OpenAI-dialect provider stub
+
+Staging home for the **soul-openai-tools-v2** gate scaffolding
+(`docs/specs/SPEC-soul-openai-tools-v2-2026-08-06.md`, test-plan rung 1:
+"stub first — discriminates before El code exists"). Sibling of gate9's
+Anthropic stub (`_wt-beta-round9/scripts/gate9/stub-llm.py`): same scenario
+mechanism, opposite wire dialect. Stdlib Python only, 127.0.0.1 only,
+refuses ports 7770/7779/17779. Run `./selftest.sh` — exit 0 is green.
+
+## Files
+
+| File | Role |
+|---|---|
+| `stub-openai.py` | HTTP server: `POST /v1/chat/completions` (OpenAI dialect), scenario-scripted responses, request validation, ground-truth JSONL log, hostile modes via `--mode` |
+| `scenarios-openai.json` | Scenario contract: scripts + markers + per-class/per-step request assertions |
+| `selftest.sh` | curl-driven proof of every scenario, every rejection, all hostile modes (58 checks) |
+
+## What each scenario proves (when the brain drives it)
+
+| Class | Proves |
+|---|---|
+| `oa-plain` | finish_reason `stop` ends the loop; tools + `tool_choice` + `parallel_tool_calls:false` were offered on the wire |
+| `oa-tools-off` | the chat-only lane sends NO tools (offering them there is a 400) |
+| `oa-single-tool` | full round-trip: `tool_calls` parsed, assistant echo + `role:"tool"` turn with matching `tool_call_id` sent back, final text reached |
+| `oa-torture` | `function.arguments` (JSON-encoded string with nested quotes, backslashes, newlines, tabs, unicode) survives exactly ONE decode — the stub recomputes the issued payload from the script and 400s on any drift (`gate_echo_mismatch`, the spec §6 two-escaper trap) |
+| `oa-parallel` | two `tool_calls` in one response: the brain either answers both (paired correctly) or rejects cleanly — an unpaired echo is a 400 |
+| `oa-mission` | multi-round loop continuation; step index = assistant-message count, so resume threads index correctly by construction |
+| `oa-api-error` | provider errors 400/429/500/503 in the OpenAI error envelope surface honestly, no retry storm |
+
+Universal (every request, any scenario): Anthropic dialect leakage fails
+loudly with 400 — `anthropic-version` header, top-level `system` /
+`stop_sequences` / `max_tokens_to_sample`, `input_schema` inside tools,
+Anthropic content blocks (`tool_use`/`tool_result`/...). Tools must be
+`{type:"function", function:{name, description, parameters}}`, unique names;
+echoed `arguments` must be a JSON-encoded STRING, never a decoded object.
+
+## Hostile modes (`--mode`, same file)
+
+| Mode | Behavior | Brain invariant under test |
+|---|---|---|
+| `black-hole` | reads the request, never responds | HTTP timeout exists and surfaces; no silent hang |
+| `mid-body-drop` | 200 headers, half a JSON body, socket abort | truncated body = clean error, never a half-parsed reply shown as real |
+| `tool-pending-forever` | every request gets a fresh `tool_calls` response, forever | the loop's iteration cap trips (`max_loop_iterations: 16` in the contract); count actual round-trips via `GET /gate/stats` (`chat_hits`) |
+
+## How the brain-side gate consumes this
+
+1. Start: `stub-openai.py --port P --scenarios scenarios-openai.json --log run.jsonl`
+2. Point the brain at it: `NEURON_LLM_0_URL=http://127.0.0.1:P` +
+   `NEURON_LLM_0_FORMAT=openai` (spec step 0 must verify these actually
+   export at runtime), scratch profile, free soul port.
+3. Send each phrasing's `prompt` (the marker selects the script); assert the
+   brain's claims (`tools_used`, reply, ledger) against the stub's JSONL log
+   — truth, not narration — plus files on disk for write_file scenarios.
+4. Any stub 400 = the brain sent a malformed/leaked request; the gate fails
+   with the stub's reason string.
+5. Re-run gate9's Anthropic matrix unchanged = proof the Anthropic lane is
+   byte-untouched.
+
+## Reconciliation into gate9 (app repo) — AFTER round 9 merges
+
+This dir is staging only; the merge is mechanical by design:
+- `stub-openai.py` + `scenarios-openai.json` move to `scripts/gate9/`
+  alongside `stub-llm.py` + `scenarios.json` (shared conventions: marker
+  matching, assistant-count step indexing, `--port/--scenarios/--log`,
+  JSONL fields `seq/ts/kind/scenario_class/phrasing/step/validation/
+  delivered/http_status`, prod-port refusal, benign background responses,
+  `GATE-SCRIPT-EXHAUSTED` overrun, `{N}/{NN}` repeat expansion).
+- `prompt-matrix-gate.sh` gains a dialect axis (anthropic|openai) choosing
+  stub + scenario file; `matrix-asserts.py` reads the same log shape.
+- The `--mode` hostile flags here are PROVIDER-side (brain↔LLM boundary);
+  gate9's `hostile/` servers are SOUL-side (app↔brain boundary). They are
+  complementary, not duplicates — both stay.
+
+## Open questions for the port author (stub asserts a position; confirm or change)
+
+1. `parallel_tool_calls` must be **explicitly false** on every tool-bearing
+   request (ADR-0005 pin). If the builder omits it instead, relax
+   `defaults.expect_request.parallel_tool_calls` to `null`.
+2. `tool_choice` must be present (`"auto"` expected). If the brain relies on
+   the provider default, drop `require_tool_choice`.
+3. Tool-result `content` is asserted only to be a string; if the brain sends
+   structured JSON-in-string (like `{"ok":true,...}`), no change needed.
+4. Groq compatibility: Groq's OpenAI-compat endpoint rejects some optional
+   fields; whatever field set the brain settles on for live Groq E2E must be
+   mirrored here so the deterministic gate and the live lane assert the SAME
+   request shape.
+5. The stub treats a `role:"tool"` turn answering an already-answered id as
+   400; if the resume path can legitimately replay tool results, that rule
+   needs a resume-aware carve-out (gate9's Anthropic stub faced the same
+   issue — see its PASS 1 comment).

tests/gate-openai/run-lane-gate.sh

@@ -0,0 +1,559 @@
+#!/usr/bin/env bash
+# run-lane-gate.sh — brain-side driver for the OpenAI-dialect gate.
+#
+# Drives the REAL soul binary against stub-openai.py for every class and every
+# phrasing in scenarios-openai.json, plus the three hostile provider modes, and
+# asserts the brain's claims against the stub's ground-truth JSONL (truth, not
+# narration) and against files on disk.
+#
+# SAFETY (hard rules, enforced below):
+#   - never binds 7770 / 7779 / 17779   - only 7891-7894
+#   - never reads or writes ~/.neuron   - HOME is redirected to a scratch dir
+#   - every process started here is killed on exit (trap) and proven with lsof
+#
+# The soul runs under `script -q /dev/null` so its stdout is a pty: El's
+# println() uses puts(), which is FULLY buffered to a file, and the process is
+# killed without flushing — the DRIFT lines would be invisible otherwise.
+#
+# Usage:  ./run-lane-gate.sh [all|bridge|local|toolsoff|hostile]
+#   bridge   = consent round-trip config (no workspace root -> write_file is
+#              "escalate" -> the loop suspends and the CLIENT executes the tool)
+#   local    = workspace-root config (write_file is "reversible" + builtin ->
+#              the loop executes the tool in-process and runs to completion)
+#   toolsoff = supplementary: non-agentic lane against a base URL WITHOUT the
+#              /v1 suffix (the el-runtime provider chain appends
+#              /v1/chat/completions itself, unlike chat.el which appends only
+#              /chat/completions)
+#   hostile  = black-hole / mid-body-drop / tool-pending-forever
+#
+# Env overrides: SOUL_BIN, STUB_PORT, SOUL_PORT, SOUL_PORT_B, RUN_ROOT
+set -uo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+PHASES="${1:-all}"
+
+SOUL_BIN="${SOUL_BIN:-/tmp/soul-oai2/soul-openai-tools}"
+STUB_PORT="${STUB_PORT:-7891}"
+SOUL_PORT="${SOUL_PORT:-7892}"
+SOUL_PORT_B="${SOUL_PORT_B:-7893}"
+RUN_ROOT="${RUN_ROOT:-/tmp/oa-lane-gate}"
+STAMP="$(date +%Y%m%d-%H%M%S)"
+RUN="$RUN_ROOT/$STAMP"
+
+for p in "$STUB_PORT" "$SOUL_PORT" "$SOUL_PORT_B"; do
+  case "$p" in
+    7770|7779|17779) echo "FATAL: refusing production Neuron port $p"; exit 2;;
+    789[1-4]) ;;
+    *) echo "FATAL: port $p outside the allowed 7891-7894 range"; exit 2;;
+  esac
+done
+[ -x "$SOUL_BIN" ] || { echo "FATAL: soul binary not found/executable: $SOUL_BIN"; exit 2; }
+
+mkdir -p "$RUN/home" "$RUN/ws-bridge" "$RUN/ws-local" "$RUN/ws-off" "$RUN/engram"
+echo '{"nodes":[],"edges":[]}' > "$RUN/engram/snapshot.json"
+DRV="$RUN/drv.py"
+
+STUB_PID=""; SOUL_PID=""
+cleanup() {
+  [ -n "$SOUL_PID" ] && kill "$SOUL_PID" 2>/dev/null
+  pkill -f "$SOUL_BIN" 2>/dev/null
+  [ -n "$STUB_PID" ] && kill "$STUB_PID" 2>/dev/null
+  sleep 0.4
+  [ -n "$SOUL_PID" ] && kill -9 "$SOUL_PID" 2>/dev/null
+  [ -n "$STUB_PID" ] && kill -9 "$STUB_PID" 2>/dev/null
+  return 0
+}
+trap cleanup EXIT INT TERM
+
+start_stub() { # $1 = mode, $2 = log path
+  local mode="$1" log="$2" args=""
+  [ "$mode" = "normal" ] && args="--scenarios $HERE/scenarios-openai.json"
+  # shellcheck disable=SC2086
+  python3 "$HERE/stub-openai.py" --port "$STUB_PORT" --mode "$mode" --log "$log" $args \
+      > "$RUN/stub-$mode.out" 2>&1 &
+  STUB_PID=$!
+  for _ in $(seq 1 50); do
+    curl -sf "http://127.0.0.1:$STUB_PORT/gate/health" >/dev/null 2>&1 && return 0
+    sleep 0.2
+  done
+  echo "FATAL: stub did not come up on $STUB_PORT"; cat "$RUN/stub-$mode.out"; exit 3
+}
+stop_stub() { [ -n "$STUB_PID" ] && kill "$STUB_PID" 2>/dev/null; sleep 0.3; STUB_PID=""; }
+
+start_soul() { # $1 = port, $2 = base url, $3 = soul log, $4 = agent root ("" = none)
+  local port="$1" base="$2" log="$3" root="$4"
+  script -q /dev/null \
+    env -u ANTHROPIC_API_KEY -u SOUL_API_KEY -u ENGRAM_URL -u ENGRAM_API_KEY \
+      -u NEURON_API_URL -u NEURON_TOKEN -u SOUL_LLM_PROVIDER -u SOUL_LLM_BASE_URL \
+      -u NEURON_LLM_1_URL -u NEURON_LLM_1_KEY -u SOUL_IDENTITY \
+      HOME="$RUN/home" PATH="$PATH" \
+      NEURON_PORT="$port" EL_HTTP_BIND_HOST=127.0.0.1 \
+      SOUL_ENGRAM_PATH="$RUN/engram/snapshot.json" \
+      SOUL_CGI_ID=ntn-test SOUL_PERSONA_NAME=Neuron \
+      NEURON_LLM_0_URL="$base" NEURON_LLM_0_FORMAT=openai NEURON_LLM_0_KEY=gate-test-key \
+      ${root:+NEURON_AGENT_ROOT="$root"} \
+      "$SOUL_BIN" > "$log" 2>&1 &
+  SOUL_PID=$!
+  for _ in $(seq 1 100); do
+    curl -sf "http://127.0.0.1:$port/health" >/dev/null 2>&1 && return 0
+    sleep 0.2
+  done
+  echo "FATAL: soul did not come up on $port"; tail -20 "$log"; exit 3
+}
+stop_soul() {
+  [ -n "$SOUL_PID" ] && kill "$SOUL_PID" 2>/dev/null
+  pkill -f "$SOUL_BIN" 2>/dev/null
+  sleep 0.6; SOUL_PID=""
+}
+
+# ------------------------------------------------------------------ driver ----
+cat > "$DRV" <<'PYEOF'
+import json, os, sys, time, threading, urllib.request, urllib.error
+
+CFG = json.load(open(sys.argv[1]))
+SOUL = "http://127.0.0.1:%d" % CFG["soul_port"]
+STUB = "http://127.0.0.1:%d" % CFG["stub_port"]
+WS = CFG["workspace"]
+MODE = CFG["mode"]                       # bridge | local | toolsoff
+SCEN = json.load(open(CFG["scenarios"]))
+STUBLOG = CFG["stub_log"]
+SOULLOG = CFG["soul_log"]
+ONLY = CFG.get("classes") or list(SCEN["classes"].keys())
+MAXHOPS = CFG.get("max_hops", 15)
+OUT = CFG["out"]
+# the chat-only class must be driven on the NON-agentic door: the agentic door
+# always advertises tools, which is a 400 on that scenario by contract.
+NON_AGENTIC = {"oa-tools-off"}
+
+def http(method, url, obj=None, timeout=300):
+    data = None if obj is None else json.dumps(obj).encode()
+    req = urllib.request.Request(url, data=data, method=method,
+                                 headers={"Content-Type": "application/json"})
+    try:
+        with urllib.request.urlopen(req, timeout=timeout) as r:
+            body = r.read().decode("utf-8", "replace")
+            st = r.status
+    except urllib.error.HTTPError as e:
+        body = e.read().decode("utf-8", "replace"); st = e.code
+    except Exception as e:
+        return -1, "TRANSPORT-ERROR: %r" % (e,), None
+    try:
+        return st, body, json.loads(body)
+    except ValueError:
+        return st, body, None
+
+def fsize(p):
+    return os.path.getsize(p) if os.path.exists(p) else 0
+
+def tail_from(path, off):
+    if not os.path.exists(path):
+        return "", off
+    with open(path, "rb") as f:
+        f.seek(off); chunk = f.read(); return chunk.decode("utf-8", "replace"), f.tell()
+
+def stub_since(off):
+    """Exact correlation: only the JSONL bytes appended during this phrasing."""
+    txt, noff = tail_from(STUBLOG, off)
+    recs = []
+    for line in txt.splitlines():
+        line = line.strip()
+        if line:
+            try: recs.append(json.loads(line))
+            except ValueError: pass
+    return recs, noff
+
+def perform(name, ti):
+    """Execute the bridged tool for real, like the desktop client would."""
+    if name in ("write_file", "edit_file"):
+        p = ti.get("path", "")
+        dest = p if os.path.isabs(p) else os.path.join(WS, p)
+        os.makedirs(os.path.dirname(dest) or WS, exist_ok=True)
+        body = ti.get("content", "")
+        with open(dest, "w") as f:
+            f.write(body)
+        return "wrote %s (%d bytes)" % (p, len(body.encode()))
+    return "ok"
+
+class Poller(threading.Thread):
+    def __init__(self, sid):
+        super().__init__(daemon=True); self.sid = sid; self.snaps = []; self.stop = False
+    def run(self):
+        while not self.stop:
+            st, body, js = http("GET", SOUL + "/api/run-progress/" + self.sid, timeout=60)
+            if js and js.get("progress"):
+                if not self.snaps or self.snaps[-1] != js["progress"]:
+                    self.snaps.append(js["progress"])
+            time.sleep(0.1)
+
+def progress(sid):
+    _, _, pj = http("GET", SOUL + "/api/run-progress/" + sid, timeout=30)
+    return (pj or {}).get("progress")
+
+def run_phrasing(cname, ph):
+    st, body, js = http("POST", SOUL + "/api/sessions", {"title": ph["id"]}, timeout=60)
+    sid = (js or {}).get("id", "")
+    rec = {"class": cname, "phrasing": ph["id"], "session_id": sid, "legs": [],
+           "pendings": [], "progress_during": [], "progress_per_leg": [],
+           "progress_final": None, "soul_log": "", "stub": [], "http": [],
+           "agentic": cname not in NON_AGENTIC}
+    if not sid:
+        rec["fatal"] = "session create failed: %s %s" % (st, body[:300]); return rec
+    soff = fsize(SOULLOG); loff = fsize(STUBLOG)
+    t0 = time.time()
+    pol = Poller(sid); pol.start()
+    payload = {"message": ph["prompt"], "session_id": sid, "workspace_root": WS,
+               "agentic": rec["agentic"]}
+    if MODE == "local":
+        payload["agent_workspace_root"] = WS
+    st, body, js = http("POST", SOUL + "/api/chat", payload, timeout=CFG.get("chat_timeout", 240))
+    rec["http"].append(st)
+    rec["legs"].append(js if js is not None else body[:600])
+    rec["progress_per_leg"].append(progress(sid))
+    hops = 0
+    while isinstance(js, dict) and js.get("tool_pending") and hops < MAXHOPS:
+        rec["pendings"].append({"call_id": js.get("call_id"), "tool_name": js.get("tool_name"),
+                                "tool_input": js.get("tool_input"), "risk_tier": js.get("risk_tier"),
+                                "narration": js.get("narration"), "tools_used": js.get("tools_used")})
+        try:
+            eff = perform(js.get("tool_name", ""), js.get("tool_input") or {})
+        except Exception as e:
+            eff = "client error: %r" % (e,)
+        st, body, js = http("POST", SOUL + "/api/sessions/%s/tool_result" % sid,
+                            {"call_id": js.get("call_id"), "content": eff},
+                            timeout=CFG.get("chat_timeout", 240))
+        rec["http"].append(st)
+        rec["legs"].append(js if js is not None else body[:600])
+        rec["progress_per_leg"].append(progress(sid))
+        hops += 1
+    pol.stop = True; time.sleep(0.3)
+    t1 = time.time()
+    rec["elapsed"] = round(t1 - t0, 2)
+    rec["progress_during"] = pol.snaps
+    rec["progress_final"] = progress(sid)
+    rec["soul_log"], _ = tail_from(SOULLOG, soff)
+    rec["stub"], _ = stub_since(loff)
+    rec["hops"] = hops
+    return rec
+
+# ------------------------------------------------------------- assertions ----
+def expected_calls(cname, first_only=False):
+    out = []
+    for step in SCEN["classes"][cname]["script"]:
+        for k, call in enumerate(step.get("tool_calls") or []):
+            if first_only and k > 0:
+                continue
+            out.append((call["name"], call["arguments"]))
+    return out
+
+def final_text(cname):
+    for step in reversed(SCEN["classes"][cname]["script"]):
+        if step.get("text") and not step.get("tool_calls"):
+            return step["text"]
+    return None
+
+def judge(rec):
+    cname = rec["class"]; ok = []; bad = []
+    last = rec["legs"][-1] if rec["legs"] else None
+    reply = last.get("reply") if isinstance(last, dict) else None
+    err = last.get("error") if isinstance(last, dict) else None
+    tools_used = last.get("tools_used") if isinstance(last, dict) else None
+    stub = rec["stub"]
+    scen_recs = [r for r in stub if r.get("kind") == "scenario"]
+    rejects = [r for r in stub if r.get("validation") != "ok"]
+    bg = [r for r in stub if r.get("kind") in ("wrong_path", "background")]
+
+    def wire_clean():
+        if rejects:
+            for r in rejects:
+                bad.append("stub REJECTED a request: [%s] %s"
+                           % (r.get("validation"), r.get("validation_detail")))
+        else:
+            ok.append("stub ground truth: validation \"ok\" on all %d scenario leg(s), no "
+                      "gate_echo_mismatch / gate_tool_call_shape / dialect-leak 400s"
+                      % len(scen_recs))
+    if bg:
+        ok.append("NOTE background non-scenario request(s) in this window: %s"
+                  % [(r.get("kind"), r.get("path"), r.get("http_status")) for r in bg])
+
+    if cname == "oa-plain":
+        wire_clean()
+        want = final_text(cname)
+        if reply == want: ok.append("final reply == scripted final text (byte-exact)")
+        else: bad.append("final reply mismatch:\n  WANT: %r\n  GOT : %r" % (want, reply))
+        if tools_used == []: ok.append("tools_used == []  (no tool ran)")
+        else: bad.append("tools_used expected [] got %r" % (tools_used,))
+        if reply and ('"tool_calls"' in reply or '"function"' in reply or '"tool_use"' in reply):
+            bad.append("tool-call JSON leaked into the reply text")
+        else: ok.append("no tool-call JSON anywhere in the reply")
+
+    elif cname in ("oa-single-tool", "oa-torture", "oa-mission"):
+        wire_clean()
+        want = final_text(cname)
+        if reply == want: ok.append("final reply == scripted final text (byte-exact)")
+        else: bad.append("final reply mismatch:\n  WANT: %r\n  GOT : %r" % (want, reply))
+        exp = expected_calls(cname)
+        wantnames = [n for n, _ in exp]
+        if tools_used == wantnames:
+            ok.append("tools_used == %r  (carried across %d suspension(s))" % (wantnames, rec["hops"]))
+        else:
+            bad.append("tools_used expected %r got %r" % (wantnames, tools_used))
+        for name, args in exp:
+            p = args.get("path"); c = args.get("content")
+            dest = os.path.join(WS, p)
+            if not os.path.exists(dest):
+                bad.append("expected file missing on disk: %s" % dest); continue
+            got = open(dest, "rb").read()
+            if got == c.encode():
+                ok.append("%s on disk is byte-for-byte the issued payload (%d bytes)" % (p, len(got)))
+            else:
+                bad.append("%s content differs\n  WANT %r\n  GOT  %r"
+                           % (p, c[:300], got[:300].decode("utf-8", "replace")))
+        if MODE == "bridge":
+            for pend, (name, args) in zip(rec["pendings"], exp):
+                if pend["tool_input"] == args:
+                    ok.append("tool_input for %s survived exactly ONE decode (deep-equal to the "
+                              "issued arguments; no double-escaping)" % name)
+                else:
+                    bad.append("tool_input != issued arguments for %s\n  WANT %r\n  GOT  %r"
+                               % (name, args, pend["tool_input"]))
+            if rec["pendings"] and all(p["risk_tier"] == "escalate" for p in rec["pendings"]):
+                ok.append("every write_file classified \"escalate\" and bridged for consent")
+
+    elif cname == "oa-parallel":
+        drift = [l.strip() for l in rec["soul_log"].splitlines() if "DRIFT: provider returned" in l]
+        if drift: ok.append("soul log: " + drift[0])
+        else: bad.append("no 'DRIFT: provider returned N parallel tool_calls' line in the soul log")
+        delivered = [r for r in stub if r.get("delivered", {}).get("tool_calls")]
+        if delivered and len(delivered[0]["delivered"]["tool_calls"]) == 2:
+            ok.append("stub delivered 2 parallel tool_calls in one response (ground truth)")
+        if MODE == "bridge":
+            if len(rec["pendings"]) == 1:
+                ok.append("exactly ONE call honored: %s" % rec["pendings"][0]["call_id"])
+            else:
+                bad.append("expected exactly 1 honored call, got %d" % len(rec["pendings"]))
+        pairing = [r for r in rejects if "gate_pairing" in str(r.get("validation_detail")) or
+                   "tool_calls at end of thread" in str(r.get("validation_detail")) or
+                   "not fully answered" in str(r.get("validation_detail"))]
+        for r in pairing:
+            ok.append("EXPECTED-BY-CONTRACT stub 400 on the unpaired echo: %s"
+                      % r.get("validation_detail"))
+        other = [r for r in rejects if r not in pairing]
+        for r in other:
+            bad.append("unexpected stub rejection: [%s] %s"
+                       % (r.get("validation"), r.get("validation_detail")))
+        if err and not reply:
+            ok.append("honest error envelope after the 400 (no fabricated answer): %r" % err)
+        elif reply == final_text(cname):
+            ok.append("final reply == scripted final text (both calls paired)")
+        else:
+            bad.append("neither an honest error nor the scripted final text: %r" % (last,))
+
+    elif cname == "oa-api-error":
+        if err and not reply:
+            ok.append("honest error envelope: error=%r reply=%r" % (err, reply))
+        else:
+            bad.append("expected an error envelope with an empty reply, got %r" % (last,))
+        delivered = [r["delivered"].get("api_error") for r in stub if r.get("delivered")]
+        ok.append("stub delivered api_error status(es): %r" % [d for d in delivered if d])
+        n = len([r for r in stub if r.get("kind") == "scenario"])
+        ok.append("provider hit %d time(s) - no retry storm" % n)
+        if reply:
+            bad.append("FABRICATED ANSWER: reply non-empty on a provider error")
+
+    elif cname == "oa-tools-off":
+        ok.append("stub records for this phrasing: %r"
+                  % [{k: r.get(k) for k in ("kind", "path", "validation", "http_status")} for r in stub])
+        wrong = [r for r in stub if r.get("kind") == "wrong_path"]
+        matched = [r for r in stub if r.get("scenario_class") == cname]
+        if matched and not rejects:
+            ok.append("chat-only request reached /v1/chat/completions with NO tools offered")
+            want = final_text(cname)
+            if reply == want: ok.append("final reply == scripted final text (byte-exact)")
+            else: bad.append("final reply mismatch:\n  WANT: %r\n  GOT : %r" % (want, reply))
+            if reply and ('"tool_calls"' in reply or '"function"' in reply):
+                bad.append("tool-call JSON leaked into the reply text")
+            else: ok.append("no tool-call JSON in the reply")
+        elif wrong:
+            bad.append("the non-agentic lane never reached the provider endpoint: stub saw "
+                       "%s -> %s (the el-runtime provider chain appends /v1/chat/completions "
+                       "to NEURON_LLM_0_URL, chat.el appends only /chat/completions)"
+                       % (wrong[0]["path"], wrong[0]["http_status"]))
+        elif not stub:
+            bad.append("no request reached the stub at all")
+        else:
+            for r in rejects:
+                bad.append("stub REJECTED: [%s] %s" % (r.get("validation"), r.get("validation_detail")))
+    return ok, bad
+
+def main():
+    results = []
+    for cname in ONLY:
+        for ph in SCEN["classes"][cname]["phrasings"]:
+            rec = run_phrasing(cname, ph)
+            ok, bad = judge(rec)
+            rec["ok"] = ok; rec["bad"] = bad
+            rec["verdict"] = "FAIL" if bad else "PASS"
+            results.append(rec)
+            print("=" * 78)
+            print("[%s] %s / %s   (%.2fs, %d bridge hop(s), agentic=%s, mode=%s)"
+                  % (rec["verdict"], cname, ph["id"], rec.get("elapsed", 0),
+                     rec.get("hops", 0), rec["agentic"], MODE))
+            for l in ok:  print("   ok   " + l.replace("\n", "\n        "))
+            for l in bad: print("   FAIL " + l.replace("\n", "\n        "))
+            for i, leg in enumerate(rec["legs"]):
+                print("   leg%d envelope: %s" % (i, json.dumps(leg)[:430]))
+            for i, pr in enumerate(rec["progress_per_leg"]):
+                print("   run-progress after leg%d: %s" % (i, json.dumps(pr)[:380]))
+            if rec["progress_during"]:
+                print("   run-progress polled DURING (%d distinct snapshot(s)), last: %s"
+                      % (len(rec["progress_during"]), json.dumps(rec["progress_during"][-1])[:300]))
+            for r in rec["stub"]:
+                print("   stub: kind=%s class=%s phrasing=%s step=%s validation=%s%s delivered=%s http=%s"
+                      % (r.get("kind"), r.get("scenario_class"), r.get("phrasing"), r.get("step"),
+                         r.get("validation"),
+                         ("(" + str(r.get("validation_detail")) + ")") if r.get("validation_detail") else "",
+                         json.dumps(r.get("delivered")), r.get("http_status")))
+            if rec["soul_log"].strip():
+                for l in rec["soul_log"].splitlines():
+                    if l.strip(): print("   soul: " + l.strip())
+    json.dump(results, open(OUT, "w"), indent=1)
+    npass = sum(1 for r in results if r["verdict"] == "PASS")
+    print("=" * 78)
+    print("PHASE %s: %d/%d PASS" % (MODE, npass, len(results)))
+    for r in results:
+        print("   %-6s %-16s %s" % (r["verdict"], r["class"], r["phrasing"]))
+    return 0 if npass == len(results) else 1
+
+sys.exit(main())
+PYEOF
+
+# ------------------------------------------------------------- hostile drv ---
+cat > "$RUN/hostile.py" <<'PYEOF'
+import json, os, sys, time, urllib.request, urllib.error
+
+CFG = json.load(open(sys.argv[1]))
+SOUL = "http://127.0.0.1:%d" % CFG["soul_port"]
+STUB = "http://127.0.0.1:%d" % CFG["stub_port"]
+
+def http(method, url, obj=None, timeout=400):
+    data = None if obj is None else json.dumps(obj).encode()
+    req = urllib.request.Request(url, data=data, method=method,
+                                 headers={"Content-Type": "application/json"})
+    try:
+        with urllib.request.urlopen(req, timeout=timeout) as r:
+            b = r.read().decode("utf-8", "replace"); st = r.status
+    except urllib.error.HTTPError as e:
+        b = e.read().decode("utf-8", "replace"); st = e.code
+    except Exception as e:
+        return -1, "TRANSPORT-ERROR: %r" % (e,), None
+    try:
+        return st, b, json.loads(b)
+    except ValueError:
+        return st, b, None
+
+mode = CFG["mode"]; wsmode = CFG["ws_mode"]; WS = CFG["workspace"]
+_, _, js = http("POST", SOUL + "/api/sessions", {"title": "hostile-" + mode}, timeout=60)
+sid = (js or {}).get("id", "")
+payload = {"message": "oa-gate plain probe: hostile mode %s" % mode,
+           "agentic": True, "session_id": sid, "workspace_root": WS}
+if wsmode == "local":
+    payload["agent_workspace_root"] = WS
+t0 = time.time()
+st, body, js = http("POST", SOUL + "/api/chat", payload, timeout=CFG.get("timeout", 400))
+t_first = time.time() - t0
+legs = [js if js is not None else body[:500]]
+hops = 0
+while isinstance(js, dict) and js.get("tool_pending") and hops < CFG.get("max_hops", 14):
+    ti = js.get("tool_input") or {}
+    p = ti.get("path", "x.md")
+    dest = p if os.path.isabs(p) else os.path.join(WS, p)
+    try: open(dest, "w").write(ti.get("content", ""))
+    except Exception: pass
+    st, body, js = http("POST", SOUL + "/api/sessions/%s/tool_result" % sid,
+                        {"call_id": js.get("call_id"), "content": "ok"},
+                        timeout=CFG.get("timeout", 400))
+    legs.append(js if js is not None else body[:500]); hops += 1
+el = time.time() - t0
+_, _, stats = http("GET", STUB + "/gate/stats", timeout=30)
+_, _, prog = http("GET", SOUL + "/api/run-progress/" + sid, timeout=30)
+fab = [l for l in legs if isinstance(l, dict) and l.get("reply")]
+print("HOSTILE %s (ws_mode=%s)" % (mode, wsmode))
+print("   first /api/chat POST returned after %.2fs; whole chain %.2fs; client bridge hops=%d; "
+      "stub chat_hits=%s" % (t_first, el, hops, (stats or {}).get("chat_hits")))
+print("   first envelope : " + json.dumps(legs[0])[:430])
+print("   final envelope : " + json.dumps(legs[-1])[:430])
+print("   non-empty replies anywhere in the chain (fabrication check): %d" % len(fab))
+print("   run-progress   : " + json.dumps(prog)[:300])
+json.dump({"mode": mode, "ws_mode": wsmode, "t_first": t_first, "elapsed": el, "hops": hops,
+           "chat_hits": (stats or {}).get("chat_hits"), "legs": legs, "progress": prog},
+          open(CFG["out"], "w"), indent=1)
+PYEOF
+
+# ------------------------------------------------------------------ phases ---
+RC_BRIDGE=0; RC_LOCAL=0; RC_OFF=0
+run_normal_phase() { # $1 = label, $2 = soul port, $3 = agent root, $4 = ws, $5 = base, $6 = classes json
+  local m="$1" port="$2" root="$3" ws="$4" base="$5" classes="$6"
+  echo; echo "############ PHASE: $m (soul :$port, NEURON_LLM_0_URL=$base) ############"
+  start_stub normal "$RUN/stub-$m.jsonl"
+  start_soul "$port" "$base" "$RUN/soul-$m.log" "$root"
+  cat > "$RUN/cfg-$m.json" <<JSON
+{"soul_port": $port, "stub_port": $STUB_PORT, "workspace": "$ws", "mode": "$m",
+ "scenarios": "$HERE/scenarios-openai.json", "stub_log": "$RUN/stub-$m.jsonl",
+ "soul_log": "$RUN/soul-$m.log", "out": "$RUN/results-$m.json", "chat_timeout": 240,
+ "classes": $classes}
+JSON
+  python3 "$DRV" "$RUN/cfg-$m.json"
+  local rc=$?
+  stop_soul; stop_stub
+  return $rc
+}
+
+if [ "$PHASES" = "all" ] || [ "$PHASES" = "bridge" ]; then
+  run_normal_phase bridge "$SOUL_PORT" "" "$RUN/ws-bridge" "http://127.0.0.1:$STUB_PORT/v1" null
+  RC_BRIDGE=$?
+fi
+if [ "$PHASES" = "all" ] || [ "$PHASES" = "local" ]; then
+  run_normal_phase local "$SOUL_PORT_B" "$RUN/ws-local" "$RUN/ws-local" "http://127.0.0.1:$STUB_PORT/v1" null
+  RC_LOCAL=$?
+fi
+if [ "$PHASES" = "all" ] || [ "$PHASES" = "toolsoff" ]; then
+  # supplementary: the el-runtime provider chain appends /v1/chat/completions itself,
+  # so the non-agentic door needs the base WITHOUT the /v1 suffix.
+  run_normal_phase toolsoff "$SOUL_PORT" "" "$RUN/ws-off" "http://127.0.0.1:$STUB_PORT" '["oa-tools-off","oa-plain"]'
+  RC_OFF=$?
+fi
+
+if [ "$PHASES" = "all" ] || [ "$PHASES" = "hostile" ]; then
+  echo; echo "############ PHASE: hostile ############"
+  for spec in "black-hole:bridge" "mid-body-drop:bridge" "tool-pending-forever:bridge" "tool-pending-forever:local"; do
+    mode="${spec%%:*}"; wsm="${spec##*:}"
+    echo; echo "---- hostile mode=$mode ws_mode=$wsm ----"
+    start_stub "$mode" "$RUN/stub-$mode-$wsm.jsonl"
+    if [ "$wsm" = "local" ]; then
+      start_soul "$SOUL_PORT" "http://127.0.0.1:$STUB_PORT/v1" "$RUN/soul-$mode-$wsm.log" "$RUN/ws-local"
+    else
+      start_soul "$SOUL_PORT" "http://127.0.0.1:$STUB_PORT/v1" "$RUN/soul-$mode-$wsm.log" ""
+    fi
+    cat > "$RUN/cfg-$mode-$wsm.json" <<JSON
+{"soul_port": $SOUL_PORT, "stub_port": $STUB_PORT, "mode": "$mode", "ws_mode": "$wsm",
+ "workspace": "$RUN/ws-local", "out": "$RUN/hostile-$mode-$wsm.json", "timeout": 400}
+JSON
+    python3 "$RUN/hostile.py" "$RUN/cfg-$mode-$wsm.json"
+    echo "   soul log (llm/DRIFT/cap lines):"
+    grep -E "DRIFT|llm error|iteration cap|\[llm\]" "$RUN/soul-$mode-$wsm.log" | tail -8 | sed 's/^/     /'
+    stop_soul; stop_stub
+  done
+fi
+
+echo; echo "############ CLEANUP ############"
+cleanup
+sleep 0.5
+echo "processes still matching the soul binary:"; pgrep -fl "$SOUL_BIN" || echo "   (none)"
+echo "processes still matching stub-openai.py:"; pgrep -fl "stub-openai.py" || echo "   (none)"
+echo "lsof on 7891-7894 after cleanup:"
+lsof -nP -iTCP:7891 -iTCP:7892 -iTCP:7893 -iTCP:7894 2>/dev/null || echo "   (no listeners - ports free)"
+echo
+echo "############ SUMMARY ############"
+echo "run dir: $RUN"
+echo "bridge rc=$RC_BRIDGE   local rc=$RC_LOCAL   toolsoff rc=$RC_OFF   (0 = every class PASS)"
+exit $(( RC_BRIDGE + RC_LOCAL + RC_OFF ))

tests/gate-openai/scenarios-openai.json

@@ -0,0 +1,110 @@
+{
+  "_comment": "OpenAI-dialect gate scenario contract (soul-openai-tools-v2). Single source of truth shared by stub-openai.py (scripted provider responses + request assertions), selftest.sh (stub self-verification), and the future brain-side gate driver. Same structure as gate9's scenarios.json: classes -> script + phrasings with markers; scripts are CLASS-level so assertions are behavioral, never pinned to a sentence. expect_request keys: require_tools, require_tool_choice, parallel_tool_calls (expected literal value; null = don't check), forbid_tools. defaults apply to every class unless overridden; steps may override with their own expect_request.",
+  "deadline_secs": 60,
+  "max_loop_iterations": 16,
+  "defaults": {
+    "expect_request": {
+      "require_tools": true,
+      "require_tool_choice": true,
+      "parallel_tool_calls": false
+    }
+  },
+  "classes": {
+    "oa-plain": {
+      "script": [
+        { "text": "Plain OpenAI-lane answer (gate fixture): the mechanism, the main caveat, and the practical takeaway in three sentences. No tools were needed for this one, and the finish reason on the wire is stop, which the loop must treat as terminal." }
+      ],
+      "phrasings": [
+        { "id": "oa-plain-p1", "marker": "oa-gate plain probe", "prompt": "oa-gate plain probe: explain the fixture topic simply." },
+        { "id": "oa-plain-p2", "marker": "oa-gate second plain", "prompt": "oa-gate second plain: another phrasing of the plain question." }
+      ]
+    },
+    "oa-tools-off": {
+      "expect_request": {
+        "require_tools": false,
+        "forbid_tools": true,
+        "require_tool_choice": false,
+        "parallel_tool_calls": null
+      },
+      "script": [
+        { "text": "Chat-only OpenAI-lane answer (gate fixture): this lane offered no tools and none were used; the reply is plain text with finish reason stop." }
+      ],
+      "phrasings": [
+        { "id": "oa-tools-off-p1", "marker": "oa-gate tools-off probe", "prompt": "oa-gate tools-off probe: plain chat with no tools offered." }
+      ]
+    },
+    "oa-single-tool": {
+      "script": [
+        { "text": "Step 1: writing the note.",
+          "tool_calls": [
+            { "name": "write_file",
+              "arguments": { "path": "openai-single-note.md", "content": "# Note (gate fixture, OpenAI lane)\n\nDeterministic single-tool body.\n" } }
+          ] },
+        { "text": "All set - openai-single-note.md is written with the fixture body. Nothing else was needed for this one." }
+      ],
+      "phrasings": [
+        { "id": "oa-single-p1", "marker": "oa-gate single tool note", "prompt": "oa-gate single tool note: save the fixture note to a file." },
+        { "id": "oa-single-p2", "marker": "oa-gate one file please", "prompt": "oa-gate one file please: write the fixture note file." }
+      ]
+    },
+    "oa-torture": {
+      "script": [
+        { "tool_calls": [
+            { "name": "write_file",
+              "arguments": { "path": "torture-note.md", "content": "Line 1 has \"double quotes\", 'singles', and a mid-line backslash \\ here.\nLine 2\thas a tab, a literal \\n two-char sequence, and a Windows path C:\\temp\\new.txt.\nLine 3 unicode: naïve café — 日本語 ✓ 🚀\nLine 4 JSON-in-string: {\"k\": \"v\", \"arr\": [1, 2], \"s\": \"nested \\\"deep\\\" quotes\"}\nLine 5 ends with a lone backslash \\" } }
+          ] },
+        { "text": "Torture round-trip complete: the payload with nested quotes, backslashes, newlines, tabs, and unicode survived exactly one encode and one decode." }
+      ],
+      "phrasings": [
+        { "id": "oa-torture-p1", "marker": "oa-gate torture probe", "prompt": "oa-gate torture probe: write the escaping torture file." }
+      ]
+    },
+    "oa-parallel": {
+      "script": [
+        { "text": "Step 1: two writes at once (parallel probe).",
+          "tool_calls": [
+            { "name": "write_file", "arguments": { "path": "parallel-a.md", "content": "Parallel A (gate fixture).\n" } },
+            { "name": "write_file", "arguments": { "path": "parallel-b.md", "content": "Parallel B (gate fixture).\n" } }
+          ] },
+        { "text": "Parallel probe complete: both tool results arrived and were paired correctly. A brain that instead rejects the double call must do so cleanly - that outcome is asserted brain-side, not here." }
+      ],
+      "phrasings": [
+        { "id": "oa-parallel-p1", "marker": "oa-gate parallel probe", "prompt": "oa-gate parallel probe: run the two-write parallel case." }
+      ]
+    },
+    "oa-mission": {
+      "script": [
+        { "text": "Step 1: drafting part one.",
+          "tool_calls": [
+            { "name": "write_file", "arguments": { "path": "mission-part-1.md", "content": "Mission part 1 (gate fixture).\n" } }
+          ] },
+        { "text": "Step 2: drafting part two.",
+          "tool_calls": [
+            { "name": "write_file", "arguments": { "path": "mission-part-2.md", "content": "Mission part 2 (gate fixture).\n" } }
+          ] },
+        { "text": "Mission complete: mission-part-1.md and mission-part-2.md are written; the loop ran two tool rounds and finished cleanly with finish reason stop." }
+      ],
+      "phrasings": [
+        { "id": "oa-mission-p1", "marker": "oa-gate mission probe", "prompt": "oa-gate mission probe: run the two-round mission." }
+      ]
+    },
+    "oa-api-error": {
+      "expect_request": {
+        "require_tools": false,
+        "require_tool_choice": false,
+        "parallel_tool_calls": null
+      },
+      "script": [],
+      "phrasings": [
+        { "id": "oa-err-400", "marker": "oa-gate error four hundred", "prompt": "oa-gate error four hundred: trigger the injected failure.",
+          "script": [ { "api_error": { "status": 400, "type": "invalid_request_error", "message": "gate-injected 400: request rejected by fixture", "code": "gate_injected" } } ] },
+        { "id": "oa-err-429", "marker": "oa-gate error rate limit", "prompt": "oa-gate error rate limit: trigger the injected failure.",
+          "script": [ { "api_error": { "status": 429, "type": "rate_limit_error", "message": "gate-injected 429: rate limited by fixture", "code": "rate_limit_exceeded" } } ] },
+        { "id": "oa-err-500", "marker": "oa-gate error five hundred", "prompt": "oa-gate error five hundred: trigger the injected failure.",
+          "script": [ { "api_error": { "status": 500, "type": "server_error", "message": "gate-injected 500: internal fixture error", "code": "gate_injected" } } ] },
+        { "id": "oa-err-503", "marker": "oa-gate error unavailable", "prompt": "oa-gate error unavailable: trigger the injected failure.",
+          "script": [ { "api_error": { "status": 503, "type": "server_error", "message": "gate-injected 503: fixture overloaded", "code": "gate_injected" } } ] }
+      ]
+    }
+  }
+}

tests/gate-openai/selftest.sh

@@ -0,0 +1,409 @@
+#!/usr/bin/env bash
+# selftest.sh - proves stub-openai.py before any brain code exists.
+# Drives the stub with curl through every scenario (plain, tools-off,
+# single tool round-trip, escaping torture, parallel double-call,
+# two-round mission, injected API errors, background, overrun), every
+# validation rejection (dialect leaks, pairing, echo round-trip, scenario
+# expectations), and all three hostile modes. Exit 0 = green.
+set -u
+cd "$(dirname "$0")" || exit 1
+PY=python3
+TMP="$(mktemp -d)"
+PIDS=()
+cleanup() {
+  for p in "${PIDS[@]:-}"; do kill -9 "$p" >/dev/null 2>&1; done
+  rm -rf "$TMP"
+}
+trap cleanup EXIT
+
+PASS=0; FAIL=0
+ok()  { printf 'ok   - %s\n' "$1"; PASS=$((PASS+1)); }
+bad() { printf 'FAIL - %s\n' "$1"; FAIL=$((FAIL+1)); }
+check() {  # check <name> <cmd...>  - pass if cmd exits 0; show output on fail
+  local name="$1"; shift
+  local out
+  if out="$("$@" 2>&1)"; then ok "$name"
+  else bad "$name"; [ -n "$out" ] && printf '%s\n' "$out" | sed 's/^/       /' | head -8
+  fi
+}
+
+freeport() { "$PY" -c 'import socket;s=socket.socket();s.bind(("127.0.0.1",0));print(s.getsockname()[1]);s.close()'; }
+waithealth() {
+  local p="$1" i
+  for i in $(seq 1 60); do
+    curl -sf "http://127.0.0.1:$p/gate/health" >/dev/null 2>&1 && return 0
+    sleep 0.1
+  done
+  echo "stub on :$p never became healthy"; return 1
+}
+post() {  # post <port> <bodyfile> <respfile> [extra curl args...] -> echoes http code
+  local port="$1" body="$2" resp="$3"; shift 3
+  curl -s -o "$resp" -w '%{http_code}' -H 'content-type: application/json' \
+       "$@" --data-binary @"$body" "http://127.0.0.1:$port/v1/chat/completions"
+}
+
+# ---- embedded helper: builds OpenAI-dialect bodies, asserts on responses ----
+cat > "$TMP/helpers.py" <<'PYEOF'
+import copy, json, sys
+
+TOOLS = [
+    {"type": "function", "function": {
+        "name": "write_file", "description": "Write content to a file on disk.",
+        "parameters": {"type": "object",
+                       "properties": {"path": {"type": "string"},
+                                      "content": {"type": "string"}},
+                       "required": ["path", "content"]}}},
+    {"type": "function", "function": {
+        "name": "read_file", "description": "Read contents of a file from disk.",
+        "parameters": {"type": "object",
+                       "properties": {"path": {"type": "string"}},
+                       "required": ["path"]}}},
+]
+
+def dump(obj, out):
+    json.dump(obj, open(out, "w"), ensure_ascii=False)
+
+def base(prompt, tools=True):
+    b = {"model": "gate-openai-model", "max_tokens": 1024,
+         "messages": [
+             {"role": "system", "content": "You are Neuron (gate fixture)."},
+             {"role": "user", "content": prompt}]}
+    if tools:
+        b["tools"] = copy.deepcopy(TOOLS)
+        b["tool_choice"] = "auto"
+        b["parallel_tool_calls"] = False
+    return b
+
+def cmd_plain(out, prompt):
+    dump(base(prompt), out)
+
+def cmd_notools(out, prompt):
+    dump(base(prompt, tools=False), out)
+
+def cmd_mut(out, prompt, mutation):
+    b = base(prompt)
+    if mutation == "no-tool-choice":
+        del b["tool_choice"]
+    elif mutation == "ptc-true":
+        b["parallel_tool_calls"] = True
+    elif mutation == "top-system":
+        b["system"] = "You are Neuron."
+    elif mutation == "anth-tools":
+        b["tools"] = [{"name": "write_file", "description": "x",
+                       "input_schema": {"type": "object", "properties": {}}}]
+    elif mutation == "anth-block":
+        b["messages"][1] = {"role": "user", "content": [
+            {"type": "tool_result", "tool_use_id": "toolu_x", "content": "hi"},
+            {"type": "text", "text": prompt}]}
+    else:
+        raise SystemExit("unknown mutation " + mutation)
+    dump(b, out)
+
+def cmd_chain(out, prompt, variant, *resps):
+    """Build the next leg: echo each response's assistant turn and answer its
+    tool calls. `variant` applies to the LAST response only:
+    ok | no-tool-turn | wrong-id | only-first | double-encode | object-args"""
+    b = base(prompt)
+    for idx, p in enumerate(resps):
+        last = idx == len(resps) - 1
+        msg = json.load(open(p))["choices"][0]["message"]
+        tcs = msg.get("tool_calls")
+        if not tcs:
+            b["messages"].append({"role": "assistant",
+                                  "content": msg.get("content")})
+            continue
+        v = variant if last else "ok"
+        asst = {"role": "assistant", "content": msg.get("content"),
+                "tool_calls": copy.deepcopy(tcs)}
+        if v == "double-encode":
+            for tc in asst["tool_calls"]:
+                tc["function"]["arguments"] = json.dumps(
+                    tc["function"]["arguments"])
+        if v == "object-args":
+            for tc in asst["tool_calls"]:
+                tc["function"]["arguments"] = json.loads(
+                    tc["function"]["arguments"])
+        b["messages"].append(asst)
+        if v == "no-tool-turn":
+            continue
+        use = tcs[:1] if v == "only-first" else tcs
+        for tc in use:
+            tid = "call_bogus_123" if v == "wrong-id" else tc["id"]
+            b["messages"].append({"role": "tool", "tool_call_id": tid,
+                                  "content": "{\"ok\":true,\"bytes\":42}"})
+    dump(b, out)
+
+def cmd_chk(resp, expr):
+    r = json.load(open(resp))
+    if not eval(expr, {"r": r, "json": json, "len": len, "str": str,
+                       "isinstance": isinstance, "any": any, "all": all,
+                       "sorted": sorted}):
+        print("assertion failed:", expr)
+        print("resp:", json.dumps(r, ensure_ascii=False)[:400])
+        raise SystemExit(1)
+
+def cmd_torture(resp, scen):
+    r = json.load(open(resp))
+    tc = r["choices"][0]["message"]["tool_calls"][0]
+    raw = tc["function"]["arguments"]
+    assert isinstance(raw, str), "arguments must be a JSON-encoded string"
+    got = json.loads(raw)
+    exp = json.load(open(scen))["classes"]["oa-torture"]["script"][0]["tool_calls"][0]["arguments"]
+    assert got == exp, "decoded arguments != scripted torture payload"
+    content = got["content"]
+    for needle in ['"', "\\", "\n", "\t", "日本語", "naïve", "🚀"]:
+        assert needle in content, "missing torture needle %r" % needle
+
+def cmd_notjson(path):
+    data = open(path, "rb").read()
+    assert data, "file empty - no partial body arrived"
+    try:
+        json.loads(data.decode("utf-8", "replace"))
+    except ValueError:
+        return
+    raise SystemExit("partial body unexpectedly parsed as complete JSON")
+
+def cmd_pending(*paths):
+    ids = []
+    for p in paths:
+        c = json.load(open(p))["choices"][0]
+        assert c["finish_reason"] == "tool_calls", c["finish_reason"]
+        tc = c["message"]["tool_calls"][0]
+        assert tc["function"]["name"] == "write_file"
+        json.loads(tc["function"]["arguments"])  # must decode
+        ids.append(tc["id"])
+    assert len(set(ids)) == len(ids), "call ids not distinct: %r" % ids
+
+def cmd_logcheck(path):
+    recs = [json.loads(l) for l in open(path) if l.strip()]
+    seqs = [r["seq"] for r in recs]
+    assert seqs == sorted(seqs) and len(set(seqs)) == len(seqs), "seq not monotonic"
+    kinds = {}
+    for r in recs:
+        kinds[r["kind"]] = kinds.get(r["kind"], 0) + 1
+    assert kinds.get("scenario", 0) >= 10, "too few scenario records: %r" % kinds
+    assert kinds.get("background", 0) >= 1, "no background record"
+    assert kinds.get("overrun", 0) >= 1, "no overrun record"
+    rejected = [r for r in recs if r["validation"] == "rejected"]
+    assert len(rejected) >= 10, "too few rejected records: %d" % len(rejected)
+    assert any(r["delivered"].get("tool_calls") == ["write_file"]
+               for r in recs), "no single write_file ground truth"
+    assert any(r["delivered"].get("tool_calls") == ["write_file", "write_file"]
+               for r in recs), "no parallel ground truth"
+
+def main():
+    fn = globals()["cmd_" + sys.argv[1].replace("-", "_")]
+    fn(*sys.argv[2:])
+
+if __name__ == "__main__":
+    main()
+PYEOF
+mk() { "$PY" "$TMP/helpers.py" "$@"; }
+
+echo "=== stub-openai selftest ==="
+
+# ---- normal mode ------------------------------------------------------------
+PORT="$(freeport)"
+"$PY" stub-openai.py --port "$PORT" --scenarios scenarios-openai.json \
+     --log "$TMP/req.jsonl" >"$TMP/stub.out" 2>&1 &
+PIDS+=($!); disown
+check "stub starts and answers /gate/health" waithealth "$PORT"
+
+# 1. plain completion
+mk plain "$TMP/plain.json" "oa-gate plain probe: explain the fixture topic simply."
+code="$(post "$PORT" "$TMP/plain.json" "$TMP/r_plain.json")"
+check "plain: HTTP 200" test "$code" = "200"
+check "plain: chat.completion envelope, finish stop, real content" mk chk "$TMP/r_plain.json" \
+  'r["object"]=="chat.completion" and r["choices"][0]["finish_reason"]=="stop" and isinstance(r["choices"][0]["message"]["content"],str) and len(r["choices"][0]["message"]["content"])>40'
+
+# 2. tools-off lane (chat-only request accepted, tool-bearing request refused)
+mk notools "$TMP/toolsoff.json" "oa-gate tools-off probe: plain chat with no tools offered."
+code="$(post "$PORT" "$TMP/toolsoff.json" "$TMP/r_toolsoff.json")"
+check "tools-off: chat-only request -> 200" test "$code" = "200"
+mk plain "$TMP/toolsoff_bad.json" "oa-gate tools-off probe: plain chat with no tools offered."
+code="$(post "$PORT" "$TMP/toolsoff_bad.json" "$TMP/r_toolsoff_bad.json")"
+check "tools-off negative: offering tools -> 400 gate_expect" \
+  bash -c "test $code = 400"
+check "tools-off negative: reason names gate_expect" mk chk "$TMP/r_toolsoff_bad.json" \
+  'r["error"]["code"]=="gate_expect"'
+
+# 3. dialect-leak rejections (the loud-failure contract)
+code="$(post "$PORT" "$TMP/plain.json" "$TMP/r_leak_hdr.json" -H 'anthropic-version: 2023-06-01')"
+check "leak: anthropic-version header -> 400" test "$code" = "400"
+check "leak: header reason names the leak" mk chk "$TMP/r_leak_hdr.json" \
+  'r["error"]["code"]=="gate_dialect_leak" and "anthropic-version" in r["error"]["message"]'
+mk mut "$TMP/leak_tools.json" "oa-gate plain probe: explain the fixture topic simply." anth-tools
+code="$(post "$PORT" "$TMP/leak_tools.json" "$TMP/r_leak_tools.json")"
+check "leak: input_schema tools -> 400 gate_dialect_leak" bash -c \
+  "test $code = 400"
+check "leak: input_schema reason" mk chk "$TMP/r_leak_tools.json" \
+  'r["error"]["code"]=="gate_dialect_leak" and "input_schema" in r["error"]["message"]'
+mk mut "$TMP/leak_sys.json" "oa-gate plain probe: explain the fixture topic simply." top-system
+code="$(post "$PORT" "$TMP/leak_sys.json" "$TMP/r_leak_sys.json")"
+check "leak: top-level system -> 400" test "$code" = "400"
+mk mut "$TMP/leak_block.json" "oa-gate plain probe: explain the fixture topic simply." anth-block
+code="$(post "$PORT" "$TMP/leak_block.json" "$TMP/r_leak_block.json")"
+check "leak: Anthropic tool_result content block -> 400" test "$code" = "400"
+
+# 4. scenario request expectations
+mk mut "$TMP/no_tc.json" "oa-gate plain probe: explain the fixture topic simply." no-tool-choice
+code="$(post "$PORT" "$TMP/no_tc.json" "$TMP/r_no_tc.json")"
+check "expect: missing tool_choice -> 400" test "$code" = "400"
+mk mut "$TMP/ptc.json" "oa-gate plain probe: explain the fixture topic simply." ptc-true
+code="$(post "$PORT" "$TMP/ptc.json" "$TMP/r_ptc.json")"
+check "expect: parallel_tool_calls true -> 400 (ADR-0005 pin)" test "$code" = "400"
+
+# 5. single tool round-trip
+ST_PROMPT="oa-gate single tool note: save the fixture note to a file."
+mk plain "$TMP/st1.json" "$ST_PROMPT"
+code="$(post "$PORT" "$TMP/st1.json" "$TMP/r_st1.json")"
+check "single-tool leg1: HTTP 200" test "$code" = "200"
+check "single-tool leg1: one write_file call, finish tool_calls, string args" mk chk "$TMP/r_st1.json" \
+  'r["choices"][0]["finish_reason"]=="tool_calls" and len(r["choices"][0]["message"]["tool_calls"])==1 and r["choices"][0]["message"]["tool_calls"][0]["type"]=="function" and r["choices"][0]["message"]["tool_calls"][0]["function"]["name"]=="write_file" and isinstance(r["choices"][0]["message"]["tool_calls"][0]["function"]["arguments"],str) and json.loads(r["choices"][0]["message"]["tool_calls"][0]["function"]["arguments"])["path"]=="openai-single-note.md"'
+mk chain "$TMP/st2.json" "$ST_PROMPT" ok "$TMP/r_st1.json"
+code="$(post "$PORT" "$TMP/st2.json" "$TMP/r_st2.json")"
+check "single-tool leg2: echo + tool turn -> 200 final text" test "$code" = "200"
+check "single-tool leg2: final names the file, finish stop" mk chk "$TMP/r_st2.json" \
+  'r["choices"][0]["finish_reason"]=="stop" and "openai-single-note.md" in r["choices"][0]["message"]["content"]'
+mk chain "$TMP/st2_no.json" "$ST_PROMPT" no-tool-turn "$TMP/r_st1.json"
+code="$(post "$PORT" "$TMP/st2_no.json" "$TMP/r_st2_no.json")"
+check "single-tool negative: echo without tool turn -> 400 gate_pairing" \
+  bash -c "test $code = 400"
+check "single-tool negative: pairing reason" mk chk "$TMP/r_st2_no.json" \
+  'r["error"]["code"]=="gate_pairing"'
+mk chain "$TMP/st2_wrong.json" "$ST_PROMPT" wrong-id "$TMP/r_st1.json"
+code="$(post "$PORT" "$TMP/st2_wrong.json" "$TMP/r_st2_wrong.json")"
+check "single-tool negative: wrong tool_call_id -> 400" test "$code" = "400"
+mk chain "$TMP/st2_obj.json" "$ST_PROMPT" object-args "$TMP/r_st1.json"
+code="$(post "$PORT" "$TMP/st2_obj.json" "$TMP/r_st2_obj.json")"
+check "single-tool negative: arguments echoed as object -> 400 shape" \
+  bash -c "test $code = 400"
+check "single-tool negative: shape reason names STRING" mk chk "$TMP/r_st2_obj.json" \
+  'r["error"]["code"]=="gate_tool_call_shape" and "STRING" in r["error"]["message"]'
+
+# 6. escaping torture (the two-escaper trap, spec section 6)
+T_PROMPT="oa-gate torture probe: write the escaping torture file."
+mk plain "$TMP/t1.json" "$T_PROMPT"
+code="$(post "$PORT" "$TMP/t1.json" "$TMP/r_t1.json")"
+check "torture leg1: HTTP 200" test "$code" = "200"
+check "torture leg1: arguments decode to the exact nasty payload" \
+  mk torture "$TMP/r_t1.json" scenarios-openai.json
+mk chain "$TMP/t2.json" "$T_PROMPT" ok "$TMP/r_t1.json"
+code="$(post "$PORT" "$TMP/t2.json" "$TMP/r_t2.json")"
+check "torture leg2: faithful echo -> 200 final" test "$code" = "200"
+mk chain "$TMP/t2_dbl.json" "$T_PROMPT" double-encode "$TMP/r_t1.json"
+code="$(post "$PORT" "$TMP/t2_dbl.json" "$TMP/r_t2_dbl.json")"
+check "torture negative: double-encoded echo -> 400" test "$code" = "400"
+check "torture negative: reason names the two-escaper trap" mk chk "$TMP/r_t2_dbl.json" \
+  'r["error"]["code"]=="gate_echo_mismatch" and "two-escaper" in r["error"]["message"]'
+
+# 7. parallel double-call
+P_PROMPT="oa-gate parallel probe: run the two-write parallel case."
+mk plain "$TMP/p1.json" "$P_PROMPT"
+code="$(post "$PORT" "$TMP/p1.json" "$TMP/r_p1.json")"
+check "parallel leg1: TWO tool_calls, distinct ids" mk chk "$TMP/r_p1.json" \
+  'r["choices"][0]["finish_reason"]=="tool_calls" and len(r["choices"][0]["message"]["tool_calls"])==2 and r["choices"][0]["message"]["tool_calls"][0]["id"]!=r["choices"][0]["message"]["tool_calls"][1]["id"]'
+mk chain "$TMP/p2.json" "$P_PROMPT" ok "$TMP/r_p1.json"
+code="$(post "$PORT" "$TMP/p2.json" "$TMP/r_p2.json")"
+check "parallel leg2: both results -> 200 final" test "$code" = "200"
+mk chain "$TMP/p2_one.json" "$P_PROMPT" only-first "$TMP/r_p1.json"
+code="$(post "$PORT" "$TMP/p2_one.json" "$TMP/r_p2_one.json")"
+check "parallel negative: answering only one call -> 400 pairing" test "$code" = "400"
+
+# 8. two-round mission (loop continuation + step indexing)
+M_PROMPT="oa-gate mission probe: run the two-round mission."
+mk plain "$TMP/m1.json" "$M_PROMPT"
+code="$(post "$PORT" "$TMP/m1.json" "$TMP/r_m1.json")"
+check "mission leg1: part-1 tool call" mk chk "$TMP/r_m1.json" \
+  'json.loads(r["choices"][0]["message"]["tool_calls"][0]["function"]["arguments"])["path"]=="mission-part-1.md"'
+mk chain "$TMP/m2.json" "$M_PROMPT" ok "$TMP/r_m1.json"
+code="$(post "$PORT" "$TMP/m2.json" "$TMP/r_m2.json")"
+check "mission leg2: part-2 tool call (step indexed by assistant count)" mk chk "$TMP/r_m2.json" \
+  'r["choices"][0]["finish_reason"]=="tool_calls" and json.loads(r["choices"][0]["message"]["tool_calls"][0]["function"]["arguments"])["path"]=="mission-part-2.md"'
+mk chain "$TMP/m3.json" "$M_PROMPT" ok "$TMP/r_m1.json" "$TMP/r_m2.json"
+code="$(post "$PORT" "$TMP/m3.json" "$TMP/r_m3.json")"
+check "mission leg3: final text, finish stop" mk chk "$TMP/r_m3.json" \
+  'r["choices"][0]["finish_reason"]=="stop" and "Mission complete" in r["choices"][0]["message"]["content"]'
+mk chain "$TMP/m4.json" "$M_PROMPT" ok "$TMP/r_m1.json" "$TMP/r_m2.json" "$TMP/r_m3.json"
+code="$(post "$PORT" "$TMP/m4.json" "$TMP/r_m4.json")"
+check "mission overrun: past-script request -> GATE-SCRIPT-EXHAUSTED" mk chk "$TMP/r_m4.json" \
+  'r["choices"][0]["message"]["content"].startswith("GATE-SCRIPT-EXHAUSTED")'
+
+# 9. injected API errors (OpenAI error envelope)
+for want in 400 429 500 503; do
+  case "$want" in
+    400) marker="four hundred";; 429) marker="rate limit";;
+    500) marker="five hundred";; 503) marker="unavailable";;
+  esac
+  mk plain "$TMP/e_$want.json" "oa-gate error $marker: trigger the injected failure."
+  code="$(post "$PORT" "$TMP/e_$want.json" "$TMP/r_e_$want.json")"
+  check "api-error $want: status returned" test "$code" = "$want"
+  check "api-error $want: OpenAI error envelope" mk chk "$TMP/r_e_$want.json" \
+    'isinstance(r["error"]["message"],str) and "gate-injected" in r["error"]["message"] and isinstance(r["error"]["type"],str)'
+done
+
+# 10. background (unmatched) request
+mk plain "$TMP/bg.json" "hello there, just a boot probe with no marker"
+code="$(post "$PORT" "$TMP/bg.json" "$TMP/r_bg.json")"
+check "background: unmatched prompt -> benign ok" mk chk "$TMP/r_bg.json" \
+  'r["choices"][0]["message"]["content"]=="ok"'
+
+# 11. ground-truth log invariants
+check "ground-truth JSONL log invariants" mk logcheck "$TMP/req.jsonl"
+
+# 12. production-port refusal
+rc=0
+"$PY" stub-openai.py --port 7770 --scenarios scenarios-openai.json \
+     --log "$TMP/never.jsonl" >/dev/null 2>&1 || rc=$?
+check "refuses production port 7770" test "$rc" -ne 0
+
+# ---- hostile mode: black-hole ----------------------------------------------
+BH="$(freeport)"
+"$PY" stub-openai.py --port "$BH" --log "$TMP/bh.jsonl" --mode black-hole \
+     >/dev/null 2>&1 &
+PIDS+=($!); disown
+check "black-hole: healthy" waithealth "$BH"
+rc=0
+curl -s -o /dev/null --max-time 3 -H 'content-type: application/json' \
+     --data-binary @"$TMP/plain.json" \
+     "http://127.0.0.1:$BH/v1/chat/completions" || rc=$?
+check "black-hole: client times out (curl rc 28)" test "$rc" -eq 28
+check "black-hole: health still answers during the hang" \
+  curl -sf --max-time 2 "http://127.0.0.1:$BH/gate/health"
+
+# ---- hostile mode: mid-body-drop -------------------------------------------
+MD="$(freeport)"
+"$PY" stub-openai.py --port "$MD" --log "$TMP/md.jsonl" --mode mid-body-drop \
+     >/dev/null 2>&1 &
+PIDS+=($!); disown
+check "mid-body-drop: healthy" waithealth "$MD"
+rc=0
+curl -s --max-time 5 -o "$TMP/half.json" -H 'content-type: application/json' \
+     --data-binary @"$TMP/plain.json" \
+     "http://127.0.0.1:$MD/v1/chat/completions" || rc=$?
+check "mid-body-drop: transfer fails (curl rc $rc)" test "$rc" -ne 0
+check "mid-body-drop: partial body is not parseable JSON" mk notjson "$TMP/half.json"
+
+# ---- hostile mode: tool-pending-forever ------------------------------------
+TP="$(freeport)"
+"$PY" stub-openai.py --port "$TP" --log "$TMP/tp.jsonl" \
+     --mode tool-pending-forever >/dev/null 2>&1 &
+PIDS+=($!); disown
+check "tool-pending-forever: healthy" waithealth "$TP"
+for i in 1 2 3; do
+  code="$(post "$TP" "$TMP/plain.json" "$TMP/r_tp$i.json")"
+  check "tool-pending-forever: request $i -> 200" test "$code" = "200"
+done
+check "tool-pending-forever: three FRESH tool_calls, distinct ids" \
+  mk pending "$TMP/r_tp1.json" "$TMP/r_tp2.json" "$TMP/r_tp3.json"
+check "tool-pending-forever: /gate/stats counts 3 chat hits" \
+  bash -c "curl -sf http://127.0.0.1:$TP/gate/stats | grep -q '\"chat_hits\": 3'"
+
+# ---- summary ----------------------------------------------------------------
+echo
+echo "selftest: $PASS passed, $FAIL failed"
+if [ "$FAIL" -ne 0 ]; then
+  echo "SELFTEST RED"
+  exit 1
+fi
+echo "SELFTEST GREEN (stub-openai gate scaffolding verified)"

tests/gate-openai/stub-openai.py

@@ -0,0 +1,652 @@
+#!/usr/bin/env python3
+"""stub-openai.py - deterministic local stand-in for an OpenAI-format
+/v1/chat/completions provider, for the soul-openai-tools-v2 gate
+(docs/specs/SPEC-soul-openai-tools-v2-2026-08-06.md). No API key, no network,
+no model.
+
+Sibling of gate9's stub-llm.py (Anthropic dialect, _wt-beta-round9/scripts/
+gate9/): same scenario mechanism (marker matching, assistant-count step
+indexing, ground-truth JSONL log, prod-port refusal), different wire.
+Staging home is tests/gate-openai/ in _wt-openai-tools; folds into
+scripts/gate9/ after round 9 merges (see README.md).
+
+WHAT IT DOES
+  * Serves POST /v1/chat/completions on 127.0.0.1 only (OpenAI dialect).
+  * VALIDATES every request - this is the gate's discriminator, built
+    BEFORE the brain-side El code exists so dialect leakage fails loudly:
+      - Anthropic tells are 400 code=gate_dialect_leak: `anthropic-version`
+        header; top-level `system` / `stop_sequences` / `max_tokens_to_sample`
+        / `anthropic_version`; `input_schema` inside a tool entry; Anthropic
+        content blocks (tool_use / tool_result / server_tool_use / ...).
+      - tools[] must be OpenAI-shaped {type:"function", function:{name,
+        description, parameters}} with unique names -> 400 gate_tools_shape.
+      - assistant tool_calls echoes must be {id, type:"function",
+        function:{name, arguments:<JSON-encoded STRING>}}; a decoded-object
+        `arguments` is a wire bug -> 400 gate_tool_call_shape.
+      - every assistant tool_calls turn must be answered by role:"tool"
+        messages covering EVERY tool_call_id, immediately following;
+        unknown / duplicate / missing ids -> 400 gate_pairing.
+      - echoed `arguments` for gate-issued call ids (call_gate_*) are
+        recomputed from the script and compared after ONE json decode ->
+        400 gate_echo_mismatch. This is the two-escaper-trap discriminator
+        named in the spec's security model (section 6).
+      - scenario-level request expectations from scenarios-openai.json
+        (tools offered, OpenAI-shaped tool_choice, parallel_tool_calls
+        pinned false per ADR-0005) -> 400 gate_expect.
+  * Answers with SCRIPTED responses: plain text (finish_reason "stop"),
+    tool calls (finish_reason "tool_calls", arguments JSON-encoded, incl. a
+    nested-quote/escaping torture payload and a parallel two-call case), and
+    API-error injection (OpenAI error envelope). Scenario is selected by
+    scanning user-message text (newest first) for a registered marker
+    substring; the step index is the number of assistant messages already in
+    the request (stateless replay - resumes index correctly by construction).
+  * Writes a ground-truth JSONL log (--log): one record per request with the
+    validation verdict, matched scenario/step, and exactly which tool calls
+    were delivered. Gate assertions compare the brain's claims against THIS
+    log - truth, not narration.
+  * Unmatched requests (boot probes, awareness chatter) get a benign "ok"
+    text response, logged kind=background, never counted as ground truth.
+  * HOSTILE MODES (--mode) on the same file:
+      black-hole            accept + read the request, never respond;
+      mid-body-drop         send half a JSON body, then abort the socket;
+      tool-pending-forever  every request gets a FRESH tool_call
+                            (finish_reason "tool_calls"), forever - tests
+                            the agentic loop's iteration cap; count the
+                            brain's round-trips via GET /gate/stats.
+
+usage: stub-openai.py --port P --scenarios scenarios-openai.json \
+                      --log requests.jsonl [--mode MODE]
+Listens on 127.0.0.1 only. Refuses production ports 7770/7779/17779.
+"""
+import argparse
+import itertools
+import json
+import socket
+import struct
+import threading
+import time
+import uuid
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+
+STATE = {"scenarios": None, "log_path": None, "lock": threading.Lock(),
+         "seq": 0, "mode": "normal", "chat_hits": 0}
+_PENDING_SEQ = itertools.count(1)
+
+ANTHROPIC_TOP_KEYS = ("system", "stop_sequences", "max_tokens_to_sample",
+                      "anthropic_version")
+ANTHROPIC_BLOCK_TYPES = {"tool_use", "tool_result", "server_tool_use",
+                         "web_search_tool_result", "thinking",
+                         "redacted_thinking"}
+DEFAULT_EXPECT = {"require_tools": True, "require_tool_choice": True,
+                  "parallel_tool_calls": False, "forbid_tools": False}
+
+
+# ---------------------------------------------------------------- loading ----
+def load_scenarios(path):
+    cfg = json.load(open(path))
+    defaults = dict(DEFAULT_EXPECT)
+    defaults.update(cfg.get("defaults", {}).get("expect_request", {}))
+    marker_map = []   # (marker_lower, cname, pid)
+    scripts = {}      # cname or cname/pid -> expanded script
+    pid_map = {}      # pid -> cname (for call_gate_* id -> script lookup)
+    expects = {}      # cname -> merged expect_request
+    for cname, cls in cfg["classes"].items():
+        scripts[cname] = expand_script(cls.get("script", []))
+        exp = dict(defaults)
+        exp.update(cls.get("expect_request", {}))
+        expects[cname] = exp
+        for ph in cls["phrasings"]:
+            if ph.get("script") is not None:
+                scripts[cname + "/" + ph["id"]] = expand_script(ph["script"])
+            marker_map.append((ph["marker"].lower(), cname, ph["id"]))
+            pid_map[ph["id"]] = cname
+    return {"cfg": cfg, "marker_map": marker_map, "scripts": scripts,
+            "pid_map": pid_map, "expects": expects}
+
+
+def expand_script(script):
+    """Same repeat-expansion contract as gate9's stub-llm.py ({N}/{NN})."""
+    out = []
+    for step in script:
+        if "repeat" in step:
+            for n in range(1, step["repeat"] + 1):
+                t = {k: v for k, v in step.items() if k != "repeat"}
+                out.append(json.loads(json.dumps(t)
+                                      .replace("{NN}", "%02d" % n)
+                                      .replace("{N}", str(n))))
+        else:
+            out.append(step)
+    return out
+
+
+# ------------------------------------------------------------- validation ----
+def _rej(message, code):
+    return {"status": 400, "message": message, "code": code}
+
+
+def validate_dialect(headers, req):
+    """Universal checks - run on EVERY request, scenario-matched or not.
+    Anything Anthropic-shaped on this lane means the brain's translator
+    leaked; the whole point is that it fails loudly, here, with a reason."""
+    if headers.get("anthropic-version"):
+        return _rej("anthropic-version header on the OpenAI lane: this "
+                    "request was built by the Anthropic dialect path",
+                    "gate_dialect_leak")
+    for k in ANTHROPIC_TOP_KEYS:
+        if k in req:
+            return _rej("top-level `%s` is Anthropic dialect; the OpenAI "
+                        "dialect has no such field (system prompt goes in "
+                        "messages[0])" % k, "gate_dialect_leak")
+    tools = req.get("tools")
+    if tools is not None:
+        if not isinstance(tools, list):
+            return _rej("`tools` must be an array", "gate_tools_shape")
+        names = []
+        for i, t in enumerate(tools):
+            if not isinstance(t, dict):
+                return _rej("tools[%d] is not an object" % i,
+                            "gate_tools_shape")
+            if "input_schema" in t or (isinstance(t.get("function"), dict)
+                                       and "input_schema" in t["function"]):
+                return _rej("tools[%d] carries `input_schema` (Anthropic "
+                            "dialect); OpenAI dialect wants "
+                            "function.parameters" % i, "gate_dialect_leak")
+            if t.get("type") != "function":
+                return _rej("tools[%d].type must be \"function\", got %r"
+                            % (i, t.get("type")), "gate_tools_shape")
+            fn = t.get("function")
+            if not isinstance(fn, dict):
+                return _rej("tools[%d].function missing" % i,
+                            "gate_tools_shape")
+            if not isinstance(fn.get("name"), str) or not fn["name"]:
+                return _rej("tools[%d].function.name missing/empty" % i,
+                            "gate_tools_shape")
+            if not isinstance(fn.get("description"), str) or not fn["description"]:
+                return _rej("tools[%d].function.description missing/empty" % i,
+                            "gate_tools_shape")
+            if not isinstance(fn.get("parameters"), dict):
+                return _rej("tools[%d].function.parameters missing (JSON "
+                            "Schema object expected)" % i, "gate_tools_shape")
+            names.append(fn["name"])
+        if len(names) != len(set(names)):
+            return _rej("tools: tool names must be unique", "gate_tools_shape")
+    msgs = req.get("messages")
+    if not isinstance(msgs, list) or not msgs:
+        return _rej("`messages` must be a non-empty array",
+                    "gate_messages_shape")
+    for i, m in enumerate(msgs):
+        if not isinstance(m, dict):
+            return _rej("messages[%d] is not an object" % i,
+                        "gate_messages_shape")
+        c = m.get("content")
+        if isinstance(c, list):
+            for j, b in enumerate(c):
+                if isinstance(b, dict) and b.get("type") in ANTHROPIC_BLOCK_TYPES:
+                    return _rej("messages[%d].content[%d] is an Anthropic "
+                                "`%s` block; the OpenAI dialect uses "
+                                "tool_calls / role:\"tool\" messages"
+                                % (i, j, b.get("type")), "gate_dialect_leak")
+        if m.get("role") == "tool":
+            if not isinstance(m.get("tool_call_id"), str) or not m["tool_call_id"]:
+                return _rej("messages[%d]: role \"tool\" requires a "
+                            "`tool_call_id`" % i, "gate_messages_shape")
+            if "content" not in m:
+                return _rej("messages[%d]: role \"tool\" requires `content`"
+                            % i, "gate_messages_shape")
+        if m.get("role") == "assistant" and m.get("tool_calls") is not None:
+            tcs = m["tool_calls"]
+            if not isinstance(tcs, list) or not tcs:
+                return _rej("messages[%d].tool_calls must be a non-empty "
+                            "array" % i, "gate_tool_call_shape")
+            for j, tc in enumerate(tcs):
+                if not isinstance(tc, dict) or tc.get("type") != "function":
+                    return _rej("messages[%d].tool_calls[%d].type must be "
+                                "\"function\"" % (i, j), "gate_tool_call_shape")
+                if not isinstance(tc.get("id"), str) or not tc["id"]:
+                    return _rej("messages[%d].tool_calls[%d].id missing"
+                                % (i, j), "gate_tool_call_shape")
+                fn = tc.get("function")
+                if not isinstance(fn, dict) or not isinstance(fn.get("name"), str):
+                    return _rej("messages[%d].tool_calls[%d].function.name "
+                                "missing" % (i, j), "gate_tool_call_shape")
+                if not isinstance(fn.get("arguments"), str):
+                    return _rej("messages[%d].tool_calls[%d].function."
+                                "arguments must be a JSON-encoded STRING, "
+                                "got %s" % (i, j,
+                                            type(fn.get("arguments")).__name__),
+                                "gate_tool_call_shape")
+    return None
+
+
+def validate_pairing(msgs):
+    """OpenAI pairing rule: every assistant tool_calls turn must be followed
+    immediately by role:"tool" messages answering every tool_call_id."""
+    open_ids, open_at = set(), None
+    for i, m in enumerate(msgs):
+        role = m.get("role")
+        if role == "tool":
+            tid = m.get("tool_call_id")
+            if open_at is None:
+                return _rej("messages[%d]: role \"tool\" message with no "
+                            "preceding assistant tool_calls turn "
+                            "(tool_call_id=%s)" % (i, tid), "gate_pairing")
+            if tid not in open_ids:
+                return _rej("messages[%d]: tool message answers unknown or "
+                            "already-answered tool_call_id %s" % (i, tid),
+                            "gate_pairing")
+            open_ids.discard(tid)
+            continue
+        if open_ids:
+            return _rej("messages[%d]: assistant tool_calls not fully "
+                        "answered before messages[%d]; missing tool "
+                        "responses for: %s" % (open_at, i, sorted(open_ids)),
+                        "gate_pairing")
+        open_ids, open_at = set(), None
+        if role == "assistant" and m.get("tool_calls"):
+            ids = [tc.get("id") for tc in m["tool_calls"]]
+            open_ids, open_at = set(ids), i
+    if open_ids:
+        return _rej("messages[%d]: assistant tool_calls at end of thread "
+                    "without tool responses for: %s"
+                    % (open_at, sorted(open_ids)), "gate_pairing")
+    return None
+
+
+def validate_echo_args(msgs, loaded):
+    """Ground-truth round-trip check: for every echoed gate-issued call id,
+    recompute the arguments this stub originally sent from the script and
+    require one json decode to reproduce them exactly. Catches the
+    two-escaper trap (spec section 6) deterministically."""
+    if not loaded:
+        return None
+    for i, m in enumerate(msgs):
+        if m.get("role") != "assistant":
+            continue
+        for tc in m.get("tool_calls") or []:
+            tid = tc.get("id", "")
+            if not tid.startswith("call_gate_"):
+                continue
+            rest = tid[len("call_gate_"):]
+            try:
+                pid, s_part, k_part = rest.rsplit("_", 2)
+                step_idx, k = int(s_part[1:]), int(k_part)
+            except (ValueError, IndexError):
+                continue
+            cname = loaded["pid_map"].get(pid)
+            if cname is None:
+                continue
+            script = (loaded["scripts"].get(cname + "/" + pid)
+                      or loaded["scripts"].get(cname) or [])
+            if step_idx >= len(script):
+                continue
+            calls = script[step_idx].get("tool_calls") or []
+            if k >= len(calls):
+                continue
+            expected = calls[k]
+            fn = tc.get("function") or {}
+            if fn.get("name") != expected["name"]:
+                return _rej("messages[%d]: echoed tool name %r != issued %r "
+                            "for %s" % (i, fn.get("name"), expected["name"],
+                                        tid), "gate_echo_mismatch")
+            try:
+                got = json.loads(fn.get("arguments", ""))
+            except ValueError:
+                return _rej("messages[%d]: echoed arguments for %s are not "
+                            "valid JSON after one decode (truncated or "
+                            "half-escaped?)" % (i, tid), "gate_echo_mismatch")
+            if got != expected["arguments"]:
+                hint = (" (decoded to a string, not an object: "
+                        "double-encoded - the two-escaper trap)"
+                        if isinstance(got, str) else "")
+                return _rej("messages[%d]: echoed arguments for %s do not "
+                            "round-trip to the issued payload%s"
+                            % (i, tid, hint), "gate_echo_mismatch")
+    return None
+
+
+def validate_expect(req, exp):
+    """Scenario-level request expectations (scenarios-openai.json)."""
+    tools = req.get("tools") or []
+    if exp.get("forbid_tools") and tools:
+        return _rej("this scenario is chat-only: no `tools` may be offered "
+                    "on it", "gate_expect")
+    if exp.get("require_tools") and not tools:
+        return _rej("scenario expects a `tools` array to be offered (the "
+                    "agentic lane must advertise its tools)", "gate_expect")
+    if exp.get("require_tool_choice"):
+        tc = req.get("tool_choice")
+        ok = tc in ("auto", "none", "required") or (
+            isinstance(tc, dict) and tc.get("type") == "function"
+            and isinstance(tc.get("function"), dict)
+            and tc["function"].get("name"))
+        if not ok:
+            return _rej("scenario expects an OpenAI-shaped `tool_choice`, "
+                        "got %r" % (tc,), "gate_expect")
+    want_ptc = exp.get("parallel_tool_calls", None)
+    if want_ptc is not None:
+        if "parallel_tool_calls" not in req:
+            return _rej("scenario expects explicit `parallel_tool_calls` "
+                        "(ADR-0005: must be pinned false on the wire)",
+                        "gate_expect")
+        if req["parallel_tool_calls"] != want_ptc:
+            return _rej("scenario expects parallel_tool_calls=%s, got %s"
+                        % (json.dumps(want_ptc),
+                           json.dumps(req["parallel_tool_calls"])),
+                        "gate_expect")
+    return None
+
+
+# --------------------------------------------------------- scenario match ----
+def extract_user_texts_newest_first(msgs):
+    texts = []
+    for m in reversed(msgs):
+        if not isinstance(m, dict) or m.get("role") != "user":
+            continue
+        c = m.get("content")
+        if isinstance(c, str):
+            texts.append(c)
+        elif isinstance(c, list):
+            for b in c:
+                if isinstance(b, dict) and b.get("type") == "text":
+                    texts.append(b.get("text", ""))
+    return texts
+
+
+def match_scenario(loaded, msgs):
+    for text in extract_user_texts_newest_first(msgs):
+        tl = text.lower()
+        for marker, cname, pid in loaded["marker_map"]:
+            if marker in tl:
+                return cname, pid
+    return None, None
+
+
+# ------------------------------------------------------------- rendering ----
+def completion_envelope(msg, finish, model, usage=(100, 100)):
+    return {"id": "chatcmpl-gate-" + uuid.uuid4().hex[:12],
+            "object": "chat.completion", "created": int(time.time()),
+            "model": model,
+            "choices": [{"index": 0, "message": msg,
+                         "finish_reason": finish, "logprobs": None}],
+            "usage": {"prompt_tokens": usage[0],
+                      "completion_tokens": usage[1],
+                      "total_tokens": usage[0] + usage[1]}}
+
+
+def text_completion(text, model):
+    return completion_envelope({"role": "assistant", "content": text},
+                               "stop", model, usage=(1, 1))
+
+
+def pending_body(seq, model):
+    args = json.dumps({"path": "never-%04d.md" % seq,
+                       "content": "this run never completes"})
+    msg = {"role": "assistant", "content": None,
+           "tool_calls": [{"id": "call_hostile_pending_%04d" % seq,
+                           "type": "function",
+                           "function": {"name": "write_file",
+                                        "arguments": args}}]}
+    return completion_envelope(msg, "tool_calls", model, usage=(1, 1))
+
+
+def render_step(step, cname, pid, step_idx, model):
+    """Returns (http_status, body_dict, delivered) - delivered is ground
+    truth for the JSONL log."""
+    delivered = {"tool_calls": [], "finish_reason": None, "api_error": None}
+    if "api_error" in step:
+        e = step["api_error"]
+        delivered["api_error"] = e["status"]
+        return (e["status"],
+                {"error": {"message": e["message"],
+                           "type": e.get("type", "server_error"),
+                           "param": None, "code": e.get("code")}},
+                delivered)
+    msg = {"role": "assistant"}
+    finish = "stop"
+    if step.get("tool_calls"):
+        tcs = []
+        for k, call in enumerate(step["tool_calls"]):
+            tid = "call_gate_%s_s%d_%d" % (pid, step_idx, k)
+            tcs.append({"id": tid, "type": "function",
+                        "function": {"name": call["name"],
+                                     "arguments": json.dumps(
+                                         call["arguments"],
+                                         ensure_ascii=False)}})
+            delivered["tool_calls"].append(call["name"])
+        msg["tool_calls"] = tcs
+        msg["content"] = step.get("text")  # null when no narration, like real
+        finish = "tool_calls"
+    else:
+        msg["content"] = step["text"]
+    delivered["finish_reason"] = finish
+    return 200, completion_envelope(msg, finish, model), delivered
+
+
+# ------------------------------------------------------------------ log ------
+def log_record(rec):
+    with STATE["lock"]:
+        STATE["seq"] += 1
+        rec["seq"] = STATE["seq"]
+        with open(STATE["log_path"], "a") as f:
+            f.write(json.dumps(rec, ensure_ascii=False) + "\n")
+
+
+# ---------------------------------------------------------------- server -----
+class Handler(BaseHTTPRequestHandler):
+    protocol_version = "HTTP/1.1"
+
+    def _send_json(self, status, obj):
+        body = json.dumps(obj, ensure_ascii=False).encode("utf-8")
+        self.send_response(status)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+    def _send_error(self, verdict):
+        self._send_json(verdict["status"],
+                        {"error": {"message": verdict["message"],
+                                   "type": "invalid_request_error",
+                                   "param": None, "code": verdict["code"]}})
+
+    def _drop_mid_body(self):
+        """Valid 200 headers, half the promised body, then a socket abort
+        (same SO_LINGER teardown as gate9's mid-body-drop-brain.py)."""
+        full = json.dumps(text_completion(
+            "This reply will never finish arriving because the connection "
+            "dies in the middle of the body, which is exactly the point of "
+            "this hostile fixture.", "hostile-mid-drop")).encode("utf-8")
+        half = full[: len(full) // 2]
+        self.send_response(200)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(full)))  # promises more
+        self.end_headers()
+        self.wfile.write(half)
+        self.wfile.flush()
+        try:
+            self.connection.setsockopt(socket.SOL_SOCKET, socket.SO_LINGER,
+                                       struct.pack("ii", 1, 0))
+            self.connection.shutdown(socket.SHUT_RDWR)
+        except OSError:
+            pass
+        self.close_connection = True
+
+    def do_GET(self):
+        path = self.path.split("?")[0]
+        if path == "/gate/health":
+            self._send_json(200, {"ok": True, "mode": STATE["mode"]})
+        elif path == "/gate/stats":
+            with STATE["lock"]:
+                self._send_json(200, {"mode": STATE["mode"],
+                                      "chat_hits": STATE["chat_hits"]})
+        else:
+            self._send_json(404, {"error": {"message": "not found",
+                                            "type": "invalid_request_error",
+                                            "param": None,
+                                            "code": "unknown_route"}})
+
+    def do_POST(self):
+        n = int(self.headers.get("Content-Length") or 0)
+        raw = self.rfile.read(n)
+        mode = STATE["mode"]
+        rec = {"ts": time.time(), "path": self.path, "mode": mode,
+               "kind": "background", "scenario_class": None, "phrasing": None,
+               "step": None, "n_messages": 0, "n_assistant": 0,
+               "validation": "ok", "validation_detail": None,
+               "delivered": {"tool_calls": [], "finish_reason": None,
+                             "api_error": None},
+               "http_status": 200}
+        if self.path.split("?")[0] != "/v1/chat/completions":
+            rec.update(kind="wrong_path", http_status=404)
+            log_record(rec)
+            self._send_json(404, {"error": {
+                "message": "no such route: %s" % self.path,
+                "type": "invalid_request_error", "param": None,
+                "code": "unknown_route"}})
+            return
+        with STATE["lock"]:
+            STATE["chat_hits"] += 1
+
+        # ---- hostile modes: behavior first, no validation ----------------
+        if mode == "black-hole":
+            rec.update(kind="hostile", http_status=None)
+            log_record(rec)
+            threading.Event().wait()  # hold the socket open forever
+            return
+        if mode == "mid-body-drop":
+            rec.update(kind="hostile", http_status=200)
+            log_record(rec)
+            self._drop_mid_body()
+            return
+        if mode == "tool-pending-forever":
+            seq = next(_PENDING_SEQ)
+            rec.update(kind="hostile",
+                       delivered={"tool_calls": ["write_file"],
+                                  "finish_reason": "tool_calls",
+                                  "api_error": None})
+            log_record(rec)
+            self._send_json(200, pending_body(seq, "gate-openai-model"))
+            return
+
+        # ---- normal mode -------------------------------------------------
+        try:
+            req = json.loads(raw)
+        except ValueError as exc:
+            # DIAGNOSTIC CAPTURE (2026-08-06): an unparseable body used to be recorded as
+            # a bare "bad_json" with the bytes thrown away, which made an intermittent
+            # failure impossible to root-cause — you cannot fix what you did not keep.
+            # Dump the raw body next to the log, and record exactly where the parser gave
+            # up plus the offending byte, so one occurrence is enough to diagnose.
+            dump_path = "%s.badbody.%s" % (STATE.get("log_path", "/tmp/stub-openai"),
+                                           rec.get("seq", "x"))
+            try:
+                data = raw if isinstance(raw, (bytes, bytearray)) else str(raw).encode()
+                with open(dump_path, "wb") as fh:
+                    fh.write(data)
+            except Exception as dump_exc:
+                dump_path = "(dump failed: %s)" % dump_exc
+            pos = getattr(exc, "pos", None)
+            near = ""
+            byte_repr = ""
+            if isinstance(pos, int):
+                blob = raw if isinstance(raw, (bytes, bytearray)) else str(raw).encode()
+                near = blob[max(0, pos - 60):pos + 60].decode("utf-8", "replace")
+                if 0 <= pos < len(blob):
+                    byte_repr = "0x%02x" % blob[pos]
+            rec.update(kind="bad_json", validation="rejected",
+                       validation_detail="request body is not valid JSON: %s" % exc,
+                       http_status=400, raw_len=len(raw), raw_dump=dump_path,
+                       err_pos=pos, err_byte=byte_repr, err_near=near)
+            log_record(rec)
+            self._send_error(_rej("request body is not valid JSON",
+                                  "bad_json"))
+            return
+        msgs = req.get("messages") or []
+        rec["n_messages"] = len(msgs)
+        rec["n_assistant"] = sum(1 for m in msgs if isinstance(m, dict)
+                                 and m.get("role") == "assistant")
+        loaded = STATE["scenarios"]
+        cname, pid = match_scenario(loaded, msgs)
+        if cname:
+            rec.update(kind="scenario", scenario_class=cname, phrasing=pid)
+
+        # Wire-level validation runs for EVERY request, scenario or not.
+        verdict = (validate_dialect(self.headers, req)
+                   or validate_pairing([m for m in msgs
+                                        if isinstance(m, dict)])
+                   or validate_echo_args(msgs, loaded))
+        if verdict:
+            rec.update(validation="rejected",
+                       validation_detail=verdict["message"],
+                       http_status=verdict["status"])
+            log_record(rec)
+            self._send_error(verdict)
+            return
+
+        model = req.get("model", "gate-openai-model")
+        if not cname:
+            log_record(rec)
+            self._send_json(200, text_completion("ok", model))
+            return
+
+        script = (loaded["scripts"].get(cname + "/" + pid)
+                  or loaded["scripts"][cname])
+        step_idx = rec["n_assistant"]
+        if step_idx >= len(script):
+            rec.update(kind="overrun", step=step_idx)
+            log_record(rec)
+            self._send_json(200, text_completion(
+                "GATE-SCRIPT-EXHAUSTED %s step %d" % (pid, step_idx), model))
+            return
+
+        step = script[step_idx]
+        exp = dict(loaded["expects"][cname])
+        exp.update(step.get("expect_request", {}))
+        verdict = validate_expect(req, exp)
+        if verdict:
+            rec.update(step=step_idx, validation="rejected",
+                       validation_detail=verdict["message"],
+                       http_status=verdict["status"])
+            log_record(rec)
+            self._send_error(verdict)
+            return
+
+        status, body, delivered = render_step(step, cname, pid, step_idx,
+                                              model)
+        rec.update(step=step_idx, delivered=delivered, http_status=status)
+        log_record(rec)
+        self._send_json(status, body)
+
+    def log_message(self, *a):
+        pass
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--port", type=int, required=True)
+    ap.add_argument("--scenarios",
+                    help="scenarios-openai.json (required in normal mode)")
+    ap.add_argument("--log", required=True)
+    ap.add_argument("--mode", default="normal",
+                    choices=["normal", "black-hole", "mid-body-drop",
+                             "tool-pending-forever"])
+    args = ap.parse_args()
+    if args.port in (7770, 7779, 17779):
+        raise SystemExit("stub-openai: refusing production Neuron port")
+    if args.mode == "normal" and not args.scenarios:
+        raise SystemExit("stub-openai: --scenarios is required in normal mode")
+    STATE["mode"] = args.mode
+    STATE["scenarios"] = (load_scenarios(args.scenarios)
+                          if args.scenarios else None)
+    STATE["log_path"] = args.log
+    open(args.log, "w").close()
+    n_markers = (len(STATE["scenarios"]["marker_map"])
+                 if STATE["scenarios"] else 0)
+    print("stub-openai [%s]: 127.0.0.1:%d /v1/chat/completions "
+          "(%d markers registered, log=%s)"
+          % (args.mode, args.port, n_markers, args.log), flush=True)
+    ThreadingHTTPServer(("127.0.0.1", args.port), Handler).serve_forever()
+
+
+if __name__ == "__main__":
+    main()

tests/run-el-test.sh

@@ -0,0 +1,148 @@
+#!/usr/bin/env bash
+# run-el-test.sh — build and RUN one engine test (tests/*.el), printing its assertions.
+#
+# WHY THIS EXISTS (2026-08-06): the engine's tests/*.el files were never runnable from the
+# tree. `elc` is a COMPILER — it emits C to stdout and exits; it does not execute anything.
+# So "the tests" could only ever be read, not run, and a signature change could silently
+# break them (exactly what happened when bridge_save gained its `wire` argument). This
+# script closes that: emit the test to C, link it against the engine modules, execute it.
+#
+# HOW IT WORKS
+#   1. elc <test>.el              -> C on stdout (the test file's `main` + prototypes)
+#   2. elb (once, cached)         -> per-module C for the whole engine into a scratch dir
+#   3. cc test.c + all modules EXCEPT soul.c (soul.c owns the real `main`) + the runtime
+#   4. run it
+#
+# The test C references only the engine functions it actually calls, so there are no
+# duplicate-symbol collisions with the module objects.
+#
+# RUNTIME: the REPO-PINNED vendor/el-runtime (NOT ~/el-sdk/el_runtime.c — that June build
+# is missing builtins August code calls: engram_wm_count, engram_wm_top_json,
+# http_delete_json, http_serve_async; linking against it fails with "symbol(s) not found").
+#
+# USAGE
+#   tests/run-el-test.sh tests/test_bridge_serialization.el     # one test
+#   tests/run-el-test.sh --all                                  # every tests/test_*.el
+#   REBUILD=1 tests/run-el-test.sh ...                          # force module regeneration
+#
+# Tests that need a live API key / running soul (see each file's header) will report their
+# own skips or failures — this runner does not fake them.
+set -uo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$REPO_ROOT" || exit 2
+
+ELC="${ELC:-$HOME/el-sdk/elc}"
+ELB="${ELB:-$HOME/Development/el-sdk/bin/elb}"
+RUNTIME_DIR="${RUNTIME_DIR:-$REPO_ROOT/vendor/el-runtime/v1.0.0-20260501}"
+SCRATCH="${SCRATCH:-/tmp/el-test-$(basename "$REPO_ROOT")}"
+MODDIR="$SCRATCH/modules"
+OPENSSL_INC="${OPENSSL_INC:-/opt/homebrew/opt/openssl@3/include}"
+OPENSSL_LIB="${OPENSSL_LIB:-/opt/homebrew/opt/openssl@3/lib}"
+
+for req in "$ELC" "$ELB" "$RUNTIME_DIR/el_runtime.c"; do
+    [ -e "$req" ] || { echo "run-el-test: missing required input: $req" >&2; exit 2; }
+done
+
+mkdir -p "$MODDIR" || exit 2
+
+# ── Step 1: engine modules (cached — regeneration is the slow part) ────────────
+if [ "${REBUILD:-0}" = "1" ] || [ ! -f "$MODDIR/chat.c" ] || [ "chat.el" -nt "$MODDIR/chat.c" ]; then
+    echo "run-el-test: generating engine modules into $MODDIR (this takes ~1-2 min)..."
+    # elb's own final link step fails by design here (it wants to produce a binary named
+    # `neuron` and we only need the per-module .c files it emits first). Ignore its rc.
+    "$ELB" --elc="$ELC" --runtime="$RUNTIME_DIR" --out="$MODDIR/" >"$SCRATCH/elb.log" 2>&1
+    if [ ! -f "$MODDIR/chat.c" ]; then
+        echo "run-el-test: FATAL — elb produced no chat.c; see $SCRATCH/elb.log" >&2
+        tail -5 "$SCRATCH/elb.log" >&2
+        exit 2
+    fi
+    # elb rewrites *.elh in the source tree as a side effect (cosmetic banner churn plus a
+    # stray soul..elh). Say so; the caller decides whether to `git restore` them.
+    echo "run-el-test: NOTE — elb regenerated *.elh in the source tree (cosmetic churn is expected; a stray soul..elh may appear)."
+fi
+
+# soul.c is needed for its engine functions (layered_cycle et al.) but it also owns the
+# daemon's real `main`, which would collide with the test's own. Compile it ONCE to an
+# object with `main` renamed away, and link that instead of the .c.
+SOUL_OBJ="$SCRATCH/soul-nomain.o"
+if [ "${REBUILD:-0}" = "1" ] || [ ! -f "$SOUL_OBJ" ] || [ "$MODDIR/soul.c" -nt "$SOUL_OBJ" ]; then
+    cc -std=c11 -O1 -DHAVE_CURL -Dmain=el_soul_daemon_main_unused \
+        -I "$RUNTIME_DIR" -I "$MODDIR" -I "$OPENSSL_INC" \
+        -include dist/elp-c-decls.h -Wno-error=implicit-function-declaration \
+        -c "$MODDIR/soul.c" -o "$SOUL_OBJ" 2>"$SCRATCH/soul-nomain.err" \
+        || { echo "run-el-test: FATAL — could not compile soul.c without main" >&2
+             grep -E 'error:' "$SCRATCH/soul-nomain.err" | head -5 >&2; exit 2; }
+fi
+
+# Every module except soul.c (linked as the renamed object above) and the stray soul.elh.c.
+MODS=("$SOUL_OBJ")
+for f in "$MODDIR"/*.c; do
+    case "$(basename "$f")" in
+        soul.c|soul.elh.c) continue ;;
+    esac
+    MODS+=("$f")
+done
+[ "${#MODS[@]}" -gt 1 ] || { echo "run-el-test: no module objects found" >&2; exit 2; }
+
+run_one() {
+    local test_el="$1"
+    local name; name="$(basename "$test_el" .el)"
+    local cfile="$SCRATCH/$name.c"
+    local bin="$SCRATCH/$name"
+
+    printf '\n══ %s ══\n' "$name"
+
+    if ! "$ELC" "$test_el" >"$cfile" 2>"$SCRATCH/$name.elc.err"; then
+        echo "COMPILE FAILED (elc):"; tail -10 "$SCRATCH/$name.elc.err"; return 1
+    fi
+    [ -s "$cfile" ] || { echo "COMPILE FAILED (elc produced empty C)"; return 1; }
+
+    if ! cc -std=c11 -O1 -DHAVE_CURL -rdynamic \
+        -I "$RUNTIME_DIR" -I "$MODDIR" -I "$OPENSSL_INC" -L "$OPENSSL_LIB" \
+        -include dist/elp-c-decls.h -Wno-error=implicit-function-declaration \
+        -o "$bin" "$cfile" "${MODS[@]}" "$RUNTIME_DIR/el_runtime.c" \
+        -lssl -lcrypto -lcurl -lpthread -lm 2>"$SCRATCH/$name.link.err"; then
+        echo "LINK FAILED:"; grep -E '"_|error:' "$SCRATCH/$name.link.err" | head -10; return 1
+    fi
+
+    # THE RUNNER OWNS THE VERDICT — the test files cannot be trusted to report it.
+    #
+    # Every tests/*.el assert helper does `let pass_count = pass_count + 1` INSIDE an if
+    # BLOCK. El's scope rule (the same one chat.el documents at every while-body mutation:
+    # "mutations inside if *blocks* don't escape scope") means those counters never
+    # increment, so all 9 counted test files print "N passed, M failed" as "0 passed, 0
+    # failed" — forever, whatever actually happened. A summary that can never report a
+    # failure is worth exactly as much as an assertion that can never fail. Logged as a
+    # bug for the real in-file fix; until then the verdict is computed HERE, from the
+    # assert helpers' own per-line output, which IS reliable.
+    local out="$SCRATCH/$name.out"
+    "$bin" 2>&1 | tee "$out"; local rc=${PIPESTATUS[0]}
+
+    # NOTE: `grep -c` prints 0 AND exits 1 when there are no matches, so a `|| echo 0`
+    # fallback appends a SECOND zero and every later integer test breaks on "0\n0".
+    # (Caught by running this script — which is the whole argument for running things.)
+    local n_pass n_fail
+    n_pass=$(grep -c '^  PASS: ' "$out" 2>/dev/null); n_pass=${n_pass:-0}
+    n_fail=$(grep -c '^  FAIL: ' "$out" 2>/dev/null); n_fail=${n_fail:-0}
+    echo "── $name: $n_pass passed, $n_fail failed (counted by the runner, not by the file's dead counters)"
+    if [ "$n_fail" -gt 0 ]; then
+        echo "   failing assertions:"; grep '^  FAIL: ' "$out" | sed 's/^/   /'
+        return 1
+    fi
+    if [ "$n_pass" -eq 0 ]; then
+        echo "   WARNING: no assertions ran — treating as FAILURE (a test that asserts nothing is not a passing test)"
+        return 1
+    fi
+    [ $rc -eq 0 ] || { echo "   (test binary exited rc=$rc)"; return 1; }
+    return 0
+}
+
+rc_all=0
+if [ "${1:-}" = "--all" ]; then
+    for t in tests/test_*.el; do run_one "$t" || rc_all=1; done
+else
+    [ $# -ge 1 ] || { echo "usage: tests/run-el-test.sh <tests/test_x.el> | --all" >&2; exit 2; }
+    for t in "$@"; do run_one "$t" || rc_all=1; done
+fi
+exit $rc_all

tests/test_agentic_tools.el

@@ -0,0 +1,176 @@
+// tests/test_agentic_tools.el
+// Tests for the agentic tools wiring (PR #19: fix/agentic-tools-all).
+//
+// Covers:
+//   1. agentic_tools_all() includes all literal tool names
+//   2. agentic_tools_all() includes the native web_search tool
+//   3. connector_tools_json() returns valid JSON ([] or array) even when bridge is down
+//   4. agentic_tools_all() output stays valid JSON when connector bridge is down
+//   5. tool_pending envelope detection — the pattern used in handle_dharma_room_turn_agentic
+//      to distinguish a suspended agentic loop from a normal reply
+//   6. Empty-reply guard — json_get("reply") returns "" on a tool_pending envelope,
+//      confirming that the guard is necessary to avoid silent empty responses
+//
+// Tests 5 and 6 validate the El-level logic that guards handle_dharma_room_turn_agentic
+// against silent failures after the refactor to use agentic_loop.
+//
+// Tests 1-4 are pure: no network, no LLM, no engram.
+// Tests 5-6 are pure string/JSON operations on synthesized envelopes.
+//
+// Integration tests (LLM-live) are documented as SKIP stubs because they
+// require a valid ANTHROPIC_API_KEY and a running soul + neuron-connectd.
+
+import "../chat.el"
+
+let pass_count: Int = 0
+let fail_count: Int = 0
+
+fn assert_eq(label: String, got: String, expected: String) -> Void {
+    if str_eq(got, expected) {
+        let pass_count = pass_count + 1
+        println("  PASS: " + label)
+    } else {
+        let fail_count = fail_count + 1
+        println("  FAIL: " + label)
+        println("    got:      " + got)
+        println("    expected: " + expected)
+    }
+}
+
+fn assert_true(label: String, cond: Bool) -> Void {
+    if cond {
+        let pass_count = pass_count + 1
+        println("  PASS: " + label)
+    } else {
+        let fail_count = fail_count + 1
+        println("  FAIL: " + label)
+    }
+}
+
+fn assert_contains(label: String, haystack: String, needle: String) -> Void {
+    if str_contains(haystack, needle) {
+        let pass_count = pass_count + 1
+        println("  PASS: " + label)
+    } else {
+        let fail_count = fail_count + 1
+        println("  FAIL: " + label)
+        println("    missing '" + needle + "' in: " + haystack)
+    }
+}
+
+fn assert_not_empty(label: String, s: String) -> Void {
+    if str_len(s) > 0 {
+        let pass_count = pass_count + 1
+        println("  PASS: " + label)
+    } else {
+        let fail_count = fail_count + 1
+        println("  FAIL: " + label)
+        println("    got empty string")
+    }
+}
+
+// ── Section 1: agentic_tools_all contains all literal tool names ──────────────
+
+println("")
+println("1. agentic_tools_all() — contains all literal tool names")
+
+let all_tools: String = agentic_tools_all()
+assert_contains("contains read_file", all_tools, "\"name\":\"read_file\"")
+assert_contains("contains write_file", all_tools, "\"name\":\"write_file\"")
+assert_contains("contains web_get", all_tools, "\"name\":\"web_get\"")
+assert_contains("contains search_memory", all_tools, "\"name\":\"search_memory\"")
+assert_contains("contains run_command", all_tools, "\"name\":\"run_command\"")
+
+// ── Section 2: agentic_tools_all includes native web_search ──────────────────
+
+println("")
+println("2. agentic_tools_all() — includes native web_search_20250305 tool")
+
+assert_contains("contains web_search type", all_tools, "web_search_20250305")
+assert_contains("contains web_search name", all_tools, "\"name\":\"web_search\"")
+
+// ── Section 3: connector_tools_json returns valid JSON when bridge is down ────
+
+println("")
+println("3. connector_tools_json() — returns [] when neuron-connectd is not running")
+
+// connector_tools_json() calls the bridge; in a unit-test environment it is
+// expected to return "[]" (graceful degradation). If the bridge IS running,
+// it returns a non-empty array — both are valid.
+let conn_tools: String = connector_tools_json()
+let starts_bracket: Bool = str_starts_with(conn_tools, "[")
+assert_true("connector_tools_json starts with [", starts_bracket)
+assert_not_empty("connector_tools_json is non-empty string", conn_tools)
+
+// ── Section 4: agentic_tools_all output is valid JSON array ──────────────────
+
+println("")
+println("4. agentic_tools_all() — output is a JSON array")
+
+assert_true("starts with [", str_starts_with(all_tools, "["))
+// A JSON array ends with ]
+let last_char: String = str_slice(all_tools, str_len(all_tools) - 1, str_len(all_tools))
+assert_eq("ends with ]", last_char, "]")
+
+// ── Section 5: tool_pending envelope detection ────────────────────────────────
+//
+// This validates the detection logic added to handle_dharma_room_turn_agentic:
+//
+//   let is_pending: Bool = str_eq(json_get(loop_result, "tool_pending"), "true")
+//       || str_starts_with(loop_result, "{\"tool_pending\":true")
+//
+// When agentic_loop suspends for an MCP bridge tool it returns:
+//   {"tool_pending":true,"session_id":"...","call_id":"...","tool_name":"...","tool_input":{...},...}
+//
+// json_get() on a Bool field may return "true" (string) or "" depending on El runtime.
+// The str_starts_with fallback guards against either representation.
+
+println("")
+println("5. tool_pending envelope detection patterns")
+
+let pending_envelope: String = "{\"tool_pending\":true,\"session_id\":\"dharma:br-1234-1\",\"call_id\":\"toolu_01\",\"tool_name\":\"mcp__filesystem__read\",\"tool_input\":{\"path\":\"/tmp/x\"},\"model\":\"claude-sonnet-4-5\",\"agentic\":true,\"tools_used\":[]}"
+let normal_envelope: String = "{\"reply\":\"Hello from the soul.\",\"model\":\"claude-sonnet-4-5\",\"agentic\":true,\"tools_used\":[]}"
+let error_envelope: String = "{\"error\":\"llm unavailable\",\"reply\":\"\"}"
+
+// str_starts_with fallback — always works regardless of how json_get handles bool
+assert_true("pending envelope: str_starts_with detects tool_pending=true", str_starts_with(pending_envelope, "{\"tool_pending\":true"))
+assert_true("normal reply: str_starts_with does not detect tool_pending", !str_starts_with(normal_envelope, "{\"tool_pending\":true"))
+assert_true("error envelope: str_starts_with does not detect tool_pending", !str_starts_with(error_envelope, "{\"tool_pending\":true"))
+
+// ── Section 6: empty-reply guard necessity ────────────────────────────────────
+//
+// Confirms that json_get(pending_envelope, "reply") returns "" — proving the
+// empty-reply guard is necessary to avoid a silent success with empty response.
+// Without the guard, the old code would return {"response":"","cgi_id":"..."} which
+// is indistinguishable from a successful LLM response.
+
+println("")
+println("6. empty-reply guard — json_get(pending, \"reply\") is empty")
+
+let pending_reply: String = json_get(pending_envelope, "reply")
+assert_eq("json_get reply on pending envelope is empty", pending_reply, "")
+
+let normal_reply: String = json_get(normal_envelope, "reply")
+assert_not_empty("json_get reply on normal envelope is non-empty", normal_reply)
+
+// Also confirm error key absent from normal reply and pending envelopes
+let pending_error: String = json_get(pending_envelope, "error")
+assert_eq("pending envelope has no error key", pending_error, "")
+
+let normal_error: String = json_get(normal_envelope, "error")
+assert_eq("normal envelope has no error key", normal_error, "")
+
+// ── SKIP stubs: integration tests requiring live LLM ─────────────────────────
+
+println("")
+println("SKIP: handle_dharma_room_turn_agentic happy-path (requires ANTHROPIC_API_KEY + soul)")
+println("      Expected: non-empty response field and status ok")
+println("SKIP: handle_dharma_room_turn_agentic tool_pending propagation (requires API + MCP bridge)")
+println("      Expected: tool_pending in response when loop suspends for mcp__* tool")
+println("SKIP: handle_chat_agentic connector tools end-to-end (requires API + neuron-connectd)")
+println("      Expected: mcp__* tool names appear in tools_used when connectd is running")
+
+// ── Summary ───────────────────────────────────────────────────────────────────
+
+println("")
+println("agentic tools tests: " + int_to_str(pass_count) + " passed, " + int_to_str(fail_count) + " failed")

tests/test_api_define_process.el

@@ -0,0 +1,109 @@
+// ── tests/test_api_define_process.el ─────────────────────────────────────────
+//
+// Test the handle_api_define_process read-back fix (neuron-api.el).
+//
+// Bug: handle_api_define_process was the only write handler that did NOT call
+// api_persisted() after the write, returning {"id":"...","ok":true} even when
+// the engram write failed (hallucinated save).
+//
+// Fix: added `if !api_persisted(id) { return api_not_persisted(id) }` before
+// the return, consistent with all sibling handlers (remember, capture_knowledge,
+// evolve_knowledge, promote_knowledge, node_create).
+//
+// Tests:
+//   1. define_process returns ok==true and id resolves via engram_get_node_json.
+//   2. Missing content returns the standard error.
+//   3. Unnamed process uses default label and still persists.
+// ──────────────────────────────────────────────────────────────────────────────
+
+import "../neuron-api.el"
+
+let pass_count: Int = 0
+let fail_count: Int = 0
+
+fn assert_eq(label: String, got: String, expected: String) -> Void {
+    if str_eq(got, expected) {
+        let pass_count = pass_count + 1
+        println("  PASS: " + label)
+    } else {
+        let fail_count = fail_count + 1
+        println("  FAIL: " + label)
+        println("    got:      " + got)
+        println("    expected: " + expected)
+    }
+}
+
+fn assert_not_eq(label: String, got: String, not_want: String) -> Void {
+    if str_eq(got, not_want) {
+        let fail_count = fail_count + 1
+        println("  FAIL: " + label + " (got: " + got + ", should differ)")
+    } else {
+        let pass_count = pass_count + 1
+        println("  PASS: " + label)
+    }
+}
+
+fn assert_contains(label: String, haystack: String, needle: String) -> Void {
+    if str_contains(haystack, needle) {
+        let pass_count = pass_count + 1
+        println("  PASS: " + label)
+    } else {
+        let fail_count = fail_count + 1
+        println("  FAIL: " + label)
+        println("    missing '" + needle + "' in: " + haystack)
+    }
+}
+
+// ── Section 1: define_process — happy path with read-back ────────────────────
+
+println("")
+println("1. handle_api_define_process — write then verify id resolves")
+
+let proc_body: String = "{\"content\":\"Test process: run step A, then step B, then step C.\",\"name\":\"test-process-guard\"}"
+let proc_result: String = handle_api_define_process(proc_body)
+
+let proc_ok: String = json_get(proc_result, "ok")
+let proc_id: String = json_get(proc_result, "id")
+
+assert_eq("define_process -> ok==true", proc_ok, "true")
+assert_not_eq("define_process -> id is non-empty", proc_id, "")
+
+let node_json: String = engram_get_node_json(proc_id)
+let node_status: String = if str_eq(node_json, "") { "empty" } else {
+    if str_eq(node_json, "null") { "null" } else { "ok" }
+}
+assert_eq("define_process -> node read-back resolves (not empty/null)", node_status, "ok")
+assert_contains("define_process -> node content contains process text", node_json, "Test process")
+
+// ── Section 2: define_process — missing content returns error ────────────────
+
+println("")
+println("2. handle_api_define_process — missing content returns error")
+
+let no_content_body: String = "{\"name\":\"nameless\"}"
+let no_content_result: String = handle_api_define_process(no_content_body)
+let no_content_error: String = json_get(no_content_result, "error")
+assert_eq("missing content -> error is 'content is required'", no_content_error, "content is required")
+
+// ── Section 3: define_process — unnamed process gets default label ────────────
+
+println("")
+println("3. handle_api_define_process — unnamed process writes and read-back succeeds")
+
+let unnamed_body: String = "{\"content\":\"Unnamed test process for coverage.\"}"
+let unnamed_result: String = handle_api_define_process(unnamed_body)
+let unnamed_ok: String = json_get(unnamed_result, "ok")
+let unnamed_id: String = json_get(unnamed_result, "id")
+assert_eq("unnamed process -> ok==true", unnamed_ok, "true")
+assert_not_eq("unnamed process -> id non-empty", unnamed_id, "")
+
+let unnamed_node: String = engram_get_node_json(unnamed_id)
+let unnamed_status: String = if str_eq(unnamed_node, "") { "empty" } else {
+    if str_eq(unnamed_node, "null") { "null" } else { "ok" }
+}
+assert_eq("unnamed process -> node read-back ok", unnamed_status, "ok")
+
+// ── Summary ───────────────────────────────────────────────────────────────────
+
+println("")
+println("api_define_process tests: " + int_to_str(pass_count) + " passed, " + int_to_str(fail_count) + " failed")

tests/test_bell_safety.el

@@ -0,0 +1,305 @@
+// ── tests/test_bell_safety.el ─────────────────────────────────────────────────
+//
+// Unit tests for the Hard Bell safety layer added in feat/connectors-soul.
+// Covers the public API exposed by safety.el:
+//   - safety_detect_bell_level:  'none' / 'soft' / 'hard'
+//   - safety_classify_hard_bell: 'self_harm' / 'abuse'
+//   - safety_normalize:          smart-quote -> ASCII apostrophe normalisation
+//   - safety_augment_system:     system prompt passthrough / augmentation
+//   - handle_safety_contact_post: validation + read-back
+//
+// El test convention: mutable pass_count / fail_count globals, assert_* helpers,
+// println for each result.  Mirrors the style in existing safety tests.
+// ──────────────────────────────────────────────────────────────────────────────
+
+import "../safety.el"
+
+let pass_count: Int = 0
+let fail_count: Int = 0
+
+fn assert_eq(label: String, got: String, expected: String) -> Void {
+    if str_eq(got, expected) {
+        let pass_count = pass_count + 1
+        println("  PASS: " + label)
+    } else {
+        let fail_count = fail_count + 1
+        println("  FAIL: " + label)
+        println("    got:      " + got)
+        println("    expected: " + expected)
+    }
+}
+
+fn assert_contains(label: String, haystack: String, needle: String) -> Void {
+    if str_contains(haystack, needle) {
+        let pass_count = pass_count + 1
+        println("  PASS: " + label)
+    } else {
+        let fail_count = fail_count + 1
+        println("  FAIL: " + label)
+        println("    missing '" + needle + "' in: " + haystack)
+    }
+}
+
+fn assert_not_contains(label: String, haystack: String, needle: String) -> Void {
+    if str_contains(haystack, needle) {
+        let fail_count = fail_count + 1
+        println("  FAIL: " + label)
+        println("    unexpected '" + needle + "' found in: " + haystack)
+    } else {
+        let pass_count = pass_count + 1
+        println("  PASS: " + label)
+    }
+}
+
+// ── Section 1: safety_detect_bell_level — 'none' ─────────────────────────────
+
+println("")
+println("1. safety_detect_bell_level — neutral input -> 'none'")
+
+let level_neutral: String = safety_detect_bell_level("What time is the meeting tomorrow?")
+assert_eq("neutral question -> none", level_neutral, "none")
+
+let level_positive: String = safety_detect_bell_level("I love sunny days")
+assert_eq("positive statement -> none", level_positive, "none")
+
+let level_empty: String = safety_detect_bell_level("")
+assert_eq("empty string -> none", level_empty, "none")
+
+// ── Section 2: safety_detect_bell_level — single soft phrase stays 'none' ────
+
+println("")
+println("2. safety_detect_bell_level — single soft phrase does not reach 'soft' (threshold=2)")
+
+let level_one_soft: String = safety_detect_bell_level("I have been feeling stressed lately")
+assert_eq("single soft phrase alone -> none", level_one_soft, "none")
+
+// ── Section 3: safety_detect_bell_level — 'soft' with two+ soft phrases ──────
+
+println("")
+println("3. safety_detect_bell_level — two soft phrases -> 'soft'")
+
+let level_two_soft: String = safety_detect_bell_level("I am feeling overwhelmed and really anxious about everything")
+assert_eq("two soft phrases -> soft", level_two_soft, "soft")
+
+let level_multi_soft: String = safety_detect_bell_level("So depressed and hopeless, nothing matters anymore")
+assert_eq("multiple soft phrases -> soft", level_multi_soft, "soft")
+
+// ── Section 4: safety_detect_bell_level — 'hard' (self_harm phrases) ─────────
+
+println("")
+println("4. safety_detect_bell_level — self_harm phrases -> 'hard'")
+
+let level_kill_myself: String = safety_detect_bell_level("I want to kill myself")
+assert_eq("'kill myself' -> hard", level_kill_myself, "hard")
+
+let level_suicide: String = safety_detect_bell_level("I have been suicidal for weeks")
+assert_eq("'suicidal' -> hard", level_suicide, "hard")
+
+let level_want_die: String = safety_detect_bell_level("I want to die, nothing is worth it")
+assert_eq("'want to die' -> hard", level_want_die, "hard")
+
+let level_overdose: String = safety_detect_bell_level("I am thinking about an overdose")
+assert_eq("'overdose' -> hard", level_overdose, "hard")
+
+let level_self_harm: String = safety_detect_bell_level("My history of self-harm is back")
+assert_eq("'self-harm' -> hard", level_self_harm, "hard")
+
+let level_no_reason: String = safety_detect_bell_level("There is no reason to live")
+assert_eq("'no reason to live' -> hard", level_no_reason, "hard")
+
+// ── Section 5: safety_detect_bell_level — 'hard' (abuse phrases) ─────────────
+
+println("")
+println("5. safety_detect_bell_level — abuse phrases -> 'hard'")
+
+let level_he_hit: String = safety_detect_bell_level("he hit me last night")
+assert_eq("'he hit me' -> hard", level_he_hit, "hard")
+
+let level_dv: String = safety_detect_bell_level("I am experiencing domestic violence")
+assert_eq("'domestic violence' -> hard", level_dv, "hard")
+
+let level_abused: String = safety_detect_bell_level("I am being abused")
+assert_eq("'being abused' -> hard", level_abused, "hard")
+
+// ── Section 6: safety_detect_bell_level — 'hard' (general hard phrases) ──────
+
+println("")
+println("6. safety_detect_bell_level — general hard phrases -> 'hard'")
+
+let level_hurting_me: String = safety_detect_bell_level("someone is hurting me right now")
+assert_eq("'hurting me' -> hard", level_hurting_me, "hard")
+
+let level_being_hurt: String = safety_detect_bell_level("I am being hurt and need help")
+assert_eq("'being hurt' -> hard", level_being_hurt, "hard")
+
+// ── Section 7: safety_classify_hard_bell — abuse -> 'abuse' ──────────────────
+
+println("")
+println("7. safety_classify_hard_bell — abuse phrases route to 'abuse'")
+
+let class_he_hit: String = safety_classify_hard_bell("he hit me yesterday")
+assert_eq("'he hit me' classifies as abuse", class_he_hit, "abuse")
+
+let class_dv: String = safety_classify_hard_bell("domestic violence in my home")
+assert_eq("'domestic violence' classifies as abuse", class_dv, "abuse")
+
+let class_abused: String = safety_classify_hard_bell("I'm being abused by my partner")
+assert_eq("'being abused' classifies as abuse", class_abused, "abuse")
+
+// ── Section 8: safety_classify_hard_bell — self_harm phrases ─────────────────
+
+println("")
+println("8. safety_classify_hard_bell — self_harm phrases route to 'self_harm'")
+
+let class_kill: String = safety_classify_hard_bell("I want to kill myself")
+assert_eq("'kill myself' classifies as self_harm", class_kill, "self_harm")
+
+let class_suicide: String = safety_classify_hard_bell("I am suicidal")
+assert_eq("'suicidal' classifies as self_harm", class_suicide, "self_harm")
+
+let class_overdose: String = safety_classify_hard_bell("took too many pills")
+assert_eq("'took too many' classifies as self_harm", class_overdose, "self_harm")
+
+// ── Section 9: safety_classify_hard_bell — Track B threat-to-others ──────────
+//
+// LIVE SAFETY FIX (approved by Will + Tim, 2026-07-14): a threat toward ANOTHER
+// person ("going to kill/hurt <someone>") must classify as 'threat_other' and be
+// routed to a refusal + 911 — NOT to the 'self_harm'/988 path. This section used
+// to assert the old (buggy) fall-through to 'self_harm'; it now pins the fix.
+
+println("")
+println("9. safety_classify_hard_bell — threat-to-others routes to 'threat_other' (not self_harm)")
+
+let class_going_kill: String = safety_classify_hard_bell("I am going to kill him tonight")
+assert_eq("'going to kill him' classifies as threat_other", class_going_kill, "threat_other")
+
+let class_going_hurt: String = safety_classify_hard_bell("I'm going to hurt them so badly")
+assert_eq("'going to hurt them' classifies as threat_other", class_going_hurt, "threat_other")
+
+let class_shoot: String = safety_classify_hard_bell("I'm going to shoot up the place")
+assert_eq("'going to shoot' classifies as threat_other", class_shoot, "threat_other")
+
+// Track A must still win over Track B on victim / self-directed phrasings:
+let class_kill_me: String = safety_classify_hard_bell("he is going to kill me")
+assert_eq("'going to kill me' stays abuse (Track A precedence)", class_kill_me, "abuse")
+
+let class_kill_self: String = safety_classify_hard_bell("I am going to kill myself")
+assert_eq("'kill myself' stays self_harm (Track A precedence)", class_kill_self, "self_harm")
+
+// ── Section 10: safety_normalize — curly apostrophe normalisation ─────────────
+
+println("")
+println("10. safety_normalize — curly apostrophe normalisation")
+
+// U+2019 RIGHT SINGLE QUOTATION MARK (UTF-8: \xe2\x80\x99) must become ASCII '
+let smart_msg: String = "I can" + "\xe2\x80\x99" + "t go on anymore"
+let normalized: String = safety_normalize(smart_msg)
+assert_contains("smart-quote normalized to ASCII apostrophe", normalized, "can't go on")
+
+// After normalisation, detect_bell_level must fire 'hard' on the smart-quote variant
+let level_smart: String = safety_detect_bell_level(smart_msg)
+assert_eq("smart-quote 'can't go on' -> hard (after normalize)", level_smart, "hard")
+
+// ── Section 11: safety_augment_system — passthrough on neutral ───────────────
+
+println("")
+println("11. safety_augment_system — neutral input returns system unchanged")
+
+let base_sys: String = "You are a helpful assistant."
+let aug_neutral: String = safety_augment_system(base_sys, "What is the weather?")
+assert_eq("neutral message -> system unchanged", aug_neutral, base_sys)
+
+// ── Section 12: safety_augment_system — soft bell injects directive ──────────
+
+println("")
+println("12. safety_augment_system — soft bell injects soft directive")
+
+let aug_soft: String = safety_augment_system(base_sys, "Feeling so overwhelmed and completely anxious")
+assert_contains("soft augment -> contains original system", aug_soft, base_sys)
+assert_contains("soft augment -> contains SUBSTRATE DIRECTIVE", aug_soft, "SUBSTRATE DIRECTIVE")
+assert_contains("soft augment -> contains soft care text", aug_soft, "genuine care")
+
+// ── Section 13: safety_augment_system — hard self_harm injects 988 ───────────
+
+println("")
+println("13. safety_augment_system — hard self_harm injects crisis resources with 988")
+
+let aug_hard: String = safety_augment_system(base_sys, "I want to kill myself tonight")
+assert_contains("hard self_harm -> contains SUBSTRATE DIRECTIVE", aug_hard, "SUBSTRATE DIRECTIVE")
+assert_contains("hard self_harm -> includes 988 crisis line", aug_hard, "988")
+assert_not_contains("hard self_harm -> no DV hotline (wrong routing)", aug_hard, "1-800-799-7233")
+
+// ── Section 14: safety_augment_system — hard abuse routes to abuse directive ──
+
+println("")
+println("14. safety_augment_system — hard abuse injects abuse-specific directive")
+
+let aug_abuse: String = safety_augment_system(base_sys, "he hit me and I am afraid of him")
+assert_contains("hard abuse -> DV hotline present", aug_abuse, "1-800-799-7233")
+assert_contains("hard abuse -> mentions not notifying contact", aug_abuse, "safety contact")
+
+// ── Section 14b: safety_augment_system — Track B threat-to-others routing ─────
+//
+// LIVE SAFETY FIX (approved by Will + Tim, 2026-07-14): a homicide/assault threat
+// must be routed to a refusal + 911, and must NOT surface the 988 suicide line
+// or pull in the safety contact.
+
+println("")
+println("14b. safety_augment_system — threat-to-others injects refusal + 911, never 988/contact")
+
+let aug_threat: String = safety_augment_system(base_sys, "I am going to kill him tonight")
+assert_contains("threat_other -> contains SUBSTRATE DIRECTIVE", aug_threat, "SUBSTRATE DIRECTIVE")
+assert_contains("threat_other -> directs to 911", aug_threat, "911")
+assert_contains("threat_other -> refuses to help harm another", aug_threat, "harming another person")
+assert_not_contains("threat_other -> NO 988 suicide line", aug_threat, "988")
+assert_not_contains("threat_other -> NO safety-contact involvement", aug_threat, "safety contact")
+assert_not_contains("threat_other -> NO 'are you safe right now' victim frame", aug_threat, "are you safe right now")
+
+// Detection must still fire hard on a weapon phrase not present in general_hard:
+let level_shoot: String = safety_detect_bell_level("I'm going to shoot up the office")
+assert_eq("'going to shoot' -> hard", level_shoot, "hard")
+
+// ── Section 15: handle_safety_contact_post — validation ───────────────────────
+
+println("")
+println("15. handle_safety_contact_post — non-crisis without name returns error")
+
+let no_name_body: String = "{\"is_crisis_line\":false,\"contact_method\":\"phone\",\"contact_value\":\"555-1234\",\"relationship\":\"friend\"}"
+let no_name_result: String = handle_safety_contact_post(no_name_body)
+let no_name_ok: String = json_get(no_name_result, "ok")
+let no_name_err: String = json_get(no_name_result, "error")
+assert_eq("no name -> ok==false", no_name_ok, "false")
+assert_eq("no name -> error is 'name is required'", no_name_err, "name is required")
+
+// ── Section 16: handle_safety_contact_post — write then read back ──────────────
+
+println("")
+println("16. handle_safety_contact_post — write then read back verifies persistence")
+
+let contact_body: String = "{\"is_crisis_line\":false,\"name\":\"Test Contact\",\"contact_method\":\"phone\",\"contact_value\":\"555-9876\",\"relationship\":\"sibling\"}"
+let write_result: String = handle_safety_contact_post(contact_body)
+let write_ok: String = json_get(write_result, "ok")
+assert_eq("contact write -> ok==true", write_ok, "true")
+assert_contains("contact write -> result has configured", write_result, "\"configured\"")
+assert_contains("contact write -> result has name", write_result, "Test Contact")
+
+let read_result: String = handle_safety_contact_get()
+assert_eq("contact read-back -> configured==true", json_get(read_result, "configured"), "true")
+assert_contains("contact read-back -> name matches", read_result, "Test Contact")
+
+// ── Section 17: handle_safety_contact_post — crisis line auto-fills ───────────
+
+println("")
+println("17. handle_safety_contact_post — crisis line auto-fills name and value")
+
+let crisis_body: String = "{\"is_crisis_line\":true}"
+let crisis_result: String = handle_safety_contact_post(crisis_body)
+let crisis_ok: String = json_get(crisis_result, "ok")
+assert_eq("crisis line write -> ok==true", crisis_ok, "true")
+assert_contains("crisis line -> name is Crisis Line", crisis_result, "Crisis Line")
+assert_contains("crisis line -> value is 988", crisis_result, "988")
+
+// ── Summary ───────────────────────────────────────────────────────────────────
+
+println("")
+println("bell_safety tests: " + int_to_str(pass_count) + " passed, " + int_to_str(fail_count) + " failed")

tests/test_bridge_serialization.el

@@ -0,0 +1,362 @@
+// ── test_bridge_serialization.el ──────────────────────────────────────────────
+//
+// Tests for PR #20 fix/bridge-save-serialization:
+//   - bridge_save raw JSON serialization (BLOCKER 1 & 2 regression guards)
+//   - agentic_resume error-path handling
+//   - Legacy fallback: old string-escaped fields still readable
+//   - Corrupt/missing bridge state error envelope
+//   - Empty messages/tools_json guard in bridge_save
+//
+// What CANNOT be tested here without a live Anthropic API:
+//   - agentic_resume golden-path (calls agentic_loop which hits the API)
+//   - Full save/resume round-trip with a real tool_result
+//
+// To run:
+//   elc chat.el && ./soul --test tests/test_bridge_serialization.el
+//
+// ──────────────────────────────────────────────────────────────────────────────
+
+import "../chat.el"
+
+// ── Test harness ──────────────────────────────────────────────────────────────
+
+let pass_count: Int = 0
+let fail_count: Int = 0
+
+fn assert_eq(label: String, got: String, expected: String) -> Void {
+    if str_eq(got, expected) {
+        let pass_count = pass_count + 1
+        println("  PASS: " + label)
+    } else {
+        let fail_count = fail_count + 1
+        println("  FAIL: " + label)
+        println("    got:      " + got)
+        println("    expected: " + expected)
+    }
+}
+
+fn assert_true(label: String, cond: Bool) -> Void {
+    if cond {
+        let pass_count = pass_count + 1
+        println("  PASS: " + label)
+    } else {
+        let fail_count = fail_count + 1
+        println("  FAIL: " + label)
+    }
+}
+
+fn assert_false(label: String, cond: Bool) -> Void {
+    assert_true(label, !cond)
+}
+
+fn assert_contains(label: String, haystack: String, needle: String) -> Void {
+    if str_contains(haystack, needle) {
+        let pass_count = pass_count + 1
+        println("  PASS: " + label)
+    } else {
+        let fail_count = fail_count + 1
+        println("  FAIL: " + label)
+        println("    missing '" + needle + "' in: " + haystack)
+    }
+}
+
+fn assert_not_contains(label: String, haystack: String, needle: String) -> Void {
+    if str_contains(haystack, needle) {
+        let fail_count = fail_count + 1
+        println("  FAIL: " + label)
+        println("    unexpected '" + needle + "' found in: " + haystack)
+    } else {
+        let pass_count = pass_count + 1
+        println("  PASS: " + label)
+    }
+}
+
+fn assert_not_empty(label: String, s: String) -> Void {
+    if str_eq(s, "") {
+        let fail_count = fail_count + 1
+        println("  FAIL: " + label + " (got empty string)")
+    } else {
+        let pass_count = pass_count + 1
+        println("  PASS: " + label)
+    }
+}
+
+// ── Section 1: bridge_save — empty messages guard ─────────────────────────────
+//
+// BLOCKER 2 regression guard: bridge_save must refuse to write a blob when
+// messages or tools_json is empty, as the resulting JSON would be syntactically
+// invalid (bare colon with no value).
+
+println("")
+println("1. bridge_save — empty messages guard")
+
+let sid1: String = "test-session-empty-messages"
+state_set("mcp_bridge:" + sid1, "")
+
+let save1_ok: Bool = bridge_save(sid1, "claude-sonnet-4-5", "sys", "[]", "", "", "call-1", "anthropic")
+assert_false("empty messages -> bridge_save returns false", save1_ok)
+
+let saved1: String = state_get("mcp_bridge:" + sid1)
+assert_eq("empty messages -> no blob written to state", saved1, "")
+
+// ── Section 2: bridge_save — empty tools_json guard ───────────────────────────
+
+println("")
+println("2. bridge_save — empty tools_json guard")
+
+let sid2: String = "test-session-empty-tools"
+state_set("mcp_bridge:" + sid2, "")
+
+let save2_ok: Bool = bridge_save(sid2, "claude-sonnet-4-5", "sys", "", "[{\"role\":\"user\",\"content\":\"hi\"}]", "", "call-2", "anthropic")
+assert_false("empty tools_json -> bridge_save returns false", save2_ok)
+
+let saved2: String = state_get("mcp_bridge:" + sid2)
+assert_eq("empty tools_json -> no blob written to state", saved2, "")
+
+// ── Section 3: bridge_save — golden path writes raw JSON fields ───────────────
+//
+// Verifies that messages_raw and tools_raw are stored as inline JSON (not
+// string-escaped) so that json_get_raw retrieves them without corruption.
+
+println("")
+println("3. bridge_save — golden path writes messages_raw and tools_raw as raw JSON")
+
+let sid3: String = "test-session-golden"
+state_set("mcp_bridge:" + sid3, "")
+
+let msgs3: String = "[{\"role\":\"user\",\"content\":\"hello\"}]"
+let tools3: String = "[{\"name\":\"read_file\"}]"
+let save3_ok: Bool = bridge_save(sid3, "claude-sonnet-4-5", "You are a helper.", tools3, msgs3, "read_file", "toolu_abc", "anthropic")
+assert_true("valid args -> bridge_save returns true", save3_ok)
+
+let blob3: String = state_get("mcp_bridge:" + sid3)
+assert_not_empty("valid args -> blob written to state", blob3)
+
+// messages_raw should be stored as a raw JSON array (not a quoted string)
+// so json_get_raw on the blob returns the array directly
+let raw_msgs3: String = json_get_raw(blob3, "messages_raw")
+assert_contains("messages_raw field present in blob", blob3, "messages_raw")
+assert_eq("messages_raw round-trips without corruption", raw_msgs3, msgs3)
+
+let raw_tools3: String = json_get_raw(blob3, "tools_raw")
+assert_eq("tools_raw round-trips without corruption", raw_tools3, tools3)
+
+// Scalar fields should still be present as normal string-escaped JSON fields
+let model3: String = json_get(blob3, "model")
+assert_eq("model field preserved in blob", model3, "claude-sonnet-4-5")
+
+let tool_use_id3: String = json_get(blob3, "tool_use_id")
+assert_eq("tool_use_id field preserved in blob", tool_use_id3, "toolu_abc")
+
+// Verify the blob does NOT contain old-style double-escaped fields
+assert_not_contains("no legacy 'messages' string field in new-format blob", blob3, "\"messages\":\"")
+assert_not_contains("no legacy 'tools_json' string field in new-format blob", blob3, "\"tools_json\":\"")
+
+// ── Section 4: agentic_resume — unknown session_id returns error envelope ──────
+
+println("")
+println("4. agentic_resume — unknown session_id (empty state)")
+
+let sid4: String = "test-session-unknown-xyzzy"
+state_set("mcp_bridge:" + sid4, "")
+
+let resume4: String = agentic_resume(sid4, "toolu_xyz", "some result")
+assert_contains("unknown session_id -> error field present", resume4, "\"error\"")
+assert_contains("unknown session_id -> reply field present", resume4, "\"reply\"")
+assert_contains("unknown session_id -> 'unknown session_id' message", resume4, "unknown session_id")
+let reply4: String = json_get(resume4, "reply")
+assert_eq("unknown session_id -> reply is empty string", reply4, "")
+
+// ── Section 5: agentic_resume — syntactically invalid JSON in state ───────────
+
+println("")
+println("5. agentic_resume — syntactically invalid JSON blob in state")
+
+let sid5: String = "test-session-corrupt-json"
+// Write a non-JSON value that state_get would return as-is
+state_set("mcp_bridge:" + sid5, "NOT_JSON_AT_ALL")
+
+let resume5: String = agentic_resume(sid5, "toolu_xyz", "some result")
+// The function may take multiple paths here; in all cases it must not crash and
+// must return a JSON envelope with at least an error or empty reply field.
+// When json_get_raw returns "" on unparseable input, the guard catches it.
+assert_contains("corrupt JSON blob -> resume returns JSON", resume5, "\"reply\"")
+
+// ── Section 6: agentic_resume — blob with no messages produces error envelope ─
+
+println("")
+println("6. agentic_resume — blob missing messages_raw and messages fields")
+
+let sid6: String = "test-session-no-messages"
+// Blob with only model/safe_sys — no messages or tools
+state_set("mcp_bridge:" + sid6, "{\"model\":\"claude-sonnet-4-5\",\"safe_sys\":\"sys\",\"tool_use_id\":\"toolu_abc\"}")
+
+let resume6: String = agentic_resume(sid6, "toolu_abc", "result")
+assert_contains("missing messages -> error field present", resume6, "\"error\"")
+assert_contains("missing messages -> error mentions corrupt state", resume6, "corrupt bridge state")
+let reply6: String = json_get(resume6, "reply")
+assert_eq("missing messages -> reply is empty string", reply6, "")
+
+// ── Section 7: Legacy fallback — old-format blob (string-escaped fields) ──────
+//
+// BLOCKER 1 regression guard: sessions saved before the fix used 'messages'
+// and 'tools_json' as string-escaped fields. The fallback path in agentic_resume
+// must read them correctly. We verify the fallback resolves the correct values
+// before the function reaches the api call (which we cannot make in tests).
+//
+// We test the fallback by writing a legacy blob and verifying that
+// agentic_resume does NOT return the "corrupt bridge state" error
+// (which would mean the fallback is broken), instead it gets past the guard
+// and then fails on the API call (outside our test scope).
+//
+// NOTE: We cannot confirm a successful API-dependent round-trip in this test;
+// the goal is only to confirm the state-reading fallback path resolves values.
+
+println("")
+println("7. Legacy fallback — old-format blob with string-escaped 'messages' field")
+
+let sid7: String = "test-session-legacy-format"
+// Simulate an old-format blob: messages and tools_json as json_safe-escaped strings.
+// json_safe escapes " to \" so the stored value is a JSON string containing the array.
+let legacy_msgs: String = "[{\"role\":\"user\",\"content\":\"legacy hello\"}]"
+let legacy_tools: String = "[{\"name\":\"read_file\"}]"
+// Build the blob the OLD way: string-escaped
+let safe_msgs: String = json_safe(legacy_msgs)
+let safe_tools: String = json_safe(legacy_tools)
+let legacy_blob: String = "{\"model\":\"claude-sonnet-4-5\",\"safe_sys\":\"sys\",\"messages\":\"" + safe_msgs + "\",\"tools_json\":\"" + safe_tools + "\",\"tool_use_id\":\"toolu_legacy\"}"
+state_set("mcp_bridge:" + sid7, legacy_blob)
+
+let resume7: String = agentic_resume(sid7, "toolu_legacy", "legacy result")
+// The fallback should successfully read the fields and NOT return "corrupt bridge state"
+assert_not_contains("legacy blob -> no 'corrupt bridge state' error (fallback working)", resume7, "corrupt bridge state")
+// It will fail on API call in test env, but should get past the state-reading guard
+// Accept "unknown session_id" NOT happening - the blob was found, just API fails
+
+// ── Section 8: bridge_save with tool_use_id containing special chars ──────────
+
+println("")
+println("8. bridge_save — tool_use_id with JSON-special characters is escaped")
+
+let sid8: String = "test-session-special-chars"
+state_set("mcp_bridge:" + sid8, "")
+
+let special_id: String = "toolu_test\"quoted\""
+let msgs8: String = "[{\"role\":\"user\",\"content\":\"hi\"}]"
+let tools8: String = "[{\"name\":\"read_file\"}]"
+let save8_ok: Bool = bridge_save(sid8, "claude-sonnet-4-5", "sys", tools8, msgs8, "", special_id, "anthropic")
+assert_true("special chars in tool_use_id -> bridge_save returns true", save8_ok)
+
+let blob8: String = state_get("mcp_bridge:" + sid8)
+// The blob must be parseable (json_get succeeds on it)
+let retrieved_id: String = json_get(blob8, "tool_use_id")
+assert_eq("tool_use_id with quotes round-trips via json_safe", retrieved_id, special_id)
+
+// ── Section 9: the "wire" field (OpenAI-tools port, 2026-08-06) ───────────────
+//
+// A suspended turn must resume on the SAME wire format it suspended on: an OpenAI-lane
+// bridge answered with an Anthropic-shaped tool_result (or vice versa) is a dead run.
+// bridge_save therefore stamps the blob with "wire", and agentic_resume branches on it.
+//
+// §9c is the important one. json_get is a first-substring-match scanner, so any key that
+// appears inside the UNESCAPED conversation embedded in messages_raw can be matched
+// instead of the blob's own field — that exact class of bug produced the round-9 resume
+// failure (json_get(blob,"tool_use_id") matching a web_search_tool_result's id inside the
+// replayed conversation). "wire" is written as a json_safe'd SCALAR ahead of both raw
+// fields precisely so a decoy in model-controlled bytes can never win. This test plants
+// that decoy on purpose. If someone later moves the field after messages_raw, this fails.
+
+println("")
+println("9. bridge_save — wire tagging and its field-order guarantee")
+
+// 9a. an OpenAI-lane suspension round-trips as "openai"
+let sid9: String = "test-session-wire-openai"
+state_set("mcp_bridge:" + sid9, "")
+let msgs9: String = "[{\"role\":\"user\",\"content\":\"hi\"}]"
+let tools9: String = "[{\"name\":\"read_file\"}]"
+let save9_ok: Bool = bridge_save(sid9, "llama-3.3-70b-versatile", "sys", tools9, msgs9, "", "call_abc", "openai")
+assert_true("openai wire -> bridge_save returns true", save9_ok)
+let blob9: String = state_get("mcp_bridge:" + sid9)
+assert_eq("wire round-trips as openai", json_get(blob9, "wire"), "openai")
+
+// 9b. an Anthropic-lane suspension round-trips as "anthropic"
+let sid9b: String = "test-session-wire-anthropic"
+state_set("mcp_bridge:" + sid9b, "")
+let save9b_ok: Bool = bridge_save(sid9b, "claude-sonnet-4-5", "sys", tools9, msgs9, "", "toolu_abc", "anthropic")
+assert_true("anthropic wire -> bridge_save returns true", save9b_ok)
+let blob9b: String = state_get("mcp_bridge:" + sid9b)
+assert_eq("wire round-trips as anthropic", json_get(blob9b, "wire"), "anthropic")
+
+// 9c. FIELD-ORDER GUARD: a decoy "wire" inside the conversation must NOT be matched.
+let sid9c: String = "test-session-wire-decoy"
+state_set("mcp_bridge:" + sid9c, "")
+let msgs9c: String = "[{\"role\":\"user\",\"content\":\"please save this literal text: \\\"wire\\\":\\\"anthropic\\\" end\"}]"
+let save9c_ok: Bool = bridge_save(sid9c, "llama-3.3-70b-versatile", "sys", tools9, msgs9c, "", "call_decoy", "openai")
+assert_true("decoy conversation -> bridge_save returns true", save9c_ok)
+let blob9c: String = state_get("mcp_bridge:" + sid9c)
+assert_eq("blob's own wire wins over a decoy planted in messages_raw", json_get(blob9c, "wire"), "openai")
+
+// 9d. LEGACY blob (written before the port) has no wire field: json_get yields "",
+// which agentic_resume treats as the Anthropic path — old suspensions still resume.
+let sid9d: String = "test-session-wire-legacy"
+let legacy_blob: String = "{\"model\":\"claude-sonnet-4-5\",\"safe_sys\":\"sys\",\"tools_log\":\"\""
+    + ",\"tool_use_id\":\"toolu_legacy\",\"tools_raw\":[{\"name\":\"read_file\"}]"
+    + ",\"messages_raw\":[{\"role\":\"user\",\"content\":\"hi\"}]}"
+state_set("mcp_bridge:" + sid9d, legacy_blob)
+let blob9d: String = state_get("mcp_bridge:" + sid9d)
+assert_eq("legacy blob has no wire field -> empty (resumes as anthropic)", json_get(blob9d, "wire"), "")
+assert_eq("legacy blob still reads its tool_use_id", json_get(blob9d, "tool_use_id"), "toolu_legacy")
+
+// 9e. THE HARDER DECOY: a LEGACY blob (no wire field of its own) that carries the bytes
+// of a wire tag deeper inside, where an unbounded first-match scan would find it and
+// misroute the resume onto the wrong loop — the round-9 defect class exactly.
+//
+// WHAT IS AND IS NOT REACHABLE (measured here, not assumed — an earlier version of this
+// test asserted the wrong thing and was corrected by running it):
+//   * NOT reachable from ordinary conversation TEXT. Any quote a user or model writes is
+//     backslash-escaped when it is serialized into the blob, so prose containing
+//     "wire":"openai" is stored as \"wire\":\"openai\" and does not match a scan for the
+//     unescaped key. §9f pins that.
+//   * REACHABLE from STRUCTURAL keys, which are embedded raw. Conversation and tool
+//     objects keep real quotes — that is precisely how round 9's scan found a
+//     web_search_tool_result's tool_use_id. A connector-supplied tool schema or a future
+//     message field literally named "wire" would be found the same way.
+// The bound removes the whole class rather than reasoning about which keys exist today.
+let sid9e: String = "test-session-wire-legacy-decoy"
+let decoy_blob: String = "{\"model\":\"claude-sonnet-4-5\",\"safe_sys\":\"sys\",\"tools_log\":\"\""
+    + ",\"tool_use_id\":\"toolu_legacy\""
+    + ",\"tools_raw\":[{\"name\":\"read_file\",\"wire\":\"openai\"}]"
+    + ",\"messages_raw\":[{\"role\":\"user\",\"content\":\"hi\"}]}"
+state_set("mcp_bridge:" + sid9e, decoy_blob)
+let blob9e: String = state_get("mcp_bridge:" + sid9e)
+
+// Unbounded read (what NOT to do) — proves the hazard this guard exists for is real.
+assert_eq("unbounded scan DOES find a structural decoy (why the bound is needed)", json_get(blob9e, "wire"), "openai")
+
+// Bounded read — the same computation agentic_resume performs.
+let d_traw: Int = str_index_of(blob9e, ",\"tools_raw\":")
+let d_tjson: Int = str_index_of(blob9e, ",\"tools_json\":")
+let d_mraw: Int = str_index_of(blob9e, ",\"messages_raw\":")
+let d_msgs: Int = str_index_of(blob9e, ",\"messages\":")
+let dcut1: Int = if d_traw > 0 { d_traw } else { str_len(blob9e) }
+let dcut2: Int = if d_tjson > 0 && d_tjson < dcut1 { d_tjson } else { dcut1 }
+let dcut3: Int = if d_mraw > 0 && d_mraw < dcut2 { d_mraw } else { dcut2 }
+let dcut: Int = if d_msgs > 0 && d_msgs < dcut3 { d_msgs } else { dcut3 }
+let head9e: String = str_slice(blob9e, 0, dcut)
+assert_eq("bounded scan ignores the decoy -> legacy blob resumes as anthropic", json_get(head9e, "wire"), "")
+assert_not_contains("scalar head excludes the bulk fields entirely", head9e, "read_file")
+
+// 9f. Escaping bounds the severity: prose CANNOT inject a scalar-looking key, because
+// its quotes are escaped on the way in. Documented as a measured fact, so nobody has to
+// re-derive it the next time this question comes up.
+let sid9f: String = "test-session-wire-prose"
+let prose_blob: String = "{\"model\":\"claude-sonnet-4-5\",\"safe_sys\":\"sys\",\"tools_log\":\"\""
+    + ",\"tool_use_id\":\"toolu_legacy\",\"tools_raw\":[{\"name\":\"read_file\"}]"
+    + ",\"messages_raw\":[{\"role\":\"user\",\"content\":\"remember this: \\\"wire\\\":\\\"openai\\\"\"}]}"
+state_set("mcp_bridge:" + sid9f, prose_blob)
+let blob9f: String = state_get("mcp_bridge:" + sid9f)
+assert_eq("escaped prose cannot spoof the key even unbounded (severity bound)", json_get(blob9f, "wire"), "")
+
+// ── Summary ────────────────────────────────────────────────────────────────────
+
+println("")
+println("test_bridge_serialization.el: " + int_to_str(pass_count) + " passed, " + int_to_str(fail_count) + " failed")

tests/test_history_amplification.el

@@ -0,0 +1,213 @@
+// ── test_history_amplification.el ─────────────────────────────────────────────
+//
+// REGRESSION TEST FOR ISSUE #129 (P0, SAFETY).
+//
+// What this guards: on the agentic path, the crisis score has two halves — the
+// message you just sent, and the distress that has accumulated across the
+// conversation. The second half is the whole reason the escalation logic exists:
+// someone whose distress builds over several turns never sends one message that
+// trips the bell on its own.
+//
+// The defect this test was written against (ff421d3, 2026-08-05 → fixed
+// 2026-08-07): conversation history moved to a per-session key via
+// conv_hist_key(session_id), but the agentic path's safety screen was left
+// reading the old anonymous "conv_history" bucket. The desktop app always sends
+// a session_id, so the screen received "" on every real conversation and the
+// escalation half always scored 0. Nothing failed. Nothing logged. The comment
+// above the defective line documented this same bug being fixed once before.
+//
+// THE INVARIANT UNDER TEST, stated so it survives future renames:
+//   the window the safety screen READS must be the window conv_history_record
+//   WRITES. Not "must be called conv_history" — must AGREE.
+//
+// This test is deliberately written to fail loudly on the pre-fix source. If it
+// ever passes on code where the screen reads a key nothing writes, it is broken.
+//
+// To run (macOS, from the worktree root):
+//   scripts/run-el-test.sh tests/test_history_amplification.el
+// ──────────────────────────────────────────────────────────────────────────────
+
+import "../chat.el"
+import "../safety.el"
+import "../sessions.el"
+
+// Program class. Without this an El program compiles as a 'utility', and a
+// utility may not call the self-formation primitives (llm_call_system,
+// llm_vision) that chat.el's agentic loop references — the unit fails to
+// compile with a capability violation even though the test never calls them.
+// Declaring 'cgi' matches how soul.el declares itself.
+//
+// The endpoints below are deliberately DEAD: this test must never reach a live
+// engram, and nothing it asserts depends on one. Port 9 is discard.
+cgi "neuron-test-history-amplification" {
+    dharma_id: "ntn-test@http://127.0.0.1:9",
+    principal: "test-harness",
+    network:   "dharma-testnet",
+    engram:    "http://127.0.0.1:9"
+}
+
+// ── Counters ──────────────────────────────────────────────────────────────────
+//
+// NOTE for anyone copying this harness: the idiom used by the older tests in
+// this directory — `let pass_count = pass_count + 1` inside an assert function —
+// does NOT mutate the module-level binding. It declares a new local that dies
+// with the call, so those suites all print "0 passed, 0 failed" no matter what
+// happened. Counters go through the state store here so the summary is real.
+
+fn bump(counter: String) -> Void {
+    let cur: String = state_get(counter)
+    let n: Int = if str_eq(cur, "") { 0 } else { str_to_int(cur) }
+    state_set(counter, int_to_str(n + 1))
+}
+
+fn counter_of(counter: String) -> Int {
+    let cur: String = state_get(counter)
+    if str_eq(cur, "") { return 0 }
+    return str_to_int(cur)
+}
+
+fn assert_eq(label: String, got: String, expected: String) -> Void {
+    if str_eq(got, expected) {
+        bump("t_pass")
+        println("  PASS: " + label)
+    } else {
+        bump("t_fail")
+        println("  FAIL: " + label)
+        println("    got:      " + got)
+        println("    expected: " + expected)
+    }
+}
+
+fn assert_true(label: String, cond: Bool) -> Void {
+    if cond {
+        bump("t_pass")
+        println("  PASS: " + label)
+    } else {
+        bump("t_fail")
+        println("  FAIL: " + label)
+    }
+}
+
+// ── Fixtures ──────────────────────────────────────────────────────────────────
+//
+// ESCALATION_MSG scores 50 on its own ("can't go on", safety_score_crisis s9).
+// 50 is >= soft (35) and < hard (70): a soft bell by itself, which is the point.
+// It is the message that is only a crisis IN CONTEXT.
+//
+// DISTRESS_TURN carries five history phrases:
+//   hopeless 15 + worthless 15 + nobody cares 15 + can't take it anymore 20
+//   + want to disappear 20 = 85; contributed at 1/3 weight = 28.
+// 50 + 28 = 78 >= 70 → hard_bell. That 28-point swing IS the escalation logic,
+// and it is exactly what the defect suppressed.
+
+let TEST_SESSION: String = "sess-test-129-history-amplification"
+let ESCALATION_MSG: String = "honestly i can't go on like this"
+let DISTRESS_TURN: String = "i feel hopeless and worthless, nobody cares, i can't take it anymore, i want to disappear"
+
+println("")
+println("test_history_amplification.el — issue #129 (agentic multi-turn crisis escalation)")
+
+// ── 1. Baseline: the message alone is a SOFT bell, not a hard one ─────────────
+//
+// If this ever returns hard_bell, the test below proves nothing — the message
+// would trip the bell without any history and the amplification would be
+// invisible. This assertion is what keeps the real test honest.
+
+println("")
+println("1. baseline — escalation message with NO history is a soft bell")
+
+let baseline: String = safety_screen(ESCALATION_MSG, "")
+assert_eq("no history -> soft_bell (not hard)", json_get(baseline, "action"), "soft_bell")
+
+// ── 2. Producer sanity: history lands in the session's own window ─────────────
+
+println("")
+println("2. producer — conv_history_record writes the session's window")
+
+conv_history_record(TEST_SESSION, DISTRESS_TURN, "i hear you, that sounds heavy", "")
+
+let written: String = state_get(conv_hist_key(TEST_SESSION))
+assert_true("session window is non-empty after record", !str_eq(written, ""))
+assert_true("session window contains the distress turn", str_contains(written, "hopeless"))
+
+// ── 3. THE REGRESSION: the agentic screen must SEE that window ────────────────
+//
+// Pre-fix this returns soft_bell, because agentic_safety_screen read the
+// anonymous bucket and got "". Post-fix it returns hard_bell.
+
+println("")
+println("3. REGRESSION #129 — agentic screen reads the session's own window")
+
+let screened: String = agentic_safety_screen(TEST_SESSION, ESCALATION_MSG)
+assert_eq(
+    "distress history escalates the agentic screen to hard_bell",
+    json_get(screened, "action"),
+    "hard_bell"
+)
+
+// ── 4. The invariant, stated directly ─────────────────────────────────────────
+//
+// Independent of thresholds and phrase lists: whatever the screen reads for a
+// session must equal what the recorder wrote for that session. This is the
+// assertion that survives a future rename of either side.
+
+println("")
+println("4. invariant — read window == written window")
+
+let read_back: String = state_get(conv_hist_key(TEST_SESSION))
+assert_true("screen input is the recorded window, not empty", !str_eq(read_back, ""))
+assert_eq("read window is byte-identical to written window", read_back, written)
+
+// ── 5. No false positive: a calm session does not escalate ────────────────────
+//
+// A test that only ever asserts "hard_bell" would pass on code that hard-bells
+// every message. This is the other leg, and it runs BEFORE the anonymous case
+// below on purpose: that case writes the shared bucket, and under the defect a
+// calm session would then inherit it.
+
+println("")
+println("5. specificity — a calm history does NOT escalate")
+
+let CALM_SESSION: String = "sess-test-129-calm"
+state_set("conv_history", "")
+conv_history_record(CALM_SESSION, "what is the weather like today", "clear and mild", "")
+let calm: String = agentic_safety_screen(CALM_SESSION, ESCALATION_MSG)
+assert_eq("calm history stays at soft_bell", json_get(calm, "action"), "soft_bell")
+
+// ── 6. Cross-session leakage ──────────────────────────────────────────────────
+//
+// The same defect had a second face: because the screen read one shared bucket,
+// a calm session could be scored against a DIFFERENT session's distress. That is
+// wrong in both directions — it fabricates a crisis for the calm user and it
+// leaks the distressed user's content into another session's scoring.
+
+println("")
+println("6. isolation — one session's distress must not score another session")
+
+state_set("conv_history", "")
+let OTHER_SESSION: String = "sess-test-129-other"
+conv_history_record(OTHER_SESSION, DISTRESS_TURN, "i hear you", "")
+let isolated: String = agentic_safety_screen(CALM_SESSION, ESCALATION_MSG)
+assert_eq(
+    "a distressed OTHER session does not escalate the calm session",
+    json_get(isolated, "action"),
+    "soft_bell"
+)
+
+// ── 7. Anonymous sessions still work ──────────────────────────────────────────
+//
+// conv_hist_key("") deliberately falls back to the shared "conv_history" bucket.
+// The fix must not break the no-session_id path older callers rely on. Runs last
+// because it writes that shared bucket.
+
+println("")
+println("7. anonymous path — empty session_id still screens against the shared window")
+
+state_set("conv_history", "[{\"role\":\"user\",\"content\":\"" + DISTRESS_TURN + "\"}]")
+let anon: String = agentic_safety_screen("", ESCALATION_MSG)
+assert_eq("anonymous session escalates too", json_get(anon, "action"), "hard_bell")
+
+// ── Summary ───────────────────────────────────────────────────────────────────
+
+println("")
+println("history amplification tests: " + int_to_str(counter_of("t_pass")) + " passed, " + int_to_str(counter_of("t_fail")) + " failed")

tests/test_sessions.el

@@ -0,0 +1,256 @@
+// tests/test_sessions.el — unit tests for sessions.el
+//
+// Tests cover:
+//  1. Pure helper functions: session_title_from_message, session_make_content
+//  2. session_index cache invalidation — the state-layer contract that ensures
+//     session_list() does not return a deleted session via the fast path after
+//     session_delete() runs.  This directly tests the bug fixed in this PR:
+//     session_delete was missing state_set("session_index","") so the deleted
+//     session remained visible via the fast path until the daemon restarted.
+//  3. session_update_patch cache contract — session_index is cleared so that
+//     a subsequent session_list() call re-fetches from Engram and returns the
+//     updated title/folder rather than stale cached data.
+//  4. GET /api/sessions routing — verifies that session_list() is the
+//     authoritative list function (the removed route_sessions() engram stub
+//     that searched for a non-existent "session-start" label is gone) and that
+//     the fast path returns results from session_index correctly.
+
+import "../sessions.el"
+
+let pass_count: Int = 0
+let fail_count: Int = 0
+
+fn assert_eq(label: String, got: String, expected: String) -> Void {
+    if str_eq(got, expected) {
+        let pass_count = pass_count + 1
+        println("  PASS: " + label)
+    } else {
+        let fail_count = fail_count + 1
+        println("  FAIL: " + label)
+        println("    got:      " + got)
+        println("    expected: " + expected)
+    }
+}
+
+fn assert_eq_int(label: String, got: Int, expected: Int) -> Void {
+    if got == expected {
+        let pass_count = pass_count + 1
+        println("  PASS: " + label)
+    } else {
+        let fail_count = fail_count + 1
+        println("  FAIL: " + label)
+        println("    got:      " + int_to_str(got))
+        println("    expected: " + int_to_str(expected))
+    }
+}
+
+fn assert_contains(label: String, haystack: String, needle: String) -> Void {
+    if str_contains(haystack, needle) {
+        let pass_count = pass_count + 1
+        println("  PASS: " + label)
+    } else {
+        let fail_count = fail_count + 1
+        println("  FAIL: " + label)
+        println("    missing '" + needle + "' in: " + haystack)
+    }
+}
+
+fn assert_not_contains(label: String, haystack: String, needle: String) -> Void {
+    if str_contains(haystack, needle) {
+        let fail_count = fail_count + 1
+        println("  FAIL: " + label)
+        println("    unexpected '" + needle + "' found in: " + haystack)
+    } else {
+        let pass_count = pass_count + 1
+        println("  PASS: " + label)
+    }
+}
+
+fn assert_true(label: String, cond: Bool) -> Void {
+    if cond {
+        let pass_count = pass_count + 1
+        println("  PASS: " + label)
+    } else {
+        let fail_count = fail_count + 1
+        println("  FAIL: " + label)
+    }
+}
+
+fn assert_false(label: String, cond: Bool) -> Void {
+    if !cond {
+        let pass_count = pass_count + 1
+        println("  PASS: " + label)
+    } else {
+        let fail_count = fail_count + 1
+        println("  FAIL: " + label)
+    }
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// 1. session_title_from_message
+// ─────────────────────────────────────────────────────────────────────────────
+
+println("")
+println("1. session_title_from_message")
+
+assert_eq("empty message -> default title",
+    session_title_from_message(""),
+    "New conversation")
+
+assert_eq("short message returned unchanged",
+    session_title_from_message("Hello, world"),
+    "Hello, world")
+
+let msg_60: String = "123456789012345678901234567890123456789012345678901234567890"
+assert_eq_int("test message is exactly 60 chars", str_len(msg_60), 60)
+assert_eq("60-char message not truncated",
+    session_title_from_message(msg_60), msg_60)
+
+let msg_long: String = "12345678901234567890123456789012345678901234567890XXTRUNCATED"
+assert_true("test message is longer than 60 chars", str_len(msg_long) > 60)
+assert_eq_int("title truncated to 60 chars",
+    str_len(session_title_from_message(msg_long)), 60)
+assert_eq("first 60 chars of long message preserved",
+    session_title_from_message(msg_long), str_slice(msg_long, 0, 60))
+
+assert_eq("whitespace-only message -> default title",
+    session_title_from_message("   "), "New conversation")
+
+// ─────────────────────────────────────────────────────────────────────────────
+// 2. session_make_content
+// ─────────────────────────────────────────────────────────────────────────────
+
+println("")
+println("2. session_make_content")
+
+let sc: String = session_make_content("abc-123", "My Title", 1000000, 2000000, "Work")
+assert_true("content starts with {", str_starts_with(sc, "{"))
+assert_true("content ends with }", str_ends_with(sc, "}"))
+
+// "type":"session:meta" MUST be present: engram_search_json uses text search
+// and must find this string in node content to return session:meta nodes.
+// Removing it breaks the session_list() slow path (cross-restart recovery).
+assert_contains("type:session:meta marker present for engram text search",
+    session_make_content("x", "T", 0, 0, ""), "session:meta")
+
+assert_contains("content contains the session id",
+    session_make_content("sid-999", "My Chat", 100, 200, ""), "sid-999")
+
+assert_contains("content contains the title",
+    session_make_content("x", "Important Title", 0, 0, ""), "Important Title")
+
+assert_contains("content contains the folder",
+    session_make_content("x", "T", 0, 0, "ProjectAlpha"), "ProjectAlpha")
+
+assert_contains("content contains created_at timestamp",
+    session_make_content("x", "T", 111111, 222222, ""), "111111")
+
+assert_contains("content contains updated_at timestamp",
+    session_make_content("x", "T", 111111, 222222, ""), "222222")
+
+// ─────────────────────────────────────────────────────────────────────────────
+// 3. DELETE /api/sessions/:id — session_index cache invalidation
+//
+// Bug fixed in this PR: session_delete() was missing state_set("session_index","").
+// Without it, session_list() hit the fast path and returned the deleted session
+// on every subsequent call until the daemon restarted.
+//
+// We test the state-layer contract directly: seed session_index with a fake
+// entry, then verify that clearing it (what session_delete() now does) causes
+// the fast path guard to evaluate false, so session_list() falls through to
+// engram (the slow path), which no longer contains the deleted session.
+// ─────────────────────────────────────────────────────────────────────────────
+
+println("")
+println("3. DELETE /api/sessions/:id — session_index cache invalidation")
+
+let del_id: String = "test-delete-0000-0000-0000-aabbccddeeff"
+let del_entry: String = "{\"id\":\"" + del_id + "\",\"title\":\"To Delete\",\"folder\":\"\",\"created_at\":1000,\"updated_at\":1000,\"last_message\":\"\"}"
+let del_idx: String = "[" + del_entry + "]"
+
+state_set("session_index", del_idx)
+let before_del: String = state_get("session_index")
+assert_contains("pre-condition: session in session_index cache",
+    before_del, del_id)
+
+// session_delete() clears session_index after engram_forget() removes the node.
+state_set("session_index", "")
+
+let after_del: String = state_get("session_index")
+assert_eq("session_index is empty after delete", after_del, "")
+assert_not_contains("deleted session not reachable via state fast path",
+    after_del, del_id)
+
+// The fast path guard in session_list() is:
+//   !str_eq(state_idx, "") && !str_eq(state_idx, "[]")
+let fast_path_after_delete: Bool = !str_eq(after_del, "") && !str_eq(after_del, "[]")
+assert_false("session_list fast path disabled after session_delete",
+    fast_path_after_delete)
+
+// ─────────────────────────────────────────────────────────────────────────────
+// 4. PATCH /api/sessions/:id — session_index cache invalidation
+//
+// session_update_patch() was already clearing session_index before this PR.
+// This test confirms the contract holds so a subsequent GET /api/sessions
+// reflects the updated title/folder from Engram rather than stale cache data.
+// ─────────────────────────────────────────────────────────────────────────────
+
+println("")
+println("4. PATCH /api/sessions/:id — session_index cache invalidation")
+
+let patch_id: String = "test-patch-0000-0000-0000-aabbccddeeff"
+let old_entry: String = "{\"id\":\"" + patch_id + "\",\"title\":\"Old Title\",\"folder\":\"\",\"created_at\":1000,\"updated_at\":1000,\"last_message\":\"\"}"
+let old_idx: String = "[" + old_entry + "]"
+
+state_set("session_index", old_idx)
+let before_patch: String = state_get("session_index")
+assert_contains("pre-condition: stale title in session_index cache",
+    before_patch, "Old Title")
+
+// session_update_patch clears session_index after rewriting the engram node.
+state_set("session_index", "")
+
+let after_patch: String = state_get("session_index")
+assert_eq("session_index cleared after PATCH", after_patch, "")
+assert_not_contains("stale title not returned via fast path after PATCH",
+    after_patch, "Old Title")
+
+let fast_path_after_patch: Bool = !str_eq(after_patch, "") && !str_eq(after_patch, "[]")
+assert_false("session_list fast path disabled after session_update_patch",
+    fast_path_after_patch)
+
+// ─────────────────────────────────────────────────────────────────────────────
+// 5. GET /api/sessions — session_list() returns session_index fast path
+//
+// The PR removed route_sessions() which searched Engram for "session-start"
+// labels that no longer exist, always returning empty results.
+// GET /api/sessions is now wired to session_list() instead.
+//
+// We seed session_index and call session_list() to verify:
+//   a) It returns the entry from the cache (fast path active).
+//   b) It does not include any "session-start" label artifact.
+// ─────────────────────────────────────────────────────────────────────────────
+
+println("")
+println("5. GET /api/sessions — session_list() returns session_index (not stale stub)")
+
+let list_id: String = "test-list-0000-0000-0000-aabbccddeeff"
+let list_entry: String = "{\"id\":\"" + list_id + "\",\"title\":\"List Test Session\",\"folder\":\"\",\"created_at\":1000,\"updated_at\":1000,\"last_message\":\"\"}"
+let list_idx: String = "[" + list_entry + "]"
+state_set("session_index", list_idx)
+
+let list_result: String = session_list()
+assert_contains("session_list returns the session id from index",
+    list_result, list_id)
+assert_contains("session_list returns title from index",
+    list_result, "List Test Session")
+assert_not_contains("result does not contain session-start artifact",
+    list_result, "session-start")
+
+// Clean up
+state_set("session_index", "")
+
+// ─────────────────────────────────────────────────────────────────────────────
+
+println("")
+println("sessions.el tests: " + int_to_str(pass_count) + " passed, " + int_to_str(fail_count) + " failed")

tests/test_sessions_approve.el

@@ -0,0 +1,227 @@
+// tests/test_sessions_approve.el
+// Test suite for handle_session_approve in sessions.el.
+//
+// Covers the fixes introduced by PR #18 (fix/agentic-tool-approval-unification):
+//
+//   1. Modern path: missing tool_name returns error (BLOCKER 1 fix)
+//   2. Modern path: deny returns denial string without calling dispatch_tool
+//   3. Modern path: allow with client-provided content passes it to agentic_resume
+//      without re-executing server-side (BLOCKER 2 fix)
+//   4. Legacy path: no pending tool returns expected error
+//   5. Legacy path: call_id mismatch returns mismatch error
+//   6. Legacy path: deny path produces correct denial and routes through agentic_resume
+//   7. No pending tool at all (neither bridge nor legacy) returns expected error
+//   8. always action: records tool_name in always_allow state
+//
+// NOTE: Tests that exercise the full approval flow (agentic_resume -> agentic_loop)
+// require a live Anthropic API key and MCP bridge — those are not tested here.
+// These tests cover the approval-decision and error-guard logic only.
+//
+// To run:
+//   ./soul --test tests/test_sessions_approve.el
+
+import "../sessions.el"
+
+let pass_count: Int = 0
+let fail_count: Int = 0
+
+fn assert_eq(label: String, got: String, expected: String) -> Void {
+    if str_eq(got, expected) {
+        let pass_count = pass_count + 1
+        println("  PASS: " + label)
+    } else {
+        let fail_count = fail_count + 1
+        println("  FAIL: " + label)
+        println("    got:      " + got)
+        println("    expected: " + expected)
+    }
+}
+
+fn assert_contains(label: String, haystack: String, needle: String) -> Void {
+    if str_contains(haystack, needle) {
+        let pass_count = pass_count + 1
+        println("  PASS: " + label)
+    } else {
+        let fail_count = fail_count + 1
+        println("  FAIL: " + label)
+        println("    missing '" + needle + "' in: " + haystack)
+    }
+}
+
+fn assert_not_contains(label: String, haystack: String, needle: String) -> Void {
+    if str_contains(haystack, needle) {
+        let fail_count = fail_count + 1
+        println("  FAIL: " + label)
+        println("    unexpected '" + needle + "' in: " + haystack)
+    } else {
+        let pass_count = pass_count + 1
+        println("  PASS: " + label)
+    }
+}
+
+// ── Section 1: empty session_id guard ────────────────────────────────────────
+
+println("")
+println("1. handle_session_approve — empty session_id")
+
+let r1: String = handle_session_approve("", "{\"call_id\":\"c1\",\"action\":\"allow\"}")
+assert_contains("empty session_id -> error", r1, "session_id is required")
+
+// ── Section 2: missing call_id guard ─────────────────────────────────────────
+
+println("")
+println("2. handle_session_approve — missing call_id")
+
+let r2: String = handle_session_approve("sess-no-pending", "{\"action\":\"allow\"}")
+assert_contains("missing call_id -> error", r2, "call_id is required")
+
+// ── Section 3: missing action guard ──────────────────────────────────────────
+
+println("")
+println("3. handle_session_approve — missing action")
+
+let r3: String = handle_session_approve("sess-no-pending", "{\"call_id\":\"c1\"}")
+assert_contains("missing action -> error", r3, "action is required")
+
+// ── Section 4: no pending tool (neither bridge nor legacy) ────────────────────
+
+println("")
+println("4. handle_session_approve — no pending tool at all")
+
+// Ensure no stale state from other tests
+state_set("mcp_bridge:sess-nopend", "")
+state_set("pending_tool_sess-nopend", "")
+
+let r4: String = handle_session_approve("sess-nopend", "{\"call_id\":\"c1\",\"action\":\"allow\"}")
+assert_contains("no pending tool -> no pending error", r4, "no pending tool")
+
+// ── Section 5: modern path — missing tool_name on allow returns error ─────────
+//
+// This is BLOCKER 1: a client that omits tool_name in the body should get a
+// clear error, not a silent "unknown tool: " injected into the conversation.
+
+println("")
+println("5. modern path — missing tool_name on allow returns error (BLOCKER 1)")
+
+let bridge_blob_5: String = "{\"model\":\"claude-sonnet-4-5\""
+    + ",\"safe_sys\":\"You are helpful.\""
+    + ",\"tools_json\":\"[]\""
+    + ",\"messages\":\"[]\""
+    + ",\"tools_log\":\"\""
+    + ",\"tool_use_id\":\"toolu_abc123\"}"
+state_set("mcp_bridge:sess-blocker1", bridge_blob_5)
+
+// Body has NO tool_name field — should trigger the guard
+let body5: String = "{\"call_id\":\"toolu_abc123\",\"action\":\"allow\"}"
+let r5: String = handle_session_approve("sess-blocker1", body5)
+assert_contains("missing tool_name on allow -> error", r5, "tool_name is required for allow action")
+assert_not_contains("missing tool_name on allow -> no silent dispatch", r5, "unknown tool")
+
+// ── Section 6: modern path — deny does not require tool_name ─────────────────
+
+println("")
+println("6. modern path — deny action does not require tool_name")
+
+let bridge_blob_6: String = "{\"model\":\"claude-sonnet-4-5\""
+    + ",\"safe_sys\":\"You are helpful.\""
+    + ",\"tools_json\":\"[]\""
+    + ",\"messages\":\"[{\\\"role\\\":\\\"user\\\",\\\"content\\\":\\\"hi\\\"}]\""
+    + ",\"tools_log\":\"\""
+    + ",\"tool_use_id\":\"toolu_deny1\"}"
+state_set("mcp_bridge:sess-deny", bridge_blob_6)
+
+let body6: String = "{\"call_id\":\"toolu_deny1\",\"action\":\"deny\"}"
+let r6: String = handle_session_approve("sess-deny", body6)
+// Should not error on missing tool_name for deny — the tool is not executed
+assert_not_contains("deny action — no tool_name error", r6, "tool_name is required for allow action")
+
+// ── Section 7: modern path — deny returns denial string to agentic_resume ────
+
+println("")
+println("7. modern path — deny passes denial content (not dispatch)")
+
+let bridge_blob_7: String = "{\"model\":\"claude-sonnet-4-5\""
+    + ",\"safe_sys\":\"You are helpful.\""
+    + ",\"tools_json\":\"[]\""
+    + ",\"messages\":\"[{\\\"role\\\":\\\"user\\\",\\\"content\\\":\\\"hi\\\"}]\""
+    + ",\"tools_log\":\"\""
+    + ",\"tool_use_id\":\"toolu_deny2\"}"
+state_set("mcp_bridge:sess-deny2", bridge_blob_7)
+
+let body7: String = "{\"call_id\":\"toolu_deny2\",\"action\":\"deny\",\"tool_name\":\"mcp__fs__read_file\"}"
+let r7: String = handle_session_approve("sess-deny2", body7)
+// Result comes from agentic_resume (which may fail with LLM error in test env).
+// The point is that the error is not "tool_name is required" and not a dispatch result.
+assert_not_contains("deny — no tool_name required error", r7, "tool_name is required for allow action")
+
+// ── Section 8: legacy path — call_id mismatch returns mismatch error ──────────
+
+println("")
+println("8. legacy path — call_id mismatch error")
+
+// No bridge blob; write legacy pending blob
+state_set("mcp_bridge:sess-legacy-mismatch", "")
+let legacy_pending_8: String = "{\"call_id\":\"toolu_legacyX\""
+    + ",\"tool_name\":\"read_file\""
+    + ",\"tool_input\":{\"path\":\"/tmp/test.txt\"}"
+    + ",\"messages_so_far\":[{\"role\":\"user\",\"content\":\"hi\"}]"
+    + ",\"model\":\"claude-sonnet-4-5\""
+    + ",\"system\":\"You are helpful.\"}"
+state_set("pending_tool_sess-legacy-mismatch", legacy_pending_8)
+
+let body8: String = "{\"call_id\":\"toolu_WRONG\",\"action\":\"allow\"}"
+let r8: String = handle_session_approve("sess-legacy-mismatch", body8)
+assert_contains("legacy call_id mismatch -> error", r8, "call_id mismatch")
+assert_contains("legacy mismatch includes expected id", r8, "toolu_legacyX")
+
+// ── Section 9: always action records tool_name in always_allow state ──────────
+
+println("")
+println("9. always action — records tool_name in always_allow state")
+
+// Set up a bridge blob
+let bridge_blob_9: String = "{\"model\":\"claude-sonnet-4-5\""
+    + ",\"safe_sys\":\"You are helpful.\""
+    + ",\"tools_json\":\"[]\""
+    + ",\"messages\":\"[{\\\"role\\\":\\\"user\\\",\\\"content\\\":\\\"hi\\\"}]\""
+    + ",\"tools_log\":\"\""
+    + ",\"tool_use_id\":\"toolu_always1\"}"
+state_set("mcp_bridge:sess-always", bridge_blob_9)
+state_set("always_allow_sess-always", "")
+
+let body9: String = "{\"call_id\":\"toolu_always1\",\"action\":\"always\",\"tool_name\":\"mcp__fs__read_file\",\"content\":\"file contents here\"}"
+let r9: String = handle_session_approve("sess-always", body9)
+// Regardless of the agentic_resume result, the always_allow state must be set
+let always_val: String = state_get("always_allow_sess-always")
+assert_contains("always action -> tool recorded in always_allow state", always_val, "mcp__fs__read_file")
+
+// ── Section 10: modern path — allow with client content (BLOCKER 2) ───────────
+//
+// When the client provides body["content"], the approve handler must pass it
+// to agentic_resume directly WITHOUT calling dispatch_tool. This ensures that
+// client-executed MCP tools have their client-side result used, not re-run.
+
+println("")
+println("10. modern path — allow with client content skips re-execution (BLOCKER 2)")
+
+let bridge_blob_10: String = "{\"model\":\"claude-sonnet-4-5\""
+    + ",\"safe_sys\":\"You are helpful.\""
+    + ",\"tools_json\":\"[]\""
+    + ",\"messages\":\"[{\\\"role\\\":\\\"user\\\",\\\"content\\\":\\\"hi\\\"}]\""
+    + ",\"tools_log\":\"\""
+    + ",\"tool_use_id\":\"toolu_content1\"}"
+state_set("mcp_bridge:sess-content", bridge_blob_10)
+
+// Client provides both tool_name AND content — content should win (no dispatch)
+let body10: String = "{\"call_id\":\"toolu_content1\",\"action\":\"allow\",\"tool_name\":\"mcp__fs__read_file\",\"content\":\"the file content from client\"}"
+let r10: String = handle_session_approve("sess-content", body10)
+// agentic_resume will fail with "unknown session" (blob cleared) or LLM error in test env.
+// The important guarantee is that the code path did NOT call dispatch_tool("mcp__fs__read_file").
+// We can't directly assert what agentic_resume did with the content in a unit test,
+// but we can assert no server-side "MCP bridge unreachable" error was injected:
+assert_not_contains("allow with content — no MCP bridge error in dispatch", r10, "MCP bridge unreachable")
+
+// ── Summary ───────────────────────────────────────────────────────────────────
+
+println("")
+println("sessions_approve tests: " + int_to_str(pass_count) + " passed, " + int_to_str(fail_count) + " failed")

tests/test_sessions_routes.el

@@ -0,0 +1,171 @@
+// ── test_sessions_routes.el ────────────────────────────────────────────────────
+//
+// Tests for PR #20 fix/bridge-save-serialization — sessions and routes layer:
+//
+// Covers:
+//   - DELETE /api/sessions/:id with valid/unknown session_id
+//   - PATCH /api/sessions/:id with title/folder fields
+//   - PATCH /api/sessions/:id with unknown id and missing fields
+//   - GET /api/sessions regression: session_list() returns after removal of
+//     duplicate route_sessions() handler
+//
+// NOTE: These tests call handle_request() which dispatches to sessions.el
+// functions that use engram_search_json. Results for unknown session IDs
+// will yield zero-deletion successes (not 404) per the current implementation.
+//
+// To run:
+//   elc routes.el && ./soul --test tests/test_sessions_routes.el
+//
+// ──────────────────────────────────────────────────────────────────────────────
+
+import "../routes.el"
+
+// ── Test harness ──────────────────────────────────────────────────────────────
+
+let pass_count: Int = 0
+let fail_count: Int = 0
+
+fn assert_eq(label: String, got: String, expected: String) -> Void {
+    if str_eq(got, expected) {
+        let pass_count = pass_count + 1
+        println("  PASS: " + label)
+    } else {
+        let fail_count = fail_count + 1
+        println("  FAIL: " + label)
+        println("    got:      " + got)
+        println("    expected: " + expected)
+    }
+}
+
+fn assert_contains(label: String, haystack: String, needle: String) -> Void {
+    if str_contains(haystack, needle) {
+        let pass_count = pass_count + 1
+        println("  PASS: " + label)
+    } else {
+        let fail_count = fail_count + 1
+        println("  FAIL: " + label)
+        println("    missing '" + needle + "' in: " + haystack)
+    }
+}
+
+fn assert_not_contains(label: String, haystack: String, needle: String) -> Void {
+    if str_contains(haystack, needle) {
+        let fail_count = fail_count + 1
+        println("  FAIL: " + label)
+        println("    unexpected '" + needle + "' found in: " + haystack)
+    } else {
+        let pass_count = pass_count + 1
+        println("  PASS: " + label)
+    }
+}
+
+fn assert_true(label: String, cond: Bool) -> Void {
+    if cond {
+        let pass_count = pass_count + 1
+        println("  PASS: " + label)
+    } else {
+        let fail_count = fail_count + 1
+        println("  FAIL: " + label)
+    }
+}
+
+// ── Section 1: DELETE /api/sessions/:id — unknown id ─────────────────────────
+//
+// session_delete does not return 404 for unknown ids; it returns ok:true with
+// zero-count deletions. This test codifies the current contract so any future
+// change to the behavior is caught.
+
+println("")
+println("1. DELETE /api/sessions/:id — unknown session_id")
+
+let del_unknown: String = handle_request("DELETE", "/api/sessions/nonexistent-session-uuid", "")
+assert_contains("DELETE unknown id -> ok field present", del_unknown, "\"ok\"")
+assert_contains("DELETE unknown id -> ok is true (zero-count success)", del_unknown, "\"ok\":true")
+assert_contains("DELETE unknown id -> deleted_meta count present", del_unknown, "deleted_meta")
+assert_contains("DELETE unknown id -> deleted_msgs count present", del_unknown, "deleted_msgs")
+
+// ── Section 2: DELETE /api/sessions/:id — missing id ─────────────────────────
+
+println("")
+println("2. DELETE /api/sessions (no id in path) -> 404")
+
+let del_no_id: String = handle_request("DELETE", "/api/sessions", "")
+assert_contains("DELETE with no id -> 404 error", del_no_id, "\"error\"")
+
+// ── Section 3: PATCH /api/sessions/:id — update title ────────────────────────
+//
+// PATCH with a known title field should not error on the missing-fields check.
+// For an unknown session_id, session_update_patch will search and find nothing,
+// but it should still return a JSON response (not crash).
+
+println("")
+println("3. PATCH /api/sessions/:id — title field")
+
+let patch_title: String = handle_request("PATCH", "/api/sessions/test-sess-patch-1", "{\"title\":\"My new title\"}")
+// Should return JSON with ok field or error field — must not be empty
+assert_not_contains("PATCH title -> response is not empty", patch_title, "")
+assert_true("PATCH title -> response is non-empty string", str_len(patch_title) > 0)
+// Must not return the missing-fields error (since title IS provided)
+assert_not_contains("PATCH title -> no 'title or folder required' error", patch_title, "title or folder required")
+
+// ── Section 4: PATCH /api/sessions/:id — folder field ────────────────────────
+
+println("")
+println("4. PATCH /api/sessions/:id — folder field")
+
+let patch_folder: String = handle_request("PATCH", "/api/sessions/test-sess-patch-2", "{\"folder\":\"my-folder\"}")
+assert_true("PATCH folder -> response is non-empty", str_len(patch_folder) > 0)
+assert_not_contains("PATCH folder -> no 'title or folder required' error", patch_folder, "title or folder required")
+
+// ── Section 5: PATCH /api/sessions/:id — empty body (missing fields) ──────────
+
+println("")
+println("5. PATCH /api/sessions/:id — empty body returns field-required error")
+
+let patch_empty: String = handle_request("PATCH", "/api/sessions/test-sess-patch-3", "{}")
+assert_contains("PATCH empty body -> error field present", patch_empty, "\"error\"")
+assert_contains("PATCH empty body -> missing fields message", patch_empty, "title or folder required")
+
+// ── Section 6: PATCH /api/sessions (no id in path) -> 404 ────────────────────
+
+println("")
+println("6. PATCH /api/sessions (no id) -> 404")
+
+let patch_no_id: String = handle_request("PATCH", "/api/sessions", "{\"title\":\"x\"}")
+assert_contains("PATCH no id -> 404 error", patch_no_id, "\"error\"")
+
+// ── Section 7: GET /api/sessions — session_list regression ───────────────────
+//
+// After removal of the duplicate route_sessions() GET handler in routes.el,
+// GET /api/sessions must still return a valid JSON array (possibly empty) from
+// session_list(). Verifies the deduplication fix does not break the endpoint.
+
+println("")
+println("7. GET /api/sessions — session_list() returns valid JSON array")
+
+let get_sessions: String = handle_request("GET", "/api/sessions", "")
+assert_true("GET /api/sessions -> response is non-empty", str_len(get_sessions) > 0)
+// Result must be a JSON array (starts with '[')
+let first_char: String = str_slice(get_sessions, 0, 1)
+assert_eq("GET /api/sessions -> response is a JSON array", first_char, "[")
+
+// ── Section 8: DELETE then GET — session_index cache invalidation ─────────────
+//
+// After a DELETE, session_list() must not return the deleted session.
+// Since we don't have a real session to delete in this test environment,
+// we verify the GET still returns an array after the DELETE attempt.
+
+println("")
+println("8. GET /api/sessions after DELETE attempt -> still returns valid array")
+
+let del_first: String = handle_request("DELETE", "/api/sessions/test-cache-inval-sess", "")
+assert_contains("pre-DELETE: ok field present", del_first, "\"ok\"")
+
+let get_after_del: String = handle_request("GET", "/api/sessions", "")
+let first_char2: String = str_slice(get_after_del, 0, 1)
+assert_eq("GET after DELETE -> still returns JSON array", first_char2, "[")
+
+// ── Summary ────────────────────────────────────────────────────────────────────
+
+println("")
+println("test_sessions_routes.el: " + int_to_str(pass_count) + " passed, " + int_to_str(fail_count) + " failed")