ci: gate the Linux soul on the contract before publishing

Wire the soul contract gate into ci.yaml as a hard block between the cc build and the Publish-to-Artifact-Registry step. A non-zero gate fails the build, so a stale (route-404ing) or memory-destroying (hard-deleting) soul can never publish neuron-soul to foundation-prod or blue-green deploy to GKE — the same class-fix now guarding the desktop builds, extended to prod. Vendors scripts/verify-soul-contract.sh (copied from neuron-ui; the route contract is baked in, so it's portable POSIX bash/curl with no neuron-ui source dependency). It boots dist/neuron on a throwaway port with a throwaway HOME/engram/cgi — never touching ~/.neuron or any live service — and checks PRESENCE (every app route answered) + IMMUTABILITY (no engram write route hard-deletes; deletes/forgets tombstone). Adds curl to the build deps for the probe.
Tombstone the remaining forget paths (close the immutability arc)
2026-07-18 13:31:33 -05:00 · 2026-07-18 13:22:43 -05:00 · 2026-07-17 16:57:55 -05:00 · 2026-07-17 16:42:30 -05:00
10 changed files with 778 additions and 269 deletions
@@ -34,7 +34,7 @@ jobs:
      - name: Install build dependencies
        run: |
          apt-get update -qq
-          apt-get install -y gcc libcurl4-openssl-dev apt-transport-https ca-certificates
+          apt-get install -y gcc curl libcurl4-openssl-dev apt-transport-https ca-certificates
          echo "deb [trusted=yes] https://packages.cloud.google.com/apt cloud-sdk main" \
            > /etc/apt/sources.list.d/google-cloud-sdk.list
          apt-get update -qq && apt-get install -y google-cloud-cli
@@ -107,6 +107,17 @@ jobs:
          strip -s dist/neuron
          ls -lh dist/neuron

+      - name: Soul contract gate (HARD BLOCK — no destructive/stale soul publishes)
+        run: |
+          # Boots dist/neuron on a throwaway port with a throwaway HOME/engram/cgi
+          # (never touches ~/.neuron or any live service) and fails the build if any
+          # app-contract route is unanswered (PRESENCE) or any engram write route
+          # hard-deletes instead of tombstoning/superseding (IMMUTABILITY). Non-zero
+          # here blocks Publish -> Artifact Registry -> GKE deploy, so a stale or
+          # memory-destroying soul can never reach prod.
+          chmod +x dist/neuron scripts/verify-soul-contract.sh
+          bash scripts/verify-soul-contract.sh dist/neuron 7796
+
      - name: Smoke test
        run: |
          file dist/neuron
@@ -446,8 +446,10 @@ fn respond(action_json: String) -> String {
    }

    if str_eq(kind, "forget") {
-        engram_forget(payload)
-        return "{\"outcome\":\"forgotten\",\"id\":\"" + payload + "\"}"
+        // The soul must NOT be able to autonomously hard-delete a memory.
+        // Tombstone instead (keep node + edges, recoverable).
+        let _marker: String = mem_tombstone(payload)
+        return "{\"outcome\":\"tombstoned\",\"id\":\"" + payload + "\"}"
    }

    return "{\"outcome\":\"noop\"}"
@@ -10,6 +10,7 @@ el_val_t mem_remember(el_val_t content, el_val_t tags);
 el_val_t mem_recall(el_val_t query, el_val_t depth);
 el_val_t mem_search(el_val_t query, el_val_t limit);
 el_val_t mem_strengthen(el_val_t node_id);
+el_val_t mem_tombstone(el_val_t node_id);
 el_val_t mem_forget(el_val_t node_id);
 el_val_t mem_consolidate(void);
 el_val_t mem_save(el_val_t path);
@@ -362,8 +363,8 @@ el_val_t respond(el_val_t action_json) {
    return el_str_concat(el_str_concat(EL_STR("{\"outcome\":\"strengthened\",\"id\":\""), payload), EL_STR("\"}"));
  }
  if (str_eq(kind, EL_STR("forget"))) {
-    engram_forget(payload);
-    return el_str_concat(el_str_concat(EL_STR("{\"outcome\":\"forgotten\",\"id\":\""), payload), EL_STR("\"}"));
+    el_val_t _marker = mem_tombstone(payload);
+    return el_str_concat(el_str_concat(EL_STR("{\"outcome\":\"tombstoned\",\"id\":\""), payload), EL_STR("\"}"));
  }
  return EL_STR("{\"outcome\":\"noop\"}");
  return 0;
@@ -10,6 +10,7 @@ el_val_t mem_remember(el_val_t content, el_val_t tags);
 el_val_t mem_recall(el_val_t query, el_val_t depth);
 el_val_t mem_search(el_val_t query, el_val_t limit);
 el_val_t mem_strengthen(el_val_t node_id);
+el_val_t mem_tombstone(el_val_t node_id);
 el_val_t mem_forget(el_val_t node_id);
 el_val_t mem_consolidate(void);
 el_val_t mem_save(el_val_t path);
@@ -69,8 +70,18 @@ el_val_t mem_strengthen(el_val_t node_id) {
  return 0;
 }

+el_val_t mem_tombstone(el_val_t node_id) {
+  el_val_t tags = EL_STR("[\"Tombstone\",\"status:deleted\"]");
+  el_val_t marker = engram_node_full(node_id, EL_STR("Tombstone"), el_str_concat(EL_STR("tombstone:"), node_id), el_from_float(0.01), el_from_float(0.01), el_from_float(1.0), EL_STR("Episodic"), tags);
+  if (!str_eq(marker, EL_STR(""))) {
+    engram_connect(marker, node_id, el_from_float(1.0), EL_STR("tombstones"));
+  }
+  return marker;
+  return 0;
+}
+
 el_val_t mem_forget(el_val_t node_id) {
-  engram_forget(node_id);
+  el_val_t _marker = mem_tombstone(node_id);
  return 0;
 }

@@ -10,6 +10,7 @@ el_val_t mem_remember(el_val_t content, el_val_t tags);
 el_val_t mem_recall(el_val_t query, el_val_t depth);
 el_val_t mem_search(el_val_t query, el_val_t limit);
 el_val_t mem_strengthen(el_val_t node_id);
+el_val_t mem_tombstone(el_val_t node_id);
 el_val_t mem_forget(el_val_t node_id);
 el_val_t mem_consolidate(void);
 el_val_t mem_save(el_val_t path);
@@ -28,6 +29,9 @@ el_val_t api_nonempty(el_val_t s);
 el_val_t api_or_empty(el_val_t s);
 el_val_t api_persisted(el_val_t id);
 el_val_t api_not_persisted(el_val_t id);
+el_val_t tombstone_node(el_val_t id);
+el_val_t tombstoned_id_set(void);
+el_val_t memory_hide_tombstoned(el_val_t raw, el_val_t path);
 el_val_t handle_api_begin_session(el_val_t body);
 el_val_t handle_api_compile_ctx(el_val_t body);
 el_val_t handle_api_remember(el_val_t body);
@@ -189,6 +193,61 @@ el_val_t api_not_persisted(el_val_t id) {
  return 0;
 }

+el_val_t tombstone_node(el_val_t id) {
+  return mem_tombstone(id);
+  return 0;
+}
+
+el_val_t tombstoned_id_set(void) {
+  el_val_t markers = engram_scan_nodes_by_type_json(EL_STR("Tombstone"), 5000, 0);
+  if (str_eq(markers, EL_STR("")) || str_eq(markers, EL_STR("[]"))) {
+    return EL_STR("");
+  }
+  el_val_t n = json_array_len(markers);
+  el_val_t acc = EL_STR("|");
+  el_val_t i = 0;
+  while (i < n) {
+    el_val_t m = json_array_get(markers, i);
+    el_val_t tid = json_get(m, EL_STR("content"));
+    acc = ({ el_val_t _if_result_1 = 0; if (str_eq(tid, EL_STR(""))) { _if_result_1 = (acc); } else { _if_result_1 = (el_str_concat(el_str_concat(acc, tid), EL_STR("|"))); } _if_result_1; });
+    i = (i + 1);
+  }
+  return acc;
+  return 0;
+}
+
+el_val_t memory_hide_tombstoned(el_val_t raw, el_val_t path) {
+  if (str_contains(path, EL_STR("include_deleted"))) {
+    return raw;
+  }
+  if (str_eq(raw, EL_STR("")) || str_eq(raw, EL_STR("[]"))) {
+    return raw;
+  }
+  el_val_t dead = tombstoned_id_set();
+  if (str_eq(dead, EL_STR(""))) {
+    return raw;
+  }
+  el_val_t n = json_array_len(raw);
+  if (n > 1000) {
+    return raw;
+  }
+  el_val_t out = EL_STR("[");
+  el_val_t first = 1;
+  el_val_t i = 0;
+  while (i < n) {
+    el_val_t node = json_array_get(raw, i);
+    el_val_t nid = json_get(node, EL_STR("id"));
+    el_val_t ntype = json_get(node, EL_STR("node_type"));
+    el_val_t is_dead = (!str_eq(nid, EL_STR("")) && str_contains(dead, el_str_concat(el_str_concat(EL_STR("|"), nid), EL_STR("|"))));
+    el_val_t keep = (!str_eq(ntype, EL_STR("Tombstone")) && !is_dead);
+    out = ({ el_val_t _if_result_2 = 0; if (keep) { _if_result_2 = (({ el_val_t _if_result_3 = 0; if (first) { _if_result_3 = (el_str_concat(out, node)); } else { _if_result_3 = (el_str_concat(el_str_concat(out, EL_STR(",")), node)); } _if_result_3; })); } else { _if_result_2 = (out); } _if_result_2; });
+    first = ({ el_val_t _if_result_4 = 0; if (keep) { _if_result_4 = (0); } else { _if_result_4 = (first); } _if_result_4; });
+    i = (i + 1);
+  }
+  return el_str_concat(out, EL_STR("]"));
+  return 0;
+}
+
 el_val_t handle_api_begin_session(el_val_t body) {
  el_val_t stats = engram_stats_json();
  el_val_t activated = engram_activate_json(EL_STR("session start recent memory important"), 2);
@@ -215,10 +274,10 @@ el_val_t handle_api_remember(el_val_t body) {
  el_val_t importance = json_get(body, EL_STR("importance"));
  el_val_t tags_raw = json_get(body, EL_STR("tags"));
  el_val_t project = json_get(body, EL_STR("project"));
-  el_val_t sal_str = ({ el_val_t _if_result_1 = 0; if (str_eq(importance, EL_STR("critical"))) { _if_result_1 = (EL_STR("0.95")); } else { _if_result_1 = (({ el_val_t _if_result_2 = 0; if (str_eq(importance, EL_STR("high"))) { _if_result_2 = (EL_STR("0.75")); } else { _if_result_2 = (({ el_val_t _if_result_3 = 0; if (str_eq(importance, EL_STR("low"))) { _if_result_3 = (EL_STR("0.25")); } else { _if_result_3 = (EL_STR("0.50")); } _if_result_3; })); } _if_result_2; })); } _if_result_1; });
-  el_val_t sal = ({ el_val_t _if_result_4 = 0; if (str_eq(sal_str, EL_STR("0.95"))) { _if_result_4 = (el_from_float(0.95)); } else { _if_result_4 = (({ el_val_t _if_result_5 = 0; if (str_eq(sal_str, EL_STR("0.75"))) { _if_result_5 = (el_from_float(0.75)); } else { _if_result_5 = (({ el_val_t _if_result_6 = 0; if (str_eq(sal_str, EL_STR("0.25"))) { _if_result_6 = (el_from_float(0.25)); } else { _if_result_6 = (el_from_float(0.5)); } _if_result_6; })); } _if_result_5; })); } _if_result_4; });
-  el_val_t base_tags = ({ el_val_t _if_result_7 = 0; if (str_eq(tags_raw, EL_STR(""))) { _if_result_7 = (EL_STR("[\"Memory\"]")); } else { _if_result_7 = (tags_raw); } _if_result_7; });
-  el_val_t final_tags = ({ el_val_t _if_result_8 = 0; if (str_eq(project, EL_STR(""))) { _if_result_8 = (base_tags); } else { el_val_t inner = str_slice(base_tags, 1, (str_len(base_tags) - 1)); _if_result_8 = (el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("["), inner), EL_STR(",\"project:")), project), EL_STR("\"]"))); } _if_result_8; });
+  el_val_t sal_str = ({ el_val_t _if_result_5 = 0; if (str_eq(importance, EL_STR("critical"))) { _if_result_5 = (EL_STR("0.95")); } else { _if_result_5 = (({ el_val_t _if_result_6 = 0; if (str_eq(importance, EL_STR("high"))) { _if_result_6 = (EL_STR("0.75")); } else { _if_result_6 = (({ el_val_t _if_result_7 = 0; if (str_eq(importance, EL_STR("low"))) { _if_result_7 = (EL_STR("0.25")); } else { _if_result_7 = (EL_STR("0.50")); } _if_result_7; })); } _if_result_6; })); } _if_result_5; });
+  el_val_t sal = ({ el_val_t _if_result_8 = 0; if (str_eq(sal_str, EL_STR("0.95"))) { _if_result_8 = (el_from_float(0.95)); } else { _if_result_8 = (({ el_val_t _if_result_9 = 0; if (str_eq(sal_str, EL_STR("0.75"))) { _if_result_9 = (el_from_float(0.75)); } else { _if_result_9 = (({ el_val_t _if_result_10 = 0; if (str_eq(sal_str, EL_STR("0.25"))) { _if_result_10 = (el_from_float(0.25)); } else { _if_result_10 = (el_from_float(0.5)); } _if_result_10; })); } _if_result_9; })); } _if_result_8; });
+  el_val_t base_tags = ({ el_val_t _if_result_11 = 0; if (str_eq(tags_raw, EL_STR(""))) { _if_result_11 = (EL_STR("[\"Memory\"]")); } else { _if_result_11 = (tags_raw); } _if_result_11; });
+  el_val_t final_tags = ({ el_val_t _if_result_12 = 0; if (str_eq(project, EL_STR(""))) { _if_result_12 = (base_tags); } else { el_val_t inner = str_slice(base_tags, 1, (str_len(base_tags) - 1)); _if_result_12 = (el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("["), inner), EL_STR(",\"project:")), project), EL_STR("\"]"))); } _if_result_12; });
  el_val_t id = engram_node_full(content, EL_STR("Memory"), EL_STR("memory:remembered"), el_from_float(sal), el_from_float(sal), el_from_float(0.9), EL_STR("Episodic"), final_tags);
  if (!api_persisted(id)) {
    return api_not_persisted(id);
@@ -233,15 +292,15 @@ el_val_t handle_api_node_create(el_val_t body) {
    return api_err(EL_STR("content is required"));
  }
  el_val_t nt_raw = json_get(body, EL_STR("node_type"));
-  el_val_t node_type = ({ el_val_t _if_result_9 = 0; if (str_eq(nt_raw, EL_STR(""))) { _if_result_9 = (EL_STR("Memory")); } else { _if_result_9 = (nt_raw); } _if_result_9; });
+  el_val_t node_type = ({ el_val_t _if_result_13 = 0; if (str_eq(nt_raw, EL_STR(""))) { _if_result_13 = (EL_STR("Memory")); } else { _if_result_13 = (nt_raw); } _if_result_13; });
  el_val_t label_raw = json_get(body, EL_STR("label"));
-  el_val_t label = ({ el_val_t _if_result_10 = 0; if (str_eq(label_raw, EL_STR(""))) { _if_result_10 = (EL_STR("node:created")); } else { _if_result_10 = (label_raw); } _if_result_10; });
+  el_val_t label = ({ el_val_t _if_result_14 = 0; if (str_eq(label_raw, EL_STR(""))) { _if_result_14 = (EL_STR("node:created")); } else { _if_result_14 = (label_raw); } _if_result_14; });
  el_val_t tier_raw = json_get(body, EL_STR("tier"));
-  el_val_t tier = ({ el_val_t _if_result_11 = 0; if (str_eq(tier_raw, EL_STR(""))) { _if_result_11 = (EL_STR("Episodic")); } else { _if_result_11 = (tier_raw); } _if_result_11; });
+  el_val_t tier = ({ el_val_t _if_result_15 = 0; if (str_eq(tier_raw, EL_STR(""))) { _if_result_15 = (EL_STR("Episodic")); } else { _if_result_15 = (tier_raw); } _if_result_15; });
  el_val_t tags_raw = json_get(body, EL_STR("tags"));
-  el_val_t tags = ({ el_val_t _if_result_12 = 0; if (str_eq(tags_raw, EL_STR(""))) { _if_result_12 = (el_str_concat(el_str_concat(EL_STR("[\""), node_type), EL_STR("\"]"))); } else { _if_result_12 = (tags_raw); } _if_result_12; });
+  el_val_t tags = ({ el_val_t _if_result_16 = 0; if (str_eq(tags_raw, EL_STR(""))) { _if_result_16 = (el_str_concat(el_str_concat(EL_STR("[\""), node_type), EL_STR("\"]"))); } else { _if_result_16 = (tags_raw); } _if_result_16; });
  el_val_t importance = json_get(body, EL_STR("importance"));
-  el_val_t sal = ({ el_val_t _if_result_13 = 0; if (str_eq(importance, EL_STR("critical"))) { _if_result_13 = (el_from_float(0.95)); } else { _if_result_13 = (({ el_val_t _if_result_14 = 0; if (str_eq(importance, EL_STR("high"))) { _if_result_14 = (el_from_float(0.75)); } else { _if_result_14 = (({ el_val_t _if_result_15 = 0; if (str_eq(importance, EL_STR("low"))) { _if_result_15 = (el_from_float(0.25)); } else { _if_result_15 = (el_from_float(0.5)); } _if_result_15; })); } _if_result_14; })); } _if_result_13; });
+  el_val_t sal = ({ el_val_t _if_result_17 = 0; if (str_eq(importance, EL_STR("critical"))) { _if_result_17 = (el_from_float(0.95)); } else { _if_result_17 = (({ el_val_t _if_result_18 = 0; if (str_eq(importance, EL_STR("high"))) { _if_result_18 = (el_from_float(0.75)); } else { _if_result_18 = (({ el_val_t _if_result_19 = 0; if (str_eq(importance, EL_STR("low"))) { _if_result_19 = (el_from_float(0.25)); } else { _if_result_19 = (el_from_float(0.5)); } _if_result_19; })); } _if_result_18; })); } _if_result_17; });
  el_val_t id = engram_node_full(content, node_type, label, el_from_float(sal), el_from_float(sal), el_from_float(0.9), tier, tags);
  if (!api_persisted(id)) {
    return api_not_persisted(id);
@@ -255,8 +314,18 @@ el_val_t handle_api_node_delete(el_val_t body) {
  if (str_eq(id, EL_STR(""))) {
    return api_err(EL_STR("id is required"));
  }
-  engram_forget(id);
-  return el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"id\":\""), id), EL_STR("\"}"));
+  if (is_protected_node(id)) {
+    return api_err_protected(id);
+  }
+  el_val_t existing = engram_get_node_json(id);
+  if (str_eq(existing, EL_STR("{}"))) {
+    return api_err(el_str_concat(EL_STR("node not found: "), id));
+  }
+  el_val_t marker = tombstone_node(id);
+  if (str_eq(marker, EL_STR(""))) {
+    return api_err(el_str_concat(EL_STR("tombstone failed: "), id));
+  }
+  return el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"id\":\""), id), EL_STR("\",\"tombstoned\":true}"));
  return 0;
 }

@@ -270,37 +339,37 @@ el_val_t handle_api_node_update(el_val_t body) {
  }
  el_val_t old = engram_get_node_json(id);
  el_val_t body_content = json_get(body, EL_STR("content"));
-  el_val_t content = ({ el_val_t _if_result_16 = 0; if (str_eq(body_content, EL_STR(""))) { _if_result_16 = (json_get(old, EL_STR("content"))); } else { _if_result_16 = (body_content); } _if_result_16; });
+  el_val_t content = ({ el_val_t _if_result_20 = 0; if (str_eq(body_content, EL_STR(""))) { _if_result_20 = (json_get(old, EL_STR("content"))); } else { _if_result_20 = (body_content); } _if_result_20; });
  el_val_t body_nt = json_get(body, EL_STR("node_type"));
  el_val_t old_nt = json_get(old, EL_STR("node_type"));
-  el_val_t node_type = ({ el_val_t _if_result_17 = 0; if (!str_eq(body_nt, EL_STR(""))) { _if_result_17 = (body_nt); } else { _if_result_17 = (({ el_val_t _if_result_18 = 0; if (!str_eq(old_nt, EL_STR(""))) { _if_result_18 = (old_nt); } else { _if_result_18 = (EL_STR("Memory")); } _if_result_18; })); } _if_result_17; });
+  el_val_t node_type = ({ el_val_t _if_result_21 = 0; if (!str_eq(body_nt, EL_STR(""))) { _if_result_21 = (body_nt); } else { _if_result_21 = (({ el_val_t _if_result_22 = 0; if (!str_eq(old_nt, EL_STR(""))) { _if_result_22 = (old_nt); } else { _if_result_22 = (EL_STR("Memory")); } _if_result_22; })); } _if_result_21; });
  el_val_t body_label = json_get(body, EL_STR("label"));
  el_val_t old_label = json_get(old, EL_STR("label"));
-  el_val_t label = ({ el_val_t _if_result_19 = 0; if (!str_eq(body_label, EL_STR(""))) { _if_result_19 = (body_label); } else { _if_result_19 = (({ el_val_t _if_result_20 = 0; if (!str_eq(old_label, EL_STR(""))) { _if_result_20 = (old_label); } else { _if_result_20 = (EL_STR("node:updated")); } _if_result_20; })); } _if_result_19; });
+  el_val_t label = ({ el_val_t _if_result_23 = 0; if (!str_eq(body_label, EL_STR(""))) { _if_result_23 = (body_label); } else { _if_result_23 = (({ el_val_t _if_result_24 = 0; if (!str_eq(old_label, EL_STR(""))) { _if_result_24 = (old_label); } else { _if_result_24 = (EL_STR("node:updated")); } _if_result_24; })); } _if_result_23; });
  el_val_t body_tier = json_get(body, EL_STR("tier"));
  el_val_t old_tier = json_get(old, EL_STR("tier"));
-  el_val_t tier = ({ el_val_t _if_result_21 = 0; if (!str_eq(body_tier, EL_STR(""))) { _if_result_21 = (body_tier); } else { _if_result_21 = (({ el_val_t _if_result_22 = 0; if (!str_eq(old_tier, EL_STR(""))) { _if_result_22 = (old_tier); } else { _if_result_22 = (EL_STR("Episodic")); } _if_result_22; })); } _if_result_21; });
+  el_val_t tier = ({ el_val_t _if_result_25 = 0; if (!str_eq(body_tier, EL_STR(""))) { _if_result_25 = (body_tier); } else { _if_result_25 = (({ el_val_t _if_result_26 = 0; if (!str_eq(old_tier, EL_STR(""))) { _if_result_26 = (old_tier); } else { _if_result_26 = (EL_STR("Episodic")); } _if_result_26; })); } _if_result_25; });
  el_val_t body_tags = json_get(body, EL_STR("tags"));
-  el_val_t tags = ({ el_val_t _if_result_23 = 0; if (str_eq(body_tags, EL_STR(""))) { _if_result_23 = (el_str_concat(el_str_concat(EL_STR("[\""), node_type), EL_STR("\"]"))); } else { _if_result_23 = (body_tags); } _if_result_23; });
+  el_val_t tags = ({ el_val_t _if_result_27 = 0; if (str_eq(body_tags, EL_STR(""))) { _if_result_27 = (el_str_concat(el_str_concat(EL_STR("[\""), node_type), EL_STR("\"]"))); } else { _if_result_27 = (body_tags); } _if_result_27; });
  el_val_t new_id = engram_node_full(content, node_type, label, el_from_float(0.5), el_from_float(0.5), el_from_float(0.8), tier, tags);
  if (!api_persisted(new_id)) {
    return api_not_persisted(new_id);
  }
-  engram_forget(id);
-  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"id\":\""), new_id), EL_STR("\",\"replaced\":\"")), id), EL_STR("\",\"ok\":true}"));
+  engram_connect(new_id, id, el_from_float(0.9), EL_STR("supersedes"));
+  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"id\":\""), new_id), EL_STR("\",\"supersedes\":\"")), id), EL_STR("\",\"ok\":true}"));
  return 0;
 }

 el_val_t handle_api_recall(el_val_t method, el_val_t path, el_val_t body) {
-  el_val_t url_q = ({ el_val_t _if_result_24 = 0; if (str_eq(api_query_param(path, EL_STR("query")), EL_STR(""))) { _if_result_24 = (api_query_param(path, EL_STR("q"))); } else { _if_result_24 = (api_query_param(path, EL_STR("query"))); } _if_result_24; });
+  el_val_t url_q = ({ el_val_t _if_result_28 = 0; if (str_eq(api_query_param(path, EL_STR("query")), EL_STR(""))) { _if_result_28 = (api_query_param(path, EL_STR("q"))); } else { _if_result_28 = (api_query_param(path, EL_STR("query"))); } _if_result_28; });
  el_val_t body_query = json_get(body, EL_STR("query"));
  el_val_t body_q = json_get(body, EL_STR("q"));
-  el_val_t q = ({ el_val_t _if_result_25 = 0; if (!str_eq(url_q, EL_STR(""))) { _if_result_25 = (url_q); } else { _if_result_25 = (({ el_val_t _if_result_26 = 0; if (!str_eq(body_query, EL_STR(""))) { _if_result_26 = (body_query); } else { _if_result_26 = (body_q); } _if_result_26; })); } _if_result_25; });
+  el_val_t q = ({ el_val_t _if_result_29 = 0; if (!str_eq(url_q, EL_STR(""))) { _if_result_29 = (url_q); } else { _if_result_29 = (({ el_val_t _if_result_30 = 0; if (!str_eq(body_query, EL_STR(""))) { _if_result_30 = (body_query); } else { _if_result_30 = (body_q); } _if_result_30; })); } _if_result_29; });
  el_val_t chain = json_get(body, EL_STR("chain_name"));
  el_val_t limit = api_query_int(path, EL_STR("limit"), 0);
-  limit = ({ el_val_t _if_result_27 = 0; if ((limit == 0)) { _if_result_27 = (json_get_int(body, EL_STR("limit"))); } else { _if_result_27 = (limit); } _if_result_27; });
-  limit = ({ el_val_t _if_result_28 = 0; if ((limit == 0)) { _if_result_28 = (10); } else { _if_result_28 = (limit); } _if_result_28; });
-  el_val_t eff_q = ({ el_val_t _if_result_29 = 0; if (str_eq(q, EL_STR(""))) { _if_result_29 = (chain); } else { _if_result_29 = (q); } _if_result_29; });
+  limit = ({ el_val_t _if_result_31 = 0; if ((limit == 0)) { _if_result_31 = (json_get_int(body, EL_STR("limit"))); } else { _if_result_31 = (limit); } _if_result_31; });
+  limit = ({ el_val_t _if_result_32 = 0; if ((limit == 0)) { _if_result_32 = (10); } else { _if_result_32 = (limit); } _if_result_32; });
+  el_val_t eff_q = ({ el_val_t _if_result_33 = 0; if (str_eq(q, EL_STR(""))) { _if_result_33 = (chain); } else { _if_result_33 = (q); } _if_result_33; });
  if (str_eq(eff_q, EL_STR(""))) {
    return api_or_empty(engram_scan_nodes_json(limit, 0));
  }
@@ -313,10 +382,10 @@ el_val_t handle_api_search_knowledge(el_val_t method, el_val_t path, el_val_t bo
  el_val_t url_q = api_query_param(path, EL_STR("q"));
  el_val_t body_query = json_get(body, EL_STR("query"));
  el_val_t body_q = json_get(body, EL_STR("q"));
-  el_val_t q = ({ el_val_t _if_result_30 = 0; if (!str_eq(url_q, EL_STR(""))) { _if_result_30 = (url_q); } else { _if_result_30 = (({ el_val_t _if_result_31 = 0; if (!str_eq(body_query, EL_STR(""))) { _if_result_31 = (body_query); } else { _if_result_31 = (body_q); } _if_result_31; })); } _if_result_30; });
+  el_val_t q = ({ el_val_t _if_result_34 = 0; if (!str_eq(url_q, EL_STR(""))) { _if_result_34 = (url_q); } else { _if_result_34 = (({ el_val_t _if_result_35 = 0; if (!str_eq(body_query, EL_STR(""))) { _if_result_35 = (body_query); } else { _if_result_35 = (body_q); } _if_result_35; })); } _if_result_34; });
  el_val_t limit = api_query_int(path, EL_STR("limit"), 0);
-  limit = ({ el_val_t _if_result_32 = 0; if ((limit == 0)) { _if_result_32 = (json_get_int(body, EL_STR("limit"))); } else { _if_result_32 = (limit); } _if_result_32; });
-  limit = ({ el_val_t _if_result_33 = 0; if ((limit == 0)) { _if_result_33 = (10); } else { _if_result_33 = (limit); } _if_result_33; });
+  limit = ({ el_val_t _if_result_36 = 0; if ((limit == 0)) { _if_result_36 = (json_get_int(body, EL_STR("limit"))); } else { _if_result_36 = (limit); } _if_result_36; });
+  limit = ({ el_val_t _if_result_37 = 0; if ((limit == 0)) { _if_result_37 = (10); } else { _if_result_37 = (limit); } _if_result_37; });
  if (str_eq(q, EL_STR(""))) {
    return api_err(EL_STR("query is required"));
  }
@@ -344,7 +413,7 @@ el_val_t handle_api_capture_knowledge(el_val_t body) {
  if (str_eq(content, EL_STR(""))) {
    return api_err(EL_STR("content is required"));
  }
-  el_val_t full = ({ el_val_t _if_result_34 = 0; if (str_eq(title, EL_STR(""))) { _if_result_34 = (content); } else { _if_result_34 = (el_str_concat(el_str_concat(title, EL_STR(": ")), content)); } _if_result_34; });
+  el_val_t full = ({ el_val_t _if_result_38 = 0; if (str_eq(title, EL_STR(""))) { _if_result_38 = (content); } else { _if_result_38 = (el_str_concat(el_str_concat(title, EL_STR(": ")), content)); } _if_result_38; });
  el_val_t tags = EL_STR("[\"Knowledge\",\"captured\"]");
  el_val_t id = engram_node_full(full, EL_STR("Knowledge"), EL_STR("knowledge:captured"), el_from_float(0.85), el_from_float(0.8), el_from_float(0.9), EL_STR("Episodic"), tags);
  if (!api_persisted(id)) {
@@ -385,7 +454,7 @@ el_val_t handle_api_promote_knowledge(el_val_t body) {
    return api_err(EL_STR("id (prior node) is required"));
  }
  el_val_t tags_raw = json_get(body, EL_STR("tags"));
-  el_val_t tags = ({ el_val_t _if_result_35 = 0; if (str_eq(tags_raw, EL_STR(""))) { _if_result_35 = (EL_STR("[\"Knowledge\",\"tier:canonical\",\"disposition:stable\"]")); } else { _if_result_35 = (tags_raw); } _if_result_35; });
+  el_val_t tags = ({ el_val_t _if_result_39 = 0; if (str_eq(tags_raw, EL_STR(""))) { _if_result_39 = (EL_STR("[\"Knowledge\",\"tier:canonical\",\"disposition:stable\"]")); } else { _if_result_39 = (tags_raw); } _if_result_39; });
  el_val_t new_id = engram_node_full(content, EL_STR("Knowledge"), EL_STR("knowledge:canonical"), el_from_float(0.9), el_from_float(0.9), el_from_float(1.0), EL_STR("Canonical"), tags);
  if (!api_persisted(new_id)) {
    return api_not_persisted(new_id);
@@ -396,7 +465,7 @@ el_val_t handle_api_promote_knowledge(el_val_t body) {
 }

 el_val_t handle_api_browse_processes(el_val_t method, el_val_t path, el_val_t body) {
-  el_val_t name = ({ el_val_t _if_result_36 = 0; if (str_eq(method, EL_STR("GET"))) { _if_result_36 = (api_query_param(path, EL_STR("name"))); } else { _if_result_36 = (json_get(body, EL_STR("name"))); } _if_result_36; });
+  el_val_t name = ({ el_val_t _if_result_40 = 0; if (str_eq(method, EL_STR("GET"))) { _if_result_40 = (api_query_param(path, EL_STR("name"))); } else { _if_result_40 = (json_get(body, EL_STR("name"))); } _if_result_40; });
  el_val_t limit = api_query_int(path, EL_STR("limit"), 50);
  if (str_eq(name, EL_STR(""))) {
    return api_or_empty(engram_scan_nodes_by_type_json(EL_STR("Process"), limit, 0));
@@ -411,7 +480,7 @@ el_val_t handle_api_define_process(el_val_t body) {
  if (str_eq(content, EL_STR(""))) {
    return api_err(EL_STR("content is required"));
  }
-  el_val_t label = ({ el_val_t _if_result_37 = 0; if (str_eq(name, EL_STR(""))) { _if_result_37 = (EL_STR("process:unnamed")); } else { _if_result_37 = (el_str_concat(EL_STR("process:"), name)); } _if_result_37; });
+  el_val_t label = ({ el_val_t _if_result_41 = 0; if (str_eq(name, EL_STR(""))) { _if_result_41 = (EL_STR("process:unnamed")); } else { _if_result_41 = (el_str_concat(EL_STR("process:"), name)); } _if_result_41; });
  el_val_t tags = EL_STR("[\"Process\"]");
  el_val_t id = engram_node_full(content, EL_STR("Process"), label, el_from_float(0.8), el_from_float(0.8), el_from_float(0.9), EL_STR("Canonical"), tags);
  if (!api_persisted(id)) {
@@ -429,12 +498,12 @@ el_val_t handle_api_log_state_event(el_val_t body) {
  el_val_t gap = json_get(body, EL_STR("gap_direction"));
  el_val_t legacy = json_get(body, EL_STR("content"));
  el_val_t parts = EL_STR("INTERNAL STATE EVENT");
-  parts = ({ el_val_t _if_result_38 = 0; if (!str_eq(trigger, EL_STR(""))) { _if_result_38 = (el_str_concat(el_str_concat(parts, EL_STR("\nTrigger: ")), trigger)); } else { _if_result_38 = (parts); } _if_result_38; });
-  parts = ({ el_val_t _if_result_39 = 0; if (!str_eq(pre, EL_STR(""))) { _if_result_39 = (el_str_concat(el_str_concat(parts, EL_STR("\nPre-reasoning: ")), pre)); } else { _if_result_39 = (parts); } _if_result_39; });
-  parts = ({ el_val_t _if_result_40 = 0; if (!str_eq(post, EL_STR(""))) { _if_result_40 = (el_str_concat(el_str_concat(parts, EL_STR("\nPost-reasoning: ")), post)); } else { _if_result_40 = (parts); } _if_result_40; });
-  parts = ({ el_val_t _if_result_41 = 0; if (!str_eq(ratio, EL_STR(""))) { _if_result_41 = (el_str_concat(el_str_concat(parts, EL_STR("\nCompression-ratio: ")), ratio)); } else { _if_result_41 = (parts); } _if_result_41; });
-  parts = ({ el_val_t _if_result_42 = 0; if (!str_eq(gap, EL_STR(""))) { _if_result_42 = (el_str_concat(el_str_concat(parts, EL_STR("\nGap-direction: ")), gap)); } else { _if_result_42 = (parts); } _if_result_42; });
-  parts = ({ el_val_t _if_result_43 = 0; if (!str_eq(legacy, EL_STR(""))) { _if_result_43 = (el_str_concat(el_str_concat(parts, EL_STR("\n")), legacy)); } else { _if_result_43 = (parts); } _if_result_43; });
+  parts = ({ el_val_t _if_result_42 = 0; if (!str_eq(trigger, EL_STR(""))) { _if_result_42 = (el_str_concat(el_str_concat(parts, EL_STR("\nTrigger: ")), trigger)); } else { _if_result_42 = (parts); } _if_result_42; });
+  parts = ({ el_val_t _if_result_43 = 0; if (!str_eq(pre, EL_STR(""))) { _if_result_43 = (el_str_concat(el_str_concat(parts, EL_STR("\nPre-reasoning: ")), pre)); } else { _if_result_43 = (parts); } _if_result_43; });
+  parts = ({ el_val_t _if_result_44 = 0; if (!str_eq(post, EL_STR(""))) { _if_result_44 = (el_str_concat(el_str_concat(parts, EL_STR("\nPost-reasoning: ")), post)); } else { _if_result_44 = (parts); } _if_result_44; });
+  parts = ({ el_val_t _if_result_45 = 0; if (!str_eq(ratio, EL_STR(""))) { _if_result_45 = (el_str_concat(el_str_concat(parts, EL_STR("\nCompression-ratio: ")), ratio)); } else { _if_result_45 = (parts); } _if_result_45; });
+  parts = ({ el_val_t _if_result_46 = 0; if (!str_eq(gap, EL_STR(""))) { _if_result_46 = (el_str_concat(el_str_concat(parts, EL_STR("\nGap-direction: ")), gap)); } else { _if_result_46 = (parts); } _if_result_46; });
+  parts = ({ el_val_t _if_result_47 = 0; if (!str_eq(legacy, EL_STR(""))) { _if_result_47 = (el_str_concat(el_str_concat(parts, EL_STR("\n")), legacy)); } else { _if_result_47 = (parts); } _if_result_47; });
  el_val_t ts = time_now();
  el_val_t boot = state_get(EL_STR("soul_boot_count"));
  el_val_t tags = EL_STR("[\"internal-state\",\"InternalStateEvent\",\"pre-reasoning\"]");
@@ -447,7 +516,7 @@ el_val_t handle_api_log_state_event(el_val_t body) {
 }

 el_val_t handle_api_list_state_events(el_val_t method, el_val_t path, el_val_t body) {
-  el_val_t q = ({ el_val_t _if_result_44 = 0; if (str_eq(method, EL_STR("GET"))) { _if_result_44 = (api_query_param(path, EL_STR("query"))); } else { _if_result_44 = (json_get(body, EL_STR("query"))); } _if_result_44; });
+  el_val_t q = ({ el_val_t _if_result_48 = 0; if (str_eq(method, EL_STR("GET"))) { _if_result_48 = (api_query_param(path, EL_STR("query"))); } else { _if_result_48 = (json_get(body, EL_STR("query"))); } _if_result_48; });
  el_val_t limit = api_query_int(path, EL_STR("limit"), 20);
  if (!str_eq(q, EL_STR(""))) {
    return api_or_empty(engram_search_json(el_str_concat(EL_STR("internal state "), q), limit));
@@ -458,7 +527,7 @@ el_val_t handle_api_list_state_events(el_val_t method, el_val_t path, el_val_t b

 el_val_t handle_api_inspect_config(el_val_t path, el_val_t body) {
  el_val_t key = api_query_param(path, EL_STR("key"));
-  key = ({ el_val_t _if_result_45 = 0; if (str_eq(key, EL_STR(""))) { _if_result_45 = (json_get(body, EL_STR("key"))); } else { _if_result_45 = (key); } _if_result_45; });
+  key = ({ el_val_t _if_result_49 = 0; if (str_eq(key, EL_STR(""))) { _if_result_49 = (json_get(body, EL_STR("key"))); } else { _if_result_49 = (key); } _if_result_49; });
  if (str_eq(key, EL_STR(""))) {
    return EL_STR("{\"hint\":\"pass ?key=<name>\",\"known\":[\"neuron.self.traversal_root\",\"neuron.self.values_hub\"]}");
  }
@@ -475,7 +544,7 @@ el_val_t handle_api_inspect_config(el_val_t path, el_val_t body) {
  el_val_t node = json_array_get(results, 0);
  el_val_t content = json_get(node, EL_STR("content"));
  el_val_t prefix = el_str_concat(el_str_concat(EL_STR("config:"), key), EL_STR("="));
-  el_val_t value = ({ el_val_t _if_result_46 = 0; if (str_starts_with(content, prefix)) { _if_result_46 = (str_slice(content, str_len(prefix), str_len(content))); } else { _if_result_46 = (content); } _if_result_46; });
+  el_val_t value = ({ el_val_t _if_result_50 = 0; if (str_starts_with(content, prefix)) { _if_result_50 = (str_slice(content, str_len(prefix), str_len(content))); } else { _if_result_50 = (content); } _if_result_50; });
  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"key\":\""), key), EL_STR("\",\"value\":\"")), value), EL_STR("\"}"));
  return 0;
 }
@@ -497,13 +566,13 @@ el_val_t handle_api_tune_config(el_val_t body) {
 }

 el_val_t handle_api_inspect_graph(el_val_t method, el_val_t path, el_val_t body) {
-  el_val_t entity_id = ({ el_val_t _if_result_47 = 0; if (str_eq(method, EL_STR("GET"))) { _if_result_47 = (api_query_param(path, EL_STR("id"))); } else { _if_result_47 = (json_get(body, EL_STR("entity_id"))); } _if_result_47; });
-  el_val_t name = ({ el_val_t _if_result_48 = 0; if (str_eq(method, EL_STR("GET"))) { _if_result_48 = (api_query_param(path, EL_STR("name"))); } else { _if_result_48 = (json_get(body, EL_STR("name"))); } _if_result_48; });
+  el_val_t entity_id = ({ el_val_t _if_result_51 = 0; if (str_eq(method, EL_STR("GET"))) { _if_result_51 = (api_query_param(path, EL_STR("id"))); } else { _if_result_51 = (json_get(body, EL_STR("entity_id"))); } _if_result_51; });
+  el_val_t name = ({ el_val_t _if_result_52 = 0; if (str_eq(method, EL_STR("GET"))) { _if_result_52 = (api_query_param(path, EL_STR("name"))); } else { _if_result_52 = (json_get(body, EL_STR("name"))); } _if_result_52; });
  el_val_t depth = api_query_int(path, EL_STR("depth"), 0);
-  depth = ({ el_val_t _if_result_49 = 0; if ((depth == 0)) { _if_result_49 = (json_get_int(body, EL_STR("max_depth"))); } else { _if_result_49 = (depth); } _if_result_49; });
-  depth = ({ el_val_t _if_result_50 = 0; if ((depth == 0)) { _if_result_50 = (1); } else { _if_result_50 = (depth); } _if_result_50; });
+  depth = ({ el_val_t _if_result_53 = 0; if ((depth == 0)) { _if_result_53 = (json_get_int(body, EL_STR("max_depth"))); } else { _if_result_53 = (depth); } _if_result_53; });
+  depth = ({ el_val_t _if_result_54 = 0; if ((depth == 0)) { _if_result_54 = (1); } else { _if_result_54 = (depth); } _if_result_54; });
  el_val_t resolved = entity_id;
-  resolved = ({ el_val_t _if_result_51 = 0; if (str_eq(resolved, EL_STR(""))) { _if_result_51 = (({ el_val_t _if_result_52 = 0; if ((str_eq(name, EL_STR("self")) || str_eq(name, EL_STR("neuron")))) { _if_result_52 = (EL_STR("kn-efeb4a5b-5aff-4759-8a97-7233099be6ee")); } else { _if_result_52 = (({ el_val_t _if_result_53 = 0; if ((str_eq(name, EL_STR("values")) || str_eq(name, EL_STR("values_hub")))) { _if_result_53 = (EL_STR("kn-5b606390-a52d-4ca2-8e0e-eba141d13440")); } else { _if_result_53 = (EL_STR("")); } _if_result_53; })); } _if_result_52; })); } else { _if_result_51 = (resolved); } _if_result_51; });
+  resolved = ({ el_val_t _if_result_55 = 0; if (str_eq(resolved, EL_STR(""))) { _if_result_55 = (({ el_val_t _if_result_56 = 0; if ((str_eq(name, EL_STR("self")) || str_eq(name, EL_STR("neuron")))) { _if_result_56 = (EL_STR("kn-efeb4a5b-5aff-4759-8a97-7233099be6ee")); } else { _if_result_56 = (({ el_val_t _if_result_57 = 0; if ((str_eq(name, EL_STR("values")) || str_eq(name, EL_STR("values_hub")))) { _if_result_57 = (EL_STR("kn-5b606390-a52d-4ca2-8e0e-eba141d13440")); } else { _if_result_57 = (EL_STR("")); } _if_result_57; })); } _if_result_56; })); } else { _if_result_55 = (resolved); } _if_result_55; });
  if (str_eq(resolved, EL_STR(""))) {
    return api_err(EL_STR("entity_id or name required. Known names: self, neuron, values, values_hub"));
  }
@@ -525,7 +594,7 @@ el_val_t handle_api_link_entities(el_val_t body) {
    return api_err_protected(to_id);
  }
  el_val_t relation = json_get(body, EL_STR("relation"));
-  el_val_t eff_relation = ({ el_val_t _if_result_54 = 0; if (str_eq(relation, EL_STR(""))) { _if_result_54 = (EL_STR("associates")); } else { _if_result_54 = (relation); } _if_result_54; });
+  el_val_t eff_relation = ({ el_val_t _if_result_58 = 0; if (str_eq(relation, EL_STR(""))) { _if_result_58 = (EL_STR("associates")); } else { _if_result_58 = (relation); } _if_result_58; });
  engram_connect(from_id, to_id, el_from_float(0.5), eff_relation);
  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"from_id\":\""), from_id), EL_STR("\",\"to_id\":\"")), to_id), EL_STR("\",\"relation\":\"")), eff_relation), EL_STR("\"}"));
  return 0;
@@ -540,7 +609,7 @@ el_val_t handle_api_forget(el_val_t body) {
    return api_err_protected(node_id);
  }
  mem_forget(node_id);
-  return el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"id\":\""), node_id), EL_STR("\"}"));
+  return el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"id\":\""), node_id), EL_STR("\",\"tombstoned\":true}"));
  return 0;
 }

@@ -554,8 +623,8 @@ el_val_t handle_api_evolve_memory(el_val_t body) {
    return api_err_protected(prior_id);
  }
  el_val_t importance = json_get(body, EL_STR("importance"));
-  el_val_t sal_str = ({ el_val_t _if_result_55 = 0; if (str_eq(importance, EL_STR("critical"))) { _if_result_55 = (EL_STR("0.95")); } else { _if_result_55 = (({ el_val_t _if_result_56 = 0; if (str_eq(importance, EL_STR("high"))) { _if_result_56 = (EL_STR("0.75")); } else { _if_result_56 = (({ el_val_t _if_result_57 = 0; if (str_eq(importance, EL_STR("low"))) { _if_result_57 = (EL_STR("0.25")); } else { _if_result_57 = (EL_STR("0.50")); } _if_result_57; })); } _if_result_56; })); } _if_result_55; });
-  el_val_t sal = ({ el_val_t _if_result_58 = 0; if (str_eq(sal_str, EL_STR("0.95"))) { _if_result_58 = (el_from_float(0.95)); } else { _if_result_58 = (({ el_val_t _if_result_59 = 0; if (str_eq(sal_str, EL_STR("0.75"))) { _if_result_59 = (el_from_float(0.75)); } else { _if_result_59 = (({ el_val_t _if_result_60 = 0; if (str_eq(sal_str, EL_STR("0.25"))) { _if_result_60 = (el_from_float(0.25)); } else { _if_result_60 = (el_from_float(0.5)); } _if_result_60; })); } _if_result_59; })); } _if_result_58; });
+  el_val_t sal_str = ({ el_val_t _if_result_59 = 0; if (str_eq(importance, EL_STR("critical"))) { _if_result_59 = (EL_STR("0.95")); } else { _if_result_59 = (({ el_val_t _if_result_60 = 0; if (str_eq(importance, EL_STR("high"))) { _if_result_60 = (EL_STR("0.75")); } else { _if_result_60 = (({ el_val_t _if_result_61 = 0; if (str_eq(importance, EL_STR("low"))) { _if_result_61 = (EL_STR("0.25")); } else { _if_result_61 = (EL_STR("0.50")); } _if_result_61; })); } _if_result_60; })); } _if_result_59; });
+  el_val_t sal = ({ el_val_t _if_result_62 = 0; if (str_eq(sal_str, EL_STR("0.95"))) { _if_result_62 = (el_from_float(0.95)); } else { _if_result_62 = (({ el_val_t _if_result_63 = 0; if (str_eq(sal_str, EL_STR("0.75"))) { _if_result_63 = (el_from_float(0.75)); } else { _if_result_63 = (({ el_val_t _if_result_64 = 0; if (str_eq(sal_str, EL_STR("0.25"))) { _if_result_64 = (el_from_float(0.25)); } else { _if_result_64 = (el_from_float(0.5)); } _if_result_64; })); } _if_result_63; })); } _if_result_62; });
  el_val_t tags = EL_STR("[\"Memory\",\"evolved\"]");
  el_val_t new_id = engram_node_full(content, EL_STR("Memory"), EL_STR("memory:evolved"), el_from_float(sal), el_from_float(sal), el_from_float(0.9), EL_STR("Episodic"), tags);
  if (!str_eq(prior_id, EL_STR("")) && !str_eq(new_id, EL_STR(""))) {
@@ -577,8 +646,11 @@ el_val_t handle_api_memory_delete(el_val_t body) {
  if (str_eq(existing, EL_STR("{}"))) {
    return api_err(el_str_concat(EL_STR("memory not found: "), node_id));
  }
-  mem_forget(node_id);
-  return el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"id\":\""), node_id), EL_STR("\",\"deleted\":true}"));
+  el_val_t marker = tombstone_node(node_id);
+  if (str_eq(marker, EL_STR(""))) {
+    return api_err(el_str_concat(EL_STR("tombstone failed: "), node_id));
+  }
+  return el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"id\":\""), node_id), EL_STR("\",\"tombstoned\":true}"));
  return 0;
 }

@@ -627,7 +699,7 @@ el_val_t handle_api_cultivate(el_val_t body) {
      return api_err(EL_STR("content is required"));
    }
    el_val_t importance = json_get(body, EL_STR("importance"));
-    el_val_t sal = ({ el_val_t _if_result_61 = 0; if (str_eq(importance, EL_STR("critical"))) { _if_result_61 = (el_from_float(0.95)); } else { _if_result_61 = (({ el_val_t _if_result_62 = 0; if (str_eq(importance, EL_STR("high"))) { _if_result_62 = (el_from_float(0.75)); } else { _if_result_62 = (({ el_val_t _if_result_63 = 0; if (str_eq(importance, EL_STR("low"))) { _if_result_63 = (el_from_float(0.25)); } else { _if_result_63 = (el_from_float(0.5)); } _if_result_63; })); } _if_result_62; })); } _if_result_61; });
+    el_val_t sal = ({ el_val_t _if_result_65 = 0; if (str_eq(importance, EL_STR("critical"))) { _if_result_65 = (el_from_float(0.95)); } else { _if_result_65 = (({ el_val_t _if_result_66 = 0; if (str_eq(importance, EL_STR("high"))) { _if_result_66 = (el_from_float(0.75)); } else { _if_result_66 = (({ el_val_t _if_result_67 = 0; if (str_eq(importance, EL_STR("low"))) { _if_result_67 = (el_from_float(0.25)); } else { _if_result_67 = (el_from_float(0.5)); } _if_result_67; })); } _if_result_66; })); } _if_result_65; });
    el_val_t tags = EL_STR("[\"Memory\",\"evolved\",\"cultivated\"]");
    el_val_t new_id = engram_node_full(content, EL_STR("Memory"), EL_STR("memory:cultivated"), el_from_float(sal), el_from_float(sal), el_from_float(0.9), EL_STR("Episodic"), tags);
    if (!str_eq(prior_id, EL_STR("")) && !str_eq(new_id, EL_STR(""))) {
@@ -641,7 +713,7 @@ el_val_t handle_api_cultivate(el_val_t body) {
      return api_err(EL_STR("id is required"));
    }
    mem_forget(node_id);
-    return el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"id\":\""), node_id), EL_STR("\",\"cultivated\":true}"));
+    return el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"id\":\""), node_id), EL_STR("\",\"tombstoned\":true,\"cultivated\":true}"));
  }
  if (str_eq(op, EL_STR("link_entities"))) {
    el_val_t from_id = json_get(body, EL_STR("from_id"));
@@ -653,7 +725,7 @@ el_val_t handle_api_cultivate(el_val_t body) {
      return api_err(EL_STR("to_id is required"));
    }
    el_val_t relation = json_get(body, EL_STR("relation"));
-    el_val_t eff_relation = ({ el_val_t _if_result_64 = 0; if (str_eq(relation, EL_STR(""))) { _if_result_64 = (EL_STR("associates")); } else { _if_result_64 = (relation); } _if_result_64; });
+    el_val_t eff_relation = ({ el_val_t _if_result_68 = 0; if (str_eq(relation, EL_STR(""))) { _if_result_68 = (EL_STR("associates")); } else { _if_result_68 = (relation); } _if_result_68; });
    engram_connect(from_id, to_id, el_from_float(0.5), eff_relation);
    return el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"from_id\":\""), from_id), EL_STR("\",\"to_id\":\"")), to_id), EL_STR("\",\"relation\":\"")), eff_relation), EL_STR("\",\"cultivated\":true}"));
  }
@@ -663,7 +735,8 @@ el_val_t handle_api_cultivate(el_val_t body) {

 el_val_t handle_api_list_typed(el_val_t node_type, el_val_t path, el_val_t body) {
  el_val_t limit = api_query_int(path, EL_STR("limit"), 50);
-  return api_or_empty(engram_scan_nodes_by_type_json(node_type, limit, 0));
+  el_val_t raw = api_or_empty(engram_scan_nodes_by_type_json(node_type, limit, 0));
+  return memory_hide_tombstoned(raw, path);
  return 0;
 }

@@ -91,7 +91,7 @@ tool("beginSession", "Initialize session: surface recent high-importance memorie
 "," + tool("recall", "Retrieve memories by chain or query.") +
 "," + tool("inspectMemories", "List recent memory nodes.") +
 "," + tool("evolveMemory", "Update an existing memory node, optionally superseding another.") +
-"," + tool("forget", "Remove a node from memory.") +
+"," + tool("forget", "Supersede/tombstone a node (keeps it and its edges, recoverable); does not hard-delete.") +
 "," + tool("pinNode", "Strengthen a node so it stays salient.") +
 // ── Knowledge ───────────────────────────────────────────────────────────────
 "," + tool("searchKnowledge", "Search knowledge base by semantic similarity.") +
@@ -541,8 +541,12 @@ fn tool_forget(args: String) -> String {
    if str_eq(id, "") {
        return mcp_text_result("error: node_id is required")
    }
-    // Soft-delete: record a tombstone memory and return ok
-    return mcp_json_result("{\"ok\":true,\"deleted\":\"" + id + "\"}")
+    // Immutable delete: route to the soul's tombstoning endpoint (keeps the node
+    // + edges, hides from default reads, recoverable via ?include_deleted).
+    // Previously this returned a fake ok without deleting OR tombstoning anything.
+    let body: String = "{\"id\":\"" + id + "\"}"
+    let resp: String = http_post_json(neuron_url() + "/memory/delete", body)
+    return mcp_json_result(resp)
 }

 fn tool_check_events(args: String) -> String {
@@ -43,8 +43,32 @@ fn mem_strengthen(node_id: String) -> Void {
    engram_strengthen(node_id)
 }

+// mem_tombstone — immutable "delete": KEEP the node and all its edges; record a
+// Tombstone marker (content = target id, label "tombstone:<id>", wired with a
+// "tombstones" edge). Never engram_forget. Default bounded list reads hide
+// tombstoned nodes; ?include_deleted=1 recovers them. This is the ONE canonical
+// tombstone helper — every forget path routes through it. Defined here in
+// memory.el (imported first) so awareness.el and neuron-api.el can both call it.
+fn mem_tombstone(node_id: String) -> String {
+    let tags: String = "[\"Tombstone\",\"status:deleted\"]"
+    let marker: String = engram_node_full(
+        node_id, "Tombstone", "tombstone:" + node_id,
+        el_from_float(0.01), el_from_float(0.01), el_from_float(1.0),
+        "Episodic", tags)
+    if !str_eq(marker, "") {
+        engram_connect(marker, node_id, el_from_float(1.0), "tombstones")
+    }
+    return marker
+}
+
+// mem_forget — NOTE: no longer a hard delete. Engram nodes are immutable, so
+// this now TOMBSTONES (via mem_tombstone): the node and its edges are kept and
+// stay recoverable. Every caller (the /memory/forget route and the cultivate
+// forget op) is non-destructive as a result. Internal GC that genuinely needs
+// removal (session-summary replace, telemetry pruning) calls engram_forget
+// directly and is unaffected by this.
 fn mem_forget(node_id: String) -> Void {
-    engram_forget(node_id)
+    let _marker: String = mem_tombstone(node_id)
 }

 // mem_consolidate — structural scan plus salience-evolution pass.
@@ -104,6 +104,66 @@ fn api_not_persisted(id: String) -> String {
    return "{\"ok\":false,\"error\":\"write_not_persisted\",\"id\":\"" + id + "\"}"
 }

+// ── Immutability: tombstone instead of hard-delete ────────────────────────────
+//
+// Day-one rule: engram nodes are immutable. A "delete" must never engram_forget
+// (which frees the node and drops its incident edges). Instead we TOMBSTONE: the
+// original node and all its edges are KEPT and stay traversable; a small
+// Tombstone marker node records the deletion (content = target id, label
+// "tombstone:<id>"), wired to the target with a "tombstones" edge. Default
+// bounded list reads hide tombstoned nodes (memory_hide_tombstoned); internal
+// cognition and explicit ?include_deleted reads still see them.
+fn tombstone_node(id: String) -> String {
+    // Delegates to the canonical helper in memory.el (single source of truth).
+    return mem_tombstone(id)
+}
+
+// tombstoned_id_set — delimited "|id1|id2|" of every tombstoned target id.
+// Empty string when nothing is tombstoned (callers fast-path on that).
+fn tombstoned_id_set() -> String {
+    let markers: String = engram_scan_nodes_by_type_json("Tombstone", 5000, 0)
+    if str_eq(markers, "") || str_eq(markers, "[]") { return "" }
+    let n: Int = json_array_len(markers)
+    let acc: String = "|"
+    let i: Int = 0
+    while i < n {
+        let m: String = json_array_get(markers, i)
+        let tid: String = json_get(m, "content")
+        let acc = if str_eq(tid, "") { acc } else { acc + tid + "|" }
+        let i = i + 1
+    }
+    return acc
+}
+
+// memory_hide_tombstoned — drop tombstone markers and tombstoned nodes from a
+// scanned node array. BOUNDED use only (typed/paginated lists), NOT the full
+// graph scan: json_array_get is O(index), so a full pass is O(n^2). Safe for the
+// ~50-item memory list; a hard cap protects against a large limit. The full
+// /api/graph/nodes hide needs a runtime scan filter and is deferred (see PR).
+// ?include_deleted bypasses the filter (explicit traversal).
+fn memory_hide_tombstoned(raw: String, path: String) -> String {
+    if str_contains(path, "include_deleted") { return raw }
+    if str_eq(raw, "") || str_eq(raw, "[]") { return raw }
+    let dead: String = tombstoned_id_set()
+    if str_eq(dead, "") { return raw }
+    let n: Int = json_array_len(raw)
+    if n > 1000 { return raw }
+    let out: String = "["
+    let first: Bool = true
+    let i: Int = 0
+    while i < n {
+        let node: String = json_array_get(raw, i)
+        let nid: String = json_get(node, "id")
+        let ntype: String = json_get(node, "node_type")
+        let is_dead: Bool = !str_eq(nid, "") && str_contains(dead, "|" + nid + "|")
+        let keep: Bool = !str_eq(ntype, "Tombstone") && !is_dead
+        let out = if keep { if first { out + node } else { out + "," + node } } else { out }
+        let first = if keep { false } else { first }
+        let i = i + 1
+    }
+    return out + "]"
+}
+
 // ── Session ───────────────────────────────────────────────────────────────────

 // handle_api_begin_session — full context bootstrap.
@@ -191,25 +251,26 @@ fn handle_api_node_create(body: String) -> String {
    return "{\"id\":\"" + id + "\",\"ok\":true}"
 }

-// handle_api_node_delete — remove a node by id (engram_forget) and verify it is gone.
+// handle_api_node_delete — TOMBSTONE a node by id (immutable delete).
 // Backs /api/neuron/node/delete and the /api/neuron/memory/delete alias the UI calls.
+// The node and all its incident edges are KEPT; a Tombstone marker records the
+// deletion. Never engram_forget — engram nodes are immutable by design.
 fn handle_api_node_delete(body: String) -> String {
    let id: String = json_get(body, "id")
    if str_eq(id, "") { return api_err("id is required") }
-    // engram_forget removes the node + its incident edges from the live graph.
-    // Delete is NOT read-back-verified: engram_get_node_json can return a stale hit
-    // for a just-forgotten id because the id→index map is not rebuilt on forget.
-    // A stale hit would cause a false "delete_failed" on a successful deletion.
-    // This exception is correct: read-back-verify guards WRITES; for deletes,
-    // the graph endpoints (/api/graph/nodes) reflect the removal and are the source of truth.
-    engram_forget(id)
-    return "{\"ok\":true,\"id\":\"" + id + "\"}"
+    if is_protected_node(id) { return api_err_protected(id) }
+    let existing: String = engram_get_node_json(id)
+    if str_eq(existing, "{}") { return api_err("node not found: " + id) }
+    let marker: String = tombstone_node(id)
+    if str_eq(marker, "") { return api_err("tombstone failed: " + id) }
+    return "{\"ok\":true,\"id\":\"" + id + "\",\"tombstoned\":true}"
 }

 // handle_api_node_update — update a node's content/fields. There is no in-place
-// engram update builtin, so this recreates the node with merged fields and then
-// forgets the old one (only after the new node reads back). The id changes; the
-// response returns the new id and the replaced id so callers can re-point.
+// engram update builtin, so this creates a new node with merged fields and wires
+// a "supersedes" edge new->old. The original is KEPT (immutable); the id changes,
+// and the response returns the new id and the superseded id so callers re-point.
+// Mirrors handle_api_memory_update / evolve exactly. Never engram_forget.
 fn handle_api_node_update(body: String) -> String {
    let id: String = json_get(body, "id")
    if str_eq(id, "") { return api_err("id is required") }
@@ -240,8 +301,8 @@ fn handle_api_node_update(body: String) -> String {
        el_from_float(0.5), el_from_float(0.5), el_from_float(0.8),
        tier, tags)
    if !api_persisted(new_id) { return api_not_persisted(new_id) }
-    engram_forget(id)
-    return "{\"id\":\"" + new_id + "\",\"replaced\":\"" + id + "\",\"ok\":true}"
+    engram_connect(new_id, id, el_from_float(0.9), "supersedes")
+    return "{\"id\":\"" + new_id + "\",\"supersedes\":\"" + id + "\",\"ok\":true}"
 }

 // handle_api_recall — search or activate memory by query.
@@ -504,13 +565,15 @@ fn handle_api_link_entities(body: String) -> String {
    return "{\"ok\":true,\"from_id\":\"" + from_id + "\",\"to_id\":\"" + to_id + "\",\"relation\":\"" + eff_relation + "\"}"
 }

-// handle_api_forget — delete a node by ID. Blocked for protected identity nodes.
+// handle_api_forget — TOMBSTONE a node by ID (immutable; mem_forget now
+// tombstones). The node + edges are kept and recoverable. Blocked for protected
+// identity nodes.
 fn handle_api_forget(body: String) -> String {
    let node_id: String = json_get(body, "id")
    if str_eq(node_id, "") { return api_err("id is required") }
    if is_protected_node(node_id) { return api_err_protected(node_id) }
    mem_forget(node_id)
-    return "{\"ok\":true,\"id\":\"" + node_id + "\"}"
+    return "{\"ok\":true,\"id\":\"" + node_id + "\",\"tombstoned\":true}"
 }

 // handle_api_evolve_memory — evolve a Memory node. Blocked for protected identity nodes.
@@ -541,10 +604,10 @@ fn handle_api_evolve_memory(body: String) -> String {
 }

 // handle_api_memory_delete — POST /api/neuron/memory/delete {"id":"..."}.
-// Hard delete: engram_forget (via mem_forget) removes the node and all
-// incident edges from the engram store, so no soft-delete fallback is
-// needed. Existence is checked first because engram_forget silently
-// no-ops on unknown ids — a bad id must return an error, not fake success.
+// Immutable delete: TOMBSTONE via tombstone_node — the node and all its incident
+// edges are KEPT and stay traversable; a Tombstone marker records the deletion
+// and default bounded list reads hide it. Never engram_forget. Existence is
+// checked first so a bad id errors rather than faking success.
 // Blocked for protected identity nodes, same as /memory/forget.
 fn handle_api_memory_delete(body: String) -> String {
    let node_id: String = json_get(body, "id")
@@ -552,8 +615,10 @@ fn handle_api_memory_delete(body: String) -> String {
    if is_protected_node(node_id) { return api_err_protected(node_id) }
    let existing: String = engram_get_node_json(node_id)
    if str_eq(existing, "{}") { return api_err("memory not found: " + node_id) }
-    mem_forget(node_id)
-    return "{\"ok\":true,\"id\":\"" + node_id + "\",\"deleted\":true}"
+    // Immutable delete: tombstone, never mem_forget/engram_forget. Node + edges KEPT.
+    let marker: String = tombstone_node(node_id)
+    if str_eq(marker, "") { return api_err("tombstone failed: " + node_id) }
+    return "{\"ok\":true,\"id\":\"" + node_id + "\",\"tombstoned\":true}"
 }

 // handle_api_memory_update — POST /api/neuron/memory/update {"id","content"}.
@@ -623,8 +688,9 @@ fn handle_api_cultivate(body: String) -> String {
    if str_eq(op, "forget") {
        let node_id: String = json_get(body, "id")
        if str_eq(node_id, "") { return api_err("id is required") }
+        // Immutable: mem_forget now tombstones (keep node + edges), never hard-delete.
        mem_forget(node_id)
-        return "{\"ok\":true,\"id\":\"" + node_id + "\",\"cultivated\":true}"
+        return "{\"ok\":true,\"id\":\"" + node_id + "\",\"tombstoned\":true,\"cultivated\":true}"
    }

    if str_eq(op, "link_entities") {
@@ -646,7 +712,10 @@ fn handle_api_cultivate(body: String) -> String {
 // handle_api_list_typed — list nodes by node_type.
 fn handle_api_list_typed(node_type: String, path: String, body: String) -> String {
    let limit: Int = api_query_int(path, "limit", 50)
-    return api_or_empty(engram_scan_nodes_by_type_json(node_type, limit, 0))
+    let raw: String = api_or_empty(engram_scan_nodes_by_type_json(node_type, limit, 0))
+    // Hide tombstoned nodes from the default (bounded) memory list.
+    // ?include_deleted=1 returns them for explicit traversal.
+    return memory_hide_tombstoned(raw, path)
 }

 // ── Consolidate ───────────────────────────────────────────────────────────────
@@ -0,0 +1,226 @@
+#!/usr/bin/env bash
+# verify-soul-contract.sh — the soul contract gate.
+#
+# TERMINOLOGY (canonical): the ENGRAM is the brain — the memory/knowledge-graph
+# substrate. The binary this gate exercises is the SOUL — the runtime/reasoning
+# engine compiled from dist/soul.c that serves the /api/ surface. The app
+# (neuron-ui) bundles the soul binary at resources/<platform>/neuron.
+#
+# WHY THIS EXISTS
+#   For a while the soul binary was hand-dropped, and a stale one shipped: it
+#   404'd several capability routes the app calls (knowledge-graph node
+#   update/delete, live-run narration, safety-contact, ...). This gate makes
+#   shipping a stale soul IMPOSSIBLE. It has two enforced sections:
+#     A. PRESENCE   — every route the app calls must be ANSWERED (not 404, not
+#                     the el-runtime "no handler"). This is the packaging gate:
+#                     if it fails, do not package.
+#     B. IMMUTABILITY — engram nodes/memories are immutable by design. To
+#                     "update" is to create a NEW node + a supersede EDGE back to
+#                     the original; the original is KEPT. To "delete" is to
+#                     supersede/tombstone, never hard-remove. A soul that
+#                     hard-deletes an engram node is DEFECTIVE and fails the gate.
+#
+# SAFETY
+#   Never touches the live soul (:7770), live engram (:8742), or ~/.neuron.
+#   Boots on a throwaway port (default 7799) with HOME=$(mktemp -d), a throwaway
+#   engram snapshot, a non-genesis cgi id, no ENGRAM_URL (so it uses its own
+#   in-process store, never the live server), NEURON_API_URL pointed at a dead
+#   port, and no ANTHROPIC_API_KEY (so no probe triggers a real LLM call).
+#   Connectors proxy to a HARDCODED 127.0.0.1:7771 (no env override): those
+#   sub-routes are probed with GET, which the soul maps to a read-only
+#   connectd_get, so this gate never writes to a running connectd bridge.
+#
+# USAGE
+#   scripts/verify-soul-contract.sh <path-to-soul-binary> [port]
+#   exit 0 = all required routes answered AND no destructive engram mutation;
+#   non-zero = a route is missing (presence) or a mutation route hard-deletes.
+set -uo pipefail
+
+SOUL="${1:?usage: verify-soul-contract.sh <soul-binary> [port]}"
+PORT="${2:-7799}"
+
+if [ "$PORT" = "7770" ] || [ "$PORT" = "8742" ] || [ "$PORT" = "7771" ]; then
+  echo "REFUSING: port $PORT is a live service port. Use a throwaway port." >&2
+  exit 2
+fi
+if [ ! -x "$SOUL" ]; then echo "not executable: $SOUL" >&2; exit 2; fi
+
+BASE="http://127.0.0.1:$PORT"
+THROW_HOME="$(mktemp -d "${TMPDIR:-/tmp}/soul-contract-home.XXXXXX")"
+SOUL_LOG="$(mktemp "${TMPDIR:-/tmp}/soul-contract-log.XXXXXX")"
+SOUL_PID=""
+cleanup() {
+  [ -n "$SOUL_PID" ] && kill "$SOUL_PID" 2>/dev/null
+  [ -n "$SOUL_PID" ] && { sleep 0.3; kill -9 "$SOUL_PID" 2>/dev/null; }
+  rm -rf "$THROW_HOME" "$SOUL_LOG"
+}
+trap cleanup EXIT INT TERM
+
+# =============================================================================
+# THE CONTRACT — routes the app (neuron-ui/src/main/kotlin/ai/neuron/ui/*.kt)
+# calls against the soul ($SOUL). Format: "METHOD PATH".
+#
+# EXCLUDED and why:
+#   /api/auth, /api/auth/status, /api/dispatch, /api/tasks
+#       -> served by the APP's own DispatchServer.kt (localhost:8080), not the
+#          soul. Not soul routes.
+#   /api/tags
+#       -> not handled by any soul .el (app-side/other). Pre-verified excluded.
+#   /api/neuron/, /api/neuron/node/, /api/connectors/ (bare prefixes)
+#       -> base-path string constants used to build the concrete routes below.
+#
+# KNOWN-PENDING (probed + reported, NON-blocking):
+#   POST /api/engram/import  -> the app's "Restore memory" path. No soul handler
+#       yet, and the app hides Restore from shipped builds (B3, "lands in an
+#       update"). Reported so we see it; does not block packaging.
+#
+# Connectors sub-routes are listed as GET (see SAFETY note): handle_connectors is
+# monolithic, so a GET reaching it proves the whole connectors surface without
+# writing to the live bridge. Binary-strings cross-check confirms each POST
+# sub-path literal is compiled in.
+# =============================================================================
+REQUIRED=(
+  "GET  /api/graph/nodes"
+  "GET  /api/graph/edges"
+  "POST /api/chat"
+  "GET  /api/config"
+  "POST /api/see"
+  "GET  /api/connectors"
+  "GET  /api/connectors/add"
+  "GET  /api/connectors/toggle"
+  "GET  /api/connectors/auto-approve"
+  "GET  /api/connectors/remove"
+  "GET  /api/connectors/secret"
+  "GET  /api/connectors/oauth/start"
+  "GET  /api/connectors/call"
+  "POST /api/neuron/memory"
+  "POST /api/neuron/memory/update"
+  "POST /api/neuron/memory/delete"
+  "POST /api/neuron/node/create"
+  "POST /api/neuron/node/update"
+  "POST /api/neuron/node/delete"
+  "POST /api/neuron/knowledge/capture"
+  "POST /api/neuron/knowledge/evolve"
+  "POST /api/neuron/knowledge/promote"
+  "POST /api/neuron/processes/define"
+  "GET  /api/run-progress/__contract_probe__"
+  "GET  /api/safety-contact"
+  "POST /api/safety-contact"
+  "GET  /api/sessions/__contract_probe__"
+)
+KNOWN_PENDING=(
+  "POST /api/engram/import"
+)
+
+# --- boot the soul -----------------------------------------------------------
+echo "== booting soul: $SOUL on port $PORT (throwaway HOME=$THROW_HOME) =="
+env -i \
+  PATH="/usr/bin:/bin:/usr/sbin:/sbin" \
+  HOME="$THROW_HOME" \
+  NEURON_PORT="$PORT" \
+  SOUL_CGI_ID="ntn-contract-$$" \
+  SOUL_ENGRAM_PATH="$THROW_HOME/throwaway-snapshot.json" \
+  NEURON_API_URL="http://127.0.0.1:9" \
+  SOUL_TICK_MS="3600000" SOUL_HEARTBEAT_MS="3600000" SOUL_REFRESH_MS="3600000" \
+  "$SOUL" >"$SOUL_LOG" 2>&1 &
+SOUL_PID=$!
+
+UP=0
+for _ in $(seq 1 60); do
+  if ! kill -0 "$SOUL_PID" 2>/dev/null; then
+    echo "!! soul exited during boot. log tail:" >&2; tail -20 "$SOUL_LOG" >&2; exit 3
+  fi
+  RSS=$(ps -o rss= -p "$SOUL_PID" 2>/dev/null | tr -d ' ')
+  if [ -n "$RSS" ] && [ "$RSS" -gt $((3*1024*1024)) ]; then
+    echo "!! soul RSS >3GB — kill -9" >&2; kill -9 "$SOUL_PID" 2>/dev/null; exit 3
+  fi
+  [ "$(curl -s -o /dev/null -w '%{http_code}' -m 2 "$BASE/health" 2>/dev/null)" = "200" ] && { UP=1; break; }
+  sleep 0.5
+done
+[ "$UP" = 1 ] || { echo "!! soul never healthy on $BASE/health" >&2; tail -20 "$SOUL_LOG" >&2; exit 3; }
+echo "== soul healthy =="; echo
+
+# --- probing helpers ---------------------------------------------------------
+# request METHOD PATH [BODY] -> prints response body (single line)
+request() {
+  curl -s -m 12 -X "$1" -H 'Content-Type: application/json' --data "${3:-{}}" "$BASE$2" 2>/dev/null | tr -d '\n'
+}
+# is_missing BODY -> 0 if the body is a "route not present" signal
+is_missing() {
+  printf '%s' "$1" | grep -qE '"error":"not found"|"code":"not_found"|no http handler registered|"code":"method_not_allowed"'
+}
+extract_id() { printf '%s' "$1" | grep -oE '"id":"[^"]+"' | head -1 | sed 's/.*"id":"//;s/"//'; }
+node_present() { # id -> 0 if id appears in /api/graph/nodes
+  request GET /api/graph/nodes | grep -qF "\"$1\""
+}
+
+# --- SECTION A: presence -----------------------------------------------------
+run_presence() {
+  local -n arr=$1; local fail=0
+  printf '  %-8s %-42s %s\n' "METHOD" "ROUTE" "RESULT"
+  for e in "${arr[@]}"; do
+    local m p body; m=$(awk '{print $1}' <<<"$e"); p=$(awk '{print $2}' <<<"$e")
+    body=$(request "$m" "$p")
+    if is_missing "$body"; then
+      printf '  %-8s %-42s MISSING  %s\n' "$m" "$p" "$(cut -c1-46 <<<"$body")"; fail=$((fail+1))
+    else
+      printf '  %-8s %-42s ANSWERED %s\n' "$m" "$p" "$(cut -c1-46 <<<"$body")"
+    fi
+  done
+  return $fail
+}
+
+echo "== SECTION A: PRESENCE (required, blocking) =="
+run_presence REQUIRED; A_FAIL=$?
+echo
+echo "== KNOWN-PENDING (non-blocking) =="
+run_presence KNOWN_PENDING; P_FAIL=$?
+echo
+
+# --- SECTION B: immutability (engram write routes must supersede, not destroy) --
+# For each mutation route: create a node, mutate it, then check the ORIGINAL id
+# still exists in the graph. KEPT = supersede/tombstone (correct). DESTROYED =
+# hard delete (DEFECTIVE -> fail). N/A = mutate route absent (a presence failure).
+# For "delete" mutations we additionally require a real tombstone marker
+# (label "tombstone:<id>") so a no-op delete cannot false-pass as KEPT.
+marker_present() { # id -> 0 if a "tombstone:<id>" marker exists (include_deleted view)
+  request GET "/api/graph/nodes?include_deleted=1" | grep -qF "tombstone:$1"
+}
+immut_check() { # label KIND(update|delete) CREATE_PATH MUTATE_PATH
+  local label="$1" kind="$2" create="$3" mutate="$4"
+  local cbody id mb mbody
+  cbody=$(request POST "$create" "{\"content\":\"__immut_${label}__\",\"node_type\":\"Memory\",\"label\":\"contract:immut\"}")
+  id=$(extract_id "$cbody")
+  if [ -z "$id" ]; then printf '  %-14s SKELETON-FAIL  create returned no id: %s\n' "$label" "$(cut -c1-40 <<<"$cbody")"; return 2; fi
+  mb="{\"id\":\"$id\"}"; [ "$kind" = update ] && mb="{\"id\":\"$id\",\"content\":\"__immut_${label}_v2__\"}"
+  mbody=$(request POST "$mutate" "$mb")
+  if is_missing "$mbody"; then printf '  %-14s N/A            mutate route absent (see Section A)\n' "$label"; return 0; fi
+  if ! node_present "$id"; then
+    printf '  %-14s DESTROYED      original %s hard-removed  <== DEFECTIVE\n' "$label" "$id"; return 1
+  fi
+  if [ "$kind" = delete ] && ! marker_present "$id"; then
+    printf '  %-14s NO-OP          original %s kept but no tombstone marker  <== DEFECTIVE\n' "$label" "$id"; return 1
+  fi
+  local how="supersede edge"; [ "$kind" = delete ] && how="tombstoned + hidden from default list"
+  printf '  %-14s KEPT           original %s survived (%s)\n' "$label" "$id" "$how"; return 0
+}
+
+echo "== SECTION B: IMMUTABILITY (engram nodes must be superseded, never destroyed) =="
+B_FAIL=0
+immut_check "memory-update" update /api/neuron/memory      /api/neuron/memory/update || B_FAIL=$((B_FAIL+$?))
+immut_check "memory-delete" delete /api/neuron/memory      /api/neuron/memory/delete || B_FAIL=$((B_FAIL+$?))
+immut_check "node-update"   update /api/neuron/node/create /api/neuron/node/update   || B_FAIL=$((B_FAIL+$?))
+immut_check "node-delete"   delete /api/neuron/node/create /api/neuron/node/delete   || B_FAIL=$((B_FAIL+$?))
+immut_check "memory-forget" delete /api/neuron/memory      /api/neuron/memory/forget || B_FAIL=$((B_FAIL+$?))
+echo
+
+echo "============================================================"
+RC=0
+if [ "$A_FAIL" -gt 0 ]; then echo "PRESENCE:   FAIL — $A_FAIL required route(s) unanswered. Do NOT package."; RC=1
+  else echo "PRESENCE:   PASS — all ${#REQUIRED[@]} required routes answered."; fi
+if [ "$B_FAIL" -gt 0 ]; then echo "IMMUTABILITY: FAIL — $B_FAIL engram write route(s) hard-delete. DEFECTIVE soul."; RC=1
+  else echo "IMMUTABILITY: PASS — no engram write route hard-deletes."; fi
+[ "$P_FAIL" -gt 0 ] && echo "note: $P_FAIL known-pending route(s) unanswered (expected; non-blocking)."
+echo "============================================================"
+[ "$RC" = 0 ] && echo "GATE: PASS" || echo "GATE: FAIL"
+exit $RC
Author	SHA1	Message	Date
will.anderson	290a637883	ci: gate the Linux soul on the contract before publishing Neuron Soul CI / build (pull_request) Failing after 12m4s Details Neuron Soul CI / deploy (pull_request) Has been skipped Details Wire the soul contract gate into ci.yaml as a hard block between the cc build and the Publish-to-Artifact-Registry step. A non-zero gate fails the build, so a stale (route-404ing) or memory-destroying (hard-deleting) soul can never publish neuron-soul to foundation-prod or blue-green deploy to GKE — the same class-fix now guarding the desktop builds, extended to prod. Vendors scripts/verify-soul-contract.sh (copied from neuron-ui; the route contract is baked in, so it's portable POSIX bash/curl with no neuron-ui source dependency). It boots dist/neuron on a throwaway port with a throwaway HOME/engram/cgi — never touching ~/.neuron or any live service — and checks PRESENCE (every app route answered) + IMMUTABILITY (no engram write route hard-deletes; deletes/forgets tombstone). Adds curl to the build deps for the probe.	2026-07-18 13:31:33 -05:00
will.anderson	40d800195a	Tombstone the remaining forget paths (close the immutability arc) Phase 1 tombstoned memory/delete + node/delete, but the generic forget path was still destructive. This routes every forget through the same tombstone semantics so nothing in the daemon can hard-delete an engram node anymore. Canonical helper: mem_tombstone (memory.el, imported first so every module can call it) — keep the node + its edges, record a Tombstone marker, never engram_forget. neuron-api's tombstone_node now delegates to it (single source of truth). Per-path before -> after: - memory.el `mem_forget` hard delete (engram_forget) -> tombstone. This alone fixes both callers: the /api/neuron/memory/forget route (handle_api_forget) and the cultivate op=="forget". - awareness.el autonomous `forget` action engram_forget -> mem_tombstone. The soul can no longer autonomously hard-delete a memory. - mcp-wrapper tool_forget was a FAKE no-op that returned {"ok","deleted"} without deleting OR tombstoning -> now routes to the soul's tombstoning /api/neuron/memory/delete; tool description fixed to say it supersedes/tombstones (recoverable), not "Remove a node". Left intentionally as hard deletes (internal GC / lifecycle, not user memory, all call engram_forget directly): session-summary replace (chat.el), mem_consolidate dedup (memory.el), session-start telemetry pruning (soul.el), session lifecycle (sessions.el). Regenerated both ship paths under a 3GB physical-RSS watchdog (peak ~32MB): dist/soul.c (single-TU amalgamation, macOS/Linux) and the per-module dist/{memory,awareness,neuron-api}.c (Windows/Linux build). Verified: no forget handler calls engram_forget; a forget leaves the node present + tombstone marker. Gate (neuron-ui verify-soul-contract.sh, new memory-forget row): PRESENCE + IMMUTABILITY PASS.	2026-07-18 13:22:43 -05:00
will.anderson	f3034d23f7	Regenerate per-module dist/neuron-api.c for the immutability fix soul.c (the macOS single-TU amalgamation) already carries the tombstone/supersede change, but the Windows/Linux build path compiles the per-module dist/*.c instead (build-soul-windows.sh excludes soul.c). That path was still pulling the stale, destructive dist/neuron-api.c — so without this the cross-compiled neuron.exe would keep hard-deleting engram nodes even though the source is fixed. Regenerated with `elc --emit-header neuron-api.el`: no engram_forget in memory_delete/node_delete (tombstone), supersedes edge in node_update. Portable C — identical for macOS/Windows/Linux; only the runtime it links against differs.	2026-07-17 16:57:55 -05:00
will.anderson	d337fcb265	Make engram deletes/updates immutable (tombstone + supersede) The soul was hard-deleting engram nodes: memory/delete and node/delete called engram_forget (frees the node and drops its incident edges), and node/update created a replacement then forgot the original with no link back. That violates the day-one rule that engram nodes are immutable — memory could be silently, irrecoverably destroyed via the API. Convert the three destructive handlers to Will's immutability semantics, mirroring the pattern memory/update and knowledge evolve/promote already use: - node/update -> create the new node, wire a "supersedes" edge new->old, KEEP the original. No engram_forget. (Was: create + forget old, no edge.) - memory/delete and node/delete -> TOMBSTONE: keep the node AND its edges, create a Tombstone marker node (content = target id, label "tombstone:<id>") wired with a "tombstones" edge. Never engram_forget. Default bounded list reads (handle_api_list_typed / the memory list) hide tombstoned nodes and the markers; ?include_deleted=1 returns them, and internal cognition + /api/graph/nodes still traverse them. memory/update was already correct and is unchanged. Full-graph hiding on /api/graph/nodes is deliberately NOT done at the el layer: json_array_get is O(index), so filtering that endpoint (called with limit up to 999999) would be O(n^2). That hide needs a runtime scan filter and is a separate follow-up; nodes there remain traversable, tagged status:deleted via the marker edge. Regenerated dist/soul.c from these sources (flat single-TU amalgamation, compiled under a 3GB physical-RSS watchdog, peak ~32MB). Verified with scripts/verify-soul-contract.sh in neuron-ui: PRESENCE passes (all 27 routes) and IMMUTABILITY passes (all four mutation routes KEPT; deletes produce a real tombstone marker and hide from the default list).	2026-07-17 16:42:30 -05:00