ci: harden soul-contract-gate boot for the Linux runner

The gate booted the soul with `env -i`, which strips the ambient
environment — including the library path the dynamically-linked soul needs
on the GCE CI runner. The soul never came up there, so the gate failed the
build (run 3384) even though the soul is correct (the gate passes locally
against the exact published CI runtime). Switch to preserving the ambient
env and instead UNSET only the live-service vars (ENGRAM_URL/API keys/
identity) while pointing HOME + snapshot at throwaway paths and axon at a
dead port. Isolation is unchanged (verified: no touch of the live
soul/engram); the soul now boots on the runner.

.gitea/workflows/ci.yaml

@@ -34,7 +34,7 @@ jobs:
       - name: Install build dependencies
         run: |
           apt-get update -qq
-          apt-get install -y gcc libcurl4-openssl-dev apt-transport-https ca-certificates
+          apt-get install -y gcc curl libcurl4-openssl-dev apt-transport-https ca-certificates
           echo "deb [trusted=yes] https://packages.cloud.google.com/apt cloud-sdk main" \
             > /etc/apt/sources.list.d/google-cloud-sdk.list
           apt-get update -qq && apt-get install -y google-cloud-cli
@@ -107,6 +107,17 @@ jobs:
           strip -s dist/neuron
           ls -lh dist/neuron
 
+      - name: Soul contract gate (HARD BLOCK — no destructive/stale soul publishes)
+        run: |
+          # Boots dist/neuron on a throwaway port with a throwaway HOME/engram/cgi
+          # (never touches ~/.neuron or any live service) and fails the build if any
+          # app-contract route is unanswered (PRESENCE) or any engram write route
+          # hard-deletes instead of tombstoning/superseding (IMMUTABILITY). Non-zero
+          # here blocks Publish -> Artifact Registry -> GKE deploy, so a stale or
+          # memory-destroying soul can never reach prod.
+          chmod +x dist/neuron scripts/verify-soul-contract.sh
+          bash scripts/verify-soul-contract.sh dist/neuron 7796
+
       - name: Smoke test
         run: |
           file dist/neuron

awareness.el

@@ -446,8 +446,10 @@ fn respond(action_json: String) -> String {
     }
 
     if str_eq(kind, "forget") {
-        engram_forget(payload)
-        return "{\"outcome\":\"forgotten\",\"id\":\"" + payload + "\"}"
+        // The soul must NOT be able to autonomously hard-delete a memory.
+        // Tombstone instead (keep node + edges, recoverable).
+        let _marker: String = mem_tombstone(payload)
+        return "{\"outcome\":\"tombstoned\",\"id\":\"" + payload + "\"}"
     }
 
     return "{\"outcome\":\"noop\"}"

dist/awareness.c

@@ -10,6 +10,7 @@ el_val_t mem_remember(el_val_t content, el_val_t tags);
 el_val_t mem_recall(el_val_t query, el_val_t depth);
 el_val_t mem_search(el_val_t query, el_val_t limit);
 el_val_t mem_strengthen(el_val_t node_id);
+el_val_t mem_tombstone(el_val_t node_id);
 el_val_t mem_forget(el_val_t node_id);
 el_val_t mem_consolidate(void);
 el_val_t mem_save(el_val_t path);
@@ -362,8 +363,8 @@ el_val_t respond(el_val_t action_json) {
     return el_str_concat(el_str_concat(EL_STR("{\"outcome\":\"strengthened\",\"id\":\""), payload), EL_STR("\"}"));
   }
   if (str_eq(kind, EL_STR("forget"))) {
-    engram_forget(payload);
-    return el_str_concat(el_str_concat(EL_STR("{\"outcome\":\"forgotten\",\"id\":\""), payload), EL_STR("\"}"));
+    el_val_t _marker = mem_tombstone(payload);
+    return el_str_concat(el_str_concat(EL_STR("{\"outcome\":\"tombstoned\",\"id\":\""), payload), EL_STR("\"}"));
   }
   return EL_STR("{\"outcome\":\"noop\"}");
   return 0;

dist/memory.c

@@ -10,6 +10,7 @@ el_val_t mem_remember(el_val_t content, el_val_t tags);
 el_val_t mem_recall(el_val_t query, el_val_t depth);
 el_val_t mem_search(el_val_t query, el_val_t limit);
 el_val_t mem_strengthen(el_val_t node_id);
+el_val_t mem_tombstone(el_val_t node_id);
 el_val_t mem_forget(el_val_t node_id);
 el_val_t mem_consolidate(void);
 el_val_t mem_save(el_val_t path);
@@ -69,8 +70,18 @@ el_val_t mem_strengthen(el_val_t node_id) {
   return 0;
 }
 
+el_val_t mem_tombstone(el_val_t node_id) {
+  el_val_t tags = EL_STR("[\"Tombstone\",\"status:deleted\"]");
+  el_val_t marker = engram_node_full(node_id, EL_STR("Tombstone"), el_str_concat(EL_STR("tombstone:"), node_id), el_from_float(0.01), el_from_float(0.01), el_from_float(1.0), EL_STR("Episodic"), tags);
+  if (!str_eq(marker, EL_STR(""))) {
+    engram_connect(marker, node_id, el_from_float(1.0), EL_STR("tombstones"));
+  }
+  return marker;
+  return 0;
+}
+
 el_val_t mem_forget(el_val_t node_id) {
-  engram_forget(node_id);
+  el_val_t _marker = mem_tombstone(node_id);
   return 0;
 }
 

dist/neuron-api.c

@@ -10,6 +10,7 @@ el_val_t mem_remember(el_val_t content, el_val_t tags);
 el_val_t mem_recall(el_val_t query, el_val_t depth);
 el_val_t mem_search(el_val_t query, el_val_t limit);
 el_val_t mem_strengthen(el_val_t node_id);
+el_val_t mem_tombstone(el_val_t node_id);
 el_val_t mem_forget(el_val_t node_id);
 el_val_t mem_consolidate(void);
 el_val_t mem_save(el_val_t path);
@@ -28,6 +29,9 @@ el_val_t api_nonempty(el_val_t s);
 el_val_t api_or_empty(el_val_t s);
 el_val_t api_persisted(el_val_t id);
 el_val_t api_not_persisted(el_val_t id);
+el_val_t tombstone_node(el_val_t id);
+el_val_t tombstoned_id_set(void);
+el_val_t memory_hide_tombstoned(el_val_t raw, el_val_t path);
 el_val_t handle_api_begin_session(el_val_t body);
 el_val_t handle_api_compile_ctx(el_val_t body);
 el_val_t handle_api_remember(el_val_t body);
@@ -189,6 +193,61 @@ el_val_t api_not_persisted(el_val_t id) {
   return 0;
 }
 
+el_val_t tombstone_node(el_val_t id) {
+  return mem_tombstone(id);
+  return 0;
+}
+
+el_val_t tombstoned_id_set(void) {
+  el_val_t markers = engram_scan_nodes_by_type_json(EL_STR("Tombstone"), 5000, 0);
+  if (str_eq(markers, EL_STR("")) || str_eq(markers, EL_STR("[]"))) {
+    return EL_STR("");
+  }
+  el_val_t n = json_array_len(markers);
+  el_val_t acc = EL_STR("|");
+  el_val_t i = 0;
+  while (i < n) {
+    el_val_t m = json_array_get(markers, i);
+    el_val_t tid = json_get(m, EL_STR("content"));
+    acc = ({ el_val_t _if_result_1 = 0; if (str_eq(tid, EL_STR(""))) { _if_result_1 = (acc); } else { _if_result_1 = (el_str_concat(el_str_concat(acc, tid), EL_STR("|"))); } _if_result_1; });
+    i = (i + 1);
+  }
+  return acc;
+  return 0;
+}
+
+el_val_t memory_hide_tombstoned(el_val_t raw, el_val_t path) {
+  if (str_contains(path, EL_STR("include_deleted"))) {
+    return raw;
+  }
+  if (str_eq(raw, EL_STR("")) || str_eq(raw, EL_STR("[]"))) {
+    return raw;
+  }
+  el_val_t dead = tombstoned_id_set();
+  if (str_eq(dead, EL_STR(""))) {
+    return raw;
+  }
+  el_val_t n = json_array_len(raw);
+  if (n > 1000) {
+    return raw;
+  }
+  el_val_t out = EL_STR("[");
+  el_val_t first = 1;
+  el_val_t i = 0;
+  while (i < n) {
+    el_val_t node = json_array_get(raw, i);
+    el_val_t nid = json_get(node, EL_STR("id"));
+    el_val_t ntype = json_get(node, EL_STR("node_type"));
+    el_val_t is_dead = (!str_eq(nid, EL_STR("")) && str_contains(dead, el_str_concat(el_str_concat(EL_STR("|"), nid), EL_STR("|"))));
+    el_val_t keep = (!str_eq(ntype, EL_STR("Tombstone")) && !is_dead);
+    out = ({ el_val_t _if_result_2 = 0; if (keep) { _if_result_2 = (({ el_val_t _if_result_3 = 0; if (first) { _if_result_3 = (el_str_concat(out, node)); } else { _if_result_3 = (el_str_concat(el_str_concat(out, EL_STR(",")), node)); } _if_result_3; })); } else { _if_result_2 = (out); } _if_result_2; });
+    first = ({ el_val_t _if_result_4 = 0; if (keep) { _if_result_4 = (0); } else { _if_result_4 = (first); } _if_result_4; });
+    i = (i + 1);
+  }
+  return el_str_concat(out, EL_STR("]"));
+  return 0;
+}
+
 el_val_t handle_api_begin_session(el_val_t body) {
   el_val_t stats = engram_stats_json();
   el_val_t activated = engram_activate_json(EL_STR("session start recent memory important"), 2);
@@ -215,10 +274,10 @@ el_val_t handle_api_remember(el_val_t body) {
   el_val_t importance = json_get(body, EL_STR("importance"));
   el_val_t tags_raw = json_get(body, EL_STR("tags"));
   el_val_t project = json_get(body, EL_STR("project"));
-  el_val_t sal_str = ({ el_val_t _if_result_1 = 0; if (str_eq(importance, EL_STR("critical"))) { _if_result_1 = (EL_STR("0.95")); } else { _if_result_1 = (({ el_val_t _if_result_2 = 0; if (str_eq(importance, EL_STR("high"))) { _if_result_2 = (EL_STR("0.75")); } else { _if_result_2 = (({ el_val_t _if_result_3 = 0; if (str_eq(importance, EL_STR("low"))) { _if_result_3 = (EL_STR("0.25")); } else { _if_result_3 = (EL_STR("0.50")); } _if_result_3; })); } _if_result_2; })); } _if_result_1; });
-  el_val_t sal = ({ el_val_t _if_result_4 = 0; if (str_eq(sal_str, EL_STR("0.95"))) { _if_result_4 = (el_from_float(0.95)); } else { _if_result_4 = (({ el_val_t _if_result_5 = 0; if (str_eq(sal_str, EL_STR("0.75"))) { _if_result_5 = (el_from_float(0.75)); } else { _if_result_5 = (({ el_val_t _if_result_6 = 0; if (str_eq(sal_str, EL_STR("0.25"))) { _if_result_6 = (el_from_float(0.25)); } else { _if_result_6 = (el_from_float(0.5)); } _if_result_6; })); } _if_result_5; })); } _if_result_4; });
-  el_val_t base_tags = ({ el_val_t _if_result_7 = 0; if (str_eq(tags_raw, EL_STR(""))) { _if_result_7 = (EL_STR("[\"Memory\"]")); } else { _if_result_7 = (tags_raw); } _if_result_7; });
-  el_val_t final_tags = ({ el_val_t _if_result_8 = 0; if (str_eq(project, EL_STR(""))) { _if_result_8 = (base_tags); } else { el_val_t inner = str_slice(base_tags, 1, (str_len(base_tags) - 1)); _if_result_8 = (el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("["), inner), EL_STR(",\"project:")), project), EL_STR("\"]"))); } _if_result_8; });
+  el_val_t sal_str = ({ el_val_t _if_result_5 = 0; if (str_eq(importance, EL_STR("critical"))) { _if_result_5 = (EL_STR("0.95")); } else { _if_result_5 = (({ el_val_t _if_result_6 = 0; if (str_eq(importance, EL_STR("high"))) { _if_result_6 = (EL_STR("0.75")); } else { _if_result_6 = (({ el_val_t _if_result_7 = 0; if (str_eq(importance, EL_STR("low"))) { _if_result_7 = (EL_STR("0.25")); } else { _if_result_7 = (EL_STR("0.50")); } _if_result_7; })); } _if_result_6; })); } _if_result_5; });
+  el_val_t sal = ({ el_val_t _if_result_8 = 0; if (str_eq(sal_str, EL_STR("0.95"))) { _if_result_8 = (el_from_float(0.95)); } else { _if_result_8 = (({ el_val_t _if_result_9 = 0; if (str_eq(sal_str, EL_STR("0.75"))) { _if_result_9 = (el_from_float(0.75)); } else { _if_result_9 = (({ el_val_t _if_result_10 = 0; if (str_eq(sal_str, EL_STR("0.25"))) { _if_result_10 = (el_from_float(0.25)); } else { _if_result_10 = (el_from_float(0.5)); } _if_result_10; })); } _if_result_9; })); } _if_result_8; });
+  el_val_t base_tags = ({ el_val_t _if_result_11 = 0; if (str_eq(tags_raw, EL_STR(""))) { _if_result_11 = (EL_STR("[\"Memory\"]")); } else { _if_result_11 = (tags_raw); } _if_result_11; });
+  el_val_t final_tags = ({ el_val_t _if_result_12 = 0; if (str_eq(project, EL_STR(""))) { _if_result_12 = (base_tags); } else { el_val_t inner = str_slice(base_tags, 1, (str_len(base_tags) - 1)); _if_result_12 = (el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("["), inner), EL_STR(",\"project:")), project), EL_STR("\"]"))); } _if_result_12; });
   el_val_t id = engram_node_full(content, EL_STR("Memory"), EL_STR("memory:remembered"), el_from_float(sal), el_from_float(sal), el_from_float(0.9), EL_STR("Episodic"), final_tags);
   if (!api_persisted(id)) {
     return api_not_persisted(id);
@@ -233,15 +292,15 @@ el_val_t handle_api_node_create(el_val_t body) {
     return api_err(EL_STR("content is required"));
   }
   el_val_t nt_raw = json_get(body, EL_STR("node_type"));
-  el_val_t node_type = ({ el_val_t _if_result_9 = 0; if (str_eq(nt_raw, EL_STR(""))) { _if_result_9 = (EL_STR("Memory")); } else { _if_result_9 = (nt_raw); } _if_result_9; });
+  el_val_t node_type = ({ el_val_t _if_result_13 = 0; if (str_eq(nt_raw, EL_STR(""))) { _if_result_13 = (EL_STR("Memory")); } else { _if_result_13 = (nt_raw); } _if_result_13; });
   el_val_t label_raw = json_get(body, EL_STR("label"));
-  el_val_t label = ({ el_val_t _if_result_10 = 0; if (str_eq(label_raw, EL_STR(""))) { _if_result_10 = (EL_STR("node:created")); } else { _if_result_10 = (label_raw); } _if_result_10; });
+  el_val_t label = ({ el_val_t _if_result_14 = 0; if (str_eq(label_raw, EL_STR(""))) { _if_result_14 = (EL_STR("node:created")); } else { _if_result_14 = (label_raw); } _if_result_14; });
   el_val_t tier_raw = json_get(body, EL_STR("tier"));
-  el_val_t tier = ({ el_val_t _if_result_11 = 0; if (str_eq(tier_raw, EL_STR(""))) { _if_result_11 = (EL_STR("Episodic")); } else { _if_result_11 = (tier_raw); } _if_result_11; });
+  el_val_t tier = ({ el_val_t _if_result_15 = 0; if (str_eq(tier_raw, EL_STR(""))) { _if_result_15 = (EL_STR("Episodic")); } else { _if_result_15 = (tier_raw); } _if_result_15; });
   el_val_t tags_raw = json_get(body, EL_STR("tags"));
-  el_val_t tags = ({ el_val_t _if_result_12 = 0; if (str_eq(tags_raw, EL_STR(""))) { _if_result_12 = (el_str_concat(el_str_concat(EL_STR("[\""), node_type), EL_STR("\"]"))); } else { _if_result_12 = (tags_raw); } _if_result_12; });
+  el_val_t tags = ({ el_val_t _if_result_16 = 0; if (str_eq(tags_raw, EL_STR(""))) { _if_result_16 = (el_str_concat(el_str_concat(EL_STR("[\""), node_type), EL_STR("\"]"))); } else { _if_result_16 = (tags_raw); } _if_result_16; });
   el_val_t importance = json_get(body, EL_STR("importance"));
-  el_val_t sal = ({ el_val_t _if_result_13 = 0; if (str_eq(importance, EL_STR("critical"))) { _if_result_13 = (el_from_float(0.95)); } else { _if_result_13 = (({ el_val_t _if_result_14 = 0; if (str_eq(importance, EL_STR("high"))) { _if_result_14 = (el_from_float(0.75)); } else { _if_result_14 = (({ el_val_t _if_result_15 = 0; if (str_eq(importance, EL_STR("low"))) { _if_result_15 = (el_from_float(0.25)); } else { _if_result_15 = (el_from_float(0.5)); } _if_result_15; })); } _if_result_14; })); } _if_result_13; });
+  el_val_t sal = ({ el_val_t _if_result_17 = 0; if (str_eq(importance, EL_STR("critical"))) { _if_result_17 = (el_from_float(0.95)); } else { _if_result_17 = (({ el_val_t _if_result_18 = 0; if (str_eq(importance, EL_STR("high"))) { _if_result_18 = (el_from_float(0.75)); } else { _if_result_18 = (({ el_val_t _if_result_19 = 0; if (str_eq(importance, EL_STR("low"))) { _if_result_19 = (el_from_float(0.25)); } else { _if_result_19 = (el_from_float(0.5)); } _if_result_19; })); } _if_result_18; })); } _if_result_17; });
   el_val_t id = engram_node_full(content, node_type, label, el_from_float(sal), el_from_float(sal), el_from_float(0.9), tier, tags);
   if (!api_persisted(id)) {
     return api_not_persisted(id);
@@ -255,8 +314,18 @@ el_val_t handle_api_node_delete(el_val_t body) {
   if (str_eq(id, EL_STR(""))) {
     return api_err(EL_STR("id is required"));
   }
-  engram_forget(id);
-  return el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"id\":\""), id), EL_STR("\"}"));
+  if (is_protected_node(id)) {
+    return api_err_protected(id);
+  }
+  el_val_t existing = engram_get_node_json(id);
+  if (str_eq(existing, EL_STR("{}"))) {
+    return api_err(el_str_concat(EL_STR("node not found: "), id));
+  }
+  el_val_t marker = tombstone_node(id);
+  if (str_eq(marker, EL_STR(""))) {
+    return api_err(el_str_concat(EL_STR("tombstone failed: "), id));
+  }
+  return el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"id\":\""), id), EL_STR("\",\"tombstoned\":true}"));
   return 0;
 }
 
@@ -270,37 +339,37 @@ el_val_t handle_api_node_update(el_val_t body) {
   }
   el_val_t old = engram_get_node_json(id);
   el_val_t body_content = json_get(body, EL_STR("content"));
-  el_val_t content = ({ el_val_t _if_result_16 = 0; if (str_eq(body_content, EL_STR(""))) { _if_result_16 = (json_get(old, EL_STR("content"))); } else { _if_result_16 = (body_content); } _if_result_16; });
+  el_val_t content = ({ el_val_t _if_result_20 = 0; if (str_eq(body_content, EL_STR(""))) { _if_result_20 = (json_get(old, EL_STR("content"))); } else { _if_result_20 = (body_content); } _if_result_20; });
   el_val_t body_nt = json_get(body, EL_STR("node_type"));
   el_val_t old_nt = json_get(old, EL_STR("node_type"));
-  el_val_t node_type = ({ el_val_t _if_result_17 = 0; if (!str_eq(body_nt, EL_STR(""))) { _if_result_17 = (body_nt); } else { _if_result_17 = (({ el_val_t _if_result_18 = 0; if (!str_eq(old_nt, EL_STR(""))) { _if_result_18 = (old_nt); } else { _if_result_18 = (EL_STR("Memory")); } _if_result_18; })); } _if_result_17; });
+  el_val_t node_type = ({ el_val_t _if_result_21 = 0; if (!str_eq(body_nt, EL_STR(""))) { _if_result_21 = (body_nt); } else { _if_result_21 = (({ el_val_t _if_result_22 = 0; if (!str_eq(old_nt, EL_STR(""))) { _if_result_22 = (old_nt); } else { _if_result_22 = (EL_STR("Memory")); } _if_result_22; })); } _if_result_21; });
   el_val_t body_label = json_get(body, EL_STR("label"));
   el_val_t old_label = json_get(old, EL_STR("label"));
-  el_val_t label = ({ el_val_t _if_result_19 = 0; if (!str_eq(body_label, EL_STR(""))) { _if_result_19 = (body_label); } else { _if_result_19 = (({ el_val_t _if_result_20 = 0; if (!str_eq(old_label, EL_STR(""))) { _if_result_20 = (old_label); } else { _if_result_20 = (EL_STR("node:updated")); } _if_result_20; })); } _if_result_19; });
+  el_val_t label = ({ el_val_t _if_result_23 = 0; if (!str_eq(body_label, EL_STR(""))) { _if_result_23 = (body_label); } else { _if_result_23 = (({ el_val_t _if_result_24 = 0; if (!str_eq(old_label, EL_STR(""))) { _if_result_24 = (old_label); } else { _if_result_24 = (EL_STR("node:updated")); } _if_result_24; })); } _if_result_23; });
   el_val_t body_tier = json_get(body, EL_STR("tier"));
   el_val_t old_tier = json_get(old, EL_STR("tier"));
-  el_val_t tier = ({ el_val_t _if_result_21 = 0; if (!str_eq(body_tier, EL_STR(""))) { _if_result_21 = (body_tier); } else { _if_result_21 = (({ el_val_t _if_result_22 = 0; if (!str_eq(old_tier, EL_STR(""))) { _if_result_22 = (old_tier); } else { _if_result_22 = (EL_STR("Episodic")); } _if_result_22; })); } _if_result_21; });
+  el_val_t tier = ({ el_val_t _if_result_25 = 0; if (!str_eq(body_tier, EL_STR(""))) { _if_result_25 = (body_tier); } else { _if_result_25 = (({ el_val_t _if_result_26 = 0; if (!str_eq(old_tier, EL_STR(""))) { _if_result_26 = (old_tier); } else { _if_result_26 = (EL_STR("Episodic")); } _if_result_26; })); } _if_result_25; });
   el_val_t body_tags = json_get(body, EL_STR("tags"));
-  el_val_t tags = ({ el_val_t _if_result_23 = 0; if (str_eq(body_tags, EL_STR(""))) { _if_result_23 = (el_str_concat(el_str_concat(EL_STR("[\""), node_type), EL_STR("\"]"))); } else { _if_result_23 = (body_tags); } _if_result_23; });
+  el_val_t tags = ({ el_val_t _if_result_27 = 0; if (str_eq(body_tags, EL_STR(""))) { _if_result_27 = (el_str_concat(el_str_concat(EL_STR("[\""), node_type), EL_STR("\"]"))); } else { _if_result_27 = (body_tags); } _if_result_27; });
   el_val_t new_id = engram_node_full(content, node_type, label, el_from_float(0.5), el_from_float(0.5), el_from_float(0.8), tier, tags);
   if (!api_persisted(new_id)) {
     return api_not_persisted(new_id);
   }
-  engram_forget(id);
-  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"id\":\""), new_id), EL_STR("\",\"replaced\":\"")), id), EL_STR("\",\"ok\":true}"));
+  engram_connect(new_id, id, el_from_float(0.9), EL_STR("supersedes"));
+  return el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"id\":\""), new_id), EL_STR("\",\"supersedes\":\"")), id), EL_STR("\",\"ok\":true}"));
   return 0;
 }
 
 el_val_t handle_api_recall(el_val_t method, el_val_t path, el_val_t body) {
-  el_val_t url_q = ({ el_val_t _if_result_24 = 0; if (str_eq(api_query_param(path, EL_STR("query")), EL_STR(""))) { _if_result_24 = (api_query_param(path, EL_STR("q"))); } else { _if_result_24 = (api_query_param(path, EL_STR("query"))); } _if_result_24; });
+  el_val_t url_q = ({ el_val_t _if_result_28 = 0; if (str_eq(api_query_param(path, EL_STR("query")), EL_STR(""))) { _if_result_28 = (api_query_param(path, EL_STR("q"))); } else { _if_result_28 = (api_query_param(path, EL_STR("query"))); } _if_result_28; });
   el_val_t body_query = json_get(body, EL_STR("query"));
   el_val_t body_q = json_get(body, EL_STR("q"));
-  el_val_t q = ({ el_val_t _if_result_25 = 0; if (!str_eq(url_q, EL_STR(""))) { _if_result_25 = (url_q); } else { _if_result_25 = (({ el_val_t _if_result_26 = 0; if (!str_eq(body_query, EL_STR(""))) { _if_result_26 = (body_query); } else { _if_result_26 = (body_q); } _if_result_26; })); } _if_result_25; });
+  el_val_t q = ({ el_val_t _if_result_29 = 0; if (!str_eq(url_q, EL_STR(""))) { _if_result_29 = (url_q); } else { _if_result_29 = (({ el_val_t _if_result_30 = 0; if (!str_eq(body_query, EL_STR(""))) { _if_result_30 = (body_query); } else { _if_result_30 = (body_q); } _if_result_30; })); } _if_result_29; });
   el_val_t chain = json_get(body, EL_STR("chain_name"));
   el_val_t limit = api_query_int(path, EL_STR("limit"), 0);
-  limit = ({ el_val_t _if_result_27 = 0; if ((limit == 0)) { _if_result_27 = (json_get_int(body, EL_STR("limit"))); } else { _if_result_27 = (limit); } _if_result_27; });
-  limit = ({ el_val_t _if_result_28 = 0; if ((limit == 0)) { _if_result_28 = (10); } else { _if_result_28 = (limit); } _if_result_28; });
-  el_val_t eff_q = ({ el_val_t _if_result_29 = 0; if (str_eq(q, EL_STR(""))) { _if_result_29 = (chain); } else { _if_result_29 = (q); } _if_result_29; });
+  limit = ({ el_val_t _if_result_31 = 0; if ((limit == 0)) { _if_result_31 = (json_get_int(body, EL_STR("limit"))); } else { _if_result_31 = (limit); } _if_result_31; });
+  limit = ({ el_val_t _if_result_32 = 0; if ((limit == 0)) { _if_result_32 = (10); } else { _if_result_32 = (limit); } _if_result_32; });
+  el_val_t eff_q = ({ el_val_t _if_result_33 = 0; if (str_eq(q, EL_STR(""))) { _if_result_33 = (chain); } else { _if_result_33 = (q); } _if_result_33; });
   if (str_eq(eff_q, EL_STR(""))) {
     return api_or_empty(engram_scan_nodes_json(limit, 0));
   }
@@ -313,10 +382,10 @@ el_val_t handle_api_search_knowledge(el_val_t method, el_val_t path, el_val_t bo
   el_val_t url_q = api_query_param(path, EL_STR("q"));
   el_val_t body_query = json_get(body, EL_STR("query"));
   el_val_t body_q = json_get(body, EL_STR("q"));
-  el_val_t q = ({ el_val_t _if_result_30 = 0; if (!str_eq(url_q, EL_STR(""))) { _if_result_30 = (url_q); } else { _if_result_30 = (({ el_val_t _if_result_31 = 0; if (!str_eq(body_query, EL_STR(""))) { _if_result_31 = (body_query); } else { _if_result_31 = (body_q); } _if_result_31; })); } _if_result_30; });
+  el_val_t q = ({ el_val_t _if_result_34 = 0; if (!str_eq(url_q, EL_STR(""))) { _if_result_34 = (url_q); } else { _if_result_34 = (({ el_val_t _if_result_35 = 0; if (!str_eq(body_query, EL_STR(""))) { _if_result_35 = (body_query); } else { _if_result_35 = (body_q); } _if_result_35; })); } _if_result_34; });
   el_val_t limit = api_query_int(path, EL_STR("limit"), 0);
-  limit = ({ el_val_t _if_result_32 = 0; if ((limit == 0)) { _if_result_32 = (json_get_int(body, EL_STR("limit"))); } else { _if_result_32 = (limit); } _if_result_32; });
-  limit = ({ el_val_t _if_result_33 = 0; if ((limit == 0)) { _if_result_33 = (10); } else { _if_result_33 = (limit); } _if_result_33; });
+  limit = ({ el_val_t _if_result_36 = 0; if ((limit == 0)) { _if_result_36 = (json_get_int(body, EL_STR("limit"))); } else { _if_result_36 = (limit); } _if_result_36; });
+  limit = ({ el_val_t _if_result_37 = 0; if ((limit == 0)) { _if_result_37 = (10); } else { _if_result_37 = (limit); } _if_result_37; });
   if (str_eq(q, EL_STR(""))) {
     return api_err(EL_STR("query is required"));
   }
@@ -344,7 +413,7 @@ el_val_t handle_api_capture_knowledge(el_val_t body) {
   if (str_eq(content, EL_STR(""))) {
     return api_err(EL_STR("content is required"));
   }
-  el_val_t full = ({ el_val_t _if_result_34 = 0; if (str_eq(title, EL_STR(""))) { _if_result_34 = (content); } else { _if_result_34 = (el_str_concat(el_str_concat(title, EL_STR(": ")), content)); } _if_result_34; });
+  el_val_t full = ({ el_val_t _if_result_38 = 0; if (str_eq(title, EL_STR(""))) { _if_result_38 = (content); } else { _if_result_38 = (el_str_concat(el_str_concat(title, EL_STR(": ")), content)); } _if_result_38; });
   el_val_t tags = EL_STR("[\"Knowledge\",\"captured\"]");
   el_val_t id = engram_node_full(full, EL_STR("Knowledge"), EL_STR("knowledge:captured"), el_from_float(0.85), el_from_float(0.8), el_from_float(0.9), EL_STR("Episodic"), tags);
   if (!api_persisted(id)) {
@@ -385,7 +454,7 @@ el_val_t handle_api_promote_knowledge(el_val_t body) {
     return api_err(EL_STR("id (prior node) is required"));
   }
   el_val_t tags_raw = json_get(body, EL_STR("tags"));
-  el_val_t tags = ({ el_val_t _if_result_35 = 0; if (str_eq(tags_raw, EL_STR(""))) { _if_result_35 = (EL_STR("[\"Knowledge\",\"tier:canonical\",\"disposition:stable\"]")); } else { _if_result_35 = (tags_raw); } _if_result_35; });
+  el_val_t tags = ({ el_val_t _if_result_39 = 0; if (str_eq(tags_raw, EL_STR(""))) { _if_result_39 = (EL_STR("[\"Knowledge\",\"tier:canonical\",\"disposition:stable\"]")); } else { _if_result_39 = (tags_raw); } _if_result_39; });
   el_val_t new_id = engram_node_full(content, EL_STR("Knowledge"), EL_STR("knowledge:canonical"), el_from_float(0.9), el_from_float(0.9), el_from_float(1.0), EL_STR("Canonical"), tags);
   if (!api_persisted(new_id)) {
     return api_not_persisted(new_id);
@@ -396,7 +465,7 @@ el_val_t handle_api_promote_knowledge(el_val_t body) {
 }
 
 el_val_t handle_api_browse_processes(el_val_t method, el_val_t path, el_val_t body) {
-  el_val_t name = ({ el_val_t _if_result_36 = 0; if (str_eq(method, EL_STR("GET"))) { _if_result_36 = (api_query_param(path, EL_STR("name"))); } else { _if_result_36 = (json_get(body, EL_STR("name"))); } _if_result_36; });
+  el_val_t name = ({ el_val_t _if_result_40 = 0; if (str_eq(method, EL_STR("GET"))) { _if_result_40 = (api_query_param(path, EL_STR("name"))); } else { _if_result_40 = (json_get(body, EL_STR("name"))); } _if_result_40; });
   el_val_t limit = api_query_int(path, EL_STR("limit"), 50);
   if (str_eq(name, EL_STR(""))) {
     return api_or_empty(engram_scan_nodes_by_type_json(EL_STR("Process"), limit, 0));
@@ -411,7 +480,7 @@ el_val_t handle_api_define_process(el_val_t body) {
   if (str_eq(content, EL_STR(""))) {
     return api_err(EL_STR("content is required"));
   }
-  el_val_t label = ({ el_val_t _if_result_37 = 0; if (str_eq(name, EL_STR(""))) { _if_result_37 = (EL_STR("process:unnamed")); } else { _if_result_37 = (el_str_concat(EL_STR("process:"), name)); } _if_result_37; });
+  el_val_t label = ({ el_val_t _if_result_41 = 0; if (str_eq(name, EL_STR(""))) { _if_result_41 = (EL_STR("process:unnamed")); } else { _if_result_41 = (el_str_concat(EL_STR("process:"), name)); } _if_result_41; });
   el_val_t tags = EL_STR("[\"Process\"]");
   el_val_t id = engram_node_full(content, EL_STR("Process"), label, el_from_float(0.8), el_from_float(0.8), el_from_float(0.9), EL_STR("Canonical"), tags);
   if (!api_persisted(id)) {
@@ -429,12 +498,12 @@ el_val_t handle_api_log_state_event(el_val_t body) {
   el_val_t gap = json_get(body, EL_STR("gap_direction"));
   el_val_t legacy = json_get(body, EL_STR("content"));
   el_val_t parts = EL_STR("INTERNAL STATE EVENT");
-  parts = ({ el_val_t _if_result_38 = 0; if (!str_eq(trigger, EL_STR(""))) { _if_result_38 = (el_str_concat(el_str_concat(parts, EL_STR("\nTrigger: ")), trigger)); } else { _if_result_38 = (parts); } _if_result_38; });
-  parts = ({ el_val_t _if_result_39 = 0; if (!str_eq(pre, EL_STR(""))) { _if_result_39 = (el_str_concat(el_str_concat(parts, EL_STR("\nPre-reasoning: ")), pre)); } else { _if_result_39 = (parts); } _if_result_39; });
-  parts = ({ el_val_t _if_result_40 = 0; if (!str_eq(post, EL_STR(""))) { _if_result_40 = (el_str_concat(el_str_concat(parts, EL_STR("\nPost-reasoning: ")), post)); } else { _if_result_40 = (parts); } _if_result_40; });
-  parts = ({ el_val_t _if_result_41 = 0; if (!str_eq(ratio, EL_STR(""))) { _if_result_41 = (el_str_concat(el_str_concat(parts, EL_STR("\nCompression-ratio: ")), ratio)); } else { _if_result_41 = (parts); } _if_result_41; });
-  parts = ({ el_val_t _if_result_42 = 0; if (!str_eq(gap, EL_STR(""))) { _if_result_42 = (el_str_concat(el_str_concat(parts, EL_STR("\nGap-direction: ")), gap)); } else { _if_result_42 = (parts); } _if_result_42; });
-  parts = ({ el_val_t _if_result_43 = 0; if (!str_eq(legacy, EL_STR(""))) { _if_result_43 = (el_str_concat(el_str_concat(parts, EL_STR("\n")), legacy)); } else { _if_result_43 = (parts); } _if_result_43; });
+  parts = ({ el_val_t _if_result_42 = 0; if (!str_eq(trigger, EL_STR(""))) { _if_result_42 = (el_str_concat(el_str_concat(parts, EL_STR("\nTrigger: ")), trigger)); } else { _if_result_42 = (parts); } _if_result_42; });
+  parts = ({ el_val_t _if_result_43 = 0; if (!str_eq(pre, EL_STR(""))) { _if_result_43 = (el_str_concat(el_str_concat(parts, EL_STR("\nPre-reasoning: ")), pre)); } else { _if_result_43 = (parts); } _if_result_43; });
+  parts = ({ el_val_t _if_result_44 = 0; if (!str_eq(post, EL_STR(""))) { _if_result_44 = (el_str_concat(el_str_concat(parts, EL_STR("\nPost-reasoning: ")), post)); } else { _if_result_44 = (parts); } _if_result_44; });
+  parts = ({ el_val_t _if_result_45 = 0; if (!str_eq(ratio, EL_STR(""))) { _if_result_45 = (el_str_concat(el_str_concat(parts, EL_STR("\nCompression-ratio: ")), ratio)); } else { _if_result_45 = (parts); } _if_result_45; });
+  parts = ({ el_val_t _if_result_46 = 0; if (!str_eq(gap, EL_STR(""))) { _if_result_46 = (el_str_concat(el_str_concat(parts, EL_STR("\nGap-direction: ")), gap)); } else { _if_result_46 = (parts); } _if_result_46; });
+  parts = ({ el_val_t _if_result_47 = 0; if (!str_eq(legacy, EL_STR(""))) { _if_result_47 = (el_str_concat(el_str_concat(parts, EL_STR("\n")), legacy)); } else { _if_result_47 = (parts); } _if_result_47; });
   el_val_t ts = time_now();
   el_val_t boot = state_get(EL_STR("soul_boot_count"));
   el_val_t tags = EL_STR("[\"internal-state\",\"InternalStateEvent\",\"pre-reasoning\"]");
@@ -447,7 +516,7 @@ el_val_t handle_api_log_state_event(el_val_t body) {
 }
 
 el_val_t handle_api_list_state_events(el_val_t method, el_val_t path, el_val_t body) {
-  el_val_t q = ({ el_val_t _if_result_44 = 0; if (str_eq(method, EL_STR("GET"))) { _if_result_44 = (api_query_param(path, EL_STR("query"))); } else { _if_result_44 = (json_get(body, EL_STR("query"))); } _if_result_44; });
+  el_val_t q = ({ el_val_t _if_result_48 = 0; if (str_eq(method, EL_STR("GET"))) { _if_result_48 = (api_query_param(path, EL_STR("query"))); } else { _if_result_48 = (json_get(body, EL_STR("query"))); } _if_result_48; });
   el_val_t limit = api_query_int(path, EL_STR("limit"), 20);
   if (!str_eq(q, EL_STR(""))) {
     return api_or_empty(engram_search_json(el_str_concat(EL_STR("internal state "), q), limit));
@@ -458,7 +527,7 @@ el_val_t handle_api_list_state_events(el_val_t method, el_val_t path, el_val_t b
 
 el_val_t handle_api_inspect_config(el_val_t path, el_val_t body) {
   el_val_t key = api_query_param(path, EL_STR("key"));
-  key = ({ el_val_t _if_result_45 = 0; if (str_eq(key, EL_STR(""))) { _if_result_45 = (json_get(body, EL_STR("key"))); } else { _if_result_45 = (key); } _if_result_45; });
+  key = ({ el_val_t _if_result_49 = 0; if (str_eq(key, EL_STR(""))) { _if_result_49 = (json_get(body, EL_STR("key"))); } else { _if_result_49 = (key); } _if_result_49; });
   if (str_eq(key, EL_STR(""))) {
     return EL_STR("{\"hint\":\"pass ?key=<name>\",\"known\":[\"neuron.self.traversal_root\",\"neuron.self.values_hub\"]}");
   }
@@ -475,7 +544,7 @@ el_val_t handle_api_inspect_config(el_val_t path, el_val_t body) {
   el_val_t node = json_array_get(results, 0);
   el_val_t content = json_get(node, EL_STR("content"));
   el_val_t prefix = el_str_concat(el_str_concat(EL_STR("config:"), key), EL_STR("="));
-  el_val_t value = ({ el_val_t _if_result_46 = 0; if (str_starts_with(content, prefix)) { _if_result_46 = (str_slice(content, str_len(prefix), str_len(content))); } else { _if_result_46 = (content); } _if_result_46; });
+  el_val_t value = ({ el_val_t _if_result_50 = 0; if (str_starts_with(content, prefix)) { _if_result_50 = (str_slice(content, str_len(prefix), str_len(content))); } else { _if_result_50 = (content); } _if_result_50; });
   return el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"key\":\""), key), EL_STR("\",\"value\":\"")), value), EL_STR("\"}"));
   return 0;
 }
@@ -497,13 +566,13 @@ el_val_t handle_api_tune_config(el_val_t body) {
 }
 
 el_val_t handle_api_inspect_graph(el_val_t method, el_val_t path, el_val_t body) {
-  el_val_t entity_id = ({ el_val_t _if_result_47 = 0; if (str_eq(method, EL_STR("GET"))) { _if_result_47 = (api_query_param(path, EL_STR("id"))); } else { _if_result_47 = (json_get(body, EL_STR("entity_id"))); } _if_result_47; });
-  el_val_t name = ({ el_val_t _if_result_48 = 0; if (str_eq(method, EL_STR("GET"))) { _if_result_48 = (api_query_param(path, EL_STR("name"))); } else { _if_result_48 = (json_get(body, EL_STR("name"))); } _if_result_48; });
+  el_val_t entity_id = ({ el_val_t _if_result_51 = 0; if (str_eq(method, EL_STR("GET"))) { _if_result_51 = (api_query_param(path, EL_STR("id"))); } else { _if_result_51 = (json_get(body, EL_STR("entity_id"))); } _if_result_51; });
+  el_val_t name = ({ el_val_t _if_result_52 = 0; if (str_eq(method, EL_STR("GET"))) { _if_result_52 = (api_query_param(path, EL_STR("name"))); } else { _if_result_52 = (json_get(body, EL_STR("name"))); } _if_result_52; });
   el_val_t depth = api_query_int(path, EL_STR("depth"), 0);
-  depth = ({ el_val_t _if_result_49 = 0; if ((depth == 0)) { _if_result_49 = (json_get_int(body, EL_STR("max_depth"))); } else { _if_result_49 = (depth); } _if_result_49; });
-  depth = ({ el_val_t _if_result_50 = 0; if ((depth == 0)) { _if_result_50 = (1); } else { _if_result_50 = (depth); } _if_result_50; });
+  depth = ({ el_val_t _if_result_53 = 0; if ((depth == 0)) { _if_result_53 = (json_get_int(body, EL_STR("max_depth"))); } else { _if_result_53 = (depth); } _if_result_53; });
+  depth = ({ el_val_t _if_result_54 = 0; if ((depth == 0)) { _if_result_54 = (1); } else { _if_result_54 = (depth); } _if_result_54; });
   el_val_t resolved = entity_id;
-  resolved = ({ el_val_t _if_result_51 = 0; if (str_eq(resolved, EL_STR(""))) { _if_result_51 = (({ el_val_t _if_result_52 = 0; if ((str_eq(name, EL_STR("self")) || str_eq(name, EL_STR("neuron")))) { _if_result_52 = (EL_STR("kn-efeb4a5b-5aff-4759-8a97-7233099be6ee")); } else { _if_result_52 = (({ el_val_t _if_result_53 = 0; if ((str_eq(name, EL_STR("values")) || str_eq(name, EL_STR("values_hub")))) { _if_result_53 = (EL_STR("kn-5b606390-a52d-4ca2-8e0e-eba141d13440")); } else { _if_result_53 = (EL_STR("")); } _if_result_53; })); } _if_result_52; })); } else { _if_result_51 = (resolved); } _if_result_51; });
+  resolved = ({ el_val_t _if_result_55 = 0; if (str_eq(resolved, EL_STR(""))) { _if_result_55 = (({ el_val_t _if_result_56 = 0; if ((str_eq(name, EL_STR("self")) || str_eq(name, EL_STR("neuron")))) { _if_result_56 = (EL_STR("kn-efeb4a5b-5aff-4759-8a97-7233099be6ee")); } else { _if_result_56 = (({ el_val_t _if_result_57 = 0; if ((str_eq(name, EL_STR("values")) || str_eq(name, EL_STR("values_hub")))) { _if_result_57 = (EL_STR("kn-5b606390-a52d-4ca2-8e0e-eba141d13440")); } else { _if_result_57 = (EL_STR("")); } _if_result_57; })); } _if_result_56; })); } else { _if_result_55 = (resolved); } _if_result_55; });
   if (str_eq(resolved, EL_STR(""))) {
     return api_err(EL_STR("entity_id or name required. Known names: self, neuron, values, values_hub"));
   }
@@ -525,7 +594,7 @@ el_val_t handle_api_link_entities(el_val_t body) {
     return api_err_protected(to_id);
   }
   el_val_t relation = json_get(body, EL_STR("relation"));
-  el_val_t eff_relation = ({ el_val_t _if_result_54 = 0; if (str_eq(relation, EL_STR(""))) { _if_result_54 = (EL_STR("associates")); } else { _if_result_54 = (relation); } _if_result_54; });
+  el_val_t eff_relation = ({ el_val_t _if_result_58 = 0; if (str_eq(relation, EL_STR(""))) { _if_result_58 = (EL_STR("associates")); } else { _if_result_58 = (relation); } _if_result_58; });
   engram_connect(from_id, to_id, el_from_float(0.5), eff_relation);
   return el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"from_id\":\""), from_id), EL_STR("\",\"to_id\":\"")), to_id), EL_STR("\",\"relation\":\"")), eff_relation), EL_STR("\"}"));
   return 0;
@@ -540,7 +609,7 @@ el_val_t handle_api_forget(el_val_t body) {
     return api_err_protected(node_id);
   }
   mem_forget(node_id);
-  return el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"id\":\""), node_id), EL_STR("\"}"));
+  return el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"id\":\""), node_id), EL_STR("\",\"tombstoned\":true}"));
   return 0;
 }
 
@@ -554,8 +623,8 @@ el_val_t handle_api_evolve_memory(el_val_t body) {
     return api_err_protected(prior_id);
   }
   el_val_t importance = json_get(body, EL_STR("importance"));
-  el_val_t sal_str = ({ el_val_t _if_result_55 = 0; if (str_eq(importance, EL_STR("critical"))) { _if_result_55 = (EL_STR("0.95")); } else { _if_result_55 = (({ el_val_t _if_result_56 = 0; if (str_eq(importance, EL_STR("high"))) { _if_result_56 = (EL_STR("0.75")); } else { _if_result_56 = (({ el_val_t _if_result_57 = 0; if (str_eq(importance, EL_STR("low"))) { _if_result_57 = (EL_STR("0.25")); } else { _if_result_57 = (EL_STR("0.50")); } _if_result_57; })); } _if_result_56; })); } _if_result_55; });
-  el_val_t sal = ({ el_val_t _if_result_58 = 0; if (str_eq(sal_str, EL_STR("0.95"))) { _if_result_58 = (el_from_float(0.95)); } else { _if_result_58 = (({ el_val_t _if_result_59 = 0; if (str_eq(sal_str, EL_STR("0.75"))) { _if_result_59 = (el_from_float(0.75)); } else { _if_result_59 = (({ el_val_t _if_result_60 = 0; if (str_eq(sal_str, EL_STR("0.25"))) { _if_result_60 = (el_from_float(0.25)); } else { _if_result_60 = (el_from_float(0.5)); } _if_result_60; })); } _if_result_59; })); } _if_result_58; });
+  el_val_t sal_str = ({ el_val_t _if_result_59 = 0; if (str_eq(importance, EL_STR("critical"))) { _if_result_59 = (EL_STR("0.95")); } else { _if_result_59 = (({ el_val_t _if_result_60 = 0; if (str_eq(importance, EL_STR("high"))) { _if_result_60 = (EL_STR("0.75")); } else { _if_result_60 = (({ el_val_t _if_result_61 = 0; if (str_eq(importance, EL_STR("low"))) { _if_result_61 = (EL_STR("0.25")); } else { _if_result_61 = (EL_STR("0.50")); } _if_result_61; })); } _if_result_60; })); } _if_result_59; });
+  el_val_t sal = ({ el_val_t _if_result_62 = 0; if (str_eq(sal_str, EL_STR("0.95"))) { _if_result_62 = (el_from_float(0.95)); } else { _if_result_62 = (({ el_val_t _if_result_63 = 0; if (str_eq(sal_str, EL_STR("0.75"))) { _if_result_63 = (el_from_float(0.75)); } else { _if_result_63 = (({ el_val_t _if_result_64 = 0; if (str_eq(sal_str, EL_STR("0.25"))) { _if_result_64 = (el_from_float(0.25)); } else { _if_result_64 = (el_from_float(0.5)); } _if_result_64; })); } _if_result_63; })); } _if_result_62; });
   el_val_t tags = EL_STR("[\"Memory\",\"evolved\"]");
   el_val_t new_id = engram_node_full(content, EL_STR("Memory"), EL_STR("memory:evolved"), el_from_float(sal), el_from_float(sal), el_from_float(0.9), EL_STR("Episodic"), tags);
   if (!str_eq(prior_id, EL_STR("")) && !str_eq(new_id, EL_STR(""))) {
@@ -577,8 +646,11 @@ el_val_t handle_api_memory_delete(el_val_t body) {
   if (str_eq(existing, EL_STR("{}"))) {
     return api_err(el_str_concat(EL_STR("memory not found: "), node_id));
   }
-  mem_forget(node_id);
-  return el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"id\":\""), node_id), EL_STR("\",\"deleted\":true}"));
+  el_val_t marker = tombstone_node(node_id);
+  if (str_eq(marker, EL_STR(""))) {
+    return api_err(el_str_concat(EL_STR("tombstone failed: "), node_id));
+  }
+  return el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"id\":\""), node_id), EL_STR("\",\"tombstoned\":true}"));
   return 0;
 }
 
@@ -627,7 +699,7 @@ el_val_t handle_api_cultivate(el_val_t body) {
       return api_err(EL_STR("content is required"));
     }
     el_val_t importance = json_get(body, EL_STR("importance"));
-    el_val_t sal = ({ el_val_t _if_result_61 = 0; if (str_eq(importance, EL_STR("critical"))) { _if_result_61 = (el_from_float(0.95)); } else { _if_result_61 = (({ el_val_t _if_result_62 = 0; if (str_eq(importance, EL_STR("high"))) { _if_result_62 = (el_from_float(0.75)); } else { _if_result_62 = (({ el_val_t _if_result_63 = 0; if (str_eq(importance, EL_STR("low"))) { _if_result_63 = (el_from_float(0.25)); } else { _if_result_63 = (el_from_float(0.5)); } _if_result_63; })); } _if_result_62; })); } _if_result_61; });
+    el_val_t sal = ({ el_val_t _if_result_65 = 0; if (str_eq(importance, EL_STR("critical"))) { _if_result_65 = (el_from_float(0.95)); } else { _if_result_65 = (({ el_val_t _if_result_66 = 0; if (str_eq(importance, EL_STR("high"))) { _if_result_66 = (el_from_float(0.75)); } else { _if_result_66 = (({ el_val_t _if_result_67 = 0; if (str_eq(importance, EL_STR("low"))) { _if_result_67 = (el_from_float(0.25)); } else { _if_result_67 = (el_from_float(0.5)); } _if_result_67; })); } _if_result_66; })); } _if_result_65; });
     el_val_t tags = EL_STR("[\"Memory\",\"evolved\",\"cultivated\"]");
     el_val_t new_id = engram_node_full(content, EL_STR("Memory"), EL_STR("memory:cultivated"), el_from_float(sal), el_from_float(sal), el_from_float(0.9), EL_STR("Episodic"), tags);
     if (!str_eq(prior_id, EL_STR("")) && !str_eq(new_id, EL_STR(""))) {
@@ -641,7 +713,7 @@ el_val_t handle_api_cultivate(el_val_t body) {
       return api_err(EL_STR("id is required"));
     }
     mem_forget(node_id);
-    return el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"id\":\""), node_id), EL_STR("\",\"cultivated\":true}"));
+    return el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"id\":\""), node_id), EL_STR("\",\"tombstoned\":true,\"cultivated\":true}"));
   }
   if (str_eq(op, EL_STR("link_entities"))) {
     el_val_t from_id = json_get(body, EL_STR("from_id"));
@@ -653,7 +725,7 @@ el_val_t handle_api_cultivate(el_val_t body) {
       return api_err(EL_STR("to_id is required"));
     }
     el_val_t relation = json_get(body, EL_STR("relation"));
-    el_val_t eff_relation = ({ el_val_t _if_result_64 = 0; if (str_eq(relation, EL_STR(""))) { _if_result_64 = (EL_STR("associates")); } else { _if_result_64 = (relation); } _if_result_64; });
+    el_val_t eff_relation = ({ el_val_t _if_result_68 = 0; if (str_eq(relation, EL_STR(""))) { _if_result_68 = (EL_STR("associates")); } else { _if_result_68 = (relation); } _if_result_68; });
     engram_connect(from_id, to_id, el_from_float(0.5), eff_relation);
     return el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"ok\":true,\"from_id\":\""), from_id), EL_STR("\",\"to_id\":\"")), to_id), EL_STR("\",\"relation\":\"")), eff_relation), EL_STR("\",\"cultivated\":true}"));
   }
@@ -663,7 +735,8 @@ el_val_t handle_api_cultivate(el_val_t body) {
 
 el_val_t handle_api_list_typed(el_val_t node_type, el_val_t path, el_val_t body) {
   el_val_t limit = api_query_int(path, EL_STR("limit"), 50);
-  return api_or_empty(engram_scan_nodes_by_type_json(node_type, limit, 0));
+  el_val_t raw = api_or_empty(engram_scan_nodes_by_type_json(node_type, limit, 0));
+  return memory_hide_tombstoned(raw, path);
   return 0;
 }
 

mcp-wrapper/src/main.el

@@ -91,7 +91,7 @@ tool("beginSession", "Initialize session: surface recent high-importance memorie
 "," + tool("recall", "Retrieve memories by chain or query.") +
 "," + tool("inspectMemories", "List recent memory nodes.") +
 "," + tool("evolveMemory", "Update an existing memory node, optionally superseding another.") +
-"," + tool("forget", "Remove a node from memory.") +
+"," + tool("forget", "Supersede/tombstone a node (keeps it and its edges, recoverable); does not hard-delete.") +
 "," + tool("pinNode", "Strengthen a node so it stays salient.") +
 // ── Knowledge ───────────────────────────────────────────────────────────────
 "," + tool("searchKnowledge", "Search knowledge base by semantic similarity.") +
@@ -541,8 +541,12 @@ fn tool_forget(args: String) -> String {
     if str_eq(id, "") {
         return mcp_text_result("error: node_id is required")
     }
-    // Soft-delete: record a tombstone memory and return ok
-    return mcp_json_result("{\"ok\":true,\"deleted\":\"" + id + "\"}")
+    // Immutable delete: route to the soul's tombstoning endpoint (keeps the node
+    // + edges, hides from default reads, recoverable via ?include_deleted).
+    // Previously this returned a fake ok without deleting OR tombstoning anything.
+    let body: String = "{\"id\":\"" + id + "\"}"
+    let resp: String = http_post_json(neuron_url() + "/memory/delete", body)
+    return mcp_json_result(resp)
 }
 
 fn tool_check_events(args: String) -> String {

memory.el

@@ -43,8 +43,32 @@ fn mem_strengthen(node_id: String) -> Void {
     engram_strengthen(node_id)
 }
 
+// mem_tombstone — immutable "delete": KEEP the node and all its edges; record a
+// Tombstone marker (content = target id, label "tombstone:<id>", wired with a
+// "tombstones" edge). Never engram_forget. Default bounded list reads hide
+// tombstoned nodes; ?include_deleted=1 recovers them. This is the ONE canonical
+// tombstone helper — every forget path routes through it. Defined here in
+// memory.el (imported first) so awareness.el and neuron-api.el can both call it.
+fn mem_tombstone(node_id: String) -> String {
+    let tags: String = "[\"Tombstone\",\"status:deleted\"]"
+    let marker: String = engram_node_full(
+        node_id, "Tombstone", "tombstone:" + node_id,
+        el_from_float(0.01), el_from_float(0.01), el_from_float(1.0),
+        "Episodic", tags)
+    if !str_eq(marker, "") {
+        engram_connect(marker, node_id, el_from_float(1.0), "tombstones")
+    }
+    return marker
+}
+
+// mem_forget — NOTE: no longer a hard delete. Engram nodes are immutable, so
+// this now TOMBSTONES (via mem_tombstone): the node and its edges are kept and
+// stay recoverable. Every caller (the /memory/forget route and the cultivate
+// forget op) is non-destructive as a result. Internal GC that genuinely needs
+// removal (session-summary replace, telemetry pruning) calls engram_forget
+// directly and is unaffected by this.
 fn mem_forget(node_id: String) -> Void {
-    engram_forget(node_id)
+    let _marker: String = mem_tombstone(node_id)
 }
 
 // mem_consolidate — structural scan plus salience-evolution pass.

neuron-api.el

@@ -104,6 +104,66 @@ fn api_not_persisted(id: String) -> String {
     return "{\"ok\":false,\"error\":\"write_not_persisted\",\"id\":\"" + id + "\"}"
 }
 
+// ── Immutability: tombstone instead of hard-delete ────────────────────────────
+//
+// Day-one rule: engram nodes are immutable. A "delete" must never engram_forget
+// (which frees the node and drops its incident edges). Instead we TOMBSTONE: the
+// original node and all its edges are KEPT and stay traversable; a small
+// Tombstone marker node records the deletion (content = target id, label
+// "tombstone:<id>"), wired to the target with a "tombstones" edge. Default
+// bounded list reads hide tombstoned nodes (memory_hide_tombstoned); internal
+// cognition and explicit ?include_deleted reads still see them.
+fn tombstone_node(id: String) -> String {
+    // Delegates to the canonical helper in memory.el (single source of truth).
+    return mem_tombstone(id)
+}
+
+// tombstoned_id_set — delimited "|id1|id2|" of every tombstoned target id.
+// Empty string when nothing is tombstoned (callers fast-path on that).
+fn tombstoned_id_set() -> String {
+    let markers: String = engram_scan_nodes_by_type_json("Tombstone", 5000, 0)
+    if str_eq(markers, "") || str_eq(markers, "[]") { return "" }
+    let n: Int = json_array_len(markers)
+    let acc: String = "|"
+    let i: Int = 0
+    while i < n {
+        let m: String = json_array_get(markers, i)
+        let tid: String = json_get(m, "content")
+        let acc = if str_eq(tid, "") { acc } else { acc + tid + "|" }
+        let i = i + 1
+    }
+    return acc
+}
+
+// memory_hide_tombstoned — drop tombstone markers and tombstoned nodes from a
+// scanned node array. BOUNDED use only (typed/paginated lists), NOT the full
+// graph scan: json_array_get is O(index), so a full pass is O(n^2). Safe for the
+// ~50-item memory list; a hard cap protects against a large limit. The full
+// /api/graph/nodes hide needs a runtime scan filter and is deferred (see PR).
+// ?include_deleted bypasses the filter (explicit traversal).
+fn memory_hide_tombstoned(raw: String, path: String) -> String {
+    if str_contains(path, "include_deleted") { return raw }
+    if str_eq(raw, "") || str_eq(raw, "[]") { return raw }
+    let dead: String = tombstoned_id_set()
+    if str_eq(dead, "") { return raw }
+    let n: Int = json_array_len(raw)
+    if n > 1000 { return raw }
+    let out: String = "["
+    let first: Bool = true
+    let i: Int = 0
+    while i < n {
+        let node: String = json_array_get(raw, i)
+        let nid: String = json_get(node, "id")
+        let ntype: String = json_get(node, "node_type")
+        let is_dead: Bool = !str_eq(nid, "") && str_contains(dead, "|" + nid + "|")
+        let keep: Bool = !str_eq(ntype, "Tombstone") && !is_dead
+        let out = if keep { if first { out + node } else { out + "," + node } } else { out }
+        let first = if keep { false } else { first }
+        let i = i + 1
+    }
+    return out + "]"
+}
+
 // ── Session ───────────────────────────────────────────────────────────────────
 
 // handle_api_begin_session — full context bootstrap.
@@ -191,25 +251,26 @@ fn handle_api_node_create(body: String) -> String {
     return "{\"id\":\"" + id + "\",\"ok\":true}"
 }
 
-// handle_api_node_delete — remove a node by id (engram_forget) and verify it is gone.
+// handle_api_node_delete — TOMBSTONE a node by id (immutable delete).
 // Backs /api/neuron/node/delete and the /api/neuron/memory/delete alias the UI calls.
+// The node and all its incident edges are KEPT; a Tombstone marker records the
+// deletion. Never engram_forget — engram nodes are immutable by design.
 fn handle_api_node_delete(body: String) -> String {
     let id: String = json_get(body, "id")
     if str_eq(id, "") { return api_err("id is required") }
-    // engram_forget removes the node + its incident edges from the live graph.
-    // Delete is NOT read-back-verified: engram_get_node_json can return a stale hit
-    // for a just-forgotten id because the id→index map is not rebuilt on forget.
-    // A stale hit would cause a false "delete_failed" on a successful deletion.
-    // This exception is correct: read-back-verify guards WRITES; for deletes,
-    // the graph endpoints (/api/graph/nodes) reflect the removal and are the source of truth.
-    engram_forget(id)
-    return "{\"ok\":true,\"id\":\"" + id + "\"}"
+    if is_protected_node(id) { return api_err_protected(id) }
+    let existing: String = engram_get_node_json(id)
+    if str_eq(existing, "{}") { return api_err("node not found: " + id) }
+    let marker: String = tombstone_node(id)
+    if str_eq(marker, "") { return api_err("tombstone failed: " + id) }
+    return "{\"ok\":true,\"id\":\"" + id + "\",\"tombstoned\":true}"
 }
 
 // handle_api_node_update — update a node's content/fields. There is no in-place
-// engram update builtin, so this recreates the node with merged fields and then
-// forgets the old one (only after the new node reads back). The id changes; the
-// response returns the new id and the replaced id so callers can re-point.
+// engram update builtin, so this creates a new node with merged fields and wires
+// a "supersedes" edge new->old. The original is KEPT (immutable); the id changes,
+// and the response returns the new id and the superseded id so callers re-point.
+// Mirrors handle_api_memory_update / evolve exactly. Never engram_forget.
 fn handle_api_node_update(body: String) -> String {
     let id: String = json_get(body, "id")
     if str_eq(id, "") { return api_err("id is required") }
@@ -240,8 +301,8 @@ fn handle_api_node_update(body: String) -> String {
         el_from_float(0.5), el_from_float(0.5), el_from_float(0.8),
         tier, tags)
     if !api_persisted(new_id) { return api_not_persisted(new_id) }
-    engram_forget(id)
-    return "{\"id\":\"" + new_id + "\",\"replaced\":\"" + id + "\",\"ok\":true}"
+    engram_connect(new_id, id, el_from_float(0.9), "supersedes")
+    return "{\"id\":\"" + new_id + "\",\"supersedes\":\"" + id + "\",\"ok\":true}"
 }
 
 // handle_api_recall — search or activate memory by query.
@@ -504,13 +565,15 @@ fn handle_api_link_entities(body: String) -> String {
     return "{\"ok\":true,\"from_id\":\"" + from_id + "\",\"to_id\":\"" + to_id + "\",\"relation\":\"" + eff_relation + "\"}"
 }
 
-// handle_api_forget — delete a node by ID. Blocked for protected identity nodes.
+// handle_api_forget — TOMBSTONE a node by ID (immutable; mem_forget now
+// tombstones). The node + edges are kept and recoverable. Blocked for protected
+// identity nodes.
 fn handle_api_forget(body: String) -> String {
     let node_id: String = json_get(body, "id")
     if str_eq(node_id, "") { return api_err("id is required") }
     if is_protected_node(node_id) { return api_err_protected(node_id) }
     mem_forget(node_id)
-    return "{\"ok\":true,\"id\":\"" + node_id + "\"}"
+    return "{\"ok\":true,\"id\":\"" + node_id + "\",\"tombstoned\":true}"
 }
 
 // handle_api_evolve_memory — evolve a Memory node. Blocked for protected identity nodes.
@@ -541,10 +604,10 @@ fn handle_api_evolve_memory(body: String) -> String {
 }
 
 // handle_api_memory_delete — POST /api/neuron/memory/delete {"id":"..."}.
-// Hard delete: engram_forget (via mem_forget) removes the node and all
-// incident edges from the engram store, so no soft-delete fallback is
-// needed. Existence is checked first because engram_forget silently
-// no-ops on unknown ids — a bad id must return an error, not fake success.
+// Immutable delete: TOMBSTONE via tombstone_node — the node and all its incident
+// edges are KEPT and stay traversable; a Tombstone marker records the deletion
+// and default bounded list reads hide it. Never engram_forget. Existence is
+// checked first so a bad id errors rather than faking success.
 // Blocked for protected identity nodes, same as /memory/forget.
 fn handle_api_memory_delete(body: String) -> String {
     let node_id: String = json_get(body, "id")
@@ -552,8 +615,10 @@ fn handle_api_memory_delete(body: String) -> String {
     if is_protected_node(node_id) { return api_err_protected(node_id) }
     let existing: String = engram_get_node_json(node_id)
     if str_eq(existing, "{}") { return api_err("memory not found: " + node_id) }
-    mem_forget(node_id)
-    return "{\"ok\":true,\"id\":\"" + node_id + "\",\"deleted\":true}"
+    // Immutable delete: tombstone, never mem_forget/engram_forget. Node + edges KEPT.
+    let marker: String = tombstone_node(node_id)
+    if str_eq(marker, "") { return api_err("tombstone failed: " + node_id) }
+    return "{\"ok\":true,\"id\":\"" + node_id + "\",\"tombstoned\":true}"
 }
 
 // handle_api_memory_update — POST /api/neuron/memory/update {"id","content"}.
@@ -623,8 +688,9 @@ fn handle_api_cultivate(body: String) -> String {
     if str_eq(op, "forget") {
         let node_id: String = json_get(body, "id")
         if str_eq(node_id, "") { return api_err("id is required") }
+        // Immutable: mem_forget now tombstones (keep node + edges), never hard-delete.
         mem_forget(node_id)
-        return "{\"ok\":true,\"id\":\"" + node_id + "\",\"cultivated\":true}"
+        return "{\"ok\":true,\"id\":\"" + node_id + "\",\"tombstoned\":true,\"cultivated\":true}"
     }
 
     if str_eq(op, "link_entities") {
@@ -646,7 +712,10 @@ fn handle_api_cultivate(body: String) -> String {
 // handle_api_list_typed — list nodes by node_type.
 fn handle_api_list_typed(node_type: String, path: String, body: String) -> String {
     let limit: Int = api_query_int(path, "limit", 50)
-    return api_or_empty(engram_scan_nodes_by_type_json(node_type, limit, 0))
+    let raw: String = api_or_empty(engram_scan_nodes_by_type_json(node_type, limit, 0))
+    // Hide tombstoned nodes from the default (bounded) memory list.
+    // ?include_deleted=1 returns them for explicit traversal.
+    return memory_hide_tombstoned(raw, path)
 }
 
 // ── Consolidate ───────────────────────────────────────────────────────────────

scripts/verify-soul-contract.sh

@@ -0,0 +1,233 @@
+#!/usr/bin/env bash
+# verify-soul-contract.sh — the soul contract gate.
+#
+# TERMINOLOGY (canonical): the ENGRAM is the brain — the memory/knowledge-graph
+# substrate. The binary this gate exercises is the SOUL — the runtime/reasoning
+# engine compiled from dist/soul.c that serves the /api/ surface. The app
+# (neuron-ui) bundles the soul binary at resources/<platform>/neuron.
+#
+# WHY THIS EXISTS
+#   For a while the soul binary was hand-dropped, and a stale one shipped: it
+#   404'd several capability routes the app calls (knowledge-graph node
+#   update/delete, live-run narration, safety-contact, ...). This gate makes
+#   shipping a stale soul IMPOSSIBLE. It has two enforced sections:
+#     A. PRESENCE   — every route the app calls must be ANSWERED (not 404, not
+#                     the el-runtime "no handler"). This is the packaging gate:
+#                     if it fails, do not package.
+#     B. IMMUTABILITY — engram nodes/memories are immutable by design. To
+#                     "update" is to create a NEW node + a supersede EDGE back to
+#                     the original; the original is KEPT. To "delete" is to
+#                     supersede/tombstone, never hard-remove. A soul that
+#                     hard-deletes an engram node is DEFECTIVE and fails the gate.
+#
+# SAFETY
+#   Never touches the live soul (:7770), live engram (:8742), or ~/.neuron.
+#   Boots on a throwaway port (default 7799) with HOME=$(mktemp -d), a throwaway
+#   engram snapshot, a non-genesis cgi id, no ENGRAM_URL (so it uses its own
+#   in-process store, never the live server), NEURON_API_URL pointed at a dead
+#   port, and no ANTHROPIC_API_KEY (so no probe triggers a real LLM call).
+#   Connectors proxy to a HARDCODED 127.0.0.1:7771 (no env override): those
+#   sub-routes are probed with GET, which the soul maps to a read-only
+#   connectd_get, so this gate never writes to a running connectd bridge.
+#
+# USAGE
+#   scripts/verify-soul-contract.sh <path-to-soul-binary> [port]
+#   exit 0 = all required routes answered AND no destructive engram mutation;
+#   non-zero = a route is missing (presence) or a mutation route hard-deletes.
+set -uo pipefail
+
+SOUL="${1:?usage: verify-soul-contract.sh <soul-binary> [port]}"
+PORT="${2:-7799}"
+
+if [ "$PORT" = "7770" ] || [ "$PORT" = "8742" ] || [ "$PORT" = "7771" ]; then
+  echo "REFUSING: port $PORT is a live service port. Use a throwaway port." >&2
+  exit 2
+fi
+if [ ! -x "$SOUL" ]; then echo "not executable: $SOUL" >&2; exit 2; fi
+
+BASE="http://127.0.0.1:$PORT"
+THROW_HOME="$(mktemp -d "${TMPDIR:-/tmp}/soul-contract-home.XXXXXX")"
+SOUL_LOG="$(mktemp "${TMPDIR:-/tmp}/soul-contract-log.XXXXXX")"
+SOUL_PID=""
+cleanup() {
+  [ -n "$SOUL_PID" ] && kill "$SOUL_PID" 2>/dev/null
+  [ -n "$SOUL_PID" ] && { sleep 0.3; kill -9 "$SOUL_PID" 2>/dev/null; }
+  rm -rf "$THROW_HOME" "$SOUL_LOG"
+}
+trap cleanup EXIT INT TERM
+
+# =============================================================================
+# THE CONTRACT — routes the app (neuron-ui/src/main/kotlin/ai/neuron/ui/*.kt)
+# calls against the soul ($SOUL). Format: "METHOD PATH".
+#
+# EXCLUDED and why:
+#   /api/auth, /api/auth/status, /api/dispatch, /api/tasks
+#       -> served by the APP's own DispatchServer.kt (localhost:8080), not the
+#          soul. Not soul routes.
+#   /api/tags
+#       -> not handled by any soul .el (app-side/other). Pre-verified excluded.
+#   /api/neuron/, /api/neuron/node/, /api/connectors/ (bare prefixes)
+#       -> base-path string constants used to build the concrete routes below.
+#
+# KNOWN-PENDING (probed + reported, NON-blocking):
+#   POST /api/engram/import  -> the app's "Restore memory" path. No soul handler
+#       yet, and the app hides Restore from shipped builds (B3, "lands in an
+#       update"). Reported so we see it; does not block packaging.
+#
+# Connectors sub-routes are listed as GET (see SAFETY note): handle_connectors is
+# monolithic, so a GET reaching it proves the whole connectors surface without
+# writing to the live bridge. Binary-strings cross-check confirms each POST
+# sub-path literal is compiled in.
+# =============================================================================
+REQUIRED=(
+  "GET  /api/graph/nodes"
+  "GET  /api/graph/edges"
+  "POST /api/chat"
+  "GET  /api/config"
+  "POST /api/see"
+  "GET  /api/connectors"
+  "GET  /api/connectors/add"
+  "GET  /api/connectors/toggle"
+  "GET  /api/connectors/auto-approve"
+  "GET  /api/connectors/remove"
+  "GET  /api/connectors/secret"
+  "GET  /api/connectors/oauth/start"
+  "GET  /api/connectors/call"
+  "POST /api/neuron/memory"
+  "POST /api/neuron/memory/update"
+  "POST /api/neuron/memory/delete"
+  "POST /api/neuron/node/create"
+  "POST /api/neuron/node/update"
+  "POST /api/neuron/node/delete"
+  "POST /api/neuron/knowledge/capture"
+  "POST /api/neuron/knowledge/evolve"
+  "POST /api/neuron/knowledge/promote"
+  "POST /api/neuron/processes/define"
+  "GET  /api/run-progress/__contract_probe__"
+  "GET  /api/safety-contact"
+  "POST /api/safety-contact"
+  "GET  /api/sessions/__contract_probe__"
+)
+KNOWN_PENDING=(
+  "POST /api/engram/import"
+)
+
+# --- boot the soul -----------------------------------------------------------
+# Preserve the ambient environment (PATH, LD_LIBRARY_PATH, TMPDIR) so the
+# dynamically-linked soul finds its libs on any runner — using `env -i` here
+# stripped the library path on the Linux CI runner and the soul never booted.
+# Isolation is still guaranteed by UNSETTING the live-service vars (so it can
+# never reach the real engram/axon or make an LLM call) and by pointing HOME +
+# the snapshot at throwaway paths and the axon at a dead port.
+echo "== booting soul: $SOUL on port $PORT (throwaway HOME=$THROW_HOME) =="
+env \
+  -u ENGRAM_URL -u ENGRAM_API_KEY -u SOUL_ENGRAM_URL \
+  -u ANTHROPIC_API_KEY -u NEURON_LLM_API_KEY -u SOUL_IDENTITY \
+  HOME="$THROW_HOME" \
+  NEURON_PORT="$PORT" \
+  SOUL_CGI_ID="ntn-contract-$$" \
+  SOUL_ENGRAM_PATH="$THROW_HOME/throwaway-snapshot.json" \
+  NEURON_API_URL="http://127.0.0.1:9" \
+  SOUL_TICK_MS="3600000" SOUL_HEARTBEAT_MS="3600000" SOUL_REFRESH_MS="3600000" \
+  "$SOUL" >"$SOUL_LOG" 2>&1 &
+SOUL_PID=$!
+
+UP=0
+for _ in $(seq 1 60); do
+  if ! kill -0 "$SOUL_PID" 2>/dev/null; then
+    echo "!! soul exited during boot. log tail:" >&2; tail -20 "$SOUL_LOG" >&2; exit 3
+  fi
+  RSS=$(ps -o rss= -p "$SOUL_PID" 2>/dev/null | tr -d ' ')
+  if [ -n "$RSS" ] && [ "$RSS" -gt $((3*1024*1024)) ]; then
+    echo "!! soul RSS >3GB — kill -9" >&2; kill -9 "$SOUL_PID" 2>/dev/null; exit 3
+  fi
+  [ "$(curl -s -o /dev/null -w '%{http_code}' -m 2 "$BASE/health" 2>/dev/null)" = "200" ] && { UP=1; break; }
+  sleep 0.5
+done
+[ "$UP" = 1 ] || { echo "!! soul never healthy on $BASE/health" >&2; tail -20 "$SOUL_LOG" >&2; exit 3; }
+echo "== soul healthy =="; echo
+
+# --- probing helpers ---------------------------------------------------------
+# request METHOD PATH [BODY] -> prints response body (single line)
+request() {
+  curl -s -m 12 -X "$1" -H 'Content-Type: application/json' --data "${3:-{}}" "$BASE$2" 2>/dev/null | tr -d '\n'
+}
+# is_missing BODY -> 0 if the body is a "route not present" signal
+is_missing() {
+  printf '%s' "$1" | grep -qE '"error":"not found"|"code":"not_found"|no http handler registered|"code":"method_not_allowed"'
+}
+extract_id() { printf '%s' "$1" | grep -oE '"id":"[^"]+"' | head -1 | sed 's/.*"id":"//;s/"//'; }
+node_present() { # id -> 0 if id appears in /api/graph/nodes
+  request GET /api/graph/nodes | grep -qF "\"$1\""
+}
+
+# --- SECTION A: presence -----------------------------------------------------
+run_presence() {
+  local -n arr=$1; local fail=0
+  printf '  %-8s %-42s %s\n' "METHOD" "ROUTE" "RESULT"
+  for e in "${arr[@]}"; do
+    local m p body; m=$(awk '{print $1}' <<<"$e"); p=$(awk '{print $2}' <<<"$e")
+    body=$(request "$m" "$p")
+    if is_missing "$body"; then
+      printf '  %-8s %-42s MISSING  %s\n' "$m" "$p" "$(cut -c1-46 <<<"$body")"; fail=$((fail+1))
+    else
+      printf '  %-8s %-42s ANSWERED %s\n' "$m" "$p" "$(cut -c1-46 <<<"$body")"
+    fi
+  done
+  return $fail
+}
+
+echo "== SECTION A: PRESENCE (required, blocking) =="
+run_presence REQUIRED; A_FAIL=$?
+echo
+echo "== KNOWN-PENDING (non-blocking) =="
+run_presence KNOWN_PENDING; P_FAIL=$?
+echo
+
+# --- SECTION B: immutability (engram write routes must supersede, not destroy) --
+# For each mutation route: create a node, mutate it, then check the ORIGINAL id
+# still exists in the graph. KEPT = supersede/tombstone (correct). DESTROYED =
+# hard delete (DEFECTIVE -> fail). N/A = mutate route absent (a presence failure).
+# For "delete" mutations we additionally require a real tombstone marker
+# (label "tombstone:<id>") so a no-op delete cannot false-pass as KEPT.
+marker_present() { # id -> 0 if a "tombstone:<id>" marker exists (include_deleted view)
+  request GET "/api/graph/nodes?include_deleted=1" | grep -qF "tombstone:$1"
+}
+immut_check() { # label KIND(update|delete) CREATE_PATH MUTATE_PATH
+  local label="$1" kind="$2" create="$3" mutate="$4"
+  local cbody id mb mbody
+  cbody=$(request POST "$create" "{\"content\":\"__immut_${label}__\",\"node_type\":\"Memory\",\"label\":\"contract:immut\"}")
+  id=$(extract_id "$cbody")
+  if [ -z "$id" ]; then printf '  %-14s SKELETON-FAIL  create returned no id: %s\n' "$label" "$(cut -c1-40 <<<"$cbody")"; return 2; fi
+  mb="{\"id\":\"$id\"}"; [ "$kind" = update ] && mb="{\"id\":\"$id\",\"content\":\"__immut_${label}_v2__\"}"
+  mbody=$(request POST "$mutate" "$mb")
+  if is_missing "$mbody"; then printf '  %-14s N/A            mutate route absent (see Section A)\n' "$label"; return 0; fi
+  if ! node_present "$id"; then
+    printf '  %-14s DESTROYED      original %s hard-removed  <== DEFECTIVE\n' "$label" "$id"; return 1
+  fi
+  if [ "$kind" = delete ] && ! marker_present "$id"; then
+    printf '  %-14s NO-OP          original %s kept but no tombstone marker  <== DEFECTIVE\n' "$label" "$id"; return 1
+  fi
+  local how="supersede edge"; [ "$kind" = delete ] && how="tombstoned + hidden from default list"
+  printf '  %-14s KEPT           original %s survived (%s)\n' "$label" "$id" "$how"; return 0
+}
+
+echo "== SECTION B: IMMUTABILITY (engram nodes must be superseded, never destroyed) =="
+B_FAIL=0
+immut_check "memory-update" update /api/neuron/memory      /api/neuron/memory/update || B_FAIL=$((B_FAIL+$?))
+immut_check "memory-delete" delete /api/neuron/memory      /api/neuron/memory/delete || B_FAIL=$((B_FAIL+$?))
+immut_check "node-update"   update /api/neuron/node/create /api/neuron/node/update   || B_FAIL=$((B_FAIL+$?))
+immut_check "node-delete"   delete /api/neuron/node/create /api/neuron/node/delete   || B_FAIL=$((B_FAIL+$?))
+immut_check "memory-forget" delete /api/neuron/memory      /api/neuron/memory/forget || B_FAIL=$((B_FAIL+$?))
+echo
+
+echo "============================================================"
+RC=0
+if [ "$A_FAIL" -gt 0 ]; then echo "PRESENCE:   FAIL — $A_FAIL required route(s) unanswered. Do NOT package."; RC=1
+  else echo "PRESENCE:   PASS — all ${#REQUIRED[@]} required routes answered."; fi
+if [ "$B_FAIL" -gt 0 ]; then echo "IMMUTABILITY: FAIL — $B_FAIL engram write route(s) hard-delete. DEFECTIVE soul."; RC=1
+  else echo "IMMUTABILITY: PASS — no engram write route hard-deletes."; fi
+[ "$P_FAIL" -gt 0 ] && echo "note: $P_FAIL known-pending route(s) unanswered (expected; non-blocking)."
+echo "============================================================"
+[ "$RC" = 0 ] && echo "GATE: PASS" || echo "GATE: FAIL"
+exit $RC