v0.4.2 — controlled-prune human UI, soft-delete, heat ordering

Highlights:

• Soft-delete (reversible). Forgotten memories get a forgottenAt tombstone and disappear from recall / injection / crystallization, but stay in the store until you restore them.
• pinned — three-tier protection. Pin a memory and it is locked from every code path: never enters prune candidates, never overwritten by near-duplicate reinforcement, never deleted without an explicit confirm=true. The protection lives in the data layer, so it holds regardless of whether the delete came from the panel, a tool call, or a future code path.
• Heat is a read-only ordering signal. Each memory gets a power-law coldness score. Time basis is accessedAt || createdAt — never updatedAt. Heat only orders prune candidates; it never archives anything automatically.
• Two-stage panel: preview → execute. Stage 1 builds an in-memory plan and returns a planDigest. Stage 2 consumes it. The plan registry uses atomic claim (synchronous consumed-flag flip before the applyPlan await) so double-click / retry / resend cannot re-execute.
• Per-target ETag staleness check. If something mutates a target between preview and execute, that target is skipped (not-found / stale) with a reason; the rest of the plan still applies.
• JSONL audit, fail-open + amortized ring-trim. Every run is appended to a JSONL sidecar (500-row cap). The audit write is fail-open — a disk error warns, never blocks the prune.

A2 layout: approval queue (existing) at top, then the new controlled-prune block, then overview. Pinned rows render their checkbox disabled.

Tool count stays at 22. Web routes now 5 (added /prune, /prune/preview, /prune/execute). The auto-physical-eviction path is retired; capacity governance is now "detect automatically, dispose explicitly" — over-budget emits a warn and surfaces trim candidates for you to act on.

Excluded by design: local vector models, semantic search, knowledge graphs (too heavy for an optimization, not a rewrite).