The "I leaked a secret into a trace; what do I do?" question now has a first-class answer: morph forget <hash> permanently retires a Run, Trace, or prompt Blob from the local store and (with --remote <name>) propagates the deletion to teammates via an immutable, content-addressed Tombstone. Code (PR 4 / v0.41.0): - morph-core/src/objects.rs: Tombstone variant added to MorphObject with original_hash / original_kind / forgotten_at / actor / reason. Content-addressed; the bytes are gone, the fact of the deletion is permanent. - morph-core/src/forget.rs (new): forget_local() validates the kind (Run / Trace / prompt Blob only), locates referencing commits, deletes the original + per-type index entries, writes the tombstone, and drops a .morph/forgotten/<hash>.txt marker. apply_tombstone() is the idempotent receiver path used by morph fetch.…