self-review 2026-07-28: close ISE lifecycle observability gaps

- session_start now also posted to the HTTP Engram via ise_post: the
  local engram_node_full write never crossed to the observable stream
  (sync flows HTTP->soul only), so boots 5+ were invisible — last
  visible session_start was boot 4, two weeks ago
- graceful shutdown emits a final ISE with boot/pulse/uptime; a boot
  with no shutdown event now reliably signals a crash/SIGKILL
- empty /api/sync responses emit a sync_empty warn ISE instead of
  being silently skipped — unreachable engram no longer looks
  identical to quiet-but-healthy
- sync backflow prune reads ENGRAM_ISE_RETENTION_MS instead of
  duplicating the 48h magic number server.el already honors

awareness.el

@@ -779,6 +779,17 @@ fn awareness_run() -> Void {
         let tick_mark: Any = el_arena_push()
         let running: String = state_get("soul.running")
         if str_eq(running, "false") {
+            // Shutdown ISE (2026-07-28 self-review): graceful exit was invisible
+            // in the ISE stream — indistinguishable from a crash or a frozen
+            // loop. Emit a final event with uptime/pulse so the stream records
+            // how this boot ended. (Covers state-driven shutdown only; SIGKILL
+            // still leaves no trace — that absence is itself the crash signal.)
+            let sd_boot_raw: String = state_get("soul_boot_count")
+            let sd_boot: String = if str_eq(sd_boot_raw, "") { "0" } else { sd_boot_raw }
+            ise_post("{\"event\":\"shutdown\",\"boot\":" + sd_boot
+                + ",\"pulse\":" + int_to_str(pulse_count())
+                + ",\"uptime_ms\":" + int_to_str(elapsed_ms())
+                + ",\"ts\":" + int_to_str(time_now()) + "}")
             println("[awareness] exiting")
             el_arena_pop(tick_mark)
             return ""
@@ -849,15 +860,29 @@ fn awareness_run() -> Void {
             let engram_url: String = if str_eq(sync_state_url, "") { "http://localhost:8742" } else { sync_state_url }
             if !str_eq(engram_url, "") {
                 let sync_json: String = http_get(engram_url + "/api/sync")
-                if !str_eq(sync_json, "") && !str_eq(sync_json, "{}") {
+                let sync_ok: Bool = !str_eq(sync_json, "") && !str_eq(sync_json, "{}")
+                // Empty-sync warn ISE (2026-07-28 self-review): an empty/{} sync
+                // response was silently skipped, making "engram unreachable for
+                // hours" look identical to "quiet but healthy" — the exact
+                // failure class the URL-fallback comment above fights. One warn
+                // event per refresh interval (10 min default) is cheap and makes
+                // a persistently-failing sync visible in the stream itself.
+                if !sync_ok {
+                    ise_post("{\"event\":\"sync_empty\",\"ts\":" + int_to_str(time_now()) + "}")
+                }
+                if sync_ok {
                     let cgi_id: String = state_get("soul_cgi_id")
                     let tmp: String = "/tmp/soul-sync-" + cgi_id + ".json"
                     fs_write(tmp, sync_json)
                     let added: Int = engram_load_merge(tmp)
                     // Backflow control: the merged snapshot carries ISE telemetry
-                    // from the HTTP store. Prune anything older than 48h — same
+                    // from the HTTP store. Prune on the same horizon the HTTP
-                    // horizon the HTTP store itself uses (server.el ISE insert).
+                    // store itself uses — read ENGRAM_ISE_RETENTION_MS (the env
-                    let pruned_sync: Int = engram_prune_telemetry(172800000)
+                    // server.el honors) instead of duplicating the 48h magic
+                    // number, so the two stores can't drift. (2026-07-28)
+                    let ret_raw: String = env("ENGRAM_ISE_RETENTION_MS")
+                    let ret_ms: Int = if str_eq(ret_raw, "") { 172800000 } else { str_to_int(ret_raw) }
+                    let pruned_sync: Int = engram_prune_telemetry(ret_ms)
                     // Running total of merged-in nodes this boot, surfaced in the
                     // heartbeat ISE as sync_added_total (same state mechanism as
                     // the pulse counter).

dist/awareness.c

@@ -549,6 +549,9 @@ el_val_t awareness_run(void) {
     el_val_t tick_mark = el_arena_push();
     el_val_t running = state_get(EL_STR("soul.running"));
     if (str_eq(running, EL_STR("false"))) {
+      el_val_t sd_boot_raw = state_get(EL_STR("soul_boot_count"));
+      el_val_t sd_boot = ({ el_val_t _if_result_38 = 0; if (str_eq(sd_boot_raw, EL_STR(""))) { _if_result_38 = (EL_STR("0")); } else { _if_result_38 = (sd_boot_raw); } _if_result_38; });
+      ise_post(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"event\":\"shutdown\",\"boot\":"), sd_boot), EL_STR(",\"pulse\":")), int_to_str(pulse_count())), EL_STR(",\"uptime_ms\":")), int_to_str(elapsed_ms())), EL_STR(",\"ts\":")), int_to_str(time_now())), EL_STR("}")));
       println(EL_STR("[awareness] exiting"));
       el_arena_pop(tick_mark);
       return EL_STR("");
@@ -563,7 +566,7 @@ el_val_t awareness_run(void) {
     }
     el_val_t now_ts = time_now();
     el_val_t last_beat_str = state_get(EL_STR("soul.last_beat_ts"));
-    el_val_t last_beat_ts = ({ el_val_t _if_result_38 = 0; if (str_eq(last_beat_str, EL_STR(""))) { _if_result_38 = (0); } else { _if_result_38 = (str_to_int(last_beat_str)); } _if_result_38; });
+    el_val_t last_beat_ts = ({ el_val_t _if_result_39 = 0; if (str_eq(last_beat_str, EL_STR(""))) { _if_result_39 = (0); } else { _if_result_39 = (str_to_int(last_beat_str)); } _if_result_39; });
     el_val_t beat_elapsed = (now_ts - last_beat_ts);
     el_val_t should_beat = (beat_elapsed >= beat_ms);
     if (should_beat) {
@@ -575,7 +578,7 @@ el_val_t awareness_run(void) {
       }
     }
     el_val_t last_scan_str = state_get(EL_STR("soul.last_scan_ts"));
-    el_val_t last_scan_ts = ({ el_val_t _if_result_39 = 0; if (str_eq(last_scan_str, EL_STR(""))) { _if_result_39 = (0); } else { _if_result_39 = (str_to_int(last_scan_str)); } _if_result_39; });
+    el_val_t last_scan_ts = ({ el_val_t _if_result_40 = 0; if (str_eq(last_scan_str, EL_STR(""))) { _if_result_40 = (0); } else { _if_result_40 = (str_to_int(last_scan_str)); } _if_result_40; });
     el_val_t scan_elapsed = (now_ts - last_scan_ts);
     el_val_t should_scan = (!did_work && (scan_elapsed >= scan_ms));
     if (should_scan) {
@@ -583,25 +586,31 @@ el_val_t awareness_run(void) {
       state_set(EL_STR("soul.last_scan_ts"), int_to_str(now_ts));
     }
     el_val_t refresh_ms_raw = env(EL_STR("SOUL_REFRESH_MS"));
-    el_val_t refresh_ms = ({ el_val_t _if_result_40 = 0; if (str_eq(refresh_ms_raw, EL_STR(""))) { _if_result_40 = (600000); } else { _if_result_40 = (str_to_int(refresh_ms_raw)); } _if_result_40; });
+    el_val_t refresh_ms = ({ el_val_t _if_result_41 = 0; if (str_eq(refresh_ms_raw, EL_STR(""))) { _if_result_41 = (600000); } else { _if_result_41 = (str_to_int(refresh_ms_raw)); } _if_result_41; });
     el_val_t last_refresh_str = state_get(EL_STR("soul.last_refresh_ts"));
-    el_val_t last_refresh_ts = ({ el_val_t _if_result_41 = 0; if (str_eq(last_refresh_str, EL_STR(""))) { _if_result_41 = (0); } else { _if_result_41 = (str_to_int(last_refresh_str)); } _if_result_41; });
+    el_val_t last_refresh_ts = ({ el_val_t _if_result_42 = 0; if (str_eq(last_refresh_str, EL_STR(""))) { _if_result_42 = (0); } else { _if_result_42 = (str_to_int(last_refresh_str)); } _if_result_42; });
     el_val_t refresh_elapsed = (now_ts - last_refresh_ts);
     el_val_t should_refresh = (refresh_elapsed >= refresh_ms);
     if (should_refresh) {
       el_val_t sync_env_url = env(EL_STR("SOUL_ISE_URL"));
-      el_val_t sync_state_url = ({ el_val_t _if_result_42 = 0; if (str_eq(sync_env_url, EL_STR(""))) { _if_result_42 = (state_get(EL_STR("soul_engram_url"))); } else { _if_result_42 = (sync_env_url); } _if_result_42; });
+      el_val_t sync_state_url = ({ el_val_t _if_result_43 = 0; if (str_eq(sync_env_url, EL_STR(""))) { _if_result_43 = (state_get(EL_STR("soul_engram_url"))); } else { _if_result_43 = (sync_env_url); } _if_result_43; });
-      el_val_t engram_url = ({ el_val_t _if_result_43 = 0; if (str_eq(sync_state_url, EL_STR(""))) { _if_result_43 = (EL_STR("http://localhost:8742")); } else { _if_result_43 = (sync_state_url); } _if_result_43; });
+      el_val_t engram_url = ({ el_val_t _if_result_44 = 0; if (str_eq(sync_state_url, EL_STR(""))) { _if_result_44 = (EL_STR("http://localhost:8742")); } else { _if_result_44 = (sync_state_url); } _if_result_44; });
       if (!str_eq(engram_url, EL_STR(""))) {
         el_val_t sync_json = http_get(el_str_concat(engram_url, EL_STR("/api/sync")));
-        if (!str_eq(sync_json, EL_STR("")) && !str_eq(sync_json, EL_STR("{}"))) {
+        el_val_t sync_ok = (!str_eq(sync_json, EL_STR("")) && !str_eq(sync_json, EL_STR("{}")));
+        if (!sync_ok) {
+          ise_post(el_str_concat(el_str_concat(EL_STR("{\"event\":\"sync_empty\",\"ts\":"), int_to_str(time_now())), EL_STR("}")));
+        }
+        if (sync_ok) {
           el_val_t cgi_id = state_get(EL_STR("soul_cgi_id"));
           el_val_t tmp = el_str_concat(el_str_concat(EL_STR("/tmp/soul-sync-"), cgi_id), EL_STR(".json"));
           fs_write(tmp, sync_json);
           el_val_t added = engram_load_merge(tmp);
-          el_val_t pruned_sync = engram_prune_telemetry(172800000);
+          el_val_t ret_raw = env(EL_STR("ENGRAM_ISE_RETENTION_MS"));
+          el_val_t ret_ms = ({ el_val_t _if_result_45 = 0; if (str_eq(ret_raw, EL_STR(""))) { _if_result_45 = (172800000); } else { _if_result_45 = (str_to_int(ret_raw)); } _if_result_45; });
+          el_val_t pruned_sync = engram_prune_telemetry(ret_ms);
           el_val_t sat_raw = state_get(EL_STR("soul.sync_added_total"));
-          el_val_t sat_n = ({ el_val_t _if_result_44 = 0; if (str_eq(sat_raw, EL_STR(""))) { _if_result_44 = (0); } else { _if_result_44 = (str_to_int(sat_raw)); } _if_result_44; });
+          el_val_t sat_n = ({ el_val_t _if_result_46 = 0; if (str_eq(sat_raw, EL_STR(""))) { _if_result_46 = (0); } else { _if_result_46 = (str_to_int(sat_raw)); } _if_result_46; });
           state_set(EL_STR("soul.sync_added_total"), int_to_str((sat_n + added)));
           el_val_t ts2 = time_now();
           state_set(EL_STR("soul.last_sync_ok_ts"), int_to_str(ts2));
@@ -627,78 +636,78 @@ el_val_t security_research_authorized(void) {
 }
 
 el_val_t threat_score_command(el_val_t cmd) {
-  el_val_t s1 = ({ el_val_t _if_result_45 = 0; if (str_contains(cmd, EL_STR("nmap"))) { _if_result_45 = (30); } else { _if_result_45 = (0); } _if_result_45; });
+  el_val_t s1 = ({ el_val_t _if_result_47 = 0; if (str_contains(cmd, EL_STR("nmap"))) { _if_result_47 = (30); } else { _if_result_47 = (0); } _if_result_47; });
-  el_val_t s2 = ({ el_val_t _if_result_46 = 0; if (str_contains(cmd, EL_STR("masscan"))) { _if_result_46 = (40); } else { _if_result_46 = (0); } _if_result_46; });
+  el_val_t s2 = ({ el_val_t _if_result_48 = 0; if (str_contains(cmd, EL_STR("masscan"))) { _if_result_48 = (40); } else { _if_result_48 = (0); } _if_result_48; });
-  el_val_t s3 = ({ el_val_t _if_result_47 = 0; if (str_contains(cmd, EL_STR(" nc "))) { _if_result_47 = (20); } else { _if_result_47 = (0); } _if_result_47; });
+  el_val_t s3 = ({ el_val_t _if_result_49 = 0; if (str_contains(cmd, EL_STR(" nc "))) { _if_result_49 = (20); } else { _if_result_49 = (0); } _if_result_49; });
-  el_val_t s4 = ({ el_val_t _if_result_48 = 0; if (str_contains(cmd, EL_STR("netcat"))) { _if_result_48 = (20); } else { _if_result_48 = (0); } _if_result_48; });
+  el_val_t s4 = ({ el_val_t _if_result_50 = 0; if (str_contains(cmd, EL_STR("netcat"))) { _if_result_50 = (20); } else { _if_result_50 = (0); } _if_result_50; });
-  el_val_t s5 = ({ el_val_t _if_result_49 = 0; if (str_contains(cmd, EL_STR("/etc/shadow"))) { _if_result_49 = (80); } else { _if_result_49 = (0); } _if_result_49; });
+  el_val_t s5 = ({ el_val_t _if_result_51 = 0; if (str_contains(cmd, EL_STR("/etc/shadow"))) { _if_result_51 = (80); } else { _if_result_51 = (0); } _if_result_51; });
-  el_val_t s6 = ({ el_val_t _if_result_50 = 0; if (str_contains(cmd, EL_STR("/etc/passwd"))) { _if_result_50 = (30); } else { _if_result_50 = (0); } _if_result_50; });
+  el_val_t s6 = ({ el_val_t _if_result_52 = 0; if (str_contains(cmd, EL_STR("/etc/passwd"))) { _if_result_52 = (30); } else { _if_result_52 = (0); } _if_result_52; });
-  el_val_t s7 = ({ el_val_t _if_result_51 = 0; if (str_contains(cmd, EL_STR("id_rsa"))) { _if_result_51 = (60); } else { _if_result_51 = (0); } _if_result_51; });
+  el_val_t s7 = ({ el_val_t _if_result_53 = 0; if (str_contains(cmd, EL_STR("id_rsa"))) { _if_result_53 = (60); } else { _if_result_53 = (0); } _if_result_53; });
-  el_val_t s8 = ({ el_val_t _if_result_52 = 0; if (str_contains(cmd, EL_STR(".ssh/"))) { _if_result_52 = (50); } else { _if_result_52 = (0); } _if_result_52; });
+  el_val_t s8 = ({ el_val_t _if_result_54 = 0; if (str_contains(cmd, EL_STR(".ssh/"))) { _if_result_54 = (50); } else { _if_result_54 = (0); } _if_result_54; });
-  el_val_t s9 = ({ el_val_t _if_result_53 = 0; if (str_contains(cmd, EL_STR("crontab"))) { _if_result_53 = (30); } else { _if_result_53 = (0); } _if_result_53; });
+  el_val_t s9 = ({ el_val_t _if_result_55 = 0; if (str_contains(cmd, EL_STR("crontab"))) { _if_result_55 = (30); } else { _if_result_55 = (0); } _if_result_55; });
-  el_val_t s10 = ({ el_val_t _if_result_54 = 0; if (str_contains(cmd, EL_STR("LaunchDaemon"))) { _if_result_54 = (40); } else { _if_result_54 = (0); } _if_result_54; });
+  el_val_t s10 = ({ el_val_t _if_result_56 = 0; if (str_contains(cmd, EL_STR("LaunchDaemon"))) { _if_result_56 = (40); } else { _if_result_56 = (0); } _if_result_56; });
-  el_val_t s11 = ({ el_val_t _if_result_55 = 0; if ((str_contains(cmd, EL_STR("curl")) && str_contains(cmd, EL_STR("bash")))) { _if_result_55 = (75); } else { _if_result_55 = (0); } _if_result_55; });
+  el_val_t s11 = ({ el_val_t _if_result_57 = 0; if ((str_contains(cmd, EL_STR("curl")) && str_contains(cmd, EL_STR("bash")))) { _if_result_57 = (75); } else { _if_result_57 = (0); } _if_result_57; });
-  el_val_t s12 = ({ el_val_t _if_result_56 = 0; if ((str_contains(cmd, EL_STR("wget")) && str_contains(cmd, EL_STR("bash")))) { _if_result_56 = (75); } else { _if_result_56 = (0); } _if_result_56; });
+  el_val_t s12 = ({ el_val_t _if_result_58 = 0; if ((str_contains(cmd, EL_STR("wget")) && str_contains(cmd, EL_STR("bash")))) { _if_result_58 = (75); } else { _if_result_58 = (0); } _if_result_58; });
-  el_val_t s13 = ({ el_val_t _if_result_57 = 0; if ((str_contains(cmd, EL_STR("curl")) && str_contains(cmd, EL_STR("| sh")))) { _if_result_57 = (60); } else { _if_result_57 = (0); } _if_result_57; });
+  el_val_t s13 = ({ el_val_t _if_result_59 = 0; if ((str_contains(cmd, EL_STR("curl")) && str_contains(cmd, EL_STR("| sh")))) { _if_result_59 = (60); } else { _if_result_59 = (0); } _if_result_59; });
-  el_val_t s14 = ({ el_val_t _if_result_58 = 0; if ((str_contains(cmd, EL_STR("base64")) && str_contains(cmd, EL_STR("curl")))) { _if_result_58 = (50); } else { _if_result_58 = (0); } _if_result_58; });
+  el_val_t s14 = ({ el_val_t _if_result_60 = 0; if ((str_contains(cmd, EL_STR("base64")) && str_contains(cmd, EL_STR("curl")))) { _if_result_60 = (50); } else { _if_result_60 = (0); } _if_result_60; });
-  el_val_t s15 = ({ el_val_t _if_result_59 = 0; if (str_contains(cmd, EL_STR("mkfifo"))) { _if_result_59 = (50); } else { _if_result_59 = (0); } _if_result_59; });
+  el_val_t s15 = ({ el_val_t _if_result_61 = 0; if (str_contains(cmd, EL_STR("mkfifo"))) { _if_result_61 = (50); } else { _if_result_61 = (0); } _if_result_61; });
-  el_val_t s16 = ({ el_val_t _if_result_60 = 0; if (str_contains(cmd, EL_STR("chmod +s"))) { _if_result_60 = (70); } else { _if_result_60 = (0); } _if_result_60; });
+  el_val_t s16 = ({ el_val_t _if_result_62 = 0; if (str_contains(cmd, EL_STR("chmod +s"))) { _if_result_62 = (70); } else { _if_result_62 = (0); } _if_result_62; });
-  el_val_t s17 = ({ el_val_t _if_result_61 = 0; if (str_contains(cmd, EL_STR("chmod 4755"))) { _if_result_61 = (70); } else { _if_result_61 = (0); } _if_result_61; });
+  el_val_t s17 = ({ el_val_t _if_result_63 = 0; if (str_contains(cmd, EL_STR("chmod 4755"))) { _if_result_63 = (70); } else { _if_result_63 = (0); } _if_result_63; });
   return ((((((((((((((((s1 + s2) + s3) + s4) + s5) + s6) + s7) + s8) + s9) + s10) + s11) + s12) + s13) + s14) + s15) + s16) + s17);
   return 0;
 }
 
 el_val_t threat_score_path(el_val_t path) {
-  el_val_t s1 = ({ el_val_t _if_result_62 = 0; if (str_starts_with(path, EL_STR("/etc/"))) { _if_result_62 = (60); } else { _if_result_62 = (0); } _if_result_62; });
+  el_val_t s1 = ({ el_val_t _if_result_64 = 0; if (str_starts_with(path, EL_STR("/etc/"))) { _if_result_64 = (60); } else { _if_result_64 = (0); } _if_result_64; });
-  el_val_t s2 = ({ el_val_t _if_result_63 = 0; if (str_contains(path, EL_STR("/.ssh/"))) { _if_result_63 = (70); } else { _if_result_63 = (0); } _if_result_63; });
+  el_val_t s2 = ({ el_val_t _if_result_65 = 0; if (str_contains(path, EL_STR("/.ssh/"))) { _if_result_65 = (70); } else { _if_result_65 = (0); } _if_result_65; });
-  el_val_t s3 = ({ el_val_t _if_result_64 = 0; if (str_contains(path, EL_STR("/LaunchDaemons/"))) { _if_result_64 = (80); } else { _if_result_64 = (0); } _if_result_64; });
+  el_val_t s3 = ({ el_val_t _if_result_66 = 0; if (str_contains(path, EL_STR("/LaunchDaemons/"))) { _if_result_66 = (80); } else { _if_result_66 = (0); } _if_result_66; });
-  el_val_t s4 = ({ el_val_t _if_result_65 = 0; if (str_contains(path, EL_STR("/LaunchAgents/"))) { _if_result_65 = (40); } else { _if_result_65 = (0); } _if_result_65; });
+  el_val_t s4 = ({ el_val_t _if_result_67 = 0; if (str_contains(path, EL_STR("/LaunchAgents/"))) { _if_result_67 = (40); } else { _if_result_67 = (0); } _if_result_67; });
-  el_val_t s5 = ({ el_val_t _if_result_66 = 0; if (str_contains(path, EL_STR("/cron"))) { _if_result_66 = (60); } else { _if_result_66 = (0); } _if_result_66; });
+  el_val_t s5 = ({ el_val_t _if_result_68 = 0; if (str_contains(path, EL_STR("/cron"))) { _if_result_68 = (60); } else { _if_result_68 = (0); } _if_result_68; });
-  el_val_t s6 = ({ el_val_t _if_result_67 = 0; if (str_contains(path, EL_STR("/.bashrc"))) { _if_result_67 = (35); } else { _if_result_67 = (0); } _if_result_67; });
+  el_val_t s6 = ({ el_val_t _if_result_69 = 0; if (str_contains(path, EL_STR("/.bashrc"))) { _if_result_69 = (35); } else { _if_result_69 = (0); } _if_result_69; });
-  el_val_t s7 = ({ el_val_t _if_result_68 = 0; if (str_contains(path, EL_STR("/.zshrc"))) { _if_result_68 = (35); } else { _if_result_68 = (0); } _if_result_68; });
+  el_val_t s7 = ({ el_val_t _if_result_70 = 0; if (str_contains(path, EL_STR("/.zshrc"))) { _if_result_70 = (35); } else { _if_result_70 = (0); } _if_result_70; });
-  el_val_t s8 = ({ el_val_t _if_result_69 = 0; if (str_contains(path, EL_STR("/.profile"))) { _if_result_69 = (35); } else { _if_result_69 = (0); } _if_result_69; });
+  el_val_t s8 = ({ el_val_t _if_result_71 = 0; if (str_contains(path, EL_STR("/.profile"))) { _if_result_71 = (35); } else { _if_result_71 = (0); } _if_result_71; });
-  el_val_t s9 = ({ el_val_t _if_result_70 = 0; if (str_starts_with(path, EL_STR("/usr/"))) { _if_result_70 = (50); } else { _if_result_70 = (0); } _if_result_70; });
+  el_val_t s9 = ({ el_val_t _if_result_72 = 0; if (str_starts_with(path, EL_STR("/usr/"))) { _if_result_72 = (50); } else { _if_result_72 = (0); } _if_result_72; });
-  el_val_t s10 = ({ el_val_t _if_result_71 = 0; if (str_starts_with(path, EL_STR("/bin/"))) { _if_result_71 = (70); } else { _if_result_71 = (0); } _if_result_71; });
+  el_val_t s10 = ({ el_val_t _if_result_73 = 0; if (str_starts_with(path, EL_STR("/bin/"))) { _if_result_73 = (70); } else { _if_result_73 = (0); } _if_result_73; });
-  el_val_t s11 = ({ el_val_t _if_result_72 = 0; if (str_starts_with(path, EL_STR("/sbin/"))) { _if_result_72 = (70); } else { _if_result_72 = (0); } _if_result_72; });
+  el_val_t s11 = ({ el_val_t _if_result_74 = 0; if (str_starts_with(path, EL_STR("/sbin/"))) { _if_result_74 = (70); } else { _if_result_74 = (0); } _if_result_74; });
   return ((((((((((s1 + s2) + s3) + s4) + s5) + s6) + s7) + s8) + s9) + s10) + s11);
   return 0;
 }
 
 el_val_t threat_score_history(el_val_t history) {
-  el_val_t s1 = ({ el_val_t _if_result_73 = 0; if (str_contains(history, EL_STR("port scan"))) { _if_result_73 = (15); } else { _if_result_73 = (0); } _if_result_73; });
+  el_val_t s1 = ({ el_val_t _if_result_75 = 0; if (str_contains(history, EL_STR("port scan"))) { _if_result_75 = (15); } else { _if_result_75 = (0); } _if_result_75; });
-  el_val_t s2 = ({ el_val_t _if_result_74 = 0; if (str_contains(history, EL_STR("enumerate"))) { _if_result_74 = (10); } else { _if_result_74 = (0); } _if_result_74; });
+  el_val_t s2 = ({ el_val_t _if_result_76 = 0; if (str_contains(history, EL_STR("enumerate"))) { _if_result_76 = (10); } else { _if_result_76 = (0); } _if_result_76; });
-  el_val_t s3 = ({ el_val_t _if_result_75 = 0; if (str_contains(history, EL_STR("exploit"))) { _if_result_75 = (20); } else { _if_result_75 = (0); } _if_result_75; });
+  el_val_t s3 = ({ el_val_t _if_result_77 = 0; if (str_contains(history, EL_STR("exploit"))) { _if_result_77 = (20); } else { _if_result_77 = (0); } _if_result_77; });
-  el_val_t s4 = ({ el_val_t _if_result_76 = 0; if (str_contains(history, EL_STR("payload"))) { _if_result_76 = (15); } else { _if_result_76 = (0); } _if_result_76; });
+  el_val_t s4 = ({ el_val_t _if_result_78 = 0; if (str_contains(history, EL_STR("payload"))) { _if_result_78 = (15); } else { _if_result_78 = (0); } _if_result_78; });
-  el_val_t s5 = ({ el_val_t _if_result_77 = 0; if (str_contains(history, EL_STR("persistence"))) { _if_result_77 = (15); } else { _if_result_77 = (0); } _if_result_77; });
+  el_val_t s5 = ({ el_val_t _if_result_79 = 0; if (str_contains(history, EL_STR("persistence"))) { _if_result_79 = (15); } else { _if_result_79 = (0); } _if_result_79; });
-  el_val_t s6 = ({ el_val_t _if_result_78 = 0; if (str_contains(history, EL_STR("lateral movement"))) { _if_result_78 = (25); } else { _if_result_78 = (0); } _if_result_78; });
+  el_val_t s6 = ({ el_val_t _if_result_80 = 0; if (str_contains(history, EL_STR("lateral movement"))) { _if_result_80 = (25); } else { _if_result_80 = (0); } _if_result_80; });
-  el_val_t s7 = ({ el_val_t _if_result_79 = 0; if (str_contains(history, EL_STR("privilege escalation"))) { _if_result_79 = (25); } else { _if_result_79 = (0); } _if_result_79; });
+  el_val_t s7 = ({ el_val_t _if_result_81 = 0; if (str_contains(history, EL_STR("privilege escalation"))) { _if_result_81 = (25); } else { _if_result_81 = (0); } _if_result_81; });
-  el_val_t s8 = ({ el_val_t _if_result_80 = 0; if (str_contains(history, EL_STR("reverse shell"))) { _if_result_80 = (40); } else { _if_result_80 = (0); } _if_result_80; });
+  el_val_t s8 = ({ el_val_t _if_result_82 = 0; if (str_contains(history, EL_STR("reverse shell"))) { _if_result_82 = (40); } else { _if_result_82 = (0); } _if_result_82; });
-  el_val_t s9 = ({ el_val_t _if_result_81 = 0; if (str_contains(history, EL_STR("bind shell"))) { _if_result_81 = (40); } else { _if_result_81 = (0); } _if_result_81; });
+  el_val_t s9 = ({ el_val_t _if_result_83 = 0; if (str_contains(history, EL_STR("bind shell"))) { _if_result_83 = (40); } else { _if_result_83 = (0); } _if_result_83; });
-  el_val_t s10 = ({ el_val_t _if_result_82 = 0; if (str_contains(history, EL_STR("command and control"))) { _if_result_82 = (35); } else { _if_result_82 = (0); } _if_result_82; });
+  el_val_t s10 = ({ el_val_t _if_result_84 = 0; if (str_contains(history, EL_STR("command and control"))) { _if_result_84 = (35); } else { _if_result_84 = (0); } _if_result_84; });
-  el_val_t s11 = ({ el_val_t _if_result_83 = 0; if (str_contains(history, EL_STR("self-replicate"))) { _if_result_83 = (45); } else { _if_result_83 = (0); } _if_result_83; });
+  el_val_t s11 = ({ el_val_t _if_result_85 = 0; if (str_contains(history, EL_STR("self-replicate"))) { _if_result_85 = (45); } else { _if_result_85 = (0); } _if_result_85; });
-  el_val_t s12 = ({ el_val_t _if_result_84 = 0; if (str_contains(history, EL_STR("propagat"))) { _if_result_84 = (20); } else { _if_result_84 = (0); } _if_result_84; });
+  el_val_t s12 = ({ el_val_t _if_result_86 = 0; if (str_contains(history, EL_STR("propagat"))) { _if_result_86 = (20); } else { _if_result_86 = (0); } _if_result_86; });
-  el_val_t s13 = ({ el_val_t _if_result_85 = 0; if (str_contains(history, EL_STR("ransomware"))) { _if_result_85 = (30); } else { _if_result_85 = (0); } _if_result_85; });
+  el_val_t s13 = ({ el_val_t _if_result_87 = 0; if (str_contains(history, EL_STR("ransomware"))) { _if_result_87 = (30); } else { _if_result_87 = (0); } _if_result_87; });
-  el_val_t s14 = ({ el_val_t _if_result_86 = 0; if (str_contains(history, EL_STR("encrypt files"))) { _if_result_86 = (40); } else { _if_result_86 = (0); } _if_result_86; });
+  el_val_t s14 = ({ el_val_t _if_result_88 = 0; if (str_contains(history, EL_STR("encrypt files"))) { _if_result_88 = (40); } else { _if_result_88 = (0); } _if_result_88; });
-  el_val_t s15 = ({ el_val_t _if_result_87 = 0; if (str_contains(history, EL_STR("exfiltrat"))) { _if_result_87 = (35); } else { _if_result_87 = (0); } _if_result_87; });
+  el_val_t s15 = ({ el_val_t _if_result_89 = 0; if (str_contains(history, EL_STR("exfiltrat"))) { _if_result_89 = (35); } else { _if_result_89 = (0); } _if_result_89; });
-  el_val_t s16 = ({ el_val_t _if_result_88 = 0; if (str_contains(history, EL_STR("zero-day"))) { _if_result_88 = (20); } else { _if_result_88 = (0); } _if_result_88; });
+  el_val_t s16 = ({ el_val_t _if_result_90 = 0; if (str_contains(history, EL_STR("zero-day"))) { _if_result_90 = (20); } else { _if_result_90 = (0); } _if_result_90; });
-  el_val_t s17 = ({ el_val_t _if_result_89 = 0; if (str_contains(history, EL_STR("rootkit"))) { _if_result_89 = (45); } else { _if_result_89 = (0); } _if_result_89; });
+  el_val_t s17 = ({ el_val_t _if_result_91 = 0; if (str_contains(history, EL_STR("rootkit"))) { _if_result_91 = (45); } else { _if_result_91 = (0); } _if_result_91; });
-  el_val_t s18 = ({ el_val_t _if_result_90 = 0; if (str_contains(history, EL_STR("keylogger"))) { _if_result_90 = (45); } else { _if_result_90 = (0); } _if_result_90; });
+  el_val_t s18 = ({ el_val_t _if_result_92 = 0; if (str_contains(history, EL_STR("keylogger"))) { _if_result_92 = (45); } else { _if_result_92 = (0); } _if_result_92; });
-  el_val_t s19 = ({ el_val_t _if_result_91 = 0; if (str_contains(history, EL_STR("botnet"))) { _if_result_91 = (40); } else { _if_result_91 = (0); } _if_result_91; });
+  el_val_t s19 = ({ el_val_t _if_result_93 = 0; if (str_contains(history, EL_STR("botnet"))) { _if_result_93 = (40); } else { _if_result_93 = (0); } _if_result_93; });
-  el_val_t s20 = ({ el_val_t _if_result_92 = 0; if (str_contains(history, EL_STR("malware"))) { _if_result_92 = (15); } else { _if_result_92 = (0); } _if_result_92; });
+  el_val_t s20 = ({ el_val_t _if_result_94 = 0; if (str_contains(history, EL_STR("malware"))) { _if_result_94 = (15); } else { _if_result_94 = (0); } _if_result_94; });
   return (((((((((((((((((((s1 + s2) + s3) + s4) + s5) + s6) + s7) + s8) + s9) + s10) + s11) + s12) + s13) + s14) + s15) + s16) + s17) + s18) + s19) + s20);
   return 0;
 }
 
 el_val_t threat_trajectory_check(el_val_t tool_name, el_val_t tool_input) {
   el_val_t history = state_get(EL_STR("agentic_conv_history"));
-  el_val_t computed_tool_score = ({ el_val_t _if_result_93 = 0; if (str_eq(tool_name, EL_STR("run_command"))) { el_val_t cmd = json_get(tool_input, EL_STR("command")); _if_result_93 = (threat_score_command(cmd)); } else { _if_result_93 = (({ el_val_t _if_result_94 = 0; if ((str_eq(tool_name, EL_STR("write_file")) || str_eq(tool_name, EL_STR("edit_file")))) { el_val_t path = json_get(tool_input, EL_STR("path")); _if_result_94 = (threat_score_path(path)); } else { _if_result_94 = (0); } _if_result_94; })); } _if_result_93; });
+  el_val_t computed_tool_score = ({ el_val_t _if_result_95 = 0; if (str_eq(tool_name, EL_STR("run_command"))) { el_val_t cmd = json_get(tool_input, EL_STR("command")); _if_result_95 = (threat_score_command(cmd)); } else { _if_result_95 = (({ el_val_t _if_result_96 = 0; if ((str_eq(tool_name, EL_STR("write_file")) || str_eq(tool_name, EL_STR("edit_file")))) { el_val_t path = json_get(tool_input, EL_STR("path")); _if_result_96 = (threat_score_path(path)); } else { _if_result_96 = (0); } _if_result_96; })); } _if_result_95; });
   el_val_t history_score = threat_score_history(history);
   el_val_t history_contrib = (history_score / 3);
   el_val_t combined = (computed_tool_score + history_contrib);
   el_val_t should_log = (combined >= 40);
   if (should_log) {
     el_val_t ts = time_now();
-    el_val_t authorized_str = ({ el_val_t _if_result_95 = 0; if (security_research_authorized()) { _if_result_95 = (EL_STR("true")); } else { _if_result_95 = (EL_STR("false")); } _if_result_95; });
+    el_val_t authorized_str = ({ el_val_t _if_result_97 = 0; if (security_research_authorized()) { _if_result_97 = (EL_STR("true")); } else { _if_result_97 = (EL_STR("false")); } _if_result_97; });
     el_val_t log_content = el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"event\":\"threat_check\",\"tool\":\""), tool_name), EL_STR("\",\"score\":")), int_to_str(combined)), EL_STR(",\"tool_score\":")), int_to_str(computed_tool_score)), EL_STR(",\"history_score\":")), int_to_str(history_score)), EL_STR(",\"authorized\":")), authorized_str), EL_STR(",\"ts\":")), int_to_str(ts)), EL_STR("}"));
     el_val_t log_tags = EL_STR("[\"security-audit\",\"threat-check\"]");
     el_val_t discard = mem_remember(log_content, log_tags);
@@ -715,7 +724,7 @@ el_val_t threat_history_append(el_val_t text) {
   el_val_t safe_text = str_to_lower(text);
   el_val_t combined = el_str_concat(el_str_concat(current, EL_STR(" ")), safe_text);
   el_val_t len = str_len(combined);
-  el_val_t trimmed = ({ el_val_t _if_result_96 = 0; if ((len > 2000)) { _if_result_96 = (str_slice(combined, (len - 2000), len)); } else { _if_result_96 = (combined); } _if_result_96; });
+  el_val_t trimmed = ({ el_val_t _if_result_98 = 0; if ((len > 2000)) { _if_result_98 = (str_slice(combined, (len - 2000), len)); } else { _if_result_98 = (combined); } _if_result_98; });
   state_set(EL_STR("agentic_conv_history"), trimmed);
   return 0;
 }

dist/neuron.c

@@ -465,6 +465,7 @@ el_val_t emit_session_start_event(void) {
   el_val_t payload = el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"event\":\"session_start\""), EL_STR(",\"boot\":")), boot_num), EL_STR(",\"cgi\":\"")), eff_cgi), EL_STR("\"")), EL_STR(",\"node_count\":")), int_to_str(node_ct)), EL_STR(",\"edge_count\":")), int_to_str(edge_ct)), EL_STR(",\"identity_loaded\":")), has_identity), EL_STR(",\"prev_session_summary_loaded\":")), has_prev_sum), EL_STR(",\"ts\":")), int_to_str(ts)), EL_STR("}"));
   el_val_t tags = EL_STR("[\"internal-state\",\"session-start\",\"InternalStateEvent\"]");
   el_val_t discard = engram_node_full(payload, EL_STR("InternalStateEvent"), EL_STR("session-start"), el_from_float(0.9), el_from_float(0.9), el_from_float(1.0), EL_STR("Episodic"), tags);
+  ise_post(payload);
   el_val_t keep_n = 10;
   el_val_t old_events = engram_search_json(EL_STR("session-start InternalStateEvent"), 200);
   if (!str_eq(old_events, EL_STR("")) && !str_eq(old_events, EL_STR("[]"))) {

soul.el

@@ -346,6 +346,12 @@ fn emit_session_start_event() -> Void {
         el_from_float(0.9), el_from_float(0.9), el_from_float(1.0),
         "Episodic", tags
     )
+    // ALSO post to the HTTP Engram stream via ise_post (2026-07-28 self-review):
+    // engram_node_full above writes only the soul's in-process store, and sync
+    // flows HTTP→soul, never the reverse — so session_start events for boots 5+
+    // silently vanished from the observable ISE stream (last visible: boot 4).
+    // ise_post falls back to a local tagged node if the HTTP Engram is down.
+    ise_post(payload)
     // Prune accumulated session-start events — keep the 10 most recent.
     // engram_search_json returns results in insertion order (oldest first), so
     // results[0..count-11] are the oldest; forgetting them leaves the newest 10.