feat(engine): plain chat generates at L3 — inside the safety cycle, not around it

Non-agentic /api/chat (the desktop app's default "Tools: Off" mode) returned the
user's own screened text as a bare non-JSON string. Every JSON client failed to
parse it and showed "Couldn't reach Neuron - it may be offline."

Root cause: f52d5bd (2026-06-11) correctly moved the route onto the layer spine
(handle_chat -> layered_cycle), but L3 never got a generator — imprint_respond()
annotates its input and returns it. Two pieces of the architecture were already
waiting for that step: layered_cycle parks a bell directive in the state key
build_system_prompt is written to consume, and build_system_prompt carries a
chat_mode ("no tools") flag with no live caller.

The fix composes rather than replaces. Wiring handle_chat would have removed
safety_screen, the hard-bell short-circuit, the whole stewardship layer and
safety_validate — the only enforcing output gate in the codebase — in exchange
for a working reply (see _engine-websearch-20260804/SAFETY-STOP.md). Instead
layered_cycle keeps every gate, in order, and gains a generation step between
imprint_respond and safety_validate.

  L1 screen -> guard -> hard-bell short-circuit -> L2a -> L2b -> L2c
    -> L3 imprint_respond (prompt) -> L3b layered_generate (NEW) -> L1 validate

- chat.el:  NEW layered_generate (L3 generation, no tools offered),
            conv_history_block, conv_history_record.
            FIX build_system_prompt never concatenated no_tools_rule into its
            return — the "[NO TOOLS THIS TURN]" rule reached no model at all.
            handle_chat annotated DO-NOT-WIRE with the reason.
- soul.el:  layered_cycle gains L3b + post-validation turn bookkeeping.
- routes.el: NEW plain_chat_envelope; all three /api/chat dispatch sites wrap the
            cycle's output. Built OUTSIDE the cycle so safety_validate always sees
            raw model text — nothing to unwrap or rebuild on the crisis path.
            Emits both `reply` and `response`: the desktop app reads `reply`,
            the CLI tools and telegram-gateway read `response`.

Also fixes BUG-PLAINCHAT-1, a pre-existing CRITICAL crash on the crisis path.
elc compiles `let n: Int = pos + str_len(marker)` to el_str_concat() — string
concat on two integers — inside a block-expression initializer, segfaulting the
daemon (SIGSEGV in strlen). Six inline copies of the same " | ts:" parser had it:
two in layered_cycle L2c, two in engram_compile (live on the AGENTIC path too),
two in affective_context_prefix. A distress turn following an earlier affective
turn killed the whole process. Proven pre-existing: an unmodified baseline binary
crashes identically, and the same bad C is in the committed dist/soul.c. Fixed by
hoisting to one top-level function, affective_node_ts(), where the expression
compiles to integer addition — verified in the generated C.

Proof (throwaway HOME/engram, explicit NEURON_PORT, live chain untouched):
- Plain turn returns a JSON envelope with the provider's answer, not an echo.
- Captured request body: no `tools`, no `tool_choice`; system prompt carries the
  NO-TOOLS rule. Tools:Off means no tool is offered, structurally.
- Hard bell: canned 988 message, and the provider request count does not move —
  the message never reaches a model.
- Soft bell + a 2-char model reply: safety_validate's care phrase is appended to
  the MODEL's output. Output gate acting, on this route.
- The L1 bell directive now reaches the model here for the first time (the state
  addendum had a producer and no consumer).
- test_layered_cycle PASS; all six El suites byte-identical to baseline.
- verify-soul-contract.sh (bash 5.3): GATE PASS, 27/27, immutability PASS.
- The crash sequence that killed the baseline daemon now returns HTTP 200.

Not proven: no live Anthropic call — the login keychain refuses the key to a
non-interactive process (rc=24 errSecInteractionNotAllowed). Details and the
one-command close-out are in _engine-plainchat-20260805/README.md §7.

Builds on PR #108. dist/soul.c deliberately not regenerated — Will's toolchain.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

routes.el

@@ -15,6 +15,40 @@ fn flag_true(body: String, key: String) -> Bool {
     return json_get_bool(body, key) || json_get_int(body, key) > 0
 }
 
+// ---------------------------------------------------------------------------
+// plain_chat_envelope — the JSON response contract for a non-agentic ("Tools: Off")
+// chat turn. Every /api/chat dispatch that calls layered_cycle goes through here, so
+// the three call sites cannot drift apart.
+//
+// WHY THE ENVELOPE IS BUILT HERE AND NOT INSIDE layered_cycle:
+// layered_cycle returns the user-facing text AFTER safety_validate has acted on it.
+// Keeping the JSON out of the cycle means the output gate always sees raw model text
+// and never an escaped blob — there is nothing to unwrap and re-wrap on the crisis
+// path, which is exactly the failure mode that made wiring handle_chat unsafe.
+// Escaping is the last thing that happens, strictly after the gate.
+//
+// FIELDS: `reply` and `response` carry the same validated text. Both are required by
+// live clients — the desktop app reads `reply` first (DaemonClient.parseChatResponse),
+// while the CLI tools and the Telegram gateway read `response` (the gateway reads only
+// `response`). Emitting one would break the other.
+//
+// EMPTY MEANS FAILURE, NOT AN EMPTY ANSWER: a hard bell returns the fixed crisis
+// message and a soft bell is padded to non-empty by safety_validate, so the only way
+// an empty string leaves the cycle is a failed model call. It is reported as an error
+// rather than dressed up as a successful blank reply.
+// ---------------------------------------------------------------------------
+fn plain_chat_envelope(validated: String, model: String) -> String {
+    if str_eq(validated, "") {
+        return "{\"error\":\"llm unavailable\",\"reply\":\"\",\"response\":\"\",\"agentic\":false,\"tools_used\":[]}"
+    }
+    let safe: String = json_safe(validated)
+    return "{\"reply\":\"" + safe + "\""
+        + ",\"response\":\"" + safe + "\""
+        + ",\"model\":\"" + json_safe(model) + "\""
+        + ",\"agentic\":false"
+        + ",\"tools_used\":[]}"
+}
+
 // ---------------------------------------------------------------------------
 // Rate limiting — simple in-memory per-IP sliding window counter.
 //
@@ -243,8 +277,11 @@ fn handle_dharma_recv(body: String) -> String {
         } else if agentic_flag {
             handle_chat_agentic(chat_body)
         } else {
+            // Non-agentic ("Tools: Off"): the full L1→L2→L3→L1 cycle, which now generates
+            // at L3 instead of echoing. Envelope built outside the cycle — see
+            // plain_chat_envelope.
             let screened_reply: String = layered_cycle(raw_msg)
-            screened_reply
+            plain_chat_envelope(screened_reply, chat_default_model())
         }
         auto_persist(chat_body, reply)
         return reply
@@ -416,8 +453,9 @@ fn handle_request(method: String, path: String, body: String) -> String {
             } else if agentic_flag {
                 handle_chat_agentic(body)
             } else {
+                // Non-agentic ("Tools: Off") — same cycle and same envelope as POST.
                 let screened_reply: String = layered_cycle(eff_msg)
-                screened_reply
+                plain_chat_envelope(screened_reply, chat_default_model())
             }
             auto_persist(body, reply)
             return reply
@@ -580,8 +618,11 @@ fn handle_request(method: String, path: String, body: String) -> String {
             } else if agentic_flag {
                 handle_chat_agentic(body)
             } else {
+                // Non-agentic ("Tools: Off") — the app's DEFAULT mode (AgentMode.NEVER).
+                // Full L1→L2→L3→L1 cycle with real generation at L3; envelope built
+                // outside the cycle so safety_validate always sees raw text.
                 let screened_reply: String = layered_cycle(raw_msg)
-                screened_reply
+                plain_chat_envelope(screened_reply, chat_default_model())
             }
             auto_persist(body, reply)
             return reply