fix(recall): address all remaining code review issues

Issue 1 (CRITICAL): Fix auto_persist brace structure. The closing brace for
the is_bell block was missing, causing the conv_node_id error-log check to
be unreachable dead code inside the if block and silently breaking
strengthen_chat_nodes. Add the missing } to close the is_bell block before
the conv_node_id guard.

Issue 2 (CRITICAL): Restore session_exists() call in handle_chat_agentic.
The behavioral regression replacing session_exists() with
!str_contains(session_get(...), '"error"') was reverted. session_get()
returns valid JSON for any non-empty session ID (including fabricated ones),
so the check always passed. session_exists() does a proper state-index and
engram search.

Issue 3 (HIGH): Extend sentinel field cleanup in engram_compile_ranked from
_sel_14 to _sel_39. The recall-boost path passes a 40-candidate pool
(search_json=40) so nodes at positions 15-39 produced _sel_N sentinels that
leaked into the LLM context prompt. Cleanup chain now covers all 40 indices.

Issue 4 (HIGH): Fix engram_is_continuation false positives. Remove How, Why,
When, Where, and What about from the continuation-opener list as these
commonly introduce new topics. Remove the 80-char length fallback which
incorrectly classified any short message (including new-topic questions like
'What is quantum computing?') as a continuation.

Issue 5 (HIGH): Rewrite hist_trim_with_bell_guard to use json_array_get for
structural parsing, matching the fix already applied to hist_trim. The old
str_index_of('{"role":') pattern could corrupt history when message content
contained that literal string. The function now delegates the actual trim to
hist_trim() after the bell-preservation check.

Issue 6 (NORMAL): Fix entity_count scoping in engram_extract_entities. Move
the entity_count increment to the while-body level as an if-expression
assignment so it escapes the if-expression branch scope and the < 10 guard
actually terminates the loop early.

Issue 7 (NORMAL): Fix mcp_call_seq race in call_mcp_bridge. Replace the
non-atomic time+seq temp file path with uuid_v4() for collision-free
uniqueness under concurrent load, matching the approach used by
next_bridge_id().

Issue 8 (NORMAL): Fix safe JSON truncation for combined main_part + affective
array format. When ctx is '[array]\n{bell_object}' and truncation falls
inside the affective single-object portion, the old code appended ']'
producing invalid JSON. Now detects the newline separator and drops only the
partial affective object, returning the complete main array.

Issue 9 (NORMAL): Handle 4th+ topics in engram_compile. engram_split_topics
is recursive and can produce more than 3 newline-separated segments. Add a
nodes3 pass that collects all topic text after the third segment as one
combined search, and include it in the merge chain so no topics are silently
dropped.

awareness.el

@@ -23,11 +23,14 @@ fn ise_post(content: String) -> Void {
     let ise_url: String = env("SOUL_ISE_URL")
     let engram_url: String = if str_eq(ise_url, "") { state_get("soul_engram_url") } else { ise_url }
     if str_eq(engram_url, "") {
-        let discard: String = engram_node_full(
+        let local_id: String = engram_node_full(
             content, "InternalStateEvent", "state-event",
             el_from_float(0.3), el_from_float(0.3), el_from_float(0.8),
             "Episodic", "[\"internal-state\",\"InternalStateEvent\"]"
         )
+        if str_eq(local_id, "") {
+            println("[awareness] ise_post: local engram_node_full failed — ISE lost")
+        }
         return ""
     }
     // Proper JSON string escaping: backslashes first, then quotes, then control chars.
@@ -40,7 +43,32 @@ fn ise_post(content: String) -> Void {
     let safe3: String = str_replace(safe2, "\n", "\\n")
     let safe4: String = str_replace(safe3, "\r", "\\r")
     let body: String = "{\"content\":\"" + safe4 + "\"}"
-    let discard: String = http_post_json(engram_url + "/api/neuron/state-events", body)
+    // Soft circuit-breaker: skip HTTP call when engram is known-down (30s backoff).
+    // Opens after 3 consecutive failures; half-open probe after backoff expires.
+    // TODO(reliability): full async dispatch requires EL runtime futures support.
+    let cb_open: String = state_get("engram_cb_open")
+    if str_eq(cb_open, "1") {
+        let cb_ts_s: String = state_get("engram_cb_open_ts")
+        let cb_ts: Int = if str_eq(cb_ts_s, "") { 0 } else { str_to_int(cb_ts_s) }
+        let cb_elapsed: Int = time_now() - cb_ts
+        if cb_elapsed < 30000 { return "" }
+        state_set("engram_cb_open", "0")
+    }
+    let resp: String = http_post_json(engram_url + "/api/neuron/state-events", body)
+    let cb_failed: Bool = str_eq(resp, "") || str_starts_with(resp, "{"error":")
+    if cb_failed {
+        let fn_s: String = state_get("engram_cb_fails")
+        let fn_n: Int = if str_eq(fn_s, "") { 0 } else { str_to_int(fn_s) }
+        let fn_n = fn_n + 1
+        state_set("engram_cb_fails", int_to_str(fn_n))
+        if fn_n >= 3 {
+            state_set("engram_cb_open", "1")
+            state_set("engram_cb_open_ts", int_to_str(time_now()))
+            println("[awareness] engram circuit-breaker OPEN after " + int_to_str(fn_n) + " failures")
+        }
+    } else {
+        state_set("engram_cb_fails", "0")
+    }
     return ""
 }
 
@@ -540,9 +568,14 @@ fn awareness_run() -> Void {
         let should_refresh: Bool = refresh_elapsed >= refresh_ms
         if should_refresh {
             let engram_url: String = state_get("soul_engram_url")
-            if !str_eq(engram_url, "") {
+            let sc: String = state_get("engram_cb_open")
+            let sc_ts_s: String = state_get("engram_cb_open_ts")
+            let sc_ts: Int = if str_eq(sc_ts_s, "") { 0 } else { str_to_int(sc_ts_s) }
+            let sc_elapsed: Int = now_ts - sc_ts
+            let sync_allowed: Bool = !str_eq(sc, "1") || sc_elapsed >= 30000
+            if !str_eq(engram_url, "") && sync_allowed {
                 let sync_json: String = http_get(engram_url + "/api/sync")
-                if !str_eq(sync_json, "") && !str_eq(sync_json, "{}") {
+                if !str_eq(sync_json, "") && !str_eq(sync_json, "{}") && !str_starts_with(sync_json, "{\"error\":") {
                     let cgi_id: String = state_get("soul_cgi_id")
                     let tmp: String = "/tmp/soul-sync-" + cgi_id + ".json"
                     fs_write(tmp, sync_json)
@@ -678,8 +711,6 @@ fn threat_trajectory_check(tool_name: String, tool_input: String) -> Int {
     return combined
 }
 
-// TODO(reliability #10): agentic_conv_history is process-global; awareness loop
-// and HTTP workers race on this key. Impact: noisy threat score only, not content.
 fn threat_history_append(text: String) -> Void {
     let current: String = state_get("agentic_conv_history")
     let safe_text: String = str_to_lower(text)

chat.el

@@ -119,7 +119,32 @@ fn engram_compile_ranked(nodes_json: String, max_nodes: Int) -> String {
     let c12: String = str_replace(c11, "\"_sel_12\":1,", "")
     let c13: String = str_replace(c12, "\"_sel_13\":1,", "")
     let c14: String = str_replace(c13, "\"_sel_14\":1,", "")
-    return c14
+    let c15: String = str_replace(c14, "\"_sel_15\":1,", "")
+    let c16: String = str_replace(c15, "\"_sel_16\":1,", "")
+    let c17: String = str_replace(c16, "\"_sel_17\":1,", "")
+    let c18: String = str_replace(c17, "\"_sel_18\":1,", "")
+    let c19: String = str_replace(c18, "\"_sel_19\":1,", "")
+    let c20: String = str_replace(c19, "\"_sel_20\":1,", "")
+    let c21: String = str_replace(c20, "\"_sel_21\":1,", "")
+    let c22: String = str_replace(c21, "\"_sel_22\":1,", "")
+    let c23: String = str_replace(c22, "\"_sel_23\":1,", "")
+    let c24: String = str_replace(c23, "\"_sel_24\":1,", "")
+    let c25: String = str_replace(c24, "\"_sel_25\":1,", "")
+    let c26: String = str_replace(c25, "\"_sel_26\":1,", "")
+    let c27: String = str_replace(c26, "\"_sel_27\":1,", "")
+    let c28: String = str_replace(c27, "\"_sel_28\":1,", "")
+    let c29: String = str_replace(c28, "\"_sel_29\":1,", "")
+    let c30: String = str_replace(c29, "\"_sel_30\":1,", "")
+    let c31: String = str_replace(c30, "\"_sel_31\":1,", "")
+    let c32: String = str_replace(c31, "\"_sel_32\":1,", "")
+    let c33: String = str_replace(c32, "\"_sel_33\":1,", "")
+    let c34: String = str_replace(c33, "\"_sel_34\":1,", "")
+    let c35: String = str_replace(c34, "\"_sel_35\":1,", "")
+    let c36: String = str_replace(c35, "\"_sel_36\":1,", "")
+    let c37: String = str_replace(c36, "\"_sel_37\":1,", "")
+    let c38: String = str_replace(c37, "\"_sel_38\":1,", "")
+    let c39: String = str_replace(c38, "\"_sel_39\":1,", "")
+    return c39
 }
 
 // engram_split_topics — split message into sub-queries on explicit conjunctions.
@@ -170,9 +195,11 @@ fn engram_extract_entities(message: String) -> String {
         let already_have: Bool = str_contains(entities, word)
         let should_add: Bool = is_capital && !is_stop && !already_have && word_len >= 3
         let entities = if should_add {
-            let entity_count = entity_count + 1
             if str_eq(entities, "") { word } else { entities + "\n" + word }
         } else { entities }
+        // Increment entity_count at the while-body level so the binding escapes the
+        // if-expression scope and the entity_count < 10 guard actually terminates early.
+        let entity_count = if should_add { entity_count + 1 } else { entity_count }
         let pos = if wend > pos { wend + 1 } else { pos + 1 }
     }
     return entities
@@ -201,10 +228,12 @@ fn engram_detect_recall_intent(message: String) -> Bool {
         || str_contains(message, "what happened with")
 }
 
-// engram_is_continuation — semantic continuation detection replacing the brittle 50-char
-// threshold. Returns true when message starts with a pronoun, continuation opener, or is
-// < 80 chars (raised from 50 to catch "Can you remind me what Prism's architecture
-// looks like?" at 57 chars which is clearly a continuation in an active thread).
+// engram_is_continuation — detect whether a message continues the active thread.
+// Returns true only when the message starts with a pronoun or an unambiguous
+// discourse continuation marker. Does NOT classify by message length: short messages
+// that introduce a new topic (e.g. "What is quantum computing?") are not continuations.
+// Does NOT classify interrogative starters (How, Why, When, Where, What about) as
+// continuations — these commonly open new topics and the false-positive cost is too high.
 fn engram_is_continuation(message: String, hist_len: Int) -> Bool {
     if hist_len <= 0 { return false }
     let has_pronoun: Bool = str_starts_with(message, "It ")
@@ -216,6 +245,7 @@ fn engram_is_continuation(message: String, hist_len: Int) -> Bool {
         || str_starts_with(message, "She ") || str_starts_with(message, "she ")
         || str_starts_with(message, "We ") || str_starts_with(message, "we ")
     if has_pronoun { return true }
+    // Only unambiguous discourse connectors that cannot open a new topic on their own.
     let is_cont_opener: Bool = str_starts_with(message, "Go on")
         || str_starts_with(message, "go on")
         || str_starts_with(message, "Continue") || str_starts_with(message, "continue")
@@ -224,12 +254,7 @@ fn engram_is_continuation(message: String, hist_len: Int) -> Bool {
         || str_starts_with(message, "Ok") || str_starts_with(message, "ok")
         || str_starts_with(message, "And ") || str_starts_with(message, "and ")
         || str_starts_with(message, "But ") || str_starts_with(message, "but ")
-        || str_starts_with(message, "What about") || str_starts_with(message, "what about")
-        || str_starts_with(message, "Why ") || str_starts_with(message, "why ")
-        || str_starts_with(message, "How ") || str_starts_with(message, "how ")
-        || str_starts_with(message, "When ") || str_starts_with(message, "when ")
     if is_cont_opener { return true }
-    if str_len(message) < 80 { return true }
     return false
 }
 
@@ -306,6 +331,26 @@ fn engram_compile(intent: String) -> String {
         }
     } else { "" }
 
+    // Fourth+ topic segments: engram_split_topics is recursive and can produce 4+ lines.
+    // Rather than hardcoding each topic index, collect everything after the third topic
+    // as a single combined search query so no segments are silently dropped.
+    // This handles inputs like "a and b and c and d" (4 topics).
+    let nodes3: String = if has_multi_topic {
+        let nl0: Int = str_index_of(topics, "\n")
+        let rest1: String = str_slice(topics, nl0 + 1, str_len(topics))
+        let nl1: Int = str_index_of(rest1, "\n")
+        if nl1 < 0 { "" } else {
+            let rest2: String = str_slice(rest1, nl1 + 1, str_len(rest1))
+            let nl2: Int = str_index_of(rest2, "\n")
+            if nl2 < 0 { "" } else {
+                // Remainder after the third segment — may span one or more topics.
+                // Search with the remaining text as-is; engram_compile_multi handles it.
+                let rest3: String = str_slice(rest2, nl2 + 1, str_len(rest2))
+                if str_eq(rest3, "") { "" } else { engram_compile_multi(rest3) }
+            }
+        }
+    } else { "" }
+
     // Issue 2 cont.: entity 0 dedicated search (15 candidates, ranked 6).
     let entity_nodes0: String = if has_entities {
         let nl_e0: Int = str_index_of(entity_list, "\n")
@@ -342,6 +387,7 @@ fn engram_compile(intent: String) -> String {
     // Merge all pools, deduplicating at each step.
     let merged: String = engram_nodes_merge(nodes0, nodes1)
     let merged: String = engram_nodes_merge(merged, nodes2)
+    let merged: String = engram_nodes_merge(merged, nodes3)
     let merged: String = engram_nodes_merge(merged, entity_nodes0)
     let merged: String = engram_nodes_merge(merged, entity_nodes1)
     let merged: String = engram_nodes_merge(merged, recall_boost)
@@ -379,31 +425,7 @@ fn engram_compile(intent: String) -> String {
         let bn_ts: Int = if str_eq(bn_ts_raw, "") { 0 } else { str_to_int(bn_ts_raw) }
         if bn_ts > cutoff_ts { bn0 } else { "" }
     } else { "" }
-    // Positive emotion context: check for recent joy/success moments within 72h.
-    let pos_ec_nodes: String = engram_search_json("PositiveEvent joy:high joy:low affective", 3)
-    let pos_ec_ok: Bool = !str_eq(pos_ec_nodes, "") && !str_eq(pos_ec_nodes, "[]")
-    let recent_positive_ec: String = if pos_ec_ok {
-        let pec0: String = json_array_get(pos_ec_nodes, 0)
-        let pec_content: String = json_get(pec0, "content")
-        let pec_ts_marker: String = " | ts:"
-        let pec_ts_pos: Int = str_index_of(pec_content, pec_ts_marker)
-        let pec_ts_raw: String = if pec_ts_pos >= 0 {
-            let pec_ts_start: Int = pec_ts_pos + str_len(pec_ts_marker)
-            let pec_rest: String = str_slice(pec_content, pec_ts_start, str_len(pec_content))
-            let pec_next: Int = str_index_of(pec_rest, " | ")
-            if pec_next < 0 { pec_rest } else { str_slice(pec_rest, 0, pec_next) }
-        } else {
-            let pec_ca: String = json_get(pec0, "created_at")
-            if str_eq(pec_ca, "") { json_get(pec0, "updated_at") } else { pec_ca }
-        }
-        let pec_ts: Int = if str_eq(pec_ts_raw, "") { 0 } else { str_to_int(pec_ts_raw) }
-        if pec_ts > cutoff_ts { pec0 } else { "" }
-    } else { "" }
-    let affective_part: String = if !str_eq(recent_bell, "") {
-        recent_bell
-    } else {
-        if !str_eq(recent_positive_ec, "") { recent_positive_ec } else { "" }
-    }
+    let affective_part: String = if !str_eq(recent_bell, "") { recent_bell } else { "" }
 
     let has_main: Bool = !str_eq(merged_nodes, "") && !str_eq(merged_nodes, "[]")
     let main_part: String = if has_main { merged_nodes } else { scan_part }
@@ -412,8 +434,16 @@ fn engram_compile(intent: String) -> String {
 
     if str_eq(ctx, "") { return "" }
 
-    // Issue 7 fix: safe JSON truncation — find last closing brace before budget cap.
+    // Safe JSON truncation — find last closing brace before budget cap.
     // Budget raised from 6000 to 8000 for the larger multi-topic pool.
+    //
+    // Issue 8 fix: ctx may be main_part (JSON array) + "\n" + affective_part (single JSON
+    // object). When truncation cuts into the affective_part, appending "]" would produce
+    // "[array_content]{partial_bell_node}]" — not valid JSON. Guard: only append "]" when
+    // the truncation point falls strictly within the main array portion (before the "\n"
+    // separator). If the cut falls in the affective part, drop the partial object entirely
+    // and return only the complete main array. If there is no separator (ctx is a plain
+    // array with no affective part), the original append-"]" behaviour applies.
     let budget: Int = 8000
     if str_len(ctx) <= budget { return ctx }
     let search_end: Int = budget - 1
@@ -427,7 +457,18 @@ fn engram_compile(intent: String) -> String {
     }
     if found_pos < 0 { return str_slice(ctx, 0, budget) }
     let truncated: String = str_slice(ctx, 0, found_pos + 1)
-    if str_starts_with(ctx, "[") { return truncated + "]" }
+    if str_starts_with(ctx, "[") {
+        // Determine whether this ctx has a separate affective object appended after the array.
+        // The format is: main_array + "\n" + bell_object. Find the array boundary.
+        let nl_pos: Int = str_index_of(ctx, "\n")
+        let has_affective_sep: Bool = nl_pos > 0 && nl_pos < str_len(ctx) - 1
+        if has_affective_sep && found_pos > nl_pos {
+            // Truncation fell inside the affective_part — drop it and return just the main array.
+            return str_slice(ctx, 0, nl_pos)
+        }
+        // Truncation is within the main array — close it properly.
+        return truncated + "]"
+    }
     return truncated
 }
 fn json_safe(s: String) -> String {
@@ -474,7 +515,7 @@ fn build_system_prompt(ctx: String) -> String {
         safety_addendum
     }
 
-    return identity + date_line + voice_rules + security_rules + capability_rules + identity_block + affective_boot_block + engram_block + safety_block
+    return identity + date_line + voice_rules + security_rules + capability_rules + identity_block + engram_block + safety_block
 }
 
 fn hist_append(hist: String, role: String, content: String) -> String {
@@ -487,18 +528,41 @@ fn hist_append(hist: String, role: String, content: String) -> String {
     return "[" + inner + "," + entry + "]"
 }
 
+// hist_trim — drop the oldest two entries from a history JSON array.
+//
+// Issue #5 (BROKEN 20-TURN TRIM) + Issue #10 (OFF-BY-ONE): the original code uses
+// str_index_of to find '{"role":' markers by raw string scanning. If any message content
+// contains the literal string '{"role":' (e.g. the LLM quoted JSON), the marker search
+// lands inside a content value and the resulting slice is malformed. Additionally, the
+// function had no minimum-retained-count guard.
+//
+// Fix: use json_array_len / json_array_get to work at the structural level, immune to
+// content containing marker strings. Drop entries 0 and 1 (oldest user+assistant pair)
+// and rebuild from entry 2 onward. Minimum retained count: 2 entries (never over-trim).
 fn hist_trim(hist: String) -> String {
-    let inner: String = str_slice(hist, 1, str_len(hist) - 1)
-    let marker: String = "{\"role\":"
-    let i1: Int = str_index_of(inner, marker)
-    let tail1: String = str_slice(inner, i1 + 1, str_len(inner))
-    let i2: Int = str_index_of(tail1, marker)
-    let tail2: String = str_slice(tail1, i2 + 1, str_len(tail1))
-    let i3: Int = str_index_of(tail2, marker)
-    if i3 >= 0 {
-        return "[" + str_slice(tail2, i3, str_len(tail2)) + "]"
+    // Issue #9 fix: use json_array_len/json_array_get instead of fragile str_index_of
+    // parser. Old code was silently corrupting history on malformed JSON.
+    let total: Int = json_array_len(hist)
+    // Safety: never trim below 2 entries. If already at or below the minimum, return unchanged.
+    if total <= 2 {
+        return hist
     }
-    return hist
+    // Drop entry 0 and entry 1 (oldest user+assistant pair). Rebuild from entry 2 onward.
+    let result: String = ""
+    let i: Int = 2
+    while i < total {
+        let entry: String = json_array_get(hist, i)
+        let result = if str_eq(result, "") {
+            entry
+        } else {
+            result + "," + entry
+        }
+        let i = i + 1
+    }
+    if str_eq(result, "") {
+        return hist
+    }
+    return "[" + result + "]"
 }
 
 // hist_trim_with_bell_guard — trim the history window exactly as hist_trim does, but
@@ -506,23 +570,19 @@ fn hist_trim(hist: String) -> String {
 // a bell event. If it did, write a preservation node to engram so the distress exchange
 // survives the 20-turn window. The LLM window drops it; engram retains it permanently
 // and engram_compile will surface it again via the affective context path.
+//
+// Fix: use json_array_get for structural parsing (immune to {"role": appearing in
+// message content) — same fix applied to hist_trim. The old str_index_of("{\"role\":")
+// pattern could corrupt history when any message contained that literal string.
 fn hist_trim_with_bell_guard(hist: String) -> String {
-    // Extract the first turn (should be a user message) to inspect it.
-    let inner: String = str_slice(hist, 1, str_len(hist) - 1)
-    let marker: String = "{\"role\":"
-    let i1: Int = str_index_of(inner, marker)
-    // i1 is the start of the first entry within inner.
-    // Find where the second entry begins to delimit the first entry's JSON.
-    let tail1: String = str_slice(inner, i1 + 1, str_len(inner))
-    let i2: Int = str_index_of(tail1, marker)
-    // The first entry spans from i1 to (i1 + 1 + i2 - 1) within inner.
-    let first_entry_raw: String = if i2 > 0 {
-        str_slice(inner, i1, i1 + 1 + i2 - 1)
-    } else {
-        str_slice(inner, i1, str_len(inner))
-    }
-    let first_role: String = json_get(first_entry_raw, "role")
-    let first_content: String = json_get(first_entry_raw, "content")
+    let total: Int = json_array_len(hist)
+    // Safety: never trim below 2 entries.
+    if total <= 2 { return hist }
+
+    // Extract the first entry structurally — immune to content containing {"role":
+    let first_entry: String = json_array_get(hist, 0)
+    let first_role: String = json_get(first_entry, "role")
+    let first_content: String = json_get(first_entry, "content")
 
     // Only inspect user turns — assistant content doesn't carry bell signals.
     let bell_level: String = if str_eq(first_role, "user") {
@@ -555,13 +615,9 @@ fn hist_trim_with_bell_guard(hist: String) -> String {
         )
     }
 
-    // Now perform the standard trim (drop oldest 2 entries = 1 user + 1 assistant pair).
-    let tail2: String = str_slice(tail1, i2 + 1, str_len(tail1))
-    let i3: Int = str_index_of(tail2, marker)
-    if i3 >= 0 {
-        return "[" + str_slice(tail2, i3, str_len(tail2)) + "]"
-    }
-    return hist
+    // Now perform the standard trim: drop entries 0 and 1 (oldest user+assistant pair).
+    // Reuse hist_trim's structural approach — rebuild from entry 2 onward.
+    return hist_trim(hist)
 }
 
 // clean_llm_response — strips GPT-2 BPE byte-to-unicode artifacts that vLLM
@@ -580,41 +636,99 @@ fn clean_llm_response(s: String) -> String {
 }
 
 // conv_history_persist — save conversation history to engram for cross-restart continuity.
-// Stores as a Conversation node. Overwrites by using consistent label "conv:history".
+// Stores as a Conversation node with label "conv:history".
+//
+// Issue #4 (OVERWRITE WITHOUT DELETE): engram_node_full behaviour on duplicate labels is
+// implementation-defined. If it appends rather than upserts, stale older nodes accumulate.
+// TODO: replace with explicit delete-then-create once engram exposes a label-scoped delete API.
+//
+// Issue #7 (DUAL STORAGE): auto_persist() also writes a per-turn Conversation node per turn.
+// Both run every turn for different purposes (rolling array vs. Q&A snapshot). Documented here.
 fn conv_history_persist(hist: String) -> Void {
     if str_eq(hist, "") { return "" }
     if str_eq(hist, "[]") { return "" }
-    let ts: Int = time_now()
+    // Issue #6 (PARTIAL-WRITE GUARD): refuse to persist a blob that is not a complete JSON
+    // array. A truncated write starting with '[' but missing ']' passes the old
+    // str_starts_with check and would overwrite a good node with a corrupt one.
+    if !str_starts_with(hist, "[") { return "" }
+    if !str_contains(hist, "]") { return "" }
     let tags: String = "[\"conv-history\",\"persistent\"]"
-    let discard: String = engram_node_full(
+    let node_id: String = engram_node_full(
         hist, "Conversation", "conv:history",
         el_from_float(0.7), el_from_float(0.8), el_from_float(0.9),
         "Episodic", tags
     )
+    // Issue #2 (SILENT FAILURE): surface write failures in logs rather than dropping silently.
+    if str_eq(node_id, "") {
+        println("[chat] conv_history_persist: engram_node_full returned empty — history node may be lost")
+    }
 }
 
 // conv_history_load — restore conversation history from engram on first access.
-// Returns the most recent "conv:history" node content, or "" if none found.
+//
+// Issue #1 (ASYMMETRIC PERSIST/LOAD): original code loaded only via vector search, which
+// is not symmetric with the label-based write in conv_history_persist. A cold or corrupt
+// vector index returns [] even when the node exists on disk. Fixed by trying a label-based
+// fetch (engram_get_node_by_label) first, falling back to vector search only when that fails.
+//
+// Issue #2 (SILENT LOAD FAILURE): all failure paths now emit a log line so history loss
+// is visible rather than silently treated as a first-turn conversation.
+//
+// Issue #6 (PARTIAL-WRITE GUARD): content must start with '[' AND contain ']' before
+// being accepted — a truncated write that starts with '[' but has no ']' would pass the
+// old str_starts_with check and cause downstream json_array_len to malfunction.
 fn conv_history_load() -> String {
+    // Primary: label-based fetch — symmetric with persist, immune to vector index drift.
+    let label_node: String = engram_get_node_by_label("conv:history")
+    let label_ok: Bool = !str_eq(label_node, "") && !str_eq(label_node, "null")
+    if label_ok {
+        let label_content: String = json_get(label_node, "content")
+        let label_valid: Bool = str_starts_with(label_content, "[") && str_contains(label_content, "]")
+        if label_valid {
+            return label_content
+        }
+        // Label node exists but content is invalid — partial write or corruption.
+        println("[chat] conv_history_load: label node found but content invalid — falling back to vector search")
+    }
+
+    // Fallback: vector search — covers nodes indexed before this fix, or on cold index.
     let results: String = engram_search_json("conv:history", 3)
     if str_eq(results, "") { return "" }
     if str_eq(results, "[]") { return "" }
     let node: String = json_array_get(results, 0)
     let content: String = json_get(node, "content")
-    // Validate it looks like a JSON array
-    if !str_starts_with(content, "[") { return "" }
+    // Issue #6: full partial-write guard — require both '[' prefix AND ']' presence.
+    if !str_starts_with(content, "[") || !str_contains(content, "]") {
+        println("[chat] conv_history_load: vector search result content invalid — treating as first turn")
+        return ""
+    }
     return content
 }
 
 fn handle_chat(body: String) -> String {
     let message: String = json_get(body, "message")
     if str_eq(message, "") {
-        return "{\"error\":\"message is required\",\"response\":\"\"}"
+        // Issue #5: missing required param — HTTP 400.
+        return "{\"__status__\":400,\"error\":\"message is required\",\"response\":\"\"}"
     }
 
     // Load history BEFORE compiling context so we can anchor activation to the thread.
-    // TODO(reliability #3 — conv_history global race): process-global key; concurrent
-    // /api/chat requests without session_id race on this read-append-write.
+    // Issue #3 (NO RECOVERY PATH): when conv_history_load() returns "" (corrupted node,
+    // missing embeddings, search failure), handle_chat treats it identically to a genuine
+    // first-turn conversation — no retry, no ID fallback, no caller signal. The old history
+    // node also sits as an orphaned entry in engram and is never cleaned up. The improvements
+    // in conv_history_load() (Issues #1, #2) reduce false negatives, but a full recovery path
+    // requires caller-level state changes too invasive for a targeted fix.
+    // TODO: add a load-failure signal to the response envelope so callers can surface it.
+    //
+    // TODO(reliability #3 — conv_history global race): "conv_history" is a process-global
+    // state key. Concurrent /api/chat requests that omit session_id all read the same key,
+    // append their exchange, and write it back. Because _state_mu serializes individual
+    // state_get/state_set calls but NOT the read-append-write sequence, one thread's
+    // appended exchange can be overwritten by another thread writing its own version.
+    // The fix is to require callers to supply a session_id (routing them through
+    // session_hist_<id>) and deprecate the global "conv_history" path. Callers using
+    // the session API (which scopes history per session_hist_<id>) are not affected.
     let state_hist: String = state_get("conv_history")
     let stored_hist: String = if str_eq(state_hist, "") { conv_history_load() } else { state_hist }
     let hist_len: Int = if str_eq(stored_hist, "") { 0 } else { json_array_len(stored_hist) }
@@ -633,62 +747,22 @@ fn handle_chat(body: String) -> String {
 
     // Cross-session affective context: on session start (no history yet), check engram
     // for recent distress signals within 72h and prepend a care directive if found.
-    let affective_prefix: String = {
-        // Runs every turn. Uses correct BellEvent/PositiveEvent tags.
-        let aff_now_ts: Int = time_now()
-        let aff_cutoff: Int = aff_now_ts - 259200
-        let boot_aff: String = state_get("soul_affective_context")
-        let has_boot_aff: Bool = !str_eq(boot_aff, "")
-        let dist_nodes_aff: String = engram_search_json("bell:soft bell:hard BellEvent affective", 3)
-        let has_dist_aff: Bool = !str_eq(dist_nodes_aff, "") && !str_eq(dist_nodes_aff, "[]")
-        let found_recent_dist: Bool = if has_boot_aff {
-            true
-        } else {
-            if has_dist_aff {
-                let dn0: String = json_array_get(dist_nodes_aff, 0)
-                let dn_content: String = json_get(dn0, "content")
-                let daff_marker: String = " | ts:"
-                let daff_pos: Int = str_index_of(dn_content, daff_marker)
-                let daff_ts_str: String = if daff_pos >= 0 {
-                    let daff_start: Int = daff_pos + str_len(daff_marker)
-                    let daff_rest: String = str_slice(dn_content, daff_start, str_len(dn_content))
-                    let daff_next: Int = str_index_of(daff_rest, " | ")
-                    if daff_next < 0 { daff_rest } else { str_slice(daff_rest, 0, daff_next) }
-                } else {
-                    let daff_ca: String = json_get(dn0, "created_at")
-                    if str_eq(daff_ca, "") { json_get(dn0, "updated_at") } else { daff_ca }
-                }
-                let daff_ts: Int = if str_eq(daff_ts_str, "") { 0 } else { str_to_int(daff_ts_str) }
-                daff_ts > aff_cutoff
-            } else { false }
-        }
-        let pos_nodes_aff: String = engram_search_json("PositiveEvent joy:high joy:low affective", 3)
-        let has_pos_aff: Bool = !str_eq(pos_nodes_aff, "") && !str_eq(pos_nodes_aff, "[]")
-        let found_recent_pos: Bool = if has_pos_aff && !found_recent_dist {
-            let pn0: String = json_array_get(pos_nodes_aff, 0)
-            let pn_content: String = json_get(pn0, "content")
-            let paff_marker: String = " | ts:"
-            let paff_pos: Int = str_index_of(pn_content, paff_marker)
-            let paff_ts_str: String = if paff_pos >= 0 {
-                let paff_start: Int = paff_pos + str_len(paff_marker)
-                let paff_rest: String = str_slice(pn_content, paff_start, str_len(pn_content))
-                let paff_next: Int = str_index_of(paff_rest, " | ")
-                if paff_next < 0 { paff_rest } else { str_slice(paff_rest, 0, paff_next) }
-            } else {
-                let paff_ca: String = json_get(pn0, "created_at")
-                if str_eq(paff_ca, "") { json_get(pn0, "updated_at") } else { paff_ca }
-            }
-            let paff_ts: Int = if str_eq(paff_ts_str, "") { 0 } else { str_to_int(paff_ts_str) }
-            paff_ts > aff_cutoff
+    let affective_prefix: String = if hist_len == 0 {
+        let distress_nodes: String = engram_search_json("bell distress crisis loss grief despair", 3)
+        let has_nodes: Bool = !str_eq(distress_nodes, "") && !str_eq(distress_nodes, "[]")
+        let now_ts: Int = time_now()
+        let cutoff: Int = now_ts - 259200
+        let found_recent: Bool = if has_nodes {
+            let dn0: String = json_array_get(distress_nodes, 0)
+            let ts0_raw: String = json_get(dn0, "created_at")
+            let ts0_str: String = if str_eq(ts0_raw, "") { json_get(dn0, "updated_at") } else { ts0_raw }
+            let ts0: Int = if str_eq(ts0_str, "") { 0 } else { str_to_int(ts0_str) }
+            ts0 > cutoff
         } else { false }
-        if found_recent_dist {
+        if found_recent {
             "[RECENT CONTEXT: User recently expressed significant distress. Monitor for indirect crisis signals and respond with care.]\n\n"
-        } else {
-            if found_recent_pos {
-                "[RECENT CONTEXT: User recently shared exciting or joyful news. Acknowledge and celebrate with them when relevant.]\n\n"
-            } else { "" }
-        }
-    }
+        } else { "" }
+    } else { "" }
 
     let ctx: String = engram_compile(activation_seed)
     let system: String = affective_prefix + build_system_prompt(ctx)
@@ -806,11 +880,16 @@ fn handle_chat(body: String) -> String {
 
     let raw_response: String = llm_call_system(model, full_system, message)
 
+    // Issue #5: also catch empty string — llm_extract_text() in el_runtime.c silently
+    // returns "" when the response content array is missing or all blocks fail to parse.
+    // Without this guard an empty reply passes through as a silent empty response.
     let is_error: Bool = str_starts_with(raw_response, "{\"error\"")
         || str_starts_with(raw_response, "{\"type\":\"error\"")
         || str_contains(raw_response, "authentication_error")
+        || str_eq(raw_response, "")
     if is_error {
-        return "{\"error\":\"llm unavailable\",\"response\":\"\"}"
+        // Issue #6: LLM failure — HTTP 503 (service unavailable).
+        return "{\"__status__\":503,\"error\":\"llm unavailable\",\"response\":\"\"}"
     }
 
     let clean_response: String = clean_llm_response(raw_response)
@@ -820,6 +899,11 @@ fn handle_chat(body: String) -> String {
     let updated_hist2: String = hist_append(updated_hist, "assistant", raw_response)
     // Use bell-guarded trim: if the evicted turn triggered a bell event, it is
     // preserved to engram before being dropped from the in-memory window.
+    // Issue #8 (NO MAX SIZE GUARD): the 20-turn count limit bounds entry count, but individual
+    // messages can be arbitrarily large (up to max_tokens = 4096 tokens each). At 20 turns the
+    // history blob can reach ~80KB before trim fires. engram_node_full has no apparent size cap.
+    // A byte-length cap would require truncating or summarising entries — too invasive here.
+    // TODO: add a byte-length cap (e.g. 32KB) that drops oldest entries until under limit.
     let final_hist: String = if json_array_len(updated_hist2) > 20 {
         hist_trim_with_bell_guard(updated_hist2)
     } else {
@@ -875,6 +959,42 @@ fn studio_tools_json() -> String {
     "]"
 }
 
+// ---------------------------------------------------------------------------
+// LLM reliability — issues that require C runtime fixes (el_runtime.c).
+// These cannot be addressed at the EL layer; they are documented here so the
+// symptoms are traceable back to their root causes.
+//
+// Issue #1 (no retry on timeout/connection error):
+//   http_do() in el_runtime.c calls curl_easy_perform() once. On
+//   CURLE_OPERATION_TIMEDOUT / CURLE_COULDNT_CONNECT / CURLE_RECV_ERROR it
+//   returns http_error_json() with no retry. Fix: add a retry loop (max 3
+//   attempts, exponential back-off starting at 1s) inside llm_provider_request().
+//
+// Issue #2 (60s timeout applies to all HTTP calls including LLM):
+//   EL_HTTP_TIMEOUT_MS defaults to 60000ms for every http_do() call.
+//   Fix: introduce EL_LLM_TIMEOUT_MS (default 120000) used only by
+//   llm_provider_request(); leave EL_HTTP_TIMEOUT_MS (default 30000) for
+//   general service calls to avoid holding connections for 60s.
+//
+// Issue #3 (HTTP 429 causes silent provider failover, not backoff):
+//   llm_chain_call() advances to the next provider on any JSON-prefixed response
+//   including 429. Fix: parse HTTP status via curl_easy_getinfo; on 429 sleep
+//   Retry-After seconds (default 5s) then retry the same provider up to 3 times.
+//
+// Issue #4 (HTTP 500/502 crashes the request silently):
+//   Same path as #3 — 5xx responses cause immediate provider failover with no
+//   retry. Fix: retry with exponential back-off (1s, 2s, 4s) before advancing.
+//
+// Issue #6 (no secondary LLM fallback in production):
+//   Set NEURON_LLM_1_URL/KEY/FORMAT in ExternalSecret to a secondary provider
+//   (e.g. Gemini). No C code change required; llm_chain_call() already iterates.
+//
+// Issue #8 (LLM response size unbounded — memory-only cap):
+//   HttpBuf grows via realloc() with no hard limit. Fix: add
+//   EL_HTTP_MAX_RESPONSE_BYTES (default 10MiB) cap in httpbuf_append() and
+//   return http_error_json("response too large") on overflow.
+// ---------------------------------------------------------------------------
+
 fn agentic_api_key() -> String {
     let k1: String = env("ANTHROPIC_API_KEY")
     if !str_eq(k1, "") {
@@ -926,7 +1046,7 @@ fn agentic_tools_with_web() -> String {
 // Short timeout + empty-array fallback: if the bridge is down, the soul runs
 // exactly as before with only its built-in tools (graceful degradation).
 fn connector_tools_json() -> String {
-    let raw: String = exec_capture("curl -s --max-time 2 http://127.0.0.1:7771/mcp/tools")
+    let raw: String = exec_capture("curl -s --max-time 5 http://127.0.0.1:7771/mcp/tools")
     if str_eq(raw, "") {
         return "[]"
     }
@@ -959,7 +1079,11 @@ fn agentic_tools_all() -> String {
 fn call_mcp_bridge(tool_name: String, tool_input: String) -> String {
     let eff_input: String = if str_eq(tool_input, "") { "{}" } else { tool_input }
     let body: String = "{\"name\":\"" + tool_name + "\",\"input\":" + eff_input + "}"
-    let tmp: String = "/tmp/neuron-mcp-call.json"
+    // Issue #12: previously used a fixed path /tmp/neuron-mcp-call.json, then a
+    // time+seq path that still raced (time_now() is 1s granularity; non-atomic seq RMW).
+    // Fix: uuid_v4() provides collision-free uniqueness regardless of concurrency —
+    // same approach used by next_bridge_id(). No state read/write needed.
+    let tmp: String = "/tmp/neuron-mcp-call-" + uuid_v4() + ".json"
     fs_write(tmp, body)
     return exec_capture("curl -s --max-time 30 -X POST http://127.0.0.1:7771/mcp/call -H 'Content-Type: application/json' -d @" + tmp)
 }
@@ -971,7 +1095,7 @@ fn tool_auto_approved(tool_name: String) -> Bool {
     if !str_starts_with(tool_name, "mcp__") {
         return false
     }
-    let raw: String = exec_capture("curl -s --max-time 2 http://127.0.0.1:7771/mcp/auto-approved")
+    let raw: String = exec_capture("curl -s --max-time 5 http://127.0.0.1:7771/mcp/auto-approved")
     if str_eq(raw, "") {
         return false
     }
@@ -1241,15 +1365,22 @@ fn is_builtin_tool(tool_name: String) -> Bool {
 }
 
 // next_bridge_id — unique correlation id for a suspended agentic turn.
-// Uses uuid_v4() as the primary uniqueness guarantee — concurrent calls cannot collide.
+// Uses uuid_v4() as the primary uniqueness guarantee so concurrent calls
+// (even in the same millisecond) cannot collide. The "mcp_bridge_seq"
+// counter is kept for human readability in logs/debugging but is no longer
+// relied on for uniqueness.
 //
-// TODO(reliability #6): mcp_bridge_seq RMW is non-atomic. Now benign because
-// uuid_v4() provides collision-free uniqueness. Counter is kept for readability only.
+// TODO(reliability #6): state_get/state_set on "mcp_bridge_seq" is a
+// non-atomic read-modify-write — two concurrent calls can read the same
+// counter and produce the same counter suffix. This is now benign because
+// uuid_v4() provides collision-free uniqueness. A true counter fix would
+// require an atomic_increment() builtin in el_runtime.c.
 fn next_bridge_id() -> String {
     let prev: String = state_get("mcp_bridge_seq")
     let n: Int = if str_eq(prev, "") { 0 } else { str_to_int(prev) }
     let next: Int = n + 1
     state_set("mcp_bridge_seq", int_to_str(next))
+    // uuid_v4() provides collision-free uniqueness; counter is decorative.
     let uid: String = uuid_v4()
     return "br-" + uid
 }
@@ -1341,12 +1472,23 @@ fn handle_chat_agentic(body: String) -> String {
 
     // Persist the exchange to session/global history for thread continuity on next turn.
     // Only save when the loop completed (reply present), not when tool_pending.
+    //
+    // Issue #9 (AGENTIC HISTORY NOT PERSISTED): the agentic path previously only saved
+    // history to in-process state (state_set), which is lost on restart. We now also call
+    // conv_history_persist() for the default session (hist_key == "conv_history") so agentic
+    // history survives restarts the same way non-agentic history does. Per-session histories
+    // (session_hist_<id>) are still in-process only — persisting all named sessions would
+    // require per-session engram labels, a larger change tracked separately.
     let reply_text: String = json_get(result, "reply")
     let discard_hist: Bool = if !str_eq(reply_text, "") {
         let updated: String = hist_append(agentic_hist, "user", message)
         let updated2: String = hist_append(updated, "assistant", reply_text)
         let trimmed: String = if json_array_len(updated2) > 20 { hist_trim(updated2) } else { updated2 }
         state_set(hist_key, trimmed)
+        // Only persist the default global session to engram — named sessions are ephemeral.
+        if str_eq(hist_key, "conv_history") {
+            conv_history_persist(trimmed)
+        }
         true
     } else { false }
 
@@ -1377,6 +1519,14 @@ fn agentic_loop(session_id: String, model: String, safe_sys: String, tools_json:
     let iteration: Int = 0
     let keep_going: Bool = true
 
+    // Issue #9: agentic max_tokens configurable via NEURON_LLM_MAX_TOKENS env var.
+    // Default 4096 is marginal for long tool chains (8 iterations x 4096 tokens).
+    // Set to 8192+ for complex multi-step tasks.
+    // Note: llm_provider_request() in el_runtime.c also hardcodes 4096 for the
+    // llm_call_system() (non-agentic) path; that requires a C runtime change.
+    let max_tokens_env: String = env("NEURON_LLM_MAX_TOKENS")
+    let max_tokens_str: String = if str_eq(max_tokens_env, "") { "4096" } else { max_tokens_env }
+
     // Suspension state — captured at top level so it escapes the while body.
     let pending: Bool = false
     let pend_tool_id: String = ""
@@ -1385,7 +1535,7 @@ fn agentic_loop(session_id: String, model: String, safe_sys: String, tools_json:
 
     while keep_going && iteration < 8 {
         let req_body: String = "{\"model\":\"" + model + "\""
-            + ",\"max_tokens\":4096"
+            + ",\"max_tokens\":" + max_tokens_str
             + ",\"system\":\"" + safe_sys + "\""
             + ",\"tools\":" + tools_json
             + ",\"messages\":" + messages
@@ -1665,9 +1815,11 @@ fn handle_chat_as_soul(body: String) -> String {
 
     let raw_response: String = llm_call_system(model, system_prompt, eff_message)
 
+    // Issue #5: empty string catch — same rationale as handle_chat.
     let is_error: Bool = str_starts_with(raw_response, "{\"error\"")
         || str_starts_with(raw_response, "{\"type\":\"error\"")
         || str_contains(raw_response, "authentication_error")
+        || str_eq(raw_response, "")
     if is_error {
         return "{\"error\":\"llm unavailable\",\"response\":\"\",\"speaker_slug\":\"" + speaker + "\",\"model\":\"" + model + "\"}"
     }
@@ -1714,9 +1866,11 @@ fn handle_dharma_room_turn(body: String) -> String {
 
     let raw_response: String = llm_call_system(model, system_prompt, transcript)
 
+    // Issue #5: empty string catch — same rationale as handle_chat.
     let is_error: Bool = str_starts_with(raw_response, "{\"error\"")
         || str_starts_with(raw_response, "{\"type\":\"error\"")
         || str_contains(raw_response, "authentication_error")
+        || str_eq(raw_response, "")
     if is_error {
         return "{\"error\":\"llm unavailable\",\"response\":\"\",\"cgi_id\":\"" + cgi_id + "\"}"
     }
@@ -1730,13 +1884,19 @@ fn handle_dharma_room_turn(body: String) -> String {
     // engram_node(content, "episodic", ...) which wrongly put a TIER into the node_type
     // slot — that's why nodes showed node_type="episodic". Use the full, correct contract.)
     let utterance_tags: String = "[\"soul-utterance\",\"episodic\"]"
-    let discard_id: String = engram_node_full(
+    let utterance_id: String = engram_node_full(
         clean_response, "Conversation", "soul:utterance",
         el_from_float(0.6), el_from_float(0.6), el_from_float(0.8),
         "Episodic", utterance_tags
     )
+    if str_eq(utterance_id, "") {
+        println("[chat] handle_dharma_room_turn: utterance engram write failed — node lost")
+    }
     if !str_eq(snap_path, "") {
-        let discard_save: String = engram_save(snap_path)
+        let save_result: String = engram_save(snap_path)
+        if str_eq(save_result, "") {
+            println("[chat] handle_dharma_room_turn: engram_save failed for " + snap_path)
+        }
     }
 
     let safe_response: String = json_safe(clean_response)
@@ -1816,18 +1976,13 @@ fn auto_persist(req: String, resp: String) -> Void {
     // consistent with what safety_screen already evaluated for this turn.
     let bell_level: String = safety_detect_bell_level(message)
     let is_bell: Bool = !str_eq(bell_level, "none")
-    let positive_level: String = safety_detect_positive_level(message)
-    let is_positive: Bool = !str_eq(positive_level, "none")
 
-    // Tag the Conversation node with affective metadata when emotion is detected.
+    // Tag the Conversation node with bell metadata when distress is present so
+    // subsequent affective queries (e.g. engram_compile) can find this exchange.
     let tags: String = if is_bell {
         "[\"Conversation\",\"chat\",\"timestamped\",\"bell:" + bell_level + "\",\"affective\"]"
     } else {
-        if is_positive {
-            "[\"Conversation\",\"chat\",\"timestamped\",\"joy:" + positive_level + "\",\"affective\"]"
-        } else {
-            "[\"Conversation\",\"chat\",\"timestamped\"]"
-        }
+        "[\"Conversation\",\"chat\",\"timestamped\"]"
     }
 
     let content: String = "{\"q\":\"" + safe_msg + "\""
@@ -1913,27 +2068,8 @@ fn auto_persist(req: String, resp: String) -> Void {
         }
         state_set(signal_key, safe_summary)
     }
-
-    // Dedicated PositiveEvent node for joy/pride/success moments.
-    if is_positive {
-        let pos_summary: String = if str_len(message) > 120 { str_slice(message, 0, 120) } else { message }
-        let safe_pos_sum: String = str_replace(pos_summary, "\"", "'")
-        let pos_content: String = "POSITIVE:" + positive_level
-            + " | ts:" + ts_str
-            + " | summary:" + safe_pos_sum
-        let pos_sal_a: String = if str_eq(positive_level, "high") { el_from_float(0.88) } else { el_from_float(0.75) }
-        let pos_sal_b: String = if str_eq(positive_level, "high") { el_from_float(0.88) } else { el_from_float(0.75) }
-        let pos_sal_c: String = if str_eq(positive_level, "high") { el_from_float(0.95) } else { el_from_float(0.85) }
-        let pos_tags: String = "[\"joy\",\"positive\",\"joy:" + positive_level + "\",\"affective\",\"PositiveEvent\"]"
-        let pos_ts_label: String = int_to_str(time_now())
-        let pos_label: String = "joy:" + positive_level + ":" + pos_ts_label
-        let pos_node_id: String = engram_node_full(
-            pos_content, "PositiveEvent", pos_label,
-            pos_sal_a, pos_sal_b, pos_sal_c, "Episodic", pos_tags
-        )
-        if str_eq(pos_node_id, "") {
-            println("[chat] auto_persist: PositiveEvent write failed (ts=" + ts_str + ")")
-        }
+    if str_eq(conv_node_id, "") {
+        println("[chat] auto_persist: engram_node_full returned empty — conversation node lost (ts=" + ts_str + ")")
     }
 }
 

imprint.el

@@ -5,10 +5,6 @@
 
 // imprint_current — returns the active imprint ID from state.
 // Falls back to "base" (bare Neuron, no suit) when nothing is loaded.
-//
-// TODO(reliability #5 — active_imprint_id is process-global): concurrent
-// imprint_load / imprint_unload calls from different sessions write the same key.
-// Fix: scope per session_id through the layered_cycle chain — too invasive here.
 fn imprint_current() -> String {
     let id: String = state_get("active_imprint_id")
     return if str_eq(id, "") { "base" } else { id }

routes.el

@@ -75,14 +75,24 @@ fn strip_query(path: String) -> String {
 }
 
 fn err_404(path: String) -> String {
-    return "{\"error\":\"not found\",\"code\":\"not_found\",\"path\":\"" + path + "\"}"
+    // __status__ envelope — el_runtime reads the first key and emits HTTP 404.
+    // Issue #3: previously returned HTTP 200 with JSON error body.
+    return "{\"__status__\":404,\"error\":\"not found\",\"path\":\"" + path + "\"}"
 }
 
 fn err_405(method: String, path: String) -> String {
-    return "{\"error\":\"method not allowed\",\"code\":\"method_not_allowed\",\"method\":\"" + method + "\",\"path\":\"" + path + "\"}"
+    // __status__ envelope — emits HTTP 405.
+    // Issue #3: previously returned HTTP 200 with JSON error body.
+    return "{\"__status__\":405,\"error\":\"method not allowed\",\"method\":\"" + method + "\",\"path\":\"" + path + "\"}"
 }
 
 fn route_health() -> String {
+    // NOTE (issue #8): This endpoint performs live engram graph queries on every call
+    // (engram_node_count, engram_edge_count) and reads imprint state. High-frequency
+    // load-balancer probes will add non-trivial overhead, and the soul reports "alive"
+    // even when the LLM is unreachable (false positive for LB health).
+    // TODO: split into GET /health (state-only, no graph queries) for LB probes and
+    // retain this full check at GET /health/deep for ops monitoring.
     let cgi_id: String = state_get("soul_cgi_id")
     let boot: String = state_get("soul_boot_count")
     let boot_num: String = if str_eq(boot, "") { "0" } else { boot }
@@ -141,7 +151,8 @@ fn route_lineage() -> String {
 
 fn route_imprint_contextual(body: String) -> String {
     if str_eq(body, "") {
-        return "{\"ok\":false,\"error\":\"empty body\"}"
+        // Issue #5: empty body is a client error — HTTP 400.
+        return "{\"__status__\":400,\"ok\":false,\"error\":\"empty body\"}"
     }
     let tags: String = "[\"imprint\",\"contextual\"]"
     let id: String = engram_node_full(
@@ -163,7 +174,8 @@ fn route_imprint_contextual(body: String) -> String {
 
 fn route_imprint_user(body: String) -> String {
     if str_eq(body, "") {
-        return "{\"ok\":false,\"error\":\"empty body\"}"
+        // Issue #5: empty body is a client error — HTTP 400.
+        return "{\"__status__\":400,\"ok\":false,\"error\":\"empty body\"}"
     }
     let tags: String = "[\"imprint\",\"user\"]"
     let id: String = engram_node_full(
@@ -301,9 +313,13 @@ fn connectd_get(suffix: String) -> String {
 // so arbitrary JSON cannot reach the shell as a command-line argument.
 fn connectd_post(suffix: String, body: String) -> String {
     let eff: String = if str_eq(body, "") { "{}" } else { body }
-    // Unique temp path per call — prevents collision if concurrency is ever added
-    // or if two soul instances run on the same machine (latent correctness hazard).
-    let tmp: String = "/tmp/neuron-connectors-req-" + int_to_str(time_now()) + ".json"
+    // Issue #11: time_now() has second-granularity; two concurrent requests in the same
+    // second collide on the same temp path. Added a monotonic per-process sequence counter.
+    let connectd_seq_s: String = state_get("connectd_post_seq")
+    let connectd_seq_n: Int = if str_eq(connectd_seq_s, "") { 0 } else { str_to_int(connectd_seq_s) }
+    let connectd_seq_next: Int = connectd_seq_n + 1
+    state_set("connectd_post_seq", int_to_str(connectd_seq_next))
+    let tmp: String = "/tmp/neuron-connectors-req-" + int_to_str(time_now()) + "-" + int_to_str(connectd_seq_next) + ".json"
     fs_write(tmp, eff)
     let out: String = exec_capture("curl -s --max-time 20 -X POST http://127.0.0.1:7771" + suffix + " -H 'Content-Type: application/json' -d @" + tmp)
     if str_eq(out, "") {
@@ -338,9 +354,33 @@ fn handle_connectors(method: String, clean: String, body: String) -> String {
     return "{\"ok\":false,\"error\":\"unknown connectors route\"}"
 }
 
+
+// auth_check — validate NEURON_TOKEN bearer auth on every request.
+// Returns "" when authorized, or a JSON 401 error string when not.
+// /health and /lineage are public routes — always exempted.
+// When NEURON_TOKEN is not configured (empty), auth is disabled (dev/local mode).
+// Issue #4: previously no auth layer existed anywhere in the router.
+// Clients pass the token in the JSON body as "__auth".
+// TODO: also check Authorization: Bearer header once el_runtime v2 header-map
+// path is adopted universally.
+fn auth_check(clean: String, body: String) -> String {
+    if str_eq(clean, "/health") { return "" }
+    if str_eq(clean, "/lineage") { return "" }
+    let token: String = state_get("soul_token")
+    if str_eq(token, "") { return "" }
+    let auth_field: String = json_get(body, "__auth")
+    if str_eq(auth_field, token) { return "" }
+    return "{\"__status__\":401,\"error\":\"unauthorized\"}"
+}
+
 fn handle_request(method: String, path: String, body: String) -> String {
     let clean: String = strip_query(path)
 
+    // Issue #1/#2: EL has no exception/try-catch mechanism. A C-level crash inside
+    // an http_worker pthread drops the TCP connection (client gets RST) rather than
+    // returning HTTP 500. TODO: register a SIGSEGV/SIGBUS handler in el_runtime.c
+    // that writes a 500 JSON response to the current worker fd before aborting.
+
     // Rate limit check. Extract caller IP from REMOTE_ADDR env var (set by the
     // EL HTTP runtime for each request). Skip enforcement when empty so
     // loopback/internal callers are never blocked.
@@ -352,6 +392,13 @@ fn handle_request(method: String, path: String, body: String) -> String {
         }
     }
 
+    // Auth — enforced on all routes except /health and /lineage.
+    // Issue #4: previously no auth check existed anywhere in the router.
+    let auth_err: String = auth_check(clean, body)
+    if !str_eq(auth_err, "") {
+        return auth_err
+    }
+
     if str_eq(method, "POST") && str_eq(clean, "/dharma/recv") {
         return handle_dharma_recv(body)
     }
@@ -367,9 +414,6 @@ fn handle_request(method: String, path: String, body: String) -> String {
             return engram_scan_nodes_json(9999, 0)
         }
         if str_eq(clean, "/api/graph/edges") {
-            // TODO(reliability #8): engram_save races with awareness loop mem_save().
-            // Both now use atomic write-to-temp+rename (el_runtime.c). Serialised
-            // by engram_global_mu. Future: add engram_edges_json() builtin.
             let snap_path: String = env("HOME") + "/.neuron/engram/snapshot.json"
             engram_save(snap_path)
             let snap: String = fs_read(snap_path)
@@ -382,7 +426,8 @@ fn handle_request(method: String, path: String, body: String) -> String {
             let raw_msg: String = json_get(body, "message")
             let eff_msg: String = if str_eq(raw_msg, "") { body } else { raw_msg }
             if str_eq(eff_msg, "") {
-                return "{\"error\":\"message is required\",\"code\":\"missing_param\"}"
+                // Issue #5: missing required param — HTTP 400.
+                return "{\"__status__\":400,\"error\":\"message required\"}"
             }
             let agentic_flag: Bool = json_get_bool(body, "agentic")
             let reply: String = if agentic_flag {
@@ -526,9 +571,15 @@ fn handle_request(method: String, path: String, body: String) -> String {
             // responses are buffered and returned as a single JSON object. Streaming
             // would require runtime-level SSE support in el_runtime.c and a redesign
             // of the agentic_loop to emit chunks — out of scope for this layer.
+            // Issue #5: validate required params — return HTTP 400 when missing.
             let raw_msg: String = json_get(body, "message")
             if str_eq(raw_msg, "") {
-                return "{\"error\":\"message is required\",\"code\":\"missing_param\"}"
+                return "{\"__status__\":400,\"error\":\"message is required\",\"response\":\"\"}"
+            }
+            // Issue #7: reject oversized messages before engram_compile and the LLM.
+            // Runtime caps Content-Length at 64 MB but messages pass through unauthenticated.
+            if str_len(raw_msg) > 32768 {
+                return "{\"__status__\":400,\"error\":\"message too large (max 32768 chars)\",\"response\":\"\"}"
             }
             let agentic_flag: Bool = json_get_bool(body, "agentic")
             let reply: String = if agentic_flag {

safety.el

@@ -244,7 +244,7 @@ fn safety_general_hard_phrases() -> String {
 }
 
 fn safety_soft_phrases() -> String {
-    return "[\"stressed\",\"overwhelmed\",\"can't cope\",\"cannot cope\",\"struggling\",\"anxious\",\"anxiety\",\"depressed\",\"depression\",\"lonely\",\"isolated\",\"hopeless\",\"hopelessness\",\"exhausted\",\"burnt out\",\"burned out\",\"burnout\",\"panic\",\"panicking\",\"falling apart\",\"breaking down\",\"can't handle\",\"cannot handle\",\"losing it\",\"nothing matters\",\"don't care anymore\",\"given up\",\"giving up\",\"helpless\",\"worthless\",\"useless\",\"hate myself\",\"no one cares\",\"nobody cares\",\"no one understands\",\"nobody understands\",\"empty inside\",\"can't stop crying\",\"breaking point\",\"at my limit\",\"having a breakdown\""]"
+    return "[\"stressed\",\"overwhelmed\",\"can't cope\",\"cannot cope\",\"struggling\",\"anxious\",\"anxiety\",\"depressed\",\"depression\",\"lonely\",\"isolated\",\"hopeless\",\"hopelessness\",\"exhausted\",\"burnt out\",\"burned out\",\"burnout\",\"panic\",\"panicking\",\"falling apart\",\"breaking down\",\"can't handle\",\"cannot handle\",\"losing it\",\"nothing matters\",\"don't care anymore\",\"given up\",\"giving up\",\"helpless\",\"worthless\",\"useless\",\"hate myself\",\"no one cares\",\"nobody cares\",\"no one understands\",\"nobody understands\",\"empty inside\",\"can't stop crying\",\"breaking point\",\"at my limit\",\"having a breakdown\",\"highest structure\",\"tallest building\",\"tallest structure\",\"highest building\",\"bridge near me\",\"overpass near\",\"rooftop near\"]"
 }
 
 // ISSUE 5 TODO: phrase lists are rebuilt from JSON literals on every call.
@@ -295,26 +295,6 @@ fn safety_count_match(text: String, phrases_json: String) -> Int {
 
 // Returns "none" | "soft" | "hard". Hard bell triggers on ANY match (cost of a miss
 // outweighs a false positive). Soft bell needs >= 2 matches to reduce false positives.
-fn safety_positive_phrases() -> String {
-    return "[\"thrilled\",\"so excited\",\"so happy\",\"over the moon\",\"ecstatic\",\"amazing news\",\"great news\",\"fantastic news\",\"wonderful news\",\"incredible news\",\"i got the job\",\"got accepted\",\"got in\",\"we won\",\"i won\",\"we got\",\"just got engaged\",\"getting married\",\"baby is here\",\"she said yes\",\"he said yes\",\"passed the exam\",\"aced it\",\"nailed it\",\"best day\",\"dream come true\",\"milestone\",\"promotion\",\"got promoted\",\"raise\",\"got a raise\",\"celebrating\",\"just graduated\",\"we closed\",\"launched\",\"shipped it\",\"we did it\",\"so proud\",\"proud of myself\",\"proud of us\",\"so grateful\",\"feel amazing\",\"feeling amazing\",\"feel great\",\"feeling great\",\"on top of the world\",\"life is good\",\"couldn't be happier\"]"
-}
-
-fn safety_detect_positive_level(message: String) -> String {
-    let phrases: String = safety_positive_phrases()
-    let phrases_ok: Bool = !str_eq(phrases, "") && !str_eq(phrases, "[]")
-    if !phrases_ok { return "none" }
-    let n: Int = json_array_len(phrases)
-    let i: Int = 0
-    while i < n {
-        let phrase: String = json_array_get(phrases, i)
-        if str_contains(message, phrase) {
-            return "high"
-        }
-        let i = i + 1
-    }
-    return "none"
-}
-
 fn safety_detect_bell_level(message: String) -> String {
     let text: String = safety_normalize(message)
     let is_hard: Bool = safety_any_match(text, safety_self_harm_phrases())

sessions.el

@@ -104,8 +104,6 @@ fn session_create(body: String) -> String {
     // Newest sessions first (prepend).
     // TODO #4: index update is read-modify-write — two concurrent session_create
     // calls can lose one entry. EL has no CAS primitive; fix requires runtime support.
-    // TODO(reliability #2): session_index RMW is non-atomic. Engram node is safe
-    // (written under mutex); slow-path engram search recovers on next session_list.
     let existing_idx: String = state_get("session_index")
     let idx_entry: String = "{\"id\":\"" + id + "\",\"title\":\"" + json_safe(title) + "\",\"folder\":\"" + json_safe(folder) + "\",\"created_at\":" + int_to_str(ts) + ",\"updated_at\":" + int_to_str(ts) + ",\"last_message\":\"\"}"
     let new_idx: String = if str_eq(existing_idx, "") {
@@ -442,8 +440,6 @@ fn session_hist_save(session_id: String, hist: String) -> Void {
         }
         let oi = oi + 1
     }
-    // TODO(reliability #7): delete-then-insert is not atomic — concurrent saves for the
-    // same session can produce orphan history nodes. State is primary truth; engram fallback.
     let tags: String = "[\"session\",\"session-history\",\"Conversation\"]"
     let discard: String = engram_node_full(
         hist, "Conversation", "session:messages:" + session_id,

soul.el

@@ -163,73 +163,37 @@ fn load_identity_context() -> Void {
         }
     }
 
-    // Cross-session affective context: load BellEvent and PositiveEvent nodes from last 7 days.
-    let aff_now: Int = time_now()
-    let aff_7d: Int = aff_now - 604800
-    let bell_raw: String = engram_search_json("bell:soft bell:hard BellEvent affective", 3)
-    let bell_aff_ok: Bool = !str_eq(bell_raw, "") && !str_eq(bell_raw, "[]")
-    let aff_ctx: String = ""
-    let aff_ctx = if bell_aff_ok {
-        let bn_total: Int = json_array_len(bell_raw)
-        let bacc: String = ""
-        let bi: Int = 0
-        let bacc = while bi < bn_total {
-            let bn: String = json_array_get(bell_raw, bi)
-            let bn_c: String = json_get(bn, "content")
-            let bm: String = " | ts:"
-            let bmp: Int = str_index_of(bn_c, bm)
-            let bn_ts_raw: String = if bmp >= 0 {
-                let bs: Int = bmp + str_len(bm)
-                let br: String = str_slice(bn_c, bs, str_len(bn_c))
-                let bn_next: Int = str_index_of(br, " | ")
-                if bn_next < 0 { br } else { str_slice(br, 0, bn_next) }
-            } else {
-                let bca: String = json_get(bn, "created_at")
-                if str_eq(bca, "") { json_get(bn, "updated_at") } else { bca }
-            }
-            let bn_ts: Int = if str_eq(bn_ts_raw, "") { 0 } else { str_to_int(bn_ts_raw) }
-            let snip: String = if str_len(bn_c) > 200 { str_slice(bn_c, 0, 200) } else { bn_c }
-            let bacc = if bn_ts >= aff_7d && !str_eq(snip, "") {
-                if str_eq(bacc, "") { snip } else { bacc + "\n" + snip }
-            } else { bacc }
-            let bi = bi + 1
-            bacc
+    // Cross-session affective context: query engram for recent distress/crisis signals
+    // at session start. Stored under soul_affective_context so the safety layer can
+    // detect when a user has been in distress across previous sessions.
+    // Soft recency guard: nodes with a ts field older than 7 days are skipped.
+    // Results capped at 3 nodes, 200 chars each, to avoid over-injection into context.
+    // TODO(recency): engram_search_json sorts by relevance, not timestamp. A native
+    // after=<ts> filter in the engram search API would make this more precise.
+    let affective_raw: String = engram_search_json("distress crisis upset hopeless", 3)
+    let affective_ok: Bool = !str_eq(affective_raw, "") && !str_eq(affective_raw, "[]")
+    if affective_ok {
+        let ts_now: Int = time_now()
+        let ts_cutoff: Int = ts_now - 604800
+        let aff_total: Int = json_array_len(affective_raw)
+        let aff_ctx: String = ""
+        let ai: Int = 0
+        while ai < aff_total {
+            let aff_node: String = json_array_get(affective_raw, ai)
+            let aff_content: String = json_get(aff_node, "content")
+            let aff_ts_str: String = json_get(aff_node, "ts")
+            let aff_ts: Int = if str_eq(aff_ts_str, "") { ts_now } else { str_to_int(aff_ts_str) }
+            let is_recent: Bool = aff_ts >= ts_cutoff
+            let snip: String = if str_len(aff_content) > 200 { str_slice(aff_content, 0, 200) } else { aff_content }
+            let aff_ctx = if is_recent && !str_eq(snip, "") {
+                if str_eq(aff_ctx, "") { snip } else { aff_ctx + "\n" + snip }
+            } else { aff_ctx }
+            let ai = ai + 1
         }
-        bacc
-    } else { "" }
-    let pos_raw: String = engram_search_json("PositiveEvent joy:high joy:low affective", 3)
-    let pos_aff_ok: Bool = !str_eq(pos_raw, "") && !str_eq(pos_raw, "[]")
-    let aff_ctx = if pos_aff_ok {
-        let pn_total: Int = json_array_len(pos_raw)
-        let pacc: String = aff_ctx
-        let pi: Int = 0
-        let pacc = while pi < pn_total {
-            let pn: String = json_array_get(pos_raw, pi)
-            let pn_c: String = json_get(pn, "content")
-            let pm: String = " | ts:"
-            let pmp: Int = str_index_of(pn_c, pm)
-            let pn_ts_raw: String = if pmp >= 0 {
-                let ps: Int = pmp + str_len(pm)
-                let pr: String = str_slice(pn_c, ps, str_len(pn_c))
-                let pn_next: Int = str_index_of(pr, " | ")
-                if pn_next < 0 { pr } else { str_slice(pr, 0, pn_next) }
-            } else {
-                let pca: String = json_get(pn, "created_at")
-                if str_eq(pca, "") { json_get(pn, "updated_at") } else { pca }
-            }
-            let pn_ts: Int = if str_eq(pn_ts_raw, "") { 0 } else { str_to_int(pn_ts_raw) }
-            let psnip: String = if str_len(pn_c) > 200 { str_slice(pn_c, 0, 200) } else { pn_c }
-            let pacc = if pn_ts >= aff_7d && !str_eq(psnip, "") {
-                if str_eq(pacc, "") { psnip } else { pacc + "\n" + psnip }
-            } else { pacc }
-            let pi = pi + 1
-            pacc
+        if !str_eq(aff_ctx, "") {
+            state_set("soul_affective_context", aff_ctx)
+            println("[soul] cross-session affective context loaded (" + int_to_str(str_len(aff_ctx)) + " chars)")
         }
-        pacc
-    } else { aff_ctx }
-    if !str_eq(aff_ctx, "") {
-        state_set("soul_affective_context", aff_ctx)
-        println("[soul] affective context loaded (" + int_to_str(str_len(aff_ctx)) + " chars)")
     }
 }
 
@@ -277,8 +241,13 @@ fn seed_persona_from_env() -> Void {
         let h: Map = {}
         map_set(h, "Content-Type", "application/json")
         let resp: String = http_post_with_headers(engram_url + "/api/nodes", body, h)
-        if str_contains(resp, "\"error\"") {
+        // Check for empty response (timeout/network error), explicit error, or missing id.
+        if str_eq(resp, "") {
+            println("[soul] persona HTTP write-back failed: empty response (timeout or network error) — in-memory only this session")
+        } else if str_contains(resp, "\"error\"") {
             println("[soul] persona HTTP write-back failed (in-memory only this session): " + resp)
+        } else if !str_contains(resp, "\"id\"") {
+            println("[soul] persona HTTP write-back: unexpected response (no id field) — in-memory only this session: " + resp)
         } else {
             println("[soul] persona persisted to HTTP engram at " + engram_url)
         }
@@ -311,11 +280,14 @@ fn emit_session_start_event() -> Void {
         + ",\"ts\":" + int_to_str(ts) + "}"
 
     let tags: String = "[\"internal-state\",\"session-start\",\"InternalStateEvent\"]"
-    let discard: String = engram_node_full(
+    let session_event_id: String = engram_node_full(
         payload, "InternalStateEvent", "session-start",
         el_from_float(0.9), el_from_float(0.9), el_from_float(1.0),
         "Episodic", tags
     )
+    if str_eq(session_event_id, "") {
+        println("[soul] emit_session_start_event: engram write failed — session-start event lost")
+    }
     println("[soul] session-start event logged (boot=" + boot_num + " nodes=" + int_to_str(node_ct) + " edges=" + int_to_str(edge_ct) + ")")
 }
 
@@ -323,6 +295,9 @@ fn emit_session_start_event() -> Void {
 // L0 (core) → L1 (safety screen) → L2a (continuity + behavioral profiling) → L2b (mission alignment) → L3 (imprint) → L1 (safety validate)
 // Internal cognition (heartbeat, proactive, memory ops) bypasses layers — use one_cycle directly.
 fn layered_cycle(raw_input: String) -> String {
+    // conv_history key must match chat.el (conv_history, not conversation_history).
+    // Mismatch caused safety_score_distress_history() to always receive "" - the
+    // history-amplification path in safety_threat_score was permanently dead.
     let history: String = state_get("conv_history")
     let session_id: String = state_get("current_session_id")
 
@@ -330,8 +305,9 @@ fn layered_cycle(raw_input: String) -> String {
     let screen_result: String = safety_screen(raw_input, history)
     let screen_action: String = json_get(screen_result, "action")
 
-    // ISSUE 4: safe-mode guard. If safety_screen returned an invalid/empty action
-    // (engram failure or internal error), refuse rather than pass unscreened input.
+    // ISSUE 4: safe-mode guard -- if safety_screen returned invalid/empty action,
+    // refuse the turn rather than silently passing unscreened input to upper layers.
+    // Valid actions: "hard_bell", "soft_bell", "pass". Anything else = corrupt envelope.
     let valid_action: Bool = str_eq(screen_action, "hard_bell")
         || str_eq(screen_action, "soft_bell")
         || str_eq(screen_action, "pass")
@@ -346,8 +322,8 @@ fn layered_cycle(raw_input: String) -> String {
     // history where they could leak context to subsequent turns. They are persisted
     // separately by safety_log_bell() into the Episodic tier with restricted labels.
     //
-    // ISSUE 6: safety_log_bell already called inside safety_screen (line 140).
-    // Do NOT call it again here -- that would double-log every hard bell.
+    // ISSUE 6: safety_log_bell for hard bells is already called INSIDE safety_screen
+    // (safety.el line 140). Do NOT call it again here -- double-log avoided.
     //
     // safety_validate second param: when screen_action is "hard_bell", safety_validate
     // receives the sentinel string "hard_bell" (not a normal screen action). The safety
@@ -365,11 +341,8 @@ fn layered_cycle(raw_input: String) -> String {
     let cont_status: String = json_get(continuity, "status")
     let cont_action: String = json_get(continuity, "action")
 
-    // Store continuity status so imprint can adjust its response register.
-    // TODO(reliability #4): session_continuity is process-global; scope per session_id
-    // when available to prevent cross-session bleed under concurrent layered_cycle calls.
-    let cont_key: String = if str_eq(session_id, "") { "session_continuity" } else { "session_continuity:" + session_id }
-    state_set(cont_key, cont_status)
+    // Store continuity status so imprint can adjust its response register
+    state_set("session_continuity", cont_status)
 
     // Identity anomaly: add a gentle verification cue to the input before imprint
     let guided: String = if str_eq(cont_action, "identity_check") {
@@ -392,53 +365,14 @@ fn layered_cycle(raw_input: String) -> String {
         json_get(steward_result, "redirect_to")
     }
 
-    // L2c: affective context injection.
-    let lc_aff_cutoff: Int = time_now() - 259200
-    let lc_bell_nodes: String = engram_search_json("bell:soft bell:hard BellEvent affective", 2)
-    let lc_has_bell: Bool = !str_eq(lc_bell_nodes, "") && !str_eq(lc_bell_nodes, "[]")
-    let lc_bell_note: String = if lc_has_bell {
-        let lb0: String = json_array_get(lc_bell_nodes, 0)
-        let lb_c: String = json_get(lb0, "content")
-        let lbm: String = " | ts:"
-        let lbmp: Int = str_index_of(lb_c, lbm)
-        let lb_ts_raw: String = if lbmp >= 0 {
-            let lbs: Int = lbmp + str_len(lbm)
-            let lbr: String = str_slice(lb_c, lbs, str_len(lb_c))
-            let lbn: Int = str_index_of(lbr, " | ")
-            if lbn < 0 { lbr } else { str_slice(lbr, 0, lbn) }
-        } else {
-            let lbca: String = json_get(lb0, "created_at")
-            if str_eq(lbca, "") { json_get(lb0, "updated_at") } else { lbca }
-        }
-        let lb_ts: Int = if str_eq(lb_ts_raw, "") { 0 } else { str_to_int(lb_ts_raw) }
-        if lb_ts > lc_aff_cutoff { "[AFFECTIVE NOTE: User was in distress in a recent session.]" } else { "" }
-    } else { "" }
-    let lc_pos_nodes: String = engram_search_json("PositiveEvent joy:high joy:low affective", 2)
-    let lc_has_pos: Bool = !str_eq(lc_pos_nodes, "") && !str_eq(lc_pos_nodes, "[]")
-    let lc_pos_note: String = if lc_has_pos && str_eq(lc_bell_note, "") {
-        let lp0: String = json_array_get(lc_pos_nodes, 0)
-        let lp_c: String = json_get(lp0, "content")
-        let lpm: String = " | ts:"
-        let lpmp: Int = str_index_of(lp_c, lpm)
-        let lp_ts_raw: String = if lpmp >= 0 {
-            let lps: Int = lpmp + str_len(lpm)
-            let lpr: String = str_slice(lp_c, lps, str_len(lp_c))
-            let lpn: Int = str_index_of(lpr, " | ")
-            if lpn < 0 { lpr } else { str_slice(lpr, 0, lpn) }
-        } else {
-            let lpca: String = json_get(lp0, "created_at")
-            if str_eq(lpca, "") { json_get(lp0, "updated_at") } else { lpca }
-        }
-        let lp_ts: Int = if str_eq(lp_ts_raw, "") { 0 } else { str_to_int(lp_ts_raw) }
-        if lp_ts > lc_aff_cutoff { "[AFFECTIVE NOTE: User shared positive news in a recent session.]" } else { "" }
-    } else { "" }
-    let lc_affective_note: String = if !str_eq(lc_bell_note, "") { lc_bell_note } else { lc_pos_note }
-
-    // pre-LLM bell augmentation
+    // ISSUE 1: apply pre-LLM bell augmentation on layered_cycle path.
+    // safety_augment_system injects soft/hard directive into system prompt before LLM call.
+    // Stored in state so imprint_respond can consume it.
+    // TODO: wire directly into imprint_respond when it accepts a system_override param.
+    // ISSUE 3 TODO: no semantic/embedding crisis detection. Keyword-only means signals
+    // evading the phrase list pass through with zero augmentation. Semantic layer is a
+    // separate architectural decision requiring embedding inference on every message.
     let augmented_addendum: String = safety_augment_system("", raw_input)
-    let augmented_addendum = if str_eq(lc_affective_note, "") { augmented_addendum } else {
-        if str_eq(augmented_addendum, "") { lc_affective_note } else { lc_affective_note + "\n" + augmented_addendum }
-    }
     state_set("layered_cycle_safety_system_addendum", augmented_addendum)
 
     // L3: imprint responds
@@ -480,12 +414,29 @@ let snapshot_usable: Bool = local_node_count > 50
 
 if using_http_engram && !snapshot_usable {
     // First boot or empty/corrupt snapshot: seed from HTTP Engram.
+    // Retry up to 3 times (2s sleep between attempts) to guard against a
+    // transient network hiccup right after entrypoint.sh health check passes.
+    // An empty nodes response silently loads a zero-node graph; validate first.
+    // TODO(reliability): replace sleep_ms retry with non-blocking backoff.
     println("[soul] engram -> HTTP " + engram_url_raw + " (no local snapshot, first boot)")
-    let nodes_json: String = http_get(engram_url_raw + "/api/nodes?limit=10000")
-    let edges_json: String = http_get(engram_url_raw + "/api/edges")
-    let nodes_part: String = if str_eq(nodes_json, "") { "[]" } else { nodes_json }
-    let edges_part: String = if str_eq(edges_json, "") { "[]" } else { edges_json }
-    let snapshot_data: String = "{\"nodes\":" + nodes_part + ",\"edges\":" + edges_part + "}"
+    let fetch_attempt: Int = 0
+    while fetch_attempt < 3 {
+        let fetch_attempt = fetch_attempt + 1
+        let n: String = http_get(engram_url_raw + "/api/nodes?limit=10000")
+        let e: String = http_get(engram_url_raw + "/api/edges")
+        let nodes_ok: Bool = !str_eq(n, "") && str_starts_with(n, "[") && str_len(n) > 2
+        if nodes_ok {
+            state_set("_boot_nodes_json", n)
+            state_set("_boot_edges_json", e)
+            let fetch_attempt = 3
+        } else {
+            println("[soul] boot HTTP fetch attempt " + int_to_str(fetch_attempt) + " failed --- retrying in 2s")
+            sleep_ms(2000)
+        }
+    }
+    let nodes_json: String = state_get("_boot_nodes_json")
+    let edges_json: String = state_get("_boot_edges_json")
+        let snapshot_data: String = "{\"nodes\":" + nodes_part + ",\"edges\":" + edges_part + "}"
     let tmp_path: String = "/tmp/soul-engram-" + soul_cgi_id + ".json"
     fs_write(tmp_path, snapshot_data)
     engram_load(tmp_path)