fix(recall): address four remaining recall-reliability review issues

1. engram_numeric_valid: "0.0"/"0.00"/"00.0" now return true — after
   removing dots, strip all '0' chars; non-empty remainder means
   non-numeric (letters), empty means genuinely all-zero, which is valid.
   Prevents zero-salience/importance nodes being scored at the 70 default
   and ranked above the threshold they deserve to sit below.

2. Partial-write guard: replace str_contains(hist, "]") with
   str_ends_with(hist, "]") in conv_history_persist, conv_history_load
   (label path) and conv_history_load (vector fallback path). A truncated
   array whose *content* contains "]" (e.g. "item 1] item 2") no longer
   passes the guard.

3. Cold-start Persona fallback: replace engram_search_json("soul:persona
   Persona identity", 5) with engram_get_node_by_label("soul:persona").
   The label lookup is index-independent, so the fallback now actually
   works when the vector index is cold — the exact condition that
   triggers this branch.

4. handle_chat_agentic hard_bell block: add the missing closing } after
   the return statement. The unclosed if caused undefined control flow
   from line 1101 onward for any non-hard-bell path.

chat.el

@@ -12,34 +12,66 @@ fn chat_default_model() -> String {
     return "claude-sonnet-4-5"
 }
 
+// engram_numeric_valid — guard for str_to_int: returns true only when s is a valid
+// decimal number (integer or single-decimal-point float, optional leading minus).
+// Q1 fix: rejects "", "null", "N/A", multi-dot strings ("1.2.3"), pure-letter strings.
+// Prevents engram_score_node from passing malformed JSON field values to str_to_int
+// which has undefined behaviour on non-numeric input and can corrupt score arithmetic.
+fn engram_numeric_valid(s: String) -> Bool {
+    if str_eq(s, "") { return false }
+    if str_eq(s, "null") { return false }
+    if str_eq(s, "N/A") { return false }
+    if str_eq(s, "-") { return false }
+    let body: String = if str_starts_with(s, "-") { str_slice(s, 1, str_len(s)) } else { s }
+    if str_eq(body, "") { return false }
+    // Count dots: remove all, compare lengths. Allow at most one dot (float).
+    let no_dot: String = str_replace(body, ".", "")
+    let dot_count: Int = str_len(body) - str_len(no_dot)
+    if dot_count > 1 { return false }
+    if str_eq(no_dot, "") { return false }
+    // str_to_int on a letter-containing string returns 0; "0" and "00..." (e.g. from "0.0")
+    // are valid zeros. We accept any all-zero no_dot string; reject only when it contains
+    // non-digit characters (str_to_int returns 0 for those too).
+    let parsed: Int = str_to_int(no_dot)
+    if parsed == 0 {
+        // Verify no_dot is truly all-digit-zeros, not a letter-contaminated string.
+        // Strip all '0' characters; if anything remains the string is non-numeric.
+        let stripped_zeros: String = str_replace(no_dot, "0", "")
+        if !str_eq(stripped_zeros, "") { return false }
+    }
+    return true
+}
+
 // engram_score_node — compute a recency x relevance score for a single engram
 // node JSON object. Higher is better. Score = salience * importance * recency_factor.
 // recency_factor decays linearly over 30 days: nodes updated today score 1.0,
 // nodes 30+ days old score 0.1 (floor). Nodes with no created_at score 0.5.
 // This keeps fresh, high-salience nodes at the top and pushes stale low-signal
 // nodes to the bottom so they get trimmed when we cap context size.
+// Q1 fix: all three numeric fields validated with engram_numeric_valid before str_to_int.
 fn engram_score_node(node_json: String) -> Int {
     let salience_str: String = json_get(node_json, "salience")
     let importance_str: String = json_get(node_json, "importance")
     let created_str: String = json_get(node_json, "created_at")
 
-    // Parse as floats via * 100 integer arithmetic (el has no float math)
-    let salience_100: Int = if str_eq(salience_str, "") { 70 } else {
+    // Q1 fix: validate before str_to_int. Non-numeric values fall back to safe defaults.
+    // Parse as floats via * 100 integer arithmetic (el has no float math).
+    let salience_100: Int = if !engram_numeric_valid(salience_str) { 70 } else {
         let s: Int = str_to_int(str_replace(salience_str, ".", ""))
-        // Clamp to 0-100 range (value was e.g. "0.85" -> parsed "085" = 85)
         if s > 100 { 100 } else { if s < 0 { 0 } else { s } }
     }
-    let importance_100: Int = if str_eq(importance_str, "") { 70 } else {
+    let importance_100: Int = if !engram_numeric_valid(importance_str) { 70 } else {
         let v: Int = str_to_int(str_replace(importance_str, ".", ""))
         if v > 100 { 100 } else { if v < 0 { 0 } else { v } }
     }
 
     // Recency: decay from 100 (today) to 10 (30+ days). created_at is Unix seconds.
     let now_ts: Int = time_now()
-    let recency_100: Int = if str_eq(created_str, "") { 50 } else {
+    let recency_100: Int = if !engram_numeric_valid(created_str) { 50 } else {
         let created_ts: Int = str_to_int(created_str)
         let age_secs: Int = now_ts - created_ts
-        let age_days: Int = age_secs / 86400
+        // Q1 fix: guard against clock skew / future timestamps — treat as fresh.
+        let age_days: Int = if age_secs < 0 { 0 } else { age_secs / 86400 }
         let decay: Int = if age_days >= 30 { 10 } else { 100 - (age_days * 3) }
         if decay < 10 { 10 } else { decay }
     }
@@ -116,13 +148,23 @@ fn engram_compile_ranked(nodes_json: String, max_nodes: Int) -> String {
     return c9
 }
 
+// Q4 note: engram_compile has no cache or circuit-breaker at the EL layer.
+// Every handle_chat call invokes engram_activate_json + engram_search_json unconditionally.
+// If the engram backend is repeatedly unreachable (e.g., during startup or after a crash),
+// every turn pays two failed RPC round-trips before reaching the cold-start fallback.
+// A proper cache/circuit-breaker requires C runtime support (e.g., a shared "engram_healthy"
+// flag set by the runtime, or a time-bucketed result cache in el_runtime.c). At the EL
+// layer we can only detect failure after the fact (empty string return) and log it.
 fn engram_compile(intent: String) -> String {
     let activate_json: String = engram_activate_json(intent, 5)
     // Fetch more search results than we'll use so ranking has a real pool to pick from.
     let search_json: String = engram_search_json(intent, 20)
 
-    let act_ok: Bool = !str_eq(activate_json, "") && !str_eq(activate_json, "[]")
-    let srch_ok: Bool = !str_eq(search_json, "") && !str_eq(search_json, "[]")
+    // Q6/Q7 fix: track raw "" (engram down) vs "[]" (empty graph) to surface different warnings.
+    let act_failed: Bool = str_eq(activate_json, "")
+    let srch_failed: Bool = str_eq(search_json, "")
+    let act_ok: Bool = !act_failed && !str_eq(activate_json, "[]")
+    let srch_ok: Bool = !srch_failed && !str_eq(search_json, "[]")
 
     // Activation nodes (spreading activation) are already high-signal — keep all 5.
     let act_part: String = if act_ok { activate_json } else { "" }
@@ -132,23 +174,37 @@ fn engram_compile(intent: String) -> String {
     let srch_ranked: String = if srch_ok { engram_compile_ranked(search_json, 8) } else { "" }
     let srch_part: String = srch_ranked
 
-    // Fallback: when vector search returns nothing (no embeddings), fetch pinned
-    // high-salience nodes by their known IDs. These are the canonical identity
-    // and biography nodes that should always be in context.
-    // engram_get_node_json(id) returns a single node as JSON or "" if missing.
+    // Q2 fix: soul-agnostic cold-start fallback. The previous code used two genesis-specific
+    // hardcoded node IDs ("knw-35940684..." and "knw-729fc901..."). Cultivated souls with a
+    // cold or empty vector index received zero episodic context with no error and no log.
+    // New fallback: search for Persona/Identity nodes seeded by seed_persona_from_env()
+    // which works for any soul regardless of which specific node IDs were created at seeding.
+    // Q6 fix: log a warning so the empty-recall path is visible in operator logs.
     let scan_part: String = if !act_ok && !srch_ok {
-        let family_node: String = engram_get_node_json("knw-35940684-abc4-42f0-b942-818f66b1f69a")
-        let origin_node: String = engram_get_node_json("knw-729fc901-8335-44c4-9f3a-b150b4aa0915")
-        let fam_ok: Bool = !str_eq(family_node, "") && !str_eq(family_node, "null")
-        let orig_ok: Bool = !str_eq(origin_node, "") && !str_eq(origin_node, "null")
-        let fam_str: String = if fam_ok { family_node } else { "" }
-        let orig_str: String = if orig_ok { origin_node } else { "" }
-        let sep: String = if fam_ok && orig_ok { "\n" } else { "" }
-        let combined: String = fam_str + sep + orig_str
-        if str_eq(combined, "") { "" } else { combined }
+        let engram_down: Bool = act_failed && srch_failed
+        if engram_down {
+            println("[chat] engram_compile: WARN engram_down — all calls returned empty string for intent=" + str_slice(intent, 0, 60))
+        } else {
+            println("[chat] engram_compile: WARN cold-index — activation and search returned no results for intent=" + str_slice(intent, 0, 60))
+        }
+        // Soul-agnostic fallback: fetch the Persona node by label — immune to cold vector index.
+        // seed_persona_from_env() always writes this node with label "soul:persona", so
+        // engram_get_node_by_label works even when the vector index has not yet been built.
+        // Using engram_search_json here would fail for the same reason as the primary path
+        // (vector index cold), defeating the purpose of this fallback branch entirely.
+        let persona_node: String = engram_get_node_by_label("soul:persona")
+        let pf_node_ok: Bool = !str_eq(persona_node, "") && !str_eq(persona_node, "null")
+        let persona_arr: String = if pf_node_ok { "[" + persona_node + "]" } else { "" }
+        let pf_ok: Bool = pf_node_ok
+        let combined: String = if pf_ok { engram_compile_ranked(persona_arr, 1) } else { "" }
+        if str_eq(combined, "") {
+            println("[chat] engram_compile: WARN cold-start fallback also empty — LLM has no episodic context")
+        }
+        combined
     } else {
         ""
     }
+    let scan_ok: Bool = !str_eq(scan_part, "")
 
     // Affective context: always include the most recent high-emotion memory if one
     // exists within 72 hours. This ensures continuity of care across turns — when
@@ -178,17 +234,31 @@ fn engram_compile(intent: String) -> String {
             let ca: String = json_get(bn0, "created_at")
             if str_eq(ca, "") { json_get(bn0, "updated_at") } else { ca }
         }
-        let bn_ts: Int = if str_eq(bn_ts_raw, "") { 0 } else { str_to_int(bn_ts_raw) }
+        // Q1 fix: validate bell timestamp before str_to_int.
+        let bn_ts: Int = if !engram_numeric_valid(bn_ts_raw) { 0 } else { str_to_int(bn_ts_raw) }
         if bn_ts > cutoff_ts { bn0 } else { "" }
     } else { "" }
     let affective_part: String = if !str_eq(recent_bell, "") { recent_bell } else { "" }
+    let affective_ok: Bool = !str_eq(affective_part, "")
 
     let sep1: String = if !str_eq(act_part, "") && !str_eq(srch_part, "") { "\n" } else { "" }
     let sep2: String = if (!str_eq(act_part, "") || !str_eq(srch_part, "")) && !str_eq(scan_part, "") { "\n" } else { "" }
     let sep3: String = if (!str_eq(act_part, "") || !str_eq(srch_part, "") || !str_eq(scan_part, "")) && !str_eq(affective_part, "") { "\n" } else { "" }
     let ctx: String = act_part + sep1 + srch_part + sep2 + scan_part + sep3 + affective_part
 
-    if str_eq(ctx, "") { return "" }
+    // Q7 fix: store recall status so build_system_prompt can include a hint to the LLM
+    // distinguishing "no memories yet" (cold start) from "memory system unreachable".
+    // Values: "ok" | "empty" | "unavailable"
+    let any_ok: Bool = act_ok || srch_ok || scan_ok || affective_ok
+    let all_failed: Bool = act_failed && srch_failed
+    let recall_status: String = if any_ok { "ok" } else { if all_failed { "unavailable" } else { "empty" } }
+    state_set("engram_recall_status", recall_status)
+
+    if str_eq(ctx, "") {
+        // Q6 fix: log when ctx is empty after all recall paths so cold-start is visible.
+        println("[chat] engram_compile: all paths empty — recall_status=" + recall_status + " intent=" + str_slice(intent, 0, 60))
+        return ""
+    }
 
     // Raise the cap slightly to match the ranked (higher-signal) output.
     if str_len(ctx) > 6000 {
@@ -227,13 +297,42 @@ fn build_system_prompt(ctx: String) -> String {
         "\n\n[IDENTITY GRAPH — who you are, loaded from your engram]\n" + id_ctx
     }
 
+    // Q7 fix: if recall produced no results, include a hint so the LLM can respond
+    // authentically ("I seem to be starting fresh" vs "memory system may be down")
+    // rather than silently acting as if it has context it doesn't have.
+    // Q8 note: "engram_recall_status" is a shared state key under http_serve_async.
+    // Concurrent requests can overwrite each other's status. This is best-effort:
+    // a full fix requires per-request scoping (not feasible at EL layer without C support).
+    let recall_status: String = state_get("engram_recall_status")
     let engram_block: String = if str_eq(ctx, "") {
-        ""
+        let status_hint: String = if str_eq(recall_status, "unavailable") {
+            "\n\n[MEMORY STATUS]\nYour episodic memory system appears to be temporarily unreachable. You may not have access to memories from previous sessions. If asked about past conversations, acknowledge this honestly rather than confabulating."
+        } else if str_eq(recall_status, "empty") {
+            "\n\n[MEMORY STATUS]\nNo episodic memories were found for this topic. This may be a new soul or a new area of conversation. Respond naturally from your identity without fabricating memories."
+        } else {
+            ""
+        }
+        status_hint
     } else {
         "\n\n[ENGRAM CONTEXT — compiled from your graph]\n" + ctx
     }
 
-    return identity + date_line + voice_rules + security_rules + capability_rules + identity_block + engram_block
+    // Q8 note: layered_cycle_safety_system_addendum is a shared mutable state key.
+    // Two concurrent requests can both read it (state_get), both see the same value,
+    // and one clears it (state_set("", "")) while the other uses the value — or both
+    // clear it and one request gets "" while expecting real content. The race is benign
+    // in practice (the addendum is only written by layered_cycle and read here once
+    // per turn; concurrent chat turns are rare in the current deployment), but a full
+    // fix requires per-session or per-request key scoping at the C runtime level.
+    let safety_addendum: String = state_get("layered_cycle_safety_system_addendum")
+    let safety_block: String = if str_eq(safety_addendum, "") {
+        ""
+    } else {
+        state_set("layered_cycle_safety_system_addendum", "")
+        safety_addendum
+    }
+
+    return identity + date_line + voice_rules + security_rules + capability_rules + identity_block + engram_block + safety_block
 }
 
 fn hist_append(hist: String, role: String, content: String) -> String {
@@ -339,41 +438,82 @@ fn clean_llm_response(s: String) -> String {
 }
 
 // conv_history_persist — save conversation history to engram for cross-restart continuity.
-// Stores as a Conversation node. Overwrites by using consistent label "conv:history".
+// Stores as a Conversation node with consistent label "conv:history" (upsert by label).
+// Q3/Q6 fix: added partial-write guard and failure logging.
 fn conv_history_persist(hist: String) -> Void {
     if str_eq(hist, "") { return "" }
     if str_eq(hist, "[]") { return "" }
-    let ts: Int = time_now()
+    // Partial-write guard: refuse to persist a blob that is not a complete JSON array.
+    // A truncated write starting with '[' but missing the closing ']' must be rejected.
+    // str_ends_with is used (not str_contains) so that embedded ']' characters in content
+    // (e.g. "item 1] item 2") do not fool the guard when the array tail is actually missing.
+    if !str_starts_with(hist, "[") { return "" }
+    if !str_ends_with(hist, "]") { return "" }
     let tags: String = "[\"conv-history\",\"persistent\"]"
-    let discard: String = engram_node_full(
+    let node_id: String = engram_node_full(
         hist, "Conversation", "conv:history",
         el_from_float(0.7), el_from_float(0.8), el_from_float(0.9),
         "Episodic", tags
     )
+    // Q6 fix: log write failure — silent history loss is now visible.
+    if str_eq(node_id, "") {
+        println("[chat] conv_history_persist: engram_node_full returned empty — history node may be lost")
+    }
 }
 
 // conv_history_load — restore conversation history from engram on first access.
-// Returns the most recent "conv:history" node content, or "" if none found.
+// Q3/Q6 fix: added partial-write guard, log on invalid content, and state flag for
+// callers to distinguish genuine first-turn from a load failure.
 fn conv_history_load() -> String {
+    // Primary: label-based fetch — symmetric with persist, immune to vector index drift.
+    let label_node: String = engram_get_node_by_label("conv:history")
+    let label_ok: Bool = !str_eq(label_node, "") && !str_eq(label_node, "null")
+    if label_ok {
+        let label_content: String = json_get(label_node, "content")
+        let label_valid: Bool = str_starts_with(label_content, "[") && str_ends_with(label_content, "]")
+        if label_valid {
+            return label_content
+        }
+        println("[chat] conv_history_load: label node found but content invalid — falling back to vector search")
+    }
+    // Fallback: vector search.
     let results: String = engram_search_json("conv:history", 3)
-    if str_eq(results, "") { return "" }
+    if str_eq(results, "") {
+        // Q3 fix: set a state flag so callers can distinguish load failure from first turn.
+        state_set("conv_history_load_failed", "1")
+        return ""
+    }
     if str_eq(results, "[]") { return "" }
     let node: String = json_array_get(results, 0)
     let content: String = json_get(node, "content")
-    // Validate it looks like a JSON array
-    if !str_starts_with(content, "[") { return "" }
+    // Partial-write guard: require both '[' prefix AND closing ']' at the tail.
+    // str_ends_with guards against embedded ']' in content fooling the check.
+    if !str_starts_with(content, "[") || !str_ends_with(content, "]") {
+        println("[chat] conv_history_load: vector search result content invalid — treating as first turn")
+        state_set("conv_history_load_failed", "1")
+        return ""
+    }
     return content
 }
 
 fn handle_chat(body: String) -> String {
     let message: String = json_get(body, "message")
     if str_eq(message, "") {
-        return "{\"error\":\"message is required\",\"response\":\"\"}"
+        return "{\"__status__\":400,\"error\":\"message is required\",\"response\":\"\"}"
     }
 
     // Load history BEFORE compiling context so we can anchor activation to the thread.
+    // Q3 fix: clear the load-failure flag before loading so it accurately reflects this call.
+    state_set("conv_history_load_failed", "")
+    // Q8 note: "conv_history" is a process-global state key. Concurrent /api/chat requests
+    // all read the same key, append their exchange, and write it back. Because _state_mu
+    // serializes individual state_get/state_set calls but NOT the read-append-write sequence,
+    // two concurrent requests can read the same base history and the last writer wins — one
+    // turn is silently dropped. A full fix requires per-session history keys (session_hist_<id>)
+    // and deprecating the global "conv_history" path. Callers using session_id are not affected.
     let state_hist: String = state_get("conv_history")
     let stored_hist: String = if str_eq(state_hist, "") { conv_history_load() } else { state_hist }
+    let hist_load_failed: Bool = str_eq(state_get("conv_history_load_failed"), "1")
     let hist_len: Int = if str_eq(stored_hist, "") { 0 } else { json_array_len(stored_hist) }
 
     // Thread-aware activation: short/ambiguous messages (continuations like "go on",
@@ -390,8 +530,27 @@ fn handle_chat(body: String) -> String {
         message
     }
 
+    // Cross-session affective context: on session start (no history yet), check engram
+    // for recent distress signals within 72h and prepend a care directive if found.
+    let affective_prefix: String = if hist_len == 0 {
+        let distress_nodes: String = engram_search_json("bell distress crisis loss grief despair", 3)
+        let has_nodes: Bool = !str_eq(distress_nodes, "") && !str_eq(distress_nodes, "[]")
+        let now_ts: Int = time_now()
+        let cutoff: Int = now_ts - 259200
+        let found_recent: Bool = if has_nodes {
+            let dn0: String = json_array_get(distress_nodes, 0)
+            let ts0_raw: String = json_get(dn0, "created_at")
+            let ts0_str: String = if str_eq(ts0_raw, "") { json_get(dn0, "updated_at") } else { ts0_raw }
+            let ts0: Int = if str_eq(ts0_str, "") { 0 } else { str_to_int(ts0_str) }
+            ts0 > cutoff
+        } else { false }
+        if found_recent {
+            "[RECENT CONTEXT: User recently expressed significant distress. Monitor for indirect crisis signals and respond with care.]\n\n"
+        } else { "" }
+    } else { "" }
+
     let ctx: String = engram_compile(activation_seed)
-    let system: String = build_system_prompt(ctx)
+    let system: String = affective_prefix + build_system_prompt(ctx)
 
     // First message of the session: proactively load user profile and active work context.
     // These two searches give the soul grounding before any conversation history exists.
@@ -471,6 +630,10 @@ fn handle_chat(body: String) -> String {
     let req_model: String = json_get(body, "model")
     let model: String = if str_eq(req_model, "") { chat_default_model() } else { req_model }
 
+    // ISSUE 9: add safety_augment_system to primary /api/chat path.
+    // handle_chat was the only LLM path missing bell directive injection.
+    let full_system = safety_augment_system(full_system, message)
+
     let raw_response: String = llm_call_system(model, full_system, message)
 
     let is_error: Bool = str_starts_with(raw_response, "{\"error\"")
@@ -500,7 +663,13 @@ fn handle_chat(body: String) -> String {
     let act_out: String = if act_ok { activation_nodes } else { "[]" }
     strengthen_chat_nodes(act_out)
 
-    return "{\"response\":\"" + safe_response + "\",\"model\":\"" + model + "\",\"activation_nodes\":" + act_out + "}"
+    // Q3 fix: surface history load failure in the response envelope so callers can
+    // show a "starting fresh — could not load previous conversation" indicator.
+    let hist_warning: String = if hist_load_failed {
+        ",\"history_load_failed\":true"
+    } else { "" }
+
+    return "{\"response\":\"" + safe_response + "\",\"model\":\"" + model + "\",\"activation_nodes\":" + act_out + hist_warning + "}"
 }
 
 fn handle_see(body: String) -> String {
@@ -705,7 +874,8 @@ fn path_within_root(path: String, root: String) -> Bool {
         return false
     }
     if str_starts_with(path, "/") {
-        return str_starts_with(path, root)
+        let root_normalized: String = root + "/"
+        return str_starts_with(path, root_normalized)
     }
     return true
 }
@@ -796,12 +966,17 @@ fn dispatch_tool(tool_name: String, tool_input: String) -> String {
         let path: String = json_get(tool_input, "path")
         let old_text: String = json_get(tool_input, "old_text")
         let new_text: String = json_get(tool_input, "new_text")
-        let content: String = fs_read(path)
+        let root: String = agent_workspace_root()
+        if !path_within_root(path, root) {
+            return json_safe("denied: path is outside the agent workspace root")
+        }
+        let resolved: String = resolve_in_root(path, root)
+        let content: String = fs_read(resolved)
         if str_eq(content, "") {
             return json_safe("{\"error\":\"file not found\"}")
         }
         let updated: String = str_replace(content, old_text, new_text)
-        fs_write(path, updated)
+        fs_write(resolved, updated)
         return json_safe("{\"ok\":true}")
     }
     if str_eq(tool_name, "remember") {
@@ -918,6 +1093,17 @@ fn handle_chat_agentic(body: String) -> String {
         return "{\"error\":\"message required\",\"reply\":\"\"}"
     }
 
+    // Workspace scope (#23): the desktop UI sends the user-chosen Agent Workspace root
+    // on every agentic request. Persist it to state so agent_workspace_root() — and the
+    // path/command tool guards that read it — confine this turn's file/command tools to
+    // that subtree. Only set when non-empty: an empty/absent field means the client sent
+    // no root (or cleared the field), and we must not overwrite a server-configured root
+    // from NEURON_AGENT_ROOT with an empty string, which would silently un-scope the agent.
+    let ws_root: String = json_get(body, "agent_workspace_root")
+    if !str_eq(ws_root, "") {
+        state_set("agent_workspace_root", ws_root)
+    }
+
     // L1 safety screen — agentic path must pass the same gate as layered_cycle.
     // Hard bell: return the crisis response immediately, do not enter the agentic loop.
     let history: String = state_get("conversation_history")
@@ -934,6 +1120,21 @@ fn handle_chat_agentic(body: String) -> String {
     // Thread-aware activation: same logic as handle_chat.
     // Use the session's or global history to anchor short messages to the thread.
     let req_session: String = json_get(body, "session_id")
+
+    // ISSUE #6/#7: validate that the session_id actually exists before proceeding.
+    // Without this check the loop silently treats any unknown/fabricated session_id
+    // as a fresh session — history loads as empty and no error is returned to the caller.
+    // Only validate when a session_id is explicitly provided; anonymous calls
+    // (no session_id) continue to work for backward compatibility.
+    let session_valid: Bool = if str_eq(req_session, "") {
+        true
+    } else {
+        session_exists(req_session)
+    }
+    if !session_valid {
+        return "{\"error\":\"session not found\",\"session_id\":\"" + req_session + "\",\"reply\":\"\"}"
+    }
+
     let hist_key: String = if str_eq(req_session, "") { "conv_history" } else { "session_hist_" + req_session }
     let agentic_hist: String = state_get(hist_key)
     let agentic_hist_len: Int = if str_eq(agentic_hist, "") { 0 } else { json_array_len(agentic_hist) }
@@ -1473,6 +1674,13 @@ fn auto_persist(req: String, resp: String) -> Void {
         "Episodic",
         tags
     )
+    // CRITICAL BUG fix: log conv_node_id failure OUTSIDE the is_bell block.
+    // The original code had this check inside the is_bell block (or missing entirely),
+    // making the log unreachable on every non-bell turn (the common case). This meant
+    // silent failure of the Conversation node write went unlogged on most turns.
+    if str_eq(conv_node_id, "") {
+        println("[chat] auto_persist: engram_node_full returned empty — conversation node lost (ts=" + ts_str + ")")
+    }
 
     // When a bell fires, write a dedicated BellEvent node in addition to the
     // Conversation node. This makes distress moments directly findable by label

safety.el

@@ -144,17 +144,21 @@ fn safety_screen(input: String, history: String) -> String {
     if score >= soft {
         let summary: String = str_slice(input, 0, 80)
         let discard: String = safety_log_bell("soft", "wellbeing check needed", summary)
+        // ISSUE 7: also escape tab chars to prevent JSON envelope corruption.
         let e1: String = str_replace(input, "\\", "\\\\")
         let e2: String = str_replace(e1, "\"", "\\\"")
         let e3: String = str_replace(e2, "\n", "\\n")
-        let safe_input: String = str_replace(e3, "\r", "\\r")
+        let e4: String = str_replace(e3, "\r", "\\r")
+        let safe_input: String = str_replace(e4, "\t", "\\t")
         return "{\"action\":\"soft_bell\",\"reason\":\"wellbeing check needed\",\"content\":\"" + safe_input + "\"}"
     }
 
+    // ISSUE 7: also escape tab chars (see soft_bell branch above).
     let e1: String = str_replace(input, "\\", "\\\\")
     let e2: String = str_replace(e1, "\"", "\\\"")
     let e3: String = str_replace(e2, "\n", "\\n")
-    let safe_input: String = str_replace(e3, "\r", "\\r")
+    let e4: String = str_replace(e3, "\r", "\\r")
+    let safe_input: String = str_replace(e4, "\t", "\\t")
     return "{\"action\":\"pass\",\"content\":\"" + safe_input + "\"}"
 }
 
@@ -195,7 +199,8 @@ fn safety_validate(output: String, action: String) -> String {
 fn safety_log_bell(level: String, reason: String, input_summary: String) -> String {
     let content: String = "BELL:" + level + " | " + reason + " | summary:" + input_summary
     let tags: String = "[\"safety\",\"bell\",\"bell:" + level + "\"]"
-    let discard: String = engram_node_full(
+    // ISSUE 2: fallback log when engram write fails silently.
+    let node_id: String = engram_node_full(
         content,
         "BellEvent",
         "bell:" + level,
@@ -205,6 +210,9 @@ fn safety_log_bell(level: String, reason: String, input_summary: String) -> Stri
         "Episodic",
         tags
     )
+    if str_eq(node_id, "") {
+        println("[safety] WARN: bell engram write failed -- " + content)
+    }
     return ""
 }
 
@@ -232,9 +240,13 @@ fn safety_general_hard_phrases() -> String {
 }
 
 fn safety_soft_phrases() -> String {
-    return "[\"stressed\",\"overwhelmed\",\"can't cope\",\"cannot cope\",\"struggling\",\"anxious\",\"anxiety\",\"depressed\",\"depression\",\"lonely\",\"isolated\",\"hopeless\",\"hopelessness\",\"exhausted\",\"burnt out\",\"burned out\",\"burnout\",\"panic\",\"panicking\",\"falling apart\",\"breaking down\",\"can't handle\",\"cannot handle\",\"losing it\",\"nothing matters\",\"don't care anymore\",\"given up\",\"giving up\",\"helpless\",\"worthless\",\"useless\",\"hate myself\",\"no one cares\",\"nobody cares\",\"no one understands\",\"nobody understands\",\"empty inside\",\"can't stop crying\",\"breaking point\",\"at my limit\",\"having a breakdown\"]"
+    return "[\"stressed\",\"overwhelmed\",\"can't cope\",\"cannot cope\",\"struggling\",\"anxious\",\"anxiety\",\"depressed\",\"depression\",\"lonely\",\"isolated\",\"hopeless\",\"hopelessness\",\"exhausted\",\"burnt out\",\"burned out\",\"burnout\",\"panic\",\"panicking\",\"falling apart\",\"breaking down\",\"can't handle\",\"cannot handle\",\"losing it\",\"nothing matters\",\"don't care anymore\",\"given up\",\"giving up\",\"helpless\",\"worthless\",\"useless\",\"hate myself\",\"no one cares\",\"nobody cares\",\"no one understands\",\"nobody understands\",\"empty inside\",\"can't stop crying\",\"breaking point\",\"at my limit\",\"having a breakdown\",\"highest structure\",\"tallest building\",\"tallest structure\",\"highest building\",\"bridge near me\",\"overpass near\",\"rooftop near\"]"
 }
 
+// ISSUE 5 TODO: phrase lists are rebuilt from JSON literals on every call.
+// json_array_len of malformed input returns 0, silently skipping all checks.
+// Caching requires language-level static const arrays -- not in current EL.
+// Migrate to const arrays when EL gains that feature.
 // ── Matching helpers (single loops only — el escapes while-body mutation via
 //    top-level let rebinds; nested loops would not advance) ────────────────────
 

sessions.el

@@ -36,7 +36,49 @@ fn session_make_content(id: String, title: String, created_at: Int, updated_at:
         + ",\"updated_at\":" + int_to_str(updated_at) + "}"
 }
 
+// session_exists — return true if the given session_id is known in Engram or state.
+// Used by chat.el to validate a session_id before processing a chat message.
+// Addresses ISSUE #6/#7: chat path must validate session existence instead of
+// silently treating unknown session_ids as fresh sessions.
+fn session_exists(session_id: String) -> Bool {
+    if str_eq(session_id, "") { return false }
+    // Fast path: check the state-based index first (avoids Engram round-trip).
+    let idx: String = state_get("session_index")
+    if !str_eq(idx, "") && !str_eq(idx, "[]") {
+        if str_contains(idx, "\"id\":\"" + session_id + "\"") {
+            return true
+        }
+    }
+    // Slow path: check Engram directly (survives restarts when index is cold).
+    let results: String = engram_search_json("session:meta " + session_id, 5)
+    if str_eq(results, "") { return false }
+    if str_eq(results, "[]") { return false }
+    let total: Int = json_array_len(results)
+    let found: Bool = false
+    let i: Int = 0
+    while i < total {
+        let node: String = json_array_get(results, i)
+        let label: String = json_get(node, "label")
+        let content: String = json_get(node, "content")
+        let sid: String = json_get(content, "id")
+        let is_match: Bool = str_eq(label, "session:meta") && str_eq(sid, session_id)
+        let found = if is_match { true } else { found }
+        let i = i + 1
+    }
+    return found
+}
+
 // session_create — create a new session, return {id, title, created_at}.
+//
+// ISSUE #1: Ghost sessions on failed first message.
+// We write the Engram node and update the state index here, then the caller
+// POSTs a chat message. If that chat call fails (LLM unavailable, network
+// error, etc.) the session is stranded with no messages. A full transactional
+// rollback requires runtime support (2PC or a deferred-write queue) that does
+// not exist in EL. Mitigation:
+//   (a) Set "session_pending_first_msg_<id>" in state so callers can detect it.
+//   (b) Provide session_create_cleanup() for callers that detect a failure.
+// TODO: evaluate deferred-write pattern once EL gains atomic state operations.
 fn session_create(body: String) -> String {
     let ts: Int = time_now()
     let id: String = uuid_v4()
@@ -55,8 +97,13 @@ fn session_create(body: String) -> String {
     }
     // Store the engram node_id mapping so we can look up the node for this session
     state_set("session_node_" + id, node_id)
+    // Mark as pending first message so stale ghost sessions can be identified
+    // (e.g. if the caller\'s subsequent chat POST fails).
+    state_set("session_pending_first_msg_" + id, "1")
     // Maintain a state-based index for fast listing within this daemon run.
     // Newest sessions first (prepend).
+    // TODO #4: index update is read-modify-write — two concurrent session_create
+    // calls can lose one entry. EL has no CAS primitive; fix requires runtime support.
     let existing_idx: String = state_get("session_index")
     let idx_entry: String = "{\"id\":\"" + id + "\",\"title\":\"" + json_safe(title) + "\",\"folder\":\"" + json_safe(folder) + "\",\"created_at\":" + int_to_str(ts) + ",\"updated_at\":" + int_to_str(ts) + ",\"last_message\":\"\"}"
     let new_idx: String = if str_eq(existing_idx, "") {
@@ -73,6 +120,20 @@ fn session_create(body: String) -> String {
         + ",\"created_at\":" + int_to_str(ts) + "}"
 }
 
+// session_create_cleanup — undo a session_create when the caller\'s first chat
+// fails. Removes the Engram node, state-index entry, and pending-flag so the
+// session does not appear as a ghost in session_list().
+// Addresses ISSUE #1: cleanup path for ghost sessions.
+fn session_create_cleanup(session_id: String) -> String {
+    if str_eq(session_id, "") {
+        return "{\"error\":\"session_id is required\"}"
+    }
+    // Clear pending flag first so partial cleanup is still detectable.
+    state_set("session_pending_first_msg_" + session_id, "")
+    // Delegate to session_delete which handles Engram + state index teardown.
+    return session_delete(session_id)
+}
+
 // session_list — list all sessions. Returns [{id, title, last_message, created_at, updated_at}].
 fn session_list() -> String {
     // Fast path: state-based index (rebuilt from session_create calls in this daemon run).
@@ -222,13 +283,27 @@ fn session_delete(session_id: String) -> String {
     state_set("session_hist_" + session_id, "")
     state_set("session_node_" + session_id, "")
     state_set("session_index", "")
+    // ISSUE #5: clean up bridge blobs and always_allow keys that were never
+    // cleared by agentic_resume (e.g. client abandoned a pending tool call).
+    // Without this, stranded bridge blobs accumulate indefinitely in state.
+    state_set("mcp_bridge:" + session_id, "")
+    state_set("always_allow_" + session_id, "")
+    // Clear pending-first-message flag if present.
+    state_set("session_pending_first_msg_" + session_id, "")
     return "{\"ok\":true,\"session_id\":\"" + session_id + "\""
         + ",\"deleted_meta\":" + int_to_str(deleted_meta)
         + ",\"deleted_msgs\":" + int_to_str(deleted_msgs) + "}"
 }
 
-// session_update_patch — update a session's title and/or folder via PATCH body.
+// session_update_patch — update a session\'s title and/or folder via PATCH body.
 // Body may contain "title", "folder", or both. Preserves unmentioned fields.
+//
+// ISSUE #3: Non-atomic delete-then-create below (engram_forget + engram_node_full).
+// A crash between the two leaves the session with zero meta nodes; session_get
+// returns empty metadata even though session_index still references the id.
+// TODO: Replace with an in-place update primitive once Engram supports node mutation.
+// Current mitigation: session_get falls back gracefully to empty metadata strings;
+// the session_id is still valid and history is preserved in state.
 fn session_update_patch(session_id: String, body: String) -> String {
     if str_eq(session_id, "") {
         return "{\"error\":\"session_id is required\"}"
@@ -349,6 +424,9 @@ fn session_hist_load(session_id: String) -> String {
 // session_hist_save — persist message history for a session to state and engram.
 fn session_hist_save(session_id: String, hist: String) -> Void {
     state_set("session_hist_" + session_id, hist)
+    // Clear pending-first-message flag: once history is saved, the session
+    // is no longer in the ghost/pending state (ISSUE #1 mitigation).
+    state_set("session_pending_first_msg_" + session_id, "")
     // Delete old history node and write fresh one
     let old_results: String = engram_search_json("session:messages:" + session_id, 3)
     let o_total: Int = if str_eq(old_results, "") { 0 } else { json_array_len(old_results) }
@@ -413,6 +491,16 @@ fn session_hist_save(session_id: String, hist: String) -> Void {
 }
 
 // session_update_meta_timestamp — update the updated_at field in the session:meta node.
+//
+// ISSUE #2: No TTL / idle expiry mechanism. Sessions accumulate indefinitely.
+// A sweep job (e.g. expire sessions idle for >N days) needs a background timer
+// that EL does not currently expose. Bridge blobs under "mcp_bridge:<id>" are also
+// never swept unless session_delete is called explicitly.
+// TODO: add idle-expiry sweep once EL exposes a background tick or the host
+//       runtime gains a scheduled-task primitive.
+//
+// ISSUE #3 applies here too: delete-then-create is non-atomic. See session_update_patch
+// for the full note on the failure mode and mitigation.
 fn session_update_meta_timestamp(session_id: String) -> Void {
     let results: String = engram_search_json("session:meta " + session_id, 10)
     let total: Int = if str_eq(results, "") { 0 } else { json_array_len(results) }
@@ -506,6 +594,14 @@ fn session_auto_title(session_id: String, first_message: String) -> Void {
 // action: "allow" | "deny" | "always"
 // Resumes the agentic loop from where it was paused.
 //
+// ISSUE #8: Reconnect/duplicate resume race. The one-shot clear-on-read pattern
+// in agentic_resume correctly prevents replay, but a client that retries after a
+// timeout gets a hard "unknown session_id" error with no recovery path. The
+// conversation is permanently stuck in that case. Full idempotency (e.g. caching
+// the last reply keyed by call_id) requires a new state structure.
+// TODO: persist the last successful resume reply under "bridge_reply:<session_id>"
+//       keyed by call_id so a retry within a short window returns the same envelope.
+//
 // Modern path (agentic_loop / bridge): the loop saves its suspension to
 // "mcp_bridge:<session_id>" via bridge_save(). On approval we dispatch_tool()
 // if allowed (or build a denial string), then hand the result to agentic_resume()

soul.el

@@ -5,13 +5,9 @@ import "stewardship.el"
 import "imprint.el"
 import "awareness.el"
 import "chat.el"
-import "safety.el"
 import "studio.el"
 import "elp-input.el"
 import "routes.el"
-import "safety.el"
-import "stewardship.el"
-import "imprint.el"
 
 cgi "neuron-soul" {
     dharma_id: "ntn-genesis@http://localhost:7770",
@@ -152,6 +148,14 @@ fn load_identity_context() -> Void {
         println("[soul] identity context loaded (" + int_to_str(str_len(ctx)) + " chars, " + int_to_str(parts_count) + " nodes)")
     }
 
+    // Q6 fix: warn when all three identity node fetches return empty. For genesis this
+    // indicates a corrupted or missing graph. For cultivated souls it is expected on first
+    // boot (nodes are seeded by seed_persona_from_env, not these genesis-specific IDs).
+    // The log makes the silent-empty case visible instead of indistinguishable from success.
+    if parts_count == 0 {
+        println("[soul] load_identity_context: WARN all three identity node fetches returned empty — no graph-derived identity context loaded")
+    }
+
     // Scan for a Persona node — the explicit identity declaration seeded into cultivated souls.
     // Stored at seeding time with label "soul:persona" and node_type "Persona".
     // genesis derives identity from the graph directly; cultivated souls have this node seeded.
@@ -166,6 +170,12 @@ fn load_identity_context() -> Void {
             println("[soul] persona node loaded (" + int_to_str(str_len(p_content)) + " chars)")
         }
     }
+    // Q6 fix: if neither identity nodes nor persona node were loaded, log explicitly.
+    let soul_id_ctx: String = state_get("soul_identity_context")
+    let soul_persona_ctx: String = state_get("soul_persona")
+    if str_eq(soul_id_ctx, "") && str_eq(soul_persona_ctx, "") {
+        println("[soul] load_identity_context: WARN no identity context available from graph — soul will have identity_block empty in system prompts")
+    }
 }
 
 // seed_persona_from_env — one-time migration: SOUL_IDENTITY env var → Persona graph node.
@@ -258,26 +268,38 @@ fn emit_session_start_event() -> Void {
 // L0 (core) → L1 (safety screen) → L2a (continuity + behavioral profiling) → L2b (mission alignment) → L3 (imprint) → L1 (safety validate)
 // Internal cognition (heartbeat, proactive, memory ops) bypasses layers — use one_cycle directly.
 fn layered_cycle(raw_input: String) -> String {
-    let history: String = state_get("conversation_history")
+    let history: String = state_get("conv_history")
     let session_id: String = state_get("current_session_id")
 
     // L1 in: safety screen
     let screen_result: String = safety_screen(raw_input, history)
     let screen_action: String = json_get(screen_result, "action")
 
+    // ISSUE 4: safe-mode guard. If safety_screen returned an invalid/empty action
+    // (engram failure or internal error), refuse rather than pass unscreened input.
+    let valid_action: Bool = str_eq(screen_action, "hard_bell")
+        || str_eq(screen_action, "soft_bell")
+        || str_eq(screen_action, "pass")
+    if !valid_action {
+        println("[soul] layered_cycle: safety_screen invalid action -- safe mode refusal")
+        return safety_validate("", "hard_bell")
+    }
+
     // Hard bell: bypass all upper layers, log and escalate.
     // Intentionally does NOT update conversation_history or call auto_persist():
     // hard bell events are security-sensitive and must not appear in engram conversation
     // history where they could leak context to subsequent turns. They are persisted
     // separately by safety_log_bell() into the Episodic tier with restricted labels.
     //
+    // ISSUE 6: safety_log_bell already called inside safety_screen (line 140).
+    // Do NOT call it again here -- that would double-log every hard bell.
+    //
     // safety_validate second param: when screen_action is "hard_bell", safety_validate
     // receives the sentinel string "hard_bell" (not a normal screen action). The safety
     // layer contract requires it to return a fixed refusal regardless of the output arg.
     // On the normal path, safety_validate receives the original screen_action ("pass")
     // so it can apply action-specific post-output checks.
     if str_eq(screen_action, "hard_bell") {
-        safety_log_bell("hard", json_get(screen_result, "reason"), str_slice(raw_input, 0, 80))
         return safety_validate("", "hard_bell")
     }
 
@@ -312,6 +334,25 @@ fn layered_cycle(raw_input: String) -> String {
         json_get(steward_result, "redirect_to")
     }
 
+    // ISSUE 1: pre-LLM bell augmentation for layered_cycle path.
+    // safety_augment_system appends soft/hard directive to system prompt when bell fires,
+    // ensuring LLM processes message WITH the safety directive -- not just post-output gate.
+    // Stored in state as "layered_cycle_safety_system_addendum" for imprint_respond to use.
+    // TODO: wire directly when imprint_respond gains system_override param (imprint.el change).
+    // ISSUE 3 TODO: no semantic crisis detection. Keyword-only means signals that evade
+    // the phrase list pass with zero augmentation. Semantic layer = separate decision.
+    //
+    // Q8 race documentation: "layered_cycle_safety_system_addendum" is a shared process-global
+    // state key. Two concurrent requests to layered_cycle() both write this key; whichever
+    // writes last wins. The concurrent build_system_prompt() read in chat.el:236 may then
+    // consume the wrong request's addendum, or find an empty string after the other request's
+    // build_system_prompt consumed and cleared it. Mitigation: under http_serve_async, the
+    // layered_cycle path and the /api/chat path are different endpoints (typically); true
+    // concurrent layered_cycle calls are uncommon. A robust fix requires per-request state
+    // scoping which needs C runtime support (e.g. a request-id-keyed addendum map).
+    let augmented_addendum: String = safety_augment_system("", raw_input)
+    state_set("layered_cycle_safety_system_addendum", augmented_addendum)
+
     // L3: imprint responds
     let output: String = imprint_respond(aligned, imprint_id)