fix(chat): agent write_file/edit_file no longer return false success receipts (BUG-29)

Root cause: dispatch_tool's write_file returned {"ok":true} without checking
fs_write's result, and edit_file returned ok:true even when old_text was absent
(str_replace silently no-ops) and its fs_write was also unchecked. Any failed
or no-op write fed the model a false success receipt, which it then repeated
to the user as fact.

The change (Receipt Contract rule 1 — a tool result must reflect what actually
happened):
- write_file: check fs_write's return (1 = all bytes written, 0 = fail);
  on failure return {"error":"write failed"} in the handler's existing
  error-JSON shape.
- edit_file: reject empty old_text, verify old_text is actually present
  (str_contains) before replacing, and check the fs_write result the same way.
- Verification is by operation result, NOT an fs_read read-back: fs_read arms
  the runtime's one-shot binary send length, the exact mechanism that truncated
  the safety-contact response (#96). Same honest-write pattern as that fix.

E2E evidence (sandboxed elb build, dispatch_tool driven directly):
- unpatched: write_file into a chmod-000 dir -> {"ok":true} (lie);
  edit_file with absent old_text -> {"ok":true} (lie, file untouched)
- patched:   same calls -> {"error":"write failed"} /
  {"error":"old_text not found in file"}; happy paths still ok:true
- scripts/verify-soul-contract.sh on the patched soul: GATE PASS (27/27
  presence + immutability)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

chat.el

@@ -1706,7 +1706,17 @@ fn dispatch_tool(tool_name: String, tool_input: String) -> String {
         if !path_within_root(path, root) {
             return json_safe("denied: path is outside the agent workspace root")
         }
-        fs_write(resolve_in_root(path, root), content)
+        // BUG-29 (Receipt Contract rule 1): fs_write's result was ignored, so a
+        // failed write (missing/unwritable dir, disk full) still returned
+        // {"ok":true} — a false receipt fed straight to the model. Check the
+        // return (1 = all bytes written, 0 = fail), the same honest-write pattern
+        // as the safety-contact fix. A read-back via fs_read is deliberately NOT
+        // used here: fs_read arms the runtime's one-shot binary send length,
+        // which truncated longer HTTP responses (the #96 failure mode).
+        let write_ok: Int = fs_write(resolve_in_root(path, root), content)
+        if write_ok == 0 {
+            return json_safe("{\"error\":\"write failed\"}")
+        }
         return json_safe("{\"ok\":true}")
     }
     if str_eq(tool_name, "web_get") {
@@ -1784,8 +1794,22 @@ fn dispatch_tool(tool_name: String, tool_input: String) -> String {
         if str_eq(content, "") {
             return json_safe("{\"error\":\"file not found\"}")
         }
+        // BUG-29 (Receipt Contract rule 1): when old_text was absent (or empty),
+        // str_replace was a silent no-op and the handler still claimed ok:true —
+        // a false receipt. Verify the text is actually present before replacing.
+        if str_eq(old_text, "") {
+            return json_safe("{\"error\":\"old_text is required\"}")
+        }
+        if !str_contains(content, old_text) {
+            return json_safe("{\"error\":\"old_text not found in file\"}")
+        }
         let updated: String = str_replace(content, old_text, new_text)
-        fs_write(resolved, updated)
+        // BUG-29: the fs_write result was also unchecked — a failed write still
+        // returned ok:true. Same honest-write check as write_file above.
+        let write_ok: Int = fs_write(resolved, updated)
+        if write_ok == 0 {
+            return json_safe("{\"error\":\"write failed\"}")
+        }
         return json_safe("{\"ok\":true}")
     }
     if str_eq(tool_name, "remember") {

dist/safety.c

@@ -340,6 +340,7 @@ el_val_t handle_safety_contact_get(void) {
   if (str_eq(raw, EL_STR(""))) {
     return EL_STR("{\"configured\":false}");
   }
+  el_val_t _reset = fs_read(EL_STR(""));
   return el_str_concat(el_str_concat(EL_STR("{\"configured\":true,\"contact\":"), raw), EL_STR("}"));
   return 0;
 }
@@ -359,9 +360,8 @@ el_val_t handle_safety_contact_post(el_val_t body) {
   el_val_t crisis_str = ({ el_val_t _if_result_51 = 0; if (is_crisis) { _if_result_51 = (EL_STR("true")); } else { _if_result_51 = (EL_STR("false")); } _if_result_51; });
   el_val_t now = time_format(time_now(), EL_STR("%Y-%m-%dT%H:%M:%SZ"));
   el_val_t contact_json = el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"name\":\""), json_safe(name)), EL_STR("\"")), EL_STR(",\"contact_method\":\"")), json_safe(method)), EL_STR("\"")), EL_STR(",\"contact_value\":\"")), json_safe(value)), EL_STR("\"")), EL_STR(",\"relationship\":\"")), json_safe(rel)), EL_STR("\"")), EL_STR(",\"confirmed\":true")), EL_STR(",\"is_crisis_line\":")), crisis_str), EL_STR(",\"set_at\":\"")), now), EL_STR("\"}"));
-  fs_write(safety_contact_path(), contact_json);
-  el_val_t check = fs_read(safety_contact_path());
-  if (str_eq(check, EL_STR(""))) {
+  el_val_t write_ok = fs_write(safety_contact_path(), contact_json);
+  if (write_ok == 0) {
     return EL_STR("{\"ok\":false,\"error\":\"write_failed\"}");
   }
   return el_str_concat(el_str_concat(EL_STR("{\"configured\":true,\"contact\":"), contact_json), EL_STR(",\"ok\":true}"));

dist/soul.c

@@ -25754,6 +25754,7 @@ el_val_t handle_safety_contact_get(void) {
   if (str_eq(raw, EL_STR(""))) {
     return EL_STR("{\"configured\":false}");
   }
+  el_val_t _reset = fs_read(EL_STR(""));
   return el_str_concat(el_str_concat(EL_STR("{\"configured\":true,\"contact\":"), raw), EL_STR("}"));
   return 0;
 }
@@ -25773,9 +25774,8 @@ el_val_t handle_safety_contact_post(el_val_t body) {
   el_val_t crisis_str = ({ el_val_t _if_result_51 = 0; if (is_crisis) { _if_result_51 = (EL_STR("true")); } else { _if_result_51 = (EL_STR("false")); } _if_result_51; });
   el_val_t now = time_format(time_now(), EL_STR("%Y-%m-%dT%H:%M:%SZ"));
   el_val_t contact_json = el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"name\":\""), json_safe(name)), EL_STR("\"")), EL_STR(",\"contact_method\":\"")), json_safe(method)), EL_STR("\"")), EL_STR(",\"contact_value\":\"")), json_safe(value)), EL_STR("\"")), EL_STR(",\"relationship\":\"")), json_safe(rel)), EL_STR("\"")), EL_STR(",\"confirmed\":true")), EL_STR(",\"is_crisis_line\":")), crisis_str), EL_STR(",\"set_at\":\"")), now), EL_STR("\"}"));
-  fs_write(safety_contact_path(), contact_json);
-  el_val_t check = fs_read(safety_contact_path());
-  if (str_eq(check, EL_STR(""))) {
+  el_val_t write_ok = fs_write(safety_contact_path(), contact_json);
+  if (write_ok == 0) {
     return EL_STR("{\"ok\":false,\"error\":\"write_failed\"}");
   }
   return el_str_concat(el_str_concat(EL_STR("{\"configured\":true,\"contact\":"), contact_json), EL_STR(",\"ok\":true}"));

safety.el

@@ -438,6 +438,12 @@ fn safety_contact_path() -> String {
 fn handle_safety_contact_get() -> String {
     let raw: String = fs_read(safety_contact_path())
     if str_eq(raw, "") { return "{\"configured\":false}" }
+    // fs_read set the runtime's binary-safe send length to len(raw); the HTTP
+    // response writer uses that length when non-zero, which would TRUNCATE this
+    // wrapped (longer) response to len(raw). Reset it with a no-op read of a
+    // missing path (fs_read zeroes the length before it opens) so the full
+    // response is sent.
+    let _reset: String = fs_read("")
     return "{\"configured\":true,\"contact\":" + raw + "}"
 }
 
@@ -463,9 +469,12 @@ fn handle_safety_contact_post(body: String) -> String {
         + ",\"confirmed\":true"
         + ",\"is_crisis_line\":" + crisis_str
         + ",\"set_at\":\"" + now + "\"}"
-    fs_write(safety_contact_path(), contact_json)
-    // Read-back verify the write actually persisted.
-    let check: String = fs_read(safety_contact_path())
-    if str_eq(check, "") { return "{\"ok\":false,\"error\":\"write_failed\"}" }
+    // Verify persistence via fs_write's return (1 = all bytes written, 0 = fail).
+    // The previous fs_read read-back set the runtime's binary-safe send length to
+    // the file size, which then TRUNCATED this longer JSON response to that size
+    // (the safety-contact 988 response was cut mid-"set_at"). Checking the write
+    // return avoids the fs_read entirely, so the full response is sent.
+    let write_ok: Int = fs_write(safety_contact_path(), contact_json)
+    if write_ok == 0 { return "{\"ok\":false,\"error\":\"write_failed\"}" }
     return "{\"configured\":true,\"contact\":" + contact_json + ",\"ok\":true}"
 }