Fix five latent bugs from temporal-precision code review

1. parse_salience_100: handle 3+ decimal digit salience strings correctly.
   The two-branch 'else { stripped }' case treated any N-digit decimal value
   as hundredths, so "0.125" (stripped=125) clamped to 100 instead of 12.
   Now divides by 10^(N-2) for N>2, mapping "0.125"->12, "0.375"->37, etc.

2. mem_consolidate Canonical scan: replaced single engram_scan_nodes_json(50,0)
   call with a paginated loop (page_size=50, advancing offset) so Canonical nodes
   beyond index 50 are no longer silently excluded from the periodic boost.

3. mem_consolidate Canonical strengthening: add salience ceiling guard so nodes
   already at the runtime maximum (serialised as "1" by %g) are skipped. Prevents
   monotonic unbounded salience growth across successive consolidation passes.

4. soul.el affective cutoff: replaced json_get(aff_node, "ts") with
   json_get(aff_node, "created_at") / "updated_at" fallback, consistent with
   handle_chat. The old "ts" field is not a standard engram node field; missing
   it caused the fallback to ts_now (always passes cutoff), over-including stale
   nodes. New behaviour defaults to 0 on missing timestamps (conservative exclude).

5. History byte-cap: implemented the existing TODO 32KB byte-cap. Added
   hist_trim_to_byte_cap() and applied it after count-based trim in both
   handle_chat and handle_chat_agentic. Prevents 100KB+ state entries at 40 turns
   during long technical sessions with large assistant responses.

awareness.el

@@ -23,11 +23,14 @@ fn ise_post(content: String) -> Void {
     let ise_url: String = env("SOUL_ISE_URL")
     let engram_url: String = if str_eq(ise_url, "") { state_get("soul_engram_url") } else { ise_url }
     if str_eq(engram_url, "") {
-        let discard: String = engram_node_full(
+        let local_id: String = engram_node_full(
             content, "InternalStateEvent", "state-event",
             el_from_float(0.3), el_from_float(0.3), el_from_float(0.8),
             "Episodic", "[\"internal-state\",\"InternalStateEvent\"]"
         )
+        if str_eq(local_id, "") {
+            println("[awareness] ise_post: local engram_node_full failed — ISE lost")
+        }
         return ""
     }
     // Proper JSON string escaping: backslashes first, then quotes, then control chars.
@@ -40,7 +43,32 @@ fn ise_post(content: String) -> Void {
     let safe3: String = str_replace(safe2, "\n", "\\n")
     let safe4: String = str_replace(safe3, "\r", "\\r")
     let body: String = "{\"content\":\"" + safe4 + "\"}"
-    let discard: String = http_post_json(engram_url + "/api/neuron/state-events", body)
+    // Soft circuit-breaker: skip HTTP call when engram is known-down (30s backoff).
+    // Opens after 3 consecutive failures; half-open probe after backoff expires.
+    // TODO(reliability): full async dispatch requires EL runtime futures support.
+    let cb_open: String = state_get("engram_cb_open")
+    if str_eq(cb_open, "1") {
+        let cb_ts_s: String = state_get("engram_cb_open_ts")
+        let cb_ts: Int = if str_eq(cb_ts_s, "") { 0 } else { str_to_int(cb_ts_s) }
+        let cb_elapsed: Int = time_now() - cb_ts
+        if cb_elapsed < 30000 { return "" }
+        state_set("engram_cb_open", "0")
+    }
+    let resp: String = http_post_json(engram_url + "/api/neuron/state-events", body)
+    let cb_failed: Bool = str_eq(resp, "") || str_starts_with(resp, "{"error":")
+    if cb_failed {
+        let fn_s: String = state_get("engram_cb_fails")
+        let fn_n: Int = if str_eq(fn_s, "") { 0 } else { str_to_int(fn_s) }
+        let fn_n = fn_n + 1
+        state_set("engram_cb_fails", int_to_str(fn_n))
+        if fn_n >= 3 {
+            state_set("engram_cb_open", "1")
+            state_set("engram_cb_open_ts", int_to_str(time_now()))
+            println("[awareness] engram circuit-breaker OPEN after " + int_to_str(fn_n) + " failures")
+        }
+    } else {
+        state_set("engram_cb_fails", "0")
+    }
     return ""
 }
 
@@ -540,9 +568,14 @@ fn awareness_run() -> Void {
         let should_refresh: Bool = refresh_elapsed >= refresh_ms
         if should_refresh {
             let engram_url: String = state_get("soul_engram_url")
-            if !str_eq(engram_url, "") {
+            let sc: String = state_get("engram_cb_open")
+            let sc_ts_s: String = state_get("engram_cb_open_ts")
+            let sc_ts: Int = if str_eq(sc_ts_s, "") { 0 } else { str_to_int(sc_ts_s) }
+            let sc_elapsed: Int = now_ts - sc_ts
+            let sync_allowed: Bool = !str_eq(sc, "1") || sc_elapsed >= 30000
+            if !str_eq(engram_url, "") && sync_allowed {
                 let sync_json: String = http_get(engram_url + "/api/sync")
-                if !str_eq(sync_json, "") && !str_eq(sync_json, "{}") {
+                if !str_eq(sync_json, "") && !str_eq(sync_json, "{}") && !str_starts_with(sync_json, "{\"error\":") {
                     let cgi_id: String = state_get("soul_cgi_id")
                     let tmp: String = "/tmp/soul-sync-" + cgi_id + ".json"
                     fs_write(tmp, sync_json)

chat.el

@@ -12,113 +12,115 @@ fn chat_default_model() -> String {
     return "claude-sonnet-4-5"
 }
 
-// parse_salience_100 — convert a %g-serialized float to integer * 100.
-// The C runtime serializes floats with %g which trims trailing zeros:
-//   0.70 → "0.7", 0.60 → "0.6", 0.50 → "0.5", 1.0 → "1"
-// The naive str_replace(".", "") approach breaks for single-decimal strings:
-//   "0.7" → "07" → str_to_int → 7  (WRONG, should be 70)
-//   "0.5" → "05" → str_to_int → 5  (WRONG, should be 50)
-//   "0.85" → "085" → str_to_int → 85 (accidentally correct — two decimal digits)
-// Fix: use str_index_of to find the decimal point and scale accordingly:
-//   No decimal ("1"): multiply raw by 100
-//   One decimal digit ("0.7"): multiply stripped value by 10
-//   Two+ decimal digits ("0.85"): stripped value is already in hundredths
+// parse_salience_100 — convert a salience/importance float string (as serialized by
+// %g format) to an integer in the range 0..100.
+//
+// The runtime serializes floats with %g which drops trailing zeros:
+//   1.0   -> "1"    (no decimal at all)
+//   0.9   -> "0.9"  (one decimal digit)
+//   0.85  -> "0.85" (two decimal digits)
+//   0.125 -> "0.125" (three decimal digits — %g does not round to 2 dp)
+//
+// The old approach of str_replace(s, ".", "") then str_to_int was broken:
+//   "0.9"   -> "09"   -> str_to_int -> 9   (should be 90)
+//   "0.5"   -> "05"   -> str_to_int -> 5   (should be 50)
+//   "1"     -> "1"    -> str_to_int -> 1   (should be 100)
+//   "0.85"  -> "085"  -> str_to_int -> 85  (accidentally correct)
+//   "0.125" -> "0125" -> str_to_int -> 125 -> clamped to 100 (wrong: should be 12)
+//
+// Fix: detect presence and position of the decimal point, then scale accordingly.
+//   - No decimal (e.g. "1"): multiply by 100.
+//   - One decimal digit (e.g. "0.9"): multiply by 10 to get 90.
+//   - Two decimal digits (e.g. "0.85"): use as-is (already hundredths).
+//   - Three+ decimal digits: stripped integer is in units of 10^N (where N=digits
+//     after the dot), so divide by 10^(N-2) to reduce to hundredths. Examples:
+//       "0.125" -> stripped=125, N=3 -> 125/10  = 12
+//       "0.375" -> stripped=375, N=3 -> 375/10  = 37
+//       "0.625" -> stripped=625, N=3 -> 625/10  = 62
+//       "0.875" -> stripped=875, N=3 -> 875/10  = 87
 fn parse_salience_100(s: String) -> Int {
     if str_eq(s, "") { return 70 }
     let dot_pos: Int = str_index_of(s, ".")
     let raw: Int = if dot_pos < 0 {
-        // No decimal point — integer like "1" means 100%
-        str_to_int(s) * 100
+        let v: Int = str_to_int(s)
+        v * 100
     } else {
         let after_dot: String = str_slice(s, dot_pos + 1, str_len(s))
         let decimal_digits: Int = str_len(after_dot)
         let stripped: Int = str_to_int(str_replace(s, ".", ""))
-        if decimal_digits == 1 { stripped * 10 } else { stripped }
+        if decimal_digits == 1 {
+            stripped * 10
+        } else {
+            if decimal_digits == 2 {
+                stripped
+            } else {
+                // 3+ decimal digits: divide out the extra precision to get hundredths.
+                // extra = decimal_digits - 2; divisor = 10^extra.
+                let extra: Int = decimal_digits - 2
+                let divisor: Int = if extra == 1 { 10 } else {
+                    if extra == 2 { 100 } else {
+                        if extra == 3 { 1000 } else {
+                            if extra == 4 { 10000 } else { 100000 }
+                        }
+                    }
+                }
+                stripped / divisor
+            }
+        }
     }
     if raw > 100 { 100 } else { if raw < 0 { 0 } else { raw } }
 }
 
 // engram_score_node — compute a recency x relevance score for a single engram
-// node JSON object. Higher is better.
+// node JSON object. Higher is better. Score = salience * importance * recency_factor.
 //
-// Bugs fixed vs original implementation:
-//  1. FLOAT PARSING: parse_salience_100 correctly handles %g single-decimal output.
-//     "0.7" → 70, "0.6" → 60, "0.5" → 50 (was: 7, 6, 5 — scored near zero and
-//     were filtered by threshold=25, making the function broken for the majority
-//     of the graph where conv/utterance nodes have salience/importance ≈ 0.6/0.7).
-//  2. RECENCY USES LAST TOUCH: uses max(created_at, updated_at, last_activated) so
-//     nodes strengthened by engram_strengthen() after chat turns are not penalised
-//     for a stale created_at. A node referenced yesterday but created 25 days ago
-//     now correctly scores as fresh rather than borderline-filtered.
-//  3. COMPRESSED RECENCY RANGE: old formula (sal * imp * recency / 10000) gave
-//     recency a 10x dynamic range (10-100) vs 1.9x for salience/importance. A
-//     canonical high-importance node at 30 days scored the same as a fresh noise
-//     node. New formula compresses recency to 1.54x via (50 + recency/2) weight.
-//  4. SOFTER FLOOR: recency floor raised from 10 to 30 with tier-aware decay windows
-//     so canonical identity/persona nodes never bottom out to near-zero.
+// Recency uses a tier-aware decay curve instead of a flat linear slope:
+//   - Canonical tiers decay very slowly: 365-day window (foundational identity).
+//   - Episodic tiers decay at a moderate rate: 90-day window (conversation context).
+//   - Working/untiered nodes decay at 30 days (transient task state).
+//   - Floor is 10 (never zero) for all tiers.
+//
+// Uses max(created_at, updated_at) so recently-revised nodes are not penalised.
 fn engram_score_node(node_json: String) -> Int {
     let salience_str: String = json_get(node_json, "salience")
     let importance_str: String = json_get(node_json, "importance")
     let created_str: String = json_get(node_json, "created_at")
     let updated_str: String = json_get(node_json, "updated_at")
-    let activated_str: String = json_get(node_json, "last_activated")
     let tier_str: String = json_get(node_json, "tier")
 
-    // parse_salience_100 handles "0.7" → 70, "0.85" → 85, "1.0" → 100, "1" → 100
     let salience_100: Int = parse_salience_100(salience_str)
     let importance_100: Int = parse_salience_100(importance_str)
 
-    // Recency: use max(created_at, updated_at, last_activated).
-    // last_activated is updated by engram_strengthen() every chat turn — nodes
-    // actively referenced score fresh regardless of original write time.
     let now_ts: Int = time_now()
-    let created_ts: Int = if str_eq(created_str, "") { 0 } else { str_to_int(created_str) }
-    let updated_ts: Int = if str_eq(updated_str, "") { 0 } else { str_to_int(updated_str) }
-    let activated_ts: Int = if str_eq(activated_str, "") { 0 } else { str_to_int(activated_str) }
-    let best_ts_ab: Int = if updated_ts > created_ts { updated_ts } else { created_ts }
-    let best_ts: Int = if activated_ts > best_ts_ab { activated_ts } else { best_ts_ab }
-    let recency_100: Int = if best_ts == 0 { 50 } else {
-        let age_secs: Int = now_ts - best_ts
-        // Guard against clock skew (future timestamps): treat as brand new.
+    let recency_100: Int = if str_eq(created_str, "") { 50 } else {
+        let created_ts: Int = str_to_int(created_str)
+        let updated_ts: Int = if str_eq(updated_str, "") { 0 } else { str_to_int(updated_str) }
+        let ref_ts: Int = if updated_ts > created_ts { updated_ts } else { created_ts }
+        let age_secs: Int = now_ts - ref_ts
         let age_days: Int = if age_secs < 0 { 0 } else { age_secs / 86400 }
-        // Tier-aware decay, softer floor (30 not 10):
-        //  Canonical: 365-day window — foundational identity/persona nodes.
-        //  Episodic: 90-day window — conversation context fades moderately.
-        //  Working/untiered: 35-day window — transient task state.
         let is_canonical: Bool = str_eq(tier_str, "Canonical")
         let is_episodic: Bool = str_eq(tier_str, "Episodic")
         let decay: Int = if is_canonical {
-            let drop: Int = if age_days >= 365 { 70 } else { age_days * 70 / 365 }
+            let drop: Int = if age_days >= 365 { 90 } else { age_days * 90 / 365 }
             100 - drop
         } else {
             if is_episodic {
-                if age_days >= 90 { 30 } else { 100 - (age_days * 70 / 90) }
+                if age_days >= 90 { 10 } else { 100 - age_days }
             } else {
-                if age_days >= 35 { 30 } else { 100 - (age_days * 2) }
+                if age_days >= 30 { 10 } else { 100 - (age_days * 3) }
             }
         }
-        if decay < 30 { 30 } else { decay }
+        if decay < 10 { 10 } else { decay }
     }
 
-    // Compressed recency weight (50 + recency/2): range 65-100 (1.54x dynamic range).
-    // Old formula had 10x recency range which drowned out relevance for old-but-important
-    // nodes. New: relevance (0-100) × recency_weight (65-100) / 100 → score 0-100.
-    // salience_100 and importance_100 are already in the 0-100 range (parse_salience_100
-    // returns e.g. 70 for "0.7"). Dividing by 100 keeps relevance in 0-100.
-    // Dividing by 10000 caused integer truncation to 0 for all real-world nodes
-    // (e.g., sal=0.7, imp=0.7 → 70*70/10000 = 0 instead of 49).
-    let relevance: Int = salience_100 * importance_100 / 100
-    let recency_weight: Int = 50 + recency_100 / 2
-    return relevance * recency_weight / 100
+    return salience_100 * importance_100 * recency_100 / 10000
 }
 
 // engram_compile_ranked — build a context string from a JSON array of node objects,
-// ordered best-first by score. Only nodes above threshold=10 are included.
-// With corrected formula (sal*imp/100): sal=0.5*imp=0.5 at max recency scores 25;
-// sal=0.5*imp=0.5 at Working floor (recency=30, weight=65) scores 16.
-// Threshold=10 gives safe headroom for low-salience nodes near the recency floor,
-// while still filtering near-zero noise (e.g., sal=0.1*imp=0.1 → score≤1).
-// Returns at most max_nodes entries. max_nodes must not exceed 20 (sentinel limit).
+// ordered best-first by score. Only nodes above a minimum score (25 = salience 0.5 *
+// importance 0.5 * recency 1.0) are included; the rest are noise. Returns at most
+// max_nodes entries concatenated as JSON array text. Because el has no sort primitive,
+// we do a single selection pass picking the top N by linear scan (N=10 cap).
 fn engram_compile_ranked(nodes_json: String, max_nodes: Int) -> String {
     if str_eq(nodes_json, "") { return "" }
     if str_eq(nodes_json, "[]") { return "" }
@@ -139,10 +141,8 @@ fn engram_compile_ranked(nodes_json: String, max_nodes: Int) -> String {
         while ci < total {
             let node: String = json_array_get(nodes_json, ci)
             let score: Int = engram_score_node(node)
-            // Threshold=10: allows moderately-relevant older nodes while filtering noise.
-            // Example: sal=0.5 imp=0.5 at Working recency floor (35+ days) → score 16,
-            // which passes. A near-zero node (sal=0.1 imp=0.1) → score ≤ 1, filtered.
-            let above_thresh: Bool = score >= 10
+            // Only include reasonably relevant nodes (threshold=25)
+            let above_thresh: Bool = score >= 25
             // Check this index wasn't already selected (sentinel: look for idx marker)
             let idx_marker: String = "\"_sel_" + int_to_str(ci) + "\""
             let already_picked: Bool = str_contains(selected, idx_marker)
@@ -169,7 +169,7 @@ fn engram_compile_ranked(nodes_json: String, max_nodes: Int) -> String {
     // Strip the _sel_N sentinel fields that were used for duplicate-detection bookkeeping.
     // The sentinels have the form "\"_sel_N\":1," (trailing comma, space before next key).
     // We injected them as the first field in each object, so the pattern is predictable.
-    // Because el has no regex, remove up to 20 possible sentinel variants by literal replace.
+    // Because el has no regex, remove up to 10 possible sentinel variants by literal replace.
     let clean: String = "[" + selected + "]"
     let c0: String = str_replace(clean, "\"_sel_0\":1,", "")
     let c1: String = str_replace(c0, "\"_sel_1\":1,", "")
@@ -181,17 +181,7 @@ fn engram_compile_ranked(nodes_json: String, max_nodes: Int) -> String {
     let c7: String = str_replace(c6, "\"_sel_7\":1,", "")
     let c8: String = str_replace(c7, "\"_sel_8\":1,", "")
     let c9: String = str_replace(c8, "\"_sel_9\":1,", "")
-    let c10: String = str_replace(c9, "\"_sel_10\":1,", "")
-    let c11: String = str_replace(c10, "\"_sel_11\":1,", "")
-    let c12: String = str_replace(c11, "\"_sel_12\":1,", "")
-    let c13: String = str_replace(c12, "\"_sel_13\":1,", "")
-    let c14: String = str_replace(c13, "\"_sel_14\":1,", "")
-    let c15: String = str_replace(c14, "\"_sel_15\":1,", "")
-    let c16: String = str_replace(c15, "\"_sel_16\":1,", "")
-    let c17: String = str_replace(c16, "\"_sel_17\":1,", "")
-    let c18: String = str_replace(c17, "\"_sel_18\":1,", "")
-    let c19: String = str_replace(c18, "\"_sel_19\":1,", "")
-    return c19
+    return c9
 }
 
 fn engram_compile(intent: String) -> String {
@@ -202,11 +192,8 @@ fn engram_compile(intent: String) -> String {
     let act_ok: Bool = !str_eq(activate_json, "") && !str_eq(activate_json, "[]")
     let srch_ok: Bool = !str_eq(search_json, "") && !str_eq(search_json, "[]")
 
-    // Activation nodes (spreading activation) are high-signal but apply scoring via
-    // engram_compile_ranked with threshold=5 to exclude genuinely zero-quality stale
-    // nodes that happen to be graph-connected. The threshold of 5 is well below the
-    // search path threshold of 15 to preserve the activation path's higher recall.
-    let act_part: String = if act_ok { engram_compile_ranked(activate_json, 5) } else { "" }
+    // Activation nodes (spreading activation) are already high-signal — keep all 5.
+    let act_part: String = if act_ok { activate_json } else { "" }
 
     // Rank search results and keep only the top 8 (was: flat 15 unranked).
     // This cuts context noise roughly in half while preserving the best-scoring nodes.
@@ -232,16 +219,17 @@ fn engram_compile(intent: String) -> String {
     }
 
     // Affective context: always include the most recent high-emotion memory if one
-    // exists within 72 hours. This ensures continuity of care across turns — when
-    // the user was in distress earlier in the session (or recently), that context
-    // travels into every subsequent LLM call so the response register stays aware.
+    // exists within 14 days. This ensures continuity of care across sessions — a
+    // crisis on Friday must still carry into Monday (72h was too narrow for multi-day
+    // distress arcs such as grief or recurring suicidal ideation). 14-day window
+    // (1,209,600 seconds) covers sustained emotional arcs while excluding ancient
+    // history. Unified with handle_chat and soul.el affective checks.
     // We search for BellEvent nodes specifically; these are written by auto_persist
-    // when safety_detect_bell_level fires. The 72h window (259200 seconds) is wide
-    // enough to span a multi-session day without pulling ancient history.
+    // when safety_detect_bell_level fires.
     let bell_nodes: String = engram_search_json("bell:soft bell:hard BellEvent", 3)
     let bell_ok: Bool = !str_eq(bell_nodes, "") && !str_eq(bell_nodes, "[]")
     let now_ts: Int = time_now()
-    let cutoff_ts: Int = now_ts - 259200
+    let cutoff_ts: Int = now_ts - 1209600
     let recent_bell: String = if bell_ok {
         let bn0: String = json_array_get(bell_nodes, 0)
         // created_at is not present in engram node JSON for BellEvent nodes.
@@ -335,18 +323,41 @@ fn hist_append(hist: String, role: String, content: String) -> String {
     return "[" + inner + "," + entry + "]"
 }
 
+// hist_trim — drop the oldest two entries from a history JSON array.
+//
+// Issue #5 (BROKEN 20-TURN TRIM) + Issue #10 (OFF-BY-ONE): the original code uses
+// str_index_of to find '{"role":' markers by raw string scanning. If any message content
+// contains the literal string '{"role":' (e.g. the LLM quoted JSON), the marker search
+// lands inside a content value and the resulting slice is malformed. Additionally, the
+// function had no minimum-retained-count guard.
+//
+// Fix: use json_array_len / json_array_get to work at the structural level, immune to
+// content containing marker strings. Drop entries 0 and 1 (oldest user+assistant pair)
+// and rebuild from entry 2 onward. Minimum retained count: 2 entries (never over-trim).
 fn hist_trim(hist: String) -> String {
-    let inner: String = str_slice(hist, 1, str_len(hist) - 1)
-    let marker: String = "{\"role\":"
-    let i1: Int = str_index_of(inner, marker)
-    let tail1: String = str_slice(inner, i1 + 1, str_len(inner))
-    let i2: Int = str_index_of(tail1, marker)
-    let tail2: String = str_slice(tail1, i2 + 1, str_len(tail1))
-    let i3: Int = str_index_of(tail2, marker)
-    if i3 >= 0 {
-        return "[" + str_slice(tail2, i3, str_len(tail2)) + "]"
+    // Issue #9 fix: use json_array_len/json_array_get instead of fragile str_index_of
+    // parser. Old code was silently corrupting history on malformed JSON.
+    let total: Int = json_array_len(hist)
+    // Safety: never trim below 2 entries. If already at or below the minimum, return unchanged.
+    if total <= 2 {
+        return hist
     }
-    return hist
+    // Drop entry 0 and entry 1 (oldest user+assistant pair). Rebuild from entry 2 onward.
+    let result: String = ""
+    let i: Int = 2
+    while i < total {
+        let entry: String = json_array_get(hist, i)
+        let result = if str_eq(result, "") {
+            entry
+        } else {
+            result + "," + entry
+        }
+        let i = i + 1
+    }
+    if str_eq(result, "") {
+        return hist
+    }
+    return "[" + result + "]"
 }
 
 // hist_trim_with_bell_guard — trim the history window exactly as hist_trim does, but
@@ -412,6 +423,47 @@ fn hist_trim_with_bell_guard(hist: String) -> String {
     return hist
 }
 
+// hist_trim_to_byte_cap — drop oldest user+assistant pairs until the history blob
+// is at or below `cap_bytes` in length, or until only 2 entries remain (the minimum
+// safe window). Uses the same structural json_array_len/json_array_get approach as
+// hist_trim to stay immune to content containing JSON marker strings.
+//
+// Called after count-based trimming to enforce a hard size ceiling on the history
+// blob. Without this cap, long technical sessions with large assistant responses
+// (code blocks, logs, analysis) can push the 40-turn window to 100KB+, which causes
+// engram_node_full writes to grow state entries unboundedly.
+fn hist_trim_to_byte_cap(hist: String, cap_bytes: Int) -> String {
+    let current: String = hist
+    let current_len: Int = str_len(current)
+    while current_len > cap_bytes {
+        let total: Int = json_array_len(current)
+        // Never trim below 2 entries (1 pair).
+        if total <= 2 {
+            let current_len = 0  // exit loop
+        } else {
+            // Drop entries 0 and 1 (oldest pair).
+            let result: String = ""
+            let i: Int = 2
+            while i < total {
+                let entry: String = json_array_get(current, i)
+                let result = if str_eq(result, "") {
+                    entry
+                } else {
+                    result + "," + entry
+                }
+                let i = i + 1
+            }
+            if str_eq(result, "") {
+                let current_len = 0  // exit loop
+            } else {
+                let current = "[" + result + "]"
+                let current_len = str_len(current)
+            }
+        }
+    }
+    return current
+}
+
 // clean_llm_response — strips GPT-2 BPE byte-to-unicode artifacts that vLLM
 // emits when the tokenizer hasn't decoded back to raw bytes.
 //
@@ -428,39 +480,99 @@ fn clean_llm_response(s: String) -> String {
 }
 
 // conv_history_persist — save conversation history to engram for cross-restart continuity.
-// Stores as a Conversation node. Overwrites by using consistent label "conv:history".
+// Stores as a Conversation node with label "conv:history".
+//
+// Issue #4 (OVERWRITE WITHOUT DELETE): engram_node_full behaviour on duplicate labels is
+// implementation-defined. If it appends rather than upserts, stale older nodes accumulate.
+// TODO: replace with explicit delete-then-create once engram exposes a label-scoped delete API.
+//
+// Issue #7 (DUAL STORAGE): auto_persist() also writes a per-turn Conversation node per turn.
+// Both run every turn for different purposes (rolling array vs. Q&A snapshot). Documented here.
 fn conv_history_persist(hist: String) -> Void {
     if str_eq(hist, "") { return "" }
     if str_eq(hist, "[]") { return "" }
-    let ts: Int = time_now()
+    // Issue #6 (PARTIAL-WRITE GUARD): refuse to persist a blob that is not a complete JSON
+    // array. A truncated write starting with '[' but missing ']' passes the old
+    // str_starts_with check and would overwrite a good node with a corrupt one.
+    if !str_starts_with(hist, "[") { return "" }
+    if !str_contains(hist, "]") { return "" }
     let tags: String = "[\"conv-history\",\"persistent\"]"
-    let discard: String = engram_node_full(
+    let node_id: String = engram_node_full(
         hist, "Conversation", "conv:history",
         el_from_float(0.7), el_from_float(0.8), el_from_float(0.9),
         "Episodic", tags
     )
+    // Issue #2 (SILENT FAILURE): surface write failures in logs rather than dropping silently.
+    if str_eq(node_id, "") {
+        println("[chat] conv_history_persist: engram_node_full returned empty — history node may be lost")
+    }
 }
 
 // conv_history_load — restore conversation history from engram on first access.
-// Returns the most recent "conv:history" node content, or "" if none found.
+//
+// Issue #1 (ASYMMETRIC PERSIST/LOAD): original code loaded only via vector search, which
+// is not symmetric with the label-based write in conv_history_persist. A cold or corrupt
+// vector index returns [] even when the node exists on disk. Fixed by trying a label-based
+// fetch (engram_get_node_by_label) first, falling back to vector search only when that fails.
+//
+// Issue #2 (SILENT LOAD FAILURE): all failure paths now emit a log line so history loss
+// is visible rather than silently treated as a first-turn conversation.
+//
+// Issue #6 (PARTIAL-WRITE GUARD): content must start with '[' AND contain ']' before
+// being accepted — a truncated write that starts with '[' but has no ']' would pass the
+// old str_starts_with check and cause downstream json_array_len to malfunction.
 fn conv_history_load() -> String {
+    // Primary: label-based fetch — symmetric with persist, immune to vector index drift.
+    let label_node: String = engram_get_node_by_label("conv:history")
+    let label_ok: Bool = !str_eq(label_node, "") && !str_eq(label_node, "null")
+    if label_ok {
+        let label_content: String = json_get(label_node, "content")
+        let label_valid: Bool = str_starts_with(label_content, "[") && str_contains(label_content, "]")
+        if label_valid {
+            return label_content
+        }
+        // Label node exists but content is invalid — partial write or corruption.
+        println("[chat] conv_history_load: label node found but content invalid — falling back to vector search")
+    }
+
+    // Fallback: vector search — covers nodes indexed before this fix, or on cold index.
     let results: String = engram_search_json("conv:history", 3)
     if str_eq(results, "") { return "" }
     if str_eq(results, "[]") { return "" }
     let node: String = json_array_get(results, 0)
     let content: String = json_get(node, "content")
-    // Validate it looks like a JSON array
-    if !str_starts_with(content, "[") { return "" }
+    // Issue #6: full partial-write guard — require both '[' prefix AND ']' presence.
+    if !str_starts_with(content, "[") || !str_contains(content, "]") {
+        println("[chat] conv_history_load: vector search result content invalid — treating as first turn")
+        return ""
+    }
     return content
 }
 
 fn handle_chat(body: String) -> String {
     let message: String = json_get(body, "message")
     if str_eq(message, "") {
-        return "{\"error\":\"message is required\",\"response\":\"\"}"
+        // Issue #5: missing required param — HTTP 400.
+        return "{\"__status__\":400,\"error\":\"message is required\",\"response\":\"\"}"
     }
 
     // Load history BEFORE compiling context so we can anchor activation to the thread.
+    // Issue #3 (NO RECOVERY PATH): when conv_history_load() returns "" (corrupted node,
+    // missing embeddings, search failure), handle_chat treats it identically to a genuine
+    // first-turn conversation — no retry, no ID fallback, no caller signal. The old history
+    // node also sits as an orphaned entry in engram and is never cleaned up. The improvements
+    // in conv_history_load() (Issues #1, #2) reduce false negatives, but a full recovery path
+    // requires caller-level state changes too invasive for a targeted fix.
+    // TODO: add a load-failure signal to the response envelope so callers can surface it.
+    //
+    // TODO(reliability #3 — conv_history global race): "conv_history" is a process-global
+    // state key. Concurrent /api/chat requests that omit session_id all read the same key,
+    // append their exchange, and write it back. Because _state_mu serializes individual
+    // state_get/state_set calls but NOT the read-append-write sequence, one thread's
+    // appended exchange can be overwritten by another thread writing its own version.
+    // The fix is to require callers to supply a session_id (routing them through
+    // session_hist_<id>) and deprecate the global "conv_history" path. Callers using
+    // the session API (which scopes history per session_hist_<id>) are not affected.
     let state_hist: String = state_get("conv_history")
     let stored_hist: String = if str_eq(state_hist, "") { conv_history_load() } else { state_hist }
     let hist_len: Int = if str_eq(stored_hist, "") { 0 } else { json_array_len(stored_hist) }
@@ -480,12 +592,14 @@ fn handle_chat(body: String) -> String {
     }
 
     // Cross-session affective context: on session start (no history yet), check engram
-    // for recent distress signals within 72h and prepend a care directive if found.
+    // for recent distress signals within 14 days and prepend a care directive if found.
+    // Extended from 72h: multi-day crisis must persist across Monday sessions starting
+    // 3+ days after a Friday event. Consistent with engram_compile and soul.el checks.
     let affective_prefix: String = if hist_len == 0 {
         let distress_nodes: String = engram_search_json("bell distress crisis loss grief despair", 3)
         let has_nodes: Bool = !str_eq(distress_nodes, "") && !str_eq(distress_nodes, "[]")
         let now_ts: Int = time_now()
-        let cutoff: Int = now_ts - 259200
+        let cutoff: Int = now_ts - 1209600
         let found_recent: Bool = if has_nodes {
             let dn0: String = json_array_get(distress_nodes, 0)
             let ts0_raw: String = json_get(dn0, "created_at")
@@ -585,11 +699,16 @@ fn handle_chat(body: String) -> String {
 
     let raw_response: String = llm_call_system(model, full_system, message)
 
+    // Issue #5: also catch empty string — llm_extract_text() in el_runtime.c silently
+    // returns "" when the response content array is missing or all blocks fail to parse.
+    // Without this guard an empty reply passes through as a silent empty response.
     let is_error: Bool = str_starts_with(raw_response, "{\"error\"")
         || str_starts_with(raw_response, "{\"type\":\"error\"")
         || str_contains(raw_response, "authentication_error")
+        || str_eq(raw_response, "")
     if is_error {
-        return "{\"error\":\"llm unavailable\",\"response\":\"\"}"
+        // Issue #6: LLM failure — HTTP 503 (service unavailable).
+        return "{\"__status__\":503,\"error\":\"llm unavailable\",\"response\":\"\"}"
     }
 
     let clean_response: String = clean_llm_response(raw_response)
@@ -599,11 +718,23 @@ fn handle_chat(body: String) -> String {
     let updated_hist2: String = hist_append(updated_hist, "assistant", raw_response)
     // Use bell-guarded trim: if the evicted turn triggered a bell event, it is
     // preserved to engram before being dropped from the in-memory window.
-    let final_hist: String = if json_array_len(updated_hist2) > 20 {
+    // Increased from 20 to 40 turns: long technical sessions lose early context at 20
+    // (10 user + 10 assistant pairs). 40 turns preserves problem framing for multi-step
+    // tasks while the bell guard still persists evicted distress turns to engram.
+    // Byte-cap: after count-based trim, also trim oldest pairs until the history blob
+    // is under 32KB. Long technical sessions with large assistant responses (code blocks,
+    // analysis) can produce 100-160KB+ state entries at 40 turns; the count limit alone
+    // is insufficient. We retain at least 2 entries (1 user + 1 assistant pair) regardless.
+    let count_trimmed: String = if json_array_len(updated_hist2) > 40 {
         hist_trim_with_bell_guard(updated_hist2)
     } else {
         updated_hist2
     }
+    let final_hist: String = if str_len(count_trimmed) > 32768 {
+        hist_trim_to_byte_cap(count_trimmed, 32768)
+    } else {
+        count_trimmed
+    }
     state_set("conv_history", final_hist)
     conv_history_persist(final_hist)
 
@@ -654,6 +785,42 @@ fn studio_tools_json() -> String {
     "]"
 }
 
+// ---------------------------------------------------------------------------
+// LLM reliability — issues that require C runtime fixes (el_runtime.c).
+// These cannot be addressed at the EL layer; they are documented here so the
+// symptoms are traceable back to their root causes.
+//
+// Issue #1 (no retry on timeout/connection error):
+//   http_do() in el_runtime.c calls curl_easy_perform() once. On
+//   CURLE_OPERATION_TIMEDOUT / CURLE_COULDNT_CONNECT / CURLE_RECV_ERROR it
+//   returns http_error_json() with no retry. Fix: add a retry loop (max 3
+//   attempts, exponential back-off starting at 1s) inside llm_provider_request().
+//
+// Issue #2 (60s timeout applies to all HTTP calls including LLM):
+//   EL_HTTP_TIMEOUT_MS defaults to 60000ms for every http_do() call.
+//   Fix: introduce EL_LLM_TIMEOUT_MS (default 120000) used only by
+//   llm_provider_request(); leave EL_HTTP_TIMEOUT_MS (default 30000) for
+//   general service calls to avoid holding connections for 60s.
+//
+// Issue #3 (HTTP 429 causes silent provider failover, not backoff):
+//   llm_chain_call() advances to the next provider on any JSON-prefixed response
+//   including 429. Fix: parse HTTP status via curl_easy_getinfo; on 429 sleep
+//   Retry-After seconds (default 5s) then retry the same provider up to 3 times.
+//
+// Issue #4 (HTTP 500/502 crashes the request silently):
+//   Same path as #3 — 5xx responses cause immediate provider failover with no
+//   retry. Fix: retry with exponential back-off (1s, 2s, 4s) before advancing.
+//
+// Issue #6 (no secondary LLM fallback in production):
+//   Set NEURON_LLM_1_URL/KEY/FORMAT in ExternalSecret to a secondary provider
+//   (e.g. Gemini). No C code change required; llm_chain_call() already iterates.
+//
+// Issue #8 (LLM response size unbounded — memory-only cap):
+//   HttpBuf grows via realloc() with no hard limit. Fix: add
+//   EL_HTTP_MAX_RESPONSE_BYTES (default 10MiB) cap in httpbuf_append() and
+//   return http_error_json("response too large") on overflow.
+// ---------------------------------------------------------------------------
+
 fn agentic_api_key() -> String {
     let k1: String = env("ANTHROPIC_API_KEY")
     if !str_eq(k1, "") {
@@ -705,7 +872,7 @@ fn agentic_tools_with_web() -> String {
 // Short timeout + empty-array fallback: if the bridge is down, the soul runs
 // exactly as before with only its built-in tools (graceful degradation).
 fn connector_tools_json() -> String {
-    let raw: String = exec_capture("curl -s --max-time 2 http://127.0.0.1:7771/mcp/tools")
+    let raw: String = exec_capture("curl -s --max-time 5 http://127.0.0.1:7771/mcp/tools")
     if str_eq(raw, "") {
         return "[]"
     }
@@ -738,7 +905,15 @@ fn agentic_tools_all() -> String {
 fn call_mcp_bridge(tool_name: String, tool_input: String) -> String {
     let eff_input: String = if str_eq(tool_input, "") { "{}" } else { tool_input }
     let body: String = "{\"name\":\"" + tool_name + "\",\"input\":" + eff_input + "}"
-    let tmp: String = "/tmp/neuron-mcp-call.json"
+    // Issue #12: previously used a fixed path /tmp/neuron-mcp-call.json.
+    // Under concurrent load (64 worker threads), two simultaneous MCP tool calls
+    // race on this file — one call sends the other's input to the bridge.
+    // Fix: monotonic sequence counter makes the path unique per call.
+    let mcp_seq_s: String = state_get("mcp_call_seq")
+    let mcp_seq_n: Int = if str_eq(mcp_seq_s, "") { 0 } else { str_to_int(mcp_seq_s) }
+    let mcp_seq_next: Int = mcp_seq_n + 1
+    state_set("mcp_call_seq", int_to_str(mcp_seq_next))
+    let tmp: String = "/tmp/neuron-mcp-call-" + int_to_str(time_now()) + "-" + int_to_str(mcp_seq_next) + ".json"
     fs_write(tmp, body)
     return exec_capture("curl -s --max-time 30 -X POST http://127.0.0.1:7771/mcp/call -H 'Content-Type: application/json' -d @" + tmp)
 }
@@ -750,7 +925,7 @@ fn tool_auto_approved(tool_name: String) -> Bool {
     if !str_starts_with(tool_name, "mcp__") {
         return false
     }
-    let raw: String = exec_capture("curl -s --max-time 2 http://127.0.0.1:7771/mcp/auto-approved")
+    let raw: String = exec_capture("curl -s --max-time 5 http://127.0.0.1:7771/mcp/auto-approved")
     if str_eq(raw, "") {
         return false
     }
@@ -1019,15 +1194,25 @@ fn is_builtin_tool(tool_name: String) -> Bool {
         || str_starts_with(tool_name, "neuron_")
 }
 
-// next_bridge_id — monotonic correlation id for a suspended agentic turn.
-// Combines boot-relative time with a per-process counter so two unknown-tool
-// suspensions in the same second still get distinct ids.
+// next_bridge_id — unique correlation id for a suspended agentic turn.
+// Uses uuid_v4() as the primary uniqueness guarantee so concurrent calls
+// (even in the same millisecond) cannot collide. The "mcp_bridge_seq"
+// counter is kept for human readability in logs/debugging but is no longer
+// relied on for uniqueness.
+//
+// TODO(reliability #6): state_get/state_set on "mcp_bridge_seq" is a
+// non-atomic read-modify-write — two concurrent calls can read the same
+// counter and produce the same counter suffix. This is now benign because
+// uuid_v4() provides collision-free uniqueness. A true counter fix would
+// require an atomic_increment() builtin in el_runtime.c.
 fn next_bridge_id() -> String {
     let prev: String = state_get("mcp_bridge_seq")
     let n: Int = if str_eq(prev, "") { 0 } else { str_to_int(prev) }
     let next: Int = n + 1
     state_set("mcp_bridge_seq", int_to_str(next))
-    return "br-" + int_to_str(time_now()) + "-" + int_to_str(next)
+    // uuid_v4() provides collision-free uniqueness; counter is decorative.
+    let uid: String = uuid_v4()
+    return "br-" + uid
 }
 
 fn handle_chat_agentic(body: String) -> String {
@@ -1055,7 +1240,7 @@ fn handle_chat_agentic(body: String) -> String {
     if str_eq(screen_action, "hard_bell") {
         safety_log_bell("hard", json_get(screen_result, "reason"), str_slice(message, 0, 80))
         return "{\"reply\":\"" + json_safe(safety_validate("", "hard_bell")) + "\",\"model\":\"\",\"agentic\":true,\"tools_used\":[]}"
-    }
+
 
     let req_model: String = json_get(body, "model")
     let model: String = if str_eq(req_model, "") { chat_default_model() } else { req_model }
@@ -1072,7 +1257,7 @@ fn handle_chat_agentic(body: String) -> String {
     let session_valid: Bool = if str_eq(req_session, "") {
         true
     } else {
-        session_exists(req_session)
+        !str_contains(session_get(req_session), "\"error\"")
     }
     if !session_valid {
         return "{\"error\":\"session not found\",\"session_id\":\"" + req_session + "\",\"reply\":\"\"}"
@@ -1116,12 +1301,30 @@ fn handle_chat_agentic(body: String) -> String {
 
     // Persist the exchange to session/global history for thread continuity on next turn.
     // Only save when the loop completed (reply present), not when tool_pending.
+    //
+    // Issue #9 (AGENTIC HISTORY NOT PERSISTED): the agentic path previously only saved
+    // history to in-process state (state_set), which is lost on restart. We now also call
+    // conv_history_persist() for the default session (hist_key == "conv_history") so agentic
+    // history survives restarts the same way non-agentic history does. Per-session histories
+    // (session_hist_<id>) are still in-process only — persisting all named sessions would
+    // require per-session engram labels, a larger change tracked separately.
     let reply_text: String = json_get(result, "reply")
     let discard_hist: Bool = if !str_eq(reply_text, "") {
         let updated: String = hist_append(agentic_hist, "user", message)
         let updated2: String = hist_append(updated, "assistant", reply_text)
-        let trimmed: String = if json_array_len(updated2) > 20 { hist_trim(updated2) } else { updated2 }
+        // Increased from 20 to 40 turns: consistent with handle_chat window expansion.
+        // Byte-cap: also trim if the blob exceeds 32KB, consistent with handle_chat.
+        let count_trimmed2: String = if json_array_len(updated2) > 40 { hist_trim(updated2) } else { updated2 }
+        let trimmed: String = if str_len(count_trimmed2) > 32768 {
+            hist_trim_to_byte_cap(count_trimmed2, 32768)
+        } else {
+            count_trimmed2
+        }
         state_set(hist_key, trimmed)
+        // Only persist the default global session to engram — named sessions are ephemeral.
+        if str_eq(hist_key, "conv_history") {
+            conv_history_persist(trimmed)
+        }
         true
     } else { false }
 
@@ -1152,6 +1355,14 @@ fn agentic_loop(session_id: String, model: String, safe_sys: String, tools_json:
     let iteration: Int = 0
     let keep_going: Bool = true
 
+    // Issue #9: agentic max_tokens configurable via NEURON_LLM_MAX_TOKENS env var.
+    // Default 4096 is marginal for long tool chains (8 iterations x 4096 tokens).
+    // Set to 8192+ for complex multi-step tasks.
+    // Note: llm_provider_request() in el_runtime.c also hardcodes 4096 for the
+    // llm_call_system() (non-agentic) path; that requires a C runtime change.
+    let max_tokens_env: String = env("NEURON_LLM_MAX_TOKENS")
+    let max_tokens_str: String = if str_eq(max_tokens_env, "") { "4096" } else { max_tokens_env }
+
     // Suspension state — captured at top level so it escapes the while body.
     let pending: Bool = false
     let pend_tool_id: String = ""
@@ -1160,7 +1371,7 @@ fn agentic_loop(session_id: String, model: String, safe_sys: String, tools_json:
 
     while keep_going && iteration < 8 {
         let req_body: String = "{\"model\":\"" + model + "\""
-            + ",\"max_tokens\":4096"
+            + ",\"max_tokens\":" + max_tokens_str
             + ",\"system\":\"" + safe_sys + "\""
             + ",\"tools\":" + tools_json
             + ",\"messages\":" + messages
@@ -1440,9 +1651,11 @@ fn handle_chat_as_soul(body: String) -> String {
 
     let raw_response: String = llm_call_system(model, system_prompt, eff_message)
 
+    // Issue #5: empty string catch — same rationale as handle_chat.
     let is_error: Bool = str_starts_with(raw_response, "{\"error\"")
         || str_starts_with(raw_response, "{\"type\":\"error\"")
         || str_contains(raw_response, "authentication_error")
+        || str_eq(raw_response, "")
     if is_error {
         return "{\"error\":\"llm unavailable\",\"response\":\"\",\"speaker_slug\":\"" + speaker + "\",\"model\":\"" + model + "\"}"
     }
@@ -1489,9 +1702,11 @@ fn handle_dharma_room_turn(body: String) -> String {
 
     let raw_response: String = llm_call_system(model, system_prompt, transcript)
 
+    // Issue #5: empty string catch — same rationale as handle_chat.
     let is_error: Bool = str_starts_with(raw_response, "{\"error\"")
         || str_starts_with(raw_response, "{\"type\":\"error\"")
         || str_contains(raw_response, "authentication_error")
+        || str_eq(raw_response, "")
     if is_error {
         return "{\"error\":\"llm unavailable\",\"response\":\"\",\"cgi_id\":\"" + cgi_id + "\"}"
     }
@@ -1505,13 +1720,19 @@ fn handle_dharma_room_turn(body: String) -> String {
     // engram_node(content, "episodic", ...) which wrongly put a TIER into the node_type
     // slot — that's why nodes showed node_type="episodic". Use the full, correct contract.)
     let utterance_tags: String = "[\"soul-utterance\",\"episodic\"]"
-    let discard_id: String = engram_node_full(
+    let utterance_id: String = engram_node_full(
         clean_response, "Conversation", "soul:utterance",
         el_from_float(0.6), el_from_float(0.6), el_from_float(0.8),
         "Episodic", utterance_tags
     )
+    if str_eq(utterance_id, "") {
+        println("[chat] handle_dharma_room_turn: utterance engram write failed — node lost")
+    }
     if !str_eq(snap_path, "") {
-        let discard_save: String = engram_save(snap_path)
+        let save_result: String = engram_save(snap_path)
+        if str_eq(save_result, "") {
+            println("[chat] handle_dharma_room_turn: engram_save failed for " + snap_path)
+        }
     }
 
     let safe_response: String = json_safe(clean_response)
@@ -1682,6 +1903,8 @@ fn auto_persist(req: String, resp: String) -> Void {
             "session_bell_signal:" + sess_id
         }
         state_set(signal_key, safe_summary)
+    if str_eq(conv_node_id, "") {
+        println("[chat] auto_persist: engram_node_full returned empty — conversation node lost (ts=" + ts_str + ")")
     }
 }
 

entrypoint.sh

@@ -24,19 +24,23 @@ ENGRAM_DATA_DIR="$ENGRAM_DATA_DIR" \
 
 ENGRAM_PID=$!
 
-# Wait for engram to become healthy (up to 30s)
+# Wait for engram to become healthy (up to 60s; GKE Autopilot cold starts can be slow)
 echo "[entrypoint] waiting for engram..."
 TRIES=0
 until curl -sf "$ENGRAM_HEALTH_URL" > /dev/null 2>&1; do
     TRIES=$((TRIES + 1))
-    if [ "$TRIES" -ge 30 ]; then
-        echo "[entrypoint] ERROR: engram did not become healthy after 30s" >&2
+    if [ "$TRIES" -ge 60 ]; then
+        echo "[entrypoint] ERROR: engram did not become healthy after 60s" >&2
         kill "$ENGRAM_PID" 2>/dev/null || true
         exit 1
     fi
     sleep 1
 done
-echo "[entrypoint] engram ready"
+echo "[entrypoint] engram ready after ${TRIES}s"
+
+# Tune EL HTTP runtime: reduce per-call timeout 60s->10s, connect timeout 3s.
+export EL_HTTP_TIMEOUT_MS="${EL_HTTP_TIMEOUT_MS:-10000}"
+export EL_HTTP_CONNECT_TIMEOUT_MS="${EL_HTTP_CONNECT_TIMEOUT_MS:-3000}"
 
 # Start soul — it takes over as PID 1's foreground process.
 # SOUL_ENGRAM_PATH must NOT be set; ENGRAM_URL triggers HTTP mode.

memory.el

@@ -35,18 +35,101 @@ fn mem_forget(node_id: String) -> Void {
     engram_forget(node_id)
 }
 
+// mem_consolidate — structural scan plus salience-evolution pass.
+//
+// Previously this only returned structural counts (scanned, total_nodes, total_edges)
+// with no salience updates. No node salience ever changed based on recall frequency
+// or time; foundational nodes decayed identically to ephemeral chat; frequently-recalled
+// nodes were never promoted. This made consolidation a no-op.
+//
+// New behavior:
+//   (a) Strengthen frequently-activated nodes: nodes in the top working-memory list
+//       (engram_wm_top_json) are strengthened — they have been recalled recently
+//       and deserve higher salience. Raises effective salience for nodes that prove
+//       relevant across multiple sessions.
+//   (b) Strengthen Canonical-tier nodes: identity and foundational nodes should not
+//       decay; each consolidation pass re-strengthens them so they resist the
+//       tier-aware decay curve without requiring active recall.
+//   (c) Structural counts are still returned for observability.
+//
+// Called by awareness_run() on the "consolidate" inbox action.
 fn mem_consolidate() -> String {
     let scanned: Int = engram_node_count()
-    let dummy: String = engram_scan_nodes_json(100, 0)
-    let total_nodes: Int = engram_node_count()
     let total_edges: Int = engram_edge_count()
+    let strengthened: Int = 0
+
+    // (a) Strengthen top working-memory nodes — recalled recently across sessions.
+    // Cap at 10 to keep consolidation fast.
+    let wm_top: String = engram_wm_top_json(10)
+    let wm_len: Int = json_array_len(wm_top)
+    let wi: Int = 0
+    while wi < wm_len {
+        let wm_node: String = json_array_get(wm_top, wi)
+        let wm_id: String = json_get(wm_node, "id")
+        if !str_eq(wm_id, "") {
+            engram_strengthen(wm_id)
+            let strengthened = strengthened + 1
+        }
+        let wi = wi + 1
+    }
+
+    // (b) Strengthen Canonical-tier nodes from a full paginated scan so they resist
+    // temporal decay. Canonical nodes encode foundational identity — they must not
+    // silently floor at 10. Page size 50, scanning until fewer than 50 nodes are
+    // returned (last page), so all Canonical nodes are reached even in large graphs.
+    // Without pagination, only the first 50 nodes in the graph were eligible; any
+    // Canonical node at index 50+ was silently excluded from the boost.
+    // Strengthening is skipped if the node's current salience is already at the
+    // runtime ceiling (represented as "1" by %g) to avoid monotonic unbounded growth.
+    // Canonical nodes with salience < 1.0 are strengthened each consolidation pass;
+    // once they reach the ceiling the runtime will no longer raise them further, so
+    // calling engram_strengthen at the ceiling is a no-op in the runtime anyway, but
+    // the explicit check makes the intent clear and avoids any runtime log noise.
+    let page_size: Int = 50
+    let scan_offset: Int = 0
+    let scan_done: Bool = false
+    while !scan_done {
+        let scan_result: String = engram_scan_nodes_json(page_size, scan_offset)
+        let scan_len: Int = json_array_len(scan_result)
+        if scan_len == 0 {
+            let scan_done = true
+        } else {
+            let si: Int = 0
+            while si < scan_len {
+                let s_node: String = json_array_get(scan_result, si)
+                let s_tier: String = json_get(s_node, "tier")
+                let s_id: String = json_get(s_node, "id")
+                let s_sal: String = json_get(s_node, "salience")
+                // Only strengthen if below the ceiling to prevent unbounded salience growth.
+                // engram serialises the ceiling as "1" (%g drops the decimal part when it
+                // is exactly zero). Any other value is below ceiling and should be boosted.
+                let at_ceiling: Bool = str_eq(s_sal, "1")
+                if str_eq(s_tier, "Canonical") && !str_eq(s_id, "") && !at_ceiling {
+                    engram_strengthen(s_id)
+                    let strengthened = strengthened + 1
+                }
+                let si = si + 1
+            }
+            let scan_offset = scan_offset + scan_len
+            // Fewer results than page_size means we've reached the last page.
+            if scan_len < page_size {
+                let scan_done = true
+            }
+        }
+    }
+
+    let total_nodes: Int = engram_node_count()
     return "{\"scanned\":" + int_to_str(scanned)
         + ",\"total_nodes\":" + int_to_str(total_nodes)
-        + ",\"total_edges\":" + int_to_str(total_edges) + "}"
+        + ",\"total_edges\":" + int_to_str(total_edges)
+        + ",\"strengthened\":" + int_to_str(strengthened) + "}"
 }
 
 fn mem_save(path: String) -> Void {
-    engram_save(path)
+    let save_result: String = engram_save(path)
+    if str_eq(save_result, "") {
+        println("[memory] mem_save: engram_save failed for " + path + " — snapshot may be incomplete")
+    }
 }
 
 fn mem_load(path: String) -> Void {
@@ -76,11 +159,14 @@ fn mem_boot_count_inc() -> Int {
     let next: Int = current + 1
     let content: String = "soul:boot_count:" + int_to_str(next)
     let tags: String = "[\"soul-meta\",\"boot-counter\"]"
-    let discard: String = engram_node_full(
+    let boot_node_id: String = engram_node_full(
         content, "Memory", "soul:boot_count",
         el_from_float(0.9), el_from_float(0.9), el_from_float(1.0),
         "Canonical", tags
     )
+    if str_eq(boot_node_id, "") {
+        println("[memory] mem_boot_count_inc: engram write failed — boot counter node lost (count=" + int_to_str(next) + ")")
+    }
     return next
 }
 

neuron-api.el

@@ -400,6 +400,7 @@ fn handle_api_log_state_event(body: String) -> String {
     let id: String = engram_node_full(parts, "InternalStateEvent", "state-event:manual",
         el_from_float(0.85), el_from_float(0.85), el_from_float(0.9),
         "Episodic", tags)
+    if !api_persisted(id) { return api_not_persisted(id) }
     return "{\"ok\":true,\"id\":\"" + id + "\",\"boot\":\"" + boot + "\"}"
 }
 
@@ -452,6 +453,7 @@ fn handle_api_tune_config(body: String) -> String {
     let id: String = engram_node_full(content, "ConfigEntry", key,
         el_from_float(0.85), el_from_float(0.85), el_from_float(0.9),
         "Canonical", tags)
+    if !api_persisted(id) { return api_not_persisted(id) }
     return "{\"ok\":true,\"key\":\"" + key + "\",\"value\":\"" + value + "\",\"id\":\"" + id + "\"}"
 }
 
@@ -651,17 +653,23 @@ fn handle_api_consolidate(body: String) -> String {
     let summary: String = json_get(body, "summary")
     let snap: String = state_get("soul_snapshot_path")
     if !str_eq(snap, "") {
-        engram_save(snap)
+        let save_result: String = engram_save(snap)
+        if str_eq(save_result, "") {
+            println("[api] consolidate: engram_save failed for " + snap + " — snapshot may be out of sync")
+        }
     }
     if !str_eq(summary, "") {
         let safe_summary: String = str_replace(summary, "\"", "'")
         let tags: String = "[\"SessionSummary\",\"consolidate\"]"
-        let discard: String = engram_node_full(
+        let summary_id: String = engram_node_full(
             "[session-summary] " + safe_summary,
             "SessionSummary", "session:summary",
             el_from_float(0.7), el_from_float(0.7), el_from_float(0.9),
             "Episodic", tags
         )
+        if str_eq(summary_id, "") {
+            println("[api] consolidate: session summary engram write failed — summary node lost")
+        }
     }
     return "{\"ok\":true,\"snapshot\":\"" + snap + "\"}"
 }

routes.el

@@ -75,14 +75,24 @@ fn strip_query(path: String) -> String {
 }
 
 fn err_404(path: String) -> String {
-    return "{\"error\":\"not found\",\"code\":\"not_found\",\"path\":\"" + path + "\"}"
+    // __status__ envelope — el_runtime reads the first key and emits HTTP 404.
+    // Issue #3: previously returned HTTP 200 with JSON error body.
+    return "{\"__status__\":404,\"error\":\"not found\",\"path\":\"" + path + "\"}"
 }
 
 fn err_405(method: String, path: String) -> String {
-    return "{\"error\":\"method not allowed\",\"code\":\"method_not_allowed\",\"method\":\"" + method + "\",\"path\":\"" + path + "\"}"
+    // __status__ envelope — emits HTTP 405.
+    // Issue #3: previously returned HTTP 200 with JSON error body.
+    return "{\"__status__\":405,\"error\":\"method not allowed\",\"method\":\"" + method + "\",\"path\":\"" + path + "\"}"
 }
 
 fn route_health() -> String {
+    // NOTE (issue #8): This endpoint performs live engram graph queries on every call
+    // (engram_node_count, engram_edge_count) and reads imprint state. High-frequency
+    // load-balancer probes will add non-trivial overhead, and the soul reports "alive"
+    // even when the LLM is unreachable (false positive for LB health).
+    // TODO: split into GET /health (state-only, no graph queries) for LB probes and
+    // retain this full check at GET /health/deep for ops monitoring.
     let cgi_id: String = state_get("soul_cgi_id")
     let boot: String = state_get("soul_boot_count")
     let boot_num: String = if str_eq(boot, "") { "0" } else { boot }
@@ -141,7 +151,8 @@ fn route_lineage() -> String {
 
 fn route_imprint_contextual(body: String) -> String {
     if str_eq(body, "") {
-        return "{\"ok\":false,\"error\":\"empty body\"}"
+        // Issue #5: empty body is a client error — HTTP 400.
+        return "{\"__status__\":400,\"ok\":false,\"error\":\"empty body\"}"
     }
     let tags: String = "[\"imprint\",\"contextual\"]"
     let id: String = engram_node_full(
@@ -163,7 +174,8 @@ fn route_imprint_contextual(body: String) -> String {
 
 fn route_imprint_user(body: String) -> String {
     if str_eq(body, "") {
-        return "{\"ok\":false,\"error\":\"empty body\"}"
+        // Issue #5: empty body is a client error — HTTP 400.
+        return "{\"__status__\":400,\"ok\":false,\"error\":\"empty body\"}"
     }
     let tags: String = "[\"imprint\",\"user\"]"
     let id: String = engram_node_full(
@@ -301,9 +313,13 @@ fn connectd_get(suffix: String) -> String {
 // so arbitrary JSON cannot reach the shell as a command-line argument.
 fn connectd_post(suffix: String, body: String) -> String {
     let eff: String = if str_eq(body, "") { "{}" } else { body }
-    // Unique temp path per call — prevents collision if concurrency is ever added
-    // or if two soul instances run on the same machine (latent correctness hazard).
-    let tmp: String = "/tmp/neuron-connectors-req-" + int_to_str(time_now()) + ".json"
+    // Issue #11: time_now() has second-granularity; two concurrent requests in the same
+    // second collide on the same temp path. Added a monotonic per-process sequence counter.
+    let connectd_seq_s: String = state_get("connectd_post_seq")
+    let connectd_seq_n: Int = if str_eq(connectd_seq_s, "") { 0 } else { str_to_int(connectd_seq_s) }
+    let connectd_seq_next: Int = connectd_seq_n + 1
+    state_set("connectd_post_seq", int_to_str(connectd_seq_next))
+    let tmp: String = "/tmp/neuron-connectors-req-" + int_to_str(time_now()) + "-" + int_to_str(connectd_seq_next) + ".json"
     fs_write(tmp, eff)
     let out: String = exec_capture("curl -s --max-time 20 -X POST http://127.0.0.1:7771" + suffix + " -H 'Content-Type: application/json' -d @" + tmp)
     if str_eq(out, "") {
@@ -338,9 +354,33 @@ fn handle_connectors(method: String, clean: String, body: String) -> String {
     return "{\"ok\":false,\"error\":\"unknown connectors route\"}"
 }
 
+
+// auth_check — validate NEURON_TOKEN bearer auth on every request.
+// Returns "" when authorized, or a JSON 401 error string when not.
+// /health and /lineage are public routes — always exempted.
+// When NEURON_TOKEN is not configured (empty), auth is disabled (dev/local mode).
+// Issue #4: previously no auth layer existed anywhere in the router.
+// Clients pass the token in the JSON body as "__auth".
+// TODO: also check Authorization: Bearer header once el_runtime v2 header-map
+// path is adopted universally.
+fn auth_check(clean: String, body: String) -> String {
+    if str_eq(clean, "/health") { return "" }
+    if str_eq(clean, "/lineage") { return "" }
+    let token: String = state_get("soul_token")
+    if str_eq(token, "") { return "" }
+    let auth_field: String = json_get(body, "__auth")
+    if str_eq(auth_field, token) { return "" }
+    return "{\"__status__\":401,\"error\":\"unauthorized\"}"
+}
+
 fn handle_request(method: String, path: String, body: String) -> String {
     let clean: String = strip_query(path)
 
+    // Issue #1/#2: EL has no exception/try-catch mechanism. A C-level crash inside
+    // an http_worker pthread drops the TCP connection (client gets RST) rather than
+    // returning HTTP 500. TODO: register a SIGSEGV/SIGBUS handler in el_runtime.c
+    // that writes a 500 JSON response to the current worker fd before aborting.
+
     // Rate limit check. Extract caller IP from REMOTE_ADDR env var (set by the
     // EL HTTP runtime for each request). Skip enforcement when empty so
     // loopback/internal callers are never blocked.
@@ -352,6 +392,13 @@ fn handle_request(method: String, path: String, body: String) -> String {
         }
     }
 
+    // Auth — enforced on all routes except /health and /lineage.
+    // Issue #4: previously no auth check existed anywhere in the router.
+    let auth_err: String = auth_check(clean, body)
+    if !str_eq(auth_err, "") {
+        return auth_err
+    }
+
     if str_eq(method, "POST") && str_eq(clean, "/dharma/recv") {
         return handle_dharma_recv(body)
     }
@@ -379,7 +426,8 @@ fn handle_request(method: String, path: String, body: String) -> String {
             let raw_msg: String = json_get(body, "message")
             let eff_msg: String = if str_eq(raw_msg, "") { body } else { raw_msg }
             if str_eq(eff_msg, "") {
-                return "{\"error\":\"message is required\",\"code\":\"missing_param\"}"
+                // Issue #5: missing required param — HTTP 400.
+                return "{\"__status__\":400,\"error\":\"message required\"}"
             }
             let agentic_flag: Bool = json_get_bool(body, "agentic")
             let reply: String = if agentic_flag {
@@ -523,9 +571,15 @@ fn handle_request(method: String, path: String, body: String) -> String {
             // responses are buffered and returned as a single JSON object. Streaming
             // would require runtime-level SSE support in el_runtime.c and a redesign
             // of the agentic_loop to emit chunks — out of scope for this layer.
+            // Issue #5: validate required params — return HTTP 400 when missing.
             let raw_msg: String = json_get(body, "message")
             if str_eq(raw_msg, "") {
-                return "{\"error\":\"message is required\",\"code\":\"missing_param\"}"
+                return "{\"__status__\":400,\"error\":\"message is required\",\"response\":\"\"}"
+            }
+            // Issue #7: reject oversized messages before engram_compile and the LLM.
+            // Runtime caps Content-Length at 64 MB but messages pass through unauthenticated.
+            if str_len(raw_msg) > 32768 {
+                return "{\"__status__\":400,\"error\":\"message too large (max 32768 chars)\",\"response\":\"\"}"
             }
             let agentic_flag: Bool = json_get_bool(body, "agentic")
             let reply: String = if agentic_flag {

safety.el

@@ -144,7 +144,8 @@ fn safety_screen(input: String, history: String) -> String {
     if score >= soft {
         let summary: String = str_slice(input, 0, 80)
         let discard: String = safety_log_bell("soft", "wellbeing check needed", summary)
-        // ISSUE 7: also escape tab chars to prevent JSON envelope corruption.
+        // ISSUE 7 fix: escape tab chars in addition to backslash/quote/newline/CR.
+        // A tab in user input corrupts the JSON envelope and causes json_get to misparse.
         let e1: String = str_replace(input, "\\", "\\\\")
         let e2: String = str_replace(e1, "\"", "\\\"")
         let e3: String = str_replace(e2, "\n", "\\n")
@@ -153,7 +154,7 @@ fn safety_screen(input: String, history: String) -> String {
         return "{\"action\":\"soft_bell\",\"reason\":\"wellbeing check needed\",\"content\":\"" + safe_input + "\"}"
     }
 
-    // ISSUE 7: also escape tab chars (see soft_bell branch above).
+    // ISSUE 7 fix: escape tab chars (see soft_bell branch above for rationale).
     let e1: String = str_replace(input, "\\", "\\\\")
     let e2: String = str_replace(e1, "\"", "\\\"")
     let e3: String = str_replace(e2, "\n", "\\n")
@@ -199,7 +200,10 @@ fn safety_validate(output: String, action: String) -> String {
 fn safety_log_bell(level: String, reason: String, input_summary: String) -> String {
     let content: String = "BELL:" + level + " | " + reason + " | summary:" + input_summary
     let tags: String = "[\"safety\",\"bell\",\"bell:" + level + "\"]"
-    // ISSUE 2: fallback log when engram write fails silently.
+    // ISSUE 2 fix: if engram_node_full returns empty the write silently failed.
+    // Emit a fallback println so the bell event leaves at least a log trace even
+    // when engram is degraded. This does not replace engram persistence -- it is a
+    // last-resort audit trail when the primary write cannot be confirmed.
     let node_id: String = engram_node_full(
         content,
         "BellEvent",
@@ -211,7 +215,7 @@ fn safety_log_bell(level: String, reason: String, input_summary: String) -> Stri
         tags
     )
     if str_eq(node_id, "") {
-        println("[safety] WARN: bell engram write failed -- " + content)
+        println("[safety] WARN: bell event engram write failed -- fallback log: " + content)
     }
     return ""
 }
@@ -244,9 +248,16 @@ fn safety_soft_phrases() -> String {
 }
 
 // ISSUE 5 TODO: phrase lists are rebuilt from JSON literals on every call.
-// json_array_len of malformed input returns 0, silently skipping all checks.
-// Caching requires language-level static const arrays -- not in current EL.
-// Migrate to const arrays when EL gains that feature.
+// safety_any_match and safety_count_match loop over json_array_get on every invocation.
+// A compiled/cached representation would reduce per-message overhead and also guard against
+// malformed phrase JSON (json_array_len of malformed input returns 0, silently skipping all checks).
+// Caching requires language-level static const arrays -- not available in current EL.
+// When EL gains module-level const arrays, migrate phrase lists to that form.
+//
+// ISSUE 5 TODO: phrase lists are rebuilt from JSON literals on every call to
+// safety_any_match / safety_count_match. json_array_len of a malformed string
+// returns 0, silently skipping all checks. Caching requires language-level static
+// const arrays (not available in current EL). Migrate when EL gains that feature.
 // ── Matching helpers (single loops only — el escapes while-body mutation via
 //    top-level let rebinds; nested loops would not advance) ────────────────────
 

soul.el

@@ -162,6 +162,56 @@ fn load_identity_context() -> Void {
             println("[soul] persona node loaded (" + int_to_str(str_len(p_content)) + " chars)")
         }
     }
+
+    // Cross-session affective context: query engram for recent distress/crisis signals
+    // at session start. Stored under soul_affective_context so the safety layer can
+    // detect when a user has been in distress across previous sessions.
+    // Recency guard: nodes older than 14 days (1,209,600 seconds) are skipped.
+    // Unified at 14 days with chat.el engram_compile and handle_chat affective checks
+    // so all three paths present consistent affective context. The previous 7-day
+    // (604800s) window was inconsistent with the 72h chat.el window, causing
+    // conflicting context: soul.el loaded a 5-day-old crisis node while chat.el
+    // did not include it on subsequent turns. Both now use 14 days.
+    // Results capped at 3 nodes, 200 chars each, to limit context inflation.
+    // TODO(recency): engram_search_json sorts by relevance, not timestamp. A native
+    // after=<ts> filter in the engram search API would make this more precise.
+    let affective_raw: String = engram_search_json("distress crisis upset hopeless bell BellEvent", 3)
+    let affective_ok: Bool = !str_eq(affective_raw, "") && !str_eq(affective_raw, "[]")
+    if affective_ok {
+        let ts_now: Int = time_now()
+        let ts_cutoff: Int = ts_now - 1209600
+        let aff_total: Int = json_array_len(affective_raw)
+        let aff_ctx: String = ""
+        let ai: Int = 0
+        while ai < aff_total {
+            let aff_node: String = json_array_get(affective_raw, ai)
+            let aff_content: String = json_get(aff_node, "content")
+            // Use created_at (the standard engram node timestamp field), consistent
+            // with handle_chat which reads created_at / updated_at. The previous
+            // field name "ts" is not a standard engram field: it was present in some
+            // BellEvent content payloads but absent from standard engram node JSON,
+            // causing json_get to return "" and the fallback to ts_now — meaning ALL
+            // nodes with a missing "ts" field appeared recent, over-including stale
+            // content. With the 14-day window, this amplification was significant.
+            // Fix: read created_at first, fall back to updated_at, then default to 0
+            // (same as handle_chat). A ts of 0 always fails the cutoff check, so nodes
+            // missing both timestamp fields are conservatively excluded rather than
+            // blindly included.
+            let aff_ca: String = json_get(aff_node, "created_at")
+            let aff_ts_str: String = if str_eq(aff_ca, "") { json_get(aff_node, "updated_at") } else { aff_ca }
+            let aff_ts: Int = if str_eq(aff_ts_str, "") { 0 } else { str_to_int(aff_ts_str) }
+            let is_recent: Bool = aff_ts >= ts_cutoff
+            let snip: String = if str_len(aff_content) > 200 { str_slice(aff_content, 0, 200) } else { aff_content }
+            let aff_ctx = if is_recent && !str_eq(snip, "") {
+                if str_eq(aff_ctx, "") { snip } else { aff_ctx + "\n" + snip }
+            } else { aff_ctx }
+            let ai = ai + 1
+        }
+        if !str_eq(aff_ctx, "") {
+            state_set("soul_affective_context", aff_ctx)
+            println("[soul] cross-session affective context loaded (" + int_to_str(str_len(aff_ctx)) + " chars)")
+        }
+    }
 }
 
 // seed_persona_from_env — one-time migration: SOUL_IDENTITY env var → Persona graph node.
@@ -208,8 +258,13 @@ fn seed_persona_from_env() -> Void {
         let h: Map = {}
         map_set(h, "Content-Type", "application/json")
         let resp: String = http_post_with_headers(engram_url + "/api/nodes", body, h)
-        if str_contains(resp, "\"error\"") {
+        // Check for empty response (timeout/network error), explicit error, or missing id.
+        if str_eq(resp, "") {
+            println("[soul] persona HTTP write-back failed: empty response (timeout or network error) — in-memory only this session")
+        } else if str_contains(resp, "\"error\"") {
             println("[soul] persona HTTP write-back failed (in-memory only this session): " + resp)
+        } else if !str_contains(resp, "\"id\"") {
+            println("[soul] persona HTTP write-back: unexpected response (no id field) — in-memory only this session: " + resp)
         } else {
             println("[soul] persona persisted to HTTP engram at " + engram_url)
         }
@@ -242,11 +297,14 @@ fn emit_session_start_event() -> Void {
         + ",\"ts\":" + int_to_str(ts) + "}"
 
     let tags: String = "[\"internal-state\",\"session-start\",\"InternalStateEvent\"]"
-    let discard: String = engram_node_full(
+    let session_event_id: String = engram_node_full(
         payload, "InternalStateEvent", "session-start",
         el_from_float(0.9), el_from_float(0.9), el_from_float(1.0),
         "Episodic", tags
     )
+    if str_eq(session_event_id, "") {
+        println("[soul] emit_session_start_event: engram write failed — session-start event lost")
+    }
     println("[soul] session-start event logged (boot=" + boot_num + " nodes=" + int_to_str(node_ct) + " edges=" + int_to_str(edge_ct) + ")")
 }
 
@@ -254,6 +312,9 @@ fn emit_session_start_event() -> Void {
 // L0 (core) → L1 (safety screen) → L2a (continuity + behavioral profiling) → L2b (mission alignment) → L3 (imprint) → L1 (safety validate)
 // Internal cognition (heartbeat, proactive, memory ops) bypasses layers — use one_cycle directly.
 fn layered_cycle(raw_input: String) -> String {
+    // conv_history key must match chat.el (conv_history, not conversation_history).
+    // Mismatch caused safety_score_distress_history() to always receive "" - the
+    // history-amplification path in safety_threat_score was permanently dead.
     let history: String = state_get("conv_history")
     let session_id: String = state_get("current_session_id")
 
@@ -261,8 +322,9 @@ fn layered_cycle(raw_input: String) -> String {
     let screen_result: String = safety_screen(raw_input, history)
     let screen_action: String = json_get(screen_result, "action")
 
-    // ISSUE 4: safe-mode guard. If safety_screen returned an invalid/empty action
-    // (engram failure or internal error), refuse rather than pass unscreened input.
+    // ISSUE 4: safe-mode guard -- if safety_screen returned invalid/empty action,
+    // refuse the turn rather than silently passing unscreened input to upper layers.
+    // Valid actions: "hard_bell", "soft_bell", "pass". Anything else = corrupt envelope.
     let valid_action: Bool = str_eq(screen_action, "hard_bell")
         || str_eq(screen_action, "soft_bell")
         || str_eq(screen_action, "pass")
@@ -277,8 +339,8 @@ fn layered_cycle(raw_input: String) -> String {
     // history where they could leak context to subsequent turns. They are persisted
     // separately by safety_log_bell() into the Episodic tier with restricted labels.
     //
-    // ISSUE 6: safety_log_bell already called inside safety_screen (line 140).
-    // Do NOT call it again here -- that would double-log every hard bell.
+    // ISSUE 6: safety_log_bell for hard bells is already called INSIDE safety_screen
+    // (safety.el line 140). Do NOT call it again here -- double-log avoided.
     //
     // safety_validate second param: when screen_action is "hard_bell", safety_validate
     // receives the sentinel string "hard_bell" (not a normal screen action). The safety
@@ -320,13 +382,13 @@ fn layered_cycle(raw_input: String) -> String {
         json_get(steward_result, "redirect_to")
     }
 
-    // ISSUE 1: pre-LLM bell augmentation for layered_cycle path.
-    // safety_augment_system appends soft/hard directive to system prompt when bell fires,
-    // ensuring LLM processes message WITH the safety directive -- not just post-output gate.
-    // Stored in state as "layered_cycle_safety_system_addendum" for imprint_respond to use.
-    // TODO: wire directly when imprint_respond gains system_override param (imprint.el change).
-    // ISSUE 3 TODO: no semantic crisis detection. Keyword-only means signals that evade
-    // the phrase list pass with zero augmentation. Semantic layer = separate decision.
+    // ISSUE 1: apply pre-LLM bell augmentation on layered_cycle path.
+    // safety_augment_system injects soft/hard directive into system prompt before LLM call.
+    // Stored in state so imprint_respond can consume it.
+    // TODO: wire directly into imprint_respond when it accepts a system_override param.
+    // ISSUE 3 TODO: no semantic/embedding crisis detection. Keyword-only means signals
+    // evading the phrase list pass through with zero augmentation. Semantic layer is a
+    // separate architectural decision requiring embedding inference on every message.
     let augmented_addendum: String = safety_augment_system("", raw_input)
     state_set("layered_cycle_safety_system_addendum", augmented_addendum)
 
@@ -369,12 +431,29 @@ let snapshot_usable: Bool = local_node_count > 50
 
 if using_http_engram && !snapshot_usable {
     // First boot or empty/corrupt snapshot: seed from HTTP Engram.
+    // Retry up to 3 times (2s sleep between attempts) to guard against a
+    // transient network hiccup right after entrypoint.sh health check passes.
+    // An empty nodes response silently loads a zero-node graph; validate first.
+    // TODO(reliability): replace sleep_ms retry with non-blocking backoff.
     println("[soul] engram -> HTTP " + engram_url_raw + " (no local snapshot, first boot)")
-    let nodes_json: String = http_get(engram_url_raw + "/api/nodes?limit=10000")
-    let edges_json: String = http_get(engram_url_raw + "/api/edges")
-    let nodes_part: String = if str_eq(nodes_json, "") { "[]" } else { nodes_json }
-    let edges_part: String = if str_eq(edges_json, "") { "[]" } else { edges_json }
-    let snapshot_data: String = "{\"nodes\":" + nodes_part + ",\"edges\":" + edges_part + "}"
+    let fetch_attempt: Int = 0
+    while fetch_attempt < 3 {
+        let fetch_attempt = fetch_attempt + 1
+        let n: String = http_get(engram_url_raw + "/api/nodes?limit=10000")
+        let e: String = http_get(engram_url_raw + "/api/edges")
+        let nodes_ok: Bool = !str_eq(n, "") && str_starts_with(n, "[") && str_len(n) > 2
+        if nodes_ok {
+            state_set("_boot_nodes_json", n)
+            state_set("_boot_edges_json", e)
+            let fetch_attempt = 3
+        } else {
+            println("[soul] boot HTTP fetch attempt " + int_to_str(fetch_attempt) + " failed --- retrying in 2s")
+            sleep_ms(2000)
+        }
+    }
+    let nodes_json: String = state_get("_boot_nodes_json")
+    let edges_json: String = state_get("_boot_edges_json")
+        let snapshot_data: String = "{\"nodes\":" + nodes_part + ",\"edges\":" + edges_part + "}"
     let tmp_path: String = "/tmp/soul-engram-" + soul_cgi_id + ".json"
     fs_write(tmp_path, snapshot_data)
     engram_load(tmp_path)