Fix four review findings: busy release, poison recovery, core.md errors, chat loop

Implemented-By: OpenCode session (model recorded in docs/implementer-log.md)

crates/loopd/src/baseline.rs

@@ -47,12 +47,20 @@ impl Baseline {
         let mut system = system.trim_end().to_string();
 
         let core = cfg.paths.home.join("memory/core.md");
-        if let Ok(text) = std::fs::read_to_string(&core) {
-            let trimmed = text.trim();
-            if !trimmed.is_empty() {
-                system.push_str("\n\n");
-                system.push_str(trimmed);
+        match std::fs::read_to_string(&core) {
+            Ok(text) => {
+                let trimmed = text.trim();
+                if !trimmed.is_empty() {
+                    system.push_str("\n\n");
+                    system.push_str(trimmed);
+                }
             }
+            // A missing file is fine; an unreadable one is reported so the owner is not given a
+            // session without the memory they curated and no sign of it.
+            Err(e) if e.kind() != std::io::ErrorKind::NotFound => {
+                return Err(BaselineError::Read(core.clone(), e));
+            }
+            Err(_) => {}
         }
 
         Ok(Baseline {

crates/loopd/src/channel.rs

@@ -1,6 +1,6 @@
 //! The channel server: one turn per connection over the M1 frame protocol. A session runs one
 //! turn at a time; the busy set keeps a second turn on the same session from starting until the
-//! first finishes, and is released before the final frame so a client can send the next turn the
+//! first finishes, and is released before every final frame so a client can send the next turn the
 //! moment it reads the last one.
 
 use std::collections::HashSet;
@@ -54,9 +54,8 @@ struct Held<'a> {
 
 impl Drop for Held<'_> {
     fn drop(&mut self) {
-        if let Ok(mut busy) = self.ctx.busy.lock() {
-            busy.remove(&self.id);
-        }
+        let mut busy = self.ctx.busy.lock().unwrap_or_else(|p| p.into_inner());
+        busy.remove(&self.id);
     }
 }
 
@@ -132,6 +131,7 @@ pub fn handle(stream: UnixStream, ctx: Arc<Context>) {
         match Session::open(&ctx.cfg.paths.home, turn.session.clone()) {
             Ok(session) => session,
             Err(e) => {
+                drop(held);
                 let _ = write_frame(
                     &mut stream,
                     &error_frame(session_code(&e), request.id, e.to_string()),
@@ -143,6 +143,7 @@ pub fn handle(stream: UnixStream, ctx: Arc<Context>) {
         let baseline = match Baseline::assemble(&ctx.cfg, &ctx.registry) {
             Ok(baseline) => baseline,
             Err(e) => {
+                drop(held);
                 let _ = write_frame(
                     &mut stream,
                     &error_frame(ErrorCode::Internal, request.id, e.to_string()),
@@ -158,6 +159,7 @@ pub fn handle(stream: UnixStream, ctx: Arc<Context>) {
         ) {
             Ok(session) => session,
             Err(e) => {
+                drop(held);
                 let _ = write_frame(
                     &mut stream,
                     &error_frame(session_code(&e), request.id, e.to_string()),

crates/loopd/tests/baseline.rs

@@ -232,3 +232,28 @@ fn replay_of_a_prefix_is_a_prefix() {
         assert_eq!(whole[..part.len()], part[..], "prefix of {n} records");
     }
 }
+
+/// A core memory file that exists but cannot be read is an error, not silently absent: the owner
+/// would otherwise get a session without the memory they curated, and no sign of it.
+#[test]
+fn an_unreadable_core_memory_file_is_an_error() {
+    use std::os::unix::fs::PermissionsExt;
+    if running_as_root() {
+        return; // root can read anything; the check is meaningless there
+    }
+    let home = Home::new();
+    let cfg = home.config(Path::new("/tmp/unused.sock"));
+    home.write("memory/core.md", "secret memory\n");
+    let core = home.dir.join("memory/core.md");
+    std::fs::set_permissions(&core, std::fs::Permissions::from_mode(0o000)).unwrap();
+    let result = Baseline::assemble(&cfg, &Registry::m2b());
+    std::fs::set_permissions(&core, std::fs::Permissions::from_mode(0o644)).unwrap();
+    let e = result.expect_err("an unreadable core.md must not be ignored");
+    assert!(e.to_string().contains("core.md"), "{e}");
+}
+
+fn running_as_root() -> bool {
+    std::fs::read_to_string("/proc/self/status")
+        .map(|s| s.lines().any(|l| l.starts_with("Uid:\t0\t")))
+        .unwrap_or(false)
+}