Fix four review findings: busy release, poison recovery, core.md errors, chat loop

Implemented-By: OpenCode session (model recorded in docs/implementer-log.md)

crates/loopd/tests/baseline.rs

@@ -232,3 +232,28 @@ fn replay_of_a_prefix_is_a_prefix() {
         assert_eq!(whole[..part.len()], part[..], "prefix of {n} records");
     }
 }
+
+/// A core memory file that exists but cannot be read is an error, not silently absent: the owner
+/// would otherwise get a session without the memory they curated, and no sign of it.
+#[test]
+fn an_unreadable_core_memory_file_is_an_error() {
+    use std::os::unix::fs::PermissionsExt;
+    if running_as_root() {
+        return; // root can read anything; the check is meaningless there
+    }
+    let home = Home::new();
+    let cfg = home.config(Path::new("/tmp/unused.sock"));
+    home.write("memory/core.md", "secret memory\n");
+    let core = home.dir.join("memory/core.md");
+    std::fs::set_permissions(&core, std::fs::Permissions::from_mode(0o000)).unwrap();
+    let result = Baseline::assemble(&cfg, &Registry::m2b());
+    std::fs::set_permissions(&core, std::fs::Permissions::from_mode(0o644)).unwrap();
+    let e = result.expect_err("an unreadable core.md must not be ignored");
+    assert!(e.to_string().contains("core.md"), "{e}");
+}
+
+fn running_as_root() -> bool {
+    std::fs::read_to_string("/proc/self/status")
+        .map(|s| s.lines().any(|l| l.starts_with("Uid:\t0\t")))
+        .unwrap_or(false)
+}