Correctness and disclosure fixes (review, area 2)

[adamjohnwright]

These come from the max-level review of the chat flow. Each one was reproduced by the reviewer.

Finding	Fix	Checked by
Directive escaping missed colons after non-alphanumerics: 1,206 of Release 97's 25,286 colon names still broke, e.g. "(ACTA2,ACTG2):ATP"	Escape every colon followed by a letter, outside code	Same parser chain (unified + remark-gfm + remark-directive) over all 25,286 names: 0 broken in prose, link labels and table cells. URLs, times and code are untouched.
The web-search guard on analysis threads was a browser-session flag. A late reconnect or a restart lost it, and Tavily came back on.	The seeded turn is marked; AgentGraph.thread_holds_analysis reads the thread's own history	Marker test; thread_holds_analysis test
A failed model call sent nothing, because Chainlit swallows exceptions from on_message	Catch, log, and tell the reader	—
PrefixedS3StorageClient re-prefixed stored keys (P/P/...). Resumed attachments broke, and deleted files stayed in S3.	Prefix only once	Storage test, sabotaged
The per-solve fallback key trusted X-Forwarded-For, which the client controls	CF-Connecting-IP, then REMOTE_ADDR	—
Importing chainlit loads the repo's real .env into the test process	CHAINLIT_ENV_FILE points at nothing in conftest	The suite passes; this was found because a secrets test failed only in the full run

./checks.sh passes.

🤖 Generated with Claude Code