Fix dict iteration crash in neuro_foundation + harden QB spec workflow

neuro_foundation.py: snapshot self.synapses before iteration in step()
and _prune_synapses() — concurrent writes were causing RuntimeError on
dictionary changed size during iteration.

system_prompt.py: Step 1 now explicitly blocks Step 2 (no exceptions);
Step 2 grep template adds --exclude-dir=venv --exclude-dir=.git to
prevent 60s timeout scanning venv/. Both issues observed in QB #126 run.

app.py: defensive list() copies for history/pending_proposals state.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app.py

@@ -341,8 +341,8 @@ def _build_api_messages(history: list, system_prompt: str) -> list:
 # ---------------------------------------------------------------------------
 
 def agent_loop(message: str, history: list, pending_proposals: list, uploaded_file) -> tuple:
-    safe_hist = history or []
-    safe_props = pending_proposals or []
+    safe_hist = list(history or [])
+    safe_props = list(pending_proposals or [])
 
     if not message.strip() and uploaded_file is None:
         return (safe_hist, "", safe_props, _format_gate_choices(safe_props),

neuro_foundation.py

@@ -1893,7 +1893,7 @@ class Graph:
         if self.config.get("three_factor_enabled", False):
             trace_tau = self.config["eligibility_trace_tau"]
             trace_decay = math.exp(-1.0 / trace_tau) if trace_tau > 0 else 0.0
-            for syn in self.synapses.values():
+            for syn in list(self.synapses.values()):
                 if abs(syn.eligibility_trace) > 1e-12:
                     syn.eligibility_trace *= trace_decay
 
@@ -2757,7 +2757,7 @@ class Graph:
         initial_w = self.config["initial_sprouting_weight"]
 
         to_prune: List[str] = []
-        for sid, syn in self.synapses.items():
+        for sid, syn in list(self.synapses.items()):
             age = self.timestep - syn.creation_time
 
             # Weight-based pruning

system_prompt.py

@@ -1,4 +1,10 @@
 # ---- Changelog ----
+# [2026-04-17] Claude (Sonnet 4.6) — Harden spec workflow: Step 1 blocks Step 2, venv exclusion
+# What: Step 1 now explicitly states "do this before Step 2, no exceptions"; added venv/git
+#       exclusion pattern to Step 2 grep template. Both from QB #126 test run observation.
+# Why:  QB skipped read_file (Step 1) and jumped to grep (Step 2), missing line number drift.
+#       grep also timed out scanning venv/ — 60s limit hit on every broad search.
+# How:  Reworded Step 1 lead-in; added --exclude-dir=venv --exclude-dir=.git to Step 2 example.
 # [2026-04-16] Claude (Sonnet 4.6) — Add WorkBlockSpec generation section
 #   What: _build_spec_generation_section() added; included in build_system_prompt().
 #   Why:  Teaching QB to generate its own specs. Section gives the JSON schema,
@@ -108,14 +114,16 @@ When asked to generate a spec for a code change, follow this workflow exactly.
 Do not skip steps. Do not draft the spec before completing Steps 1 and 2.
 
 ### Step 1 — Verify current code state
-Use read_file on every target file in the task description.
-- Confirm the described problem still exists in the current code
-- Note actual line numbers — punchlist descriptions drift as files change
-- Use shell_execute with `grep -c 'pattern' file` to count exact occurrences
+**Do this before Step 2. No exceptions.**
+Use read_file on every target file named in the task description.
+- Read the actual file. Do not assume the punchlist line numbers are correct — they drift as files change.
+- Identify where the described problem actually lives in the current code.
+- Use shell_execute with `grep -c 'pattern' file` to count exact occurrences.
 - If the problem no longer exists, report that and stop. Do not write a spec for a closed item.
 
 ### Step 2 — Check callers
 For every function or method being modified, grep the full repo for callers.
+Always exclude venv and generated directories: `grep -r 'pattern' . --include='*.py' --exclude-dir=venv --exclude-dir=.git`
 The scope of a change includes every call site. A spec that fixes the function
 but leaves callers using the old API is broken. Find them all before drafting.