fix(safety): KI-095 — 5 defensive guards against profile-field clearing

Closes audit holes found post-KI-094:
1. main.py /api/profile — reject empty-string / empty-list overwrites
2. needs_finder.py record_answer — defer asked.append until setattr succeeds
3. fact_find_brain.py greedy fallback — comment direct-setattr scope reason
4. session_state.py disk rehydrate — log dropped schema-drift keys
5. main.py /reset — require explicit confirm=true to wipe session

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/fact_find_brain.py

@@ -749,7 +749,10 @@ def _canonical_fallback(session, user_text: str, *, reason: str) -> FactFindOutc
                 if val is None:
                     continue
                 captured[q_obj.field] = val
-                setattr(profile, q_obj.field, val)
+                # KI-095 — route through session.update_profile_field for
+                # consistency with the rest of the codebase (centralised
+                # write + flush); val is guarded non-None just above.
+                session.update_profile_field(q_obj.field, val)
                 if slot_id not in profile.asked:
                     profile.asked.append(slot_id)
         except Exception as e:

backend/main.py

@@ -569,6 +569,7 @@ class ProfileUpdateRequest(BaseModel):
 class SessionResetRequest(BaseModel):
     session_id: str
     drop_profile: bool = False  # True = nuke session entirely; False = clear chat only
+    confirm: bool = False  # KI-095 — must be True when drop_profile=True; guards accidental wipes
 
 
 class SessionResetResponse(BaseModel):
@@ -593,6 +594,10 @@ async def session_reset(req: SessionResetRequest):
     cleared = False
     new_sid: Optional[str] = None
     if req.drop_profile:
+        # KI-095 — require explicit confirm=True so a misclick or replayed
+        # request cannot wipe a populated session by accident.
+        if not req.confirm:
+            raise HTTPException(status_code=400, detail="confirm=true required to drop session")
         cleared = reset_session(req.session_id)
         new_sid = uuid.uuid4().hex[:12]
     return SessionResetResponse(ok=True, session_id=new_sid, cleared_state=cleared)
@@ -623,8 +628,10 @@ async def profile_update(req: ProfileUpdateRequest):
         "health_conditions", "budget_band",
     ):
         v = getattr(req, field_name, None)
-        if v is not None:
-            setattr(sess.profile, field_name, v)
+        if v in (None, "", []):
+            # KI-095 — never clobber a filled field with empty input from the client
+            continue
+        setattr(sess.profile, field_name, v)
 
     # KI-077 — if name is set, also persist to the named-profile store so a
     # returning visitor's profile is recoverable across sessions.

backend/needs_finder.py

@@ -205,7 +205,6 @@ def record_answer(profile: Profile, question_id: str, raw_answer: str) -> Profil
     q = next((x for x in GRAPH if x.id == question_id), None)
     if q is None:
         return profile
-    profile.asked.append(question_id)
     value: Any = raw_answer
     if q.parser:
         try:
@@ -214,6 +213,9 @@ def record_answer(profile: Profile, question_id: str, raw_answer: str) -> Profil
             value = None
     if value is not None and value != "":
         setattr(profile, q.field, value)
+        # KI-095 — only mark slot asked once setattr succeeds, so a parse
+        # failure doesn't leave the slot in an asked-but-empty desync state.
+        profile.asked.append(question_id)
     return profile
 
 

backend/session_state.py

@@ -104,12 +104,20 @@ def _load_from_disk(session_id: str) -> Optional[SessionState]:
         return None
     try:
         raw = json.loads(target.read_text())
-        prof_dict = raw.get("profile", {}) or {}
+        raw_profile_dict = raw.get("profile", {}) or {}
         # Profile may have new fields added since this file was written —
         # filter to only what the current Profile dataclass accepts so we
         # never crash on schema drift.
         valid_fields = {f for f in Profile.__dataclass_fields__.keys()}
-        prof_dict = {k: v for k, v in prof_dict.items() if k in valid_fields}
+        dropped = set(raw_profile_dict.keys()) - valid_fields
+        if dropped:
+            # KI-095 — log schema-drift drops so silent data loss is visible.
+            import logging
+            logging.warning(
+                "session_state load_from_disk dropped %d unknown profile keys for %s: %s",
+                len(dropped), session_id, sorted(dropped),
+            )
+        prof_dict = {k: v for k, v in raw_profile_dict.items() if k in valid_fields}
         return SessionState(
             session_id=raw["session_id"],
             profile=Profile(**prof_dict),