get_app_storage_path() previously built app storage paths directly from state.journal_root, which defaults to an empty string before convey boots and could silently redirect writes into the current working directory. This change falls back to think.utils.get_journal() when state.journal_root is empty and raises RuntimeError when the resolved root is not absolute, so that failure happens loudly at the shared helper every app uses. Tests cover state-backed paths, get_journal() fallback, the non-absolute-root failure, and invalid app-name rejection. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>