The refusals in the package comment are the best part of this PR, and they are enforced rather than described. No timer, no IPC method, no web route, no fetch of code from anywhere. Snapshotting before the build, with the reason spelled out, is the non-obvious ordering and it is the correct one. The preflight health check is right, and for the reason given. Without a baseline, a failed update and an already broken box are the same picture. context.WithoutCancel around the rollback is the detail that makes a Ctrl-C during the health wait safe. Copies rather than hardlinks or a git stash, re-hashed on the way back out. A restore is checked, not hoped for.
The refusals are the best part of this PR and they are refusals in code, not in
The core change is right and the reasoning in the keywrap.go header is the clearest statement of the old bug I have read. Three details earn their keep. secretLen = 32 as a structural refusal, so a 77-byte COSE public key cannot be passed here again by accident. The magic authenticated as GCM additional data, so a v2 blob cannot be stripped and re-read as v1. Replacing the hand-rolled HKDF that keyed expand with the salt instead of the PRK. The daemonLock.st handoff is a separate real bug caught in passing. A cold-started daemon never called store.Close. Every write of that session was lost on the next boot, silently.
Scan(ctx) taking no target is the correct API, and it is what makes the rest of the bounds hold. There is no exported path from an utterance to a range, so the prompt-injection story is closed by shape rather than by validation. Rejecting a non-private prefix and anything wider than a /22 at config load, in netscan.Validate, means the daemon cannot be talked into a scan it would not have done at boot. TCP-connect plus an ARP-table read, with no raw sockets and no root, is the right cost for the answer. The Russian count inflection in hostWord is correct including the teens.
One renderer for the voice reply and the page is the right structure. The reason string is what makes the ranking auditable instead of a black box. Refusing to ask the model which task matters, on the same grounds as the counted behaviour profile, is consistent and correct. Blanking a candidate's reason so her reading of a mail is never shown as his priority is a good detail. dayDelta in whole days rather than hours is right.
Encoding a device as an allowlist row with cmd = ["smarthome", "<entity_id>", "<service>"] is the right move. It reuses the enable gate, the confirm turn and tool.Matcher without touching any of them, exactly as MCP did. Dropping the spoken args in the Exec branch is the load-bearing detail. The router picks a row and never composes a target. A misheard number cannot become a different lamp. Leaving set_temperature and set_brightness out of the controllable table for the same reason is consistent. The block ships "enabled": false.
Half-duplex is the right fix and the reasoning holds. With no echo canceller, muting capture is the only honest option. Barge-in has to be off by default because the threshold is a property of the room. Putting aplay behind a player interface makes both halves testable. The gen counter in aplayPlayer closes a real race, where a finishing playback clears the flag of the one that replaced it. TestSessionEchoLevelAudioNeverBargesIn is the test that matters most and it is there.
The shape of internal/media is the good part. Sidecars instead of another
The credential split holds end to end. The password is read from a file, trimmed and checked for empty. It is never logged, and never put on a struct that outlives the call. mailIngester is a one-method interface, so the daemon's whole reach into core is visibly IngestMail and nothing else. The seen-state being an optimisation rather than a correctness requirement, with CaptureTask dedupe as the real guard, is the right way round. Atomic rename at 0600 for a file of message ids is the correct paranoia level.
Adding no eighth intent is the right call. Tying it to the prompt-parity contract in the header comment is the argument that makes it stick. The candidate status earns its keep. A derived task is named as unconfirmed in the spoken list and in the page. Mail can never quietly become work he owns. The partial unique index over live rows only is the correct shape for a recurring errand. NormalizeTaskText refusing to stem is the right kind of shallow.
Reviewing 927e46b only. The extra commit on this branch is 7f42cc7. It answers your comments on 50, 52, 53, 54, 59 and 61. Not part of this PR.
Kill-then-load rather than blue/green is the right call for this box, and the file comment argues it instead of asserting it. One 1.7B fully offloaded to a Vega iGPU leaves no room for a second copy. The "keep the old one warm" design would OOM the laptop. The new server is probed for its own model identity before it is published, and that identity is reported instead of an echo of the request. A mislabelled gguf shows up on the page, not in a week of bad replies. launch staying nil in NewLLMPhraserAt so Swap refuses a server it did not start is the detail that keeps the eval harness safe. The allowlist is exact paths a human typed. cfg.Phraser.ModelPath is always included, so the way back never depends on remembering to list it.
The bound is real and it is structural, not a promise in a comment. Extractor holds no store and no writer, so it cannot persist anything. mailIntake.ingest hardcodes store.TaskCandidate and calls only CaptureTask, so no fact, reminder or nudge is reachable from a parsed mail. The double gate is the right shape too: no email block or no LLMPhraser leaves IngestMailFn nil, and MethodIngestMail then answers ErrUnknownMethod rather than succeeding quietly.
Synthesising the fixtures instead of recording them is the right trade. Nothing of his voice is committed. The WAVs are regenerable from the script plus a voice model. The nginx note in gen-stt-fixtures.sh shows the artefact was hit and worked around, not guessed at. TestGoldenFixturesAreCanonical running the fixtures through gateReason before the model test uses them is the check that stops a silent-fixture false pass.