Merge branch 'fix/g07' into fix/integrated

# Conflicts:
#	internal/ipc/api.go
#	internal/ipc/client.go
#	internal/llm/client.go

internal/config/config.go

@@ -117,10 +117,14 @@ type Config struct {
 	// the update capability does not exist, which is the state to leave it in
 	// unless the operator has read internal/update's package comment.
 	//
-	// mavend never reads this block: the daemon does not import internal/update
-	// and cannot update itself. It lives here because cmd/mavupdate — a CLI the
-	// owner runs on the host, the only trigger there is — reads the same config
-	// file to find the socket it health-checks.
+	// mavend never acts on this block: it constructs no Updater and cannot
+	// update itself. Validate below is the one thing the daemon does with it, so
+	// a broken update config is caught at startup instead of on the night it is
+	// needed. That validation is also why internal/update is linked into mavend
+	// at all — linked, with no caller, which is the property that matters. The
+	// block lives here because cmd/mavupdate — a CLI the owner runs on the host,
+	// the only trigger there is — reads the same config file to find the socket
+	// it health-checks.
 	Update *update.Config `json:"update,omitempty"`
 
 	// Voice — the client↔core surface + the stt/tts modules the daemon
@@ -945,8 +949,13 @@ type CrawlConfig struct {
 	Interval Duration `json:"interval,omitempty"`
 
 	// AllowHosts — when set, the ONLY hosts the crawler may reach (subdomains
-	// included). Watched pages' own hosts are added automatically. Setting this
-	// is how "she may read the arch wiki and nothing else" is expressed.
+	// included). Setting this is how "she may read the arch wiki and nothing
+	// else" is expressed.
+	//
+	// A watched page's own host is reachable by the scheduled crawler whether
+	// or not it is listed here, because configuring a watch is already saying
+	// she may read it. That does NOT extend to on-demand reading: a watch is
+	// not an allowlist entry for pages he pastes.
 	AllowHosts []string `json:"allow_hosts,omitempty"`
 
 	// DenyHosts — never reachable, checked first. Private addresses do not need

internal/config/config_test.go

@@ -346,7 +346,8 @@ func TestUpdateBlockValidatedAtStartup(t *testing.T) {
 		"snapshot_dir": "/var/lib/maven/snapshots",
 		"binaries": ["mavend", "mavweb"],
 		"restart_cmd": ["docker", "compose", "up", "-d", "--build", "mavend"],
-		"health_socket": "/run/maven/mavend.sock"
+		"health_socket": "/run/maven/mavend.sock",
+		"source_rollback": "git"
 	}}`
 	c, err := Load(writeConfig(t, good))
 	if err != nil {