Make delivery and integration failures explicit

Persist reminder presentations and retry state, atomically complete collapsed deliveries, fall back across away reaches, and block permanent failures visibly (V-715, V-678). Fail closed when enabled integrations lack credentials and keep remote arms explicitly dark (V-691). Give mavweb one sanitized, request-correlated error contract (V-689). Owner explicitly requested direct commits to master.

docs/caveats/CLAUDE.md

@@ -22,27 +22,26 @@ caveat is the pointer between them plus the trigger.
 
 Every entry below came from the 2026-08-10 deep audit
 (`docs/evals/2026-08-10-repo-audit.md`), except the last, which came from wiring
-the gate the audit asked for. Nine of the twenty findings are fixed and have no
+the gate the audit asked for. Twelve of the twenty findings are fixed and have no
 entry. The unauthenticated mavgpud proxy was V-673. The 20 reachable advisories
 in the toolchain and `x/text` were V-682. The missing analyzers were V-694, and
 what they now report is the baseline entry under V-701. The invalid STT and
 weather responses were V-675/V-676, the stuck TCP close was V-679, and the
 unbounded PTT path was V-688. The two unguarded
 invariants were V-692 and V-693, and their guards are described in
-`docs/routing.md`.
+`docs/routing.md`. The complete secret inventory and fail-closed integration
+validation were V-691. The atomic reminder transition was V-678. The traceable,
+sanitized mavweb problem contract was V-689.
 
 | limit | severity |
 | --- | --- |
 | [Anyone past the proxy can enroll a passkey](security.md#enrollment) | high |
 | [Passkey credentials are rewritten in place](security.md#credentials) | medium |
 | [Dialogue persistence errors are swallowed](storage.md#dialogue) | medium |
-| [The reminder transition is a lost update](storage.md#reminders) | medium |
 | [A recall miss scans two whole tables](storage.md#recall) | medium |
-| [mavweb errors cannot be traced](transport.md#errors) | medium |
 | [Fact enrichment is a 20-call serial waterfall](workers.md#enrichment) | medium |
 | [A suppressed nudge is phrased anyway](workers.md#nudges) | medium |
 | [Committed absolute paths pin the build to this box](config.md#paths) | medium |
-| [The env example omits deployed variables](config.md#secrets) | medium |
 | [The analyzers pass against a baseline, not zero](dependencies.md#baseline) | medium |
 | [Domain packages depend on store and IPC types](layering.md#dtos) | low |
 | [Eleven symbols are unreachable](layering.md#deadcode) | low |

docs/caveats/config.md

@@ -8,14 +8,3 @@ workstation model and Python paths. Vendoring hides the `go.mod` problem for an
 ordinary build. `-mod=mod`, `go mod tidy` and a fresh checkout all fail.
 Revisit when: anyone clones this repo elsewhere, or a `tidy` is needed.
 Workaround: build only from this checkout, with the vendor directory.
-
-## The env example omits deployed variables [#691] {#secrets}
-
-Costs: a fresh deploy can lose remote speech-to-text or ambient authentication
-and run on fallback behaviour with an apparently valid config. Three variables
-are referenced and undocumented: `MAVEN_STT_TOKEN`, `MAVEN_AMBIENT_TOKEN` and
-`CW2_TOKEN`. V-673 added `MAVEN_GPU_TOKEN` to the example.
-It is not silent. The loader logs which variables were unset and says whatever
-they configure is off. What is missing is a startup failure.
-Revisit when: the box is redeployed from scratch, or a new secret is added.
-Workaround: read that log line at startup.

docs/caveats/storage.md

@@ -11,14 +11,6 @@ Revisit when: a restart is reported as losing context. Sooner if a turn starts
 reading dialogue rows back to him.
 Workaround: none. The failure is invisible from outside.
 
-## The reminder transition is a lost update [#678] {#reminders}
-
-Costs: a concurrent fire and cancel both succeed and the last writer wins.
-Medium today because cancellation has no surface. High the moment V-622 adds
-one, and V-622 does not describe this invariant.
-Revisit when: V-622 starts, whichever comes first.
-Workaround: none, but the window is small while nothing can cancel.
-
 ## A recall miss scans two whole tables [#681] {#recall}
 
 Costs: every missed recall reads all of `memory_vectors` and then decodes and

docs/caveats/transport.md

@@ -1,12 +0,0 @@
-# Transport
-
-The HTTP and socket seams. What a client can do to them, and what a shutdown
-can do to us.
-
-## mavweb errors cannot be traced [#689] {#errors}
-
-Costs: some handlers return the raw internal error, which discloses internals.
-Others return a generic one with no identifier, which cannot be joined to its
-log line. There is no request-id middleware to join them.
-Revisit when: a reported UI failure cannot be found in the log.
-Workaround: read the log by timestamp.