Make delivery and integration failures explicit

Persist reminder presentations and retry state, atomically complete collapsed deliveries, fall back across away reaches, and block permanent failures visibly (V-715, V-678). Fail closed when enabled integrations lack credentials and keep remote arms explicitly dark (V-691). Give mavweb one sanitized, request-correlated error contract (V-689). Owner explicitly requested direct commits to master.

internal/loop/gather.go

@@ -12,6 +12,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"sort"
 	"time"
 
 	"github.com/kami/maven/internal/calendar"
@@ -258,16 +259,62 @@ func readFact(ctx context.Context, s *store.Store, key string) (store.Fact, bool
 }
 
 // collapseReminders — when multiple reminders are due at once (e.g. after
-// the daemon was offline), collapse them into a single digest reminder to
-// avoid a burst of individual notifications. The synthetic digest (ID=0)
-// carries the originals in Collapsed; the dispatcher completes them (mark
-// fired / reschedule) only after the digest actually delivers, preserving
-// the "failed send leaves the reminder pending" invariant.
-// When 0 or 1 reminders are due, returns them unchanged.
+// the daemon was offline), collapse them into digest reminders to avoid a
+// burst of individual notifications. A previously phrased delivery group is
+// kept intact and separate from newly-due reminders: otherwise one new row
+// joining a failed bundle would force the old bundle through the model again.
+// The synthetic digest (ID=0) carries the originals in Collapsed; the
+// dispatcher completes them only after the digest actually delivers.
 func collapseReminders(due []store.Reminder) []store.Reminder {
 	if len(due) <= 1 {
 		return due
 	}
+
+	// Every reminder without a delivery group is part of the new bundle for
+	// this tick. Persisted groups each retain their own bundle identity.
+	const ungrouped = "\x00"
+	type reminderGroup struct {
+		key       string
+		reminders []store.Reminder
+	}
+	var groups []reminderGroup
+	byKey := make(map[string]int)
+	for _, r := range due {
+		key := r.DeliveryGroup
+		if key == "" {
+			key = ungrouped
+		}
+		i, ok := byKey[key]
+		if !ok {
+			i = len(groups)
+			byKey[key] = i
+			groups = append(groups, reminderGroup{key: key})
+		}
+		groups[i].reminders = append(groups[i].reminders, r)
+	}
+	// DueReminders was ordered globally. Grouping can move rows together, so
+	// restore earliest-first ordering between the resulting deliveries.
+	sort.SliceStable(groups, func(i, j int) bool {
+		a := groups[i].reminders[0]
+		b := groups[j].reminders[0]
+		if a.NextFireTs.Equal(b.NextFireTs) {
+			return a.ID < b.ID
+		}
+		return a.NextFireTs.Before(b.NextFireTs)
+	})
+
+	out := make([]store.Reminder, 0, len(groups))
+	for _, group := range groups {
+		if len(group.reminders) == 1 {
+			out = append(out, group.reminders[0])
+			continue
+		}
+		out = append(out, collapseReminderGroup(group.reminders))
+	}
+	return out
+}
+
+func collapseReminderGroup(due []store.Reminder) store.Reminder {
 	// Build a summary payload.
 	var items []string
 	earliest := due[0].FireTs
@@ -294,11 +341,11 @@ func collapseReminders(due []store.Reminder) []store.Reminder {
 
 	// Return a single synthetic digest reminder. ID=0 signals "digest" to
 	// the dispatcher, which completes the Collapsed originals on success.
-	return []store.Reminder{{
+	return store.Reminder{
 		ID:        0,
 		FireTs:    earliest,
 		Payload:   string(digestPayload),
-		Status:    "pending",
+		Status:    store.ReminderPending,
 		Collapsed: due,
-	}}
+	}
 }

internal/loop/gather_test.go

@@ -47,3 +47,36 @@ func TestGatherStateLoadsPrefixFamilies(t *testing.T) {
 		t.Fatal("the rule must fire on a gathered per-monitor fact")
 	}
 }
+
+func TestCollapseRemindersKeepsPersistedBundleSeparateFromNewDueRows(t *testing.T) {
+	now := time.Date(2026, 8, 13, 8, 0, 0, 0, time.UTC)
+	due := []store.Reminder{
+		{ID: 1, FireTs: now, NextFireTs: now, Payload: "one", DeliveryGroup: "reminder:old", PhraseBody: "old bundle"},
+		{ID: 2, FireTs: now.Add(time.Second), NextFireTs: now.Add(time.Second), Payload: "two", DeliveryGroup: "reminder:old", PhraseBody: "old bundle"},
+		{ID: 3, FireTs: now.Add(2 * time.Second), NextFireTs: now.Add(2 * time.Second), Payload: "three"},
+	}
+
+	got := collapseReminders(due)
+	if len(got) != 2 {
+		t.Fatalf("deliveries = %d, want old bundle plus new reminder: %+v", len(got), got)
+	}
+	if got[0].ID != 0 || len(got[0].Collapsed) != 2 || got[0].Collapsed[0].ID != 1 || got[0].Collapsed[1].ID != 2 {
+		t.Fatalf("old persisted bundle was changed: %+v", got[0])
+	}
+	if got[1].ID != 3 || len(got[1].Collapsed) != 0 {
+		t.Fatalf("new reminder joined the old phrase: %+v", got[1])
+	}
+}
+
+func TestCollapseRemindersMakesOneBundleForNewDueRows(t *testing.T) {
+	now := time.Date(2026, 8, 13, 8, 0, 0, 0, time.UTC)
+	due := []store.Reminder{
+		{ID: 1, FireTs: now, NextFireTs: now, Payload: "one"},
+		{ID: 2, FireTs: now, NextFireTs: now, Payload: "two"},
+		{ID: 3, FireTs: now, NextFireTs: now, Payload: "three"},
+	}
+	got := collapseReminders(due)
+	if len(got) != 1 || got[0].ID != 0 || len(got[0].Collapsed) != 3 {
+		t.Fatalf("new reminders did not collapse together: %+v", got)
+	}
+}