Split honesty into three milestones, defer five capabilities (V-719)

Owner's call. M1 is the turn path, M2 is memory he cannot correct, M3 is
step-up. They were one milestone and are three jobs: M1 and M2 touch
different code and owe different docs, and step-up is configuration, not
honesty. Nine milestones now.

Speaker recognition, smart home, bluetooth, model swap and self-update
move past v1. Bluetooth was on the v1 list and comes off it: no bluez on
the box. Their spec entries keep their DoD.

--no-verify: committing on master by the owner's call this session.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/roadmap.md

@@ -29,36 +29,75 @@ at exists.
 spec entries name one to write. The scenarios a milestone's DoD items cite are
 part of that milestone.
 
-## M1: Honesty in the turn
+## Honesty, in three milestones
 
 She currently claims things that are not true. That is worse than a gap, because
 a gap is visible and a false claim is not. Nothing else is worth building on top
 of a turn that lies.
 
-V-683 rides alongside this milestone as one bounded configuration-and-code job.
+That is one theme and three separate jobs. M1 is the turn path. M2 is the memory
-It is not honesty and it is not a milestone of its own. Every step-up gate is
+he cannot correct. M3 is a configuration job that is not honesty at all. They are
-fail-open today, including `POST /api/chat`, which reaches the act path. Anyone
+split because each is one session, and because M1 and M2 touch different code
-past the proxy can enroll a passkey.
+with different docs owed.
 
-Lands: Route an utterance. Speak as herself. Facts. Notes. Answer from the world.
+None of the three touches voice. A dishonest turn spoken aloud is still
-Passkey and step-up.
+dishonest.
+
+## M1: The turn does not lie
+
+Every item is on the path from utterance to reply, and each is a false statement
+rather than a missing one.
+
+Lands: Route an utterance. Speak as herself. Answer from the world.
 
 Gate:
 
 - A question about what Maven remembers routes to query. Both audit probes pass.
 - No masculine self-reference reaches the wire, checked on the outbound path and
   not only in the eval.
-- No confirmation claims a write that did not happen.
+- A world answer that would invent content is refused instead of phrased. The
+  audit's "почему небо голубое?" answer is the failing case.
+
+Docs this milestone owes: none new. `docs/routing.md`, `docs/language.md` and
+`docs/world.md` all exist and are corrected in place.
+
+## M2: Memory he can correct
+
+The store is the other place she claims something untrue, and the only place he
+cannot fix it himself. It is separate from M1 because it is store and surface
+work, and because it owes the largest doc in the spec.
+
+Lands: Facts. Notes.
+
+Gate:
+
+- No confirmation claims a write that did not happen. The audit's "я записала
+  информацию о тебе" wrote nothing.
 - A note can be deleted by voice and from the web UI (V-494).
-- A world answer that would invent content is refused instead of phrased.
+- A question is not stored as a statement.
-- WebAuthn is configured and no step-up gate is fail-open (V-683).
+- A superseding fact retires the old value and both are readable.
 
-Docs this milestone owes: the memory doc covering facts, notes and the supersede
+Docs this milestone owes: the memory doc covering facts, notes, the supersede
-rule. It is the largest gap in the spec.
+rule and the digestion worker's consolidation pass. It is the largest gap in the
+spec, and it is why this is its own milestone.
 
-Not here: anything about voice. A dishonest turn spoken aloud is still dishonest.
+## M3: Step-up is not fail-open
 
-## M2: The four broken, none of them code
+One bounded configuration-and-code job. It is not honesty and it does not belong
+inside M1. It is the audit's only high-severity item and it gates the act path,
+so it lands before anything reaches Hexis.
+
+Lands: Passkey and step-up.
+
+Gate:
+
+- WebAuthn is configured and no step-up gate is fail-open, including
+  `POST /api/chat` (V-683).
+- Enrollment requires an existing credential once the first one exists. Anyone
+  past the proxy can enroll today.
+- Step-up is per-request, not process-global.
+
+## M4: The four broken, none of them code
 
 Cheap, and it unblocks two later milestones. Nexus with entities is what makes
 the act path real. Weather is the capability he asked about first on the audit
@@ -78,7 +117,7 @@ Gate:
 
 Not here: smart home and bluetooth. Both are blocked on the host, not on Nexus.
 
-## M3: Voice is the spine
+## M5: Voice is the spine
 
 v1 is a voice assistant. Until a proactive message can reach him by speech, she
 is a web app he can talk at. He reaches her by speaking, which is a pull. She has
@@ -102,7 +141,7 @@ milestone does not LAN-bind it.
 Docs this milestone owes: what holds a live voice session open. `docs/protocol.md`
 documents the wire and nothing documents the listener.
 
-## M4: Proactive that arrives
+## M6: Proactive that arrives
 
 Everything in this milestone exists and fails at the last step. The morning
 routine builds a plan and drops it. Reminders fire and one reach failure loops.
@@ -126,7 +165,7 @@ Gate:
 Docs this milestone owes: the reminder lifecycle. Parking, firing, delivery,
 retry and cancellation span three packages with no written contract.
 
-## M5: Breadth she can already almost do
+## M7: Breadth she can already almost do
 
 These have code and no path from an utterance. Each is one wiring job, not a
 design job. They come after the spine because none of them changes whether she is
@@ -148,12 +187,12 @@ Gate:
   `internal/lexicon` or the embedder (V-606).
 - One memory evaluation run is observed and its notes read back (V-248).
 
-## M6: The product decision, then the deploy
+## M8: The product decision, then the deploy
 
 Email and calendar are built and neither is in `docker-compose.yml`.
 `internal/email` with `mavmaild`, `internal/calendar` with `mavcaldav`. Deploying
 either before deciding what she does with his mail writes the decision by
-accident. That is why they sit behind a milestone boundary rather than inside M5.
+accident. That is why they sit behind a milestone boundary rather than inside M7.
 
 Lands: Email triage. Calendar management.
 
@@ -166,12 +205,12 @@ Gate:
   in `Europe/Samara`.
 - Both daemons are in compose, or their absence is deliberate and recorded.
 
-## M7: Design pass, then the undesigned seven
+## M9: Design pass, then the undesigned seven
 
 Seven v1 capabilities have no design. They keep a DoD in the spec so the gap
 stays visible, and each needs a design pass before any code. Every one of them
 assumes a turn that is honest, reachable and proactive. Each gets cheaper once M1
-through M4 have landed, which is why they come last.
+through M6 have landed, which is why they come last.
 
 Lands: Web crawling. Summaries. Webhooks. Cron jobs. Desk notifications, outbound
 half. Learning the style. Learning from mistakes. Command chaining.
@@ -179,7 +218,7 @@ half. Learning the style. Learning from mistakes. Command chaining.
 Two decisions this milestone opens with:
 
 - **Cron jobs against routines against recurring reminders.** Three schedulers
-  must not exist. `internal/routine` already carries a `Cron`, and M4 gives
+  must not exist. `internal/routine` already carries a `Cron`, and M6 gives
   reminders one. What "cron jobs" adds beyond those two is undecided.
 - **Which direction webhooks means.** The only webhook in the tree is Telegram's
   own inbound intake. Inbound as an event source and outbound as a fourth reach
@@ -189,10 +228,12 @@ Learning means behavioral, not weights. Stored outcomes: dismissed nudges,
 corrected phrasings, repaired routes. No adapter, no training set. Everything
 learned is readable on a page and deletable.
 
-## Proposed for after v1
+## Deferred past v1
 
-These are audit rows the owner's v1 list did not name. The list below is a
+Owner's call, 2026-08-15. Four are audit rows the v1 list did not name.
-proposal, not a decision.
+Bluetooth control was on that list and comes off it. No bluez exists on the box
+and the radio has no owner. Their spec entries stay, so the DoD is already
+written when one comes back.
 
 | capability | why deferred |
 | --- | --- |

docs/spec.md

@@ -9,6 +9,8 @@ carries the order. This file carries the target.
 The capability list is the union of two sources. The 39 rows measured in
 `docs/evals/2026-08-13-capability-audit.md`, and the 18 items the owner named as
 v1 scope. Twelve of the owner's items had no audit row, so this file has 51.
+Five entries are marked deferred past v1. They keep their DoD, so it is written
+when one comes back.
 
 ## How to read an entry
 
@@ -353,6 +355,8 @@ consolidation pass. This is the largest documentation gap in the list.
 
 ### Speaker recognition
 
+**Deferred past v1**, owner's call 2026-08-15. See `docs/roadmap.md`.
+
 - **State**: `internal/speaker`. No living doc (V-255).
 - **DoD**
   - The owner's voice is distinguished from another voice.
@@ -394,6 +398,8 @@ consolidation pass. This is the largest documentation gap in the list.
 
 ### Smart home
 
+**Deferred past v1**, owner's call 2026-08-15. See `docs/roadmap.md`.
+
 - **State**: `internal/smarthome`, disabled in config (V-256).
 - **DoD**
   - A device is controlled through Hexis, resolved through Nexus, never by free text.
@@ -411,6 +417,8 @@ consolidation pass. This is the largest documentation gap in the list.
 
 ### Bluetooth control
 
+**Deferred past v1**, owner's call 2026-08-15. See `docs/roadmap.md`.
+
 - **State**: no package. **Finding**: nothing exists, and the box has no bluez
   (V-257). This is the only v1 item blocked on the host rather than on code.
 - **DoD**
@@ -462,6 +470,8 @@ consolidation pass. This is the largest documentation gap in the list.
 
 ### Model swap
 
+**Deferred past v1**, owner's call 2026-08-15. See `docs/roadmap.md`.
+
 - **State**: `docs/deployment.md` (V-250).
 - **DoD**
   - `phraser.swap_models` lists the allowed gguf paths, or the page is removed.
@@ -470,6 +480,8 @@ consolidation pass. This is the largest documentation gap in the list.
 
 ### Self-update
 
+**Deferred past v1**, owner's call 2026-08-15. See `docs/roadmap.md`.
+
 - **State**: `cmd/mavupdate`, `internal/update`. Blocked at step 3: it cannot
   reach the containerized socket (V-477).
 - **DoD**