Cancel a reminder by voice, and honour a refusal (V-719)

reminder_cancel.go is a stateful pre-route resolver ahead of a parked
clarification and the statistical cascade. It accepts only an addressed
command-position imperative plus the reminder or alarm noun, so questions,
reported speech, past-tense reports and prohibitions establish no mutation
authority. Subject terms keep negation and quantity, and a parsed time
passes the same resolved-hour gate as capture.

One match cancels through the typed IPC method. Several are stored as
session candidates in the spoken order, capped at five, and only a whole
affirmative ordinal consumes that list: re-querying on the follow-up would
let a state change move the ordinal underneath him. No match, an unread
time, a spent ordinal and an ambiguous delivery result are all explicit
no-ops.

command_prohibition.go is the first mutation boundary in a turn. A direct
prohibition clears the three confirmation slots under their shared mutex,
so a later bare "да" cannot revive authority he has just revoked. A parked
clarify question is not authority and survives, suspended and repeated.
refusesCommand is the same belt at the executor entry points, checked
against the original utterance so a model rewriting Slots.Text cannot get
around it.

The rung is named in preRouteLadder, so /trace records whether it won or
declined on every surface.

--no-verify: master is the working branch this session by the owner's call.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

cmd/mavend/actions_reminder.go

@@ -14,6 +14,12 @@ import (
 // actionReminder handles router.IntentReminder: parse the time when stage-0
 // skipped the extractor, then create the reminder.
 func (h *reactiveHandler) actionReminder(ctx context.Context, dec router.Decision) string {
+	// The pre-route belt normally answers this before routing. Keep the write
+	// boundary guarded as well: a model calling the sentence a reminder does
+	// not turn "don't ..." into permission to create a row.
+	if refusesCommand(dec) {
+		return commandProhibitionReply
+	}
 	if !dec.Slots.HasTime {
 		// Stage-0 (reminder-wakeword grammar) skips the extractor, so the
 		// time wasn't parsed. Run the parser as a fallback.