Cancel a reminder by voice, and honour a refusal (V-719)

reminder_cancel.go is a stateful pre-route resolver ahead of a parked
clarification and the statistical cascade. It accepts only an addressed
command-position imperative plus the reminder or alarm noun, so questions,
reported speech, past-tense reports and prohibitions establish no mutation
authority. Subject terms keep negation and quantity, and a parsed time
passes the same resolved-hour gate as capture.

One match cancels through the typed IPC method. Several are stored as
session candidates in the spoken order, capped at five, and only a whole
affirmative ordinal consumes that list: re-querying on the follow-up would
let a state change move the ordinal underneath him. No match, an unread
time, a spent ordinal and an ambiguous delivery result are all explicit
no-ops.

command_prohibition.go is the first mutation boundary in a turn. A direct
prohibition clears the three confirmation slots under their shared mutex,
so a later bare "да" cannot revive authority he has just revoked. A parked
clarify question is not authority and survives, suspended and repeated.
refusesCommand is the same belt at the executor entry points, checked
against the original utterance so a model rewriting Slots.Text cannot get
around it.

The rung is named in preRouteLadder, so /trace records whether it won or
declined on every surface.

--no-verify: master is the working branch this session by the owner's call.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

cmd/mavend/entityname_test.go

@@ -147,6 +147,48 @@ func TestClarifyStillAsksWithoutHexis(t *testing.T) {
 	}
 }
 
+// A verb is not an entity. Before the reach gate, an exact local matcher hit
+// with no arguments still sent the raw verb to Nexus and could discover a
+// similarly named entity through Hexis. The local tool lane may handle or
+// reject it, but the ecosystem must not be consulted without a target.
+func TestBareMatchedActNeverReachesNexus(t *testing.T) {
+	nexus := newFakeNexus(t, fixtureNexusResolved("ent_power", "Power", "service"))
+	hexis := newFakeHexis(t, restartCaps(), fixtureHexisExecuted("exec_1", "succeeded"))
+	h, _, _ := newClarifyHandler(t)
+	h.ecosystem = ecoHandler(t, nexus, nil, hexis).ecosystem
+
+	reply := h.actionAct(context.Background(), router.Decision{
+		Utterance: "выключи",
+		Intent:    router.IntentAct,
+		Slots:     router.Slots{Fn: "выключи", HasFn: true, Text: "выключи"},
+	})
+	if len(nexus.Requests()) != 0 {
+		t.Fatalf("bare verb reached Nexus: %+v", nexus.Requests())
+	}
+	if reply == "" {
+		t.Fatal("bare act disappeared instead of staying in Maven's local lane")
+	}
+}
+
+func TestUnresolvedActNeverReachesNexusBeforeClarify(t *testing.T) {
+	nexus := newFakeNexus(t, fixtureNexusResolved("ent_it", "It", "service"))
+	hexis := newFakeHexis(t, restartCaps(), fixtureHexisExecuted("exec_1", "succeeded"))
+	h := ecoHandler(t, nexus, nil, hexis)
+	dec := router.Decision{
+		Utterance: "сделай это",
+		Intent:    router.IntentAct,
+		Stage:     3,
+		Clarify:   true,
+		Slots:     router.Slots{Text: "сделай это"},
+	}
+	if reply := h.hexisBeforeClarify(context.Background(), dec); reply != "" {
+		t.Fatalf("unresolved act was answered by Hexis: %q", reply)
+	}
+	if len(nexus.Requests()) != 0 {
+		t.Fatalf("unresolved act reached Nexus: %+v", nexus.Requests())
+	}
+}
+
 // nexusInOrder serves one resolve answer per call, in order, so a test can say
 // what Nexus knows about the first name and what it knows about the second. The
 // last body repeats once the list runs out.