docs: the six ready tasks all ran, and all six stop at the deploy (V-459)

docs/qa.md

@@ -41,9 +41,14 @@ Sessions 1, 2 and 3 all ran. Read these five before picking anything up.
   WebAuthn is unconfigured. `mavupdate` needs to reach a socket that only an
   in-container uid can open.
 
-Sixteen defects were filed on 02-08-2026: 462 through 477. Six tasks this plan
-had written off as blocked turned out to be ready to check. Two of the six passed
-the moment they were run.
+- **479: an unconfigured capability lets the question escape to web search.**
+  Netscan off, asked `какие устройства в сети?`. She answered from the live web
+  with a general article about network hardware. A question about his LAN went to
+  an upstream engine. The crawler fails the same way.
+
+Twenty defects were filed on 02-08-2026: 462 through 481. Six tasks this plan
+had written off as blocked turned out to be ready to check. All six ran. Every
+one of them is code-correct and stops at the deploy.
 
 ---
 
@@ -424,6 +429,48 @@ So the honest split is three blocked on a credential or hardware, two blocked on
 a download, and six ready to check. That is roughly a session of real QA this
 plan had written off as backlog.
 
+**All six ran on 02-08-2026.** Every one of them is code-correct and stops at the
+deploy. The pattern repeats often enough to be the headline: the packages pass,
+and the box cannot reach them.
+
+**251, MCP.** Steps 1, 2, 3, 4 and 13 pass. Package tests green under `-race`.
+Off-by-default is clean, and the SSRF refusal is exact: without `allow_private`
+the log reads `refusing to connect to a private address: 127.0.0.1` and `/tools`
+shows the server down with zero proposals. Steps 5 to 12 are blocked. `ss -lntp`
+shows the Vikunja MCP server on `127.0.0.1:9100` only, so no container reaches it
+at any address (**478**). `allow_private` does work, measured both ways.
+
+**253, hearing.** Steps 1, 2 and 17 pass. `internal/capture` covers 90.3%. Steps
+7 to 16 are blocked on something nobody can work around: no shipped client calls
+`CaptureStart`. There is no `cmd/mavheard`, no mavweb route, and `mavenclient`
+never calls it (**480**). Two of its QA steps are also stale.
+
+**257, netscan.** Steps 2, 3 and 9 pass at unit level. Step 1 fails. Steps 4 to 8
+need the block enabled. Step 10 is Bluetooth and stays skipped.
+
+**259, crawler.** Steps 1 and 15 pass. Step 2 fails. Steps 3 to 14 need a `crawl`
+block that nobody has written.
+
+257 step 1 and 259 step 2 fail the same way and share a task (**479**). An
+unconfigured capability does not name the gap, so the question escapes to web
+search. `какие устройства в сети?` was answered with a general article about
+network hardware. That is his LAN going to an upstream engine.
+
+**252 vision and 255 speaker.** Both confirmed blocked. The disk claim was
+re-verified rather than taken on trust: 16 text-only ggufs under `/mnt/hdd1`, no
+mmproj and no speaker embedding model. Everything not needing the model passes,
+including the two refusals that matter. `TestNewLocalRefusesNonPrivateEndpoints`
+rejects `https://api.openai.com`, and forget really deletes
+(`internal/store/memory.go:145` is a real `DELETE`, not a tombstone). Vision is
+19/19, speaker 22/22, media 16/16.
+
+**470 got worse.** Both poisoned facts show `voided` on `/history`, and the
+defect survives. Re-measured at 15:42, after four restarts: `почему небо синее?`
+still answers `какая последняя версия языка Go?` with no `search:` line. What
+comes back is the question he typed, not the value the fact held. So the poison
+is a vector in the memory index, and `revert` does not remove it. There is
+currently no documented way to repair a poisoned box.
+
 ---
 
 ## Needs you specifically