docs: the operations sitting and the degraded-mode suite both ran (V-459)

docs/qa.md

@@ -1,6 +1,6 @@
 # QA plan: checking Maven properly
 
-*Last verified: 2026-08-02 @ af9d213. Living doc: correct it in place, do not append.*
+*Last verified: 2026-08-02 @ 20aa2d5. Living doc: correct it in place, do not append.*
 
 Written 2026-08-01, after the 35-PR stack landed and the box came back up.
 Refreshed 2026-08-02 against the live list, after PRs #85-#90.
@@ -21,8 +21,7 @@ the redeploy.
 
 ## What the 02-08-2026 run found
 
-Sessions 1 and 2 ran, and so did most of session 3. Read these four before
+Sessions 1, 2 and 3 all ran. Read these five before picking anything up.
-picking anything up.
 
 - **470: a question writes invented knowledge into memory.** Recall then serves
   it back. `что дальше?` lands on `IntentFact` and stores the model's answer as a
@@ -37,8 +36,12 @@ picking anything up.
   `act`, and capture is reachable only from the `note` intent.
 - **The classifier baseline in this repo was wrong**, and it flattered the
   router. See session 2 and **464**.
+- **477: the model swap and the self-update cannot be triggered on this box.**
+  Both are built and both are correct in test. The swap needs a passkey and
+  WebAuthn is unconfigured. `mavupdate` needs to reach a socket that only an
+  in-container uid can open.
 
-Thirteen defects were filed on 02-08-2026: 462 through 474. Six tasks this plan
+Sixteen defects were filed on 02-08-2026: 462 through 477. Six tasks this plan
 had written off as blocked turned out to be ready to check. Two of the six passed
 the moment they were run.
 
@@ -312,8 +315,7 @@ minimum-interval floor, so seeding by hand mints a permanent false routine
 (**468**). Do not try to seed a pattern with four fast chat turns.
 
 **Ecosystem** (**272**, **273**, **276**): nexus, hexis and praxis are wired and
-logged clean at boot. **276** is the degraded-mode suite, which means taking
+logged clean at boot.
-siblings down on purpose. Worth doing while you are already in there.
 
 Run 02-08-2026, read-only half. All three answer `/health` 200 and `/ecosystem`
 lists 18 Hexis capabilities with correct read-only and mutating badges. **272 and
@@ -323,10 +325,41 @@ holds no attention items, and the Calls panel has never recorded a call. See
 here. An empty Calls panel is exactly what the old bug looked like. The page is
 `/ecosystem`, not `/siblings`.
 
-**Operations** (**249**, **250**): these bite hardest if they are broken, and
+**276 ran 02-08-2026 and the suite is sound.** 17 `TestEcosystem_` cases pass
-nobody has pulled either lever on this box. Roll **249** forward and back once,
+under `-race`, not the 10 the task describes. The mutation check bites: patching
-then swap `phraser.model_path` and confirm **250** reloads without a restart. Do
+the Nexus-error branch of `handleHexisAct` to `return ""` fails
-this sitting last, because both checks can take the box down.
+`TestEcosystem_MalformedNexusResponseFailsClosed` on the expected line.
+
+Steps 4 and 6 could not be checked through chat, because no utterance reaches
+Praxis (**475**). «что требует внимания» routes to `intent=query` and is answered
+by the search leg, identically whether `ecosystem-praxis-1` is up or stopped. The
+degraded string never appears because its branch is never entered. Step 5 is
+blocked the same way: `перезапусти muzick indexer` clarifies on
+`HasFn:false`, and the router had already rewritten the entity name to
+`музик индексер` (**476**).
+
+Both steps were checked on `/ecosystem` instead, which reads Praxis directly.
+With Praxis stopped the card reads `praxis — unreachable` while Nexus and Hexis
+keep rendering. On `docker start` the card returns to `nothing needs attention.`
+with no mavend restart. Independent degradation and recovery both hold.
+
+**Operations** (**249**, **250**): both ran 02-08-2026. The code is correct and
+neither lever can be pulled on this box. See **477**.
+
+**250** passes steps 1, 2, 3, 9 and 10 on the deploy. The capability announces
+itself. `/models` names the model llama-server reports, not the config filename.
+Asking her to switch models does nothing. Removing `swap_models` renders `swap
+not configured`. Step 4's refusal half passes at HTTP 403, and the 403 comes from
+mavend rather than mavweb. WebAuthn is unconfigured, so the web gate fails open
+and the wire gate fails closed. Steps 5 to 8 need a passkey assertion nothing on
+this box can produce. They pass in test: 13 swap cases and 7 page cases covering
+drain, mid-swap refusal, rollback, failed rollback and the not-owned refusal.
+
+**249** passes steps 1 and 2. Step 3 stops it. `mavupdate` health-checks over
+`/run/maven/mavend.sock`, which is `srw------- 1 10001 999` inside a docker
+volume. The host owner cannot traverse `/var/lib/docker/volumes` and cannot
+connect to a socket owned by an in-container uid. `mavupdate` assumes a
+host-installed daemon and the deploy is containers. Do not sudo around this.
 
 ---
 
@@ -434,4 +467,10 @@ where they land, so the board stops reading as 50 things Maven owes.
    31ms. The router buys about 4 points of accuracy for four orders of magnitude
    of latency. Whether that still earns its place is now an open question.
 4. Housekeeping. Cheap, and it makes the remaining backlog honest.
-5. Session 3, split whichever way suits you.
+5. Session 3, split whichever way suits you. All five sittings ran on
+   02-08-2026. Read the per-sitting notes before repeating any of them.
+
+The next thing to fix is not in this plan. Four defects say the same sentence:
+a capability is built and no utterance reaches it. **466** (a clarify is global),
+**467** (capture is act-routed), **475** (attention is act-routed), **476** (the
+router rewrites entity names). Routing is where the work is.