config: clear three of 472's five QA blockers (V-459)

morning_routines, feeds, crawl.on_demand and netscan.enabled in
deploy/mavend.json; -ambient-token on mavweb, interpolated from a gitignored
/.env. All verified on the box: the dispatcher builds the morning plan,
/api/ambient answers 401/201, the crawler reads a named page, netscan finds 3
devices, and /events fills with scan:lan and ambient:notif.

Filed 482 (ambient reads a notification's wall clock as UTC). Corrected 479:
both capabilities work once configured, so it is not a routing defect.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NJYcaBiuny9UGSpFweQVQ1

docs/qa.md

@@ -46,10 +46,15 @@ Sessions 1, 2 and 3 all ran. Read these five before picking anything up.
   with a general article about network hardware. A question about his LAN went to
   an upstream engine. The crawler fails the same way.
 
-Twenty defects were filed on 02-08-2026: 462 through 481. Six tasks this plan
+Twenty-one defects were filed on 02-08-2026: 462 through 482. Six tasks this plan
 had written off as blocked turned out to be ready to check. All six ran. Every
 one of them is code-correct and stops at the deploy.
 
+Three of the five config blockers in **472** were then cleared. The morning
+routine, ambient ingest, feeds, the crawler and netscan are all live. Two remain,
+and both are the owner's call: a token for each ecosystem sibling, and seed data
+in Nexus and Praxis.
+
 ---
 
 ## Before you start
@@ -256,6 +261,27 @@ its presence rule passes on inspection. Three of its five items need traffic the
 box has not had. **283 is blocked**: nothing feeds the intake journal. **128
 found the worst defect of the whole session, see below.**
 
+Three of 472's five blockers were cleared the same day, in `deploy/mavend.json`
+and `docker-compose.yml`.
+
+- A `morning_routines` block, one routine `утро` 08:00-11:00 with medicine,
+  water and pets. It is live: the dispatcher logged `dropped morning:утро (sev1,
+  presence=away)`, so the plan builds and the nudge is proposed. 280's
+  behaviours and 128 step 11 are checkable now. 473 still stands.
+- `-ambient-token` on mavweb, value in a gitignored `/.env` that docker compose
+  reads for interpolation. `/api/ambient` answers 401 without the token and 201
+  with it, storing `calendar_event_20260802_Standup`. 283 step 5 and 128 step 8
+  are unblocked. The token is a flag, so it shows in `ps` inside that container.
+  The zenmoney and IMAP secrets are read from files instead. Ingest also
+  reads the notification's wall clock as UTC and stores a 14:30 meeting at 18:30
+  (**482**).
+- `feeds` (two sources), `crawl.on_demand` and `netscan.enabled`. The intake
+  journal now fills: `/events` holds `scan:lan` and `ambient:notif` rows.
+
+Two are not mine to clear. No sibling has a `token` in `deploy/mavend.json`, so
+273 steps 6 and 8 need a credential decision. Nexus has no entities and Praxis no
+attention items, so 272 step 3 needs seed data whose content is the owner's call.
+
 For **285**, two facts bear on the choice. Synapse is already running on this box
 and healthy, so a Matrix reach has a live target and needs no new service. And
 mavweb is already a PWA with a service worker, which 285 itself calls the highest
@@ -451,6 +477,14 @@ need the block enabled. Step 10 is Bluetooth and stays skipped.
 **259, crawler.** Steps 1 and 15 pass. Step 2 fails. Steps 3 to 14 need a `crawl`
 block that nobody has written.
 
+Both were configured later the same day, and both work. `netscan.enabled: true`
+answers `какие устройства в сети?` with `нашла 3 устройства, из них 2 с вебом, 2 с
+ssh. список записала.` and the scan lands in the intake journal as `scan:lan`.
+`crawl.on_demand: true` answers `посмотри https://lwn.net — что там пишут?` from
+the real page. So **479** is one defect, not the routing defect it was filed as.
+An unconfigured capability declines its own turn instead of naming the gap.
+Nothing is wrong with the routing.
+
 257 step 1 and 259 step 2 fail the same way and share a task (**479**). An
 unconfigured capability does not name the gap, so the question escapes to web
 search. `какие устройства в сети?` was answered with a general article about