Drop "never phones home" as a hard rule

The owner's call, 2026-07-31: a 0.8B model does not know enough about the
world to be useful without reading something. So she may now read external
sources to answer world questions.

What replaces the old rule, in all three docs:

- No telemetry, no cloud model, no third-party account. Unchanged.
- Local first: the Kiwix ZIMs on the box before anything on the network.
- External search is allowed but off unless configured, same as weather
  and telegram.
- His notes and facts are never search input. Only the utterance goes out
  — never the persona block, the history, or matched notes.

Docs only, no code.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CGeSZxh1DCtRxmFVSYVGvJ

DESIGN.md

@@ -15,7 +15,8 @@
 
 **Maven** — self-hosted personal assistant. Manages your day, acts on your
 homelab. One daemon on homesrv (always-on, not the workstation), multiple
-client surfaces. All local, never phones home.
+client surfaces. Inference and data stay on the box; she may READ external
+sources (see Non-goals — "never phones home" is deprecated).
 
 Primary name is "Maven", with feminine-gendered Russian self-reference
 ("она", "меня", "помогла"). Clients may choose their own UI label. Consistent
@@ -35,8 +36,13 @@ Inside boundary — the ones that actually constrain the build:
   she records. A confident wrong fact is worse than a known gap.
 - **Not a nag** — she'd rather miss a nudge than be mutable. Shuts up when
   uncertain. Load-bearing.
-- **Not a stranger** — runs on your stuff, your model, your data. Never
-  phones home.
+- **Not a stranger** — runs on your stuff, your model, your data. No
+  telemetry, no cloud model, no third-party account. She may READ external
+  sources to answer world questions (Kiwix first, then optional search); she
+  never reports anything about you to anyone, and your notes and facts are
+  never used as search input. **"Never phones home" as an absolute is
+  deprecated** — owner's call, 2026-07-31: a small model does not know enough
+  to be useful without reading.
 - **Not a relationship** — mom-tone is a function that makes nudges land, not
   emotional company. Names the drift a warm small model falls into.
 
@@ -458,7 +464,7 @@ decides *insistence*. Both are needed.
 
 sev ≤ 2 drops on away, sev ≥ 3 holds: a missed water nudge is noise, a missed
 backup failure isn't. Away-channels (ntfy/telegram) leave the box — the one
-path that crosses "never phones home," through your own relay. **Minimal
+path that leaves the box for a person to see, through your own relay. **Minimal
 body** — "disk low on homesrv," not detail; don't make notifications a
 shoulder-surf exfil surface.